ML20206N471
| ML20206N471 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 05/13/1999 |
| From: | Scherer A SOUTHERN CALIFORNIA EDISON CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| Shared Package | |
| ML20206N476 | List: |
| References | |
| TAC-MA0387, TAC-MA0388, TAC-MA387, TAC-MA388, NUDOCS 9905170240 | |
| Download: ML20206N471 (25) | |
Text
..
50U1Hf RN CAllf 0RNIA A. Edward Scherer i
EDISON
=%~rras An / DISO V IV71RV4TIONAL*' Cumpany May 13, 1999 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, D. C. 20555 Gentlemen:
Subject:
Docket Nos. 50-361 and 50-362 Amendment Application Nos.172 and 158 Reduced Pressurizer Water Volume Change San Onofre Nuclear Generating Station Units 2 and 3 (TAC Nos. MA0387 and MA0388)
References:
1.
September 22,1998 letter from James W. Clifford (NRC) to Harold B. Ray (SCE),
Subject:
Request for Additional Information on Change to Pressurizer Level Technical Specification PCN-470 (TAC Nos. MA0387 1
and MA0388)
I 2.
December 19,1997 letter from Dwight E. Nunn (SCE) to Document Control Desk (NRC),
Subject:
Docket Nos. 50-361 and 50-362, Amendment Application Nos.172 and 158, Reduced Pressurizer Water Volume Change, San Onofre Nuclear Generating Station Units 2 and 3 This letter provides information requested by the September 22,1998 NRC letter (Reference 1) concerning the Reduced Pressurizer Water Volume Change Amendment Application Nos.172 and 158 for San Onofre Units 2 and 3, respectively. These amendment applications are~ Proposed Change Number (PCN) 470 (described in
/
Reference 2) which requested NRC approval to revise Technical Specification 3.4.9 to
/
be consistent with certain Updated Final Safety Analysis Report Chapter 15 events which had been reanalyzed. The proposed change will reduce the pressurizer water level required for operability.
9905170240 990513 PDR ADOCK 05000361 P
\\
P. O. Ilox 128 San Clemente. CA 92674-0128 949 468-7501
~
Fax 949468-7575
a Document Control Desk May 13, 1999 The NRC questions from Reference 1 and Southern California Edison's responses are provided in Enclosure 1 to this letter.
Additionally, Enclosure 2 is a replacement page which corrects " Peak RCS pressure, psia" (at 608.5 seconds) to " Pressurizer safeties close, psia" in Table 15.5-4 of to PCN-470. Please replace the PCN-470 Attachment 5 Table 15.5-4 with this corrected page.
If you have any further questions regarding these responses, or need additional information on this subject, please feel free to contact me or Mr. Jack Rainsberry at (949) 368-7420.
Sincerely, d-nuS Enciosures cc:
E. W. Merschoff, Regional Administrator, NRC Region IV J. A. Sloan, NRC Senior Resident inspector, San Onofre Units 2 & 3 L. Raghavan, NRC Project Manager, San Onofre Units 2 and 3
l l
ENCLOSURE 1 Responses to NRC Request for Additional Information on PCN 470
Responses to NRC Request for Additional Information on PCN 470 OUESTION I For the feedwater line break event, please explain the difference in the maximum pressurizer water volume indicated in Table 15.2.3-8 and Figure 15.2-41. Describe the i
margin available between the maximum transient pressurizer water level and the point the pressurizer becomes solid.
i RESPONSE 1 The maximum pressurizer water volume value of <l465.7 ft' listed in Updated Final Safety Analysis Report (UFSAR) Table 15.2.3-8 is the acceptance criteria value for the feedwater line break event. This value is the pressurizer volume corresponding to the elevation at the bottom of the pressurizer safety valve (PSV) nozzle. Maintaining the pressurizer volume at s 1465.7 ft' insures that no water flows through the PSVs during this event. The values of pressurizer water volume in UFSAR Figure 15.2-41 represent the actual trend in water volume during the insurge portion of this event. In short, the peak water volume for this event is 1396 n' (as shown in Figure 15.2-41), which is below the acceptance criteria of s 1465.7 ft" (as shown in Table 15.2.3-8).
The total volume of the pressurizer at hot operating conditions (i.e.,2250 psia and Tsat of 653F) is 1537.7 ft' This is the water volume at which the pressurizer would go solid. However, the acceptance criteria for this event is not based on when the pressurizer would go solid, but instead conservatively set at the level at which no water would flow through the pressurizer safety valves for the Updated Final Safety Analysis Report (UFSAR) peak pressure case (Reference). The pressurizer water volume corresponding to the elevation at which no water would flow through 1
the PSVs is calculated to be 1465.7 R3 Therefore, the margin between the transient peak pressurizer volume for this event and the acceptance criteria for this event is currently 69.7 fl' (1465.7 ft'- 1396 ft') and between the transient peak pressurizer volume for this event and the point at which the pressurizer goes solid is 141.7 ft'(1537.7 fl'- 1396 ft').
Reference EPRI NP-2318, " Valve Inlet fluid Conditions for Pressurizer Safety and Relief Valves in Combustion Engineering-Designed Plants," December 1982.
OUESTION 2 Page 2 of the December 19,1997, submittal states " Inadvertent Operation of ECCS During Power Operation was analyzed with concurrent. single failure of an active component."
f 1
(
Please provide the following:
a.
List of assumptions for the analysis, b.
Sequence of events (including the time of alarm, operator actions and the maximum pressurizer water volume),
Transient curves (including the pressurizer water volume), and c.
d.
Brief description of Emergency Operating Procedures (EOPs) applicable to mitigate this event.
