ML20197F632
| ML20197F632 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry, Brunswick, 05000000 |
| Issue date: | 09/02/1981 |
| From: | Michelson C NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | Harold Denton, Stello V NRC OFFICE OF INSPECTION & ENFORCEMENT (IE), Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 8109220940 | |
| Download: ML20197F632 (2) | |
Text
-
. e,
\\
UNITED STATES NUCLEAR REGULATORY COMMISSION 8
g h
- R WASHINGTON, D. C. 20655
%.7,,f' SEP 2 1981 Ad db c
MEMORANDUM FOR: Harold R. Denton, Director Office of Nuclear Reactor Regulation
- "ictor Stello, Jr.
Director Office;of Inspection and Enforcement FROM:
Carlyle Michelson, Director
- Office for Analysis and Evaluation of Operational D,ata
-.s -
SUBJECT:
CASE STUDY REPORT - SAFETY. CONCERN ASSOCIATED WITH REACTOR VESSEL INSTRUMENTATION IN BOILING WATER REACTORS On January 20, 1981 Brunswick Unit 1 experienced a plant trip involving reactor vessel level instrumentation. Similarly, on March 31, 1981 Browns Ferry Unit 2 also experienced a vessel level instrumentation related unit trip. Alerted by these events, AEOD has performed a case study on vessel level instrumentation in BWRs and our preliminary report on the subject
, is s:nclosed.
s In accordance with our " peer review" process prior to the finalization and distribution of our case study reports, we are providing NRR, IE, NSAC, and INR0 with a copy of a preliminary report for review and comment, particularly regarding accuracy and completeness of the technical details.
Changes to the findings, conclusions, and recommendations will be considered only if the underlying information concerning the details of plant design or systems operation is in error.
Therefore, comments are being solicited on the tech-nical accuracy of the report.
The findings, conclusions, and recommendations q
are provided for your.information in order that you may understand the l
significance AEOD places on th'is concern and therefore obtain a more complete picture of the tq.tal report. We would welcome comments either informally by phone or formally 67 memo.
_ Since we wish to finalize' and issue the report shortly, we ask that any icomments be received by us witnin 30 days from receipt of the preifminary l
Should your office requtie some additional time beyond that point, copy.
pl. ease let us know, otherwise it will be assumed that there are no comments.
8J.e22ews % f x a
3 m.u 5
Harold R. Denton Victor Stallo, Jr.
m, He are also placing a copy of the preliminary report in the Public Document Room.
If /ou have any quettiens regarding this matter, please contact either Matthew Chiramal or Frank Ashe of ry staff.
p Orisinni signed byt g
C. J. Heltemos, Jr Carlyle Michelson, Director Office for Analysis and Evaluation of Operational Data
Enclosure:
As stated cc: w/ enclosure T. Ippolito. NRR R. Mattson. NRR F.1.ainas. NRR F. Ros a NRR-
- s -
R. J. Clark. NRR J. Hannon NRR P. Check, NRR J. T. Beard, NRR b
E. Jo r... IE V
A. Szukiewicz. NRR W. Mills. IE V. Thomas, IE
.J. Van Vliet. NRR bec: w/ enclosure
. Central File AE00 RF AE00 SF,
' C. Michelson C. Heltemes M. Chiranisl S. Rubin F. Ashe q
m
........A,E,Q,g,,,fbt,........A,E,g D,,,(c,,
Qp,,,,,,,,,
y L,,,
emat MChiramal:9r sc FAshe temes C
a.c..i..r..o..n....
. sun:nu o mo
.8/st'/.8.1.................alg./.a1...
11.a1.........a L/.a1.......
T
r u
s
. c.
s t
t
.y SAFETY C0t.'CIRN ASSOCIATG WITH AEACTOR YES INST &UMENTATION IM BOILING WATER REACTORS l
by the OFFICE FOR ANALYSIS AND EYALUATION 1-CF CPEAATIONAL DATA t
1, January 1982 l
Prepared by: Matthew Chirmal Frank Ashe 1
i
~
Nota:
This rt;or documents resul s of studies pre:ared by the Office for Analysis and Evaluation of Deert-Tonal Data wita regard to several emerating events.
The fin:ings contained in this report are ;rsvideo in suoport of other ongoing NRC ac':ivities encarning
- .r.se events.
Since the studies are ongoing, the re: ort is not n'ecessarily final, tac,ne findings ao not represent tne po.sition or recuireents :( :ne program office of :ne Nuclear Regulttery C:=mi:sien.
0 e
e I
e y p en n e
g y na/ ^ D o a g pga.ay. A h gt1pp.
P-l.
s s.
1
_ TABLE OF CONTE I
i EXEC'T!YE :UMMAAY.,,,,,..........
J 1.
uCx= 0uMD........
2.
0!$CU33!CW CF 3AFETY CONCIAN.,,
2.1 Description of Aeactor Yessel Level Ins Monitoring Normal or Narrow Aange 2.2 Effect of Instrument Line Failure on
.i Protection and Control Systmas....
P14 i
2.3 The safety Cencarn and Related Angulat 2.4 Possible Unanalyzed Sequence of Oc:urre 3.
FIMDING3....,,,,.,,,,,,,,,,
4.
CONCLU3!0N.....,,,,,,,,,,,,
5.
RECDMMENDATIONS...,,,,*,,,,,,,,,
LIST OF F100AE3 l
l Fi ure - 1 f
AEACTOR YEssEL LgYEl. IM5TRUMENT
, {
Figure - 2 YEsstL WATIA LEVEL ILOCX O!A I
APPENDIX A EVENTS INVOLVING kWA trygt, I gg374
'l
, i l l i
- I 9
e G
' - ---~:
~ ~
~
3 EXEC'JT!YE swr.ARY s
1
. Our review of operating reactor events involving toiling water reac.cr W vessel level instrumentation has shown several cases wn plant control iystems and protection systes is evident.
4 I
This intaractica is,
basically d.Je to fluid coupling and sharing of inst ument sensing Ifnes atuched sensors that monitor vessel level and provide input to the protectio and control systams.
i Our review of there cases has raised the safety concern of a single failure i
causing a control syste action that (1) results in a station condition protec-ive action and, at the same time, (2) prevents proper actuation of pr
}
tion system channels designed to protect against such. a condition.
~.
We believe the physical installation of ceruin'!WR level instrumentation say.not fully meet the intent of the regulations (or the separation of 'protaction and contro
'w
. systass and the single failure critaria,.eas delineatqd in General Design Critarion 24.
1 Based upon operating experi.epce, we believe that a single randas
{
failure in me instrument sensing lines should now be considered in im IIII 275-1971.
In this study w have not conducted a detailed plant specific review of level instrumentation installation, but have confined ourselves to a general eval A-
{
This study addresses the interaction bec<een feedwater control, reactor ;r primary contaiment isolation, and emergency core cooling systems.
The effect of J.
the inter' action may vary frcm that det.afled in this study depending on the ~
t details of the t'nstallation of the instrumentation.
