ML20151H606
| ML20151H606 | |
| Person / Time | |
|---|---|
| Site: | La Crosse File:Dairyland Power Cooperative icon.png |
| Issue date: | 04/30/1983 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| References | |
| TASK-***, TASK-RR NUREG-0827, NUREG-0827-DRFT, NUREG-827, NUREG-827-DRFT, NUDOCS 8305040682 | |
| Download: ML20151H606 (494) | |
Text
{{#Wiki_filter:--- - - - - - - - - NUREG-0827 l Integrated Plant Safety Assessment Systematic Evaluation Program La Crosse Boiling Water Reactor Dairyland Power Cooperative Docket No. 50-409 Draft Report U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation April 1983 pr "c oy
% . .'l . . **'~
gggsggggg2gggggg9 0 P PDR
- 1
( i NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:
- 1. The NRC Public Document Room,1717 H Street, N.W.
Washington, DC 20555
- 2. The NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission, Washington, DC 20555
- 3. The National Techaical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.
Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices; Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence. The following documents in the NUREG series are available for purchase from the NRC/GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brnchures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances. Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission. Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries. Documents such as theses, dissertations, foreign reports and translations, and non NRC conference proceedings are available for purchase from the organization sponsoring the publication cited. Single copies of NRC draft reports are available free upon written request to the Division of Tech-nical Information and Document Control, U.S. Nuclear Regulatory Commission, Washington, DC 20555. Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 10018. (
FL
./ %, usTao sTATas
.fg
, g a
NUCLEAR REGULATORY COMMISSION wAsMinoTow, p. c. 2oses J April 18,1983 Docket No. 50-409 LS05-83-04-038 Mr. Frank Linder General Manager Dairyland Power Cooperative 2615 East Avenue South Lacrosse, Wisconsin 54601
Dear Mr. Linder:
SUBJECT:
DRAFT INTEGRATED PLANT SAFETY ASSESSENT REPORT FOR THE LACROSSE B0ILING WATER REACTOR (NUREG-0827) l A copy of our Draft Report, NMEG-0827, the Integrated Plant Safety Assessment Report for the Lacrosse Boiling Water Reactor is enclosed. The report documents our review completed under the Systmentic Evaluation Program. l The review has provided for (1) an assessment of the significance of differences between current technical positions on selected safety issues and those that existed when the Lacrosse plant was licensed, (2) a basis for deciding on how these differences should be resolved in an integrated plant review, and (3) a doctmented evaluation of l plant safety. Equipment and procedural changes have been identified as a result of the review. Aisc enclosed is a related Notice of Availability which has been forwarded to the Office of the Federal Register for publication. Sincerely,
, idaituA. audw h Dennis M. Crutchfield, Chief F Operating Reactors Branch No. 5 Division of Licensing 1
Enclosures:
- 1. NUREG-0827 (Draft Report)
- 2. Notice l cc w/ enclosures:
See next page
- Mr. Frank Linder Docket No. 50-409 General Manager Lacrosse Dairyland Power Cooperative 2615 East Avenue South Lacrosse, Wisconsin 54601
- CC .
Fritz Schubert, Esquire U.S. Environmental Protection Agency Staff Attorney Federal Activities Branch Dairyland Power Cooperative Region V Office 2615 East Avenue South ATTN: Regional Radiation Representative Lacrosse, Wisconsin 54601 230 South Dearborn Street Chicago, Illinois 60604
- 0. S. Heistand, Jr. , Esquire Morgan, Lewis & Bockius James G. Keppler, Regional Administrator 1800 M Street, NW. U.S. Nuclear Regulatory Commission Washington, D.C. 20036 Region III 799 Roosevelt Road Mr. John Parkyn Glen Ellyn, Illinois 60137 Lacrosse Boiling Water Reactor Dairyland Power Cooperative Mr. George R. Nygaard Post Office Box 275 Coulee Region Energy Coalition Genoa, Wisconsin 54632 2307 East Avenue Lacrosse, Wisconsin 54601 U.S. Nuclear Regulatory Commission Resident Inspectors Office Rural Route #1, Box 276 Town Chairman Genoa, Wisconsin 54632 Town of Genoa Route 1 Chairman, Public Service Commission Genoa, Wisconsin 54632 of Wisconsin -
Hill Farms State Office Building Madison, Wisconsin 53702
e
- r UNITED STATES NUCLEAR REGULATORY COMMISSION DOCKET NO. 50-409 DAIRYLAND POWER COOPERATIVE +
NOTICE OF AVAILABILITY OF DRAFT INTEGRATED PLANT SAFETY ASSESSMENT REPORT _ FOR THE LACROSSE BOILING WATER REACTOR The Nuclear Regulatory Commission's (NRC) Office of Nuclear Reactor Regulation (NRR) has published its Draft Integrated Plant Safety Assessment Report related to Dairyland Power Cooperative's Lacrosse Boiling Water Reactor, located in Vernon County, Wisconsin. The report documents the review completed under the Systematic Evaluation Program (SEP). The SEP was initiated by the NRC to review the design of older operating, nuclear, reactor plants to reconfirm and document
~
their safety. The review has provided for (1) an assessment of the significance of differences between current technical positions on selected safety issues and those that existed when Lacrosse was licensed, (2) a basis for deciding on how these differences should be resolved in an integrated plant review, and (3) a documented evaluation of plant safety. Equipment and procedural changes have been identified as a result of the review. The report is being referred to the Advisory Committee on Reactor Safeguards and is being made available at the NRC's Public Document Room,
~- - ~-
r--
.'e 1717 H Street, NW., Washington, D.C. 20555 and at the Lacrosse Public
~
Library, 800 Main Street, Lacrosse, Wisconsin 54601 for inspection and copying. Single copies of this report (Document No. NUREG-0827) may be requested' from the U. S. Nuclear Regulatory Consission, Director, Division of Technical Infomation and Document Control, Washington, D.C. 20555, Attention: Publications.Ustt. Dated at Bethesda, Maryland this 18th day of April 1983. FOR THE NUCLEAR REGULATORY COMMISSION A.f4 Walter A. Paulson, Acting Chief Operating Reactors Branch No. 5 Division of Licensing
' ^
l __
. - ~ _ _ _ _ _ _ _ __ _ _ _ _
NUREG-0827 Integrated Plant Safety Assessment Systematic Evaluation Program La Crosse Boiling Water Reactor Dairyland Power Cooperative Docket No. 50-409 Draft Report U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation i April 1983 l
,p= ===s,
-c ABSTRACT The Systematic Evaluation Program was initiated in February 1977 by the U.S.
Nuclear Regulatory Commission to review the designs of older operating nuclear reactor plants to confirm and document their safety. The review provides (1) an assessment of how these plants compare with current licensing safety requirements relating to selected issues, (2) a basis for deciding on how these differences should be resolved in an integrated plant review, and (3) a documented evaluation of plant safety. This report documents the review of the La Crosse Boiling Water Reactor, oper-ated by Dairyland Power Cooperative. The La Crosse plant is one of 10 plants reviewed under Phase II of this program. This report indicates how 137 topics selected for review under Phase I of the program were addressed. Equipment and procedural changes have been identified as a result of the review. 3 La Crosse SEP iii
CONTENTS Page ABSTRACT ............................................................. iii ACRONYMS AND INITIALISMS ............................................. xi
SUMMARY
.............................................................. xiii 1 INTRODUCTION .................................................... 1-1 1.1 Background ................................................. 1-1 1.2 Systematic Evaluation Program Objectives ................... 1-2 1.3 Description of Plant ....................................... 1-3 1.4 Summary of Operating History and Experience ................ 1-4 1.4.1 Summary of Oak Ridge National Laboratory Report . . . . . 1-5 1.4.1.1 Introduction ............................... 1-5 1.4.1.2 Forced Shutdowns and Power Reductions ...... 1-5 1.4.1.3 Reportable Events .......................... 1-6 1.4.1.4 Recurring Events ........................... 1-6 1,4.2 Operating Experience, January 1,1982 Through December 31, 1982 .................................... 1-8 1.4.3 Assessment of Licensee Performance .................. 1-8 2 REVIEW METHOD ................................................... 2-1 2.1 Overview ................................................... 2-1 2.2 Selection of Topic List .................................... 2-1 2.3 Topic Evaluation Procedures ................................ 2-2 2.4 Integrated Plant Safety Assessment ......................... 2-3 3 TOPIC EVALUATION
SUMMARY
........................................ 3-1 3.1 Final La Crosse-Specific List of Topics Reviewed . . . . . . . . . . . 3-1 3.2 Topics for Which Plant Design Meets Current Criteria or Was Acceptable on Another Defined Basis .................... 3-5 3.3 Topics for Which Plant Design Meets Current Criteria or Equivalent Based on Modifications Implemented by theLicensee............................................... 3-5 3.3.1 Topic III-6, Seismic Design Considerations .......... 3-5 3.3.2 Other Modifications ................................. 3-6 l
i 4 INTEGRATED ASSESSMENT
SUMMARY
................................... 4-1 4.1 Topic II-1.A, Exclusion Area Authority and Control ......... 4-1 4.2 Topic II-3.B, Flooding Potential and Protection Requirements ............................................... 4-2 La Crosse SEP v
CONTENTS (Continued) Page 4.3 Topic II-3.B.1, Capability of Operating Plants To Co With Design-Basis Flooding Conditions ..............pe ........ 4-2 4.4 Topic II-3.C, Safety-Related Water Supply (Ultimate Heat Sink) ................................................. 4-2 4.5 Topic III-1, Classification of Structures, Components and Systems (Seismic and Quality) .............................. 4-3 4.6 Topic III-2, Wind and Tornado Loadings ..................... 4-5 4.7 Topic III-3. A, Effects of High Water Level on Structures ... 4-6 4.7.1 Containment Stability ............................... 4-6 4.7.2 Stack Stability ..................................... 4-7 4.7.3 Crib House .......................................... 4-7 4.8 Topic III-3.C, Inservice Inspection of Water Control Structures ................................................. 4.9 Topic III-4.A, Tornado Missiles ............................ 4-7 4-8 4.10 Topic III-4.B, Turbine Missiles ............................ 4-9 4.11 Topic III-5.A, Effects of Pipe Break on Structures, Systems, and Components Inside Containment ................. 4-11 4.12 Topic III-5.B, Pipe Break Outside Containment . . . . . . . . . . . . . . 4-12 4.12.1 Clarification of Pipe Whip Damage Criteria and Jet Impingement Model ............................... 4-12 4.12.2 Verification of Potential Releases From the Worst High-Energy-Line Break .............................. 4-12 4.12.3 Failure of Steam Heating System in Electrical Equipment Room ...................................... 4-13 4.13 Topic III-6, Seismic Design Considerations ................. 4-13 4.14 Topic 111-7.B, Design Codes, Design Criteria, Load Combinations, and Reactor Cavity Design Criteria ........... 4-15 4.15 Topic-III-8.A, Loose-Parts Monitoring and Core Barrel Vibration Monitoring ....................................... 4-15 4.16 Topic III-10. A, Thermal-0verload Protection for Motors of Motor-0perated Valves ...................................... 4-17 4.17 Topic V-5, Reactor Coolant Pressure Boundary (RCPB) Leakage Detection .......................................... 4-18 4.17.1 Leakage Sensitivity ................................. 4-18 4.17.2 Seismic Qualification ............................... 4-19 4.18 Topic V-10.A, Residual Heat Removal System Heat - Exchanger Tube Failures .................................... 4-19 4.19 Topic V-10.B, Residual Heat Removal System Reliability ..... 4-20 4.19.1 Use of Safety-Grade Systems for Safe Shutdown ....... 4-20 4.19.2 Shutdown Condenser Shell-Side Level Control ......... 4-20 4.19.3 Additional Emergency Procedures ..................... 4-21 La Crosse SEP vi
CONTENTS (Continued) Page 4.20 Topic V-12.A, Water Purity of BWR Primary Coolant .......... 4-21
- 4. 20.1 Chl oride and pH Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-21 4.20.2 Conductivity Limits ................................. 4-21 4.21 Topic VI-4, Containment Isolation System ................... 4-22 4.21.1 Valve Location ...................................... 4-22 4.21.1.1 Penetrations M-8 and M-11, High-Pressure Service Water and Demineralized Water Lines ...................................... 4-22 4.21.1.2 Penetrations M-21 and M-31, Vent Exhaust Damper and Ventilation Supply Lines. . . . . . . . . 4-23 4.21.1.3 Penetration M-23, Resin Sluice to Atmosphere ................................. 4-24 4.21.1.4 Penetration M-34, Shutdown Condenser Atmospheric Vent ........................... 4-24 4.21.1.5 Penetration 1-A, Alternate Core Spray High-Pressure Service Water Line ........... 4-25 4.21.1.6 Penetration 1-A, Containment Building Drain Suction Line ......................... 4-25 4.21.2 Valve Type .......................................... 4-25 4.21.2.1 Penetrations M-9 and M-10, Component Cooling Water Lines ......................... 4-25 1
4.21.2.2 Penetration M-12, Control Air System Line ... 4-26 4.21.2.3 Penetration M-17, Decay Heat Removal Line. . . . 4-26 4.21.2.4 Penetration M-18, Seal Injection Line ....... 4-27 4.21.2.5 Penetration M-28, Reactor Cavity Purge Air Line ........................................ 4-27 4.21.2.6 Penetration M-29, Offgas Vent to Chimney .... 4-27 4.21.3 Valve Type and Locked-Closed Valves .................. 4-28 l 4.21.3.1 Penetration M-13, Station Air ............... 4-28 4.21.3.2 Penetration M-19, Offgas Vent From Shutdown l Condenser ................................... 4-28 4.21.3.3 Penetrations M-22, M-25, and M-27, Waste l 4-28 l Water Lines ................................ t 4.21.3.4 Penetration M-26, Heat Injection Supply and Return Lines ............................ 4-29 4.21.4 Instrument Lines ..................................... 4-29 4.21.5 Insufficient Indication for Operation of Remote Manual Valves ........................................ 4-30 4.22 Topic VI-6, Containment Leak Testing ........................ 4-30 La Crosse SEP vii
CONTENTS (Continued) Page 4.23 Topic VI-7.A.3, Emergency Core Cooling System Actuation System ...................................................... 4-31 4.24 Topic VI-7.C.1, Appendix K--Electrical Instrumentation and Control Re-Reviews ...................................... 4-31 4.24.1 480-V Essential Buses 1A and IB ..................... 4-31 4.24.2 120-V AC Circuit Breakers ............................ 4-32 4.25 Topic VI-10.A, Testing of Reactor Trip System and Engineered Safety. Features, Including Response-Time Testing ...... 4-32 4.26 Topic VII-1. A, Isolation of Reactor Protection System From Nonsafety Systems, Including Qualification of Isolation Devices ..................................... 4-33 4.26.1 Channel Isolation ................................... 4-33 4.26.2 Qualification as IE Equipment ....................... 4-33 4.26.3 Isolation Between Reactor Protection System Channels and Power Supplies ......................... 4-34 4.26.4 Power Source for Scram Channels ..................... 4-34 4.26.5 Isolation of Range Common Modules ................... 4-34 4.27 Topic VIII-1.A, Potential Equipment Failures Associated - With Degraded Grid Voltage ................................. 4-35 4.27.1 480-V Buses 1A and IB ............................... 4-35 4.27.2 Single Source of Offsite Power ...................... 4-36 4.28 Topic VIII-3.B, DC Power System Bus Voltage Monitoring and Annunciation ........................................... 4-36 4.29 Topic IX-5, Ventilation Systems ............................ 4-36 4.29.1 Turbine Building and Penetration Room ............... 4-37 4.29.1.1 1A-480-V Essential Switchgear .............. 4-37 4.29.1.2 Oil Vapors in Oil Storage Room ............. 4-38 4.29.2 Electrical Equipment Room ........................... 4-38 4.29.3 Emergency Diesel Generator 1A Ventilation System .... 4-39 4.29.4 Diesel Building Ventilation System .................. 4-39 4.29.5 Intake Structure .................................... 4-39 4.30 Topic IX-6, Fire Protection ................................ 4-40 4.31 Topic XV-20, Radiological Consequences of Fuel-Damaging Accidents .................................................. 4-40 5 REFERENCES ...................................................... 5-1 La Crosse SEP viii
l l
\
CONTENTS (Continued) APPENDIX A -- TOPIC DEFINITIONS FOR SEP REVIEW APPENDIX B -- SEP TOPICS DELETED BECAUSE THEY ARE C0VERED BY A TMI TASK, UNRESOLVED SAFETY ISSUE (USI), OR OTHER SEP TOPIC APPENDIX C -- PLANT-SPECIFIC SEP TOPICS DELETED, REFERENCE LETTER, AND REASON FOR DELETION APPENDIX D -- PROBABILISTIC RISK ASSESSMENT STUDY APPENDIX E -- REFERENCES TO CORRESPONDENCE FOR EACH TOPIC EVALUATED APPENDIX F -- REVIEW 0F OPERATING EXPERIENCE FOR LA CROSSE BOILING WATER REACTOR APPENDIX G -- NRC STAFF CONTRIBUTORS AND CONSULTANTS l La Crosse SEP ix i i
1 ACRONYMS AND INITIALISMS ac alternating current ACS alternate core spray ACRS Advisory Committee on Reactor Safeguards AEC U.S. Atomic Energy Commission ASA American Standards Association ASB Auxiliary Systems Branch ASME American Society of Mechanical Engineers AWWA American Water Works Association BTP branch technical position BWR boiling-water reactor CCW component cooling water CFR Code of Federal Regulations CRD control rod drive DBE design-basis event DBFL design-basis flooding level dc direct current DPC Dairyland Power Cooperative ECC emergency core cooling ECCS emergency core cooling system ESWSS emergency service water supply system FTOL full-term operating license GDC general design criterion (a) gpm gallons per minute hp horsepower HPCS high pressure core spray HPSW high pressure service water ICSB Instrumentation and Control Systems Branch IEEE Institute of Electrical and Electronics Engineers ! IPSAR Integrated Plant Safety Assessment Report LACBWR Lacrosse boiling-water reactor LER licensee event report LPSW low pressure service water LWR light-water reactor MCC motor control center MEB Mechanical Engineering Branch MPA multiplant action l mph miles per hour i MSIV main steam isolation valve MSL mean sea level MWe megawatt-electric MWt megawatt-thermal NRC U.S. Nuclear Regulatory Commission OHST overhead storage tank POL provisional operating license PRA probabilistic risk assessment psf pounds per square foot La Crosse SEP xi
psi pounds per square inch psig pounds per square inch gage PWR pressurized water reactor RCPB reactor coolant pressure boundary RG regulatory guide RPS reactor protection system RSB Reactor Systems Branch SALP systematic assessment of licensee performance SAR safety analysis report SEP Systematic Evaluation Program SER safety evaluation report SRP Standard Review Plan SSE safe shutdown earthquake TER technical evaluation report
. TMI Three Mile Island USI unresolved safety issue i
La Crosse SEP xii
i ; L i l SUMARY
- The Systematic Evaluation Program (SEP) was initiated by the U.S. Nuclear Regulatory Commission (NRC) to review the designs of older operating nuclear l reactor plants to reconfirm and document'their safety. The review provides (1) an assessment of the significance of differences between current technical positions on safety issues and those that existed when a particular plant was l
- licensed, (2) a basis for deciding on how these differences should be resolved in an integrated plant review, and (3) a documented evaluation of plant safety.
. The review compared the as-built design with current review criteria in 137 different areas defined as " topics." The " Definition" and other information for each of these topics appear in Appendix A. During the review, 54 of the topics were deleted from consideration by the SEP because a review was being made under other programs (Unresolved Safety Issue (USI) or Three Mile Island j (TMI) Action Plan Tasks), or the topic was not applicable to the plant; that ' is, the topic was applicable to pressurized-water reactors rather than to boiling-water reactors or the items to be reviewed under that topic did not exist at the site. The topics deleted because they were being reviewed under either the USI or TMI programs are listed in Appendix B, and the topics deleted because they did not apply to the plant are listed in Appendix C. Of the original 137 topics, 83 were, therefore, reviewed for La Crosse; of these, 52 met current criteria or were acceptable on another defined basis. References for correspondence pertaining to safety evaluation reports (SERs) for each of
- the 83 topics appear in Appendix E.
1 The review of the remaining 31 topics found that certain aspects of plant design ' differed from current criteria. These topics were considered in the integrated assessment of the plant, which consisted of evaluating the safety significance and other factors of the identified differences from current design criteria to arrive at decisions on whether backfitting was necessary from an overall plant safety viewpoint. To arrive at these decisions, engineering judgment was used as well as the results of a limited probabilistic risk assessment study (see Appendix D). Table 4.1 summarizes the staff's positions reached in the integrated assessment. In general, these fell into one or more of the following categories: (1) equip-ment modification or addition, (2) procedure development or Technical.Specifi-cation changes, (3) refined engineering analysis or continuation of ongoing evaluation, and (4) no modifications necessary. i Safety improvements are being planned as a result of the integrated assessment and are listed below. Some safety improvements have already been implemented by the licensee. These are discussed in Sections 3.3 and 4 but are not listed below. The following descriptions summarize the modification actions addressed by the integrated assessent. The sections in this report relating to the issue are given in parentheses. La Crosse SEP xiii
i SAFETY RESULT OFIMPROVEMENTS SEP AGREED TO AND TO BE IMPLEMENTED BY THE LICENSE These improvements fall into three categories. The first category comprises hardware modifications or additions that the licensee has agreed to make and that are required by the NRC. The second category comprises procedural or Technical Specification changes that become part of the operating license. The third category comprises additional engineering analysis followed by corrective measures where required. These three categories are listed below, and the issues are discussed in sections of this report given in parentheses. Category 1, Equipment Modifications or Additions Required by NRC (1) Put cutouts in parapets of the turbine, office, and crib house buildings (4.2). (2) Add a second shell-side level controller to the shutdown condenser (4.19.2). (3) Relocate manual valve 56-24-009 on penetration M-17 to a position where it is accessible after a postulated core damage accident (4.21.2.3). (4) Install a remote manual solenoid valve outside containment on penetra-tion M-19 (4.21.3.2). (5) Modify one power range channel to compensate for feedwater temperature deviation inaccuracies (4.25). (6) Provide separate power supplies for the full scram channels (4.26.4). Category 2, Technical Specification Changes and Procedure Development The staff's position regarding Technical Specification changes is that the proposed changes may be submitted all together following the completion of the integrated assessment. The licensee should submit within 90 days after the issuance of the Final Integrated Plant Safety Assessment Report a request for an amendment of the operating license to change the facility Technical Specifications. (1) Inform NRC of any changes in occupancy of privately owned land, Technical Specification change (4.1). (2) Develop or modify emergency procedures for site flooding, Technical Specifi-cation change (4.3). (3) Develop and perform inservice inspection of water control structures (4.8). # (4) Specify sampling frequency of primary water purity, Technical Specifica-tion change (4.18). } (5) Revise chloride and pH limits to conform with Regulatory Guide 1.56, Technical Specification change (4.20.1). La Crosse SEP xiv
(6) Reestablish conductivity limits following review of system capability, Technical Specification change (4.20.2). (7) Develop procedures to manually isolate penetration M-8 from outside con-tainment coincident with failure of containment check valves (4.21.1.1(1)). (8) Develop procedures to close new manual valve outside containment on pene-tration M-23 when resin transfer is in progress. This valve shall be locked closed at all other times (4.21.1.3). (9) Develop procedures to close valves 57-24-001, 57-24-003, 57-24-006, and 57-24-008 on penetrations M-9 and M-10 based on component cooling water surge tank level alarm (4.21.2.1). (10) Develop procedures to close valve 56-24-009 on penetration M-17 in the event of loss-of-coolant accident (4.21.2.3). (11) Develop procedures to close remote manual valve 55-25-004 outside con-tainment on penetration M-29 if closure signal is sent to automatic valve 55-25-003 inside containment (4.21.2.6). (12) Lock-close manual valve 70-24-30 outside containment on penetration M-13, and develop procedures to open and relock (4.21.3.1). (13) Lock-close manual valves 55-24-101 and 62-28-013 on penetration M-19 (4.21.3.2). (14) Lock-close manual valve 54-24-179 on penetration M-22, and develop oro-cedures to open and relock (4.21.3.3(1)). (15) Lock-close manual valve 54-24-162 on penetration M-25, and develop pro-cedures to open and relock (4.21.3.3(2)). (16) Lock-close manual valve 54-24-160 on penetration M-27 (4.21.3.3(3)). (17) Lock-close manual valves 73-24-009 and 73-24-057 on penetration M-26 (4.21.3.4). (18) Develop procedures to specify under which conditions remote manual valves will be closed (4.21.5). (19) Visually inspect airlock door seals within 72 hr after each opening, but not more than every 72 hr, and replace seals in accordance with manu-facturer's recommendations, Technical Specification change (4.22). (20) Develop procedures need for monitoring ventilation in diesel building rooms (4.29.4). Category 3, Additional Engineering Evaluation It is the staff's position regarding additional engineering evaluation that all evaluations and corresponding modifications and schedule for implementing these modifications be submitted within the established schedules, as documented La Crosse SEP xv
in the appropriate report sections and summarized in Table 4.1. These evalua-tions are as follows: (1) Review possible loss of cooling water to plant (4.4). (2) Review stack stability for design-basis flood level load combinations (4.7.2). (3) Compare present overspeed protection tests with interim criteria for tur-bines at Genoa Units 2 and 3 (4.10.1). (4) Evaluate Items 1,. 2, 4, 5, and 6 of Topic III-5. A. , "Effect of Pipe Break on Structures, Systems, and Components Inside Containment" (4.11). (5) Clarify pipe whip damage criteria and jet impingement model (4.12.1). (6) Complete seismic reanalysis and modify, where necessary, structures, piping systems, major mechanical equipment, mechanical components, and supports so that safe shutdown is ensured. Justify use of existing structures, piping systems, and components, when modification is not intended by a 3 consequence study, to assess the potential impact on the health and safety of the public. Provide the implementation schedule for any necessary modifications (4.13). (7) Assess structural code changes on safety margins in "as built" structures (4.14). (8) Either seismically qualify primary leakage detection system or develop procedures (4.1.17.2). (9) Develop interlocking method to prevent both diesel generators from being l paralleled (4.24.1). (10) Demonstrate by analysis and/or tests that a single failure in any one of the process recorders does not affect any other channel of the reactor protection system (RPS) (4.26.1). (11) Demonstrate by analysis and/or tests which RPS channels have inadequate power supply isolation and propose corrections for identified deficiencies (4.26.3). (12) Evaluate de system monitoring and identify any necessary modifications (4.28). (13) Demonstrate by analysis and/or tests that no ventilation is necessary for the oil storage room or develop procedures to provide ventilation l (4.29.1.2). (14) Demonstrate by analysis and/or tests that the 1A emergency diesel gener-ator can continue to function without ventilation or propose corrective measures (4.29.3). La Crosse SEP xvi
SAFETY IMPROVEMENTS REQUIRED BY THE STAFF AND TO WHICH THE LICENSEE DOES NOT AGREE The staff has determined that the following improvements or analyses are re-quired, but the licensee has either not responded to or specifically disagrees with the staff positic,n. These issues are identified below and are discussed in the sections of the report given in parentheses. (1) Demonstrate by test or analysis adequate quality standards for structures, systems, and components (4.5). (2) Analyze and upgrade the structural capacity for wind and tornado loadings so that safe shutdown is ensured (4.6). (3) Compare alternate methods to achieve safe shutdown to protect against tornado missiles (4.9). TOPIC SAFETY EVALUATION REPORTS Copies of this report and the associated safety evaluation reports for the 83 topics listed in Appendix E are available for public inspection at the NRC Public Document Room, 1717 H Street, N.W., Washington, D.C. 20555 and at the La Crosse Public Library, 800 Main St. , La Crosse, Wisconsin 54601. Copies of this report are also available for purchase from sources indicated on the inside front cover. The review of the 83 topics was performed by the NRC staff and contractors listed in Appendix G. The members of the Integrated Assessment Team performing the integrated assessment of the 31 topics that did not meet current criteria are as follows: T. Michaels--Sr. Project Manager, Integrated Assessment, La Crosse R. Dudley--Project Manager, La Crosse M. Rubin--Reliability and Risk Analyst M. Branch--Senior Resident Inspector, La Crosse Mr. T. Michaels may be contacted by calling (301) 492-8166 or writing to the l following address: T. Michaels Division of Licensing U.S. Nuclear Regulatory Commission Washington, D.C. 20555 l La Crosse SEP xvii
INTEGRATED PLANT SAFETY ASSESSMENT SYSTEMATIC EVALUATION PROGRAM LA CROSSE BOILING WATER REACTOR 1 INTRODUCTION
1.1 Background
In the late 1960s and early 1970s, the U.S. Atomic Energy Commission's (now Nuclear Regulatory Commission) scope of review of proposed power reactor designs was evolving and somewhat less defined than it is today. The require-ments for acceptability evolved as new facilities were reviewed. In 1967, the Commission published for comment and interim use proposed General Design Cri-teria for Nuclear Power Plants (GDC) that established minimum requirements for the principal design standards. The GDC were formally adopted, though somewhat modified, in 1971, and have been used as guidance in reviewing new plant appli-cations since then. Safety guides issued in 1970 became part of the Regulatory Guide Series in 1972. These guides describe methods acceptable to the staff for implementing specific portions of the regulations, including certain GDC, and formalize staff techniques for performing a facility review. In 1972, the Commission distributed for information and comment a proposed " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," now Regula-tory Guide 1.70. It provided a standard format for these reports and identi-fied the principal information needed by the staff for its review. The Standard Review Plan (SRP, NUREG-75/087) was published in December 1975 and updated in July 1981 (NUREG-0800) to provide further guidance for improving the quality and uniformity of staff reviews, to enhance communication and understand-ing of the review process by interested members of the public and nuclear power industry, and to stabilize the licensing process. For the most part, the detailed acceptance criteria prescribed in the SRP are not new; rather they are methods of review that, in many cases, were not previously published in any regulatory document. Because of the evolutionary nature of the licensing requirements discussed above and the developments in technology over the years, operating nuclear power plants embody a broad spectrum of design features and requirements depending on when the plant was constructed, who was the manufacturer, and when the plant was licensed for operation. The amount of documentation that defines these safety-design characteristics also has changed with the age of the plant--the older the plant, the less documentation and potentially the greater the difference from current licensing criteria. Although the earlier safety evaluations of operating facilities did not address many of the topics discussed in current safety evaluations, all operating facil-ities have been reviewed more recently against a substantial number of major safety issues that have evolved since the operating license was issued. Con-clusions of overall adequacy with respect to these major issues (e.g., emergency core cocling system, fuel design, and pressure vessel design) are a matter of record. On the other hand, a number of other issues (e.g., seismic considera-tions, tornado and turbine missiles, flood protection, pipe break effects inside la Crosse SEP 1-1 o
containment, and pipe whip) have not been reviewed against today's acceptance criteria for many operating plants, and documentation for them is incomplete. 1.2 Systematic Evaluation Program Ob.iectives The Systematic Evaluation Program (SEP) was initiated by the U.S. Nuclear Regu-latory Commission (NRC) in 1977 to review the designs of older operating nuclear power plants in order to reconfirm and document their safety. The review provides (1) an assessment of the significance of differences between current technical positions on safety issues and those that existed when a particular plant was licensed, (2) a basis for deciding on how these differ-
~
ences should be resolved in an integrated plant review, and (3) a documented evaluation of plant safety. The original SEP objectives were: (1) The program should establish documentation that shows how the criteria for each operating plant reviewed compare with current criteria on significant safety issues, and should provide a rationale for acceptable departures from these criteria. (2) The program should provide the capability to make integrated and balanced decisions with respect to any required backfitting. (3) The program should be structured for early identification and resolution of any significant deficiencies. (4) The program should assess the safety adequacy of the design and operation of currently licensed nuclear power plants. (5) The program should use available resources efficiently and minimize requirements for additional resources by NRC or industry. The program objectives were later interpreted to ensure that the SEP also pro-vides safety assessments adequate for conversion of provisional operating licenses (POLS) to full-term operating licenses (FTOLs). The final version of the integrated plant safety assessment report and a POL conversion safety evalua-tion report that will address the status of all applicable generic activities (TMI and USI), including those that formed the basis for deletion of specific SEP topics, will form a part of the basis for the Commission's consideration of the license conversion. Many of the plants selected for review were licensed before a comprehensive set of licensing criteria had been developed. They include five of the oldest nuclear reactor plants and seven plants under NRC review for the conversion of POLS to FTOLs. The plants to be considered under the original Phase II program were (1) Yankee (FTOL PWR) ) (2) Haddam Neck (FTOL PWR) (3) Millstone 1 (POL BWR) (4) Oyster Creek (POL BWR) (5) Ginna (POL PWR) La Crosse SEP 1-2
(6) La Crosse (POL BWR) (7) Big Rock Point (FTOL BWR) (8) Palisades (POL PWR) (9) Dresden 1 (FTOL BWR) (10) Dresden 2 (POL BWR) (11) San Onofre (POL PWR) The SEP of Dresden Unit I has been deferred because the plant is undergoing an extensive modification and is not scheduled for restart before June 1986. There-fore, the total number of plants being reviewed for Phase II is 10. 1.3 Description of Plant The La Crosse Boiling Water Reactor, located on the east bank of the Mississippi River in Vernon County, Wisconsin, approximately 1 mi south of the village of Genoa, Wisconsin, and approximately 19 mi south of the city of La Crosse, Wisconsin, is a 50-MWe boiling-water reactor designed by the Allis-Chalmers Company. Two other generating plants are located on the site, a 350-MWe coal-fired and a 14-MWe oil-fired plant. The licensee is Dairyland Power Cooperative (DPC). The population within 30 mi of the plant is 140,000. There are two cities and a population of 320,000 within a 50-mi radius. The La Crosse primary coolant system consists of the reactor vessel, recircula-tion system, main steam system, and shutdown condenser. A diagram of the major components of the primary coolant system and other water systems is provided in Figure 1.1. The reactor is a single-cycle, forced-circulation boiling-water reactor produc-ing steam for direct use in the steam turbine. The reactor vessel contains internal components, which include the necessary equipment for separating steam and water flow paths. The recirculation system provides for forced flow through the reactor core to facilitate heat removal capability. Water that is separated from the steam in the reactor vessel and mixes with water provided by the feedwater system is drawn from outside the core, passes through the recirculation pumps, and re-enters the reactor vessel below the core. The water then flows upward through the core where boiling produces a steam water mixture. The main steam system directs the steam generated in the reactor vessel to the turbine generator for conversion to electrical power. The steam-water mixture travels from the reactor core, through the steam-separating equipment into the main steam lines. The steam then passes through the main steam lines to the turbine. Included in the main steam system are safety valves, which provide overpressure protection for the reactor vessel and associated piping systems. The shutdown condenser system will provide reactor core cooling if the reactor should become isolated from the main condenser because of closure of the main steam isolation valves. The isolation condenser operates by natural circulation. During operation steam flows from the reactor, condenses in the tubes of the shutdown condenser, and flows back to the reactor by gravity. Emergency core cooling can be provided through two high pressure core spray (HPCS) pumps that take suction from the overhead storage tank. Alternatively, La Crosse SEP 1-3
water to the HPCS pumps can be provided directly from the river by electrically driven pumps (high pressure service water and low pressure service water pumps), by two diesel-driven pumps, or by three gasoline-driven pumps (see Figure 1.1). 1 Another method of cooling is available but is used only if other methods fail. This method requires the activation of the manual depressurization system, which is designed to rapidly depressurize the reactor vessel to enable the alternate core spray to function. The containment structure is a circular cylinder with a hemispherical dome and semiellipsoidal bottom. It has an overall internal height of 144 ft and an inside diameter of 60 ft, and extends 26 ft 6 in. below grade level. The , shell thickness is 1.16 in., except for the upper hemispherical dome, which is 0.60 in. thick. The interior of the shell is lined with a 9-in,-thick layer of concrete up to the hemispherical dome to limit direct radiation doses in the event of fission product release within the containment building. The containment contains most of the equipment associated with the nuclear steam i supply system, including the reactor vessel and biological shielding, the fuel element storage wall, the forced-circulation pumps, the shutdown condenser, and the process equipment of the reactor water purification system, decay heat cooling system, shield cooling system, seal injection system, high pressure core spray system, boron injection system, and storage well cooling system. The containment building is designed to withstand the instantaneous release of all the energy of the primary system to the containment atmosphere at an initial temperature of 80 F, neglecting the heat losses from the building and heat absorption by internal structures. 1.4 Summary of Operating History and Experience The plant is one of a series of demonstration plants funded in part by the U.S. Atomic Energy Commission (AEC). The nuclear steam supply system and its auxiliaries were funded by the AEC, and the balance of the plant was funded by the Dairyland Power Cooperative. The Allis-Chalmers Company was the original licensee; the AEC later sold the plant to the Dairyland Power Cooperative (DPC) and provided them with a provisional operating license. . The Allis-Chalmers Company applied for a construction permit on November 5, l 1962. The construction permit was issued to the Allis-Chalmers Company on March 29, 1963 (CAPR-5), and on July 3, 1967 (DPRA-5) the AEC authorized the Allis-Chalmers Company to use and operate the La Crosse nuclear plant. On July 11, 1967, initial criticality was achieved. On October 31, 1969, a pro-visional operating authorization (DPRA-6) was given to DPC to operate the reactor up to 165 MWt (50 MWe) of power, and on November 1, 1969, commercial operation began. On August 28, 1973, Provisional Operating License No. DPR-45 was issued to DPC. On October 9, 1974, the licensee applied for a full-term j operating license. i La Crosse SEP 1-4 l L-- - - - - -- -- -- _- - -
1.4.1 Summary of Oak Ridge National Laboratory Report 1.4.1.1 Introduction From 1970 through 1981, the cumulative reactor availability factor at La Crosse was 66.7% and the unit cumulative capacity factor averaged 46.71. Both of these are below average for commercial nuclear power plants. The cumulative reactor availability and unit capacity factors are 67.1% and 46.7%, respectively. Since 1970, the yearly availability has always been above 50% except for 2 years, 1976 and 1977. In 1976,~ the unit shut down for more than 5 months so that modi-fications could be made to bring the facility into compliance with NRC's interim criteria for emergency core cooling of light-water reactors. In 1977, the May refueling outage was extended to the end of the year because of abnormal fuel degradation and the associated evaluation. The operating history review focused on data evaluation which was divided into two segments: (1) evaluation of forced shutdowns and power reductions and (2) evaluation of reportable events. Design-basis events (DBEs), which are defined in the NRC's Standard Review Plan (NUREG-0800), are failures that initiate system transients and challenge engineered safety features. In the forced shutdown and power reduction segment, DBEs and recurring events that might indicate a potential operating concern were identified. In the report-able event segment, which included environmental events and radiological release events, significant events and recurring events that might indicate a potential operating concern were reviewed. Significant events were either DBEs or events with a loss of engineered safety function. 1.4.1.2 Forced Shutdowns and Power Reductions Of the 315 forced shutdowns and power reductions between 1967 and 1981, 62 were DBEs of one of the following 8 types: (1) single or multiple reactor recirculation pump trip (35) (2) increased feedwater flow (8) (3) decreased feedwater flow (6) (4) loss of electric load (4) (5) inadvertent main steam isolation valve closure (4) (6) turbine trip (3) (7) control rod maloperation (1) (8) radioactivity release (1) Of the 62 DBEs, 44 were the result of equipment failure. Human error caused the remaining 18 events. In all DBEs, the engineered safety features operated properly to mitigate the transient." La Crosse has experienced an average of four DBEs per year since startup in 1967. However, the majority of DBEs occurred before 1974. Since then the t yearly average has been just over two DBEs per year. The largest number of events in a single year (11) occurred in 1968 and 1973. The frequency of occurrence of each type of DBE, except the reactor recirculation pump trips, is consistent with the experience of other plants. Of the 35 reactor recircula-tion pump trips, 33 were caused by seal injection system malfunctions. These malfunctions stem from several sources: instrumentation, seal flow / pressure, vibration, and operator interaction. Several causes have been identified and La Crosse SEP 1-5
--- _ _-__ J
solved, but recirculation pump trips continue to dominate the number of DBEs (8 of 18 since 1974).
- 1. 4.1. 3 Reportable Events In the reportable event segment of the operating history review of La Crosse, 246 events were reviewed. No upward or downward trends in the yeaily total number of events were discernible. The peak year was 1970 with 30 events reported. The causes of reportable events have been either equipment / weather related (55%) or human error (45%). Human error includes administrative, design, fabrication, installation, maintenance, and operator error. No trend in the causes of reported events is apparent.
Of the 246 reported events,15 are~ considered significant: (1) loss of offsite power (10) (2) main steam bypass valve malfunction, reactor core uncovered (1) (3) slow main steam isolation valve closure time (1) (4) setpoint drift in three main steam relief valves (1) (5) turbine governor malfunction with high cooldown rate (1) (6) loss of containment integrity (1) Significant events at La Crosse were cause'd,almost. equally by (1) equipment failure, which accounted for eight events, and (2) human error, which accounted ' for seven. The frequency of occurrence of significant events has been rela-tively constant with peaks of three events in 1974 and 1981. The loss of offsite power was a dominant contributor to the signifiEant events. ' The unit has experienced 10 losses. Only one offsite tie-line exists; there-fore, every loss of offsite power is a complete loss. From the 69-kV switch-yard, power can be fed to the plant through two separate transformers (main and reserve auxiliary). Both of these transformers are capable of-supplying power to the 2,400-V and 480-V buses. However, several one-event failure modes exist that have the potential to cause a loss of offsite power. Human error was the largest contributor to this failure mode (four maintenance errors, one admin-istrative error, and one operato'r error). ' l The large number of losses of offsite pcwer places an added importance on the l reliability of the diesel generators. The diesel generators must start, run for the entire mission, and supply the correct voltage. Before 1976, only one ! diesel generator was available. During this time, La Crosse experienced eight ! losses of offsite power. The lone diesel generator failed to start only once. i After the second diesel generator was installed, there were only five occasions, l not related to loss of offsite power, when one of the diesel generators was
- unavailable. '
1.4.1.4 Recurring Events i l The following six types of recurring events were noted during the .wo segments ! of the operating history review: l (1) losses of offsite power (2) recirculation pump seal injection failures (3) overcooling transients l La Crosse SEP 1-6 l l
(4) control rod problems (5) fuel leaks and fuel bowing (6) improperly scaled power range instruments The problems with loss of offsite power and recirculation pump seal injection were discussed previously. La Crosse experienced four incidents of excessive cooldown rates throughout its operating history. Any large cooldown rate is of concern because a thermal st~ress is placed on the reactor vessel and the resulting fatigue is a cumulative effect. The first and most significant cooldown occurred in 1970. The cool-down rate was equivalent to 825 F/hr. Three other blowdowns that resulted in excessive.cooldown rates occurred in 1972, 1979, and 1980. These cooldown rates ranged from 120 F/hr to 423 F/hr. The control rods and control rod drives were involved in 29 failures. Nine of these involved failure of the control rod to scram; seven involved the jamuing of a single control rod. On four occasions, installation errors contributed to the control rod drive (CRD) failures. A spare CRD roller was installed backwards, a clutch plate was bent, a snap ring was dropped into a CRD gear reducer, and an upper brake ring was installed incorrectly. An operator error also was a con-tributing factor when, during power escalation, an operator incorrectly withdrew the wrong control rod. In addition, considerable difficulty wr encountered in early operation with leaks of the "0" rings on the control rod nccumulator pis-tons. After consultation with the ring manufacturer and some onsite testing, the original butyl rings were replaced with bronze-impregnated teflon rings. During the October 1969 to May 1970 outage, several fuel pins were found to be bowed. Two factors contributed to the fuel pin bowing. First, the shroud can locking rings were left unlocked during power operation. Twisting and stressing of the fuel elements resulted from the improperly seated fuel pins. Secondly, high transverse power gradients develepad in the fuel pins causing large dif-ferences in the axial thermal expansion of the fuel pins in an element beginning in 1973. In addition to this early fuel bewing, La Crosse experienced several fuel leaks. The type of fuel rods that leaked was manufactured by the Allis- ! Chalmers Company and had stainless steel cladding with each rod containing uranium; dioxide fuel pellets housed in a closed hollow tube of stainless steel. To improve fuel integrity, new operating restrictions regulated the rate of control rod movement, rate of power increase, and the maximum allowable burnup limit for fuel assemblies. A failed assembly discovered in April 1982 was one of two remaining Allis-Chalmers assemblies in use. The rest of the fuel is of the upgraded Exxon design which has shown no degradation. Ikthe' first'5 years of operation, the reactor operator failed to take correc-
.tive action with the power range instruments on 14 occasions. On nine occasions, the power range instruments were downscaled rather than upscaled. On other occasions, the operator failed to upscale (three times), downscaled the wrong instrument channel (once), and downscaled the instrument channel one decade too far (once). Operator training was intensified, and since 1971, fewer instances of operator errors involving the improper scaling of the power range instruments have occurred.
La Crosse SEP 1-7
1.4.2 Operating Experience, January 1 Through December 31, 1982 The La Crosse Boiling Water Reactor has operated from January 1, 1982 through December 31, 1982, with a unit availability factor of 44.6% and a capacity factor of 31.5% as compared with the cumulative availability and capacity factors of 60.4% and 45.5%, respectively. The low rating for 1982 was due in part to the extension of the routine refueling outage from 7 to 23 weeks because of the discovery and repair of cracks in the soldered joints on the main generator rotor field coil. During the 1982 refueling outage, the licensee completed a facility modifica-tion designed to reduce the size and number of spurious high reactor power signals received by the power-to-flow protective circuit. This modification should reduce the number of spurious scrams and should improve the reliability and availability of the plant. During 1982 there were 11 forced shutdowns or power reductions. Four of these shutdowns could be categorized as design-basis events (DBEs) and would fall into the following types: (1) inadvertent main steam isolation valve closure (2) (2) turbine trip (1) (3) single or multiple reactor recirculation pump trips (1) The number of DBEs that occurred during 1982 was consistent with the average of four per year that occurred over the operating life of the La Crosse plant. Twenty licensee event reports (LERs) were submitted from January 1 through December 31, 1982. The number and nature of the reportable events were con-sistent with those in previous years, and none of the events were considered significant. The number of events that were attributed to human error (4/20 or 20%) was low when compared with the plant's lifetime average of 45%. The number of equipment failure events (13/20 or 65%) was slightly higher than the plant's lifetime average of 55%. 1.4.3 Assessment of Licensee Performance A management meeting was held with Dairyland Power Cooperative on December 15, 1980, to discuss the "H.d ts of NRC's first systematic assessment of licensee performance (SALP IN ? W assessment was based on activities from August 1, 1979 through Ja@ l 18C, and was directed at improving the licensee's regula-tory performar.x tb <icensee's overall performance was considered to be adequate, but r 20. . " age performance was noted in the areas of health physics and security. /., weakness was also noted regarding ineffective corrective action in the area of adherence to procedures. The second assessment (SALP II) for the period July 1,1980 through June 30, 1981 identified aknesses, but significant improvements were noted in the areas that were oelow average during the SALP I. The overall regulatory performance of Dairyland Power Cooperatiw was considered adequate for the appraisal period; however, increased management attention was deemed to be warranted in the areas of plant operations, design control, and emergency preparedness. The contributing factors to a lower rating in these areas were La Crosse SEP 1-8
considered to be minimal staff resources, ineffective review and audit, short-comings in the training of nonlicensed operators, and the lack of a disciplined approach toward meeting regulatory requirements. The third assessment (SALP III) for the period July 1, 1981 through June 30, 1982 noted significant improvement in the licensee's regulatory performance; however, improvements made by the licensee were not totally effective in the areas of operations and emergency preparedness. There was a noted improvement in management's attention to operational problens, but limited and strained resources continued to be a common contributing factor to the licensee's inabil-ity to cope satisfactorily with many problems and issues. The licensee's over-all regulatory performance was considered to be adequate. In summary, it is the NRC's observation that the licensee's performance has improved since SALP I. It should also be noted that the licensee has volun-tarily committed to a regulatory improvement program. This program is under development and is expected to be finalized by April 1, 1983. When completed, this program should result in significant improvements in the licensee's regu-latory performance and ability to cope effectively with operational problems and regulatory issues. 4 La Crosse SEP 1-9
I ai [5I h5 gg EE i "
> S $11- !!
e I;);.;
~
g
<, ln
, l'
{ $$" Y T ', I gl s s l 1 ~ l' i, _ in- 9 s T 5" 9 g g
- f]oh' J5 i i t i r ! I$h liit E _
- I
!o
/ 8 i +
l E [I " R
-{
. l -
l e > n .
.h 5 l[ "
l l' "
~ _ _ _
' )) '
I g- I i + Igt y - I p'= "
- =
g .
$m J( 11 0 1 )RE lg
~
~1 v )
glj . __ ih.ad [ La Crosse SEP 1-10 i
1 2 REVIEW METHOD 2.1 Overview The Systematic Evaluation Program (SEP) review procedure represents a departure from the typical NRC staff reviews conducted to support the granting of a con-struction permit or operating license for a new facility or a license amendment for an operating facility. A typical licensing review starts with the submit-tal by the utility of a safety analysis report (SAR) that describes the design of the proposed plant. The staff reviews the SAR on the basis of the Standard Review Plan (SRP), Regulatory Guides, and Branch Technical Positions (found in the SRP) that constitute current licensing criteria. The guidelines in the SRP represent acceptable means of complying with licensing regulations specified in Title 10 of the Code of Federal Regulations (10 CFR). The SEP was initiated by NRC, and not by the licensee as part of an application for a license or request for a license amendment. The SEP procedure involves several phases of data gathering and evaluation so that an integrated assess-ment of the overall plant safety can be made. The various phases and their interrelationships are described below. 2.2 Selection of Topic List A list of significant safety topi.cs was derived from existing safety issues during Phase I of the program. More than 800 items were considered in the development of the original list; however, a number of these were found to be duplicative in nature or were deleted for other reasons. Categories of topics that were deleted for other reasons are (1) those not normally included in the review of light-water reactors, (2) those related either to research-and-development programs or to the development of analytical evaluation models and inethodology, and (3) those that are reviewed on a periodic basis in accordance with current criteria (for example, fuel performance). The topics retained numbered 137; these were arranged in groups corresponding to the organization of the SRP. A " definition" was prepared for each topic to ensure a common understanding. This definition plus a statement of the safety objective for the review and the status of the review at that time is contained in Appendix A for ease of reference. During the course of this review, the number of topics that applied to all plants was reduced further because some topics were being reviewed generically under either the Unresolved Safety Issues (USIs) program or the Three Mile Island (TMI) NRC Action Plan; also, duplicates found within the SEP topics were deleted. Appendix B shows these topics along with the corresponding USI, THI task, or SEP topic referenced. The basis for deletion appears in Appendix A under the individual topics. The current status of USI and TMI Action Plan Item reviews applicable to SEP will be discussed in a POL conversion safety evaluation report that will be issued following completion of the integrated assessment. La Crosse SEP 2-1
. Plant-specific deletions other than those comon to all SEP plants were made to account for nonapplicability of particular topics to La Crosse. The plant-specific topics that were removed for La Crosse and the basis for deletion are shown in Appendix C. For La Crosse, this process resulted in 83 topics from the topic list that formed the SEP review. The final list of 83 topics that were reviewed appears in Section 3.1, The milestones in the review of the SEP and the La Crosse plant are shown in Table 2.1. 2.3 Topic Evaluation Procedures Each SEP topic in Section 3.1 was reviewed to determine whether the corresponding plant design was consistent with current licensing criteria such as regulations, guides, and SRP review criteria, or the equivalent of such criteria. Safety evaluation reports (SERs) for all 83 topics were issued to document the compari-son with current licensing criteria and to identify potential areas for back-fitting. References for letters regarding the individual topic SERs are con-tained in Appendix E. These documents describe the detailed evaluations where conclusions are summarized in this report. Topics were evaluated by one of two methods: (1) The NRC staff reviewed and formally issued an SER to the licensee. This SER was termed a draft because it was only one input element to the evalua-tion. The purpose of the draft SER was to verify the factual accuracy of the described facility and to allow the licensee to identify possible alternate approaches to meeting the current licensing criteria. After a review of the licensee's comments on the draft SER, factual changes were incorporated as needed, proposed alternatives were reviewed, and the SER was issued in final form. (2) The licensee submitted a safety analysis report and the staff issued a final SER based on a review of this submittal. After completion of the topic evaluation, the disposition of each topic was grouped according to one of the following results: (1) The plant is consistent with current licensing criteria and the topic re-view is considered complete. If the plant does not meet current licens-ing criteria, but the present design is equivalent to current criteria, the topic is also considered complete. A justification for this conclusion is provided in the topic SER. The topics in this category are identified in Section 3.1 of this report by an asterisk. j (2) The plant is not consistent with current licensing criteria, but the licen-see has implemented design or procedural changes that the staff finds accept-able. A summary of the topic evaluations and the corrective actions taken in this category appear in Section 3.3. t La Crosse SEP 2-2
1 (3) The plant is not consistent with current licensing criteria, and the dif-ferences from these criteria are to be evaluated as potential candidates for modification. If the staff determines the difference is of immediate safety significance, action is taken to resolve the issue promptly. At La Crosse one issue of immediate safety significance was identified during topic reviews, namely, the liquefaction potential of the soil distribution under the crib house when subjected to an unlikely event of a safe shut-down earthquake. The crib house contains the components that provide the ultimate heat sink, the Mississippi River, to the plant. The licensee's fix for this condition was the provision of an alternate system, the emer-gency service water supply system, which can pump Mississippi water to the plant for a safe shutdown (see Section 3.3.1). If the difference is not of immediate safety significance, the resolution is deferred to the inte-grated plant safety assessment to obtain maximum benefit from coordinated and integrated modification decisions. The SEP evaluation of all 83 top-ics led to the conclusion that 31 topics were not consistent with current licensing criteria. All of these topics were considered in the integrated safety assessment and appear in Section 4. 2.4 Integrated Plant Safety Assessmerit
. The objective of the integrated plant safety assessment is to make balanced and integrated decisions on when to modify SEP facilities to current licensing cri-teria. Factors considered important in reaching decisions on modification in-clude safety significance, radiation exposure to workers, and, to a lesser ex-tent, implementation impact and schedule.
A meeting was held with the licensee to discuss these factors as they related to the differences identified during the SEP review between actual facility design and current licensing criteria and to obtain the licensee's views on safety significance and possible corrective actions. These factors were considered in reaching a decision on modification and are discussed in Section 4 for each identified difference between actual facility design and current licensing criteria. Because these factors sometimes rely on judgment, risk assessment techniques were used to the extent possible to supple-ment the staff's judgments concerning safety significance. The probabilistic risk assessment (PRA) performed by Science Applications, Inc. appears in Appen-dix D. For reasons given in Appendix D, only certain topics could be readily analyzed by a PRA. Of a total number of 31 topics considered in the integrated assessment, 15 were evaluated assisted by PRA techniques. La Crosse SEP 2-3
t Table 2.1 Topic list selectioit and resolution ORIGINAL PHASE I TOPIC LIST 800 Many of these topics were deleted because they were duplicative in nature, were not normally included in the review of light-water reactors, were related to research-and-development programs, or were reviewed on a periodic basis in accordance with current criteria. FINAL LIST OF PHASE I TOPICS REVIEWED DURING PHASE II 137 (see Appendix A) Of the 137 topics, 18 were deleted because they were being reviewed generically under either the Unresolved Safety Issues (USIs) program or the Three Mile Island (TMI) NRC Action Plan (see Appendix B). t REMAINING TOPICS AFTER DELETION OF USIs AND THI-RELATED TOPICS 119 t Of the remaining 119 topics, 36 were deleted because the topics did not apply to La Crosse or are being generically reviewed (see Appendix C). k FINAL NUMBER OF TOPICS REVIEWED FOR LA CROSSE 83 (see Section 3.1 and Appendix E) TOPICS THAT MET CURRENT CRITERIA OR WERE ACCEPTABLE ON ANOTHER DEFINED BASIS 52 (see Section 3.1) TOPICS THAT MET CURRENT CRITERIA OR WERE ACCEPTABLE ON ANOTHER DEFINED BASIS AFTER MODIFICATIONS MADE DURING TOPIC REVIEW 0 (however, see Section 3.3.1) t TOPICS CONSIDERED FOR MODIFICATION IN THE INTEGRATED ASSESSMENT 31 (see Table 4.1 and Sections 4.1-4.31) i l La Crosse SEP 2-4
k 3 TOPIC EVALUATION SUP94ARY 3.1 Final La Crosse-Specific List of Topics Reviewed T Listed below are the 83 topics that were reviewed for La Crosse. The topics , with asterisks are those for which the plant meets current criteria or was acceptable on another defined basis: TOPIC TITLE II-1.A Exclusion Area Authority and Control II-1.B* Population Distribution. II-1.C* Potential Hazards or Changes in Potential Hazards Due to Trans-
- portation, Institutional, Industrial, and Military Facilities II-2.A* Severe Weather Phenomena II-2.C* Atmospheric Transport and Diffusion Characteristics for Accident Analysis II-3.A* Hydrologic Description II-3.B Flooding Potential and Protection Requirements II-3.B.1 Capability of Operating Plant To Cope With Design-Basis Flooding Conditions l- II-3.C Safety-Related Water Supply (Ultimate Heat Sink (UHS))
II-4* Geology and Seismology II-4.A* Tectonic Province II-4.B* Proximity of Capable Tectonic Structures in Plant Vicinity II-4.C* Historical Seismicity Within 200 Miles of Plant II-4.D* Stability of Slopes II-4.E* Dam Integrity II-4.F* Settlement of Foundations and Buried Equipment III-1 Classification of Structures, Components, and Systems (Seismic and Quality) l III-2 Wind and Tornado Loadings i La Crosse SEP 3-1 { 1
TOPIC TITLE III-3.A Effects of High Water Level on Structures III-3.C Inservice Inspection of Water Control Structures III-4.A Tornado Missiles III-4.B Turbine Missiles III-4.C* Internally Generated Missiles III-4.D* Site-Proximity Missiles (Including Aircraft) III-5.A Effects of Pipe Break on Structures, Systems, and Components Inside Containment III-5.B Pipe Break Outside Containment III-6 Seismic Design Considerations III-7.B Design Codes, Design Criteria, Load Combinations, and Reactor Cavity Design Criteria III-7.D* Containment Structural Integrity Tests III-8.A Loose-Parts Monitoring and Core Barrel Vibration Monitoring III-8.C* Irradiation Damage, Use of Sensitized Stainless Steel, and Fatigue Resistance III-10.A Thermal-0verload Protection for Motors of Motor-0perated Valves IV-1.A* Operation With Less Than All Loops in Service IV-2* Reactivity Control Systems Including Functional Design and Protec-tion Against Single Failures V-5 Reactor Coolant Pressure Boundary (RCPB) Leakage Detection V-6* Reactor Vessel Integrity V-10.A Residual Heat Removal System Heat Exchanger Tube Failures V-10.8 Residual Heat Removal System Reliability s V-11.A* Requirements for Isolation of High- and Low-Pressure Systems V-11.B* Residual Heat Removal System Interlock Requirements V-12.A Water Purity of BWR Primary Coolant La Crosse SEP 3-2
[ TOPIC TITLE VI-1* Organic Materials and Postaccident Chemistry VI-2.D* Mass and Energy Release for Postulated Pipe Break Inside Containment VI-3* Containment Pressure and Heat Removal Capability VI-4 Containment Isolation System VI-6 Containment Leak Testing VI-7.A.3 Emergency Core Cooling System Actuation System VI-7.C* Emergency Core Cooling System (ECCS) Single-Failure Criterion and Requirements for Locking Out Power to Valves, Including Independence of Interlocks on ECCS Valves VI-7.C.1 Appendix K--Electrical Instrumentation and Control Re-Reviews VI-7.C.2* Failure Mode Analysis (Emergency Core Cooling System) VI-7.D* Long-Term Cooling Passive Failures (e.g., Flooding of Redundant Components) VI-10.A Testing of Reactor Trip System and Engineered Safety Features, Including Response-Time Testing VII-1.A Isolation of Reactor Protection System From Nonsafety Systems, Including Qualification of Isolation Devices VII-1.B* Trip Uncertainty and Setpoint Analysis Review of Operating Data Base VII-2* Engineered Safety Features System Control Logic and Design VII-3* Systems Required for Safe Shutdown. VII-6* Frequency Decay VIII-1.A Potential Equipment Failures Associated With Degraded Grid Voltage VIII-2* Onsite Emergency Power System (Diesel Generator) VIII-3.A* Station Battery Capacity Test Requirements VIII-3.B DC Power System Bus Voltage Monitoring and Annunciation VIII-4* Electrical Penetrations of Reactor Containment IX-1* Fuel Storage La Crosse SEP 3-3
TOPIC TITLE IX-3* Station Service and Cooling Water Systems IX-5 Ventilation Systems IX-6 Fire Protection XIII-2* Safeguards / Industrial Security XV-1* Decrease in Feedwater Temperature, Increase in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a~ Steam Generator Relief or Safety Valve XV-3* Loss of External Load, Turbine Trip, Loss of Condenser Vacuum, Closure of Main Steam Isolation Valve (BWR), and Steam Pressure Regulator Failure (Closed) XV-4* Loss of Nonemergency AC Power to the Station Auxiliaries XV-5* Loss of Normal Feedwater Flow XV-7* Reactor Coolant Pump Rotor Seizure and Reactor Coolant Pump Shaft Break XV-8* Control Rod Misoperation (System Malfunction or Operator Error) XV-9* Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature, and Flow Controller Malfunction Causing an Increase in BWR Core Flow Rate XV-11* Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position (BWR) XV-13* Spectrum of Rod Drop Accidents (BWR) XV-14* Inadvertent Operation of Emergency Core Cooling System and Chemical and Volume Control System Malfunction ~That Increases Reactor Cool-ant Inventory XV-15* Inadvertent Opening of a PWR Pressurizer Safety / Relief Valve or a BWR Safety / Relief Valve XV-16* Radiological Consequences of Failure of Small Lines Carrying Primary Coolant Outside Containment XV-18* Radiological Consequences of Main Steam Line Failure Outside ) Containment l XV-19* Loss-of-Coolant Accidents Resulting From Spectrum of Postulated Piping Breaks Within the Reactor Coolant Pressure Boundary La Crosse SEP 3-4
TOPIC TITLE XV-20 Radiological Consequences of Fuel-Damaging Accidents (Inside and Outside Containment) XVII
- Operational Quality Assurance Program l 3.2 Topics for Which Plant Design Meets Current Criteria or Was Acceptable on Another Defined Basis As listed in Section 3.1.
3.3 Topics for Which Plant Design Meets Current Criteria or Equivalent Based on Modifications Implemented by the Licensee This section summarizes issues within topics where modifications were made by the licensee during topic review. Other issues of these topics do not meet cur-rent criteria and were considered in the integrated assessment (see Section 4). 3.3.1 Topic III-6, Seismic Design Considerations During topic review, the La Crosse facility was identified as having a potential for site liquefaction in the unlikely event of a postulated safe shutdown earth-quake (SSE) having peak ground acceleration of 0.12g. Liquefaction is a soil phenomenon produced by seismic conditions in soils with insufficient compaction, which may result in loss of support for structures and piping. The licensee was required, by NRC order dated February 25, 1980, to show cause why he should not (1) design and install a site dewatering system at the La Crosse Boiling Water Reactor (LACBWR) to preclude the occurrence of liquefacticn in the event of an earthquake with peak ground surface accelerations of 0.12g or less (2) make the dewatering system operational by February 25, 1981 or place the LACBWR in a safe cold shutdown condition By letter dated August 29, 1980, the staff issued a safety evaluation consider-ing DPC's responses to the NRC order forwarded by letter dated February 25, 1980 and an NRC April 25, 1980 request for additional information. The safety evaluation concluded that the soils under the existing turbine building and the reactor containment are adequately safe against liquefaction effects for an earthquake up to a magnitude of 5.5 with peak ground acceleration of 0.12g. Although the staff concluded that liquefaction remained a concern for the crib house and underground piping, it found that a site dewatering system was not necessary to resolve this concern. It also concluded that the concept of a dedicated safe shutdown system, proposed by the licensee in a letter dated 1The Operational Quality Assurance Program was reviewed according to the cri-teria specified for operating reactors in 1974 (see Appendix A). NRC has recently approved the licensee's Quality Assurance Program by . letter dated February 2, 1983. La Crosse SEP 3-5 l l
August 25, 1980, to preclude reliance on the crib house and underground piping was feasible and that engineering details and installation could be completed by February 25, 1981. The dedicated shutdown system would provide additional assurance that the reactor could be safely shut down by providing sufficient ; river cooling water in the unlikely event that the normal supply capability is j lost because of seismically induced soil liquefaction at the pumps' intake ' structure and buried piping. For the above reasons, the staff concluded that a dewatering system for the LACBWR site was not necessary. The dedicated safe shutdown system, known as the emergency service water supply l system (ESWSS), was operational by February 1981. It consists of three gasoline-driven pumps (and one spare) that are normally stored in the turbine building but can be moved to the river's bank to supply water to effect a safe shutdown in case the other pumps in the crib house are not available. Each pump can deliver 300 gpm at 150 psig, which gives a total capacity of 900 gpm. The ESWSS was accepted by the staff as an alternate to a dewatering system, through issuance of Amendment No. 24 to Provisional Operating License No. DPR-45 in a letter dated February 25, 1981. 3.3.2 Other Modifications The original 137 SEP topics contained issues that were later combined into TMI and other generic issues. The TMI and other generic issues were removed from the integrated assessment review (see Appendices B and C); the progress on these issues will be documented in the supplement to this report. However, the following modifications have been made at La Crosse for some of these issues. (1) Topic Il-1.C, Potential Hazards or Changes in Potential Hazards Due to Transportation, Institutional, Industrial, and Military Facilities An analysis of potential transportation hazards has been completed and hydrogen chloride and ammonia detectors have been installed on the ventila-tion supply to the facility control room, which accomplish isolation if unacceptable concentrations are reached. (2) Topic II-2.B, Onsite Meteorological Measurements Program This topic was expedited following the accident at TMI under NUREG-0578 and other reports. The meteorological measuring system has been modified by establishing a new 10-m tower, modernizing certain instrumentation, and transmitting the information to computer systems that can communicate with the tower remotely. (3) Topic III-6, Seismic Design Considerations The seismic mounting of numerous pieces of electrical equipment has been anchored or strengthened and seismic restraints have been installed on the high pressure core spray lines, both discharge and suction. La Crosse SEP 3-6
(4) Topic VII-5, Instruments for Monitoring Radiation and Process Variables During Accidents Two high-radiation monitors for postaccident situations and grab sampling systems for containment atmosphere, stack gas analysis, and reactor primary fluid analysis have been installed. Also upgraded stack gaseous monitoring equipment has been installed to provide a full range of analysis which is capable of monitoring potential stack releases following an incident. (5) Topic VIII-1.A, Potential Equipment Failures Associated With Degraded Grid Voltage , As a result of a grid voltage study, the taps on the unit and reserve auxiliary transformers were changed. (6) Topic VIII-2, Onsite Emergency Power Systems (Diesel Generator) Diesel testing procedures have been modified to achieve comparability to ' existing standards. (7) Topic IX-6, Fire Protection The following modifications have been made: (a) Sprinklers have been installed in the penetration room and over the 1A diesel generator, transformer, turbine lube oil reservoir, and much of the turbine oil piping. (b) A fire wall has been installed between the turbine lube oil reservoir and certain switchgear. (c) The fire alarm system has been modernized. (d) Hydrogen monitors have been installed on certain batteries. (e) A Halon fire suppression system has been installed in the electrical equipment room. (f) Certain combustible liquids have been removed from the recirculation system in containment. (g) Reactor shielding around control rod drive mechanisms has been replaced with a noncombustible material. (h) Voltage alarms have been installed on the diesel fire system. (i) Penetrations on fire walls have been sealed throughout the plant. (j) A fuel oil transfer cutoff switch in the 1A diesel generator fuel oil supply system has been installed. La Crosse SEP 3-7
(8) Topic XIII-1, Conduct of Operations This topic was deleted from the SEP and incorporated in NUREG-0578 and NUREG-0737 following the TMI accident. The licensee has made revisions to procedures, established procedures by cooperative management that give addi-tional authority to the Shift Supervisor in charge of the plant, formalized the shift turnover, and reviewed training programs. (9) Topic XIII-2, Safeguards / Industrial Security The licensee has instituted a security program including many facility modifications, provision of various means of surveillance, the establish-ment of a well-trained guard force, and the production and implementation of a security plan. 1 1 La Crosse SEP 3-8
4 INTEGRATED ASSESSMENT
SUMMARY
Table 4.1 shows the list of topics considered in the integrated assessment, whether Technical Specification requirements or modifications are needed, whether or not the licensee proposes to modify, and the completion date. It also shows the overall PRA study rating as interpreted by the staff when the issues in a topic were evaluated by the limited PRA study. A more detailed description of each topic with identified differences follows. Implementation schedules have not yet been provided by the licensee. This is consistent with the current status of the staff's integrated assessment review. The licensee will be requested to provide implementation schedules for all plant modifications and procedure review following review by the Advisory Committee on Reactor Safeguards (ACRS) of this draft Integrated Plant Safety Assessment Report (IPSAR). Implementation schedules and any requirements for preimple-mentation design review by the staff will be identified in the final IPSAR for La Crosse. The differences from current licensing criteria identified in this section were derived from staff safety evaluation reports referenced in Appendix E. A limited probabilistic risk assessment (PRA) has been performed for 15 of the SEP topics with identified differences from current licensing criteria, as presented in Appendix D. This risk perspective has been used to judge the importance of the identified differences in relation to accident sequences leading to core melt, with due consideration of the uncertainties in the PRA techniques. In addition, the licensee has performed his own integrated assess-ment, submitted by letter dated February 16, 1983, and has proposed corrective actions to resolve those issues considered significant. The licensee's submittal and limited risk assessment have been evaluated by the staff and used as input to this integrated plant safety assessment. Where the licensee's proposed corrective actions are consistent with or equivalent to the current licensing criteria constitutes the basis for the staff's acceptance. The remai.ning issues were evaluated using the process described in Section 2.4. 4.1 Topic II-1.A, Exclusion Area Authority and Control 10 CFR 100.3(a), as implemented by Standard Review Plan (SRP) Section 2.1.7, requires the licensee to have the authority to determine all activities, including exclusion or removal of personnel and property from the exclusion area. i Two small unoccupied parcels of land are under private ownership with restric-The larger parcel, i tive land easements associated with the La Crosse It is unlikelysite. that these parcels located on a hillside, is steeply graded. will be used for residences or will be occupied. The licensee in a letter dated , 1983, has proposed to submit a revision to the Technical Specifications by , 1983, to state that La Crosse SEP 4-1
the licensee will inform the NRC of any changes in occupancy on the two pri-vately owned land parcels within the exclusion area. The staff finds this proposal acceptable. 4.2 Topic II-3.B, Flooding Potential and Protection Requirements 10 CFR 50 (GDC 2), as implemented by SRP Sections 2.4.2 and 2.4.5 and Regulatory Guide (RG) 1.59, requires that structures, systems, and components important to safety be designed to withstand the effects of natural phenomena such as flooding. The topic evaluation concluded that the probable maximum precipitation-induced load for the roofs of the turbine building and crib house exceeds the original design load. The roofs of the turbine building, the office building (which houses the control room), and the crib house are designed for uniform live loading of 30 lb per square foot (psf). The height of the parapet in these three buildings is 21 in. The resulting maximum live load is 109 psf. If an assumption is made that the roof drains completely plug from the proposed maximum probable precipitation (25.74 in. in 6 hr), roof failure could occur in less than 1 hr after the maximum rainfall. The licensee, in a letter dated February 16, 1983, proposed to put the neces-sary cutouts in the parapet at a height that will restrict the live load from ponded water to less than 30 psf if the drains completely plug. This action will prevent any potential roof failure should the probable maximum precipita-tion ever be reached at this site. This modification is scheduled to be com-pleted by , 1983. The staff finds this action and the pro-
. posed schedule acceptable.
4.3 Topic II-3.8.1, Capability of Operating Plants To Cope With Design-Basis j Flooding Conditions l I 10 CFR 50 (GDC 2), as implemented by SRP Section 2.4.10, requires that struc-l tures, systems, and components important to safety be designed to withstand i the effects of natural phenomena such as flooding. The topic evaluation concluded that emergency procedures and Technic'al Specifi-cation limiting conditions for operation for site flooding and Mississippi River low water level to complement use of the emergency service water supply system to cope with such conditions are not available. The licensee in a letter dated February 16, 1983, proposed to develop emergency procedures to cope with a flood elevation of 658 ft mean sea level (MSL) in addition to 3-ft wind waves to 661 ft, which are consistent with current licensing criteria. The necessary procedures are scheduled to be developed by , 1983. The staff finds this action and the proposed schedule acceptable. 4.4 Topic II-3.C, Safety-Related Water Supply (Ultimate Heat Sink) 10 CFR 50 (GDC 2), as implemented by SRP Section 2.4.11 and RG 1.27, requires that structures, systems, and components important to safety be designed to withstand the effects of natural phenomena such as flooding. La Crosse SEP 4-2
The topic evaluation concluded that the ultimate heat sink function.could be lost because of flooding or Mississippi River low water level resulting from a failure of dams downstream. The licensee has proposed, in a letter dated February 16, 1983, to evaluate the consequences of the events identified in the topic evaluation in conjunction with the development of the procedures described in Section 4.3. In addition, the licensee will propose a Tr.chnical Specification change, if necessary, to identify the alternate cooling water source should the circulating water pump suction be lost for such events. This evaluation will be completed by
. The staff finds this acceptable.
4.5 Topic III-1, Classification of Structures, Components, and Systems (Seismic and Quality) 10 CFR 50 (GDC 1), as implemented by RG 1.26, requires that structures, systems, and components important to safety be designed, fabricated, erected, and tested to quality standards commensurate with the importance of safety functions to be performed. The codes used for the design, fabrication, erection, and testing of the La Crosse plant were compared with current codes. The development of the current edition of the American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code" (ASME Code), has been a process evolving from earlier ASME Code, American National Standards Institute, and other standards, and manufacturer's requirements. In general, the materials of construction used in earlier designs provide comparable levels of safety. The review of this topic identified several systems and components for which the licensee was unable to provide information to justify a conclusion that the quality standards imposed during plant construction meet quality standards required for new facilities. The staff did not identify any inadequate compo-nents. However, because of the limited information on the components involved, the staff was unable to conclude that, for code and standard changes deemed important to safety, the La Crosse plant met current requirements. The staff will require that the licensee complete the evaluations described ' below and incorporate the results in the update of the Final Safety Analysis Report (Allis-Chalmers), which must be submitted within 2 years after comple-tion of the SEP review (10 CFR 50.71). If the results of the licensee's evaluations indicate that facility modifications are required, those actions should be reported to the staff. Radiography Requirements ASME Code, Section III, requires that Category A, B, and C weld joints be radiographed. Furthermore, ASME Code, Section III,1977 Edition, requires that weld joints for Class 1 and 2 piping, pumps, and valves be radiographed. Because information was not available during the topic review, the staff con-cluded that the licensee should verify that (1) the control rod drive housing, (2) Class 2 and 3 vessels for which Code Case 1273N was not invo hd and having welded joint thicknesses less than 1 in., and (3) Class 1 and 2 piping and valves designed only to American Standards Association (ASA) 831.1 have been La Crosse SEP 4-3
I radiographed or subsequently volumetrically inspected. If neither has been done, the licensee should perform a volumetric inspection. Fracture Toughness ASME Code, Section III, imposes minimum fracture toughness requirements on certain carbon steel components. For 49 of the 72 components reviewed, the information was not sufficient to complete this review. The licensee should identify whether the remaining components, identified in the Franklin Technical Evaluation Report (TER) C5257-437 appended to the staff's Safety Evaluation Report (SER) forwarded by letter dated June 7, 1982, are exempt from fracture toughness requirements (i.e., austenitic stainless steel or other criteria). The licensee should perform an evaluation of those items that are not exempt from current fracture toughness requirements to determine if toughness of the material for the remaining components is sufficient to pre-clude brittle failure and, if it is not, evaluate the consequences and demon-strate acceptability or replace the components. Piping The current Class 1 piping design requirements are given in ASME Code, Section III, NB-3600. Calculations similar to those presented in Examples 1 and 2 in Section 4.2, Appendix A, of TER CS257-437, applicable to La Crosse plant design parameters, should be performed on a sampling basis to assess the impact of the usage factor of gross discontinuities in Class 1 piping systems for a medium and large number of cyclic loads. Valves Current ASME Code, Section III, design requirements regarding body shapes and Service Level C stress limits for Class 1 valves and pressure-temperature ratings for Class 2 and 3 valves are different from those used when the plant was designed. Sufficient information was not available during the topic review to assess the valves in the above-stated areas. The licensee should verify, on a sampling basis, that Class 1 valve stress limits meet current criteria for body shape and Service Level C conditions and that the pressure-temperature ratings of Class 2 and 3 valves are comparable to current standards. Valves designed to ASA B16.9 and ASA B16.10 should be evaluated against the current requirements. If current criteria are not met, the licensee should take appropriate corrective action (analysis or upgrading). Pumps None of the nine pumps reviewed were designed to Section VIII of the ASME Code. The topic evaluation concluded that codes, code classes, editions, code cases, and design calculations should be provided for all pumps in the La Crosse plant. Proof of compliance with current fatigue analysis requirements for current Class 1 pumps (the recirculation system pumps) should be established. The licensee should evaluate the design standards used for these pumps in relation to current design standards and identify whether adequate safety margins exist. La Crosse SEP 4-4
Storage Tanks Compressive stress requirements for atmospheric storage tanks and tensile stress requirements for 0- to 15 psig storage tanks designed to ASME Code, Section VIII (1962), or American Water Works Association (AWWA) D-100 (1959) differ from those of Section III, Class 2 and 3, of the current ASME Code. Sufficient information was not available during the topic review to assess the significance of these changes for the tanks designed to earlier ASME Code editions or other code editions. The licensee should evaluate the margins of safety for (1) atmospheric storage tank compressive stresses (2) 0- to 15 psig storage tank biaxial tensile stress field conditions (3) tanks designed to AWWA D-100 4.6 Topic III-2, Wind and Tornado Loadings 10 CFR 50 (GDC 2), as implemented by SRP Sections 3.3.1, 3.3.2, and 3.8 and RGs 1.76 and 1.117, requires, in part, that safety-related structures, systems, and components be adequately designed to resist wind and tornado loadings, includ-ing tornado pressure drop loading. In the staff's topic evaluation, it was concluded that portions of some structures cannot withstand the postulated design-basis tornado loads of 360-mph winds and a 3.0 psi pressure drop. In the topic evaluation forwarded by letter dated January 27, 1983, the staff recommended that the licensee (1) implement modifications for the following structures to meet the design-basis tornado loads (a) containment (stability) (b) ventilation stacks (Genoa Unit 3 and La Crosse boiling-water reactor) (c) crib house (d) turbine building (e) control room (f) discharge structure (g) diesel generator building (h) electrical penetration room (2) demonstrate that the consequences of their failure if subjected to tornado loads are acceptable (3) demonstrate adequate resistance for smaller tornado loadings and that the risk associated from larger tornado loadings is acceptable for all Category I structures and structures whose failure can affect Category I structures Further, the topic evaluation recommended that, for safety-related components not inside qualified structures, the licensee should demonstrate (1) accepta-bility for tornado wind loads or (2) that the consequences of failure of these structures if subjected to tornado loads are acceptable. The licensee should demonstrate that foundation anc soil capacities are not more limiting than the La Crosse SEP 4-5
values reported in the licensee's safety analysis report of August 6, 1981, or the staff's safety evaluation report forwarded by letter dated January 27, 1983. Further, it should be determined whether structures at La Crosse possess suf-ficient strength to resist straight wind loading in combination with other loads (e.g. , operating pipe reactor loads, thermal loads, and snow loads). The staff will require that the licensee complete the evaluations described below: (1) Determine the capability of the structures, systems, and components neces-sary to ensure the ability to reach safe shutdown to withstand the NRC-determined 10 4 and 10 5 upper 95% confidence limit windspeed. (The upper 95% confidence limit windspeed is to be used to compensate for inaccuracy in determining hazard probabilities.) (2) Determine the plant modifications necessary to protect against both windspeeds. (3) Estimate the cost of any necessary modifications for each value of windspeed. (4) Perform a cost / benefit analysis to support a determination of which modifications should be made. This evaluation is scheduled to be completed and a schedule for any necessary plant modifications will be identified by 1983. The staff finds this proposal acceptable. 4.7 Topic III-3.A, Effects of High Water Level on Structures 10 CFR 50 (GDC 2), as implemented by SRP Sections 3.4 and 3.8 and RG 1.102, requires, in part, that plant structures be designed to withstand the effects of flooding. The safety objective of this topic is to ensure the functions of safety-related structures subject to hydrostatic or hydrodynamic loading as a result of design-basis water levels when combined with other nonaccident loadings. ,The staff's review of this topic identified the following three areas of concern. 4.7.1 Containment Stability The topic Safety Evaluation Report forwarded by letter dated December 13, 1982, asked the licensee to identify the calculated factors of-safety against gross sliding and overturning for the containment. The licensee in a letter dated February 14, 1983, stated that the factor-of-safety for gross sliding was 2.1 and for overturning it was 2.2, both of which are above the criterion of 1.5 in SRP Section 3.8.5. However, the staff has not had an opportunity to audit the assumptions and analysis techniques used to derive those factors. That evaluation will be described in the final version of this report. La Crosse SEP 4-6
d 4.7.2 Stack Stability An assessment was not completed during the topic evaluation to determine if the stack would collapse under design-basis flooding level (DBFL) load combina-tions and what the consequences would be for Category I structures. The licensee, in a letter dated February 14, 1983, proposed to review stack stability for DBFL load combinations in conjunction with other stack-related topics in Sections 4.6, 4.13, and 4.14 to determine the limiting conditions. The results are scheduled to be submitted to the NRC by , 1983. The staff finds this proposal acceptable. 4.7.3 Crib House The crib house structure was not evaluated during topic reviews. An alternate system to provide water for shutdown is the emergency service water supply system. The licensee is developing any necessary changes to the emergency procedures to ensure safe shutdown capability should normal cooling be unavail-able (Section 4.3). Therefore, the staff considers this issue resolved. 4.8 Topic III-3.C, Inservice Inspection of Water Control Structures 10 CFR b0 (GDC 1, 2, and 44) and 10 CFR 100 (Appendix A), as implemented by SRP Sections 2.5.4 and 2.5.5 and RGs 1.27, 1.28, 1.59, 1.127, and 1.132, require, in part, that water control structures built for use in conjunction with a nuclear power plant be inspected routinely. The safety objective is to ensure that water control structures that are part of the ultimate heat sink are available at all times during both normal and accident conditions. The topic review identified the following issues. A formal inspection program for the water control structures using the method-ology in RG 1.127 has not been established. The structures that are considered water control structures are the crib house and the bank slope containing rip-rap facing the river. The plant can achieve safe shutdown without the use of the diesel-driven or electrically driven pumps in the crib house. This can be done through the use of three gasoline-driven pumps (and one spare), known as the emergency service water supply system, stored in the turbine building. Procedures for use of these pumps will be upgraded as necessary, as described in Section 4.3; therefore, the need to have the crib house inspected to the requirements of RG 1.127 is not as critical as if it were the only cooling path. The rip-rap protected bank sl. ope facing the river has been reviewed under SEP Topic ;I-4.0, " Slope Stability," and has been found to be stable. The licensee, in a letter dated February 16, 1983, has proposed to develop a program to inspect the crib house visually which will not require a pumpdown, special operational procedures or divers. The inspection will include the crib house, its foundation, intake screens, sheet piling side wdlls, outfall seal well, the rip-rap condition in the vicinity of the plant, and the sheet piling used for weed diversion. An appropriately detailed checklist will be developed and the inspection program will be conducted under the direction of the La Crosse La Crosse SEP 4-7
staff experienced in inspection practices. A current file of engineering drawings for the crib house will be kept on site. Inspection reports will be prepared and available for offsite reference. The proposed inspection frequency is every 2 years. These procedures are scheduled to be developed by , 1983, and the first inspection shall begin by , 1983. The staff finds this proposal acceptable. 4.9 Topic III-4.A, Tornado Missiles 10 CFR 50 (GDC 2), as implemented by RG 1.117, prescribes structures, systems, and components that should be designed to withstand the effects of a tornado, including tornado missiles, without loss of capability to perform their safety functions. RG 1.117 specifies that structures, systems, and components that should be protected from the effects of a design-basis tornado are (1) those necessary to ensure the integrity of the reactor coolant pressure boundary, (2) those necessary to ensure the capability to shut down the reactor and main-tain it in a safe shutdown condition (ongoing hot standby and cold shutdown) and (3) those whose failure could lead to radioactive releases resulting in calculated offsite exposures greater than 25% of the guideline exposures of 10 CFR 100 using appropriately conservative analytical methods and assumptions. The physical separation of redundant or alternate structures or components required for the safe shutdown of the plant is not considered acceptable by itself for providing protection against the effects of tornadoes, including tornado generated missiles, because of the large number and random direction of potential missiles that could result from a tornado as well as thd need to consider the single-failure criterion. In the topic evaluation forwarded by letter dated November 29, 1982, the staff identified the following structures, systems, and components that do not meet current criteria for tornado-missile protection: (1) reactor coolant pressure boundary (2) shutdown condenser (3) manual depressurization and alternate core spray (4) emergency service water supply system (5) demineralized water storage tank (6) diesel generators (turbine building and diesel generator building) (7) 125-V dc bus (8) control room (9) waste disposal building (10) high pressure service water The topic evaluation found that the containment is adequately protected against tornado missiles, which in a design-basis tornado are characterized by a maximum windspeed of 360 mph, except for the containment dome, which consists of only a 0.60-in.-thick steel shell. It was found that the steel dome could withstand penetration by a steel rod at velocities below 245 mph. Using the results from SEP Topic II-2.A, this windspeed has a probability of exceedance ) in 1 year of approximately 5 x 10 8 using the upper 95th percentile confidence interval value. The staff concludes that this probability is sufficiently Icw that the following essential equipment, which is located inside the containment, should be considered adequately protected against tornado missiles: La Crosse SEP 4-8
(1) reactor coolant pressure boundary (Item #1) (2) shutdown condenser structure, though not its cooling water supply (Item #2) (3) manual depressurization system (Item #3) The staff will require that the licensee provide protection against tornado missiles for a sufficient number of systems and components to ensure a safe shutdown. The licensee in a letter dated February 16, 1983, proposed to develop a detailed procedure and provide necessary modifications and/or system modifications for shutting the plant down using the OHST, HPCS, 1A emergency diesel generator, 4 and decay heat blowdown line and for ensuring that Fire Department equipment can provide long-term cooling. The concept described by the licensee involves the discharge of primary coolant outside containment to systems that are not protected against tornado missiles and a decay heat removal method (i.e., feed and bleed of a BWR) that has not been analyzed or tested. Therefore, the staff will require that the licensee demonstrate the ability to remove decay heat using such methods, demonstrate the adequacy of the proposed procedures, justify the need for potential release of primary coolant to the environment, and compare the proposed method with alternative decay heat removal techniques that would , not require such a release. 4.10 Topic III-4.B, Turbine Missiles 4 10 CFR 50 (GDC 4), as implemented by RG 1.115 and SRP Sections 2.2.3 and 3.5.1.3, requires that structures, systems, and components important to safety be appropriately protected against dynamic effects, which include potential missiles. The safety objective of this review is to ensure that all of the structures, systems, and components important to safety (identified in RG 1.117) have adequate protection against potential turbine missiles because of either structural barriers or a high degree of assurance that failures at design or destructive overspeed will not occur. There are three generating plants with turbine complexes at the La Crosse site. Genoa Unit 1 is an oil-fired plant with a capacity of 14 MWe. Its turbine is located about 950 ft from LACBWR (also known as Genoa Unit 2). The turbine of Unit 1 is not favorably oriented with regard to LACBWR; that is, the axes of its four turbine generators are parallel to Genoa Unit 2. The turbines of Genoa Unit 2 and Genoa Unit 3 (a coal-fired plant) have their axes perpendicular to the nuclear plant, and the containment building is outside the low trajectory turbine missile strike zone of either of these plants. The licensee's safety analysis was prepared in accordance with licensing criteria in effect at the time of the review (March 5, 1982) which based the , probability of unacceptable damage resulting from turbine missiles (P4) as the product of (1) the probability of turbine failure resulting in the ejection of a turbine disk (or internal structure) fragment through the turbine casing (P1) La Crosse SEP 4-9
(2) the probability of ejected missiles perforating intervening barriers and striking safety-related structures, systems or components (P2) (3) the probability of struck structures, systems, or components failing to perform their safety functions (P3) The licensee's analysis found, using these criteria, that the probability of unacceptable damage resulting from turbine missiles (P4) for the nuclear plant (Genoa Unit 2) was within the guidelines of SRP Section 2.2.3. Subsequent to the licensee's analysis, the NRC revised the acceptance criterion for determining the unacceptable damage resulting from turbine missiles to one of determining the probability of turbine failure resulting in ejection of a turbine disk through the turbine casing (P1). This approach, which emphasizes turbine reliability, improved regulation of turbine generator system reliability and reduced the analytical burden placed on the licensee. This shift of emphasis relies on volumetric (ultrasonic) examination techniques suitable for inservice inspection of turbine rotors (without the need for removing the disks from the shaft) and for determining probabilities of turbine-missile generation. These methods are (1) to relate disk design, materials properties, and inservice volumetric inspection to the design overspeed missile-generation probability and (2) to relate overspeed protection characteristics and stop and control valve design and inservice inspection and test intervals to the destructive overspeed missile generation probability. Following NRC acceptance of generic methods and procedures, the manufacturer provides to applicants and licensees tables of missile generation probabilities versus time (inservice volumetric disk inspection interval for rated speed or design over-speed failure, and inservice valve testing interval for destructive overspeed failure) for their particular turbine, which are then used to establish inspec-tion schedules. Applicants and licensees with turbines from manufacturers who have not yet submitted reports to the NRC describing their methods and procedures for calculating probabilities of turbine-missile generation or who have sub-mitted reports, which are still being reviewed by the NRC, are expected to meet the interim criteria, regardless of turbine orientation, which may be found in Section IV.C.1 of the NRC SER forwarded by letter dated January 27, 1983. The integrated assessment for this topic found that the ability to safely shut down the nuclear plant adequately protects the plant against turbine missiles for the following reasons: (1) The staff, in the SER forwarded on January 27, 1983, found acceptable the licensee's inservice inspection program and schedule for ensuring the integrity of the LACBWR turbine rotors acceptable and concluded that the design overspeed missile generation probability is sufficiently low to meet the safety objectives. (2) The licensee has stated, in a letter dated December 27, 1982, that the high pressure and low pressure disks and rotors at Genoa Units 2 and 3 are of integral construction made from solid forgings. Unlike the builtup-type rotor common to large low pressure elements, which consist of disks shrunk onto a shaft, the integral-type rotor is not expected to be particularly susceptible to stress corrosion cracking and brittle failure. La Crosse SEP 4-10 i
(3) The probability of P4 for Genoa Units 2 and 3, causing unacceptable damage to Genoa Unit 2 which would prevent safe shutdown of the reactor, is accept-ably low because of the turbine orientation with regard to containment. (4) The probability of P4 for Genoa Unit 1, causing unacceptable damage to Genoa Unit 2 which would prevent safe shutdown of the reactor, is within the acceptance guidelines of SRP Section 2.2.3. The licensee, in a letter dated April 11, 1983, has proposed to compare the valve inspection and testing for the overspeed protection systems at Genoa Units 2 and 3 with the NRC interim criteria described in Section IV-C-2 of the topic Safety Evaluation Report of January 27, 1983, and either justify the ade-quacy of his present program or propose modifications to the valve inspection and testing program to ensure the functional performance of the overspeed pro-tection. The staff finds this proposal acceptable. 4.11 Topic III-5.A, Effects of Pipe Break on Structures, Systems, and Components Inside Containment 10 CFR 50 (GDC 4), as implemented by RG 1.46 and SRP Section 3.6.2, requires, in part, that structures, systems, and components important to safety be appro-priately protected against dynamic effects such as pipe whip and discharging fluids that may result from equipment failures. The safety objective of this topic is to ensure that if a pipe should break inside the containment, the plant can be safely shut down without a loss of containment integrity and that the break would pose no more severe conditions than those analyzed in the design-basis accidents. The topic evaluation concluded that the La Crosse plant is adequately protected against the dynamic effects of pipe break inside containment, except for the following areas which require further evaluation: (1) clarification concerning the effects of jet impingement and pipe whip motion on mitigating systems (2) confirmation that the portion of the steel vessel not protected by the 9-in. concrete would not be damaged by any postulated high-energy-line breaks (3) installation of a valve on the decay heat cooling system blowdown line to the main condenser and administrative controls to maintain it in a closed position during power operation (4) acceptability of damage to control rod drive mechanisms from postulated high-energy-line breaks (5) resolution of postulated breaks in boron injection system piping damaging the containment ventilation exhaust damper operators (6) justification of the design adequacy of anchor bolts for the existing pipe whip restraints in the alternate core spray lines La Crosse SEP 4-11
The licensee in a letter dated February 16, 1983, agreed with all but Item (3) of the staff's positions and has stated that the evaluations listed above will be performed and submitted by , 1983. With regard to Item (3), the licensee proposed to relocate a manual isolation valve, 56-24-009, outside containment on penetration M-17 (see Section 4.21.2.3) and to leave this valve open and develop procedures to close'this valve in the event of an accident. The topic SER found that the manual isolation valve , should be closed because GDC 55 criteria apply to this penetration; because this line is nonessential, the present criteria can be met by an automatic valve on the outside or by keeping the manual valve on the outside closed. The valve cannot remain closed as originally proposed in the SER because the penetra-tion has other lines that are used during normal operation for steam trap drains and shutdown condenser condensate leg drains. The valve, 56-24-009, shall be relocated and the procedures implemented by , 1983. The staff finds this proposal acceptable. 4.12 Topic III-5.B, Pipe Break Outside Containment 10 CFR 50 (GDC 4), as implemented by SRP Sections 3.6.1 and 3.6.2 and Branch Technical Positions (BTPs) MEB 3-1 and ASB 3-1, requires, in part, that struc-tures, systems, and components important to safety be designed to accommodate the dynamic effects of postulated pipe ruptures. The safety objective of this topic review is to ensure that if a pipe should break outside the_ containment, the plant can be safely shut down without a loss of containment integrity.. The staff's SER concluded that the plant is adequately protected from the dynamic effects of pipe break outside containment subject to resolution of the following in the integrated plant safety assessment. 4.12.1 Clarification of Pipe Whip Damage Criteria and Jet Impingement Model During the topic evaluation, the staff could not determine what pipe whip dam-age criteria and jet impingement model were used in the licensee's SEP reevalua-tion of the effects of pipe break outside containment as described in the licensee's report of June 29, 1981. The staff requested clarification of the assumptions used in the evaluation of the effects of postulated pipe breaks with respect to the jet impingement model, pipe whip damage criteria, and pipe motions caused by the dynamic effects of postulated pipe breaks. The licensee, in a letter dated Feb'ruary 16, 1983, proposed to provide addi-tional clarification of the pipe wnip dacaage criteria and jet impingement model. This clarification will be submitted by , 1983. The staff finds this acceptable. 4.12.2 Verification of Potential Releases From thelWorst High-Energy-Line Break The topic evaluation dated August 12, 1982, concluded that if the main steam line breaks outside containment (between the containment and the outboard isolation valve) and the main steam isolation valve (MSIV) inside containment fails to operate, the reactor system would blow down to essentially atmospheric pressure. Consequently, the topic evaluation requested that the licensee La Crosse SEP 4-12
verify that the potential releases from the worst high-energy-line break (i.e., steam line) with single failure of the inboard isolation valve do not exceed 10 CFR 100 guidelines. - Current criteria for such piping p'enetrations rely cn short piping runs between the containment and outboard isolation valve, high quality standards for the piping, and low stresses in the penetration to preclude the potential for such an uncontrolled release of primary coo l ant. However, the topic evaluation did Not include the quality of, and stresses in, the main steam piping penetration. The PRA rated the significance of this issue low because the expected frequency of a pipe break between the containment and the outboard isolation valve and a failure of the inboard isolation valve is relatively small, approximately 10 8/ reactor year when compared with the core-melt frequencies associated with many nuclear power plants. An event with a frequency of 10 8/ reactor year would not be expected to contribute significantly to the risk resulting from core melt at the LACBWR. Therefore,tbestaffconcludesthatastudytodeterminethepotentialreleases from a staam-line break and a failure of the inboard MSIV is not warranted. 4.12.3 Failure of~ Steam Heating System in Electrical Equipment Room The hot water conwrter system in the electrical equipment room was presumed to be a live steam system in the topic evaluation. The SRP criteria state that
'for a system to oe considered a high-energy line, the operating temperature must exceed 200 F'or the maximum operating pressure must exceed 275 psig. The operating pressure of this system is 15 psig and the maximum operating temper-ature is between 180 F and ISO F. Therefore, the' staff considers this issue resolved and further analysis is not necessary.
