ML20212N622
| ML20212N622 | |
| Person / Time | |
|---|---|
| Issue date: | 08/31/1986 |
| From: | Lam P NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20212N620 | List: |
| References | |
| TASK-AE, TASK-E609 AEOD-E609, NUDOCS 8608290040 | |
| Download: ML20212N622 (34) | |
Text
-
r 3
AE0D/E609 ENGINEERING EVALUATION REPORT
- INADVERTENT DRAINING OF PEACTOR VESSEL DURING SHUTDOWN COOLING OPERATION August 1986 Prepared by: Peter Lam Office for Analysis and Evaluation of Operational Data U. S. Nuclear Regulatory Commission 1
i I
This document supports ongoing activities of the Office for Analysis ar.d Evaluation of Operational Data and the Nuclear Regulatory Comission and i does not necessarily represent the position or requirements of the respon-sible program office.
0609290040 860808 NEXD pp PDR ORG i
7 -
)- t TABLE OF CONTENTS Page EXECUTIVE
SUMMARY
.......................................... 11
- 1. INTRODUCTION................................................ 1
- 2. BWR RESIDUAL HEAT REMOVAL SYSTEM PIPING CONFIGURATION AND 0PERATION................................................... 2 2.1 PHR Modes of 0peration................................. 2 2 ~. 2 Existing Measures to Prevent Inadvertant Draining...... 5
- 3. PEACTOR VESSEL DRAINING EVENTS.............................. 7
- 4. ANALYSIS OF 0PERATIONAL DATA................................ 17 4.1 Drain Paths............................................ 17 4.2 Human Performance Considerations....................... 18 4.3 Corrective Actions Taken or Planned.................... 20
- 5. EVALUATION OF SAFETY SIGNIFICANCE........................... 21 5.1 Qualitative Assessment of Safety Significance ......... 21 4
5.2 Quantitative Assessment of Safety Significance......... 22
- 6. GENERIC EVALUATIONS BY THF "RC AND INDUSTRY................. 25 l
l 7. FINDINGS AND CONCLUSIONS.................................... 26 l
! 8. SUGGESTIONS................................................. 27
- 9. REFERENCES.................................................. 29 8
e
( i 1
o EXECUTIVE
SUMMARY
In 1984, the Nuclear Regulatory Commission issued IE Information Notice 84-81,
" Inadvertent Reduction in Primary Coolant Inventory in BWRs During Shutdown and Startup," to all boiling water reactor (BWR) facilities. The information notice described five BWR operational events involving inadvertent draining of coolant from the reactor vessel. The five events occurred at three separate plants: Washington Nuclear Plant Unit 2 on August 7,1984 and again on August 23, 1984; LaSalle Unit 1 on June 11, 1982 and again on September 14, 1983; and Brunswick Unit 2 on September 24, 1984. Since the information notice was issued, additional operational events similar to those described in the information notice have occurred at six other plants. Prompted by these additional occurrences, the Office for Analysis and Evaluation of Operational Data initiated a generic analysis of the causes of these operating events, an evaluation of their associated safety significance, a review of the corrective actions already taken or planned at the involved plants, and an assessment of the need, if any, for additional corrective actions.
In broadest terms, the dominant causes of inadvertent reactor vessel draining are related to the operational and design problems associated with.the residual heat removal system when it is entering into or exiting from the shutdown cooling mode. During this transitional period water is drawn from the reactor vessel, cooled by the residual heat removal system heat exchangers (from the cooling provided by the service water system), and returned to the reactor vessel. First, there are piping and valves in the residual heat removal system which are common to both the shutdown cooling mode and other modes of operation such as low pressure coolant injection and suppression pool cooling. These valves, when improperly positioned, provide a drain path for reactor coolant to flow from the reactor vessel to the suppression pool or the radwaste system.
Second, establishing or exiting the shutdown cooling mode of operation is entirely manual, making such evolutions vulnerable to personnel and procedural errors. Third, there is no comprehensive valve interlock arrangement for all the residual heat removal system valves that could be activated during shutdown cooling. Collectively, these factors have contributed to the repetitive occurrences of the operational events involving the inadvertent draining of the reactor vessel. ,,
These events are judged to have medium safety significance because they marginally increase the likelihood of accidental radioactive releases in the BWR-2 release category in which a core-melt accident is postulated to
! progress without the benefit of containment integrity. On one hand, the lack i of containment integrity and the lessar requirement for engineered safety features during shutdown (e.g., the required number of operable systems or l trains of the emergency core cooling systems during shutdown is less than those during plant power operation, and automatic isolation of the residual heet removal system is not required during shutdown) tend to increase the probability of a significant accidental radioactive release. On the other hand, the rela-tively low heat production rate during shutdown (decay heat only), and the fact 11 l
that for modern boiling water reactors the reactor vessel can only be drained
, te expose the top one third 6f the core, allow time for operator intervention, which tends to reduce the probability of a significant accidental ra'dioactive release. A preliminary quantitative estimate indicates that these competing factors result in a marginal (about 5%) increase in the probability of an accidental release in the BWR-2 release category. In view of the severity of the BWR-2 release category which would involve a large amount of radioactivity, the 5% increase in release probability is considered to be of medium safety significance.
To reduce the likelihood of recurrence of these operating events, the following suggestions are presented.
(1). Install caution tags on the control room panel next to the hand switches for the suppression pool suction valves, shutdown cooling suction valves, test return valves, and minimum flow bypass valves, to remind plant personnel of the potential for inadvertent draining of the reactor vessel during shutdown cooling operation.
This corrective action would reduce human errors associated with inappropriate opening of residual heat removal system valves which can provide a drain path from the reactor vessel. Mispositioning of one or more of these valves was involved in seven of the 11 operational events reviewed. The presence of caution tags on the control panel next to the hand switches, when combined with appropriate training of plant operators, would be a cost-effective means of reducing personnel errors associated with positioning these valves during shutdown cooling operation.
l (2) Insert caution statements in the residual heat removal system operating l and surveillance procedures to alert plant personnel of the potential l _for inadvertent draining of the reactor vessel during the shutdown cooling mode of operation.
l l This corrective action is also incended to reduce human errors during shutdown cooling operation and the performance of surveillance testing of the residual heat removal system by reminding plant personnel of the potential for inadvertent draining of the reactor vessel when they are performing such procedures. Improved procedures, combined with appropriate training of plant operators, would reduce improper or inadvertent operator actions which were observed in five of the 11 operational events.
l l
iii
(3) Require that the automatic isolation function of the residual heat removal system is operable during shutdown cooling operation.