Va plan to expand the secpe of tne study la.ar to consider the effects cf interac-tons due to level instru-senution permissive intarlocks provided to the recir:ula-ion pusp control and residual heat reoval systes.
e y s-
I o.*
.e g,
'g This report is intended to introduce the safety concern related to 8'4R l
vessel level. instrumentation. We note that similar fluid coupling probless 1
.j could exist beween control and protection systen instrumentation that monitor other parameters sucn as steam flow, watar flow and liquid levels at both SWRs and PWRs. However, our initial review of operating reactor events has identified the SWR vessel level ins r.nnentation systen specifically as one
.]
. that involves such problems. Ve plan ts cantinue our reviews of operating
.e experiences at both BWRs. and PWRs for events involving similar probless that could affect safe operation of nuclear ~ plant units.
I e
)
I
(
.L
?
i
- 40
- e.
e 3,,..
'e 6
+
s 6
e i
e 4
e O
s py-,
~,
3*
1 5
. 1.
SACXGROUND
.)
In the desi n of the instrumentation used in control and protection syste 5
.i*
conscious effort has been made to physically separate the different se l
In reviewing IWR vessel level inst usentation drawings of operating plants 4
provided in F5AAs and in other associated documentation (e.g., NEDO h
" Compliance of protection System to Industry Criteria:
we note that the sensors used for control systens were shown mounted on lines that are separate fras other instrument lines associatad with sens in protection systams.
However, review of operating experienca and a few of the "as built
- f astrumentation drawings show that sensors for protection and 4
i systams may be mounted on cammen instrument lines.
This study is based on Licensee Event Reports (LERs) and Nuclear pow 1
(Npts) involving SWR level instrumentation.
e.
The events, are listed in Appendix A. The events cited are examples of how occurrences isolving instrument lin and/or related itans can lead to erroneous reactor vessel level The probles of control and protection systes interattien stJdied here is ap to operating IWRs and those with const.uction pensits.
2.
D13CU5310N CF $AFITY CONCIAN i
There have been a number of doctamented events' twolving potentially erroneo indications by reactor vessel wate'r level instrumentation at operating BWRs-(Appendix A).
The events in general show that a single failure twolving one of the ins.rument legs ccnnected to the level measuring differential pressure cella could affect all instruments connected to eiber or 'both legs.
A review of each event shows that the effect on the plant varies, depending on the' instr;ments af fectes and on tr.e function of those inst u:::ents.
Thus, the initiating failure
7.
v t
j.
4.
1-either led to a pfant trip or was detected and corrested by the plant opera without significantly affecting plant operation.
Our review ranged further afield I
to consider the control. and protective functions of the instruments involved i
'l
.Jl BWR vessel water level is measured by means of differential pressure sensed across two instrument lines.
In general, operating SVRs use four consuntT ho reb w
]
reference legs and seven variable legs (see Figure 1 for a typical installat The constant reference is obtained by means of constant head condensing c Two of the condensing chambers have a temperature ccrnpensated' column and auxiliary head chamber.
The other chambers have ne tamperature compensation.
The level instruments connected to tamperature c:rapensated reference leg used to monitor vessel water level in the accident or wide range (. typically -
1 to +60 inches with instrument zero 528 inches above vessel zero.)
The so
~
without temperature caspensated reference legs are used for normal or narrow range level instrumentation (zero to 60 inches with instrument zero 528 inches above vessel ero.)
These reference legs are also used for instruments that k
monitor water level inside the core shroud (-100 inches to +200 i I
instrument zero 360 inches above vessel sero.)A fifth reference chamber is for the water level instrumentation in the refuel range (zero to +400 inches j
with instrument zero 525 inches above vessel
- zero.)
s Review of the LIRs. raised a concarn regarding the level ins rumentation that monitors the nomat or narrow range of the vessel kater level.
~
This is discussed t
bel ow.
2.1 Descriatien of Retetor Yessel L.evel instrwenta: fen.Menf tering Normat
- r narrow Aance The level instruments.nat monitor nomal or narrow range.
l cf the Assel water level are connetted across two pairs of instrument lines (see Figure 1).
Cne sair :f instrument lines has the fo11 ewing level instrumer.ts:
B
,,s
..g.,_
- - * * ' * ~ * ' ~
+
g O
N k
z y
i t'
,l
!-@- is t
5:l!'J,El4 4 I!-3' !!!l$ 4 $I $. 'h liljl! j i'*@~~!&,';-@- I =gi..ni i @.,l.-e m !!!!ii il
- 1 5
.l I h k
- ._ _l ti t i 1
- , 3=
( 0--,! 'yI j II * ! a," I! } !! ! s I 4 _xi s. 3 1.-. .l. '(. 1 !ls~! ,E I 1 k
- e.
L g I j- ,n g- ~ m 4 i l h [ 1,
- i l
- I: 9 3
,3 p I i ce i, ~ ci eq _v,m i i n i. v 4 1 pr e 3,. t__ ! ! -@y-
- T t.:41.)
.u $3 II
6- ~ L15 3-2CBA and 3-2088 LIS 3-203A and 3-2038 l LIS 3-184 I t .LT 3-206 and LT 3-53 The constant reference leg associated with these instruments is also used. t as the reference for the shroud level monitor LITS 3-52. The other pair .j. of instrue:ent itnes has: LIS 34208C and 3-208D LIS 3-203C and 3-2030 LIS 3-185 LT 3-60 i i The constant reference leg' is also insed by shroud level monitors LITS 3-62 j and LT 3-62. i u The functions perfomed by these instruments are as follows: } LIS 3-208 A, 8 C O HPCI and ACIC turbine trip on high vessel level. LIS 3-203 A, 8. C, D Scram and primary contaiment isolation on low level. HPCI and RCIC turbine trip on high level. ,4 i J' LIS 3-184 and LIS 3-185 Auto blowdown persissive on r low l evel. LT 3-53,LT 3-60 and 3-206 Feedwatar control systan inputs (A high water level trip of the main and reactor feedwater turbine is also provided by = the feedwater control sys an). LITS 3-52 and LIS 3-42 Containment spray interlock on low-l ow-l ow l evel. The physical arrangement of these level instruments on two separate sets of instru:sent lines is such that the A and 8 sensors are connected to one set of inst ument lines and the C and 0 sensors to another set. These sensors provide input to protec-ion channels in the plant protaction and mergency core cooling The protection systam and mergency core c:oling systam logic arrange-sys tems. =ents *or these 3'm instrument channels are the usual one-out-of-two-twice '11 2-- i - ------- -- - - -
m, v, l s 1 i
- enfiguration using channel (A OR C) AND (B OR D) arrangement.
The two sets of instrun$ent ifnes are separated and f solated in their physical co J reactor pressure vessel. Thus, the arrangement of these' level instruments assa-i ciatad with the plant protection system meets the Single Failure Criterion o 279-1971 paragraph 4.2. n 7 The same instrument ifnes, however, also have reactor vessel level control transmitars (LT 3-53' and LT 3-Z06 on one set; LT 3-60 on the other) mounted } These transmittars provide input to the plant's feedwater control on them. system (See Figure 2). Each transmitter provides an output signal ranging fras , [10 50 ma, which represents the nonnal water level ranging from t l at nor:nal operating press,ure. Corrections for water density changes a're made by t reacar pressure measurenants. Signals fron" pressure tra' smitters (shown on n Figure 2) are applied to level correction amplifiers to accomplish this. ,L Each of the three corrected level signals is applied to an alann unit. The three alarm h!I unit outputs are connected in a two-out-of-three coincidence logical to provide l is high watar level trip (+E4 inches) to the main and reactor feedwater turbines ~, The three corrected signals are also displayed in the control room, as are the three pressure monitors. The correc:ad level signal fran either transmi-.ar LT 3-53 or LT 3-60 is selected by the~ contrat rocm operator for use in -he feedwa.er control systam. The selec-ad level signal is recorded in the control roan.' It is aIso supplied to two alarm units, the feedwater bypass valve con ~ ro11er, a level flow error' summing device, and the feedwater con: ol mode salec-3r; switch (one or *hree el,ement control).
