ML20205D029
Text
T'
\\
C3 &l9
%%NN SAIC-85/1524-14 4
REVIEW OF LICENSEE AND APPLICANT RESPONSES TO NRC GENERIC LETTER 83-28 (Required Actions Based on Generic Implications of Salem ATWS Events). Item 1.2 "POST-TRIP REVIEW:
DATA AND INFORMATION CAPABILITIES" FOR pit. GRIM STATION (50-293)
Technical Evaluation Report Prepared by Science Applications International Corporation 1710 Goodridge Drive McLean, Virginia 22102 Prepared for U.S. Nuclear Regulatory Commission Washington. 0.C. 20555 Contract No. NRC-03-82-096
'r 0810270047 000926
)
F, O
FOREWOR0 This report contains the technical evaluation of the Pilgrim Station response to Generic Letter 83-28 (Required Actions Based on Generic Implica-tions of Salem ATWS Events), Itts 1.2 "Post Trip Review:
Data and Informa-tion Capabilitics."
For the purposes of this evaluation, the review criteria, presented in part 1 of this report, were divided into five separate categories. These are:
1.
The parameters monitored by the sequence of events and the time history recorders, 2.
The performance characteristics of the sequence of events recorders, 3.
The performance characteristics of ti., time history recorders,
+
4.
The data output format, and 5.
The long-term data retention capability for post-trip review material.
1 All available renponses to Generic Letter 83-28 were evaluated. The plant for which this report is applicable was found to have adequately responded to, and met, categories 2 and 4.
The report dascribes the specific methods used to determine the cate-gorization of the responses to Generic Letter 83-28.
Since this evaluation report we.s intended to apply to more than one nuclear power plant specifics l
regarding how each plant met (or failed to meet) the review criteria are not presented.
Instead, the evaluation presents a categorization of the i
responses according to which categories of review criteria are satisfied and
+
which are not.
The evaluations are based on specific criteria (Section 2) derived from the requirements as stated in the generic letter.
l 1
i
e 4
TABLE OF CONTENTS Section Page Introduction.........................
1 l.
Background..........................
2 2.
Review Criteria.......................
3 3.
Evaluation..........................
8 1
4.
Conclusion...................
9 4
5.
R e fe re nc e s..........................
10 II
- 6. SWA4Tw+ doceUA*e7 FtK 7t%80W l
1 l
1 1
i l
l 1
J I
1 4
i
.i i
i 4
4 9
1 l
_. -... -, _ _., _ -,, _..., = _.
i O
6 4
INTRODUCTION SAIC has reviewed the utility's response to Generic Letter 83-28, item 1.2 "Post-Trip Review:
Data and Information capability." The response (see references) contained sufficient information to determine that the data and trformation capabilities at these plants are acceptable in the following areas.
e The sequence-of-events recorder (s) performance charac-teristics.
l e
The cutput f,ormat of the recorded data.
However, the data and information capabilities, as described in the 1
submittal, either fail to meet the review criteria or provide insufficient
)
information to allow determination of the adequacy of the data and information capabilities in the following areas.
I I
e The parameters monitored by both the sequence-of-events l
l and time history recorders.
f J
e The time history recorder (s) performance characteris-i tics.
1 4
l e
The long-term data retention, record keeping, capa-bility.
k I
i l
s 1
===1.
Background===
I On February 25, 1984, both of the scram circuit breakers at Unit 1 of the Salem Nuclear Power Plant failed to open upon an automatic reactor trip signal from the reactor protection system.
This incident occurred during the plant startup and the reactor was tripped manually by the operator about 30 seconds after the initiation of the automatic trip signal.
The failure of the circuit breakers has been determined to be related to the sticking of the under voltage trip attachment.
Prior to this incident; on February 22, 1983; at Unit 1 of the Salem Nuclear Power Plant an automatic trip signal was generated based on steam generator low-low level during plant startup.
In this case the reactor was tripped manully by the operator almost coinci-dentally with the automatic trip. At that time, because the utility did not have a requirement for the systematic evaluation of the reactor trip, no investigation was performed to determine whether the reactor was tripped automatically as expected or manually.
The utilities' written procedures required only that the cause of the trip be determined and identified the
]
responsible personnel that could authorize a restart if the c6use of the trip is known.
Following the second trip which c1carly indicated the problem with the trip breakers, the question was raised on whether the circuit breakers had functioned properly during the earlier incident.
The most useful source of information in this case, namely the sequence of events printout which would have indicated whether the reactor was tripped automatically or manually during the February 22 incident, was not retained af ter the incident.
Tnus, no judgment on the proper functioning of the trip system during the earlier incident could be made.
I Following these incidents; on February 28, 1983; the NRC Executive Director for Operations (E00), directed the staf f to investigate and report on the generic implications of these occurrences at Unit 1 of the Salem Nuclear Power Plant. The results of the staf f's inquiry into the generic implications of the Salem Unit incidents is reported in NUREG-1000. "Generic Implications of ATWS Events at the Salem Nuclear Power Plant." Based on the results of this study, a set of required actions were developed and included in Generic Letter 83-28 which was issued on July 8,1983 and sent to all licensees of operating reactors, applicants for operating license, and construction permit holders. The required actions in this generic letter consist of four categories.
These are:
(1) Post-Trip Review. (2) Equipment i
2 3
Classification and Vender Interface. (3) Post Maintenance Testing, and (4)
Reactor Trip System Reliability Improvements.
The first required action of the generic letter Post-Trip Review, is the subject of this TER and consists of action item 1.1 "Program Description and Procedure" and action item 1.2 "Data and Information Capability." In the next section the review criteria used to assess the adequacy of the utilities' responses to the requirements of action item 1.2 will be discussed.
2.
Review Criteria The intent of the Post Trip Review requiren.ents of Generic Letter 83-28 is to ensure that the licensee has (dequate procedures and data and information sources to understand the cause(s) and progression of a reactor trip. This understanding should go beyond a simple identification of the course of the event, it should include the capability to determine the root cause of the reactor trip and to determine whether safety limits have been exceeded and if so to what extent. Sufficient information about the reactor trip event should be available so that a decision on the acceptability of a reactor restart can be made.
The following are the review criteria developed for the requirements of Generic Letter 83-28, action item 1.2:
The equipment that provides the digital sequence of events (SOE) record and the analog time history records of an unscheduled shutdown should pro-vide a reliable source of the necessary information to be used in the post trip review.
Each plant variable which is necessary to determine the cause(s) and progression of the event (s) following a plant trip should be monitored by at least one recorder (such as a sequence-of-events recorder or a plant process computer for digital parameters; and strip charts, a plant process comp 4ter or analog recorder for analog (time history) variables].
Each device used to record an analog or digital plant variable should be described in suf ficient detail so that a determination can be made as to whether the following performance characteristics are met:
l i
i 3
e Each sequence-of-events recorder should be capable of' detecting and recording the sequence of events with a sufficient time discrimination capability to ensure that the time responses asse-ciated with each monitored safety-related system can be ascer-tained, and that a determination can be made as to whether the time response is within acceptable limits based on FSAR Chapter 15 Accident Analyses. The recommended guideline for the SOE time i
discrimination is approxnately 100 msec.
If current SOE recorders do not have this time discrimination capability the licensee or applicant should show that the current time discrimi-nation capability is sufficient for an adequate reconstruction of the course of the reactor trip.
As a minimum thi. should include the ability to adequately reconstruct the accident scenarios pre-sented in Chapter 15 of the plant FSAR.
l e
Each analog time history data recorder should have a sample inter-val small enough so that the incident can be accurately reconstructed following a reactor trip.
As a minimum, the licensee or applicant should be able to reconstruct the course of i
the accident sequences evaluated in the accident analysis of the plant FSAR (Chapter 15). The recommended guideline for the sample interval is 10 sec.
If the time history equipment does not meet this guideline, the licensee or applicant should show that the current time history capability is sufficient to accurately recon-struct the accident sequences presented in Chapter 15 of the FSAR.
e To support the post trip analysis of the cause of the trip and the i
proper functioning of involved safety related equipment, each l
analog time history data recorder should be capable of updating j
and retaining information from approximately five minutes prior to the trip until at least ten minutes after the trip.
{
e The information gathered by the sequence-of-events and time history data collectors should be stored in a manner that will j
1 allow for retrieval and analysis.
The data may de retained in either hardcopy (computer printout, strip chart output, etc.) or in an accessible memory (magnetic disc or tape). This information should be present:J in a readable and meaningful format, taking 4
l
-o, i
into consideration good human factors practices (such as those l
outlined in NUREG-0700).
