NRC Generic Letter 1988-17
| ML031200496 | |
| Person / Time | |
|---|---|
| Issue date: | 10/17/1988 |
| From: | Crutchfield D Office of Nuclear Reactor Regulation |
| To: | |
| References | |
| GL-88-017 | |
| Download: ML031200496 (29) | |
UNtTED STATES
NUCLEAR REGULATORY COMMISSION
WASHINGTON, D. C. 20555 October 17, 1988 TO ALL HOLDERS OF OPERATING LICENSES OR CONSTRUCTION PERMITS FOR PRESSURIZED
WATER REACTORS (PWRs)
SUBJECT: LOSS OF DECAY HEAT REMOVAL (GENERIC LETTER NO. 88-17)
Loss of decay heat removal (DHR) during nonpower operation and the consequences of such a loss have been of increasing concern for years. Numerous industry and NRC publications have addressed the subject. The Diablo Canyon event of April 10, 1987, and ensuing work by both the staff and industry organizations have provided additional insight. Yet the problems continue, as illustrated by
(1) the inadequacies demonstrated by many licensees in their response to Generic Letter (GL) 87-12; (2) the event at Waterford on May 12, 1988; (3) the event at Sequoyah on May 23, 1988; (4) the DHR perturbations due to inadequate level at San Onofre on July 7, 1988; and (5) the apparent lack of a complete industry understanding of the potential seriousness of such events.
The report of the Diablo Canyon event, NUREG-1269, stated that operating a plant with a reduced reactor coolant system (RCS) inventory was a particularly sensitive condition and identified many generic weaknesses in DHR. GL 87-12, which requested information from all PWR licensees, provided additional in- sight, and NUREG-1269 was transmitted with the generic letter to ensure that licensees had the latest information. Despite this, many of the responders to GL 87-12 demonstrated that they did not understand the identified problems.
Deficiencies exist in procedures, hardware, and training in the areas of (1)
prevention of accident initiation, (2)mitigation of accidents before they potentially progress to core damage, and (3) control of radioactive material if a core damage accident should occur. Although deficiencies exist in all PWRs, certain design features make initiation and the time available for mitigation in the Westinghouse and Combustion Engineering designs of more concern than in the nuclear steam supply systems (NSSSs) designed by Babcock and Wilcox.
Nevertheless, we believe expeditious actions are necessary at all PWRs to rectify these deficiencies. These should be paralleled by programmed enhance- ments which supplement, add to, or replace the expeditious actions to accom- plish a more comprehensive improvement. Recommendations covering these items are summarized in the attachment, and additional information and guidance are provided in the three enclosures.
A-
2 Pursuant to 10 CFR 50.54(f), we request your response regarding your plans with respect to each of the recommendations as related to operation following placement of the NSSS on shutdown cooling, or following the attainment of NSSS
conditions under which shutdown cooling would normally be initiated. Your response is to include the following:
(1) A description of the actions you have taken to implement each of the eight recommended expeditious actions identified in the attachment. Your reply shall be submitted to us within 60 days of receipt of this letter.
(2) A description of enhancements, specific plans, and a schedule for imple- mentation for each of the six programmed enhancement recommendations identified in the attachment. Your reply shall be provided to us within
90 days of receipt of this letter.
Individual deviations from the recommendations will be considered on a case by case basis provided compensatory measures are provided which will achieve a comparable level of protection.
No further responses are required to GL 87-12 and licensees or construction permit holders need not provide any supplemental information in a response to GL 87-12 to which they previously committed.
We will accept documents such as technical reports, action plans, and schedules prepared by industry groups when accompanied by commitments from participating licensees in lieu of individual documents from those licensees. Alternatively, such industry group documents may be incorporated by reference in licensee documentation. We encourage your participation in cooperative efforts to effectively resolve these issues.
Your written response shall be submitted under oath or affirmation under the provisions of Section 182a, Atomic Energy Act of 1954, as amended. Your written response is needed to determine whether actions to modify, suspend, or revoke your license are necessary. An analysis as required by 10 CFR 50.109 has been performed regarding this request.
The original copy of your written response shall be transmitted to the U. S.
Nuclear Regulatory Commission, Document Control Desk, Washington, D.C. 20555 for reproduction and distribution.
This request is covered by Office of Management and Budget Clearance lumber
3150-0011 which expires December 31, 1989. The estimated average burden hours is 200 person-hours per licensee response, including assessment of the new requirements, searching data sources, gathering and analyzing the data, and preparing the required reports. Comments on the accuracy of this estimate and suggestions to reduce the burden may be directed to the Office of Management and Budget, Room 3208, New Executive Office Building, Washington, D.C. 20503, and to the U. S. Nuclear Regulatory Commission, Records and Reports Management Branch, Office of Administration and Resources Management, Washington, D.C.
20555.
3 If you have technical questions regarding this matter please contact Wayne Hodges at 301-492-0895. Other questions may be directed to the NRR Project Manager assigned to this issue, Charles M. Trammell (301-492-3121) or to the Project Manager assigned to your plant.
en . Cru Acting Associate Di ctor for Projects Office of Nuclear Reactor Regulation Attachment:
Recommended Actions Enclosures:
1. Overview and
Background Information
Pertinent to Generic Letter 88-17
2. Guidance for Meeting Generic Letter 88-17
3. Abbreviations and Definitions
LIST OF RECENTLY ISSUED GENERIC LETTERS
Generic Date of Letter No. Subject Issuance Issued To
88-16 REMOVAL OF CYCLE-SPECIFIC 10/04/88 ALL POWER REACTOR
PARAMETER LIMITS FROM LICENSEES AND
TECHNICAL SPECIFICATIONS APPLICANTS
88-15 ELECTRIC POWER SYSTEMS - 09/12/88 ALL POWER REACTOR
INADEQUATE CONTROL OVER LICENSEES AND
DESIGN PROCESSES APPLICANTS
88-14 INSTRUMENT AIR SUPPLY 08/08/88 ALL HOLDERS OF
SYSTEM PROBLEMS AFFECTING OPERATING LICENSES
SAFETY-RELATED EQUIPMENT OR CONSTRUCTION
PERMITS FOR NUCLEAR
POWER REACTORS
88-13 OPERATOR LICENSING 08/08/88 ALL POWER REACTOR
EXAMINATIONS LICENSEES AND
APPLICANTS FOR
AN OPERATING LICENSE.