4.13 Top _ic III-6, Seismic Design Considerations 10 CFR 50 (GDC 2), as implemented by SRP Sections 2.5, 3.7, 3.8, 3.9, and 3.10 and SEP review criteria (NUREG/CR-0098, " Development of Criteria for Seismic Review of Selected Nuclear Power Plants"), requires that structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes. The scope of the licensee's evaluations did not conform with that required by the SEP criteria. Consequently, several deficiencies and open items have been identified in topic evaluation analyses.
- The licensee, in a letter dated February 7, 1983, submitted an analysis of many of the open items identified in the staff SER forwarded by letter dated November 19, 1982.
The staff,has reviewed the analyses of the issues addressed in the licensee's letter of February 7,1983 and has found that the following structures, piping, and electrical-and mechanical components have not been adequately addressed for the reasons stated in the staff SER forwarded by letter dated April 5, 1983. La Crosse SEP 4-13
Structures (1) Evaluate adequacy of the in-structure response spectra (input to the subsystem evaluation) generated from containment building analysis. (2) Evaluate structural integrity of the overhead water storage tank. (3) Evaluate design adequacy of turbine building, penetration room, and 18 diesel building. (4) Evaluate dynamic stability and design adequacy of stacks (LACBWR stack and Genoa 3 stack). (5) Complete the analyses of all masonry walls adjacent to the safety-related piping systems and associated electrical / instrumentation equipment and upgrade them, if necessary. Piping Systems The criteria, modeling techniques, analysis methods, and load combinations used for the licensee's evaluation are considered to be acceptable. However, the open items listed below were identified during the course of the staff review and additional information should be provided: (1) Evaluate adequacy of seismic input (in-structure response spectra) for ' the analyses and design adequacy of supports of recirculation, main steam, feedwater, shutdown condenser vent, and manual depressurization lines. (2) Complete the analysis of high pressure service water line, alternate core spray line, emergency service water supply system, and main steam piping between the two containment isolation valves, and upgrade, if necessary. Electrical Equipment (1) Evaluate the structural integrity of all safety-related cable trays and upgrade if necessary. (2) The following equipment has been found to need anchorage and bracing by the licensee and the staff agrees with the implementation approach pro-posed by the licensee (see staff SER of , 1983, Attachment 5). (a) generator battery rack (b) 480-V essential bus (c) reactor battery rack (d) battery charger (e) IA diesel starting battery rack (f) IB diesel generator control panel (g) IB diesel generator building electrical equipment (h) reactor water level transmitter Nos. 1 and 2 (i) auxiliary distribution panel for 125-V dc generator plant bus (j) electrical equipment room modification La Crosse SEP 4-14
Mechanical Components (1) Shutdown condenser--there was improper modeling of the saddle supports, and no evaluation of the internals was performed. (2) Shutdown condenser platform--some structural members were found to be overstressed and no evaluation was done for the connections. (3) Diesel fuel oil tank--the evaluation of structural integrity of both the 1A and IB tanks and the 1A tank support has not been performed. The tank 1B support is adequate. (4) Reactor vessel (including supports) and control rod drive mechanism--no evaluation was performed. The licensee has proposed in the letter dated February 7, 1983, to evaluate the above items by one or more of the methods listed below: (1) Perform a study to determine the consequence of system failures and assess the potential impact on the health and safety of the public if such systems are not modified to resist seismic events. Determine an effective heat removal method which would be upgraded to provide for the reactor safe shutdown. (2) Perform analysis on the sy; tem to determine the as-built capability to withstand an SSE. (3) Perform a system walkdown. Using a piping handbook method, restrain the system using good engineering judgment and verify that thermal margins are i not unacceptably affected by the additional restraints. This evaluation shall be submitted by . The licensee also proposed, in the letter dated February 7,1983, to perform a simplified analysis of the control rod drive mechanisms and to make any necessary modifications to ensure control rod drive insertion for a seismic event. The control rod drive analysis shall be submitted by . The staff finds these proposals acceptable. 4.14 Topic III-7.B, Design Codes, Design Criteria, Load Combinations, and Reactor Cavity Design Criteria 10 CFR 50 (GDC 1, 2, and 4), as implemented by SRP Section 3.8, requires that structures, systems, and components be designed for the loading that will be imposed on them and that they conform to applicable codes and standards. Code, load and load combination changes affecting specific types of structural elements have been identified where existing safety marg. ins in structures are significantly reduced from those that would be required by current versions of the applicable codes and standards. Thirty-four specific areas of design code changes potentially applicable to the La Crosse plant have been identified in the topic evaluation for which the current code requires substantially greater La Crosse SEP 4-15
safety margins than did the earlier version of the code, or for which no original code provision existed. The significance of the identified code changes cannot be assessed until a plant-specific review of their applicability, as well as of margins in the original design, is completed. This does not infer that existing structures have inadequate safety margins. The review, however, will clarify if the original margins are comparable to those currently specified and will include consideration of the appropriate applied loads (e.g., roof loading resulting from probable maximum precipitation and snow) and load combinations. To address the concerns under this topic, the licensee, in a letter dated February 16, 1983, proposed to perform, on a sampling basis, an evaluation of the code, load, and load combination issues on existing structures at the La Crosse facility in order to assess the adequacy of the as-built structures. In addition, the licensee proposed to consolidate structural issues raised under other SEP topics,and address them as part of the review of this topic in an inte-grated structural assessment program. Structural capacity issues raised under SEP Topics II-3.8, III-2, III-3.A, III-4.A, and III-6 and the issues discussed above will be included in this program. The results of this evaluation and a schedule for any necessary corrective actions will be submitted by , 1983. The staff finds this approach te resolve these issues acc,eptable. 4.15 Topic III-8.A, Loose-Parts Monitoring and Core Barrel Vibration Monitoring 10 CFR 50 (GDC 13), as implemented by RG 1.33, Revision 1, and SRP Section 4.4, requires a loose parts monitoring program for the primary system of light-water-cooled reactors (LWRs). La Crosse does not have a loose parts monitoring program that meets the criteria of RG 1.133. A loose parts monitoring program could provide an early detection of loose parts in the primary system that could help prevent damage to the primary system. Such damage relates primarily to (1) damage to fuel cladding resulting from reheating or mechanical penetration (2) jamming of control rods (3) possible degradation of the component that is the source of the loose part to a such level that it cannot properly perform its safety-related function Modification of a loose parts monitoring program is being considered in Revi-sion 1 to RG 1.133. If the staff decides to implement the recommendations of this revision, then the need to implement a loose parts monitoring program at operating reactors will be addressed generically. The following factors were considered in making the recommendation that no modifications be done at this time: (1) A 1982 staff study indicates that only 21 of a total of 52 representative r loose parts incidents resulted in interference of moving components or further structural damage. Although two loose parts incidents (Prairie l Island Un t 1 in October 1979 and Ginna in January 1982) resulted in steam i La Crosse SEP 4-16
generator tube rupture, neither of the incidents resulted in a significant release. (2) Most loose parts can be detected during refueling inspections. (3) The limited probabilistic risk assessment (PRA) of this issue for La Crosse concluded that eliminating loose parts-induced transients by installing a loose parts monitoring system would have little effect on core melt fre-quency and rated this issue as one of low safety significance. Modification, therefore, is not required at this time. 4.16 Topic III-10. A, Thermal-Overload Protection for Motors of Motor-0perated Valves 10 CFR 50.55a(h), as implemented by Institute of Electrical and Electronics ' Engineers (IEEE) Std. 279-1971 and 10 CFR 50 (GDC 13, 21, 22, 23, and 29), requires that protective actions be reliable and precise and that they satisfy the single-failure criterion using quality components. RG 1.106 presents the staff position on how thermal-overload protection devices can be made to meet these requirements. The topic evaluation for LAC 8WR concluded that thermal-overload devices on valve operators are not bypassed by emergency core cooling (ECC) activation 4 signals, nor is there justification available to support adequacy of trip setpoints. Further, torque switches are used to terminate valve travel and are not bypassed. The alternate core spray system in conjunction with the manual depressurization system provides a low pressure cooling injection system to back up the normal i heat removal methods. Failure of actuation of other protective devices would ( have to occur to prevent use of the main steam system, decay heat system, shut-down condenser, and high pressure core spray system before the need to use the alternate core spray system is considered. This system has never been used for its safety function in the life of the plant. All active components and boundary check valves are checked periodically as part of the plant's Technical Specifica-tions. In the event that the alternate core spray system is required to operate, only one of the two motor-operated valves, 38-30-001 or 38-30-002, must function to pass the required flow because they are in parallel in the piping system. The valve motor operators are designed to minimize common-mode failure and increase system reliability because valve 38-30-001 uses an ac motor and valve 38-30-002 uses a de motor. Valve travel can be terminated by either the torque or limit switch because they are in series in both the opening and closing control circuit. The thermal overloads have fixed setpoints. These valves are i located in the turbine building and are readily accessible from the control i room during a postaccident condition. Both valves have manual handwheels and could be manually opened locally. Two lights for each valve are located in the control room and are used to indicate close, open, and intermediate valve posi-I tion to provide immediate feedback to the operators. In addition, alternate core spray flow is displayed in the control room. The alternate core spray valves are tested under load during refueling outages, and because of the relative location of the valves in the auxiliary building, La Crosse SEP 4-17
k I the environment during testing is roughly equivalent to that which would exist
. following an accident. During the integrated assessment, the staff determined 4 ,
that the thermal-overload devices have' fixed setpoints (dc--4.2 amps and ac--1.5 l amps) which are sufficiently greater than the operating current (both approxi-mately 1 amp) to allow for uncertainties in the environmental conditions. Moreover, both valves can be opened manually by handwheel, and there is suf-ficient shielding in the area to permit such manual operation. The PRA rated the significance of this issue low because the reduction in the failure rates for the motor-operated valves achieved by bypassing the thermal overload would not have any significant effect on core-melt risk. 4 Modification is not required. 4.17 Topic V-5, Reactor Coolant Pressure Boundary (RCPB) Leakage Detection 10 CFR 50 (GDC 30), as implemented by RG 1.45 and SRP Section 5.2.5, prescribes the types and sensitivity of systems and their seismic, indication, and testa-bility criteria necessary to detect leakage of primary reactor coolant to the containment or to other interconnected systems. RG 1.45 recommends that at . least three separate leak detection systems be installed in a nuclear power plant to detect unidentified leakage of 1 gallon per minute (gpm) from the RCPB to the primary containment within 1 hr. Leakage from identified sources must be isolated so that the flow of this ieakage may be monitored separately from unidentified leakage. The detection systems should be seismically qualified and it should be possible to check them in the control room. Of the three separate leakage detection methods recommended, two of the methods should be (1) sump level and. flow monitoring and (2) airborne particulate radioactivity monitoring. The third method may be either monitoring the con-
- densate flow rate from air coolers or monitoring airborne gaseous radioactivity.
Other detection methods--such as monitoring humidity, temperature, or pressure-- should be considered to be indirect indications of leakage to the containment. In addition, provisions should be made to monitor systems that interface with i the RCPB for signs of intersystem leakage by methods such as monitoring radio-activity and water levels or flow. The topic evaluation for LACBWR concluded that the types of leakage detection 4 systems incorporated for measurement of leakage from the reactor coolant pres-sure boundary to the containment meet the minimum recommendation of RG 1.45. However, none of the incorporated systems have been shown to be able to detect
- a 1 gpm leak within 1 hr and none have been seismically qualified.
i 4.17.1 Leakage Sensitivity Although the licensee does not explicity calculate a leak rate so that 1 gpm would be detected within an hour, the leakage detection sensitivity is con-sidered acceptable for the following reasons: (1) The accumulation of water in the retention tank is recorded every 4 hr, and the leakage rate to containment is calculated at least once every i 24 hr. Generally, the total accumulation of water in containment is at a rate less than the Technical Specification limit of unidentified leakage. La Crosse SEP 4-18 i _ _ _ . _ , _ . - - _ , , , ,m. , _, .__
If the total leak rate to retention tank approaches the unidentified leak-age rate limit, then known (identified) sources of water are measured and a search for unidentified leakage is initiated. Moreover, the level set-point on the retention tank is set so that it would alarm in the control room within an hour if the leakage were 1 gpm or greater, regardless of when the leakage is calculated. (2) An airborne particulate monitor is in operation to monitor the air exhausted from the lower reactor cavity for 20 out of 24 hr a day. It is used on the upper reactor cavity for the other 4 hr. Another airborne particulate monitor is continuously in operation to check the air exhausted from the two forced-circulation pump cubicles. The exhaust air from the recirculation pump cubicles is routed through high-efficiency particulate air filters and is exhausted from the containment building. The output of each of these monitors is displayed on a strip chart recorder in the control room. Activity is logged every hour and a leak rate greater than 1 gpm can be readily detected. If the activity has inexplicably increased on either monitor, the leak rate is then calculated; in any case, it is calculated at least once a day. The licensee believes that the airborne particulate monitors have sufficient sensitivity to correlate to a 1 gpm leak rate within 1 hr. The PRA rated the significance of this issue low because detection of a 1 gpm leak in 1 hr would have little or no effect on the LOCA frequency. On the basis of these consideration, the staff concludes that modification is not required. 4.17.2 Seismic Qualification The detection systems do not meet the recommendations of RG 1.45 with regard to the seismic qualification. The need for any corrective action associated with the lack of seismic capability will be reviewed in conjunction with the resolu-tion of Tcpic III-6, " Seismic Design Considerations." The licensee has proposed in a letter dated April 11, 1983 to either seismically qualify the primary leakage detection system or develop procedures which will identify the actions to be taken following a seismic event and the failure of the leakage detection equipment. Such procedures would specify the operator i actions to be taken to ascertain the operability of leakage detection systems and, when leakage detection is unavailable, any subsequent actions necessary to place the reactor in a cold shutdown. The staff finds this proposal acceptable. 4.18 Topic V-10.A, Residual Heat Removal System Heat Exchanger Tube Failures 10 CFR 50 (GDC 46), as implemented by SRP Section 9.2.2, requires the testing of cooling water systems by providing auxiliary cooling water system design features which permit operational functional testing of the system and its components. The topic evaluation concluded that the Technical Specifica-tions do not adequately address the measurement of contaminant inleakage into the primary system from secondary water sources. The likelihood of leakage into the primary system from either (or both) the decay heat removal or component cooling water (CCW) heat exchangers is small, given the relatively small amount l l La Crosse SEP 4-19
of time that primary pressure is low enough that inleakage could occur (i.e., plant shutdown). Existing means of automatic indication and alarm to detect inleakage is the CCW surge tank low level alarm. Another means of detecting l inleakaga is to monitor the sight glass on the surge tank, which is done twice every shif t. The primary system conductivity is also monitored by a chart recorder connected to conductivity cells in the primary purification system piping. This is also considered a reliable indication of any leakage into the 4 primary system. The significance of this issue is low, according to the limited PRA study, because it has no effect on the calculated core-melt frequency. The licensee has committed to review and upgrade, as necessary, the Technical Specification requirements related to primary water purity (see Section 4.20). The staff concludes that this action is sufficient to resolve the identified concern. 4.19 Topic V-10.8, Residual Heat Removal System Reliability 10 CFR 50 (GDC 19 and 34), as implemented by SRP Section 5.4.7, BTP RSB 5-1, and RG 1.139, requires that the plant be taken from normal operating conditions to cold shutdown using only safety grade systems, assuming a single failure, and utilizing either onsite or offsite power through the use of suitable procedures. 4.19.1 Use of Safety-Grade Systems for Safe Shutdown The topic evaluation concluded that the plant operating / emergency procedures for conducting a plant shutdown and cooldown using only safety grade systems are not fully developed. The licensee has developed and implemented operating / emergency procedures for conducting a plant shutdown and cooldown, which include the use of " safe shut-down systems" as well as other systems that may be available for use during various conditions that may exist. Because the emergency procedures already address shutdown procedures and because use of any method for cooling the reactor reduces the risk of core-melt events, the limited PRA found that use of safety grade systems only was of low significance. Moreover, the licensee is developing improved emergency procedures under TMI Action Plan Item I.C.9 which will cover all of the available equipment to miti-gate an accident. Therefore, the staff concludes that no further action is necessary, l 4.19.2 Shutdown Condenser Shell-Side Level Control A single failure of the shutdown condenser shell-side level control could disable the condenser. This issue was reviewed during the limited PRA and it was concluded that, in the PRA analysis of other BWRs, the failure of a shutdown condenser has proven to be a significant contributor to the core-melt frequency. Because of this La Crosse SEP 4-20 l
_= - . . -. . and a potential reduction of the shutdown condenser failure probability by approximately two orders of magnitude, the issue was judged to be of high risk significance. The licensee, in a letter dated February 16, 1983, has proposed to add a second level controller by , 1983. The staff finds this acceptable. 4.19.3 Additional Emergency Procedures The topic evaluation concluded that procedures may be needed to address provis-ions for demineralized water from Unit 3 and the use of the manual depressuriza-tion system and alternate core spray as backup cooling methods, in case the shutdown condenser level controller fails. During.the integrated assessment, the staff found that the use of the alternate core spray system and manual depressurization system as a means of heat removal / pressure control is adequately addressed in the major primary leak procedure, which was modified following the Three Mile Island accident. The limited PRA found that the dominant failure of the demineralized water system from Unit 3, for supplying water to the shutdown condenser, is the failure of the demineralized water inlet valve to the shutdown condenser. The additional water supply from Unit 3 would not significantly reduce the pro-bability of~ failure of the demineralized water system. Modification is therefore not required. , 4.20 Topic V-12.A, Water Purity of BWR Primary Coolant 10 CFR 50 (GDC 14), as implemented by RG 1.56, requires that the reactor coolant pressure boundary (RCPB) have minimal probability of rapidly propagating failure. This includes corrosion-induced failures from impurities in the reactor coolant system. The safety objective of this review is to ensure that the plant reactor coolant chemistry is adequately controlled to minimize the possibility of corrosion-induced failures. The topic reviaw identified the following issues. 4.20.1 Chloride and pH Limits The present limits on chloride concentration do not meet the recommendations of l RG 1.56 and there are no pH limits. The licensee, in a letter dated February 16, l 1983, has proposed to submit a revision to the Technical Specifications by
, 1983, to include chloride and pH limits in accordance with those of RG 1.56. The staff finds this proposal acceptable.
4.20.2 Conductivity Limits The present limits on conductivity do not meet the recommendations of RG 1.56. ! The licensee, in a letter dated February 16, 1983, has proposed to reestablish conductivity limits following a review of the primary coolant cleanup system capability. The new limit and sampling frequency will be included in a Tech-nical Specification revision to be submitted by , 1983. The staff finds i this proposal acceptable. l f La Crosse SEP 4-21
4.21 Topic VI-4, Containment Isolation System GDC 55, 56, and 57, as implemented by RG 1.141, establish explicit requirements for isolation provisions in lines penetrating the containment. Specifically, they address the number and location of isolation valves (e.g., redundant valving with one located inside containment and the other located outside con-tainment), valve actuation provisions (e.g, automatic or remote manual isola-tion valves), valve position (e.g, locked closed or the position of greater safety in the event of an accident or power failure), and valve type (e.g., a simple check valve is not a permissible automatic isolation valve outside containment). The topic evaluation identified differences between the plant design and current licensing criteria as described in the following sections. The limited PRA study performed an analysis of penetrations 4 in. or more in diameter, as discussed in Appendix D, to determine the change in unavailability of the present system configuration and the unavailability of a system configured to current criteria. Penetrations less than 4 in. were not evaluated because they were not considered significant to risk in terms of possible containment leakage for core-melt events (WASH-1400 (USAEC), Appendix II, Section 5.12). GDC 55 and 56 permit alternate containment provisions for specific classes of lines. The following sections describe the other. defined bases by which the staff h'as judged the existing containment isolation provisions or in some cases those changes proposed by the licensee compared with containment isolation requirements for new plants. These judgments are based on an assessment of the improvement in isolation capability and whether substantial additional protec-tion would result. The staff qualitatively considered the expected cost of backfitting the penetration to conform to current licensing criteria. These judgments were supplemented by the risk perspective described above. 4.21.1 Valve Location 4.21.1.1 Penetrations M-8 and M-11, High-Pressure Service Water and Demineralized Water Lines The isolation provided penetrations M-8 and M-11 (3-in. penetrations)--the high-pressure service water (HP5W) and demineralized water lines, respectively--does not meet the criteria of GDC 56 with regard to valve location. (1) Penetration M-8, High-Pressure Service Water Line The service water system divides inside containment into essential and nonessential loads. The first isolation valve inside containment is a check valve, 75-26-003, which is leak tested. Beyond that the system divides to provide service water to essential and nonessential systems. The essential loads inside containment are the shell side of the shutdown i condenser and backup water to the suction of the high pressure core sp-ay pumps. The line going to the shell side of the shutdown condenser has a check valve and a makeup control valve, which provides additional isola-tion for this line. The suction to the high pressure core spray pumps has been placed out of service; that is, the valve is closed and power to its operator has been disconnected. It can only be activated if it is decided that the high pressure service water to the high pressure core La Crosse SEP 4-22
spray pumps be used--an action govarned by procedure. The nonessential loads for postaccident conditions have an automatic isolation valve which isolates them. The first valve outside containment is a manual valve, 75-24-069. This valve may not be accessible-during LOCA conditions involving core degrada-tion because of a high radiation environment. Another manual valve, 75-24-083, is located beyond the first valve,in this line. In addition, three fire headers, which are essentially closed, branch off from the HPSW line between valves 75-24-069 and 75-24-083. The licensee, in a letter dated February 16, 1983, proposed to develop procedures with necessary instructions to an operator to isolate this system manually should there be an indication of failure of the system coincident with failure of the isolation check valves inside containment. These procedures shall be developed by , 1983. The staff finds this acceptable. (2) Penetration M-11, Demineralized Water System Line The demineralized water system also divides inside containment into essen-tial and nonessential systems. The first isolation valve inside contain-ment is a check valve, 67-26-001, which is leak tested. In a postaccident situation there are only two essential loads. One is the makeup to the overhead storage tank which provides water to the suction of the high-pressure core spray system which is part of the emergency core cooling system. The makeup valve in the line to the overhead storage tank is 69-25-001. In series with this makeup valve is a check valve, 69-26-002; thus, at least double-valve isolation is provided between the overhead storage tank, which is open to the containment building atmosphere, and the portion of this system piping outside containment. The second essen-tial load is the makeup to the shell side of the shutdown condenser. The shutdown condenser shell side does not communicate with the containment atmosphere. This line, in addition to the principal containment isolation check valve, has an automatically controlled makeup valve, 62-25-018. In series with this makeup valve is a check valve, 62-26-002. The nonessen-tial loads inside containment have triple-valve isolation between the containment and the loads, that is check valve 67-26-001, automatic isola-tion valve, 67-25-001, and another check valve in series. The staff finds that there are a sufficient number of valves on the lines inside containment so that installation of a remotely operated containment isolation valve outside containment will not significantly improve the containment isola-tion capability. Modification is not required. 4.21.1.2 Penetration M-21 and M-31, Vent Exhaust Damper and Ventilation Supply Lines The isolation provisions for penetrations M-21 and M-31 (20-in. lines)--the vent exhaust damper and the ventilation supply lines, respectively--do not meet i the criteria of GDC 56. These lines have two automatic valves inside contain-ment. Current criteria would require one of the automatic valves be outside containment. Modification is not necessary because: La Crosse SEP 4-23
i (1) The PRA study ranked the significance of this issue low because placing the signal-actuated valve on the outside of containment would only ovide a small reduction in the present system unavailability of 5.6 x 10-i j (2) The single-failure criterion for the valves is satisfied even though both ; valves are inside containment. '
- (3) The two valves on penetr,ation M-21 are leak tested.
4.21.1.3 Penetration M-23, Resin Sluice to Atmosphere The isolation provisions for penetration M-231(l'-in. line)--the resin sluice , to atmosphere--do not meet the criteria of GDC 55. This line has locked-closed j valves, which are leak tested, inside containment but no valve,outside contain-ment. An automatic valve or a locked-closed valve outside containment would be required to meet current criteria. 4 The licensee, in a letter dated February 16, 1983, proposed to place under pro-cedural control a new manual valve being installed under a current modification to the waste treatment building, to ensure that this valve will be closed in I the event of an incident in containment while resin transfer is in progress. i The valve will normally be locked closed at other times. The valve is scheduled , to be installed by 1983, and the procedure shall also be available by that date.
- The staff finds this acceptable.
4.21.1.4 Penetration M-34, Shutdown Condenser Atmospheric Vent The isolation provisions for penetration M-34 (14-in. line)--shutdown condenser i atmospheric vent--do not meet the criteria of GDC 57. Remote manual isolation valves are available inside containment to shut off high pressure service water I and demineralized water; however, to meet current criteria a remote manual isolation valve would be required on the vent line that goes outside containment. l This penetration vents the shell side of the shutdown condenser to the atmosphere
- (see Figure V-10.B-1, p. 36, of Appendix D). The release of reactor coolant F is possible if any of the 348 (5/8-in.-diameter) tubes of the shutdown condenser i rupture. Two automatic valves in parallel control the flow of primary coolant to the tubes. These valves leak; however, the leakage rate has not been specifically quantified.
Therefore, a path for a possible radioactive release to the atmosphere through penetration M-34 is through a condenser tube rupture. Given that event and a single failure of either one of the automatic control valves, 62-25-001 or 62-25-011, to close on command could result in an uncontrolled release of primary coolant ou?. side containment. If one of the automatic valves failed to close on command, a backup manual valve, either 62-24-001 or 62-24-036, could be used to isolate flow to the isolation condenser. In addition, there is a radiation monitor in the vent line and the shutdown condenser tube bundle is hydrostatically tested approximately once a year. La Crosse SEP 4-24
The limited PRA rated the significance of this issue as low because placing a remotemanualisolationvalveoutsidecontainmentwouldonigprovideasmall reduction of the present system unavailability of 4.4 x 10 . However, that evaluation did not consider the potential for, or consequences of, a tube rupture event as described above. The staff concludes that the hydrostatic testing of the isolation condenser provides adequate assurance of the integrity of the tube sheet. Even if tube rupture were to occur, there is sufficient indication available to alert the operator to terminate the event. Although the offsite doses for such an event have not been explicitly calculated, the staff judges that the consequences are bounded by other accident sequences. Further, the probability of a tube rupture coincident with a major LOCA (forced circulation pump seal failure), which could produce significant fuel failures, is estimated to be 1 x 10 7 On this basis, the staff concludes that modifying the penetration to include an automatic isolation valve is not warranted. 4.21.1.5 Penetration 1-A, Alternate Core Spray High-Pressure Service Water Line The isolation provisions for one of the lines at penetration 1-A (6-in. line)-- the alternate core spray high pressure service water line--do not meet the criteria of GDC 55. This line has two check valves inside and one manual valve outside containment. Because this line is essential, a remote manual valve outside containment would be required by current criteria. The staff concludes that modification of this line is not necessary because: (1) The single-failure criterion for the valves is satisfied even though both check valves are located inside containment. (2) The PRA study determined that the system unavailability would increase over the present arrangement (i.e., it would be less reliable). 4.21.1.6 Penetration 1-A, Containment Building Drain Suction Line The isolation provisions for one of the lines at penetration 1-A (4-in. line)-- the containment building drain suction line--do not meet the criteria of GDC
- 56. This line has two locked-closed valves outside containment. Because this line is nonessential, current criteria would require that one of the locked-closed valves should be inside containment.
The staff concludes that modification of this line is not necessary because the PRA study found that the system unavailability would not change by moving one of the locked-closed valves inside. 4.21.2 Valve Type 4.21.2.1 Penetrations M-9 and M-10, Component Cooling Water Lines The isolation provisions for penetrations M-9 and M-10 (10-in. lines)--the component cooling water lines--do not meet the criteria of GDC 57. These lines La Crosse SEP 4-25
have manual valves outside containment. Because these lines are essential, a remote manual valve outside containment would be required by current criteria. The component cooling water line is currently leak tested because it may poten-tially contain radioactive materials in a postaccident situation in accordance with NUREG-0578. This test consists of pressurization of the system and a visual inspection for leaks on the portion of the piping outside the contain-ment building. This test also includes soap-bubble testing of welded and threaded connections to determine leakage up to and including the first isola-tion valve in each line. The PRA study ranked the significance of this issue low because use of a remote manual valve would only provide a small reduction in the present system unavail-ability of 4 x 10 7 There are four manual valves, 57-24-001, 57-24-003, 57-24-006, and 57-24-008, which are accessible to an operator in the turbine building that can isolate these lines outside containment. The licensee has proposed in a letter dated February 16, 1983, to include pro-cedures to close these valves based on the component cooling water surge tank level alarm. These procedures shall be developed by , 1983. The staff finds this acceptable. 4.21.2.2 Penetration M-12, Control Air System Line The isolation provisions for penetration M-12 (1 -in. line)--the control air system line--do not meet the criteria of GDC 56. This line has one check valve inside containment and a check valve and a manual valve on the two branch lines outside containment. The manual valve serves to isolate the emergency air compressor. Because this line is essential, a remote manual valve outside containment would be required by current criteria. The staff concludes that modification of these valves is not warranted because: (1) The inside and outside check valves are series leak checked. (2) The control air pressure is nearly twice the expected maximum calcuated containment pressure, that is, 75 psig compared with 43.5 psig. (3) The manual valve line is only a 1-in. line. (4) The limited PRA concluded that the isolation reliability would not be significantly improved by adding a remote manual valve. 4.21.2.3 Penetration M-17, Decay Heat Removal Line The isolation provisions for penetration M-17 (2-in. penetration)--the decay heat removal line--do not meet the criteria of GDC 55. This line has two automatic valves in parallel inside containment that are leak tested 'and a manual valve outside containment. Because this line is nonessential, the present criteria can be met by an automatic valve on the outside or by keeping the existing manual valve on the outside locked closed. The licensee has proposed, in a letter dated February 16, 1983, to move the manual valve (56-24-009), which is currently outside containment but not acces-sible during a core-damage accident, to a position on the line further from the La Crosse SEP 4-26
containment wall where it would be accessible and to develop procedures to close this valve in the event of a loss-of-coolant accident. Moving valve 56-24-009 into a location where it can be reached after a core-damage accident will add to the containment boundary the 3/4-in. discharge line from the process water transfer pump. This line has a check valve, 56-26-002, followed by a normally closed manual valve, followed by a normally locked-closed manual valve. The check valve and the valves behind it would then become part of the leak test boundary. The valve, 56-24-009, will be relocated and the procedures for its closure implemented by , 1983. The staff finds this acceptable. 4.21.2.4 Penetration M-18, Seal Injection Line The isolation provisions for penetration M-18 (1 -in. line)--the seal injection line--do not meet the criteria of GDC 56. This line has a check valve on the inside and a check valve on the outside of containment. Because this line is nonessential, an automatic valve on the outside of containment would be required to meet current criteria.' Modification of this line is not recommended because other limited PRA studies show that the isolation reliability would not be sig-nificantly improved by replacing a check valve with an automatic valve. Addi-tionally, leak testing is performed on both check valves in series. 4.21.2.5 Penetration M-28, Reactor Cavity Purge Air Line - The isolation provisions for penetration M-28 (1-in. line)--the reactor cavity purge air line--do not meet the criteria of GDC 56. This line has a check valve outside the containment, which is leak tested, and a manual valve inside the containment. Because this line is nonessential, an automatic valve inside and outside containment or a locked-closed valve inside and outside containment, or a combination, thereof, would be required to meet current criteria. The reactor cavity purge air system provides supply air into the lower reactor cavity to provide accurate primary system leak rate detection on the radiation monitor and humidity monitors at the discharge of the cavity. Because the line is only a 1-in. line and the check valve provides equivalent isolation to that currently required for an instrument line (R.G.1.11), the staff concludes that modification is not required. 4.21.2.6 Penetration M-29, Offgas Vent to Chimney The isolation provisions for penetration M-29 (3-in. line)--the offgas vent to chimney--do not meet the criteria of GDC 56. This line has an automatic valve inside containment and a remote manual valve outside containment. Because this is a nonessentic; line, an automatic isolation valve or a locked-closed valve outside containment would be required by current criteria. i The licensee, in a letter dated February 16, 1983, has proposed to require by procedure that the remote manual valve, 55-25-004, outside containment be closed in the event it is open and an automatic closure signal is sent to the inside valve, 55-25-003. The procedure is scheduled to be developed by
, 1983. The staff finds this acceptable.
La Crosse SEP 4-27
- 4.21.3 Valve Type and Locked-Closed Valves t
j 4.21.3.1 Penetration M-13, Station Air Line i j The isolation provisions for penetration M-13 (1 -in. line)--the station air line--do not meet the current criteria of GDC 57. This line has one check i valve inside containment and a manual valve outside. Because this line is non-essential, an_ automatic valve would be required or the existing manual valve. on the outside should be locked closed to meet the current criteria. l The check valve inside'the containment building is currently leak tested. The licensee in a letter dated February 16, 1983, has proposed to lock close the manual valve, 70 24-30, outside containment and only open this valve under certain limited operations within the containment building. This modification is scheduled to be completed by , 1983. The staff finds this
- acceptable.
4.21.3.2 Penetration M-19, Offgas Vent From Shutdown Condenser The isolation provisions for penetration M-19 (1-in. line)--offgas vent from the shutdown condenser--do not meet the criteria of GDC 55. Inside containment, - this line has four feeders. One feeder has an automatic valve, 62-25-003, which i is in accordance with criteria, two other feeders have closed manual valves (55-24-101 and 62-24-005), and the fourth has an open manual valve (62-28-013). Current criteria would require that the manual valves be locked closed. Outside containment there is only one manual valve. Because this is an essential line, current criteria would require a remote manual valve outside containment. i The licensee in a letter dated February 16, 1983, has proposed to lock close manual valves 55-24-101 and 62-28-013 inside containment and to install a remotely operated solenoid valve in the pipe tunnel outside containment. These modifications are scheduled to be completed by , 1983. The staff finds , this acceptable. 4.21.3.3 Penetrations M-22, M-25, and M-27, Waste Water Lines The isolation provisions for penetrations M-22, M-25, and M-27 (1 -in. lines)-- the waste water lines--do not meet the criteria of GDC 56. These lines have locked closed valves inside containment backed up by a common isolation valve, which is automatically initiated, but only manual valves outside containment,
- .which are normally open and not accessible during a LOCA. Because these lines
-are nonessential, an automatic valve or a locked-closed valve outside contain-ment would be required to meet current criteria. , The licensee, in a letter dated February 16, 1983, proposed the following:
(1) Penetration M-22 The outside manual valve, 54-24-179, will be maintained in a normally locked-closed position and opened only under a controlled procedure to
'. transfer waste water.
1 i 4 i La Crosse SEP 4-28 i 1
(2) Penetration M-25 The outside manual valve, 54-24-162, will be maintained in a normally locked-closed position. Its use will be limited and controlled by administrative procedure. (3) Penetration M-27 The outside manual valve, 54-24-160, will be maintained in a normally locked-closed position. These modifications shall be completed by
, 1983. The staff finds this acceptable.
4.21.3.4 Penetration M-26, Heat Injection Supply and Return Lines The isolation provisions for dual-use penetration M-26 (4-in. and 1\-in. lines)--the heat injection supply and return lines, respectively--do not meet the criteria of GDC 57. The supply line has a check valve and the return line has an automatic valve outside containment. Both of these valves are leak tested. The difference from current criteria is that the supply line should have an automatic valve or a locked-closed valve. The return line is accept-able under GDC 57 criteria. Modification of the supply line is not recommended because the limited PRA ranked the significance of this issue low since an automatic valve instead of a check valve would only provide a small reduction in the present system unavailability. The licensee, in a letter dated February 16, 1983, has proposed to maintain manual valves 73-24-009 and 73-2,4-057 in these lines normally locked closed as a backup to the check valve and the automatic valve. The modifications are scheduled to be completed by , 1983. The staff finds this acceptable. 4.21.4 Instrument Lines The following instrument lines do not meet the provisions of RG 1.11 in that they do not have an excess flow check valve. (1) M-1A--supplies containment building pressure switch, which activates annunciator C4-4, containment building isolation, emergency core system pump, and a high pressure service water diesel start. (2) M-28--supplies containment building pressure to the annunciator in the control room, also provides high pressure service water systems start and high pressure core spray systems start representing the redundant signal i to low reactor water level to the high pressure core spray system. (3) M-14 and M provide level indication for the containment building to the operator in the control room. These penetrations must perform their design functions after an accident to provide the operator with the necessary information required to mitigate possible core-damage accidents. The staff concludes that the installation of local manual valves or excess flow checks for these instrument lines is not warranted for the following reasons: La Crosse SEP 4-29
)
(1) These lines mor.itor essential containment parameters that should not be automatically isolated. Any logic circuit that would automatically isolate these lines could introduce spurious isolation and cause the loss of vital safety information. (2) Several risk assessments have shown that containment leakage from small penetrations is of low importance to risk. Modification is not required. 4.21.5 Insufficient Indication for Operation of Remote Manual Valves SRP Section 6.2.4.11.6.q states, on the basis of GDC 54, that manual isolation valves are acceptable if provisions are made to allow the operator in the main control room to know when to isolate fluid systems containing them. Such pro-visions may include instruments to measure flow rate, sump water level, tempera-ture, pressure, and radiation level. It was not apparent from the licensee's response whether these provisions are available. The licensee, in a letter dated February 16, 1983, proposed to develop proce-dures that will contain the conditions under which remote manual valves will be closed identified in the plant procedures. These procedures are scheduled to be developed by , 1983. The staff finds this acceptable. 4.22 Topic VI-6. Containment Leak Testing 10 CFR 50, Appendix J, requires that tests be performed to ensure that leakage through the primary reactor containment and systems and components penetrating primary containment shall not exceed allowable leakage rate values as specified in the Technical Specifications or associated bases. The licensee's request to continue to test containment airlocks every 4 months does not satisfy the requirements of Appendix J to 10 CFR 50. A reduced pres-sure test of airlock door seals or other positive means to verify the integrity of the seals within 72 hr of opening or every 72 hr during periods of frequent s openings is necessary to satisfy the testing requirements of Appendix J. In the approximately 15 years that the La Crosse containment airlock door seals have been tested (every 4 months), the tests have not detected a failed door seal caused by seal degradation or damage resulting from airlock use. The failures that have occurred were due to improper testing or damage which resulted from the test. The PRA rated this issue to be of low significance, as described in Appendix D, because the probability of excessive laakage through the airlock is small in comparison to the overall probability of excessive containment leakage. Each airlock door has a single seal. The volume of the airlock is such that even a low pressure test would require approximately 24 hr so that meaningful results could be obtained. In view of the favorable testing experience, the staff concludes that a modification to provide the capability to perform a leakage test every 72 hr is not warranted. The licensee has proposed in a letter dated , to perform a visual inspection of all airlock door seals within 72 hr of each opening, but La Crosse SEP 4-30
I not more than every 72 hr, and to replace seals periodically in accordance with the manufacturer's recommendations. These Technical Specification changes are scheduled to be submitted by , 1983. The staff finds this acceptable. 4.23 Topic VI-7.A.3, Emergency Core Coolina System Actuation System 10 CFR 50.55a(h), as implemented by IEEE Std. 279-1971, and 10 CFR 50 Appendix A (GDC 37), as implemented by PG 1.22, requires that equipment important to safety be tested periodically to ensure the operability of the system as a whole and to verify, under conditions as close to design as practical, the performance of the full operational sequence that brings the system into operation, including the operation of the associated cooling water system. The emergency core cooling system actuation system is tested in accordance with Test Procedures 17.5.1 and 17.5.2. These procedures fullfill the requirements for emergency core cooling system acutation tests but are not currently required by Technical Specifications. The licensee has submitted in a letter dated September 29, 1982, a proposed revision to the LACBWR Technical Specifications, which incorporates Test Procedures 17.5.1 and 17.5.2 into the Technical Specifica-tions surveillance requirements. The staff finds this acceptable. 4.24 Topic VI-7.C.1, Appendix K - Electrical Instrumentation and Control Re-Reviews 10 CFR 50 (GDC 17), as implemented by SRP Sections 8.2 and 8.3 and RG 1.6, requires that redundant load groups and the redundant standby electrical power sources be independent at least to the extent that, if means exist for manually connecting redundant load groups, at least one interlock should be provided to prevent an operator error that would parallel their standby power sources. In two cases, the design of the La Crosse onsite ac power systems allows the manual connection of redundant load groups without interlocks to prevent paralleling of redundant ac power sources.
-The first case involves the ability to manually connect, without interlocks, Class 1E 480-V buses 1A and 1B, by closing breakers 452TBA on bus 1A and Weaker 452TBB on bus 2B. The second case involves the ability to connect the same buses as before, without interlocks, if the following sequence occurs.
If dc-ac inverter 1B fails, a static switch in the inverter automatically transfers the power source for the 120-V ac noninterruptible bus 18 to the diesel bus 480-V motor control center. If two normally open circuit breakers on the turbine building 120-V regulated bus are closed, then Class IE 480-V buses 1A and 1B will be tied together. 4.24.1 480-V Essential Buses 1A and 1B The licensee, in a letter dated February 16, 1983, has proposed to evaluate a design for an interlock that will prevent either breakers '452TBA or 452TBB from closing if both diesel generators are supplying their respective essential buses, and if the tie breaker is already closed, it will trip if the second diesel generator output breaker closes. This interlock will prevent paralleling of La Crosse SEP 4-31
the two diesel generators. The evaluation shall be submitted by July 1983, and any necessary modifications shall be installed by , 198T , The staff finds this acceptable. 4.24.2 120-V AC Circuit Breakers
- In the second case, an interlock to prevent paralleling the 480-V buses 1A and 1B is not recommended for the following reasons:
(1) Section 21.4 of the operating procedures is specific in its instructions as to the sequence for opening and closing the breakers. In this case two breakers would have to be left in a closed position after the static inverter is serviced and reenergized to tie the buses together. (2) Before the static inverter is taken out of service for repair or placed back into service, it is necessary to momentarily parallel the two buses to prevent deenergizing and reenergizing safety instrumentation which would cause automatic actions of other safety system.s. (3) The PRA rated the significance of this issue as low because the frequency of total loss of ac power caused by the closing of specific manual breakers and paralleling of diesel generators was less than the frequency of loss of total ac power caused by loss of offsite power combined with the common-mode failure of the diesel generators. Modification is not required. 4.25 Topic VI-10.A, Testing of Reactor Trip System and Engineered Safety Features, Including Response-Time Testing 10 CFR 50 (GDC 21) requires that the reactor protection system (RPS) be designed to permit periodic testing of its functioning, including a capability to test channels independently. 10 CFR 50.55a(h), through IEEE Std. 279-1971 and IEEE Std. 338-1971, requires that response-time testing be performed on a periodic basis for plants with construction permits issued after January 1,1971. The nuclear power range instrumentation is not calibrated in a manner that addresses all important parameters (e.g., feedwater temperature). The response of the plant to an overcooling transient may be affected if the nuclear power range instrumentation is not properly calibrated. However, from previous PRA studies, as described in Appendix D, overcooling transients do not contribute significantly to the risk for core-melt accidents. Additionally, a simplified PRA analysis of the RPS showed that the loss of the nuclear instrumentation , trip signal would not significantly affect the reliabilit.y of the RPS and, l l therefore, the PRA rated this issue to be of low risk significance. As a result of a previous operating experience, the licensee had developed a design change which would consider the current inaccuracies that are seen when , feedwater temperature deviates from its normal operating value. The licensee
- proposed, in a letter dated February 16, 1983, installation of a modification l to one power range channel for the fall 1983 outage if the necessary hardware La Crosse SEP 4-32
1 can be obtained. Pending successful testing and operation of this design, one or more of the additional power range channels will be modified in subsequent refueling outages. The staff finds this proposal acceptable. 4.26 Topic VII-1.A, Isolation of Reactor Protection System From Nonsafety Systems, Including Qualification of Isolation Devices 10 CFR 50.55a(h), through IEEE Std. 279-1971, requires that safety signals be isolated from nonsafety signals and that no credible failure at the output of an isolation device shall prevent the associated protection system channel from meeting the minimum performance requirements specified in the design bases.
. 4.26.1 Channel Isolation The analog signals from the nuclear flux intermediate and power range flux monitoring sensors and the reactor pressure, reactor water level, and reactor power-to-forced-circulation sensors are not isolated from the process recorders and remote indicating meters.
These sensor circuits provide the operator with information required for safe operation of the reactor core and provide inputs to the RPS to ensure that preset limits are not exceeded. Because of the safety significance of these circuits, the licensee in a letter dated April 11, 1983, has proposed to demon-strate by analysis and/or tests that a single failure (defined in IEEE Std. 279-1971, Sec. 4.2) in any one of the process recorders will not propagate and disable the RPS. The analysis and/or test results are scheduled to be submitted by , 1983. The staff finds this proposal acceptable. The in<licating meters do not affect the isolation of the RPS because they are on separate circuits so that there are no apparent common-mode-failures, and the meters are manufactured to the same quality standards as the other RPS components; therefore, they do not have to be analyzed or modified. The PRA found that although some reduction of the RPS unavailability is possible by isolating the nonsafety components, it may not result in a reduction of the scram failure probability. According to NUREG-0460, the common-mode failure of control rods failing to insert results in a scram failure probability in the range of 3 x 10 5/ demand based on actual operating experience. This failure mode will not be reduced by the recommended changes and, therefore, the overall scram failure probability would not be significantly changed. 4.26.2 Qualification as Class 1E Equipment The topic evaluation concluded that power supplies for the RPS channels do not qualify as Class 1E equipment. The qualification programs for Class 1E equipment are designed to ensure that equipment will operate under normal and accident conditions. At La Crosse the power supplies for the RPS channels are not subject to the LOCA environment. Therefore, operating and testing experience can be used to demonstrate suitable environmental qualification. La Crosse SEP 4-33
With regard to* seismic qualification, the staff has initiated a generic program to develop criteria for the seismic ~ qualification of equipment in operating plants as an unresolved safety issue (USI A-46). Under this program, an explicit set of guidelines (or criteria) will be developed and used to judge the adequacy of seismic qualification (both functional capability and struc-tural integrity) of safety-related mechanical and electrical equipment at all operating plants. Past operating experience indicates that the power supplies do not pose a safety problem and their quality is similar to that of other electrical equipment at i.a Crosse. Modification is not required. 4.26.3 Isolation Between Reactor Protection System Channels and Power Supplies The topic evaluation concluded the isolation between each RPS channel and its power supply is inadequate. Inadequate isolation between the power supply and the RPS channels could lead to common-mode failures. The licensee in a letter dated April 11, 1983, has proposed to demonstrate by analysis and/or test which RPS channels have inadequate power supply isolation and to correct identified deficiencies. The analysis and/or test results shall be submitted by , 1983. The staff finds this acceptable. i 4.26.4 Power Source For Scram Channels A single power source is common to all three scram channels. Although failure of the power source would scram the reactor, other types of power system malfunctions, such as overvoltage or underfrequency, could cause relays to hang up and prevent a scram. The PRA found that the unavailability of the RPS because of a power system failure of 5.4 x 10 5 is relatively high. Separating one of the scram logic channels onto an independent redundant bus would decrease the unavailability to 3 x 10 9 Therefore, on the basis of the assumptions made in the PRA analysis, the unisolated failure of the RPS power supply is of high risk significance. The licensee, in a letter dated February 16, 1983, proposed to separate the two r full-scram channels. The partial-scram channel and one of the full-scram chan-nels would remain on a single power source. The modification is scheduled to be completed by , 1983. The staff finds this proposal acceptable. 4.26.5 Isolation of Range Common Modules 'l The topic evaluation concluded that range common modules are used in Channels 5 and 6. Their locations with regard to the interface between nonsafety and ' safety equipment is not adequately documented. Some form of isolation may be required. During the integrated assessment the staff found that the range change modules ' in Channels 5 and 6 are physically separate modules and are electrically isolated. Modification is not required. 1 La Crosse SEP 4-34
4.27 Topic VIII-1.A, Potential Equipment Failures Associated With Degraded Grid Voltaae 10 CFR 50 (GDC 17) requires an offsite electric power system to provide func-tioning of systems and components important to safety. The topic is being evaluated generically through Multiplant Actions (MPAs) B-23, " Degraded Grid Voltage Protection for Class 1E Power Systems," and B-48, " Adequacy of Station Electrical Distribution Voltages." The purpose of this topic is to ensure that a degradation of the offsite power system will not result in the loss of capability of redundant safety-related equipment and to determine the susceptibility of such equipment to the inter-action of onsite and offsite emergency power sources. The resolution of MPA B-23 is to determine the grid characteristics and to provide a suitable system to isolate the plant from the grid in the event of grid voltage degradation. The purpose of MPA B-48 is to determine the minimum acceptable bus conditions that will then define the setpoint for the degraded grid protection system. The licensee has committed to revise Technical Specifications to account for deficiencies found in the review of MPA B-23. Additionally, in the review of MPA B-48 it was determined that taps on the reserve auxiliary transformer needed to be changed for the offsite power system and onsite distribution system to be capable of providing acceptable voltages at the terminals of the Class 1E equipment for the worst-case station electric load and grid voltages. The tap setting was changed to the 70725-V tap on January 7, 1981. The remaining open items from the topic evaluation are as follows. 4.27.1 480-V Buses 1A and 18 The systems analysis for degraded grid voltage was performed with the bus-tie breaker 452 BT, which ties the two 480-V nonessential buses lA and 1B, in the open position. If this breaker was closed and both 480-V essential and non-essential buses were supplied by only one 2,400/480-V transformer (normally supplied by two transformers of equal capacity), a degraded grid voltage could result if emergency loads were suddenly placed on the grid. The staff concludes that the potential for and consequences of this condition are low for the following reasons: (1) A Technical Specification currently exists (4.2.3.2.1) which prohibits breaker 452 BT from being closed except under hot or cold shutdown or refueling. (2) A Technical Specification currdntly exists (5.2.10.1.1.1) which calls 5 for the inspection of the status of these breakers every 7 days. (3) The status of breaker 452 BT is available in the control room and if it is closed an alarms sounds. (4) Undervoltage relays will trip the breakers on the nonessential buses and begin transfer to onsite power. La Crosse SEP 4-35
(5) The plant can be shut down without offsite or onsite power by the use of two diesel-driven pumps or an emergency service water supply system con-sisting of three gasoline-driven pumps to achieve cold shutdown. Therefore, modification is not required. 4.27.2 Single Source of Offsite Power There is only one source of offsite power. This is contrary to GDC 17, which assumes multiple sources of offsite power and requires two paths from the switchyard to the onsite distribution system. The intent of GDC 17 is to be able to shut down on loss of one of the offsite sources (or paths) and the onsite generation. This intent is achieved at La Crosse because the plant can be shut down without any offsite power and also without the two diesel generators. Shutdown can be accomplished'through the use of two diesel-driven pumps or an emergency service water supply system consisting of three gasoline-driven pumps and one backup, gasoline-driven, to achieve cold shutdown. However, during the 10 losses of offsite power at la Crosse, the diesel or gasoline-driven pumps never had to be used to achieve a safe shutdown. 4.28 Topic VIII-3.B, DC Power System Bus Voltage Monitoring and Annunciation 10 CFR 50.55a(h), through IEEE Std. 279-1971, and 10 CFR 50 (GDC 2, 4, 5, 17, 18, and 19), as implemented by SRP Section 8.3.2, RGs 1.6, 1.32, 1.47, 1.75, 1.118, and 1.29, and BTP ICSB-21, require that the control room operator be given timely indication of the st'atus of the batteries and their availability under accident conditions. The La Crtsse control room does not have indication of battery current, battery i charger output current, dc bus voltage (on two out of three buses) battery breaker (s) or fuse (s) open alarm, or battery charger output breaker (s) or fuse (s) open alarm. Therefore, the dc power system monitoring is not in compliance with current licensing criteria. l The PRA found that the installation of the recommended dc system annunciators can lead to a reduction of the bus unavailabilities by a factor of approxi-mately 4. The dc power supply reliability can, therefore, be expected to have an impact on the risk resulting from a core melt. In previous PRA studies on BWRs (even though of somewhat different design than La Crosse), failure of the de system has proven to be a significant contributor to risk. Because of the magnitude of the reduction in dc power unavailability and the possible importance of the de systems, the PRA ranked this issue of high risk significance. The licensee, in a letter dated February 16, 1983, has proposed to evaluate the exisiting and proposed dc system monitoring and identify any necessary modifica-l tions by , 1983. The staff finds this acceptable. 4.29 Topic IX-5, Ventilation Systems 10 CFR 50 (GDC 4), as implemented by SRP Section 9.4.4, requires that systems and components important to safety shall be designed to accommodate the effects
- La Crosse SEP 4-36
._ = _ _ - .
I of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents. The following area ventilation systems at La Crosse were fcund not to be in conformance with current licensing criteria. 4.29.1 Turbine Building and Penetration Room The turbine building ventilation system services components within the turbine building. The only essential equipment located in the turbine building is the IA-480-V essential switchgear. This switchgear is in the penetration room (a part of the turbine building), which is between the turbine building and the reactor building. There is no ventilation system in this room; however, the overall turbine building is ventilated by admitting outside air through louvered openings (motive power for the ventilation system is-provided by the plant stack exhaust system, which also serves the reactor containment building and the waste disposal building). The concerns identified during the topic
' e cvaluation are: ,
(1) There may be inadequate ventilation in the penetration room, especially under LOCA conditions, and the essential 1A-480-V switchgear may be affected. (2) Loss of ventilation to the turbine room after a loss of offsite power could result in explosive vapors collecting over an extended period of time be'cause of inadequate ventilation of the oil storage room. 4.29.1.1 1A-480-V Essential Switchgear The licensee, in a letter dated January 12, 1983, provided data with regard to , post-LOCA temperatures in the penetration room. The maximum predicted tempera- l ture in the penetration room after a LOCA is 123 F. The 1A-480-V essential Thus, # switchgear is designed for a maximum ambient temperature of 75*C (167*F). the equipment rating is well above the maximum predicted post-LOCA temperature in the area. Additionally, lack of a ventilation system has never prevented the switchgear from functioning during 15 years of operation. Also, even if the 1A-480-V essential bus did fail because of inadequate ventilation, the 1B-480-V essential bus would be unaffected, because it is serviced by the diesel building ventilation system. The PRA rated the importance of this issue to risk as high on the basis of a relatively high probability of station blackout because station blackout would be dependent on loss of offsite power (assumption is made that the 1A bus would be affected because of the loss of turbine building ventilation) and failure of the other diesel bus, 18. However, LACBWR can be shut down, even under station blackout conditions, through the use of either the two diesel-driven pumps or the three gasoline-driven emergency service water pumps. For this reason and those previously mentioned, modification is not required.
/
La Crosse SEP 4-37
4.29.1.2 011 Vapors in Oil Storage Room The oil storage room that supplies the heating boiler is ventilated by one exhaust fan. Air inlet to this room is by leakage from the turbine building and the atmosphere. The ventilation fan will stop with a loss of offsite power. Although not nuclear safety related, a lack of ventilation to the oil storage of time. room could permit explosive vapors to collect over an extended period l The licensee, in a letter dated April 11, 1983, has proposed to demonstrate that no ventilation is necessary for this room or that appropriate procedures will be developed to ensure adequate ventilation under normal and emergency conditions, (i.e., plant stack exhaust system inoperative). The demonstration shall be submitted or be available by , 1983. The staff finds this acceptable. 4 4.29.2 Electrical Equipment Room The electrical equipment room is below the control room and contains the following equipment, which is either essential for the safe shutdown of the plant or the mitigation of maximum credible accident events: (1) reactor plant battery set (2) cable spreading (3) turbine building motor control center, MCC-1A (4) 1A motor generator (inverter) set (supplies 18 noninterruptible bus) (5) IB noninterruptible 120-V bus (6) reactor plant battery chargers Ventilation of this equipment is provided by the control room ventilation system, also located in this room or in an extension. The major problem with this ventilation system is that its source of electrical power is turbine building motor control center MCC-1B, which is supplied through 480-V auxiliary switchgear IB, which is not an essential electrical service. Thus, in the event of a loss of offsite power, the control room heating, ventilation, and air conditioning system will shut down and not supply ventilation to the vital equipment in the electrical equipment room. The licensee, in a letter dated January 12, 1983, provided data on temperature when the electrical equipment room ventilation system was inoperative. These outages lasted for 5 days or more with outdoor temperature ranging as high as 93 F. There is no post-LOCA load adjacent to this room. The PRA rated the importance of this issue to risk as high on the basis of a relatively high probability of station blackout because station blackout would ! be dependent on loss of offsite power (assumption is made that the 1A bus would be other affected diesel because bus, 18. of the loss of control room ventilation) and failure of the C However, LACBWR can be shut down, even under station blackout conditions, through use of either the two diesel-driven pumps or the three gasoline-driven emergency service water pumps. For this reason and those previously mentioned, modification is not required. La Crosse SEP 4-38 l l
4.29.3 Emergency Diesel Generator 1A Ventilation System The diesel generator 1A, which provides 250 kW of emergency power independently of the 1B diesel generator and other power sources, is located in a separate room between the machine shop and the reactor building wall. The ventilation inlet fan and damper, as well as the exhaust damper, are subject to active failures. Available supplementary sentilation through the machine shop doors appears to provide an alternative that would permit continued operation of the diesel generator. The limited PRA rated the importance of this issue to risk as low because failure of the ventilation system contributes approximately 6% to the overall diesel or train failure rate. The licensee, in a letter dated Jaauary 12, 1983, proposed to either demon-strate that the 1A emergency diesel generator can continue to function without ventilation or propose corrective measures, such as procedures to open machine shop doors, if warranted. The results of this evaluation are scheduled to be submitted by , 1983. The staff finds this acceptable 4.29.4 Diesel Building Ventilation System A separate building houses diesel generator 1B, an electrical equipment room, and a battery room. Each room is serviced by separate sets of ventilation fans and dampers. The diesel generator room ventilation subsystem has sufficient design redundancy with the exception of the motor-operated exhaust damper. The hydrogen removal portions of the battery room ventilation subsystem are susceptible to a single failure. Each of the rooms in the diesel building, that is, diesel generator, electrical equipment, and battery rooms, is serviced by its own ventilation system. There-fore, any single failure can be mitigated by opening the door (s) between the three rooms. The PRA rated the importance of this area to risk as low because failure of the ventilation system contributes approximately 8% to the overall diesel or train failure rate. The licensee, in a letter dated April 11, 1983, has proposed to develop proce-dures which identify the monitoring of ventilation in these rooms and take ap-propriate action if necessary. The procedures are scheduled to be implemented by , 1983. The ba,ttery room has a hydrogen alarm in the control room to alert the operator if abnormal quantities of gas are being generated. There-fore, modification of the battery ~ room is not required. 4.29.5 Intake Structure The alternate core spray (ACS) pumps are located in the intake structure. There is no actual ventilation system for this area. During the summer, the intake structure windows are opened to provide natural, passive cooling. Tests are performed on the ACS diesel generators during the summer and winter months. The diesel generators are water cooled and have never failed to run because of the lack of a ventilation system. La Crosse SEP 4-39
The PRA rated the importance of this issue to risk as low because the working fluid for the ACS pumps and the nature of the crib house environment render ventilation unnecessary. Modification is not required. 4.30 Topic IX-6, Fire Protection , 10 CFR 50, Appendix R, Sections, III.G- and III. L, require that fire protection features be provided for structures, systems, and components important to safe shutdown and that, if separation and barriers between redundant safe shutdown equipment in a fire area do not meet the requirements of Section III.G.2, alternative or dedicated shutdown capability be provided that can achieve safe shutdown conditions independent of the effects of fire in the area. This action is being handled outside the scope of SEP under MPA B-41; however, any modifications resulting from that review will be integrated to the extent practical with the results of ongoing. evaluations resulting from the' integrated assessment. , 4.31 Topic XV-20, Radiological Consequences of Fuel-Damaging Accidents 10 CFR 100.11, as implemented by SRP Section 15.7.4 and RG 1.25, prescribes limits to doses from fuel-damaging accidents. Specifically, SRP Section 15.7.4 states that the dose to an individual at either the exclusion area boundary or outer boundary of the low population zone should be "well within" the exposure guidelines of 10 CFR 100. The dose limit of 10 CFR 100 at the exclusion area boundary for a dose to the thyroid is 300 rems. The "well-within"' 10 CFR 100 ' SRP guideline is defined as 75 rems. The staff has calculated a dose to the thyroid at the exclusion area boundary of 138 rems, which is above the SRP limit of 75 rems but less than half tne 10 CFR 100 limit of 300 rems. The SRP guideli m have been chosen on the the basis of qualitative assessments of the probability of occurrence of accidents. That is, for accidents con-sidered to be in the category of relatively high probability of occurrence, a fraction of the 10 CFR 100 dose guideiines is considered appr,cpriate as the SRP limit; for an accident having a probability of-occurrence comparable to the 10 CFR 100 event, the SRP limit is that'of the 10 CFR 109 Cose guideline. The staff's assessment includes assumptions related to isotope decay before fuel movement of 24 hr and atmospheric diffusion parameters (X/Q) generally equivalent to default values suggested in Regulatory Guide 1.3. The Regulatory Guide 1.3 default guideline values were used because of the unavailaoility of, high quality, onsite meteorologic data normally used in assessing directionly dependent diffusion conditions for SRP accident evalu,ations. Such default values are considered conservative. The 24-hr core fuel movement assumptions also are considered reasonably conservative in view of La Crosse Technical < Specification 4.2.8.4, which limits mcvement of fuel elements into the spent fuel storage well to at least 72 hr. In view of these two conservatisms (24-hr core decay and Regulatory Guide 1.3 f default diffusion values), the staff concludes that the consequences of a fuel-handling accident are unlikely to exceed the SRP dose guideline values and, in any case, are unlikely to exceed 10 CFR 100 dose guidelines. Therefore, no fur-
.ther' analysis is warranted.
l La Crosse SEP 4-40 l l
l Table'4.1 Integrated assessment summary I Tech. Spec. modifications' Comple-SEP required from Modification Licensee tion PRA r- Topic Section . rating
- No. No. Title SEP review requirements agrees date r, .
-s Incorporate Technical Yes --- ---
o II-1.A 4.1 Exclusion Area f.uthority Yes m and Control Speiification change to
" inform NRC of any changes L^ in occupancy of privately SS owned land.
I II-3.B 4.2' flooding Potential and No Put cutouts in parapets of Yes --- ---
> Protection Requirements the turbine, office, and l crib house buildirigs to . '
limit live load from ponded a ' water to less than 30 psf. i 11-3.B.1 4.3 Capability of Operating Yes Develop or modify emer- Yes --- --- ' Plants To Cope With gency procedures for site Design-Basis Flooding flooding. ' Conditions II-3 C 4.4 Safety-Related Water No Review possible loss of Yes --- --- dI Supply (Ultimate Heat cooling water to plant,
- and if needed develop ll Sink) orocedures to identify alternate sources of water.
III-I 4.5 Classification of Struc- --- Analyze and upgrade, if No 10 CFR I necessary, structures, com- 50.71 ture, Components, and {* Systems (Seismic and ponents, and systems as e.3.li Quality) described in Section 4.5. 1 III-2 4.6 Wind and Tornado --- Analyze structures, sys- No --- j
- Loadings tems, and components as described in Section 4.5.
41 i
' '* w~ -
Table 4.1 Integrated assessment summary n Tech. Spec. o SEP Topic modifications Comple-N Section required from Modification
'D No. No. Title Licensee tion -PRA SEP review requirements agrees date us rating Q III-3.A 4.7 Effects of High Water Level on Structures 4.7.1 Centainment Stability ---
Calculate factors of safety Yes Submitted --- against gross sliding and 2/14/83 overturning of containment. 4.7.2 Stack Stability --- Review stack stability for Yes --- --- design-basis flood level load combinations. 4.7.3 Crib House --- None --- --- --- III-3.C 4.8 Inservice Inspection of No Perform inservice inspec- Yes --- t Water Control Structures tion as described in g Section 4.8. III-4.A 4.9 Tornado Missiles --- Compare 01 ternate methods No --- --- to achieve safe shutdown response to protect against tornado missiles. III-4.B 4.10 Turbine Missiles No Provide comparison of over- Yes --- --- speed protection for Genoa Units 2 and 3. , III-5.A 4.11 Effects of Pipe Break --- Evaluate open Items 1, 2 Yes --- --- on Structures, Systems, 4, 5, and 6 in Section 4.11. and Components Inside Containment --- Item ~3 requires no --- --- --- modification. e
Table 4.1 Intzgrated asstssment summary Tech. Spec. SEP modifications Comple-p Topic Section required from Modification Licensee tion PRA No. No. Title SEP review requirements agrees- date rating
-s O III-5.B 4.12 Pipe Break Outside *'
g Containment 4.12.1 Clarification of Pipe --- Clarify pipe whip damage Yes --- --- Mo Whip Damage Criteria and criteria and jet impinge- , Jet Impingement Model ment model. 4.12.2 Verification of Poten- --- None --- --- Low tial Releases From the Worst High-Energy-Line Break 4.12.3 Failure of Steam Heating --- None System in Electrical Equipment Roora III-6 4.13 Seismic Design --- Analyze structures, sys- Yes --- --- Considerations- tems, and components as
, described in Section 4.13.
i w III-7.B 4.14 Design Codes, Design --- Assess structural code Yes --- --- Criteria, Load Combina- changes on safety margins tions, and Reactor in "as built" structures as Cavity Design Criteria described in Section 4.14. Loose-Parts Monitoring None Low III-8.A 4.15 --- and Core Barrel Vibra-tion Monitoring None Low III-10.A 4.1G Thermal-3verload Pro- --- tectior, for Motors of Motor-0perated Valves I
Table 4.1 Integrated assessment summary E n Tech. Spec. 3 SEP modifications Comple-g- Topic Section required from Modification
** No. No.
Licensee tion PRA Title SEP review requirements agrees date rating m Q V-5 4.17 Reactor Coolant Pressure Boundary (RCPB) Leakage Detection 4.17.1 Leakage Sensitivity --- None --- --- Low 4.17.2 Seismic Qualification --- Either seismically qualify Yes --- --- primary leakage detection system or develop appro-priate procedures. V-10.A 4.18 Residual Heat Removal Yes See Section 4.20. Yes --- --- System Heat Exchanger Tube Failures A 5 V-10.8 4.19 Residual Heat Removal System Reliability 4.19.1 Use of Safety-Grade Sys- --- None --- --- --- tems for Safe Shutdown 4.19.2 Shutdown Condenser No Add a second level Yes --- High Shell-Side Level Control controller. } 4.19.3 Additional Emergency --- None --- --- --- l Procedures V-12.A 4.20 Water Purity of BWR Primary Coolant E- -
Table 4.1 Integrated assessment summary r-
- Tech. Spec.
modifications Comple-Q o SEP Topic Section required from Modification . Licensee tion PRA Title SEP review requirements agrees date rattag m No. No. . a 4.20.1 Chloride and pH Limits Yes Revise chloride and pH Yes --- --- M V-12.A limits and sampling m frequency to conform with RG 1.56. 4.20.2 Conductivity Limits Yes Reestablish conductivity Yes --- --- limits and sampling fre-quency following review of system capability. VI-4 4.21 Containment Isolation System j 4.21.1 Valve Loc.etion 4.21.1.1(1) Penetration M-8, High- No Develop procedures to Yes --- i isolate penetration M-8
$ Pressure Service Water Line from outside containment-coincident with failure of containment check valves.
None 4.21.1.1(2) Penetration M-11 Demineralized Water System Line None Low 4.21.1.2 Penetrations M-21 and --- M-31, Vent Exhaust Damper and Ventilation Supply l l L_ .
Table 4.1 Integrated assessment summary EI Tech. Spec. r3 SEP modifications Comple-g Top c Section required from Modification Licensee . tion PRA m No. No. Title SEP review requirements agrees date rating ra on VI-4 4.21.1.3 Penetration M-23, Resin No Develop procedures to close Yes --- --- rn
' Sluice to Atmosphere new valve when resin transfer is in progress, normally locked closed at other times.
4.21.1.4 Penetration M-34, --- None --- --- Low Shutdown Condenser Atmospheric Vent 4.21.1.5 Penetration I-A, Alter- --- None --- --- Low nate Core Spray High-Pressure Service Water Line 45 4.21.1.6 Penetration I-A, Con- --- None j, Low tainment Building Drain
' cn Suction Line l 4.21.2 Valve Type 4.21.2.1 Penetrations M-9 and No Develop procedures to Yes ---
Low M-10, Component Cooling close valves 57-24-001, ( Water Lines 57-24-003, 57-24-006, and 57-24-008 based on compo-nent cooling water surge tank level alarm. 4.21.2.2 Penetration M-12, Con- --- None --- --- --- trol Air System Line
Table 4.1 Integrated assessment sumary Tech. Spec. r- Comple-
- moditications SEP required from Modification Licensee tion PRA Q Topic Section agrees date rating No. Title SEP review requirements o No.
us Yes --- P 4.21.2.3 Penetration M-17, Decay No Relocate manual valve VI-4 56-24-009 and develop p Heat Removal Line procedutes to close this o valve in the event of loss-of coolant accident. Penetration M-18, Seal --- None 4.21.2.4 Injection Line
--- None 4.21.2.5 Penetration M-28, Reactor Cavity Purge Air Line Develop procedure to close Yes 4.21.2.6 Penetration M-29, Off- No gas Vent to Chimney remote manual valve 55-25-004 outside contain-ment if closure signal is i sent to automatic valve $ 55-25-003 inside containment.
4.21.3 Valve Type and Locked-Closed Valves 4.21.3.1 Penetration M-13, No Lock-close manual isolation Yes Station Air valve, 70-24-30, outside containment and provide procedures to open and relock.
Table 4.1 Integrated assessment summary r-
- Tech.' Spec.
SEP modificaticns Topic Comple-r3 Section required from Modification Licensee tion o PRA i No. No. Title SEP review requirements I agrees date rating E
- VI-4 4.21.3.2 Penetration M-19, Off- No on Lock-close manual valves Yes --- ---
gas Vent From Shutdown 55-24-101 and 62-28-013
. 43 Condenser and install a remotely operated solenoid valve outside containment.
4.21.3.3(1) Penetration M-22, No Valve 54-24-179 will be Yes --- --- Waste Water Line maintained in a normally locked-closed position. Its use will be controlled by administrative procedure. 4.21.3.3(2) Penetration M-25, Waste No Valve 54-24-162 will be Yes --- --- Water Line maintained in a normally locked-closed position. Its use will be controlled
. 4df. by administrative procedure.
4.21.3.3(3) Penetration M-27, Waste No Valve 54-24-160 will be Yes --- --- Water Line maintained in a normally locked-closed position. 4.21.3.4 Penetration M-26, Heat- No Maintain valves 73-24-009 Yes --- Low ing System Supply and and 73-24-057 in a normally - Return locked-closed position. 4.21.4 Instrument Lines --- None --- --- --- , 4.21.5 Insufficient Indication No Develop procedures to Yes --- --- for Operation of Remote specify under which condi-Manual Valves tions remote manual valves will be closed. J s a _ _ _ _ . _ _ . _ _
l Table 4.1 Integrated assessment summaty 5 Tech. Spec. Q modifications Comple-g SEP required from Modification Licensee tion PRA vi Topic Section agrees date ~ rating O No. No. Tit 1e SEP review requirements
$o VI-6 4.22 Containment Leak Testing Yes Visually inspect airlock Yes ---
Low seals 72 hr af ter opening and replace seals in accordance with manufac-turer's recommendations. Emergency Core Cooling Yes Incorporate Test Procedures Yes Submitted Low VI-7.A.3 4.23 17.5.1 and 17.5.2 into Tech- 9/29/82 System Actuation System nical Specifications. VI-7.C.1 4.24 Appendix K--Electrical Instrumentation and Con-trol Re-Reviews Yes Develop interlocking method Yes --- Low i 4.24.1 480-V Essential Buses 1A and 18 to prevent both diesels
$ from being paralleled.
4.24.2 120-V AC Circuit Breakers --- None Testing of Reactor Trip No Modify one power range Yes Before Low VI-10.A 4.25 end of System and Engineered channel to compensate for Safety Features, Includ- feedwater temperature refueling ing Response-Time Testing deviation inaccuracies. outage of 1983 VII-1.A 4.26 Isolation of Reactor Protection System From Nonsafety Systems, including Qualification of Isolation Devices 1 l I I l
Table 4.1 Integrated assessment summary as r1 Tech. Spec. o SEP modifications Comple-5l Topic Section required from Modification Licensee tion PRA
# No. No. Title SEP review requirements agrees date rating m
E3 VII-1.A 4.26.1 Channel Isolation --- Demonstrate by analysis Yes --- Low and/or tests that a single failure in any one of the process recorders does not affect any other channel of the reactor protection system. 4.26.2 Qualification as --- None --- --- --- Class 1E Equipment 4.26.3 Isolation Between --- Demonstrate by analysis --- --- --- Reactor Protection and/or test which RPS System (RPS) Channels channels have inadequate 47 and Power Supplies power supply isolation on and correct identified C' deficiencies. t 4.26.4 Power Source for Scram No Provide separate power Yes --- High I Channels supplies for the full scram channels. 4.26.5 Isolation of Range --- None --- --- --- Common Modules VIII-1.A 4.27 Pctential Equipment Failures Associated With Degraded Grid Voltage 4.27.1 480-V Buses 1A and -- None --- --- --- 1B
Table 4.1 Integrated asssssment summary Tech. Spec. r- SEP modifications Comple-Topic Section - required from Modification Licensee tion PRA No. No. Title SEP review requirements agrees date rating Q O E VIII-1.A 4.27.2 Single Source of Off- --- None --- --- ---
- site Power m
@ VIII-3.B 4.28 DC Power System Bus ---
Evaluate de system Yes --- High Voltage Monitoring and monitoring and Annunciation any necessary modifications. IX-5 4.29 Ventilation Systems 4.29.1.1 1A-480-V Essential --- None --- --- High Switchgear 4.29.1.2 011 Vapors in Oil --- Demonstrate that no venti- Yes --- --- Storage Room lation is necessary for this room or develop pro-cedures to provide i ventilation. w
" Electrical Equipment None --- ---
High 4.29.2 --- Room 4.29.3 Emergency Diesel --- Demonstrate that the 1A Yes --- Low Generator lA Ventilation emergency diesel generator System can continue to function without ventilation or pro-pose corrective measures. 4.29.4 Diesel Suilding --- Develop procedures for Yes --- tow Ventilation System monitoring ventilation in diesel building rooms. I i,
..-i......... .. . .
g Table 4.1 Integrated assessment summary n 2 Tech. Spec. g SEP modifications Comple-to Topic Section required from Modification Licensee tion PRA-m No. No. Title SEP review requirements agrees date rating ! m IX-5 4.29.b Intake Structure --- None - --- --- Low I IX-6 4.30 Fire Protection --- None --- --- --- l XV-20 4.31 Radiological Consequences --- None --- --- Low
- of Fuel-Damaging Accidents t
w i N l l 4
5 REFERENCEC Allis-Chalmers, "La Crosse Boiling-Water Reactor Safeguards Report for Operating Authorization," Docket No.115-5, July 1965. Code of Federal Regulations, Title 10, " Energy" (10 CFR) (includes General Design Criteria), Jan. 1982. Letter, Feb. 25, 1980, from H. R. Denton (NRC) to F. Linder (DPC),
Subject:
Forwards Show Cause Order Regarding Facility Liquefaction Issue. -- , Apr. 25, 1980, from D. L. Ziemann (NRC) to F. Linder (DPC),
Subject:
Forwards Request for Additional Information Regarding March 25, 1982 Answer to Show Cause Order and Response to NRC Concerns on Liquefaction Potential at Site. -- , Aug. 25, 1980 from F. Linder (DPC) to D. Crutchfield (NRC),
Subject:
Respon<is to NRC Letter of August 6, 1980 Regarding Powered Pumping Equip-ment Wn bh Will Draw Cooling Water From Mississippi River and Inject Into Cooling System. -- , Aug. 29, 1980, from H. R. Denton (NRC) to F. Linder (DPC),
Subject:
For-wards Safety Evaluation in Support of Licensee Position That Design and Installation of Site Dewatering System Is Not Required. -- , Fab. 25, 1981, from D. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Amendment No. 24 to Provisional Operating License No. DPR-45. -- , June 29, 1981, from F. Linder (DPC) to D. G. Eisenhut (NRC),
Subject:
Dairyland Power Cooperative, La Crosse Boiling Water Reactor (LACBWR), SEP Topic III.5.B, Pipe Break Outside Containment. -- , Aug. 5,1981, from F. Linder (DPC) to D. G. Eisenhut (NRC),
Subject:
DPC, LACBWR, POL No. DPR-45, SEP Topic 111-5.B - Pipe Break Outside Containment. -- , Aug. 6,1981 from F. Linder (DPC) to D. Eisenhut (NRC)
Subject:
DPC, LACBWR, POL No. DPR-45, SEP Topic III-2, Wind and Tornado Loadings.
-- , June 7,1982, from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-1, Quality Grcup Classification of Components and Systems - Lacrosse Boiling Water Reactor.
-- , Aug. 12, 1983, from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-5.A, Effects of Pipe Break on Structures, Systems and Components - Lacrosse Boiling Water Reactor.
-- , Sept. 29, 1982, from F. Linder (DPC) to D. Crutchfield (NRC),
Subject:
DPC, LACBWR, POL DPR Application for Amendment to License. La Crosse SEP 5-1
-- , Oct. 7,1982, from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topics V-10.8, RHR System Reliability; V-11.B. RHR Interlock Require-ments; and VII-3, Systems Required for Safe Shutdown (Safe Shutdown Systems Report) - Lacrosse Boiling Water Reactor (LACBWR).
-- , Nov. 19, 1982, from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Safety Topics III-6, Seismic Design Considerations, and III-11, Compo-nent Integrity - Lacrosse Boiling Water Reactor.
-- , Nov. 29, 1982, from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-4.A, Tornado Missiles - Lacrosse Boiling Water Reactor.
-- , Dec. 13, 1982, from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-3.A, Effects of High Water Level on Structures - Lacrosse Boiling Water Reactor.
-- , Dec. 27, 1982, from F. Linder (DPC) to D. Crutchfield (NRC),
Subject:
DPC, LACBWR, POL. No. DPR Systematic Evaluation Program Topic III-4.B.
-- , Jan 12, 1983, from F. Linder (DPC) to D. Crutchfield (NRC),
Subject:
DPC, LACBWR, POL No. DPR Systematic Evaluation Program Topic IX-5, " Venti-lation Systems."
-- , Jan. 17, 1983, from F. Linder (DPC) to D. Crutchfield (NRC),
Subject:
DPC, LACBWR, POL No. DPR SEP Topic III-4.A - Tornado Missiles.
-- , Jan 27, 1983, from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-2, Wind and Tornado Loadings - Lacrosse Nuclear Power Station.
-- , Jan. 27, 1983, from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-4.B, Turbine Missiles - Lacrosse Boiling Water Reactor.
-- , Feb. 2,1983, from D. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Review of Revision 1 to Lacrosse's Quality Assurance Program Submitted August 28, 1980.
-- , Feb. 7,1983, from F. Linder (DPC) to D. Crutchfield (NRC),
Subject:
DPC, LACBWR POL No. PDR SEP Topic III-6, Seismic Design Considerations.
-- , Feb. 14, 1983, from F. Linder (DPC) to D. Eisenhut (NRC),
Subject:
DPC, LACBWR, SEP Topic III-3.A, Safety Evaluation Report, Effect of High Water Level on Structures.
-- , Feb. 16, 1983, from F. Linder (DPC) to D. Crutchfield (NRC),
Subject:
DPC-LACBWR, POL No. DPR Integrated Assessment - Systematic Evaluation Program Summary of Unresolved Differences. U.S. Atomic Energy Commission, WASH-1400, " Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," The Rasmussen Report, Aug. 1974. U.S. Nuclear Regulatory Commission, NUREG-75/087, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants--LWR Edition," Dec.1975 (includes Branch Technical Positions). La Crosse SEP 5-2
o -- , NUREG-0460, " Anticipated Transients-Without Scram for Light Water Reactors," Vol. 4, Mar. 1980. -- , NUREG-0578, "TMI-2 Lessons Learned Task Force: Status Report and Short-Term Recommendations," July 1979. -- , NUREG-0737, " Clarification of TMI Action Plan Requirements," Nov. 1980. -- , NUREG-0800 (formerly NUREG-75/087), " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," July 1981 (includes Branch Technical Positions). -- , NUREG/CR-0098, " Development of Criteria for Seismic Review of Selected Nuclear Power Plants," by N. M. Newmark and W. J. Hall, May 1978. -- , Regulatory Guide (RG) 1.3, " Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Boiling Water Reactors."
-- , RG 1.6, " Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems." -- , RG 1.11, " Instrument Lines Penetrating Primary Reactor Containment." -- , RG 1.22, " Periodic Testing of Protection System Actuation Functions." -- , RG 1.25, " Assumptions Used for Evaluating the Potential Radiological Con-sequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors." -- , RG 1.26, " Quality Group Classifications and Standards for Water , Steam ,
and Radioactive Waste-Containing Components of Nuclear Power Plants."
-- , RG 1.27, " Ultimate Heat Sink for Nuclear Power Plants." -- , RG 1.28, " Quality Assurance Program Requirements (Design and Construction)." -- , RG 1.29, " Seismic Design Classification." -- , RG 1.32, " Criteria for Safety-Related Electric Power Systems for Nuclear Power Plants." -- , RG 1.33, Rev. 1, " Quality Assurance Program Requirements (Operations)." -- , RG 1.45, " Reactor Coolant Pressure Boundary Leakage Detection Systems." -- , RG 1.46, " Protection Against Pipe Whip Inside Containment." -- , RG 1.47, " Bypassed and Inoperable Status Indication.for Nuclear Power Plant Safety Systems." -- , RG 1.56, " Maintenance of Water Purity in Boiling Water Reactors." -- , RG 1.59, " Design Basis Floods for Nuclear Power Plants."
La Crosse SEP 5-3
.. . ._ . - - _ = . _~ . . . . _ . .
k 6 4-
-- , RG 1.70, " Standard Format and Content of Safety Analysis Reports for
- Nuclear Power Plants."
1 l -- , RG 1.75, " Physical Independence of Electric Systems."
-- , RG 1.76, " Design Basis Tornado for Nuclear Power Plants."
-- , RG 1.102, " Flood Protection for Nuclear Power Plants.
-- , RG 1.106, " Thermal Overload Protection for Electric Motors on Motor-Operated Valves."
-- , RG 1.115, " Protection Against Low Trajectory Turbine Missiles."
] -- , RG 1.117, " Tornado Design Classification." i
-- , RG 1.118, " Periodic Testing of Electric Power and Protection Systems." l
-- , RG 1.127, " Inspection of Water-Control Structures Associated With Nuclear Power Plants."
-- , RG 1.132, " Site Investigations for Foundations of Nuclear Power Plants."
-- , RG 1.139, " Guidance for Residual Heat Removal."
-- , RG 1.141, " Containment Isolation Provisions for Fluid Systems."
Industry Codes and Standards American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code" (ASME Code), Section III, " Nuclear Power Plant Components," 1977 Edition. i
-- , Section VIII, "Unfired Pressure Vessels," 1962.
American Standards Association (ASA) B16.9, " Factory-Made Wrought Steel Butt l Welding' Fittings," American Society of Mechanical Engineers, 1958. I i --- B16.10, " Face-to-Face and End-to-End Dimensions of Ferrous Valves," ( American Society of Mechanical Engineers, 1957.
-- , B31.1, " Code for Pressure Piping," American Society of Mechanical Engi-l neers, 1955.
i American Water Works Association (AWWA) D-100, "AWWA Standard for Welded Steel ! Elevated Tanks, Standpipes, and Reservoirs for Water Storage," New York, l 1959. Institute of Electrical and Electronics Engineers (IEEE) Std. 279-1971, "Cri-teria for Protection System for Nuclear Power Generating Stations."
-- , 338-1971, " Standard Criteria for Periodic Testing of Nuclear Power Gener-i ating Station Safety Systems."
La Crosse SEP 5-4
APPENDIX A TOPIC DEFINITIONS FOR SEP REVIEW
- i 5
*The topic definitions and other data appearing in this appendix were assembled in April 1977; therefore, some references to organizations and other references reflect the status of the review at 'that time. The basis for deletion of a topic
- because the review of a related TMI task, USI, or other SEP topic was identical
( to the review of the SEP topic was developed in May 1981 on a generic basis i and does not address the plant-specific design aspects. The plant-specific deletions that are due to generic review or nonapplicability to the Dresden Unit 2 design are given in Appendices B and C. Lacrosse SEP 1
CONTENTS TOPIC TITLE PAGE' II-1.A Exclusion Areas Authority and Control.................. A-1 II-1.B Population Distribution................................ A-1 II-1.C Potential Hazards or Changes in Potential Hazards Due to Transportation, Institutional, Industrial, and Military Facilities................................. A-2 II-2.A Severe Weather Phenomena................................ A-3 II-2.B Onsite Meteorological Measurements Program.............. A-3 II-2.C Atmospheric Transport and Diffusion Characteristics for Accident Analysis...................................
~
A-4 II-2.0 Availability of Meteorological Data in the Control Room.................................................... A-6 II-3.A Hydrologic Description.................................. A-7 II-3.B Flooding Potential and Protection Requirements.......... A-8 II-3.B.1 Capability of Operating Plant To Cope With Design-Basis Flooding Conditions.................. .................. A-8 II-3.C Safety-Related Water Supply (Ultimate Heat Sink [ UHS]).. A-9 II-4 Geology and Seismology.................................. A-9 II-4.A Tectonic Province....................................... A-10 II.4.B Proximity of Capable Tectonic Structures in Plant Vicinity................................................ A-11 II-4..C Historical Seismicity Within 200 Miles of Plant......... A-11 l i II-4.0 Stability of Slopes..................................... A-12 II-4.E Dam Integrity........................................... A-12 II-4.F Settlement of Foundations and Buried Equipment.......... A-13 l III-1 Classification of Structures, Components, and System. (Seismic and Quality)................................... A-13 III-2 Wind and Tornado Loadings............................... A-14 III-3.A Effects of High Water Level on Structures............... A-15 III-3.B Structural and Other Consequences (e.g., Flooding of
- Safety-Related Equipment in Basements) of Failure of Underdrain Systems...................................... A-15 III-3.C Inservice Inspection of Water Control Structures........ A-16 III-4.A Tornado Missiles........................................ A-16 III-4.B Turbine Missiles...................... ............ .. A-17
! Lacrosse SEP A-iii
CONTENTS (Continued) TOPIC TITLE PAGE III-4.C Internally Generated Missiles........................... A-18 III-4.0 Site-Proximity Missiles (Including Aircraft)............ A-19 III-5.A Effects of Pipe Break on Structures, Systems, and Components Inside Containment........................... A-19 III-5.B Pipe Break Outside Containment.......................... A-20 III-6 Seismic Design Considerations........................... A-20 III-7.A Inservice Inspection, Including Prestressed Concrete Containments With Either Grouted or Ungrouted Tendons... A-21 III-7.B Design Codes, Design Criteria, Load Combinations, and Reactor Cavity Design Criteria.......................... A-22 III-7.C Delamination of Prestressed Concrete Containment Structures.............................................. A-22 III-7.D Containment Structural Integrity Tests.................. A-23 III-8.A Loose-Parts Monitoring and Core Barrel Vibration. Monitoring.............................................. A-23 III-8.B Control Rod Drive Mechanism Integrity................... A-24 III-8.C Irradiation Damage, Use of Sensitized Stainless Steel, and Fatigue Resistance.................................. A-25 III-8.D Core Supports and Fuel Integrity........................ A-25 III-9 Support Integrity....................................... A-27 III-10.A Thermal-Overload Protection for Motors of Motor-Operated Valves.................................................. A-29 III.10.B Pump Flywheel Integrity................................. A-29 III.10.C Surveillance Requirments on BWR Recirculation Pumps and Discharge Valves........................................ A-30 III-11 Component Integrity..................................... A-30 III-12 Environmental Qualification of Safety-Related Equipment. A-32 IV-1.A Operation With Less Than All Loops in Service........... A-33 IV-2 Reactivity Control Systems Including Functional Design and Protection Against Single Failures........... A-33 IV-3 BWR Jet Pump Operating Indications...................... A-34 i V-1 Compliance With Codes and Standards (10 CFR 50.55a)..... A-34 V-2 Applicability of Code Cases............................*. A-35 V-3 Overpressurization Protection........................... A-36 V-4 Pipi ng and Safe-End Integri ty. . . . . . . . . . . . . . . . . . . . . . . . . . . A-36 V-5 Reactor Coolant Pressure Boundary (RCPB) Leakage Detection....................................... A-37 Lacrosse SEP A-iv
CONTENTS (Continued) TOPIC TITLE PAGE V-6 Reactor Vessel Integrity................................ A-38 V-7 Reactor Coolant Pump 0verspeed.......................... A-39 V-8 Steam Generator (SG) Integrity.......................... A-39 V-9 Reactor Core Isolation Cooling System (BWR)............. A-40 V-10.A Residual Heat Removal System Heat Exchanger Tube Failures................................................ A-41 V-10.8 Residual Heat Removal System Reliability................ A-41 V-11.A Requirements for Isolation of High- and Low-Pressure Systems................................................. A-42 V-11.8 Residual Heat Removal System Interlock Requirements. . . . . A-43 V-12.A Water Purity of BWR Primary Coolant..................... A-44 V-13 Waterhammer............................................. A-44 VI-1 Organic Materials and Postaccident Chemistry............ A-45 VI-2.A Pressure-Suppression-Type BWR Containments.............. A-46 VI-2.B Subcompartment Analysis................... ............. A-47 VI-2.C Ice Condenser Containment............................... A-48 VI-2.D Mass and Energy Release for Postulated Pipe Break Inside Containment...................................... A-49 VI-3 Containment Pressure and Heat Removal Capability........ A-50 VI-4 Containment Isolation System............................ A-50 VI-5 Combustible Gas Control................................. A-51 VI-6 Containment Leak Testing................................ A-53 VI-7.A.1 Emergency Core Cooling System Reevaluation To Account for Increased Reactor Vessel Upper-Head Temperature..... A-53 l VI-7.A.2 Upper Plenum Injection.................................. A-54 VI-7.A.3 Emergency Core Cooling System Actuation System.......... A-54 VI-7.A.4 Core Spray Nozzle Effectiveness......................... A-55 VI-7.8 Engineered Safety Feature Switchover From Injection to Recirculation Mode (Automatic Emergency Core Cooling System Realignment)............................. A-56 VI-7.C Emergency Core Cooling System (ECCS) Single-Failure Criterion and Requirements for Locking Out Power to Valves, Including Independence of Interlocks on ECCS Valves.................................................. A-56 VI-7.C.1 Appendix K--Electrical Instrumentation and Control Re-reviews.............................................. A-57 VI-7.C.2 Failure Mode Analysis (Emergency Core Cooling System)... A-57 Lacrosse SEP A-v l l 1
CONTENTS (Continued) TOPIC TITLE PAGE VI-7.C.3 Effect of PWR Loop Isolation Valve Closure During a Loss-of-Coolant Accident on Emergenc System Performance. . . . . . . . . . . . . . . ....................