This corrective action would provide an additional safeguard in terminating an inadvertent draining of the reactor vessel. Presently, automatic isolation of the residual heat removal system is not required during shutdown cooling operation while the plant is in the refueling or cold shutdown modes. In two of the 11 operational events observed, auto-matic isolation capability of the residual heat removal system was either not available or seriously degraded. Therefore,'this corrective action would be helpful as an additional safeguard for terminating an inadvertent draining of the reactor vessel. This corrective action may be implemented either voluntarily by procedure or as a part of the plant technical specifications.
(4) Investigate the benefits and risk impacts of installing valve ,
interlocks for preventing the simultaneous opening of the shutdown cooling suction valve and the suppression pool suction valve when returning the residual heat removal system from the shutdown cooling mode to the low pressure coolant injection mode.
The lack of interlocks for the residual heat removal system valves for this evolution is primarily a result of the concern over degrading low pressure coolant injection operability (a major emergency core cooling system requirement). The low pressure coolant injection mode of operation is irrportant in reducing the reactor accident risks associated with the design basis loss-of-coolant accidents and anticipated transients. Therefore, a study should be conducted, prior to any installation of valve interlocks for preventing the simultaneous opening of the shutdown cooling suction valve and the suppression pool suction valve, to determine whether or not such an installation would adversely impact low pressure coolant injection reliability. The installation of valve interlocks on the residual heat removal system should only lead to a reduction of reactor accident risks associated with inadvertent draining of the reactor vessel during plant shutdown without incr' easing the reactor accident risks from design basis loss-of-coolant accidents and anticipated transients during power operation. If no significant adverse impact on low pressure coolant injection reliability results from an appropriately designed, installed, tested and maintained interlock system, licensees should consider installing such a system.
i'V l
1.0 INTRODUCTION
In 1984, the NRC Office of Inspection and Enforcement issued IE.Information Notice 84-81., " Inadvertent Reduction in Primary Coolant Inventory in Boilin Water Reactors During Shutdown and Startup," to all boiling water reactor (gBWR) facilities (Ref. 1). The information notice described five operational events involving an inadvertent drainage of coolant from the reactor vessel at three separate BWR plants. Since the information notice was issued, additional operational events similar to those described in the information notice have occurred at six other BWR plants. Prompted by these ' additional occurrences, the Office for Analysis and Evaluation of 0perational Data initiated an independent and generic analysis of the causes of these operating events, an evaluation of their associated safety significance, a review of the corrective actions already taken or planned at the involved facilities, and an assessment of the need for development of additional corrective actions. The results of this independent study are presented in the following sections of this report.
O 1
1
2.0 BWR RESIDUAL HEAT REV0 VAL SYSTEM PIPING CONFIGURATION AND OPERATI0t:
To aid the reader in reviewing the ope' rational events, a brief description is given in this section about the piping configuration of the residual heat removal (RHR) system, and the various modes of RHR operation. The focus here is to give the reader an overview of the RHR system piping design and operation .
relevant to the inadvertent draining of the vessel.
'2.1 RHR Modes of Operation The RHR system is a multi-purpose safety-related system which has five operational modes: low pressure coolant injection, shutdown cooling, suppression pool cooling, containment spray, and standby coolant supply. A brief discussion on each of these five modes of RHR operation is given below.
As shown in Figure 1, the RHR system is aligned for the low pressure coolant injection (LPCI) mode during normal power operation, with the suppression pool suction valves open and the 1.PCI injection valve closed. This valve alignment places the RHR in standby readiness for the LPCI mode of operation, during which the RHR pump will take water from the suppression pool and discharge it to the reactor vessel via the recirculation loop discharge piping when the LPCI iniection valve is opened.
The shutdown cooling mode is placed in operation manually during a normal reactor shutdown. When the reactor pressure has decreased to a sufficiently low value, about 100 psig, the inboard and outboard shutdown cooling suction isolation valves can be opened to allow water to be removed from the recirculation loop suction piping, through the shutdown cooling suction line to the RHR heat exchangers, and discharged back to one of the recirculation loop discharge lines via the open LPCI infection valve. The flow path of the shutdown cooling mode is illustrated in Figure 2.
The suppression pool cooling mode is placed in operation manually during plant normal operation to maintain normal suppression pool temperature limits,g or during a loss-of-coolant accident to keep the pool temperature below 170 F. To enter the suppression pool cooling mode, the RHR service water flow is first established, tien the suppression pool cooling / spray valve is opened. An RHR pump is started to take water from the suppression pool, pump it through the RHR heat exchanger, through the open suppression pool cooling / spray valve, and back to the suppression pool via the full flow test line.
2
t FORM RHR _ 2 2 SR ( E r, ,,
DIVISION 1 '
W i STAND 8V ggpogy T- l
= '
LPCI trJJECTION VALVE TO RHR DIVISION 1 7 ROM RHR ~
DIVISION I X X TORUS COOLING /
d b n- r5 SPRAY VALVE stECIR RE CIR RHR fl H R FORM RHR PUMP PUM P TORU HK A HR8 DevlSION 1 r,
I SHUTDOWN 7 '
h J COOLING L ISOLATION TEST LETURN LINE Nd bd VALVE
[ h SHUTDOWN I y p COOLING
'r L ISOLATION __y __.yi. r / g SHUTDOWN
- g magigyu
>4-N-
,gg N
,g, FLOW LINE PUMP PUMP SUC O L NE SHUTDOWN COOLING SHUTDOWN SUCTION VALVE ,, COOLING TORHR _
-, SUCTION DivtS80N 1 ~ 1' VALVE X R I ' SuCJi $$"Ji V ALVE VALWE TOR JS SUCTION LINE Figure 1 Residual Heat Removal System Valve Alignment During Normal Power Operation for a Typical BWR/4 Reactor witt a Mark I Containment 3
e i
O FORM RHR _ , , shn gNg DIVISION I v, ,,
' d b
_ = ==
T- lMl 1 i k
LPCI INJECTION VALVE
'"~
DIVISsON I FROM RHR DIVISION 4 X TORUS COOLING SPRAY VALVE M
r3 RE CIR g[Cgg gqq ggg 90RM RHR Div1SION I k F '
PUMP PUMP TORU HX A HR S SHUTDOWN ,,
1 OLA ON RETU N k> bd
, VALVE LINE
/ \
$HU TDOWN COOLING ~
'P. ISOL ATION 'ii
- : , >o-N- <>o-N-1
' SHUTDOWN MIN MUM FL LIN E py g p pygp SUC O L NE SHUTDOWN COOLING SHUTDOWN TO RHR _ SUCTION V ALVE COOLING DIVISION I ' SUCTION VALVE X R IV 5'S ' '
I SM"Yis" VALVE db Sui"?A VALVE l TORUS %UCTION tINF l
t l Figure 2 Residual Heat Removal System Shutdown Cooling Mode for a Typical BWR/4 Reactor with Mark I Containment 4
The containment spray mode is placed manually in operation to limit the temperature and pressure in containment after 'a loss-of-coolant accident. Two
. permissive conditions must be first satisfied: LPCI initiation and reactor vessel water level exceeding two-thirds core height. Water from the subpression pool is pumped through the RHR heat exchangers for heat removal, then is diverted to either the drywell spray spargers via two open drywell spray valves, or the torus spray spargers via en open suppression rool cooling / spray valve.