1 l
e All equipment used to record sequence of events and time history j
information should be powered from a reliable and non-interruptible power source.
The power source used need not be safety related.
i The sequence of events and time history recordint; equipment should l
monitor sufficient digital and analog parameters, respectively, to assure
)
that the course of the reactor trip can be reconstructed. The parameters monitored should provide sufficient information to determine the root cause j
of the reactor trip, the progresstor, of the reactor trip, and the response of the plant parameters and systems to the reactor trip.
Specifically, all input parameters associated with reactor trips, safety injections and other safety-related systems as well as output parameters sufficient to record the proper functioni.sg of these systems should be recorded for use in the post trip review.
The parameters deemed necessary, as a minimum, to perform a post-trip review (one that would determine if the plant remained within its design envelope) are presented on Tables 1.2-1 and 1.2-2.
If the appli-
)
cants' or licensees' SOE recorders and time history recorders do not monite.-
l all of the parameters suggested in these tables the applicant or licensee should show that the existing set of monitored parameters are sufficient to establish that the plant remained within the design envelope for the appro-priate accident conditions; such as those analyzed in Chapter 15 of the plant Safety Analysis Report.
Information gathered during the post trip review is required input for future post trip reviews.
Data from all unscheduled shutdowns provides a valuable reference source for the determination of the acceptability of the plant vital parameter and equipment response to future unscheduled shut-downs.
It is therefore necessary that information gathered during all post trip reviews be maintained in an accessible manner for the life of the plant.
5 I
l l
1 l
t l
l Table 1,2-1.
PWR Parameter List SOE Time History Recorder Recorder Parameter / Signal l
x Reactor Trip i
(1)x Safety injection x
Containment Isolation (1) x Turbine Trip x
Control Rod Position (1)x x
Neutron Flux, Power x
x Containment Pressure (2)
Containment Radiation x
Containment Sump Level (1) x x
Primary System Pressure (1)x x
Primary System Temperature (1) x Pressurizer Level l
(1) x Reactor Coolant Pump Status (1) x x
Primary System Flow l
(3)
Safety inj.; Flow. Pump / Valve Status x
MS!V Position x
x Steam Generator Pressure
(
(1) x x
Steam Generator Level (1) x x
Feedwater Flow (1) x x
Steam Flow (3)
Auxiliary Feedwater System; Flow.
Pump /Value Status AC and DC bystem Status (Bus Voltage) u x
Diesel Generator Status (Start /Stop, On/Off) x PORY Position l
l l
(1): Trip parameters l
(2): Parameter may be monitored by either an SOE or time history recorder.
(3): Acceptable recorder options are: (a) system flow recorded on an SOE recorder, (b) system flow recorded on a time history recorder, or (c) equipment status recorded on an SOE recorder.
l 6
)
Table 1.2 2.
BWR Parameter List SOE Time History Recorder Recorder Parameter / Signal x
Safety Injection x
Containment Isolation x
Turbire Trip x
Control Rod Position x(1) x Neutron Flux, Power x (1)
Main Steam Radiation (2)
Containment (DryWell) Radiation x (1) x Drywell Pressure (Containment Pressure)
(2)
Suppression Pool Temperature x (1) x Primary System Pressure x(1) x Primary System level x
MSIV Position x (1)
Turbine Stop Valve / Control Valve Position x
Turbine Bypass Valve Position x
Feedwatsr Flow I
x Steam Flow l
(3)
Recirculation; Flow. Pump Status I
x(1)
Scram Discharge Level
]
x(1)
Condenser Vacuum AC and DC System Status (Bus Voltage) x (3/4)
Safety Injection; Flow. Pump / Valve Status Diesel Generator Status (On/Off.
x
]
Start /Stop) i i
(1): Trip parameters.
(2): Parameter may be recorded by either an SOE or time history recorder.
1 (3): Acceptable recorder options are: (a) system flow recorded on an SOE recorder. (b) system flow recorded on a time history recorder, or
'(c) equipment status recorded on an SOE recorder.
I i
(4): Includes recording of parameters for all applicable systems from the i
following: HPCI, LPCI, LPCS, IC, RCIC, a
7
.. - _ _,. _ _ _. _ _ -. ~.,,
,n,--
s 3.
Evaluation 1
The parameters identified in part 2 of this report as a part of the review criteria are those deemed necessary to perform an adequate post-trip review.
The recording of these parameters on equipment that meets the guidelines of the review criteria will result in a source of information that can be used to determine the cause of the reactor trip and the plant response to the trip, including the responses of important plant systems.
The parameters identified in this submittal as being recorded by the l
i l
sequence of events and time history recorders do not correspond to the parameters specified in part 2 of this report, i
The review criteria require that the equipment being used to record the sequence of events and time history data required for a post-trip review meet certain performance characteristics.
These characteristics are intended to ensure that, if the proper parameters are recorded, the record-ing equipment will provide an adequate source of information for an effec-I tive post-trip review.
The information provided in this submittal does not indicate that the time history equipment used would meet the intent of the
{
performance criteria outlined in part 2 of this report.
Information j
supplied in the submittal does indicate that the SOE equipment meets the
[
performance criteria specified in part 2 of this report.
1 The data and information recorded for use in the post-trip review l
should be output in a format that allows for ease of identification and use
)
of the data to meet the review criterion that calls for information in a 2
readable and meaningful format. The information contained in this submittal l
indicates that this criterion is met.
t j
The data and information used during a post-trip review should be
)
retained as part of the plant *iles. This information could prove useful j
j during future post-trip reviews.
Therefore, one criterion is that infor-mation used during a post-trip review be maintained in an accessible manner for the life of the plant.
The information contained within this submittal does not indicate that this criterion will be met.
1 1
i 8
i 1
l 4.
Conclusion The information supplied in response to Generic Letter 83-28 indicates that the current post-trip review data and information capabilities are adequate in the following areas:
i 1.
The recorded data is output in a readable and meaningful format.
t P
2.
The sequence of events recorders meet the minimum performance characteristics.
Tha information supplied in response te Generic Letter 83-28 does not indicate that the post-trip review data and information capabilities are j
adequate in the following treas:
1.
Based upon the information contained in the submittal, all of the parameters specified in part 2 of this repcet that should be recorded for use in a post-trip review are not racorded.
1 2.
Time history recorders, as described in the submittal, do not meet the minimum performance characteristics.
l 3.
The data retention procedures, as described in the submittal, may i
not ensure that the information recorded for the post-trip review i
is Wntained in an accessible ranner for the life of the plant.
l It is possible that the current data and information capabilities at this nucitar power plant are adequate to meet the intent of these revfew I
criteria, but were not completely describec. Under these circumstances, the licensee should provide an updated, more complete, description to show in more detail the data and information capabilities at this nuclear power plant.
If tne information provided accurately represents all current data and informatin capabilities, then the licensee should show that the data i
l and ir. formation capabilities meet the intent o' the criteria in part 2 of this report, of detail future modifications that would enable the licensee l
to meet the intent of the evaluation criteria.
9
AEFERENCES NRC Generic letter 83-28.
"i.etter to all licensees of operating reactors, applicants for operating license, and holders of construction permits regsrding Required Actions Based on Generic Implications of Salem ATWS Events." July 8. 1983.
MUREG-1000, Generic Implications of ATWS Events at the Salem Nuclear Power Plant, April 1983.
Letter from W.O. Harrington. Boston Edison Company, to D.B. Vassallo.
NRC. dated November 7.1983, Accession Number 8311090331 in response to Generic Letter 83-28 of July 8,1983, with attachment.
l a
E I
t t
i i
l i
1 l
)
j 3
l j
J l
l
b S offo4 72 M F l$0G h %t M T 00*< TettCc y pilgrim 1.
P&r6 meters recorded: Unsatisfactory See attached table for discrepancies.
2.
SOE recorders performance characteristics: Satisfactory Plant computer:
16.6msee time discrimination with non-interruptible i
power supply 3.
Time history recorders performance characteristics: Unsatisfactory I
Plarit computer:
5 see sample interval for the period from 2.5 minutes pre-trip to 2.5 minutes post-trip Strip charts are also used.
I 4.
Data output format:
Satisfactory l
SOE: output includes time, event descriptor, and tensor 10.
Time history: output includes time, parameter value, and sensor ID.
5.