. . .y Core Cooling A-58 VI-7.D Long-Term Cooling Passive Failures (e.g., Floodin Redundant Components)............................g of
....... A-58 VI-7.E Emergency Core Cooling System Sump Design and Test for Recirculation Mode Effectiveness.................... A-59 VI-7.F Accumulator Isolation Valves Power and Control System Design.................................................. A-60 VI-8 Control Room Habitability............................... A-60 VI-9 Main Steam Line Isolation Seal System (BWR)............. A-61 VI-10.A Testing of Reactor Trip System and Engineered Safety Features, Including Response-Time Testing............... A-62 VI-10.8 Shared Engineered Safety Features, Onsite Emergency Power, and Service Systems for Multiple Unit Stations... A-63 VII-1.A Isolation of Reactor Protection System From Nonsafety Systems. Including Qualification of Isolation Devices... A-63 VII-1.8 Trip Uncertainty and Setpoint Analysis Review of Operating Data Base..................................... A-64 VII-2 Engineered Safety Features S Design......................ystem Control Logic and
............................ A-65 VII-3 Systems Required for Safe Shutdown...................... A-66 VII-4 Effects of Failure in Nonsafety-Related Systems on Selected Engineered Safety Features..................... A-66 VII-5 Instruments for Monitoring Radiation and Process Variables During Accidents.............................. A-68 VII-6 Frequency Decay......................................... A-70 VII-7 Acceptability of Swing Bus Design on BWR-4 Plants....... A-71 VIII-1.A Potential Equipment Failures Associated With Degraded Grid Voltage................................... A-71 VIII-2 Onsite Emergency Power Systems (Diesel Generator)....... A-72 VIII-3.A Station Battery Capacity Test Requirements.............. A-73 VIII-3.B DC Power System Bus Voltage Monitoring and Annunciation............................................ A-74 (
VIII-4 Electrical Penetrations of Reactor Containment.......... A-74 IX-1 Fuel Storage............................................ A-75 IX-2 Overhead Handling System (Cranes)....................... A-76 IX-3 Station Service and Cooling Water Systems............... A-77 Lacrosse SEP A-vi-
I CONTENTS (Continued) TOPIC TITLE PAGE IX-4 Boron Addition System (PWR)............................. A-79 IX-5 Ve nti l ati o n Sys tems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-79 IX-6 Fire Protection......................................... A-80 X Auxi l i a ry Feedwate r System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-81 XI-1 Appendix I.............................................. A-82 XI-2 Radiological (Effluent and Process) Monitoring Systems.. A-83 XIII-1 Conduct of Operations................................... A-85 XIII-2 Safeguards / Industrial Security.......................... A-87 XV-1 Decrease in Feedwater Temperature, Increase in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Steam Generator Relief or Safety Valve......................................... A-87 XV-2 Spectrum of Steam System Piping Failures Inside and Outside Containment (PWR)............................... A-88 XV-3 Loss of External Load, Turbine Trip, Loss of Condenser Vacuum, Closure of Main Steam Isolation Valve-(BWR), and Steam Pressure Regulator Failure (Closed)........... A-89 XV-4 Loss of Nonemergency AC Power to the Station Auxiliaries............................................. A-89 XV-5 Loss of Normal Feedwater Flow........................... A-90 i XV-6 Feedwater System Pipe Breaks Inside and Outside Containment (PWR)....................................... A-90 XV-7 Reactor Coolant Pump Rotor Seizure and Reactor Coolant Pump Shaft Break........................................ A-91 XV-8 Control Rod Misoperation (System Malfunction or Operator Error)......................................... A-91 XV-9 Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature, and Flow Controller Malfunction Causing an Increase in BWR Core Flow Rate... A-92 XV-10 Chemical and Volume Control System Malfunction That Results in a Decrease in Boron Concentration in the Reactor Coolant (PWR). ................................. A-92 XV-11 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position (BWR).............................. A-93 XV-12 Spectrum of Rod Ejection Accidents (PWR)................ A-93 XV-13 Spectrum of Rod Drop Accidents (BWR).... ............... A-94 XV-14 Inadvertent Operation of Emergency Core Cooling System and Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory. . . . . A-95 Lacrosse SEP A-vii
CONTENTS (Continued) TOPIC TITLE PAGE XV-15 Inadvertent Opening of a PWR Pressurizer Safety / Relief Valve or a BWR Safety / Relief Valve...................... A-95 XV-16 Radiological Consequences of Failure of Small Lines Carrying Primary Coolant Outside Containment. . . . . . . . . . . . A-96 XV-17 Radiological Consequences-of Steam Generator Tube Failure (PWR)........................................... A-97 XV-18 Radiological Consequences of Main Steam Line Failure Outside Containment..................................... A-97 XV-19 Loss of-Coolant Accidents Resulting From Spectrum of Postulated Piping Breaks Within the Reactor Coolant Pressure Boundary....................................... A-98 XV-20 Radiological Consequences of Fuel-Damaging Accidents (Inside and Outside Containment)........................ A-99 XV-21 Spent Fuel Cask Drop Accidents.......................... A-99 XV-22 Anticipated Transients Without Scram.................... A-100 XV-23 Multiple Tube Failures in Steam Generators.............. A-101 XV-24 Loss of All AC Power.................................... A-102 XVI Technical Specifications................................ A-102 XVII Operational Quality Assurance Program................... A-103 i Lacrosse SEP A-viii
l l TOPIC: II-1.A Exclusion Area Authority and Control (1) Definition: The establishment of the exclusion area and the licensee's control over it are reviewed at the construction permit / operating license stage. There-after, the licensees are required to report any changes with safety implica-tions. The concern exists, however, that (1) the original review may not have been as thorough as currently done, or (2) changes may have occurred but have not been reported and reviewed. In particular, new activities within the exclusion area (for. example, new recreational, facilities or offshore oil drilling) and topographical changes (for example, changes in water levels) may need to be reviewed. (2) Safety Objective: 1 To assure that appropriate exclusion area authority and control is main-tained by the licensee. (3). Status: Selective reviews have been performed (San Onofre Nuclear Generating Station Unit 1) or are under way (Fort Calhoun) where changes in exclusion area boundary have become necessary. 4 (4)
References:
- 1. Title 10, " Energy," Code of Federal Regulations, Part 100*
- 2. NUREG-75/087, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants - LWR Edition, " December 1975,"**
j Section 2.1.2 1 TOPIC: II-1.B Population Distribution (1) Definition: Population distribution in the vicinity of operating plants may have changed since the initial review was performed at the construction permit stage. Special attention should be given to new housing and commercial, l military, or institutional installations established since the initial l population-distribution review. i (2) Safety Objective: New population distributions may require revision of low population zone (LPZ) and population center to assure appropriate protection for the public by complying with the guidelines of 10 CFR Part 100. Adjustments may have [
*Hereafter referred to as 10 CFR.
**Hereafter referred to as Standard Review Plan.
l Lacrosse SEP A-1 f l 1
1 to be made in emergency plans. New accident analyses may have to be per-formed to determine consequent conformance with 10 CFR Part 100 at new LPZ distances. Potential need for additional engineered safety features (for example, chemical sprays or better filters) exists. (3) Status: Has been done on a selective basis only, that is, Pilgrim Unit I new population center. (4)
References:
- 1. 10 CFR Part 100
- 2. Standard Review Plan, Section 2.1.3 TOPIC: II-1.C Potential Hazards or Changes in Potential Hazards Due to Trans-portation, Institutional, Industrial, and Military Facilities (1) Definition:
For operating plants there are three concerns: (a) New hazards created since the facility was licensed, (b) Hazards considered for licensing but that have expanded beyond projec-tions or which were not reviewed against current criteria, and (c) Hazards that were not analyzed at the licensing stage because of lack of regulatory criteria at the ~ time. Nearby transportation, institutional, industrial, and military facilities may be threats to safe plant operation due to: (a) Control room infiltration of toxic gases, (b) Onsite fires triggered by transport of combustible chemicals from offsite releases, (c) Shock waves due to detonation of stored or transported explosives l and military ordnance firing, and I (d) Onsite aircraft impact. (2) Safety Objective: To assure that the control room is habitable at all times and that the l postulated hazards will not result in releases in excess of the 10 CFR ! Part 100 guidelines by disabling systems required for safe plant shutdown. l ' (3) Status: Action has been taken on a selective basis only, for example, curbing of military air activity in the. vicinity of the Big Rock Point Plant. Liquid l Lacrosse SEP A-2 l
natural gas (LNG) hazards at Calvert Cliffs are under review. The review of older plants did not consider offsite hazards in detail (for example, aircraft traffic in the vicinity). (4)
Reference:
Standard Review Plan, Sections,2.2.1 and 2.2.2 TOPIC: II-2.A Severe Weather Phenomena (1) Definition: Safety-related structures, systems, and components should be designed to function under all severe weather conditions to which they may be exposed. Meteorological phenomena to be considered include tornadoes, snow and ice loads, extreme maximum and minimum temperatures, lightning, combinations of meteorology and air quality conditions contributing to high corrosion rates, and effects of sand and dust storms. (2) Safety Objective: To assure that the designs of safety-related structures, systems, and components reflect consideration of appropriate extreme meteorological conditions and severe weather phenomena. This effort would identify deficiencies in designs and/or operation that may contribute to accidental releases of radioactivity to the atmosphere resulting in doses to the public in excess of 10 CFR Part 100 or Part 20 guidelines (as appropriate to the design of the component or system). (3) Status: Generic studies have been initiated to develop guidelines for extreme temperatures and lightning, and to the review the current Branch Positions on snow loads. Estimated completion dates are 6/1/78 or later. i (4)
References:
- 1. 10 CFR Part 100 or Part 20
- 2. Regulatory Guide 1.76, " Design Basis Tornado for Nuclear Power Plants"
- 3. Standard Review Plan, Section 2.3.1
- 4. Branch Technical Position, " Winter Precipitation Loads," March 24, 1975
- 5. Inquiry by Chairman Rowden Concerning Lightning Protection, July 9, 1976
- 6. 10 CFR Part 50 TOPIC: 11-2.B Onsite Meteorological Measurements Program (1) Definition:
To review the onsite meteorological measurements program to determine the l extent that the licensee complies with 10 CFR Part 50, Appendix E and 1 Appendix I. Lacrosse SEP A-3 1
1 (2) Safety Objective:
; To assure that adequate meteorological instrumentation to quantify the offsite exposures from routine releases is available and maintained.
-(3) Status:
2 Onsite meteorological measurements programs are being reviewed as a part of the Appendix I evaluations. (4)
References:
- 1. 10 CFR Part 50, Appendix E and Appendix I 1- 2. Regulatory Guide 1.97, Rev.1, " Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs'Cond.itions During and Following an Accident"
- 3. Regulatory Guide 1.23, "Onsite Meteorological Programs"
- 4. Standard Review Plan, Section 2.3.3 1.
' (5) Basis for Deletion (Related TMI Task, Unresolved Safety Issue (USI), or Other SEP Topic): t (a) TMI Action Plan Task II.F.3, " Instrumentation for Monitoring Accident Conditions" (NUREG-0660) Task II.F.3 requires that appropriate instrumentation be provided ' for accident monitoring with expanded ranges and a source term that
' considers a damaged core capable of surviving the accident environ-ment in which it is located for the' length of time its function is required. Regulatory Guide 1.97, Revision 2, " Instrumentation for 4
Light-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During and Following an Accident," issued December 1980, contains the required meteorological instrumentation to quantify the offsite' exposure. ' (b) TMI Action Plan Task III.A.1, " Improve Licensee Emergency Preparedness - Short Term" (NUREG-0660) i Task III.A.1 requires the evaluation of 10 CFR Part 50, Appendix E, backfit requirements in accordance with NUREG-0654, " Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants." Backfit require-ments include review of the Onsite Meteorological Measurement Program. The evaluations required by Tasks II.F.3 and III.A.1 are identical to SEP Topic II-2.B; therefore, this SEP topic has been deleted. i TOPIC: II-2.C Atmospheric Transport and Diffusion Characteristics l for Accident Analysis _ (1) Definition: To review the atmospheric transport and diffusion characteristics assumed to demonstrate compliance with the 10 CFR 100 guidelines with respect to Lacrosse SEP A-4
- r. - - - - . - _ , . - _ - - -
-( .
l plant design, control room habitability, and doses to the public during and following a 'pcstulated design-basis accident. examine the assumptions for: Thiseffy)rtwould l . (a) Effects of explosive concentrations from onsite or offsite releases of hazardous material for consideration in structural design, (b) Calculation of relative concentration (x/Q) values for releases of radioactivity *and toxic chemicals for consideration in control room habitabilit'y, and (c) Calculations of doses to th3 public resulting from releases of radio-activity to the atmosphere during and following a postulated design-basis accident. - This effort is considered necessary because most original reviews were performed using the' assumptions provided in Regulatory Guides =1.3 and 1.~4 which have been found to be generally nonconservative based on evaluation of over 50 sites with act631 meteorological observations. (2) Safety Objective: To assure that the atmospheric transport and diffusion characteristics . originally assumed to demonstrate compliance with the 10 CFRa100 guidalines are appropriate, considering additional.onpite meteorological datenand results of recent atmospheric diffusion experiments. , (3) Status: x A review of long-term (annual average} atmospheric transport and diffusion characteristics is ongoing for Appendix I evaluations independent of the SEP effort. A study has also. recently been performed by the Hydrology-Meteorology Branch for the Dinsion of Operating Reactors for review of l the meteorological assumptions'for estimating control room dose; consequences ! resulting f rom post-LOCA purges through tall stacks. (4)
References:
- 1. 10 'CFR Part 20 1
- 2. 10 CFR Part 50, Appendix A and Appendix I .
- 3. 10 CFR Part 100 '
- 4. Regulatory Guides i 1.3, " Assumption Used for Evaluating the Potential Radiologica' Consequences of a Loss-of-Coolant Accident for Boiling N'4ater
- React. ors" 1.4, " Assumptions Used for Evaluating the Potential Radiologca'l Consequences of a Loss of-Coolant Accident for Pressurized Water Reactors"
- 5. Standard Review Plan, Sections 2.3.4, 6.4, 2.2.1, 2.2.2, and 2.2.3 s
m3 Lacrosse SEP A-5 . l . l '
s. TOPIC: II-2.0 Availability of Meteorological Data in the Control Room (1) Definition: Data from the onsite meteorological program should be available in the control room. (2) Safety Objective: To assure that the lincensee has appropriate meteorological logical data displayed in the control room to assess conditions during and following an accident to allow for (1) early indication of the need to initiate action necessary to protect portions of the offsite public and (2) an estimate of the magnitude of the hazard from potential or actual accidental releases. (3) Status: No work currently being done on this subject for operating plants. (4)
References:
- 1. 10 CFR Part 50, Appendix E and Appendix I
- 2. Regulatory Guide 1.97, Rev.1, " Instrumentation for Light-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During and Following an Accident"
- 3. Regulatory Guide l.23, "Onsite Meteorological Programs" 4 .~ Standard, Review Plan, Section 2.3.3 (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Tooic):
(a) TMI Action Plan Task II.F.3, " Instrumentation for Monitoring Accident Conditions" (NUREG-0660) Task II.F.3 requires that appropriate instrumentation be provided for accident monitoring with expanded ranges and a source term that considers a damaged core capable of surviving the accident environment in which it is located for the length of time its function is required. Regulatory Guide 1.97, Revision 2, " Instrumentation for' Light-Water-Cooled Nuclear Power Plants To Assess Plant and Environs Conditions During and Following an Accident," issued December 1980, contains the required meteorological instrumentation to quantify the offsite exposure. (b) TMI Action Plan Task III.A.1, " Improve Licensee Emergency
' Preparedness - Short Term" (NUREG-0660) 1 Task III. A.1, " Improve Licensee Emergency Preparedness - Short Term,"
requires the evaluation of 10 CFR Part 50, Appendix E backfit require-ments in accordance with NUREG-0654, " Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants." Backfit requirements include _ review of the Onsite Meteorological Measurement Program. Lacrosse SEP A-6
<e (c) TMI Action Plan Task I.D.1, " Control Room Design Reviews" (NUREG-0660)
Task I.D.1, " Control Room Design Reviews," requires that operating reactor licensees and applicants for operating licenses perform a detailed control room design review to identify and correct design deficiencies. This review will include an assessment of control room layout, the adequacy of the information provided, the arrange-ment and identification of important controls and instrumentation displays, the usefulness of the audio and visual alarm systems, the information recording and recall capability, lighting, and other considerations of human factors that have an impact on operator effectiveness. The evaluations required by Tasks II.F.3, III.A.1, and I.D.1 are indentical to SEP Topic II-2.D; therefore, this SEP topic has been deleted. TOPIC: II-3.A Hydrologic Description (1) Definition: Hydrologic considerations are the interface of the plant with the hydro-sphere, the identification of hydrologic causal mechanisms that may require special plant design or operating limitations with regard to floods and water supply requirements, and the identification of surface-and groundwater uses that may be affected by plant operation. These hydrologic considerations may have changed since they were reviewed at the licensing stage. A review of such changes, if any, should be per-formed including an assessment of their impact on the plants. (2) Safety Objective: To assure that the designs of safety-related structures, systems, and components reflect consideration of appropriate hydrologic conditions, and to identify deficiencies in designs and/or operations that could contribute to accidental radioactive releases. (3) Status: 1 No work currently being done on this subject for operating plants. i (4)
References:
- 1. 10 CFR Parts 20, 50, and 100
- 2. American National Standards Institute, ANSI N170-1976, " Standards for Determining Design Basis Flooding at Power Reactor Sites"
- 3. Regulatory Guide 1.59, " Design Basis Floods for Nuclear Power Plants"
- 4. Standard Review Plan, Section 2.4.1 i
1 l Lacrosse SEP A-7 l l
TOPIC: 11-3. B Flooding Potential and Protection Requirements (1) Definition: If the potential for floods exists and protection is required, the type of protection (sand bags, flood doors, bulkheads, and so forth) will be reviewed to assure that equipment is available and that provisions have been made to implement the required protection. (2) Safety Objective: To assure that safety-related structures,. systems, and components are adequately protected against floods. (3) Status: Flooding protection requirements were reviewed on selected operating plants during the winter of 1976 due to the potential for flooding caused by ice accumulation and predictions for abnormally high spring runoff for some areas. (4)
References:
- 1. 10 CFR Parts 50 and 100
- 2. Regulatory Guide 1.59, " Design Basis Floods for Nuclear Power Plants"
- 3. American National Standards Institute, ANSI N170-1976, " Standards for Determining Design Basis Flooding at Power Reactor Sites"
- 4. Standard Review Plan, Section 2.4.10 TOPIC: II-3.B.1 Capability of Operating Plants To Cope With Design-Basis Flooding Conditions (1) Definition:
Protection against postulated floods is accomplished, if necessary, by
" hardening" the plant and by implementing appropriate technical specifica-tions and emergency procedures.
These technical specifications and flood emergency procedures need to be reviewed for plants licensed prior to 1972 to estab1' 9 the degree of conformance with current criteria. Flooding criteric u 1 for. the design of older plants are not known. (2) Safety Objective: Same as II-3.B (3) Status: Same as II-3.B Lacrosse SEP A-8 i
3 f (4)
References:
- 1. 10 CFR Part 100
- 2. American National Standards Institute, ANSI N170-1976, " Standards for Determining Design Basis Flooding at Power Reactor Sites"
- 3. Regulatory Guide 1.59, " Design Basis Floods for Nuclear Power Plants"
- 4. Standard Review Plan, Sections 2.4.3, 2.4.4, 2.4.5, and 2.4.7 TOPIC: II-3.C Safety-Related Water Supply (Ultimate Heat Sink [ UHS])
(1) Definition: To determine the adequacy of onsite water sources with respect to providing safety-related water during emergency shutdown and maintenance of safe shutdown. The location and inventory of safety-related water sources and the meteorological conditions to be used in evaluating both temperature and inventory of the sources should be established. Considerations of ice, low water, leak potential, and underwater dams should be included. In most cases, plants operating prior to 1973 will have to be reviewed to establish the degree of conformance with current criteria. Prior to the issuance of Regulatory Guide 1.27 in 1973, the Standard Format and Content (now Regulatory Guide 1.70) provided the only guidelines to prospective applicants on VHS requirements. Since compliance was not required and hydrologic and meteorologic criteria had not been established, usually only minimal data were provided. (2) Safety Objective:
+
To assure an appropriate supply of cooling water during normal and emer-gency shutdown procedures.
\
(3) Status: No work currently being done on this subject for operating plants. (4)
References:
- 1. 10 CFR Part 100
- 2. Regulatory Guide 1.27, " Ultimate Heat Sink for Nuclear Power Plants"
- 3. Standard Review Plan, Sections 2.4.11 and 9.2.5 TOPIC: 11-4 Geology and Seismology l
1 ! (1) Definition: Prior to the adoption of Appendix A to 10 CFR Part 100 in 1973, the Stan-dard Format provided the only guidelines to prospective applicants regarding l the type of geologic and seismic information needed by the Atomic Energy Commission staff. The applicant, because compliance with Regulatory Guide 1.70 was not required, usually provided only minimal data. Therefore, a re-review of plants licensed prior to 1973 is needed in order to determine the adequacy of the plant design with respect to geologic and seismologic phenomena such as earthquakes, landslides, ground collapse, and liquefaction. Lacrosse SEP A-9 i
The review will also include ground motion and surface faulting and will establish the ground-motion values and foundation conditions to be input into the structural reevaluation for seismic loads. (It is possible that some of the older plants would require assessing only the effects of new geologic and seismic discoveries on the site safety and the resulting design acceleration and/or the response spectra.) (2) Safety Objective: To assure that accidents (for example, loss of-coolant accident) do not occur and that plants can safely shut down in the event of geologic and seismologic phenomena which may occur at the site. (3) Status: Selected plants are undergoing reevaluation of geology and seismology (San Onofre Nuclear Generating Station Unit 1 and Humboldt Bay). A plan for reevaluating operating plants was developed in 1975-76 but has not been implemented pending formation of the Systematic Evaluation Program. (4)
References:
- 1. Standard Review Plan, Sections 2.5.1, 2.5.2, 2.5.3, 2.5.4, and 2.5.5
- 2. 10 CFR Part 100, Appendix A TOPIC: II-4.A Tectonic Province (1) Definition:
\
This subtopic covers a specific area within the major topic Geology and Seismology. Its purpose is to reassess the tectonic province for operat-
/
ing plants based on more current knowledge. (A tectonic province is a region characterized by a relative consistency of the geologic structural features contained within. Tectonic provinces are used operationally as regions within which risk from earthquakes not associated with tectonic structures or faults is considered uniform. Usually the largest historical earthquake not associated with a specific structure can be assumed to occur anywhere within the same province.) (2) Safety Objective: To assure that plants can be safely shut down in the event of geologic and seismologic phenomena which may occur at the site. (3) Status: The Geosciences Branch is currently attempting to delineate the boundaries of specific tectonic provinces (estimated completion date, fall 1977). The Site Safety Standards Branch is attempting to revise Appendix A to 10
- CFR Part 100 so that the definition of tectonic province will more closely f
conform to its operational use (estimated completion date, 1978). We cur-rently accept such provinces as generally proposed by King, Rogers, or Eardley. Limited subdivision of these provinces has been allowed based on thorough geological and seismic analyses, j Lacrosse SEP A-10 l l
(4)
References:
- 1. 10 CFR Part 100, Appendix A
- 2. King, P. B., Tectonic Map of North America; Washington, D.C., U.S.
Geological Survey, 1969
- 3. Rogers, John, The Tectonics of the Appalachians, N.Y., Wiley-Interscience, 271 p, 1970
- 4. Eardley, A. H., " Tectonic Divisions of North America," Bulletin of the American Association of Petroleum Geologists, 35: 2229-2237, 1951 TOPIC: II-4.B Proximity of Capable Tectonic Structures in Plant Vicinity (1) Definition:
This subtopic covers a specific area within the major topic Geology and Seismology. Its purpose is to determine the expected shaking character-istics at a plant site from known capable faults. The ground motion associ-ated with an earthquake generated by a capable fault or a tectonic structure may be greater than that associated with earthquakes in the same tectonic province not related to the structure. (2) Safety Objectives: To assure that plants can be safely shut down in the event of geologic and seismologic phenomena which may occur at the site. (3) Status: No work currently being done on this subject for operating plants. (4)
References:
- 1. 10 CFR Part 100, Appendix A
- 2. Standard Review Plan, Section 2.5.2
- 3. Regulatory Guide 1.60, " Design Response Spectra for Seismic Design of Nuclear Power Plants" TOPIC: II-4.C Historical Seismicity Within 200 Miles of Plant (1) Definition:
Determination of the safe shutdown earthquake (SSE) is made with consider-ation of past seismicity in the vicinity of the plant. However, there is sometimes disagreement or inconsistency in reporting oider earthquakes in the literature. Current high seismicity may also indicate possible hidden tectonic features. The historical seismicity within 200 miles of the plants will be reviewed including all earthquakes of Richter magnitude greater'than 3.0 or of Modi-fied Mercalli intensity greater than III. Association with tectonic features and provinces should be included. l l Lacrosse SEP A-11
(2) Safety Objective: To assure that the SSE is compatible with past seismicity in the area. (3) Status: No work currently being done in this subject for operating reactors. (4)
References:
1. Richter, C. F. , Elementary Seismology, W. H. Freeman and Company, San Francisco, Calif., 1958
- 2. 10 CFR Part 100, Appendix A TOPIC: II-4.0 Stability of Slopes (1) Definition:
Overstressing a slope may cause sudden failure with rapid displacement or shear strain which may damage safety related structures. The possibility of movement is evaluated by comparing forces resisting failure to those causing failure. An assessment of this ratio should be made to determine the safety factor. (2) Safety Objective: To assure that safety-related structures, systems, and components are adequately protected against failure of natural or man-made slopes. (3) Status: i No work currently being done on this subject for operating plants. (4)
References:
- 1. Standard Review Plan, Section 2.5.5
- 2. 10 CFR Part 100, Appendix A
- 3. Naval Facilities Engineering Command, NAVFAC DM-7, " Design Manual -
Soil Mechanics, Foundations, and Earth Structures." TOPIC: II-4.E Dam Integrity (1) Definition: Dam integrity is the ability of a dam to safely perform its intended functions. These functions would normally include remaining stable under all conditions of reservoir operation, controlling seepage to prevent excessive uplifting water pressures or erosion of. soil materials, and prcviding sufficient freeboard and outlet capacity to prevent overtopping. (2) Safety Objective: To assure that adequate margins of safety are available under all loading conditions and uncontrolled releases of retained liquid are prevented. Lacrosse SEP A-12
I For many projects an important consideration is the necessity of assuring that an adequate quantity of water is available in times of emergency. (3) Status: Additional guidance on assuring the integrity of dams is currently being developed by the Office of Standards Development in Regulatory Guide 1.127,
" Inspection of Water-Control Structures Associated With Nuclear Power Plants,"
and through the geotechnical engineering service contract with the U.S. Army Corps of Engineers on design of structures such as ultimate heat sinks. (4)
References:
- 1. Standard Review Plan, Section 2.5.6
- 2. 10 CFR Part 100, Appendix A
- 3. U.S. Army Corps of Engineers, EM 1110-2-1902, " Engineering and Design Stability of Earth and Rock-Fill Dams," Office of Chief of Engineers, 1970
- 4. U. S. Army Corps of Engineers, EM 1110-2-2300, " Earth and Rock-Filled Dams General Design and Construction Considerations," 1971
- 5. Regulatory Guide 3.11, " Design, Construction, and Inspection of Embankment Retention Systems for Uranium Mills"
. TOPIC: II-4.F Settlement of Foundations and Buried Equipment (1) Definitions:
Structural loads develop pressures in compressible strata which are not equivalent to the original geostatic pressures. Settlement and differential settlement should be evaluated. (2) Safety Objecti_ve: To assure that safety-related structures, systems, and components are l adequately protected against excessive settlement. (3) Status: No work currently being done on this subject for operating plants. (4)
References:
- 1. Standard Review Plan, Section 2.5.4
- 2. 10 CFR Part 100, Appendix A
- 3. Naval Facilities Engineering Command, NAVFAC DM-7, " Design Manual -
Soil Mechanics, Foundations, and Earth Structures" l TOPIC: III-1 Classification of Structures, Components, and Systems j (Seismic and Quality) (1) Definition: l l Plant structures, systems, and components that are required to withstand l the effects of a safe shutdown earthquake and remain fur.ctional should be Lacrosse SEP A-13
classified as Seismic Category I. Systems and components important to safety should be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety function to be performed. Review the classification of structures, systems, and components important to safety to assure they are of the quality level commensurate with their safety function. (2) Safety Objective: To assure that structures, systems, and components will fullfill their intended safety functions in accordance with design requirements. To assure that structures, systems, and components necessary for safety will withstand , the effects of the designated safe shutdown earthquake and will remain functional. (3) Status: There is currently no Division of Operating Reactors activity to confirm the classification of structures, components, and systems important to safety of operating reactors. (4)
References:
- 1. Standard Review Plan, Section 3.2.1
- 2. Standard Review Plan, Section 3.2.2
- 3. Regulatory Guide 1.26, " Quality Group Classifications and Standards for Water , Steam , and Radioactive-Waste-Containing Components of Nuclear Power Plants"
- 4. Regulatory Guide 1.29, " Seismic Design Classification" TOPIC: III-2 Wind and Tornado Loadings (1) Definition: '
Review the capability of the plant structures, systems, and components to withstand design wind loadings in accordance with 10 CFR 50, Appendix A. The review includes the following: (A) Design Wind Protection; (B) Tor-nado Wind and Pressure Drop Protection; (C) Effect of Failure of Structures Not Designed for Tornado on Safety of Category I Structures, Systems and Components; (D) Tornado Effects on Emergency Cooling Ponds. (2) Safety Objective: To assure that Category I structures, systems, and components are adequately designed for tornado winds and pressure drop, that any damage to structures not designed for tornado generated forces will not endanger Category I structures, systems, and components, and that tornado winds will not prevent the water in the cooling ponds from acting as a heat sink. (3) Status: This review applies to all plants. There are no ongoing reviews concern-ing this matter. l Lacrosse SEP A-14
(4)
References:
- 1. 10 CFR Part 50, Appendix A, General Design Criterion (GDC) 2
- 2. Standard Review Plan, Sections 3.3, 3.S, and 9.2.5
- 3. Regulatory Guides 1.76, " Design Basis Tornado for Nuclear Power Plants" 1.117, " Protection of Nuclear Plants Against Industrial Sabotage" TOPIC: III-3.A Effects of High Water Level on Structures (1) Definition:
If the high water level for the plant is reevaluated and found to be above the original design basis, then review the ability of the plant structures to withstand this water level. (2) Safety Objective: To provide assurance that floods or high water level will not jeopardize the structural integrity of the plant seismic Category I structures and that seismic Category I systems and components located within these structures will be adequately protected. (3) Status: This review applies to all plants. There are no ongoing reviews concern-ing this matter. (4)
References:
- 1. 10 CFR Part 50, Appendix A, GDC 2
- 2. Standard Review Plan, Sections 2.4, 3.4, and 3.8
- 3. Regulatory Guides 1.59, " Design Basis Floods for Nuclear Power Plants" 1.102, " Flood Protection for Nuclear Power Plants" TOPIC: III-3.8 Structural and Other Consequences (e.g., Flooding of Safety-Related Equipment in Basements) of Failure of Underdrain Systems (1) Definition:
Some plants rely on underdrain systems to limit the water table elevation at the plant to a safe level. Review underdrain systems of those facili-ties in which they are used. l (2) Safety Objective: To assure that the integrity of underdrain systems is maintained because a failure could lead to a rise in water table elevation which, in turn,
-could jeopardize the integrity of structures or the safety equipment within such structures.
Lacrosse SEP A-15
(3) Status: The structural consequences of the failure of underdrain systems were thoroughly reviewed during the construction permit review of Douglas Point Units 1 and 2 and Perry Units 1 and 2. There are no ongoing reviews of this topic for operating facilities. (4)
References:
- 1. 10 CFR Part 50, Appendix A, GDC 2
- 2. Standard Review Plan, Sections 2.4.13, 3.4, and 3.8 TOPIC: III-3.C Inservice Inspection of Water Control Structures (1) Definition:
Review the adequacy of the inservice inspection program of water control structures for operating plants to assure conformance with the intent of Regulatory Guide 1.127. (2) _Sa_fety Objective: To assure that water control structures of a nuclear power facility (for example, dams, reservoirs, and conveyance facilities) are adequately inspected and maintained so as to preclude their deterioration or failure which could result in flooding or in jeopardizing the integrity of the ultimate heat sink for the facility. (3) Status: This review applies to all plants. There are no' ongoing reviews concern-ing this matter. (4)
Reference:
Regulatory Guide 1.127, " Inspection of Water-Control Structures Associated With Nuclear Power Plants" TOPIC: III-4.A Tornado Missiles (1) Definition: Plants designed after 1972 have been consistently reviewed for adequate protection against tornadoes. The concern exists, however, that plants j reviewed prior to 1972 may not be adequately protected, in particular, those l reviewed before 1968 when Atomic Energy Commission criteria on tornado l protection were developed. An assessment of the adequacy of a plant to withstand the impact of tor-nado missiles would include: (a) Determination of the capability of the exposed systems, components, l and structures to withstand key missiles (including small missiles I Lacrosse SEP A-16
witn penetrating characteristics and larger missiles which result in an overall structural impact), (b) Determination of whether any areas of the plant require additional protection. The systems, structures, and components required to be protected because of their importance to safety are identified in Regulatory Guide 1.117. (2) Safety Objective: To assure that those structures, systems, and components necessary to ensure: (a) The integrity of the reactor coolant pressure boundary, (b) The capability to shut down the reactor and maintain it in a safe shutdown condition, and (c) The capability to prevent accidents which could result in unaccept-able offsite exposures, can withstand the impact of an appropriate postulated spectrum of tornado-generated missiles. (3) Status: The Regulatory Requirements Review Committee (RRRC) has approved case-by-case rereviews of plants against criteria in Regulatory Guide 1.117, which establishes the systems, structures, and components required to be protected against tornado missiles. This rereview was deferred pending the formation of the SEP. The RRRC is in the process of rereviewing Standard Review Plan, Section 3.5.1.4, which establishes appropriate missiles and impact velocities for new applications. Electric Power Research Institute (EPRI) has missile research in progress. (4)
References:
- 1. Standard Review Plan, Section 3.5.1.4
- 2. Regulatory Guide 1.117, " Tornado Design Classification" TOPIC: III-4.8 Turbine Missiles (1) Definition:
A number of nonnuclear plants and one nuclear plant (Shippingport) have experienced turbine disk failures. Rancho Seco has had chemistry problems leading to sodium deposits which caused stress-corrosion cracking of disks. Failure of turbine disks and rotors can result in high energy missiles which have the potential for resulting in plant releases in excess of 10 CFR 100 exposure guidelines. Lacrosse SEP . A-17
Two areas of concern should be considered: (a) Design overspeed failures - material quality'of disk and rotor, inservice inspection for flaws, chemistry conditions leading to stress-corrosion cracking, and (b) Destructive overspeed failures reliability of electrical overspeed protection system, reliability and testing program for stop and con-trol valves, inservice inspection of valves. The focus of the review would be on turbine disk integrity'and overspeed protection, including stop, intercept, and control valve reliability. (2) Safety Objective: To assure that all the structures, systems, and components important to safety (identified in Regulatory Guide 1.117) have adequate protection against potential turbine missiles either by structural barriers or a high degree of assurance that failures at design (120%) or destructive (180%) overspeed will not occur. (3) Status: No work currently being done on this subject for operating plants. Elec-tric Power Research Institute (EPRI) has missile research in progress. (4)
References:
- 1. Regulatory Guides 1.115, " Protection Against Low Trajectory Turbine Missiles" 1.117, " Tornado Design Classification"
- 2. Standard Review Plan, Section 3.5.1.3 TOPIC: III-4.C Internally Generated Missiles (1) Definition:
Review the probability of missile generation and the extent to which safety-related structures, systems, and components are protected against the effects of potential internally generated missiles (including missiles generated inside or outside the containment). (2) Safety Objective: t To provide assurance that the integrity of the safety-related structures, systems, and components will not be impaired and that they may be relied on to perform their safety functions.following any postulated internally generated igissile. (3) Status: No work currently being done on this subject for operating plants. Elec-tric Power Research Institute (EPRI) has missile research in progress. Lacrosse SEP A-18
(4)
Reference:
Standard Review Plan, Sections 3.5.1.1 and 3.5.1.2 TOPIC: III-4.D Site-Proximity Missiles (Including Aircraft) (1) Definition: Review the extent to which safety-related structures, systems, and compo-nents are protected against the effects of missiles postulated in Topic II-1.C, including postulated aircraft crashes and resulting fires. (2) Safety Objective: To provide assurance that the integrity of the safety-related structures, systems, and components will not be impaired and that they will perform their safety functions in the event of a site proximity missile. (3) Status: No work currently being done on this subject for operating plants. Elec-tric Power Research Institute has missile research in progress. (4)
Reference:
Standard Review Plan, Sections 3.5.1.5, 3.5.1.6, 3.5.2, and 3.5.3 TOPIC: III-5.A Effects of Pipe Break on Structures, Systems, and Components Inside Containment (1) Definition:
, Review the licensee's break and crack location criteria and methods of analysis for evaluating postulated breaks and cracks in high and moderate energy fluid system piping inside containment. The review includes con-sideration of compartment pressurization, pipe whip, jet impingement, l environmental effects, and flooding. Regulatory Guide 1.46 does not require i
that cracks be postulated inside containment. However, the recent proposed revision to Standard Review Plan, Section 3.6.2, " Determination of Break Locations and Dynamic Effects Astociated With the Postulated Rupture of Piping," recommends that cracks be postulated inside containment. Old
- and current plants are not postulating cracks.
I (2) Safety Objective: To assure that the integrity of structures, systems, and components relied upon for safe reactor shutdown or to mitigate the consequences of a postulated pipe break is maintained. (3) Status: This program has not been started for facilities licensed prior to about early 1974. Subsequent to that date, this topic was included in the operating-license review and has been completed for later facilities. l Lacrosse SEP A-19
1 l (4)
References:
- 1. 10 CFR Part 50, Appendix A, GDC 4
- 2. American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section III
- 3. Standard Review Plan, Sections 3.6.2 and 3.8
- 4. Regulatory Guides 1.46, " Protection Against Pipe Whip Inside Containment" 1.29, " Seismic Design Classification" TOPIC: III-5.B Pipe Break Outside Containment (1) Definition:
Review the licensee's break and crack location criteria and methods of analysis for evaluating postulated breaks and cracks in high and moderate energy fluid system piping located outside containment. The review includes consideration of compartment pressurization, pipe whip, jet impingement, environmental effects, and flooding. (2) Safety Objective: To assure that pipe breaks would not cause the loss of needed functions of safety-related systems, structures, and components and to assure that the plant can be safely shut down in the event of such breaks. (3) Status: This task is complete for all operating plants with the exception of three plants for which the review is in progress. (4)
References:
- 1. 10 CFR Part 50, Appendix A, GDC 4
- 2. American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section III
- 3. Standard Review Plan, Section 3.6.1
- 4. Regulatory Guides 1.46, " Protection Against Pipe Whip Inside Containment" 1.29, " Seismic Design Classification"
- 5. Standard Review Plan, Branch Technical Position MEB 3-1, " Postulated Break and Leakage Locations in Fluid System Piping Outside Containment"
- 6. NUREG-0328, " Regulatory Licensing: Status Summary Report," (Pink Book)
Issue 3-25
- 7. Standard Review Plan, Section 3.6.2 TOPIC: III-6 Seismic Design Considerations (1) Definition:
Review and evaluate the original plant design criteria in the following areas: Seismic Input, Analysis and Design Criteria, Qualification of Electrical and Mechanical Equipment, Seismic Instrumentation, Seismic Lacrosse SEP A-20
Categorization, and the effect of fag ure of non-Category I structures on the safety of Category I structures, systems, and components. (2) Safety Objective: To ensure the capability of the plant to withstand the effect of earthquakes. (3) Status: Humboldt Bay and San Onofre plants are currently undergoing seismic review. Technical Assistance Contracts: (a) Seismic Conservatism (Lawrence Livermore Laboratory) (b) Elasto-Plastic Seismic Analysis (Lawrence Livermore Laboratory) (c) Seismic Review of Operating Plants (Newmark) (4)
References:
- 1. Standard Review Plan, Sections 2.5, 3.7, 3.8, 3.9, and 3.10
- 2. Regulatory Guides 1.12, " Instrumentation for Earthquakes" 1.60, " Design Response Spectra for Seismic Design of Nuclear Power Plants" 1.61, " Damping Values for Seismic Design of Nuclear Power Plants" 1.92, " Combining Modal Responses and Spatial Components in Seismic Response Analysis" 1.122, " Development of Flood Design Spectra for Seismic Design of Floor-Supported Equipment or Components" TOPIC: III-7.A Inservice Inspection, Including Prestressed Concrete Contain-ments With Either Grouted or Ungrouted Tendons (1) Definition:
Review licensee's inspection program for all Category I structures including steel, "einforced concrete, and prestressed concrete containments. The progrt.... should include investigations for possible corrosion and cracking l of steel containments, excessive cracking of concrete structures, lift-off I tests of tendons, periodic testing of prestressing tendons for contain-ments with grouted tendons, and possible deterioration of prestressed , containments. (2) Safety Objective: To assure that the licensee's inspection program will detect any damaging l deterioration of the structures and that they will be capable of perform-ing as required by 10 CFR 50, Appendix A. (3) Status: This review applies to all plants. There are no ongoing reviews concern-ing this matter. Lacrosse SEP A-21
(4)
References:
- 1. 10 CFR Part 50, Appendix A
- 2. Standard Review Plan, Section 3.8
- 3. Regulatory Guides 1.35, " Inservice Inspection of Ungrouted Tendons in Prestressed Concrete Containment Structures" 1.90, " Inservice Inspection of Prestressed Concrete Containment Structures With Grouted Tendons" TOPIC: III-7.8 Design Codes, Design Criteria, Load Combinations, and Reactor Cavity Design Criteria (1) Definition:
Review the design codes, design criteria, and load combinations for all Category I structures (that is, containment, structures inside containment, and structures outside containment). (2) Safety Objective: To provide assurance that the plant Category I structures will withstand the NRC specific design conditions without impairment or structural integrity or the performance of required safety functions. (3) Status: This review applies to all plants. There are ne_ ongoing reviews concern-ing this matter. (4)
References:
- 1. 10 CFR Part 50, Appendix A, GDC 2 and 4
- 2. Standard Review Plan, Section 3.8 TOPIC: III-7.C Delamination of Prestressed Concrete Containment Structures (1) Definition:
Review the design of prestressed concrete containment structures to assess i the likelihood of delamination occurring in the shell walls or dome and to evaluate the consequences, if any. (2) Safety Objective: To assure that the licensee's design and construction methods have provided a structure which will maintain its integrity and will perform its intended function. Delaminations (internal cracking of concrete in planes roughly parallel to the surface) could possibly reduce the capability of the con-crete to withstand compression. Lacrosse SEP A-22
(3) Status: This review applies to all plants with prestressed concrete containments. A delamination occurred in the domes of the Turkey Point and Crystal River prestressed concrete containments. No evidence of such occurrences have been reported at other plants; however, no specific inspections have been made for any delaminations. It is not clear if the Structural Integrity Test or the existing inservice inspection programs would discover the existence of any delaminations. (4)
References:
Safety Evaluation Reports for Turkey Point (Docket No. 50-250/251) and Crystal River (Docket No. 50-302) TOPIC; III-7.D Containment Structural Integrity Tests (1) Definition: Review the licensee's structural integrity testing procedure to ensure compliance with the requirements of 10 CFR 50, Appendix A. , (2) Safety Objective: To assure that the licensee's design and constructive methods provide a structure which will safely perform its intended functions. (3) Status: This review applies to all plants. To our knowledge, all containments have had a structural integrity test. This opinion should be verified. (4)
References:
l l 1. 10 CFR Part 50, Appendix A Standard Review Plan, Sections 3.8.1 and 3.8.2 2. l TOPIC: III-8.A Loose-Parts Monitoring and Core Barrel Vibration Monitoring (1) Definition: Inservice surveillance programs to detect loose parts and excessive motion of the main core support structure.
- (2) Safety Objective
1 To detect loose parts or excessive vibration before they can cause flow blockage or mechanical damage to the fuel or other safety-related components. (3) Status: The NRC staff currently requires applicants to describe and licensees to implement a loose part detection program. Guidance for such a program is i Lacrosse SEP A-23 l
1, provided in a newly proposed Regulatory Guide 1.133, " Loose-Part Detection Program for the Primary System of Light-Water-Cooled Reactors." The regulatory guide outlines the minimum system characteristics which the NRC staff feels are necessary for a workable system and combines this with . a technical specification and reporting procedures for a complete and
- enforceable loose part detection program.
The concept of detec' ting core barrel motion through use of excore neutron detectors is well established. A proposed regulatory guide that describes j an acceptable core barrel vibration monitoring program has been temporarily placed on " hold" to permit the NRC staff and its consultants (Oak Ridge l National Laboratory Inspection and Enforcement Group) time to evaluate apparently anomalous data from core barrel motion monitoring programs that ! are currently in service as part of the technical specification requirements for certain licensees. ] (4)
References:
- 1. Combustion Engineering, CE Report CEN-5(P), " Palisades Reactor Internals Wear Report," March 1, 1974
- 2. Regulatory Guide 1.133, " Loose-Part Detection Program for the Primary System of Light-Water-cooled Reactors"
{ TOPIC: III-8.8 Control Aod Drive Mechanism Integrity (1) Definition: Review and evaluate the reliability, operability and any reported mechan-ical failures in control rod drives. . (2) Safety Objective: . i l To assure that the integrity and operability of control rod drives is adequately maintained so that they will be capable of normal reactor con-trol and prompt reactor shutdown, if required.
-(3) Status:
The Division of Operating Reactors Engineering Branch is currently evaluat-ing the failure modes and internal component redesigns of BWR control rod drives to preclude stress corrosion and thermal fatigue cracking. There have been no reported generic failures of PWR drives. i I . (4)
Reference:
General Electric, NED0-21021, " Test Program for Collet Retainer Tube," June 23, 1976. Lacrosse SEP A-24
l l TOPIC: III-8.C Irradiation Damage, Use of Sensitized Stainless Steel, and Fatigue Resistance (1) Definition: Review the safety aspects that affect reactor vessel internals integrity l for compliance with 10 CFR Part 50, including radiation damage, use of sensitized stainless steel, and fatigue resistance. (2) Safety Objective: l To assure continued reactor vessel internals integrity and compliance with 10 CFR Part 50 and applicable industry Codes and Standards. l (3) Status: The Engineering Branch, Division of Operating Reactors, currently has no review programs relating to reactor vessel internals integrity. (4)
References:
- 1. 10 CFR Part 50, Appendix A
- 2. American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section III
- 3. American Society of Testing Materials, ASTM A-262-70, " Standard Recommended Practices for Detecting Susceptibility to Intergranular Attack in Stainless Steels"
- 4. Regulatory Guides 1.37, " Quality Assurance Requirements for Cleaning of Fluid Systems and Associated Components of Water-Cooled Nuclear Power Plants" 1.44, " Control of the'llse of Sensitized Stainless Steel" 1.61, " Damping Values for Seismic Design of Nuclear Power Plants" j TOPIC: III-8.D Core Supports and Fuel Integrity l
(1) Definition: Abnormal loading conditions on the core supports and fuel assemblies due to seismic events or loss-of-coolant accidents (LOCAs) could cause fuel damage due to impact between fuel assemblies and upper- and lower grid plates or lateral impact between fuel assemblies and the core baffle wall. The resulting damage could result in loss of coolable heat transfer geometry, make it impossible to insert control rods, or cause releases of radioactive i materials due to fuel pin failure. (2) Safety Objective: l To assure that all credible loading conditions on core supports and fuel assemblies will not result in unacceptable fuel damage or distortion. l l Lacrosse SEP A-25 l
(3) Status: The Division of Operating Reactors is currently reviewing the dynamic loads imposed on the fuel assemblies during a LOCA. Independent analyses are being conducted by staff consultants. (4)
Reference:
American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section III (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic): USI A-2, " Asymmetric Blowdown Loads on Reactor Primary Coolant System" (NUREG-0649) USI A-2 requires that an analysis be performed by licensees to assess the design adequacy of the reactor vessel supports and other structures to withstand the loads when asymmetric LOCA forces are taken into account. The staff has completed its investigation and concluded that an acceptable basis has been provided in NUREG-0609, " Asymmetric Blowdown Loads on PWR Primary Systems," January 1981, for performing and reviewing plant analyses for asymmetric LOCA loads. The structural acceptance criteria specified in NUREG-0609 are as follows: The structural integrity of the primary system including the reactor pressure vessel, reactor pressure vessel internals, primary coolant loop, and components must be evaluated against appropriate acceptance criteria to determine if acceptable margins of safety exist. Allowable limits and appropriate loading combinations are set forth in Standard
-Review Plans (SRPs), which are listed in the table that follows.
The staff recognizes that in some specific cases where "as-built" designs are being reevaluated for asymmetric LOCA loads, these design limits may be exceeded. Acceptance of alternative allowable limits will be based on a case-by-case evaluation of the safety margins. Load-combination criteria in general were not addressed as part of this study. Currently the staff requires that seismic arj LOCA response be combined, along with responses due to other loading as specified by the SRP. An acceptable method for combining elastically generated seismic and LOCA responses is provided in NUREG-0484. Acceptable methods for combining response generated by an inelastic LOCA analysis and elastic seismic analyses will be evaluated on a case-by-case basis. 1 Since USI A-2 also requires the investigation of seismic and LOCA
- response be combined, the evaluation required by USI A-2 is identical to SEP Topic III-8.D; therefore, this SEP topic has been deleted.
l l Lacrosse SEP A-26
Item SRP Section Reactor pressure vessel 3.9.3 Reactor internals 3.9.5, 3.9.1 Primary coolant loop piping 3.9.3 ECCS piping 3.9.3 RPV, SG, pump supparta 3.8.3 Biological shield % , 3.8.3 Steam generator compartment wall 3.8.3 Neutron-shield tank 3.8.3 TOPIC: III-9 Support Integrity (1) Definition: Review the design, design loads, and materials integrity including corro-sion and fracture toughness and the inservice inspection programs of supports and restraints including bolting for the reactor vessel, steam generator, reactor coolant pump, torus, and other Class 1, 2, and 3 safety-related components and piping systems. (2) Safety Objective: To assure adequate support and/or restraint of safety-related systems and components under normal and accident loads so that they will not be pre-vented from performing their intended functions because of support failures. (3) Status: The Division of Operating Reactors has ongoing programs to review component supports. Current emphasis is on primary system supports and on piping system supports and restraints (snubbers). (4)
References:
- 1. American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section III
- 2. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book), Generic Topics 3-5 and 3-43 (5) Basis for Deletion (Related TMI Task, USI, or other SEP Topic):
(a) USI A-12, " Fracture Toughness of Steam Generator and Reactor Coolant Pump Supports" (NUREG-0510 and NUREG-0606) The original scope of USI A-12 was the review of the steam generator and reactor coolant pump supports of pressurized water reactors. l Lacrosse SEP A-27 _l
However, the staff has expande' d the. review to include other support structures, such as boiling water reactor (BWR) vessel supports, BWR pump supports, pressurized water reactor (PWR) vessel supports and 1 PWR pressurizer supports (NUREG-0577, Section 1.3). This expanded review will be undertaken in accordance with the guidance of Section 4 of NUREG-0577. j (b) USI A-7, " MARK I Containment Lona-Term Program" (NUREG-0649) Support integrity of the torus is being evaluated under USI A-7. i Under this task, a short-term program that evaluated Mark I contain-mant has provided assurance that the Mark I containment system of l each operating BWR facility would maintain its integrity and func-l tional capability during a postulated loss-of-coolant accident. A longer term program for BWR facilities, not yet licensed, is planned 4 wherein the NRC staff will evaluate the loads, load combinations, 1 and associated structural acceptance criteria proposed by the Mark I i Owners Group prior to the performance of plant-unique structural evaluations. The Mark I Owners Group has initiated a comprehensive testing and evaluation program to define design-basis loads for the Mark I containment system and to establish structural acceptance criteria which will assure margins of safety for the containment system ' which are equivalent to that which is currently specified in the ASME Boiler and Pressure Vessel Code. Also included in their program is an evaluation of the need for structural modifications and/or load mitigation devices to assure adequate Mark I containment system structural safety margins. (c) USI A-24, " Qualification of Class 1E Safety-Related Equipment" (NUREG-0371 and NUREG-0606) Snubber operability and degradation of seals are covered under USI A-24. ! ~ (d) USI A-46, " Seismic Qualification of Equipment in Operating Plants" (NUREG-0705) Mechanical snubbers are covered under USI A-46. (e) SEP Topic III-6, " Seismic Desian Considerations" Snubbers are evaluated for capacity under SEP Topic III-6. (f) SEP Topic V-1, " Compliance With Codes and Standards (10 CFR 50.55a)" Inservice inspection requirements for supports are covered under SEP Topic V-1, which refers to 10 CFR 50.55a. SEP plants currently have surveillance Technical Specifications on snubbers. The evaluation required by USI A-12, A-7, A-24, and.A-46 and SEP Topics III-6 and V-1 is identical to the evaluation required by SEP Topic III-9; therefore, this SEP topic has been deleted. Lacrosse SEP A-28
l TOPIC: III-10.A Thermal-Overload Protection for Motors of Motor-Operated Valves j (1) Definition: The primary objective of thermal overload relays is to protect motor windings of motor-operated valves (MOVs) against excessive heating. This feature of thermal overload relays could, however, interfere with the successful functioning of a safety-related system. In nuclear plant safety system application, the ultimate criterion should be to drive the valve to its proper position to mitigate the consequences of an accident, rather than to be concerned with degradation or failure of the motor due to excess heating. (2) Safety Objective: To assure that (1) thermal overload protection, if provided for MOVs, should have the trip setpoint at a value high enough to prevent spurious trips due to design inaccuracies, trip setpoint drift, or variation in the ambient temperature at the installed location; (2) the circuits which bypass the thermal overload protection under accident conditions should be designed to IEEE Std. 279-1971 criteria, as appropriate for the rest of the safety-related system; and (3) in MOV designs that use a torque switch instead of a limit switch to limit the opening or closing of the valve, the automatic opening or closino signal should be used in conjunction with a corresponding limit switch and thermal overload should remain as backup protection. (3) Status: The staff position (Reference 1) is implemented on designs of new appli-cations (construction permit and operating license). . (4)
References:
1
- 1. Standard Review Plan, Branch Technical Position EICSB 27, " Design Criteria for Thermal Overload Protection for Motors of Motor-0perated Valves"
- 2. Institute of Electrical and Electronics Engineers, IEEE Std. 279-1971, Criteria for Protection System for Nuclear Power Generating Stations"
- 3. Regulatory Guide 1.106, " Thermal Overload Protection for Electric Motors on Motor-0perated Valves" l TOPIC: III-10.B Pump Flywheel Intogrity (1) Definition:
l Review the PWR reactor coolant pump flywheel inservice inspection programs of operating plants to assure that they comply with the intent of Regula-tory Guide 1.14 and review reports of flywheel flaws if found by inservice inspections. (BWR reactor coolant pumps do not have flywheels.) Lacrosse SEP A-29
(2) Safety Objective: To assure that pump flywheel integrity is maintained to prevent failure at normal operating speeds and at speeds that might be reached under accident conditions and thus preclude the generation of missiles. (3) Status: The inservice inspection programs for flywheels of older PWRs have not been reviewed for compliance with t' e intent of Regulatory Guide 1.14. (4)
Reference:
Regulatory Guide 1.14, " Reactor Coolant Pump Flywheel Integrity" TOPIC: III-10.C Surveillance Requirements on BWR Recirculation Pumps and Discharge Valves (1) Definition: At facilities which have completed the low pressure coolant injection system ' (LPCIS) modification, the recirculation pump discharge valves and bypass valves are now required to close upon initiation of LPCIS. The closure of these discharge valves is necessary to isolate a pipe break in a suction line to prevent loss of cooling water by reverse flow through the recircula-tion pump or its bypass line and out the break. (2) Safety Objective: To assure effective core cooling in the event of a BWR recirculation line break on the pump suction line by closing the pump discharge valve and bypass line valve. (3) Status: All licensees of facilities with completed LPCIS modification have been sent letters requesting that they apply for a license amendment to incor-porate technical specification surveillance requirements on recirculation pump discharge valves and bypass valves. New BWRs have the LPCIS modifi-I 1 cation and technical specification surveillance requirements. (4)
Reference:
' NUREG-0328, " Regulatory Licensing: Status Summary Report," (Pink Book) Issue 3-46, June 17, 1977 l TOPIC: III-11 Component Integrity (1) Definition: Review licensee's criteria, testing procedures, and dynamic analyscs employed to assure the structural integrity and functional operability of safety-related mechanical equipment under faulted conditions and accident Lacrosse SEP- A-30
loads. Included are mechanical equipment such as pumps, valves, fans, pump drives, heat exchanger tube bundles, valve actuators, battery and instrument racks, control consoles, cabinets, panels, and cable trays. (2) Safety Objective: To confirm the ability of safety-related mechanical equipment having experienced problems to function as needed during and after a faulted or accident condition. The capability of safety-related mechanical equipment to perform necessary protective actions is essential for plant safety. (3) Status: This review is not currently under way in the Divisions of Operating Reactors. (4)
References:
- 1. 10 CFR Part 50, Section 50.55a
- 2. 10 CFR Part 50, Appendix A, GDC 2, 4, 14, and 15
- 3. Standard Review Plan, Section 3.9.2
- 4. American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section III,
- 5. Regulatory Guides ,
1.20, " Comprehensive Vibration Assessment Program for Reactor Internals During Preoperational and Initial Startup Testing" 1.68, " Initial Test Programs for Water-Cooled Nuclear Power Plants"
- 6. Institute of Electrical and Electronics Engineers, IEEE Std. 344-1975,
" Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations" '
- 7. Standard Review Plan, Section 3.9.3 (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
(a) USI A-46, " Seismic Qualification of Equipment in Operating l Plants" (NUREG-0606 and NUREG-0705) l The component integrity (both structural integrity and functional operability) for safety-related mechanical and electrical equipment for all operating plants including SEP plants will be addressed in this new USI (A-46). (b) USI A-2, " Asymmetric Blowdown Loads on Reactor Primary Coolant System" (NUREG-0649) l The assessment of faulted loads for the primary loop is being performed l under USI A-2. Furthermore, the assessment of high-energy pipe breaks considers the effect of accident loads with regard to jet impingement, pipe whip, and other reaction loads. i l (c) SEP Topic III-6, " Seismic Design Considerations" 1 The evaluation of equipment structural integrity under seismic loads will be performed under SEP Topic III-6. Lacrosse SEP A-31
l l The evaluations required by USI A-46 and A-2 and SEP Topic III-6 are identical to SEP Topic III-11; therefore, this SEP topic has been deleted. TOPIC: III-12 Environmental Qualification of Safety-Related Equipment (1) Definition: Safety related electrical and mechanical equipment that is required to survive and function under environmental conditions calculated to result from a loss of-coolant accident (LOCA) or a postulated main steam line break accident inside containment must be environmentally qualified. In addition, determine whether environment-induced failures of nonsafety-related equipment could interfere with the operation of safety equipment. Special attention should be given to the effect of beta radiation on exposed organic surfaces, such as gaskets. (2) Safety Objective: To assure that the mechanical and Class IE electrical equipment of safety systems has been qualified for the most severe environment (temperature, pressure, humidity, chemistry, and radiation) of design basis accidents. (3) Status: Westinghouse is conducting a verification program which is expected to be completed by the end of 1977 for those plants qualified to IEEE 323-1971. The Office of Nuclear Regulatory Research is sponsoring programs relating to Class IE equipment qualification, the results of which can be utilized to determine the adequacy of the equipment previously qualified. (4)
References:
- 1. NUREG-0153, " Staff Discussion of Twelve Additional Technical Issues Raised by Responses to November 3, 1976 Memorandum From Director, NRR, to NRR Staff," Issue 25, " Qualification of Safety-Related Equipment," December 1976 l 2. Division of Operating Reactors, D0R Technical Activities, Category B, i Item 34, " Environmental Qualifications of Safety-Related Equipment
! (Post LOCA)," May 1977 { 3. Division of Systems Safety, DSS Technical Activities, Category A, l Item 33, " Qualification of Class IE Safety-Related Equipment," l April 1977 4., Regulatory Guide 1.89, ". Qualification of Class IE Equipment for Nuclear Power Plants" ( l (5) Basis for Deletion (Related TMI Task, USI, or other SEP TopicJ: USI A-24, " Qualification of Class IE Safety-Related Equipment" i (NUREG-0371 and NUREG-0606) The issue identified in Reference 1 (NUREG-0153, Item 25) and the l review criteria, that is, Regulatory Guide 1.89, are identical to those specified in USI A-24. The Task Action Plan for USI A-24 Lacrosse SEP A-32
e n- ,
-e q '4,
- g (NUREG-0371)coversthe\environmentalqualif1ationof'bohelectrical and mechanical safety-related equipment.
s The evalbation required by USI' A-24*is identical to,'SEP' Topic III-12; therefore, this SEP topic has been deleted. . TOPIC: IV-1.A OperationWithLessTiianAllLocpsinService - x - (1) Definition: - 1 A number of BWR and PWR likensee'c have requested cuthorization to operate , with one of the recirculation loops (BWR) or steamygenerator loops .(PWR) out of service.\ These pr'oposals are being reviewed Onerically with regard to analytical methods. Plant-specific reviews will,be done to determine appropriate Technical Specification limits. PlapcGpecific reviews will address results,of LOCA analyses using genericaMP approved methods. Analysis of accidents,(other than LOQA) and operatiyg transients result-ing from operation in the (N-1) loop mode have been' reviewed on a " lead plant basis."iy'.ost of this effort has been com9leted. Tests have been conducted by General Electric which show that significant core flow asymmetries do*not exist with single-loop operation for two-loop plants; however, there is backflow through inactive jet purr.pt. Therefore, for single-loop operation, raodifications are necessary iri trip settings which take inputs from j'et pump drive flow. These will be determined on a plant-specific basis. , (2) Safety Objective:
.u - O ,
To provide' assurance that operation with less than all coolant loops in operation will not result in decreased safety margins. 3 (3) Status: .
/ s A combinption of generic and plant-specific reviews is being perform d'-on both BWRs and PWRs. '
l s O ( t IV-2 Reactivity Control Systems Including Fm.ctional Design'ano, TOPIC: N , yrotectionAgaingtSingleFailurec,,' ,' y (1) Definitiorn ,- ' I GeneralDesignCriterion25 requires'ttatthereact'orprotectionhystem be designed to assure that fuel-damage limits are never exceeded in the event of any single failure of the reactivity control systems. Reactivity control systems need not be designed sjngle failure proof, but the protec-tion system (which is designed against: sin of limiting fuel damage in the event of\a;gle reactivity failures) control system single should be ca s l failure. t .
- s ,
s (2) Safety Objective: ,
- g N
To assure that for all credible reactivity coritrol system f$ilures, the I' protection system will limit fuel damage 'to acceptable limiM. e. N s i: Lacrosse SEP A-33 . f
/
(3) Status: NRC has concluded that revisions to existing licenses are not warranted. Staff effort on this issue will continue at a low level. (4)
References:
- 1. NUREG-0138, " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum From Director, NRR, to NRR Staff," Issue No. 6, " Protection Against Single Failures in Reactivity Control Systems," December 1976.
- 2. Standard Review Plan, Section 15.4.3 TOPIC: IV-3 BWR Jet Pump Oparating Indications (1) Definition:
If a jet pump BWR operates with a failed jet pump, it may be impossible to reflood the core in the event of a LOCA. Some BWRs have experienced jet pump instrument sensing line failures. With a sensing line failed, it may not be possible to accurately measure core flow or to detect fail-ure of a jet pump. (2) Safety Objective: 4
'To assure that the core flow can be determined. Also to assure the ability to detect a jet pump failure for a range of crack / break sizes at various locations on the pump.
(3) Status: This issue is currently being reviewed for Dresden Units 2 and 3 and Quad Cities Units 1 and 2. The topic has generic implications for all jet pump BWR plants. (4)
References:
- 1. Letters from Commonwealth Edison Company to NRC, dated September 19, 1975, March 3, 1976, and June 7, 1976.
- 2. Letter from NRC to Commonwealth Edison Company, dated January 19, 1976.
- 3. Memorandum from J. H. Sniezek, NRC, to D. L. Ziemann, dated November 19, 1975.
TOPIC: $ V-1 Compliance With Codes and Standard (10 CFR 50.55a) ' (1) Definition: ; Review the licensee's inservice inspection and testing programs for Class 1, 2, and 3 pressure vessels, piping, pumps and valves and other safety related components to assure compliance with the American Society of Mechanical Engineers (ASHE) Code, Sections III and XI, as required by 10 CFR 50.55a. This review will also include review of the inservice inspection and testing program applicable to isolation condensers of the early operating BWRs. Lacrosse SEP ' A-34 L
(2) Safety Objective: To assure that the initial integrity of components is maintained through-out service life. (3) Status: NUREG-0081 was completed for reactor vessels not designed to ASME Code, Section III. The Engineering Branch conducts a generic review of all plants for compliance with inspection requirements of 10 CFR 50.55a(g) and fracture toughness requirements of 10 CFR 50.55a(i). This program will continue for the life of operating, reactors. (4)
References:
- 1. 10 CFR Part 50, Section 50.55a
- 2. American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Sections III;and XI 1 4 3. NUREG-0081, " Evaluation of the Integrity of Reactor Vessels Designed
\ to ASME Code, Section I and/or VIII," July 1976
\ 4. Memorandum from'V.' Stello, NRC, to B. H. Grier, October 12, 1976
\
TOPIC: V-2 Applicability \ of Code Cases
.(1) Definition:
Review Code Cases currently accepted by the NRC, t.s indicated in Regula-tory Guides 1.84 and 1.85. (2) Safety Objective: \ 7 ,, l To assure that only those Co'de Cases which are acceptable to the NRC are utilized by the licensee in the design, fabricatierri or repair of the plant. The use of Code Cases other than those contained in Regulatory Guides 1.84 and 1.85 are addressed on a case-by-case basis to assess their acceptability. (3) Status: l The Engineering Branch, Division of Operating Reactors, routinely reviews design modifications and component repairs (for example, reactor vessel The program ! s cozzles) to assure compliance with NRC acceptable Code Ca.ses. ! : lis ongoing on an as-needed basis. (4)' Re'ferences: i s'e'gulatory R Guides 1.84,." Design and Fabrication Code Case Acceptability - ASME Section III, ' Division 1" 1.85, " Materials Code Case Acceptability - ASME Section III, Division 1" e Lacrosse SEP A-35 t
TOPIC: V-3 Overpressurization Protection (1) Definition: Inadvertent overpressurization of the primary system at temperatures below the nil ductility transition temperature may result in reactor vessel fail-ure during heatup and pressurization. Such overpressure transients are caused by pressure surges when the primary system is water solid. The most severe transients have occurred when a charging pump starts up or inadvertent closing of a letdown valve with a charging pump running. Pressure temperature limits as a function of neutron fluence of the material at the reactor vessel beltline are specified in 10 CFR 50, Appendix G. All PWR licensees have been directed to institute interim administrative procedures to prevent damaging pressure transients and on a longer time scale to provide permanent protection which will probably include hardware changes such as high-capacity safety relief valves. (2) Safety Objective: To protect the primary system from potentially damaging overpressurization transients during plant pressurization and heatup. (3) Status: Generic review of all PWR licensee submittals is under way. Criteria for evaluation have been developed and refined by the Office of Nuclear Reactor Regulation and the Office of Nuclear Regulatory Research. An effort is being made to complete the review sufficiently early to ensure installation of mitigating systems by the end of 1977. (4)
Reference:
NUREG-0138, " Staff Discussion of Fifteen Technical Issues Listed in Attachp;nt to November 3, 1976 Memorandum From Director, NRR to NRR Staff," November 1976 (5) Basis for Deletion (Related TMI Task, USI,'or Other SEP Topic): USI A-26, " Reactor Vessel Pressure Transient Protection" (NUREG-0410) Under USI A-26, licensees were requested to modify their systems and procedures to protect against low temperature overpressurization. All operating PWRs have made these modifications, and safety evalua-tion reports for the SEP' plants have been issued. The evaluation required by USI A-26 is identical to SEP Topic V-3; therefore, this SEP topic has been deleted. TOPIC: 4-4 Piping and Safe-End Integrity (1) Definition: Review the safety aspects that affect BWR and PWR piping and safe end integrity for compliance with 10 CFR Part 50, includiig fracture toughness, Lacrosse SEP A-36
flaw evaluation, stress corrosion cracking in BWR and PWR piping, and control of materials and welding. (2) Safety Objective: To ensure continued piping integrity and compliance with 10 CFR Part 50 and applicable industry codes and standards. (3). Status: The Engineering Branch, Division of Operating Reactors, is conducting an ongoing program that includes the as-needed review of those aspects necessary to ensure the continuing integrity of piping systems important to safety including stress corrosion cracking of BWR coolant pressure boundary piping. This program will continue for the life of operating reactors. (4)
Reference:
' American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section XI (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
(a) USI A-42, " Pipe Cracks in Boiling Water Reactors" (NUREG-0510) The scope of USI A-42 is the study of stress corrosion cracking in
> BWR piping. NUREG-0313, Revision 1, " Technical Report on Material i Selection and Processing Guidelines for BWR Coolant Pressure Boundary Piping," is the resolution of USI A-42 and presents staff positions.
! (b) USI A-10, "BWR Feedwater Nozzle Cracking and Control Rod Drive l Hydraulics Return Line Nozzle Cracking" (NUREG-0649) l (c) NRR Generic Activity C-7, "PWR System Piping" (NUREG-0471) The scope of this activity is the study of stress corrosion cracking 1 in PWR piping. NUREG-0691, " Investigation and Evaluation of Crack-I ing Incidents in Piping in Pressurized Water Reactors," recommends the same corrective actions (pp. 2-12) proposed for BWRs in NUREG-0313, Revision 1, USI A-42. ! The evaluation required by USI A-42 and Task C-7 is identical to the evaluation required by SEP Topic V-4; therefore, this SEP topic has 7
- been deleted.
l V-5 Reactor Coolant Pressure Boundary (RCPB) Leakage Detection
~
TOPIC: (1) Definition: Reactor primary coolant leakage detection systems are a significant means of preventing primary system boundary failure by identifying leaks before failures occur. L i I Lacrosse SEP A-37 l l
(2) Safety Objective: To provide reliable and sensitive leakage detection systems to identify primary system leaks at an early stage before failures occur.
- (3) Status
. This issue has been resolved for all plants which have recently received an operating license by requiring conformance to Regulatory Guide L45.
Individual older plants.have not been systematically reviewed and leakage detection systems may need upgrading on a plant-by plant basis. J i (4)
References:
1.
- Regulatory Guide 1.45, " Reactor Coolant Pressure Boundary Leakage Detection Systems"
- 2. Standard Review Plan, Section 5.2.5
- TOPIC
- V-6 Reactor Vessel Integrity i (1) Definition:
1 Review the safety aspects that affect BWR and PWR reactor vessel and nozzle integrity for compliance with 10 CFR Part 50, including fracture toughness, neutron irradiation, evaluation of surveillance programs, operating limita-tions, inservice inspection and flaw evaluation, and transient analyses.
- (2) Safety Ojective
i To assure continued reactor vessel integrity and compliance with 10 CFR Part 50 and applicable industry codes and standards. 4 (3) Status: The Engineering Branch, Division of Operating Reactors, is conducting l ongoing programs that include the periodic review of aspects necessary to ensure the continued integrity of reactor vessels. These programs include-- i BWR feedwater and control rod drive nozzle cracking, low upper-shelf toughness, radiation effects, reactor vessel materials surveillance, and updating of operating plants' inservice inspection programs and will continue for the life of operating reactors. ! (4)
References:
k L 1. 'NUREG-0312, " Interim Technical Report on BWR Feedwater and Control i Rod Drive Return Line Nozzle Cracking," July 1977 l 2. 10 CFR Part 50, Appendix G
- 3. Regulatory Guide 1.99, " Effects of Residual Elements on Predicted Radiation Damage to Reactor Vessel Materials" i
- 4. American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section III, Appendix G
- 5. American Society of Testing Materials, ASTM E185, " Standard Recommended Practice for Surveillance Tests for Nuclear Reactor Vessels" !
LeCrosse SEP A-38 i _, _ . , _ . , , _ +sy_ ,-~-. , ---.-.-,-.ymwgm_= - - , , - - . , , , , . , _g , .+y-_ = . , , ,. ,
- 6. American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," Section XI
- 7. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book),
Issue 3-9, 3-21, 3-41 TOPIC: V-7 Reactor Coolant Pump Overspeed (1) Definition: Review the potential for reactor coolant pumps to fail because of over-speed in the unlikely event of a major loss-of-coolant accident (LOCA). (2) Safety Objective: To assure that, in the event of a major LOCA, a reactor coolant pump assembly is not driven to a speed which would cause structural failure of the unit and result in missiles which could increase the consequences of the LOCA. Of greatest concern are the PWR pump flywheels because of their mass and rotational energy. (3) Status: An indepth review of this topic was performed by the Atomic Energy Commission staff and reported to the Advisory Committee on Reactor Safeguards (ACRS) in 1973 (Reference 1). The staff concluded that, because of the small likelihood for the occurrence of a pump overspeed event that could seriously increase the consequences resulting from a LOCA (less than 10-8 per plant year), the action taken by the staff to assess tt..s problem in a generic fashion outside the context of individual application reviews is an accept-able course to foilow. A generic experimental program to be completed in 1978 by the Electric Power Research Institute is expected to provide data to verify pump model overspeed predictions. (4)
References:
- 1. Letter from R. C. DeYoung, NRC, to Harold G. Mangelsdorf, ACRS, August 6, 1973, transmitting " Report on Reactor Coolant Pump Overspeed During a LOCA," August 3, 1973.
- 2. Regulatory Guide 1.14, " Reactor Coolant Pump Flywheel Integrity" l
TOPIC: V-8 Steam Generator (SG) Integrity (1) Definition: Review the safety aspects affecting operation of steam generators includ-ing secondary water chemistry, tube plugging criteria, inservice inspec-tion, possibly including a dimensional inspection for proper evaluation of denting, steam generator tube leakage, tube denting, flow-induced vibration of steam generator tubes, tube repair, and tube bundle or steam generator replacement. Lacrosse SEP A-39
(2) fafety Objective: To ensure that acceptable levels of integrity of that portion of the reactor coolant pressure boundary made up by the steam generator are maintained in accordance with current codes, standards, and/or regulatory criteria during normal and postulated accident conditions. The integrity
' of the steam generator is needed to ensure that leakage following a postu-lated design basis accident will not result in doses to the public in excess of 10 CFR Part 100 guidelines and that the emergency core cooling systems will be able to perform their safety functions.
(3) Status: i Review of this topic is being performed by the Division of Operating Reactors (DOR). This effort will continue for the life of operating reactors.
- (4) .
References:
1
- 1. Regulatory Guide 1.83, Rev.1, " Inservice Inspection of Pressurized Water Reactor Steam Generator Tubes"
- 2. Regulatory Guide 1.121, " Bases for Plugging Degraded PWR Steam Generator Tubes" l 3. 10 CFR Part 50, Appendix A, GOC 30 and 32 i 4. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book),
i 3-27 { (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic): [ USI A-3, A-4, A-5, " Westinghouse, Combustion Engineerin<2, and Babcock and Wilcox Steam Generator Tube Integrity" (NURiG-0649) The definition of this topic and the references cited are covered by USI A-3, A-4, and A-5. The evaluation for USI A-3, A-4, and A-5 is identical to SEP Topic V-8; therefore, this SEP topic has been
- deleted.
-TOPIC: V-9 Reactor Core Isolation Cooling System (BWR)
(1) Definition: Reactor core isolation cooling (RCIC) has not been classified as a safety system. On GESSAR, for certain small breaks, GE assumed credit for RCIC as a backup for HPCI. The s~taff required GE to reclassify the RCIC system on the GESSAR 238 standard NSSS as a safety system. j (2) Safety Objective: To ensure that the RCIC system is qualified as a safety system where credit is assumed in the safety analysis. (3) Status: GE has agreed to reclassify RCIC as a safety system on the GESSAR docket. Lacrosse SEP A-40 1 l
TOPIC: V-10.A Residual Heat Removal System Heat Exchanger Tube Failures (1) Definition: Residual heat removal (RHR) heat exchangers are designed to remove residual and decay heat so that the reactor can be placed in a safe cold shutdown condition and to maintain core cooling following a postulated loss-of- - coolant accident. Some light-water reactors (LWRs) have a pressure control system on the cooling water piping system which maintains the pressure of the cooling water higher than the primary coolant pressure in the primary coolant side of the heat exchanger during plant cooldown operations. A leak in the tubes could result in back leakage of coolant water into the primary loop. Pressure in the cooling water side is maintained higher than that in the primary coolant side so that in the event of a tube failure there would be no leakage of radioactive fluids into the environ-ment. Cooling water passing from the cooling water side of the heat exchanger into the primary coolant water could introduce impurities such as chlorides into the primary coolant system. (2) Safety Objective: To assure that impurities from the cooling water system are not introduced into the primary coolant in the event of an RHR heat exhanger tubo failure. (3) Status: Recently there have been several RHR heat exchanger tube failures at operating BWRs. This issue has been defined as a 00R Category B Technical Activity. TOPIC: V-10.B Residual Heat Removal System Reliability l (1) Definition: l In all current plant designs, the residual heat removal (RHR) system has i a lower design pressure than the reactor coolant system (RCS). In most l current designs, the system is located outside of containment and is part f of the emergency core cooling system. However, it is possible for the l RHR system to have different design characteristics. For example, the ! RHR system might have the same design pressure as the RCS, or be located inside of containment. The functional, isolation, pressure relief, pump l . protection, and test requirements for the RHR system are of concern in the safety review of reactor plants. Three types of RHR system designs are defined in Branch Position RSB 5-1. On June 24, 1976, the Regulatory Requirements Review Committee approved a revision of Standard Review Plan, Section 5.4.7 requiring a capability to i ! go from hot to cold shutdown without offsite power and that all components necessary for cooldown from hot shutdown must be designed to safety grade seismic I standards, and be operable from the control room. System must be designed to meet the single failure criterion. Lacrosse SEP A-41 __ _ _ _ l
i l (2) Safety Objective: To ensure reliable plant shutdown capability using safety grade equipment. (3) Status: Because of vendor concern over the impact of the revision, a review was conducted of three PWR plants, and as a result of this review, the staff is proposing that Branch Position RSB 5-1 be modified but that the functional requirements be retained. (4)
References:
- 1. Standard Review Plan, Branch Technical Position RSB 5-1, " Design Requirements of the Residual Heat Removal System"
- 2. Standard Review Plan, Section 5.4.7 2
- 3. Memorandum from E. G. Case, NRC, to L. V. Gossick, July 15, 1976.
- 4. Summary of meeting September 22, 1976, " Capability To Achieve Cold Shutdown Using Safety Grade Systems and Equipment," C. O. Thomas, t
Docket No. STN-50-545, October 5, 1976. TOPIC: V-11.A Requirements for Isolation of High and Low-Pressure Systems (1) Definition: Several systems that have a relatively low design pressure are connected to the reactor coolant pressure boundary. The valves that form the inter-face between the hign- and low pressure systems must have sufficient redundancy and interlocks to assure that the low pressure systems are not subjected to coolant pressures that exceed design limits. The problem is complicated since under certain operating modes (for exacple, shutdown cooling and emergency core cooling system injection), these valves must open to assure adequate reactor safety. (2) Safety Objective: 1 To assure that adequate measures are taken to protect low pressure systems connected to the primary system frca Deing subjected to excessive pressure which could cause failures and in scae cases potentially cause a loss of-coolant accident outside of containment. (3) Status: A preliminary review of a representative operating plant of each nuclear steam supply system vendor was undertaken. Each low pressure system 5 connected to the reactor coolant pressure boundary and penetrating the containment was examined. The investigation of a few potential areas of concern is continuing. Lacrosse SEP A-42
TOPIC: V-11.8 Residual Heat Removal System Interlock Requirements (1) Definition: The residual heat removal (RHR) system is normally located outside of primary containment. It is an intermediate pressure system (usually 600 psia) and has motor-operated valve (MOV) isolation valves connecting it to the reactor coolant system (RCS). If the RHR system were inadvertently connected to the RCS while the RCS is at pressure, a loss-of-coolant acci-dent (LOCA) could result with a loss of all capability of core reflooding since the coolant inventory could be lost outside of containment. To prevent inadvertent opening of the MOVs while the RCS is at pressure, an "0 PEN PERMISSIVE" interlock is provided.
"If the operator shuts only one of the isolation valves prior to pressurizing the RCS, there is a single valve RCS pressure boundary.