The staff requires this information to confirm your conclusion that this event is bounded by the results of a chemical and volume control system (CVCS) malfunction. The qualitative assessment currently provided in the proposed FSAR Section 15.5 is not sufficient.
RESP ()NSE 2 I
i For San Onofre Nuclear Generating Station (SONGS) Units 2 and 3, the design shutoff head for the High Pressure Safety injection (HPSI) pumps was established at a value significantly below the minimum operating pressure for the reactor coolant system (RCS). The minimum RCS operating pressure for SONGS is approximately 500 psi greater than the HPSI pump shutoff head. Therefore, no water is injected into the RCS through the High Pressure Safety Injection
{
System for the Inadvertent Emergency Core Cooling System (ECCS) Operation events, with or without a single failure.
Similar to the CVCS Malfunction events, the Inadvertent ECCS Operation events will start all available charging pumps, which are positive displacement pumps. Upon receipt of a Safety Injection Actuation Signal (SlAS), the charging pumps will realign their suction from the Volume Control Tank (VCT) to the Boric Acid Makeup Tanks (BAMT) or Refueling Water Storage Tank (RWST). In addition, letdown flow is isolated on a SIAS. Therefore, for this event, borated charging flow at a rate of up to 135 gpm (45 gpm per pump) could be injected into the RCS.
Note that although letdown is isolated, controlled bleed ofTof 4 gpm to the quench tank via a pressure control relief valve would still be maintained throughout this transient.
Based on this information, a maximum flow of 131 gpm could be injected into the RCS given an Inadvertent SIAS. This injection flow is the same as for the CVCS Malfunction events. The only difference between the events is that for the CVCS Malfunction events the charging pump suction would be from the VCT, but for the Inadvertent ECCS Operation events the charging pump suction would be switched from the VCT to the BAMT or RWST. Due to this switching of tanks, the boron concentration of the injected water would be higher for the inadvertent ECCS Operation events than for the CVCS Malfunction events. The higher boron concentration water will inject negative reactivity into the core, causing a power decrease and subsequent temperature decrease. This decrease in temperature will result in a shrinkage of RCS volume which will act to reduce the increase in RCS inventory caused by the operation of all available charging pumps.
Therefore, the Inadvertent ECCS Operation events will be similar to the CVCS Malfunction events in every respect except that the consequences will be less adverse due to the higher boron 2
concentration in the charging water being injected into the RCS, until operator action at 15 minutes, which terminates the events.
Based on the above conclusion, the inadvertent ECCS Operation events are not explicitly analyzed for SONGS 2 and 3.
a) Assumptions of analysis All analysis assumptions for the inadvertent ECCS Operation with single failure event were exactly the same as the CVCS Malfunction with single failure event presented in Table 15.5-3.
For completeness, the Assumptions for this event were as follows:
ASSUMPTIONS FOR THE INADVERTENT ECCS OPERATION WITH SINGLE FAILURE Parameter Assumotion Initial core power level, Mwt 3,478 Core inlet coolant temperature, *F 542 Core mass flow rate, E+6 lbm/hr 143 7 Reactor coolant system pressure, psia 2,000 Moderator temperature coeflicient, E-4 delta K/K 0.0 Doppler coeflicient multiplier 1.25 Control Element Assembly (CEA) worth on trip,
-6.0 x10-2 Steam Bypass Control System (SBCS) mode Manual Pressurizer Pressure Control System (PPCS) mode Manual CVCS flow mismatch, Charging, gpm 135 Letdown + Reactor Coolant Pump (RCP) bleed off, gpm 4
initial Pressurizer Volume, ft' 913 3
b) Sequence of events (including the time of alarm, operator actions and the maximum pressurizer water volume)
The sequence of events for this event, including time of alarms and operator actions, would be similar to the CVCS Malfunction with single failure event, presented in Table 15.5-4, except that the times would be slightly later and the resultant peak pressurizer pressure and volume would be somewhat less adverse for the Inadvertent ECCS Operation with single failure event due to more shrinkage of the RCS as a result of the higher boron concentration in the charging flow as discussed in the response to Question 2.
c) Transient curves (including the pressurizer water volume)
The transient curves would be similar to the curves for the CVCS Malfunction with single failure event shown in UFSAR Figures 15.5-13 through 15.5-23, except that the times would differ and peak pressurizer pressure and volume would be somewhat less adverse.
d) Brief description of Emergency Operating Procedures (EOPs) applicable to mitigate this event.
The procedure for handling an inadvertent actuation of ECCS is Abnormal Operating Instruction (AOI) SO23-13-17 " Recovery From Inadvertent Safety injection, Containment Isolation, or Containment Spray." This procedure requires Operators to determine the validity of the ECCS actuation by assessing four parameters (Pressurizer pressure, Containment pressure, RCS core exit saturation margin, and Pressurizer level). If the actuation is determined to be inadvertent, Operators are then directed to override and stop all charging pumps.
When the loss of otTsite power and resultant reactor trip occurs, the Operators will perform the standard post trip actions in accordance with Emergency Operating Instruction (EOI) SO23-12-1
" Standard Post Trip Actions" as the priority procedure. In this case, SO23-12-1 will be completed in about 10 minutes and a Loss of Offsite Power / Loss of Forced Circulation will be diagnosed and EOI SO23-12-7 " Loss of Forced Circulation / Loss of OfTsite Power" will be entered. One of the first actions in this procedure is to monitor for Throttle /Stop of Safety Injection (SI). It will be determined that Safety injection is not required and the SI pumps and charging pumps will be stopped as required to maintain pressurizer level. Copies of SO23-13-17, SO23-12-1, and SO23-12-7 (relevant pages) are provided in Attachments B, C, and D.