- ror ras in general, eignt reactor vessel tevel it.dicators and r o regorters are
- rovided in the main control room to aid :ne operator.
High and low level ........ ~ - - - -
O.
- i.,.
j. PRESSURE COMPENIATICN PRESS A PRESS 3 [ E PRES 3 C ~ i ~ h k LEVEL E l A7/l l 1.T.3 S.3 LEV E,. 4.P/l [' C"3do aPfl . i., J. 2 e d' M m T- -. T __T 'l f. l T~~~ PROP e AMP PRCP PROP AMP .I ntP f i T A } } i O O O t P -l ~~-----l-~~--...-'.'.... r HIGH LEVEL TURSINE .........n-i q'-. TRIP (2 CF 3 ~ COINC'CENCE) 3 4 A-1 I 5 5 4 L-~3 yj CR = h 'hSELECTOR ] M J-4o c d L7. 3 1
- I LEVEL SWITCH 3.
A LEVEL LEVEL 3 5 WATER LEVEL ~ C- ~ FW PuutP. TRIP INTERLOCK O O I 4 REC 1RCdt./.710N FLOW HIGH/ LOW REDUCTION
- ~
ALARM UNIT ~"" REACTOR VEI5EL I WATER LEVEL I TOTAL FEECWATER FLCW r VALVE LEVEL $j$ i! CONTROLLER } LEVEL " FEED -- - b 3 ,3 F'.OW i LEVEI./ FLOW 80 ~ (ERROR NETWORK C'M IUMMER) ( MCDE SELEC CR IWITCH P R CP'"a (1 CR 3 ELEMENT CCNTROL) AMP l ~ l MASTER a STEAM /FEEC FLCWE.;RCA r I ~ Figurt f. , Vessai Va:a.- !.evei iiock liagra. # l 1 ( 1 ~
o- .g-4 ? . digital inputs to ne control room annunciator system and the plant cc system also infom the operaur. vessel level staas. s j The control roon indicators *ind recorders are: i 1 (1) two level indicators (LI 3-52 and LI 3-62) and one leve (LR 3-62) monitor the shroud level. These instrucents are normally pegged high at +200 inches during power operation; '} (2) one level indicater (LI 3-E5) monitors the refueling range (zero to +400 inches)1 (3) two tevel indicators (LI 3-46A and LI 3-463) monitor ue a j-range (-155 inches to + 60 inches); (4) three level indicators (LI 3-53, LI 3-60 and LI 3-206) monitor normal range (zero ta +50 inches). A reactor level / feed flow two pen recorder in the control room also continuously monitors i. !9 the level signal selected for the feedwater contral system (either-LI 3-53 or LI 3-60 signal). t During normal power operation, five indicators and one re' corder (numbers 3 a I 2 above).would be used by the operator to monitor level. Control roan alarms would alert the operator u abnomal conditions. The refueling range level inoicaur (numoer 2 above) is not cal _ibrated for operating conditions and i's not used during noma 1 coeratic'n. 2.2 2ffect of Instr: ment Line Feilure en plant Protection and Centrol Systems A failure in the ins:-.: ment.line connected to the c:nstant head cmndensing ena=cer (e.g. equali-ing valve leak, excess flew eneck valve leak, drain 1 0 ^ cr:: - ~
,r, ~. y valve leak, etc.) could cause the reference leg level to decrease. This decrease in reference leg level'yould cause all the differential pressure instruments connected to that'line to indicate false high reactor vessel w ~ level. Referring to Figure ?, if such a fatiure was to occur in the reference 1 of the normal range level sensors A and B, then LIS 3-208M8, LIS 3-203 A&B, LIS 3-184, LT 3-53 and LT 3-206 would all sense an increasing level ,If LT 3-53 was selected by the control. roi:m ope'rator for the~ level input to the feedwater control system (with the feedwater control mode swit:h in either the one or three element control), then the feedwater system [ would reduce feedwater flow into the reactor vessel.This would tend to decrease the actual reactor vessel water level. If pr'anpt operator action is not taken to canually control the feedwater systas, then {~ ~ eventually the vessel level would reach th.e low level scran setpoint. However,' scram level sensors LIS 3-203MB would s'ense a high levei and would not actuate. Therefore, LIS 3-203 CAD cn the redundant instrument { lines would be required to provide the necessary protective action. ' In such an event the c$ntrol roon level i.ndicators recorders and alarms ~ would be providing ambiguous level informa-ica to the operator. The two accident range indicators (LI 3-46 MB) would still'show true level, but only one of the normal range level indicators Hn this instance LI 3-60) ~ would indicate true 1evel. The other two nomal range leve1 indicators (LI 3-53 and LI 3-206), as well as the level recer.ter pen, would show an erroneous high level. If, on the other hand, the failure was. to occur in the reference leg associated with normal level sensors C and D (i e 9 e ~
b.., , i, l' LIS 3-203 CAD, LIS 3-208 C3D, LIS 3-185 and LT 3-60) and if LT 3 e i l for level input to the feedwater control system, the effects would be s i wien the fo11'owing exceptio' ns: (1) only o'ne nomal range level indicator { (LI 3-60) and the level recorder would show the erroneous increasing le
- and (2) tha high level turbine / reactor trip would not occur, since only one threc level transmittars associated with the feedwater control, system w i
affected. 1 i 'j In either case, during the ensuing plant transient, both high and low level alams could.be actuated in the control rom. Depending on the type of instrument failure, the plant would soon' experience a low level scram frcm the redundant unaffected inst ument channels and perhaps a high level turbin t-ip/ reactor trip. All of these conflicting. indications and auto:iatic actions i l could hamper timely and correct operster response to such an event. t-Automatic I plant response must be relied upon to terminate and control the transient. /d ~ This is confined by operating experience (see Apendix A) which shows s$ cases where operators did not respond to such events and automatic protadtive action was needed to taminata the transient. \\, If the failure 'in the instrumentation causes a very gnadual decrease in ^ ^ ' he ref.erence'les level, then actual reactor level could fall to the low level .s sere satpoint (because of the feedwater control sys an action) before the false level appearing to level sensers in the failed instrument legs rises ~ ~ to the high level turoine trip se point. Low level reactor s:rn would ec:ur due to actuatier, of redundant level sensors (LIS 3-203 C3D) on the o-her instr.: ment lines. Even aally, the s;uricus hign level sensed could 9
s 12 - i' cause main and reactor feedwater turbine trips on two-out-of-thre coincidence high level fran the alarm - its in the feedwater control systs. If,on the other han'd, the rate of increase of spurious level is fa t s er, a high level trip (two-out-of-three high level) of the main and reactor feedwater turbines (and consequent reactor trip due to main turbine trip) co ld j u occur before the vessel level reaches the low level scran setpoint. 1 In either case, the g failure would cause a sourious hich level to be sensed .The control systen would then cause a reduction in the true vessei level , which could require the protective action of low level scram of the reactor. Tnis interaction between the feedwiter conyol systen and the rea t protection systen is the safety concern in that the initiating ir}st c or i rument ,i line failure could cause adverse feedwater control systen action 3cw vessel level protective actions and, at the sam requiring 'E ~ proper action of certain low leve1 protection systee channels v._ i, 2:3 The safety Concern and Related Reculations tt General Design Criterion 24 on separation of protection and cont rol systens i states, ~'i'he protection s,yste shall be separated fr::m cont ol syste t I the extent C:-t failure of any single contro1 systam c=npon o ent or channel, or failure or renoval frca service of any single protection systs ent or channel which is c::= mon to the control and prctecticn systens intact a systs satisfying all retir.bility, redundancy , and independence ~ requirments of the protection systen. Intarconnec. ion of the protection ~ and control systens shall be limited so as to assure f. hat safety is not significantly impaired." In the.WR 1evel instrumenta:icn system, a single 1 failure in the sensing line that causes control syste action , coes not leave in act a systen satisfying all reliability, redundancy and i d n ependence recuirenents for :ne low vessel Itvel":rotective function qq eN4 ____,_.._.......- _.-.. _--._.._ _ _ _ _ _~ ~ _ _ _ ~ _ '.. _ _ _ _ _ _ _ _ _ _ _