To ensure that both MOVs are shut during a startup and heatup, an "AUT0-CLOSURE" interlock is provided that closes the MOVs. (2) Safety Objective: To ensure that operating reactor plants are adequately protected from overpressurizing the RHR system and potentially causing a LOCA outside of containment. (3) Status: Several PWR plants do not have the auto closure feature on the RHR, and at least one does not have the open permissive feature. Plants should be reviewed on a case-by-case basis factoring in (1) ASME Code safety valve setting and capacity, (2) interlocks, (3) closure time of MOVs, and (4) location of RHR. (4)
References:
- 1. Proposed Branch Technical Position RSB-5-1, " Design Requirements of the Residual Heat Removal System"
- 2. Regulatory Requirements Review Committee Meeting No. 50, June 24, 1976
- 3. 10 CFR Part 50, Appendix A, GDC 34
- 4. Memorandum from .1 Angelo to R. C. DeYoung, V. Stello, et al., NRC,
Subject:
"RP-TR Staff Meeting of February 13, 1974 Regarding the Requirements on Shutdown Cooling Systems," February 28, 1974
- 5. Letter from R. Boyd, NRC, to C. Eicheldinger, Westinghouse Electric Corporation, November 12, 1975
- 6. Letter from R. Boyd, NRC, to I. Stuart, General Electric Company, November 12, 1975
- 7. Letter from R. Minogue, NRC, to J. D. Geier, Illinois Power Company, July 8, 1975 Lacrosse SEP A-43
5 TOPIC: V-12.A Water Purity of BWR Primary Coolant (1) Definition: Review the primary water monitoring and reactor water cleanup system capa-bilities, including the water purity, to determine if the maintenance of the necessary purity levels complies with Regulatory Guide 1.56. Review limits on quality control and defined provisions in the event of demineral- ; izer breakthrough. (2) Safety Objective: 1 To assure that the water purity level is acceptably low to minimize the potential for intergranular stress corrosion cracking of austenitic stainless steel piping in the reactor coolant pressure boundary of BWRs, including assuring the implementation of Regulatory Guide 1.56. l (3) Status: Recommendations for specifying the use of additional conductivity measure-ments and monitoring at various locations, plus the use of pH and chloride measurements, have been submitted to the Division of Standards Development to initiate a revision of Regulatory Guide 1.56, " Maintenance of Water Purity in Boiling Water Reactors," dated June 1973. To date, a generic review of operating BWRs has not been initiated and the current regula- ' tory guide has been implemented in the Technical Specifications of only a few operating plants. (4)
Reference:
Memorandum from R. E. Heineman, to R. B. Minogue, NRC,
Subject:
" Request for Revision of Regulatory Guide 1.56," 1973 TOPIC: V-13 Waterhammer j (1) Definition:
Waterhammer events have occurred in light water reactor systems. Water-hammer events increase the probability of pipe breaks and could increase the consequences of certain events such as the loss of-coolant accident. The types of waterhammer, the vulnerable systems (for example, contain-ment spray, service water, feedwater, and steam), and the safety signifi-cance of waterhammer have been identified and defined in a staff report of May 1977. - (2) Safety Objective: To reduce the probability of waterhammer events that have the potential to lead to pipe ruptures in light-water reactor systems which are needed , to mitigate the consequences of accidents or that might increase the 1 consequences of accidents previously analyzed. 4 Lacrosse SEP A-44
(3) Status: Generic review is under way. On March 10, 1977, an interdivisional Division of Operating Reactors / Division of Systems Safety technical review group was formed to investigate the waterhamer issue and to develop a program for its appropriate consideration in licensing reviews and for operating reactors. Consultant work has been performed by CREARE and Livermore Labs. (4)
References:
- 1. " Water Hamer in Nuclear Power Plants," NRC Staff Report, June 1,1977
- 2. Wallis, G. B., P. H. Rothe, et al., "An Evaluation of PWR Steam Generator Water Hamer" (draft), CREARE Inc. , F?bruary 1977
- 3. Sutton, S. B., "An Investigation of Pressure Transient Propagation in Pressurized Water Reactor Feedwater Lines" (preliminary),
Lawrence Livermore Laboratory, April 15, 1977
- 4. Office of Nuclear Reactor Regulation, NRR Technical Activities, Category A, Item 1, " Water Hamer," May 1977 (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
- USI A-1, " Water Hamer" (NUREG-0649)
The references cited in this topic were the precursors of USI A-1. The evaluation required for USI A-1 is identical to SEP Topic V-13; therefore, this SEP topic has been deleted. TOPIC: VI-1 Organic Materials and Postaccident Chemistry (1) Definition: (a) Organic materials The design basis for selection of paints and other organic materials t l is not documented for most operating reactors. Therefore, there is l a need to review the suitability of paints and other organic materials used inside containment, including the possible interactions of the decomposition products of organic materials with engineered safety features (such as filters). ( l (b) Postaccident chemistry l Low pH solutions that may be recirculated within containment after a i design basis accident (DBA) may accelerate chloride stress corrosion cracking which may lead to equipment failure or loss of containment integrity. Low pH may also increase the volatility of dissolved iodines with a resulting increase in radiological consequences. (2) Safety Objective: I (a) Organic materials To assure that organic paints and coatings used inside containment do not behave adversely during accidents when they may be exposed to ! high radiation fields. In particular, the possibility of coatings clogging sump screens should be minimized. Lacrosse SEP A-45
(b) Postaccident chemistry To assure that appropriate methods are available to raise or main-tain the pH of solutions expected to be recirculated within contain-ment after a DBA. (3) Status: No work currently being done on this subject for operating plants. (4)
References:
- 1. Standard Review Plan, Sections 6.1.2 and 6.1.3
- 2. Regulatory Guide 1.54, " Quality Assurance Requirements for Protective Coatings Applied to Water-Cooled Nuclear Power Plants" TOPIC: VI-2.A Pressure-Suppression-Type BWR Containments (1) Definition:
BWR pressure-suppression-type containments (for example, Mark I containment) are subjected to hydrodynamic loads during the blowdown phase of a lost of-coolant accident (LOCA). These loads have the potential for damaging the components and structures (wetwell, internal structures, restraints, supports, and connected systems) of the containment. During a relief valve blowdown into the suppression pool, the wetwell (torus) shell and safety / relief valve restraints may be overstressed. The hydrodynamic loads were not explicitly identified and included in the design of the Mark I pressure-suppression containment. (2) Safety Objective: To assure that the structural integrity of pressure-suppression pool con-tainments is maintained under hydrodynamic loading conditions. It has been determined that the upward forces during the blowdown phase follow-ing a LOCA potentially cause the Mark I torus to be lifted, causing fail-ure of connecting systems and supports and leading to loss of the contain-ment integrity. Structural modifications and/or changes in the mode of operation might be necessary to' assure adequate safety margins. (3) Status: Mark I containments are currently evaluated in a two-step generic review program: The Short-Term Program (STP), completed May 1977, has focused on the determination of the magnitude and significance of hydrodynamic loads. In the Long-Term Program (LTP), to be completed by late 1978, the design basis loads will be finalized and the capability of the containment to withstand the loads within the original design structural margins will be verified. This verification will be based in part on research results from NRC and industry sponsored programs. As a result of the STP, the staff required that Mark I plants be operated with a drywell to wetwell differential pressure of at least 1 psi to reduce the vertical loads. In addition, some licensees have modified the torus support system for addi-tional safety margin. ' i Lacrosse SEP A-46 l
(4)
References:
- 1. NUREG-0328, " Regulatory Licensing: Status Summary Report," (Pink Book) - Generic Issues (April 1977)
- a. Mark I Containment - STP Technical Specifications
- b. Mark I Containment Evaluation - STP
- c. Mark I Containment Evaluation - LTP
- d. Mark I Safety / Relief Valve Line Restraints in Torus
- 2. Division of Operating Reactors, D0R Technical Activities, Category A, April 1977
- a. Item 2, " Mark I Containment STP"
- b. Item 3, " Mark I Containment LTP"
- c. Item 23, " Mark II Containment"
- 3. Division of Operating Reactors, 00R Technical Activities, Category B, Item 12, " Assessment of Column Buckling Criteria," May 1977
- 4. Division of Systems Safety, DSS Technical Activities, Category A, Item 31, " Determination of LOCA and SRV Pool Dynamic Loads for Water Suppression Containments," April 1977 (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
- USI A-7, " Mark I Containment Long-Term Program" (NUREG-0649)
Under this task, a short-term program that evaluated Mark I contain-ment has provided assurance that the Mark I containment system of each operating BWR facility would maintain its integrity and func-tional capability during a postulated LOCA. A longer term program for BWR facilities, not yet licensed, is planned wherein the NRC staff will evaluate the loads, load combinations, and associated structural acceptance criteria proposed by the Mark I Owners Group prior to the performance of plant-unique structural evaluations. The Mark I Owners Group has initiated a comprehensive testing and evaluation program to define design basis loads for the Mark I con-tainment system and to establish structural acceptance criteria which will assure margins of safety for the containment system which are equivalent to that which is currently specified in the ASME Boiler and Pressure Vessel Code. Also included in their program is an evalua-tion of the need for structural modifications and/or load-mitigation devices to assure adequate Mark I containment system structural safety margins. The long-term program for USI A-7 will assure that all plants with Mark I containments are able to tolerate, without loss of function, the LOCA-induced hydrodynamic loads. l The evaluation required by USI A-7 is identical to SEP Topic VI-2.A; ! therefore, this SEP topic has been deleted. TOPIC: VI-2.B Subcompartment Analysis (1) Definition: The rupture of a high energy line inside a containment subcompartment can cause a pressure differential across the walls of the subcompartment. In Lacrosse SEP A-47 i l
. - _ - _ ~ __-
I the case of a rupture of a PWR main coolant pipe adjacent to the reactor vessel, the subcooled blowdown produces pressure differentials in the annulus between the reactor vessel and the shield wall and also within the reactor vessel across the core barrel. This asymmetric pressure dis-tribution generates loads on the reactor vessel support and on reactor , vessel internals, on other equipment supports, and on subcompartment struc-tures which have not been analyzed previously for sust operating reactors. (2) Safety Objective: To assure that the reactor vessel supports, reactor vessel internals, and other equipment supports and subcompartment structures are designed with i an adequate margin against failure due to these loads. The failure could l result in a loss of emergency core cooling system capability. [ (3) Status: The staff is reviewing the nuclear steam supply system vendor and architect-engineer design codes used to calculate the loads produced by the asymmetric pressure distribution. Analyses have been completed for a limited number of operating plants. The W TMD code is approved. Bechtel, Gilbert, and United Engineering have submitted codes for review. (4)
References:
- 1. NUREG-0328, " Regulatory Licensing: Status Summary Report," (Pink Book) - Generic Issue, Item 3-5, " Asymmetric }.0CA Loads - PWR,"
April 1977
- 2. Division of Operating Reactors, DOR Technical Activities, Category A, Item 32, " Asymmetric LOCA Loads (Reactor Vessel Support Problem),"
April 1977
- 3. Division of Systems Safety, DSS Technical Activities, Category A, Item 14, " Asymmetric Blowdown Loads on Reactor Vessel," April 1977
, 4. Division of Project Management, DPM Technical Activities, Category A, j Item 2, " Reactor Vessel Supports (Asymmetric LOCA Loads From Sudden Subcooled Blowdown)," April 1977 (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic): USI A-2, " Asymmetric Blowdown Loads on Reactor Primary Coolant System" (NUREG-0649) The references cited in this topic were the precursors of USI A-2. The evaluation required fqr USI A-2 is identical to SEP Topic VI-2.B (see also SEP Topic III-8.D); therefore, this SEP topic has been deleted. TOPIC: VI-2.C Ice Condenser Containment (1) Definition: Operating experience from the D. C. Cook plant has indicated that sub-limation and melting of ice causes a loss of ice inventory and related functional performance problems for the ice consenser system. P Lacrosse SEP A-48 1
l (2) Safety Objective: To assure that a sufficient ice inventory is maintained and to assure the functional performance of the ice condenser system. (3) Status: The results of the surveillance program for ice inventory and of the functional performance testing (for example, operation of vent doors) are periodically reviewed by the staff to determine whether the surveillance frequencies should be increased or other action should be taken. Recent surveillance testing indicates that the ice inventory is acceptable and that the D. C. Cook plant can be' operated safely for the current fuel cycle. CONTEMPT-4 long-term ice condenser code is expected to be completed by Edgerton, Germeshausen & Grier in October 1977. (4)
Reference:
Division of Operating Reactors, 00R Technical Activities, Category B, Item 53, " Ice Condenser Containments," May 1977 TOPIC: VI-2.0 Mass and Energy Release for Postulated Pipe Breaks Inside Containment (1) Definition: Review the methods and assumptions of the mass and energy i lease model, including containment temperatures and pressure response, that were used in previously performed analyses of high-energy line breaks inside containment, including the main steam line break. (2) Safety Objective: To assure that design basis conditions (for example, design pressure and temperature) for the containment structure and safety-related equipment are adequate. Determine if the models used in the earlier analyses provide adequate margins of safety when compared with the assumptions and models for current analytical techniques. (3) Status: Mass and energy release models, including containment response models, l are being reassessed to determine the degree of conservatism in the pre-diction of the containment pressure and temperature transient resulting from a PWR main steam line break. Application of those models to operating plants is contingent on the results of this reassessment. Mass and energy release models for operating BWR plants are considered in the Mark I Long-Term Program and other BWR review efforts. (4)
References:
- 1. Division of Operating Reactors, D0R Technical Activities, Category B, May 1977 l
l l Lacrosse SEP A-49
- a. Item 1, " Pipe Break Inside Containment"
- b. Item 2, " Mass and Energy Release to Containment"
- 2. Division of Systems Safety, DSS Technical Activities, Category A, April 1977
- a. Item 7, " Pipe Rupture Design Criteria"
- b. Item 29, " Main Steam Line Break Inside Containment"
- 3. Division of Systems Safety, DSS Technical Activities Report, Item I-C.B.1, " Mass and Energy Release to Containment," December 1975 TOPIC: VI-3 Containment Pressure and Heat Removal Capability (1) Definition:
The temperature and pressure conditions inside containment due to a postulated loss-of-coolant accident (LOCA), main steam line or feedwater line break depend on the effectiveness of passive heat sinks and active heat removal systems (for example, containment spray system). (2) Safety Objective: To assure that the maximum temperature and pressure following a LOCA, main steam, or feedwater line break have been calculated with conservative assumptions and to assure that the passive heat sinks and active heat removal systems provide the full heat removal capability required to main-tain the pressure and temperature below the design pressure and temperature of the containment, of safety-related equipment, and ir.strumentation inside containment. (3) Status: The modified CONTEMPT computer code properly accounts for the condensation of superheated steam on containment passive heat sinks. The effects on the design temperatures within the containment are being studied for plants under licensing review. (4)
References:
- 1. Standard Review Plan, Section 6.2.1.1.A
- 2. Division of Systems Safety, DSS Technical Safety Activities Report, December 1975
- 3. Division of Operating Reactors, D0R Technical Activities, Category B, Item 62, " Effective Operation of Containment Sprays in LOCA," May 1977 TOPIC: VI-4 Containment Isolation System (1) Definition:
Isolation provisions of fluid system of nuclear power plants limit the release of fission products from the containment for postulated pipe breaks inside containment and thus prevent the uncontrolled release of primary system coolant as a result of postulated pipe breaks outside containment. This must be accomplished without endangering the perform-ance cf postaccident safety systems. Review the primary containment Lacrosse SEP A-50
isolation provisions, in particular, the containment sump lines and fluid systems penetrating containment. Review the design bases for containment ventilation system isolation valves to determine potential releases from the containment. Review the containment purge made during normal operation with respect to various accident scenarios and consequences including operation of containment purge valves, closure times, and leak tightness. (2) Safety Objective: To assure that the primary containment isolation provisions meet the require-ments of 10 CFR 50, Appendix A, General Design Criteria 54 through 57. Some of the operating plants may have too few or too many . isolation pro-visions. Containment purging during normal operation in PWRs has raised a concern regarding the ability of the ventilation system isolation valves to close upon receipt of an accident signal. The use of resilient sealing materials in conjunction with the cycling of these valves has resulted in an increased degradation in the leakage integrity of the valve seats. To assure the adequacy of the maintenance and repair schedule to maintain the leakage integrity of the valves for the service life of.the plant. To assure that containment purge operations will not adversely affect the consequences of postulated accidents. (3) Status: The functional performance of the sump lines and emergency core cooling systems is being reviewed in conjunction with the Appendix K submittals. Implementation criteria are being developed to apply the requirements of Branch Technical Position CSB 6-4 to containment purging practices and to improve the leakage integrity of ventilation system isolation valves. (4)
References:
- 1. 10 CFR Part 50, Appendix A, GDC 54 through 57 l 2. Standard Review Plan, Section 6.4.2
- 3. Standard Review Plan, Branch Technical Position CSB 6-4, " Containment Purging During Normal Plant Operations" l
TOPIC: VI-5 Combustible Gas Control (1) Definition: I Review the combustible gas control system to determine the capability of the system to monitor the combustible gas concentration in the containment, to mix combustible gases within the containment atmosphere, and to maintain - combustible gas concentrations below the combustion limits (for example, by recombination, dile' ' or purging). For facilities which share recombiners (portable) oetween units or sites, determine that the recom-biners can be made available within a suitable time. For facilities which ! utilize purging as a primary meEns of combustible gas control, determine l the radiological consequences of the system operation. Reevaluate hydrogen l production and accumulation analysis to consider (1) reduction of Zr/ water l reaction on the basis of five times the Appendix K calculation amount and (2) potential increases in Udrogen production from corrosion of metals inside containment. 1 ! Lacrosse SEP A-51
=_. - . . . . _-
l (2) Safety Otijective: I To prevent the formation of combustible gas enlosive concentrations in the containment or in localized regions within containment, following a postulated accident; to assure that the radiological consequences of the system operation are acceptable. (3) Status: Proposed 10 CFR 50.44 would permit a BWR licensee to propose an alternate combustible gas control system in lieu of inerting. Four such proposals for containment atmosphere dilution systems are currently under review, and the COGAP II computer code is being revised to perform the system evaluations. (4)
References:
- 1. Proposed rule 10 CFR Part 50, Section 50.44
- 2. Division of Operating Reactors, D0R Technical Activities, Category A, Item 8, " Containment Purge During Normal Operation," April 1977
- 3. Division of Operating Reactors, DOR Technical Activities, Category A, i
Item 14, "Inerting Requirements / CAD," April 1977 4. Standard Review Plan, Branch Technical Position CSB 6-2, " Control of Combustible Gas Concentrations in Containment Following a Loss of
' Coolant Accident"
- 5. Standard Review Plan, Section 6.2.5 (5) Basis for Deletion (Related TMI TASK, USI, or Other SEP Topic):
(a) TMI Action Plan Task II.B.7, " Analysis of Hydrogen Control" (NUREG-0660) As a result of TMI Task II.B.7, short- and long-term rulemaking to amend 10 CFR 50.44 has been initiated. The short-term rulemaking (interim rule) requires that all Mark I and Mark II containments be inerted. It also requires that the owners of all plants with other containments perform certain analyses of accident scenarios involving hydrogen releases and furnish the staff with a proposed approach for mitigating these hydrogen releases. !' The longer-term rulemaking will address both degraded core and melted core issues. In the area of hydrogen control, it will pre-scribe requirenents that are appropriate for operating plants as well as for plants under construction. (b) USI A-48, " Hydrogen Control Measures and Effects of Hydrogen Burns
; on Safety Equipment" (NUREG-0705)
Under USI A-48, a Task Action Plan has been de' fined and is being developed that encompasses the concerns in the Definition and the Safety Objective of SEP Topic VI-5. - The evaluation required by TMI II.B.7 and USI A-48 is identical to SEP Topic VI-5; therefore, this SEP topic has been deleted. I Lacrosse SEP A-52 l,
i TOPIC: VI-6 Containment Leak Testing (1) Definition: Certain requirements of primary reactor containment leakage testing for water-cooled power reactors as described in Appendix J to 10 CFR Part 50 (issued February 1973) have been found to be conflicting, impractical for implementation, or subject to a variety of interpretations. Review the primary reactor containment leak testing program for operating nuclear plants. (2) Safety Objective: To assure that the containment leak testing program provides a conserva-tive assessment of the leakage rate through individual leak &ge barriers and to assure that proper maintenance and repairs are conducted during the service life of the containment. The testing acceptance criteria are established to ensure that containment leakage following a postulated accident will not result in offsite doses exceeding 10 CFR 100 guidelines. (3) Status: A generic review for compliance with Appendix J and the review of requested exemptions to the regulation is currently underway. Proposed revisions to Appendix J to improve the testing requirements are under development. (4)
References:
- 1. 10 CFR Part 50, Appendix J
- 2. 10 CFR Part 50, Appendix A, GDC 52 and 53
- 3. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book),
l Generic Issue 3-10 " Containment Leak Testing - Appendix J," April 1977 l 4. Division of Operating Reactors, D0R Technical Activities, Category B, l Item 33, " Containment Leak Testing Requirements," May 1977
- 5. Division of Systems Safety, DSS Technical Activities, Category A, Item 30, " Containment Leak Testing," April 1977 TOPIC: VI-7.A.1 Emergency Core Cooling System Reevaluation To Account for j Increased Reactor Vessel Upper Head Temperature (1) Definition:
Loss-of-coolant accident (LOCA) analyses for all Westinghouse reactors were conducted assuming that the water in the upper head region of the l reactor vessel was the same as the inlet water temperature because of a l bypass flow from the downcomer to the upper head. Temperature measurements [ made by Westinghouse indicate tnat the actual temperature of the upper head fluid exceeds cold leg temperature by 50 to 75% of the difference between hot leg and cold leg (inlet) temperature. All operating reactors were required to resubmit LOCA analyses using hot leg temperature for the upper head volume. Lacrosse SEP A-53
(2) Safety Objective: To provide revised LOCA analyses with correct upper head temperatures to assure that peak clad temperature limits are not exceeded. (3) Status: Revised analyses have been received from all Westinghouse plants. All but three have been reviewed and approved. TOPIC: VI-7.A.2 Upper Plenum Injection (1) Definition: Emergency core cooling system (ECCS) evaluation of Westinghouse two-loop plants was performed assuming that low pressure pumped injection is delivered directly to the lower plenum. However, ECC coolant is delivered directly into the upper plenum. Interaction of the cold injection water with the steam exiting from the core during refill and reflood and the heat transfer effects during the downward passage to the lower plenum have l not been adequately considered. l ( (2) Safety Objective: To provide assurance that existing analyses with Westinghouse two-loop plants are acceptable either by showing that the present analyses are conservative, or by developing a new ECCS model which considers upper plenum injection. (3) Status: The staff met with the licensees and Westinghouse on January 11 and 26, 1977. The staff requested that the licensees formally submit the infor-mation presented at the January 26, 1977 meeting. Two Westinghouse reports have been received to date. The staff is continuing to evaluate the problem. Research requested by the Office of Nuclear Reactor Regulation and performed by the Office of Nuclear Regulatory Research in the semiscale facility provided basis for evaluation. TOPIC: VI-7.A.3 Emergency Core Cooling System Actuation System (1) Definition: l Review the emergency core cooling system (ECCS) actuation system with l respect to the testability of operability and performance of individual t active components of the system and of the entire system as a whole under l conditions as close to the design condition as practical. (2) Safety Objective: To assure that all ECCS components (for example, valves and pumps) are ! included in the component and system test. To assure that the frequency and scope of the periodic testing are adequate and meet the requirements of General Design Criterion 37. i Lacrosse SEP A-54 l l l
(3) Status: New applications (construction permit and operating license) are reviewed in accordance with the Standard Review Plan and the references listed below. No specific activity for operating reactors is in progress. (4)
References:
- 1. Regulatory Guide 1.22, " Periodic Testing of Protection System Actuation Function"
- 2. Standard Review Plan, Branch Technical Position EICSB-25, " Guidance for the Interpretation of General Design Criterion 37 for Testing the Operability of the Emergency Core Cooling System as a Whole"
- 3. 10 CFR Part 50, Appendix A, GDC 37 TOPIC: VI-7.A.4 Core Spray Nozzle Effectiveness (1) Definition:
Core spray systems are designed with a nozzle.or a set of nozzles arranged above the core in such a way that, following a LOCA, a spray of water will be distributed over the top of the core so that each fuel bundle will receive a specified minimum flow which will provide adequate core cooling. Recent test data for a single nozzle in a steam environment noted partial or complete collapse of the spray cone and/or a shift in the direction of spray. These effects were not included in earlier full scale spray tests in air. (2) Safety Objective: To assure adequate spray cooling following a LOCA. (3) Status: The NRC has reviewed and accepted spray system performance for multiple nozzle spray systems, but has not accepted spray systems with a single overhead spray nozzle. Recent tests in Florida on the Big Rock Point spray nozzle indicate incomplete core coverage. As a result of these tests, NRC is requesting further testing by GE of multiple spray nozzles. (4)
References:
- 1. Letter from K. Goller, NRC, to operating reactor branch chiefs,
Subject:
" Generic Issue - Effects of Steam Environment on Core l
Spray Distribution for Non-jet Pump BWRs," December 7, 1976
- 2. General Electric, GE Topical Report NED0-10846, "BWR Core Spray Distribution" i
Lacrosse SEP A-55
1 TOPIC: VI-7.B Engineered Safety Feature Switchover From Injection to Recirculation Mode (Automatic Emergency Core Cooling System Realignment) (1) Definition: Most PWRs require operator action to realign emergency core cooling (ECC) systems for the recirculation mode following a LOCA. We have been requiring, on an ad hoc basis, some automatic features to realign the ECCS from the injection to the recirculation mode of operation. (2) Safety Objective: To increase the reliability of long-term core cooling by not requiring operator action to change system realignment to the recirculation mode. (3) Status: A draft Branch Technical Position has been prepared which covers both ECC and containment spray systems. The proposed position is awaiting review by the Regulatory Requirements Review Committee. (4)
Reference:
American National Standards Institute, Draft ANSI Standard N 660, " Proposed American National Standard Criteria for Safety-Related Operator Actions" TOPIC: VI-7.C Emergency Core Cooling System (ECCS) Single-Failure Criterion and Requirements for Iocking Out Power to Valves, Including Independence of Interlocks on ECCS Valves (1) Definition: The physical locking out of electrical sources to specific motor-operated valves required for the engineered safety functions of ECCS has been required, based on the assumption that a spurious electrical signal at an inopportune time could activate the valves to the adverse position; for exa:nple, closed rather than open, or opened rather than closed. There is some concern that interlock circuitry on ECCS valves may not be independent such that a single failure of an interlock due to equipment malfunction or operator error could defeat more than one interlock and cause the valves to be cycled to the wrong position. (2) Safety Objective: To ensure that all power-operated valves which could affect emergency core cooling (ECC) system performance by being in the wrong position have power removed except when in use. This will ensure that ECC systems are not defeated by having a valve in the wrong position. (3) Status: The staff plans to reconsider EICSB BTP-18 and RSB BTP-6-1. Lacrosse SEP A-56
4 TOPIC: VI-7.C.1 Appendix K--Electrical Instrumentation and Control , Re-reviews (1) Definition: During the Appendix K reviews of some facilities initially considered, a detailed electrical instrumentation and control review was not performed. 4 Re-review the modified ECCS of these facilities to confirm that it is designed to meet the most limiting single failure. (2) Safety Objective: i .To assure that the modified ECCS is designed to meet the most limiting (design basis) single failure. t , (3) Status: No current activity in the Division of Operating Reactors. (4)
References:
. 1. Regulatory Guide 1.6, " Independence Between Redundant Standby (Onsite)
Power Sources and Between Their Distribution Systems"
- 2. Institute of Electrical and Electronics Engineers, IEEE Std. 308,
" Standard Criteria for Class IE Electric Systems for Nuclear Power 4 Generating Stations"
. TOPIC: VI-7.C.2 Failure Mode Analysis (Emergency Core Cooling System) (1) Definition: t , Failure modes and effects criticality analyses (FMECA) would be conducted , for the purpose of systematically determinir.g potential single failures in emergency core cooling (ECC) systems.
.(2) Safety Objective:
To determine if single failures exist in ECC system as an aid in assess-ing overall plant safety. (3) Status: L FMECAs have been conducted on the. hydraulic portion of ECC systems of representative plant types. In addition, single-failure analyses were ! . performed on each plant as a part of the required Appendix K analysis except for those plants with stainless steel' clad cores.
-Lacrosse SEP A-57
- _ _ _ . - - - - . . . --,-m- , --. , -, - ~ _ - . r.- .- - - e-.,.---- - - -- - - - - - - ,,r-
! TOPIC: VI-7.C.3 Effect of PWR Loop Isolation Valve Closure During a
,~ Loss-of-Coolant Accident on Emergency Core Cooling System Performance i
(1) Definition: i Some PWRs are equipped with loop isolation valves. The effect of spuri-ous closure of a: loop isolation valve during a LOCA has never been ana-lyzed. To ensure emergency core cooling system (ECCS) performance, power in some cases has been removed from loop isolation valves to prohibit spurious closure. (2) Safety Objective: To assure that all plants with loop isolation valves have power removed during operation, or that other acceptable measures are taken to preclude inadvertent closing. (3) Status: i In most cases power has been removed from loop isolation valves, and this ! is confirmed as part of staff ECCS performance evaluations. This has not been confirmed for all plants with loop isolation valves. TOPIC: VI-7.D Long-Term Cooling Passive Failures (for example, Flooding of Redundant Congonents) (1) Definition: ' The General Design Criteria require that the emergency core cooling sys-
-tems (ECCSs) shall be capable of providing adequate core cooling following a loss of-coolant accident, assuming a single failure in emergency core cooling systems. The staff-assumes the single failure to be either an
, active failure during the injection phase, or an active or passive fail-l ure during the long-term recirculation phase. The physical layouts of engineered safety feature pumps and components on some pressurized water reactors make them vulnerable to flooding that might result from passive failures in system piping. Protection for pipe cracks or ruptures is not required because of the low probability of occurrence during the ECCS recirculation mode.
-(2) Safety Objective:
To provide for increased reliability of ECCSs by assuring that passive failures will not cause flooding and failure of ECCS valves and equipment. (3) Status: Y ! Issue identified by Fluegge in letter to Rowden, October 24, 1976. Staff response was prepared which concluded that "... consideration of this issue does not warrant revisions to any existing licenses or changes in present l priority for addressing the treatment of passive failures subsequent to a I LOCA. ECCS passive failure criteria being implemented by the staff Lacrosse SEP A-58
- . , , , . - - . , - . - - - - , , -,m ----, ,,.-,-.c .,,e- , , ,
a , , , ,n,, , , - - - - ~ . . -
require considerations of additional leakage but not pipe breaks beyond the initiating LOCA." (4)
Reference:
NUREG-0138, " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Remorandum From Director, NRR, to NRR 5taff," Issue No. 7, " Passive Failures Following a Loss-of-Coolant Accident," December 1976 TOPIC: VI-7.E Emergency Core Cooling System Sump Design and Test for Recirculation Mode Effectiveness (1) Definition: Following a loss-of-coolant accident in a PWR, an emergency core cooling system (ECCS) automatically injects water into the system to maintain core cooling. Initially, water is drawn from a large supply tank. Water discharging from the break and containment spray collects in the contain-ment building sump. When the supply tank has emptied to a predetermined level, the ECCS is switched from the " injection" mode to the " recirculation" mode. Water is then drawn from the containment building sump. ECCSs are required to operate indefinitely in this mode to provide decay heat removal. Certain flow conditions could occur in the sump, which could cause pump failures. These include entrained air, prerotation or vortexing, and losses leading to deficient net positive suction head. (2) Safety Objective: To confirm effective operation of ECCSs in the recirculation mode. i (3) Status: l l Confirmation through preoperational testing is now required on all con-l struction permits. Staff has been accepting scaled tests in lieu of preoperational tests at the operating-license stage. Some plants have required modification to achieve vortex control. (4)
Reference:
Regulatory Guide 1.79, "Preoperational Testing of Emergency Core Cooling Systems for Pressurized Water Reactors," (paragraph b(2)) (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic): l USI A-43, " Containment Emergency Sump Reliability" (NUREG-0510 and NUREG-0660) The definition of this topic cnd the references cited are covered by USI A-43. The evaluation for USI A-43 is identical to SEP Topic VI-7E; therefore, this SEP topic has been deleted. Lacrosse SEP A-59
TOPIC: VI-7.F Accumulator Isolation Valves Power and Control System Design (1) Definition: For many loss of-coolant accidents, the performance of the ECCS in PWR plants depends upon the proper functioning of the accumulators. 'The motor-operated isolation valve, provided between the accumulator and the primary system, must be considered to be " operating bypass" (IEEE 279-1971) because, when closed, it prevents the accumulator from performing the intended protective function. The motor-operated isolation valve should be designed against a single failure that can result in a loss of capability to perform a safety function. (2) Safety Objective: To assure that the accumulator isolation valve meets the " operation bypass" requirements of IEEE 279-1971, which states that the bypass of a protective function will be removed automatically whenever permissive conditions are not met. To assure that a single failure in the electrical system or single operator error cannot result in the loss of capability of an accumulator to perform its safety function.
- (3) Status
Staff positions 1isted below are implemented on new applications. No systematic review program for operating reactors exists. (4)
References:
- 1. Institute of Electrical and Electronics Engineers, IEEE Std. 279-1971,
" Criteria for Protection System for Nuclear Power Generating Stations"
- 2. Standard Review Plan, Branch Technical Position EICSB-4, " Requirements on Motor-0perated Valves in the ECCS Accumulator Lines"
- 3. Standard Review Plan, Branch Technical Position EICSB-18, " Application of Single Failure Criteria to Manually-Controlled Electrically Operated Valves" TOPIC: VI-8 Control Room Habitability (1) Definition:
Control rooms in operating plants may not fully comply with General Design Criterion 19. This review should include, but not be limited to, analysis ' of the control room air infiltration rate, ventilation system isolability and filter efficiency, shielding, emergency breathing apparatus, short distance atmospheric dispersion, operator radiation exposure, and onsite toxic gas storage proximity, j (2) Safety Objective: To assure that the plant operators can safely remain in the control room to manipulate the plant controls after an accident. Lacrosse SEP A-60 L _. ___ _
~. _ . . _. _ __ _ _
y 3 Y (3) Status: ,
,- t g The Division of Operating Reactors now reviews control room habitability in operating plants when related licensing actions (for example,qssassment of BWR containment air dilution system post-LOCA radiological impact)
. require it. The Divi39n of Site Safety and Environnehtal Apialysis has a
! technical assistance cor, tract with thg National Bureau of Standardh to measure the control room air infiltraf.fon rate at a few operating plants. These measurements wil.1 be used to gauge the conservatism of the assumed air infiltration rates currently used by NRC. Some reviews are now in progress fdr plants wp* hare'l'eason to believe do not meet General Design c Criterion 19 (San Onofre Nuclear Generating-Station Unit 1,-Vermont Yankee, *y
- St. Lucie). % >
(4)
References:
- 1. Standard Review Plan, Section 6.4
- 3 s
- 2. 10 CFR Part 50, Appendix A, GDC 19 s' -
- 3. Murphy, K. G., and K. M. Caepe, " Nuclear Power Plant Control Room Ventilation System Design for Meeting Genera,1 Criterion 19," in Proceedings of the Thirteenth AEC Air Cleanina Conference, August 1974 .s
- 4. Regulatory Guide 1.78, " Assumptions for Evaluating tt e Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous
' 4 Chemical Release"-
- 5. Regulatory Guide 1.55, Rev. 1, " Protection of Nuclear Power Plant e
Control Room Operators Against an Accidental Chlorine Release" (5) Basis for Deletion (Related TMI Task, USI, or 0ther SEP Topfch , _TMI Action Plan Task III.D.3.4, " Control Room Habitability c\ L Requirements" (NUREG-0737) The review criteria required by Task III.D.3.4 (NUREG-0737, pp. 3-197) K l are identical to the review criteria specified in the Definition and References of SEP Topic VI-8; therefore,Nthis SEP topic has been deleted. .. 4;V' '. s. TOPIC: VI-9 Main Steam Line Isola' tion Seal System \BWR) -
+
e ,, g
' i " '
(1) Definition: 7 - 3 {, , s (m . Operating experience ha.s 4ndHcS.ted that theye'is a relative b high fail-ure rate and varipty of (Miuit modes for:co@onents of the main steam , l isolation valve l{aka9yontrol system in'certain operating BWRs. ( '% u s t .., a \ (2) Safety ObjectM ^ / h, ,- ( l Toassurethatleaka'geratelimitsarenotexceeoedandthere'sulting [l L calculated offsite doses do not exceed 10 CFR Party 100 guidelines using - , , the staff's' assumptions. l - c, l l ..
x t At b .
Lacrosse SEP , A-61 - y s g %
e
/
t (3); St'a'tus: Experience from surveillance testing as reported in recent licensee event
. reports.i.s compiled by the Division of Operating Reactors to serve as a basis for' identifying design improvements and for preparing recommendations for future revisions to Regulatory Guide 1.96.
(4)
References:
' 1. Division of Operating Reactors, D0R Technical Activities, Category 8,
~" Main Steam Line Leakage Control System," May 1977-2 Regulatory Guide 1.96, " Design of Main Steam Isolation Valve Leakage Control Systems for Boiling Water Reactor Nuclear Power Plants"
' 3 '. Standard Review Plan., Section 6.7
' TOPIC: VI-10.A Testing of Reactor Trip System and Engineered Safety Features,. Including Response-Time Testing
'(1) Definition:
Review the reactor trip system (RTS) and engineered safety features (ESF)
-test program to verify RTS and ESF operability on a periodic basis and to
- verify RTS and ESF response time.
! (2) Safety 0b'Jective: _ To assure the operability of the RTS and ESF, on a periodic basis, including verification of sensor response times. To ensure that the RTS and ESF test program demonstrates a high degree of availability of the systems 1 N and the response' times assumed in the accident analyses are within the design specifications. (3) Statu s
\
V Thetesi,programoftheRTSandESFofnewlicense-applicationsisreviewed in accordance with the Standard Review Plan, including applicable Branch 4 Technical Positions. Some licensees have agreed to perform response-time i measurements. Operability testing is probably performed, in one form or
~
another, for most licensees of operating reactors. (4)
References:
- 1. Standard Review Plan, Branch Technical Position EICSB-24, " Testing
[ of Reactor Trip System and Engineered Safety Feature Actuation System Sensor Response Times"
- 2. Memorandum from V. Stello, NRC, to V. A. Moore,
Subject:
"GESSAR Second Round of Questions No.'2 and No. 9," October 12, 1973 '
- 3. Regulatory Guides
- 1.22, " Periodic Testing of Protection System Act,uation Functions"
- 1.105, " Instrument Setpoints" 4
1.118, " Periodic Testing of Electric Power and Protection Systems" 4
-. I ,
C,
. 's Lacrosse SEP 3
, A-62
- '1 %
\
v
. . ___a -- . w -- .- - - - -- - - -- - ----- -
v. 3 s i t I) t TOPIC: VI-10.8 Shared Engineered Safety Features, Onsite Emergency Power, and Service Systems for Multiple Unit Stations (1) Definition: The sharing of engineered safety features (ESF) systems, including onsite emergency power systems, and service systems for a multiple-unit facility can result in a reduction of the number and of the capacity of onsite systems to below that which normally is provided for the same number of units located at separate sites. Review these shared systems for multiple-unit stations.
- -(2) Safety Objactive:
'To assure that: (1) the' interconnection of ESF, onsite emergency power, and service systems between different units is not such that a failure, maintenance, or testing op'eration in one unit will affect the accomplish-ment of the protection function of the systems (s) in other units; (2) the required coordination between unit operators can cope with an incident in one unit and safe shutdown of the remaining units (s); and (3) system over-load conditions will not arise as a consequence of an accident in one unit
. coincident with a spurious accident signal or any other single failure in another unit. j (3) Status:
A' systematic review of shared ESF, onsite emergency power, and service systems for operating multiple-unit stations is not being conducted. The EICSB Branch Technical Position is applied in the review of new licensee applications. (4)
References:
- 1. Standard Review Plan, Branch Technical Position EICSB-7, " Shared Onsite Emergency Electric Power Systems for Multi-Unit Stations"
- 2. Regulatory Guide 1.81, " Shared Emergency and Shutdown Electric Systems for Multi-Unit Nuclear Power Plants" TOPIC: VII-1.A Isolation of Reactor Protection System From Nonsafety Systems, Including Qualification of Isolation Devices (1) Definition:
Nonsafety systems generally receive control signals from the reactor pro-tection system (RPS) sensor current loops. The nonsafety sensor circuits are required to have isolation devices to ensure the independence of the . RPS channels. Requirements for the design and qualification of isolation devices are quite specific. Recent operating experience has shown that some of the earlier isolation devices or arrangements at operating plants may not be effective. Lacrosse SEP A-63 l
- _ _ -_ ._ - l
(2) Safety Objective: To verify that operating reactors have RPS designs which provide effective and qualified isolation of nonsafety systems from safety systems to assure that safety systems will function as required. (3) Status: A limited generic review of isolation devices is being performed by the Division of Operating Reactors as part of a followup on LER No. 76-42/IT for Calvert Cliffs Unit 1 (TAC 6696). This limited generic review should be complete by August 1, 1977. (4)
References:
- 1. Licensee Event Report No. 76-42/IT, Calvert Cliffs Unit 1 (Technical Assignment Control (TAC) No. 6696)
- 2. Standard Review Plan, Section 7.2 TOPIC: VII-1.8 Trip Uncertainty and Setpoint Analysis Review of Operating Data Base (1) Definition:
As a result of Issue No. 13 in NUREG-0138 (Ref. 1) the staff is conducting a survey of plants at the operating-license stage of review to more specifically identify the cargir, between actual allowable trip parameter limits (from safety analyses standpoint) and actual reactor protection system (RPS) setpuitats specified in the Technical Specifications. To clearly identify the setpoint margins, both the ultimate allowable and the specified nominal atting will be identified in the Technical Specifications. (2) Safety Objective: To assure that the margins between the allowable trip parameters and the actual RPS setpoints are adequate and properly identified. (3) Status: Implementation letters have been sent to the current applicants for operating licenses. The Technical Specifications for operating reactors are only being changed to include both values if a particular plant is converting to Standard Technical Specifications. (4)
References:
- 1. NUREG-0138, " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum From Director, NRR, to NRR Staff," Issue No. 13, " Instrument Trip Setpoints in Standard Technical Specifications," November 1976
- 2. Memorandum from V. Stello, NRC, to R. Boyd,
Subject:
" Instrument Trip Setpoint Values," February 18, 1977 Lacrosse SEP A-64
- 3. Division of Operating Reactors, D0R Technical Activities, Category B, Item 29, "Instru=ent Trip Setpoints on Standard Technical Specifica-tions," May 1977 TOPIC: VII-2 Engineered Safety Features System Control Logic and Design (1) Definition:
During the staff review of the safety injection system (SIS) reset issue (Ref. 1) the staff determined that the engineered safety features actuation systems (ESFASs) at both PWRs and BWRs may have design features that raise questions about the independence of redundant channels, the interaction of reset features and individual equipment controls, and the interaction of the ESFAS logic that controls transfers between onsite and offsite power sources. Review the as-built logic diagrams and schematics, operator action rr uired to supplement the ESFAS automatic actions, the startup and surv. ilance testing procedures for demonstrating ESFAS performance. Several specific concerns exist with regard to the manual SIS reset feature following a LOCA: (1) If a loss of offsite power occurs after reset, operator action would be required to remove normal shutdown cooling loads from the emergency bus and reestablish emergency cooling loads. Time would be critical if the loss of offsite power occurred within a few minutes following a LOCA. (2) If loss of offsite power occurs after reset, some plants may not restart some essential loads such as diesel cooling water. (3) The plant may suffer a loss of ECCS delivery for some time period before emergency power picks up the ECCS systea. Review the ESF system control logic and design, including bypasses, reset features, and interactions with transfers between onsite and offsite power sources. (2) Safety Objective: To assure that the ESFASs are designed and installed so that the necessary automatic control of engineered safety features equipment can be accomplished when required. (3) Status: A review of ESFASs of operating PWRs is being performed by the Division of Operating Reactors as part of the followup action to Reference 1 (to be completed end of 1977). (4)
References:
- 1. NUREG-0138, " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum From Director, NRR, to NRR Staff," Issue No. 4, " Loss of Offsite Power Subsequent to Manual Safety Injection Reset Following a LOCA," November 1976
- 2. Division of Operating Reactors, D0R Technical Activities Category A, Item 22, " Loss of Offsite Power Subsequent to Manual Reset," April 1972 Lacrosse SEP A-65
- 3. - Regulatory Guide 1.41, "Preoperational Testing of Redundant Onsite 1
Electric Power Systems To Verify Proper Load Group Assignments" TOPIC: VII-3 Systems Required for Safe Shutdown (1) Definition: Review plant systems that are needed to achieve and maintain a safe shut-down condition of the plant, including the capability for prompt hot shutdown of the reactor from outside the control room. Included also, a review of the design capability and method of bringing a PWR from a high-pressure condition to low pressure cooling assuming the use of only l safety grade equipment. i (2) Safety Objective: (1) To assure the design adequacy of the safe shutdown system to (i) initiate automatically the operation of appropriate systems, including the reactivity control systems, such that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences or postulated accidents and (ii) initiate the operation ; of systems and components required to bring the plant to a safe shutdown. ' (2) To assure that the required systems and equipment, including necessary i instrumentation and controls to maintain the unit in a safe ccndition during hot shutdown are located at appropriate locations outside the control room and have a potential capability for subsequent cold shut-4 down of the reactor through the use of suitable procedures. (3) To assure that only safety grade equipment is required for e PWR ' j-plant to bring the reactor coolant system from a high pressure condition to a low pressure cooling condition. I (3) Status: A survey of remote shutdown capability of operating plants was performed some time ago by the Division of Operating Reactors. A technical activity has been proposed by the Division of Project Management (see reference below) regarding safety objective (3). No other activities are in progress. (4)
Reference:
Division of Project Management', DPM Technical Activities, Category A, Item 7, " Isolating Low Pressure Systems Connected to the RCPB," April 1977 TOPIC: VII-4 Effects of Failure in Nonsafety-Related Systems on Selected j Engineered Safety Features l l (1) Definition: Potential combinations of transients and accidents with failures of l nonsafety-related control systems were not specifically evaluated in the 1 original safety analysis of currently operating reactor plants. Review l Lacrosse SEP A-66
i the effects of control system malfunctions as initiating events for anticipated transients and also as failures concurrent with or subsequent to anticipated events or postulated accidents initiated by a different malfunction (for example, the effect of the loss of the plant air system on the plant control and monitoring system). A complete discussion is provided in Reference 1. (2) Safety Objective: To assure that any credible combination of a nonsafety-related system failure with a postulated transient or accident will not cause unaccept-able consequences. (3) Status: A technical assistance contract with Dak Ridge National Laboratory for failure mode analyses of control systems was initiated to determine sensi-tive areas of the plant designs. The results of this program in conjunc-tion with the results of the failure mode and effects analyses for transients and accidents being performed under contract by Idaho Nuclear Engineering Laboratory should provide a basis for any new review and safety requirements. (4)
References:
- 1. NUREG-0153, " Staff Discussion of Twelve Additional Technical Issues Raised by Responses to November 3, 1976 Memorandum from Director, NRR, to NRR Staff," Issue 22, " Systematic Review of Normal Plant Operation and Control System Failures," December 1976
- 2. Memorandum from V. Stello, NRC, to R. J. Hart, December 23, 1976, NRR letter No. 46.
- 3. Division of Operating Reactors, 00R Task Force Report on SEP, Appendix B (TFL 118), November 1976
- a. Item 33, " Safety Related Control Power"
- b. Item 34, " Safety Related Instrumentation Power"
- c. Item 56, "Effect of Failure in Non-Safety Related Systems During Design Basis Events" l
- d. Item 57, " Loss of Plant Air System (Effect on Plant Control and Monitoring)"
- e. Item 77, " Safety Related Control and Instrument Power"
- 4. Directorate of Operational Technology, D0T Recommended List of SEP Subjects, C 00T 102, Item 100z, " Loss of Plant Air System (Effect on Plant Control and Monitoring)," Spring 1977 l
(5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic): (a) USI A-47, " Safety Implications of Control System" (NUREG-0705 and NUREG-0606) The issue defined in Reference 1 (NUREG-0153, Item 22) is as follows: In evaluating plant safety, the effects of control system malfunctions should be reviewed as initiating events for l Lacrosse SEP A-67
i anticipted transients and also as failures that could l occur concurrently subsequent to postulated anticipated events (initiated by a different malfunction) or postulated accidents.
- . The issue defined in US! A-47 is, in part, as follows
This issue concerns the potential for transients or acci-dents being made more severe as a result of the failure or j ' malfunction of control systems. These failures or malfunc-tions may occur independently, or as a result of the acci-dent or transient under consideration. (b) USI A-17, " Systems Interactions in Nuclear Power Plants" (NUREG-0649 and NUREG-0606) i The purpose of this task is to develop a method for conducting a disciplined and systematic review of nuclear power plant systems, for both process function couplings of systems and space couplings, to identify the potential sources and types of systems interactions that are determined to be potentially adverse. A report has been developed, " Final Report - Phase 1 Systems Inter-action Methodology Applications Program," NUREG/CR-1321, SAND 80-0384, whose objectives are:
- 1. To develop a methodology for conducting a disciplined and systematic review of nuclear power plant systems which facilitates identification and evaluation of systems interactions that affect the likelihood of core damage.
- 2. To use the methodology to asses:; the Standard Review Plan to determine the completeness of the plan in identifying and i evaluating a limited range of systems interactions.
The work done under USI A-17 may be useful in the development of USI A-47. The Definition cf USI A-47 is identical to that of Topic. VII-4; therefore, this SEP topic has been deleted. l TOPIC: VII-5 Instruments for Monitoring Radiation and Process Variables During Accidents (1) Definition: The adequacy of the instruments for monitoring radiation and process variables during accidents has not been reviewed for conformance with Regulatory Guide 1.97. A generic review is planned to assess the licensee's existing or proposed monitoring instruments during and following accidents to determine the adequacy of their range, response, and qualifications, and to determine the sufficiency of the variables to be monitored. Certain e instruments to monitor conditions beyond the design basis accidents will I Lacrosse SEP A-68
also be required in accordance with an Regulatory Requirements Review Committee (RRRC) determination (Reference 3). (2) Safety Objective: To assure that plant operators and emergency response personnel have available sufficient information on plant conditions and radiological releases to determine appropriate in plant and offsite actions throughout the course of any accident. The instrumentation should also provide recorded transient or trend information necessary for postaccident evalua-tion of the event. The ability to follow the course of accidents beyond the design basis accidents is also required. (3) Status: Generic review of instrumentation to follow the course of accidents in operating plants and in all plants now under construction or seeking a construction permit will begin with the issuance of Regulatory Guide 1.97, Revision 1, this year. Submittals describing the facilities' postaccident instrumentation will be obtained from all operating licensees and reviewed by the end of 1978. The implementation of Regulatory Guide 1.97, Revision 1 on operating plants is proceeding independent of the SEP. The Regulatory Requirements Review Committee has determined that Revision 1 to Regulatory Guide 1.97 should be treated as a Category 2 item (backfit on operating plants on a case-by-case basis). (4)
References:
i
- 1. Memorandum from H. G. Mangelsdorf (ACRS) to L. H. Muntzing (Regulations), August 14, 1973
- 2. Memorandum from L. M. Muntzing (Regulation) to H. G. Mangelsdorf (ACRS), November 1, 1973
- 3. Memorandum from R. B. Minogue (SD) to E. G. Case (NRR), Enclosure, Proposed Revision 1 to Regulatory Guide 1.97, April 4, 1977
- 4. Standard Review Plan, Section 7.5
- 5. Standard Review Plan, Section 7.6
- 6. Standard Review Plan, Section 11.5
- 7. Memorandum from T. A. Ippolito (EICSB) to Emergency Instrumentation Task Force Members, August 12, 1974
- 8. NUREG-0153, " Staff Discussion of Twelve Additional Technical Issues Raised by Responses to November 3, 1976 Memorandum from Director, l
NRR, to NRR Staff," Issue 21, " Instruments for Monitoring Both I Radiation and Process Variable During Accidents," December 1976
- 9. Minutes of Regulatory Requirements Review Committee meeting, January 28, 1977 (S) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
TMI Action Plan Task II.i, " Instrumentation and Controls" NUREG-0660 and NUREG-0737 l There are three subtasks under Task II.F as follows: Lacrosse SEP A-69
(a) II.F.1 - Additional Accident Monitoring Instrumentation (b) II.F.2 - Identification of and Recovery From Conditions Leading to Inadequate Core Cooling t (c) II.F.3 - Instruments for Monitoring Accide.t Conditions l Specific positions on the required instrumentatico for II.F.1 and II.F.2 are in NUREG-0737 and regulatory Guide 1.97, Revision 2 (December 1980). Instrumentatipi need for II.F.3 is also in Regulatory Guide 1.97, Revision 2. The emphasis of TMI Task II.F is the monitoring of radiation and ' process variables; guidance for this relies primarily on Regulatory Guide 1.97. This is identical to the review proposed in Topic VII-5; therefore this SEP topic has been deleted. TOPIC: VII-6 Frequency Decay , (1) Definition: In an issue of Reference 1 it is~ stated that the staff should require that j a postulated rapid decay of the frequency of .the offsite power system be included in the-accident analysis and that the result be demonstrated to be acceptable. Alternatively, the reactor coolant pump (RCP) circuit breakers should be-designed to protection system criteria and tripped to separate the pump motors from the offsite power system. . Rapid decay of the frequency of the offsite power system has the potential for slowing. down or breaking the RCP, thereby reducing the coolant flow rates to levels t not considered in previous analyses, (2) Safety Objective: To assure that the reactor coolant flow rate will not decrease below those assumed for a flywheel coastdown.
- (3) Status
} Oak Ridge National Laboratory, urider a technical assistance program, is currently reviewing the frequency decay rate and its effects on RCPs. l~ This program should be completed before the end of this year and this issue resolved. (4)
References:
- l
- 1. NUREG-0138, " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3,1976 Memorandum From Director, NRR, to NRR Staff," Issue No. 9, " Frequency Decay," November 1976 :
- 2. Division of Operating Reactors, D0R Technical Activities, Category B, Item 27, " Frequency Decay," May 1977 l
Lacrosse SEP A-70 i
i TOPIC: VII-7 Acceptability of Swing Bus Design on BWR-4 Plants (1) Definition: The swing bus in the original BWR-4 design was used to provide power from either of two redundant electric sources to the low pressure coolant injection (LPCI) valves by means of an automatic transfer scheme. A single failure in the transfer circuitry could result in paralleling the two redundant electric power sources, thereby degrading their functional capa-bilities. Review licensee's swing bus automatic transfer circuitry to verify that it is immune to single failuret. which could lead to paralleling the two electric power sources. (2) Safety Objective: To assure that the swing bus design will not propagate an electrical failure Lutween two redundant power sources due to a single failure in the automatic transfer circuit at the BWR-4 swing bus. (3) Status: During the course of generic review for compliance with emergency core cooling system criteria 10 CFR 50.46 and Appendix K, some licensees have elected to modify the LPCI system to take credit for a portion of the LPCI flow. These facilities have replaced the swing bus design with a split bus configuration which complies with the requirements of Regulatory Guide 1.6. Not all facilities required a modification of the LPCI to meet the criteria and have retained the swing bus design. The issue of the swing bus design was identified in Reference 1 and in addition in a letter from the Advisory Committee on Reactor Safeguards (ACRS) dated December 12, 1976 1 (4)
References:
- 1. NUREG-0138, " Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum From Director, NRR, to NRR 5taff," Issue No. 3, " Acceptability of Swing Bus Design of BWR-4 Plants," November 197.6
- 2. Regulatory Guide 1.6, " Independence Between Redundant Standby (Onsite)
Power Sources and Betmen Their Distribution Systems"
- 3. 10 CFR Part 50, Appendix A, GDC 17
- 4. Institute of Electrical and Electronics Engineers, IEEE Std. 308,
" Standard Criteria for Class IE Electric Systems for Nuclear Power Generating Stations" TOPIC: VIII-1.A Potential Equipment Failures Associated With l
Degraded Grid Voltage (1) Definition: A sustained degradation of the offsite power source voltage could result in the loss of capability of redundant safety loads, their control circuitry, and the associated electrical components required to perform safety functions. 1 Lacrosse SEP A-71 l l
i (2) Safety Objective: To assure that a degradation of the offsite power system will not result in the loss of capability of redundant safety related equipment and to determine the susceptibility of such equipment to the interaction of onsite and offsite emergency power sources. (3) Status: A program plan has been developed which includes a short-term program for the review of the emergency power systems of operating reactors and a long-term program to identify those conditions affecting the offsite power sources which may require that additional safety measures be taken. (4)
References:
- 1. NUREG-0090-5, " Report to Congress, Abnormal Occurrences at Millstone 2, July-September 1976," March 1977
- 2. Memorandum from D. G. Eisenhut, NRC, to K. R. Goller,
Subject:
" Staff Positions (Short-Term Program)," April 20, 1977
- 3. Letters to licensees, August 12 and 13, 1976
- 4. Division of Operating Reactors, 00R Technical Activities, Category A, Item 9, " Potential Equipment Failures Associated with a Degraded Off-site Power Source," April 1977 TOPIC: VIII-2 Onsite Emergency Power Systems (Diesel Generator)
(1) Definition: Diesel generators, which provide emergency standby power for safe reactor shutdown in the event of total loss of offsite power, have experienced a significant number of failures. The failures to date have been attributed to a variety of causes, including failure of the air startup, fuel oil, and combustion air systems. In some instances, the malfunctions were due to lockout- The information available to the control room operator to indicate the operational status of the diesel generator was imprecise and could lead to misinterpretation. This was caused by the sharing of a single annunciator station by alarms that indicate conditions that render a diesel generator unable to respond to an automatic emerger.cy start signal and alarms that only indicate a warning of abnormal, but not disabling, conditions. Another cause was-the wording on an annunciator window which did not specifically say that the diesel generator was inoperable (that is, unable at the time to respond to an automatic emergency start signal), when in fact it was inoperable for that purpose. The review includes the qualification, reliability, operation at low loads, lockout, fuel oil, and testing of diesel generators. (2) Safety Objective: To assure that the diesel generator meets the availability requirements for providing emergency standby power to the engineered safety features. Lacrosse SEP A-72
(3) Status: Under a technical assistance request (in preparation), a thorough evalua-tion of all reported failures, including a comprehensive evaluation of diesel manufacturer and utility procedures for inspection, maintenance, and operation, will be performed. Letters were sent on March 29, 1977 to all the affected licensees requesting additional information about diesel generator status indication in the control room. Our intention is to require that at least one annunciation be provided in the control room which will alarm whenever the diesel generator is unavailable due to any lockout condition. (4)
References:
- 1. Regulatory Guide 1.108, " Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants"
- 2. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book),
Generic Issue 3-11, " Diesel Generator Lockout," April 1977 TOPIC: VIII-3.A Station Battery Capacity Test Requirements (1) Definition: Review the Technical. Specification, including the test program, with regard to the requirement for periodic surveillance testing of onsite Class IE batteries and the extent to which the test meets Section 5.3.6 of IEEE Std. 308-1971, to determine battery capacity. (2) Safety Objective: To assure that the onsite Class IE battery capacity is adequate to supply dc power to all safety-related loads required by the accident analyses and is verified on a periodic basis. This effort is needed to ensure that the test to determine battery capacity includes (1) an acceptance test of battery capacity performed in accordance with Section 4.1 of IEEE Std. 450-1975; (2) a performance discharge test listed in Table 2 of IEEE Std. 308-1971, performed according to Sections 4.2 and 5.4 of IEEE Std. 450-1975; and (3) a battery service test described in Section 5.6 of IEEE Std. 450-1972, to be performed during each refueling operation. (3) Status: The review of station battery capacity test requirements is applicable to all operating reactors. There is no ongoing effort on this subject for operating reactors except for those reactors converting to Standard Technical Specifications. (4)
References:
- 1. Standard Review Plan, Appendix 7-A, Branch Technical Position EICSB 6
- 2. Institute of Electrical and Electronics Engineers, IEEE Std. 308-1971, 1974, " Standard Criteria for Class 1E Electric Systems for Nuclear Power Generating Stations" Lacrosse SEP A-73
3. Institute of Electrical and Electronics Engineers, IEEE Std. 450-1975, "Recommanded Practice for Maintenance, Testing, and Replacement of Large Lead Storage Batteries for Generating Stations and Substations"
- 4. Memorandum from J. G. Keppler to R. H. Voilmer, NRC, March 20, 1972
- 5. Memorandum from V. D. Thomas to R. Carlson, January 18, 1972 TOPIC: VIII-3.B DC Power System Bus Voltage Monitoring and Annunciation (1) Definition:
Review the de power system battery, battery charger, and bus voltage monitoring and annunciation design with respect to dc power system operability status indication to the operator. This information is needed so that timely corrective measures can be taken in the event of loss of an emergency dc bus. (2) Safety Objective: To assure the design adequacy of the de power system battery and bus voltage monitoring and annunciation schemes such that the operator can (1) prevent the loss of an emergency dc bus or (2) take timely corrective action in the event of loss of an emergency de bus. (3) Status: ' The review of the de power system battery and bus voltage monitoring and ar.nunciation adequacy as it relates to the loss of an emergency de bus is applicable to all operating reactors. This topic is included in the NRR Technical Activity, " Adequacy of Safety Related DC Power Supplies." (4)
Reference:
Standard Review Plan, Section 8.3.2 TOPIC: VIII-4 Electrical Penetrations of Reactor Containment (1) Definition: Review the electrical penetration assembly with respect to the capability to maintain containment integrity during short-circuit current conditions and mechanical integrity during the worst expected fault current vs. time conditions resulting from single random failures of circuit overload protection devices. (2) Safety Objective: To assure that all electrical penetrations in the containment structure, whether associated with Class IE circuits or non-Class IE circuits, are designed not to fail from electrical faults during a loss-of-coolant accident. Lacrosse SEP A-74
(3) Status: The subject of electrical cable penetrations was identified in Reference 1 and has been proposed as a Technical Activity Category A item by the Division of Systems Safety (Reference 2). The purpose of that activity is a reevaluation of the penetrations to clarify and augment the design safety margin. (4)
References:
- 1. NUREG-0153, " Staff Discussior nf Twelve Additional Technical Issues Raised by Responses to November 3, 1976 Memorandum From Director, NRR, to NRR Staff," Issue 18, " Electrical Cable Penetration of Reactor Containment," December 1976
- 2. Division of Systems Safety, DSS Technical Activity,. Category A, Item 36, " Electrical Cable Penetrations of Reactor Containment,"
April 1977
- 3. Regulatory Guide 1.63, " Electric Pentration Assemblies in Containment Structures for Light-Water-Cooled Nuclear Power Plants"
- 4. Institute of Electrical and Electronics Engineers, IEEE Std. 317-1976,
" Standard for Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations" TOPIC: IX-1 Fuel Storage (1) Definition Review the storage facility for new and irradiated fuel, including the cooling capability and seismic classification of the fuel pool cooling system of the spent fuel storage pool. Specifically review the expansion of the onsite spent fuel storage capacity, including the structural response of the fuel storage pool and the racks, the criticality analysis for the increased number of stored fuel assemblier. at reduced spacing, and the capability of the spent fuel cooling system to remove the addi-tional heat load.
(2) Safety Objective: To assure that new and irradiated fuel is stored safely with respect to criticality (keff ( 0.95), cooling capability (outlet temperature ( 150 F), shielding, and structural capability. (3) Status: Approximately two-thirds of the operating reactor plants have requested authorization to increase the storage capacity of their fuel storage pool. The applications are reviewed on a case-by-case basis. New or modified storage rack designs are reviewed against current design criteria; however, the existing pool structure is based on original design criteria. 1 Lacrosse SEP A-75
! (4) References
- 1. Division of Operating Reactors, 00R Technical Activities, Category A, Item 27, " Increase in Spent Fuel ~ Storage Capacity," April 1977
- 2. American National Standards . Institute, ANSI-210 " Design Objectives for Spent Fuel Storage Facilities"
- TOPIC
- IX-2 Overhead Handling Systems (Cranes)
(1) Definition: Overhead handling systems (cranes) are used to lift heavy objects in the vicinity of PWR and BWR spent fuel storage facilities and inside the reactor building. If a heavy object (for example, a shielded cask) were to drop on the spent fuel or on the reactor core during refueling, there could be a potential for overexposure of plant personnel and for release of radioactivity to the environment. Review the overhead handling system, including sling and other lifting devices, and the potential for the drop of a heavy object on spent fuel, including structural effects. (2) Safety Objective: To assess the safety margins, and improve margins where necessary, of the overhead handling systems to assure that the potential for dropping a heavy object on spent fuel is within acceptable limits and that the po-tential radiation dose to an individual does not exceed the guidelines of 10 CFR Part 100. (3) Status: Regulatory Guide 1.104, " Overhead Crane Handling Systems for Nuclear Power Plants," was issued for comment in February 1976 and references various industry standards. New applications (construction permit and operating ' license) are reviewed in accordance with APCSB Branch Technical Position 9-1 which is identical to Regulatory Guide 1.104. The review of overhead handling systems of operating reactor facilities is performed on a generic basis and has also been identified as a D0R Technicai Activity Category A. (4)
References:
- 1. Regulatory Guide 1.104, " Overhead Crane Handling Systems for Nuclear Power Plants"
- 2. Stanaard Review Plan, Branch Technical Position APCSB 9-1, " Overhead Handling Systems for Nuclear Power Plants"
- 3. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book),
Generic Issue 3-22, " Fuel Cask Drop Analysis," April 1977
- 4. Division of 0p rating Reactors, D0R Technical Activities, Category A, Item 50, " Control of Heavy Loads Over Spent Fuel," April 1977 Lacrosse SEP A-76
(5) Basis for Deletion (Related TMI Task, USI or Other SEP Topic): USI A-36, " Control of Heavy Loads Near Spent Fuel" (NUREG-0649) The review criteria required by USI A-36 (Standard Review Plan, Section 9.1.4, and NUREG-0554) are identical to the review criteria specified in the References of SEP Topic IX-2 (BTP 9-1 and Regulatory Guide 1.104); therefore, this SEP topic has been deleted. TOPIC: IX-3 Station Service and Cooling Water Systems (1) Definition: Review the station service water and cooling water systems that are required for safe shutdown during normal, operational transient, and accident conditions, and for mitigating the consequences of an accident or preventing the occurence of an accident. These include cooling water systems for reactor system components (components cooling water system), reactor shutdown equipment, ventilation equipment, and components of the emergency core cooling system (ECCS). These systems also include the station service water system, the ultimate heat sink, and the interaction of all the above systems. The review of these systems includes the pumps, heat er. changers, valves and piping, expansion tanks, makeup piping, and points of connection or interfaces with other systems. Emphasis is placed on the cooling systems for safety-related components such as ECCS equipment, ventilation equip-ment, and reactor shutdown equipment. The following specific aspects of those systems will be considered in the review: (a) Physical separation of redundant cocling water systems that are vital to the performance of engineered safety systems components, (b) Availability of cooling water to primary reactor coolant pumps, (c) Requirements for makeup water of cooling water systems, (d) Effect of water overflow from tanks, (e) Circulating water system barrier failure protection. (2) Safety Objective: To assure that the station service and cooling water systems have the capability, with adequate margin, to meet their design objective. To assure, in particular, that (a) Systems are provided with adequate physical separation such that there are no adverse interactions among those systems under any mode of operation; l l l Lacrosse SEP A-77 l
(b) Cooling water is provided to the bearings of the primary reactor coolant pumps by two independent essential service water systems for PWR plants to take credit for core cooling by pump coastdown. In addition, it should be demonstrated that the possibility of simultaneous loss of water in both essential service water systems by valve closure is sufficiently small; (c) Sufficient cooling water inventory has been provided or that adequate provisions for makeup are available; (d) Tank overflow cannot be released to the environment without monitoring and unless the level of radioactivity is within acceptable limits; (e) Vital equipment necessary for achieving a controlled and safe shutdown is not flooded due to the failure of the main condenter circulating water system. (3) Status: The station service and cooling water systems of applications currently under review are evaluated in accordance with the Standard Review Plan (Sections 9.2.2 and 10.4.5). Some of the specific concerns identified above are under generic review or have been proposed for a technical activity in the Office of Nuclear Reactor Regulation in accordance with the references below. (4)
References:
- 1. Letter from R. F. Fraley (ACRS) to L. V. Gossick,
Subject:
" Analysis of Systems Interactions," November 1, 1976
- 2. Memorandum from B. C. Rusche to L. V. Gossick, ACRS Subcommittee on Systems Interactions, January 1977
- 3. Division of Project Management, DPM Technical Activities, Category A, Item DPM-15, " Systems Interactions in Nuclear Power Plants," April 1977
- 4. Memorandum to R. L. Tedesco, NRC, to D. B. Vassallo, Auxiliary Systems Branch 02 on Yellow Creek Nuclear Plant, Item 010.42, (cooling water for RCP), January 31, 1977
.I 5. Division of Systems Safety, DSS Technical Safety Activities Report,
" Cooling Water System Makeup Water Requirements (For Safety Systems),"
December 1975
- 6. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book),
Generic Issue 3-20, " Flood of Equipment Important to Safety (Generic)," April 1977
- 7. Division of Operating Reactors, D0R Technical Activities, Category A, Item 15, " Flood of Equipment Important to Safety," April 1977 l
\ Lacrosse SEP A-78 i
l l l l TOPIC: IX-4 Boron Addition System (PWR) (1) Definition: a l Review the boron addition system (PWR), in particular with respect to boron j precipitation during the long-term cooling mode of operation following a loss-of-coolant arcident. (2) Safety Objective: To assure that boron precipitation will not impair the operability of valves or components in the boron addition system which could compromise i its capability to control core reactivity during the normal,. transient, or emergency shutdown conditions or that would result in flow blockage through the core during the long-term core cooling mode fol. lowing a loss-of-coolant accident. (3) Status: i Operating PWR reactors, with the exception of the Combustion Engineering reactors, have been reviewed and found to be acceptable in regard to boron precipitation following a loss of coolant. There are still certain out-standing issues that need to be resolved on this issue for Combustion Engineering reactors. In regard to the precipitation of boron in the boron addition system in both BWRs and PWRs, certain older plants may not-have been reviewed in sufficient detail to assure that system reliability is adequate. (4)
Reference:
Standard Review Plan, Section 9.3.4 TOPIC: IX-5 Ventilation Systems (1) Definition: Review the design and operation of ventilation systems whose function is to maintain a safe environment for plant personnel and engineered safety features equipment. For example, the function of the spent fuel pool area ventilation system is to provide ventilation in the spent fuel pool equip-ment areas, to permit personnel access, and to control airborne radioactivity in the area during normal operation, anticipated operational transients, and following postulated fuel handling accidents. The function of the 7 engineered safety feature ventilation system is to provide a suitable and controlled environment for engineered safety feature components following certain anticipated transients and design basis accidents. (2) Safety Objective: To assure that the ventilation systems have the capability to provide a safe environment, under all modes of operation, for plant personnel (10 CFR Part 20) and for engineered safety features (for example, to assure that l , Lacrosse SEP A-79
i the diesel room has redundant outside air intakes and removed from the exhaust discharge). (3) Status: The ventilation systems of plants under current review (construction permit and operating license applications) are currently evaluated in accordance with the Standard Review Plan. No specific issues or concerns have been ider.'.1fied for operating reactor plants. (4)
References:
Standard Review Plan, Sections 9.4.1 through 9.4.5 TOPIC: IX-6 Fire Protection (1) Definition: ' Review the fire protection program of operating reactor plants to determine whether improvements are required in accordance with the APCSB Technical Position 9.5-1, Appendix A (Reference 2). The fire protecticn program encompasses the components, procedures, and personnel utilized in carrying out all activities of fire protection and includes such things as fire prevention, detection, annunciation, control, confinement, suppression, l extinguishment, administrative procedures, fire brigade organization, i inspection and maintenance, training, quality assurance, and testing. The review includes such items as: (1) the use of insulation inside the containment and (2) the consequences of the inadvertent release of hydrogen into the plant. (2) Safety Objective: To assure that, in case of a fire within the plant, the integrity.of the engineered safety features is not compromised and that the safe shutdown capability and control of the plant are not lost. (3) Status: A generic review of fire protection for operating plants is under way. All i licensees were requested by letter (May 11, 1976) to submit an evaluation of their fire protection program for that plant in comparison with the APCSB Technical Position 9.5-1. Subsequently, in September 1976, the licensees were provided with Appendix A to the BTP 9.5-1 which presents acceptable alternatives for operating plants. s (4)
References:
- 1. NUREG-0050, " Recommendations Related to Browns Ferry Fire," February 1976
, 2. Standard Review Plan, Branch Technical Position APCSB 9.5-1, Appendix A, " Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1,1976" \ l l Lacrosse SEP A-80 i r
- 3. Regulatory Guide 1.120, " Fire Protection Guidelines for Nuclear Power Plants"
- 4. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book), Generic Issue 3-18, " Fire Protection," April 1977
- 5. Division of Operating Reactors, D0R Technical Activities, Category A, Item 28, " Fire Protection," April 1977
- 6. Division of Systems Safety, DSS Technical Activities, Category A, Item 32, " Fire Protection," April 1977
- 7. Letter from R. F. Fraley, ACRS, to L. V. Gossick,
Subject:
" Analysis of Systems Interactions - Item 6," November 1, 1976 TOPIC: X Auxiliary Feedwater System (1) Definition:
Review the auxiliary feedwater system, associated instrumentation, and connection between redundant systems. The review includes the aspects of pump drive and power supply diversity (for example, electrical and steam-driven sources), and the water supply sources for the auxiliary feedwater system. (2) Safety Objective: To assure that the auxiliary feedwater system can provide an adequate supply of cooling water to the steam generators for decay heat removal in the event of a loss of all main feedwater. Older PWR plants may not meet the requirement for pump drive and power supply diversity. (3) Status: Reviews for new license applications are performed in accordance with the Standard Review Plan. This topic is not under active review for operatir.g plants. (4)
References:
- 1. Standard Review Plan, Section 10.4.9
- 2. Standard Review Plan, Branch Technical Position APCSB 10-1, " Design Guidelines for Auxiliary Feedwater System Pump Drive and Power Supply Diversity for PWR Plants" (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
) TMI Action Plan Task II.E.1.1, " Auxiliary Feedwater System Evaluation" (NUREG-0660) The THI-2 accident and subsequent investigations and studies high-lighted the importance of the auxiliary feedwater (AFW) system in the mitigation of severe transients and accidents. Since then, the AFW systems have come under close scrutiny by the NRC and many
- improvements have been recommended to enhance the reliability of AFW l systems for all plants. The scope of the review outlined in the SEP Lacrosse SEP A-81
Topic X definition is identical to the scope of NUREG-0737, "Clarifi-cation of TMI Action Plan Requirements," Item II.E.1.1(2), which requires that each PWR plant licensee: Perform a deterministic review of the AFW system usinq the i t acceptance criteria of Standard Review Plan Section 10.4.9 and associated Branch Technical Position ASB 10-1 as principal guidance. The review criteria for the evaluations required by Item II.E.1.1(2) are identical to SEP Topic X; therefore, this SEP topic has been deleted. TOPIC: XI-1 Appendix I (1) Definition: A generic review of all operating plants to determine their capability to comply with Appendix I, 10 CFR 50, and to prevent explosions in the gaseous radwaste system is currently underway. (2) Safety Objective: To provide assurance that radioactive gaseous effluents from the facility can be kept "as low as reasonably achievable" as defined in Appendix I, - 10 CFR Part 50, and to assure adequate control of the mixture of gases in
~
the gaseous radwaste system to prevent explosions. (3) Status: A generic review of all operating reactors (ors) for their capability to conform with Appendix I, 10 CFR Part 50, is currently under way by the Division of Site Safety and Environmental Analysis. Upon the completion of this review, new gaseous and liquid radiological effluent and monitoring Technical Specifications will be issued to all ors. This will include new Technical Specifications on gaseous radwaste systems which may contain explosive gas mixtures to meet present criteria. The estimated completion date of this review is 1979. (4)
References:
- 1. 10 CFR Part 20
- 2. 10 CFR Part 50, Appendix I e
- 3. 10 CFR Part 50, Appendix A I
- 4. 10 CFR Part 50, Appendix A, GDC 60, 61, 63, and 64
- 5. Standard Review Plan, Section 11.3 1
(5) Basis for Deletion Topic XI-1 is being resolved by the following NRR generic topics: (a) A-02, " Appendix I" and (b) B-35, " Confirmation of Appendix I Models." Resolution of these two generic topics will primarily result in Technical Specification changes and may require some minor hardware changes. At Lacrosse SEP A-82 L___._-- __ -___ - - - - _ _ - _ _ _ _ _ . - _ _ _ - _ _ _ _ _ . -___ .,
present, nothing more than the addition of monitoring instrumentation is foreseen. The implementation of Appendix I will, therefore, not affect the integrated assessment for SEP plants. In addition, the implementation of Appendix I will result in limiting conditions for operation to assist licensees in keeping the amount of radioactive material released in effluents to unrestricted areas as low as is reasonably achievable. Since licensees are currently restricted in the types and amounts of effluents they can release, implementation of additional restrictions on releases should not impact operation of the plant. Based on the above, Topic XI-1 has been deleted from the SEP program. TOPIC: XI-2 Radiological (Effluent and Process) Monitoring Systems (1) Definition: Onsite radiological monitoring systems are used to: (a) Assess the proper functioning of the process and waste treatment systems, (b) Assure that radioactive releases do nct exceed the appropriate guidelines, and (c) Measure actual releases to evaluate their environmental impact. There is concern about the adequacy of radiation monitoring systems. A survey of 12 plants has been initiated. The results of this survey will indicate whether this area needs to be reviewed for all operating plants. Re-review would include the monitor's sensitivity, range, location, and calibration techniques. (2) Safety Objective: To provide reasonable assurance that the licensee adequately monitors the releases of radioactive materials in liquid and gaseous effluent and that the releases are properly restricted. To provide assurance that the licensee adequately munitors the operation of equipment that contains or may contain radioactive material. ) (3) Status: A technical assistance program has been initiated at Brookhaven National Laboratory with the scope including the above safety objectives. (4)
References:
- 1. 10 CFR Part 20, Section 20.106
- 2. 10 CFR Part 50, Section 50.36a .
- 3. 10 CFR Part 50, Appendix A, GDC 60, 61, 63, and 64
- 4. 10 CFR Part 50, Appendix I
- 5. Standard Review Plan, Section 11.5 Lacrosse SEP A-83
l (5) Basis for Deletion ' Topic XI-2 is being resolved by the following NRR generic topics: (a) A-02,
" Appendix I" and (b) B-67, " Effluent and Process Monitoring Instrumenta-4 tion." A-02 is discussed in Topic XI-1. Generic item B-67 was subdivided into four subtasks. The staff believes that events since the inception of B-67 have largely addressed the identified concerns or changed its thinking in regard to their safety significance. The description and bases for deletion of each subtask are presented below.
Mtask1: Monitoring of Radioactive Materials Released in Effluents Item III.D.2.1, Radiological Monitoring of Effluents requires an NRR evaluation of modifying effluent monitoring design criteria based on TMI-2 and their experiences. Item II.F.1(1), Noble Gas Effluent Honitor of Clarification of the TMI Action Plan Requirements (NUREG-0737) is being implemented to require ade-quate monitoring capability during accident conditions. Subtask 2: Control of Radioactive Materials Released in Effluents The purpose of this subtask was to review plant operating histories and prepare NUREG reports documenting the evaluations and recommending solu-tions to identified problems. Various staff actions since 1978 (including NUREG reports and IE Bulletins) have resulted in the staff conclusion that no continuing need for add!- tional staff guidance exists. Subtask 3: Effects of Accidental Liquid Releases on Nearby Water Supplies The purpose of this task was to perform a generic analysis of the conse-quences of liquid tank failures for those plants which received their license prior to issuance of the Standard Review Plan (SRP). Experience in performing SRP analyses for newer plants has indicated that it is highly unlikely that radioactive concentrations in the nearest I potable water supply could exceed 10 CFR Part 20 values. Subtask 4: Pe; formance of Solid Waste Systems The purpose of subtask 4 was to perform an industry-wide survey to deter-mine the extent to which power plants could process wastes and to develop q plans for upgrading existing systems or adding new systems, i The NRC position relative to a requirement for an operable installed solid radwaste systcm has changed and, therefore, this subtask is no longer i appropriate. For the above reasons, Issue B-67 is being deleted from the NRR list of generic issues. Since Issue B-67 is being deleted, only Generic Issue A-02, " Appendix I" is appropriate to this topic. Lacrosse SEP A-84
4 i The resolution of Issue A-02 is described in the Basis for Deletion for Topic XI-1. Topic XI-2 is being deleted from the SEP program for the same reasons. TOPIC: XIII-1 Conduct of Operations , (1) Definition: The organization, administrative controls, and operating experience will be reviewed. The existing organization and administrative controls will be compared with Standard Technical Specifications and guidance provided 4 in Regulatory Guides 1.8 and 1.33 to determine the adequacy of the staff to protect the plant and to operate safely in routine, emergency, and long-term postaccident circumstances. The plant operating history will be reviewed to assess the combination of staff, operating controls and alarms, and administrative controls, in particular plant procedures, emergency planning, and offsite preparedness, to determine whether additional staff, qualifications, or administrative controls will be required for continued safe operation. (2) Safety Objective: To obtain reasonable assurance that the plant has enough people, with sufficient training and experience, and has administrative controls 4 adequate to specify proper operation in routine, emergency, and postaccident conditions. , (3) Status: Most of the older plants have staff members that meet the experience and educational requirements given in ANSI N18.1-1971 (endorsed by Regulatory Guide 1.8); however, a comparison against current criteria for the composite staff has not been made. These plants have provided training for subsequent plant staffs, and plant experience has, in general, demonstrated safe design and operation. Operating experience review is ongoing, and has been, in general, favorable. However, an analysis of this experience for trends, common elements, and potential hidden problems has not been systematically performed. A review of Section VI of operating reactor licensees' Technical Specifica-tions was begun in 1974 using_Section VI of the Standard Technical Specifi- !.. cations (STS) as a model. As of September 1975, these reviews had been completed and the plants licensed prior to this time had been found to: k (1) be acceptable and upgrading was not required, (2) require upgrading of only the reparting requirements, or (3) require improvement to be coeparable to the STS model. Plants licensed after September 1975 have been reviewed against the STS model. Further review of Section VI, therefore, will not be required. Emergency plans submitted at the operating-license stage complied with 10 CFR 50, Appendix E, 1970; however, these plans are not consistent with the guidance given in new Regulatory Guide 1.101, Revision 1,1977. Lacrosse SEP A-85
l (4)
References:
- 1. Regulatory Guides 1.8, " Personnel Selection and Training" '
1.33, " Quality Assurance Program Requirements (Operations)"
- 2. American National Standards Instit.ute, ANSI N18.1-1971, " Selection and Training of Nuclear Power Plant Personnel"
- 3. American National Standards Institute, ANSI N18.7-1972 Revised,
" Administrative Controls and Quality Assurance for the Operational Phase of Nuclear Power Plants"
- 4. Standard Technical Specifications, Section VI
- 5. 10 CFR Part 50, Appendix E
- 6. Regulatory Guide 1.101, Rev.1, " Emergency Planning for Nuclear Power Plants"
- 7. Standard Review Plan, Section 13.3 l
- 8. NUREG 75/111, " Guide and Checklist for Development and Evaluation of State and Local Government Radiological Emergency Response Plans In Support of Fixed Nuclear Facilities," October 1975
- 9. Environmental Protection Agency, " EPA Manual of Protective Action Guides and Protective Action for Nuclear Incidents," September 1975
- 10. Memorandum of Understanding, NRR and Office of State Programs on State and Local Preparedness, March 10, 1977 (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
(a) TMI Action Plan Task I.C.6, " Procedures for Verification of Correct Performance of Operating Activitie_s," (NUREG-0737) Under TMI Task I.C.6, a review of licensee procedures will be con-ducted to assure that an effective system of verifying the correct performance of operating activities exists. The purpose of this review is to provide a means of reducing human errors and improving the quality of normal operation. References cited for this review are ANSI Standard N18.7-1972 (ANS 3.2), " Administrative Controls and Quality Assurance for the Operational Phase of Nuclear Power Plants," and Regulatory Guide 1.33, " Quality Assurance Program Requirements (Operations)." These are the same references cited for Topic XIII-1. (b) TMI Action Plan Task III.A.1, " Improve Licensee Emergency Prepared ness - Short-Term," and Task III.A.2, " Improving Licensee Emergency Preperedness - Long-Term" (NUREG-0660 and NUREG-0737) Under Task III.A.1, a review of 10 CFR Part 50, Appendix E backfit , requirements is being conducted in accordance with NUREG-0654, y
" Criteria for Preparation and Evaluation of Radiological Emergency l Response Plans and Preparedness in Support of Nuclear Power Plants."
The scope of NUREG-0654 covers Standard Review Plan, Section 13.3, and NUREG 75/111. Regulatory Guide 1.101 has been deleted and has been superseded by an amended Appendix E to 10 CFR Part 50 (45 FR 55410, August 19, 1980). Under Task III. A.2, a review of licensee's emergency prepa-redness plans with respect to amended Appendix E will be conducted in accordance with NUREG-0654. Lacrosse SEP A-86 I i
l i
.The evaluations required by TMI Tasks I.C.6, III.A.1, and III.A.2 ,
are identical to SEP Topic XIII-1; therefore, this SEP topic ' has been deleted. XIII-2 Safeguards / Industrial Security TOPIC: (1) Definition: Industrial security will be included under the scope of the operations , review. Design. features to assess the plant's capability to prevent ! sabotage and protect the operating unit (s) at dual or thres-unit sites ' with unit (s) under construction will be included. Protective measures will be balanced against the sabotage threat. Fuel accountability will i also be reviewed to assure that adequate inventory control procedures exist and the required records are kept. (2) Safety Objective:
; To determine that the plant has adequate security forces, design features, procedures and plans, and other administrative controls to meet the postu-lated sabotage threat. To assure that the fuel is adequately accounted for, that proper records are maintained, and the required reports are made.
(3) Status: Each licensee currently has a security program and a fuel accountability program. Revised 10 CFR 73.55 has been published and submittals in accord-ance with its provisions were due May 25, 1977. These submittals are currently being evaluated. (4)
References:
- 1. 10 CFR Part 70
- 2. 10 CFR Part 73
- 3. Standard Technical Specifications, Section VI l
l- TOPIC: XV-1 Decrease in Feedwater Temperature, Increase in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Steam Generator Relief or Safety Valve
~
(1) Definition: Review the assumptions, calculational models used and consequences of h , postulated accidents which involve an unplanned increase in heat removal. An excessive heat removal, that is, a heat removal rate in excess of the heat generation rate in the core, causes a decrease in moderator tempera-l ture which increases core reactivity and can lead to a power level increase j and a decrease in shutdown margin. If clad failure is calculated to occur, determine that offsite dose consequences are acceptable. (2) Safety Objective: f To assure that pressures in the reactor coolant and main steam systems are limited in order to protect the reactor coolant pressure boundary from I Lacrosse SEP A-87
overpressurization and that fuel rod cladding failure as a result of departure from nucleate boiling ratio is limited. (3) Status: During each reload review by the staff, the previously determined limiting t*ansient is reviewed to determine if new core parameters are more restric-tive than the reference analysis parameter values. (4)
References:
Standard Review Plan, Sections 15.1.1 through 1E 1.4 TOPIC: XV-2 Spectrum of Steam System Piping Failures Inside and Outside of Containment (PWR) (1) Definition: Review the assumptions, including use of nonsafety grade equipment and concurrent steam generator or tube failure or blowdown of more than one steam generator, calculational models used, and consequences of postulated accidents which cause an increase in steam flow. The excessive steam flow reduces system temperature and pressure which increases core reactivity and can lead to a decrease of shutdown margin and departure from nucleate boiling ratio. (2) Safety Objective: To assure that (1) pressure in the reactor coolant and main steam lines is limited in order to protect the reactor coolant pressure boundary from overpressurization, (2) fuel damage is sufficiently limited so that the core will remain in place and intact with no loss of core cooling capability, (3) doses at the nearest exclusion area boundary are a small fraction of 10 CFR Part 100 guidelines, (4) ambient conditions do not exceed equipment qualification conditions (particularly nonsafety grade equipment used to mitigate the accident), (5) the thermal and stress transients do not damage the reactor vessel, and (6) systerr.s necessary for safe shutdown are not damaged by the accident. (3) Status: Investigation of the effects of high-energy line failures outside containment = on other equipment was initiated as a generic issue in 1971 and all but a few facilities have been completed. New acceptance criteria have evolved ' during the review period. There was no similar investigation for failures inside containment. No reviews on operating plants of the effects on the reactor of concurrent steam generator or tube failure, or of blowdown of more than one steam generator have been performed. (4)
Reference:
Standard Review Plan, Section 15.1.5 Lacrosse SEP A-88
TCPIC: X ;3 Loss of External Load, Turbine Triu, Loss Y;f A ndenser ' Vacuuma Closure of Main Steam Isolation 1/aive (BWR), and ' Steam Pressure Regulatory Failure (Cicsed' , (1) Definition: Review the assumpt' ions, calculational models used, and conse uences-vJ . postulated accidents which involve a decrease in secondary heat removal. The decrease in heat rernavai causes a suddent increase in sfitem prenu e ar:d temperature. , (2) Safety Objective: . To assure that pressure in the reactor coolant and main steam systems is limited in order to protect the reactor coolant pressure boundary from !. overpressurization and that thermal margin for fuel integrity is maintained. , m (3) Status: , The consequences associated with these transients are compared during each reload review to the consequences found to be acceptable during previous reload reviews. (4)
References:
Standard Review Plan, Sections 15.2.1 through 15.2.5' TOPIC: XV-4 Loss of Nonemergency AC Power to the Station Auxiliaries (1) Definition: Review the assumptions, calculational models used, and consequences of postulated accidents which involve the loss of ncnemergency ac power (loss of offsite power or onsite ac distribution system) to station auxiliaries (for example, mactor coolant circulation pumps). This power loss will, within a few seconds, cause the turbine to trip and reactor coolant system to be isolated, which in turn causes the coolant pressure and temperature to increase. (2) Safety Objective: , Toassurethatthepressureinthereactorcoolantal'dua'nsteamsystems , is limited in order to protect the reactor coolant pressure boundary from , = overpressurization and that thermal margin for fuel integrity is maintained. \' (3) Status: .s During each reload review by the staff, the previously determined limiting transient is reviewed to determine if new core parameters are more restri::tive than the reference analysis parameter values. .
^
(4)
Reference:
Standard Review Plan, Section 15.2.6 i Lacrosce SEP A-89 -
,s ,
3
.\ -,
- n. ,. (._ ,
TOPIC: XV Losss of Normal Feedwater Flow w (1) Definition [ o Review the assumptions, calculational models used, and consequences of the postulated loss of feedwater flow accidents, which cause an increase in coolant pressure and temperature.
- (2) Safet Objective
F . ' To assure that pressure in the reactor coolant and main steam systems is limited in order to protect the reactor coolant pressure boundary from overpressurization and that thermal margin for fuel integrity is maintained. [ (3) Status: ' ~;
^The consequences as ociated with these transients are compared during each reload review to the, consequences found to be acceptable during previous reload reviews. ,
! (4)
Reference:
[ Standard Review Plan, Section 15.2.7 TOPIC: XV-6 Feedwater System Pipe Breaks Inside and Outside
- Containment (PWR) n (1) Definition
Review the assumptions, calculational models used, and consequences of
- postulated accidents yhich involve feedwater line breaks of different sizes. A feedwater line break, deoending on size, may cause reactor
~
~
system heatup (by reducing feedwater flow to the steam generator), or F cooldown (by excessive erergy discharge through the break). } (2) Safety Objective: s To assure that pressure in the reactor coolant and main steam systems is limited in order to protect the, reactor coolant pressure boundary from overpressurization and that themal margin for fuel integrity is maintained i and that any radioactivity release would result in doses at the site boundary = _ well within 10 CFR Part 100 guidqlines. L (3) Status: w i , _- The identification of the most limiting transients and the consequences F associated sith these transients is evaluated during each reload review =
- by the cta#f.
1 (4) Referente: t
- Stardard Review Plan, Section 15.2.8 2 ' -s Lacrosse SEP ,
A-90
3 i TOPIC: XV-7 -Reactor-Coolant Pump Rotor _ Seizure and Reactor Coolant Pump Shaft Break (1) Definition: Review the assumptions, calculational models, and consequences of. seizure of the rotor or break of the shaft of a. reactor coolant pump in a PWR or recirculation pump in a BWR. These accidents result in a sudden decrease in core' coolant flow and corresponding degradation of core heat transfer and, in a PWR, an increase in primary system pressure. If clad failure is calculated, determine that offsite consequences are acceptable. < (2) Safety Objective:
; To assure'that the consequences-of a reactor coolant pump rotor seizure or reactor coolant pump shaft break are acceptable; that is, that no more
.than a small fraction of the fuel rods fail, that the radiological con-sequences are a small fraction of 10 CFR Part 100 guidelines, and that the-system pressure is limited in order to protect the reactor coolant pressure boundary from overpressurization.
(3) Status: Reviewed during each reload only if there is reason to believe that results would be different from the reference analysis; that is, only if a change in core parameters invalidates previous analyses. , (4)
Reference:
- Standard Review Plan, Section 15.3.3
. TOPIC: XV-8 Control Rod Misoperation (System Malfunction or Operator Error)* (1) Definition:
- Review the licensee's description of rod position, flux, pressure, and temperature indication systems and the actions initiated by those systems
- which.can mitigate the effects or prevent the occurrence of various mis-operations. Review the descriptions of the input calculations and the calculational ~models used and the justification of their validity and adequacy. A transient of this type can result in achieving fuel melt l temperatures and potential fuel damage.
Y' (2) Safety Objective: i
~To assure.that,the consequences of this event do not exceed specified-fuel design limits and that the protection system action be initiated 1
automatically. i I i
- Reviewed for PWRs only; Standard Review Plan, Sections 15.4.1 and 15.4.2 cover BWRs and no additional areas considered. :
i
'LeCrosse SEP A-91
(3) Status: Reviewed during reload, Technical Specifications revised to compensate for changes in analytical results. ; (4)
Reference:
Standard Review Plan, Section 15.4.3 TOPIC: XV-9 Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature, and Flow Controller Malfunction Causing an Increase in BWR Core Flow Rate (1) Definition: Review BWRs for (1) startup of an idle recirculation pump and (2) a flow controller malfunction causing increased recirculation flow. Review PWRs with loop isolation valves for startup of a pump in an initially isolated inactive reactor coolant loop where the rate of flow increase is limited by the rate at whicn isolation valves open. For PWRs without loop isolation valves, review startup of a pump in any inactive loop. If clad failures are calculated, determine that offsite consequences are acceptable. (2) Safety Objective: To verify that the plant responds in such a way that the criteria regarding fuel damage and system pressure are met (that is, no more than a small fraction of the fuel rods fail, that radiological consequences are a small fraction of 10 CFR Part 100 guidelines, and that the system pressure is limited in order to protect the reactor coolant pressure boundary from overpressurization.) (3) Status: PWRs reviewed against the final safety analysis report, BWR reviewed at each reload, Technical Specifications required to preclude exceeding safety limits during transients. (4)
Reference:
Standard Review Plan, Sections 15.4.4 and 15.4.5 TOPIC: XV-10 Chemical and Volume Control System Malfunction That Results in a Decrease in Boron Concentration in the Y Reactor Coolant (PWR) (1) Definition: Review the assumptions, calculational models used, and consequences of moderator dilution. An accident of this type could result in a departure from nucleate boiling and a loss of shutdown margin. Lacrosse SEP A-92
(2) Safety Objective: To confirm that the plant responds to the events in such a way that the { criteria regarding fuel damage and system pressure are met and adequate i time allowed for the operator to terminate the dilution before the shut- l down margin is reduced. (Reactor coolant pressure and main steam pres-sure should be listited in order to protect the reactor coolant pressure boundary from overpressurization.) (Operator action must be initiated within 30 minutes rollowing this event if refueling, and within 15 minutes during.other modes of operation.) (3) Status: Only reviewed during initial operating-license review and not thereafter. The consequences may not have been calculated in accordance with current practice. (4)
Reference:
Standard Review Plan, Section 15.4.6 TOPIC: XV-11 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position (BWR) (1) Definition: Review the spectrum of misloading events analyzed to verify that the worst situation undetectable by incore instrumentation has been identified. This review will include an assessment of the plant's offgas and steam line radiation monitors to detect fuel damage anc their capability to autoc:atically isolate 'he offgas system when necessary. (2) Safety Objective: To assure that a misloaded assembly is detected and if undetected will not result in exceeding fuel safety limits or radioactive releases. (3) Status: Reviewed during reloads, Technical Specifications developed to limit con-sequences of worst misloaded assembly to small fraction of 10 CFR Part 100 guidelines. Technical Specifications setpoints for radiation monitors alarm / isolation signals have been found deficient and have been updated y on a case-by-case basis for several plantr.. g (4)
Reference:
Standard Review Plan, Section 15.4.7 TOPIC: XV-12 Spectrum of Rod Ejection Accidents (PWR) , (1) Definition: Review the assumptions, calculational models used, and consequences, including radiological consequences, of PWR control rod ejection accidents, Lacrosse SEP A-93
and review the Technical Specifications regarding control of reactivity worth and technical specifications on primary to secondary leakage. Ejec-tion of a control element assembly from the core can occur if the control element drive mechanism housing or the nozzle on the reactor vessel head breaks off circumferentially. The ejection of a control element assembly by the reactor coolant system pressure can cause a severe reactivity excur-sion. This accident may result in high doses for those plaats where fuel failures are postulated to occur as a result of the accident. This accident usually determines the maximum allowable steam generator leak rate. (2) Safety Objective: To ensure that if a control element assembly ejection occurs, core damage is minimal, no additional reactor coolant pressure boundary failures occur, the calculated radial average energy density is limited to 280 cals/gm at any axial fuel location in any fuel rod, and that the radiologfcal conse-quences will not exceed ~ appropriate limits. (3) Status: Releases through the containment and/or steam generator leaks are analyzed for current plants, but were not reviewed routinely for older plants. Many of the operating plants.have no leak Technical Specifications or they are excessively high. During each reload by the staff, the previously determined limiting transient is reviewed to determine if the new ejected rod worth is more restrictive than the reference analysis values. (4)
References:
- 1. Standard Review Plan, Section 15.4.8
- 2. Regulatory Guide 1.77, " Assumptions Used for Evaluating a Control Rod Ejection Accident for Pressurized Water Reactors" TOPIC: XV-13 Spectrum of Rod Drop Accidents (BWR)
(1) Definition: Review the assumptions, calculational models used, and consequences of BWR control rod drop accidents and review the Technical Specifications regarding control of rod activity worth. An uncoupled rod may hang up in the core when the control rod drive is withdrawn and drop later when the consequences of a rapid control rod withdrawal are most severe. An analysis of the radiological consequences from this accident will be included. (2) Safety Objective:
.To limit the effects of a postulated control rod drop to the extent that reactor coolant pressure boundary stresses are not exceeded and core damage is minimal. To assure that the radial average fuel rod enthalpy at any axial location in any fuel rod is limited to less than 280 cals/gm follow-ing the worst reactivity excursion and to assure that the radiological consequences do not exceed appropriate guidelines.