Data retention capability: Unsatisfactory Data is retained but for an unspecified period.
l l
i I
i
${
Desirable BWR Parameters for Post-Trip Review (circled parameters are not recorded)
SOE Time History Recorder Recc. der Parameter / Signal x
Reactor Trip 8x Safety Injection x
Containment Isolation x
Contr91 Rod Position x (1) x Neutron Flux, Power x (1)
Main Steam Radiation Containment (Dry Well) Radiation x (1) x Drywell Pressure (Containment Pressure)
I (2)
Suppression Pool Temperature x (1) x Primary System Pressure x (1) x Primary System level MSIV Position x (1)
Turbine Stop Valve / Control Valve Position Turbine Bypass Valve Position x
Feedwater Flow x
Steam Flow (3)
Recirculation; Flow Pump Status x (1)
Scram Discharge Level x (1)
Condenser Vacuum AC and DC System Status (Bus Voltage)
(3)(4)
Safety injection; Flow. Pump / Valve Status Diesel Generator Status (On/Off.
Start /Stop)
(1): Trip parameters.
(2): Parameter may be recorded by either an SOE or time history recorder.
(3): Acceptable recorder options are:
(a) system flow recorded on an SOE recorder (b) system flow recorded on a time history recorder, or (c) equipment status recorded on an SOE recorder.
(4): Includes recording of parameters for all applicable systems from the following: HPCI, LPCI, LPCS, IC, RCIC.
11
S UE SRUTDOWN CAPABILITY The following discusses the recuircrents for protecting redundant and/or alter-native equipment needed for safe shutdown in the event of a fire. "The' require-ments address only hot shutdown eqJipment which must be free of fire damage as required by Appendix R.
In additien, the following require ents also apply to cold shstdown equipunt that is tc bc free of fire damage.
A;;cndiy R does allew catage to cold shutdown equip ent.
Usin; the requirements of Sections !!!.G and III.L of Appendia R, the capability to achieve hot shutdown nust exist given a fire in any area of the plant in conjunction with a loss of offsit(for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
Section III.G of Appendix R e
provides four methods for ensuring that the hot shutdown capability is protected from fires. The first three options as defined in Section III.G,2 provides methods for protection from fires of redundant trains of eq;i;..Ent needed for hot shutdown:
1.
Redundant trains including cables, equipment, and associated circuits may be separated by a three-hour barrier; 2.
Redandant trains including cables, equipment and associated circuits may be separated by a horizontal distance of more than 20 feet with no inter-vening combustibles.
In addition, fire detection and an automatic fire suppression system are required; 3.
Redandant trains including cables, equipment and associated circuits may be separated by a one-hour barrier.
In addition, fire detectors and an automatic fire suppression systen are required.
The last option as defined by Section Ill G.3 provides an alternative shutdown capability to the redundant trains damaged by a fire.
4 Alternative shutdown equip. Tent must be independent of the cables, equip ent and associatcd circuits of the redundant trains damaged by the fire.
Associated Circuits Our concern is that associated circuits can sustain fire damage that can jffect" shutd%n capability and thereby prevent post-fire safe shutdown.
Circuits associateo with the fire area are those cables (safety related, non-safety related Class IE, and non-Class IE) that:
1.
Have a physical separation from the fire area less than that required by Section Ill.G 2 of Appendix Tt and 2.
Have either a.
a common power source with the redundant or alternative shutdown equipment and the power source is not electrically protected from the circuit of concern (see diagram), or y/9
f 0
-2 5
b.
a c;nnection to circuits of equi;-snt whose spurious operation would Et e*:Ely affect the shutdoe cecability (RHR/RCS isolation valves, relief valve FORV's, steam dump instrumentation, steam bypass) (see diagram), or c.
a cc-en enclosure (raceway, rarei, junction box) with the **d.mdent or alternutive shutdown cables (see diagram).
Y' 'J*
s.-
tr Ti&
T..
%r t
u, ts G
I i
lG
!, i t
'I I
l
- i i
1 l
'l
\\
i i
i i
s s
g s
s
$j
\\ f,l
\\
i
\\
i s
l h- ? :.c '
y r..'.,y y j
j N
e.~..... ~ c i e 1...h.,,. * >h
..ut t. e T%; ts bt. I S L) d o ce. CittM O,ss.c 4 :1. cit t hi b w. a u s p, A -i ( 'E*. C. I)
Redadant or alternative shutdown capability may be protected from the adverse Jffe:t of da age to associated circuits by the following methods:
1.
Frc.4de protection between the associated circuits and the shutdown circuit as defined by Section !!!.G 2 of Appendix R or 2a.
For a co=on power source case:
provide load fuse / breaker to bus feed breaker coordination to prevert loss of the or redundant alternative shutdown power supply.
Technical Specification are required for periodic surveillance of testing of the breakers and/or fuses (one breaker or fuse per circuit is acceptable).
Additionally, the following coordination criteria should be met:
F 3-(a.) The breaker time-overcurrent trip characteristic for all circuit faults should cause the breaker to irterrupt the fault current prior to initiation of a trip of any upstream breaker.
Periocic testing shall demonstrate that the overall coordination sche e remains within the limits specified in the design criteria.
T r.i s testing may be performed as a series of overlapping tests.
(b.) The power sou*ce shall supply the necessary fault carrent for sufficient time to ensure the proper coordination without loss of function of the redundant or alternative shutdown loads.
A fuse may qualify as an isolation device if the following criteria are met:
(a.) Each fuse shall be factory tested to verify overturrent protection as designed.
(b.) Fuses shall provide the design overcurrent protection capability for the life of the fuse.
(c.) The fuse time.overcurrent trip characteristic for all circuits faults shall cause the fuse to open prior to the initiation of an opening of any upstream interrupting device.
(d.) The power source shall supply the necess6ry fault current to ensure the proper coordination without loss of function of the redundant or alternative shutdown loads.
(e.) Proper fusing characteristics shall be verified by periodic non-destructuve tests such as by resistance measurement to deronstrate that the coordination remains within the limits specified in the design criteria.
2b.
For a connection to circuits of equipment whost: spurious operation would af fect the capability to safely shutdown.
(1) provide a means and procedures to defeat the maloperation of equipment and return it to the safe mode or to otherwise avercome its effects or (2) provide electrical isolation, thus preventing spurious operation.
Acceptable isolation devices are amplifiers, control switches, current XFRS, fiber optic couplers, fuses (see 2a), photo optic couplers, relays and transducers, provided these devices can 1,e shown to prevent the maleperation.
2c. For comon enclosures:
provide appropriate fire stops or barriers to prevent propagation of the fire.
l i
inforuation Recuired Fue areas of the plant v rere fire protection is provided in accordance with Section ll!.G.2, the staf f does not require information from the licensee.
For areas of the plant where alternative shutdown is provided in accordance witn Section !!!.G.3, the staf f requires a point by point response to the February 20, 198() ger.aric letter.
)
i PILGRIM STATION UNIT NO. 1 SAFETY EVALUATION REPORT FOR APPENDIX R TO 10 CFR PART 50, ITEMS III.G.3 AND III.L 1.0. INTR 000CTI_0,fi On February 19, 1981, the fire protection rule for nuclear power plants, 10 CFR 50 and Appenoix R to 10 CFR Part 50, became effective.
This rule required all Licensees cf plants licerised prior to January 1, 1979, to submit by March, 1980:
(1) plans and schedules for meeting the applicable requirenents of Appendix R,
(2) a design description of any mocifications proposed to provide alternative safe shutdown capability pursuant to Paragraph III.G.3 of Apoendix R,
and (3) exemption requests for which the tolling provir. ion of Section 50.48(c)(6) was to be invoked.
Sections III.G and III.L of Appendix R are retrofit itens to all pre-1979 plants regardless of previous SER positions and resolutions.
The caiteria contained in Section III.L of Appendix R is used for those cases in which licensees are incorporating alternate or dedicated shutdown capability.
By submittats dated January 1980 and June 1982, the licensee described the means by wtich safe shutdown can be achieved in the event of fire and proposed modifications to &A4 Pilgrim O
. Station Unit 1 to meet the requirements of Appendix R to 10 CFR 50, Sections III.G.3 and III.L.
Tne licensee's submittal dated June 1982, summarizes all ?he work contained in the pre-vious s'abmittals and provides ansbers to the questions con-tained in our generic letter 81-12.
In addition to these sub-mittals, several questions in the areas of systens and asso-eiated circuits were clarified in a meating with the licensee on December 7, 1982.
