NUREG-0785, Forwards Draft NUREG-0785, Safety Concerns Associated W/Pipe Breaks in BWR Scram Sys. Requests Rept Re Applicability to Facility & Determination of Remedial Measures
| ML20126K367 | |
| Person / Time | |
|---|---|
| Site: | Fermi  |
| Issue date: | 05/05/1981 |
| From: | Tedesco R Office of Nuclear Reactor Regulation |
| To: | Tauber H DETROIT EDISON CO. |
| References | |
| RTR-NUREG-0785, RTR-NUREG-785 NUDOCS 8105120661 | |
| Download: ML20126K367 (3) | |
Text
{{#Wiki_filter:. 7 3.. ( * - . T + DISTRIBUTION:*w/ enc 1. gusteem6mbe* LB#1 Rdg bec: DEisenhut TERA AfAY 5 G81 JYoungblood PDR* Docket No.: 50-341 LKintner LPDR* MRushbrook NSIC RTedesco TIC Mr. Harry Tauber SHanauer ACRS (16) Vice President RVollmer Engineering & Construction TMurley Detroit Edison Cortpany RMattson 2000 Second Avenue RHartfield, MPA Detroit, Michigan 48226 OELD* OIE(3)
Dear Mr. Tauber:
Subject:
Safety Concerns Associated with Pipe Breaks in the BWR Scran System On April 23, 1981, we discussed with your representatives the HRC's Office of Analysis and Evaluation of Operational Data ( AE00)- report entitled, " Safety Concerns Associated with Pipe Break in the BWR Scram System." The Report describes a potential sequence of events which could result from a break in the BWR scram discharge piping during a scram condition concurrent with an inability to reclose the scram outlet valves. Concerns identified include the quality of the scram discharge volume piping, the ability to detect and isolate 4 such a break, and potential water and steam degradation of available ECCS equipment as a result of the break. A number of recommendations were made in the report to remedy the potential concerns. We are presently studying these issues and recomendations to detemine whether the BWR design basis accidents should be modified and as a consequence whether appropriate actions should be taken for operating BWR plants. The purpose of this letter is o provide to you the AE00 report so that you can evaluate its applicability to your plant and determine appropriate remedial measures, and to request information from you concerning your evaluation in order to assist in determining an appropriate course of action for the NRC. Therefore, please provide us within 45 days of your receipt of this letter, the following infomation:
<1 1 I D
- 1. A generic evaluation of the appifcability of the indicated to sequences of events in the REPORT to the BWR plant desian, O your estimate of the probability of occurrence of such fg[A secuences, and the bases for these conclusions, 24 " N, ,
/ [Llj i
q m
- 2. A generic evaluation of the applicability of the indicated 4 *%0 7 jpgk:B safety concerns and findings in the REPORT relative to BWR \
N a k 'otr N plant construction, design, and operation and the bases for g these conclusions, and t 8105120 5 8/ A c"'c6 .. . .I . . !. . .!. . '" ^ % . .. . . . . .
! .l .
*'Y . ... . . . . . . .
.=: <ca u r e oc .ove m u OFFICIAL RECORD COPY *o *- m
. . . - - - -=
i w .. pv,, _
). .
Ci Mr. Harry Tauber 3. A generic evaluation of the recommendations listed in the REPORT discussing the degree of which the recommendations are being or have been implemented with bases why the recomendations should or should not be completely implemented on BWRs. In addition, provide the following information within 120 days of your receipt of this letter:
- 1. Provide an evaluation of the applicability of the 45 day oeneric evaluation to your plant. This evaluation should contain plant specific considerations related to system design, instrumentation, construction, operation, operator training, and emergency procedures for your plant.
- 2. In light of the AE0D report and the 45 day generic evaluation, provide a plant specific evaluation of your facility's Scram Discharge Volume System conformance to GDC 14, GDC 35, GDC 55, $50.2(v), 50.55a (including footnote 2), and 550.46 of the comission's regulations.
This evaluation should address which portions of the Scram Discharge Volume System are considered to be part of the reactor coolant pressure boundary, the quality group and safety class of the Scram Discharge Volume System, the codes and standards used for the design, fabrication and inservice inspection of this system, and your bases for the above classifications or groupings.
- 3. Provide by analysis or reference a demonstration that a break in the Scram Discharge Volume System meets the requirements of $50.46 of the Comission's regulations, taking into account the environ-mental and flooding aspects of such a break.
Sincerely, orggenal sisel W aohert I. T*188** I Robert L. Tedesco, Assistant Director { for Licensing Division of Licensing l
Enclosure:
As stated I 1 cc w/ encl.: See next page M a c cO DL:LB.6fh( D(( , D ', L ,' j , ,, , ' "* O LXi.,n tn.er/,1 s. ,BJfoyn.gbl.co.d ,RL. e s.c o. , , .
.j .