Lacrosse SEP A-94
0 j (3) Status: 1 The potential for and reactivity consequences of an accidental control rod ; drop are now routinely evaluated prior to issuance of an operating license ! and any time thereafter when changes could affect the accident results or probability of occurrence. Radiological consequences may not have been-calculated in accordance with present practice. (4)
Reference:
Standard Review Plan, Section 15.4.9 TOPIC: XV-14 Inadvertent Operation of Emergency Core Cooling System and Chemical and Volume Control System Malfunction ,That Increases Reactor Coolant Inventory (1) Definition: 4 Review the assumptions, calculational models used, and consequences of actuation of the high pressure coolant injection system or faulty operation of the volume control system. The chemical and volume control system reguhtes both the chemistry and the quantity of coolant in the reactor coolant system. Changing the boron concentration in the reactor coolant system is a part of normal plant operation, compensating for long-term reactivity effects. Actuation of these systems could increase the volume of coolant within the reactor coolant pressure boundary (RCPB) causing a high water level, possible high power level, and high or low pressure. If clad failure is calculated, determine that offsite consequences are acceptable. (2) Safety Objective: To assure that water added to the RCPB does not cause transients that exceed RCPB pressure limits or result in unacceptable fuel damage. No activity is released during the transient, but the transient may subsequently result in increased radioactivity in gaseous releases during normal operation. (3) Status: This transient is now routinely analyzed prior to issuance of an operating license and any time thereafter when oroposed changes would affect the transient results. Radiological consequences may not have been calculated l i in accordance with current practice. W (4)
Reference:
Standard Review Plan, Section 15.5.1 TOPIC: XV-15 Inadvertent Opening of a PWR Pressurizer Safety / Relief Valve or a BWR Safety / Relief Valve (1) Definition: Review the assumptions, calculational models used, and consequences of inadvertent opening of a PWR pressurizer safety / relief valve or a BWR i ! Lacrosse SEP A-95 l _ - . . _ _ _ _ . _ __ _ _ _ _ _ _ ~ _ _ _ l
I safety / relief valve. Loss of reactor coolant inventory and depressurizing action of the rr.?ctor coolant system can occur if the PWR pressurizer safety / relief valve or the BWR safety / relief valves open spuriously, or open when required but fail to reclose properly. (2) Safety Obiective: To preserve fuel cladding integrity during reactor coolant system depres-surization transients resulting from faulty operation of a relief or safety valve while at rated power. (3) Status: The transient is now evaluated prior to issuance of an operating license and any time thereafter when proposed changes could affect the transient , results. (4) Referencas:
- 1. Standard Review Plan, Section 15.5.1
- 2. Regulatory Guide 1.70, " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants" TOPIC: XV-16 Radiological Consequences of Failure of Small Lines Carrying Primary Coolant Outside Containment (1) Definition:
Review the assumption, calculational models used, and radiological conse-quences of failure of small lines carrying primary coolant outside con-tainment and review the Technical Specifications associated with primary coolant radioactivity concentrations, isolation valve closure times, and isolation valve leakage limits. In the event of a rupture of any component in the instrument lines outside primary containment, primary coolant and any radioactivity contained in the coolant or released to the coolant during the transient will be released if the instrument lines are connected co the reactor coolant pressure bourdary. Primary coolant sample lines if broken outside primary ' containment can also allow coolant and radioactivity in the coolant to escape in the same manner. When these lines discharge to secondary containment, the integrity of the secondary containment and the efficiency of the filtration systems must be determined. (2) Safety Objective: a To assure that any release of radioactivity to the environment is substan-tially below the guidelines of 10 CFR 100. , l (3) Status: The radiological consequences of small line breaks outside of primary con-tainment have been evaluated routinely since 1970 prior to issuance of operating licenses, but have not always included the effects of iodine spikes during the depressurization transient. Lacrosse SEP A-96
- - . l
(4)
References:
- 1. Regulatory Guide 1.11, " Instrument Lines Penetrating Primary Reactor Containment"
- 2. 10 CFR Part 50, Appendix A, GDC 55 and 56
- 3. Standard Review Plan, Section 15.6.2 TOPIC: XV-17 Radiological Consequences of Steam Generator Tube Failure (PWR)
(1) Definition: Review the assumpticns, calculational models used, and consequences of a steam generator tube failure with and without loss of offsite power and review the Technical Specifications associated with coolant activity con-centrations. Steam generator tube failures allow escape of reactor coolant An analysis of the into the main steam system and to the environment. radiological consequences of this accident will be included. (2) Safety Objective: To assure that the plant responds in a proper manner to this accident, including appropriate operator actions, and to assure that radioactivity released following steam generator tube failure (s) is a small fraction of the 10 CFR 100 guidelines and within 10 CFR 100 for the case of a coincident iodine spike. (3) Statug: The iodine release mechanism may not have been analyzed in accordance with present_ assumptions and methods for some of the older PWRs. Some operat-ing plants do not have iodine activity limits in their Technical Speci-fications or have inappropriately high limits. (4)
References:
- 1. Standard Review Plan, Section 15.6.3
- 2. Regulatory Guide 1.5, " Assumptions Used for Evaluating the Potential Radiological Consequences of a Steam Line Break Accident for Boiling Water Reactors" TOPIC: XV-18 Radiological Consequences of Main Steam Line Failure Outside Containment L (1) Definition:
Review the assumptions, calculational models used, and consequences of failure of a main steam line outside containment and review the Technical Specifications associated with primary coolant activity concentrations
~
and main steam isolation valve closure times. (2) Safety Objective: A steam line break outside containment allows radioactivity to escape to the environment. To limit the release of radioactivity to the environment Lacrosse SEP A-97
to well within the guidelines of 10 CFR 100 in the event of a large steam l line break, the primary coolant radioactivity must be appropriately limited I by Technical Specifications. l l (3) Status: Some operating plants do not have appropriate coolant activity Technical Specifications. (4)
Reference:
Standard Review Plan, Section 15.6.4 TOPIC: XV-19 Loss-of-Coolant Accidents Resulting From Spectrum of Postulated Piping Breaks Within the Reactor Coolant Pressure Boundary (1) Definition: Review the licensee's analyses of the spectrum of loss-of coolant accidents (LOCAs) including break locations, break sizes, and initial conditions assumed, the evaluation model used, failure modes, radiological conse-quences, acceptability of auxiliary systems, functional capability of the containment, and the effects of blowdown loads. LOCAs are postulated breaks in the reactor coolant pressure boundary resulting in a loss of reactor coolant at a rate in excess of the capability of the reactor cool-ant maket.p system. LOCAs result in excessive fuel damage or melt unless coolant is replenished. (2) Safety Objective: 1 To assure that the consequences of loss-of-coolant accidents are accept-able; that is, that the requirements of 10 CFR 50.46 and Appendix K to 10 CFR 50 are met, that the radiological consequences of a design basis loss of-coolant accident from containment leakage and the radiological consequences of leakage from engineered safety features outside containment are acceptable, and the structural effects of blowdown are acceptable. (3) Status: Emergency core cooling system (ECCS) evaluation is a generic item which is currently under review or is complete for all operating reactors (La Crosse and San Onofre have stainless steel cores and have analyses ccmpleted to show conformance with the Interim Acceptance Criteria). Related generic items currently under review are reevaluations for l increased vessel head fluid temperatures in W PWRs, effects of core flow g on BWR LOCA analyses, GE ECCS input errors, and non-jet pump BWR core spray cooling coefficients. Radiological consequences are not routinely rereviewed. (4)
Reference:
Standard Review Plan, Section 15.6.5 and its Appendices Lacrosse SEP A-98 l l _- - - -
4 TOP!C: XV-20 Radiological-Consequences of Fuel-Damaging Accidents i I (Inside and Outside Containment) l 1
-(1) Definition:
Review the assumptions, calculational. models used, and consequences of postulated fuel damaging accidents inside and outside contai.. ment and review Technical Specifications associated with fuel handling and ventilation system and filter systems, including interlocks on fuel movement and damage from fuel cask drop and tipping. . Include in the review the assumed activity available for release, decontamination factors, filter efficiencies, activity ~ transport mechanisms and rates, ventilation system potential release pathways, and calculated doses. (2) Safety Objective: To assure that offsite doses resulting from fuel damaging accidents, resulting from fuel handling, or dropping a heavy load en fuel are well within the guideline values of 10 CFR Part 100. (3) Status: 4 The radiological consequences of fuel handling accidents inside contain-ment are currently being performed as a generic review for PWRs. The radiological consequences of fuel damaging accidents outside containment of operating plants are only evaluated if Technical Specifications are reviewed. (4)
References:
- 1. Standard Review Plan, Section 15.7.4
- 2. Regulatory Guide 1.25, " Assumptions Used for Evaluating the Poten-tial Radiological Consequences'of'a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors" TOPIC: XV-21 Spent Fuel Cask Drop Accidents (1) Definition:
Review the potential for spent fuel cask drops, the damage which could result from cask drops, and the radiological consequences of a cask drop from fuel damaged within the cask under conditions exceeding the design t basis impact on the cask. (2) Safety Objective: To assure that the damage to fuel within the casks and radiological consequences resulting from a cask drop are acceptable or that acceptable measures have been taken to preclude cask drops. Lacrosse SEP A-99
A (3)- Status: . Fuel cask drop analysis is a generic item which has been completed on some plants or is currently under review for all other operating reactors. (4)
References:
- 1. Standard Review Plan, Section 15.7.4
- 2. Regulatory Guide 1.25 " Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors"
- 3. NUREG-0328, " Regulatory Licensing. Status Summary Report" (Pink Book)
(5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic): USI A-36, " Control of Heavy Loads Near Spent Fuel" (NUREG-0649) The review criteria required by USI A-36 (Standard Review Plan, i j Section 15.7.5) are identical to the review criteria specified in the References of SEP Topic IX-2; therefore, this SEP topic has been deleted. TOPIC: XV-22 Anticipated Transients Without Scram (1) Definition: Review the postulated sequences of events, analytical models, values of parameters used in the analytical models, and the predicted results and consequences of events in which an anticipated transient occurs and is not followed by an automatic reactor shutdown (scram). Analyses of the radiological consequences for these transients will be included. Failure of the reactor to shut down quickly during anticipated transients can lead to unacceptable reactor. coolant system pressures and to fuel damage. (2) Safety Objective: To assure that the reliability of the reactor shutdown systems is high enough so that anticipated transient without scram (ATWS) events need not be considered or to assure that the consequences of ATWS events are accept- ' able; that is, that the reactor coolant system pressure, fuel pressure, fuel thermal and hydraulic performance, maximum containment pressure, and radiological consequences are within acceptable limits. (3) Status: ATWS is a generic topic currently under review to determine a position for all power reactors. BWR licensees have been requested to install reactor coolant pump trips as a short-term program measure. All licensees have submitted descriptions of the applicability of vendor generic ATWS reports for their plants. The schedule for review of Class C plants, which includes those plants designated for Phase II of SEP, has not yet been developed. l Lacrosse SEP A-100
l L ! (4)
References:
1
- 1. NUREG-0328, " Regulatory Licensing: Status Summary Report" (Pink Book)
- 2. WASH 1270, " Technical Report on Anticipated Transients Without Scram for Water-Cooled Power Reactors," September 1973
- 3. Standard Review Plan, Section 15.8 and Appendix (5) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
USI A-9, " Anticipated Transients Without Scram" (NUREG-0606) The reference cited in this topic, that is, NUREG-0328, was the precursor of USI A-9. The evaluation required for USI A-9 is l identical to SEP Topic XV-22; therefore, this SEP topic has been deleted. TOPIC: XV-23 Multiple Tube Failures in Steam Generators (1) Definition: Assess the effects of multiple steam generator tube failures (ranging from leaks to double-ended ruptures) as a result of pressure differentials that
- may occur following a loss-of-coolant accident (LOCA), steam line break, or anticipated transient without scram (ATWS) events.
(2) Safety Objective: Assure that the reflood of the core following a LOCA is possible and that the radiological consequences following these accidents are within the 10 CFR Part 100 guidelines. (3) Status: The consequences of multiple tube failures- have not been analyzed for any plant at the licensing stage. Work has been done for some operating plants, but ultimate goals have yet to be set. (4)
References:
- 1. Prairie Island Nuclear Station, Docket Nos. 50-282 and 50-306
- 2. Turkey Point Plant, Docket Nos. 50-250 and 50-251
- 3. Surry Power Stations, Units 1 and 2, Docket Nos. 50-280 and 50-281 l
l (5) ' Basis for Deletion (Related TMI Task, USI, or Other SEP Topic): (a) USI A-3, A-4, A-5, " Westinghouse, Combustion Engineerina, Babcock and Wilcox Steam Generatar Tube Integrity" (NUREG-0649) Two of the tasks of USI A-3, A-4, A-5 are as follows:
- 1. Analyses of LOCA with Concurrent Steam Generator Tube Failures
- 2. Analyses of Main Steam Line Break Latrosse SEP A-101 l
The analyses required by these two tasks'in USI A-3, A-4, A-5 cover Ltwo of the three events specified in the Definition. (b) USI A-9, " Anticipated Transients Without Scram" (NUREG-0606)
-Pressure differentials resulting from ATWS events have been determined to be no greater than.those resulting from main steam line breax events (NUREG-0460, Volune 2, Appendix V). The analysis for ATWS event is, therefore, covered under USI A-3, A-4, and A-5.
The evaluation required for USI A-3, A-4, A-5 is identical to SEP Topic XV-23; therefore, this SEP topic has'been deleted. TOPIC: XV-24 Loss of All AC Posar (1) Definition: Review plant systems-to determine that following loss of all ac power (onsite and offsite) the reactor is shut down and core cooling can be initiated. Loss of all ac power caus'es loss of most emergency equipment and instrumentation. , (2) Safety Objective: l To assure that with only d: power, equipment design, diversity, and operator action are suffioient to initiate core cooling within a short time period (typically 20 minutes). (3) Status: Not an exp. licit SRP topic. Availability of some ac power is assumed in all accident / transient analyses. Topic may be considered as an auxiliary l fuel' pump or~ reactor core isolation cooling pump diversity spinoff. (4) Basis for Deletion (Related TMI Task, USI, or Other SEP Topic):
.USl A-44, " Station Blackout" (NUREG-0606)
) The problem description of USI A-44 is identical to the Definition of SEP Topic XV-24, and the review of USI A-44 would be the same as l Topic XV-24; therefore, this SEP topic has been deleted. f i TOPIC: XVI Technical Specifications (1) Definition: The existing Technical Specifications, associated with SEP topics, will be compared with the Standard Technical Specifications for deviations. Where significant differences exist, they will be identified and considered ! for upgrading. The bases for the specifications will be examined including trip setpoints and' accounting for nuclear uncertainty. Where significant voids occur in existing specifications, appropriate values will be identified and considered for upgrading. I t !' Lacrosse SEP A-102
- r. . , _ . _ _ _ _ _. .- _ _ _ _ _ _ _ - _ - -_ _ _ _ _ _ _ . . _ _ _ _
4 (2) Safety Objective: To assure that the safety limits and operational safety measures are sufficiently specified for the plant to minimize the probability of acci-dents that could result from equipment failure, misoperation, or human error. 4 (3) Status: See Topic XIII-1, " Conduct of Operations" for Section VI status. The other sections of the Technical Specifications are reviewed only to the extent that reloads, license amendments, or generic-problems require. (4)
References:
- 1. Standard Technical Specifications; Regulatory Guide 1.8, " Personnel Selection and Training," and Regulatory Guide 1.33, " Quality Assur-ance Program Requirements (Operations)"
- 2. Standard Review Plan
- 3. Regulatory Guide 1.70, " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," Chapter 16
- 4. 10 CFR Part 50, Section 50.36 TOPIC: XVII Operational Quality Assurance Program (1) Definition:
Review the Quality Assurance (QA) Program with respect to safe and reli-able operation of the plant. (2) Safety Objective: Since 1973, significant new guidance for operational QA programs in the form of Regulatory Guides and WASH documents has been issued describing how to meet the criteria of 10 CFR Part 50, Appendix B. The objective of l i this guidance is to assure that operation, maintenance, modification, and I test activities do not degrade the capability of safety-related items to perform their intended functions. (3) Status: Generic review for compliance with current standards is under way. As of May 1977, 50 of the 63 operating plants have QA programs which meet current criteria. The 13 remaining plants are currently under review, with an l estimated completion date of July 1977. f (4)
References:
l 1. 10 CFR Part 50, Appendix B
- 2. WASH-1283, Revision 1, " Guidance on Quality Assurance Requirements During Design and Procurement Phase of Nuclear Power Plants,"
May 24, 1974
- 3. WASH-1284, " Guidance on Quality Assurance Requirements During the Operations Phase of Nuclear Power Plants," October 26, 1973 f
Lacrosse SEP A-103
l
~4. WASH-1309, " Guidance on Quality Assurance Requirements During the-Construction Phase of Nuclear' Power Plants," May 10, 1974-
.5. American' National Standards Institute, ANSI N18.7-1976, "Administra-
. tive Controls and Quality. Assurance for the Operational Phase of-Nuclear Power Plants,"' February 19, 1976
'U.S. Nuclear Regulatory Commission reports cited under " Basis for Deletion"
{ include: NUREG-75/111 ' Guide and Checklist for Development and Evaluation 'of
-State and Local Government Radiological Emergency Response
' Plans in Support of Fixed Nuclear Facilities" (Reprint of WASH-1293), Oct. 1975. I NUREG-0153
" Staff Discussion of 12 Additional Technical Issues Raised
'by Responses to November 3, 1976 Memorandum from Director, NRR, to NRR staff," 1976.
i- NUREG-0313
" Technical Report on Material Selection and Processing Guidelines for BWR Coolant Pressure Boundary Piping,"
- j. July 1977.
NUREG-0328. " Regulatory Licensing: Status Summary Report" (Pink Book). j NUREG-0371 " Approved Category A Task Action Plans," Nov. 1977.
- NUREG-0410 "NRC. Program for the Resolution of Generic Issues Related
! .to Nuclear Power Plants, Report to Congress," Dec. 1977. I NUREG-0460 " Anticipated Transients Without Scram for Light Water Reactors," Vol. 2,.Apr. 1978. P i -NUREG-0471 " Generic Task Problem Descriptions - Category B,'C, and D ! Tasks," Sept. 1978. i NUREG-0484 " Methodology for Combining Dynamic Responses," May 1980. i NUREG-0510 " Identification of Unresolved Safety Issues Relating to L [ I Nuclear Power Plants--A Report to Congress 1979," Jan. 1979. NUREG-0554 " Single-Failure-Proof Cranes for Nuclear Power Plants," May 1979.' NUREG-0577 " Potential for Low Fracture Toughness and Lamellar Tearing on PWR Steam Generator and Reactor Coolant Pump Supports," Sept. 1979. i NUREG-0606 " Unresolved Safety Issues Summary," issued quarterly. l NUREG-0609 " Asymmetric Blowdown Loads on PWR Primary Systems, Resolu-l t tion of Generic Task Action Plan A-2," Jan.1981. i 4 NUREG-0649 " Task Action Plan for Unresolved Safety Issues Related to Nuclear Power Plants," Feb. 1980. [ -Lacrosse SEP A-104 l
. . _ . , _ . . - -_ _ _ _ - - __ - - . _ _ _ _ .. s
NUREG-0654 " Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants," Feb. 1980. NUREG-0660, "NRC Action Plan Developed as a Result of the TMI-2 R v. 1 Accident," Vols.1 and 2, May 1980, Rev.1, Aug.1980. NUREG-0691 " Investigation and Evaluation of Cracking Incidents in Piping in Pressurized Water Reactors," Sept. 1980. NUREG-0705
" Identification of New Unresolved Safety Issues Relating to Nuclear Power Plants," Mar. 1981.
NUREG-0737
" Clarification of TMI Action Plan Requirements," Nov. 1980.
NUREG-0800
" Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," July 1981 (formerly NUREG-75/087).
NUREG/CR-1321 " Final Report - Phase I. Systems Interaction Methodology Applications Program," Apr.1980. I l 1 l l Lacrosse SEP A-105
APPENDIX B SEP TOPICS DELETED BECAUSE THEY ARE COVERED BY A TMI TASK, UNRESOLVED SAFETY ISSUE (USI), OR OTHER SEP TOPIC 1,2 l l L , 15ee " Basis for Deletion" in Appendix A under applicable SEP topic. 2 Letter from G. C. Lainas (NRC) to all SEP licensees,
Subject:
Deletion of Systematic Evaluation Program Topics Covered by Three Mile Island NRC Action Plan, Unresolved Safety Issues, or Other SEP Topics, May 1981. La Crosse SEP
I SEP TMI, USI, or TMI, USI, or SEP Title j Topic No. SEP Title SEP No. l 11:2.8 Onsite Meteorological Measurements TMI II.F.3 Instrumentation for Monitoring Accident Conditions j Program TMI III.A.1 Improve Licensee Emergency Preparedness - Short Tore 11-2.0 Availability of Meteorological Data TMI II.F.3 Instrumentation fer Monitoring Accident Conditions in the Contrcl Room TMI III.A.1 Improve Licensee Energency Preparedness - Short Tore TMk I.D.1 Control Room Design Reviews III-8.D Core Supports and Fuel Integrity USI A-2 Asymmetric Blowdown Loads on Reactor Primary Coolant System III-9 Support Integrity USI A-12 Fracture Toughness of Steam Generator and Reactor Coolant Pump Supports USI A-7 Mark I Containment Long-Term Program USI A-24 Environmental Qualification of Safety-Related Equipment USI A 46 Seisele Qualification of Equipment in Operating Plants SEP !!I-6 Selseic Design Considerations SEP V-1 Compliance With Codes and Standards (10 CFR Part 50, Section 50.55a) III-11 Component Integrity USI A-46 Seiselc Qualification of Equipment in Operating Plants USI A-2 Asymmetric 8 lowdown Loads on Reactor Primary Coolant SEP III-6 Selseic Design Considerations 111-12 Environmental Oalification of USI A-24 Qualification of Safety-Related Fquipment Safety-Related Equipment V-38 Overpressurization Protection USI A-26 Reactor Vessel Pressure Transient Protection V-4 Piping and Safe-End Integrity USI A-32 Pipe Cracks in Boiling Water Reactors V-8* Steam Generator (SG) Integrity USI A-3,4,5 Steam Generator Tube Integrity V-13 Waterhammer USI A-1 Waterhammer VI 2.A* Pressure-Suppression-Type BWR USI A-7 Mark I Cuntainment Long-Term Program Containments VI-2.B Subcompartment Analysis USI A-2 Asymmetric Blowdown loeds on Reactor Primary Coolant System VI-5 Combustible Gas Control TMI II.B.7 Analysis of stydrogen Control USI A-48 Hydrogen Control Measures and Effects of Hydrogene 8 urns on Safety Equipment VI-7.E" Emergency Core Cooling System Sump USI A-43 containment Emergency Sump Reliability Design and Test for Recirculation Mode Effactiveness VI-8 Control Room Habitability TMI III.D.3.4 Control Room Habitability Requirements VII-4 Effects of Failure in Monsafety- USI A-17 Systems Interactions la Nuclear Power Plants Related Systems on Selected USI A-47 Safety Implications of Control Systems Engineered Safety Features VII-5 Instruments for Monitoring Radia- TMI II.F.1 Additional Accident Monitoring Instroentation I tion and Process Variables During TMI II.F.2 Identification of a..J Recovery From Conditions Accidents Leading to Inadequate Core Cooling TMI II.F.3 Instruments for Monitoring Accident Conditions IX-2 Gwe dead Handling Systems (Cranes) USI A-36 Control of Heavy Loads Near Spent Fuel Pool X8 Auxiliary Feedwater System TM1 II.E.1.1 Auxiliary Feedwater Systee Evaluation i XIII-1 Conduct of Operations TMI I.C.6 Procedures for Verification of Correct Performance of l Operating Activities i TMI III A.1 Improve Licensee Emergency Preparedness - Short-Tere ! TMI III.A.2 Improving Licensee Emergency Preparedness - Long-Tere XV-21 Spent Fuel Cask Drop Accidents USI A-36 Control of Heavy Loads Meer Spent Fuel Pool XV-22 Anticipated Transients Without USI A-9 Anticipated Transients Without Scram i
- Scram XV-23" Multiple Tse Failures In Steam USI A 3,4,5 Steam Generator Tube Integrity Generators USI A-9 Anticipated Transients Without Scraa l XV-24 Loss of All AC Power USI A-44 Station Blackout f *Also appears in Appendix C. These topics were deleted f rom the Lacrosse review because nf nonappilcability to SWRs or to the La Crosse design and will not be discussed in the provisional operating license conversion safety evaluation report.
La Crosse SEP B-1 l i--_---_____________.- _ _ _ _
APPENDIX C PLANT-SPECIFIC SEP TOPICS DELETED, REFERENCE LETTER, AND REASON FOR DELETION l t l l ? l l l La Crosse SEP
SEP Data of Topic No. SEP title letter Reason for deletion of topic III-3.B Structural and Other Consequences (e.g., 3/10/B1 Not applicable to site because site Flooding of Safety-Related Equipment in does not have a system whose function Basements) of Failure of Underrirain is to lower the groundwater table. Systems III-7.A Inservice Inspection, including Prestressed 5/7/81 Not applicable to this unit 5 Concrete Containments With Either Grouted containment design. or Ungrouted Tendons III-7.C Delanination of Prestressed Concrete 10/29/79 Not applicable to this unit's Containment Structures containment design. 111-8.8 Control Rod Drive Mechanism Integrity 9/26/80 Review published as NUREG-0479, " Report on BWR Control Red Drive Failures." III-10.8 Pump Flywheel Integrity 10/29/79 Not applicable 'o SWRs. III-10.C Surveillance Requirements on BWR 10/29/79 Not applicable to this facility design. Recirculation Pumps and Discharge Valves IV-3 BWR Jet Pumps Operating Indications 5/7/81 Not applicable to this facility design. V-1 Compliance With Codes and Sta*.Jards 11/27/81 Reviewed under inservice ir.spection/ inservice test program. V-2 Appilcability of Code Cases 10/29/79 Not applicable at this time; to be reviewed for any future modifications using references to Code Cases. V-3 Overpressurization Protection 10/29/79 Not applicable to BWRs, based on operating experience. V-7 Reactor Coolant Pumo Overspeed 5/7/81 Not applicable to BWRs. V-B Steam Generator Integrity 10/29/79 Not appilcable to BWRs. V-9 Reactor Core Isolation Cooling 10/29/79 Not applicable to this facility design. System (SWR) VI-2.A Pressure-Suppression-Type BWR Containments 10/29/79 Not applicable to this facility design. VI-2.C Ice Condenser Containment 10/29/79 Not applicable to this unit's containment design. VI-7.A.1 Emergency Core Cool,ing System Reevaluation 10/29/79 Not applicable to BWRs. To Account for Increased Reacter Vessel Upper-Head Temperature
.VI-7.A.2 Upper Plenum injection 10/29/79 Not applicable to BWRs.
i VI-7.A.4_ Core Spray Norzle Effectiveness 10/29/79 Not applicable to this facility design. VJ-7.8 Engineered Safety Feature Switchover From 10/29/79 Not applicable to BWRs. InjectiontoRecirculationMeds(Automatic Emergency Cora Cooling System Realignment) VI-7.C.3 Effect of PWR Loop Isolation Valve Closure 10/29/79 Not applicable to BWRs. 9 During a Loss-of-Coolant Accident on Emer-gency Core Cooling System Performance VI-7.E Laergency Core Cooling System Sump Design 10/25/79 Not applicable to this facility design. and Test for Recirculation Mode Effectiveness VI-7.F Accumulator Isolation Valves 6wer and 10/29/79 Not epplicable to BWRs. Control System Design VI-9 Main Steam Line Isol nion Seal System (BWR) 10/29/79 Not applicable to this facility design. VI-10.B Shared Engineered Safety Features, Onsite 10/29/79 Not applicable to this facility design. Emergency Power, and Service Systems for Multiple Unit Stations Lacrosse SEP C-1
SEP Date of Topic No. SEP title letter Reason for deletion of topic VII-7 Acceptability of Swing Bus Design on BWR-4 10/29n9 Not applicable to this facility design. Plants IX-4 Baron Addition System (PWR) 10/29n9 Not applicable to 8WRs. X Aurillary Feedwater System 10/29n9 Not applicable to BWRs. XI-1 Appendix I 12/4/81 Being resolved under generic activities A-02, " Appendix I," and E-35, "Confirma-tion of Appendix I Nodels." (See
" Basis for Deletion" in Appendix A under Topic XI-1.)
XI-2 Rajlological (Effluent and Process) 12/4/81 Being resolved under generic activities Nonitoring Systems A-02,"ApndixI." (See " Basis for Deletion in Appendix A under Topic XI-2.) XV-2 Spectrum of Steam System Piping Failures 10/29n9 Not applicalle to BWRs. Inside and Outside Containment (PWR) XV-6 Feessater System Pipe Breaks Inside and 10/29n9 Not applicable to BWRs. Outside Containment (PWR) XV-10 Cheetcal and Volume Contrcl Systen 10/29n9 Not applicable to BWRs. Na1 function That Results in a Decrease in Boron Concentration in the Reactor Coolant (PWR) XV-12 Secetrum of Rod Ejection Accidents (PWR) 10/29n9 Not applicable to BWRs. XV-17 Rcdtological Conseawnces of Steam 10/29n9 Not applicable to BWRs. Generator Tube Failure (PWR) XV-23 Nultiple Tube Failures in Steam Generators 11/16n9 Not applicable to 8WRs. XVI Technical Specifications 11/5/80 Will be addressed after completion of the integrated assessment. 1 1 Lacrosse SEP C-2
APPE. N DIX D PROBABILISTIC RISK ASSESSMENT STUDY b La Crosse SEP
SAI-83-129-WA Revision 1 RISK BASED CATEGORIZATION OF THE LA CROSSE BWR SEP ISSUES Paul Amico Bahman Atafi Michael Chol Walter Ferrell Daniel Gallagher Willia.n Galyean Paul Liang Robert Liner Charles Scardino J. Frank'Wimpey March 7, 1983 i Prepared for l U.S. Nuclear Regulatory Commission
- Washington, D.C.
l Contract MRC-03-82-096 1 f
i TABLE OF CONTENTS Section Py EXECUTIVE
SUMMARY
. . . . . . . . . . . . . . . . . . . 1 I INTRODUCTION ..................... 1 II METHODOLOGY FOR CATEGGRIZATION OF LA CROSSE BWR SEP ISSUES ..................... 2 III RESULTS . . . . . . . . . . . . . . . . . . . . . . . . 7 IV ANALYSIS ....................... 12 V REFERENCES ...................... 74 4
i
\
EXECUTIVE SUPMARY This is an Executive Summary of the report, " Risk-Based Categorization of La Crosse BWR SEP Issues." Refer to the main report for the details of the analysis we have used to classify the La Crosse BWR SEP issues with respect to their importances to risk. These classifications have been performed using probabilistic risk assessment (PRA) techniques. The issues have been examined from the perspective of the impact their resolution would have on risk from the plant. The classifications are based on the criteria given in Table Ex-1. Following are discussions of each ' issue, their classifications based on these criteria, and the supportive results of our analysis which were judged by these criteria. The methodology adopted in this study was to examine the impact of each issue on the systems they affect and assess the importance of the issue by qualitative and quantitative consideration of a simplified fault tree developed for the particular system under consideration and insights of other PRAs. For each issue, we estimated the impact its resciution would have on the La Crosse BWR fault trees and thus the impact on the risk at the La Crosse BWR. The La Crosse BWR -f ault trees referred to here are the simplified fault trees that were developed for et.ch issue when it was deter-mined that such a f ault tree would be necessary for the resolution of the issue. The " dominance" of a f ault tree indicates whether that f ault tree would appear in the perceived dominant accident sequences. Since no compre-hensive Probabilistic Risk Assessment (PRA) analysis has been performed for the La Crosse BWR, overall results of other PRAs performed in the interim reliability evaluation program (IREP), raactor safety study methodology applications program (RSSMAP) and WASH-1400 studies on BWRs were used for judgments related to the effect of a system on dominant accident sequences. i Table Ex-2 gives the results of the classification of the issues as high, medium, or low importance to risk. The numbers denote the issues. The rest of this executive summary consists of brief summaries of each of the issues evaluated and its risk resolution. The main report contains more detailed discussions of the methodology and the analysis of each issue. l l l i 1
1 I TABLE EX-1 Classification of Issues Classificati_on Criterion High Resolution of issue dominates value of the top event of a dominant fault tree or dominant sequence event. Medium Resolution of issue impacts but does not dominate value of top event of dominant fault tree or dominant sequence event. Low Resolution of issues has no impact on value of top event of dorainant fault tree or dominant sequence event. i i t ii
TABLE EX-2 C16ssification of Issues , Importance to Risk
$158 V-10.8 RHR Reliability VII-1.A Isolation of Reactor Protection System.From Non-Safety Systems VIII-3.8 DC Power System Bus Voltage Monitoring and Annunciation IX-5 Ventilation Systems Medium None Low III-5.B Pipe Break Outside Containment , III-8.A Loose Parts Monitoring and Core Barrel Vibration Program III-10.A Thermal Overload Protection for Motors of Motor Operated !
Valves V-5 Reactor Coolant Pressure (RCPB) Leakage Detection V-10.A RHR Heat Exchanger Tube Failures VI-4 Containment Isolation System VI-6 Containment Leak Testing l VI-7.A.3 ECCS Actuation System VI-7.C.1 Appendix K. Electrical Instrumentation and Control (EIC) Re-Review VI-10.A Testing of Reactor Trip System and Engineered Safety f Features, Including Response Time Testing i XV-20 Radiological Consequences of Fuel Damaging Accidents l iii
( III-5.B Pipe Break Outside Containment In this analysis the frequency of a pipe break between the containment and outboard isolation valves in combination with a failure of the reactor i building isolation valve was estimated. The other two areas of concern for this topic were not within the scope of this analysis. These two topics not evaluated dealt with pipe whip damage criteria and jet impungement, and effects of a failure in the electrical equipment room steam heating systein. The analysis of the pipe break, isolation valve failure showed that this combination of events was of a very low frequency. Due to this expected low frequency of occurrence we rate this portion of this issue to be of low risk
- significance.
III-8.A Loose Parts Monitoring and Core Barrel Vibration Monitoring The La Crosse BWR does not have a loose parts monitoring system (for loose parts within the reactor coolant pressure boundary) to meet the re-quirements of Regulatory Guide 1.133. Features lacking for the system would include sensors on the exterior surface of the RCPB. capable of detecting
- acoustic disturbances, system sensitivity specifications, alert levels, data acquisition modes and other system and procedural requirements.
The loose parts that would be detected by a loose parts monitoring system have not been a significant cause of transients at nuclear power plants. Due to the relatively high transient frequency from other causes the elimination of loose parts induced transients has a small effect on the core melt frequency. This issue is of low risk significance. l III-10.A Thermal Overload Protection for Motors of Motor Operated Valves Current criteria requires that the thermal overload protection for motors of MOVs be bypassed during emergency operation. Additionally, for valves that use a torque switch to end valve travel..the torque switch should be bypassed with a limit switch during automatic actuation. To determine the effect of bypassing the thermal overload protection for MOVs during emergency operation, the contribution of thermal overload failure on the total failure of the MOV on demand was calculated. It was shown that bypassing of the thermal overload protection results in a 14% reduction in the failure probability of MOVs on -demand. It was found that the overall effect of this reduction in the MOV failure rate on the failure probabilities of the auxiliary core spray system is negligible. The aux-111ary core spray system is the only system affected by this issue. Thus, = it is concluded that bypassing of the MOV's thermal overload protection
- devices has a very small effect on the overall core melt frequency. Also, the replacement of the torque switch with a limit switch does not improve the reliability of the MOV (Failure probabilities for limit and torque switches are of the same order of magnitude i.e., not significantly dif-ferent. The limit switch is not a more reliable device than the torque switch.) The risk significance of this issue is therefore rated as low.
4 iv
V-5 Reactor Coolant Pressure Boundary Leakage Detection Current criteria requires that three separate detection systems be installed in a nuclear power plant to detect unident1fied leats from the
; reactor coolant pressure boundary to the primary containment. These systems 3 should have the capability to detect a 1 gpa leak within 1 hour. The detection systems at the La Crosse BWR meet all of these requirements except that the systems have not been shown to be able to detect the 1 gpm leak in 3
1 hour. A 1 gpm leak can be detected over a longe" interval. The analysis compared the Sp LOCA frequency associated with the present La Crosse BWR detection capabTlities with the expected frequency given the improved detec-tion capabilities. (It was assumed that all pipe breat LOCAs begin as leaks and can be prevented 10 those leats are detected.) The analysis shows that if the time required for a leak to become a LOCA is much longer than the suggested one hour detection time plus the time the La Crosse BWR would be pressurized after detection of a leak, there is virtually no change in the S2 LOCA frequency. For this analysis the effect of the improved leakage detection capabilities on the S2 LOCA frequency was the only effect analyzed. The analysis did not consider the significance of leakage detection to mitigate the high energy pipe breaks. It also excludes consideration of common mode pipe break effects. This issue is ranked of low significance. 4 V-10.A RHR Heat Exchanger Tube Failures The only area of concern for this topic at the La Crosse BWR is the potential for in-leakage, the leakage of contaminant water into the primary system via the decay heat removal system. The current La Crosse BWR testing procedures do not conform to the Standard Technical Specifications. The licensee is installing surveillance procedures that will be in accordance with the Standard Technical Specifications. Additionally, this issue deals with leakage into the primary system, not out of the primary system. No radioactivity is released and the cooling system's ability to perform its function is not impaired. Therefore, this issue has no effect on the core melt frequency and is of low risk significance. V-10.B RHR Reliability The two areas of concern for this topic deal with the La Crosse BWR procedures for shutdown and cooldown and the existence of a single level ) controller whose failure could disable the shutdown condenser. The NRC evaluation of the plant procedures concluded that the procedures did not adequately address the use of the manual depressurization system in conjunction with the alternate core spray system as an alternative to the
- shutdown condenser and the use of demineralized water from onsite Unit 3 as l an alternate supply of water as the shutdown condenser makeup. An examination of the emergency procedures found that these procedures did reference all the required " safety grade" systems even though the normal '
operating procedures did not. Conventional PRA analyses would allow credit for use of a system referenced in the emergency procedure. The need to use demineralized water from onsite Unit 3 was analyzed by determining the Y l
.= .-. _. _ - -
i dominant failure probabilities of the demineralized water system. Failure of the shutdown condenser makeup valve was determined to be the dominant failure of the makeup so that adding another source of demineralized water would not significantly increase the reliability of the shutdown condenser. l However, the analysis of the shutdown condenser system showed that failure of the level controller was the dominant mechanical failure mode of the system. Installation of a redundant controller reduced the system failure probability by approximately two orders of magn:tude. An improved testing program for the level controller results in a reduction of system failure probability of a similar magnitude. This in combination with the relative importance of the shutdown condenser in previous PRA studies leads us to rate this issue as high in risk significance. , VI-4 Containment Isolation System Eight of the containment penetrations at the La Crosse BWR, four inches or larger, do not comply with the current general design criteria (GDC). Among these penetrations there are six configurations which deviate from the GDC. These deviations are:
- no isolation valves (in a system closed outside containment) where a manually operated MOV is required,
- a check valve is used rather than an automatic MOV,
' - no isolation valves (for a system that is closed inside containment) wher'e a manually operated MOV is required,
- both isolation valves are on the same side of the containment,
- both normally closed manual valves are outside the containment, and
- a check valve is used rather than a manual M0V.
A comparison of the failure probabilities for these eight penetrations (i.e., leak probabilities) in their present and proposed configurations shows no decrease in the containment isolation failure probability. This is , due to the dominance of the f ailure probability by penetration IA (cont. building drain suction) and the lack of a reduction in its failure probability when modified. This issue is rated as low in risk significance.
~
VI-6 Containment Leak Testing The containment airlock door seal testing program at the La Crosse BWR does not fulfill current criteria. Appendix J requirements include i provisions for airlock door seal testing after every use (within 72 hours of use) or during periods of frequent use of the airlock, tests to be conducted every 72 hours. At the La Crosse BWR, where the containment air locks are used frequently, the current test program requires door seal testing every 4 , months. i vi
l i The analysis performed evaluated the. failure probability of the con-tainment airlock door seals given testing every 3 days or every 4 months and the failure history of the door seals. The analysis did show a reduction in i the containment isolation failure probability due to containment airlock door seal failures from 1.1E-4 to 6.4E-8). However, the expected.contain-ment leakage probability due to other leak patgs, based on the results of the Big Rock Point PRA, is on the order of 10 . Given this containment leakage probability, we rate this issue to be of low risk significance. VI-7.A.3 ECCS Actuation System Current criteria requires that the ECCS be designed to permit periodic i pressure and functional testing to insure system operability. This includes the ability to test the actuation circuitry for the ECCS. Present La Crosse BWR test procedures require that the alternate core spray system motor operated valves be tested at intervals of no less than 3 months but no more than 6 months. This test involves the automatic opening of the valves (timed) after the introduction of false reactor pressure and level signals. These are the only signals that will open the valves. This test seems to meet the intent of the NRC requirements. However these test procedures are not included in the current plant Technical Specifications. The NRC recommendation is to incorporate the test requirements into the Technical Specifications. Such a change would not have any effect on the results of a PRA for the La Crosse BWR. We rank this issue to be of low risk significance. - VI-7.C.1 Appendix K, Electrical Instrumentation and Control (EIC) Re-Review General Design Criteria 17 and Regulatory Guide 1.6 indicate that the onsite AC and DC power systems should be sufficiently redundant and independent such that they can perform their function given a single l failure. At the La Crosse BWR there are manual cross tie breakers between the redundant AC power trains that do not have interlocks to prevent paralleling of redundant AC sources. This does not conform to the intent of the GDC and Regulatory Guide. The analysis performed compared the probabil-ity of losing the AC power system due to a failure to properly align the cross tie breakers and the probability of a station blackout (loss of offsite AC power and the diesel generators fail). The failure to properly ' i align the manual breakers was significantly smaller than the station black- > out probability. Therefore, modifications to the circuit breakers to pre-l clude parallel operation of redundant AC power sources would have little j effect on system reliability. We therefore rant this issue as of low risk significance. V I-10.A Testing of Reactor Trip Systems and Engineered Safety Features Including Response Time Testing The calibration procedures used at the La Crosse BWR do not meet current criteria in that the calibration of the nuclear power range instrumentation may not address all the important parameters (e.g., vii
i feedwater temperature). The calibration procedure used may cause an inaccurate output from the nuclear power range instrumentation if the feed-water temperature is lower than it would be for normal plant operation. This would affect the response of the plant to an overcooling transient. However, overcooling transients d.o-not (from previous PRAs) contribute significantly to the risk of nuclear power plant operation. Additionally, a simplified analysis of the RPS showed that the loss of the nuclear instru-mentation trip signal would not significantly affect the reliability of the RPS. We therefore rank this issue to be of low risk significance.
- VII-1.A Isolation of Reactor Protection System From Non-Safety Systems Current criteria requires that the reactor protection system be adequately isolated from all non-safety equipment. At.the La Crosse BWR there are several RPS circuits that .are not properly isolated from remote, non-safety indicating meters and/or recorders to which they are connected.
These circuits include those for the following signals: the power range neutron flux the intermediate range neutron flux the reactor high pressure the reactor water. level, and the reactor power to forced circulation. The NRC recommends that suitablo isolators be installed for each of these trip signals. Also the safety signals are powered from a single AC bus. It
- ' is possible that a single failure of this bus (overvoltage, etc.) could fail the RPS.
The analysis performed evaluated the failure probability associated i with each trip signal assuming that an unisolated fault in the non-safety , equipment would fail that trip signal. Then for each trip signal these 3 ' failures were removed (simulating proper isolation) and the changes in the i channel failure probabilities calculated. There is some reduction in the trip channels failure probabilities with improved isolation, however this does not significantly affect the RPS failure probability since the RPS failure is dominated by the common mode mechanical failure of the control rods to insert. '. The failure probability of the non-interruptible bus (for a failure that could affect the RPS) was calculated. This failure would be due to an erratic output from the AC generator used to power this bus. If there is ' indeed inadequate isolation of the power supply, i.e., the breakers located between the RPS and the AC generator are inadequate, then the failure of the i generator significantly affects the RPS failure probability. Based on the d assumption of inadequate isolation between the RPS and the AC generator we
- rate this issue of high risk significance.
i VIII-3.B DC Power System Bus Voltage Monitoring and Annunciation The three 125V DC power systems at the La Crosse BWR do not have all of j the currently required control room annunciators. The indications not j viii l
currently found in the La Crosse BWR control room are battery current, battery charger current, breaker / fuse status and on all but the diesel building 125V DC system, bus voltage indication. The diesel building 125V DC system does have a battery charger fault alarm in the control room. The analysis performed assumed that with inadequate battery system monitoring, no battery faults are detected until battery service tests and that the improved monitoring system would detect at least some of these battery faults. A fault tree was constructed for a loss of power at the DC battery buses. Evaluation of the fault tree for all three DC systems showed a factor of 4 reduction in the bus unavailability when the proposed annunciators were provided. In previous PRA studies, such as IREP and WASH-
- 1400, failure of the battery system was an important contributor to the core melt frequency. Therefore, this issue is ranked high in rist significance.
IX-5 Ventilation Systems i This topic addresses the need to provide further analysis to determine the need for ventilation to assure system operability. This in itself does not serve to reduce risk; however, a finding that ventilation is not needed in certain areas could serve to " reduce" the perceived potential for risk significance. The analysis performed was conservative and serves to indicate the upper bound for potential risk, thus indicating for which areas further analysis should be carried out. The conclusions for each issue are as follows: o The turbine building penetration room and electrical equipment room contain important emergency AC train 1A equipment, vital to that system's operation. The ventilation for these areas cannot function during loss of offsite power. The analysis showed that l i this situation results in a very high frequency of station blackout. We assess that the potential of this issue could make it a significant contributor to the core melt frequency, based on the results of other BWR PRAs. Thus we rank the importance of this issue as high. o The loss of ventilation in the diesel generator room / building i would be expected to cause the diesel / power train to fail. This l mode of failure was shown in the analysis to increase the overall ' diesel or train failure rate by only 6 or 8 percent, respectively. Although diesel failure has been shown to be historically a r significant contributor to core melt at other BWRs, and is l therefore an important system, a change of 6 or 8 percent in its failure rate is not significant. Thus, we rank the importance of l this issue as low. l l o The lack of ventilation in the crib house does not affect l anything. This is because the working fluid for the alternate l core spray pumps and the nature of the crib house environment render ventilation unnecessary. Thus we rank the importance of this issue as low. ix
(In their analysis the SEP branch of the NRC did not agree with the l recommendations of the TER for this part of the ventilation issue. If an I active ventilation system is required in the crib house then the loss of that system would affect one of the systems capable of operating in the absence of AC power. During a loss of offsite power event this would be an issue of high risk significance.) i l XV-20 Radiological Consequences of Fuel Damaging Accidents This topic deals with accidents that do not lead to core melt. Various probabilistic risk assessment studies have shown that the major part of the risx due to operation of a nuclear power plant come from core melt sequen-ces. Thus, this issue has little effect on risk and various recommendations related to this issue have little potential for significant risk reduction. Therefore, this issue has a low ranking from a risk point of view. l X _ _ _ _ _ . . _ _ _ _ _ . _ _ ~ _ _ - _ - . - _ _ - _ _ _ _ _ _ -
l I I. Introduction This report will present the analysis and results for the risk-based categorization of issues identified by the USNRC Systematic Evaluation Program (SEP) for the La Crosse BWR Nuclear Power Plant. Section II will discuss the methodology, Section III will present our resuits for the La Crosse BWR and Section IV will give the analysis per-formed for each La Crosse BWR SEP issue. A brief discussion of the analysis and results for each issue is given in the Executive Sumary of this report. 1 h d 1
1 l l II. Methodology for Categorization of La Crosse BWR SEP Issues j The United States Nuclear Regulatory Commission (USNRC) Systematic Evaluation Program (SEP) is identifying deviations from current licensing requirements for older nuclear power plants. This project evaluates those issues which are amendable to study by probabilistic' risk assessment (PRA) techniques, for the La Crosse BWR plant. The result of this evaluation is
.the categorization of these issues by the impact their resolution would have on risk. This categorization will be used as input to the USNRC decisions on what hardware and procedure changes will be required for the nuclear plants as the product of the SEP.
Not all of the issues identified are easily addressed by well-defined
- PRA techniques. In particular, issues which address the ability of the power plant to safely deal with events for which the frequency and/or effects on plant systems are unknown are not evaluated in this study. PRA
' examines accident scenarios for which the initiating event frequencies are 1 relatively well known and probabilities of system failures are estimated by
- detailed consideration of system configuration, random component failures, and system interactions. Thus the issues evaluated are those which address systems or plant features during normal operation or accident situations of relatively well-known frequency where that system or plant-feature may be demanded.
Issues excluded are those dealing with seismic, tornado, or flooding events for which the frequency of a given severity event, or any such event,
- is not well known. Also excluded are issues dealing with high energy line breaks, where it is not the frequency, but the effects on systems, which is not known. Treating these issues in the framework of PRA would generally be at the edge of the state-of-the-art (since event frequencies, etc., are not well known) and thus our confidence in the risk-based categorization of
- these issues would be less than for the results of our analysis of those issues which fit well into present PRA considerations.
, Since no probabilistic risk assessment has been performed for the La 4 Crosse BWR Nuclear Power Plant, the results of other PRAs performed in the IREP, RSSMAP and reactor safety study on BWRs were used for judgments on the i importance of an issue to the risk. Also used was the Big Rock Point PRA. This PRA was used in the evaluation of the containment isolation failure probability containments. since both plants are relatively small and have large The method adopted in this study was to examine the impact of each issue on the systems it affects and assess the importance of the issue by both quantitative and qualitative consideration of the fault trees and the i results and insights of other PRAs. For each issue, we consider the impact its resolution would have on the unavailability of the system under consideration by developing a simple fault tree for the system or subsystem of interest. If the impact of the proposed changes on unavailability of the system under consideration is significant, the next step is to evaluate the impact of the issue on the i 2 1
core melt sequences from PRAs on other BWRs that include failure of the , system under consideration. I~ If we could ascertain no impact on the top event of any dominant fault tree (or event in any dominant sequence) due to resolution of an issue, we classified the issue's importance as low. If the resolution of the issue , affects but does not dominate a fault tree (or event), the issue was classified as of medium. importance. . If the resolution of the issue domi-nates the value of the top event.of any dominant fault tree (or event), the issue's importance was classified as high.- i In general, the evaluation was done in consecutive phases in order to reduce the amount of work as much as possible while still getting the required insights to' assure a proper ranking. Phase I - Evaluate the effect of the SEP issue resolution on the
- particular event or component it is associated with. That is, deter-mine if there is a frequency / reliability change induced on the event / component by resolving the issue as suggested by the NRC. If t there is essentially no effect, no further analysis is required and the 1 risk significance is low. If there is an effect, proceed to Phase II.
Phase II - Evaluate the effect of the frequency /reliasility change found in Phase I on the overall reliability of the systems which it ! impacts. If there is essentially no effect, no further analysis is required and the risk significance is low. If there is an effect, proceed to Phase III. Phase III - Evaluate the effect of the reliability change found in Phase II on perceived plant rist/ core melt frequency. If there is essentially no effect, the risk significance is low. If there is an effect but it does not involve the perceived dominant contributors to core melt frequency, the risk significance is moderate. If there is an effect and it involves a perceived dominant contributor to the core s melt frequency, the risk significance is high. From this description, it can be seen that some subjective judgment is i required for Phase III as to what are the perceived dominant contributors to core melt frequency and what is the perceived total plant rist/ core melt ' frequency. To some extent, this is based on the experience gained from other PRAs done on BWRs. Although the La Crosse BWR is a unique plant, the functions performed by the systems. analyzed are similar to the functions performed by the corresponding systems in a more typical BWR. In general, t when an issue was judged using other PRAs the ranking of the issue was based on the PRA which showed the greatest effect. Thus, if an issue was shown to be dominant (high) for any one of the BWR PRAs considered-, it was concluded '. that it might also prove to be dominant for the La Crosse BWR, and it was ranked high. On the other hand, in order to be ranked low, the issue would have to be shown to be low for all of the BWR PRAs considered. This should i result in a more conservative analysis. 3
The evaluation of the risk significance of each issue is based on the ' possible effect on core melt frequency only, not actual risk reduction. It was not possible to calculate the actual core melt frequency reduction for i any issue. Without a plant specific PRA the contribution of a particular system failure probability to the core melt frequency can only be estimated based on previous PRA studies on BWRs. Without knowing the percentage of the core melt frequency a system failure will contribute to, it is not possible to evaluate the actual reduction in core melt frequency that a reduction in the system failure probability will have. I To evaluate the risk reduction the actual core melt frequency reduction
- must be known. Since this is not known for the La Crosse BWR only j
qualitative judgments of risk reduction can be made. The analyses performed
- used the possible effects on the core melt frequency as the primary basis for the judgment as to how risk s'.cftificant an issue was.
1 l The evaluation of the actual risk significance of each issue would require an analysis of the consequences of a core melt accident at the La Crosse BWR. It is reasonable to assume that the consequences of a core , melt accident at the La Crosse BWR would be significantly less than for a core melt accident at most nuclear power plants. two f actors: the core inventory at the La CrosseThis is due primarily to BWR is smaller than at most nuclear populated power plants and the plant is in a relatively sparcely region. Since the consequences are less severe for a core melt accident at the La Crosse BWR than for most other nuclear power plants, there is less potential for risk reduction. This would tend to reduce the perceived risk significance of each issue. l The overall study methodology is given in flowchart form in Figure 1. The importance of an issue is determined by the impact of resolution of the issue on the La Crosse BWR fault trees or events and the dominance or nondominance of accidents containing those faults or events. The impacts are developed from the SEP branch evaluations of the issues and the fault trees developed for each issue. The " dominance" of the La Crosse BWR fault trees and events is determined as previously stated from the results of other PRAs performed in the IREP, RSSMAP and reactor safety study on similar BWRs. The resulting classifications are given in Table 1. A discussion of each issue and its classification is given in the Executive Summary of this report. The next section provides a brief overview of the results of this study. 4
IREP Millstone 1 Plant FSAR, IREP Browns Ferry RSSMAP Grand Gulf Drawings' Big Rock Point Procedures RSS Peach Bottom PRA Results I I I o g Proposed I"P8Ct 0" Component / l SEPB l Modifications ,, Event I . I I Impact on l System Reliability I (pha u II) l I u g Impact on g Plant Risk l I (Phase III) l l l l u l Importance ( ' of Issue Figure 1. Study Methodology i 5 i
TABLE 1 Classification of Issues Classification Criterion High Resolution of issue dominates value of the top event of a dominant fault tree or dominant sequence event. Medium Resolution of issue impacts but does not dominate value of. top event of dominant fault tree or dominant sequence event. Low Resolution of issues has no impact on value of top event of dominant fault tree or dominant sequence event. i 6
III. Results There were 30 issues identified by the Systematic Evaluation Program Branch for the La Crosse BWR Nuclear Power Plant. Of these,15 were outside the scope of our analysis and 15 were within our scope. Table 2 gives those issues we did not analyze and Table 3 gives those issues we did analyze. Each issue was analyzed for classification by the criteria described in ' the previous section of this report. That is, we assessed whether resolution of the issue would affect the fault trees which were developed for the particular issue at the La Crosse BWR and quantified the effect. l The fault trees were examined to determine the resulting change in the top l event (s), and other BWR PRAs were reviewed to characterize the affected f ault trees by whether they would be part of dominant accident sequences. Table 4 presents the results of our analysis. For each issue, the system or accident event that the issue potentially impacts, the change in unavailability due to resolution of the issue and the component or system for which this was calculated (Phase I), whether the issue affects the top event of the f ault tree (s)/ event (s), whether the f ault tree (s) or event (s) affected would appear in any dominant accident sequences (Phase III), and, based on applying the criteria of Section II to all of the above results, the resulting classification of the issues are given. Table 5 gives a list of the classifications of the issues as high, medium, or low importance to risk. A discussion of the classification of each issue is given in the Executive Summary of this report. l l l t l 7
TABLE 2 SEP Issues Not Evaluated l l II - 1.A Exclusion Area Authority and Control ' ' ~ ~ II - 3.B Flooding Potential and Protection Requirements II - 3.B.1 Capability of Operating Plant to Cope With Design Basis Flooding Conditions II - 3.C Safety Related Water Supply (Ultimate Heat Sint- [ UHS]) III - 1 Classification of Structures, Systems and Components l (Seismic and Quality) III - 2 Wind and Tornado Loadings III - 3.A Effects of High Water Level on Structures III - 3.C Inservice Inspection of Water Control Structures III - 4.A Tornado Missiles III - 4.B Turbine Missiles III - 5.A Effects of Pipe Break on Structures, Systems & Components Inside Containment III - 6 Seismic Design Considerations III - 7.B Design Codes, Design Criteria, Load Combinations and Reactor Cavity Design Criteria V - 12.A Water Purity of Boiling Water Reactor Primary Coolant VIII - 1.A Potential Equipment Failures Associated With a Degraded Grid Voltage i 1 8 \ _ _ . _ _ _ , _ - - . _ - . - - - - - - --- - -- ----
TABLE 3 SEP Issues Evaluated III - 5.B Pipe Break Outside Centainment III - 8.A Loose Parts Monitoring and Core Barrel Vibration Program III - 10.A Thermal-0verload Protection for Motors of Motor Operated Valves V-5 Reactor Coolant Pressure (RCPB) Leakage Detection V - 10.A RHR Heat Exchanger Tube Failures V - 10.B RHR Reliability VI - 4 Containment Isolation System VI - 6 Containment Leak Testing VI - 7.A.3 ECCS Actuation System VI - 7.C.1 Appendix K, Electrical Instrumentation and Control (EIC) Re-Reviews VI - 10.A Testing of Reactor Trip System and Engineered Safety Features Including Response Time Testing VII - 1.A Isolation of Reactor Protection System From Non-Safety Systems, Including Qualifications of Isolation Devices VIII - 3.B DC Power System Bus Voltage Monitoring and Annunciation IX - 5 Ventilation Systems XV - 20 Radiological Consequences of Fuel Damaging Accidents l l l l 9
Table 4 Results of Analysis Affects Affects System Affects Core Dominant or Non- Rist 1ssue Event / Component Event / Component Unavaliability Nelt Rist Domir. ant Contributor Stentffcance III-5.A LOCA Outside No - - Containment Low III-8.A Transtents No - - - Low III-10.A Valves Yes No - - Low V-5 Small LOCA No - - - Low V-10.A Leakage Into , Primary System No - - - i Low V-10.B Shutdown Reliability Yes Yes Yes Dominant High VI-4 Centalement i Integrity No - - - i Low ! VI-4 Centalement Door Seals Yes No - - Lew VI-7.A.3 Alt. Core Spray 1 w Valves and I o Shutdown Condenser l Seasors Yes No - - t Low VI-7.C.1 Emergency AC Yes No - - i Low l VI-10.A RPS Nuclear
- Instrumentation No - - -
Low VII-1.A RPS Sensor Channels Yes Yes Yes Dominans High VIII-3.B DC Batteries Yes Yes Yes Dominant High II-5 Turbine Butiding Penetration and Electrical Egulpment Room Ventilation Yes fes Yes Dominant High Olesel Generator Ventflat1on Yes No - - Low
*Crlb House No - - -
Ventilation Low XV-20 Offsite Consequences No - - - Low
*This issue is ranked high if the SEP branch assumptions are used.
Table 5 Classification of Issues Importance to Risk High V-10.B RHR Reliability VII-1.A Isolation of Reactor Protection System.From Non-Safety Systems VIII-3.B DC Power System Bus Voltage Monitoring and Annunciation IX-5 Ventilation Systems Medium None Low III-5.B Pipe Break Outside Containment III-8.A Loose Parts Monitoring and Core Barrel Vibration Program III-10.A Thermal Overload Protection for Motors of Motor Operated Valves V-5 Reactor Coolant Pressure (RCPB) Leakage Detection V-10.A RHR Heat Exchanger Tube Failures VI-4 Containment Isolation System VI-6 Containment Leak Testing VI-7.A.3 ECCS Actuation System VI-7.C.1 Appendix K, Electrical Instrumentation and Control (EIC) Re-Review i VI-10.A Testing of Reactor Trip System and Engineered Safety Features, Including Response Time Testing I XV-20 Radiological Consequences of Fuel Damaging Accidents 11
IV. Analysis Following is the analysis for each topic to determine its importance to risk. l I i l i 12 l i _ . _ . _ - _ . _ _ _ _ - . . - - - .
III-5.B Pipe Break Outside Containment
- 1. NRC Evaluation There are three areas of concern regarding this issue. The jet impingement model and pipe whip criteria used in the licensee's evaluation of the effects of pipe breaks outside the containment are unclear. Clarifi-cation of the assumptions used in the analysis is required. The effects of a steam heating system f ailure in the electrical equipment room have not been analyzed. The resulting adverse environment could affect the ;
batteries, switchgear and other components in the room. A pipe break between the containment and the outboard isolation valve could result in a non-isolable condition. The radiological effects of such a condition have not been verified.
- 2. NRC Recomendation No specific recommendations have been made at this time. Further information is required for each of the three areas of concern outlined above. This includes:
o clarification of pipe whip damage criteria and jet impingement model o evaluation of the effects of a failure in the steam heating system o verification of the potential releases from the worst high energy line break with a single failure of the inboard isolation valve
- 3. System Affected The system affected by the portion of this issue analyzed here is the containment isolation system.
- 4. Comments An analysis will be performed to determine the probability of a pipe
~ break between the inboard and outboard isolation valves only. The remaining two areas of concern will not be considered. They are beyond the scope of this analysis. For the item analyzed no es'timation of the radiological consequences of the event are considered.
- 5. Analysis l The piping segment analyzed is the main steam line between the
- containment and the outboard isolation valve. An unisolable break would I require the failure of the inboard isolation valve in addition to the pipe l break. The failure rate for large piping is IE-10/hr (from WASH-1400). ,
, This yields a frequency, for a break in one pipe segment, of 8.7E-7/Ryr. The inboard isolation valve at the La Crosse BWR is tested during refueling outages (approximately a one year test interval). The failure ra% for the l hydraulic valve, from WASH-1400, is 2.8E-6/hr. Using the following equation the failure probability for this valve would be 1.2E-2, using the valve failure as the dominating failure probability. 13 l
1/2At where A = failure rate t = test interval The frequency of a pipe break in conjunction with a failure of the isolation valve would be (8.7E-7/Ryr)(1.2E-2)
= IE-8/Ryr.
- 6. Conclusion The expected frequency of a pipe break between the containment and the outboard isolation valve and a failure of the inboard isolation valve is relatively small, approximately 1E-8/Ryr, when compared to the core melt frequencies associated with many nuclear power plants. An event with a frequency of IE-8/Ryr would not be expected to contribute significantly to the risk due to core melt at the La Crosse BWR. We therefore rank this issue to be of low risk significance.
4 4 i 4 t l i l 14 J
, , . . . - - . _ _- - - - . - - - - , , , - - - - , am- ., ,--- - , , - - - -----e -m .-* . ----- - ---.---m- - - - - , - - - - - - - . --,-~.-n ------
l 1 III-8.A Loose-Parts Monitoring and Core Barrel Vibration Monitoring j
- 1. NRC Evaluation A loose-parts monitoring system as required by Regulatory Guide 1.133 does not exist at the La Crosse BWR.
- 2. NRC Recommendations Install a loose-parts monitoring system to detect loose parts in the Reactor Coolant Pressure Boundary.
- 3. Systems Affected Loose parts can cause transient events by causing damage within the reactor coolant system.
- 4. Comments None
- 5. Analysis The only concern, from a risk perspective, of loose parts is that they may cause a transient which challenges the plant and its safety systems. '
There is ample data on transients to show that this effect is negligible. That is, because the historical transient rate is so high, several per reactor year, and the historical contribution to this frequency by loose parts has been negligible. Eliminating loose-parts-induced transients will have no virtually effect on the transient frequency and no effect on risk.
- 6. Conclusions Eliminating loose-parts-induced transients by installing a loose-parts monitoring system would have no effect on risk. We therefore rank the risk significance of this issue as low.
I 15
III-10.A Thermal Overload Protection for Motors of Motor-Operated Valves I (MOVs)
- 1. NRC Evaluation Thermal overload protection for MOVs should be bypassed, under accident i conditions, by.an ECCS signal or the trip setpoints should be set high enough to prevent spurious trips due to design inaccuracies, trip setpoint drif t, or ambient temperature variations. At the La Crosse BWR thermal overload protection devices are not bypassed.
- 2. NRC Recomendation La Crosse modifications should be provided to bypass the thermal over-load protection with an ECCS signal. Additionally, the NRC recommends that torque switches should be bypassed with a limit switch during automatic valve actuation.
- 3. Systems Affected Review of the La Crosse BWR drawings shows that the only two motor-operated valves supplied power from ESF buses are the alternate core spray valves. Therefore, only the alternate core spray system is affected.
- 4. Coments The concern is that a spurious trip of a thermal overload protection device could cause a safety-related valve not to open during accident conditions, even though nothing is wrong with the valve. However, by bypassing the thermal overload protection, the danger of damaging the valve increases, and this reduces the possibility of recnvering the operability of the valve. This negative effect on system reliability will not be
- addressed.
- 5. Analysis This analysis will address the reliability of a valve both with and j without the thermal overload protection bypass. The failure rate per demand of a motor-operated valve can be found in Appendix III of the Reactor Safety l Study (WASH-1400) on Table III-2-1; this failure rate is i 20(M0V) = 1 x 10-3/d,
{ and is a combined failure rate; that is, it represents valve failure from i all modes. This implies that failures due to unbypassed thermal overloads ' i are included in the failure rate.* i *It is valid to say this since thermal overload devices are seldom, if ever, j bypassed during test. l 16
- _ - - - - - - - -_ _ _ - - - - - - - - - - - - - - , - - - - - - - - - - - - - ~ ~ - ~ ~ - ' - - - - ~ ~ ~ ~ - <
Therefore, the failure rate we assign for MOVs with unbypassed thermal overloads is AD(MOV/NOBY) = 1 x 10-3/d. In order to determine the failure rate of valves with their thermal overload devices bypassed, it is necessary to find the contribution of the thermal overload device failure to the valve failure rate. The failure rate per hour of a thermal relay (common quality, ground-fixed environment) can be found in Section 1, Nonelectronic Parts Reliabil-ity Data (NPRD-2). The failure rate is AS(TS) = 4 x 10-7/hr. In order to determine the demand failure rate, it is necessary to have a test interval. The WASH-1400 demand failure rate for MOVs is based on monthly testing, thus the number of hours in a month (720) will be applied
; to the equation T
AD=S 2 where T is the test interval. This equation gives AD (TR) = (4x10-7/hr) (720 hr/d) = 1.4 x 10-4/d. 2 ' Thus the demand failure rate of a valve with the thermal overload bypassed is AD(MOV/BY) = A (MOV/NOBY) D AD(TR) = 1 x 10-3/d - 1.4 x 10-4/d
= 8.6 x 10-4/d, or approximately a 14 percent decrease in the valve failure rate by bypassing the thermal overload.
Review of La Crosse drawings shows that the only motor-operated valves , supplied power from ESF buses are alternate core spry valves. Therefore, to evaluate the effect the reduction in MOV failure rate would have on the risk due to core melt, the only system that needs to be exarained is the alternate core spray system. Figure III-10.A-1 shows a simplified
- diagram of the auxiliary core spray system. To examine the effect of the reduction in the motor operated valves failure rate on the unavailability of this system, a f ault tree for this system was developed and is shown in Figure III-10.A-2. This fault tree was next quantified using the data shown in Table III-10.A-1 (WASH-1400). The equation of " Top Event" (TE) for the fault tree shown in Figure III-10.A-2 can be written as TE = 3.03x10-4 + MOVl*MOV2 + 1.1x10-3(MOV1 + MOV2)
The unavailability of the alternate core spray system based on MOV faijure rate of 1.0x10-3, i.e., the present situation, is approximately 3.1x10 . i 1 17 i en, . ---- m.-. rn -nn- - - - ---,,,e.o --,--..,_--_.,_------._e -,- ,,n,--_,e.,,,,_-,_-n,-- ---- - - - - - - - - - - -
If the MOV f ailure rates are reduced to 8.6x10-4 based on bypassing of the thermal overload protection, t remains approximately 3.1x10 p The alternate coredue reduction spretosystem the bypassing unavailability of the t thermal overload protection of the system unavailability is only 6E-7 and does not significantly change the system unavailability. As can be seen, the effect of the above change on the auxiliary core spray system unavail-ability is negligible. Therefore, although bypassing the thermal overloads ; for the MOVs has an effect on the component failure rate, the effect on core melt risk is minimal. The issue of overriding the torque switches with limit switches during i automatic both valve devices. actuation From can bethe WASH-1400 analyzed by comparing failure rate of a torquethe swfailure rates o{ ! d tch is 1x10- ' per demand and the failure rate of a limit switch is 3x10 6 per demand.
- Overriding the torque switch with a limit switch does not replace the torque switch with a more reliable device. Therefore it cannot be expected that i
overriding the torque switch will improve the availability of the M0V.
- 6. Conclusion l The failures of motor-operated valves do not significantly affect risk.
,. The reduction in the f ailure rates for the MOVs achieved by bypassing the l thermal overloads would not have any significant effect on risk due to core . melt. Consequently, we rank the risk significance of this issue as low. f l 18
Table III-10.A-1 Failure Rates for Various Faults Shown on Figure III-10.A-2 Fault Failure Mode Failure Identifier Description Rate Strainers Failure of Strainers c MV1, Manual valve fails to 1.0x10-4/D MV2, remain open MV3, MV4, MVS P-A Pump does not start 1.0x10-3/o P-B on demand y CV1, CV2 Check valve fails 1.0x10-4/D CV3, CV4 to open MOV1, MOV2 MOV does not open 1.0x10-3/D on demand AC1 No AC power 1.0x10-3/D AC2 19
l SYRAINER 1 MV-1 CV-1 P-A R MV-3 LIJ / vm l ^ cv-4 cv-3 uv-s ALT. CORE SPRAY PUMPS INJECTION LINE LIA / Vm ^ uov-2 uv-4 l l uv-2 cv-2 P.s STRAINER 2 o REACTOR i f l l Figure 111-10.A-1 SIMPLIFIED DIAGRAM OF THE ALTERNATE CORE SPHAY SYSTEM
___________.,_________r, . _ _ _ _ _ _ _ _ _ _ _ _ _ _ f r 1
/ ,
Y FAILURE OF,THE ALT. COME < SPRAY SYSTEM 1
, e \
\
. t i
e
*f r NO FLOW THROUOH NO FLOW THROUGH NO FLOW THROUGH PUMP UNES A & B MOV HNES 1 & 2 INJECTION UNE U 3 SHEET 3 m I I I I I MANUAL VALVE CHECK VALVE CHECK VALVE NO FLOW THROUGH NO FLOW THROUGH MV S FAILS TO CV-3 FAILS TO CV-4 FAILS TO PUMP UNE A PUMP UNE B REMAIN OPEN OPEN OPEN A
SHEET 2 SHEET 2 O 1 Figure III-10.A-2 FAULT TREE FOR THE EVENT " FAILURE OF THE ALTERNATE CORE SPRAY SYSTEM" SHEET 1 l
NO FLOW THROUGH PUMP UNE A NO FLOW THROUGH PUMP UNE S T ^ l l I I CHECK VALVE MANUAL VALVE DOES NO START ~ OPEN REMAIN OPEN AINER = O O I I I I PUMP 5 CHECK VALVE MANUAL VALVE DOES NOT START 2 FAILS TO MW2 FAKS TO F.ULURE OF OPEN REMAIN OPEN STRAINER 2 Figure lit-10.A-2 CONTINUED SHEET 2
l l l l NO FLOW THROUGH 3
\ MOV LINE 1 & 2 O
I I I NO FLOW THROUOH NO FLOW THROUGH MOV UNE 1 MOV UNE 2 w l l l 1 i MOTOR OPER ATED MANUAL VALVE MOTOR OPERATED M ANUAL VALVE VALVE MOV-1 AC POWER TRAIN 1 MV 3 FAES TO AC WER TRA4N 2 VALVE MOV-2 MV-4 FAILS TO DOES NOT OPEN NOT AVAEASLE NOT AVAEAkE REMAIN OPEN DOES NOT OPEN REMAIN OPEN
. Figure III-10.A-2 CONTINUED l
l SHEET 3 i l l ..
V-5 Reactor Coolant Pressure Boundary Leckage Detection
- 1. NRC Evaluation By current criteria three separate detection systems should be installed in a nuclear power plant to detect unidentified leats from the reactor coolant pressure boundary to the primary containment. These systems should have the capability to detect a one gallon per minute leak within one hour. Also the detection systems should be seismically qualified and be-capable of being checked in the control room.
Two of the three detection systems should be sump level and flow monitoring, and airborne particulate radioactivity monitoring. The third method should be either monitoring of condensate flow rate or monitoring of airborne gaseous radioactivity. At the La Crosse BWR the leakage detection systems incorporated for measurement of leakage from the reactor coolant pressure boundary (RCPB) to the containment meet the minimum recommended requirements given in the previous paragraph. However, none of the incorporated systems have been shown to be able to detect a one gallon per minute (gpm) leak within one hour and none have been seismically qualified. j 2. NRC Recommendation j The need to install leakage detection systems of the sensitivity I currently required will be evaluated in the integrated assessment. To meet l current criteria three seismically qualified leak detection systems capable of detecting a one gpm leak in one hour are required. l
- 3. Systems Affected The system affected is the reactor coolant system. The risk associated with this issue is due to the issue's effect on small break LOCA frequencies.
- 4. Coments The NRC hypothesis is that early leak detection may allow the prevention of that leak becoming a LOCA through operator action to isolate l the leak or shutdown (depressurize) the plant. This is the "leat-before-break" issue for pipes. This evaluation does not consider the significance of leakage detection to mitigate the high energy pipe breaks. It also excludes consideration of common-mode pipe break effects (e.g., pipe whip).
The La Crosse power station, according to their Technical Specifications, must go to hot shutdowr, within 24 hours after discovering an unknown one gallon per minute (gpm) leak and to cold shutdown in an additional 24 hours. (New Technical Specifications have been submitted to ! the NRC for approval. These new Technical Specifications would require the l plant to go to hot shutdown within 12 hours after discovering an unknown 1 gpm leak and to cold shutdown in the next 24 hours if the leak cannot be isolated.) Therefore, La Crosse presently has a total of 48 hours to go to 24
cold shutdown once a 1 gpm leak is detected. Once the new Technical Speci-fications are approved the corresponding time to go to cold shutdown will be reduced to 36 hours. , There are several unknowns associated with assessing the impact of . leak detection time on preventing LOCAs: the mean time it would take a leak to grow to LOCA proportions, the fraction of -leaks which, in fact, become LOCAs, and the probability that the operators, upon discovering a leak, would (or could) prevent the LOCA. Currently there are three . systems that are used to ' detect small leaks from the RCPB at the la Crosse power station. These three systems and their estimated times to detect a one gpm leak are given below: Tech. Spec. Time to Achieve System Limits Sensitivity Reactor Lower Cavity .04 gpm known Recorded hourly (Airborne Particulate .01 gpm unknown (Calculated every Radioactivity Monitoring) 24 hours)* Forced Circulate Pump 2.0 gpm known Recorded hourly l (Airborne Particulate 0.5 gpm unknown (Calculated every Radioactivity Monitoring) 24 hours)* Balance of Containment 4.0 gpm Known Calculated Every
-Building 1.0 gpm known 24 hours (Retention Tank Level) *The leak rate is calculated once every 24 hours. If there is a noticeable increase in the monitored airborne particulate radioactivity, a leak rate based on humidity is calculated.
It should be noted that.two other primary detectica systems are not included above:
- 1. Sump Level Monitoring System.
This system has a high level alarm, but its primary purpose is for detecting large leaks. Leaks of the size of 1 gpm would first be detected by the retention tank level monitoring system. Water is transferred from the sump to the retention tank before the water level reaches the sump high water level alarm. Therefore, the high level alarm acts more as a device to show that water is not being transferred to the retention tank.
- 2. Airborne Gaseous Radioactivity Monitoring System l
L La Crosse has airborne gaseous radioactivity monitoring at their
- plant but it is not used for leax rate calculations.
, 5. Analysis l A fault tree for S LOCA frequency, incorporating leakag'e detection, is , given in figure V-5 2I. The impact of this issue is to change the 25
quantification of the leak detection probability. Two assumptions are made to maximize the calculated impact of this issue. First, all pipe break LOCAs as calculated in ' WASH-1400 are assumed to begin as leaks which can be prevented from becoming LOCAs. Second, the change in leakage detection probability is maximized. The chinge in leakage detection probability is maximized by assuming that the present detection time at the La Crosse BWR is 24 hours. The mean' time it would take for a leak to become a LOCA, Y, is now considered. This mean time is unknown. There are three possibilities:
- a. t > 24 hours,
- b. 1 hr. < t < 24 hrs.
- c. t < 1 hr.
The probability that a leak will not be detected is, approximately, ( 0, t > td PND" 1 - t/td , t < t d. where td is the detection period.
- The values of non-detection probability for the "before" case when td
= 24 hrs for the three above possibilities are:
i _ _ a. O _ 1 > 24 hrs (t > td)
- b. 1 .t/24 1 hr t<tJ
- c. 1 - t/24 1 < 24 hrs (T < t )
t < 1 hr ( The value of non-detection probability for the "after" case when td = 1 hour ! for the three above possibilities are:
- a. 0 Y > 24 hrs (t > t )
l b. 0 1 hr Y < 24 hrs (T > t ) ,
- c. 1-T T < 1 hr (T < t ) {
The differences in the non-detection probabilities between the "before" and l "after" cases for the three above possibilities are-l
- a. O r > 24 hrs
- b. 1 - 1/24 1 hr < r < 24 hrs
- c. 23 r/24 f < 1 hr
[ Cases b and c are maximized by choosing t = 1 hr. In this case the proba- ! bility of not detecting the leak is assumed to be 23/24 in the "before" case j and 0 in the "af ter" case. Since portions of the primary system are unisolatable, the probability J that the operator cannot isolate the leak is assumed to be 1.0. If the leak is detected, there may remain some time to prevent the leak ( from becoming a LOCA. This is the reason for requiring leakage detection capability. However, if we choose the time for the leak to become a break to be 1 hour, then in both our "befeore" and "after" cases, by the time the 26
leakage detection system integrates the leakage for 1 hour, or_24 hours, there is no time left to prevent .the LOCA. Thus the effect of leakage detection is negligible. Using these data, summarized in Table V-5-1, the fault tree in Figure V-5-1 can be quantified for T = 1_ hour, T = 49 hours, and t = 72 hours. These values have been selected for.1t primarily due to the Technical Speci-fication limits on allowable leak" rates. The La Crosse BWR is allowed to continue operation, if possible, for up to 48 hours after a 1 gpm leak is detected. Therefore, with the ability to detect a 1 gpm leak in 1 hour the plant could operate for 49 hours after the leak began. Similarly with the ability to detect a 1 gpm leak in 24 hours the plant could operate for up to 72 hours after the leak began. (With the submitted modifications to the Technical Specifications these times would be reduced to 37 and 60 hours.) This quantification can be used as a descriptive aid. From observing the fault tree, it is noticed that the probability of a pipe break due to a leak is not changed for either case until the time for a leak to become a LOCA reaches 49 hours. From that time on the probability of a LOCA is reduced to zero in the "af ter" case. It does not become zero in the "before" case until1 = 72 hours. Therefore, the advantage of increasing the leakage detection to 1 gpm in one hour for the La Crosse BWR occurs when the time for a leak to become a LOCA (t) is between 49 hours and 72 hours. (It is assumed that once the plant is in cold shutdown the leak will no longer propagate and become a breat.)
- 6. Conclusion The analysis performed here is a bounding analysis; the best possible reduction in the LOCA frequency was calculated. The reduction in the LOCA frequency is completely dependent upon the time it would require a leak to become a LOCA. Assuming that the small break LOCA frequency is approximately 1E-3 the following reduction is possible given the different assumed leak to break times.
Leak to breat Beforel After2 I < 49 hrs 1E-3 1E-3 49 hrs < Y < 72 hrs 1E-3 to 03 0 72 hrs < T 0 0 l The only change is for the leak to break times of between 49 and 72 hours. This is due to the change in detecti.on intervals and the length of time the La Crosse BWR may continue to operate after detecting a 1 gpm leak as dictated by the plant Technical Specifications. It is expected that an improved rea:: tor coolant boundary detection to 1 l 9pm in one hour for La Crosse will have little or no effect on the LOCA l frequency. 1 24 hour detection time for 1 gpm leak 2 1 hour detection time for 1 gpm leak 3 IE-3 at 49 hours reducing to 0 at 72 hours 27 l
l Table V-5-1 ' Fault Tree Quantification Data l Event Name/ Description Unavailability or Frequency i Leak which could become a LOCA 1E-2/yr - IE-3/yr Leak not detected _ 9.6E-1 "before" ! t =~1 hr , l 1 0 "after" l _ (0 "before" i t = 49 hrs l 0 *after" l ' _ 0 "before" t = 72 hrs 0 "after" Leak detected - _ "before"
, t = 1 hr q(4.0E-2 m i 1.0 "after"
_ 1.0 "before" t = 49 hrs q{1.0 "after" _ 1.0 "before" t = 72 hrs 1.0 "after" Operator fails to isolate 1.0 LOCA prior to depressurization _ "before" going to cold shutdown t = 1 hr <(1.0 H,1 .0 "after" _ '1.0 "before" I t = 49 hrs IO "after" "before" _t = 72 hrs <{ 0 t J0 "after" l 1 1 i 28
l
~
LOCA FREQUENCY DUE TO MPE GREAK f3 T I I LEAK WHN;M COULD M MT SECOME A LOCA MEWMD FROM ' SECOMING A LOCA O A LEAK NOT LOCA NOT DETECTED MEVENTED O 0 -- OPERATOR FAILS LOCA mlORTO LEAK DETECTED TOISOLATE DEMENW SY GOING TO COLD SHUTDOWN l O I FIGURE V-81 FAULT TREE FOR LOCA FREOUENCY i l 29 l
. - - _ ~ _ . - - - - = _ -
V-10.A RHR Heat Exchanger Tube' Failures
- 1. 'NRC Evaluation At present 'the only existing means of detecting a leak from. the i
component cooling water system into the primary system (possibly via the decay heat removal system) is the component cooling water surge tank low level alarm. An interim sampling procedure has been instigated at La Crosse, however this sampling procedure does not meet the requirements of the Standard Technical Specifications.
- 2. NRC Recomendations The licensee is ~ installing surveillance procedures that are in accordance with the Standard Technical Specifications. With this change, La Crosse meets the intent of current licensing criteria and no further recomendations are made. ,
! 3. Systems Affected -' The systems affected by this issue are the component cooling water system, the decay heat removal system and the primary coolant system.
- 4. Comments The only unresolved area of concern in this topic deals with inleakage:
i contaminant leakage into the primary system. This requires a failure of a heat exchanger at a time when the primary system is at a lower pressure than the component cooling water system (an event of relatively low likelihood). This event does not lead to a radioactive release (leakage is into not out 4 of the primary system) nor does it affect the ability of the systems to perform their function of cooling the reactor. Therefore this "f ailure" does not contribute to the risk due to a core melt. The long-term effects on primary system integrity of water chemistry
, changes due to contaminant inleakage are not precisely known. The effects on primary system integrity were not analyzed here since such work would be beyond the scope of the analyses performed for this report.
- 5. Analysis None. i i
, 6. Conclusion I i This topic does not deal with an issue that will affect the risk due to a core melt of the La Crosse BWR. Therefore, resolution of this issue has l no effect on the risk. We therefore rank this issue to be of low risk significance. i t 30 I
r V-10.8 RHR Reliability
- 1. NRC Evaluation l Staff evaluation of residual heat s removal (RHR) reliability included analysis of the following systems: b ,
,c o the shutdown condenser with several alternate water supply systems, o the high pressure core spray (HPCS), and o the manual depressurization system (MDS) with an alternate core spray (ACS) system.
The evaluation concluded the followin : o The operating / emergency procedures for conducting a plant shutdown and cooldown using the above mentioned systems and equipment are not fully developed, o A single failure of the shutdown condenser shell side level con-troller could disable the condenser. o Procedures may be needed to address provisions for demineralized water from unit No. 3 and the use of the MDS with the ACS system as a backup to the shutdown condenser.
- 2. NRC Recomendations o La Crosse should specify use of only safety grade equipment to accomplish shutdown and cooldown.
o La Crosse should improve its shell side level control to preclude a single failure from disabling the condenser.
- 3. Systems Affected The shutdown condenser, demineralized water system, high pressure service water system, manual depressurization system (MDS), and the alter-
! nate core spray (ACS) system are affected by this issue.
- 4. Comments i
Plant emergency procedures do reference all of the safety grade systems [ in use at the La Crosse BWR. Due to the resulting contamination of the containment following use of the MDS, use of this system is not covered in the normal plant operating procedures. However, from a PRA standpoint, the presence of the system in the emergency procedures is sufficient since an emergency condition will exist prior to a core melt. 31
The second NRC conclusion deals with the shell side level controller. Makeup water for. the shutdown condenser is . supplied by either of. two systems, the demineralized water system or the high pressure service yater (HPSW) system.- Both of these systems have redundant pumps and access to separate and different water sources. Flow from these water supplyisystems to the shell side of the shutdown condenser is automatically regulated by air operated valves. Valve No. 62-25-005 regulates flow from the HPSW system and valve No. 62-25-004 regulates flow from the demineralized water system (see Figure V-10.B-1). Both of these valves are controlled by the same shell side level controller. Upon loss of power the valves will fail open. However, should the shell side level controller fail in such a way as to maintain air on the ! valves while reading a normal water level, the valves will remain closed and [ no water level alarms will sound. < There are other local and control room indicators which would suggest problems with the shutdown condenser. These include: local si. ell side levels and vent line pressure indication; and control room indication of , shell side temperature, condensate flow, and condensate temperature. How-l ever, such indication is not reasonably substitutable for_ high/ low shell
- side water level annunciation in the control room and automatic control of l the air valves discussed above. Hence, a single failure of the shell side
, level controller could disable the shutdown condenser. The third NRC conclusion deals with provisions for addressing: 1) use of demineralized water from Genoa Unit No. 3;* and 2) the use of the MDS I with the ACS as an alternate shutdown mechanism. l Procedures for making a flexible hose connection to supply demineralized water from Unit No. 3 to the demineralized water system are not provided at La Crosse. However, the demineralized water tank is sup-plied by two parallel non-essential pumps which can supply water from a deep well. Furthermore, the demineralized water system is backed up by the HPSW system which has available several water sources, including the low pressure service water system. Hence, procedures for obtaining demineralized water from Unit No. 3 do not seem necessary in response to emergency situations. For long term use, such procedures would be helpful since water supplies other than demineralized would adversely affect the structural integrity of the components they passed through. Procedures for providing demineralized water from Genoa Unit No. 3 would provide a redundant water supply to the demineralized water system. However, tne dominant failure of the demineralized water system, for supply-1 ing water to the shutdown condenser, is the failure of the inlet valve (probability = 3.6E-3, from Table V-10.B-1). The additional water supply would not significantly reduce the demineralized water system failure proba-bility.
*A coal plant on the same site.
l 32
l i Procedures for deploying the MDS with the ACS are contained in the emergency section of the operating manual under the heading Primary Leat Procedures.
- 5. Analysis In order to determine the severity of a failure of the shell side level controller, a f ault tree analysis was conducted. The boundaries of the system analyzed are described by Figure V-10.B-1. These boundaries include all components deemed critical in conducting a failure analysis of the shutdown condenser. Shell side water supply systems were 1.
not analyzed all non-air beyond the air valves, described above, for two reasons: operated valves identified in the figure are left open; 2. downstream com-The i ponents (pumps and water supply) are all redundant as described above. control logic to the shutdown condenser steam inlet and condensate outlet valve is not evaluated for this issue. Faults in the shutdown condenser system actuation system are not expected to contribute significantly to the j system f ailure probability. This is due in large part to the redundancy provided in the actuation signal logic. Also no credit is taken for opera-tor recovery of the shutdown condenser system, since at this time no procedures exist for manual recovery of the shutdown condenser system. (Plant personnel have indicated such procedures are being formulated.) The resultant f ault tree is presented in Figure V-10.B-2. Table V-10.B-1 presents the data utilized. Utilizing these values, failure of the shutdown condenser via the shell side level controller dominates the shutdown condenser failure probability of 9.2E-3 with a failure probability value of 9.2E-3. For comparison, f ailure of the shutdown condenser via i failure of the condenser itself or both the water inlet air operated valves
' have the second and third highest probability. Their values are 2E-5 and 1.3E-5 respectively.
I If one considers supplementing the existing level controller with a second one which works independently of the first and is completely redundant in terms of operating the water inlet valves, the system will be improved. In this case the redundant level controllers are no longer the Under this only dominating failure mode for the shutdown condenser system. scenario the failure probability for the shutdown condenser system is 1.2E-4 with the level controller contributing 8.5E-5 to this value. If the test interval for the one level controller is reduced to one month the failure I probability of the level controller would be reduced to 1/2 (1.8E-6)(720) = l 6.5E-4. Using this value for the level controller failure probability the shutdown condenser system failure probability would be approximately 6.8E-4 (from the failures considered in this analysis). This a reduction of 8.5E-3 i compared to the reduction of 9.1E-3 gained by adding a second level controller.
- 6. Conclusichs
- i With regards to the plant's operating procedures, we have found that from the standpoint of a PRA ell of the NRC concerns are adequately addressed by the existing manual .
33
The basic conclusion is that an independent redundant shell side level controller will increase system reliability to a point where the system failure probability is distributed among several components. A second way to achieve a similar improvement is to increase the frequency at which the shell side level controller is tested. In this case monthly testing would be required. In the PRA analysis of other BWRs the failure of a shutdown condenser has proven to be a significant contributor to the core melt frequency. Based on this and the size of the reduction in the shutdown condenser failure probability we rate this issue to be of high risk significance. 1 l 34 t
TABLE V-10.8-1 DATA ELEMENTS FOR FAULT TREE ANALYSIS OF LA CROSSE SHUTDOWN CONDENSER Failure Rate (A) Fault Exposure Time (t) Unavailability (4At) Component Steam Inlet and 8.3E-7/hr 2,190 hrs 9.1E-4 Condenser Outlet Air Operated (Ref. WASH-1400) (Ref. Operating Manual) Valves 8.3E-7/hr 8,760 hrs 3.6E-3 Demineralized g and High Pressure , Service Water (Ref. WASH-1400) (Ref. Operating Manual) Inlet Air Oper-I ated Valves 1.8E-6/hr 10,220 hrs 9.2E-3 Level Controller (Ref. IEEE-500- (Ref. Phone Conversation 1977) withPlantPersonnel)
- - 2E-5 Shutdown Condenser (Ref. Millstone 1 - IREP)
g g- O*
";" "7E S
SERVICE WATER
' My $P8CH>'[p 14~
OS EME 3" V2" 3" ( lf SHUTDOWN CONDENSER 62-01-001 N2 ( Ak ll FROM 3" - DEMMERAll2ED WATER TANK X X
/ / / / # 6
_ L_
+#
A g +r c4 c4 4 4 e X c c c *~ '~ , S-na U 4- 4-qO 10~ O s.$ e F OS'g r M W STEAM FROM REACTOR gg I
# f* CONO NSATE d # TO REACTOR Figure Y SHUTDOWN CONDENSER
l
=
!g u-l in -
le I!.
=;i s, I.g-3 I. N N.I l les *$
l
=I 8" 1; s; I l! -
=
*i I
I,= . W
- 8!
- e. .=
=
II -. i, O g - s; h =
;_ - B a jy:I. !<=!v = a g -
2 o g '
*!= 5 s
.- =
nl i o - ri! gg- a "g a I ,
=l d
u - e _ i e g a c
-llI lse:r l
IV - l ii ,
" E I5$
'5!
37
[ VI-4 Containment Isolation System
- 1. Evaluation Being an older design, many of the La Crosse BWR containment penetra-tions do not meet the current General Design Criteria. Table VI-4-1 lists these penetrations and their areas of non-compliance.
- 2. Recomendation Change penetration configurations to meet the General Design Criteria (GDC).
- 3. Systems Affected The ability of the containment penetrations to isolate and insure containment integrity is affected by the configurations of the penetrations.
- 4. Comments l
l The containment penetrations were analyzed, those found not in compliance categorized into six cases depending on the particular configuration of the penetration. The unava11 abilities of the containment penetrations were calculated using information which did not include any details on the isolation valves (for example, the sourco of power to MOVs). Therefore, the results presented are not intended as a definitive analysis, but instead are meant for comparison purposes only. ! 5. Analysis l There are six cases where the particular configuration of. the containment penetration does not conform to the General Design Criteria. The six cases are characteristic of penetrations which have an identical configuration and therefore are treated collectively. Each penetration case is drawn in both the "before" and "after" co.nfigurations in regard to their meeting the GDC. As mentioned previously, detailed information on the valves used for containment isolation was not available, therefore, the analysis does not consider either control or motive power or isolation signals received by the valves. Valve positions for the containment penetrations are checked only when they are moved. Typically, this occurs during refueling with the restoration of the valve tn its original position being double checked. Consequently, a fault exposure time of 4380 hours is used on Table VI-4-3. Only those penetrations four inches or larger in diameter are considered significant in terms of possible containment leakage (see WASH-1400, Appendix II, Section 5.12). We have interpreted this to include leak paths through equivalently sized paths (<4") as not bein'g of significance. l i i 38 i
Case I Applies to penetration Number M-9, M-10 , l Present configuration: OPEN SYSTEM PPA CLOSED SYSTEM INSIDE CONTAINMENT OUTSIDE CONTAINMENT GDC Required Configuration: M
~
OPEN SYSTEM 1/10 PPA 9/10 PPA CLOSED SYSTEM INSIDE CONTAINMENT OUTSIDE CONTAINMENT The boolean equations which describe these configurations are presented below: Before: PPA After: [1/10 PPA + (V1
- 9/10 PPA)]
Using the failure rates presented on Table VI-4-3, the following unavailabilities were calculated. Before: (4.4x10-7) After: [1/10 (4.4x10-7) + (igio-1
- 9/10 4.4x10-7)] .
8.4x10-Case II Applies to penetration no. M-26 (inlet) ! Present configuration: PPA PPB OPEN SYSTEM CLOSED SYSTEM OUTSIDE INSIDE CONTAINMENT CV1 CONTAINMENT I l l 39 l
i l GDC required configuration: V AUTO CLOSE CLOSED SYSTEM PPA PPB OPEN SYSTEM INSIDE CONTAINMENT ya OUTSIDE CONTAINMENT The boolean equations which describe these configurations are presented below. Before: PPA * (PPB + CVI) After: PPA * (PPB + V2) Using the failure rates presented on Table VI-4-3, the following unavailabilities were calculated l Before: 4.4x10-7 * (4,4x10-7 + 1.4x10-3) = c l After: 4.4x10-7 * (4,4x10-7 + 10-3) = c Case III i Applies to penetration no. M-34 I Present configuration: CLOSED SYSTEM PPA OPEN SYSTEM l INSIDE CONTAINMENT OUTSIDE l CONTAINMENT l GDC required configuration: ! M CLOSED SYSTEM PPA PPB i OPEN SYSTEM l lNSIDE CONTAINMENT yj OUTSIDE CONTAINMENT
)
The boolean equations which describe these configurations are presented below: 40
Before: PPA After: PPA * (PPB + VI) Using the failure rate presented on Table VI-4-3, the following unavailabilities were calculated: Before: 4.4x10-7 After: 4.4x10-7 * (4.4x10-7 + 1x10-1) = 4.4x10-8 Case IV Applies to penetrations No. M-21, M-31 Present configuration: AUTO CLOSE AUTO CLOSE O O PPB OPEN SYSTEM PPA OUTSIDE CONTAINMENT NV1 NV2 OPEN SYSTEM INSIDE CONTAINMENT GDC required configuration: AUTO CLOSE AUTO CLOSE PPA PPB ' OPEN SYSTEM OUTSIDE CONTAINMENT OPEN SYSTEM INSIDE CONTAINMENT The boolean equations which describe these configurations are presented below: Before: [(NV1 + PPA)
- NV2] + PPB After: (NV1 + PPA) * (PPB + NV2)
Using the f ailure rates presented on Table VI-4-3 the following unavailabilities were calculated: Before: [ (3.4x10-4 + 4.4x10-7)
- 3.4x10-41 + 4.4x10-7 = 5.6x10-7 After: (3.4x10-4 + 4.4x10-7) * (4,4xio-7 + 3.4x10-4) = 1.2x10-7 1
41 i
Case V i Applies to penetration no. lA (Containment building drain suction) Present configuration: OPEN SYSTEM PPB L 2 ppa g j INSIDE CONTAINMENT F 7 F 7 MV2 MV1 OPEN SYSTEM OUTSIDE CONTAINMENT GDC required configruation: 2 g j PPA PPB g j OPEN SYSTEM F ' F 7 MV1 OUTSIDE CONTAINMENT MV2 OPEN SYSTEM INSIDE CONTAINMENT The boolean equations which describe these configurations are presented below: Before: [(MV1 + PPA)
- MV2] + PPB After: (MV1 + PPA) * (PPA + MV2)
Using the failure rates presented on Table VI-4-3, the following unavailabilities were calculated: Before: [(10-2 + 4,4x10-7)
- 10-2) + 4,4x10-7 = 1x10-4 After: (10-2 + 4,4x10-7) * (4.4x10-7 + 10-2) = 1x10-4 42
[ Case VI Applies to penetration no. IA (alternate core spray) Present configuration:
' PPA ppg OPEN SYSTEM OUTSIDE CONTAINMENT CV1 CV2 OPEN SYSTEM INSIDE CONTAINMENT GDC required configuration:
M
/ CV1 PPA OPEN SYSTEM PPB OPEN SYSTEM INSIDE CONTAINMENT The boolean equations which describe these configurations are presented below.