88-12 REMOVAL OF FIRE PROTECTION 08/02/88 ALL POWER REACTOR
REQUIREMENTS FROM TECHNICAL LICENSEES AND
SPECIFICATIONS APPLICANTS
88-11 NRC POSITION ON RADIATION 07/12/88 ALL LICENSEES OF
EMBRITTLEMENT OF REACTOR OPERATING REACTORS
VESSEL MATERIALS AND ITS AND HOLDERS OF
IMPACT ON PLANT OPERATIONS CONSTRUCTION PERMITS
88-10 PURCHASE OF GSA APPROVED 07/01/88 ALL POWER REACTOR
SECURITY CONTAINERS LICENSEES AND
HOLDERS OF PART 95 APPROVALS
88-09 PILOT TESTING OF FUNDAMENTALS 05/17/88 ALL LICENSEES OF ALL
EXAMINATION BOILING WATER REACTORS
AND APPLICANTS FOR A
BOILING WATER REACTOR
OPERATOR'S LICENSE
UNDER 10 CFR PART 55
88-08 MAIL SENT OR DELIVERED TO 05/03/88 ALL LICENSEES FOR POWER
THE OFFICE OF NUCLEAR REACTOR AND NON-POWER REACTORS
REGULATION AND HOLDERS OF
CONSTRUCTION PERMITS
FOR NUCLEAR POWER
REACTORS
ATTACHMENT TO GENERIC LETTER
RECOMMENDED ACTIONS
Expeditious actions and programmed enhancements are recommended concerning operation of the NSSS during shutdown coolina or during conditions where such cooling would normally be provided. The recommendations apply whenever there is irradiated fuel in the reactor vessel (RV). These recommendations are summarized below and discussed further in enclosure 2:
Expeditious actions:
The following expeditious actions should be implemented prior to operat- ing in a reduced inventory condition*:
(1) Discuss the Diablo Canyon event, related events, lessons learned, and implications with appropriate plant personnel. Provide training shortly before entering a reduced inventory condition.
(2) Implement procedures and administration controls that reasonably assure that containment closure** will be achieved prior to the time at which a core uncovery could result from a loss of DHR coupled with an inability to initiate alternate cooling or addition of water to the RCS inventory. Containment closure procedures should include consideration of potential steam and radioactive material release from the RCS should closure activities extend into the time boiling takes place within the RCS. These procedures and administrative controls should be active and in use:
(a) prior to entering a reduced RCS inventory condition for NSSSs supplied by Combustion Engineering or Westinghouse, and (b) prior to entering an RCS condition wherein the water level is lower than four inches below the top of the flow area of the hot legs at the junction of the hot legs to the RV for NSSSs supplied by Babcock and Wilcox, and should apply whenever operating in those conditions. If such procedures and administrative controls are not operational, then either do not enter the applicable condition or maintain a closed containment.
- A reduced inventory condition exists whenever RY water level is lower than three feet below the RV flange.
- Containment closure is defined as a containment condition where at least one integral barrier to the release of radioactive material is provided.
Further discussion and qualifications which the integral barrier must meet are provided in enclosure 2 and in the definitions provided in enclosure 3.
2
(3) Provide at least two independent, continuous temperature indications that are representative of the core exit conditions whenever the RCS
is in a mid-loop condition* and the reactor vessel head is located on top of the reactor vessel. Temperature indications should be periodically checked and recorded by an operator or automatically and continuously monitored and alarmed. Temperature monitoring should be performed either:
(a) by an operator in the control room (CR), or (b) from a location outside of the containment building with provision for providing immediate temperature values to an operator in the CR if significant changes occur. Observations should be recorded at an interval no greater than 15 minutes during normal conditions.**
(4) Provide at least two independent, continuous RCS water level indica- tions whenever the RCS is in a reduced inventory condition. Water level indications should be periodically checked and recorded by an operator or automatically and continuously monitored and alarmed.
Water level monitoring should be capable of being performed either:
(a) by an operator in the CR, or (b) from a location other than the CR with provision for providing immediate water level values to an operator in the CR if significant changes occur. Observations should be recorded at an interval no greater than 15 minutes during normal condi- tions.**
(5) Implement procedures and administrative controls that generally avoid operations that deliberately or knowingly lead to perturba- tions to the RCS and/or to systems that are necessary to maintain the RCS in a stable and controlled condition while the RCS is in a reduced inventory condition.
If operations that could perturb the RCS or systems supporting the RCS must be conducted while in a reduced inventory condition, then additional measures should be taken to assure that the RCS will remain in a stable and controlled condition. Such additional measures include both prevention of a loss of DHR and enhanced monitoring requiriements to ensure timely response To3a loss of DHR
should such a loss occur.
- A mid-loop condition exists whenever RCS water level is below the top of the flow area of the hot legs at the junction with the RY.
- Guidance should be developed and provided to operators that covers evacuation of the monitoring post. The guidance should properly balance reactor and personnel safety.
3
(6) Provide at least two available* or operable means of adding inventory to the RCS that are in addition to pumps that are a part of the normal DHR systems. These should include at least one high pressure injection pump. The water addition rate capable of being provided by each of the means should be at least sufficient to keep the core covered. Procedures for use of these systems during loss of DHR
events should be provided. The path of water addition must be specified to assure the flow does not bypass the reactor vessel before exiting any opening in the RCS.
(7) (applicable to Westinghouse and Combustion Engineering nuclear steam supply system (NSSS) designs) Implement procedures and administra- tive controls that reasonably assure that all hot legs are not blocked simultaneously by nozzle dams unless a vent path is provided that is large enough to prevent pressurization of the upper plenum of the RY. See references 1 and 2.
(8) (applicable to NSSSs with loop stop valves) Implement procedures and administrative controls that reasonably assure that all hot legs are not blocked simultaneously by closed stop valves unless a vent path is provided that is large enough to prevent pressurization of the RV upper plenum or unless the RCS configuration prevents RV
water loss if RV pressurization should occur. Closing cold legs by nozzle dams does not meet this condition.