34 5/3/81 j . .. . . STF/81 5/ /81
; l a.ac scsu re oc ec.Nscu c24c OFFICIAL RECORD COPY " ' ' " " '
Mr. Harry Tauber Vice President ! Engineering & Construction l Detroit Edison Company , 2000 Second Avenue Detroit, Michigan 48226 cc: Eugene B. Thomas, Jr., Esq. David E. Howell, Esq. LeBoeuf, Lamb, Leiby & MacRae 21916 John R 1333 New Hampshire Avenue, N. W. Hazel Park, Michigan 48030 Washington, D. C. 20036 Mr. Bruce Little Peter A. Marquardt, Esq. U. S. Nuclear Regulatory Commission Co-Counsel Resident Inspector's Office The Detroit Edison Company 6450 W. Dixie Highway 2000 Second Avenue Newport, Michigan 48166 Detroit, Michigan 48226 Dr. Wayne Jens Mr. William J. Fahrner Detroit Edison Company Project Manager - Fermi 2 2000 Second Avenue The Detroit Edison Company Detroit, Michigan 48226 2000 Second Avenue Detroit, Michigan 48226
' Mr. Larry E. Schuerman l
_ Detroit _ Edison _ Company _t 3331 West Big Beaver Road : Troy... Mi.ch_i gan 48084._. _ , I I
, E 'e g -
,9e ~
w w- , , -
^
s .. g ba 1 ., NUREG-0785 s ORAFT SAFETY CONCERN 5 ASSOCIATED WITH PIPE BREAKS IN THE BWR SCRAM SYSTEM by the OFFICE FOR ANALYSIS AND EVALUATION OF OPERATIONAL DATA March lor 1 Drecared hy: Stuart 3. Rubin Lead Reactor O Systems incineer 1 y ny(?. 4ggu& HOTE: This recort documents results of studies cer#orned by , the Office 'or Analysis and Evaluation of Coerational i Data. The findings and recommendations contained in this report are orovided in sucocrt of other oncoing i NRC activities and do not reoresent the oosition or : requirements of the resconsible pecoram offices of the f Nuclear Regulatory Commission. l
. - - .. _ _ _.m_, . . . . _ . . _ . . . . . _ . , , . . _ , . _ , . ~ . . . . . . . , . , .- - . , , _ _ - . . , _ , . . . _ , ,
TABLE OF CONTENTS Pace EXECUTIVE
SUMMARY
. . . . . . . . . . . . . . . . . . . . . . . . . . . i
- 1. INTRODUCTION. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
- 2. DISCUSSION OF SAFETY CONCERNS . . . . . . . . . . . . . . . . . . . 3 2.1 3 reak Loca ti o n . . . . . . . . . . . . . . . . . . . . . .. 3 2.2 Break Isol ation. . . . . . . . . ............... A 2.3 Break Di scharge .Condi tions . . . . . . . . . . . . . . . . . . 6 2.1 . Potential Core Consequences. . . . . . . . . . . . . . . . . . 7 2.5 Potential Consequences to the Mitiaation Systems . . . . . . . 8
- 3. FINDINGS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
- 4. RECOMMENDATIONS . . . . . . . . . . . . . . . . . . . . . . . . . 21 5~. REFERENCES. . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 List of Fiaures Fiaure 2-1 Fl oor Pl an - 565 ' El eva tion . . . . . . . . . . . . . . . . . . 26 2-2 Fl oo r P l a n - 519 ' El e v a ti o n . . . . . . . . . . . ....... 27 2-3 Break Outside Containment without Isolation (Co ntrol Ai r Fail ure) . . . . . . . . . . . . . . . . . . . . 29 Aeoendices A Risk Assessment ._ _ _
3 Inspection Report for LaSalle County Station
- - , . .,. . . . . - . . . . . .. .- . .. - .-. - -.. ,. ~ ,- , , - . . . -
- s. .
s .e 4 EXECUTIVE
SUMMARY
Since the Browns Ferry 3 (BF-3) partial failure to scram of June 28, 1980, the scram discharge volume (SDV) subsystem of the SWR scram system has been extensively studied with respect to failure conditions which may cause a loss of scram capability or its protective function. At the same time, while the SDV system has reactor pressure boundary and primary containment boundary functions, little if any review effort has been expended to study the safety concerns associated with postulated pipe break failures within the SDV subsystem. Prompted by the serious and fundamental findings of deficiency, documented in our original BF-3 event case study investigation, AE00 undertook a more thorough safety review of the adequacy of the scram system design with regard to the reactor coolant boundary and primary containment functions. As a result of this further work, important additional issues and safety concerns have been raised with respect to isolation capabilities of the scram system and operation of the energency core cooling systems for SDV cipe break situations. We have found -hat, in the event of a SDV system cipe break attendant to a reactor scram, termination of the resultant reactor coolant blowdown outside primary containment would be dependent on successful closure of non-redundant (scram outlet) valves. The closure principle and design arrangement of these valves do not meet the important reouirements for isolation valves described in GDC 54 and 55 of Appendix A to 10 CFR 50. Furthermore, while the break isolation involves a man-machine system, we have found that potentially less
~
than adequate human factor creparation'has been provided, given the importance to safety of isolating a break in the SDV system. Additionally, in the event that break isolation is not achieved, the current plant emergency coerating procedures do not adequately address the potentially concurrent need for maintaining the care covered and protecting against the loss of ECCS equipment due to adverse environmental conditions including flooding. _ , - _ _ . _ _ - _ _ . . _ _ _ _ _ . .. ~ . _ . __ -
o .