The standby coolant supply mode is used, if necessary, to flood the entire containment to a level above the top of the active fuel after a luss-of-coolant accident. This mode of operation requires connecting the RHR service water system discharge to the RHR system discharge (downstream of the outlet for the RHR heat exchangers) by opening locked closed, hand-opemted valves. The flow can be diverted to either the reactor' vessel, the suppression pool, or the containment spray spargers.
2.2 Existing Measures to Prevent Inadvertent Draining The elevation of the reactor vessel is significantly hiper, by about 100 feet, than that of the suppression pool. This difference in elevation, coupled with the various manual modes of RHR operation, creates a need for preventing the inadvertent draining of the reactor vessel. Several measures are already in place and are briefly discussed below. . .
First, to prevent the inadvertent draining of the reactor vessel during the switchover from the LPCI standby mode to the shutdown cooling mode, the shutdown cooling suction valves are interlocked with the suppression pool suction valves. The interlock prevents a shutdown cooling suction valve from opening unless the suppression pool suction valve associated with the same RHR pump is fully closed. Second, various procedural controls are in place to ensure that at least one valve remains closed on each potential drain path from the reactor vessel to the suppression pool. For example, the LPCI . injection valve, the suppression pool cooling / spray valve, the torus spray valvo, the drywell spray valves, and the test return valve are normally closed.
Furthermore, reverse flow check valves are installed on the LPCI injection line, the RHR pump discharge lines, and the minimum flow line. Finally, as a .
third measure for preventing the draining of the reactor vessel during shutdown cooling operation, automatic closure of the shutdown cooling suction line isolation valves (inboard and outboard) will occur when reactor vessel water-level reaches low level. The low reactor vessel water level signal will also close the LPCI infection valve during the shutdown cooling mode of operation.
Currently, most plant technical specifications do not require that the autonatic 5
closure feature of the shutdown cooling suction line isolation valves be operable during shutdown cooling. However, as a good practice, a majority of the operating plants do have such an automatic isolation capability during shutdown cooling operation. Despite these existing measures to prevent an inadvertent draining of the reactor vessel, operational events involving an inadvertent vessel draining occurred rather frequently in the past four years, for a variety of reasons. These reasons are discussed in the next section.
4 l
i 9
l ,.
s.
t
' 6
, e-
.F> ,
i-3.0 REACTOR VESSEL DRAINING EVENTS 4
A total of 11 operational events involving the inadvertent draining of coolant from the reactor vessel occurred at nine different plants in the past four years. These operational events are briefly described below.
LaSalle Uaf t -TILER 82-042)
On June 11, 1982, LaSalle Unit I was in initial startup testing with
'< unirradiated fuel in the core. The "B" loop of the RHR system was operating in the shutdown cooling mode and the "A"~ loop of the RHR system was aligned in the standby LPCI mode. In order to conduct a local leak rate test on the "A" loop drywell spray line outboard isolation valve, a portion of the loop (between the outbcard isolation valve and the PHR heat exchanger) was drained. After the test was completed the "A" loop was returned to the standby mode. During the change in valve alignment, 3,000 gallons of reactor coolant flowed from the reactor vessel into the previously drained piping. Reactor vessel water level dropped below +12.5 inches, initiating a reactor scram and an isolation of the RHR loop "B". shutdown cooling suction line. After the scram and isolation were reset, the RHR loop "B" was verified filled and vented, and shutdown cooling was restored.
As a corrective action, plant personnel were counseled on the potential of inadvertentiy' draining the reactor vessel. The shutdown cooling procedure was also revised to include caution statements concerning rapid reactor vessel water level fluctuations.
Grand Gulf Unit 1 l ijn April 3,1983, with Grand Gulf Unit 1 in cold shutdown, plant personnel were foilowing a procedure to realign the RHR systen to the LPCI standby readiness configuration after a surveillance test of the RHR shutdown ' cooling suction line isolation valves. Misled by a burnt cut "open indication" light bulb on a control room panel board, the operator thought the shutdown cooling suction valve was closed while in fact it was still partially open. Believino that the
[ valve was closed, the operator proceeded to open the suppression pool suction l valve which w'as the next step of the LPCI realignment procedure. With the shutdown cooling suction valve still open, opening the suppression pool suction valve resulted in a direct drain path between the reactor vessel and the suppress (on pool (see Figure 3). The reactor vessel water level
! rapidly dropped about 50 inches, from +42 to -8 inches. Automatic isolation of l
i 7
s
~
t t
O
/ \ CRvWELL FORM RHR a 2 SPRAYteNF DiviStON I e' r '
W g W k STANDBY COOtANT 74 :
T- "
l!l l
. Ili I ir k
L PCi lN JE C TION VALVI TO RHR D VISION 1 FROM RHR DIVISION I g d
TORUS COOtthG SPR AY V As * " r5 RECIR RE CSR RHR RHR FORM RHR PUMP HI A HA B PUMP TORU DIVIS40N I k
"' SHUYDOWN r' IOA ON RETU N k# kd VALVE k LINE
/ \
~ "'
SHUT DOWN
~~
I OLA ON VALVE 1 r SHUTDOWN s :: s .>o-N-MiNiMcM ,,g,
+o-N-pgg FL W Le E PUM P PUMP SUC O L NE d i SHUTDOWN COOttNG SHU T DOWN TO RHR SUCTION vat vf COOLING DIVISION g _
SU TION R
YO RHR TORUS TORUS DevaSION I SUC 7 TON buCTION VALVE VALVE Toni!9 St.f f TON q sNF Figure 3 Drain Path from Reactor Vessel tc Torus via an Open LPCI Suction Line 8
the shutdown cooling inboard and outboard isoletion valves at about +10 inches terminated the rapid draining of the reactor vessel. During the event, the fuel remained covered, and the RHR' pumps, the high pressure core spray and low pressure core spray systems were operable but were not challenged.
LaSalle Unit 1 (LER 83 105)
On September 14, 1983, the plant staff at LaSalle Unit I was performing a routine RHR system relay logic surveillance test while the plant was in cold shutdown. Unaware that the LPCI loop "B" testable isolation check valve was stuck open and the manual valve downstream of the testable isolation check valve was inadvertently open, the plant staff opened the RHR loop "B" injection valve as required by the test precheck. When the injection valve was opened, a rapid decrease in reactor vessel water level was observed. Water level dropped quickly from +50 inches to 0 inches, causing a Group VI containment isolation (closure cf 4hc shutdown cooling suction line isolation valves) at +12.5 inches. Although automatic containment isolation was not' required to be operable while the plant was in the shutdown or refueling mode, it was available and closed the shutdown cooling suction line isolation valves during the event. Most of the water lost from the reactor vessel flowed to the suppression pool via an open test return line (see Figure 4), while some went to the drywell via an open drywell spray.line. The operator quickly secured the valve lineup on these lines.