^* s a 3, h % IM. ~ paragraph 4.7.3 on control and protecti y.y.m.wd~ IEEE 279-1971 on systa interaction states, **.'here a single randern faiiurewn cause a control .~ results in *a. generating station condition requirino sys_tm ~ action that { also prevent proper action of a protective systa chann l dn s ~ against the condition, the reaining redundant protectio esioned to protect e providing the protective action even when degrad d c ranoca failure.' e 1 This requirment of IEEE 279 augments the red i t General Design Cr.itacion 24 on leaving intact a pu rment of I all reliability, redundancy, and independence recuirmerotectio system on failure of any single control syste:s c:rn;onentnts of th 279-1971 or channel. IEEE [ is, however, limited in secpe to the protecti circuitry fra sensor to actuation device input ter:ninalson system this to exclude the fluid sensing liries NRC ha's interpreted i Based upon operating experience, we believe that a si ng*e randczn failure in the sensing line should now be considered in impleme (It it noted that the 1977 and 1980 editions of IEEE nting IEEE 279-1971. tw i are later versions of IEEE Standard 603, which 279-1971, do address the subject lines and include them as part of the protection syst of sensir.g em.) Applying the requirment of paragraph 4.7.3 to the i ..,= nstru:nentation system under disi:vssion, the single randcen fcilure is the decreasi leg level and the resulting control system action is l ng reference, owering of the actual ~ vessel level, which woul:t require a low level protecti ve action. channels (1.*S 3-202M35 are prevented fran perf:r:-ing thei Two protection leaving redundant channels (LIS '3-203C3D) to pr: vide th r protective actions; e required ;rotective function. If a single active failure is new postulated in o :- ne of tne t.o y,ms' ,,,ese em'***
.~ .h 8,'hLu-ST - y Li i .s e c-", C(C,' .y.d i -S * ? g Ks., kc t remining en.annel s., -hen the requi.red aut.~natic pro.ective actions willas.s t '=-
. ~...
I not occJr at the low water level scru setpoint. Further, if one of the. [ - - - - - - - ~ ~ ~ - - j four channels < i,s inoperable due to maintenance or required surveillance and is not placed in a eip condition, then this would tend to exacerbate the safety concern since the single failure of a decreasing reference le i ) could defeat the associated automatic protective actio.ns at the low wetar Tevel scram setpoint. Under these conditions the infor:natica provided in } section 2.2 of this report continues to be valid and appears to make the I concern more significant. However, since the technical specifications allow l the level instrument system to remain in this degraded mode (that is ,three cperable channels and one incperable.non-tripped channel) ~ 1 ~ for a period of up ~ ~ _ to only two hours this aspect may not be sfsnificant in the broader contaxt of the concern. .( The above concern can t:e extended to all designs where the protection sy uses a one-out-of-treo-tMee logic (i.e., A or C and 3 or D) to initiate protective action. Even if only one protection system channel if coupled to a control system channel (say A), and if the single randan failur'e causes a control systam action requiring protective action and also prevents pecpe action of the, protection system channel, a f=_rther single active failure of one particult.r reaining redundant prot' action system channel (c), will prevent the required, prctectivs actions associated with these protection channel s. 2.* Possible Unanaly ed Secuence of Oc:ur ences \\ Level instrumentatien sensor LIS 3-202A thr:ugn D pr: vide che following protective actions rren 3
- -X ~
-- J
m. u },.- .a I g (1) Scram (2) Primary c:ntairment isolation i (3) HPCI and RCIC turbine trip 1 (4) Start standby gas treat:sent systa (SSGTS) 1 5 5 4 hen m channels (LtS 3-203MB) sense a spurious high level and a i failure is po'stulated in o'ne of the remaining redundant chan i or D) the protective actions are affected as follows: i ) (1) Scram - Low level-scram will not oc:ur. (2) Primary containment isolation due to 1c4 level wil1 not oc (Typically Group 2, 3, and a valves are affected.),
- ur. -
The fo11cwing pipelines will not isolata:- l RHR reactor shukdown cooling supply RHR reactor head spray Reactor water cleanup system ii l$ Drywell equipment drain discharge t( Drywell flow drain discharge Drywell purge inlet I Drywell main exhau'st j 4 Suppression chamber exhaust valve bypass Suppression chammer purge inlet Suppression chamber main exhaust Drywell e.xhaust valve bypass Suppression chamber drain RF.R flush and drain ven: a sucpression ena.mber i Drywell purge and ven outl et Drywell makeuo Su::ression.ta.e:er maictu: -xnaus: :o 53GT3
However, if isolation of the above pipelines were truly ne d d e e, excluding the lines associated with the reactor water cleanup system , it would still be obtained by other diverse means which initiate on high reacto I r building ventilation exhaust radiation anti /or high drywell pressure e (3) HPCI and1CIC turbines 11 receive a high level trip signal 4 (when LIS 3-203 A&B, connected to one set of inst 9 men 1
- nes, reaches spurious'high level of +54 inches, and if either LIS 1
~ 3-203C or D, connected to the other set of instrument lines , is postulated to fail high). 3 (4) SBGT system will not receive on aut:xnatic start signal !~ l The event initiated by the instrument line ' failure *ill c'entinu c ,e and the reacter vessel level wit 1 decrease due to reduced or F fl ow. If the operator does not take correc:fve actions, the vessel leve . er will reach the low-low level and the level instrumentati'on monito e accident or wide range, speci.filaQy sensors LIS 3-56A thru D, wil 4 I closure bf MSIYs which in turn will cause a reactor scrm. e I Sensors LIS 3-58A through D will sense conditions necessary to initiate HPCI , RCIC, ADS and core . spray' systems. Scram under these ' conditions ^nould occur at an l ; j level which is considerably below the nor:nal low level scrm (Current safety analyses normally assume that a scram occurs directly frcen the low le j instrumentation, which is defeated Gnder these conditions , and not indirectly by the way of MSIYs fran the low-low level instrumentation ) Further, when the