, .- 1 4 -
I l 1 l t '
- ii - ;
We have found that failure to isolate a SDV system oipe break raises sericas concerns regarding the assurance of long-term decay heat removal with emer:ency - core cooling systems since the break-itself ootentially threatens oceration of this equipment. At the same time, information found from our investication for the mechanical intecrity assurance basis of the SDV system pipine indicates that the present level of assurance may not be commensurate with the risks associated with an accidental rupture of this piping. In view of. the deficiencies found and issues raised, we have recommended several corrective actions which should substantially reduce, although not eliminate, the perceived risks associated with a break in the SDV system l
. piping attendant to a reactor scram.
In view of these perceived risks, we recommend that the reculatory need to costulate suen pipe breaks as part of the BWR desien basis be determined and stand <rdized. To this end, we would recommend that a cwo-phase action plan be initiated. The first phase should immediately address and correct 1 the presently inadequate mechanical integrity assurance basis of the SDV ; system comoonents for operating 3WRs. The second phase should incorporate a high priority safety issue review which will address the need to consider such breaks in the design basis and will develop and implement the needed corrective actions on a plant-by-plant basis if it is determined that SDV ' system breaks are to be included in the plant design basis. ! I
3 's
- 1. INTRODUCTION Immediately after the Browns Ferry partial failure to scram of June 29,10P0, the Office for Analysis and Evaluation of Operational Data (AE00) initiated an indeoendent investigation of the event, includino the Browns Ferry 3 scram system design, operation and. operating characteristics. The principal focus of this investigation centered on the Browns Ferry 3 (3F-3) scram discharge volume (SDV) system, including its hydraulic operating characteristics imoortant to reactor scram capability and its protective function. The recort which documented this review also touched uoan the reactor coolant boundary isolation function of the 50V system. As a result of our indecendent investigation, AE00 identified several important deficiencies in the system design and hydraulic characteristics which related principally to the SDV system scrat9 capability and protective functions. The serious and fundamental nature of these findinos made it apparent to AE00 that less than an adeouate. system design review and regulatory safety review had been made when the SDV system design was originally developed and pronosed for use in operating 3WRs. 9ecause of this perception, AE00 made the decision to extend its initial analysis and evaluation of the 3F-3 scram system to include a more thorough safety assessment of the reactor coolant boundary and primary containment functions of the 50V system and its appendages. ,
1 (1) In the case study report for the Browns Ferry 3 partial failure to scram event, we addressed deficiencies in the isolation capabilities of the 3WR scram discharge volume system. We found that during a reactor scram a single active failure (to close) of an SDV system vent valve or drain valve would result in a blowdown of the reactor coolant system (RCS) outside primary containment. For this event, the RCS blowdown could be terminated only if all of the scram discharge valves could be rec 1csed. This is normally 1
2-accomplished from the control room by manually resettina the reactor protection system (RPS). However, as described in the BF-3 case study report and further expanded in this recort, reclosure of the scram outlet valves may not always be possible. For example, many BWR reactor trio conditions do not readily clear or cannot be byoassed in either the SHUTDOWN or REFUELING mode. These are among many conditions that would normally prevent RPS reset. Thus, a sustained trio condition followina a scram, such as caused by closure of the MSIVs, would normally prevent isolation of an RCS blowdown throuan a , stuck open vent or. drain valve. Thus it was noted in our report that closure of-the scram outlet valves via RPS reset would be blocked by the trio condition itsel f (which cannot be bypassed in either the SHUTDOWN or REFUELING mode). Since the time of our case study investication of the 3F-3 event and its cause, we have extended our review to include an assessment of safety concerns associated with sincie cassive failures (i .e., cioe breaks) in the SDV system. It is postulated that attendant to a reactor scram a break may occur in the SDV system piping downstream of the scram outlet valves and upstream of the SDV system vent or drain valves. For this break location automatic closure of the vent or drain line isolation valves will not terminate the RCS blowdown since these valves are located downstream of the break location. In such an event, closure of all scram outlet valves would be the only available option to prevent an uncontrolled RCS blowdown outside primary containment.
2
-2. DISCUSSION OF SAFETY CONCERHS 2.1 Break Location When a BWR is not in a scrammed state, the scram valves are held closed by control air pressure and reactor coolant is retained on the upstream side of the closed valves. In this state, the scram valves perform reactor coolant boundary (RCB) and primary containment isolation (PCII functions. Ocwnstream of the closed scram outlet valves, the SDV headers are continuously drained (emoty), unpressurized (ocen) and isolated from the RCS. The SDV headers in this state provide a scram cacability function in that they provide the required free volume for the reactor water exhausted during a scram. Uoon a reactor scram, the scram outlet valves ocen, the SDV drain and vent valves close and the SDV system pioino fills and pressurizes as it accepts, contains, and limits the water exhausted from the reactor through the control rod drives (CRDs). Even after the control rods have fully inserted, (with the scram valves left open), reactor coolant continues to flow past the CRD seals, through the scram outlet valves and ir,to the SDV system picina pressurizine it to full reactor cressure. Therefore, durina and immediately following a scram the SDV system becomes the reactor coolant retainina boundary well outside of primary containment. After completion of a scram, therefore, the SDV system having fulfilled its scram capability function, assumes a reactor coolant boundary function and a primary containment isolation function.