As corrective' actions, the licensee repaired the testable isolation check valve on the LpCI "B" loop, and revised the surveillance procedure to require that the manual valve downstream of the testable isolation check valve be closed prior to the RHR surveillance test.
LaSalle Unit 2 (LER 84-009) -
On March 8, 1984, LaSalle Unit 2 was in cold shutdown with the RHR long "A" in the shutdown cooling mode of operation. An inadvertent isolation signal for RHR loop "A" was generated by personnel working on an RHR equipment area high temperature switch. The injection valve on locp "A" closed as designed, but the outboard shutdown cooling isolation valve did not due to an inadvertently open
~
valve breaker. This placed the RHR pump in loop "A" at shutoff head conditions and caused the minimum flow valve on loop "A" to open. Reactor coolant was pumped by the RHR pump to the suppression pool via the minimum flow line. This l
l 9
e f
I l
/
O
- \ DRVWELL FORM RHR . a m SPR AV LINE DIVISION I r , r ,
l.
M k STANOBY COOLANY 7; _
SUPPL Y T--]lll ' LPCI INJE CTION
~
- valve go ,g, FROMRHR ,
DIVISION i s
i1 TORUS COOLING-SRR AY VALVE r5 Rf C'R REC 8R RHR RHR FORM RHR PUMP HX A HM B PUMP TORU DIVISION a k
"' SHUTDOWN r ,
q h J I
COOT tNG L ISOL ATION TEST RETURN LINE Ad Ad m VALVE
/ ..
SHUTDOWN 3 I COOT tN G y -
~
I f L ISOLATION /~ '
VALVE SHUYDOWN MINIMUM pun nun FL W L.NE PUM P PUMP SUC O L NE SHUIDOWN COOLING SHUTDOWN YO RHR _
SUCTION VALVE , , COOLING DivlSION t ' r , SUCTION 1' VALVE X a ir TORUS TORUS D VIS NI SUCTION SUCTION VALVE VALVE TORtf 9 *,11CTION [ gNF 1
i l
Figure 4 Drain Path from Reactor Vessel to Jorus via an Open LPCI Injection Line and an Open Test Return Line 1 10 l
i l
o 3
led to a decrease in reactor vessel water level of about 60. inches (see Figure 5). The level decrease was manually terminated when the operator tripped the RHR pump after a reactor vessel low water level alarm was received. Automatic RHR isolation capability for the inboard shutdown cooling isolation valve was available but was not challenged, since water level was above the +12.5 inches setpoint.
As corrective actions, the licensee counseled plant personnel about potential drain paths of the reactor vessel and revised the valve breaker repair procedure.
Washington Nuclear Plant Unit 2 (LER 84-091)
On August 23, 1984, the loop "B" of the RHR system at Washington Nuclear Plant Unit 2 was being warmed as the plant was going to cold shutdown from low power.
The outboard shutdown cooling suction line isolation valve closed as a result of a high-flow isolation signal. Because it was not alarmed in the control room, the valve closure was not noticed by plant personnel for about 15 minutes. The closed suction line isolation valve allowed water in the isolated RHR line to drain to the radwaste system via an open discharge valve, thus emptying the line of water. When the suction line isolation valve was reopened by plant personnel, water from,the reactor vessel flowed into the voided line, causing a rapid drop of reactor vessel water level of about 25 inches. The rapid decrease of reactor vessel water level was noticed by the operator who then reclosed the suction line isolation valve. When the reactor vessel water level dropped to +12.5 inches, a reactor scran was initiated and the RHR system automatically isolated.
As a corrective action, a plant modification was made to provide an audible annunciation in the control room for the closure of shutdown cooling suction line isolation valves.
Brunswick Unit 2 (LER 84-011)
On September 24, 1984, with the Brunswick Unit 2 plant in cold shutdown, the "B" loop of the PHR system was aligned in the shutdown cooling mode and an integrated containment leak rate test was in progress. An operator, mistakenly thinking that the loop was in the suppression pool cooling mode, opened the discharge valves to the radwaste system in order to lower the suppression pool level. The open discharge valves allowed reactor coolant to drain from the reactor vessel to the radwaste system. A reactor scran was initiated and the RHR system isolated on low reactor vessel water level. The operator, recognizing his error, immediately reclosed the discharge valves to the.
.adwaste systen.
1 i
11
e o
O
/ \ DRvWELL FORM RHR _ 2 a %PR AY LINE DIVISION 4 7 7 7 m W L STAND 8v COOL A N T 7[ ;
. SUPPL Y FROM RHH T- ir LPCII VALVE TION YO RHR DIVISeON I DIVI $10N I y d b TOR'JS COOttNG I
$PRAV VALVE 5 R E CiR RECIR RHR RHR MA MS D VI 10 [, #
gp,OR Av NF r' SHUTDOWN r '
COOLING TEST ISOL ATION RETURN k# k#
V ALVE LINE
- s
~
SHU T D0WN
~ '
Wl'LAOON VALVE
/ ]
- g N N 1 r SHUTDOWN MINIMUM RHR RHR Il L' E PUMP PUMP
, SUC O L NE SHUTDOWN COOLING $HL'YDOWN TO RHR _
SUCTION V AlvE COOLING DIVISION I - SU TION X RL o
DIv sS e sifC""'
VALVE ON # sifC YO~
d b VALVE TORut $UCTION LIN8
( '
1 l
i I
l Figure 5 Drain Path from Reactor Vessel to Torus via the Minimum Flow Line 12
)
As corrective actions, the licensee counseled and disciplined the operator and included the event in plant personnel training sessions. The licensee also revised the procedures for the integrated containment leak rate test to require additional operator monitoring of the RHR system.
Washinoton Nuclear Plant Unit 2 (LER 85-030)
On May 7, 1985, with Washington Nuclear Plant Unit 2 in cold shutdown (refueling mode), control room operators were in the process of raaligning loop "A" of the RHR system from the shutdown cooling mode to the standby LDCI lineup. '
The operator closed the shutdown cooling suction valve, and within 30 seconds, opened the suppression pool suction valve (see Figure 3). Since the stroke times for both valves are in the range of 90 to 100 seconds, a flow path
~
between the reactor vessel and the suppression pool existed for about 60 seconds. This allowed a rapid draining of reactor coolant to the suppression pool until the shutdown cooling suction valve fully closed, terminating the draining. The reactor vessel water level decreased to about +13 inches, causing a low water level reactor scram and an automatic isolation of the RHR system.