Before: [(CV1 + PPA)
- CV21+ PPB After: (CV1 + PPA) * (PPB + VI)
Using the f ailure rates presented on Table VI-4-3, the following unavailabilities were calculated: Before: [ (1.4x10-3 + 4.4x10-7)
- 1.4x10-3 ] + 4.4x10-7 = 2.4x10-6 After: (1.4x10-3 + 4,4x10-7) * (4.4x10-7 + 10-1) = 1.4x10-4 l
43
- 6. Conclusions The results of this analysis are presented in Table VI-4-2. It can be seen that a small reduction in the unavailabilities of most of the examined penetrations can be achieved by conforming them to the GDC. However due to the dcminance of the failure of penetration IA (containment building drain suction) and the lack of failure probability reduction for this penetration, very little reduction in the containment isolation failure probability due to valve failures is possible. (For the La Crosse BWR this penetration dominates primarily because the position of the two valves is never checked except af ter the performance of a test or maintenance action involving these valves. Therefore, there is no possibility of recovering an error in the valve restoration procedure and the error will go undetected.) We therefore rate this issue low in risk significance. .
- r i ,
i l l l 44
~
i Table VI-4-1 Penetration Number Deficiency M-9 "." A M-10 .,s A M-26 (inlet) yg _ , B , M-34 A M-21 M-31 Y'. ' A A 1A (Cont. Bldg. C DrainSuction) 1A (Alternate ' A CoreSpray) Notes: A. Valve number: deviates by ha';ing no isolation valve outside containment. B. Check valve usage: deviates by having a check valve outside containment. C. Valve position: deviates by having both isolation valves outside containment. l 45 i l - _ _ _ _ _ .
Table VI-4-2 Unavailability Present GDC Penetration No. Configuration Required M-9 'd.4x10-7 8.4x10-8 M-10 4.4x10-7 8.4x10-8 M-26 (inlet) c E M-34 '4.4x10-7 4.4x10-8 M-21 5.6x10-7 1.2x10-7 M-31 5.6x10-7 1.2x10-7 IA (Containment Bldg 1x10-4 1x10-4 drainsuction) 1A (Alternate 2.4x10-6 1.4x10-4 core spray) 46
1 w Table VI-4-3 Fault Sumary Fault Event Sub-Event Failure Exposure Sub-Event Total Name Description Rate
- Time Unavailability Unavailability MY1 (Manual Rupture 1x10-8/hr 4380 hr 4.x10-5 ValveNCF0)
Fail to re- 10-2 10-2 store after T or M VI (MOV, Valve fails 10-3fo NOF0) to operate Operator fails 10-1/d to act Rupture 10-8/hr 4380 hr 4.4x10-5 1xio-1 PPA Rupture 10-10/hr 4380 hr 4.4x10-7 PPB Rupture 10-10/hr 4380 hr 4.4x10-7 4380 hr
^
1.3x10-3 CV1 Internal leak 3x10-7/hr 'i (Check Valve) y - 4380 hr 4.4x10-5 1,4xio-3 ?s Rupture 1x10-8/hr V2 (MOV, NOF0 Valve fails 10-3fd , auto close) to close Rupture 10-8/hr 4380 hr 4.4x10-5 10-3 NV1 (pneu- Valve fails 3x10-4/d . l matic valve, to close ,, NOF0, auto close) Rupture 10-8/hr 4380 hr 4.4x10-5 , 3.4x10-4
-C.
y 47 .'
VI-6 Containment Leak Testing +
- 1. NRC Evaluation l
Currently the containment airlocks are tested every four months l regardless of how often these airlocks are used. Appendix J requires that ' the airlocks door seals be tested within 72 hours of opening or every 72 hours during periods of frequent openings. The La Crosse BWR containment is entered daily. Therefore the four-month test interval does not meet the requirement of Appendix J.
- 2. NRC Recommendation A reduced pressure test of the airlock door seals or other positive means to verify the integrity of the seals within 72 hours of opening or l every 72 hours. during periods of frequent openings is necessary to satisfy the testing requirements of Appendix J.
- 3. System Affected l
I Containment integrity is the " system" affected by this topic.
- 4. Coments The possible reduction in the door seal failure probability will be the only issue directly addressed in this analysis. However, more frequent testing of the containment airlock door seals could have an adverse effect on the failure probability that could partially offset the benefits of this reduction. At the La Crosse BWR there have been three door seal failures as a result of testing (i.e., a failure to follow proper test procedures).
Until the door seal is replaced or repaired after a test where the door seal is damaged the containment airlock is not available to isolate the contain-ment. This period of time during which the containment ' airlock is
- unavailable due to the test would reduce the benefits gained through more b frequent tests of the door seals.
1 L .
- 5. Analysis ,
In the approximately 15 years that the La Crosse containment airlock door seals have-been tested (every four months) the tests have not detected a' failed' door seal due to seal degradation. The failures that have occurred
'wer'e'due to improper; testing and the damage occurred during the test. A
~
,- zevo failure approximation can be used to develop a failure rate for the ,
. door seals at La Crosse. The failure rate would be calculated by using the i following: f '
j -- l s
)
1< ' wherei" f ,~ - b==t'knumt er $f' containment airlock door seal N
=
T time ove[3f,NhNEs s have been conMed = 15 yean = J Xb = 1.'386 at the 505 confidence level.
^
< 1 i
l ~ ,r
, , /* f y .18 s
Using this the f ailure rate for a f ailure of one of the two containment l airlock door seals is r 0+1 ) x , k131400 ' hrs / 1.386 = 5.3E-6/hr. 2(0+1) With this failure rate the unavailability of a containment airlock door seal with testing ever four months would be 1/2 At
= 1/2 (5.3E-6/hr)(2880 hrs)
= 7.6E-3.
If the test interval is reduced to 72 hours (the Appendix J requirement) the unavailability is reduced to 1/2 At
= 1/2 (5.3E-6/hr)(72 hours)
= 1.9E-4.
For a leakage path through either of the containment airlocks to be present both containment door seals must f ail. Therefore, the probability of a leakage path existing is 2*q*q. where q is the failura probability of one containment door seal Fcr the present configuration the lestage probability is 1.1E-4. The
- nodified test schedule would reduce this to 6.4E-8.
- 6. Conclusion Neglecting the possible detrimental effects of increased testing the failure probability for the containment airlock door seals failing to seal is reduced from 1.1E-4 to 6.4E-8. By itself this appears to be a signifi-cant reduction. However when the failure of the containment to isolate is
- considered the reduction in containment isolation failure probability is not so significant. The f ailure probability (for qontaingent isolation) for many nuclear power plants is in the range of 10-J to 10-c. A more represen-tative figure for the La Crosse BWR would be the containment isolation failure probability used for the Big Rock Point nuclear power plant. Both the La Crosse BWR and Big Rock Point are small plants with relatively large containments. The leakage probability used for the Consumers Power Company Probabilistic Risk Assessment for Big Roct Point Plant was approximately i 10-1 With a leakage probability of this magnitude the reduction of the l
door seal f ailure probability is not very significant. We therefore rate L this issue to be of low risk significance. l l 49 l
VI-7.A.3 ECCS Actuation System
- 1. NRC Evaluation The testing procedures used at the La Crosse BWR for the ECCS actuation system are in general agreement with currently acceptable practices.
However, the test procedures used are not included as part of the La Crosse BWR Technical Specifications. The test requirements of the plant Technical Specifications are not in accordance with current criteria.
- 2. NRC Recorsnendation The test procedures for the ECCS actuation system used at the La Crosse BWR sho:Jid be required by the plant Technical Specifications to be conducted in accordance with general requirements of test procedures 17.5.1 and 17.5.2. .
- 3. System Affected i
The system affected by this isste is tbe alternate core spray system. l 4. Comments l When a probabilistic rist assessment (PRA) is performed an attempt is made to model as closely as possible the conditions that exist at the F nuclear power plant. When a discrepancy is four,d between what is required i by the plant technical specifications and the plant procedurcs, the procedure er specification that more precisely represents plant conjitions is used. In this case the plant procedures were more restrict?ve, i.e., more frequent tests are required, than the La Crosse SWR Technical Specifications. Therefore, the test interval dictated by the plant procedures would be used in the PRA. Modifying the La Crosse BWR Technical Specifications to reflect the test interval currently in use at the La Crosse BWR would not change the analysis performed in a risk assessment.
- 5. Analysis No further analysis of this issue is required.
- 6. Conclusion Since the recommended change to the La Crosse BWR Technical Specifica-tions does not change the test procedures currently in use at the La Crosse BWR, no change in the results of a plant specific PRA would be expected. We therefore rate this issue to be of low risk significance.
I
, 50
. - _- _ - _~. -.
VI-7.C.1 Appendix K. Electrical Instrumentation and Control (EIC) Re-Reviews
- 1. NRC Evaluation ,
General Design Criteria (GDC) 17 .and Regulatory Guide. l.6 indicate that the onsite AC and DC power systems should have sufficient independence such that they can perform their intended function given a single failure. At La Crosse BWR there are two sets of breakers that can parallel the AC buses and i result in total loss of AC power if a loss of offsite power occurs. Thus, they do not meet the current NRC criteria for the independence of onsite power systems.
- 2. NRC Recomendation 4
The controls for the three manual breakers that could parallel the AC 2 power system should be modified so that paralleling of the redundant onsite sources can be avoided.
- 4. Coments The basic concern in this issue is related to the case where giver, a loss of offsite power, if the onsite AC buses are connected due to closing '
- of the manual breakers, the emergency AC power system might fail, i.e., the diesel generators might fail upon attempting to accept the emergency loads, resulting in a total loss of AC power.
- 5. Analysis
- In the La Crosse BWR the 480V essential buses 1A and 18, which are connected to diesel generators DG1A and DG1B, can be connected by closing breaker 452 TBA on bus 1A and 452 TBB on bus 28. There are no automatic interlock mechanisms to prevent this paralleling if the two diesels are started. It is also possible to parallel the two diesel generators through the 120V AC Non-Interruptable Bus 1B.
I To analyze the importance of this issue, the probability of total loss i of AC power due to the error of closing the'above manual breakers are calcu-lated. During normal operation, the manual breakers under consideration are open and are only closed for test or maintenance during refueling outages. l The scenario of interest consists of closing the manual breakers 452 l TBA and 452 TBB during refueling for test or maintenance procedures,
- followed by f ailure to open these manual breakers before the reactor is taken back to power. The above manual breakers are normally open and their
- status is checked weekly. If during the initial shift these manual breakers
- are clos,ed and a loss of offsite power occurs, then because the diesel generators are paralleled, a total loss of AC power might result. The probability of occurrence of this event consists of the frequency of closing the manual breaker times the human error probability in leaving the manual '
breakers closed after going back to power times the fraction of time before i this error can be detected times the probability of loss of offsite power. At the Lacrosse BWR these breakers are closed only when maintenance is being 51 l . _ _ _ _ . _ _ _ _ _ _ . - _ _ . _ . _ _ _ _ _ _ _ . _ _ _ _ .__ -
performed on the " feed breaker or on1 one of the 480 Volt buses. No maintenance outages are scheduled for"these components. Maintenance is performed during shutdown at intervals of from 14 to 20 months. Thus, the < frequency of initiation of this event is less than once per year. For the purpose of the present evaluation this frequency is conservatively assumed to be once per year. oThe probability of human error in leaving the breakers closed before going baCK to power is about 3x10-3 (NUREG/CR-1278). This is the human error of omission in using2at' written procedure with a long list 1 (more than 10 items)2 -The probability of loss of offsite power is 0.2 per l year (WASH-1400). Thus, the total ;;robability of the above scenario is: (1.0) * (3.0x10-3)
- g ) * (0.2) = 1.1E-5/ year The probability of total loss of AC power due to loss of offsite power
, followed by failure of both diesel gener ators is equal to: 1 (0.2) * (3.0x10-3) = 6.0E-4/ year 1 where 0.2 is the frequency loss of offsite power per year (WASH-1400) and 3.0x10-3 is the common-mode failure of both diesels to start (NUREG-0666). Since the diesel generators at the La Crosse BWR are smaller than those in most nuclear power plants, an attempt was made to generate a plant specific f ailure rate for the La Crosse BWR diesel generators. An examination of plant operating history data did not reveal a statistically significant difference between plant specific and generic data. Therefore, generic data was used in this analysis. 'As can be seen, the contribution of loss of total AC power due to closino of manual breakers to the total probability of loss of AC power is negligib'.e.
- 6. Conclusions The frequency of total loss of AC power due to closing of specific manual brekers and paralleling of diesel generators was calculated. This frequency is equal to 1.1E-5/ year. The frequency of loss of total AC power due to loss of offsite power combined with the common mode failure of the diesel generators is 6.0E-4/ year. Based on this, it is concluded that the
- contribution of loss of AC power due to closing of manual breakers to the total loss of AC power is negligible. Consequently, this issue is ranted low with respect to risk.
l 52
VI-10.A Testing of Reactor Trip Systems and Engineered Safety Features Including Response Time Testing
- 1. NRC Evaluation n The functional tests performed on the reactor protection system and the engineered safety features at the La; Crosse BWR meet current criteria or, in the cases where deviations exist, they have been accepted as meeting the intent of current criteria. This is true for equipment calibration also, except for the case of the nuclear power range instrumentation. The cali-bration of this instrumentation should be performed in such a manner as to address all important parameters (specifically - feedwater temperature).
The La Crosse BWR calibration of the nuclear power range instrumentation does not fulfill this requirement.
- 2. NRC Recommendation The licensee should implement [ program for calibrating the nuclear power range.g.,
parameters (e instrumentation in a manner that addresses all important feedwater temperature).
- 3. Systems Affected This issue affects the reactor protection system.
- 4. Comments The calibration for the nuclear power range instrumentation presents problems only when the feedwater temperature is lower than would normally be expected during power operation. The calibration procedure used at the La Crosse BWR may lead to erroneous readings in the nuclear power range instru-mentation when the feedwater temperature is lower than normal. (This analysis does not consider the possible fuel / fuel clad degradation that could occur over the lifetime of the fuel due to operation at other than indicated power levels.) Thus this is only important during an overcooling transient such as the loss of a feedwater heater. Previous PRA analyses have shown that the risk due to overcooling transients is insignificant compared to the risks due to other transient initiators or LOCAs. It is reasonable to expect this to be true for the La Crosse BWR also.
- 5. Analysis l In a situation where the nuclear power range instrumentatiori is not t
producing an accurate output, several other trip signals will be available to scram the reactor. Among these are the reactor low water level and reactor high pressure. Both signals require one out of two signals to trip the reactor. Even without the nuclear power range instrumentation only one of these four signals is required to trip the reactor. The failure pro-babilities for the reactor water level and pressure level trip channels are calculated for Topic VII-1.A. For the trip channels in their present configuration the failure probabilities are 7.7E-6 for the reactor water level trip signal and 7.8E-6 for the reactor pressure trip signal. 53
The probability for the failure of-both trip signals is the product of the failure probability for each signal. This failure probability is very small. This would not contribute to the system failure probability which has been dominated by the common mode f'ailure of the control rods to insert in previous PRA studies of BWRs.
- 6. Conclusion The possibility of an overcooling transient due to the present method of calibrating the nuclear power range instrumentation has been shown not to be a significant contributor to core melt risk at BWRs. Such events have not made a significant contribution to the core melt probability as eval-uated in previous PRA studies. Additionally, failure of the nuclear power range instrumentation would not significantly affect the reactor protection system reliability. We therefore rate this issue to be of low risk sig71ficance.
i j 54
VII-1.A Isolation of Reactor Protection System From Non-Safety Systems
- 1. NRC Evaluation ;
According to GDC 24 and IEEE 279-1971, it is required that non-safety systems (e.g., control, monitoring) that receive signals from the RPS are properly electrically isolated from the RPS. The areas where the La Crosse BWR deviates from this criteria are explained in the following paragraphs. o Neutron Flux, Intermediate R$nge (channels 3 and 4). The Log N amplifier in each channel supplies an analog signal to a remote Log N indicator and to the two pen process recorder without isolation. The period meter in each channel supplies an analog signal to a remote period meter, also without isolation. o Neutron Flux, Power Range (channels 5, 6, 7 and 8). There is no isolation between the linear amplifier output in each channel and the power level process recorders or the remote power level indicators. o Reactor Pressure High (channels 1 and 2). There is no isolation between the RPS analog signals and the remote indicating meter for channel 2 or the remote process recorder for channel 1. o Reactor Water Level (channels 1 and 2). There is no isolation between the RPS analog signals and the remote process recorder for channel 1 or the remote indicating meter for channel 2. o Reactor Power-to-Forced Circulation (channels 1 and 2). Each channel receives signals from two flow transmitters (1A and IB for channel 1 and 2A and 2B for channel 2) one on each recirculation loop. However, for channel 1 the two transmitters are also used as inputs to a remote two pen recorder which is not isolatable from the rest of the RPS channel. o Power Systems. With one exception all safety system circuits, both trains of the reactor scram logic and the partial scram logic, are powered by a single 120V AC non-interruptible power bus. This non-independence allows for the potential of a single common cause failure of the RPS. The single exception is the reactor water level system of the RPS. Channels 2 and 3 of this system are powered from 120V AC non-interruptible buses lA and 1C respectively.
- 2. NRC Recommendation Suitably qualified isolators should be provided for all the RPS cir-cuits listed above. A redundant and independent power supply should be furnished for one of the full reactor scram logic systems.
55
- 3. Systems Affected The system affected by this issue is the reactor protection system.
- 4. Coments This analysis will assume that any f ault in any of the non-safety recording devices or meters will result in the failure of the RPS equipment to which it is connected. Although a fault exposure time for these failures of one month (time interval betwen functional tests of RPS circuits) is assumed, a much shorter time may be justifiable. The recording devices and meters under consideration all are located in the control room. These instruments are read daily, it seems likely that any failure would lead to an unusual reading and consequently prompt detection.
In the analysis of the nuclear instrumentation, there is considerable everlap in range of the neutron datectors. The ranges are as follows: Channels 1 and 2 (source range) 10-9% to 10-4% of full power Channels 3 and 4 (intermediate) 10-6% to 1% of full power Channels 5 and 6 (pewer range) 10- % to 150% of full power Channels 7 and 8 (power range) 1% to 150% of full power Because of this overlap in range, neutron flux channels 3 and 4 will be analyzed with channels 5 and 6 and channels 5 and 6 with 7 and 8. This grouping postulates an initiating event in the 10-4 to 1% power level for the first case and the 10% to 150% power level for the second case. Other power ranges are monitored by additional neutron flux channels. For the power system deficiency, redundant independent 120V AC non-interruptible power buses already exist at tne La Crosse BWR (buses 1A and IC). However, before analyzing this deficiency a little explanation on the nature of this postulated failure is in order. The proposed scenario is one ' where the bus does not experience a complete loss of power (which would de-energize the safety system relays and trip the plant anyway) but is subjected to some type of degradation. This would be in the form of an overvoltage, undervoltage and/or underfrequency which would inhibit the de-energizing of the relay coils and/or the opening of the trip relay contacts and thereby prevent or delay a reactor scram.
- 5. Analysis This analysis will use failure rates (see Table VIII-1.A-1) for meters and recorders as given in IEEE Std. 500 "IEEE Nuclear Reliability Data Manual." These f ailure rates are 4.6E-6/hr for meters and 6.8E-6/hr for recorders.
Each RPS channel will be analyzed as a detector / sensor - amplifier - relay circuit and whatever non-safety instrumentation was specified in Section 1 of this analysis. 56
o Neutron Flux j Channel 3 unavailability is the sum of the unavailabilities of the ! detector, amplifier relay and non-isolated indicator. ! P(Ch. 3) = P(detector) + P(amp) + P(relay) + P(meter).
= 3.6E-4 + 3.6E-4 + 3.6E-6 + 1.7E-3
= 2.4E-3 P(Ch. 4) = 2.4E-3 Using P(cc) for the failure of the two pen -non-isolated recorder shared by the two channels, with P(cc) = 2.5E-3.
Then the unavailability of the neutron flux intermediate range is [ P(Ch. 3)
- P(Ch. 4)] + P(cc)
{ (2.4E-3) * (2.4E-3)] + 2.5E-3 5.8E-6 + 2.5E-3 P(Ch 3 + 4) = 2.5E-3 , Using the same analysis for channels 5 and 6. P(Ch 5 + 6) = 2.5E-3 Therefore the unavailability'of the RPS neutron flux channels for the power range of 10-4% to 1% is: P(10-4% to 1%) = P(Ch 3 + 4)
- P(Ch 5 + 6)
= 6.3E-6 This represents a worst case situation in that no credit is taken for detection of the need to scram by any other RPS channel.
o Neutron Flux (power range) i i The analysis is identical to that just presented above. The l unavailability of RPS Channels 5, 6, 7 and 8 which monitor the i neutron flux in the range of 10% to 150% of full power is 6.3E-6. t o Reactor Pressure High l Channel I consists of the normal sensor-amplifier-relay circuit with a non-isolated remote process recorder. Channel 2 contains a ! non-isolated remote indicating meter in place of the recorder. l Then the unavailabilities of Channel 1 and 2 are: i l P(Ch 1) = P(sensor) + P(amp) + P(relay) + P(recorder)
= 3.6E-4 + 3.6E-4 + 3.6E-6 + 2.5E-3
= 3.2E-3 l
l 57 _ _. _._ ._. -_ ._ _ _ _ _ _ . . _ ~_. - - .
t P(Ch 2) = P(sensor) + P(amp) + P(relay) + P(meter)
= 3.6E-4 + 3.5E-4 +-3.6E-6 + 1.7E-3
= 2.4E-3 Unavailability of the reactor pressure channels of the RPS is:
P(Ch 1)
- P(Ch 2) = 7.7E-6 l o Reactor Water Level
, The configuration of this portion of the RPS is the same as the i
- reactor pressure channels. Therefore, the analysis is identical to that just performed above resulting in an unavailability of 7.7E-6.
o Reactor Power-to-Forced Circulation
, Each of the two channels of this portion of the RPS consists of i two flow transmitters (one on each flow loop), a flow summation amplifier, a flux-flow summation amplifier, and a trip relay. A ! flux signal is input to the flux-flow sun:mation amplifier-from l nuclear instrumentation channel no. 7 for safety system 1 and from i
nuclear instrumentation channel 8 for safety system 2. There is a i non-isolated two pen remote recorder which receives' output from the two channel 1 transmitters. Channel 2 of the reactor power-to-forced circulation safety system has no non-isolated, non-j safety equipment. Then the unavailability of channel 1 is: 1 P(Ch 1) = P(sensor 1) + P(sensor 2) + P(amp 1) + P(amp 2)
+ P(relay) + P(flux sensor) + P(recorder).
P(Ch 1) = 3.6E-4 + 3.6E-4'+ 3.6E-4 + 3.6E-4
+ 3.6E-6 + 3.6E-4 + 2.5E-3 P(Ch 1) = 4.3E-3
!' without the recorder Ch 2 becomes: l P(Ch 2) = 1.8E-3 then: P(Flux-flow) = P(Ch 1)
- P(Ch 2)
= 7.8E-6 o Power Systems From IEEE Standard 500-1977, the failure rate for the degraded l operation (does not include catastrophic failures) of an uninter-ruptible power supply furnished by a motor-generator set is 3E-7/hr. This type of f ault would definately be detected during a functional test of the RPS. At the Lacrosse BWR the RPS channels are tested once a month and the tests are staggared and therefore the power supply would be tested twice a month at an interval of approximately 360 hours. Assuming that this type of failure i
1 58 l
. . _ _ . . _ _ . _ - . - . _ _ _ _ _ . - . - _ _ . _ _ _ _ _ . - - - - - _ _ . - _ . -_.--- _ _ _ _ _ _ _ . - - - - . __--.__l
propagating through the RPS would go undetected until an RPS functional test would yield an unavailabili.+.y of the RPS due to power system failures of: i 1/2(360 hrs)(3E-7/hr)=5.4E-5
- 6. Conclusions i The analysis just performed produced the following unavailabilities for the current configurations of the RPS channels.
Safety System Unavailabilities Neutron Flux (intemediate range) 6.3E-6 Neutron Flux (power range) 6.3E-6
-Reactor Pressure High 7.7E-6 Reactor Water Level 7.7E-6
- Reactor Power-to-Forced Circulation 7. 3E--6 These unavailabilities represent the worst case in that no consideration is given for detection of the need to scram by more than one safety system.
! For the neutron flux systems, isolation of the non-safety recorders , wculd lower their unasailabilities to s. ! Isolation of the non-safety recorder and indicator from channels 1 and , 2 respectively of the reactor pressure high safety system would result in an , unavailability of SE-7. The Reactor Water Level unavailability would also be reduced to SE-7 by ,
- the isolation of the non-safety equipment.
The isolation of the non-safety recorder in the reactor power-to-forced circulation circuit would result in an unavailability of 3.2E-6. Although some reduction of the RPS unavailability is possible by isolating the non-safety components, it may not result in a reduction of the j i scram f ailure probability. ' According to NUREG-0460, the common mode mechanical f ailure of control rods f ailing to insert results in a scram failure probability in the range of 3E-5/ demand based on actual operating experience. This failure mode will not be reduced by the recommended I changes and therefore the overall scram failure probability would not be
- significantly changed. The lack of adequate isolation between the safety system and the meters, indicators and recorders is of low rist significance.
l An unavailability of the RPS due to a power system failure of 5.4E-5 is l relatively high. Separating one of the scram logic channels onto an indep~endent redundant bus would decrease the unavailability to 3E-9. The existance of a suitable isolation device between the motor generator set and the RPS, with a f ailure probability of IE-3/ demand, would also make the contribution of this type of failure to the RPS failure probability insig-nificant. However, the 5.4E-5 unavailability is based on a number of 59
assumptions, two of which might be ~less than realistic. One assumption is that the circuit breakers for the RPS. circuits do not protect the system and ; the degraded power supply operation (e.g. voltage fluctuation) passes through the entire RPS and affects the ability of the scram relay contacts to perform their function. The second assumption is that this failure goes undetected until the RPS functional test. With these assumptions the unisolated failure of the RPS power supply is of high rist significance, n , i 1 I 1 I l i l l 60
Table VII-1.A-1 Fault Sunrary Camponent Failure Failur$ rate Test Interval Unavailability (A) (t) (1/2 A t) Amplifier Failure to 1E-6/hr* 720 hrs 3.6E-4 Operate Ion Failure to IE-6/hr* 720 hrs 3.6E-4 Chamber Operate Relay Short Across 1E-8/hr* 720 hrs 3.6E-6 Contact Meter / Fails 4.6E-6/hr 720 hrs 1.7E-3 Indicator Recorder Fails 6.8E-0/hr 720 hrs 2.5E -3 Sensor Failure to IE-6* 720 hrs 3.6E-4 6perate ,
*From WASH-1400 Table III 4-2.
61 i
4 i VIII-3.B DC Power System Bus Voltage; Monitoring and Annunciation
- 1. NRC Evaluation ,
1 Several of the required annunciators for the DC power systems are not in the La Crosse BWR control room. .These include battery current, battery charger current, breaker / fuse status and (for all but one bus) bus voltage i indication.
- 2. NRC Reconnendation The following additional indications and alarms for the Class 1E DC j power system status should be provided in the control room:
Battery current (ammeter - charge / discharge) Battery charger output current (awneter) t DC bus ground alarm - DC bus voltage > Battery breaker or fuse open alarm Battery charger output breaker or fuse open slarn..
- 3. Systems A'fected The DC power system is the only system directly affected by this issue. :
InJirectly this issue affects all systems that require DC power such as the - shutdown condenser, alternate core spray, emergency AC power, etc. , 4. Connents Part of the basis for this analysis is NUREG-0666 "A Probabilistic
- Safety Analysis of DC Power Supply Requirements for Nuclear Power Plants."
~
One of the ruults from the analysis of NUREG-0666 is that approximately one-half of all battery f aults are not detectable until a battery test is . performed. (This'is based on an examination of LERs concerning battery j faults.) For the La Crosse BWR this analysis has been performed for the diesel building 125 DC power supply, the reactor plant 125 V DC power supply, and the generator building 125 V DC power supply. The analysis for both the generator and reactor building DC power supplies are identical. (They have - i essentially the same annunciators.)
- 5. Analysis A fault tree for the loss of power at any one of the three DC buses is shown in Figure VIII-3.B-1. This issue affects the probability that a battery fault will go undetected between tests and the probability that
- ' given a demand on the batteries the breaker between the battery and the bus will be closed allowing the battery to supply power to the bus. Any fault
, that goes undetected between battery tests has a fault exposure time of one- ! half the test interval. Faults detected immediately (i.e., annunciated j faults) have a fault exposure time equal to the duration of the challenge to the DC power system following an initiating event. ! 62 \ __ ___ _ _ _ _ . - - - - . . - - - - - - - - - - - - - - - - - - - - ~ ~ ~ - ~ ~ " ~ ~ ~ ' ~- ~
l (
- The data used to analyze this issue was derived from two sources, WASH -
1400 and NUREG-0666. This data is shown in Table VIII-3.B-1. As stated in Section 4 of this topic analysis according to the LERs examined in NUREG-
.0666 approximately one-half of the battery faults were detected during battery tests even though minimum annunciator requirements were met. The installation of annunciators at the La Crosse BWR could not be expected to improve upon this ratio for battery f aults at the.La Crosse BWR. The conservative assumption was made that with the present monitors at the La Crosse BWR no battery f aults would be detected except at battery tests.
(Many of the monitors being recommended for use in the control room already are in place at the batteries, including bus voltage for all three DC systems and battery and battery charger current for both the reactor build-l ing DC power supply, and the generator building DC power supply.) Alarms currently are in place in the La Crosse BWR control room that indicate CC bus ground f aults, for the DC power supplies, and for the diesel building DC powersupply, alarms exist for low bus voltage and battery
+
l charger faults. ; Using the teolt tree and data table the failure probabilitics of the
- reactor building 12G V DC ous and the diesel building 125 V bus, with the ,
r press.nt aanunciation t.re 2.U-3 and 2.0E-3 respectively. The generator building 175/ CC system f ailure probaLility is also 2.2E-3. With the imprev,zo annunciatien both of these waius are reduced te SE-4, roughly a reduction by a facter of 4.
- 5. Conclusion The installation of the recommended DC system annunciators can lead to a reduction of the bus unavailabilities by a factor of approximately 4, for the reactor building DC power supply, the generator DC power supply, and the diesel building 125 V DC power supply. For the reactor building and genera-tor building DC bus the reduction is from 2.2E-3 to SE-4 and for the diesel building DC power supply the reduction is from 2.0E-3 to SE-4. All of these systems supply multiple emergency loads. (Such as the shutdown condenser valves, alternate core spray valves, and the control logic to several sys-tems.) The DC power supply reliability can therefore be expected to have an impact on the risk due to a core melt. In previous PRA studies on.BWRs (even though of somewhat different design than the La Crosse BWR) failure of the DC system has proven to be a significant contributor to rist. Due to the magnitude of the reduction in DC power unavailability and the possible importance of the DC systems we rank the issue of high risk significance.
l l 63
Table VIII-3.B-1 Data Sumary Failure Rate Fault Exposure Time Unavailability DC Bus - Test or Maintenance 10-7 DC Bus - Local Faults 10-6 Loss of AC Power
.2 Battery Charger Faults:
Generator or Reactor , Buildte;g DC Sys+.em "as is" 2.8E-6/hr 5110 hr(a,
/
1.4E-2 Ouierater or Reacter i Uuilding DC System " mod" 2.8E-6/hr 1 hr(b) ' 2.8E-6 Die:el St.ilding DC System 2.8E-6/hr 1 hr 2.8E-6 Battery Charger Breaker - Fails Open "as is" 1E-6/hr 20 hrs (c) 2E-5 "rroc" 1E-6/hr 1 hr IE-6 Battery Breaker - Fails Ocen "as is" 1E-6/hr 5110 hrs 5.0E-3
" mod" 1E-6/hr 1 hr IE-6 Detectable Battery Faults "as is" -- --
0
" mod" 4.4E-3/yr 1 hr SE-7 Non-Detectable Battery Faults
[ "as is" 8.7E-3/yr 5110 hrs 5.1E-3 ) I
" mod" 4.4E-3/yr 5110 hrs 2.6E-3 l l l
[ a. 5110 hrs is one-half of 14 months - the La Crosse fuel cycle length. b. Approximate length of demand on system following a transient /LOCA.
- c. Time is approximate - represents gradual battery discharge.
l l l 64 l l .
i DC SWITCH-BOARD FAILS T' I I sWITCHeOARD R AT OUT OF sERMCE S TCHBOARD I FOR TEST /MAINT 4 O O - T I I S NO POWER TO e.OCAL FAutTS AT SWITCH 80ARD SWITCH 2OARD O v ' , i "OPO*E"F"0" NO POWER FRom BATTERY GATTERY CHAROER m, , , k, I , NON-DETEG- SATTERY TO LOCAL FAULTS NO AC POWER CHAR R TO DETECT *.5LE ASLC 3.r.TWY SMTCHBOARD sATTERY TO eATTERY sus sREAKER BATTEMY FAULT 3 OPEN F s BREA CM ER CH ER Figure VIII-3.B-1 SIMPLIFIED DC POWER f AULT TREE
IX-5 Ventilation Systems
- 1. MRC Evaluation It is required that the ventilation systems have the capability to provide features.a safe environment for plant personnel and for engineered safety Certain plant areas at the La Crosse BWR were found to have apparent deviations. They are as follows:
o The turbine building penetration room is ventilated by the turbine building: ventilation system. This ventilation system is not powered by an emergency bus, thus during loss of offsite power events no ventilation is available. In general, the turbine 1 building is a la*ge volume with ample openings to allow cooling of ' components by natural circulation. However, this is not clear in the case of the penetration room, which contains 480 VAC emergency bus 1A. Insufficient information was provided by the licensee to evaluate if ventilation is required to maintain this bus opera-i tional during a loss of offsite power event. !- o ' The electrical equipment ~ room is veatilar2d by the control room area ventilation system. This vstilation system is not powered uy an emergency bus, thus during loss of offsite power events no l ventilation is available. The e?ectrical equipment room cantains the reactor plant batter motor-generator (inverter)yset,set,the turbir.e building MCC-1A, IB non-interruptible the 1A 120-VAC bus, and the reactor plant battery chargers. It also serves as the cable spreading area. Inufficient infor. nation was provided ' by the licensee to evaluate if ventilstion is iequired to maintain this equipment operational during a loss of cffsite power event. o The 1A diesel generator room is ventilated by its own ventilation system. This system consists of an inlet f an and damper and an outlet damper, each of which is subject to a single active failure. Insufficient information was provided by the licensee to determine if ventilation is required to maintain this equipment in operation. o The IB diesel building is divided into three areas, the diesel generator room, the diesel electrical equipment room, and the diesel battery room. Each room has a potential single active failure. They are the control actuation logic in the diesel room, a single exhaust louvre in the electrical room, and a single fan ! in the battery room. There are different equipments in each room, however they are all associated with the 18 electrical train, thus 1 loss of ventilation would result in loss of the IB train if l ventilation is required. Insufficient information was provided by the licensee to evaluate if ventilation is required to maintain this equipment in operation. o The intake structure has no ventilation system. The alternate core spray pumps are located in this area. The licensee has not i l 66
provided sufficient'information to determine if ventilation is required to assure operation of this system.
- 2. NRC Recommendation For each of the area ventilation systems discussed above, the licensee should either demonstrate that ventilation is unnecessary or propose corrective measures.
- 3. Systems Affected The systems affected by this topic are AC and DC power and the alternate core spray.
- 4. Comments One of the above issues can be eliminated based on the Franklin '
Research Center Technical Evaluation Report (TEP) and on the work of pre-vious PRM. Pertaining to the intake structure, the TER specifically states that "The technical review of the crib house ventilation system indicates i that the acceptance criteria for the titernate core spray system diesel-operated pumas are satisfied."* Aoditionally, previous PRAs, such as ; the Millstone i IREP, have concluded that pumps located in crib house; and ' drawing water from the ultimate heat sink are adeq9ately cooled by the ' pumped fluid and the nature of crib house environment. As f ar as the analysis of the re431ning issues is concerred, it is necessary to make t:1e assuizption that vor.tilation is required for all ! equipment in the area to function. This is a very conservative assumption but will provide a bounding analysis of potential rist significance in the , absence of information from the licensee on the need for vertilation. Since the NRC recommendation is to have the licensee provide this information, the analysis performed here will indicate if the potential risk justifies a detailed heat load study.
- 5. Analysis o The concern in the turbine building penetration room is that no ventilation' will be available during loss of offsite power, which could result in a loss of emergency bus 1A. This is equivalent to losing the entire electrical train by diesel failure. However, in a
this case, no additional failure other than loss of offsite power L is required. Thus the frequency of loss of electrical train IA / during loss of offsite power (LOSP) can be represented as F(loss of train 1A) = F(LOSP) = .4/yr. using the plant specific point estimate for LOSP at the La Crosse BWR contained in Table H.1 of the final draft of NUREG/CR-2815, the NREP Procedures Guide. We can estimate the f ailure rate of
*See Section 4.9.1, p. 17.
67
the other train (18) by assuming that it is dominated by failure of the diesel generator. This has been shown to be the case in previous PRAs. Using the values for diesel failure from Table C.1 of the NREP guide, the diesel failure rate to start and run can be found from the following equation Ad(diesel) = 1/2 A sT + AoT
;jstart) (run) where:
A s = standby failure rate = 6E-5/hr T = time between tests = 720 hrs A, = operating failure rate = 3E-3/hr "3dfaitsiontM)(valueusedinIREPstudiesfor l so that l Ad (diesel) = 5E-2/d and thus the frequency of station blackout is j F(blackout) = F(loss of train lA) Ad (diesel)
- = (.4/yr)(5E-2/d)
= 2E-2/yr.
\ Station blackout scenarios have been shown in previous PP.As to be sigreificant risk contributors for some BWRs. This value is very high when compared to station blackout frequencies at various other plants. (This plant does have some systems that can operate in the absence of AC power and in some cases possibly in the i absence of DC power as well. However, station blackout sequences would still be expected to contribute to the core melt risk.) This could lead to this loss of ventilation event being a significant risk contributor at the La Crosse BWR. o The concern in the electrical equipment room is that no ventila-l tion will be available during loss of offsite power. Although this room contains substantially more equipment than the pre-viously analyzed area, the effect of lost ventilation in this room would be the same. That is, the result would be the loss of emergency electrical train lA. The frequency of this event would obviously be identical to that previously calculated. In f act, since both events actually would have to occur simultaneously, this event is really a part of the previous event. o The concern in the 1A diesel generator room is what does the failure of the ventilation system contribute to the overall diesel l 68 l
l l failure rate. The base failure rate of a diesel was calculated in ! the analysis of the first issue and found to be Ad(diesel) = SE-2/d The overall diesel f ailure rate including ventilation failure would ba Ad (diesel-total) = Ad(di sel) + A d(1A-ventilation) where the failure rate of the ventilation system could be approximated by the sum of the failure rates of the two dampers ano the fan which mace up the system. Thus:
\ d(1A-ventilation) = 2(A (damper))
d + Ad (fan) Using the data frcen Table C.1 cf the NREP guide Aq(damper) = 1/2AJ Ltere: As = standby failure rate = IE-6/hr , T = time betwee't tests = 720 hrs so that Ad(damper) < 4E-4/d Ad (fan) = 1/2As t t Ao T (start) Trun) I where A t Y == standby failure time between rate= =720 tests 6E-6/hr hrs Ao = operating failure rate = 6E-6/hr* T = mission time = 10 hrs ? , so that i ! Ad (fan) = 2E-3/d l
*0nly one failure rate was given in Table C.1, thus it was used both for A s and Ao. The rate used was for air coolers, since none was shown for fans.
69
and thus Ad (IA ventilation) = 2E-3/d + 8E-4/d 3E-3/d and finally Ad (diesel-total) = 5.3E-2/d < This shows that failure of ventilation contributes approximately 6% to the overall diesel failure rate. Although previous PRAs have shown diesel failure to be a significant contributor to risk, a 6% affect on the failure rate of this particular component would 4 show a negligible affect on total risk. 1 o The concarn in the 13 diesel generator building is what does the failure of the ventilation system in any of the areas, all of which contain train IB electrical equipment, contribute to overall train f ailure rate. This issue is very similar to the previous one since the base train failure rate can be approximated by the diesel fdilure rate, so that ,
- Ad (train 18) = A d(diesel) = SE-2/d The overall train failure rate including ventilation failure would be Ad (trcin 15-totai) = A d(train 18) + Ad(IB-ventilation) where the ventilation failure rate can be approximated by the sum of the three single failures identified in the evaluation, the actuation relay, the exhaust louvre (damper), and the exhaust fan.
Thus: l Ad (18-ventilation) = A d(relay) + A (damper) d + Ad (fan) Using the data from Table C.1 of the NREP guide Ad (relay) = 1/2 As t where: As= standby failure rate = 4E-6/hr* T= q time betwen tests = 720 hrs < so that Ad (relay) = IE-3/d
- Total of coil and contact failure rates.
i 70
l- Using the values for damper and fan failure previously calculated , Ad (IB-ventilation) =-1E-3/d + 4E-4/d + 2E-3/d
= 4E-3/d and thus Ad (train IB-total) = SE-2/d + 4E-3/d = 5.4E-3/d This shows that failure of ventilation contributes approximately 8% to overall train f ailure rate. As stated in the analysis.of the previous issue, this would be expected to show a negligible affect on total risk.
o The SEP branch of the USNRC took exception to the findings of the , TER in regards to the ventilatior, of the crib house. In their , estimation ventilation of the crib house may be required and the current practice of osanirfg windows and setting up f ans may be inadequate. , ' If ventilation is requirad in this crib house, one of the dominant f ailures of the ventilatien system would be a loss of offsite power (provided the fans are necessary) sad a loss of the 1A emergency power supply. This combination of failures is the : situation analyzed for the turbine building vsntilation. For this case no additional f ailures beyond the itss of offsite pcwer and ' the 1\ emergency power supply are required to fail the alternate core spray system. The additional loss of ventilation in this crib house would be of high risk significance since the failure would effect one cf the systems that can operate without AC power, and therefore some functional redundancy is lost.
- 6. Conclusion As previously stated, this topic addresses the need to provide further analysis to determine the need for ventilation to assure system operability.
This in itself does not serve to reduce rist; however, a finding that ventilation is not needed in certain areas could serve to " reduce" the perceived potential for risk significance. The analysis performed was conservative in nature and serves to indicate the upper bound for potential risk, thus indicating for which areas further analysis should be carried out. The conclusion for each issue is as follows: o The turbine building penetration room and electrical equipment room contain important emergency AC train IA equipment, vital to that system's operation. The ventilation for these areas cannot function during loss of offsite power. The analysis showed that this situation results in a very- high frequency of station blackout. It is not possible to pinpoint what the precise contribution to risk could be at the La Crosse BWR since a plant specific PRA is not available for this plant. This particular plant is unlike other plants, and it has some interesting systems which are capable of operating in the absence of all AC power, and 71
in some cases possibly in the absence of DC power as well. Only with a plant specific PRA could a true evaluation of the signiff-cance of this issue be done. In the absence of a plant specific PRA, we can only assess that the potential of this issue could make it a significant contributor to core melt frequency, based on the results of other BWR PRAs. Thus, we rank the importance of this issue as high. 0 I The loss of ventilation in the diesel generator room / building would be expected to cause the diesel / power train to fail. This mode of failure .was shown in the analysis to increase the overall diesel or train f ailure rate, by only 6 or 8 percent, respectively. Although diesel failure has been shown to be historically a significant contributor to core melt at other BWRs, and is therefore an important system, a change of.6 or 8 percent 4 in its failure is not significant, thus, we rank the importance of this issue as low. , o The lack of ventilation in the crib house does not affect anything. This is because the wcrking fluid for the alternate , core sprey pumps and tne nature of the crib house environmer,t ' render vertilation unnecessary. Thus, we rank the finportance of this issua as low. (If the SEP branch assumptica < ventilatier is required f or this crib house is accepted, then the los: of active ventilation (i.e., the fans) would t,e a high risk signifi-cant evcnt during a loss of offsite power since it would affect ,
' one of tr.e systems capable of operating in the absen'e of AC power.) l In summary, it would apear that a detailed heat load analyhis should be performed of the penetration and electrical equipment rooms, due to the sensitivity of these areas and the potential for large scale equipment failure and station blackout if ventilation is required. All the other areas are-expected to have little risk impact and thus further analysis may not be justified.
I i l l 72 '
XV-20 Radiologica' :onsequences of Fuel Damaging Accidents , i
- 1. NRC Evaluation From a conservatively modeled fuel handling accident the dose to the thyroid at the exclusion area boundary is 138 rem. This dose exceeds the SRP limit of 75 rem but is within the 10 CFR Part 100 requirement of 300 rem.
- 2. NRC Recommendation None at this time. This evaluation will be input to the integrated safety assignment for the La Crosse plant. The licensee is given the opportunity to identify any changes needed to reflect the as-built conditions at the plant.
- 3. Systems Affected This issue affects offsite consequences. '
- 4. Connents l j None
- 5. Analysis PRAs have shown that tr.e dominant contributor to risk from a nuclear power plant is a core melt accident. Although the dose rate from a fuel handling accident at the La Crossa plant is credible under a conservative i scenario, it does not offer an opportunity to significantly reduce risk.
This follows from consideration of the frequency of fuel handling accidents. In WASH-1400, Appendix I, the probability of a fuel handling accident due to crane failure is estimated to be 10-9/yr. and since damage (qverheating) can also occur through an operator error, an upper limit of 10-J per refueling (i.e., per year) is estimated. Thus the fuel handling is perhaps more probable than a core melt accident by a factor of 10 to 100 but the consequences of a core melt far exceed the consequences of a fuel handling l accident.
- 6. Conclusion This issue has little effect on risk and has little potential for l
significantly reducing risk. Therefore it is rated as having low risk significance. l i l 73
i REFERENCES
- Baranowsky, P.W., A.M. Kolaczkowski, and M.A. Fedele, "A Probabilistic Analysis of DC Power Supply Requirements for Nuclear Power Plants," NUREG-4 0666, April 1981. ~
i Consumers Power Company, "Probabilistic Risk Assessment, Big Rock Point 'l Plant," Docket 50-155. ;. p Garcia, A.A., et. al., " Interim Reliability Evaluation Program: Millstone Point Unit 1," SAI-002-82-BE, January 1982. ( Idaho National Laboratories, " Interim Reliability Evaluation Program: Analysis of the Browns Ferry Unit 1 Nuclear Plant," NUREG/CR-2802 (EGG ' 2199), July 1982. l; IEEE Guide to the Collection and Presentation of Electrical, Electronics, and Sensing Component Reliability Data for Nuclear Generating Stations, IEEE [ Std 500-1977, 1977. t La crosse BWR Operations Manual , ! Rome Air Development Center, Reliability Analysis Center, "Ncnelectronic Parts Reliability Data," NPRD-2. ! Swain, A.0, and H.E. Guttmann, "Handbow of Human Reliability Analysis With l Emphasis or. Nuclear Power plant Applications," NUREG/CR-1270, October 1980. ! U.S. Nuclear Regulatory Commission, "Rextor Satety Study, An Assessment of ' Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975. U.S. Nuclear Regulatory Commission, " Anticipated Transients Without Scram I for Light Water Reactors," Unresolved Safety Issue Program, Office of Nuclear Reactor Regulation, NUREG/CR-0460, March 1980. U.S. Nuclear Regulatory Commission, " National Reliability Evaluation Program: Procedures Guide," NUREG-CR-2815. E l 1 l l 74 I
. _ _ _ _ . . __ _ _ _ _ - . ~ . - - - _ _ _ . - _ _ _ . . . _ , _ _ _ . _
- ~. -: ,
j % .
' s w
a
- - ~~...
#w
. .s APPENDIX E s N-REFERRENCES TO CORRESPONDENCE - , - ,
2 y' . FOR EACH TOPIC EVALUATED
. .~ .
\
,e x .-
. ~;
s 4 a 4 - 4 La Crosse SEP
" ~
;o 3 > ~x .
? ;;
- n _ . ,
~', !
f " % e.,_
~
% % q, s
&? y ~,
1 n 'SEP
'l - .
3 Topic No. Date Reference ;, , f Letter from D. M. CrutchfIeld (NRC) to F. Linder (DPC), j II-1.A' 1/31/83
Subject:
SEP Topic _II-L A, Exclusion Area Authority and Control- L'aCroJse Boiling' Water Reactor.
, 1 ,'
II-1.B 9/13/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Lacrosse - SEP Topic 11-1.B, Population Distribution. v II-1.C 8/30/82 LettirfromD.M.Crutchfield(NRC)toF,Linder(DPC),
Subject:
SEP Topic II-1.C, Peter.tial Hazards Due to Hearby Industrial, Transporation and Military Facili-ties - Lacros'se' o .-
*II-2.A 12/15/80 Letter from O'. Ml Crutchfield (NRC) to F. Linder (DPC),
GV, Subject. /LACrbsse- SEP Topic II+2, A, Severa Wea?.her _ , Phenomena. . ~-
, , ,.c 1 II-2.C 10/15/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
/
Subject:
SEP Topic II-2.C, Atmospheric Transport and Diffusion Characteristici for Accident Analysis - 4 7 aCrosse. .
;II-3.A 11/12/82 / Letter f rom'D. M. Crutchfield (NRC) tt., F. Linder (DPC),
+ -
Subject:
SEP Hydrology Topics II-3.A, II-3.B, 11-3.B.1, d ,, 'and II-3.C - Lacrosse toiling Water Reactor.
~, .
II-3.G' 11/1'2/82, 'See reference for Topic'II-3.A. +
. . ,. . 7 1103.B.1 11/12/82 See'referen'cefor' Topic 15-3.A.
(II-3.C 11/12/82 5ee' reference'for Topic II-3.A. II-4 7/20/82 Lei.ter from D. M. Crutchfield (NRC) to F. Linder (DPC),
' subject: SEP Review Topics >II-4, Geology and Seismology, and 11-4.87 Proximity of Capable Tectonic Structures in Plant Vicinity - Lacrosse Boiling Water Reactor.
f II-4 A 6/8/81 Letter from D.M. Crutchfield (NRC) to all SEP owners,
Subject:
Site Specific Ground Response Spectra for SEP n Plants Located in the Eastern United States.
., II-4.B 7/20/82 See referenc6"for Topic- l'-4.
III.C 6/8/81. See reference for Topic II-4.A.
., . m m
~ ,
La Crosse SEP E-1 -
~
, e
/
i SEP Topic No. Date Reference II-4.0 8/27/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Safety Topic II-4.0, Slope Stability - Lacrosse BoilinglWater Reactor. II-4.E 8/16/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Safety Topic II-4.E, Dam Integrity - Lacrosse Boiling Water Reactor. II-4.F 7/29/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Safety Topic II-4.F, Settlement of Foundations and Buried Equipment - Lacrosse Boiling Water Reactor. III-1 7/2/82 Letter from F. Linder (DPC) to D. M. Crutchfield (NRC),
Subject:
Lacrosse Boiling Water Reactor (LACBWR), SEP Topic III-1, Classification of Structures, Systems and Components. III-2 1/27/83 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), i s
Subject:
SEP Topic III-2, Wind and Tornado Loadings -
'% La Crosse Nuclear Power Station.
III-3.A 2/14/83 Letter from F. Linder (DPC) to D. M. Crutchfield (NRC),
Subject:
Lacrosse Boiling Water Reactor, SEP Topic III-3.A, Safety Evaluation Report, Effects of High Water Level on Structures. III-3.C 10/15/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-3.C, Inservice Inspection of Water Control Structures - Lacrosse Boiling Water Reactor. III-4.A 11/29/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), l
Subject:
SEP Topic III-4.A, Tornado Missiles - Lacrosse Boiling Water Reactor. III-4.B 1/27/83 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-4.B, Turbine Missiles - Lacrosse g Boiling Water Reactor. ' III-4.C 7/19/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), !
Subject:
SEP Topic III-4.C, Internally Generated Missiles - Lacrosse Boiling Water Reactor. l III-4.D 8/23/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), 1
Subject:
SEP Topic III-4.0, Site Proximity Missiles (Including Aircraft) - Lacrosse Boiling Water Reactor. La Crosse SEP E-2 l
SEP Topic No. Date Reference III-5.A 11/8/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-5. A, Effects of Pipe Break on Structures, Systems and Components - Lacrosse Boiling Water Reactor. III-5.B 8/12/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-5.B, Pipe Break Outside Contain-ment - Lacrosse Boiling Water Reactor. III-6 4/5/83 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-6, Seismic Design Considera-tions - Lacrosse Boiling Water Reactor. III-7.B 12/9/82 Letter from D. M.'Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-7.B, Design Codes, Design Cri-teria and Load Combinations - Lacrosse Boiling Water Reactor. III-7.D 4/13/82 Letter from D. M. Crutchfie.ld (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-7.D, Containment Structural Integ-rity Test - Lacrosse Boiling Water Reactor. III-8.A 2/22/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-8.A, Loose Parts Monitoring and Core Barrel Vibration Program - Lacrosse Boiling Water Reacter. III-8.C 12/15/80 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-8.C - Irradiation Damage, Use of Sensitized Stainless Steel and Fatigue Resistance. III-10.A 9/22/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-10.A, Thermal-Overload Protec-tion for Motors of Motor-0perated Valves, Safety Evalua-tion Report for Lacrosse. IV-1.A 4/19/79 Letter from D. L. Ziemann (NRC) to F. Linder (DPC), I
Subject:
SEP Topic IV-1.A, Operation of All Loops in Service. IV-2 9/10/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topics IV-2, Reactivity Control System Design and Protection Against Single Failures, and XV-8, Control Rod Misoperation - Lacrosse. l l La Crosse SEP E-3 l
SEP [ Topic No. Date Reference V-5 7/19/82 ' Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic V-5, Reactor Coolant Pressure Bound-l ary Leakage Detection - Lacrosse Boiling Water Reactor. V-6 3/5/80 Letter from D. L. Ziemann (NRC) to F. Linder (DPC),
Subject:
Completion of SEP Topic V-6, Reactor Vessel Integrity - Lacrosse Boiling Water Reactor. V-10.A 1/7/80 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), !
Subject:
Lacrosse - SEP Topic V-10.A, Residual Heat Removal System. Heat Exchanger. Tube Failures. V-10.B 10/7/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topics V-10.8, RHR System Reliability; j V-11.B, RHR Interlock Requirements; and VII-3, Systems Required for safe shytdown (Safe shutdown systems) Report) { - Lacrosse Boiling Water Reactor (LAC 8WR). V-11.A 2/22/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), i
Subject:
SEP Topic V-11.A, Isolation of High and Low Pressure Systems Revised Safety Evaluation - Lacrosse. V-11.B 10/7/82 See reference for Topic V-10.B. 3/4/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic V-11.B, RHR Interlock Requirements - Safety Evaluation for Lacrosse.
- V-12.A 9/22/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic V-12.A - Water Purity of Boiling Water Reactor Primary Coolant - Lacrosse Boiling Water Reactor. l VI-1 10/14/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), I
Subject:
SEP Topic VI-1, Organic Materials and Post-Accident Chemistry - Lacrosse Plant. VI-2.0 8/27/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Systematic Evaluation Program (SEP) for the & Lacrosse Boiling Water Reactor - Evaluation Report on Topics VI-2.D and VI-3. VI-3 8/27/82 See reference for Topic VI-2.D. l VI-4 12/9/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), i
Subject:
SEP Topic VI-4, Contairiment Isolation System - Lacrosse Boiling Water Reactor. j l La Crosse SEP E-4 l L- - - . __ _
SEP Topic No. Date Reference VI-4 1/5/80 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VI-4, Override of Containment Purge Isolation am.: Other ESF Actuation Signals (Lacrosse). VI-6 8/24/82 Letter frorr, I,. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Containment Leak Testing - Lacrosse Boiling Water Reactor (LACBWR). VI-7.A.3 1/5/83 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VI-7.A.3, ECCS Actuetion System Final Safety Evaluation for the Lacrosse Boiling Water Reactor. VI-7.C 3/13/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topics VI-7.C, ECCS Single Failure Criterion and Requirements for Locking Out Power to Valves, and VI-7.C.2, Failure Mode Analysis (Lacrosse). VI-7.C.1 9/21/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VI-7.C.1, Appendix K - Electrical Instrumentation and Control (EI&C) Re-Reviews - Lacrosse. VI-7.C.2 3/13/81 See reference for Topic VI-7.C. VI-7.D 8/17/78 Letter from D. G. Eisenhut (NRC) to J. P. Madgett (DPC),
Subject:
Evaluation of Eight SEP Topics. VI-10.A 9/20/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VI-10.A, Testing of Reactor Trip Sys-tem and Engineered Safety Features, Including Response-Time Testing, Final Safety Evaluation Report for the Lacrosse Boiling Water Reactor. VII-1.A 3/9/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VII-1.A, Isolation of Reactor Protec-tion System From Non-Safety Systems, Including Qualifica-tion of Isolation Devices, Draft Safety Evaluation for Lacrosse. 9 VII-1.B 8/17/78 See reference for Topic VI-7.D. VII-2 3/11/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VII-2, Engineered Safety Features System Control Logic and Design, Draft Safety Evaluation Report for Lacrosse Boiling Water Reactor. VII-3 10/7/82 See reference for Topic V-10.B. La Crosse SEP E-5
SEP Topic No. Date Reference VII-3 1/4/83 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic III-1, Classification of Structures, Systems and Components, and VII-3, Systems Required for Safe Shutdown - Lacrosse Boiling Water Reactor. VII-6 9/21/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VII-6, Frequency Decay Safety Evalua-tion for Lacrosse. VIII-1.A 10/14/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Lacrosse Boiling Water Reactor (LACBWR) (1) Degraded Grid Voltage Protection; and (2) SEP Topic VIII-1. A, Potential Equipment Failures Associated With Degraded Grid Voltage. VIII-2 12/18/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VIII-2, Onsite Emergency Power Sys-tems - Diesel Generator, Safety Evaluation Report for Lacrosse. VIII-3.A 6/5/79 Letter from D. L. Ziemann (NRC) to F. Linder (DPC),
Subject:
Topic VIII-3. A, Station Battery Test Requirement. VIII-3.8 8/28/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VIII-3.B, DC Power System Bus Volt-age Monitoring and Annunciation, Safety Evaluation for Lacrosse. VIII-4 9/9/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic VIII-4, Electrical Penetrations of Reactor Containment, Safety Evaluation Report for Lacrosse. IX-1 10/26/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic IX-1, Fuel Storage - Lacrosse Boiling Water Reactor. IX-3 7/20/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC), I
Subject:
Evaluation Report of SEP Topic IX-3, Station i Service and Cooling Water Systems - Lacrosse Boiling l l Water Reactor. l IX-5 1/12/83 Letter from F. Linder (DPC) to D. M. Crutchfield (NRC),
Subject:
Lacrosse Boiling Water Reactor - SEP Topic IX-5, i Ventilation Systems. l l I l La Crosse SEP E-6
SEP Topic No. Date Reference _. XIII-2 12/14/82 Letter from D. M.,Crutchfield (NRC) to F. Linder (DPC),
Subject:
Lacrosse - Approval of Physical Security and Safeguards Contingency Plan Revisions. XV-1 9/29/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic XV-1, Decrease in Feedwater Tempera-ture, Increase in Feedwater Flow, Increase in Steam Flow
- Lacrosse Boiling Water Reactor.
XV-3 11/13/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topics XV-3, Loss of External Load, Turbine Trip, Loss of Condenser Vacuum, Closure of Main Steam i Isolation Valve, Steam Pressure Regulator Failure (Closed).
, XV-4 11/3/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
I
Subject:
SEP Topic XV-4, Loss of Non-Emergency AC Power to the Station Auxiliaries. XV-5 8/24/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic XV-5, Loss of Normal Feedwater Flow - La Crosse Boiling Water Reactor (LACBWR). XV-7 8/6/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic XV-7, Loss of Forced Coolant Flow, Reactor Coolant Pump Rotor Seizure, Reactor Coolant Pump Shaft Break - Lacrosse Boiling Water Reactor (LACBWR). XV-8 9/10/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topics IV-2, Reactivity Control Sytem Design and Protection Against Single Failures, and XV-8, Control Rod Misoperation - Lacrosse. XV-9 10/12/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic XV-9, Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature - Lacrosse Boiling Water Reactor (LACBWR). 1 XV-11 4/5/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Safety Evaluation Reports for SEP Topics XV-8, XV-11, and XV-13 (Systems) - Lacrosse Boiling Water Reactor. XV-13 4/5/82 See reference for Topic VI-7.D. La Crosse SEP E-7
SEP Topic No. Date Reference XV-13 7/20/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Lacrosse - SEP Topic XV-13, Spectrum of Rod Drop Accidents. . XV-14 8/6/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Lacrosse - SEP Trmic XV-14 Inadvertent Opera-tion of ECCS That Increasts Reactor Coolant Inventory. XV-15 9/21/81 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
Lacrosse - SEP Topic XV-15, Inadvertent Open . ing of a PWR Pressurizer Safety / Relief Valve or a BWR Safety / Relief Valve. XV-16 10/14/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic XV-16, Radiological Consequences of Failure of Small Lines Carrying Primary Coolant Outside Containment - Lacrosse. XV-18 8/6/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic XV-18, Radiological Consequences of l Main Steam Line Failure Outside Containment - Lacrosse. XV-19 10/14/82 Letter from D. M. Crutchfield (NRC) to F. Linder (OPC),
Subject:
SEP Topic XV-19, Loss of Coolant Accidents Resulting From a Spectrum of Piping Breaks Within the Reactor Coolant Pressure Boundary (Radiological) - Lacrosse. 10/29/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic XV-19, Loss of Coolant Accidents Resulting From Spectrum of Postulated Piping Breaks Within the Reactor Coolant Pressure Boundary - Lacrosse Boiling Water Reactor. l XV-20 10/14/82 Letter from D. M. Crutchfield (NRC) to F. Linder (DPC),
Subject:
SEP Topic XV-20, Radiological Consequences of Fuel Damaging Accidents - Lacrosse. XVII 8/17/78 See reference for Topic VI-7.D. l La Crosse SEP E-8 L -- -
APPENDIX F REVIEW 0F OPERATING EXPERIENCE FOR LA CROSSE BOILING WATER REACTOR T c La Crosse SEP
i NSIC-205 l Contract No. W-7405-eng-26 ' Nuclear Safety Information Center Engineering Technology Division REVIEW OF THE OPERATING EXPERIENCE HISTORY OF LACROSSE BOILING WATER REACIOR THROUGR 1981 FOR TBE NU(LEAR REGULA1 DRY COMMISSION'S SYSTEMATIC EVALUATION PROGRAM Work performed by R. H. Guymon, ORNL/NSIC ~ K. H. Harrington, JBF Associates, Inc. ' C. A. Kukielka, SAI-Gak Ridge M. D. Muhlheim, JBF Associates, Inc. G. T. Mays, ORNL/NSIC April 1983 Prepared for the U.S. Nuclear Regulatory Commission Office of Nuclesr Reactor Regulation Under Interagency Agreement DOE 40-544-75 L Prepared by the OAK RIDGE NATIONAL LABORATURY Oak Ridge, Tenne ssee 37830 operated by UNION CARBIDE CORPORATION for the DEPARTMENT OF ENERGY F-iii
CONTENTS
.P_ast LIST OF TABLES .................................................. F-viii LIST OF FIGURES ................................................. F-ix EXECUTIVE SUIDIARY ............................................... F-zi a
- 1. SCOPE OF REVIEW ............................................. F-1 1.1 Availability and Capacity Factors ...................... F-1 1.2 Review of Forced Shutdowns and Power Reductions ........ F-2 1.3 Review of Reportable Events ............................ F-3 1.4 Events of Environmental Importance and Releases of Radioactivity .......................................... F-4 1.5 Evaluation of Operating Experience ..................... F-4
- 2. SOURCES OF INFORMATION ...................................... F-19 2.1 Availability and Capacity Factors ...................... F-19 2.2 Forced Reactor Shutdowns and Power Reductions .......... F-19 2.3 Reportable Events ...................................... F-19 2.4 Environmental Events and Releases of Radioactivity ..... F-20
- 3. IEGNICAL APPROAG POR EVALUATIONS OF ....................... F-21 OPERATING HISTORY i
3.1 Significant Shutdowns and Power Reductions ............. F-22 I 3.1.1 Criteria for significant shutdowns and power reductions ............................ F-22 3.1.2 Use of criteria for determining significant shutdowns and power reductions .................. F-22 3.1.3 Non-DBE shutdown and power reduction Categorization .................................. F-22 3.2 Significant Reportable Events .......................... F-23 3.2.1 Criteria for significant reportable events ...... F-23 3.2.2 Use'of criteria for determining significant reportable events ............................... F-23 l 3.2.3 Reportable events that were not significant ..... F-23 l
- 4. OPERATING EXPERIENCE REVIEW OF LACROSSE ..................... F-31 4.1 Summary of Operational Events of Safety Importance ..... F-31 4.2 General Plant De scription .............................. F-31 4.3 Availability and Capacity Factors ...................... F-31 F-v
2111 4.4 Forced Reactor Shutdown and Forced Power Recuctions .... F-33 i 4.4.1 Review of forced reactor shutdowns and forced power reductions ................................ F-33 4.4.1.1 Yearly summaries ....................... F-33 4.4.1.2 Systems involved ....................... F-41 4.4.1.3 Causes ................................. F-41 4.4.1.4 Non-design basis events ................ F-41 , 4.4.2 Review of design basis events ................... F-41 4.4.2.1 DBE category 1 - increased in heat removal ................................ F-41 4.4.2.2 DBE category 2 - decrease in heat removal ................................ F-41 4.4.2.3 DBE category 3 - reactor coolant system flow rate ....................... F-44 4.4.2.4 DBE category 4 - reactivity and power distribution anomalies ................. F-44 4.4.2.5 DBE category 7 - radioactive release frce a subsystem or component .......... F-44 i 4.4.3 Trends and safety implications of forced reac-tor shutdowns and forced power reductions ....... F-44 4.4.3.1 Forced circulating pumps and seal in-jection system ......................... F-44 4.4.3.2 Control rod drives oil system leaks .... F-45 4.4.3.3 Abnormal fuel degradation .............. F-45 4.5 Reportable Events ...................................... F-46 4.5.1 Review of reportable events from 1967 to 1981 ............................................ F-46 4.5.1.1 Yearly summaries ....................... F-46 4.5.1.2 Systems involved ....................... F-55 4.5.1.2.1 Reactor systems ............. F-55 4.5.1.2.2 Reactor coolant systems ..... F-57 4.5.1.2.3 Reactor trip system ......... F-59 t 4.5.1.2.4 Reactor containment sy s-tems ........................ F-60 4.5.1.2.5 Emergency power systems ..... F-60 4.5.2.2.6 Steam and power conversion systems ..................... F-62 4.5.1.3 Causes ................................. F-63 4.5.1.4 Events of environmental importance ..... F-63 4.5.2 Review of significant events .................... F-67 4.5.2.1 Loss of offsite power ................. F-67 4 .'5 . 2 .1.1 Loss of offsite power in March 1969 ................. F-7 0 4.5.2.1.2 Loss of offsite power on January 20, 1971 ........... F-7 0 4.5.2.1.3 Loss of offsite power on March 24, 1971 ............. F-7 0 F-vi l l
.Pggg 4.5.2.1.4 Loss of offsite power on August 17, 1972 ............ F-71 4.5.2.1.5 Loss of offsite power on Septembe r 17, 1974 ......... F-71 4.5.2.1.6 Loss of offsite power on October 23, 1974 ........... F-71 4.5.2.1.7 Loss of offsite power on May 12, 1975 ............... F-72 4.5.2.1.8 Loss of offsite power on July 5,1975 ............... F-7 2 4.5.2.1.9 Loss of offsite power on February 1,1981 ........... F-72 4.5.2.1.10 Loss of offsite power on December 23, 1981 ......... F-7 2 4.5.2.2 Main steam bypass valve malfunction, reactor core uncovered ................ F-7 3 4.5.2.3 Slow main steam isolation valve closure time resnited in low water level ................................. F-7 3 4.5.2.4 Setpoint drif t on three main steam relief valves ......................... F-74 4.5.2.5 Turbine governor malfunction with a high cooldown rate .................... F-74 4.5.2.6 Loss of containment integrity ......... F-74 4.5.3 Trends and safety implications of reportable events .......................................... F-7 5 4.5.3.1 Fuel leakage and bowing ................ F-7 5 4.5.3.2 Control rod drive problems ............. F-76 4.5.3.3 Improperly scaled power range in-struments .............................. F-7 6 4.5.3.4 Losses of offsite power ................ F-76 4.5.3.5 Overcooling transients ................. F-77 4.6 Evaluation of Operating Experience ..................... F-78 REFERENCES ...................................................... F-79 Appendix A.1 FORCED SHUTDOWN AND POWER REDUCTION TABLES ........ F-85 Appendix A.2 REPORTABLE EVENT CODING SHEE'IS .................... F-139 l
l 6 F-vii
a m . ._ _ _ . _ _ _ __A. l LIST OF TABLES Noaber fa,ga 1.1 Codes for causes of forced shutdown or power reduc-tion and methods of shutdown .......................... F-5 1.2 Codes for systems involved with the forced shutdown, power reduction, or reportable event .. . . . . . . . . . . . . . . . . F-6 1.3 Components involved with the forced shutdown or power reduction ............................................. F-9 1.4 Codes for data collected on plant status, component status, and cause of reportable events . . . . . . . . . . . . . . . . F-11 1.5 Codes for equipment and instruments involved in re-portable events ....................................... F-12 1.6 Code s used for reportable events abnormal ! Conditions ............................................ F-13 3.1 Initiating event descriptions for DBEs as listed in Standard Revies Plant, Chap.15 (revision 3) . . . . . .. . . . F-24 3.2 NSIC event categories for non-DBE shutdowns . . . . . . . . . . . F-26 i 3.3 Reportable event criteria significant . . . . . . . . . . . . . . . F-28 l
- 3.4 Reportable event criteria conditionally signficant . . F-29 4.1 Lacrosse availability and capacity factors . . . . . . . . . . . . F-32 4.2 Lacrosse forced shutdown summary ...................... F-34 4.3 Lacrosso forced power reduction summary . . . . . . . . . . . . . . . F-3 5 4.4 Lacrosse non-DBE initiating event sammary . . . . . . . . . . . . . F-42 l 4.5 Lacrosse DBE initiating event sammary . . . . . . . . . . . . . . . . . F-43 4.6 Summary of systems involved in reportable events at Lacrosse ........................................... F-56 4.7 Causes of reportable events by year at Lacrosse . . . . . . . F-64 4.8 Summary of radiation releases at Lacrosse . . . . . . . . . . . . . F-65 4.9 Events of environmental significant at Lacrosse . . . . . . . F-66 4.10 Summary of significant events at Lacrosse . . . .. . . . . . . . . F-68 i
4.11 Tabulation of reports categorized as significant l at Lacrosse ........................................... F-69 1 1 F-vitt L l
LIST OF FIGURES Figure _P_g.gg 4.1 Ntumber of reported events per year at Lacrosse ........ F-47 F-ix
i REVIEW OF THE OPERATING HISTORY OF j MILLSTONE UNIT 1 THROUGH 1981 EXECUTIVE
SUMMARY
The Systematic Evaluation Program Branch of the Nuclear Regulatory Commission (NRC) is conducting the Systematic Evaluation Program (SEP) for the purpose of determining the safety margins of the design and operation of ten of the older operating commercial nuclear power plants in the United States. These ten plants are being reevaluated in terms of present NRC licensing requirements and regulations. Thus, the SEP is intended:
- 1. to establish documentation that shows how these ten plants compare with current acceptance criteria and guidelines on significant safety issues and to provide a technical rationale for acceptable departures f rom these critoria and guidelines,
- 2. to provide the capability for making integrated and balanced deci-sions with respect to any required backfitting, and
- 3. to provide for the early identification sad resolution of any poten-tial safety deficiency.
The SEP evaluates specific safety topics based on an integrated review of the overall ability of a plant to respond to certain design-basis events including normal operation, transients, and postulated accidents. As part of the SEP, the NRC contracted with the Oak Ridge National Laboratory to perform operating history reviews. These reviews are in- I tended to augment the SEP's saf ety topic review and to aid in the deter-mination of priorities for required backfitting during the integrated a s se s sment. Each review includes collection and evaluation of availabil-ity and capacity factors, forced shutdowns, forced power reductions, r e-portable events, environmental events, and radiological release events. This summary presents the results from the review of the Lacrosse Boiling Water Reactor, which is an Allis-Chalmers-designed reactor, owned and operated by Dairyland Power Cooperative. The plant is located on the Mississippi River at Genoa, Wisconsin. The reactor has a licensed thermal power of 165 MWt and a design electric rating of 50 MWo. Lacrosse achieved initial criticality on July 11, 1967 and began commercial opera-tion on November 1,1969. From 1970 through 1981, the cumulative reactor availability factor at Lacrosse was 66.7% and the canulative unit capacity factor was 46.7%. Both of these are below average for commercial nuclear power plants. Since 1970, the yearly availability has always been above 50% except for two years,1976 and 1977. In 1976, the unit shut down for more than five ' months for modifications to bring the f acility into compliance with the NRC's interim criteria for emergency core cooling of light water reactors. In 1977, the May refueling outage was extended to tho' end of the year as a result of abnormal fuel degradation and the associated evaluation. The operating history review focused -on data evaluation which was divided into two sepsonts: (1) evaluation of forced shutdbwns and power F-xi I
reductions and (2) evaluation of reportable events. Design basis events (DBEs), which are defined in the NRC's Standard Review Plan,1 are f ailures that-initiate system transients and challenge engineered safety features. In the _ forced shutdown and power reduction sessent, the review identified i DBEs and recurring events that might indicate a potential operating con-cern. In the reportable event segment which included environmental events and radiological release events, the review identified significant events and recurring events that might indicate a potential operating concern. Significant events were either DBEs or events with a loss of engineered safety function. Forced Shutdowns and Power Reductions Of the 315 forced shutdowns and power reductions be tween 1967 and 1981, sixty-two were DBEs of one of the following eight types:
- 1. single or multiple reactor recirculation pump trip (35),
- 2. increased feedwater flow (8),
- 3. decreased feedwater flow (6),
- 4. loss of electric load (4),
- 5. inadvertent main steam isolation valve (MSIV) closure (4),
- 6. turbine trip (3),
- 7. control rod maloperation (1), and
- 8. radioactivity release (1).
Forty-four of the sixty-two DBEs were the result of equipment f ailure. Human error caused the remaining eighteen events. In all DBEs, the ensi-neered safety features operated properly to mitigate the transient. The number of DBEs per year at Lacrosse has averaged four since 4 startup in 1967. However, the maj ority of DBEs occurred prior to 1974. Since then the yearly average has been just over two DBEs per year. The large st number of events in a single year (11) occurred in 1968 and 1973. The frequency of occurrence of each type of DBE is consistent with the I experience of other plants except the reactor recirculation pump trips. j Thirty-three of the thirty-five trips were caused by seal inj ection system l malfunctions. These malfunctions stem from several sources: instrumenta- l tion, seal flow / pressure, vibration, and operator interaction. Several ' causes have been identified and solved but recirculation pump trips con- l tinue to dominate the number of DBEs (8 of 18 since 1974). l t Reportable Events I l In the reportable event segment of the operating history review of Lacrosse, 246 events were reviewed. There were no upward or downward I trends in the yearly total number of events. The peak year was 1970 with thirty events reported. The causes of reportable events'have been either l equipment / weather related causes (5$%) and human error (45%). Human errer include s administrative, design, fabrication, installa tion, maintenance, and operator error. There is no apparent trend on the causes of reported
- events.
l F-xii l _- . - - - _ . - _. . - _ _
l l l Of the 246 reported events, fif teen are considered significant: !
- 1. loss of of f site power (10),
- 2. main steam bypass valve malfunction, reactor core uncovered (1),
- 3. slow main steam isolation valve closure time (1),
- 4. setpoint drif t in three main steam relief valves (1),
- 5. turbine governor malfunction with high cooldown rate (1), and
- 6. loss of containment integrity (1). ,
The causes of significant events at Lacrosse are split about equally be-tween equipment f ailure that caused eight events and human error that caused seven. The frequency of -occurrence of significant events has been relatively constant with peaks of three events in 1974 and 1981. The loss of off site power was a dominant contributor to the signif-icant events. The unit has experienced ten losses. Only one offsite tie-line exists and therefore every loss of of f site power is a complete loss. From the 69 kv switchyard, power can be fed to the plant through two sep-arate transformers (main and reserve auxiliary). Both of these transform-ers are capable of supplying power to the 2400 V and 480 V buses. How- l ever, several one event f ailure modes exist that have the potential to cause a loss of offsite power. Human error was the largest contributor to this f ailure mode (four maintenance errors, one administrative, and one operator). The large number of losses of of fsite power place an- added importance on the reliability of the diesel ' generators. The diesel generators must start, run for the entire mission, and supply the correct voltage. Prior to 1976, only one diesel generator was available. During this time, La-Crosse experienced eight losses of offsite power. On one of these 8 occa-sions (September 17, 1974) the lone diesel generator f ailed to start. Since the installation of the second diesel generator, in 1976, only two losses of offsite power have occurred and both diesel generators were ; available. Af ter the second diesel generator was installed there were only five occasions, not related to loss of offsite power, when one of the diesel generators was' unavailable. Recurrina Events The following six types of recurring events were noted during the two segments of the operating history review:
- 1. losses of off site power,
- 2. recirculation pump seal inj ection f ailures,
- 3. overcooling transients,
- 4. control rot problems,
- 5. fuel leaks and fuel bowing, and
- 6. improperly scaled power range instruments.
The problems with loss of of f site power and recirculation pump seal inj ec-tion were discussed previously. F-xiii
~_ --
Lacrosse experienced four incidents of excessive cooldown rates throughout its operating history. Any large cooldown rate is of concern since a thermal stress is placed on the reactor vessel and the resulting fatigue is a cumulative effect. The first and most significant cooldown j occurred in 1970 The cooldown rate was equivalent to 825'F/h. Three ! other blowdowns that resulted in excessive cooldown rates occurred in 1972, 1979, and 1980 These cooldown rates ranged from 120 *F/h to 423*F/h. The control rods.and control rod drives were involved in twenty-nine f ailure s. Nine of these f ailures involved f ailure of the control rod to scram while on seven occasions a singla control rod became j ammed. On < four occasions, installation errors were held accountable for the control l rod drive f ailures. A spare CED roller was installed backwards, a clutch plate was bent, a snap ring was dropped into a CRD gear reducer and sn upper brake ring was installed incorrectly. An operator error a' eo oc - j curred with the CRDs when, during power escalation, an operator incor-rectly withdrew the wrong control rod. In addition, considerable diffi-culty was encountered in early operation with leaks of the 'O' rings on 4 the control rod accanulator pistons. Af ter consultation with the ring manuf acturer and some onsite testing, the original butyl rings were re-placed with bronze-impregnated teflon rings. During the October 1969 to May 1970 outage several fuel pins were found to be bowed. TWo f actors contributed to the fuel pin bowing, dirst, the shroud can locking rings were lef t unlocked during power opera-tion. Twisting and stressing of the fuel elements resulted from the in-properly seated fuel pins. Secondly, high transverse power gradients de-veloped in the fuel pins causing large differences in the axial thermal expansion of the fuel pins in an element. In addition to this early fuel i i bowing, Lacrosse experienced several fuel leaks, commencing in 1972. The type of fuel rods that leaked were manuf actured by Allis-Chalmers and had stainless steel cladding with each rod containing uranium-dioxide fuel pellets housed in a closed hollow tube of stainless steel. To improve fuel integrity, new opeating restrictions regulated the rate of control rod movement, rate of power increase, and the maximum allowable burnup limit for fuel assemblies. A failed assembly discovered in April 1982 was one of two remaining Allis-Chalmers assemblies in use. The rest of the l fuel is of the upgraded Exxon design which has shown no degradation.8 In the first five years of operation, the reactor operator f ailed to take corrective action with the power range instruments on fourteen occa-sions. On nine occasions, the power range instruments were downscaled rather than upscaled. On other occasions, the operator f ailed to upscale (three times), downscaled the wrong instrument channel (once), and down-scaled the instrument channel one decade too far (once). Operator train- :
- ing was intensified and since 1971, fewer instance s operator errors in- !
volving the improper scaling of the power range instruments have occurred. 1 l Conclusions For this analysis of the operating history of Lacrosse, 316 shutdowns and power reductions were reviewed along with 246 reportable events and l i l F-xiv l l 1 \ __ _ _ _ _ . -__ -_ . - - a
other miscellaneous documentation concerning the operation of the Lacrosse Boiling Water Reactor. The objective was to identify those areas of plant operation that have compromised plant safety. This review identified two f ailure types that should be of continued concern: loss of of fsite power and excessive cooldown rates. Lacrosse is more highly susceptible to lo'ases of off site power than other SEP plants because of its single tie during normal operation. How-ever, the low number of diesel generator f ailures (six in fif teen years) coupled with the reserve of f site tie breakers actuating automatically, there exists at Lacrosse a higher probability of supplying emergency pcwe r. During the ten losses of offsite power, the diesel generator f ailed to supply emergency loads only once. The cause of this failure was corrected in 1974 and a second diesel was added is 1976. Excessive cooldown rates are of concern because of the thermal stress placed upon the reactor vessel and coolant piping. It is additionally important because the resulting effect of f atigue is canulative. The num-ber of excessive cooldowns experienced at Lacrosse is greater than the number of similar events found in other SEP operational reviews. Because of the cumulative effect and the increased recurrence rate, the problem of excessive cooldown rates should also be of continued concern. T l l F-xv
References
- 1. Nuclear Regulatory Commission, " Accident Analysis for the Review of Safety Analysis Reports for Nuclear Power Plants," Chap.15 of Stan-danf Review Plan, NURBG-0800 (July 1981).
- 2. Letter from Frank Linder, LAGWR General Manager to James G. Kappler, Regional Director, U.S. Nuclear Regulatory Commission, RO 50-409/
82-06, August 10, 1982. 1 l l I F-xvi l
i REVIEW OF THE OPERATING EIPERIENG HISTORY OF LA M OSSE IBROUGH 1981 FOR THE NUG. EAR REGULATORY COMMISSION'S SYSTEMATIC EVALUATION PROGRAM
- 1. S(DPE OF REVIEW The assessment of the operating experience review for Lacrosse cov-ered the time from initial criticality through 1981. The data collection and evaluation included the following aspects of operation: availability and capacity factors, forced shutdowns and power reductions, reportable events, events of environmental importance and radioactivity releases, and evaluation of the operating experience in total. Tables at the end of Chap.1 show the codes assigned to operational aspects of forced shut-downs, power reductions, and reportable events. These codes are used in the reporting of data collected during the review of operating experience.
1.1 Availability and Canacity Factors Both reactor and unit availability factors were compiled for all years. Starting with 1974, th, unit capacity factors using the design electrical rating (DER) in not megawatts (electric) and the maximum de-pendable capacity (MDC) in not megawatts (electric) were compiled as well.' Data for the capacity f actors were not avallanle f rom earlier years. The two availability and two capacity factors are defined as follows:
- 3. reactor availability =
hours reactor critical + reactor reserve shutdown hours period hours
- 2. unit availability =
hours generator on line + unit reserve shutdown hours period hours not electrical energy generated
- 3. unit capacity (DER) = period hours x DER not not electrical energy generated
- 4. unit capacity (MDC) = period hours x MDC not F-1
_= - . . _. _ _ _ . - - -. - - Reserve shutdown hours are the enounts of time the reactor is not critical or the unit is shutdown for administrative or other similar reasons when operation could have been continued.
, 1.2 Review of Forced Shutdowns and Power Reductions Forced shutdowns and. power reductions were reviewed, and da ta were collected on each incident. Scheduled shutdowns for refueling and main-tenance were not included in the review. However, if a utility had a re- ,
- fueling outage scheduled, the plant experienced a shutdown as a result of an abnormal event prior to the scheduled refueling, the utility reported that the refueling was being rescheduled to coincide with the current shutdown, and the utility reported the cause of the shutdown as refueling, then this shutdown was considered as forced. Only that portion of the outage time concerned with the abnormal event, not the refueling time, was l included in the compilations.
The power reductions were included to provide information and details that may have been associated with a previous or subsequent shutdown. The power reductions are included in the proper chronological sequence with the shutdowns in the data tables for the forced shutdowns and power reduc-tions (see Appendize s). The following data were compiled annually for the forced shutdowns and power reductions:
- 1. date of occurrence,
- 2. duration (hours),
- 3. power level (percent),
- 4. notation of whether the shutdowns were also reportable events (e.g.,
a licensee event report (LER) or abnormal occurrence report (AOR)] ,
- 5. summary description of events associated with the forced shutdown or power reduction,
- 6. cause of shutdown (Table 1.1),
- 7. method of shutdown (Table 1.1),
- 8. system taken from NURBG-0161 (Ref.1) that was directly involved with the shutdown or power reduction (Table 1.2),
i 9. component directly involved with the shutdown or power reduction (Table 1.3), and
- 10. categorization of the shutdown or power reduction.
i l Each shutdown or power reduction was placed in one of two sets of signif-icance ca tegories. The shutdowns and power reductions were first evala-ated against criteria for design basis events (DBEs) as described in Chap. a 15 of the Standard Review Plan.8 If the shutdown or power reduction could not be categorized as a design-basis initiating event, then it was placed in one of a series of Nuclear Safety Information Center (NSIC) categories. j For further discussions of the two sets of significance categories, use of the categories, and a listing of them, see Sect. 3.1. l The listings for the cause, shutdown method, system involved, and l component involved along with their respective codes are those used in the NUREG-0020 series: (" Gray Books") on shutdowns. Note that the information ' listed under the " System involved" column in the data tables in the appen-dizes indicates (1) a general classification of systems (fully written F-2
- -. - - . - - . _. . - - . = . - _ ._. - -
l l 1 out) and (2) a specific system, which is coded with two letters, within the general classification. 1.3 Review of Resortable Events The operating events as reported in LERs and LER predecessors (e.g., abnormal occurrence reports (A0s*), unusual event reports, reportable occurrences (R0s)] were reviewed. These types of reportable events were retrieved f rom the NSIC computer file. Approximately six years ago, oper-ating experience information for operating nuclear power plants was input to the NSIC file for the period of time before LERs were reviewed. Any documents that contained LER-type information (such as equipment f ailures or abnormal events) were coded or indexed so that they could be retrieved in the same manner as an LER. Primarily, this involved various types of operating reports and general correspondence for the late 1960s and early 1970s. The following information was recorded for each reportable event reviewed:
- 1. LER number or other means of identification of report type,
- 2. NSIC accession number (a unique identification number assigned to each document entered into the NSIC computer file),
- 3. date of the event,
- 4. date of the report or letter transmitting the event description,
- 5. status of the plant at the time of the occurrence (Table 1.4),
- 6. system involved with the reportable event (Table 1.2),
- 7. type of equipment involved with the reportable event (Table 1.5),
- 8. type of instrument involved with the reportable event (Table 1.5),
- 9. status of the component (equipment) at the time of the occurrence (Table 1.4),
- 10. abnormal condition associated with the reportable event (e . g. ,
corrosion, vibration, leak) (Table 1.6),
- 11. cause of the reportable event (Table 1.4), and
- 12. significance of the reportable event.