Programmed enhancements:
Programmed enhancements should be developed in-parallel with the expedi- tious actions and they may replace, supplement, or add to the expeditious actions. For example, programmed enhancements may be used to change expeditious actions as a result of better understanding or improved procedures. This may lessen the initial impact of expeditious actions such as the speed with which containment closure must be achieved and may include consideration of such factors as the decay heat rate. Additional guidance is provided in enclosure 2. For example the first paragraph of section 2.2.2 and the first paragraph of section 3.3.2 illustrate the flexibility we have in mind as long as safety is adequately addressed.
We intend that programmed enhancements be incorporated into plant opera- tions as they are developed when this results in significant safety improvement or enhancement of plant operations with no decrease in safety. Procedural and hardware modifications may be implemented without prior staff approval where the criteria of 10 CFR 50.59 are met, although it is our intent to review and/or audit such changes.
Programmed enhancements should be implemented as soon as is practical, but no later than the following schedule:
- Available means ready for use quickly enough to meet the intended functional need.
4
(1) Programmed enhancements consisting of hardware installation and/or modification, and programmed enhancements that depend upon hardware installation and/or modification, should be implemented:
(a) by the end of the first refueling outage that is initiated 18 months or later following receipt of this letter, or (b) by the end of the second refueling outage following receipt of this letter, whichever occurs first. If a shutdown for refueling has been initiated as of the date of receipt of this letter, that is to be counted as the first refueling outage.
(2) Programmed enhancements that do not depend upon hardware changes should be implemented within 18 months of receipt of this letter.
We recommend you implement the following six programmed enhancements:
(1) Instrumentation Provide reliable indication of parameters that describe the state of the RCS and the performance of systems normally used to cool the RCS
for both normal and accident conditions. At a minimum, provide the following in the CR:
(a) two independent RCS level indications (b) at least two independent temperature measurements representa- tive of the core exit whenever the RV head is located on top of the RV (We suggest that temperature indications be provided at all times.)
(c) the capability of continuously monitoring DHR system perfor- mance whenever a DHR system is being used for cooling the RCS
(d) visible and audible indications of abnormal conditions in temperature, level, and DHR system performance
(2) Procedures Develop and implement procedures that cover reduced inventory operation and that provide an adequate basis for entry into a reduced inventory condition. These include:
(a) procedures that cover normal operation of the NSSS, the con- tainment, and supporting systems under conditions for which cooling would normally be provided by DHR systems.
_ _
. . ..
(b) procedures that cover emergency, abnormal, off-normal, or the equivalent operation of the NSSS, the containment, and support- ing systems if an off-normal condition occurs while operating under conditions for which cooling would normally be provided by DHR systems.
(c) administrative controls that support and supplement the proce- dures in items (a), (b), and all other actions identified in this communication, as appropriate.
(3) Equipment (a) Assure that adequate operating, operable, and/or available equipment of high reliability* is provided for cooling the RCS
and for avoiding a loss of RCS cooling.
(b) Maintain sufficient existing equipment in an operable or available status so as to mitigate loss of DHR or loss of RCS
inventory should they occur. This should include at least one high pressure injection pump and one other system. The water addition rate capable of being provided by each equipment item should be at least sufficient to keep the core covered.
(c) Provide adequate equipment for personnel communications that involve activities related to the RCS or systems necessary to maintain the RCS in a stable and controlled condition.
(4) Analyses Conduct analyses to supplement existing information and develop a basis for procedures, instrumentation installation and response, and equipment/NSSS interactions and response. The analyses should encompass thermodynamic and physical (configuration) states to which the hardware can be subjected and should provide sufficient depth that the basis is developed. Emphasis should be placed upon obtain- ing a complete understanding of NSSS behavior under nonpower opera- tion.
(5) Technical Specifications Technical specifications (TSs) that restrict or limit the safety benefit of the actions identified in this letter should be identi- fied and appropriate changes should be submitted.
- Reliable equipment is equipment that can be reasonably expected to perform the intended function. See Enclosure 2 for additional information.
6
(6) RCS perturbations Item (5) of the expeditious actions should be reexamined and opera- tions refined as necessary to reasonably minimize the likelihood of loss of DHR.
Additional information and guidance are given in enclosure 2.
REFERENCES
(1) C. E. Rossi, "Possible Sudden Loss of RCS Inventory during Low Coolant Level Operation," NRC Information Notice 88-36, June 8, 1988.
(2) R. A. Newton, "Westinghouse Owners Group Early Notification of Mid-Loop Operation Concerns," Letter from Chairman of Westinghouse Owners Group to Westinghouse Owners Group Primary Representatives (1L, 1A), OG-88-21. May
27, 1988.
ENCLOSURE 1 TO GENERIC LETTER
OVERVIEW AND
BACKGROUND INFORMATION
PERTINENT TO GENERIC LETTER 88-17
CONTENTS
Page
1.0 THE ISSUE . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.0 PERSPECTIVE . . . . . . ... . . . . .* . . . . ... 4
2.1 Phenomena and Impact ....... .. . .. .. . .. . . 4
2.1.1 Pressurization . . .. .. . .. .. .. .. .. . 5
2.1.2 Vortexing. ..... 5
2.1.3 SG tube draining in plants with "U" tube SGs . . . 6
2.1.4 RCS level differences . . . . . . . . . . . . . . . 6
2.1.5 DHR system effects ......... .. . .... 7
2.1.6 Instrumentation.. . . . ... . 7
2.2 Time available for mitigation .. .. .. .. . .. .. . 8
2.3 Generic Letter 87-12 review . .. .. .. .. .. . .. . 9
3.0 NEEDED RESPONSE . . . . ...... . 10
4.0 REFERENCES . . . . ....... . 10
3
1.0 THE ISSUE
Concern has been increasing for some time that an event involving the loss of decay heat removal (DHR)* while there is substantial core decay heat may pose a significant likelihood of a release due to a severe core damage accident.
Recently obtained probabilistic risk information and a survey of industry operations substantiate this concern. Independent engineering evaluation of plant operation while cooling is provided by DHR systems leads to a similar conclusion. Consideration of plant behavior points out several phenomena that had previously gone unrecognized and that potentially could lead to severe core damage in approximately one hour rather than in the previously believed conservative time of more than four hours. Plants are operating under conditions that have not been analyzed and in which plant response is not understood.