As corrective actions, the operators were counseled regarding their lack of attentidn to detail. Caution tags were also added to both the control room panel and the remote shutdown panel. Finally, plant procedures for RHR system valve realignments were revised.
Hatch Unit 2 (LER 85-014)
On May 10, 1985, with Hatch Unit 2 in the refueling mode, plant personnel were in the process of performing a surveillance test of the automatic depressurization system (ADS). Due to an inadequate surveillance test procedure, the two-min'ute ADS timer was allowed to time out, causing the seven ADS valves to open. The seven ADS valves remained opened for about 17 minutes.
During this time, reactor coolant drained to the torus via the main steamline and the safety relief discharge line (the mainsteam outlet nozzles were covered with water during the refueling outage). This led to a 42-inch drop in reactor vessel water level (from +195 inches to +153 inches from reference 7e ro) . The ADS valves were reclosed after the surveillance test was performed, terminating the water level decrease.
J 13
As a corrective measure, the ADS surveillance procedure was revised to include the opening of the . links for'the ADS valves to preclude valve actuation on an ADS initiation signal.
Shoreham (LER 85-31)
On July 26, 1985, with the Shoreham plant in' cold shutdown, a station operator
' was returning loop "A" of the RPR system from the shutdown cooling mode to the standby LPCI mode. During the valve realignment, the operator inadvertently opened the suppression pool suction valve before the shutdown cooling suction valve had fully closed. This resulted in a direct drain path from the reactor vessel to the suppression pool (see Figure 3). As a result, approximately,7,000 gallons of reactor coolant drained to the pool. When reactor vessel water level dropped to +12.5 inches, a low water level reactor trip occurred. An automatic closure of the shutdown cooling suction line isolation valves also occurred, terminating the water level decrease.
For corrective actions, the licensee counseled plant personnel on the generic implications .of the event, provided additional training of the RHR system operation, and revised the RHR system operating procedure. The licensee also considered plant modifications involving the installation of valve interlocks to prevent the opening of the RHR suppression pool suction valves while the RHR shutdown cooling suction valves are open.
River Bend Unit 1 (LER 85-008)
On September 23, 1985, prior to initial plant criticality, and during the performance of an 18-month emergency core cooling systems surveillance test, the River Bend Unit 1 operating staff was in the process of returning loop "A" of the RHR system from the shutdown cooling mode to the LPCI standby mode. The operator first closed the RHR shutdown cooling suction valve and immediately opened the suppression pool suction valve. The opening of the suppression pool suction valve before the shutdown cooling suction valve had fully closed led to a direct drain path from the reactor vessel to the suppression pool (see 14
9 Figure 3). Reactor vessel water level rapidly decreased by about 50 inches, causing a reactor scram on low water level (+9 inches on the narrow range instrumentation). The reduction in water level was terminated when the shutdown cooling suction valve fully closed. During the event the RHR system automatic isolation feature was inoperable.
Short-term corrective measures included adding a caution statement to the emergency core cooling systems test procedure to ensure that the PHR shutdown cooling suction valve is fully closed prior to the opening of the suppression pool suction valve. Caution tags were also added to the control room panel board near the hand switches for the suppression pool suction valves and the shutdown cooling suction valves. In the long term, the licensee intends to revise the test procedure to ensure that the RHR system automatic isolation ,
feature is made operable immediately following surveillance testing.
Furthermore, the feasibility of installing valve interlocks to prevent simultaneous opening of the suppression pool suction valve and the shutdown cooling suction valve are being investigated.
Peach Bottom Unit 2 (LER 85-020)
On September 24, 1985, witii Peach Bottom Unit 2 in cold shutdown, loop "A" of the RHR system was operating in the shutdown cooling mode. Responding to a request to operate the RHR pump "A" in the full flow test mode, the operator shut off the "A" RHR pump and closed the loop "A" shutdown cooling suction valve. Unaware that the loop "C" shutdown cooling suction valve had been inadvertently left open from a previous evolution of the RHR system, the operator opened the loop "A" full flow test return valves (see Figure 6).
This resulted in a direct drain path from the reactor vessel to the torus through the loop "C" piping. As vessel water level decreased, a reactor scram and containment isolation occurred on low reactor water level. This closed the inboard and outboard shutdown cooling suction line isolation valves on the RHR loop "A" and terminated the water level reduction. The loep "C" shutdown ecoling suction valve was subsequently closed by the operator. Reactor water level was automatically restored by the reactor feedwater system via the feedwater pump "C" bypass level control valve.
As a corrective action, the licensee counseled the operator involved on the use of procedures and on the potentiel of inadvertently draining the reactor vessel.
15
6* 9 e
O
/ \ ORVWELL FORMRHR . 2 2 SPR Av LINE v , v ,
Division I e
,D
$fANDSV i
' COOLANY 7( :
T- LPCII LVE flON TO RHR FROM RHR DIVI $10N I X iORus COOLING
$PR AY W ALVE 4 r$
RHR RHR RECIR R E CIR FORM RHR TORUS Q HR A HX B PUMP PUMP D8Vis10_Nui r2 Q $PRnvLtNF M2 r ,
~
F ' $ HUT DOWN 4ETU N \# Nd t$OLA ON v ,
/
VALVE s
h LINE
$HUTDOWN
~
'r t$OLA ON VALVE
- : >o+t- N
$HU T DOWN MINIMUM sing gn Il L' I PUMP PUMP SUC O L NE
$HUTDOWN COOLING $HU T OOWN SUCTION vatvE - COOtrNG TO RHR $UCTiON DIVISsON 1 ' bALVE <
X R v ,
II O RHR TORUS r TORUS SUCTION $UCTION VALVE b V ALVE TORil% $UC FION TINE f
f n
Figure 6 Drain Path from Reactor Vessel to Torus via an Open Test Return Line 4
16
4.0 ANALYSIS OF OPERATIONAL. DATA 4.1 Drain Paths A review of the RHR system configuration in various BWRs (from BWR/2 to BWR/6 ~
product lines) and the operational data collected in the previous section has identified six potential pathways for draining the reactor vessel during shutdown or startup. These drain paths are: (1) from the reactor vessel to the suppression pool via an open LPCI suction line as shown in Figure 3, (2) from the reactor vessel to the suppression pool via the RHR test' return line as shown in Figures 4 and 6, (3) from the reactor vessel to the suppression pool via the minimum flow bypass line as shown in Figure 5, (4) from the reactor vessel to the radwaste system, (5) from the reactor vessel to a voided RHR line, and (6) from the reactor vessel to the suppression pool via the main steam lines and ADS valves.,
Number of Drain Path Events Plants Reactor vessel to pool via 4 Grand Gulf, WNP-2, an LPCI suction line Shoreham, River Bend
, Reactor vessel to pool via an 2 LaSalle-1, Peach RHR test return line Bottom-2 Reactor vessel to pool via a 1 LaSalle-2 minimum flow line Reactor vessel to radwaste 1 Brunswick-2 system Reactor vessel to an emptied 2 LaSalle-1, WNP-2 PHR line Reactor vessel to pool via ADS 1 Hatch-2 valves As indicated by the above. table, the most frequent pathway for draining the reactor vessel is via the shutdown cooling' suction line and an open LPCI suction line to the suppression pool. This pathway was involved in four of the 11 operational events. The next most frequently occurring pathways are those involving the RHR test return line to the suppression pool, and from the reactor vessel to an emptied RHk line. Each of these pathways was observed in two operational events. ,
17 b
ao
- e
/
4.2 Human Performance Considerations To various degrees, all of the operational events involved human performance deficiencies. The observed human errors may be divided into six categories:
(1) deficient procedures (2) improper or inadvertent actions, (3) lack of
' knowledge or training, (4) man / machine interface problems, (5) cognitive errors, and (6) maintenance errors. The number of events associated with the above human errors is given below:
Number of Human Performance Deficiency Events Plants Deficient procedures 2 LaSalle-1, Hatch-2 Improper or inadvertent 5 LaSalle-2, WNP-2, actions Shoreham, River Bend, Peach Bottom-2 Lack of knowledge or training 1 Brunswick-2 Man / machine interface problems 1 WNP-2 Cognitive errors 1 Grand Gulf Maintenance errors 1 LaSalle-1 The human error cateaories above are not generally exclusive of one another.