- <SIVs close, inis action will tend to collacse the voids contained i n the fluid and will fur-her decrease the fluid level in the rea ve:,el
= =-- tw = _ _. L:^.T - ~ ~ ~ ~- - - - - - - ~ - - - - - ^ - ^ ~ ~~
i = i - 17. t In addition, due to the presence of high level trip interlock si gnals. (item 3 above), aut:matic operation of~ HPCI and RCIC would not o I } esigns since the high level trip signal takes precedence over the lo I initiation signal. start This situation of a decreasing water level in the ves I j coupled with (1) scram which is initiated at a vessel level lo nomal low level scram, and (2) the unavailability of automatic e eration of k safety grade high pressure injection systams, appears to be an sequence of oc:urrences. yzed c f A typical scenario initiated by a level inst:amentation refere N nce leg failure would be as follows: u 4 The loss'of the reference leg.in the nomal range level 'I instrumentation causes a spurious increasing level to be j sensed by the feedwater control system, -leading to a decreas { in actual vessel level. 'i-- protection system channels are disabled.By the same failure, two low t level reaches the low level setpoint, reactor scram andWhen the primary contaiment isolation would nomally occur due to ,~ actuation of redundant low level protection channels on the FJ unaffected instrument ifnes. ,Is disable the low level reactor scram.the redundant lo , could - j line could cause a turbine trip which would, in tu The spuricus high n the reactor or, based on the various indications availabl , scram in the control roon and time pemit-ing, an alert o' erator e could initiata manual serem and c:taiment isolation. I p and RCIC could be manually started if not locked out by the HPCI failed instrumentation. Otherwise, low pressure mergency core cooling would have to be initiated to provide water to the vessel. If no hanual action is taken, when low-low vessel level is reached MS_IY closure and associated scr will oc:ur. Au,.omatic ECCS ac.uation will also be initiated Sased on the availability of these various means ~of aut:matica11y a ...-- ~ n manually ace::=plishing the required protective actions, g not cons'ider the c:n:rol system pr:tection system interaction ;recipitated by hydra"ulic e ae ects \\ o l ....... - - - - - - - - ' ' ' ' - ^ ~ " ~ ~ ~ ' ~ ^
u
- e.,
an immediate safety concern: f however, we do consider that the safety concern needs to be addressed. t ~ 1 S FINDING 3 1 (1) The physical arrangement of reactor vessel water level instrumentat t 1 in operating 3'4Rs is such that hydraulic coupling exists between s -1 }- _ that provide input to the feedwater control system and to the plant 1 j protaction systams. The level instrumentation that monitors the perating range is physically arranged so that sensors which separately provide 4 input to the feedwater control system and to two channels of the reacto protection system and ECCS are connected across ex. mon inst ument ifn (2) Certain single failures in the instrument lines can'cause a decrease in i the r'eferenc's leg level er affect the variable les level of the vess evel ~ instrumentation. The ensuing spurious level is sensed by the feedwater control system and two channels of the protection systen. Tne spurious level 3- 's sensed by the control syitem could cause the system to respond adv resulting in a plant condition requiring protective action. (3) Moreover, such a failure causing ' incorrect control system response would also prevent pr per action by two of the protection channels. If a ranecm failure is now postulated in one of the reafning redundant two channels, then the protective f, unction will not occur auamatically from the normal low level protective instru=enation. Tnis could. lead a a plant condition which appears to be unanalyzed. p) Tne c;erator is presented with conflicting infcrmation whichimay prevent hi= fran takir:g correct and timely actions. s ~ ~ ~ ~ ~ ~ ~ ~ ~
[.;. e \\ t I oe s c (5) The situation outlined toove suggests that selec ed SWR lev l 4 e nst:: men-tation systems may not meet be intent of the regulations f ~> or operation of protection and control systems single failure criterion a I in General Design Criterion 24 e l 4. C0!."U.! SIC:l 9 1 SWR operating experience has shown that a single failure in an ins ..1 .i ent sensing line could affect all level sensors that share the same t 1 There also have been events where ir.teraction has o n rol systems and protection systems. Our review of these operating experiences has raisa'd the safety concern of a single failure in the 3WR vesse nst.: men-tation causing a feedwater control system action that could 1) N l i su : in a condition requiring protective actions and, at the same time 2) prev i L proper action'of the reactor protection systm channels designed to against suc'h a condition. Va.also consider that certain level instrume 1, configuration in operating 8WRs may not fully meet the inte ~ 4 Criterion 24. Based upon operating experience we believe that a single j rendem failure in the instrument sensing lines should new be conside n . implementing IEEE 279-1971. I Although we do not consider the postulated control system-protection system interaction an immediate concern we do cons that the safety, concern and associated problem need to be add ressed. I }, 5. RECD'.ME!lDATIONS (1)' Action should be imolemented.o assure that automatic and manual safety-related low-low level start and high pressure ir.jection functions of HPCI and RC*C turoines are nct ;revented or delayec by the non saf t :y-related high level trip. For example, tne con:rol sys m cf HFCI and
20 - i t RCIC turbines could be modified to provide a low-low level st art signal which overri'ss the high level trip signal. (2) Action should be implemented to assure that protective functi ons Are - provided in spite of any adverse control systen-protection syste n er-action in the narrow range level instrumentation. 3 For e.xample, the , rotective functions provided by the narrcw range l'evel sensors co p i also be provided by the wide range level sensors (In e: ployin range level instrumentation, the desired output signal quality in te e rms of sensitivity. resolution, accuracy and repeatability must te co 1 to assure that the initiating signals schieve the required protecti ve function.). This approach would be consistent with the concept of
- alterr. ate channels" as defined in paragraph 4.7.4.I of IEEE St 279-1971. -
1 .L '(3) Control' roan operators should be trained to recognize spurious ib. level indications, and procedures should be provided for corrective actigns to mitigata the consequences of potential transients that 2 1 be caused by level instrumentation malfuncticas.
- 4e believe that the i,-
BWR emergency procedure guidelines p-ovide the best vehicle for the i definition of appropriate. corrective actions in the event of level * - inst umenta, tion malfunctions. e G 1 = Pa I l WL.. '7 ~ T::~ ~ ~r :'T : ~
- l
=.