Evaluation of plant data shows that an unacceptably large number of events have occurred and continue to occur. If not mitigated, such events lead to core damage. Many of these events have involved a loss of DHR for one or more hours. A number of events have resulted in boiling in the core, a condition that has not been analyzed at most plants. Often, plant personnel were unaware of the real difficulty for some time during or after the event. Experience clearly substantiates that a problem exists.
Information obtained since the Diablo Canyon event of April 10, 1987 shows that many previously unrecognized mechanisms exist that exacerbate the prob- lem, and that are not represented in the PRA results. Some of these can realistically cause core uncovery or complete core voiding in less than half an hour; significantly less than the previously believed "conservative" boil down of water with uncovery of the top of the core in four hours. Our review of licensee responses to Generic Letter (GL) 87-12** and plant experience has clearly established that few procedures exist to avoid these scenarios. Many licensees demonstrated in the GL 87-12 responses that they were not even aware that such scenarios exist.
Review of industry responses to GL 87-12 shows that most licensees are poorly prepared for reduced RCS inventory operation. Procedures are incomplete, incorrect, or nonexistent. Little effective thought has been given to avoiding the initiation of accidents or to mitigating an accident once it has begun.
e.,
- Enclosure 3 provides a list of abbreviations and definitions.
- GL 87-12 (ref. 1) requested licensees to describe operation of their plants under conditions where some of the water inventory had been removed from the reactor coolant system (RCS). We have completed our review of these responses with assistance from the Idaho National Engineering Laboratory, and a NUREG/CR document describing that review is being prepared. Further infor- mation is provided in Section 2.3 of this enclosure.
4 The inability of containment to mitigate an accident is seldom addressed at any level of operating procedures, administrative controls, or training.
Instrumentation is often of low quality or inaccurate, and little provision is made for using equipment effectively. The responses establish that the problemn is extensive, many disciplines are involved, many licensees are not adequately responding, and information is not being effectively shared within the industry.
2.0 PERSPECTIVE
2.1 Phenomena and Impact A number of phenomena have been recognized as affecting nuclear power plant operation when these plants are operating in a nonpower condition. Some of these phenomena can cause the time between loss of DHR and severe core damage to be as short as approximately one hour. Such phenomena also cause instru- mentation errors, loss of DHR, and unstable operation. These phenomena are of particular concern at operating conditions where the water level is below the top of the hot and cold legs. This level permits air to be distributed throughout the RCS. This complicates interpretation of the event. In addi- tion, the allowable operating band for water level is often only a few inches (too low, and DHR is lost; too high, and steam generator (SG) tubes do not drain or water floods the SGs and containment).
This is a challenging environment for the operators, and one with a high probability of failure. For example:
(1) The actual state of the RCS may differ from the analyzed state, and phenomena may occur that have been neither recognized nor analyzed. This can lead to RCS behavior that operators and advisors do not anticipate.
Of serious concern is the discovery of accident sequences that can cause core uncovery or complete core voiding in 15 or 20 minutes and severe core damage in approximately an hour from the time DHR is lost.
(2) Operators and advisors may not recognize the potential seriousness of the situation until unanticipated phenomena become obvious. Corrective action may be further delayed because operators and advisors disbelieve the symptoms as indicated by available instrumentation.
(3) Changes in RCS state may cause viable mitigation paths to be unavailable.
(4) Failure to recognize the potential seriousness of the situation and lack of clear, appropriate procedures can lead to significant delay in obtain- ing resources needed to cope with the event.
We discuss a number of phenomena and related concerns in the subsections that follow. Although incomplete, these discussions will help to illustrate the magnitude and breadth of the issue. We will discuss:
(1) pressurization
(2) vortexing
(3) SG tube draining in plants with U-tube SGs
5
(4) RCS level differences
(5) DHR system effects
(6) instrumentation
2.1.1 Pressurization The principal concern is that a small pressurization can occur as a result of conditions unique to operation with a reduced RCS inventory - and this pres- sure increase can seriously affect plant safety. Previously at least four We hours were believed to be available between loss of DHR and core uncovery.
now know that these newly appreciated phenomena can cause core uncovery or complete core voiding in 15 or 20 minutes and severe core damage in approxi- mately an hour following loss of DHR.
A number of considerations are applicable (refs. 1 - 4), including:
(1) Inappropriate use of SG nozzle dams can lead to complete core voiding within 15 or 20 minutes of loss of DHR. A similar phenomenon can occur when loop stop valves are inappropriately used.
(2) Cold leg openings can allow water to be ejected from the vessel following loss of DHR until sufficient water is lost that steam is relieved by clearing of the crossover pipes.
(3) Phenomena associated with pressure differences within the RCS may prevent injection water from reaching the reactor vessel (RV).
(4) Rapid RCS pressurization may prevent gravity feed of water from tanks that are anticipated to be available.
(5) Rapid pressurization may cause instruments to malfunction or provide misleading indications.
(6) Rapid pressurization may cause the RCS to respond in unanticipated ways.
(7) Small RCS pressure boundary openings at various locations (vents and drains both above and below the water level) may lead to instrument malfunctions or unanticipated RCS responses.
(8) Large RCS pressure boundary openings at various locations (SG manways, reactor coolant pump (RCP) bowl, loop stop valves, pressurizer manways)
may lead to instrument malfunctions or unanticipated RCS responses.
(9) Steam generator secondary side inventory and openings may influence RCS
behavior.
2.1.2 Vortexing will
.Yortexing at the junction of the DHR system suction line and the RCS this may occur if water level is too low, a situation to be avoided since may lead to introduce air into the DHR pump suction. Small amounts of air and may subtle changes that occur over a time of minutes to an hour or more,
.1
.. *.