LllIES170N 3 During the event of a CVCS malfunction, confirm that the assumed 15 minute operator action time is available between the positive indication to the operators (alarms, etc.) and the operator action to terminate the event. Describe the positive indications used in this scenario and EOPs involved in mitigating this event.
l 4
1 l
RESPONSE 3 This event, as initiated by a malfunction of the CVCS (e.g., failure of the controlling pressurizer level channel transmitter), would initiate erroneous indications oflow pressurizer level. That is, pressurizer level would actually be at the normal program level, but the control system would "think" level was low as a result of the instrument failure. The automatic response of the control system would then be to try to " refill" the pressurizer to its programmed level, when in actuality this response would cause actual pressurizer level to be driven above normal.
The available 15 minute operator action time will adequately provide time for Operators to detect the event and take corrective action for a CVCS malfunction event. A malfunction of the CVCS (failure of pressurizer level control channel) would be detected by a minimum of two immediate alarms: "UA50A23 PRESSURIZER LEVEL ERROR LO" and "UA50A03 PRESSURIZER LEVEL LO-LO." The latter alarm is a Red Priority (highest priority) alarm. Alarm Response Procedure (ARP) SO23-15-50. AJ " Alarm Response Instruction" directs Operators to first validate an off-normal (alarmed) condition and to assume an alarm is valid "until substantiated by hard data that it is erroneous or a nuisance alarm" (see page 3 Attachment A). The specific ARP response section for each of the alarms listed above provides the Operator with a list of
" VALIDATION INSTRUMENT (s)" which should be used to determine whether the alarmed condition is real or the result of an instrument failure. Ifit is an instrument problem (CVCS malfunction), ARP SO23-15-50.A.1 is followed which directs the following required actions (see pages 14,15, and 62 Attachment A):
Action 1.1 Ensure maximum charging flow and minimum letdown flow.
1.2 Ensure all Pressurizer Heaters are De-energized.
1.3 Determine if Letdown and Charging Systems are responding as desired. If not, then:
1.3.1 Place the Pressurizer level controller in MANUAL.
1.3.2 Start and/or stop the charging pumps to match letdown flow as closely as possible (this would involve placing two charging pumps in OFF, which would reduce charging flow to 44 gpm).
1.3.3 Adjust the Pressurizer level controller to match letdown and charging flow (this would involve raising the output in MANUAL to raise letdown flow to match the charging flow of 44 gpm).
1.3.4 Monitor Pressurizer level and maintain it stable.
5
ARP SO23-15-50. A.1 (see pages 14,15,62 Attachment A) then directs follow up' actions to determine the cause of the instrument problem and its correction, including transfer to the alternate pressurizer level control channel.
QUESTION 4 The proposed reduction in allowable pressurizer water level for operability from 60 percent to 57 percent includes an assumed time allowed for operators to perform certain actions to mitigate two types of events: CVCS malfunction and inadvertent emergency core cooling system (ECCS) actuation during power operation. For these events, the proposal reduces the allowed operator response time from 30 minutes to 15 minutes. Questions a. through d.
below request information on the evaluations of these events.
QUESTION 4.a CVCS Malfunction Event The December 19,1997, submittal states that a full scope simulator was used to demonstrate that operators could recognize and terminate the CVCS malfunction event in approximately 5 minutes. The submittal also states that on March 2,1995, SONGS Unit 3 experienced a CVCS malfunction event and operator action "was implemented within approximately 5 minutes which terminated the event, demonstrating that an operator response time of 15 minutes can be accommodated." To fully evaluate the operator ability to mitigate the CVCS malfunction event in the reduced time allowed, please provide the following additional information:
RESPONSE 4.a
- 1) Describe the composition of the crew (s) used in the simulator evaluation (i.e., full crew complement verses minimum crew complement; experienced licensed operators verses inexperienced licensed operators or combination; verses simulator instructors).
The simulator evaluation was performed with a normal full crew complement oflicensed Operators with a mix of experience. Although only one Operator is required on the control boards to take the actions, the second Operator is performing cross-checking (peer-checking) and following up with the alarm response procedure. The Senior Reactor Operator (SRO) is providing oversight.
- 2) What portion of SONGS operating crews have been evaluated on the simulator? If all crews have not been evaluated on the scenario, what basis does the licensee have for believing that all crews can perform reliably within the time required? Have all crews evaluated on the simulator performed successfully? If the crews have performed 6
unsuccessfully on the scenario, what has been done to address the performance deficiencies?
The CVCS Malfunction event is a routine training task which is mn for all SONGS licensed operating crews on a minimum once per two year frequency. All crews have been evaluated on the simulator and have performed satisfactorily. This evaluation credits crew training scenario performance debriefs, as critiqued by the Operations Shift Manager and Nuclear Training Division (NTD) training personnel, to ensure all appropriate technical and good operating practice areas are adequately addressed.
- 3) Were the operators " naive" to the event, i.e., were they unaware that they would be evaluated on the event, or did they have advance knowledge of the scenario on which they would be evaluated?
Yes, the Operators were naive to the initial event described in the submittal. To ensure operator skill assessment the normal training scenarios are not advertised to the crews.
- 4) Describe the steps and actions that are required by the operators to mitigate this event and provide a copy of the steps / operator actions as they appear in the associated procedures.