The license has re-ested exemptions from the requirements of Paragraph I
.G.2 of Appendix R for several fire areas ues will be reviewed by the Chemical Engineering and this,r B r a ntn'.
The licensee has provided a safe shutdown analysis for a fire event and has demsnstrated that adequate redundancy and/or an alternative safe shutdown method exists for those tystems required to assure safe shutdown.
Our enalysis and evalua-tion of this follocs.
. 1.
Reector protection system (RPS) 2.
Automatic depressurization system (ADS) 3.
Reactor core isolation cooling (RCIC) system 4.
High pressure coolant injection (HPCI) system 5.
Residual heat removal (RHR) system, low pressure coolant injection (LPCI) mode 6.
Residual heat removal (RHR) system, torus cooling mod.e 7.
Residual heat removal (RHR) system, shutdown cooling mode, and 8.
Core spray (CS) system Safe shutdown is initiated from the control room by a manual scram of the control rodt or by action of the reactor protec-tior system.
Reactor coolant inventory can be maintained by either the reactor core isolation cooling (RCIC) system, i
the high pressure coolant injection (HPCI) system during high pressure conditions or the low pressure coolent injection (LPCI) system or the core spray (CS) system in conjunction with the automatic depressurization system (ADS) during low pressure conditions.
Reactor coolant system pressure is controlled by either the RCIC, the HPCI or the ADS in conjunction with the residual heat removal (RHR) system in the steam condensing mode.
Decay heat removal is provided by either the RHR in the shutdown cooling mode or the LPCI or core spray in conjunction with the RHR in the suppression pool cooling mode.
l l
i
. The support systems required for safe shutdown include the salt service water systen, the reactor building closed cooling water system, the primary containment isolation system, the essential ventilation systems, the emergency diesel generator and the essential electrical distribution system.
The above systems will be monitored and controlled from the controt room or the remote shutdown panels and local control stations.
l i,
2.2 Arte.s_Where. Alter _nate Safe Shutdown is Proposed.
The licensee analyzed the need for alternate safe shutdown i
at the Pilgrim Station for a fire in any fire zone (69 zones total).
As a result of this study, by submittat dated r
l June 25, 1982, the licensee concluded that alternate shutdown l
capability was required for 17 fire areas, including the con-trol room and the cable spreauing room, as the requirements of Section III.G.2 are not met.
The licensee's analysis included f
j the unresolved items identified by the staff in out SER dated i
J December 21, 1778.
The licensee requested exemptions to l
Sections III.G.2 and III.G.3 of Appendix R which deal with L
instrumentation required for safe shutdown.
These exemptions are discussed in Section 3.0 of this SER.
k d
4
. 2.3 _ Alternate Safe Shulggwn Systems The alternate safe shutdown system required for those areas not meeting Section III.G.2 or included in the exemption requests utilizes existing plant systems and equipment as identified in Section 2.1 with some modifications, L9 cal manual valve alignments, local instrumentation and local control of shutdown and support equipment)
The alternative shutdown capability consists of 13 remote shutdoan genets, local control and isolation switches and alternate control 1
power feeders.
The Licensee has also proposed putling fuses and opaning circuit breakers as methods of electrically isolating some equipment during shutdown outside the control l
l room.
This is unacceptable.
The Licensee must propose an l
acceptable alternative such as installing isolation switches.
l The shutdown panels are Located near the associated equipment and consist of Locked enclosures housing switches and instru-mentation.
Applicable orerating procedures are kept inside each shutdown panel to guide the operstors in car
- ing out i
emergency operations at the panels.
l Alternate safe whutdown is initiated by activation of the relief valves and t.he RCIC system.
O, ring this chace of the shutdown, the suppression poal wilL be cool 0d as required by 1
I eperating the RHR system in the suppression pool cooling
. i mode.
Reactor pressure will be controlled and core decay end sensible heat rejected to the suppression pool by dumping steam through the relief valves.
Reactor water inventory will be osintained by the RCIC system.
The RHR system will be used to bring the reactor to cold shutdown.
The plant pro-cedures specify which valves are operated from the alternate shutdown panels and which valves are operated locally using.
valve handwheels.
The power for the alternate shutdown r
equipment will be supplied by the emergency diesel generators.
These circuits are routed from the electrical buses directly to the shutdown components outside the cable spreading room or main control room.
t 3.0 FVAlMATT&M 3.1 Perfgtnance Gnale The performance goals for post fire shutdown can be met using the proposed alternate shutdown systems described in Section 2.3.
1 1
The process monitoring instruments to be used for a post fire shutdown include reactor water level, reactor coolant pressure,
{
dyrwell Lressure, torus pressure, drywell/ torus differential pressure, HPCI and RCIC turbine flow indicator and controllers.
Level indication for all tanks used for post-fire alternative l
shutdown will be available.
The support systems available 1
. include the redundant diesel generators, vital buses, salt service water system, the tube oil system, the essential cooling water system and the equipment area cooling system.
Control and monitoring capability for these support systems i s a l s o p r o v i d e d a t 4te+4 stations.
! OCctl The licensee has not provided direct reading of several impo,r-tant pro:ess parameters outside the control room.
In parti-cular, the licensee should commit to provide readings of suppression pool level and temperature as well as reactor vessel level and pressure outside the control room which will be available given a fire in any fire zone including the control room and the cable spreading room.
l The licensee has requested exemptions for compliance with Section III.G.2 of Appendix R for several instruments monitoring important process parameters until after TMI modi-fications related to Regulatory Guide 1.97 are implemented.
l These are identified in the licensee's June 25, 1982 sub-mittal as exemption requests i through 4.
We consider the capability to monitor the process variables involved (reactor water level and pressere, drywell wressure and torus pressure i
as well as torus /drywell differential pressure) in the event l
l J
8-licensee will not\\have suppression pool level and tempera-The ture instrumentation available i/ the centrol room in esse of fire in the torus compartment (fire zone 1.30A).
The licensee has requested an exemption from the fire protection require-ments of Section !!!.6.2 of Appendix R for this case.
CMEB it currently reviewing the exemption request.
If this request is denied, we,will require that this instrumentation be available in case of a fire in fire zone 1.30A.
l Inaddtr+e*,fhe licensee has not provided direct reading of
~
several important procc>ss parameters outside the control room.
l In particular, the licensee should commit to provide readings of suppression pool level and temperature as well as reactor vessel level and pressure outside the control room which will I
be available given a fire in any fire zone including the control room and the cable spreading room.
l ine licensee has rtauested exemptions for compliance with Section !!!.G.2 of Appendix R for several instruments l
monitoring important process carameters until after TM1 modi-fications related to Regulatory Guide 1.97 are implemented.
These are identified in the licensee's June 25, 1982 sub-mittal as exemption requests 1 through 4 We consider the capability to monitor the process variables involved (reactor i
l t
I 9
I water level and pressure, drywelL pressure and torus pressure as well as torus /drywell differential pressure) in the event f
l of a fire to be of such importance that the instrumentation f
should be provided according to the schedule specified in Section 50.48(c).
l l
t n quirement 3,2 7).wnne a
'ita. / itec.c. % s+
+ hit The alternative shutdown ys ems have the capability of A
A%Co! Q0 N
achieving cold shutdown within / ? '.c a e., ut i kN 80 4KSS.
l 3,3 o.n.4r.
i The Licensee in submittats dated January 1980 and June 1982, has stated that no repairs are planned in order to achieve l
hot or cold shutdown conditions.
However, the licensee has proposed providing electrical isolation by puttin9 fuses.
l We advised the licensee both by conference call and during a j
l
)
meeting on December 7, 1982 that we considered the putting of fuses to be a repair and therefore not in compliance l
i with Appendia R requirements for hot shutdown.
The use of l
switches or similar devices is an acceptable alternative.
Co rn end m erd % 99 rForro Re<4 N hh ql t
t,et 2
' 00 hs MtQO_$ O hQ M hOO P*"i nj Nsh dun n9 he t shu4down l
i
. of these circuits would prevent spurious operation or matopera-tion that would adversely affect the safe shutdown capability.
The licensee's analysis identified a high/ low pressure inter-face where fire induced operation of the redundant electri-cally controlled valves could potentially result in LOCA (RHR shutdown cooling valves M0100l-47 and M01001-5C).
The control cabtes for these valves are located six feet teart iii the cable spreading room.
The licensee relies on certain fire protection measures and assumes that there will be no fire damage during the first 20 minutes after a fire starts in the cable spreading room.
We consider this assumption unacceptable since the 20 minute time period between start of a fire and fire damage to redundant cables cannot be verified.