It is durinQ this fully pressurized state of the SDV system that we have exanined the potential safety concerns associated with a break in the SDV system piping. The pipe break is costulated to he a high energy break in any size line in the system and initiated by the cressure, temoerature and other loadinas attendant to the reactor scram but not, necessarily, consicered in the mechanical design basis of the SDV system.
o, ,
.4.
2.2 Break Isolation From a system's viewpoint, the blowdown of the postulated break into the reactor building (secondary containment where the SDV system pipino is located) could be terminated via manual control room ooerator action by initiatino . group closure of the scram outlet valves. This action requires the ability to manually reset the RPS (which requires RPS power and an absence of trio conditions) and the availability of control air sucoly. However, group closure . of the scram outlet valves has not heretofore been defined as a recuired safety function. Accordingly, the systems (includino control air supply) uoen which operation of the scram outlet valves is deoendent have not been I designed to assure reliable closure of these valves. Thus, isolation of a postulated break in the SDV portion of the RC3 which lies outside crimary l containment and downstream of the hydraulic contral units (HCUs) cannot presently be reliably assured, at least to the degree inherent in other RC8 pipes incorporating qualified isolation valve desions and arrancements. Al thougn the scram outlet valves incorocrate a relatively leak resistant desien, there are numerous disabling conditions consequential to the trip condition or pipe break, as well as numerous disabling single failures in the RPS and control air systems, which could temocrarily or permanently crevent successful reclosure of these valves following a scram. For examole, such conditions ; as (1) a loss of control air pressure for any reason, (2) a trip condition which cannot be bypassed in either the SHUTDOWN or REFUELING mode or (3) a total loss of RPS power sucoly would prevent grouo reclosure of the scram outlet valves. , Also, unlike qualified RC3 or FCI isolation valves, the scram outlet valves do not incorocrate an automatic closure feature. The absence of an auto closure feature is clearly necessitated by the need for a reliable scram function wnich must not be automatically overridden under any circumstances.
o . I The net effect is that scram valve group closure is a manual operation which must be remotely actuated by the operator from one of the control room consoles. Even under such circumstances, closure is precluded by a time delay relay for a minimum of ten seconds. This is to prevent the control room operator from interfering with, or prematurely terminating scram insertion of control rods. Thus, isolation of a break in the SDV system piping with the current design of the scram valve closure apoaratus of necessity involves the human
~
factor; that is, the isolation system for a costulated break in the SDV system piping can be characterized as a " man-machine" system. A review of the " man" s'de of the man-machine SDV break isolation arrancement indicates potentially less t.*an adecuate human-factor preparation. There are no qualified SDV system break detection instruments for the operator to rely upon to quickly identify the presence of a break in the SDV system piping. Typically, BWRs like Browns Ferry-3 have reactor building radiation monitors located in the CRD-HCU areas. However, their coerability and caIibration are not presently included in plant Technical Specification requirements as are other radiation monitorino instruments in the plant. Addi tionally, depending on the sensor positions and their sensitivity, these instruments may annunciate for every reactor scram, regardless of whether a break were present or not. Furthermore, the control room operator has not been provided with special emergency operating procedures or training to quickly and appropriately respond to SDV system pipe break symptoms which would accompany normal post-reactor trip control room indications and activities. Additionally, should immediate reclosure of the scram valves not be possible there are no emergency operating procedures or operator training provided to aid the operator in diagnosing and correcting the source of failure in attaining RPS reset and/or recovering from a loss of control air supply. Continued blowdown of hot reactor water past the scram valves may also decrade and eventually disintegrate their teflon seating surface which could eventually eliminate the primary means of break isolation.
6-A local manual isolation valve is provided in series with each remote air-operated scram outlet valve on each HC'J. However, dispatching an auxiliary operator to enter the reactor buildina to manually close each of these valves would be extremely unlikely, given the harsh environmental conditions including hot water blowdown, high radiation and Dossible loss of lightino or visibility in the area of the reactor buildina where the postulated break is located. Therefore, for both equioment-related and procedural-related reasons, isolation of a break in the SDV system attendant to a reactor scram may not be reliably assured. 2.3 Break Discharge Conditions One should excect that failure to close the remote air-coersted scram outlet valves or the local manual isolation valves would result in.1 considerable blowdown rate out of the reactor coolant system directly into the reactor buildina secondary containment. The blowdown rate would be limited only by either the combined control red drive seal leakace from all drives manifolded by the SDV headers (via the 3/a inch Schedule an scram exhaust risers on each drive) or by the costulated SDV system pipe break si::e and location.
. l Currently, there is no Technical Specification limit for CRD seal leakace j i
l rate. uowever, seal leak rate (stall) testing at the 3F-3 site after the June 29,1980 control rod insertion failure indicated that the averace CRD seal leak rate (with acoreximately 250 psi pressure differential across the seals) could be aoout a 3 gpm per drive. Furthermore, the General Electric (2) Comoany technical manual used for CRD ooeration, maintenance and testing recommends that seals be rebuilt when ual leakage exceeds 5 com. Thus, for 1 A5 CRDs initial cumulative seal leakace could be anywhere from about 550 cpm to 300 com assuming a 250 psi pressure differential across the seal s. Continued blowdown of Nt reactor water throuch the CRDs would likely _ _ , . . . . , . _ _ . , . - _ . , . ~. _ _ . ._
, a.