As discussed in the response to Question 3, the CVCS Malfunction event (e.g., failure of the controlling pressurizer level channel transmitter) would initiate erroneous indications oflow pressurizer level. That is, pressurizer level would actually be at the normal program level, but the control system would "think" level was low as a result of the instrument failure. The automatic response of the control system would then be to try to " refill" the pressurizer to its programmed level, when in actuality this response would cause actual pressurizer level to be driven above normal.
For the CVCS Malfunction event, Alarm Response Procedure (ARP) SO23-15-50. Al ensures the following required ARP operator actions are taken. (See Attachment A pages 14 and 62 of ARP SO23-15-50. A.1 - applicable steps are listed under sections 1.0, " Required Actions") :
Action 1.1 Ensure maximum charging flow and minimum letdown flow.
1.2 Ensure all Pressurizer Heaters are De-energized.
1.3 Determine if Letdown and Charging Systems are responding as desired.. If not, then:
1.3.1 Place the Pressurizer level controller in MANUAL 7
l o
l.3.2 Start and/or stop the charging pumps to match letdown flow as closely as possible (this would involve placing two charging pumps in OFF, which would reduce charging flow to 44 gpm).
1.3.3 Adjust the Pressurizer level controller to match letdown and charging flow (this would involve raising the output in MANUAL to raise letdown flow to match the charging flow of 44 gpm).
1.3.4 Monitor Pressurizer level and maintain it stable.
These actions will also effectively terminate any pressurizer overfill.
- 5) Were changes to any procedures required as a result of this proposal? If so, please describe the changes and the training provided the operators on the changes.
No procedure changes were required for dealing with the analyzed events, thus no new training was required.
- 6) Are all required operator actions performed from the control room, or are local actions necessary? Iflocal actions are necessary, how were they simulated and evaluated? Do local actions cause the operators to be placed in an inhospitable environment?
All actions are performed from the control board on one section of the control boards. Only one Operator is required, with a second Operator cross-checking his/her actions.
- 7) What are the consequences of the operator / crew not taking the required actions in the j
time allowed? What actions would the operator / crew perform to recover from not taking the actions in the required time?
There are many indications, alarms, and Plant Protection System (PPS) trips which respond to this condition, alerting the Operators that corrective action is needed. The operator action is expected to be taken early in the 15 minute design basis operator action time. If the Operators did not take the required actions within the 15 minute design basis, then the pressurizer would slowly fill and the VCT level would drop. The Control Room will receive an additional alarm on low VCT level.
Eventually the pressurizer begins to go solid and RCS pressure begins to rise. At the high pressurizer pressure trip setpoint the reactor will trip, resulting in a volume reduction in the RCS as a result of the negative reactivity addition to the core. The volume reduction would re-establish a steam bubble in the pressurizer and would prompt operr. tor action which would correct the charging / letdown mismatch.
8 1
1
e GllES110N 4.h
- b. Inadvertent Operation of ECCS Duri g Power Operation Event 9
i The December 19,1997, submittal does not adequately describe a basis for supporting the conclusion that operators can mitigate this event within the 15 minute time allowed. The submittal identifies the potential cause for this event as operator error (i.e., inadvertent actuation of safety injection actuation signal) which results in an unplanned increase in reactor inventory and pressurizerlevel. The submittal further states that this moderate frequency event has consequences which "are less adverse than the CVCS malfunction event... and there is at least as much time for operator action as in the CVCS malfunction event. Therefore, there is at least 15 minutes for the operator to correct the malfunction and prevent filling of the pressurizer."
The submittal does not provide evidence that operators can successfully mitigate this event in the time allowed. Please address the seven questions (4.a.1 through 4.a.7) previously identified for the CVCS malfunction event as they relate to the inadvertent operation of ECCS during power operation event.
RESPONSE 4.h
- 1) Describe the composition of the crew (s) used in the simulator evaluation (i.e., full crew complement verses minimum crew complement; experienced licensed operators verses inexperienced licensed operators or combination; verses simulator instructors).
Routine simulator evaluations of operator response to the Inadvertent ECCS Operation event are performed with a normal full crew complement oflicensed Operators with a mix of experience.
Although only one Operator is required on the control boards to take the actions, the second Operator is performing cross-checking (peer-checking) and following up with the alarm response procedure. The Senior Reactor Operator (SRO)is providing oversight.
- 2) What portion of SONGS operating crews have beert evaluated on the simulator? If all crews have not been evaluated on the scenario, what basis does the licensee have for believing that all crews can perform reliably within the tiine required? Ilave all crews evaluated on the simulator performed successfully? If the crews have performed unsuccessfully on the scenario, what has been done to address the performance deficiencies?
The inadvertent ECCS Operation event is a routine training task which is run for all SONGS licensed operating crews on a minimum once per two year frequency. All crews have been evaluated on the simulator and have performed satisfactorily. This evaluation credits crew training scenario performance debriefs, as critiqued by the Operations Shift Manager and Nuclear Training Division (NTD) training personnel, to ensure all appropriate technical and good 9
1 operating practice areas are adequately addressed.
- 3) Were the operators " naive" to the event, i.e., were they unaware that they would he evaluated on the event, or did they have advance knowledge of the scenario on which they would be evaluated?
Yes, the Operators were naive to the initial event described in the submittal. To ensure operator skill assessment the normal training scenarios are not advertised to the crews.
- 4) Describe the steps and actions that are required by the operators to mitigate this event and provide a copy of the steps / operator actions as they appear in the associated procedures.