As a step in the evaluation process, each reportable event was screened using the criteria further discussed in Sect. 3.2. Note that in the tables of reportable events in Appendix A for La-Crosse, comments and/or details on the events were included. [ *The A0 designation used by some utilities f or identifying opera-tional events during a particular time frame is n21 to be confused with those safety-significant event,s listed in the Resort to Conaress on Abnor-mal Occurrences (NUREG-0090 series) which also uses the A0 designation. F-3
1.4 Events of Environmental Y==ortance and Releases of Radioactivity Any significant or recurring environmental problems were summarized i based on the review of forced shutdowns, power reductions, reportable events (environmental LERs), and operating reports. Routine radioactivity releases were tabulated as well, and releases where limits were exceeded were reviewed and are discussed in Sect. 4.5.1.4. 1.5 Evaluation of Goeratina Exnerience The operating history of the plants was evaluated base,d on a review that involved screening, categorizing, and compiling data. Judgments and conclusions were made regarding safety problems, operations, trends (re-curring problems), or potential safety concerns. Events were analyzed to - determine their safety significance from the information provided through the various operating reports and the review process. The final safety analysis reports provided specific plant and equipment details when ' ne ce s sa ry. t i F-4 s
i Table 1.1. Codes for causes of forced shutdown or power reduction and methods of shutdown Causes A Equipment f ailure B Maintenance or testing C Refueling D Regulatory restriction E Operator training and license exams < F Administrative G Operational error H Other Methods 1 Manual 2 Manual scram 3 Automatic scram 4 Continuation 5 Load reduction 9 Other F-5
Tsble 1.2. Codes for systems involved with the forced shutdown, power reduction, or reportable event Syatom Code Reactor RI Reactor vessel internals RA Reactivity control systems RB Reactor core RC Reactor coolant and connected systems CX Reactor vessels and appurtenances CA Coolant recirculation systems and controls CB Main steam systems and controls CC Main steam isolation systems and controis CD Reactor core isolation cooling systems and controls CE Residual heat removal systems and controls CF Reactor coolant cleanup systems and controls OG Feedwater systems and controls CE Reactor coolant pressure boundary leakage detection systems CI Other coolant subsystems and their controls CI
! Engineered safety features SX Reactor containment systems SA Containment heat removal systems and controls SB I
Containment air purification and cleanup systems and controls SC Containment isolation systems and controls SD Containment combustible control systems and controls SE Emergency core cooling systems and controls SF Core reflooding system SF-A Low pressure safety injection system and controls SF-B High pressure safety inj ection system and controls SF-C Core spray systet and controls SF-D Control room habitability systems and controls SG Other engineered safety feature systems and their controls SH Containment purge system and controls SH-A Containment spray system and controls SH-B Auxiliary feedwater system and controls SH-C Standby gas treatment systems and controls SH-D l Instrumentation and controls II l ! Reactor trip systems IA I l Engineered safety feature instrument systems IB l Systems required for safe shutdewn IC { j i Safety-related display instrumentation ID Other instrument systems required for safety IE Other instrument systems not required for safety IF l i F-6
t Table 1.2 (continued)
~
System Code Electric power systems EI Offsite power systems and controls EA AC onsite power systems and controls Eb-DC onsite power systems and controls 1BC' Onsite power systems and controls (composite ao and do). - ED , Emergency generator systems and controls EE Emergency lighting systems and controls 4 EF Other electric power systmas and controls EG Fuel storage and handling systems N FI New fuel storage f acilities FA Spent-fuel storage f acilities ' FB Spont-fuel pool cooling and cleanup systems and controls FC Fuel handling systems P0 Auxiliary water systems
~
WI Station service water systems and controls WA Cooling systems for reactor auxiliaries and controls WB Domineralized water makeup systems and controls WC . Potable and sanitary water systems and controls WD Ultimate heat sink facilities WE Condensate storage f acilities WF Other auxilisry water systems and controls WG Auxiliary proce ss systems PI Compressed air systems and controls PA Process sampling systems PB Chemical, volume control, and liquid poison systems and PC controls Failed-fuel detection systems PD Other auxiliary process systems and controls PE Other auxiliary systems - AI - Air conditioning, heating, cooling, and ventilation systems AA and controls Fire protection systems and controls AB Communication systems AC Other auxiliary systems and controls AD l Steam 'and power conversion systems - HI l - t Turbine generators and controls HA l ' Main steam supply systems and controls (other than-CC) HB Main condenser systems and controls HC Turbine gland sealing systems and controls HD Turbine bypass systems and controls HE l < i e l F-7
i -
- ,,.i.
i i _ Table 1.2 (continued)
)
System Code Cironisting water systems and controls HF , Condensate cleanup systems and controls HG Condensate and feedwater systems and controls (other than CE) HH steam generator blowdows systems and controls HI
-Other feature _s of steam sad power conversion systema (not HJ includid elsewhere) l
'Radioactire waste management systems ,,
MI Liquid radioactive waste management ;ifstems MA Gaseous radioactivs wasts management systems NB Process and effluent radiological monitoring systems MC Solid radioactive waste management systems MD Radiation protection systems BX Area monitoring systems BA
. Airborne radioactivity monitoring systems BB Other XI Not applicable ZZ
{ \ l l i F-8 l
4 Table 1.3. Components involved with the forced shutdown or power reduction Component type Including Accumulators Scram accumulators Safety inj ection tanks Surge tanks
- , Air dryers Annunciator modules Alarms Bells Buz zers Claxons Horns Gongs Sirens Batteries and chargers Chargers Dry cells Wet cells Storage cells Blowers Compressors Gas circulators Fans Ventilators Circuit closers /interruptors Circuit breakers l Contactors Controllers Starters Switches (other than sensors)
Switchgear Control rods Poison curtains Control rod drive mechanisms Domineralizers Ion exchangers Electrical conductors Bus Cable Wire Engines, internal combustion ' Butans engines f Diesel engines ( Gasoline engines Natural gas engines
- Propane engines Filters Strainers Screens Fuel elements Generators Inverters Heaters, electric l
F-9 l
Table 1.3 (continued) Component type Including Heat exchangers Condensers Coolers Evaporators Regenerative heat exchangers Steam generators Fan coil units Instrumentation and controls Mechanical function units Mechanical controllers Governors Gear boxes Varidrives Couplings Motors Electric motors Hydraulic motors Pneunatic (air) motors Servo motors Penetrations, primary containment air locks Pipes, fittings Pamps Recombiners Relays Shock suppressors and supports ! Transfonners Turbine s Steam turbine s Gas turbine s Hydro turbine s Valves Valves Dampers Valve operators Vessels, pressure Containment vessels Dry wells Pressure suppression Pressurizers I Reactor vessels ) F-10
l l Table 1.4. Codes for data collected on plant ( status, component status, and cause of l reportable events l Component Cause of reportable Code Plant status status event A Construction Maintenance Administrative error and repair E Operation Operation De sign error C Refueling Testing Fabrication error D Shutdown Inherent error E Installation error F Lightning G Maintenance error H Operation error I Weather i i F-ll
Table 1.5. Codes for equipment and instruments involved in reportable events Code Code Eauipment A Accumulator W Internal combustion engine B Air drier X Motor C Battery and charger Y Nozzle D Bearing Z Pipe and pipe fitting E Blower and dampers AA Power supply F Breaker BB Pressure vessel l G Cables and connectors CC Pressurizer l H Conde nser DD Pump I Control rod EE Recombiner J Control rod drive FF Seal K Cooling tower GG Shock absorber L Crane HH Solenoid M Demineralizer II Steam generator N Diesel generator JJ Storage container O Fa ste ner KK Support structure ! P Filter / screen LL Transformer Q Flange MM Tubing R Fuel element NN Turbine S Fuse 00 Valve T Generator PP Valve, check U Heat exchanger QQ Valve operator V Neater j Instrumentation A Alarm L Power range instrument B Amplifier M Pressure sensor - l C Electronic function unit N Radiation monitor D Failed fuel detection instrument O Recorder E Flow sensor P Relay F In-core instrument Q Seismic instrument G Indicator R Solid state device H Intermediate range instrument S Start-up range instrument I Level sensor T Switch J Me teorological instrument U Temperature sensor K Position instrument i ( j F-12
Table 1.6. Codes used for reportable events abnormal conditions l l i Mechanical AA Normal wear / aging /end of life: expected effect of normal usage AB Excessive wear / clearance: component (especially a moving component) experiences excessive wear or too much clearance or gap exists be-cause of overuse, lack of lubrication AC De terioration/ damage : component is no longer at an acceptable level of quality (e.g., high temperature causes rubber seals to chemically break down or deteriorate, insulation breaks down) AD Break / shear: structural component physically breaks apart (not when something " breaks down") AE Warp / bend / deformation: shape of component is physically distorted AF Collapse: tank or compartment has an external pressure exerted that results in deformation AG Seize / bind /jaa: component has inhibited movement caused by crud, foreign material, mechanical bonding, another component AH Excessive mechanical loads: mechanical load exceeds design limits AI Mechanical fatigue: f ailure due to repeated stress AJ Impact: the result of the force of one object striking another AK Improper lubrication: insuf ficient or incorrect lubrication AL Missing / loose: component is missing f rom its proper place or is loose or has unde sired f ree movement AM Wrong part: incorrect component installed in a piece of equipment AN Wrong material: incorrect material used during f abrication or in-stallation A0 Weld-related failure: f ailure caused by defective weld or located in the heat-af fected zone AP Vibration other than flow induced: vibration from any cause other than fluid flow AQ Crud buildup: buildup of foreign material such as dust, sticks, trash (not corrosion or boron precipitation) AR Corrosion / oxidation: unanticipated attach f t AS Dropped: component is dropped (include s control rod that is
" dropped" into core)
AT Leak, internal, within system: leak from one part of a system to another part of the same system AU Leak, internal, be tween systems: leak from one system to a different system ! AV Crack: defect in a component does not result in a leak through the wall F-13
--.-,,--,-----.--n - - - - .,
Table 1.6 (continued) l AN Leak, external: defect in a component results in a Isak from the system that is contained in an onsite building i AI Leak to environment: leak not resulting f rom a cracked or broken component AY Was opened / transfers open: component is/was opened by error or spur-iously opens AZ Was closed /transf erred closed: component is/was wrongly closed by error or spuriously closes BA Fails to open: component is in the closed state and f ails to open on I demand (e. g. , the circuit breaker " falls to open" when an overcur-rent occurs) BB Fails to close: component is in the open state and f ails to close on demand BC Ma1 position or maladj ustment: component is out of de sired position (e . g. , normally open valve is closed) or adjusted improperly (not for instrument drift or out of calibration) BD Failure to start / turn on: component f ails to start on demand BE Stopped /f ailed to continue to run: component fails to continue run-ning when it has previously started BF Trlpped: component automatically trips on or off (desired or unde-sired) (e . g. , the turbine tripped because of overspeed, the circuit breaker tripped because of overspeed, or the circuit breaker tripped because of overload) BG Deenergized/ power removed: component on system loses its driv'ing potential but not necessarily electrical power (e.g., (1) a fuse blows and there is no power to a sensor, and the sensor is deener-gized; (2.' a valve closes off the steam supply to a turbine, and the turbine has no driving power] BH Energized / power applied: component or system gains its driving po-tential but not necessarily electrical power (e.g., valve is opened allowing steam to turn a turbine) BI Unacceptable response time: component does not respond to a demand j within a desired time frame but does not otherwise f ail (e.g., a l diesel generator f ails to come to full speed within the time con- J straint) BJ High pressure: higher than normal or desired pressure exists in a ! component or system (does not include instrument misindications) l 1 i l F-14 1
i l Table 1.6 (continued) l BE Low pressure: lower than normal or desired pressure exists in a com-ponent or system (ign nql include instrument misindication) BL High temperature: component experiences a higher than normal or de-sired temperature BM Low temperature: component (or system) experiences a lower than nor-mal or de sired temperature , BN Freezing: fluid medium (e.g. , water) freezes in or on a camponent BO Excessive thermal cycling: frequent changes in temperature that could result in metal fatigue or cracking BP Unacceptable heatup/cooldown rate: heatup or cooldown rate exceeds limit s BQ Thermal transient: system experience s an unde sired or unstable thermal transient or thermal change BR Excessive number of pressure cycles: systma experience s an unde sired number of significant pressure changes (e.g., pressure pulses as from a positive displacement pump) BS High level / volume: higher than normal or desired level or volume exists (actual or potential) in a component, such as tank or samp, or area, such as auxiliary, building (not for instrument misindica-tion) BT Low level / volume: lower than normal or desired level or volume s exists in a component (not for instrument misindication)
- BU Abnormal concentration /pH: an abnormal (either high or low) concen-tration of a chemical or reagent exists in a fluid system or an ab-normal pH exists (does not include abnormal boron concentrations)
BV Abnormal boron concentration: process system control rod has an ab-normal boron concentration from burnup, dilution, or overaddition BW Overspeed: speed in excess of design limits BI Cladding f ailure: cladding of a component f ails (e.g. , the cladding
, of a fuel pellet is breached, and radioactive fuel leaks out)
BY Burning / maoking: component is on fire or smoking i BZ Engaged: component engages or meshes (this is not to be used when a component binds or becomes stuck or jammed) CA Disengaged / uncoupled: component disengage s, loses required fric-tion, or is no longer meshed (as in gears)s for example, the clutch on the motor disengages from the shaf t (this should not be used for dropped control rods) i 4 l F-15
l Table 1.6 (continued) Electric / instruments l EA Excessive electrical loads: electrical loads exceed design rating EB Overvoltage/ undercurrent: component f ailure produces an over-voltage / undercurrent condition other than open circuits l EC Undervoltage /overcurrent: component f ailure produce s an under-voltage /overcurrent condition other than shorts l ED Short circuit / arcing / low impedance : electrical component shorts or arcs in the circuit or has a low impedance including shorts to 1 ground I EE Open circuit /high impedance / bad . electrical contact: electrical com-ponent has a structural break, or electrical contacts f ail to com-tact and fail to pass the desired current EF Erratic operation: compo nent (especially electrical or instrument) , behaves erratically or inconsistently (if an instrument produce s a
- bad but constant signal, use "BG" if an instrument produce s an in-consistent signal use "EF")
BG Erroneous /no signal: electrical component or instrument produces an erroneous signal or gives no signal at all (not for out-of-calibra-tion error) EH Drift: a change in a setting caused by aging ar change of physical characteristics (does not include personnel errors or a physical shif t of a component) EI Out of calibration: component (particularly instruments) become out of adjustment or calibration (does not include drif t) EJ Electromagnetic interference: abnormal indication or action result-ing from unanticipated electromagnetic field ! EK Instrument snubbing: dampening of pulsating signals to an instrument Hydraulic HA High flow: higher than normal or desired flow exists in a compo-nent/ system (does not include instrument misindication (see code EG) HB Low flow: lower than normal or desired flow exists in a component / system (does not include instrument misindication) . HC No flow or impulse: fluid flowing through a pipe, filter, orifice,
- or trench or the fluid in an impulse line (e.g., instrument sensing line) is blocked completely or decreased due to some foreign mate-rial, crud, closed (either partially or completely) valve or damper, or insufficient flow area l
l F-16
Table 1.6 (continued) l HD Flow induced vibration HE Cavita tion HF Erosion HG Vortex formation EH Water hammer HI Pressure pulse / surge HJ Air / steam binding HK Loss of pump section HL Boron precipitation 9.O.tK OA Declared inoperable: component or system is declared inoperable as required by Technical Specifications but may be capable of partial-ly or completely performing its desired duties when requested (a component / system that is completely failed should not use this code) OB Flux anomaly: flux characteristics of the reactor core are not as required or de sired (e.g. , flux spike due to menon burnout) OC Test not performed: operator or test personnel fails to perform a required test within the required period OD Radioactivity contamination: compone nt, system, or area becomes more radioactive than de sired or expected OE Temporary modification: an installation intended for short term use (usually this is for maintenance or modification of installed equip-ment) 0F Environmental anomaly 00 Airborne release OH Waterborne release OI Operator communication j OJ Operator incorrect action OK Procedure or record error l F-17
I i
- 2. SOURSS OF INFORMATION Several sources of information including periodic (annual, quarterly, and monthly) NRC publications were used in the review. Some sources com-tained information relative to more than one area within the scope of the r ev iew.
4 2.1 Availability and Canacity Factors The availability and capacity factors were either extracted or calcu-lated from data given in the Gray Books 8 from 1974 through 1981 (the first Gray Book was issued in May 1974). Prior to 1974, annual or semiannual reports were used to compile availability factors only. 2.2 Forced Reactor Shutdowns and Power Reductions Review of the forced power reductions involved checking the following sources for accuracy and completeness of details.
- 1. Nuclear Power Plant Operating Experience for 1911, for the years 1973-1979 (Refs. 4-11). The report for 1981 has not been published. How-ever, because work on the section on outages in these reports has been performed by NSIC since 1973, the draf t copy of this report for 1981 was available.
- 2. NUREG-0020 series 8 (Gray Books).
- 3. Annuni or semiannual reports of the Lacrosse plant from the time of startup through 1977. For 1977 through 1981, monthly operating re-ports were used because the utilities were no longer required to file annual reports. The review of power reductions involved primarily the annual, semiannual, and monthly reports.
2.3 Renortable Events The NSIC computer file of LERs was the primary source of information in reviewing reportable events. Material on the NSIC computer file con-sists of the appropriate bibliographic material, title, 100-word abstract, and keywords. When additional information on the event was needed, the original LER (or equivalent) was consulted by examining (1) those full-sized copies on flie at NSIC (for the years 1976-1981)* (2) the microfiche i file of docket material at NSIC: or (3) the appropriate operating report I (semiannual, annual, or monthly). Two computer files on RECON (a computer retrieval system containing
~40 data bases operated at ORNL) were used extensively. Printouts were obtained from the files for Lacrosse to provide coverage on many types of
!. " docket material," including reportable events, whete the licensee may have been in correspondence with NRC [or the Atomic Energy Commission (AEC)] concerning a particular event. Licensees are of ten requested to submit additional information or perform further analysis. Before the F-19 1
LERs came into existence in the mid-1970s, it was not unusual for licens-ees to submit, on their own or at the request of NRC or AEC, more than one letter transmitting information on a particular event. Thus, these print-outs provided additional sources of information on reportable events. Several special publications were reviewed to provide details on , events of significance. Af ter further analyses and examination of the following publications, details, evalua tions, or assessments could be found other than those provided in the appropriate NRC-requested transmis-sion.
- 1. " Reports to Congress on Abnormal Occurrence s," NUREG-0090 series 18,
- 2. " Power Reactor Event Series" (formerly Current Event Series) published bimonthly by NRC,
- 3. " Operating Experiences," a section of each issue of the Nuclear Safety journal, and
- 4. the publications of NRC's Office of Inspection and Enforcement (IE),
such as operating experience bulletins, IE bulletions, IE circulars, and IE information notices. 2.4 Environmental Events and Releases of Radioactivity l Events of environmental importance were obtained as a result of con-ducting the overall review of the plant's operating history, and the sources of information involve all types of documents listed thus f ar. The data for radioactivity releases were compiled primarily from Radioactive Materlats Released from Nuclear Power Plants - Annual Report 1977 (Ref.13) . This report presents year-by year comparisons for plants in a number of different categories (such as solid, gas, liquid, noble gas, and tritium). Data for 1978 were taken from Radioactive Materials Reteased from Nuctear Power Ptanta - Annual Report 1978 (Ref. 14). Da ta for 1979,1980, and 1981 were compiled from the annual enviroimiental re-ports submitted by Lacrosse. i 5 I I F-20
- - . , . . , - , , - , - .n . . . - , _-. ._ ,, ,n-,,_,-,-,n._.-, -
- .. . . w
- 3. TEGNICAL APPROAG POR EVALUATIONS OF OPERATING HISTORY Forced shutdowns (and power reductions) and reportable events were the two areas focused on in the evaluation of the operating history of Lacrosse. Given the large number of both forced shutdowns and reportable events, it was necessary to develop consistent review procedures that in-volved screening and categorizing of both occurrences. After the events were screened and categorized, the study then assessed the safety signif-icance of the events and analyzed the categories of events for various trends and recurring problems.
The approach in evaluation of operational events (forced shutdowns and reportable occurrences) consisted primarily of a three-step process: (1) compilation of information on the events, (2) screening of the events for significance using selected criteria and guidelines, and (3) ovalua- , tion of the significance and importance of the events from a safety stand-point. The evaluations were to determine those areas where safety pro-blems existed in terms of systems, equipment, procedures, and human error. Shutdowns were evaluated against the DBEs found in Chap.15 of the Standard Review Plan.8 The DBEs are those postulated disturbances in process variables or postulated malfunctions or f ailures of equipment that the plants are designed to/ withstand and that licensees analyze and in-clude in safety analysis reports (SARs). The SAR provides the opportunity for the effects of anticipated process disturbances and postulated com-ponent failures to be examined to determine their consequences and to evaluate the capability built into the plant to control or accommodate
- ' such f ailures and situations (or to identify the limitations of expected performance).
The intent is to organize the transients and accidents considered by the licensee and presented in the SAR in a manner that will:
- 1. ensure that a sufficiently broad spectrum of initiating events has
- been considered,
- 2. categorize the initiating events by type and expected frequency of occurrence so that only the limiting cases in each group need to be quantitatively analyzed, and
- 3. permit the consistent application of specific acceptance criteria for each postulated initiating event.
Each postulated initiating event is to be assigned to one of the following ca te gorie s: 1
- 1. increase in heat removal by the turbine plant,
- 2. decrease in heat removal by the turbine plant,
. 3. decrease in reactor coolant system flow rate,
- 4. anomalies in reactivity and power distribution,
- 5. increase in reactor coolant inventory,
- 6. decrease in reactor coolant inventory,
- 7. radioactive release from a subsystem or component, or
- 8. anticipated transients without scram.
4 i l l F-21
- . - . _ . ~ .- --
l Those shutdowns identified as design-basis initiating events were categorized as such. If _ the shutdown was not a DBE, then it was assigned I a category from a list developed by NSIC to indicate the nature and type j' of error or f ailure. The NSIC categories for shutdowns not caused by DBEs were examined as part of a trends analysis. Reportable events were screened using the criteria presented in Sect. , 3.2 and were categorized according to their significance. The information , : collected on the reportable events was used to analyze trends for all re-portable events, both significant and not significant. I 1
; 3.1 Sinnificant Shutdowns and Power Reductions For the purposes of compiling information and evaluation, power re-ductions were treated in the same manner as forced shutdowns, i
3.1.1 Criteria for sinnificant shutdowns and nower reductions _As indicated previously, the occurrences identified as DBEs were used l as criteria to categorize and note significant shutdowns. These events are listed in Table 3.1 at the end of Sect. 3 as they are found in Chap. 15 of the Standard Review Plan.s 3.1.2 Use of criteria for determinina sinnificant shutdowns and nower reductiogg Generic design-basis initiating events such as " increase in heat re-moval by the secondary system" or " decrease in reactor coolant system flow rate," were used as primary flags for reviewing the forced shutdowns (and power reductions). Once the generic type of event was identified, the particular initiating event was determined from the details associated with the shutdown. For example, if the reactor shuts down because of an
- increase in heat removal because a feedwater regulator valve failed open, l the shutdown is a generic type 1 DBE. Specifically, based on the initiat-ing event (valve f ailed open), it is a 1.2 DBE "feedwater system mal-function that results in an increase in feedwater flow." Some shutdowns were readily identifiable as specific DBEs, such as tripping of a main coolant pump, a 3.1 DBE. Once categorized as a DBE, the shutdown was con-sidered significant regardless of the resulting effect on the plant (be-cause a DBE had been initiated).
Loss of flow from one feedwater loop was considered suf ficient to J qualify as a 2.7 DBE " loss of normal feedwater flow." The closure of a I main steam isolation valve in one loop was considered sufficient to qual- l l ify as a 2.4 DBE " inadvertent closure of main steam isolation valves." I l l 3.1.3 Non-DBE shutdown and nower reduction catemorization Those shutdowns that were not DBEs were assigned NSIC categories l (Table 3.2) to provide more information on the failure or error associated with the shutdown. With these categories, more specific types of errors l F-22
l l and f ailures could be exaciasd through tabular summaries to focus the re-viewer's attention on problem areas (safety related or not) that were not revealed by the DBE categories. The causes (Table 1.1) for non-DBE shutdowns taken fram the Gray Books are limited and very general, while NSIC cause categories are more specific. Thus, as an example, the number of Gray Book causes noted as equipment f ailure should not be expected to equal those identified as equipment f ailures with the NSIC categories. Other NSIC categories, such as component f ailure, could be classified as an equipment f ailure if the only available designations for cause were those listed in the Gray Books. 3.2 Sinnificant Resortable Events 3.2.1 Criteria for sinnificant renortable events TWc groups of criteria were used in determining significant report-able events. The first set of criteria (Table 3.3) indicates those events that are definitely significant in terms of safety
- they are teoned sig-nificant. The second set of criteria (Table 3.4) indicates events that may be of potential concern. These events, which might require additional information or evaluation to determine their full implication, were noted as conditionally significant.
- 3.2.2 Use of criteria for determinina sinnificant renortable events The reportable events were all reviewed, applying the two sets of criteria for significance rather liberally. A number of significant events and conditionally significant events were noted. The events initially identified as significant or conditionally significant were analyzed and evaluated fu.-ther based on (1) engineering judgment * (2) the systems, equipment, or components involved
- or (3) whether the safety of the plant was compromised. The final evaluation for significa,nce consid-ered whether a DBE was initiated or whether a safety function was compro-mised so that the system as designed could not mitigate the progression of events. Thus, the number of events finally categorized as significant was reduced considerably by these steps in the review process.
3.2.3 Resortable events that were not sinnificant Those reportable events not identified as significant or condition-ally significant were categorized as not significant (with an "N" in the significsuce column of the coding sheets in the appendizes). These events and the events rejected during the additional review step were further reviewed by compiling a tabular summary of the systems to detect trends and recurring problems (Table 1.4 provides a listing of the systems). i l l F-23
Table 3.1. Initiating event descriptions for DBEs as listed in Chap.15, Standani Revites PIms (Revision 3) ! 1. Increase in heat removal by the secondary system 1.1 Feedwater system malfanction that results la a doorease la feedwater temperature-1.2 Feedwater system malfanotion that results la an imorease in food-water flow 1.3 Steam pressure regulator malfanotion or failure that results la i increasing steam flow 1.4 Inadvertent opening of a steam generator relief or safety valve 1.5 Spectrum of steam system piping f ailures inside and outside of l containment in a pressurized-water reactor (FWR) l 1.6 Startup of idle recirculation paap" 1.7 Inadgertent opening of bypass resulting in laorease in steam flow
- 2. Decrease in heat removal by the secondarv system 2.1 Steam pressure regulator malfunotion or failure that results la decreasing steam flow 2.2 Loss of external electric load 2.3 Turbine trip (stop valve closure) 2.4 Inadvertent closure of main steam isolation valves 2.5 Loss,of condenser vacuum 2.6 Coincident loss of onsite and external (offsite) ao power to the station 2.7 Loss of normal feedwater flow 2.8 Feedwater piping break 2.9 Feedwater system ga1 functions that result la an increase in feed-l water temperature j 3. Decrease in reactor coolant system flow rate 3.1 Single and multiple reactor coolant pump trips 3.2 Boiling-water reactor (BTR) roolroulation loop controller mal- ,
function that results in decreasing flow rate J 3.3 Reactor coolant pump shaf t seizure 3.4 Reactor coolant pump shaf t break )
- 4. Rosctivity and nover distribution anomalies 4.1 Uncontrolled control rod assembly withdrawal from a saboritical or low power start-up condition (assuming the most unf avorable i reactivity conditions of the core and remotor coolant system),
including control rod or temporary control device removal error during refueling 4.2 Uncontrolled control rod assembly withdrawal et the particular power level (assuming the most unf avorable reactivity conditions of the core and reactor coolant system) that yields the most severe results (Iow power to full power) 4.3 Control rod maloperation (system malfanotion or operator error), including saloperation of part length control rods e F-24
Table 3.1 (continued) 4.4 Start-up of an inactive reactor coolant loop or recirculating loop at an incorrect temperature. 4.5 A malfunction or f ailure of the flow controller in a BWR loop - that results in an increased reactor coolant flow rate 4.6 Chemical and volume control system malfunction that results in a decrease in the soron concentration in the reactor coolant of a PWR 4.7 Inadvertent loading and operation of a fuel assembly in an in-proper position , 4.8 Spectrum of rod ejection accidents in a PWR 4.9 Spectrum of rod drop accidents in a BWR
- 5. Increase in reactor coolant inventory 5.1 Inadvertent operation of energency core cooling system during power operation.
5.2 Chemical and volume control system malfunction (or operator error) that increases reactor coolant inventory-5.3 A number of BWR transients, including items 1.2 and 2.1-2.6
- 6. Decrease ir reactor coolant inventorv 6.1 Inadvertent opening of a pressuriser safety or relief valve in either a PWR or a BWR 6.2 Break in instrument line or other lines from reactor coolant pressure boundary that penetrate containment 6.3 Steam generator tube f ailure 6.4 Spectrum of BWR steam system piping failures outside of contain-i ment 6.5 Loss-of-coolant accidents resulting from the spectrum of posta-lated piping breaks within the reactor coolant pressure boundary, including steam line breaks inside of containment in a BWR 6.6 A number of BWR transients, including items 1.3, 2.7, and 2.8
- 7. Radioactive release from a subsystem or cannonent 7.1 Radioactive gas waste system leak or failure 7.2 Radioactive liquid waste system leak or f ailure 7.3 Postulated radioactive releases due to liquid tank failures 7.4 Design basis fuel handling accidents in the' containment and spent fuel storage buildings 7.5 Spent fuel cask drop accidents
- 8. Anticinated transients without scram
[ 8.1 Inadvertent control rod withdrawal I 8.2 Loss of feedwater ( ~ 8.3 Loss of so power 8.4 Loss of electrical load 8.5 Loss of condenser vacuum 8.6 Turbine trip 8.7 Closure of main steam line isolation valves "These initiating events were added for BTRs to be more specific than DBE events 5.3 and 6.6. F-25
m Table 3.2. NSIC event categories for non-DBE shutdowns N 1.0 Equipment f ailure N 1.1 Failure on demand under operating conditions N 1.1.1 Design error N 1.1.2 Fabrication error N 1.1.3 Installation error , N 1.1.4 End of design life / inherent failure / random failure ! N 1.2 Failure on demand under test conditions N 1.2.1 Design error N 1.2.2 Fabrication error N 1.2.3 Installation error N 1.2.4 End of design life / inherent f ailure/ random f ailure N 2.0 Instranentation and control ananalies N 2.1 Hardware f ailure
, N 2.2 Power supply problem
, N 2.3 Setpoint drift N 2.4 Spurious signal N 2.5 Design inadequacy (system required to function outside de-sign specifications) N 3.0 Non-DBE reductions in coolant inventory (leaks) N 3.1 'In primary system N 3.2 In secondary system and anziliaries N 4.0 Fuel / cladding f ailurs (densification, swelling, failed fuel elements as indicated by elevated coolant activity) N 5.0 Maintenance error N 5.1 Failure to repair camponent/ equipment / system N 5.2 Calibration error N 6.0 Operator error N 6.1 Incorrect action (based on correct understanding on the part of the operator and proper procedures, the operator turned the wrong switch or valve - incorrect action) N 6.2 Action on misunderstanding (based on proper procedures and improper understanding or misinterpretation on the operator's part of what was to be done -- incorrect action) N 6.3 Inadvertent action (purpose and action not related, for example, bumping against a" switch or instrument cabinet) N 7.0 Procedural / administrative error (incorrect operating or testing procedures, incorrect analysis of an event - f ailure to consider certain conditions in analysis) N 8.0 Regulatory restriction N 8.1 Notice of generic event N 8.2 Notice of violation N 8.3 Backfit/ reanalysis l r j F-26
Table 3.2 (continued) N 9.0 External events N 9.1 Human induced (sabotage, plane crashes into transformer) N 9.2 Environment induced (tornado, severe weather, floods, earthquake) N 10.0 Environmental operating constraint as set forth in Technical Specifications F-27 l
i Table 3.3. Reportable event criteria significant
'I[I,,f, Event description S1 TWo or more f ailures occur in redundant systems during the same event S2 TWo or more f ailures due to a common cause occur during the same event .
i S3 Three or more f ailures occur during the same event S4 Component f ailures occur that would have easily escaped detection by testing or examination S5 An event proceeds in a way significantly differe'nt from what would be expected S6 An event or operating condition occurs that is not envel-oped by the plant de sign base s l S7 An event occurs that could have been a greater threat to l Plant safety with (1) different plant conditions, (2) the advent of another credible occurrence, or (3) a different progression of occurrence, i S8 Administrative, procedural, or operational errors are com-i mitted that resulted from a fundamental misunderstanding of plant performance or safety requirements S9 Other (explain) 1 l i i l F-28
I i Table 3.4. Reportable event criteria -- conditionally significant Category of conditional Event description si'gnificance C1 A single f ailure occurs in a nonredundant system C2 TWo apparently unrelated f ailures occur during the same event C3 A problem results in an offsite radiation release or ex-posure to personnel C4 A design or manuf acturing deficiency is identified as the cause of a f ailure or potential failure C5 A problem results in a long outage or maj or equipment damage C6 An engineering safety feature actuation occurs during an event C7 A particular occurrence is recognized as having a signif-icant recurrence rate C8 Other (explain) l F-29 l l
l t l l l
- 4. OPERATING EXPERIENCE REVIEW OF LAMOSSE 4.1 Summary of Operational Events of Safety Imoortance The operational history of LaCrosso has been reviewed to indicate those areas of plant operation that cmapromised plant safety. The review included a detailed examination of plant shutdowns, power reductions, reportable events, and events of special environmental importance. The criteria used for determining degradations in plant safety were (1) events that initiated a DBE and (2) events that compromised safety functions de signed to mitigate propogation of the initiating events.
Shutdowns and power reductions indicated the number and types of l DBE's entered. The reportable events indicated the number of times each engineered safety function was compromised. The analysis of shutdowns and power reductions revealed sixty-two DBEs entered. In addition, the analy-sis identified fif teen events in which there was a loss of safety system f unct ion. 4.2 General Plant Descriotion Lacrosse Boiling Water Reactor (LACBWR) is an Allis-Chalmers designed power plant owned and operated by Dairyland Power Cooperative. It is lo-cated on the Mississippi River at Genoa, Wisconsin. The population within 30 miles of the plant is 140,000. Within a 50-mile radius of Lacrosse, there are two cities and a total population of 320,000. The reactor has a licr7 sed thermal power of 165 MNt and a de sign electrical rating of 50 NKe. Initial criticality was achieved on July 11, 1967. Commercial operation started on November 1,1969. 4.3 Availability and Canacity Factors Table 4.1 presents the Lacrosse availability and capacity factors [ reactor availability, unit availability, unit capacity using the maximum dependable capacity (MDC) and unit capacity using the de sign electrical rating (DER)]. The average reactor availability was 66.7% and the average unit availability was 61.7% for the years f rom 1970 to 1981. The MDC and DER capacity factors for the eleven years averaged 48.6% and 46.7%, respec-tively. Since 1970, the availability factors were above 50% for all years except 1976 and 1977. In 1976, there was a shutdown of more than five months duration for modifications to bring the facility into compliance with the Nuclear Regulatory Commission's interim acceptance criteria for emergency core cooling for light water reactors. In 1977, the May ref uel-ing outage was extended to the end of the year as a result of abnormal fuel degradation and the associated evaluation. i l l F-31
s e g t e 7 7 6 7 au ll ua 6 1 8 6 6 6 4 4 u mv C 1 8 3 0 2 0 e 9 8 6 7 5 1 8 7 $ $ 0 6 7 9 8 8 9 1 8 0 8 1 7 4 3 4 9 6 8 8 9 7 9 3 1 7 5 1 7 7 4 4 8 5 0 4 8 7 9 8 2 1 9 1 6 6 4 3 7 5 7 2 4 7 9 4 5 1 0 1 3 3 2 2 6 8 6 0 4 7 9 9 7 1 9 e 1 4 4 4 3 r o t 5 7 6 6 1 e 7 e 9 1 9 2 0 f 1 7 4 6 6 y t t 4 4 2 2 0 e 7 e p 9 9 1 9 6 s 1 8 8 7 7 e d 3 0 0 2 3 n 7 a 9 8 8 7 5 y 1 5 $ 4 4 t i l 2 6 1 8 5 i 7 b 9 0 4 6 4 a 1 7 6 3 S a v 1 1 0 5 6 a 7 9 1 6 6 4 e 1 6 5 4 4 s s o r 0 1 4 C 7 e 9 3 6 9 8 L 1 7 6 2 2
~ ~
1 9 4 4 9 6 a 4 6 5 1 2 1 1 e ~ - l b a 8 2 T 6 a a 9 4 4 1 1 ~ .
]
)
e . 7 ( ] 6 9 a a a a W M e
)
1 ( 8 W _ 4 N [ O y S _ t [ t e g e n p i _ s t e a r e l t b s y a e - *) d i t ) n r . i y C R D E e t 1 _ l p c 8 i t M D e e 9 b i ( ( d l 1 a l . e i y y b t a m h a a t t u n t v l l e e t a m d i io g u o az se r a i ae pe p r o av es es t a t t t "N N # Dk s i l i o n a n R U D U [LDJJ
4.4 Forced Emactor Shutdowns and Forced Power Reductions
, 4.4.1 Review of fr.rced reactor shutdowns and ! forced never reductions Fram startup on July 11, 1967 through December 31, 1980, Lacrosse reported 296 forced skatdowns. During the same period there were only 20 power redactions reported. Power level histograms show numerous other -
power reductions but no information was available on them. Therefore, they are not covered in this report. Tables 4.2 and 4.3 summarize the forced skatdowns and forced power reductions which were reported. Tables A1.1 throssh A1.15 present a compilation of data describing each forced shutdown and power reduction reported. The consegnance of some of these events was solely the inability to produce power. However, many of the events have saf ety implications. Some of the shutdowns were design basis events (DBEs). DBEs are postulated f ailure events which result in system transients, cha11 easing one or more safety systems. Because they challenge safety systems and are the initiating events in postulated accident segnances, DBEs warrant special attention. 4.4.1.1 Yeariv s ries. The following is a discussion of shut-downs, power reductions and other events for the years 1967 through 1981. lifl Lactosse achieved initial criticality at 7:35 PM on July 11, 1967 with a tes-element core. The 72-element core was complete on July 24. In July and August daring initial criticality experiments and shake down operation, the reactor scrammed twenty-eight times due to noise in the nuclear instrumentation and operator errors. The reactor was shutdown from September 5 to November 24 to complete construction of items neces-sary for power operation. Shielding measurements and other low power tests were done daring the remainder of the year. Some difficulties were enconatored with the forced circulation pump (FCP) seal injection system (see Sect. 4.4.3.1). lifI. Twenty-nine forced shutdowns occurred in 1968. Seventeen of these were due to equipment f ailures, three were caused by maintenance and testing and nine were due to operational errors. I No forced power reductions we,re reported in 1968. Throughout most of ' the years of operation there was little information about forced power reductions even though the histograms indicated that some had occurred. Low power operation resumed in February and initial turbine operation l began in April. Af ter a short period of operation, shutdown was necessary l due to high conductivity and chloride concentration in the reactor coolant system. The system was cleaned and flushed and the ion exchange beds were rege nerated. The power testing program was continued natil May 30 when it was terminated due the inability to open the two shutdown condenser steam inlet valves and one of the condensate return valves. The period from F-33
l a 6 29204 9621 1 t o 9 2 21 2 5 6 0 6 31408628I8iI157I081311I 3 6 ,2 0 2 3 T 1 1 8 7 81I44 2 3 I 1 9 1 1 5 22 3 1 0 8 5 3 !1 '4 01 3 6 9 1 1 1 4 2I1 I 1 9 7 4 2 2 3 1 2 I 9 1 1 1 1 4 5 3 1 1 8 7 6 5 9 1 1 1 510 1 42 3 1 1 7 7 7 4 2 2 2 21 0 I 1 I 9, 1 1 1 6 7 9 8 1 513 1 21 1I 9 3 I _ 1 _ 5 7 6 15 312 3 I 9 1 1 1 I 3 8 I1 1 1 4 7 6 12 3 7 9 4 9 1 1 7 221 2 1 1 1 3 7 2 91 2 6 6 1 3 1 9 2 1 1 1 1 4 4 1 2 7 0 71 2 828 7 3I 91 3 1 9 2 1 11 3 1 y r a 1 2 7 0 2 7I4 n 9 2 2 1 6 3 3 4 5 II 7 e 1 s n w 0 o 7 9 0 9 7!1 2 2 13 2 d 9 3 3 3 5 1 I 21 i t 1 2 u h s 9 d 6 4 S2 4 6 8i 2 3 24 e 9 2 I 1 3 8 1 4 c 1 r o f e A 9 1 73 9 4 5 ! 2 102 s 9 2 1 2 ! 1 I4 5I 1 1I s 1 r o ca 7 L 6 3 14 8 3 5 5 9 3 2 3 8 1 2 2 4 e ) F l b I a ( T ) - )I t E y - C( e I f ( ye ) t e J - ne R wf r ( _ oso def n t urd o i hoe s - sf r r ed u i e v f eq are sir n o c u
)
D S aqt rrn eo r e ( o w f ss p o . ) G m e dee em ) S - . ) C d S )( t s et t rss ( E n C D r iyy a
) ( C p e uss s
_ gn s ( u q m ))
) m no a n n n enn e AS )Ca
_ ii ( o na o roo FRe t)HR - eeir t t sc l o)C a
)i At oe i il t ii st t) yE sC(())(R( CE t
p s rt ro rC(l t c a a) maaA s(ryRR ruf u t r e tR l Aet tE ol(( eno t rsr e u)l t oIt nn(rrt p t a _ t oee r on(l erCoaHt econ) e( see eeaprsaes a r ecn cest(tlc ymmrwwrueswl e psuueooessa f e cya l eso i rsc o(ti rrwppn npg cru d r d yoeenmo nrt t t o emeynet t nrn o cet e t cvraacret r naoo e ntt h t st a s v i t u n l ae em nsspee1en enn t t adbit a t se b e meat e ollv en w o vrrtt t rt n r m ii te eenscnl i oonssoaiou t t etn oeaef m ptl er m aami tt t a t wat rrrt nni iaure i uer u n ut geh n nnt n qo ept w aa uo u uuot d a cccl t t aaaott aacdt aenashhfct eeeoobeabcde rt t rrnh l e qNROO o MMAC d h eeeoaaeeoenttfCCuhauiot s eeRRRCMMRFCRIOOOADTM MTCCO a s t t t u .A3DCR
. . . h . u1234
. . .. e ty s1234567890!234567890123 ToC a S -
D S 1!111111112222 m8$
l a t 0 4 7 3 1 2 9 o 2 2 T 1 8 1 1 1 9 1 0 8 3 3 1 2 2 9 1 9 7 3 3 2 t' 9 1 8 7 4 4 4 9 1 7 7 0 9 1 6 7 0 9 1 5 7 0 9 y 1 r a m e 4 5 s 7 6 6 1 o 9 1 n o i t 3 c 7 1 1 1 u 9 d 1 e r r 2 e 7 2 2 1 1 w 9 o 1 p d e 1 c 7 0 r 9 o 1 f e s 0 s 7 0 o 9 r 1 _ C I A 9 6 0
. 9 3 1 4
e 8 l 6 0 b 9 a 1 T 7 6 0 9 1
)
_ ) ) _ G )A ( R (B*) F E ( ( l C e o r y E r r r ot l ( e a t s a p r a p t l l a o r s e w s en e s n s f d y e m e a t e t g a d l n v i e n t r e l v e t o a e m p v o i tn i s c l a b m i n c b n s e u u i a r i i r n q e a a a i l e E me R T M M C a s t t o a u . s A y 1 2 3 4 $ T C S 0*
) June to December was spent doing maintenance and modifications. During j December, the 25% power testing program was completed. ' M There were twenty-four forced shutdowns in 1969. Eighteen were due to equipment failures, two were caused by maintenance and testing and four were due to operation errors. No forced power reductions were reported. ; ' The reactor was returned to 60% power on January 17, but completion of testing at 60% power was delayed due to a turbine casing flange leak and the loss of a 2400-volt bus. The 605 to 75% power tests were can-pleted by May 3 when the reactor was shut down to realign FCP-1A for the higher speeds required at 90% power. The shutdown was extended to perform control rod drive maintenance which required unloading the reactor core (see Sect. 4.4.3.2). Operation at 90% power was attained on July 23 and 1005 on August 1. During September the 28-day warranty run was completed. On November 1, Lacrosse began commercial operation and responsibility for operations was transf erred from Allis-Chalmers to Dairyland Power Cooperative (DPC). The reactor was shut down for maintenance and testing for the remainder of the I year. M j Thirty-nine forced shutdowns occurred in 1970. Thirty of these were l due to equipment f ailures and nine were caused by operator errors. No forced power reductions were reported. The 1969 maintenance shutdown continued until May 1,1970 when the reactor was again taken critical. Power was limited to 60% prior to final evaluation of the modified instrumentation system and load rej ection tests. The reactor was shut down on June 19 for turbine generator rotor inspection because of a ground fault indication. Operation at 60% power resaned early in July. On September 5, the power was increased to 1005 after receiving full power authorization. The plant was shut down for scheduled maintenance from November 1 to December 15 at which time power operation was resmaed. M There were twenty-two forced shutdowns in 1971. Twenty of these were due to equipment f ailures and two were caused by operator errors. No forced power reductions were reported. The reactor operated at 100% power until January 20 when turbine l steam rehester tube leakage forced a reactor shutdown. The reactor was restarted at about 90% power on January 31 but had to be shut down six l more times for tube repairs. The total downtime was about 500 hours. Other shutdowns were of short duration. A scheduled maintenance shutdown started on September 4 and lasted until the end of the year. M There were twenty forced shutdowns in 1972. Seventeen of these were due to equipment failures, one was caused by maintenance and testing, and i F-36 l l l
V G-two were the results of operator errors. Both of the reported forced power reductions were due to equipment f ailures. The reactor operated at greater than 90% full power until the sched-uled maintenance shutdown on May 19. The reactor was returned to opera-tion at 97% full power on June 16; On August 19, the reactor was shut down for fuel element inspection due to the high off gas. activity. All fuel assemblies were removed. Crud was cleaned from th'o assemblies and the fuel assembly nozzle. Operation was resuned on1 0ctober 16. A continuing review of plant records revealed ihat there was a pos- , sibility of stainless steel sensitization in two areas. Therefore, the reactor was shut down and metallographic examinationsc9ere made. The se showed that the " safe end" on the reactor side of ths-NSIV and four branch connections on either side of the two FCP discharge vilves were indeed I sensitized. Af ter further tests a decision was madd to continuo operation and make repairs during a future shutdown. The reactor operated at 93% during most of December. _ w 1973 Trenty-two forced shutdowns occurred in 1973. Nineteen of these were due to equipnent f ailures, one was caused by maintoniace and testing, and two were the result of operator errors. The only raported forced power reduction was caused by equipment f ailure. The reactor operated at greater than 90% powei antil February 1 when it was shut down to perf orm emergency diesel generator auto transfer tests. During the shutdown and subsequent start up, difficulties were encountered with control rod drives numbers eighteen and nineteen. The wiring f ailures which caused the difficulties were corrected. Also, a loose mechanical connector on the MSIV bypass valve prevented it from closing. Proper operator' action prevented a low-level scrsa. The reactor operated at greater than 97%Lpower for most of the time between February 5 and March 30 when it was intentionally scranned for a test prior to the scheduled refueling and maintenance shutdown' During . shutdow n, the fuel was removed and the crud;was cleaned f rom it. Twenty ' ' t f ailed fuel elements were replaced. , The plant was started up on June 25. Numerous shutdowns occurred during July and August mainly due to the FCP seal injsction system and the control rod drive mechanisms. The plant w./s shut down from' September 10 to 13 to repair the seal injection system. Power operation was continuous f rom September 13 until the November 3 refueling and maintenance shutdown. During the shutdown, 23 failed fuel assemblies were replaced and 32 zircc-nium shroud cans were replaced with stainless steel shroud can's. The i stainless steel shroud cans were installed in order to extesd the 'next l cycle length by reducing the initial excess reactivity. The reactor was started up pn December 23 but power production was l - limited and shutdowns occurred largely due to troubles with the seal injection system and the control rod drive.nschanisms. l l F-37
4 1974 i There were sixteen forced shutdowns in 1974. Eleven of these were due to equipment f ailures, two were caused by maintenance and testing, and three resulted from operator errors. All six of the forced power reduc-4 tions were due to equipment failures. ' ~ The reactor operated at greater than 90% full power for most of the timef until the May 4 to May 24 maintenance shutdown which included: _ re-placies the FCP seals, repairing and modifying the seal injection system, i and repairing the control rod drive mechanisms. !
, During subsequent reactor start-up, the leakage from No. 2 control
- rod drive seal was above tolerance. The rods were scrammed four times in unsuccessful attempts to reduce the leakage (this had helped in the past but did not help this time). The seal manuf acturer advised that the leak-age should decrease with time. Therefore the reactor was started up on i
May 29 and within 48 h the seal leakage was within tolerance. Except for ' t three short outages, power operation continued until August 28 when loss i of I&C control power caused a scram. The shutdown was extended to September 20 to repair control rod drive No. 28 which required replacement
- of the lower drive mechanism. On September 24, a shutdown was necessary i
due to an oil leak on No.12 control rod drive. , During start-up, a low-level scram occurred because the MSIV did not close completely. Investigations indicated that the valve was interait-tently failing to seat, and it was disassembled and overhauled. ! The reactor operated at about 97% power from October 11 until October 23 when a load rej ection occurred due to a f also signal to the 69-kV tie line breaker. High power operation was essentially continuous for the rest of the year. l 1975 i There were sixteen forced shutdowns in 1975. Eleven of these were due to equipment f ailures and five were caused by maintenance and testing. No forced power reductions were reported. The plant operated at nearly full power until February 14 when it was i shut down for piping inspection per NRC IE Bulletin 75-01.1s Operation then continued until the first of April when the power was reduced to 91%
< due to burnup limitations. On April 17, an operator error caused a scram.
Start-up was delayed to locate and correct a DC ground f ault. On May 9, the reactor was scrammed as part of the annual Technical Specification sur-veillance test of the station transfer relay device and to start the re-fueling and maintenance shutdown. During the shutdown, the turbine was dismantled and inspected, tube bundles in the low pressure feedwater heat-ers were replaced, control rod drives were overhauled, and the containment { 1eak test was successfully completed. l Start-up testing began on August 11. Howev er, several scrams, includ-l ing one due to control rod drive leakage, delayed full power operation un- ! til August 29. Except for a few short-duration shutdowns, operation con-tinued at nearly full power for the rest of the year. ) I i F-38
l I
- 111t Nine forced shutdowns occurred in 1976. Eight of these were due to equipment failures, and one resulted from an ogerator error. There were no forced power reductions.
' Operation at nearly full power continued until February 23 when the reactor was shut down due to high chloride concentration in the primary system. This resulted from the primary purification system being shutdown on February 11, due to a steam leak. The shutdown was extended for the addition of a new diesel generator to comply with requirements for the BCCS for light-water reactors. A feedwater heater was replaced and opera-tor license tests were performed. . The plant was. returned to commercial operation at 85% power on August 18 Power was slowly reduced throughout the rest of the year due to high of f gas activity. Difficulties with FCP-1A seals caused two shutdowns in November with a total of 12 d downtime. 1.211 There were four forced shutdowns in 1977. TWo of these were due to equipment failures, and two resulted from operator errors. No forced power reductions were reported. Operation continued at reduced power until February 2 when an oper-ator error caused a reactor scram. The shutdown was extended to replace . FCP seals. A shutdown occurred on February 23 due to hydraulic leaks in the control rod drives and one on April 6 for operator training and 11-censing exams. On May 11, leaks in the seal inj ection system caused a shutdown which
- was extended for refueling and maintenance. Due to abnormal degradation of fuel cladding and evaluation of the problem, start-up was delayed until March 15,1978 (see Sect. 4.4.3.3) Major maintenance was done on the tur-bine, control rod drives, and safety valves.
111I. There were sixteen forced shutdowns in 1978. Fif teen of these were due to equipment f ailure, and one resulted from an operator error. All four of the forced power reductions were due to equipment f ailures, i The shutdown which started on May 11, 1977, continued until March 15, 1914. During start-up, a generator trip and two reactor scrans were L caused by binding of the secondary relay piston in the turbine governor oil system which controls the turbine inlet valves. The binding was due to sediment in the oil from the long shutdown. Operation at 96% of full l power was attained by the first of April. On April 27, the plant was shut down due to vibration of the radial bearing of the fluid coupling of FCP-1A. This bearing, the mechanical seal, sad the motor bearing were re-placed. The reactor was restarted on May 12. On June 22, the power was reduced to 80% due to renewal of the vibrations of the radial bearing. These vibrations caused additional power reductions prior to the mainte-
- nance shutdown starting October 17. During the outage, FCP-1A hydraulic
[ bearing was repisced and the shaf t seal was rebuilt. The plant was F-39
i I started up on November 17 and three days later excessive wear on the FCP-1A seal caused a reactor scram. Due to excessive degradation of FCP-1A, it was secured and the plant was operated at 49% power on one loop during De cembe r. 1221 There were fourteen forced shutdowns in 1979. Twelve of these were due to equipment f ailures, and two were the result of operator errors. All three of tho' forced power reductions were due to equipment failures. Operation continued at 49% power due to FCP-1A being out of service. Scrans occurred on January 13 and January 24 due to f ailures of No.13 control rod drive solenoids. The reactor was shut down from March 25 to May 28 for ref ueling. During start-up, the turbine was removed from the grid due to turbine inlet valve governor problems. The reactor remained critical and steam was bypassed to the condenser. Six miscellaneous shut-downs occurred prior to a period of steady operation at greater than 80% fran July 10 to September 4. On September 4, a six day shutdown occurred to repack the FCP-1A discharge bypass valve and perform maintenance on the turbine governer control system. A 10 d shutdown on September 28 resulted from control rod drive mechanical seal leakage. The plant operated at an average of 72% of full power during the last six months of 1979. 1180 There were fif teen forend shutdowns in 1980. Thirteen of these were due to equipment f ailures, one was to comply with a regulatory restric-tion, and one was caused by an operator error. All three of the forced power reductions were due to equipment f ailures. The plant operated at 85% of full power for most of the year prior to the refueling and maintenance shutdown on April 6. During the shutdown, equipment was installed to meet requirements of NURBG-0578.18 These in-cluded position indicators for safety relief valves and diverse parameter closure signals and manual resets on several containment isolation valves. Operation resumed on May 1. An 8 d shutdown on June 21 was caused by seal leaks on a control rod drive and on FCP-1A. During subsequent operation, low seal injection leak off flow caused FCP-1B to trip on July 19 and caused both FCPs to trip on August 8. From August 8 until the refueling outage that began on November 9, the reactor operated in an end-of-cycle coastdown mode. The ref ueling outage lasted into 1981.
)
1981 There were seventeen forced shutdowns in 1981. Eight of these were due to equipment f ailures, one was a maintenance error, one due to regula-tory requirements, and four were caused by operator errors. The only forced power reduction was due to an equipment f ailure. The refueling outage lasted 755 h into 1981. Af ter the refueling outage, the pt ar i operated at 85% power for the remainder of the year. The longe 4s shutdown during the year was over twenty-three days. The plant had a shutdown scheduled on May 23 for TMI modifications, installing of seismic restraints, and to perform maintenance. F-40
Offsite power was lost on two occassions (February 1 and December 23). The first shutdown lasted 15 h while the- second lasted for the re-maining 195 h in 1981 and continued into 1982. These events are discussed in detail in Sect. 4.5.2. 4.4.1.2 System involved. As indicated in Tables 4.2 and 4.3,108 of the forced outages were due to the '" Instrumentation & Control Reactor Trip Systems" (IA). About half of these were at low power and were of ten ; due to noise or due to the operator f ailing to upscale. Sixty-six of the j 108 outage s occurred in the first four years. Since thon' Lacrosse has ' averaged less than four per year. There were sixty-seven forced shutdowns or power reductions due to difficulties with the " Coolant Recirculation System and Controls" (CB). Many of these were caused by the seal injection system (see Sect. 4.4.3.1). Thirty-three shutdowns were caused by the " Reactivity Control Sys-tems" (RB). Most of these resulted from hydraulic fluid leakage from the control rod drives (see Sect. 4.4.3.2). None of the other systems accounted for more than 8% of the forced shutdowns or power reductions. 4.4.1.3 Causes. As indicated in Table 4.2, 224 of the 296 forced shutdowns were caused by equipment f ailures. Operation:1 errors accounted for forty-eight shutdowns and nineteen were due to maintenance or testing. One shutdown was to modify the containment isolation system to comply with NUREG-0578.18 As indicated in Table 4.3, all twenty of the reported forced power , reductions were due to equipment f ailures. 4.4.1.4 Non-desian basis events. There were 256 forced shutdown or l forced power reductions which were not attributable to DBE initiating i events. Table 4.4 lists the number of these per year by NSIC category. One hundred and four of the 256 forced shutdowns or power reductions were assigned to NSIC event category 1.0 " Equipment Failure",106 to 2.0 -
" Instrumentation and Controls Anomolles" and forty-three to 6.0 " Opera-tor Errors". One was due to 5.0 " Maintenance Error" while two were due to 8.0 " Regulatory Re striction".
4.4.2 Review of desian basis events De sign basis events (DBEs) are transients which challenge the safe operation of the plant and -the ability of engineered safety features to safely shut it down. Lacrosse has experienced sixty-two forced shutdowns and power reductions caused by DBE initiating events. Table 4.5 gives the number of these events by DBE type for each year. This section discusse s l them by DBE category. l 4.4.2.1 DBE catemory 1 -- increase in heat removal. All eight of the
- events in category 1 were classified as type 1.2 "Feedwater system mal-functions that result in an increase in feedwater flow". Six of these were caused by malfunctions of the reactor feed pump controller. One was due to high flow which occurred when a reactor feed pump was restarted after a trip. The other was due to high flow during use of the main steam bypass valve.
4.4.2.2 DBE catemorv 2 - decrease in heat removal. The screnteen events in this category were of four types: l l F-41
I Table 4.4. Lacrosse non-DBE lattiatlag event sammary 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 Total 1.0 Egalpment fallares 5 11 5 10 10 7 15 5 5 2 12 6 7 4 104 2.0 instrumentation and controls 19 5 8 25 4 4 4 1 5 2 7 9 5 8 106 anomalies 5.0 Natatemance error 1 1 6.0 Operator error 8 8 4 7 2 1 1 1 3 1 2 1 1 3 43 8.0 Regulatory restricticas 1 1 2 i [ a Total 28 18 23 37 16 15 12 17 13 8 4 20 15 14 16 256 N l
1 3 g 8 4 3 4 6 5 1 1 2 _
. 3 6 7 _
1 3 1 g 2 _ 9 _ 1 0 g 3 3 4 9 1 _ 9 _ 7 2 2 _ 9 1 _ 3 _ 7 1 1 9 1 7
- 7 0 9
1 6 7 1 1 9 1 _ 5 7 1 2 3 9 1 y r a m 4 m 7 1 1 1 2 S u 9 S 1 t n e 3 v 7 4 7 1 E 9 1 1 g a t t 2 a 7 3 1 1 1 1 7 i 9 t 1 i n I 1 E 7 1 3 2 6 S I 9 1 e s s 0 o 7 1 1 2 r 9 ca 1 L 9
. 6 2 2 5 9 1
4 e l 8 b 6 2 9 1 a 9 1 T 1 7 6 S 5 9 1 e- ow tl nf e k er a re e t l ea nw e m e od V I t t e t e S s _ ef N r e n y n e p o s ua f t i i . fl d o a rt t a e l a w t ae ol e d r s mss r e p e a me l er a u s f o e oop ws p l t e n l l a a se r e p e a g m g yl s t i t m r i d n e a s r n o t o v rn e t a n s r i e t i t t a f e r f s l el al o n e o e o s a w i v r r o t d s s b d e i t i o ea s r a e o n d T e! eL aT mI 4 e1 o Ra c R F 2 2 3 4 7 1 3 1 1 2 2 2 2 3 4 7 gW
- 1. 2.2 Loss of external electrical load (4) i 2. 2.3 Turbine trip (3)
- 3. 2.4 Inadventent closure of main steam isolation valves (4)
- 4. 2.7 Loss of normal feedwater flow (6) l All of these events were followed by a reactor scram and safe reactor shut dow n.
Two of the type 2.2 event s resulted f rom transformer f ailures. One
; resulted from a transformer espiedits causing a fire in the switchyard while the last one resulted from overpressurizing a transformer due to the ;
addition of oil. l Two of the type 2.3 events were due to operator errors during test-ing. The third was caused by a spurious low-voltage signal on the turbine building electrical bus. Three of the four type 2.4 events were the result s of human errors. The fourth was due to vibrations of a control relay. l Three of the type 2.7 events were caused by feed pump speed con-l troller failures, one was due to low feed pump suction pressure which ; , caused a feed pump trip, and another was due to low oil pressure which i also caused a feed pump trip. Slew opening of a reactor feed pump control ! valve caused the other type 2.7 event. 4.4.2.3 DBE catenory 3 - decrease in reactor system flow rate. All thirty-five events in this category were type 3.1 " Single and multiple reactor recirculation pump trips". Thirty-three of these were due to seal inj ection system malfunctions (see Sect. 4.4.3.1). The other two were due to operator errors which tripped the FCPs. 4.4.2.4 DBE catemory 4 reactivity and power distribution j anomolies. The only event in this category occurred in 1972 at low , power. It was classified as type 4.3 " Control rod maloperation". Co n- , trol rod number 16 would not function due to a shorted electrical plug. ! The reactor was manually shut down. 4.4.2.5 DBE catenory 7 - Radioactive release from a subsystem or l component. Ile single event in this category was classified as Type 7.1 -
" Radioactive ga s waste system leak or failure". It was due to fuel ele-r ment leakage. Although there were some discrepancies in the monitoring l
in st rum ent a tion, charcoal cartridge sample s indica ted higher than normal 2:21 releases, therefore the reactor was manually shut down. 4.4.3 Trends and safety isolications of forced reactor shutdowns and forced power reductions 4.4.3.1 Forced circulatina onmos and seal iniection system. At Lacrosse there are two forced circulating pumps (FCP) which cause water to flow through the reactor vessel to remove the heat generated by the nu-clear reaction. One of two posi tive displacement seal inj ection pumps provides coolant for the FCP seals. From 1967 through 1981, there were 66 outages associated with the ' forced circulating pumps or the seal inj ection system. Analysis of these failures does not indicate any abnormal saf ety implications. Eleven of the 66 outages were caused by human errors and none have occurred since 1973. F-44
4 1 Instrumentation malfunctions accounted for eight of the outages. In 1973, a series of tests weis conducted to determine the best possible op-eration with the existint system. Several flow and pressure transients, such as pump transf ers and step change s f u demand flow and pressure, were simulated at simulated reactor operating conditions. Several causes of system instability were identified and corrected. There have been only two instrument related outage s since then. i There were eight shutdowns which were reported as being caused by the FCP seals. How ev e r, in addition to these, other events that may have been i related to the FCP seals include the sixteen outages reported as due to low leak of f flow. Iow seal inj ection system pressure, or high seal leak off temperature. Only five of the above mentioned twenty-four outage s occurred since 1975. r In 1978, seven power reductions were necessary due to vibrations of FCP-1A fluid coupling. This was corrected by replacement of the hydraulic bearing and rebuilding of the shaft seal. Five of the outages were due to valve malfunctions and leaks. They occurred prior to 1974. 4.4.3.2 Control rod drives oil system leaks. Considerable diffi-culty was encountered in early operation with leaks of the "0" rings on the control rod accumulator pistons. Af ter consultation with the ring manuf acturer and some on-site testing, the original butyl rings were replaced with bronze-impregnated teflon rings. After installation, gas leakage on some of the pistons was experienced. Therefore, a third pheno-lic backup ring was added. This corrected the problem of accumulator pis-ton oil leakage. How ev er, leaks of other seals in the oil system contin-ned. These were repaired as they occurred. In May 1969, at the manufac-turer's recommendation, all lower unit "0" rings (about 150) were re- 1 plactl. Eased on the overall excellent condition of these rings, the rec-ommended replacement of all seals every two years was changed to every f our years. Although no change of design or "0" ring material was reported, the frequency of leaky seals decreased with time and only a few occurred af ter 1970. 4.4.3.3 Abnormal fuel dearadation. During the May 1977 refueling outage, abnormal fuel degradation was found. All fuel assemblies were ex-amined. Six assemblies had defective rods and three had sections of the rods missing. The total length of missing rods was estimated to be 55 in. This would amount to about 782 grams of uranium. Approxima sely 430 grams were recovered in the form of small pieces and sections, and about 131 grams were recovered in the deionizer resin beds and filters in the water purification system before restart. The remaining 221 grams were gradu-( ally removed by continued operation of the water purification system. Degradation was believed to be the result of stress corrosion crack-ing of the stainless steel cladding accelerated by rapid power increase and control rod movement as well as flow-induced vibrations. Therefore,
- steps were taken to control the rate of power increases and the average rate of control rod movement in subsequent operation. Later reports did not indicate other abnormal degradation of the fuel.
F-45 l 1 - - _ _ _ _ . _ . _ _
4.5 Renortable Events Lacrosse had a total of 246 reportable events. The events concern technical specification viciations and limiting conditions for operation. The filing of reports were as letters, telegrams, abnormal occurrence s ( A0 s ) *, reportable occurrences (R0s), and licensee event reports (LERs). In addition, several events listed in the monthly reports were considered as " reportable events." In these instance s, the monthly reports were the i main or only source of information for a particular event. The reports 4 have been reviewed and coded as per Sect. 1.3 and are arranged by year in Part 2 of Appendiz 2. 4.5.1 Review of reportable events from 1967 to 1981 Lacrosse achieved initial criticality on July 11, 1967. Since infor-mation in the first few years of operation was limited, several events from the monthly reports that were considered " reportable" were added to the total. A histogram of reports filed by Lacrosse (including the events from the monthly reports, herein called month 11es) for 1967 to 1981 is illustrated in Fig. 4.1. There were no yearly trends on the number of reports. No biasing effects were identified due to the addition of the ! monthlies. The following sections present a summary for each year of operating
, experience at Lacrosse (including month 11es). Environmental reports are discussed in Sect. 4.5.1.4.
4.5.1.1 Yearly summaries. The following sections present a summary for each year of the reportable events at Lacrosse. 1967 Lacrosse went critical for the first time on July 11, 1967. This was only a ten-element core and loading resumed on July 13. On July 24, 1967,
; criticality was achieved with a 72-element core. During the six months in 1967, sixteen reportable events occurred. The reactor trip system had the most occurrences (seven occasions). Every one of these occurrences in-volved the reactor operator erring on the control of the power range in-
- , struments. The operator either downscaled too many decades, failed to downscale, or f ailed to upscale a nuclear instrument channel.
One event worth noting occurred in September. Again, an operator was I responsible for the occurrence of the event. While returning the rotary inverter set to service, the noninterruptible bus lost voltage when the operator paralleled the inverter set without synchronizing.17 Because the - undervoltage tripping relays for the 480 V system were supplied by the i noninterruptible bus, the loss of voltage tripped the feed breakers for the entire 480 V distribution system. The emergency diesel started and
*The A0 de signation by Dresden 2 for identify.ing operational events during a particular time frame is not to be confused with those sa f e ty-significant events listed in the Report to Congress on Abnormat Occur-rences (NUREG-0090 series),
t F-46
a 30 30 - I l v> s 21 z 20 w
> 20 - 19 19 w
O 17 II 17
$ 16 16 e @
o I' cL w - u e 13 ti. 12 0 11 6 10 - 9
$ 8 o 4 z
.* +. +, -
=
i 1967 1968 1969 1970 1971 1972 1973 1974 1975 1978 3977 1978 1979 1980 1981 YEAR Fig. 4 1. Number of reported event s Per year at Lacrosse,
rotureod tho voltags to the cessatial b:s. The socintorr7pt:blo b:s was reenergized from the reserve feed and the inverter set was synchronized and paralleled. Work was already scheduled to change the ac coils on the l undervoltage auxiliary relays for dc operation and to supply these coils ' from the dc bus. This change would prevent the reoccurrence of this type of event. 1968 i Seventeen reportable events occurred in 1968 at Lacrosse. The
- reactor systems were involved more than any other system (five occur-rences). Tho of the events were noteworthy. The first event occurred on May 25 and the second occurred on December 7. Both events involved the water level in the reactor. In May, it was discovered that the unvoided water in the standpipe read lower than the actual water level since it was at a lower temperature. As Insulation placed around the standpipe did not solve the problem as observed in December.18 The problem was not resolved until April 1970 when external heaters were installed on the surface of the standpipes. For further details, see Sect. 4.5.3.2.
i ! 1969 l { Seventeen reportable events also occurred in 1969. For the second straight year, the reactor systems were involved in the most events (seven i occurrences). In May 1969, the reactor was shut down and inspected af ter power escalation tests to 75% power. Personnel noticed several fuel pins bowed during the power escalation tests.se The cause of the bowing was not determined until the October 1969 to May 1970 outage. High transverse power gradients coupled with the shroud can locking rings being lef t un-locked produced twisting and stressing of the fuel elements. For further details of this event, see Sect. 4.5.3.1. Another event occurring in the reactor system involved calibration of the nuclear instrument channels.ss,ss The indicated power on the instra-ment channels was not equivalent to the true power. A nonlinear variation of voids and zenon buildup inhibited proper calibration. Theref ore, oper-l sting restrictions were implemented until modifications to the nuclear I instranentation were implemented, which resulted in more accurate indica-tion. A significant event occurred in March 1969 when offsite power was lost.88 Fly ash accanulated on several arrestors at the Genos substation. l Wet snow compounded the problem by causing the arrestors to short; hence, offsite power was lost. For a more detailed account of this event, see Sect. 4.5.2.1.1. I 1910 I Thirty reportable events occurred during 1970 at Lacrosse. Seven of the events that occurred in the reactor trip system involved the power range instranent channels. On two occasions, the operator made a scaling error, and on three occasions, spurious signals were evidenced. The other two events involving the power range instruments were a switching voltage transient and a malfunction of a test circuit in the nuclear chan-nel. F-48
.. - .. . - - . - -- ._ - -- ~
One event that occurred in the reactor trip system was noteworthy. On October 28, it was determined that a design error allowed the power / flow bypass switch to bypass both power / flow channels.** Discovery of the error occurred during the monthly Technical Specification tests on the nuclear instrument channels. Technical Specifications require one of the power / flow channels to be operable during power operation. However, dar-ing the monthly test, both channels were taken out of service. The in- j tended performance of the scram circuits was achieved through modifica- I tions to the test procedure and to the logic circuit contact arranges ent. In April 1970, personnel determined that the reactor water level was still higher than the indicated water level. External heaters were in-stalled on the surf ace of the standpipe from which the reactor water level is road. The use of heaters had several advantages: they eliminated the water level discrepancy; they required no piping changes and therefore were easy to implement; and they required no recalibration of the level sensing instruments. Another event of interest occurred on June 17 with the reactor oper-ating at 60% power.s s An operator was dusting a control console with a dust cloth when the cloth struck an identification tag attached to the control power switch. This caused the key to move to the off position and the reactor autanatically shut down. Hence, all control key switches were evaluated and the plastic identification tags were removed where it was considered to be warranted. The operators were reminded to use the feather duster for dusting the control codsole. A significant event occurred during 1970 when a turbine main steam bypass valve malfunctioned. s s, s ? The valve unexpectedly closed during power operation and caused the reactor water level to increase. Due to the erratic action of the bypass valve, manual water level control became impossible. The water level decreased rapidly and reached its lowest level at 27 in. below the top of the core. The transient was caused by a loose valve cover on the bypass valve hydraulic control system direc-tional valve. For a more complete description of this transient, see Sect. 4.5.2.2. 1221 L Seventeen reportable events occurred during 1971 and again, the most reported system was the reactor trip system (five ev, ants). Operator errors in controlling the power range instruments accounted for two of the events. These were the last two events reported involving the operator and the power range instruments. An overview of this interaction is given in Sect. 4.5.3.4. During the year, two noteworthy events and two significant events occurred. The first noteworthy event occurred on July 2 and involved the f ailure of the main steam isolation valve to close during a test.se A man 11 amount of residue of an undetermined source was adhering to the valve operator 0-rings and spool surf ace s. The residue caused the slug-gish operation of the valve. Therefore, the valve was being inspected on a three month interval to insure its cleanliness. Pre se ntly, the valve is inspected on a semi-annual basis. F-49
4 The scoord noteacrthy cycat involved ths instcbility of the focdwator pumps automatic control system.s e, se On March 17, the B reactor feed-water pump (RFP) was in the automatic control mode and was responding pro-perly during startup. The pump discharge pressure slowly dropped yet speed and flow indications remained constant. When the reactor water level decreased, the pump was shif ted to manual and its speed was in-creased. The water level started to rise and the decay heat blowdown and
- main steam bypass valves were opened. The situation appeared to be under control when the water level again started to decrease. This required closing of the main steam bypass valve. The operator maintained a con-stant pressure through the use of control rods, yet the water level started to rise anyway. The main steam bypass and decay heat blowdown valves were opened a second time and the RFP speed was manually backed down. The level fluctuations were too great and too fast for the operator to control and the reactor scrammed on a high water level signal.
Investigation revealed that the pump controller in the automatic mode operated at a power level too low for stable operation. At this low speed, a f alse indication of a flow increase resulted from the feedwater not mixing with the recirculation water and condensing the steam bubbles. The increased void fraction reduced the bulk density of the recirculation water and thus reduced the mass flow rate. As the density of the fluid , continued to decrease due to the increasing void fraction, the differen-tial pressure increased. Hence, the operator observed a falso indication of a flow increase. Therefore, the pump is now required to remain in the manual mode until steam flow reaches 50,000 lbm/h. Tho' first significant event occurred on January 20 when vibrations at a substation tripped- a relay which de-energized several buse s. s s, a s The power f ailure was caused by vaintenance personnel working on a relay. The emergency diesel generator started on the second crank and main-tained essential loads. However, during the transient the reactor pres-sure increased causing the operation of the emergency shutdown condenser. The core spray pumps started automatically when the reactor water level decreased due to the coolant being displaced into the emergency condenser. i Several changes occurred due to this event. First, several altera- ! tions were made to the diesel generator to decrease its starting time. Secondly, due to the results of panel vibration, any relay not required for system protection and not having a restraint torque will be blocked open to prevent inadvertent operation of protective devices. See Sect. 4.5.2.1.2 for further details. The other significant event involved a transformer fire on March 24, 1971.ss,ss Offsite power was lost for 61 min. During the loss of power, seal inj ection to the CRD and FCP pumps was lost since the essential bus did not supply power to the seal injection pumps. When the CRD pumps re-started, water was drawn through the CRD nozzles without a seal water sup- l ply and the effluent temperatures increased. This resulted in a leak at I one of the CRDs and consequently, containment building air activity in-crea sed. Al so, the low pressure service water system was unavailable which rendered the decay heat removal system inoperable for decay heat l control. Hence, the emergency shutdown condanser was required for heat removal. For further details of this event se e Sect. 4.5.2.1.3. l l F-50 l 1
. ~ _ _ - - . -- - -- - . - - - - - - -
n.
1111 The number of reportable events increased to twenty-one during 1972. However, no re-occurring eveats were evidenced during the year. Three noteworthy events and one significant ovent occurred in 1972. The first noteworthy event involved a weld f ailure in the level control chamber.s4 On January 8, s 60-ins hole was blown out of the side of the level control chambe r. Contamination levels in the surrounding area reached up to 100 times the normal level. A poor weld was the cause of f ailure. The second noteworthy event occurred on June 27, 1972.ss In order to reduce -the activity in the base of the stack, the main condenser off gas was manually routed to the storage tanks f rom the normal route of dis-charging into the stack. Upon routing of the of f gas to the storage tanks, the compressor was started. An erroneous indication of steam flow from the heating boiler to the recombiner led to the incorrect decision to reduce steam flow. From the time the off gas was shif ted to the storage tanks, the recombiner outlet temperature rose to within 200*F of normal steady state operating conditions. One minute after the indicated steam flow had reached 650 lbm/h, a hydrogen explosion occurred in the off gas system. The off gas was manually shif ted from recombiner operation back to the stack. Ignition of the hydrogen was due to the reduction of dilu-tion steam coupled with the catalytic action in the recombiner or heat supplied from the electrical preheater coils. The pre s s ur e f rom the e n- I ergy release passed through the holdup tank and into the dryers rupturing a DP gage. The ruptured DP gage allowed off gas to pass directly into the stack without benefit of the holdup tank. The leak was stopped in 20 min by shif ting the off gas flow through the other dryer and capping the , lines to the ruptured DP gage. The release rates for 18 *Cs and is 2I were below the technical specifications limits. The third noteworthy event occurred on November 2, when feedwater flow control was lost.ss,s? The reactor water level control system was in the automatic mode. Since the feedwater flow recorder indicated flow oscillations, the operator switched the RFP to manual control. Feedwater flow settled out, but at a lower than nominal rate. Since the steam flow was greater than the new feedwater flow, the reactor water level de-creased. To prevent a low water level scram, the operator overincreased feedwater flow, but feed flow settled out below steam flow. The operator then reduced reactor power which decreased pressure, which in turn greatly increased feed flow. The reactor then scrammed on a high water level sig-nal. No f aults were found in the automatic control system, nor could the cause of the original oscillations be determined. Personnel believed that internal perturbations from the condensate system caused the initial feed flow oscillations. j The following event was significant and a more detailed account can be found in Sect. 4.5.2. On August 17, af ter repairing an oil leak on one of the two paralleled 69/161 kV transformers, maintenance personnel added oil to the transformer 'at a rate sufficient enough to raise the internal
, pressure above the trip set point on the sudden pressure relay.se The relay had not been disabled as required and tripped the breakers isolating
! both transformers. Conseque ntly, offsite power was lost.88 i t i F-51
1211 The lowest number of reportable events (eight) occurred in 1973. Five of the events involved the reactivity control system. In every in-stance, a control rod drive unit failed to scram. However, the sticking of one control rod is not a threat to plant safety as the other control ' rods possess enough negative reactivity to ensure subcriticality. i lili The number of reportable events increased to eleven in 1974. Again, no discernable trends were evidenced during the year. Three events were worth noting, all of which were significant. On September 28, 1974, e main steam isolation valve f ailed to fully close resulting in a low water level condition.88 The water level ecutin-ned to decrease and both core spray pumps autanatically started since the reactor feed pumps were not in operation. Examination revealed that the MSIV f ailed to seat in the fully closed position due to excessive wear of the valve operator. See Sect. 4.5.2.3 for further details. Another significant event occurred on September 17, 1974.** Pe rso n-3 nel performed maintenance on the 69 kV circuit breakers while the diesel ) generator supplied the plant load. Upon completion of the maintenance, I normal plant power was restored and the diesel secured. Later, the re-serve breaker opened and interrupted plant power.ss Manual attempts to restart the diesel failed. The diesel failed to start due to a high cool-ing water temperature interlock. For further details, see Sect. 4.5.2.1.5. The last significant event occurred on October 23, 1974 when offsite , power was lost for the second time during the year.ss,*2 A security fence was being installed around the plant when a post hole digger cut through j the control wires for the 69 kV tie line breaker. The breaker tripped open causing a loss of offsite power. For further details, see Sect. 4.5.2.1.6. 1111 , The number of reportable events was twelve in 1975. The control rod drive system experienced two of these f ailures. On one occasion, a con-trol rod drive motor f ailed when one phase was inadvertently grounded. On the other occasion, a control rod failed to hydraulically scram, but the electric motor drove the rod in automatically. Offsite power was lost on two occasions during the year.ss The plant was shutdown prior to both occasions. On May 12, the 69 kV breaker opened when an operator started a circulating water punp. A current differential caused the 69 kV breaker to open. During maintenance, this differential relay is normally opened. How ev er, the operator disabled the wrong re-lay.48 Offsite power was lost again less than two months later. On July 5, insects created a fault on a transformer. The switchyard lights attracted the insects. Therefore, the lights were turned off for the remainder of the year when insects are a problem.4: See Sect s. 4.5.2.1.7 and 4.5.2.1.8 ; for further details of these events. F-52
1111 , The number of reportable events increased to 17 in 1976. The control l l rod drive system was involved in three of these events. A control rod either f ailed to withdraw, failed to scram hydraulically or had its pres-sure switch scram set point drif t. One significant event occurred on April 1, 1976.44 The pressure set point for three main steam relief valves drifted. One of the relief ' valves would not open until the pressure reached 249 psi above the re-quired set point. For further details see Sect. 4.5.2.4. 1111 In 1977, only nine reportable events occurred. No significant events occurred during the year. However, e problem did develop with the clad-ding on several fuel elements.4 s During ref ueling operations in May, per-sonnel discovered that three of the seventy-two fuel assemblies had local-ized f uel rod f ailures. Some of the uranium in these rods had separated from the fuel assemblies. In addition, twenty fuel assemblies exhibited fission gas release rates above specified limits. For a more detailed so- j count of the fuel failures and the cause of these f ailures, see Sect. 4 4.5.3. IllE Thirteen reportable events occurred at Lacrosse in 1978. Six of these events occurred in the reactor containment system. Three events were due to leaking containment dampers, one due to f ailure of a personnel air lock leak test due to insufficient
- preparation, one due to the leakage of an outer equalizing valve on the main personnel air lock, and one leaky containment isolation valve.
The reactor water level reading errors were corrected at Lacrosse in 1970. However, on May 6,1978, a reactor water level reading was errone-ous.48 This time, the error was a direct result of a faulty level trans-mitter. A level transmitter malfunctioned due to an abnormally low output signal from the feedback amplifier which is a part of the transmitter, 1979 The number of reportable events increased to nineteen in 1979. As in 1978, the reactor containment system was the most reported system for the ! year (seven events in 1979). Leaks occurred at electrical penetration l seal s - (twice ), isolation valves (twice), dampers (twice), and an air lock
- (once ) .
i One noteworthy event as well as one significant event (a DBE) oc- ! curred during the year. On September 7,1979, the reactor flow scram by-pass switches were in the bypass position to permit completion of the con-trol rod scram tests prior to startup.47 Startup though, requires the switches to be in the " normal" position. During a routine check of the control room on September 9, the shift supervisor discovered that the l switches were still in the bypass position. No reduction in plant safety occurred since the reactor power did not exceed 0.1% and all other scram functions remained operable. F-53
A design basis event (DBE) occurred on November 9 when a problem in the turbine governor caused a scram.4 s A high cooldown rate resulted. The transient started when a turbine governor valve started to close and then reopened. As a result, the reactor pressure quickly increased caus-ing neutron flux spikes to occur. The flux spikes caused a reactor scram. The operators implemented full scram procedures. The pressure dropped enough that the MSIV closed which antanatically brought the shutdown con-denser into operation. The nearly continuous operation of the shutdown condenser and the' increased water level in the reactor vessel due to a de-layed tripping of the feedwater pumps produced a high cooldown rate.
- 128g
! Nineteen reportable events occurred during 1980. As was the case for the last two years, the reactor containment system was involved with a large percentage of the events being reported during the year (eight events in 1980). Again, the events were due to leaking isolation valves (four times), electrical penetration seals (twice), dampers (once), and air lock seals (once). No significant events occurred during the year, but for the second straight year, the maximum cooldown rate was exceeded.*
- On November 11, the cooldown rate exceeded the technical specifications limit at five points on the reactor vessel. Since a transient of this type occurred in May 1970, as well as in 1979, the region of maximum stresses in the vessel had already been analyzed. The stresses during this particular transient were less than one-half the ASME code allowable stresses. The importance of temperature differences and their effects during cooldowns was reempha-sized to all operations personnel.
128_1 Twenty reportable events occurred during 1981. The electrical power systems accounted for five of the events. On March 9, main power was lost due to an improper switching error.8* Once offsite power has reached the switchyard, there are two possible ways to provide station nower. The switching error isolated the reserve bus (bus B) from offsise power. A diesel generator automatically started and supplied power to the bus. Bus IA was operable throughout the event. The reserve bus (bus B) again lost power on November 12.s1 Power was I lost when the 2400 V 1B bus re' serve feed breaker did not automatically close. The 2400 V 1A bus did transfer properly to the reserve trans-former. The IB 480 V Essential Bus was supplied power from a diesel gen-erator. The other three events in the electrical power system concerned the loss of of f site powr. TWo of these events are significant (LER 81-02 and l LER 81-14)ss,ss and are discussed in detail in Sect. 4.5.1.2. The last event was not significant since offsite power was intentionally discon-nected (LER 81-01).s4 Ice formed on a circuit breaker preventing proper operation of that bresker. Offsite power was disconnected in order to melt the ice. F-54
l 4 The third significant event to occur during 1981 was the loss of con-tainment integrity.ss Two containment air lock doors were simultaneously open for a brief period of time. The locking mechanism that prevents both doors from being open simultaneously failed. For further details, see Sect. 4.5.2.6. 4.5.1.2 Systems involved. A compliation of reportable events by system and year is presented in Table 4.6. Subsystems having a maall num-ber of reportable events were combined into broader system titles when applicable. ! Approximately 81% of the reportable events involved the following ' systems: reactor systems (24.4%), reactor coolant systems (14.6%), reac-tor trip system (12.6%), reactor containment system (11.8%), emergency power (11.8%), and steam and power conversion systems (5.7%). The reactor systems (reactor core, internals, control), reactor coolant systems, amer-gency power, and steam and power conversion are general system categories. The reactor trip system and reactor containment system are specific subsys-
-tems with a suf ficient number of reportable occurrences such that they were considered separately. !
4.5.1.2.1 Reactor systems. This general system category consists of i the reactor internals, reactivity control, reactor core, and general reac-1 tor subsystems. This system accounted for 24.4% of the reportable events.
' The reactivity control subsystem involved most of the reportable events for this systen (36 of 60). Control rods and control rod drives dominated -
the equipment f ailures (29 events) with the majority of these f ailures due i to f ailure to scram hydraulically (nine times), inability to be withdrawn electrically (seven events), and one f ailure to scram both hydraulically and electrically. ! No significant events occurred in this system, however, several ; events worth noting did occur. The first event involved the inadequate calibration of nuclear instruments.ss,as During power escalation tests to 90% power in July 1969, thermal calibration readings revealed that the indicated power on the nuclear instrument channels was not in a one-to-one equivalence with the true power. A nonlinear variation of volds and zenon i buildup inhibited proper calibration of these instruments. The downcom-ers, which are between the neutron detectors and the core, experienced void formations from 0 to 25% of the volume (startup to full power respec-tively). As a result, the detectors saw a neutron-flux change of 80 to i 100% increasc over the fluz that would be present with zero voids during l startup. A revised control mode and subsequent instrumentation modifica-tions reduced the effect of void formations. + Another event considered noteworthy occurred during a plant cooldown on November 11, 1980.48 The cooldown rate exceeded the technical specifi-cations limit of 150*F/h at five points on the reactor vessel. However, the maximum cooldown rate (42*F in 7 min or 367'F/h) was less than that of a similar transient in May 1970 (825'F/h). Af ter the transient in 1970, the region of maximum stress in the vessel (head shell to flange) was an-alyzed. The vessel stresses in this region were less than one-half the ASME code allowable stresses. The vessel stresses for the 1980 transient , were less than those for the 1970 transient since the cooldown rate was lower and the cooldown limits were in regions of lessor stresses. The importance of temperature differences and their effects during cooldowns was reemphasized to all operations personnel. I
- i F-55
l a 0 6 3 3 9 3 9 1 6 4 3 71 6 t 6 3 4 3 2 o 4 T 2 1 8 4 2 4 2 $ 1 1 1 0 9 2 1 0 8 3 2 8 3 1 2 9 9 1 1 9 7 4 7 2 2 2 1 1 9 . 9 1
. 1 e
s 8 s 7 1 7 1 2 1 1 3 9 1 o 1 r c a L 7 7 2 2 3 1 1 9 t 9 a 1 s t n 6 e 7 4 2 6 1 4 7 v 9 1 e 1 e l b 5 a 7 3 2 3 1 3 2 t 9 1 r 1
- o p
e _ r 4 7 1 2 2 3 1 2 1 a - 9 1 f 1 d e v 3 l 7 5 1 1 1 8 o 9 v 1 n i
. s 2 m 7 5 4 1 1 3 5 2 1 e 9 2 t 1 s
y s 1 _ f 7 4 3 1 5 2 1 1 7 o 9 1 1 y r a z 0 e 7 7 5 8 3 2 1 1 2 2 0 u 9 3 S 1 6 9
. 6 7 3 1 2 1 3 7 4 9 1 1
e l b a 8 T 6 6 5 2 1 1 2 7 . 9 1 1 7 6 5 2 1 7 1 6 - 9 1 1 s l s o n e r s o r t m i u n e s s eme r t o t a c s e e y t v l - f d s s n b n y o a y a t s s s c a tci t e n r e y r s l n f o r e c r e a p a a i e t o e w w p l s t w eg wa p r1 1 o a o a op a p e o d c e n t 1 v s r y y s d i m r e c o r r u n t e r r e m i t e a a a c t o o e a r s 1 i a s t t n r t 1 l r m o y l c c i t c l l i e a i s a a a g s e e a x h e d t e e n n l u n a t t a o o R R E I E F A A O S R N T yy
In May 1969, personnel noticed several fuel pins had bowed during the last power operation.se The cause of bowing was not determined natil the October 1969 outage. TVo factors contributed to the problem: the shroud can locking rings were unlocked and high transverse power gradients devel-oped in the fuel elements. The shroud can locking rings were properly po-sitioned and a new control rod program was developed. This alleviated the twisting and stressing of the fuel pins and e1Luinated the bowing problem. For further details, see Sect. 4.5.3.1. Another problem was with the reactor water level readings. The true water level and the indicated water level disagreed by up to 19 in. de-pending on power level and flow conditions. A December 1968 revision to the LACBWR Technical Specifications allowed calibration of reactor water level channels at low power levels. However, the reactor water level at operating conditions was actually 19 in. higher than the indicated level. In July 1969, personnel performed a water level test with the reactor op-ersting at 90% power and a forced circulation flow rate of 90%. To deter-mine the true voided water level, the water level was raised past one probe and then lowered past another. The results of the test showed the voided water level to be 59 in, higher than the indicated level (as shown in the control room) . Since the standpipe error was 19 in., the swelling due to voids was 40 in. (for this test). When extrapolated to 100n power, 100% forced circulation flow, the swelling due to voids fell within the range of 42 to 48 in. External heaters, installed on the surf ace of the standpipe in April 1970, corrected the water level error. The use of heaters had several advantages: they eliminated the water level error, required no piping changes and therefore were easy to implement. Additionally, they required no recalibration of the level sensing instruments. During subsequent re- ~. actor heatup in May, data obtained from the standpipe temperature recorder indicated that the standpipe water temperature was equal to the reactor vessel water temperature. Calculations indicated an error of 1 in, be-tween the actual unvoided water level and indicated water level at operat-ing conditions (with zero voids). A water level test confirmed these cal-culations. To determine the amount of swelling at various power levels required additional te sts. The readings of the water level instruments .. were correlated with the two phase water level as determined with probes. In essence, this calibrated the water level instruments. Failed fuel assemblies began presenting problems in the control of the of f ga s activity in May 1977.88 During refueling operations, approxi-mately 55-in. (length) of fuel rod (representing parts of 7 fuel rods) was found missing from three fuel assemblies. In addition, twenty fuel assen-blies exhibited fission gas release rates above specified limits based upon fuel sipping measurements.84 ' Investigation revealed two sources causing fuel failures: excessive clad stresses and excessive fuel burnup. Since a correlation existed between previous fuel failures and the off gas activity, new operating restrictions limited the fuel burnup and of f gas a c tiv ity. Since the implementation of the restrictions, no multiple fuel element f ailures have occurred. For further details of fuel element fail-nres, see Sect. 4.5.3.1. 4.5.1.2.2 Reactor coolant systems. The eleven reactor coolant sys-tem and connected systems (see Table 1.2) accounted for 14.6% (36 of 246) of the reportable events. The most common equipment f ailures were valve F-57
i failures (fif teen occurrences). Design errors (five), maintonace errors (four), and operator errors (three) also contributed to the reporting of events in these systems. l Five events considered notwworthy and one significant event occurred in this system. The first noteworthy event was discovered duries a main-tenance shutdown in July 1968 when the reactor cavity was opened for in-spe ction. s ? One of the constant force hangers on the feedwater piping l within the cavity had a hanger rod bent 90'. The hanger rod buckled upon I initial plant heatup due to a compressive load applied at the end of the l hanger rod. Design calculations for thermal expansion of the feedwater pipe were inadequate. The hanger rods were redesigned in order to keep them f rom bending. Additionally, thermocouples were added to monitor the pipe temperature. No further henger problems have been reported. ) The second event involved one phase of the primary leak detection '
; program which involved continuously monitoring particulates in the air in j the lower reactor cavity.se Several samples taken on October 14, 1969, i indicated reactor recirculating coolant being released to tho' cavity at- '
mosphere. On November 4, a maall circumferential crack was discovered in
- the stainless steel transition section of the No. 2 feedwater injection nozzle. The nozzles were heat treated for stress relieving which resulted in sensitizing the stainless steel transition section. Examination of the other nozzles revealed an additional defect in the No.1 feedwater nozzle safe-end. Overall, eleven nozzles on the vessel has sensitized stainless steel transition sections. The probability of crack propagation in sen-sitized materials and the location of the nozzles necessitated the re-i placement of all eleven nozzles.
The third event,' which occurred on September 28, 1974, involved a f ailure of the MSIV to fully close resulting in a low water level condi-tion.s' During plant heatup operations, the operator inserted the control rods and closed the MSIV in order to open the turbine stop and reheater 1 steam valves to insure a slow heatup rate. Shortly after closing the MSIV, the water level decreased to the low set point on the water level alarm. The operator took corrective action by closing the main steam by-pass valve. The water level continued to decrease and both core spray pumps started since the reactor feedwater pumps were not in operation. Examination revealed that the MSIV failed to seat in the fully closed po-sition due to excessive wear of the valve operator. The fourth noteworthy event that occurred in this system was the in-stability of the feedwater pump automatic control system.s e, se The in-stability of the pump created water level fluctuations that were too great and too f ast for the operator to control. Investigation revealed that the pump controller in the automatic mode operated at a power level too low for stable operation. At this low speed, the operator observed a false indication of a flow increase resulting from the feedwater not mixing with the recirculation water and condensing the steam bubbles. The last noteworthy event occurred on November 2,1972, when feed-water flow control was lost.ss,sv The feedwater flow recorder indicated . flow oscillations so the operator switched the reactor feed pump to manual control. Feedwater flow settled out at a lower than nominal rate causing the reactor water level to decrease. The operator compensated and caused feedwater flow to greatly increase. The reactor scrammed on a high water level signal. No f aults were found in the automatic control system, nor i i F-58 i
could the original oscillations be determined. Personnel believed that external pertabations from the condensate system caused the initial feed flow oscillations. l The significant event that involved this system occurred on May 15, l 197 0s s, s T when the hydraulic control system initially closed tha turbine l main steam bypass valve. Since the hydraulic pressure was too high, the operator initiated normal shutdown procedures. As the control rods were inserted, the reactor pressure continued to increase since the main steam bypass valve was closed. Reactor power did not increase during the tran-sient but the reactor water level did. The water level rapidly rose since the established feedwater and seal injection flows exceeded steam flow. The increased water level decreased the pressure causing the MSIV to close and the emergency shutdown condenser (ESCS) to come into service. The operator switched the water level control system to manual and removed the ESCS from service in order to minimize the thermal transient on the ESCS tube sheet. The erratic action of the main steam bypass valve, the re-opening of the MSIV, and erroneous water level indication due to pressure change s made controlling the water level impossible. Manual closing of the main steam bypass valve sided in stabilizing the water level. The lowest water level reached during the event was 27 in, below the top of the core. At this time, the reactor had been shutdown for 10 min. There was no indication of an increase in fission products in the water. The cooldown rate (825'F/h) of the reactor exceed the technical specifica-tion 10ait of 150'F/h. The accident analysis " Accidental Opening of Main Steam Bypass Valve" was used for comparison. The analysis used a larger cooldown rate and a higher pressure drop and concluded that no serious consequences would result. A loose valve cover on the main steam bypass valve hydraulic control system directional valve restricted the movement of the valvo plunger so that it could not control the hydraulic pressure. The hydraulic system operating pressure returned to normal once the valve cover screws were ti ghte ned. Personnel secured the valve cover with cap screws and a safety wire to prevent inadvertent loosening. 4.5.1.2.3 Reactor trin system. The reactor trip system accounted for 12.6% of the reportable events. One-half of these events involved operator errors (14 of 31 events). In thirteen cases, the operator either down-scaled or f ailed to upscale's power range instrument which resulted in a reactor scram. Nine of these events occurred within the first seven months of operation. Overall, the power range instruments involved twenty-two events. Other than operator error, events which required the opera-tion of the reactor trip system were set point drif t (three events), noise spike s (three events), a malfunction in the instrument itself (two events), or a voltage transient (one event). ) Two noteworthy events occurred which involved the integrity of the reactor trip system. The first occurred on October 28, 1970, when a de-l sign error that allowed the power flow bypass switch to bypass both power-I flow channels was discovered.38 Tests conducted during power operation re-vealed a voltage transient occurred whenever the " Calibrate-Operate" switch on nuclear instrument channels seven or eight was returned to "Op-erste." When operating near 100% power, the voltage spike was of suf fi-cient magnitude to over-range the power / flow channel and produce a channel trip. During the performance of these tests, both power / flow channels F-59
,. ._ -.__ - - - - = . - . _-- - - - - _ _ _ . -- .---.
a j were negated in performing their saf ety related function. Since technical specifications do not permit negation of both power / flow channels sinal-taneously, modifications were made to the test procedures and to the coin-cidence logic circuit contact arrangement. The coincidence logic scheme and the intended performance of the scram circuits did not change. The other noteworthy event involved the low recirculation flow bypgss key switch not being returned to the normal position.4 ? Prior to the re- ,l actor startup on September 7,1979, the reactor low flow scram bypass switches were in the bypass position to permit completion of the control rod scram tests prior to startup. Startup position requires the switches to be in the " normal" position. On September 9, af ter startup operations 1 had be gun, the shif t supervisor discovered the switches in the wrong posi- l tion during a routine check of the control room. Since the reactor power 3 did not exceed 0.1% of authorized thermal power and all other scram func- l tions remained operable, reactor safety was not reduced. Procedural, ad-ministrative, and training actions were taken to increase operator atten-tion to accurate completion of startup procedures. 4.5.1.2.4 Reactor containment systems. The reactor containment sys-tems also accounted for 11.8% (29 of 246 events) of the reportable events. A large maj ority (26 events) concerned leaks. The leaks were due to valve l failures (15 events), penetrations into containment seals (6 events), air locks (3 events), and dampers (2 events). None of these events threatened plant safety nor was considered significant. However, one event worth noting did occur in this system. On May 18, 1981, an attachment was in-stalled on a containment pressure sensing'line without an approved f acil-l ity change or maintenance request. s
- The potential existed for a degrada-i tion of containment integrity. When tested, the leakage was minimal.