The licensee should provide positive means for preventing spurious operaticn of these valves, such as tocking WF/CQ97 out the power breaker for one of the1e valves, c.
Comann EnclosaLk The licensee stated at the meeting on December 7, It t
there are no nonsafety-rels ted circuits that run between redundant safety-related tieins.
It wus further stated that att cables of concern were protected by circuit breakers i
l or fuses.
We find this acceptable.
i
4 '
3.5 Safe Shutdown Procedures and Manonwar The licensee will revise existing safe shutdown procedures to incorporate the proposed alternate shutdown methods.
The licensee stated that the manpower necessary for safe shutdown usino t h e a l t e r na t i ve '. hut dowr capolility will be available.
.J above, the licensee has identified 13 shutdown pai. (s.
We have discussed with the licensee the procedures which the licensee will use to shutdown the reactor using these panels with a crew of 5 operators.
The licensee stateu ct the December 7, 1982 meeting that a drill exercise has determined that all thirteen panels can be operated within 20 minutes and that once t he equipment has been aligned, only six of the thirteen panels will require monitoring.
The licensee stated thai
,o fire brigade members are included in the shutdown manpower requirements.
4.0 CONCLUSION
We have reviewed the licensee's proposed modifications and alternate capabili'cy for achieving safe shutdown against the requirements of Section III.G.3 and III.L of Appendix R to 10 CFR Part 50.
Based on our review, we conclude that the licensee can maintain one train of systems necessary to achieve and maintain safe shutdown conditions free of fire by utilizing either the control room or alternate shutdown methods, and, thus, meets the requirements of Appendix R
i
. i l
to 10 CFR Part 50, Items III.G.3 and III.L and resolves the open items of our SER of December 21,.1978,with the following exceptions:
i 1.
The licensee has not provided cuppression pool temperature and level indication, independent of the control. room.
2.
The licensee has not committed to provic:v a positive i
means of isolating the RHR isolation. valves to prevent spurious operation of these valves at high pressure during i
a fire.
3.
The licensee has not committed to provide switches or similar devices instead of putling fuses to achieve iso-l
'lation in order to prevent spurious signals during hot l
shutdown conditions.
i
.i In addition to the 1982 meeting with tive shutdown cir protection.
The tion of this stat
.~
( i i
The licensee sh'ould'be requested to provide a commitment to
. provide the above instrumentation.
The licensee'should be advised that this instrumentation does not'have to be safety-i related but only meet the requirements contained'in Section L
III.L.6 of Appendix R.
Pending receipt of commitments from the licensee.for.the above three items and confirmation of the fourth item, we concl'ude 1
I that our review is complete.
1
.I t
i d
J J
2 7
4 4
b
,,: ~ e:.
i*
P I L G R I M, S T A T 10 i' ilttM~NOT-t SAFETY EVALUATION REPORT FOR APPENDIX R TO 10 CFR PART 50, ITEMS III.G.3 AND,III.L 1.0
,;fj T R 0 0 U C,T123 6
On February 19, 1981, the fire protection rule for nuclear to cm pm f'
power p l a n t s, tO-tFR-5 0 a,n d A p o e n d i x. R t o 10 C F R P a r t 50, j
became effe?tive.
This rule required alL Licensees $1 plants licensed prior to January 1, 1979, to submit by March, 1980:
(1) plans and schedules for meeting the applicable requirements of Appendix R,
(2) a design description of any modifications proposed to provide alternative safe. shutdown capability pursuant to Paragraph III.G.3 of Appendix R,
and i
(3) exemption requests for which tb.e t6Lling provis~ ion of Section 50.48(c)(6) was to be invoked.
Sections III.G and j
si III.L of Aopendix R are retrofit items to all pre-1979 plants
. aL L -
.y.
regardless of previous-SER-positions and resolutions.
The criteria contained in Section III.L of Appendix R is used-for those cases in which Licensees are incorporating alternate or dedicated shutdown capability.
p;(?
s,' s;, O" Y'"
By submittaLs dated January 1980 and June 1982, UA4 ficensee) 5 described the means by which safe shutdown can be achieved in the event of fire and proposed modifications to Pilgrim 6
h y
. c P
Station Uni t i to meet the requirements of. Appendix R t o 10 s
CFR 50, Sections III.G.3 and III..L.
The' Licensee's submittal dated June 1982, summarizes all the work contained in the pre-
~
vious submittal and provides answers to the adestions' con-f tained in our. generic Letter 81-12.
In addition to these sub-mittals, several questions in the areas of systems and asso-ciat'ed circuits were clarified in a meeting with.'th,e Licensee on December.7, 1982.
i The licensee has provided a safe shutdown analysis for a fire event and has demonstrated that adequate redundancy and/or an ' alternative safe shutdown method exists for those systems required to assure safe shutdown.
Our analysis and evalua-tion of this follows.
2.0 E.nMT-FTAE SAFE sHurnoun cAPARflTTY 2.1 Jy>Jans_neeuired for safe shutdown 4
The following systems are used for safe shutdown following a fire when offsite power is Lost:
1 I
3 1
(
7
8 i
i 1.
Reactor protection system (RPS) 2.
Automatic depressurization system (ADS) 3.
Reactor c o r'e isolation cooling (RCIC) system 4
High pressure coolant injection (HPCI) system f
~
5.
Residual heat removal (RHR) system, low pressure coolant inj ection (LPCI) mode 4
6.
' Residual heat removal (RHR) system, torus cooling mode 7.
Residual heat removal (RHR) system, shutdown cooling mode, and 8.
Core spray (CS) system S a'f e shutdown is initiated from the control room by a manual 1
scram of the control rods or by action of the reactor protec-w.
O tion system.
Reae:or coolant inventory can be maintained by either the reactor core isolation cooling (RCIC) system, the high pressure coolant injection (HPCI) system during high pressure conditions or the low pressure coolant, injection by--c o' hne t4en-vi th' d
(LPCI) system or the core spray (CS) system n
)
.th e-a u tentti c--dtvrTsT u rtu ri o n s y s t e rr ' f 0 ) during iow pressure conditions./
eactor coolant system pressure is controlled by
\\
t I
i either the RCIC, the HPCI or the ADS in conjunction with the NL '
Inf'%,
residual heat removal (RHR) system in the steam condeatins y
\\
mg.lfb_a,y heat removal is provided by either the RHR in the
, ~ _
_i shutdown cooling mode or the LPCI or core spray in conjunction i
1 with the RHR in.the suppression pool cooling mode.
~
i The support systems recuired for safe shutdowr i nclude the salt service water syst em, t he r.e a c t o s bui ding closed cooling water system, the primary containment i>,Lation system, the essential ventitation systems, the emergen'y di,esel generator and the essential electrical distrib'ution sys?em.
The above systems wil,L be monitored and controlled from the control room or the remote shutdown panels and local cent. col stations.
2.2 Art.u_Whered.i. ternate Safe _ Shutdown is Proposed, The licensee analyzed the need for alternate safe shutdown at the Pilgrim Station for a fire in any fire zone (69 zones l
total).
As a result of this study, by submittal dated,
June 25, 1982, the licensee concluded that alternate shutdown J
- c. a p a b i l i t y was required for 17 fire areas, including the con-trol room and the cable spreading room, as the requirements of Section III.G.2 are not mot.
The Licensee's analysis indLuded.
Q& L. s-7 the snresolved items identified by the staff in our SER dated 3
1978.,fThe Licensee requested exemptions to December 21,
/' Sections III.G.2 and III.G.3 of Appendix R which deal with J-instrume..tation required for safe shutdown.
These exemptions
?
g.t..l are discussed in Section 3.0 of this SER.
'**g a
S 8
s.
t 2.3 _ Alternate Safe Shutdown _Jystems The alternate safe shutdown system required for those areas-not meeting Section III.G.2 or included in the exemption f
requests utilizes es, ting plant systems and equipment as identified in Section 2.1' with s(ome modifications, tocal i
manual valve alignments, local instrumentation and local control of shutdown and support equipment.
The alternative shutdown capability consiste of 13 remote shutdown panel','
s f
local control and isolation switches and alternate contr>L power feeders.
The licensee has also proposed putting fuses' ar.d op eni ng circuit breakers as methods of electrically i s ola t i ng some equipment during shutoown outside the control room.
This is unacceptable.
The licensee must propose an d
acceptable alternative such as installing isolation switches.
The shutdown panels are located near the associated equipment and consist of locked enclosures housing switches and instru-mentation.