Alarm UA57A(B)l,"SIAS TRAIN A(B) ACTUATION," would cause the Operators to initiate Abnormal Operating Instruction SO23-13-17 " Recovery from Inadvertent Safety Injection, Containment Isolation or Containment Spray." This procedure requires Operators to take the
{
following actions (See Attachment "B" AOI SO23-13 significant actions are 3.2,3.4.1, 3.4.2,3.6.1, and 3.6.2):
Actions within 3.2:
3.2.1 Verify Pressurizer Pressure above SIAS setpoint (1740 psia).
3.2.2 Verify Containment Pressure below SIAS/CIAS setpoint (3.4 psig).
3.2.3 Verify Core Exit Saturation Margin greater than 20 degrees F.
3.2.4 Verify Pressurizer Level at least 27%.
If the above four criteria are satisfied the actuation is determined to be inadvertent and the procedure directs the Operators to perform the following actions:
Actions within 3.4:
3.4.1 Initiate verification of proper actuation of Safety injection Actuation Signal (SIAS)/ Containment Cooling Actuation Signal (CCAS).
3.4.2 Perform actions to recover from an inadvertent SIAS per section 3.6.
Actions within 3.6:
3.6.1 Reduce Turbine Load as necessary to maintain Turbine Power matched with Reactor Power 3.6.2 Ensure Chemical Volume Control System (CVCS) letdown isolation, then Override and Stop all Charging Pumps These actions will effectively terminate any pressurizer overfill.
10
1
- 5) Were changes to any procedures required as a result of this proposal? If so, please describe the changes and the training provided the operators on the changes.
No procedure changes were required for dealing with the analyzed events, thus no new training was required.
- 6) Are all required operator actions performed from the control room, or are local actions necessary? Iflocal actions are necessary, how were they simulated and evaluated? Do local actions cause the operators to be placed in an inhospitable environment?
All actions are performed from the control board on one section of the control boards. Only one Operator is required, with a second Operator cross-checking his/her actions.
- 7) What are the consequences of the operator / crew not taking the required actions in the time allowed? What actions would the operator / crew perform to recover from not taking the actions in the required time?
There are many indications, alarms, and Plant Protection System (PPS) trips which respond to this condition, alerting the Operators that corrective action is needed. The operator action is expected to be taken early in the 15 minute design basis operator action time. If the Operators would not take the required actions the RCS will be charged with borated water from the Boric Acid Make Up Tank. This boration would reduce the severity of the Inadvertent ECCS Operation event to be bounded by the CVCS Malfunction event previously discussed in the response to Question 4.a.7.
QUES 110N 4.c CVCS Malfunction with Concurrent Sinele Failure of an Active Component (Loss of 1
Offsite Power (LOOPn The December 19,1997, submittal does not provide a basis to conclude that operators can mitigate this infrequently occurring event within the 15 minute time allowed. The evaluation in the submittal states that 15 minutes can elapse before operator action is necessary; however information is not provided to demonstrate that operators can accomplish the actions required in the time allowed.
Please address the seven questions (4.a.1 through 4.a.7) identified for the CVCS malfunction event as they relate to the CVCS malfunction with concurrent single failure of an active component event.
I1
1 RESPONSE 4.c
- 1) Describe the composition of the crew (s) used in the simulator evaluation (i.e., full crew complement verses minimum crew complement; experienced licensed operators verses inexperienced licensed operators or combination; verses simulator instructors).
Routine simulator evaluation of operator response to the CVCS Malfunction event, without LOOP, is performed with a normal full crew complement oflicensed Operators with a mix of experience. Routine simulator evaluation of operator response to the LOOP event is performed with the same crew complement. Although only one Operator is required on the control boards to take the actions, the second Operator is performing cross-checking (peer-checking) and following up with the alarm response procedure. The Senior Reactor Operator (SRO)is providing oversight.
The operator actions, during the 15 minute response time, needed to mitigate the CVCS Malfunction event and the CVCS Malfunction plus single failure (CVCS+SF) event are similar.
This is because the initial portions of the two events (up until the time of reactor trip and the i
concurrent LOOP) are the same. Thus, the training conducted for the CVCS Malfunction event is applicable to the initial portion of the CVCS+SF event. Following the reactor trip, the operator actions for the charging and letdown systems not operating as desired (as specified in the response to Question 4.a.4) are taken. These actions are also the same for the two events, so the training for the CVCS Malfunction event is applicable to this portion the CVCS+SF event. Note that due to the presence of the single failure (the loss of offsite power), there are additional actions being performed for the CVCS+SF event associated with recovery of the plant from a loss of offsite power but these do not adversely affect the recovery actions for the CVCS malfunction portion of the event, as indicated in the response to Question 4.c.4.
- 2) What portion of SONGS operating crews have been evaluated on the simulator? If all crews have not been evaluated on the scenario, what basis does the licensee have for believing that all crews can perform reliably within the time required? Ilave all crews evaluated on the simulator performed successfully? If the crews have performed unsuccessfully on the scenario, what has been done to address the performance deficiencies?
As discussed in the response to Question 4.a.2, the CVCS Malfunction event is a routine retraining task which is run for all SONGS licensed Operators on a minimum once per two year l
frequency. The LOOP (single failure) event which would result at the time of reactor trip is also a routine retraining task. Training on the LOOP event and associated mitigating actions is conducted on the simulator for all SONGS licensed Operators with a minimum frequency of once per year. All crews have been evaluated on the simulator for both events and have performed satisfactonly. This evaluation credits crew training scenario performance debriefs, as critiqued by the Operations Shift Manager and Nuclear Training Division (NTD) training personnel, to ensure all appropriate technical and good operating practice areas are adequately addressed.
l 12
)
- 3) Were the operators " naive" to the event,i.e., were they unaware that they would be evaluated on the event, or did they have advance knowledge of the scenario on which they would be evaluated?