For example, improper or inadvertent actions can be related to a lack of adequate knowledge or training, and man / machine interface problems can be traced to maintenance errors. Additionally, more than one human error category were often involved in the observed operational events. As illustrated in Table 1, six of the 11 operational events involved two different types of human errors. For example, a lack of knowledge or training appears to be the primary cause, and deficient procedures a secondary cause for the event at Brunswick-2 (LER84-11). The main point of the discussion here is that a variety of human errors have been observed in all the operating events as contributors to the inadvertent reduction in reactor coolant inventory during shutdown and startup.
Therefore, corrective actions to prevent recurrence of these events must necessarily deal with such human errors.
18 .
.s
~ - ~ - - , . . , . . - . - . . - - , . , . , , - , , . . , - ,--- , , . ,- -, -,
. i e
Table 1 Human Performance Deficiencies Associated with the Operational Events LCS-1 GGS-1 LCS-1 LCS-2 WNP-2 BEP-? WNP-2 EIH-2 SNS RBS-1 PPS-1
. 6/11/82 4/03/83 9/14/83 3/08/84 8/23/84 9/24/84 5/07/85 5/10/85 7/26/85 9/23/85 9/P4/85 Human Performance Deficiences Deficient prncedures P S P Improper or inadvertent action P P P P P Inadequate knowledge or training S S P S S
,. Man / machine interface
") deficiencies P Cognitive errors P -
Maintenance errors P Legend P Primary cause S Secondary cause LCS LaSalle Unit 1 GGS Grand Gulf Unit I WNP Washington Nuclear Plant Unit 2 BEP Brunswick Unit 2 EIH Hatch Unit 2 SNS - Shoreham RBS River Bend Unit 1 PBS Peach Bottom Unit I
4.3 Corrective Actions Taken or Planned As discussed in Section 2, a variety of corrective actioris had been taken or planned by the licensees after the occurrence of the operational events. The corrective actions implemented are one or more of the following:
o Counseling plant personnel on the importance of proper action during RHR shutdown cooling operation and the potential pathways of draining the reactor vessel.
o Providing plant personnel additional training on the RHR shutdown ,
cooling operation, o Revising plant procedures to reduce personnel errors involved in the inadvertent draining of the reactor vessel. Revisions frequently included adding a caution statement about simultaneous opening of the shutdown cooling suction valve and suppression pool suction valve.
These procedures included: (a) RHR shutdown cooling operating procedures; (b) RHR surveillance procedures; (c) RHR realignment procedures; (d) ADS surveillance procedures; (e) integrated containment leak rate test procedures; and (f) maintenance procedures for components whose failures contributed to the draining of the reactor vessel.
o Adding caution tags to the control room panel and/or the remote shutdown panel to remind plant personnel that they should not simultaneously open the shutdown cooling suction valve and the suppression pool suction valve.
o Installing audible alarms in the cor. trol room for the closure of RHR shutdown cooling suction line isolation valves.
The corrective actions planned by two licensees included:
o Restoring the automatic RHR isolation function immediately following surveillance testing of the emergency core cooling systems while the plant is still in the shutdown cooling mode of operation, and, o Installing valve interlocks to prevent opening the suppression pool suction valve while the shutdown cooling suction valve is still open during RHR shutdown cooling operation.
20
o 5.0 EVALUATION OF SAFETY SIGNIFICAPCE 5.1 Qualitative Assessment of Safety Significance The safety significance of an inadvertent draining of reactor coolant inventory during shutdown or startup invcives four principal competing factors. Two of the factors would tend to decrease the signifiance of this concern while two would tend to increase the significance. ,
i The litigating factors are as follows: (1) An intdvertent reactor vessel draining event would be expected to occur when the reactor heat output is at j a relatively low level; namely, decay heat levels during shutdown, or slightly1 above decay heat levels during startup. (2) For most operating BWRs, BWR/2s f through BWR/6s, the maximum length of reactor fuel to be uncovered during a vessel draining event is one-third core height below the top of the active ll fuel column, due to the arrangements of the jet pumps inside the reactor vessal.
~
Further water leve! reduction (as in a severe accident scenario) would requirLe coolant boiloff due to decay heat.
Boiloff, as opposed to dreindown, would increase the length of time for fuel' uncovering. The time which would be required to uncover a significe t cdditional portion of the reactor core due to boiloff ranges from about an hour to a few days, depending on the level of decay heat. As a result, the time which woul/. be available for plant operator actions (e.g., to reclose inadverter.tly opened valve's or to manually initiate emergency core cooling systems) would be. significantly increased. Furthermore, since the draindown phase potentially could only uncover about one-third of the core at low ccre heat levels, the performance reouirements of the emergency core cooling systems (in terms of flow rate and heat removal capacity) would be less than that for a design basis loss-of-coolant accident. This would have the effect of increasing the likelihood of adequate emergency core cooling system flow being provided to mitigate a potential draindown accident. These two factors (i.e.,
low core heat levels during a shutdown or startup, and limited potential core uncovery) tend to limit the reactor accident risks associated with an inadvertent reduction of reactor coolant inventory.