Applicable operating procedures are kept inside each shutdown panet to fuide the operators in carrying out emergency operations at the panels.
3 Alternate safe shutdown is initiated by activation of the relief valves and the RCIC system.
During this phase of the shutdown, the suppression pool wilL be cooled as required by p
i d
operating the RHR system in the suppression pool cooling q
l 2
4 s
4
- D. -
~,
mode.
Reactor pressure will be controlled and core decay and' sensible heat rejected to thd suppression pool by dumoing steam throug5 tho relief valves.
Reactor water i n v e n t 'a r y will be maintained by the RCIC system.
The RHR system will be
(
f used to bring the reactor to cold shutdown.
The plant pro-cedures specify which valves are operated from the alternate shutdown panels and uhich valves are operated locally using valve handwheels.
The power for the alternate shutdown equipment will be supplied by the emergency diesel generators.
These circuits are routed from the electrical buses' directly to the shutdown components outside the cable spreading room or main control, room.
3.0 F V A ' ' ' 8 7 ' ^ 'l l
3.1 - Performane* - Goa
The performance goals for post fire shutdown can be met using the proposed alternate shutdown systems described in Section l
I 2.3.
l i
The process monitoring instruments tn be used for a post fire i
shutdown include recctor water level, reactor coolant pre.sure, dyrwel,L pressure, torus pressure, drywell/ torus differential pressure, HPCI and RCIC turbine flow indicator and controllers.
Level indication for all tank.s used for post-fite alternative shutdown will be available.
The support systems available a
e 9
5
- ~,,.
44 g.,
t
~..
j 1
-7 include the redundant diesel generators, vital busess salt service water s,y s t e m, the tube oil system, the essential tooling water system and the equipment area cooling system.
Control and monitoring c ap a b i l i t'y for these support systems is also provided at local stations.
1 l
The licensee has not provided direct r ea di ng of s eve ra l i mp'or-tant process parameters outside th'e control room.
In parti-cular, the licensee should commit to provide readings of suppression pool level and temperature as well as reactor vessel level and pressure cutside the control room which will be available given a fire in any fire zone including the t
~l control room anc~ the cable spreading room.
The licensee has equested exemptions for compliance with Section III.G.2 of Appendix R for several i.Sstrume'nts.
monitoring importar.t process parameters until efter-TM'l modi-fications related to Regulatory Guide 1.97 a re implemented.
These are identified in the licensee's June 25,'8982 sub-mittal as exemption requests 1 through 4.
We consider the o
capability to monitor the process variables involved (reactor water level and pressure, drywell pressure and t'orus pressure i
as well as torus /drywell differential pressure) in the event 1
t n,!!:
&v s.
,. n
...,n
s f b !4 of a fire to be of such inportance that the instrumentat. ion should be provided according to the schedule specified in Section 50.48(c).
3.2 7_2-8.o_u r _R.eAuir e m e n t Yhe licensee has stated that the alternative shutdown systems have the capability of achieving cold shutdown'within'72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> using only onsite power sources.
3.3
- -=4-=
The licensee in submittats dated January 1930 and June 1982, has. stated that no repairs are p'.anned in order to achieve i
hot or cold shutdown conditions.
However, the licensee has proposed providing electrical isolation by pulling fuses.
We advised the licensee both by conf erence call and durirg a meeting on December 7, 1982 that we considered the pulling of fuses to be a repair and the.*efore not in c o mp.t i a n {e with App.endix R requirements for hot shutdown.
T'he use of l
switches or similar devices is an eccep;able alternative.
The licensee should provide a commitman to perfo.rm any electrical isolation by means other than pulling fuses during hot shutdown.
L
~,
i 3.4 A_s s o e i a,t_e.d C i r e v i t1_.pftd_ IJ_o_1.ph By letter dated June 25, 1982, the Licensee provided *.he results of an associated circuit review for the alternate shutdown systems.
The results identified the asso'ciated cir-cuits of concern in t he s'e a r ea[ and 't he proposed' methods f or protecting'the safe shutdown capability from fire-induced 1
failures of these circuits.
Our. evaluation of the Licensee's analysis is discussed below.
s a.
common Power soureen Circuits required f or alternative shutdown f ot Lowing a
fire are being reviewed for circuit coordination by..the j
Licensee.
In a meeting on December 7,.1982 the licensee stated that aLL instrumentation and power circuits wilL be provided with coordinated protection by either circuit breakers or fuses.
The Licensee should provide formal documentation of this commitment.
l b.
Ma"a*^"'
'4aa '
z).
The licensee's ana Lysis identified a number of circuits.
whose fire-induced failures may adversely aff.ect the saf.e shutdown capa,bility.
The design of the alternative shut-4 down system provides local-control stations to provide isolation and control of theso circuits.
The isolation 4
e,
.m e
a a
m
.a a
- m ew
.h
4 '
\\
E of thtse circuits would prtvent spurious operation or matopera-tion that would adversely affect,the safe shutdown capa.tility.
The li c ens e e 's a r.a ly s i s identified a high/ low pressure inter-face Jhere fire induced operation of the redundant,electri-cally controlled valves could p$ tent'ially result.in LOCA (RHR shutdown cooling valves M0100l-47.and M01001-50).
.The..
controtocables for these valves are located six feet apart in the cable spreading rnom.
The licensee r lie on'certain i
fire protection measures and assumes that there will be no fire damage during_ the first 20 minutes after a fire starts in the cable spreading room.
We consider this assumption unacceptable since the 20 minute time period between start of a fire and fire damage to redundant cables cannot be I
verified.
The licensee should provide positive me'ns for a
i preventing spurious operation of these valves, such as locking out the power breaker for attleast one of these valves.
e.
Lag _mnn F1LLosura The licensee stated at the meeting on D ec embe r 7,'1982 that s
there are no nonsafety-related -ircuits that run between redundant safety-related trains.
It was further F.tated that i
all cables of concern were protected by circuit br eakers or fqses.
We find this acceptable.
e h
~
e
. 3.5
.s,a.f e. SAu t d o.wp, P r=o.c e.d u,te.1_.am d Maneeuer The licensee oill revise existing safe shutdown procedures incorporate'the proposed alternate shutdown methods.
The to licensee stated that the manpower necessary for safe shutdown f
using the alternative shutdown capability will be available.
As noted above, the licensee has identified 13 shutdown panets.
We have discussed with the licensee.the procedures which the licensee will use to shutdown the reactor using these panels with a crew of 5 operators.
The licensee stated at the December 7/1982 meeting that a drill exercise ha*,
determined that all thirteen pan. cts can be operated wj. thin 20 minutes and that once the equipment has been aligned,.only six of the thirteen panels will require monitoring.
The licensee stated that.no fire brigade members are included in the shutdown manpower requirements.
4.0 _ CONCLUSION We have reviewed the licensee's proposed modi'fication's,and alternate capabstity for achieving safe shutdown against the requirements of Section III.G.3 and III.L of Appendix R to 10 CFR Part 50.
Based on our review, we conclude that the licensee can maintain one train of systems necessary to achieve and maintain safe shutdown conditions free of fire by utilizing either the control roon or alternate shutdown methods, and, thus, meets the requirements of Appendix R I
s i
(
~
to 10.CFR Part 50, Items III.G.3 and III.L and resolves the open items of our EER of December 21, 1978 with the fotLowing exceptions:
1.
The licensee has not provided su,ppression pool temperature I
and level indication, independent of the c o n t r o l'.r o o m.
I 2.
The. licensee has not committed to provide a p.esitive
.ans of isolating the RHR isolation valves to 'grevent*
spurious operation of these valves at high pressure during i
i a fire.
3.
The Licensee has not committed to provide swite'hes or 2
i simitar devices instead of pulling fuses to achieve iso-1
- tation in order to prevent spurious signals during het i
shutdown conditions.
t 1
1 In addi; ion to the above the licensee stated at a December 7, 1982 meeting with the staff that att of the post fire alterna-1 tive shutdown circuits that share a common bus,have coordinated l
protection.
The licensee should formally document conf ema-1 tion of this statement.
4
's f
I
-t f
e The licensee should be recuested to provide a commitment to provide the above instrumentation.
The licensee should be advised that this instrunentation does not have tu be safety-related but on y meet the requirements contained in Section i
III.L.6 of Appendix R.
i Pending receipt of commitments from the licensee.for the above i
~
three items and confirmation of the fourth item, we conc.lude that our review is complete.
a
\\.- *
=
&Ce
/
4 4
4
)
i i
i e
i
)
i l
1 1
A,'
- )
I i
N' a
k s
g.<
1,.