21 - APPENDIX A EYENTS INVOLVING SWR LEVEL INSTRUMENTATIO The events cited are examples of how occurrences involving instrum ent lines and related items can lead to erroneous vessel level indication i The < vent descrip-k tions are quoted directly fran the Licensee Event Reports and Nucl I Experiences. ear Power i } Plant Name, 'Date of Event i. Event Descriotion Oyster Creek 1 March 1970 During a surveillance test on the reactor high pressure scram pressure switches, it was observed that the sensing line to the high pressure scr.am pressure'swtt:h had l. developed a leak at a " Swage-Lok" fitting which caused a level indicator to fail up-scal e. 4:ri An at arnpt was made to tighten ); t ] the fitting and the leak increased, causing Y the excess flow check valve in the pr'imary i pressure sensing line to close. The resul t. was a zero pressure signal to the pressure i i sensors mounted on this rack. (High Pressure Scram, High Pressure Isolation _ Condenser Actuation, Condenser Low Yacutsu Scram Sy-pass, Core Spray Yalve Permissive, Triple Low Level Auto Depressuri:ation,- Level Transmitter o.:eecwater Con: ol System, :.eactor Pressure Indicator Trans-mitter ar.d Auto Rei f ef Yalve Pressure). i 7- ,,,,.-M*W*
.i plant Name pateofEvent Event Descricticn - Since the Protective Instrument ifon Limiting Conditions for Operation could not -1 be met, the operators wre notified 'a-j prepare for a plant shutdown. '.i 3 subsequently, it was datamined that the ~ }i single failure of this sensing line prevented t I
- 1 g
[ the operation of both. isolation condensers I upon receipt of a reactor high pressure i:j signal. .; i s Emergency condenser isolation' on 1 pipe-break was still.operaale as was k ~ 5s mergency condenser ' actuation *by low-1cw }'[ '9 level and manual operation from the control
- t. e Plans were to detemine the wiring room.
i modifications necessary to establish the ability of the emergency condensers to } operate on a high pressure signal in the k g 1 event of a loss,of a single pressure . sensing-line. In the meantime, operating ij i~ personnel were made aware of the situation I and reinded that plant mergency procedures sall for verification of aut:matic actio.n I t L and manual initiation of such actions recuired. 3 Pesen lot.:n 2 Sect. S, 1975 5 During reutine surve.111ance hsting, centain-l! ment spray ;ermissive swit:h LIS-2-2-2-72A -as
l.. ,.e - . - v-s .e i-Plant Nace pate of Event Event Deschfo:f on found to be inoperative. Because the redundant B 1 cop was operable and a manual i override is provided for this switch, there J was no safety hazard. Cracked bellows on a Yarvay Model 441SCE l'evel switch.- Millstone 1 Sept.1973 During a plant startup, a' discrepancy of l s 15 inches was noted between the a indepen-I dent reactor level sensing columns. The mismatch was such that half of the RPS, ECCS and primary contairraent, isolation I system level switche's were seeing an Indicated level that was higher than the. t actual level in the reactor. Tne mistat:h could result in lata initiation signals for the systems in a situation where a failure occurred in the level switches that i j were reading pr:perl.y. ~ ,1, = i. An investigation revealed a valve that is nor= ally used for filling the system was leaking. The water was being drainef fran the reference column at a rate greater than the make up rata by c:ndensation in the level colu=n condensing pot. A loss of water frc: the reference coiumn in a device such its this causes the indicated level to rise.
Y . 24 Plant'Name Date of Event Event Descriotion The valve w ; replaced and the indicated levels converged such that they were within I the requirements of the Technical Specificatio Monticello 1 July 13,1975 j During normal operation a small leak (75-01T) n developed in a reactor. pressure gauge. The i leak lowered the reference leg level for the i Scram and ECCS initiating Yarway level a instruments connected to the same process t i -l tap causing incorrect level indication. 1 Aedundant Yarways were operable. l-No previous simi1ar occurrences. . Pressure ' Gauge isalated ( AD-50-263/75-12). e A leak developeq in the. g b Bourdon tube of Heise Model C MM 7646 0-1500 psig pressure gauge. d?- Brunswick 2 May 1976 During start up a level indicating swit::n (Yarway1 malfunctioned due to an internal leak. The associated instrument channel was a'anua11y tripped. The cause of the occurrence was the threaded pipe inside the instrument housing leaked because of a crossed thread.
- rownr Ferry 2 Aug. 14, 1977 During start. up fran Cold Shutdown, reactor (LER 77-021.)
water colurn '3" reference leg was 1cw, pro- .ducing a +20 inch errer in two reactor water e .y7 ....--~.....;.-. . ~ ~
3_ .o s Plant Name Date of Event Event Descriction low-level scram rdtc.5es. Aedundant 'i switches were operable and in sanice. The 'i reference leg was refilled and watar ievel l agreement confimed. This was not a 3 J ,repetittye problev. r .i, r' The integrity of all sensing lines and '3 valves axternal to the drywell was ccnfine The apparent cause was either evaporatio of watar from the reference les during esid t shu-Jewn, or inadvertant operation of equalizer or drain v'alves. I i Cooper Jan.1976 i l' Cold shutdown. While maintenance was being
- i per#ormed in the drywell, a rusty spot was noticed on some insulation close to the n'
i reactor. Upon further investigatica, it ~ was detar=ined that a crack in the 04 in instr.: ment sensing line on vessel pene-S tration X-ilA had developed cutside the safe end weld, in the heat affected :ene (HAZ) 1/2 inch frcm the weld canter. ~ History of this weld showed the origina1 weld failec the RT ar.d was cut cut and t rewelced. The see:nd weld fatied.he RT and was re: aired. The third. eld ;assed I the AT. e ~ ~ ~ ~ ~
i ?. u. t . 25 - s Plant Name .pate of Event ( Event Descriotion i ~he failure was the result of ma failure in the. HAZ of the te in j 80 AS114-A-312 GRTF-304 Sta pipe. This instrument tap fed the low le i of the scram and primary contair.nent isolation level rdtches, auto blewdo i wn .j permissive level s4tches, reactor feed-i I water control and wide range. level i indicatfor.s. j-Cooper Dec. 1977 a{ While at 75t power, during a plant tour , it was noted that three reactor level i .,h ments were reading Migh upscale. Further investigation revealed that the instrumen {g line excess flow check valve was leakin s., j around the body nut. The leak at the valve ' t caused the' condensing chamber and ref-erence les level to decrease, thus causing instrudhnts associated with that sensing itne to read upscale. Brunswict 2
- 4 arch 1978 Technicians were performing a test whi1e at
~ 97% power (reactor watar level inside shroud) en a Yarway instru=ent when the main turbine and feedwater pump turbines tripced, causing a re5ctor scrun. m ..?