I 1 1 _7. l i degrade the CRD seals as a result of flashing and cavitation and seal beat-uo j caused by hot oressuri:ed water flowing past the seals. (This effect might be similar to reactor coolant pumo seal degradation followino a loss of sea'1 cooling injection flow.) Thus, the CRD blowdown rate, as initially limited by intact seals, might be expected to increase with time from the magnitudes cited aoove. Reactor system pressure, CRD seal condition, the actual differential pressure across the seals, line losses and the break size / location in the SDV piping system, would ultimately set the blowcown rate in the long term. 2.4 Potential Core Consecuences The anticipated cumulative seal leakage would be expected to be well within the makeup capacity of the high pressure ;oolant injection (HpCI) system or possibly the reactor core isolation cc111ng (RCIC) system. If the HPCI
. system was unavailable, the automatic deoressurization system ( A05) in conjunction with either of the core spray (CSI systems or the low pressure coolant injection (LPCI) subsystem of the residual heat removal (RHR) system could orovide amole alternate makeup. Thus, as far as peak claddino temoerature, maximum cladding oxidation, maximum hydrogen generation, and coolable geometry criteria are concerned , an unisolated break in the SDV system may not be of concer9 during the initial mitigation chases of the event. It is, however, with respect to the continued lono-term core cooling recuirements and the availability of emergency makeup systems over the long term, that such an unisolated break
~
provides unique ECCS challenpes and uncertsinties. Thus, it is with respect to long-term decay heat removal and maintaining the core covered that potentially serious oublic health and safety questions arise. A break in the SDV system without isolation is equivalent to a small unisolated break in the bottom of tne reactor vessel . For this case, the core shroud l
. l
~
and jet pumo diffuser nozzles cannot provide their usual protection against a relatively rapid coolant loss and level drop above the core attendant to a ' temporary loss of makeup supply. This is unlike the case for even the ' largest postulated break in a recirculation line. Furthermore, even primary
. containment flooding (assuming water sucoly and pumps were available) would not assure long-term core coverace since the break would essentially be in the bottom of the vessel but located outside the primary containment structure. ;
, Accordingly, a source of makeup water and adecuate pumping capability must be maintained available indefinitely or until such time that some means of break isolation can be provided. However, because of the unique location of this unisolated break, long term cooling may not be assured, r For an unisolated break in the SUV system, reactor coolant would continue to be. lost out the reactor system without accumulating in the drywell-torus wnich is the .aormal reservoir for water for long term cooling. Reactor water discharged directly into the reactor building would collect on the floor ,
and be carried down through the open floor drains and other open passageways of the reactor building to the basement of the building. Once there, it would collect in the dirty radwaste (DRW) sumos located in the reactor building basement corner rooms. Water collected there would nomally be pumped out of the secondary containment by two small capacity, (50 gem) sump pumps and anter the ORW liquid waste collection system tanks. This water lost l from the reactor would not nomally be suitable or available for return to the reactor.
- i. .
2.5 Potential Consecuences to the Mitigation Systems The reactor building layout for 3F-3 incorocrates large stairwell openings I t' identified by circles in Figure 2-1) in three of the four corners of the l l 1
~
^1 ,
565-foot elevation, where the SDV headers are located. The stair steps are open-lattice _ metal gratings whien would permit hot water to cascade directly l down to the basement floor. There are no curbs at the stairwell entrances. l Any water not removed by the floor drains on the 565-feet elevation floor will run over to the stairwells and flow directly into the basement. Located in the basement at these corners (see circles in Figure 2-2) are the RHR system pumps and the CS system pumos. Thus these low pressure makeup systems might be quickly disabled by the effects of water cascading into the corner rooms and by the flashing of hot water. In this way, a break in the SDV system could result in the loss of most if not all of the low pressure emergency core cooling pumos shortly after the break occurred. Cualification of tnis equipment for operation under such environmental conditions clearly would be questionable'. Additionally, the RCIC pump is located in the same room with one train of the CS pumps and the'HPCI pumo is located in a room whicn is adjacent to ona train of the RHR pumps and would, therefore, also be subject to severe environmental conditions including flooding. The control rod drive pumps are located on a platform above one train of the CS pumps and would be similarly involved in the adverse environmental conditions. The fourth
-corner of the reactor building basement contains an elevator shaft instead of a stairwell which should provide temocrary protection against immediate damage to one train of the residual heat removal system, althougn the environment would degrade quickly.
If break isolation is not successful, the blowdown rate into the reactor building (which could be in excess of 1,000 gem) would substantially exceed i the total capacity of the sump pumos (which is approximately 100 opm). Even if the sumo pumps initially were capable of removing the reactor water being collected in the sumps, assurance of continued dater removal from the sumo
~
l 'O e 1 l cannot be provided indefinitely for_ continued SDV system blowdown. An unarrested ) blowdown would eventually challenge the operability of the sump pumps and 1
- i their electrical ci-cuits with environmental conditions for which they were not desianed. For examole, for SF-3 the sumo pumos are pcwered by the 3C 4A0V reactor buildina MOV boards which are immediately adjacent to the HCUs on the 565 feet elevation. Furthermore, these cumps and their power suppl ses would not be readily accessible by maintenance personnel given the harsn environmental conditions in the reactor building. The cumos are not sucolied with emercency onsite onwer.