Yes, the Operators were naive to the initial event described in the submittal. To ensure operator i
skill assessment the normal training scenarios are not advertised to the crews.
- 4) Describe the steps and actions that are required by the operators to mitigate this event and provide a copy of the steps / operator actions as they appear in the associated procedures.
The initial Pressurizer level transient will be mitigated as described in the response to Question 4.a.4. Alarm Response Procedure (ARP) SO23-15-50.A1 ensures the following required ARP operator actions are taken. (See Attachment A pages 14 and 62 of ARP SO23-15-50. A.1 -
applicable steps are listed under sections 1.0, " Required Actions") :
Action 1.1 Ensure maximum charging flow and minimum letdown flow.
1.2 Ensure all Pressurizer Heaters are De-energized.
1.3 Determine if Letdown and Charging Systems are responding as desired, if not, then:
1.3.1 Place the Pressurizer level controller in MANUAL.
1.3.2 Start and/or stop the charging pumps to match letdown flow as closely as possible (this would involve placing two charging pumps in OFF, which would reduce charging flow to 44 gpm).
1.3.3 Adjust the Pressurizer level controller to match letdown and charging flow (this would involve raising the output in MANUAL to raise letdown flow to match the charging flow of 44 gpm).
1.3.4 Monitor Pressurizer level and maintain it stable.
When the Reactor Trip / Turbine Trip occurs accompanied by the LOOP, the Operator will immediately initiate Emergency Operating Instruction (EOI) SO23-12-1 " Standard Post Trip Actions" and the subsequent EOI SO23-12-7 " Loss of Forced Circulation / Loss of OfTsite Power." These two EOls direct the Operator to perform the following actions. (See Attachment "C" EOI SO23-12 actions 5 and 12 and Attachment "D" SO23-12-7 [pages 3,18,39, and 122]- steps 1,2.a and 2.b and Attachment 1 [ step 3.a], Attachment 15 [ step 1] and Attachment 2
[ Floating Step (FS) 5 step g]):
13
L EOl SO23-12-1 (Attachment C) Actions:
1 Action 1
1 5 (p. 5 of 25)
Verify RCS Inventory Control criteria satisfied (Pressurizer level l
10-70% and trending to 30-60%).
If not, then ensure the Pressurizer Level Control System is operating in AUTO or MANUAL to restore Pressurizer level 12 (p.12 of 25)
Diagnose the Event in Progress EOl SO23-12-7 Actions:
Action i
I (p. 3 of 122)
Ensure SO23-12-1 STANDARD POST TRIP ACTIONS steps 2 through 12 - complete.
l 2.a (p.3 of 122)
Initiate Attachment 1, SAFETY FUNCTION STATUS CHECK. Action 3.a Safety Function Status Check to verify RCS Inventory Control (p.18 of 122)
Safety Function (Acceptance criteria: Begins with "PZR
[ Pressurizer] level: a) - between 10% and 70% AND - trending to between 30% and 60%." and continues as stated in the procedure).
2.b (p.3 of 122)
Initiate Attachment 15, FOLDOUT PAGE (p.122 of 122).
l 5 Action 1 If at least I steam generator is operating (Steam Bypass Control (p.122 of 122)
System / Atmospheric Dump Valves (SBCS/ADV), Feedwater I
I available), THEN INITIATE Attachment 2, FS-5 CHECK High Pressure Safety injection (HPSI) Throttle /Stop Criteria.
j FS-5.g STOP the charging pumps as required one at a time.
(p.39 of 122)
These actions will also efTectively terminate any pressurizer overfill.
- 5) Were changes to any procedures required as a result of this proposal? If so, please I
describe the changes and the training provided the operators on the changes.
l No procedure changes were required for dealing with the analyzed events, thus no new training was required 14 l
- 6) Are all required operator actions performed from the control room, or are local actions necessary? Iflocal actions are necessary, how were they simulated and evaluated? Do local actions cause the operators to be placed in an inhospitable environment?
All actions are performed from the control board on one section of the control boards. Only one Operator is required, with a second Operator cross-checking his/her actions.
- 7) What are the consequences of the operator / crew not taking the required actions in the time allowed? What actions would the operator / crew perform to recover from not taking the actions in the required time?
The many initial indications and plant alarms which respond to this condition and alert the Operators to take corrective actions are similar for the CVCS Malfunction event and CVCS Malfunction plus single failure (CVCS+SF) event, up until the time of trip and concurrent LOOP.
While the LOOP would initially reduce the increase in pressurizer level relative to the CVCS Malfunction event, due to the larger pressure drop concurrent with the loss of the RCPs, the general trend of slowly increasing the pressurizer level will occur. Therefore, the response to Question 4.a.7 for the CVCS Malfunction event is generally applicable to the CVCS+SF event.
QUES 170N 4.d Inadvertent Operation of ECCS Durine Power Operation with Concurrent Single Failure of an Active Component (LOOP)
The December 19,1997, submittal does not provide a basis for supporting the conclusion that operators can mitigate this infrequently occurring event within the 15 minute time allowed. The submittal states that the core and system performance parameters would be less adverse than those for a CVCS event with a single failure. "...[Tlhere is at least as much time for operator action as in the CVCS malfunction with a concurrent single failure event...".
Evidence is not provided that the operator actions required to mitigate this event can be performed successfully within the allowable time. Please address the seven questions (4.a.1 through 4.a.7) identified for the CVCS malfunction event as they relate to inadvertent ECCS operation with a concurrent single failure of an active component.
RESPONSE 4.d
- 1) Describe the composition of the crew (s) used in the simulator evaluation (i.e., full crew complement verses minimum crew complementt experienced licensed operators verses inexperienced licensed operators or combinationt verses simulator instructors).