{ ' During installation, the high containment building high pressure starting signal to the IB high pressure core spray pump, the IB alternate core spray pump, and the 1B alternate core spray valve was isolated. The at-
- tachment was removed and the original configuration was tested with zero leaka ge . Proper procedures for f acility changes and maintenance proced-uros were reemphasized with the individuals involved.
l 4.5.1.2.5 Emeraency nower systems. The electric power systems were involved in 11.8% (29 events) of the reportable events. The diesel genera-tors f ailed on six occassions with five of these occurring af ter the in-stallation of the second emergency diesel generator in 1976. Maintenance errors accounted for five events and two of these were significant. Over-all, one event was noteworthy and ten were significant. The noteworthy event occurred on January 31, 1969, while an attempt was being made to transfer plant electrical loads from the reserve feed to the main feed auxiliary transformer.88 The 2400 V bus 1A main feed break-er was closed which tripped the reserve feed breaker with a normal trans-fer. The same sequence occurred on the 1B main and reserve feed breakers. However, the IB main feed breaker reopened which caused an undervoltage on the IB bus. A partial scram resulted as well as a trip of the forced recirculating pump 1B. Investigation revealed that if the control switch of either main breaker is not held in the closed position until the closed indication light is on, the main breaker will trip the associated reserve breaker and then reopen. This will leave the bus without a power source. Therefore, the operator must be sure that the 2400 V source is closed on the bus prior to tripping a breaker. i l 1 F-60
The next ten events were considered significant and all involve losse s of off site power. This particular type of event is of concern to Lacrosse since only one of f site tie-line exists and the plant does not have the capability of sustaining a partial loss of of f site power. A brief description of each event follows with a more complete discription given in Sect. 4.5.2. The first event occurred in March 1969.as The DPC system was iso-lated to make a tie in on the 161 kV portion of the Genos substation. Three lighting arrestors shorted causing the protective relays to open and power to be lost. Since fly ash caused the arrestors to short, the arres-tors were washed and cleaned to eliminate further f ailures. On January 20, 1971, an electrical power failure deenergized the 69 kV plant tio line.as,ss The emergency diesel generator started on the second crank and maintained the essential loads. The power f ailure was caused by maintenance personnel working on a relay in the Genos substa-tion, causing a vibration suf ficient enough to trip a protective dif fer-ential relay. The differential relay tripped breakers which deenergized the 161 and 69 kV buse s, thus doenergizing the plants 69 kV tieline. Decay heat increased reactor pressure and the emergency shutdown condenser was brought into service to limit the pressure. The emergency core spray pump started automatically when the reactor water level decreased due to coolant being displaced to the shutdown condenser. Several change s oc-curred due to this event, including alterations to the diesel generator to decrease its starting time. Also, the transmission maintenance depart-ment was informed of the results of the panel vibration. Henceforth, any relay not having a restraint torque and not required for system protection will be blocked open with insulating material to prevent inadvertent oper-ation. On March 24,1971, the 69 kV tie-line breaker opened causing a load rej ection. s s, s A potential transformer exploded and hurled one of its leads across two phases of the 69 kV bus and resulted in a large fire in the switchyard. Power was restored af ter 61 min. However, during the loss of power, seal inj ection to the CRD and FCP pumps was lost since the essential bus did not supply power to the seal inj ection pump. Prior to. j power restoration, hot water was pumped through the CRD nozzles causing the effluent temperature to increase. This resulted in a leak at one of the CRDs and consequently, containment building air activity increased. The low pressure service water (LPSW) system was also unavailable which rendered the decay heat system inoperable for decay heat control. This required the shutdown condenser to provide heat removal. Therefore, a cross connect line was installed between the high pressure service water system and the LPSW system. Also, the seal inj ection pumps are now pro- / vided with power f rom the essential bus during loss of of f site power. The fourth event occurred on August 17, 1972, while one of two paral-l 1elled 69/161 kV transformers was taken out of service to repair an oil l l 1eak.s7,38 Maintenance personnel added oil to the transformer at a rate j suf ficient enough to raise the transformers internal pressure above the ( trip set point on the sudden pressure relay. The relay had not been dis-abled as required and tripped the breakers isolating both transformers. The fif th event occurred on September 17, 1974. Personnel performed maintenance on the 69 kV circuit breakers while the diesel generator l F-61
supplied the load. s s,4 e Upon completion of maintenance activities, power was restored and the diesel generator secured. Later, the reserve breaker opened and interrupted plant power. Manual attempts to restart the diesel failed. The diesel failed to start due to the lockout in the starting circuit caused by a cooling water high temperature interlock. Therefore, J the high temperature cut-off switch was renoved from the diesel start cir-cult but an alarm was retained. While erecting a security fence around the plant on October 23, 1974, plant personnel cut through the 69 kV tio line control wires.ss,4e This caused a falso phase differential signal that tripped the 69 kV tir-line breaker. A maintenance error caused offsite power to be lost on May 12, l 1975.ss,4s While performing maintenance, the operator disabled the wrong I differential relay. When a circulation pump was started up, it caused a l current differential of sufficient magnitude to cause the differential relay to open. On July 5,1975, an accumulation of insects on a transformer shorted ' the transformer to ground.ss,4s The insects were attracted to the switch-yard by the switchyard lights. The lights were turned off for the re-mainder of the season.
- Offsite power was lost on February 1,1981 when an operator opened i
the wrong air disconnect breaker.ss The breaker to the main transformer was to be opened to allow repair work in the switchyard. Instead, the operator opened the breaker to the reserve transformer which was supplying station power. On December 23, 1981, the reactor scrammed and the oil-filled circuit breaker (OCB) that connects the reserve transformer to the 69 kV line tripped.ss The offsite transmission network did not autanatically supply
; the onsite power distribution system. Both diesels supplied the essential ; buses. The reserve transformer relay was reset and the breaker closed.
l t The 1A 2400 V Reserve Feed Breaker was then closed, but the 1B 2400 V ke-serve Feed Breaker could not be closed. The 480 V tie breaker was closed connecting the 1A and Ib 480 V buses. The diesels were then secured.
, 4.5.1.2.6 Steam and nower conversion systent. The steam and power
( conversion systems accounted for 5.7% of the reportable events. Valve f ailures involved 71% of the events for this system (10 of 14 events). The events involving valves were due to operator errors, the valve being in the wrong position, or failing to open or close upon demand. TWo of the events are worth noting, one of which was significant. The first event occurred on January 8,1972, when the level control chamber had 60 in.8 blown out of its side.s4' At the time, the reactor was operating at ~97% power. Contamination levels in the surrounding area reached 100 times the normal level. The rupture of the chamber originated from a poor weld at the branch connectica. The weld produced a critical crack that propagated around the pipe for 60% of the circumference. The cause of failure was a poor weld penetration at the tranch connection, poor weld surf ace penetration at the joint, and inadequate weld reinforce-ment metal for strength compensation at the operating temperature and l pressure conditions. The second event, which is a DBE and hence a significant event, oc-curred on November 9, 1979. A problem in the turbine governor caused a scram and a high cooldown rate.4 s F-62 ; l
4 The reactor was operating at 85% power when turbine governor initial pressure regulator system experienced an unexpected reduction in freedom of movement. The turbine governor valves started to close and then re-opened to their prior position almost instantaneously. As a result, the reactor pressure quickly increased f rom 1248 psi to 1276 psi, causing non-tron flux spikes to occur on the nuclear instrument channels. The flux spike s caused a scram and the operators implemented full scram procedures. The reactor pressure decreased causing the MSIV to close and the shutdown condenser to operate. During this time, the reactor feed pump flow was reduced. However, the reactor water level increased before the feed and condensate pumps were tripped and the feedwater stop valve was closed. Following the scram, the reactor vessel cooled down at a rate of 423*F/h. TWo f actors contributed to the increased cooldown rate of the reactor vessel: nearly continuous operation of the shutdown condenser for ten min, and increased water level in the reactor vessel due to a delayed tripping of the feedwater pump. Technical specifications limit the reactor vessel cooldown rate to 150*F/h during shutdown operations. The reactor vessel stresses resulting f rom this cooldown were well within the allowable ASNE code requirements. Af ter reviewing the incident, LACBWR personnel concluded that the addition of an alarm that shows the operational status of the shutdown condenser should be studied. At the time of the incident, only one alarm provided indication of the shutdown condensers operation. The operations staf f also stressed that operators should take suf ficient time to evaluate overall plant conditions prior to initiating corrective actions. 4.5.1.3 Causes. Each reportable event was categorized by the cause code s listed in Table 1.4. The number of reports by year attributed to each cause is found in Table 4.7. Human f ailure can be further subdivided into two groups: out-of-plant personnel error and in plant personnel error. Out-of plant personnel errors involve administrative, design, and f abrication errors which gen-erally concern the reactor or component vendor, the A/E, or the utility mana gement. In plant personnel errors concern hands on human involvement such as installation, maintenance, or operator errors and in most cases pertains to the plant operating staff itself. Equipment / weather related causes were reported for 135 (54.7%) events with the remaining 112 reports being attributed to human error. Of the human errors, thirty-nine reports were attributed to out-of plant person-nel and the remains seventy-three reports to in plant personnel. Thus approximately 65% of the human errors were caused by in plant personnel. 4.5.1.4 Events of environmental imoortance. A summary of radioac-tivity releases f rom Lacrosse is shown in Table 4.8. The table gives the airborne and liquid releases and the solid waste shipped for the years 1967 through 1981. Ten events occurred at Lacrosse which involved or could have involved l radioactivity releases and personnel exposure. These events are listed in Table 4.9. Three of the events were due to operator errors while the other events were due to maintenance errors (1), fabrication errors (1), inherent failures (3), or by unknown cause s (2) . i Four events occurred at Lacrosse that were of environnental signifi-cance. However, Lacrosse had no control over one of the events. On May l F-63 l
Table 4.7. Ceases of reportable evente by year at Lacrosse 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1900 1981 Total Adelaistrative error (A) i 1 2 1 2 1 1 3 2 14 Design error (B) 2 3 2 4 2 1 1 1 1 17 Fabriestlos error (C) 1 1 1 1 1 2 1 8 Inherent error (D) 4 9 5 11 9 7 6 7 5 10 7 9 14 12 12 136 Isotallation error (E) 1 1 3 3 1 1 1 Lightalag (F) 11 Naistenance error (G) 1 2 5 5 3 1 1 2 1 3 1 23 n operator error (E) 8 3 2 7 2 6 1 2 3 1. 2 37 g Weather (I) 1 1 hhwa 1 1 1 1 4 Total 16 17 17 31" 17 21 8 11 12 17 9 13 19 19 20 247 "Omo report see neelgaos two senses.
r
'- asa
...II 1a.
4 a
- l 8.-.8
-- tt - ~
tat M - saaa M...I Isa a f
- Sat %s SRB 3 44444 AAA A
.~ ~
. 3 a Is a l E 4"E 95
-m 9
. saaa
....I Isa a
$.3999
~ --
859 5
--- N l
~ aaaa
.--.l $$a a 1 E NA:8: :: 8
- Ala AJ a A a i II Is I I E qg
- ~
qq l
-~-
saa
. . Iaa~as
! E E.EE49
~99 3
. seata asa a g E9395 598 5
I " IIIa I
% : -...: :- a f= i:AAA A14 J > . - -H ' = ~
a a<a< < as< < 8=S== 02" A 4 da
" ~~
E ig"Ci
& C h
2 A : a;
- N -
2 I4E< IE< <
- .=8.== .
. S. =
i sa=== _n ; g A ,
~ M 3
.titi 333 3 .
" e 8 -
. = (CC) un
- 5) 4/7 %50 93/5? Power reduction to clean circulating A 5 Steam & Heat N1.1 water inlet boxes and tubing of the Power Exchangers turbine condenser caused by trash (HF) Filters in the Mississippi River.
- 6) 5/2 s20 100/50 Power reduction to clean circulating A 5 Steam & Heat N1.1 water inlet boxes and tubing of the Power Exchangers turbine condenser caused by trash in (HF) Filters the Mississippi River.
- 7) 5/26 2 CRD No. 2 upper mechanism A 1 Reactor Control N1.1 mechafical seal leakage. (RB) Rod Drive Mechanisms
Table A1.8 (Continued) CBE(D)/ Date Duration Power Reportable '" "" 'I"I'* **P "*"E I No* Description Cause (1974) (Hrs) (%) Event Method Involved Involved Event Category
- 8) 5/27 2 CRD No. 2 upper mechanism A 1 Reactor Control N1.1 mechanical seal leakage. (RE) Rod Drive Mechanisms
- 9) 6/4 26 80/35 Power reduction. Turbine generator A 5 Steam & Turbines N1.1 taken off line to permit adjust- Power monts of the turbine initial pres- (HA) sure regulator system.
- 10) 6/14 97/65 Power reduction. Clean main steam A 5 Steam & Filtern N1.1 condenser inlet water box. Power (HF)
[f 11) 6/16 2 74 Operator error in adjusting C 3 Inst rumenta- Inst rumenta- N1.1 pa NIC No. 7 caused abnormal tion & tien & [" power flow. Controla Controls (IA)
- 12) 6/18 112/98 Po' w ar reduction. Clean main steam A 5 Steam & Filters N1.1 condenser inlet water box. Power (HF)
- 13) 6/25 %30 97/45 Power reduction. Purification A 5 Steam & Pumps N1.1 pump mechanical seal leakage. Power (HF)
- 14) 7/15 25 97 011 leak on CRD No. 19 A 1 Reactor Control N1.1 hydraulic accumulator (RB) Rod Drive Mechanisms i
_-. . . - . . . . . , _ _ . - ~ - - _ - ,
. - . - - - . . , _ . . . . ~ . - - . . . - - - . .
I i l Table A1.8 (Continud) DSE(D)/ ; Date Dura
- ion Power Reportable Shutdown System Component NSIC(N)
"** (1974) (Hrs) (2) Event Description Cause Method Involved Involved Event Category .
i I 1 i 15) 8/10 4 97 011 leak on CRD No. 7 hydraulic A 1 Reactor Control N1.1 i accumulator. (RB) Rod Drive Mechanisme l . 16) 8/28 2 97 LTR Loss of power to I&C regulated A 3 Instrumenta Transformers N1.1 a 8/29/74 bus RL-1 caused low recircula- tion & i tion flow indication. Controls t (IA)
- 17) 9/24 93 89 A0 011 leak on CED No.12 A 1 Reactor Control N1.1 i 74-05 hydraulic accumulator. (RB) Rod Drive Mechanisme I
]1 18) 9/28 294 Low LAC- Leaking MSIV cuased a low A 3 Reactor Valves N1.1 pa 2789 vater level scram. Coolant
[d AO (CC) 74-06
- 19) 10/11 33 %60 011 leak on CRD No. 19. A 1 Reactor Control N1.1 (RB) Rod Drive Mechanisms
- 20) 10/23 25 97 Load rejection due to in- B 3 Electrical Electrical D2.2 i advertent severing the Power Conductors .
control wires for the 69 (EA) ! kV tie line breaker. i
- 21) 11/14 Low DCP Oscillation of seal injection B 3 Reactor Pumps D3.1 ,
74-30 pressure caused both FCPs to Coolant trip. A bolt had been dropped (CB) on a Flow Meter. 1 i 1 J
, , - -- r,-.- - - - ~ , , -- _
i Ta le A1.8 (Continued) Date Duration Power Reporta31e DBE(D)/ 8 Description Shutdown System Component NSIC(N) (1974) (Hrs) (%) Event Cause Method Involved Involved Event Category
- 22) 11/14 Low DCP Operator error. MSIV bypass C 3 Reactor Valves E6.1 74-31 key was turned to " normal" Coolant at the wrong point in the (CD) procedures.
*1 i
W W (D
Table A1.9 1975 Forced Outages and Power Reductions for Lacrosse DBE(D)/ Date Duration Power Reportable Shutdown System Component NSIC(N) Description Cause Event No* (1975) (Hrs) (%) Event Methed Involved Involved Category
- 1) 1/13 32 Improper switching of safety G 3 Instrumenta- Instrumenta- N6.1 system channel, tion & tion &
Controls Controls (IA)
- 2) 2/17 2 LAC BWR Spurious short period signal A 3 Instrumenta- Instrumenta- N2.4 IIR 75-3 on NIC 4. tion & tion &
Controls Controls (IA)
- 3) 2/17 2 LAC BWR Spurious short period signal A 3 Ins t rumenta- Instrumenta- N2.4 IIR 75-4 on NIC 4. tion & tion &
Controls Controls ]1 (IA) H (( 4) 2/21 98 LAC BWR While performing a technical IIR 75-6 specification test on a re-C 3 Instrumenta-tion & Instrumenta- N6.1 tion & circulation power flow channel Controls Controls an operator turned the wrong (IA) switch.
- 5) 3/10 19 Spurious high flux trip. A 3 Instrumenta- Ins t rumenta- N2.4 tion & tion &
Controls Controls (IA)
- 6) 3/14 7 Operator turned wrong nuclear G 3 Instrumenta- Instrumenta- N6.1 channel for calibration. tion & tion &
Controls Controls (IA)
- 7) 3/21 20 Suction bellows to condensate A 3 Steam & Pumps N1.1 pump partially collapsed. Power (HG) 9
Table A1.9 (Continued) Date C3E(D)/ No. Duration Power Reportable Shutdown System Component Description Cause NSIC(N) (1975) (Hrs) (%) Event Method Involved Involved Event Category
- 8) 4/17 2 68 LAC BWR Operator erroneously closed C 3 Reactor Valves D2.4 IIR 75- MSIV. Coolant 18 (CD)
- 9) 4/17 103 2 A0 DC ground and transfer switch A 1 Electric 75-01 Circuit N1.1 damaged. Power Closers /
(EC) Interrupters
- 10) 8/13 8 30 Seal water injection system A 3 Reactor Pumps D3.1 oscillations tripped both FCPs. Coolant (CH)
- 11) 8/13 5 2 Loss of relay in scram cir-m1 A 3 Instrumenta- Inst rumenta- N2.1 cuit.
j, tion & Controls tion & Controls bJ o (IA)
- 12) 8/14 190 2 Seal water injection system A 3 Reactor Pumps D3.1 oscillations tripped both Coolant FCPs. (CH)
- 13) 8/18 5 61 Hydraulic oil leakage of A 1 Reactor Control N1.1 CRD No. 2 (RB) Rod Drive Mechanisms
- 14) 9/17 3 96 Spike on NIC No. 7 due to A 3 Instrumenta-velocity limiter of P/F Instrumenta- N2.4 tion & tion &
circuit. Controls Controls (IA)
Table A1.9 (Continued) DEE(D)/ Date Duration Power Reportable Shutdown System Component NSIC(N) U** Description Cause Involved Involved Event (1975) (Hrs) (%) Event Method Category Repairs to sampling line con- A 1 Reactor Pipes, N 1. ?.
- 15) 12/15 6 nection on feedwater system. Coolant Fittings (CH)
Mechanic tripped electrical G 2 Electric Pumps N1.1
- 16) 12/21 15 breaker for coupling fluid Power pump motor. (EB) m i
H PJ W s
Table A1.10 1976 ' Forced Outages and Power Reductions for Lacrosse Date Duration Power Reportable DDE(D)/ Shutdown System Component N'* (1976) (Hrs) (%) Event "#'E ' " ""'" Method Involved NSIC(N) Involved Event Category
- 1) 2/12 17 %45 Noise 'in nEclear instrument A 3 Instrumenta- Instrumenta- N2.4 channel. , tion & tion &
' Controls Controls (IA) k
. 2) 2/23 59 s90 RO Leak on purification system A 1 Reactor Domineralizers N1.1
- 36-01 required isolation resulting ,
- Coolant , i in high chlorides in primary. (CG)
Repaired.
- 3) 8/12 1 4100 Intermediate range nuclear instru- A 1 Instrumenta- Ins trmacn ta-ment channel No. 4 inoperative. h2.1 tion & tits ?-
Controls Controls i (IA) F" 4) 8/15 40 LekXage on the No. 2 main steam A 1 Reactor
$j relief valve.
Valves N1.1 Coolant t (CC)
- 5) 9/24 13 , s90 D ring test, operator selected C 3 Instrumenta- Circuit E6.1 an active nuclear channel and tion & Closers /
scrammed reactor.' Hiscellaneous Contrals Inturrupters
? maintenance was performed (IA)
,F) ' '9/26 15 s90 Repair gasket leak on water storage A 3 Steam & Vessels, N1.1 tank $n the generator plant. Power Pressure <
(HJ) g ,
- 7) 9/30 14 s80 Feed pump trip due to insufficient
- A. 2 Reactor Pumps D2.7 oil pressure from auxiliary oil Coolan t -
pump. e (CH) -
.~
1 l
. _ ._ _7
.y.. .. -. . ._ _ _
_ _ _ _ _ _ . . v. . _ . . ._ . _ . . . .__ - _. .
'f_
\ /
Table A1.10 (continued) DBE(D)/ f Duration Power Reportable Shutdown System Component NSIC(N) Date Description Cause-38' (2) Evant Method Involved Involved Event (1976) (Hrs) Category
- 8) 11/2 119 +95 Forced circulation pump 1A A 1 Reactor Pumps 51.1 seal repair. Coolant
'(CB)
- 9) 11/13 168 %75 Replaced the 1A forced A 1 Reactor Pumpe N1.1 circulation pump seals. Coolant (CR) ,
s N I ha bJ W I 4 I I
Table A1.11 1977 Forced Outages and Power Reductions for Lacrosse DBE(D)/ Date Duration Power Reportable Shutdown System Component NSIC(N) No. Description Cause (1977) (Hrs) (%) Evant Method Involved Involved Event Category la) 2/2 2 MO Operator error while switching C Reactor ieedpumps. 3 Circuit N6.1 Coolant Closers / (CH) Interrupters Ib) 2/2 118 Outages extended to replaced C 4 Steam & Pumps f'orced circulation pump Power seals. (HP)
- 2) 2/11 17 40 Test on NI channel 6 resulted G 3 Instrumenta- Instrumenta- N6.1 in scram due to electrical plug tion & tion 6 contact misalignment on channel Controls Controls 5.
(IA) N 3) 2/23 18 %0 Outage to repair hydraulic leaka A 1 Reactor h on two control rod drive mech- (RB) Control Rod Drive N1.1 y anisms. Mechanisms
- 5) 5/11 58 %5 Seal Injection System sensing A 1 Reactor Pipes. N1.1 line leakage. Coolant Fittings (CB) l l
l
~
- 1 Table A1.12 1978 Porced Outages and Power Reductions for Lacrosse DBE(D)/
Data Duration Power Reportable Shutdown System Component NSIC(N) escription Cause Involved No. (1978) (Hrs) (%) Event Method Involved- Event Category
- 1) 3/15 19 3 Turbine governor control oil A 1 Steam & Valves N1.1 contaminated with sediment Power or fine particles caused control (HA) piston in valve to stick.
- 2) 3/16 74 s15 Turbine governor control oil A 3 Steam & Valves N1.1 contaminated and control piston Power in valve stuck. (RA) -
l
- 3) 3/21 41 %15 Turbine governor control oil A 3 Steam & ' Valves N1.1 contaminated and control piston Power in valve stuck. (RA)
]1 4) 4/27 368 %90 Vibration on bearing of fluid A 2 Reactor Pumps N1.1 e4 coupling on forced circulation Coolant y pump 1A. (CB)
- 5) 5/19 56 N60 Spurious spike on power range A 3 Instrumenta- Instrumenta- N2.4 instrument.
tion & tion & Controle Controls (IA).
- 6) 5/28 89 %80 Replaced leaking main steam A 1 Reactor Valves' N1.1 relief valve. Coolant
-(CC)
- 7) 6/2 28 41 A scram auxiliary relay dropped A 3 Instrumenta- Relays N2.1 out resulting in scram. tion &
Controls
'(1A)
Table A1.12 (Continued) DBE(D)/ Date Duration Power Reportable Shutdown System Component NSIC(N) N **'E " *"8* (1978) (Hrs) (%) Event Method Involved Involved Event Category
- 8) 6/22 90/80 Power reduction due to increased 5 A Reactor Pumps N1.1 vibration in FCP 1A fluid coupling Coolant bearings. (CB) i
- 9) 7/1 25 80 Spurious spike on power range A
)
3 Instrumenta- Instrumenta- N2.4 instrumentation. tion & tion & Controls Controls (IA)
- 10) 8/2 80/79 T.-*er reduction due to increased A 5 Reactor Pumps N1.1 i
vibcation in FCP 1A fluid coupling Coolant bearings. I (CB) i 51 11) 8/15 38 %75 Spurious spike on power range A 3 Instrumenta- Instrumenta-
.d. instrumentation. N2.4 bJ tion & tion & i CD Controls Controls (IA)
- 12) 8/17 22 %30 011 leak on turbine bypass valve A 1 Reactor Valve N1.1 actuator. Coolant Operators (CC)
- 13) 8/19 25 Malfunction of a E/P control relay A i
3 Reactor Relays D3.1 on a seal injection control valve Coolant causing recire pump trip. (CB)
- 14) 8/24 13 640 Switching error resulted in scram. G 3 Instrumenta- Inst rumenta- N6.1 tion & tion &
Controls Controls (IA) l l l l l I _ . ~
Table A1.12 (Continued) LDE(D)/ Date Duration. Power Reportable Shutdown System Component NSIC(N) No. 88Cription Cause (1978) (Hrs) (%) Event Method Involved Involved Event Category
- 15) 9/9 80/79 Power reduction due to A 5 Reactor Pumps N1.1 -
increased vibration in Coolant FCP-1B fluid coupling (CB) bearings.
.16) 9/18 79/78 Power reduction due to increased A 5 Reactor Pumps N1.1 vibration in FCP-1A fluid Coolant coupling bearings. (CB)
, 17) 9/25 78/77 Power reduction due to increased A 5 Reactor Pumps N1.1 t vibration in FCB 1A fluid Coolant coupling bearings. (CB) ms 18) 10/17 567 Repairs on forced circulation A 1 Reactor Pumps N1.1
). pump.. Coolant b) (CB)
N
- 19) 11/17 66 40 Low flow spike on forced circ A 1 Instrumenta- Instrumenta- N2.1 loop, but no faults were tion & tion &
found. Controls Controls (IA)
- 20) 11/17 62 Low flow spike indication A 3 Instrumenta- Instrumenta- N2.4 caused indication of power tion & tion &
to flow mismatch. Controls Controls (IA)
- 21) 11/20 150 62 Replaced seal on forced cire A 3 Reactor Pumps N2.1 pump. Low flow indication Coolant caused a scram. (CB)
Table A1.13 1979 Forced Outages and Power Reductions for Lacrosse Date Duration Power Reportable DBE(D)/ No. Description cause Shutdown System Component NSIC(N) (1979) (Hrs) (%) Evant Method Involved Involved Event Category
- 1) 1/13 269 49 l' allure of a control rod scram A 3 Instrumenta- Instrumenta- N2.1 solenoid on CRD 13 due to a tion & tion &
short circuit to ground. Controls Controls (IA)
- 2) 1/24 37 31 Failure of a control rod scram A 3 Instrumenta- Instrumenta- N2.1 solenoid due to a short circuit tion & tion &
to ground. Controls Controls (IA)
- 3) 5/27 24 Spurious short periods on A 3 Instrumenta- Instrumenta- N2.4 NIC No. 3. tion & tion &
"1 Controls Controla l (IA) ba 4) 5/29 9 00 Power reduction. Turbine inlet A 5 Steam & Mechanical N1.1 valve governor problems. Power Function (RA) Units
- 5) 5/30 26 Loss of control power due to A 3 Instrumenta- Relays N2.1 failure of control rod scram tion &
relay. Controls (IA)
- 6) 6/1 34 Low MSIV closure due to loose wire A 3 Reactor Electrical N1.1 on relay of valve control cir- Coolant cultry.
Conductors (CD)
- 7) 6/18 15 490 Loss of power to pressure trans- C 3 Reactor Circuit D2.4 mitter closed the MSIV, causing Coolant Closers /
a scram. (CD) Interrupters
s 4 i Table A1.13 (Continued) DBE(D)/ i Date Duration Power Reportable Shutdown System Component NSIC(N)
**** E ' " *"**
I "'" (1979) (Hrs) (%) Evant Method Involved Involved Event Category ! s
- 8) 7/3 20 93 MSIV closure when a circuit C 3 Reactor Circuit *D2.4 fuse was removed. Coolant Closers / r 1 (CD) Interrupters j i .
- 9) 7/4 34 LER" Repair main steam bypase valve A 1 Steam & Valve N1.1 i 79-13 operating cylinder which had Power Operators I developed an oil leak. t (HE)
I
- 10) 7/7 12 75 Failure of a seal injection dif- A 3 Instrumenta- Inst rumenta- N2.1 ferential pressure transmitter tion & tion &
caused both FCPs to trip, which Controls Controls l prompted the safety system to (IA) i scram the reactor.
'vJ l 11) 7/31 80/46 Power reduction to remove silt A 5 Steam & Filters N1.1
$$ from ' turbine condenser water Power 43 box. (HF)
- 12) 8/15 90/85 Power reduction due to instability A 5 Steam & Instrumenta- N2.1 of turbine governor control. Power tion &
(RA) Controls.
- 13) 9/4 137 Repair packing on the 1A forced A 1 Reactor Valves N1.1 circulation pump discharge by- Coolant Instrumenta-pass valve and perform mainte- (CB) tion &
, nance on turbine governor control Steam & Controls ! system. Power
- 1 (BA) 4 i
e 1
Table A1.13 (Continued) Date Duration Power Reportable DBE(D)/-
"** **** P " *"**
Shutdown System Component NSIC(N) (1979) (Hrs) (%) Event Method Involved Involved . Event Category
- 14) 9/28 247 Mechanical seal leakage in an A 3 Reactor Control N1.1 upper control rod drive mecha-(RB) Rod Drive nism led to seal leak-off water Mechanisms 1
accumulating on a scram solenoid. I. 15) 10/8 Low ' Response problems in turbine A i 1 Steam & Instrumenta- N2.1 control systen. Yower l tion & 1 (RA) Controls j 16) 11/9 30 85 LER Response problems in turbine A j 3 Steam & Instrumenta- N2.1 79-17 governor control system.
- Power tion &
(HA) Controls ! mg
- 17) 11/29 27 85 Turbine building steam isola- A 3 Reactor Instrumenta-i d, tion. valve position limit N2.4 j to Coolant tion &
C3 switch actuation due to vibra- (CD) Controls l tion. l M 4 4 b i i a f
_ _ _ . . - . . . _ _ _ _ _ . . . _ _ _ _ _ _ . - . . _ _.._s _ . _ . _ , _ . .- _., _ .- .s i 1 I I I 4 i Table A1.14 1980 Forced Outages and Power Reductions for Lacrosse t I DBE(D)/ S Date Duration Power Reportable Shutdown System Component NSIC(N)
"** Description Cause (1980) (Hrs) (%) Event Method Involved Involved Event -
Category
- 1) 2/1 75 85 Spurious low voltage signal A 3 Electrical Ele'ctrical D2.3 I on turbine building MCC 1A. Power Conductors
} (EB) I
- 2) 3/20 85/47 Power reduction to remove A 5 Steam & Filters N1.1
- silt from turbine condenser Power Heat
- water boxes and clean condenser (RF) (HC) Exchangers I
t ! 3) 4/6 580 85 Install relief valves and modify D 1 Engineered Instrumenta- N8.0 b j containment isolation valve Safety tion &. E i closure systems (NUREG-0578). (SD) Controls Valves t I
- 4) 4/28 0.5 Feedwater pump did not keep C 3 Reactor na Pumps N6.0 t i up vith steam withdrawal. Coolant I
[]
>d (CH)
- 5) 4/28 Low Scram solenoid coil burned A 3 Reactor Instrumenta- N2.1 i
{ on CRD No. 29. (RB) tion & , Controls ' i 4 . , 6) 4/29- Fuse burned out due to short A 3 Reactor Instrumenta- N2.1 circuit on CRD mechanism (RB) tion & No. 1. Controls i
- 7) 6/21 85 Seal leak in' Upper Control A' 1 Reactor Control N1.1 Rod Drive Mechanism No. 24. (RB) Rod Drive Mechanisms NUREC-0578 TMI-214ssons Learned Task Force Status Report and Short Tem Recommendations.
P t i
Table A1.14 (Continued) Date DBE(D)/ No. Duration Power Reportable Shutdown System Component Description Cause NSIC(N) (1980) (Hrs) (%) Event Methcd Involved Involved Event Category
- 8) 6/21 85 Seal on FCP 1A. A 4 Reactor Pumps N1.1 Coolant (CB)
- 9) 6/28 Low Upscale failure on NIC A Ins t rumenta-No. 6.
3 Instrumenta- N2.1 tion & tion & Controls Controls (IA)
- 10) 7/19 85 , Power reduction. Seal injection A 5 Reactor Pumps D3.1 pumps' bypass valve did not Coolant compensate fast enough to main-(CB) tain sufficient flow to the N1 FCP's. This caused FCP IB to d, trip.due to low seal injection La N leakoff flow.
- 11) 8/8 254 85 FCP tripped due to low seal injec- A 3 Reactor Pumps D3.1 tion flow due to low level in the Coolant reservoir caused by lead level con- (CB) troller malfunction.
- 12) 8/9 Low Flange leak on upper CRD mechanism A 1 Reactor Pipes, N1.1 No. 28. (RB) Pittings
- 13) 8/22 226 55 Water dripping on RFP controls A 3 keactor Pumps N1.1 caused RFP 1A to trip. Coolant (CB)
- 14) 8/24 Low Seal injection pumps' bypass valves A 3 Reactor Pumps D3.1 did not compensate fast enough. Coolant Low seal injection leak off flow (CB) tripped the FCPs.
w l ! l l Table A1.14 (Continued) DBE(D)/ Date Duration Power Reportable Shutdown System Component NSIC(4) (19 80) (Hrs) (%) Event *** 'E ' " Methed Involved Involved Event Category
- 15) 8/25 Low Mechanical seal leak on upper A 1 Reactor Control N1.1 control rod drive No. 22. (RB) Rod Drive Mechanisms
- 16) 9/5 31 Electrical short on CRD No. 3 A 3 Reactor Instrumenta- N2.1 scram solenoid due to water (RB) tion &
leakage from CRD No.1. Controls
- 17) 10/4 27 High reactor water level caused A 3 Reactor Instrumenta- N2.1 by failure of a feedwater pump Coolant tion &
controller amplifier. (CH) Controls
- 18) 10/21 81/54 Power reduction to remove silt A 5 Steam & Filters N1.1 from turbine condenser water Power Heat y boxes and clean condenser tubes. (HF) HC) Exchangers W
W W
. , ._ . - - -. . - . . . - . . . _ . - - - .. - _ _ . . - - .~-- -- . - - . - . .
Table A1.15 1981 Forced Outages and Power Reductions for Lacrosse I DBE(D)/ Date Duration Power Reportable Shutdown
"** (1981) Event Description Cause System Component NSIC(N)
(Hrs) (1) Method Involved Involved Event Category
- 1) 2/1 15 LER Generator was removed from DPC C 9 81-02 grid as a precaution since Electric . Circuit 32.2 Power Closers /'
internal spring pin of controls (EA) Interrupters switch for oil circuit breaker 25NB1, which connects the generator to the DPC grid, was broken when the switch was closed. l 2) 2/2 2 Generator was temporarily removed H 9 Steam & Mechanical N2.0 from DPC grid as a precaution Power Function due to turbine governor hydraulic (HA) Units control system resonse problems. (Cevernors)
,q 3) 2/2 1 Generator was temporarily removed H i 9 Steam & Mechanical N2.0 from DPC grid as a precaution due Power Function
($ to turbine governor hydraulic con-
** trol system response problems. (HA) Units (Governors)
- 4) 2/4 1 Cenerator was temporarily removed H 9 Steam & Mechanical N2.0 from DPC grid as a precaution due Power Function to turbine governor nydraulic con- (HA) Units j trol system responsa problems. (Gove rnors)
- 5) 3/9 75 LER "15" 2400-volt bus was de-energized G 3 1
81-04 Electric Circuit N6.0 when switching plant feeds from Power Closers / reserve to unit auxiliary trans- (EB) Interrupters former. Reactor scrammed.
- 6) 3/16 1 Generator was temporarily removed H 9 Steam & Mechanical N2.0 from the DPC grid as a precaution Power Function due to turbine governor hydraulic (HA) Units control system response problems. (Gove rnors)
- 7) 5/7 12 operator did not reset scram prior C 3 Instrumenta- Instrumenta- p6.0
! l to returning scram test switch to tion & tion &
" normal" during power flow T.S. Controls Controls
- test. Procedure format was revised. (IA)
- - - _ . . - - _ - - _ - - - n f.------ - - -
Tatle A1.15 * (Continued) DBE(D)/ Date Duration Power Reportable Shutdown System Component NSIC(N) No. Description rause (1981) (Hrs) (%) Event Method Involved Involved Event Category
- 8) 5/23 462 Scheduled fuel receipt, TMI B,D 1 Unknown Unknown N8.3 modifications, seismic restraints, maintenance.
- 9) 6/15 19 Spurious spike on nuclear instru- A 3 Ins trumenta- Instrumenta- N2.4 mentation (NI) caused correspond- tion & tion &
ing momentarily high reading on Controls Controls power / flow channel which resulted (IA) in automatic shutdown. NI channel and power supply was replaced.
- 10) 6/19 185 Automatic shutdown occurred due A 3 Electric Transformers N1.1.4 to low voltage at reactor build- Power ll ing motor control center 1A, due (EB)
{j to a high amperage short caused (n when the decay heat pump control power transformer had failed. Starter was removed and bus re-energized.
- 11) 7/6 11 Spurious spike on NI caused cor- A 3 Instrumenta- Instrumenta- N2.4 responding momentarily high tion & tion &
reading on power / flow channel Controls Controls which resulted in automatic (IA) shutdown. NI channel 8 high speed multiplier was replaced.
- 12) 8/3 17 1A reactor feed pump controller A 3 Reactor Ins trumenta- Dl.2 jordan amplifier malfunctioned Coolant tion &
causing an increase in feedwater (CH) Controls flow. The increase in power due to the increased input of cold water into the primary system caused the reactor to auto-matically shutdown.
Table A1.15 (Continued) EBE(D)/ Date Duration Power Reportable Shutdown System Component NSIC(N) E** Desc 1ption Cause (1981) (Hrs) (2) Event Method Involved Involved Event Category
- 13) 8/8 69 The plant was manually shutdown A 1 Reactor Ins t rumenta- N1.1.4 ,
due to malfunctions in the (RB) tion & control rod drive charging sys- Controls tem. The 1A charging pump was Control Rod rebuilt, the pressur switch l Mechanisms that automatically starts the i selected pump on decreasing } header pressure was replaced and i thermal relief valves on 3 controJ rod drive mechanisms were replaced.
- 14) 9/10 89 Spurious spike of NI channel #8 i
A 3 Instrumenta- Electrical N1.1.4 I "1 caused corresponding momentarily tion & Conductors high reading on power / flow channel Controls
- d. #2 which resulted in automatic t La shutdown center pin of coaxial (IA)
Ch ' connector at containment penetra-tion for signal cable from NI i ' channel #8 was found to be making poor contact. t i
- 15) 10/18 0 85- Power reduction. Removed IB forced A 5 Reactor Pumps N1.1.4 41 circulation pump from service due Coolant to a couping oil leak. The plexi- (CB) glass inspection cover on the .
coupling housing was tightened which stopped the leakage. t i 5 i i e t
Table A1.15 (Continued) DBE(D)/ Date Duration Power Reportable Shutdown System Compontnt ESIC(N) 80* Event *' iE i " (1981) (Hrs) (%) Method Involved Involved Event Category
- 16) 10/18 16 41 The reactor automatically shut G 3 Reactor Pumps N6.0 down due to low recirculation (CB) flow due to 1A FCP flow being reduced while the IB forced circulation pump was being re-turned to se rvice, i
- 17) 11/12 74 85 The reactor shut down auto- A Instrumenta-3 Instrumenta- N2.4 matica11y due to a high flux tion & tion &
spike on NI channel #7 occurring Controls Controls , during T.S. test on channel #5, (IA) which involves inserting a scram Mc signal. Lov voltage power supply
- d. and the flux amplifier for channel La #7 were replaced.
%q
- 18) 12/23 195 85 LER A reserve feed breaker failed to A 3 Offsite Breaker D2.2 81-14 close. Cf fsite power was lost. Power System (EA) i
[ 6 I
Appendix A: Lacrosse Part 2. Reportable Event Coding Sheets F-139
Table A2. 1 Coding Sheet for Reportable Events at Lacrosse - 1967 MSIC SIGNIFICANCE COMPONENT ABNORMAL ACCESSI ON EVENT REPORT PLANT STATUS CONDITION CAUS E C AT EGORY COM M EN T NUMBER N U MB ER DATE D AT E STATUS SYSTEN EQUIPME NT INSTRUME NT 0 - - AL E N Missing nut on fuel 67-1 68908 060067 120771 A RA assembly from initial loading. L 3 OJ H N RO failed to upscale power 67-2 - 071367 d91267 B IA d range instrument. 071967 091267 B IA - L B OJ H N RO downscaled rather than 67-3 - upscaled power range ; ins tru me nt. , L B OJ H N RO downscaled rather than 07-4 - 072067 091267 B IA - upscaled power range instru me nt . L OJ H N RO downscaled power range 67-5 - 072067 091267 8 IA - B instrument. 7 ra 67-6 - 072567 091267 B BB J - B AG G N CBD end plates aisaligned causing CBD to stick. ($ L B OJ H N RO Jcunscaled power range 67-7 - 072667 091267 B IA - instrument. J G C EG B N Difference between actual 67-8 19785 090167 080067 D RB an$ indicated control rod position. OJ H N RO f ailed to upscale power 67-9 083 067 090067 B IA - L B ( range instrument. { P B OJ H. C8 RO parallelled inverter 67-10 - 090067 102667 B EB - without synchronizing, causing loss of 480 v system. l
- B EC D N Hydraulic line pAugged, 67-11 27621 102067 102967 D BB I therefore CR vould not wit hdraw .
8 CH P - B BI - B 5 Strainers in FW suction 67-12 - 110067 122267 line broke.
- .~.
) Table A2. 1 (continued) NSIC ACCESSION EVENT REPORT PLANT . COMPONENT ABNOPM AL SIGNIFIC A NC E , EURBER NUMBER D AT E DATE STATUS SYSTEM EQUIPME NT INSTRUMENT STATUS CONDITION CAUSE CATEGORY COMMENT 6 7-43 - 112567 122267 B IA - L B OJ H N RO downscaled power range
=s . instrument too rapidly.
2 Fd 67-14 - 120467 010068 D BB J - B BI D N CRD exceeds t ech spec time
- limit on scras by 3
! sec ond s .
67-15 27622 122667 120067 B C3 00 - B BB D N Recirculation pump valves i f ail to close. 67-16 22955 122967 012268 D SB 00 - C 3C D N Valves were being wedged too far in the seat when cold.
l Table 12. 2 Coding Sheet f or Reportable Events at Lacrosse - 1968 l NSIC SIGNIFICAh E ACCESSION EFENT REPORT PLANT COMPONENT ABNORM AL STATUS CONDITION CAUSE CATEGORY COM M EN T BURSER N U MB ER D AT E D AT E STATUS SYSTEM EQUIPM E NT INSTRUMENT CF DD - B BL B N Decay Heat pump shaf t seal 68 .1 - 020168 030068 8 damaged by excessive t e m pera t ure . FF B AT C N Chips damaged 68-2 25732 020168 030068 B CB - recirculation pump seal. L B OJ H N RO turned power range 68-3 - 021968 021968 D IA - instrument in wrong direction.
- B AU,BU B N Reanants of cleaning 25913 032568 042668 B CH T 68-4 solution collected in reheater shell. =s B HA H N Operator increased II68-5 25948 042568 040068 B CH -
feedvater flow too b4 rapidly. K C EI D C4 Reactor water level 68-6 302a1 052568 062068 B RK - reading is higher than actual water level. T C OJ H N RO closed turbine stop 68-7 - 052668 071268 B HA 00 valve, failed to bypass scram with key switch. C BA D N D uring te s tin g , t wa 26442 060868 062460 B HH 00 - 68-8 shutdown condenser valves f ailed to ope n. 00 C AI D N Two leaking valves 68-9 27504 062968 060068 D SD - responsible f or high containment leak rate. Z - B AE B N Pipe hanger in FW system 6 8-10 28963 070068 109068 D CH bent.
- B AO,1W D N Flange veld leak in Core 68-11 32638 101268 100068 D SF Z Spray System.
Table A2. 2 (continued) NSIC ACCESSION ETE NT BEPORT PLANT COMPONENT ABNORMAL SIGNIFICANCE NONBER NUMBER DATE DATE STATUS SYSTEM EQUIPRENT INSTRUMENT STATUS CONDITION CAUSE CATEGOR Y COMMENT 68-J2 - 110468 120068 D FB JJ - B AW,AO E N Spent fuel storage well liner had several veld failures. 68-13 - 123068 010069 D RB J - B AG D N CBD failed to withd raw. I Ed 6 8- 14 - 120068 010069 3 RB 00 - A BB D N CRD solenoid valve failed (l to close and solenoid overheated. 6 8- 15 30888 120068 120768 - RI - I - 04 D N Reactor water level reading is highei than actual water level. 68- 16 - 120068 010069 D RB J - B AG D N CRD f ailed to withdraw. 6 8-17 30047 120768 122368 B RI - K B EI D C4 Nater level reading in error due to temperature dif ference between reactor and standpipe. I
Table 12, 3 coding Sheet for Reportable Events at Lacrosse - 1969 NSIC ACCESSION EVE NT REPORT PLANT COMPOWENT ABNORMAL SIGNIFICANCE NUMBER N U M B ER DATE DATE ST ATUS SYST EM EQUIPME NT INSTRUMENT STATUS CONDITION CAUS E CATEGORY COM BENT 69-1 - 011469 000000 - IA - L B OJ H N RO f ailed to upscale power ran ge instrument. 69-2 - 013169 020069 B EA PP - B - - C8 Loss of voltage on 2400v bus, recirc pump tripped on undervoltage. 69-3 32470 030069 032169 - BB I G E EF D N Rod-position indicatcr lights did not work on ner drive. 69-4 - 030069 040069 D EA - - B AQ & $9 Fly ash caused arrestors to short, resulted in power f ailure, 35764 030869 032069 J .D 5 Clutch on CBD sechanisa f 69-5 RB B AG D slipped. g.
- Condensate valve failed to 09-6 35764 032269 030069 -
HH 00 - B B1 G N open, improper adjustment. 69-7 40484 032269 040469 D HH 00 - B BA G N Condensate valves vedged during cooldown, f ailed to open. 69-8 - 040369 040069 D CB DD - A AP D N FCP vibration due to bearing failure. in drive coupling. 69-9 35163 040469 051269 D HR 00 - C AY D r. Condensate valve opened when tapped. 6 9 - 10 40485 050069 112569 C BA O - B AE B N Two fuel pins bowei. 69-ji 48020 050069 042470 C RA 0 - B AE E N Several more f ue. pins bowed. 69-12 - 050069 062569 D RB J - A BC E N S pare CBD had roller installed backwards. 69-13 - 070069 090869 D CB DD - A HB B N FCP has ceramic chips on shaft, from bearings when pump starved for water.
- _ _ - - _ - - - . _ . - x.
Table A2. 3 (contiased) NSIC ACCESSION EVENT PEPORT PL ANT CORPONENT ABNOBHAL SIGNTFICANCE BUMBER NUMBEB D&TE DATF STATUS SYSTEM EQUIPMENT INSTRUNENT STATUS CONDITION CAUSE CATEGORY COMMENT 6 9- 14 41601 072169 081069 8 BI - F B OK H C4 Poor calibration of nuclear instrument =s channels due to voids j, and Eenon. La 69-15 - 090069 103069 B RB J - B AE E N CRD clutch plates bent, f aulty installation. DPC6901 39723 110469 110769 B CH Z - C AN,OD C C8 Feedwater injection nozzle cracked. DPC6902 39624 111369 112069 C FD L P B EF D N Fuel handling hoist malfunctions with irradiated element att ach ed.
Table A2. 4 Coding Sheet f or Reportable Events at Lacrosse - 1970 l NSIC SIGNIFICANCE COMPONENT ABNOR5 AL ACCESSION EVE NT REPORT PL AN T CATEGORY Con 5ENT NUMBER DATE DATE STATUS SYSTEM EQUI PM E NT INSTRUMENT STATUS CONDITION CAUSE i IU NB E R l l P B ED D N Diesel fire pump charging D PC7001 - 011570 012370 D AB - circuit control relay failed. DD - C BD B N Diesel fire pump failed to DPC7002 - 020270 021170 D AB start due to frozen pressure sensing line. 1,0 B BC B N Reactor wa ter level higher LTE 48019 040070 040770 - RA - than indicated level. AE H N RO bent fuel pin on shroud LTE - 041170 050070 C FD R can while loading core. 0,00 - C BC,EF E, G SS sain steam bypass valve DP C7003 46959 051570 060570 B CC malfunctions, 7 w - B AT D N Reactor scrammed, oil Ida k 47823 061770 072170 B RB J
$[DPC7005 in CRD.
- B OJ H C1 Control power accidently DPC7004 47823 061770 072170 B EB -
turned off. L A EG E N Scram caused f rom spurious DPC7006 47823 061870 072170 B IA - signal from power range instrument. B HB D N Reactor scrammed, air in 47823 063070 072170 B CB - K DPC7007 inst. sensing lin es . 5 B BJ D N Pressure channel received DPC7008 31945 070170 072070 B RI - spurious high pre ssu re signal. I AI C N Failed fuel detection sys. 68333 070170 102270 D PD 0 - B LTR has several cracked fittings. B BC H N Reactor scrammed, improper 47823 071470 072170 B CH DD - DPC7009 FW pump ad justaent. L B EG D N Spurious signal to nu: lear DPC7010 31945 072670 081370 B IA - channel I causes scr an.
._ s Table 12. 4 (continued)
NSIC ACCESSION EVENT REPORT PLANT CORPONENT ABNORMAL SICNI FIC ANC E NUMBER NU 5S ER DATE DATE STATUS SYSTEM EQUIPME NT INSTRUMENT STATUS CONDITION C'AUSE CATEGORY COM M ENT DPC7011 60107 080370 092170 B NG 00 - B BR,1U D N Seal injection system check valve leaks; pressure fluctuations tripped FCP. DPC7012 60107 080570 092170 B IA - 5 B AC D N Capacitor in pressure channel caused spurious scraa. DPC7013 - 083170 090870 B H& 00 - C AZ H N RO closed turbine stcp valve, reactor scrassed. DPC7015 32202 090270 092170 B H1 00 - B BC ,1 Y H N Failure to lock reheater steam supply valve. m DPC7014 32202 091670 092170 B EB - 0 1 ED G N Two leads of voltage 8 recorder shorted
$[ together.
N DPC7016 32202 091670 092170 B BB I - B HB G N Tefica tape restri:ted oil flow to scran hydraulic motor. DPC7017 32202 091670 092170 - RB I - B AG E N Snap ring dropped into a CR gear reducer. DPC7018 68608 '092570 100970 B IA - L B AP D N Out-of-core power range instrument exhibits large random noise. D PC7019 60296 100170 100970 B IA - L B EF 5 N Switching voltage transient from channel 8 caused channel 2 i trip. DPC7021 60297 102870 011571 B BB J - B BC D N CRD scraa speed less than limit. D PC70 20 61446 102870 011571 B I4 - T C 04 B C4 Power flow bypass switch bypassed both low-flow c ha nnels. l l l
.. - - . - . .- -. . ._ ~
l Table A2. 4 (continued) NSIC ACCESSION EVENT REPORT PLANT COMPONENT ABNORM AL SIGNIFICANCE NO RBER NU5BER D AT E DATE STAIUS SYSTEM EQUIPME NT INSTRUMENT S T AT US CONDITION CAUSE CATEGORY COMBENT DPC7022 60298 110170 011571 B IA - L B OJ B N Operator downscaled power range instrument rather than upscaling it. DPC7023 60299 110470 011571 D EE N - C BD D 5 Diesel generator imiled to es start. t
$l GPC7024 60300 121870 011571 5 RB I -
B AG G W CRD motor had partial 08 ground due to oil on terminal board. DPC7025 - 121970 020071 B IA - L B OJ H N RO downscaled power range instrument one decade too far. D PC7027 60303 122070 911571 B IA - L B EG D N Nuclear channels 7 and 8 malfunction, ca use scran. D PC7026 60302 122170 011571 B CE. 00 - B BC G C3 Reactor scraaned, e qualizing valve no+. f ully closed result ng in high level reading. _ _ _ _ _ . . . . _ _ . . . _ . _ _ _ _ _ _ _ _ _ ,_. _ _ o_ . _ _ _ _
w .. r Ta ble A2. 5 Coding Sheet for Reportable Events at Lacrosse - 1971 NSIC ACCESSION EVE NT REPORT PLANT COMPONENT ABNORM AL SIGNIFICANCE NUMBER NUMBIR DATE DATE ST ATUS SYSTEM EQUIPMENT INSTRU5ENT STATUS CONDITION CAUS E CATEGORY C055ENT DPC7101 61043 012071 021071 B EA - P B BF G 57 Vibrations at substation tripped a relay voich de-energized several buses. DPC7103 61445 021171 021771 B RB 00 - B AU D E Reactor scranne4, check valve to CBD leaked. DPC7104 62329 030571 031271 B WG DD - C EF G N Seal injection to circulation pump erratic, reactor
.scrassed.
DPC7105 62330 030971 032471 B RB Q - B BL,1W D N CRD flange leaked when temperature was too high. 7 DPC7106 62331 032071 032471 B CH - T B OK & Cl Feedvater pump auto F' control unstable at d$ low flow. DPC7107 63129 032471 033171 B EA LL - B BY D St Failure of transf ormer caused fire, loss of Power, load rejection, scram. DPC7109 63224 051171 051471 B IA - L B BF G N Electric drill pluqqed into bus caused noise spike and scram. D PC7110 64300 061071 062171 B IA - L B OK H N Operator f ailed to upscale range channel, high fluz scran resulted. DPC7111 65462 062271 062371 B IA - 5 C ED D E Pressure safety channel f ailed to trip due to a short. DPC7112 65463 070171 070871 B CB 00 R S AZ D N Circulation pump discharge valse closed when capacitor failed. D PC7113 64472 070271 070971 D CD 00 - C AQ D C8 Failure of main stea m isolation valve to close.
l Table A2. 5 (continued) l NSIC l ACCESSION EVENT REPORT PLANT C05fGNENT ABNORM AL SIGNIFIC A NCE N U RB ER W U 5B ER D AT E DATE STATUS SYSTEN EQUIP 5E NT INS T RU 5E NT STATUS CONDITION CAUSE CATEGOhY C055ENT DPC7115 64427 071471 072371 B IA - L B EF D N Picoammeter failed upscale when power-range channel returned to service.
}2DPC7114 64428 072071 072371 B IA -
L C OK H N Operator downscaled wrong sa instrument channel. tn cp DPC7116 66508 081271 081871 B AB - P C BD,EC D N Diesel fire pump start relay contacts f used. LTR 56873 091471 102271 D RI O - B AD G N V essel head flange stud fails. DPC7117 67629 100071 101571 D RB LL - B ED G N CBD transf ormer shor ts due to water f rom m ainten an ce. LTR 41675 122271 011372 D SA Z - C 10 D N Weld defects in primary system relief valve p ipin g.
w ,- - -. . Table 12. 6 Coding Sheet .for Reportable Events at Lacrosse - 1972 NSIC ACCESSIOP EVE NT SEPORT PL ANT COMPONENT ABNORMAL SIG NIFIC L EC E FORBER NUMBER D AT E -DATE STATUS SYSTER EQUIPRENT INSTRUMENT STATU3 CONDITION CAUSE CATEGORY C0552NT D PC7201 69171 010472 011172 B HF DD - B BL,BF D N High tisperature alars on circulation pump. , 3 g DPC7202 69313 010*872 012072 B HB Y - B AO C C3 Level control ca arber had ,
- teld failure.
.g LTR 75528 012072 C92272 B RC R <
B - AF D I Two fuel assemblies le a kad .
;l s
L2s ,
, 75006 022872f932272 D CC - - - ' p 'dd -
C3 Radiciodine buildup In
/ .
primary water af ter
- ', >/-
- s h u td ow n.
r l' ,- 'D PC720J ~ " 70013 032672 033072 B II - T A EG G N Personnel hit test button
' ' with cable while
_g7 ' ,' . vorking on other H - caused 2/4 logic and h3 . .scraa. - i- -. . /
,DPC7204 74391 050172 050572 B HA 00 -
C OJ H N Operator opened turbine < 4
+ ';~ y stop valve without' r, ,
ji,; ;j scram interlock
, 4 ,
', , 4? * ,
jf' bypassed. ,, j[ DPC7205 72841 060672 062/7 [ D e 'HH CO - C BC B N Nuts 'from b5 denser kee e .,; condensata ratuJr ~ valve from closing. D PC7206 72842 B HH DD - B BY B N ' Pc3p casing insulation has 05k672 072072 oil fire. J pe ; .- / 70935 062772 071072 B EI H C5kC) Hydrogen detonation in of f- ', . DPC7207 B EB -
' i[ E gas system.
h ,
.. 'f'
< ? y i HG ,0 Recirculation pump speed 4 LTa 69775 070072 071472 B CB 00 -
B N
. s .,s- increased, bat fluid
/ density decreased.
LTR 75025 OB0h72 061672 B RB J - B AW D N CRD' ' accumulator leak ed. s s ' . D PC7208 75086 ,091572 082972 8 f- CH DD - B EF D C8 Both f eed ~puips beha ve e rratically. j
?
3 I. ?
?
n
/"
y -
/
Table AL 6 (continued) NSIC ACCESSION EV E NT REPORT PLANT COM PONENT ABNORM AL SIG NIFIC A NCE BU RB E R NUMBER DATE DATE STATUS S YSTEM EQUIPME NT INSTRUMENT STATUS CONDITION CAUSE CATEGORY C05 MENT DPC7209 75074 081772 091372 8 EA - P B BF G S2 While perf oraing maintenance, forgot to disable relay. Offsite power was lost. DPC7210 75074 081872 091372 B MB DD - B OF, EF H C3 Iodine released when
- ompressor operated l
erratically. DPC7211 75985 101472 101972 B RB I - B AG G N CRD became stuck due te shorted electrical plug. y I 75985 101572 10.1972 B WG DD - B OJ H H Switching error stopped ((DPC7212 seal injection pump. I na DPC7213 76748 110272 110972 B CH - - B BK H C6 Operator caused suiden pressure decrease, reactor scrammed. DPC7214 76402 110272 111372 B RB I - B AG E N Upper brake ring in CED installed incorrectly. D P C7215 77418 120272 121572 B RI BB - B BP H C8 Reactor vessel heat up rate in excess of technical s pecifica tion s. DPC7216 77419 122172 122772 B WG DD - B AP D N Vibration caused sta ndby seal injection pump to start. DPC7217 - 123072 010573 - WG - M B AU D N Seal injection DP transmitter had water in it.
Table 12. 7 Coding Sheet f or Reportable Events at Lacrosse - 1973 NSIC SIGNI FIC A NC E COMPONENT ABN0hM AL ACCESSION EFENT BEPORT PLANT CATEGORY C05 5 ENT NUMBER DATE DATE STATUS SYSTEM EQUIPM E NT INSTRUMENT ST AT US CONDITION CAUSE B U MB ER
- B Ar C N Of f gas systes dryer f ails.
LTB 78420 020073 020173 - MB Ma 00 B BB D N MSIV bypass valve f ails to m 107301 78495 020373 021473 B CD - close. 4 N ECOS pipe fittings leak. C AW B U LIB 74803 050073 050173 D SF Z - l J - B BD D N CBD failr to scras. l 107303 84000 070973 090673 B RB J B BD D N CRD fails to scraa. 107304 84003 090073 090673 - BB - J - B BD D N CFD fails to scram. i A07305 84000 390073 090673 - RB l J - B BD D N CRD f ails to scraa. 107306 84000 090073 090673 - BB 110373 120773 D RB J - B BD D N CRD fails to scran f rom 507307 87284 link location.
Table A2. 8 Coding Sheet for Reportable Events at Lacrosse - 1974 NSIC ACCESSION EVENT REPORT PIANT COMPONENT ABNORMAL SIGNIFIC A NCE E U RB E R NURBER DATE DATE STATUS SYSTEM EQUI PM E NT INSTRU5ENT STATUS CONDITION CAUSE CATEGORY C055 EN T LTR 87814 010074 012374 D - Z - B AT D N 7 nipples crack due to stress corrosion. 107401 92173 051074 051774 D IB - T A BC A N Error in calibration ! procedures. 107402 94759 071774 072674 8 HB - E B AG D N Off gas rate-seter indicator needle sticks. LTR 96420 072874 101874 B - - - - OK 1 N Shif t supervisor assigned prior to issuance of nis license. "2 LTR 97492 082874 082974 B El LL - B BG D N Con trol power partially /. w interrupted.
- " A07407 98167 090174 121074 D ID I -
C EG E N CR location instrumentation incorrectly installed. 107404 95320 091774 090974 B EA LL - B BG D S7 Diesel generator isiled when an undervoltage occurred on the 69 kV line. 107405 97485 092474 092574 B RB J - B BE D N CRD fails to insert. AC7406 96302 092874 092874 8 CD 00 - B AB D N HSIT salfunction due to wear. 107406 97150 092874 092874 CD 00 - B BI D 59 RSIT closure time wa s slow and reactor water level decreased. 102374 122179 B EA F - B CA G S7 While erecting a se c uri ty fence, a 69 kw control wire was cut, of fsit e power was lost.
Table A2. 9 Coding Sheet f or Reportable Events at Lacrosse - 1975 NSIC ACCESSION EVENT REP 0FT PLANT . COMPONENT ABNORMAL SIGNI FICANCE NUMBER NUMBER D AT E DATE P-T A?US SY! TEM EQUIPME NT INSTRUMENT STATUS CONDITION CA US E CATEGORY COM M EN T LTR 100070 010075 012475 D CD 00 - B AK D d Deterioration of lubrication causes MSIVs to fail. LTR 100071 010075 012475 B RB J - B BD B E A ChD notor f ails due to inadvertent ground on one phase. 107501 102239 041775 041875 D EC - P B BY D N Auto transfer switch in 125Y DC fails due to arcing. 051275 122179 D EA F - D CA G S7 A breaker w as no t by passed during maintenance, offsite power was lost. 7 He 107502 103877 060375 062675 H RC R - B AE H N Fuel element was damaged vhile being changed to [Q a new cere position. 107503 103656 060675 061675 D SF DD - C EB D N Core spray pumps have low flow rates.
- - 070575 122179 D El LL -
B ED D 57 Insects caused a transicraer to snort, off site power was lost. 104388 071175 071175 M C EB D N Voltage regulator f ails in 107504 D IA - scraa system invalidating scraa signal. 107505 104811 072075 072875 C SA 00 - C AW A N Nev valve not added to I check list. It w as f left open and l contributed to l excessive containment l ' leakage. 1 Electrical penetrations 4 0730~45 08147 5 SA KK - C AS D N l i 107506 104955 D and 6 leak excessively. l l 1 l t e e p ' V 1
? *d.
Ill l llil d . e oa l ta i pa . dc r mzd u n l es pea iay T N vm a f l nle gl . E oad na 5 iv diu 5 0 C t aeo l g n ern. rua dmd urn l e cae rhp rrar otst ico tewe E cs ns s eio ontn C Rdt CiIi NY AR CO IG FE IT NA N N GC I S E S U D D A C N LO AI MT RI A D OD B B NN
) BO d AC e
u T NS u EU t NT n OA B B o PT c ( MS O C 9 T N
. E 2 5 A U R - -
e T l S b N a I T T N E 5 P 0 I 0 1 - U Q E E I T A 3 S C R Y S S TU NT AA D B LT PS T 5 5 RE 7 7 OT 7 1 PA 1 3 ED 0 2 R 1 1 5 5 T 7 7 NE 4 1 ET 1 3 VA 8 2 ED 0 1 N O 1 3 IR 2 1 CSE 4 6 ISB 7 9 SEB 0 0 NCU 1 1 CN A R E 7 8 B 0 0 E 5 5 U 7 7 N C 0 A 1
?5*
ll1 lll
Table 12.10 Coding Sheet for Reportable Events at Lacrosse - 1976 NSIC COMPON ENT ABNOEHAL SIGNIFICANCE ACCESSION EFENT BZPORT PL ANT CATEGORY COMMENT NUMBER N UM B ER DATE DATE STATUS SYSTIE EQUIPMENT INSTRU5ENT STATUS CONDITION CA US E r 022376 030876 CG H - B AT D N The reactor was shut down 307601 111931 B due to high chloride concentration levels. E07602 112900 022676 032676 D RB J - B BD D N A CR f ailed to withdrawal during startup. 00 C BC D S1 Set point drif t in t hree B07603 113507 033076 040976 D SF - main steam relief valves. 115111 051276 061676 D SA 00 - C AW D N Two containment isolation 307605 valves leak excessively. T C BD C N Core spray pump fails to RO7604 115112 051276 061676 D SF - start due to bad contact. T q BD D N Dirty switch causes core m 307606 116400 070776 080676 D SF - spray valve to f ail to j, open. Ln N 117058 071776 081676 SA 00 - C AW D N Leak rate of containment B07607 - building airlock exceeds limit. J B BD D N A CR failed to insert 307608 117082 072776 081676 B BB - hydraulically.
- C BD G N D.G. f ails to carry load RC7609 118750 091576 '101576 B EE N due to improper maintenance.
119331 092676 102976 B IA - R B EI D N A scram channel failed to 507610 f unction properly due to set point drift.
- BC L 5 Set point drift in R C7611 120421 110576 120776 - RB J -
pressure sviten for CBD scran.
- C BA E N The "15" HPCS pusp f ailed RC7612 120433 110576 120376 D SF P to start. A vire had been inadvertently removed f rom a relay associated with the pump.
o - l Table A2.10 (continued) NSIC ACC ES S IO N EV E NT PEPORT PL AN T COM PONENT ABNORM AL SIG NIFIC A NCE BU RB E R NU M B ER DATE DATE STATUS SYSTE5 EQUIPMENT INSTRUMENT STATUS CCNDITION CAUSE C ATEGCR Y C058ENT R07613 120431 110676 113076 D CD 00 - B BA G N Recirculation pump discharge valve fails to open.
=1307614 120297 111176 121076 -
EE F - B BC A N Procedural deficiency I ($ results in tie breaker 03 being incorrectly a lig ned . R07615 120422 111776 111876 D EE JJ - C BU D N Sediment and water exceed limits in f uel oil s a mple . R07616 121290 120376 010376 B EE N - C BI C N D. G. exceeds tech spec starting time limit by 3 sec. An electrical connector was loose. 507617 121490 122576 012177 B RB - - C BU A N Concentration of Na255 b elow tech spec limits.
Table A2.11 Coding Sheet for Reportable Events at Lacrosse - 1977 NSIC COMPONENT ABNORMAL SIGNI FIC A NC E I ACCESSION EVENT BEPORT PL ANT STATUS CONDITION CAUS E C AT EGO RY C055 EN T l BCHBER NU BB ER D AT E DATE STATUS SYSTEM EQUIPME NT INSTRUBENT KK - C AU D N Leak rate of electrical 307801 134270 012877 013078 C SA penetrations exceeds t ech spec limits. 3 AC D N Recirculation pump valve 123133 020477 022577 D CA 00 - seal leaks excessively. R07701 SA 00 - C AW D N Containment isolation 307702 124207 031 877 041577 B valve and penetration lea ks excessively. y D N CBD accumulator low gas H - C BC I i Visc7703 124883 040777 050677 D BB A pressure switch drif ts. l 1 00 - C BC D N One relief valve exceeds i LT R 126481 051677 062877 C SF set point by 50 psi.
- B AC -
N Cladding on several fuel 807704 125023 051877 060277 D RC R elements fail. l I CA EK - B AV D N Cracks found in core 307705 125999 051877 061477 C shroud. They were caused by flow induced vibration. IA - L C EI D N Fiv e of 6 APB5s drif t. R07706 144949 102577 112377 C
- C BD E N D.G. fails to start during 122077 011278 C EE B RO7707 133651 testing.
Table 12.12 coding Sheet for Reportable Events at Lacrosse - 1978 NSIC ACCESSION EYENT BEPORT PLANT COMPONENT ABNOR5&L SIGNI FICANC E NURSEE N05B ER DATE DATE STATUS SYSTER EQUIP 5E NT INSTRUBE NT STATUS CONDITION CAUSE CATEGORY C05 5 EN T 507803 134301 011378 013178 C SA FF - C AU D N Containment ventilation inlet damper laak rate exceeds limits. 307802 134271 012978 012978 C Sk 00 - C AU D 5 Seal injection valve leak rate exceeds tech spec limits. 307804 134302 013178 013178 C SA FF - C AU D N Containment ventilation outlet dampers leak rate exceeds limit. 307805 137501 030978 041178 B CJ - - B BU D N &lpha activity high in reactor coolant due to y fuel failures. I
$ LER7806 137306 032178 032878 D SFA DD -
B OJ H N LPCI pump isolated by c) operator. 307807 139334 050678 060578 D IB - I B EG D N Reactor water level instrument fails. i 207808 141157 062078 071778 B AC - 1 B OK H N & fire watch was not l established when the alara system was bypassed. 307809 139961 062078 072878 B - N - C BE D N & diesel driven pump f ailed to run due to veter in the fuel. 307810 140800 081178 091578 B EE N - 1 BU D E & D. C. removed from service for an oil c ha nge. RC7811 141406 101878 110978 D SA FF - C AU D N Leaks found in containment danters and penetrations during testing. R07812 141846 112676 112778 D S1 FF - C AW D N Containment air lock leaks.
l Table A 2.12 (continued) ISIC SIGNIFIC A NC E ACCESSION EVENT REPORT PLANT COMPONENT ADNORMAL D AT E D AT E STATUS SYSTEM EQUIPMEFF INSTRUMENT STATUS CONDITION CAUS E CATEGORY COM M ENT NUMBER NUMBER Y 8 Personnel airlock leak 142263 120278 120478 B SA FF - C AV & $307813 rate exceeds tech spec F' limit. B - C BE G N The "1B" diesel generator LEB7814 147214 121578 011879 B EE tril: ped on overspeed during testing.
Table A2.11 Coding Sheet for Reportable Events at Lacrosse - 1979 NSIC ! ACCESSION EVENT BEPORT PL ANT C05PONENT ABNORM AL SIG NIFIC ANCE l NUMBER NUMBER DATE DATE STATUS SYSTEM EQ UIPM E NT INSTRUMENT STATUS CONDITION CAUSE CATEGORY COH 5 EE T BO7901 151003 010379 010479 - EE JJ - C BU D N High concentration or sediments and water in the fuel oil for the energency D.G. LE37902 147269 011579 012979 D SA FF - C AW D N Electrical penetration seals embrittle resulting in excessive j leaking. I LEB7903 147268 011879 020179 D SA 00 - C AW D N Leak rate of containment isolation valves exceed limits. LEB7904 148202 011979 020179 D SA 00 - C AW D N One containment isolation valve did not meet 7 limits. LEB790 5 149881 040579 041979 C RC R - B AU D W Leaking fuel pin found during ref ueling. L EE7906 149239 041079 041979 C BC R - B AU D N Leaking fuel pins f ound during refueling. LIB 7907 129243 042579 050979 C SA FF - C AW D N Electrical penetration seals leak excessively. LIR7908 150259 042979 052879 C SA 00 - C AW D N Containment damper leaks. LER7909 150255 050779 061179 C EC - T A OK 1 J Procedural error nasults in 125 v D.C. being switched on incorrectly. L2R7910 152818 052279 062079 C EC - - B BU D N Reactor coolant dipha activity exceeds the lim it. 12B7911 150258 060179 062779 B IA - L C BC D N One APRM channel dritts. L257912 151828 070279 072779 B - N - C BD D N The "1 A" diesel driven pump f ailed to start due to f ailed diodes.
l.lll t v s o e l l n i b . o e d o A e id h a e n o e r g B vd to ar t t i h t pa. si n D k lo l dBsg t rde rn a c. ar al e1 nn a n ont eo ot v co p ii l yi . naa pi r g eli n sr me d ue n r r mten hrm T so et . uhkl ckto es a i pi tii N st nn ptno r oi van dsor al E M M as. pi yps row eca w r oo rft e ah i snt orw cs i gco eass sd oru t p pd ne f ote nh O b l o gd t nt rpao e l eren eet C ri pnh asos ywp nao m ro tm eoa ot gri rti a wb o hl i o neui ans ntf entv bdc irst rid i a nww pen . lsca re aisa ae _ brl i oteak atm ush tuar kte t ta res nt n erir tug nq e anc E C e ;, e uha noefa hcwo ai oeop eox v NY Tos Dt v Acrot Tssn Ach Crto Lce _ AB - C0 _ IG _ FE _ IT 3 8 7 NA N N C C S N N GC I S E S U D H H H D B D A C N LO AI MT RI C K K K P W W OD A O O O B A A NN
) BO -
d 4 C - e u T n NS &Y
'T, i EU t NT n OA B B B B B B C o PT
( c MS O C 3 T 1 N
. E .
2 M A U R - - - T - - - e T l S b N a I T T N E M P 0 N 0 F I 0 I - - N 0 F U Q E M E T B B A A A A A S H R M I H S S Y S S TU NT AA B B B C B B B LT PS T 9 9 9 9 9 9 9 RE 7 7 7 7 7 7 7 OT 5 7 8 7 7 7 6 IA 2 : 2 2 2 2 2 ED 7 7 9 9 1 2 2 R 0 0 0 0 1 1 1 9 9 9 9 9 9 9 T 7 7 7 7 7 7 7 NE 4 8 2 7 9 4 3 ET 0 0 2 0 0 1 2 VA 7 7 8 9 1 2 2 ED 0 0 0 0 1 1 1 N O 7 6 4 5 0 9 8 IR 2 2 1 1 7 6 6 CS E 8 8 3 3 2 '2 2 ISB 1 1 2 2 4 4 4 SEM 5 5 5 5 5 5 5 NCU 1 1 1 1 1 1 1 CN A 5 R 3 4 1 6 7 8 9 E 1 1 0 1 1 1 1 B 9 9 9 9 9 9 9 M 7 7 7 7 7 7 7 U R R R R B R R S E E E E E I E L L L L L L L . 1h$ l l .llllll l
Table A2.14 Coding Shea t for Reportable Events at Lacrosse - 1980 NSIC ACCESSION EVENT REPORT PLANT COMPONENT ABNOR5AL SIGNIFIC A NCE BUMBER NUEBER DATE D AT E ST ATUS SYSTEM EQUIPM E NT INSTRUEENT STATUS CONDITION CAUSE CATEGORY COM M EN T l 1 LER8001 156223 040980 042180 D Sk FF - C Ab D N The leak rate at the electrical Penetrations exceeds tech specs. LER8002 15&307 04'580 042880 D SA 00 - C AW D N Containment ventilation exhaust fan isolation damper leaks. LEB8004 157165 041780 051380 D - 00 - C BA & N Emergency flooding v ent valve f ails to open. LER8003 158309 041780 042880 D SA 00 - C AU D N Containment condencate return isolation nlve leaks. f LEB8005 163464 080680 092780 B CF 00 - A OK G N A valve was installed
- p. without approval of yl NBC.
LER8006 160363 081480 091280 D RC - - B BU D N Hain coolant alpha activity exceeds limits. LEB8007 160364 081680 091280 D RC - - B B0 D N Main coolant e pha activity exceeds limits. LEB8008 160454 081980 091960 D WA N - C BD D N The "1B" diesel operated but the high pr 'rsare service water pump failed to start. LER8009 161888 102780 112880 B SA O - B CA D N The containment air lock interlock f ailed. LEB6'010 161891 102880 112880 B CF - - C OC A N A test of the shutdown conden ser valves was performed about 4 hours beyond the required p eriod.
;IR8011 161631 111080 112480 B RA - -
B BP H C8 Maximum cooldown rate exceeded.
i Table A2.14 (continued) NSIC A CC ESSI O N EVENT BEPORT PLANT COMPONSNT ABNORMAL SIGNIFICANCE NUMBER N U M B ER D AT E D AT E ST ATUS SYSTEM EQUIPME NT INSTRUMENT STATUS CONDITION CAUSE CATEGORY COM M EN T L Es8012 162539 112480 122680 D - - - - BU D C3 Soil under turbine building contaminated. LER8013 162538 112780 122280 D SA FF - C AW D N Electrical penetrations leak due to a cracked I gland. l L238015 162016 112980 121080 D SA 00 - C AW D N A contaiLaent isolation l valve leaks i excessively. l y LEB8080 161890 120280 120380 D AB - - B OK & N Fire watch not established s within 1 bour of the
$( drilling of five small Ln holes through tne containment.
L IR8016 163577 120980 010681 C WA DD - A OK G N One high pressure service water pump was inoperable for more than 7 days. L Es81005 163577 120980 010681 C WA DD - 1 OK G N A high pressure service water pump was out of scIvice for over 7 days due to repairs. LEB8014 162014 121080 121080 D SA 00 - C AW D N A containment isolat ion valve leaks excessively. LEB8017 162536 121680 123080 D SA 00 - C AW D N T vo containment isolation valves leak excessively. e 9
y Table 12.15 Coding Sheet f or Reportable Events at Lacrosse - 1981 NSIC ACCESSION EVENT REPORT PL ANT COM PONENT ADNOR5&L SIGNIFICANCE BOMBER N U M B ER DATE DATE STATUS SYSTEM EQ UIPM E NT INSTRU ME NT STATUS CONDITION CAUSE CATEGORY C053 ENT LER8101 164649 011681 021181 D EA F - B BB,0F I C8 offsite power was disconnected to repair an iced over circuit breaker. L ER8003S 166089 013001 042381 B RC - - - BU D C3 Reactor coolant iodine activity and iodira releases exceed limits. LEB8102 166310 020181 051881 B El F - B OJ H S2 offsite power was lost when an operator opened the wrong b r ea ke r .
"1 L E 5810 5 164682 020281 022581 B RC - - -
BU D C3 Reactor coolant gross
- d. alpha activity exceeds g; limit.
L E 5810 4 165372 030981 032781 B EB F - B OJ H C7 Improper switching operation caused loss of main power. L E E810 5 166308 042481 051881 B IA - E C OK 1 N The wrong power flow sct points used during testing for the last 8 years were wr ong. LEB8102S 167776 050781 080581 B RC R - B BP D C7 Reactor thermal power changed by more than 15% of rated thermal power within an hoar. L ER8106 166638 051881 052981 B SA Z - B OK G C1 A containment pressure sensing line was modified vothout a pproval. LEB8000S 166671 053081 053081 - - JJ - - OD - C3 Two shipping casks exceed i renovalbe contamination limits (received this way) .
l l Table A2.15 (continued) ! NSIC l ACCESSION EVENT BEPORT PLANT COMPONENT ABNOBMAL SIGNIFICANCE BOMBER N U E B EB DATE D AT E ST ATUS SYSTEM EQUIPME NT INSTRUMENT STATUS CONDITION CAUSE CATEGORY C05 H EN T l l LER8107 166586 060181 060981 D SFD Z - C GA,0K C C4 Emergency servicw water supply system f ailed l flow test due to fabrication error. LIB 81005 166568 061081 061181 D AB P - C AA D N Fire suppression systen inoperable due to a lack of high pressure l I service water. LEs8108 168636 072981 081181 B CC 00 - B BA,HI D N A main steam bypass valve f ailed to open due to too short a pressure spile. 169306 091781 101381 B IA - L C EH D y A nuclear instrument 7LEB8109 channel had a set F' point drift. SS LEB8110 169233 092381 100781 B SD 0 - B AA D S7 Containment integrity violated when both air lock doors simultaneously open. LEB8111 171146 103181 112001 B En E - C AV D N The high pressure service water diesel had a cracked radia tor hose. . LER8112 171147 110381 112381 B SFD DD - C 01 D C2 Low gasoline levels were found for 3 service water supply systen pumpJ (core spray b ack up) . LEB8113 171698 111281 121081 D EB F - B BB D C7 An essential bus reserve f eed breaker f ailed to clo se. LEB8104S 172051 111281 021982 B RC B - B BP D C7 Two occasions when reactor thermal pow er changed by more than 15% rated t hermai power within an hour.
r e s k o a vi e pot . r olc t n e.lsjoe o enn T ds anim D eo nwite el o ag 5 fc ielca 5 train 0 C eo vt auefa ltsim r ua r ed croum se ir pt p te el ri cmeds E a eeuny C Af Rtdas NY AR CO IG FE IT 7 8 NA S C GC I S E S U D A A C N LO AI MT RI B K OD B O NN
) BO d AC e
u T n NS i EU t NT n OA B D o PT c MS ( O C 5 T 1 N
. E 2 B A U R - -
e T l S b N a I T T N E M P I F 3 U Q E 5 E T A B S E C Y S S TU NT AA B D LT PS T 2 2 RE 8 8 OT 9 2 PA 1 2 ED 1 4 R 0 0 1 1 T 8 8 NE 3 4 ET 2 2 VA 2 2 ED 1 1 N O 8 0 IR 4 8 CSE 3 3 ISD 2 3 sed 7 7 NCU 1 1 CN A R 4 5 E 1 1 B 1 1 M P 8 U R R N E E L L s s85C D l llllllllllll1 l
E 1 APPENDIX G NRC STAFF CONTRIBUTORS AND CONSULTANTS l La Crosse SEP
This safety evaluation report is a product of the NRC staff and its consultants. The NRC staff members listed below were principal contributors to this report. A list of consultants follows the list of staff members. NRC Staff Name Title Branch ! A. Chu Nuclear Chemical Engineer Accident Evaluation W. Pasedag Section Leader Accident Evaluation M. Thadani Nuclear Engineer Accident Evaluation A. Wang Technical Assistant ACRS Staff T. Chan Mechanical Engineer Auxiliary Systems N. Fioravante Mechanical Engineer Auxiliary Systems W. LeFave Mechanical Engineer Auxiliary Systems V. Panciera Section Leader Auxiliary Systems A. Singh Mechanical Engineer Auxiliary Systems S. Kirslis Sr. Chemical Engineer Chemical Engineering J. Wing Sr. Chemical Engineer Chemical Engineering J. Kudrick Section Leader Containment Systems I J. Lane Containment Systems Engineer Containment Systems W. Brooks Reanor Physicist Core Performance R. Abbey Sr. Meteorologist Earth Sciences M. Fliegel Section Leader Environmental and Hydrologic G. Staley Hydraulic Engineer Environmental and Hydrologic F. Litton Task Manager Generic Issues S. Brocoum Section Leader Geosciences R. Jackson Chief Geosciences J. Kimball Geophysicist / Seismologist Geosciences R. McMullen Geologist Geosciences L. Reiter Section Leader Geosciences J. Schiffgens Materials Engineer Materials Engineering Y. Li Mechanical Engineer Mechanical Engineering J. Levine Meteorologist Meteorology and Effluent Treatment E. Markee Sr. Meteorologist Meteorology and Effluent Treatment P. Chen Sr. Mechanical Engineer Operating Reactors Assessment R. Hermann Sr. Project Manager Operating Reactors #2 R. Dudley Project Manager Operating Reactors #5 G. Alberthal Nuclear Engineer Reactor Systems E. Lantz Nuclear Engineer Reactor Systems V. Leung Nuclear Engineer Reactor Systems E. Marinos Nuclear Engineer Reactor Systems L. Marsh Section Leader Reactor Systems M. McCoy Nuclear Engineer Reactor Systems R. Newton Reactor Engineer Reactor Systems M. Rubin Reliability and Risk Analyst Reliability and Risk Assessment C. Ferrell Site Analyst Siting Analysis l L. Sofer Section Leader Siting Analysis i P. Kuo Section Leader Structural Engineering
- 0. Rothberg Structural Engineer Structural Engineering D. Gupta Geotechnical Engineer Structural and Geotechnical L. Heller Section Leader Structural and Geotechnical La Crosse SEP G-1
Name Title Branch G. Lear Chief Structural and Geotechnical R. Pichumani Geotechnical Engineer Structural and Geotechnical J. Pearring Geotechnical Engineer Structural and Geotechnical M. Boyle Integrated Assessment Systematic Evaluation Program ProjectManager S. Brown Integrated Assessment Systematic Evaluation Program Project Manager T. Cheng Sr. Structural Engineer Systematic Evaluation Program G. Cwalina Integrated Assessment Systematic Evaluation Program Project Manager C. Grimes Section Leader Systematic Evaluation Program K. Herring Sr. Mechanical Engineer Systematic Evaluation Program E. McKenna Integrated Assessment Systematic Evaluation Program ProjectManager T. Michaels Sr. Project Manager Systematic Evaluation Program (Integrated Assessment) D. Persinko Integrated Assessment Systematic Evaluation Program Project Manager R. Scholl Sr. Project Manager Systematic Evaluation Program (Integrated Assessment) P. DiBenedetto* M. Fletcher
- H. Fontecilla*
K. Hoge* Consultants Name Company Topics Report date T. Br:dges EG&G, Idaho III-6 September 1982 F. Farmer EG&G, Idaho III-10.A April 1980 VI-7.C.1 June 1979 VII-2 February 1982 VIII-2 June 1980 VIII-3.B January 1980 R. Haroldsen EG&G, Idaho III-1 October 1982 VII-3 October 1982 S. Mays EG&G, Idaho V-11.A January 1980 V-11.B January 1980 D. Morken EG&G, Idaho VII-1.A February 1982 D. Morton EG&G, Idaho III-6 September 1982 E. Roberts EG&G, Idaho VIII-3.A December 1979 B. Shindell EG&G, Idaho VIII-2 October 1979 T. Thompson EG&G, Idaho III-6 August 1982 A. Udy EG&G, Idaho VIII-1.A August 1981 R. Vanderbeek EG&G, Idaho VI-7.A.3 January 1982 VI-10.A July 1982 D. Barrett Franklin Research Center III-2 August 1982 L. Berkowitz Franklin Research Center III-1 May 1982 A. Gcnzalez Franklin Research Center III-1 May 1982 R. Herrick Franklin Research Center IX-5 August 1982
*No longer with the Nuclear Regulatory Commission.
La Crosse SEP G-2
Name Company Topics Report date S. Jenkins Franklin Research Center V-10.B October 1981 V-11.B October 1981 l VII-3 October 1981 i G. Overbeck Franklin Research Center V-10.8 October 1981 l V-11.B October 1981 VII-3 October 1981 J. Scherrer Franklin Research Center II-3.B September 1982 II-3.B.1 September 1982 i II-3.C September 1982 i III-3.C July 1982 T. Stilwell Franklin Research Center III-7.B September 1982 S. Tikoo Franklin Research Center III-1 May 1982 J. Mcdonald Institute for Disaster II-2.A May 1980 Research, Texas Tech University K. Harrington JBF Associates, Inc. Operating January 1983 Experience M. Muhlheim JBF Associates, Inc. Operating January 1933 Experience D. Bernreuter Lawrence Livermore National II-4 January 1983 Laboratory C. Liaw Lawrence Livermore National III-6 December 1979 Laboratory T. Lo Lawrence Livermore National III-6 September 1982 Laboratory T. Nelson Lawrence Livermore National III-6 September 1982 Laboratory R. Rumble Lawrence Livermore National VIII-2 October 1979 Laboratory W. Stein Lawrence Livermore National VI-2.D February 1982 Laboratory VI-3 February 1982 D. Vreeland Lawrence Livermore National VI-2.D February 1982 Laboratory VI-3 February 1982 H. Casada Oak Ridge National Operating January 1983 i Laboratory Experience i R. Guymon Oak Ridge National Operating January 1983 Laboratory Experience G. Mays Oak Ridge National Operating January 1983 Laboratory Experience P. Amico Science Applications, Inc. PRA February 1983 r B. Atefi Science Applications, Inc. PRA February 1983 M. Choi Science Applications, Inc. PRA February 1983 W. Ferrell Science Applications, Inc. PRA February 1983 D. Gallagher Science Applications, Inc. PRA February 1983 W. Galyean Science Applications, Inc. PRA February 1983 C. Kukielka Science Applications, Inc. Operating January 1983 Experience P. Liang Science Applications, Inc. PRA February 1983 R. Liner Science Applications, Inc. PRA February 1983 C. Scardino Science Applications, Inc. PRA February 1983 F. Wimpey Science Applications, Inc. PRA February 1983 W. Bieganowsky U.S. Army Corps of Engineers II-4.F December 1978 La Crosse SEP G-3
Name Company Topics Report date F. Brown U.S. Army Corps of Engineers II-4.F July 1980 W. Marauson U.S. /trny Corps of Engineers II-4.F December 1978 W. Hall Will'.am Hali Engirieering III-6 Consultant Services La Crosse SEP G-4
U.S. NUCLEGR REGULOTORY CCMMISSION I BIBLIOGRAPHIC DATA SHEET NUREG-0827 4 TITLE AND SU8 TITLE LAdd Volume No.. d.porcero,tel 2. (Le,ve D/ask) Integrated Plant Safety Assessment Report, Systematic > Evaluation Program - Lacrosse Boiling Water Reactor - 3. RECIPIENT'S ACCESSION NO nairvland Power Cocoerative - Docket No. 50-409
- 7. AUTHOR (S) 5. DATE REPORT COMPLE TED MONTH lVEAR Aoril 1983 9 PE RF ORMING ORGANIZATION N AME AND MAILING ADDRESS (include l'a Codel DATE REPORT ISSUED voNTw AR Division of Licensing April lYl983 I Office of Nuclear Reactor Regulation a It,,,, y ,,,,
U. S. Nuclear Regulatory Comission Washington. D.C. 20555 s (tene u -*>
- 12. SPONSORING ORGANIZATION NAME AND M AILING ADDRESS (lac /ude les Codel Same as #9 above. ,,
- 13. TYPE OF RE PORT PE RIOD COV E RE D I/nclus.ve d,tesi (Draft Report) - Technical Evaluation
- 15. SUPPuEMENTARY NOTES 14 (Leave o/a561 Pertains to Docket No. 50-409
- 16. ABSTR ACT (200 words or lessJ The Systematic Evaluation Program was initiated in February 1977 by the U. S. Nuclear Regulatory Comission to review the designs of older operating nuclear reactor plants to confirm and document their safety. The review provides (1) an assessment of how these plants compare with current licensing safety requirements relating to selected issues, (2) a basis for deciding on how these differences should be resolved in an integrated plant review, and (3) a documented evaluation of plant safety.
This report documents the review of the Lacrosse Boiling Water Reactor, operated by the Dairyland Power Cooperative. The Lacrosse Plant is one of 10 plants reviewed under Phase II of this program. This report indicates how 137 topics selected for review under Phase I of the program were addressed. Equipment and procedural change. have been identified as a result of the review.
- 17. KE Y WORDS AND DOCUME NT AN ALYSIS 17a DESCRIPTORS Systematic Evaluation Program l 17b. IDENTIFIE RS OPE N EN DE D TERYS 18 AV AILABILITY ST ATEMENT 19 g i SgD'5 'coorr>
21 NO OF P AGES unlimited 20 ggggggno,,, 22 ,R a s NRC FORM 335 1113H
- U.S. GOVEltNMENT PRINTING OFFICE: 1983-181-297:3060
UNITED STATES finst class ua t NUCLEAR REGULATORY COMMISSION P05f ACE,4,8fis Pai0
.c WASHINGTON, D C. 20555 assa a c Pi9Weito S Q OFFICIAL BUSINESS PENAlf Y FOR PRIVATE UCE. 4300 120555078877 1 C00498 US NRC ADM DIV OF TIDC POLICY E PUB MG T BR-PDR NUPEG W-501 WASHINGTON DC 20555
(- t}}