Thus it acoears likely that all of the ECCS pumos in the basement would eventually be lost by floodina if the break were not isolated. Cl early , , the unavailability of either cualified hich or Inw cressure makeup coupled with an unisolated break in the bottom of the vessel wnuld result in a continuing drop in water level over the core and eventual core uncnvery. An integrated pictorial overview of the concerns expressed in this section is provided in Figure 2-3. Appendix A contains an estimate of the risk associated with a pipe break in the 50V system.
1
, s.
1 , I 0
- 3. FINDINGS
( 3.1 Durino a BWR reacter scram the SDV system oicing becomes an extension of the reactor coolant boundary outside crimary containment. During this (scram) condi' ' n, only non-redundant (scram outlet) valves protect acainst an uncontrolled blowdown of the reactor coolant which could arise from a costulated oice break in the SDV system oicing. As discussed previously, during a reactor scram the boundary o# the reactor coolant system is extended beyond the scram outlet valves to the SDV system piping which accepts, contains, and limits the.high oressure reactor water exhausted during a scram. The SDV system oiping would normally pressuri:e to full reactor pressure unless the scram outlet valves are reclosed immediately after full control red insertion. Isolation of a postulated break in the 3DV piping curing a reacco- scram *cu!d e.ecend acon Juccessful reclosure of each of the scram out'at valves. There is only one such valve in the flow path from each of the 185 control rod drives to the postulated break. This single " isolation" valve arrangement appears to violate those portions of General Design Criteria 5a and 55 of Apoendix A to 10 CFR 50 which require that reactor coolant pressure boundary piping systems eenetrating primary containment be provided with redundant isolation and containment capacilities which reflect the importance to safety of isolating these piping systems. Clearly, the use of a single isolation (scram) valve does not meet these criteria for the containment isolation function. It is equally clear, however,
l I that the use of an additforal redundant automatic " isolation" valve in the scram discharge (riser) line would adversely impact the reliabili+y of the scram function aspect of the lines. Thus, while opening only a single valve (to cause a rod to scram) is clearly desirable from a scram function reliability viewooint, the availability of only a single valve (to isolate a. break in the SDV system piping) is clearly equally undesirable (if not unacceptable) from a containment isolation function reliability viewpoint. Imolici tly,
~ it may be concluded from the single scram outlet valve arrangement that the overriding need for a highly reliable scram function has taken pr ecedence over (and at the expense of) the reliability of the centainment (and break) isolation function.
3.2 The non-redundant (scram outlet) valves do not utilize a closure princiale or orovide a design arrangement with a reliability reflecting the imcortance of isolating a costulated oice break. The use of scram outlet valves for reliable isolation of a postulated break in the SDV system picing attendant to a reactor scram appears to violate those portions of General Design Criteria 54 and 55 of Appendix A to 10 CFR 50 which recuire that reactor coolant pressure boundary piping systems penetrating primary reactor containment be provided with reliable isolation and containment capabilities which reflect the importance to safety of isolating these systems. As noted earlier, group closure of the scram outlet valves has not heretofore - been defined as a required safety function. Accordingly, the systems upon which scram outlet valve operation is dependent have not been designed with features to assure reliable closure of these valves.
- . . _ _ , . -. _ _ _ _ _ - . . . . _ . ~ . . _ . _ . _ _ , _
13 - Reliable group openinc of these valves has been established as a recuired safety function, to assure a reliable scram function. Because of the need for a reliable scram, the reactor protection and control air systems have been designed such that the numerous possible failure states of either of these systems would cause the scran outlet valves to coen, which is in the
" fail safe" direction for scram function reliability. Conversely, the same possible failure (loss of) modes of these two systems have the cocosite imoact on the reliability of the valves in the aroup closure sense. That is, the list of oossible active and cassive failure states of the reactor cratection and control air systems which will cause the scram valves to open also reeresents the list of oossible common failure modes which would orevent grouo closure of the scram outlet valves when reactor coolant boundary intecrity and contairment isolation are needed.
Some of these common failure causes are reanily correctable thereby permittino relatively promet remote manual arouc reclosur? of these valves, e.o., a reactor trip condition which can be ouickly byoassed in either the SHUTDOWN or REFUELDIG mode. Other causes would not be correctanle even in the lona term, e.g., ruoture of a cocoer tubing control air line caused by a costulated l hign enercy (pipe whip) tyce break in the SDV system cicing or a seismic , event. Access to the source of failure for repair likely would be precluded oy tne harsh environmental conditions created by the break. Thus, the reactor coolant blowdown would not be considered ter tinatable by reclosure of the scram outlet valves.
. r r 3.3 The reliability of ecuioment currently installed and the capability of SDV system oice break detection is neither commensurate with the needed reliability for break isolation nnr reflective of the cotential consecuences of a ructure of the SDV system oicing. Typically, BWR plants like BF-3 have radiation monitors located in each of the CRD-HCU areas of the. reactor buildina. However, this instrumentation is not safety grade nor is it succorted by Technical Soecification coerability and trip setooint (calibration check) requirements. These instruments are also of a sinnie channel design. The reactor building does have reliable l hich rsdiation monitors in the various zones of the ventilation system exhaust duct work. These zone radiation monitors are used for automatic :ene isolation
- of the reactor buildina and for automatic initiation of the standby pas treata nt system. The operability and trip set coint of these instruments are covered by Technical Specification operability and calibration check requirements.