6 propagate to loss of DHR. Large amounts of air may cause immediate loss of pump suction and hence loss of DHR. Vortexing may occur at levels higher than anticipated. For example, vortexing may initiate at the level required to drain SG tubes or if initiated, may continue while at a level where vortexing may not ordinarily initiate. This can lead to operation with unrecognized vortexing and suction of air into the DHR system. Such vortexing and air entrainment may not be reflected by pump current and flow rate instrumentation until it is sufficiently severe that continued operation of the DHR system is jeopardized. As discussed in reference 4, even when vortexing is insufficient to perturb DHR system operation, it may upset the RCS level and level indica- tions and lead to inappropriate operator actions.
For example, the operators were controlling RCS level at Diablo Canyon to the range of 107'0" to 107'8" immediately before the April 10, 1987 event, and they had drained the RCS to 10710" before the event to stay within this band.
DHR was lost when the instrumentation registered about 107'4". The Diablo Canyon licensee later reported to us that vortexing begins to occur at
107'5.5" and is fully developed at 107'3.5" with an RHR flow rate of 3000 gpm (the technical specification (TS) requirement at Diablo Canyon at the time of the event). This vortexing behavior was not understood on April 10.
2.1.3 Steam Generator Tube Draining in Plants Equipped With U-tube Steam Generators Operators frequently drain the RCS to the vicinity of vortexing to drain SG
tubes. For example, the RCS was drained to an elevation below 107'5.5" (top of the pressurizer surge line) to drain SG tubes at Diablo Canyon before the April 10 event. Vortexing was later reported to initiate at 107'5.5'. (See Appendix C of reference 4 for additional information.)
Alternate approaches exist to draining of SG tubes. These include:
(1) Introduce nitrogen via instrument connections located below the SG plena.
This may allow draining of SG tubes with most of the remainder of the RCS
full.
(2) Provide nitrogen directly into the SG plena. This may also allow drain- ing of SG tubes with most of the remainder of the RCS full.
(3) Use nitrogen from the RV to drain SG tubes. This often can be done at a higher RCS level than required to drain with nitrogen from the pressuriz- er.
2.1.4 Reactor Coolant System Level Differences When operating under mid-loop conditions, the critical level parameter is water level in the hot leg essentially at the junction with the DMR system suction line. The significance of this is often unrecognized in connecting level instrumentation and in operation. Yet a change in level of only a few inches can cause loss of DHR, and unrecognized and/or unanalyzed phenomena are more than sufficient to provide such a change. For example, differences exist between actual level at the suction line and the indicated level because of such effects as:
7
(1) Flow from the injection point to the suction connection will cause a level change between these locations because a driving force is necessary to accomplish the flow. The level difference will not be discovered if instrumentation is not independent nor will it be found by calibration between shutdown level instrumentation and the pressurizer level instru- mentation.
(2) RHR return water momentum will result in a level buildup. This will not be found by cross checks between the shutdown level instruments and pressurizer level instrumentation.
Additional information is provided in references 3 and 4.
2.1.5 Decay Heat Removal System Effects DHR systems in a plant are seldom identical. Even changeover from one DHR
system to another may result in loss of DHR due to minor differences in the systems. Changeover from one DHR system to the other can also cause a loss of DHR if it is improperly performed. For example, starting one DHR system while the other is running will increase flow rate, and can lead to entrainment of sufficient air to cause both DHR systems to be lost. The effect can occur as a result of:
(1) The increased DHR system flow rate can cause an increase in vortexing at single drop line plants.
(2) The increased flow rate can lead to a decreased level in the upper vessel and hot legs in plants equipped with one or more drop lines. This can occur because most of the pressure drop occurs between water injection locations and the hot legs, most of which is a common flow path and hence is affected by total flow rate; and by moving RCS inventory into a DHR
system that was initially only partially filled.
Another problem exists with operator response to loss of a DHR system. If the loss were due to RCS conditions, the conditions may be such that it is likely other DHR system pumps also will be lost if they are started without correct- ing the cause of the initial loss.
Shutting off or starting a DHR system may be followed by a change in RCS
inventory (1) if DHR piping drains into the RCS, (2) if air in the DHR system is displaced by water from the RCS, or (3) if air in the RCS is displaced by water from the DHR systems. Similar behavior occurs when air ingestion is occurring and there is an increase or decrease in vortexina. Such a vortexing effect may occur when RHR flow rate changes, when RCS inventory is changed, or when inventory is transferred between systems as a result of the identified effect.
2.1.6 Instrumentation Instrumentation used for level indication needs careful analysis, installation, and protection from damage or changes which may influence instrumentation indication. Level indications may easily be in error by half a foot or more.
Further, connection schemes, flow dynamics, entrapped air, or pressurization
8 may significantly and simultaneously affect all level instrumentation durinn operation with a lowered RCS inventory. These contribute to the mis-diagnosis of events and inappropriate operator response, which may exacerbate the problem. Inaccurate level indication has often led to or contributed to loss of DHR.
Many phenomena affect the instrumentation and should be considered in instru- ment design and installation as well as during plant operation. Failure to do so can lead to misunderstood level instrumentation response, operator mistrust of instrumentation, and inappropriate operator actions.
Another instrument related problem is the limiting of operator information by the common practice of disconnecting instrumentation in preparation for removing the RV head and for other operations commonly conducted during a refueling outage. Frequently, thermocouples in the RY will be disconnected well before the RV head is lifted. Remaining resistance temperature device (RTD) instrumentation in the manifolds (typical of many plants) or the hot and cold legs will not reflect vessel temperatures in a loss of DHR system flow situation even if they are available, and DHR system temperature indication is meaningless if the DHR system pumps are inoperative.
2.2 Time Available for Mitigation The traditional approach to determining system response has been to conserva- tively calculate the time to uncover the core by assuming that RCS inventory heats to the boiling point and that the inventory is then boiled away. This typically has been calculated to take four hours. This traditional approach is nonconservative.
Boiling initiated at Diablo Canyon in 30 to 45 minutes following loss of DHR
in the April 10, 1987 event. More importantly, this boiling caused RCS
pressurization, an unanticipated condition. A different RCS configuration, such as blocked hot legs and an opening in the cold legs, could have quickly led to core uncovery following initiation of boiling, an unanticipated situation. Further, the loss of DHR at Diablo Canyon occurred at a low initial RCS temperature and with a decay heat generation rate less than half of that which could occur during loss of DHR accidents.