Routine simulator evaluation of operator response to the inadvenent ECCS Operation event, 15
i a
without LOOP, is performed with a normal full crew complement oflicensed Operators with a mix of experience. Routine simulator evaluation of operator response to the LOOP event is performed with the same crew complement. Although only one Operator is required on the control boards to take the actions, the second Operator is performing cross-checking (peer-checking) and following up with the alarm response procedure. The Senior Reactor Operator (SRO) is providing oversight.
The operator actions, during the 15 minute response time, needed to mitigate the inadvenent ECCS Operation event and the Inadvertent ECCS Operation plus single failure (ECCS+SF) event are similar. This is because the initial portions of the two events (up until the time of reactor trip and the concurrent LOOP) are the same. Thus, the training conducted for the Inadvertent ECCS Operation event is applicable to the initial portion of the ECCS+SF event. Following the reactor trip, the operator actions for the charging and letdown systems not operating as desired (as specified in the response to Question 4.b.4) are taken. These actions are also the same for the two events, so the training for the Inadvertent ECCS Operation event is applicable to this portion the ECCS+SF event. Note that due to the presence of the single failure (the loss of offsite power), there are additional actions being performed for the ECCS+SF event associated with recovery of the plant from a loss of offsite power, but these do not adversely affect the recovery actions for the inadvenent ECCS operation portion of the event, as indicated in the response to Question 4.d.4.
j
(
- 2) What portion of SONGS operating crews have been evaluated on the simulator? If all crews have not been evaluated on the scenario, what basis does the licensee have for believing that all crews can perform reliably within the time required? Have all crews evaluated on the simulator performed successfully? If the crews have performed unsuccessfully on the scenario, what has been done to address the performance deficiencies?
As discussed in the response to Question 4.b.2, the Inadvertent ECCS Operation event is a routine retraining task which is run for all SONGS licensed Operators on a minimum once per two year frequency. The LOOP (single failure) event which would result at the time of reactor trip is also a routine retraining task. Training on the LOOP event and associated mitigating actions is conducted in the simulator for all SONGS licensed Operators with a minimum frequency of once per year. All crews have been evaluated on the simulator for both events and have performed satisfactorily. This evaluation credits crew training scenario performance debriefs, as critiqued by the Operations Shift Manager and Nuclear Training Division (NTD) training personnel, to ensure all appropriate technical and good operating practice areas are adequately addressed.
- 3) Were the operators " naive" to the event,i.e., were they unaware that they would be evaluated on the event, or did they have advance knowledge of the scenario on which they would be evaluated?
16
Yes, the Operators were naive to the initial event described in the submittal. To ensure operator j
skill assessment the normal training scenarios are not advertised to the crews.
- 4) Describe the steps and actions that are required by the operators to mitigate this event and provide a copy of the steps / operator actions as they appear in the associated
)
procedures.
Operator actions to mitigate the initial inadvertent ECCS (SlAS) actuation are as previously described in the response to Question 4.b.4. Alarm UA57A(B)l,"SIAS TRAIN A(B)
ACTUATION," would cause the Operators to initiate Abnormal Operating Instruction SO23 l 17 " Recovery from Inadvertent Safety Injection, Containment Isolation or Containment Spray."
This procedure requires Operators to take the following actions (See Attachment "B" AOI SO23-13 significant actions are 3.2,3.4.1,3.4.2, 3.6.1, and 3.6.2):
1 Actions within 3.2:
1 3.2.1 Verify Pressurizer Pressure above SIAS setpoint (1740 psia).
I 3.2.2 Verify Containment Pressure below SIAS/CIAS setpoint (3.4 psig).
3.2.3 Verify Core Exit Saturation Margin greater than 20 degrees F.
3.2.4 Verify Pressurizer Level at least 27%.
If the above four criteria are satisfied the actuation is determined to be inadvertent and the procedure directs the Operators to perform the following actions:
Actions within 3.4:
3.4.1 Initiate verification of proper actuation of Safety injection Actuation Signal (SIAS)/ Containment Cooling Actuation Signal (CCAS).
3.4.2 Perform actions to recover from an inadvertent SIAS per section 3.6.
Actions within 3.6:
3.6.1 Reduce Turbine Load as necessary to maintain Turbine Power matched with Reactor Power 3.6.2 Ensure Chemical Volume Control System (CVCS) letdown isolation, then Override and Stop all Charging Pumps These actions will effectively terminate any pressurizer overfill.
When the Reactor Trip / Turbine Trip and LOOP occur, the Operator will immediately initiate Emergency Operating Instruction (EOI) SO23-12-1 " Standard Post Trip Actions" and the subsequent EOI SO23-12-7 " Loss of Forced Circulation / Loss of Offsite Power." These two EOls direct the Operator to perform the following actions. (See Attachment "C" EOls 17
SO23-12 actions 5 and 12 and Attachment "D" SO23-12-7 [pages 3,18,39, and 122] -
steps 1,2.a and 2.b and attachment 1 [ step 3.a], attachment 15 [ step 1] and attachment 2
[ Floating Step (FS) 5 step g]):
EOl SO23-12-1 Actions:
Action 5 (p. 5 of 25)
Verify RCS Inventory Control criteria satisfied (Pressurizer level 10-70% and trending to 30-60%).
If not, then ensure the Pressurizer Level Control System is operating in AUTO or MANUAL to restore Pressurizer level 12 (p.12 of 25)
Diagnose the Event in Progress EOI SO23-12-7 Actions:
Action i
I (p. 3 of 122)
Ensure SO23-12-1 STANDARD POST TRIP ACTIONS steps 2 through 12 - complete.