3 F'
9
[.
e s
~ *W
[D
~
- Q' r y
.h;.
l.
. ]
Y 9
,, ~k.
'. h *,
~
Pho to #1 Photo F2 ss.
Attachment B Photographs of Fuse Insta'lation i
Typical of Those Listed I
l in Attachment A I
L.
Photo n3 NOTES:
1.
Thota "1 is a pho to ;,raph c f the breaker cubicle with the door opened.
The "Trip" and "Close" fuses are in the upper rizht hand corner, 2.
Photo "2 shows the identificati_,n for the "Trip" fuses, i
3.
Photo 3 shows the ident.fication for the "Close" fuses.
i l
The "Trip" and "Close" f uses are clearly identified in all breaker cubicles.
I i
?
l e
4 SEVERE ACCIDENT SAFETY IN BOILING WATER REACTORS j
WITH MARK I CONTAllMENT As the name indicates, a boilirg water reactor (BWR) is a reactor in wiiich the water fed to the reactor core boils right there in the reactor vessel and then passes as steam directly out to the turbine generator where its energy is converted to electricity.
The exhausted steam, after condensation, is returned to the reactor as f eedwater.
Figure 1 shows a simple schematic of a BWR plant.
The reactor is enclosed in a special' containment structure. ' The i
feedwater enters and the steam leaves this containment structure through multiple, large diameter pipes equipped with redundant valves which can be
{
closed in an emergency.
In the pressure suppression containment which is used in all large U.S. BWRs, a very large quantity of water, up to one million gallons, is stored in a special compartment of the containment called the I
suppression pool. Many auxiliary and emergency cooling systems are provided i
f to pump cooling water into the reactor and to cool the containment atmosphere and its suppression pool.
If a pipe breaks by accident, the containment closes to isolate the reactor in the containment;and many cooling systems are called into play to cool the reactor and the suppression pool, removing the stored energy and heat generated by radioactive decay.
1 Thus, the BWR is an den system removing large quantities of energy to nearby equipment which, L1 emergencies, converts to a closed system, basically relying on extcrnal cooling of the containment to remove the bottled-up energy. The most common type of pressure suppression containment in the U.S.
is the Mark I type shown in Figure 2, which is used in the 24 U.S. BWRs listed in Table 1.
The reactor is contained in the drywell portion of the containment, shaped like an electric licht bulb standing upside down. The suppression pool partially fills a toroidal shell around the base of the "bulb" and a series of ducts is installed to guide steam and other releases into the suppression pool which querches the steam and also absorbs much of the radioactive material (except gases).
"Severe accidents" is the tern most commonly used to describe accidents in which the reactor core is severely damaged. As httponed at Three Mile Island, prolonged loss of core cooling can allow the heat of radioactive decay in the l
l
r core to build up to the point that the fuel begins to disintegrate, the j
S, zirconium metal cladding melts or reacts with residual steam.to form l
~
combustible hydrogen, and even the ceramic uranium oxide fuel pellets can melt.
A great deal of attention is being given to understanding the behavior i
i of reactors and their containments in severe accidents, especially since the j
Three Mile Island accident. The objectives are to snsure that the likelihocd of core melt accidents is very low and that, should one occur, there is
{
subs *.antial assurancs that the containment will mitigate its consequences.
j, i
t The severe accident behavior of a 8WR with a Mark I containment, the Peach Bottom plant, was assessed in the Reactor Safety Study (WASH-1400 or i
NUREG-75/014) which was pubitshed in 1975.
That study indicated a rclatively low overall risk for the BWR, principally due to its ability to prevent core i
melt.
The containment was estimated to provide very little mitigation of core
{
melt consequences because the buildup of pressure under accident conditions would be a direct cause of containment failure unless adequate cocling was preserved. Consistent with sperating procedures in place in 1975, the Study
)
assumed little effort by the reacto' operators which might effectively preserve the containment's integrity.
1
~
l i
The situation, more than ten years later, is different and still changing for l
the better.
It is recognized today that molten core material melting into the ground through the thick containment base is not the principal threat; rather, 1
it is an atmospheric release of radioactive material which is the principal threat.
The principal factors which can cause containment failure with j
atmospheric release are hydrogen ignition, gas overpressure buildup to rupture, and direct attack of the drywell by core melt debris. The general situation for each of these is summarized as follows:
I j
Hydronen Ionition Recognizing that combustible hydrogen can be generated and released in severe I
accidents, all Mark I containments now are purged and filled with inert nitrogen i
gas during operation so that even if hydrogen gas is formed it has insufficient oxygen available to suppo.t combustion.
Remaining questions in this area relate to how long the containment may be without this inert atmosphere in order to i
H 4
I i
3 permit inspections, and how air might leak in or hydrogen leak out to nearby rooms under accident conditions.
Overpressure Failure Careful analysis indicates that a typical Mark I containment can withstand pressures of more than twice the design pressure without rupture.
Nevertheless, severe accidents in the extreme can generate such pressures and cause containment rupture. Overpressure damage control prccedures have been developed for pressure suppression containments and are already in place for operator use. With these procedures the containment remains closed for most accident conditions; but, if overpressure failure threatens, large vent valves above the suppression pool chamber are opened so that the excess pressure is released gradually by but.bling the releases through the pool, forming a filtered vent containment system. With this path essured, virtually nothing but the noble gases are released. The radioactive noble gases pose a modest exposure threat offsite only in the area very close to the plant.
A number of questions are being pursued in this area.
All the plancs have suitably large vent valves.and ducts but they vary one to another in the ability to open these valves under accident conditions.
The valves are designed for highly j
reliable closure, not opening.
Considerai, ion is being given to modifying valve controls.
In addition, the vent ductwork oownstream of the valves may warrant modification.
In most plants it is fairly light gauge ductwork and might Le breached in accident venting.
If so, consideration is being given to the effects of secondarj release of radiocctive gas, hydrogen, and perhaps steam into the reactor building.
Direct Attack The core melt debris, since it has aclted through the reactor vessel into the drywell say, by direct radiation of heat, cause fsilure af connections in the drywell shell; or the debris, if sufficiently fluid, s.ay flow out to the wall and melt through the steel. The Mark I containa nts have one or more spray systems in the drywell which are able to 1 pray water along the walls and onto the floor of the drywell inhibiting direct attack.
Concerns in this ar9a are in three general areas:
core debris modeling, shell and concrete attack modeling, and spray reliability.
In the first ares, it is recognized that e molton reactor core, to melt through the bottom of a BWR, must dissolve a very
. large amount of inert metal in the lower reactor vessel, probably dily. ting the core melt.
The key question is whether the melt would come out moving sluggishly like Hawaiian volcano lava or as a hot free flowing liquid. The latter is the more threatening condition.
If core melt debris reaches the concrete floor and steel shell of the wall, it is important to understand that the path to the outside that might be opened bypasses the beneficial scrubbing of rartioactive material passing through the a
pool.
As noted earlier all these plants have drywell spray systems, but they are designed as a secondary mode of operation for a reacter safety system.
Strong consideration is being given to enabling hookup of these systems to fire protection systems so that spray capability is almost always available.
Substantially different emernency operating procedures and training were put in place at all reactors after the Three Mile Island accident; further improvemer.ts in these procedures are still being mace.
For the Mark I
' containments both i dn uJtry and NRC studies are being used to identify the best combined strategy for procedures cnd perhaps some changes in equipment such as alternate vent paths, or improved valve operability.
The Mark I studies are being given highest priority by the NRC staff and the industry.
The expectation is that, with modest improvements of this type, one can achieve substantial assurance of core melt consequences mitigation by a Mark I containment.
{
4 0
_,y y
---y___,
y,
j the direct cycle boiling water reactor system 1
i i
Turbine Generator Reactor I
Extract 6on tenes Condenser Separators & Dryers Core
~
o Jet Jet Pump Pump i
Demaneralerer I
i l
Feed h
l Pump M
t/U l
Q E
a IIIIII 2
l
=
_- E E.
H
-..M i
I 1
--=
em i,
o I
I Recirculatson Pumps Demencratszer i
I i
FIGURE 1.
l L
i a
m L'
W i
N pr l
f. --
i 5
- 1. Secondary Contamment
!}
. ;,+ k
- 2. Refueling Floor
- 3. Drywell
- 4. Reactor Vessel f
1 S. Pedestal j
i
- 6. Wetwall/ Torus 7 Downcomer
- 8. Concrete Stueld.ng
'5 s
i i
j Figure 2.