Clearly, core uncovery can occur much faster than previously believed, an occurrence the Westinghouse Owners Group (WOG) recently reported to Westing- house owners (ref. 3). (The WOG report identifies boiling in less than 10
minutes.) Severe core damage can follow as soon as adiabatic heatup of the core reaches the point of rapid chemical reaction. There are two important conclusions:
(1) The time available for operators to respond to a loss of DHR can be far less than was previously believed. Immediate actions are necessary to reasonably assure an adequate operator response during such conditions.
(2) This situation constitutes a previously unanalyzed plant condition that can realistically be encountered.
Generic Letter 88-17 provides guidance in correcting this situation.
9
2.3 Generic Letter 87-12 Review of construction GL 87-12 (ref. 1) was transmitted to all licensees and toholdersoperation of nuclear permits for PMRs. It requested information pertinent below that required for normal opera- power plants when the RCS inventory is tion.
topics:
Licensee responses were evaluated with respect to the following
(1) interlocks
(2) draindown operations
(3) DHR operations
(4) SG considerations
(5) test and maintenance operations
(6) RCS pressurization considerations
(7) containment considerations
(8) instrumentation and alarms
(9) backup RCS cooling and makeup
(10) analytic basis
(11) training
(12) Resources available to operator subjects as:
and the evaluations were conducted with consideration of such
(1) understanding of issue
(2) approach
(3) adequacy
(4) procedures and training
(5) malfunction mitigative response not demonstrate The evaluation clearly established that most licensees did The situation may adequate preparation for reduced RCS inventory operation.
be summarized as follows:
(1) Accident initiation. The major reasons for such accidents is that industry has failed to adequately address the issue of operating the RCS inventory. Plants are not well plants under conditions of reduced behavior has not been designed for reduced RCS inventory operation, plant adequately analyzed or understood, instrumentation is inadequate, and inadequate coverage.
procedures sometimes are of poor quality or provide been ill prepared for riti-
(2) Prboression to core damage. Operators have Operators aeting an accident once it has initiated. are expected to recover the normal DHR system or to provide alternate cooling before the have not been given the tools condition becomes serious. Yet, operators to achieve this objective.
(3) Consequences. While the plant is in a reduced RCS inventory condition, licensees generally have their containment open, often with the equipment hatch removed. Many licensees have given little thought to closing the containment or to taking other actions to mitigate the consequences of a core damage accident.
10
Some utilities have achieved a significant improvement in the past year, and are continuing to work on this issue. Those licensees best qualified to deal with loss of DHR during lowered RCS inventory conditions have active improvement programs.
Further information on the review criteria, licensee responses, and review licensee responses will be reported in a NUREG document within the next fewof months.
3.0 NEEDED RESPONSE
Direct loss of DHR is an important initiator of accidents and its loss could cause a release of radioactive material due to a core damage accident. The problem is exacerbated by weakness in procedures for restoration of core cooling, weakness in administrative controls, and by a large likelihood of failure to mitigate a release should the core be damaged.
Actions to minimize the initiation and consequences of loss of DHR take two forms:
(1) Expeditious or immediate actions, which can be implemented quickly and little direct cost, but which may affect plant operations under some at circumstances and cause an operational cost. These actions will signifi- cantly reduce the likelihood of a significant release of radioactive material for the potential core damage accidents of concern here.
(2) Programmed enhancements or longer term actions, which involve development of understanding, procedures, training, and minimal additional instrumentation: When implemented, these will modify some immediate actions and may reduce impact on plant operations caused by the immediate actions, although other impacts may result in some plants.
Expeditious actions will reduce the likelihood of a release due to a core damage accident. They will essentially assure the containment will be closed prior to the time significant core damage could occur if DHR is lost. Addi- tional benefits will ensue because the frequency of loss of DHR accidents will be reduced and operator response to such accidents will be improved.
The longer term programmed enhancements attack the root cause of accident initiation and provide enhanced mitigative response.
4.0 REFERENCES
(1! F. J. Miraglia, 'Loss of Residual Heat Removal (RHR) while the Reactor Coolant System (RCS) is Partially Filled (Generic Letter 87-12)," Letter to all licensees of operating PWRs and holders of construction permits for PWRs, July 9, 1987.
(2) C. E. Rossi, "Possible Sudden Loss of RCS Inventory During Low Coolant Level Operation," NRC Information Notice No. 88-36, June 8, 1988.
11
(3) R. A. Newton, "Westinghouse Owners Group Mid-Loop Operations Concerns," Letter to W. Hodges, NRC, from Chairman of Westinghouse Owners Group, OG-88-24, June 20, 1988. Letter transmits R. A. Newton,
- Westinghouse Owners Group, Early Notification of Mid-Loop Operation Concerns," Letter to Westinghouse Owners Group Primary Representatives
(1L, 1A) from Chairman, Westinghouse Owners Group, OG-88-21, May 27,
1988.
(4) U. S. Nuclear Regulatory Commission, "Loss of Residual Heat Removal System, Diablo Canyon, Unit 2, April 10, 1987," NUREG-1269, June 1987.
ENCLOSURE 2 TO GENERIC LETTER
GUIDANCE FOR MEETING GENERIC LETTER 88-17
s < w 4
2
.
CONTENTS
Page
1.0 OVERVIEW . . . . . . . . . . * . *.. . S . . . . . . 3
1.1 Introduction . . . . .
1.2 Approach . . . . . . . * . . .. 1 3
2.0 GUIDANCE AND STAFF POSITION INFORMATION - EXPEDITIOUS ACTIONS .
.. 5
2.1 Diablo Canyon Event ..................
2.2 Containment Closure .......... .. 5
. . ..... .. 5
2.3 RCS Temperature ..... . . . . . . . .......
2.4 RCS Water Level ..... . . . . . .. 7
. . ....... . .8
2.5 RCS Perturbation ... ........... .....
2.6 RCS Inventory Addition ............ .. 9
..... .. 9
2.7 Nozzle Dams . . . . . . . . . . . . . . . . . . . . . . .
2.8 Loop Stop Valves ...... . . . .. .. 10
.. . ..... .. 10
3.0 PROGRAMMED ENHANCEMENTS . . . . . . . . . . . . . . . . . . . . . 11 ...
3.1 Instrumentation . . . . .. . . . . . . . .
Procedures . . . . . . . . 11
3.2 .. . . . . . .. . . . . . . . . 14
3.3 Equipment . . . . . . . . . . . . . . . . . .. .
3.4 Analyses . . . . . . . . . 15
. . . . . . . . . .