However, these instruments are not sufficiently close to the CRD-HCUs and SDV headers to provide reliable and unambiguous detection of breaks in this equipment. Accordincly, we find that the reliabili ty of the current break detection function of the overall " man-machine" arrangement for SDV break isolation cannot be assured to the decree which would normally be recuired , of a primary containment or a reactor coolant pressure boundary isolation . system.- Operator action to initiate manual reclosure of the scram outlet valves in the event of an SDY system break would be uncertain. l i
,. ._. _-_ . . _ . . . _ . _ . _ . . - _ ~ .._. _ ._ _ _ . . , _ _ . _ _ . _ _ ,
15 - 3.a A'costulated break in the SDV system oicino durino a reactor scram with a failure to reclose the scram outlet valves would result in an uncontrolled reactor coolant blowdown outside primary containment which could threaten the ECC systems and the availability of makeuo water recuired for lono-term core cooling, , As previously discussed, since the 50V system pioing is located in the reactor building and'aut' side primary containment, a costulated break there would , result in a reactor coolant blowdown outside primary containment (unless the scram outlet valves are reclosed). Furthermore, since the SDV piping is below the level of the core and drains from inside the core shroud, reactor hot water could continuously drain out of the reactor vessel and onto the floor of the reactof bc'1dinp. Additionally, an unisolated SDV break inside the reactor building would also, sooner or certainly later, threaten the operability of the emergency core coolino systems recuired for mitigation since the ECC system pumps are located in the basement of the building. The adverse environmental conditions created by the hot water break, together with cotential flooding conditions, would make operability of this equipment ouestionable before very long. Moreover, the water lost from the reactor coolant system would be unavailable to the normal heat removal recirculation flow cath (i.e., torus, low pressure ECC._ system and return to vessel) recuired for long-term cooling. Accordingly, unless the water which is lost from the RCS can be returned to the condensate storage tank (for return to the vessel), all normal ECCS inventory eventually will be depleted. At this point, an alternate makeup source would have to be provided if pumps were still available to deliver the water to the reactor vessel.
, o 3.5 A break in one or more control rod drive scram exhaust lines located uostream of the scram outlet valves and outside crimary containment would result in an unisolatable blowdown of reactor coolant outside of crimary containment even if all scram outlet valves were closed.
Except for the manual isolation valves immediately uostream and downstream of the scram outlet valves, there are no valves in the scram exnaust lines between the CRDs and the SDV which could be closed to isolate a break. Thus, should one or more of the 3/4 inch Schedule 40 exhaust lines rupture upstream of the scram outlet valves and outside primary containment, closino these valves would not isolate the break. Furthermore, since the subject oiping is below the level of the core and drains from inside the core shroud, hot reactor water would continuously drain out of the reactor vessel and onto the floor of the reactor buildino. It should be noted that this situation is dif#erent, for examole, from the small diameter BWR transversing incere probe (T!P) system instrument lines which also penetrate the bottom of the reactor vessel . The TID lines do incorocrate redundant and diverse isolation valves immediately outside the drywell to provide isolation protection. 3reak isolation of the scram exhaust lines is also different from the situation for ruptured DWR steam generator tubes. For this case, leaks through the ructured tubes (wnich would olace the lost reactor coolant outside containment) can be conveniently terminated by draining the crimary system down to a level exoosino the break elevation l of the tubes. The lowest elevation of the tubes is still well above the 1 too of the core; thus, the break flow can always be terminated eventually. Since all of the SWR scram exhaust pipino (and SDV system pioinol is well below the core elevation, drainino the RCS to uncover and thereby terminate the break flow from the bottom of the reactor vessel would not he oossible. 1
. . . . - - . - . - -.- ~ . .- . . ~ . -
I
- 17 -
The CRD seal leakage flow passing through a single scram exhaust line could' range between_3. gpm and 5 gpm immediately after the break to' about 12 gem' _ ! after CRD seal- degradation (assuming a 250 osi pressure differential). The
' flow would be consider *bly higher for a larger- pressure differential which l
might be the case for breaks immediately outside primary containment. Thus, j J rupturing only a few of these lines could cuickly result in a cumulative, break flow which would exceed the capacity of the two 50 gpm sumo cumps in
'the reactor building basement. ,
Although a single passive failure might legitimately be costulated for any pipe'in the reactor coolant boundary (including a scram exhaust line), no SDV system pipe break is thought to concurrently involve the rupture of several exhaust lines. Multiple line failures might occur, however, due to such causes. as large high energy pipe breaks, sabotage or interaction with heavy i equipment (e.g., fuel shipping railroad cars) in the vicinity of the hydraulic ' control units in the reactor building. i 13.6 The assurance orovided by the industry codes and vendor cuality assurance crocrams for the mechanical desien, fabrication, installation, testine and insoection of the SDV system oicing do not aceear to be commensurate : with the risks associated with an accidental rupture of this cioine without
- i sol ation.