t +. s { Plant Name .\\ pate 'of Event Event Descriotion The scram occurred as a result of a pre I change in the c:cmon level instrument refe l -i ence leg which apparently actuated t.E.e N0 instruments. The pressure change apparently. occurred due to the bellows move = j instrument being calibrated. No personnel j error was detected. They were shutscwn .3 for 25 hours. t i An investigation was to be performed b t det' ermine the most suitatle instrum arrangenent and tes5 procedures necessary to ) prevent reference leg pressure changes. i The investigation was to consist of an industrial survey and a design review. ki.~ Dresden 2 j May 1979 During start up the main turbine tripped on high water level. It was discovered thai a - { packing leak existed ori the isolation valve for the local pressure indication, 75-253-608. The "3" reference leg drained to an abnormally low level through the packing leak. 1:his re' ulted in an upscale riading on all the s Yarways on instrument rack 2206. The *!.* reference les rcot valve was shut to isola the leak which isolated the 511cwir.g c::m:enent l t W 7" -,,__4 - --* *} i Y - - - -- - - '- ~
, t Plant Name ,04te of Event _ Event Cese.-iction t. [ 75-253-5EC, EED. TIS-253-!8A, 533, 725 and L175-253-555. A control systems techniciu ; [ locally is:latad 71-253-605 (local p' essure indication) and PS-263-!!D (reactor high .i t pressure seren) via their common sensing lin ( .i root valve. The "3" reference les root valve l j was then opened and the reference leg filled. l Since the Technical Spectficatiens require ( two inst us:ent channels per trip systas , an orderly react:r shutdewn was begun it:=te I t The packing was tightened and subjected to hydro of 1006 psi. No letks were discovered. f. The isolation valves for PS-263-5fD and PI-263-603 were opened and the c~on sensing line root valve was opened, returning the in-systaa ts normal. .Monticello 1 Sept. 23, 1979 Ouring normal operation a leak developed in a [, (LER 79M19/03L-0) reactor pressure gauge. The leak lowered the reference leg of the scram and ECCS Yarway level swit:hes connetted to the same peccess tap. As a result, the Yarways indica .a false high level an.d would net have :rioped 4 thin the settings scecified in sections 3.1.1 anc 2.2.3 Of Technical Specifications. t i g ,, are e -,,-,,---._,-,,r,... _, - * *-.-,,-----,-,,----,.,,,r---
m--
y U 1.' e - s s l Plant Na:ne .Date of Event .l Event Descriotion 1 Redundt t level instrments were ocertole. One previous similar oc:urrence reported in A0 50-263/75-12. Pressure gauge is Reise Model C, 81/2 inch dial, 0-1500 psig. H03 - Stainless Steel Sourdon Tube. H Small crack discovered in Bourdon Tub'e, most prtoable cause is fatigue. Gauge isolated and runoved. New gauge with. wide range and improved Sourdon tube matarial to be installed o different process tap. Brunswick 1 'May 8, 1980 ) During normal surve'illance, the cap ccverin (LER 80-048/03L-0) E the calibration adjustaant screw on reactor . t.- l level instrument,1-821-US-NO313, was leaking water. ,h}. ine leak was repaired and ~ Pressure Test 3.1.7PC, Aeactor low level #2 and #3 calibration and functional test wa performed on the instrument switch f2 of the instrument would not actuata. The reportable t limit is >194.53 inches applied water. This event did not affect.the health and safety of t. - the pubite. The calibration adjustsent I, screw cap gasket was replaced, the contacts 9 of sw1.ch !2 were cleaned. Pressure Te'st 2.1.7 PC wa s ; erder ec satis, fact:rily and the inst u::ent was retur ed to service. f h- ~~ ~_
E ' Plant !!ame .Dete of Event Event Descriotion Fit ;a--ick 1 !tev. 3, 1980 1 (LER 80-084/03L-0) During normal operation while conduc t surveillance to satisfy Techn,ical Specifica-i i tions Table 4.1-1, reactor water level sw I 02-3-LIS-1018 or 1010 was found I. vative than allowed by Technical Spectfic '} Table 3.1-1 on three occasions het$ i -l 11/3/80 and 11/25/80. Redundant level switches were within Technical Specificatio 1 Ifmits and in each case the level s [ were immediately recalibrated to within its limits. No significant haza*rd axisted. See '- attachment for add'itional details. Prebab1'e L cause was personnel error which resulted i in the introduction of iir in level sensing ' i, 11ne. Sock fiushing of sensing ifnes to a renove air eliminated probles. deview } of procedura does not indicate need for change. Brunswick 1 Jan. 20, 1981' ' (LER 81-016/02L) During normal plant operation reactor instru-ment' pene ration (RIP) valve, X-52C, shut with a Control Air Supply Failure Alarm, and isolated the variable leg to reactor level instruments 5 21-LIS 51017A and ! 21-which resultad in a reac :r scr m on low level. This event did not affe::
- ne health or safer / of the puolic.
- -- L s&'~
j .,s N e ' ,? Plant.Vame Cate of Event Event Oescriotion L An exhaustive invest'igation failed to revea a'definita cause for the RIP valve This investigation included a leak chest on valve control air supply, a timed leak check b of the valve bellows and a visual inspection of the valve and the valve high flow isolatio. switch. This is considered an isolated event, as systas air pressure was normal and no other valves isolated. Browns Ferry 2 March [1 1981 j During nor=al operations while decreasing (R0 50-250/81014) l f=r.VG set mainten'ance, the Reacter '.*ater \\ Level Instrumentation indicated full upscale (- i resulting in a turbine trip. There was no hazard to the health or safety of the public. 1.
- ?
[ Instroents affected were: 2-LIT 5-3-52; 1 2-LIS-3-203A, 8; 2-1.15-3-184. The technical t I, specifications were fully emplied with at all ti=ts. E:;uali:ing valve, on 2-LITS-3-52 i was partially open. Closed equalizing valve,' verified reactor water instruments operable. Browns Ferry 3 tiay 25,1981 During startup, following a maintenance outag 1 (LER 51-027/02L-0) reac.sr watar level inst unenutica 3-LIS-3-2 and 5 indicated full upscale and wre declared inocersble. There was no 51nger to the health and safety Of -J.e puolic. indundant l I systems ere availa21e and c:ert:it. i { gar r
- ~ ~ '
"~
+, 32 - i Plan: ! lame Date :( Event' _ Event Descriotten Reference leg was los. on the watar column for undetermined reasons, causing the Barto I model 288 A, bellows type indicating swit:h to indicata full upscale. The water leg was backfilled and the instruments returned I to operable status. j cystar Creek sept. 5,1981 f On Septamber 5,1981 at appecximately 0100 (LER 81-36/03L) hours while performing a flush of Core Spray Systen I piping, one reactor water level indicator showed a high level while all other level indicato'rs remained stable an i 1 [. in agreement. The flush in progress was immediately terminated and an investigation was initiated to detarmine the cause of the high level indication. It was found i that the instrument reference leg was not filled with water which caused an errone high level reading on the instrument in , question. The failure of this instrument resulted in the loss of one of two level lastrument channels in each of two level instrument systems. It should be noted that there are no piping connections between the Core Scray System and the affgetad watar level inst.umentation reference leg. This l D b e se - *