3.5 Technical Specifications . . . . . . . .. . . . . ..
3.6 RCS Perturbations . . . . . . 17
. . . . . . . . . . . . . . . . . 17
4.0 REFERENCES . . .. .. .. . . . . . . . .. 19
3
1.0 OVERVIEW
1.1 Introduction Events have occurred for years that jeopardize core cooling during nonpower operation. These events often have not been taken seriously because of the impression that the low heat generation rate associated with nonpower opera- tion allows considerable time to restore core cooling before core damage begins, and there is a wide range of means available to the operators to restore core cooling. The general industry position seems to have been that the likelihood of a release of radioactive material due to a core damage accident during nonpower operation was so low as to be negligible when com- pared with the likelihood associated with full power operation.
Sigrificant new information has been generated within the past year, notably as a result of the Diablo Canyon event of April 10, 1987, the licensee's efforts following that event, and work conducted by the Westinghouse Owners Group (WOG). (See, for example, refs. 1 - 7.) We now know that several previously unrecognized phenomena need to be addressed. An imnediate response is necessary to deal with this new information. Generic Letter 88-17 requests information from each licensee of a pressurized water reactor (PWR) regarding the licensee response to this need.
This enclosure provides information relative to the actions identified in the letter. The information is not intended to cover all topics, nor does it represent the only solutions we will accept in response to actions identified in the letter. It should be used for guidance. If better solutions are found than illustrated in the enclosure, they should be considered and discussed with us. Our initial objective is to obtain reasonable solutions quickly.
The next objective is to develop a more comprehensive solution which may take longer to develop. Portions of the latter solution may already exist for some plants, and it may thus be feasible to implement some programmed enhancements on a schedule that meets the expeditious actions identified in GL 88-17.
A number of terms are used in the material that follows that are unique to this issue. Other terms will be more familiar, but the meaning may be more precise as applied to the DHR issue. We suggest you review the definitions provided in Enclosure 3 to avoid misunderstandings.
1.2 Approach We are using an approach that couples immediate response and a development program to achieve:
(1) an immediate reduction in the likelihood of a release of radioactive material due to a core damage accident - which we call expeditious actions, and
(2) a longer term reduction in core damage likelihood - defined as programmed enhancements.
4 The approach addresses the three key aspects which influence this issue:
(1) Prevent accident initiators from occurring.
This addresses the root cause. Although some aspects have been incorpo- rated into expeditious actions when the effect on core damage likelihood is immediate and plant implications are understood, effective initiation rate reduction will require an extended effort at many plants. Conse- quently, initiation rate reduction is addressed in the programmed en- hancement recommendations.
(2) If an accident initiates, provide in-depth mitigation capability to prevent core damage.
Comprehensive mitigation planning is also a longer term subject, and is addressed in the programmed enhancement recommendations with some consid- eration provided in the expeditious actions.
(3) Provide a closed containment before the core uncovers if a loss of DHR
occurs.
This is the primary expeditious action because it can be implemented immediately and it provides effective protection against a release.
Control of accident initiation, mitigation of an initiated accident to prevent core damage, and prevention of the release of radioactive material involve the following five topics which are important to safety:
(1) instrumentation
2) procedures
3) maintenance and testing
(4? equipment
(5) analyses A sixth topic, technical specifications (TSs), will be affected by certain changes in the above.
We have carefully considered the unique aspects of nonpower operation and their implications using various methods of addressing the issues. We believe that flexibility in equipment selection and operation will be highly effective under the less demanding physical conditions that exist during nonpower operation. Consequently, with respect to the issue as addressed in GL 88-17, we will accept the following for resolving the items identified in the letter:
(1) Containment closure in lieu of the comparable power operation requirement of containment isolation.
(2) Reliable equipment in lieu of the comparable safety grade classification.
(3) Realistic thermal-hydraulic and mechanical analysis methods (with suit- able safety factors in a few situations) rather than the evaluation model methods and multiple conservatisms that are often used for evaluation of power operation.
5
(4) Realistic equipment response (with suitable safety factors in a few situations) in lieu of conservative assumptions.
Various aspects of these approaches are discussed in the remainder of this enclosure.
2.0 GUIDANCE AND STAFF POSITION INFORMATION - EXPEDITIOUS ACTIOMS
2.1 Diablo Canyon Event
2.1.1 Recommendation Discuss the Diablo Canyon event, related events. lessons learned, and impli- cations with appropriate plant personnel. Provide training shortly before entering a reduced inventory condition.
2.1.2 Discussion He believe the lessons learned from the Diablo Canyon event are important, and that all personnel involved in plant operations during DHR system operation conditions should be aware of the event and more importantly the significance, with emphasis upon knowledge and insight developed as a result of the event.
For example, how many plant personnel are aware that cold leg injection may be ineffective under some shutdown conditions, and that they should use hot leg injection to effectively provide core cooling under those conditions? (See ref. 6.)
Many licensees accomplished this recommendation within a few months of the Diablo Canyon event. However, recently developed insight is important and warrants coverage, and was not covered during the early implementation of the recommendation. The above illustration concerning effective water injection is a good example - the knowledge was only recently disseminated on an industry- wide basis.
2.2 Containment Closure
2.2.1 Recommendation Implement procedures and administrative controls that reasonably assure that containment closure will be achieved prior to the time at which a core uncovery could result from a loss of DHR. These procedures and administrative controls should be active and in use:
(a) prior to entering a reduced RCS inventory condition for nuclear steam supply systems (NSSSs) supplied by Combustion Engineering or Westinghouse, and (b) prior to entering an RCS condition wherein the water level is lower than four inches below the top of the flow area of the hot legs at the junction of the hot legs to the RV for ?ISSSs supplied by Babcock and Wilcox,
.. I ..
6 and should apply whenever operating in those conditions.
If such procedures and administrative controls are not operational, then either do not enter the applicable condition or maintain a closed containment.