2.a (p.3 of 122)
Initiate Attachment 1, SAFETY FUNCTION STATUS CHECK. Action 3.a Safety Function Status Check to verify RCS Inventory Control (p.18 of 122)
Safety Function (Acceptance criteria: Begins with "PZR
[ Pressurizer] level: a) - between 10% and 70% AND - trending to between 30% and 60%." and continues as stated in the procedure).
2.b (p.3 of 122)
Initiate Attachment 15, FOLDOUT PAGE (p.122 of 122). 5 Action 1 If at least I steam generator is operating (Steam Bypass Control (p.122 of 122)
System / Atmospheric Dump Valves (SBCS/ADV), Feedwater available), THEN INITIATE Attachment 2, FS-5 CHECK High l
Pressure Safety injection (HPSI) Throttle /Stop Criteria. FS-5.g STOP the charging pumps as required one at a time.
(p.39 of 122) j These actions will also effectively terminate any pressurizer overfill.
18
o
- 5) Were changes to any procedures required as a result of this proposal? If so, please describe the changes and the training provided the operators on the changes.
No procedure changes were required for dealing with the analyzed events, thus no new training was required.
- 6) Are all required operator actions performed from the control room, or are local actions necessary? Ifloca! actions are necessary, how were they simulated and evaluated? Do local actions cause the operators to be placed in an inhospitable environment?
All actions are performed from the control board on one section of the control boards. Only one Operator is required, with a second Operator cross-checking his/her actions.
- 7) What are the consequences of the operator / crew not taking the required actions in the time allowed? What actions would the operator / crew perform to recover from not taking the actions in the required time?
The many initial indications and plant alarms which respond to this condition and alert the Operators to take corrective actions are the same for the Inadvertent ECCS Operation event and Inadvertent ECCS Operation plus single failure (ECCS+SF) event, up until the time of trip and concurrent LOOP. While the LOOP would initially reduce the increase in pressurizer level relative to the Inadvertent ECCS Operation event, due to the larger pressure drop concurrent with the loss of the RCPs, the general trend of slowly increasing the pressurizer level will occur.
Therefore, the response to Question 4.b.7 for the Inadvertent ECCS Operation event is generally applicable to the ECCS+SF event.
QUESTION 4.e
- c. Feedwater System Pine Break Event The December 19,1997, submittal states that the feedwater system pipe break event is a
" limiting fault event" and " sensitive to pressurizer water volume." The submittal states that operator action can be deferred until 30 minutes into the event without consequences if operators take the required actions at that time.
Please provide a basis for the conclusion that operators can mitigate this event within the 30 minute time allowed after the event is initiated. Address the seven questions (4.a.1 through 4.a.7) identified for the CVCS malfunction event as they relate to feedwater system pipe break.
RESPONSE 4.e Thirty minutes is the existing and original design basis operator response time for the feed system 19 1
i
pipe break transient. PCN-470 did not reduce the operator action time for this event. The feed system pipe break transient presented in this PCN provides the analysis assuming the 57%
pressurizer level to demonstrate that the acceptance criteria of no water flow through the pressurizer safety valves for the limiting peak pressure case will be met. Peak pressurizer volume occurs within 60 seconds (see Figure 15.2-41), after which level stabilizes and no operator action is required for the remaining 30 minutes. The feed system pipe break analysis in PCN 470 did not result in any adverse changes to the expected plant response or operator response for this event.
)
In addition, no emergency procedure changes were required to accommodate the reanalysis of this event.
QUESTION 4.f i
- f. (Other Events Creditine Operator Action) i in addition to the preceding events, the December 19,1997, submittal states that two other
{
events in the Updated FSAR take credit for operator action in less than 30 minutes (i.e.,
j within 15 minutes); dropped control rod assembly (CEA) and boron dilution events.
)
Regarding these two events, please clarify the purpose for citing these two events. Does crediting operator actions within 15 minutes for both these events constitute a change to the FSAR analysis previously reviewed by the stafr! If so, specifically, what has changed i
from their previous analysis and why? What operator actions are required to be taken for each of these events within the 15 minute time frames? What is the basis for concluding that operators can reliably take the actions required (i.e., see questions 4.a.1 through 4.a.7)?
RESPONSE 4.f The purpose of citing the dropped CEA and boron dilution events was to indicate that there is precedence for crediting less than 30 minute operator response for Chapter 15 events. The 15 i
minute response times for the dropped CEA and boron dilution events are unchanged from the UFSAR Chapter 15 analyses approved by the NRC for the SONGS 2 and 3 License. Neither the dropped CEA or boron dilution event analyses were adversely impacted by PCN-470. Since operator actions required to be taken for each of these events are not affected by this proposed change, they are not provided.
I ajb/470 rail 0 20 l
Responses to NRC Request for Additional Information on PCN 470 l
Attachments Attachment A - Alarm Response Procedure SO23-15-50.Al " Alarm Response Instruction" (pages 1,3,14,15, and 62-64)
Attachment B - Abnormal Operating Instruction SO23-13-17 " Recovery From Inadvertent Safety injection, Containment Isolation or Containment Spray" Attachment C - Emergency Operating Procedure SO23-12-1 " Standard Post Trip Actions" Attachment D - Emergency Operating Instruction SO23-12-7 " Loss of Forced Circulation / Loss of Off Site Power"(pages 1,3,18, 39, and 122) i
Attachment A - Alarm Response Procedure SO23-15-50.Al " Alarm Response Instruction" (pages I,3,14,15, and 62-64) i