.g s 23 - s Plan: '!ame ,, 4te of Event t Event Descriotion i .was confimed by a hand over hand walkdown the reference leg piping. i I The cause of the decrease in refere I 4 i head cculd not be determined. There is 6 no connection which can be inferred b the' loss of reference leg and the flush evolution. 1 The reactor water level instr.snent in questi ~ provides various Aeactor ?rotection Safegua Systam fun:tions associated *f th Aeact:r Scram, Core Spray initiation, Isolation-t Condenser initiation and ATWS Aecirc Pump Trip. Since redundant instrumentation, which b. was operable, also provides these functions and since the Reactor was shutdown, vented. 1 I and less than 212*F, the safety significance of this event is considered minimal. Addition- . ally, it should be noted that no change in i i g actual reactor watar level occurred as a, result of this event. ~ Tne reference leg for the affected level instru=ent was backfilled with c:ndensate .nica restered it to an operagle c:ndition. A hand Over hand wal%e:wn of the Referer
- e; Systen for ;:r:ce
- snfiguration ::ge her i
F F . - - - - - -. - - * - ^ * - - ' ~ ~ _,,,mmue.**da
e ., y o. \\ Plant Name .Date cf Event Event Descri: tion .c with a check of the instrument c:nnected 'l 9 the reference 1eg for 1eakage was per'ormed 4 j with no abnormalities noted.. t i j (The following event description is taken from the INPO-MSAC Anal 1-i ysis and Evalua-tion Report of April 1981 on "High Pressure C:re Csoling Systare M l f a unction at Ha tch 1.*) i Hat:n 1 June 25,1985 At 6:49 a=, on June 26,1980, Hat:h-1 was 1 operating at 99.4*. of rated power. 0;erating ' conditions appeared nomal. Reactor ;ressure s Indicated 990 psig. Both reacar feedietar } 4 pumps, and both reaca,r recirculation pumps ~ l-were runnir.g. Tne reactor wetar level was normal at about +37 inches. F.: At 6:49:09 am, the GEMAC A and C reacar wetar level channel s signal'd that the level e had quickly risan ts +58 inches. 'ii th 2 of the 3 GEMAC chanr.els indicating a high level, 1 a, number of aut:catic actions oc:urred. The reactor feedweter pumps and the :::rtine/ generat:r were tripped. Sub seo,uently, the react:r scrs=ed. ~ inere are : ree IE'4A0 trans:nittars of eenc.:r I water level ::nnected :: 2 separata ydetulic i systems that sense react:r water level. The
I..* i. ~ Plan: ' lace 2tte of Evend Event tescriotion uc.u.AC A and C channel trans: sit. ara are connected to cae of the hydraulic sys ms. Two Sarten : ans:sittars are also c:nn~e } this same hydraulic syste. The GDtAC B channel trans=$tter, and two cther tarun trans: sitters, are connected to the other hydraulic system that senses reacter level. 4 I i Only the GIMAC A and C channels signaled i } } high reactor water level. Tne GD*.AC 3' 1 i channel did not signal a high level. More-over, one second afiier the GE'iAC A and l .t C channels picked-up on high watar level, 2 Barun trans:sittars signaled low reacur wa ter level at +12.5 inches. Within 4 (r seconds; all four Sarton ct. nnels signaled that the reactor water was at +12.5 inches. Su:: narizing, GE.".AC channels,A and C said the wattr level in the reactor was high, and 4' other channels said it was 1cw. Within 2 seconds after the star of the four channels indicated that the
- event, reacer pressure had risen to 1Ca5 psig.
'41 thin 4 sa::ncs, four Bar.:n tr2ns=1tters sigr.alled a icw. escur wataElevel and t-iggered the isolation of teme of :.e react:r su::cr sys.ms.
- ncreasee sys ec, t
1
Plant Name Sa e of Event Event Descristion pressure and a decreased react:r water level are anticipated responses to a 1 total loss of feedwatar and turbint/ generator trip. Within 16 seconds, safety / relief ,i valve operation, comoined with the operation of the turbine stanta bypass systams, had brought the pressure dewn to 1020 ;sig. Wi th g-the decreased pressure, increased void i femation caused the reactsr water level to - i rise several inches and by 2S secsnds, the !2 {. react:r low water 1evel had cleared, indicatir that the reacter water level had rec'ovired to ~ at least +15 inches. 9 I~ Thirty nine seconds after the event began, l,if all four Barton channels alanned a sec:nd time, indicating that the reactor wa tar level had again drepped below +12.5 inches. The GEMAC channels shewed similar levels. The _ reactor pressurt was now staady at about 590 ps1. 9 At 47 sec:nds, a signal was received, that closed the main stasm Ifne isolation valves. All tv ne of the closure signals are alarmed en te c;=: uter.17he icw stetsr wa ar *evel !-35") closure signal is act t e ..,... -. -... - ~ ~ -' ~~ ~ ~ ~ ^~
~ i s ,' a. gian: une mate a tvent tveat oescr4= tion ~ I,. al armed. None of the c:raputar alarms asso-T ciated with t5e closure signals were activated. This indicated that the low reactor ' water l 1evel closure signal was the most likely . o, 1 source of the !1SIY closure and that reactor water level had dr:pped t5 -38". I k At 95 sec:nds a feet ater ptrap was star.ad, } but because the.tain stasm line isolation i valves had been closed, the pump ran 'for !~ only about 10 seconds. Tne HPCI turbine ~ i received a signal t5 start aut:matica11y. i i
- 0 However, the initial high flow of steam to
. L the turbine caused an instrument that monito for high stem line flow (symptom of a stam pipe break), to activate erron'#cusly and close the tw ccntairment isolation valves } in the stan 11ne to the NPCI turbine. Tne i HPCI t'tbine ran momentarily and st:pped. During this period, cperators also were attempting to start the RCIC system.- ~ However, the RCIC systam wuld not start and c;ntinue to run. It renained inoperable thr:ughou: the event. .S J G -,a-... ,.,,,n.n,,. . -,,,., ~,., - -...,, - -, - - -, -.,, - - -..., - - - - - - - -, ~- - - -, - -.,. -,,, ..._..__a.-- '~
.9 ?lant yame Sete of Event Event Descriction I Operators reset the HPu ystem isolation e signal that had been triggered by the high i i i steam flew surge on the initial startup 1 atte:npt. They then opened the inboard i. isolation valve in the HPCI turbine saam supply line, while leaving the outboard valve closed. But again, for reasons unknown, an I additional isolation signal activated, calling for closure of the closed outboard \\ valve. Operators then closed the inboard 1 valve. gi 2 ( At three minutes ina the event the following conditions existed: The main steam line iss1'ation valves wrai closed. .i There was I no feedwater supply to the reactor. Heat had ~ i been generated in the reactor faster than it .\\ was renoved. The reactor pressure had risen to "appr ximately 1100 psig and was being controlled by the safety / relief valves. The steam was now renoving the decay heat to the suppression pool. About i minutes after the event began, -he operators t-iec a cifferent HPCI tfrbine start-up s. atasy. They closed the HPCI ji ~ turnine sten.m su::1y valve. This valve \\ O' , _ _ _ _ _. _ ~. ~ ~ ~ ~ ' ~ ~ . ~~. -. o--'
. :..f o. t.T. a t 1 ~ 1 - 33 E., plant ham, Date of Event Event Description } is located downstrema of the tw iso e l valves and upstream of the HPCI turbine i stop and control valve. i They then reset the b isolation signal tJut had occurred during i \\ n the previous start atta=pt, and opened s the. inboard and outboard isolation val The isolation signal ws cleared, and with a i .I low reactor wter level signal still present
- .j the HPCI steam supply valve openec auteca 1
.f-The HPCI turbine started, and supplied
- y. j {
R 4
- r. i wter tn the reactor vessel.
I e i ~ 5 {'. Seven and one-half minutes af ter the c g! began, the wter level in the reactor was i 5 e ~. v e,ai. ome to nomei. g, w i e 3 4 f I j;! S &\\ Mi \\ m .N l . E-: 3h . ce---4
- .W, T.W
) p.4 i ~ $~ [ I.
- ~
) m}}