Two principal factors would tend to increase the reactor accident risks associated with an inadvertent reduction of reactor coolant inventory caused by a vessel draining event. (1) The number of trains of emergency core cooling systems which are required to be operable during shutdown is les than that required during power operation. This would have the effect of increasing the probability of a total loss of emergency core cooling systems makeup cepability during or immediately following a postulated core uncovery scenario. A typical technical specification requirement (e.g., LaSalle-1 and River Bend) for emergency core cooling systems operability during snutdown requires as few as 21
any two of the following systems / subsystems to be operable: low-pressere core spray system (single train), high-pressure core spray system (single train),
LPCI subsystem "A," LPCI subsystem "B," or LPCI subsystem "C." In contrast, during plant power operation, all five of these systems / subsystems mu ,t be operable. Therefore, fewer than one half of the emergency core coolina systems are required to be operable when the plant is in the shutdown mode. (2) During '
plant shutdown, the containment equipment hatch or the personnel access hatch may be open 'and the reactor vessel head and containment head may be removed for refueling or other maintenance reasons. An open vessel and/or containment would represent a major reduction in the final barrier to radioactive releases if fuel uncovery and/or damage were to occur as a result of a reactor vessel draindown.
These two factors (i.e., reduced emergency core cooling systems operability requirements and a potentially open vessel and containment) would tend to increase the accident risks associated with an inadvertent reduction of reactor coolant inventory during shutdown. .
5.E Quantitative Assessment of Safety Significance An estimate of the likelihood of a draindown event leading to reactor core damage can be calculated as follows: let T denote the frequency (occurrences per reactor year) of an inadvertent reduction of reactor coolant inventory during plant shutdown or startup, S denote the unavailability or failure probability of automatic RHR isolation at low reactor vessel water level, Q denote the probability of not manually terminating the draindown of the reactor vessel, and U denote the failure probability of the available emergency core cooling systems. The accident sequence TSQU then represents an accident scenario in which an inadvertent draindown of the reactor vessel occurs, automatic' isolation of the shutdown cooling suction line on low reactor vessel water level fails to occur, the plant operator fails to manually intervene, and the energency core cooling systems fail. Such an accident scenario would lead to reactor core damage.
The likelihood of occurrence of sequence TSQU can then be estimated as follows:
Based on 11 observed draindown events in about 100 reactor years of BWR operation, the initiator frequency T is estimated as T = 11 events /100 reactor years = 0.1/ reactor year.
The unavailbility or failure probability of automatic PHR isolation et low reactor water level, S, may be estimated from the observed operational data.
In two of the 11 operational events observed, automatic isolation of the RHR system was either not available when needed (River Bend, LER 85-008) or degraded (LaSalle-2, LER 84-009). Counting only the unavailable RHR automatic 22
eO Q i
isolation capability event at River Bend for simplification would result in one observed failure in 11 operational events. Therefore, S = 1/11 = 1 x 10E-1*.
The probability, 0, denoting the failure of plant operators to manually terminate the reactor vessel draindown and to recover and maintain reactor vessel water level, can be-estimated from NUREG/CR-1278 " Handbook of Human Peliability Analysis with Emphasis on Nuclear Power Plant Applications" (Ref. 2). Q is assessed to be of the order of 10E-2. This value corresponds to a situation in which an operator fails to act correctly after the first several hours in a high stress condition (Table 20-25, NUREG/CR-1278).
The failure probability of the available emergency core cooling systems (failure to manually or automatically start on demand or failure to run), U, is taken to be 10E-2 ard reflects the following two considerations. First bases!
on typical plant technical specifications requirements, only two emergency core cooling subsystems or systems are normally required during shutdown.
Therefore, U represents the failure probability of two subsystems or systems of the emergency core cooling systems. The probability of all emergency core cooling systems failing during a design basis loss-of-coolant accident at power is of the order of 10E-3 for modern BWRs (Refs. 3, 4 and 5). Since V in this case involves only two emergency core cooling subsystems or systems, its value therefore should be somewhat higher than 10E-3 (assuming everything else being equal). Second, during plant shutdown, the increased number of system and equipment surveillance tests (hence leading to more opportunities for human errors to occur) would tend to increase the probability that no emergency core cooling system is available or operable. A case in point would be the recent event at Brunswick-1 on October 29, 1985 (LER 85-58), in which both core spray system loops and both LPCI loops of the RHR system were rendered' inoperable during surveillance testing due to human errors. Thus, based on the above considerations, a value of 10E-2 is judged reasonable for U.
Then the likelihood of occurrence of the accident sequence TSQU is estinated as:
TSQU = (0.1/ reactor year)(10E-1)(10E-2)(10E-2)
= 1 x 10E-6/ reactor year Since the accident sequence TSQU had not been previously considered in major probabilistic risk assessments (Refs. 3, 4, and 5), this value of 1 x 10E-6 per reactor year represents an incremental increase of about 5% in the BWR-2 1
f
- 10E-1 denotes 10-1 i . 23
.. o release category initiated by transients in which a severe radioactive release
, occurs in an open or failed containment (the BWR-2 release category initiated by transients was estimated to have a probability of 2 x 10E-5/yr in the Reactor, Safety Study, WASH-1400,' Ref. 3). As indicated in the Reactor Safety Study Methodology Applications Program (Ref. 6), accidents initiated by transients leading to the BWR-2 release category contribute signific.antly to BWR reactor accident risks.
In summary, this preliminary quantitative estimate indicates that an inadvertent reduction of reactor coolant inventory during pla.it shutdown is expected to marginally increase (about 5%) the probability of accidental release in the BWR-2 release category in which a severe radioactive release occurs in an open or failed containment. In view of the severity of the BWR-2 release category in terms of the large amount of radioactivity involved and its associated significant impact on reactor accident rists, a 5% increase is considered to be of medium safety significance.
e 9
m 9
0 24
e
- ++
6.0 GENERIC EVALUATIONS BY THE NRC AND INDUSTRY ,
The Nuclear Regulatory Commission and the nuclear industry have completed or are in the process of completirg evaluations of the generic implications and safety significance associated with the inadvertent reduction in reactor .
coolant inventory during shutdown or startup. A brief summary of these activities and related reports is given below: -
0 The General Electric Company issued a generic Service Information Letter 388 on RHR valve misalignment during shutdown cooling operation in February,1983 (Ref. 7).
o The Office for Analysis and Evaluation of Operational Data issued technical review report (AE0D/T334) on the April 3,1983 event at Grand Gulf (Ref. 8).
o The Office of Inspection and Enforcement issued Information Notice 84-81 on November 16, 1984 for the events at Washin ton Nuclear Power Unit 2, LaSalle Unit 1 and Brunswick Unit 2 (Ref. 1 .
o Region I forwarded an assessment of reactor vessel draindown experience to the Office of Nuclear Reactor Regulation for review on April 23, 1986 (Ref. 9).
o An industry organization has issued two reports on the inadvertent draining of reactor coolant at Brunswick-2 and at Grand Gulf.