2.2.2 Discussion The expeditious action item addressing containment closure is a preliminary action that immediately and effectively reduces the likelihood of a release while providing the flexibility to have the containment building open under appropriate conditions. A wide range of times is available in which to close the containment building depending upon the state and configuration of the RCS.
The expeditious action that we will accept in lieu of analytically determined times includes prescribed times that reasonably assure containment closure in compliance with the recommendation. These times may be modified as soon as suitable analyses provide better estimates of the time between loss of DHR and core uncovery. Although relaxation of times and other programmed enhancement developments may relax containment closure actions, and may be implemented without staff approval subject to the provisions of 10 CFR 50.59, it is not our intention that containment closure provisions be eliminated. We recommend that containment closure considerations remain in effect whenever irradiated fuel is located in the RY unless the decay heat rate is so low that the fuel cannot overheat if completely voided of water.
We will accept containment closure actions which include all of the following:
(1) Containment closure is not necessary if the reactor vessel (RV) and surrounding pool contain no irradiated fuel.
(2) Containment penetrations, including the equipment hatch, may remain open provided closure is reasonably assured within 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of initial loss of DHR - but see the time modifications which are discussed below for some configurations. Emergency procedures which require initiation of closure activities should be operational. Once initiated, closure activities may not be terminated until controlled and stable DHR has been restored and the RCS has been returned to a controlled and stable condition.
(3) The following modifications should be met for nuclear steam supply systems (NSSSs) supplied by Westinghouse (W) and Combustion Engineering (CE):
(a) The 2.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> requirement in item 2 is replaced by 30 minutes (W) or 45 minutes (CE) if openings totaling greater than one square inch exist in the cold legs, reactor coolant pumps (RCPs) (connecting into the cold leg water space) and crossover pipes of the RCS.
This 30 or 45 minute time requirement may be increased to two hours if a vent path from the upper RY is provided which is sufficiently large (with a suitable safety factor) that core uncovery cannot occur due to pressurization resulting from boiling in the core.
(4) As soon as suitable procedures and instrumentation are available and implemented, completion of containment closure following initiation of closure activities may be delayed. This may be done on the basis of reliable temperature information obtained during a transient event provided the containment is closed prior to reaching an RCS temperature
4 7 of 200°F as displayed by the larger of two valid indications of temperature at the top of the core or immediately above the core. The location of such temperature measurements should be at the approximate highest temperature regions expected as a result of measurements obtained during normal power operation or should be representative of those locations.
Reasonable assurance of containment closure should include consideration of activities which must be conducted in a harsh environment. For example, once boiling initiates in the RCS, a large volume of steam may be entering containment, potentially leading to high containment temperature and increased pressure. The 200 F temperature identified above provides assurance that containment is closed prior to the existence of such conditions.
There are several differences in the recommendations for different vendor designed NSSSs. These have been developed from differences in operational history involving loss of DHR and from our appraisal of the implications of loss of DHR. For example, the B&W design is not sensitive to phenomena which can cause a pressure difference to develop between the hot and cold legs in the CE and W designs. Therefore, water is not forced from the RV due to a pressure difference in the B&W design and the allowable times for containment closure reflect this difference. Similarly, the specified water level at which containment closure procedures must be operational is lower in the B&W design than in the other two vendor designs because B&W does not encounter the draining difficulties, and the B&W operational history reflects less likelihood of losing DHR systems. There are a number of other considerations which apply as well, including that B&W designs seldom involve lowering level to a value commonly used in the other designs, and there is little question whether injection water will reach the core in the B&W design.
2.3 RCS Temperature
2.3.1 Recommendation Provide at least two independent, continuous temperature indications that are representative of the core exit conditions whenever the RCS is in a mid-loop condition and the reactor vessel head is located on top of the reactor vessel. Temperature indications should be periodically checked and recorded by an operator or automatically and continuously monitored and alarmed.
Temperature monitoring should be performed either:
(a) by an operator in the control room (CR), or (b) from a location outside of the containment building with provision for providing immediate temperature values to an operator in the CR if significant changes occur. Observations should be recorded at an interval no greater than 15 minutes under normal conditions.**
- Guidance should be developed and provided to operators that covers evacuation of the monitoring post. The guidance should properly balance reactor and personnel safety.
8
2.3.2 Discussion The near term concerns are that boiling may force water from the RY and significantly decrease the time available between loss of DHR and initiation of core damage, that operators should have a direct indication of the condition of the RCS, and that operators should be able to determine the effectiveness of actions taken in response to a loss of DHR.
Temperature is the only variable that can be measured that will directly track the approach to boiling in the RY. Although level can be used as an indication of the adequacy of core coverage, often the available range of level indication does not correspond to the range for which information is necessary. Temperature can assist in bridging that gap. Temperature is also useful as an aid in determining the response necessary to a loss of DHR.
Consequently, we intend that temperature be provided to the operators over as wide a range of plant conditions as is feasible and for which its indication is valuable in guiding operator actions.
The region of most concern is when the RCS is in condition where inventory is low. Minor perturbations in RCS level may cause loss of DHR and temperature increase rate with a low inventory will be faster than under other conditions.
Conseauently, as minimum coverage with respect to expeditious actions while the RV head is located on top of the RV, we recommend that operations be conducted to minimize unavailability of temperature indication during reduced RCS
inventory operation and that temperature indication be provided whenever operating in a mid-loop condition.
2.4 RCS Water Level
2.4.1 Recommendation Provide at least two independent, continuous RCS water level indications whenever the RCS is in a reduced inventory condition. Water level indications should be periodically checked and recorded by an operator or automatically and continuously monitored and alarmed. Water level monitoring should be capable of being performed either:
(a) by an operator in the CR, or (b) from a location other than the CR with provision for providing immediate water level values to an operator in the CR if significant changes occur.
Observations should be recorded at an interval no greater than 15 minutes during normal conditions.**
2.4.2 Discussion We believe reliable, accurate RCS water level information must be provided to the operators whenever approaching or operating in a condition where a loss of level can lead to loss of DHR. Level information is necessary under loss of
- Guidance should be developed and provided to operators that covers evacuation of the monitoring post. The guidance should properly balance reactor and personnel safety.