Boiling Water Reactor Mark i Containment i
~
TABLE 1 BOILING WATER REACTORS WI1H MARK I CONTAItmENTS L! CENSED OPERATING PLAd7,-
POWER LICENSE NAME LEVEL DATE COUNTY STATE UTILITY BROWNS FERRY 1 3293 12/20/73 LINESTONE COUNTY AL TVA BROWNS FERkY 2 3293 08/02/74 LIMESTONE COUNTY AL TVA BROWNS FERRY 3 3293 08/18/76 LIMESTONE C0CNTY AL TVA BRUNSWICK 1 2436 II/12/76 BRUNSWICK COUhTY NC CAROLINA POWER & LIGHT 8RUNSWICK 2 2436 12/27/74 BRUNSWICK COUNTY NC CAROLINA POWER & LIGHT COOPER 2381 01/18/74 NEMEHA COUNTY ME NEBRASKA PUBLIC POWER DISTRICT DRESDEri 2 2527 12/22/69 GRUNDY COUNTY IL COMMONWEALTH EDISON DRESDEN 3 2527 03/02/71 GRUNDY COUNTY IL COMMONWEALTH EDISON DUANE ARNOLD 1658 02/22/74 LINN COUNTY IA IOWA ELECTRIC POWER & LIGHT FERMI 2 3292 07/15/85 MONROE COUNTY MI DETROIT EDISON FITZPATRICK 2436 10/17/74 USWEGO COUNTY NY POWER AUTHORITY OF STATE OF NY HATCH 1 2436 10/13/74 APPLING COUNTY GA GEORGIA POWER PATCH 2 2436 06/13/78 APPLING COUNTY cf.
GEORGIA POWER F'BLIC SERVICE ELECTRIC & GAS HOPE CREEK 1 3293 04/11/25 SALEM COUNTY NJ J
MILLSTONE 1 2011 10/16/70 NEW LONDON CT NORTHEAST NUCLEAR ENERGY MONTICELLO 1670 01/19/71 WRIGHT COUNTY MN NORTHERN STATES POWLR NINE MILE iniM! 1 1850 08/22/69 OSWEGO COUNTY NY NIAGARA M0 HAWK POWER OYSTER CREEK 1 1930 08/01/69 OCEAN COUNTY NJ GPU NUCLEAR CORP PEACH BOTTOM 2 3293 12/14/73 YORK COUNTY PA PHILADELPHIA ELECTRIC PEACH BOTTOM 3 3293 0?/02/74 YORK COUNTY PA PHILADELPHIA ELECTRIC PILGRIM 1998 06/08/72 PLYMOUTH COUNTY MA BOSTON EDISON QUAD CITIES 1 2511 12/14/72 ROCK ISLAND COUNTY IL COPMONWEALTH EDISON QUAD CITIES 2 2511 22/14/72 ROCK ISLAND COUNTY IL COM)NWEALTH EDISON VERMONT YANKEE 1593 02/02/73 WINDHAM COUNIY VT VERMONT YANKEE NUCLEAR POWER
\\
o& twG p \\c.
u 3
,r
\\m t ki APPENDIX P SCHEDULAR EXEMPTION PILGRIM NUCLEAR POWER STATION Roston Edison has reouested a schedular exemption from 10CFR 50.48 (d)
(3) (iii) which reauires that "those fire protection features, including alternative shutdown capability, involving installation of modifications reaufring plant shutdown shall be implemented before startup after
-an unplanned outage that lasts for at least I?O days."
Pilgrim station is presentiv 'n such an unplanned outace which becan on April I?,1986 and is i.ot ;xpected to end until late August (aporoxinately 140 days duration).
The plant modifications to bring Pilorim Station into comoliance with 10CFR Part 50, Aopendix R, are approximately 85 percent complete now.
100 percent completion is scheduled to occur during Defueling Outage 87 fpresently scheduled to begin in January,1987). This completion date meets the schedular requirements of 10CFR 50.48 (d) (3)
(1).
Figure I shows the status of the various modification activities.
Poston Edison estimates that 14 weeks of pre-RF0 #7 construction work and 10 weeks of additional work during RF0 #7 will be necesary to complete all of the modifications. The pre-RF0 work has been prevented from occuring during nost of this outage by a contractor trade union work stoppace which began on May 1 and has,iust ended. This 14-week effort should commence shortly but it will 90 well btyond August.
la Roston Edison has shown,its July 14 submittal that "special circumstances are present" as required by 10CFR 50.12 for consideration of an exemption. That submittal also addresses the criteria in Generic Letter 86-10.
Correction of the equipment problems for which 1he plant wac shutdown n%E essentially completed by mid-June. PECoj decided to extend the outage several weeks to allow new management personnel to take hold. Thus, the plant could probably have received the Regional Administrator's OK to restart during.1uly.
However, the failure of RWD oumn wear rings (due to IGSCC) became an additional issue (see IE Notice i
86-391.
In view of the importance of these cumps to safety C G o #
decided to inspect and repair, if necessary, all four pumos prfor to restart.
.\\
BOST0?{ EDISON COMPANY FIRE PROTECTIO!1/APPEtIDIX R MODIFICATiott STATUS 1
i 1982 1983 1984 1985 19'86 1987 t
s 8
4 3l
- i.'
l I ~,
RF0#7 h
R:'f uf'JHQ OUTAGE # 7
.L j
e t
8 F
-es e e,sur%.. _ _'
I :
PDC 84 03A UdDERGROUND DUCTBANK
- b. i 'r'N ii ".s A.J h
'.6_ /,. w* -
d e
~ u i
e s
i IN.'LANT RACEWAY h_E~li.c.M. 9.f.fjNM__ mM PDC S4 033
.m O
e M O DIFICATIONS f r.'-W+,@h.M;F.JM 67J L',;"."T.hp%M
~
K i ' ' F.. '.
.:diU.1 3 7 5. W e; g l :
~
..,M... 6.i r. ;.- ::.= = =:.
"c.)
M y / G %1 5.5'ff. @-e s
i3 PDC 84 03E CAU.E INSTALLAT10N 9
,,,,m I
PDC 84.C3F DIESEL GENERATOR MODS
. fjh'fj'$/1;M-~ M}E *. 7g _ 5 ~ TORUS LEVEL MODIFICATION Y. N. 3 I C PDC 85-41 9 1 0 PDC 85 498 SPRINKLER MODIFICATIONS {-l] l i t e SPRtHKLER STUS OUTS & D5AINS Q j i PDC 85-49A i . i; PDC 43 61 A 3-HR FIRE RATING 4160 "A" $ WITCH 0 EAR ROOM e i f s 1 0 PDC 4,1818 3.HR FIRE RATING 4160 "B" 8WITCHOEAR R,00M 9,# 4 ] t 8 F1ME DAMPERS { l I ', PDC 84 31 e i n e PDC $3 06 b-3be N-F4 23"rel HALON ELECTRICAL 8 .I e i
- '* F-i): w ilata.*e HALON MECHANICAL 3 ; PDC 8315 wMAm~
i, i e e EMEMGENCY UGHTSH l .' l. 0 POC St.XX i e I a I LEGEND 6 COMPLETE HOLD POR RFC REMAINING i i Figure 1 .l g-......
- r-
" v. 9/gf ~.] . MEMO ROUTE SLIP s... w i m.. ry.w nma rw.eum. . rni. uc-es < r,. M.y 3 4, iW) MCM ONO N W. 44 r.twa. rorofatm. Fw lafuni.tfon. t ro <=...... an)
==Tiss
=== = 5 7 e j,g A LI C,.. ,,, 4 p, s, eu t'- ggd NTE p ra c 3 ~; f. h } b D M r ( TO (N....adunMJ F81tg3 stas AA R.$ 9 ^g""""" 'g A w n11 trP. $ 7 t [p (1 $ h / w....,.., r, (J, geo hh If L'hW ' eues \\ ~ "JL*{ Mk btse \\ pfo[wngdg hMM ' ks w in r
- ,.+b N L% # %qmc h WE
& J & S e a tL.ed4 % k. m 4 -g ev M L h WL 4.Q<wa Ae L a 1-gfd. b u
- b W4 4,$4 0 Testa 1sof FOR ACOsTIO81ab MMAAK3 cpo i tett O.
- 4. 4ae i
O i .e'i t 'l 3 l}}