~
o An industry organization is in the process of preparing another report on similar operating events.
l a
l j 25
7.0 FIhDINGS AND CONCLUSIONS The operational events discussed in this study were primarily caused, to various degrees, by human errors associated with the operation of the RHR system in the shutdown cooling mode. The cause of these human errors can be traced to deficient procedures, improper or inadvertent actions, lack of knowledge or training, man / machine interface problems, cognitive errors, or maintenance errors. Furthermore, the manual mode of operation for RHR shutdown cooling, the interconnections between the subsystems of the RHR system, and the lack of a comprehensive valve interlock system also contribute to the occurrence of these operational events.
Four principal competing factors significantly impact the risk importance or safety significance of these operational events. The relatively low heat production rate during shutdown, and the fact that for modern BWRs the reactor vessel can only be drained to expose the top one-third core, are two factors that tend to mitigate the reactor accident risks associated with an' inadvertent draining of the reactor. vessel. On the other hand, the reduced requirements for emergency core cooling systems operability during plant shutdown and the lack of reactor vessel and primary containment integrity would tend to increase the probability of a significant accidental radioactive release.
Quantitatively, it is concluded that these operational events marginally increase (about 5%) the likelihood of accidental radioactive releases in the BWR-2 release category in which a core-melt accident is postulated to progress without the benefit of containment integrity. In view of the severity of the BWR-2 release category, a 5% increase in the release probability is considered to be of medium safety significance.
Because of the relatively frequent occurrence of draining events (11' events at nine different plants during a four-year period) and their associated medium safety significance, it has been concluded that several relatively low cost
! measures should be implemented to reduce the likelihood of these occurrences.
l These suggested measures are delineated in the next section.
l l
l 26
, .. o 8.0 SUGGESTIONS (1) Install caution tags on the control room panel next to the hand switches for the RHR shutdown cooling suction valves, RHR suppression pool suction valves, RHR test return valves, and RHR minimum flow bypass valves, to remind plant personnel of the potential of inadvertent drainirg of the reactor vessel during RHR shutdown cooling operation.
This corrective action would help to reduce human errors associated with inappropriate opening of RHR valves which provide pathways to drain the reactor vessel. Mispositioning of one or two of these valves was involved in seven of the 11 operational events reviewed. The presence of caution tags on the control panel next to the hand switches, when combined with appropriate training of plant operators, would be a cost-effective means of reducing personnel errors in positioning these valves during RHP shutdown cooling operation.
(2) Insert caution st'tements, a where appropriate, in the RHR operating and surveillance procedures for shutdown cooling operation evolutions, to further remind plant personnel of the potential for inadvertent draining of the reactor vessel.
This corrective action is also intended to reduce human errors involving RHR system valve manipulations during shutdown cooling operation. Caution statements in the RHR operation and surveillance procedures would also be a cost-effective means of reminding plant personnel of the potential for inadvertent draining of the reactor vessel when they are performing such procedures. Improved procedures, combined with appropriate operator training, would reduce the probability of the kind of improper or inadvertent operator actions which were observed in five of the 11 operatiranal events reviewed.
(3) Pecuire that the automatic isolation function of the RHR system is operable during RHR shutdown cooling operation.
This corrective action would provide an additional protection against an inadvertent draining of the reactor vessel. Presently, most BWR technical specifications do not require automatic isolation of the RHR system during shutdown cooling operatic.n while the plant is in either the refueling er shutdown modes. In two of the 11 operational events observed, automatic isolation capability of the RHR system was allowed to be either unavailable or se,riously degraded. Therefore, this corrective action 27
. would provide an additional safeguard for limiting the inadvertent draining of the reactor vessel. This corrective ection may be implemented either voluntarily by procedure or as a part of the plant technical specifications.
(4) Investigate the benefits and risk impacts of installing valve interlocks for preventing the simultaneous opening of the shutdown cooling suction valve and the suppression pool suction valve when returning the RHR system from the shutdown cooling mode to the LPCI mode.
The lack of valve interlocks for the RHP system valves for this evolution is primarily a result of the concern over degrading LPCI operability (a major emergency core cooling system requirement). The LPCI node of PHR is important in reducing the reactor accident risks associated with design basis loss-of-coolant accidents and anticipated transients.
Therefore, a study should be conducted, prior to any installation of valve interlocks intended to prevent the simultaneous opening of the shutdown cooling suction valve and the suppression pool suction valve, to determine whether or not such draindown protection would adversely impact LPCI reliability. Valve interlocks on the RHR system would be beneficial if they were to reduce the reactor accident risks associated with inadvertent draining of the reactor vessel during plant shutdown without increasing the reactor accident risks from design basis loss-of-coolant accidents and anticipated transients during power operation. If no significant adverse impact on LPCI reliability results from an appropriately designed, installed, tested and maintained interlock system, licensees should consider installing such a system.
6 28
,, o . .
9.0 REFERENCES
- 1. IE Information Notice 84-81, " Inadvertent Pec'uction in Primary Coolant Inventory in BWPs during Shutdown and Startup," U.S. Nuclear Regulatory Commission, November 16, 1984
- 2. " Handbook of Human Reliability A,alysis with Emphasis on Nuclear Power Plant Applications," NUREG/CR-1278, U.S. Nuclear Regalatory Comission, October 1980.
- 3. " Reactor Safety Study - An Assessment of Accident Risks in U.S. Comercial Nuclear Power Plants," NUREG-75/014(WASH-1400), U.S. Nuclear Regulatory Comission, October 1975.
- 4. " Interim Reliability Evaluation Program: Analysis of the Browns Ferry, Unit 1,' Nuclear Plant," NUREG/CR-2802, August 1982.
- 5. "Probabilistic Risk Assessment / Limerick Generating Station," U.S. f.uclear '
Regulatory Comission, Docket No. 50-352 and 50-353,1983.
- 6. " Reactor Safety Study Methodology Applications Program: Grand Gulf #1 BWR '
Power Plant," NUREG/CR-1659, U.S. Nuclear Regulatory Comission, October 1981.
- 7. " General Electric Information Letter GE-388, RHR Valve Misalignment During Shutdown Cooling Operation," General Electric Company, February 1983.
- 8. " Reactor Vessel Drainage," Technical Review Report AE0D/T334, U.S. Nuclear Regulatory Comission, November 15, 1983.
- 9. " Potential Generic Problems with BWR RHR Valve Misalignment During Shutdown Cooling Operation," letter from R. W. Starostecki, Region I, NPC, to R. M. Bernero, NRR, NPC, April 23, 1986.
29