As discussed previously, 4 break in the SDV system piping without isolation could result in severe consequences including possible core uncovery since the break might threaten continued operabi'ity of the emergency core cooling systems and the availability of makeup water. Additionally, the reliability
- of.the break isolation arrangement upon which prompt mitigation of the event would be dependent, is considered to be less than adeouate. Under such
. circumstances it would apoear to be aporocriate to comoensate, in cart, m,. ...-,c.,, ,,r.,--c--,,,,w#,,, ,,,c,.,p-_--my,__w,y ,, , ,,a m-, w , y-.ym,,,,,v,.,y,.c,,n.,,-w,..,,,,,, ,_w,,-,,,.,,.,-- ..,,,,ew,,,,.~,,,-,,_,-w-
for these systems-related deficiencies and safety concerns by providing a higher degree of assurance for the mechanical integrity of the SDV system piping during the life of the plant. A review of the current basis for assuring mechanical integrity of the SDV system piping shows that this assurance is not commensurate with the possible consequences associated with a postulated break in this piping. For most of the operating SWRs (i.e., those for which the SDV system mechanical design was initiated before about 1971), the SDV piping system was probably designed, fabricated, installed and inspected to the requirements of USA Standard Code for Pressure Piping-Power Piping,USAS, 331.1. This code did not provide for a detailed quality assurance program for design, fabrication and construction. Also, piping systems for use in water service and built in accordance with B31.1 were not required to have volumetric examinations
'of welds except for those with nominal wall thickness greater than 1-5/8 inches. Pipes of one to two inches in diameter such as drain, vent and instrument lines were not required to have examinations.
The Section III ASME 3&PV Code rules for Class 2 components were available in ) 1971. Plants granted a construction permit from 1971 througn 1973 would probably have been specified to construct the SDV system piping to tne Class 2 l I rules esther than 331.1, but it could vary depending upon the order date for the component. The 331.1 and Class 2 rules are similar and nether requires 1 a thermal fatigue analysis (thermal expansion fatigue by anchors is included). l 1 1
, .c - - - . - - . - - - .
The Browns Ferry-3 SDV system was constructed by Reactor Controls, Inc. (RCI)'of San Jose, California. From conversations.with RCI representatives, it has been learned that'most operating BWR/3 and BWR/4 SDV systems (including the CRD-HCU pioing networks) were constructed by RCI. More recently, RCI has expanded.its scope of supply to include the mechanical engineering design and analysis of the SDV systems. The SDV systems for BWR plants noe under construction would be built to the ASME 3&PV Code, Section III, Suosection "C rules for Class 2 Components. The Code recuires that this work be done in accordance with the quality assurance requirements of ASME Section III Article NCA 4000. t
-However, examination of the construction deficiency report for LaSalle County Station (see Aopendix 3) shows that contrary to these requirements, " Reactor
. Controls, Inc., (designer and installer of portions of the Control Rod Drive System) did not have a OA/0C program that addressed the areas of ... design control, ... and detailed implementing procedures for design, installation, and inspection activities." From this inspection report it may be inferred ,
that most operating SWR SDV systems were not constructed to the hign quality assurance standards now considered to be approoriate and reflective of the potential consequences associated with an accidental rupture of this piping without isolation. Finally, inservice inspection of SDV components built to Section III would be conducted in accordance with the ASME 3&PY Code, Section XI, Subsection IWC rules for Class 2 components. Section XI rules would, most likely, also be followed for SDV components constructed to 331.1 rules because Section 50.55a of 10 CFR Part 50 requires periodic uadating of inservice insoection programs for each plant. The CRD scram exhaust risers and the SDV vent and drain lines could be exempted from examination because they are smaller
l 1 than the 4' diameter exemption provided in the Code. Tne SDV header should not be exempted on either si:e or pressure considerations, but it is not I apparent that all plants include the header in their inservice inspection l l program. One argument that might be used to explain why the header is not ' 1 included is' that there is no need to examine the larger pipe because the maximum break flow is limited by the ficw from a single. 3/4 inch scram exhaust ri se r. If the header is exempted by this reasoning, tnen the only inservice inspection required by the Code would be the system pressure test once every i 3-1/3 years and the system hydrostatic test once every ten years. ! l
l l 4 RECOMMENDATICNS ; l l
- 1. Recuire that the CRD-HCU exhaust lines and SDV system cioine meet the l hichest standards for desian, fabrication, installation, testina, inservice 1
inspection and cuality assurance which can be reasonably attained, j 1 In view of the potentially serious consequences associated with oice breaks in the SDV system without isolation and the significant difficulty and issues involved in improving break isolation reliability, it would accear most accrocriate to first assure that the probability of an SDV system pice break has been adecuately minimized. However, frem our investigation we found that the level of mechanical integrity assurance presently provided for the life of the plant is significantly
- defici ent. We, therefore, recommend that a thorougn re-review of the mechanical design, fabrication, installation, testina, inservice inspection and quality assurance standards and requirements which were aonlied to the existing CRD-HCU and SDV systems be undertaken with the intention ;f evaluating their adecuacy and upgrading as necessary and practicable. Requirino a complete fatigue analysis and a more extensive and frecuent inservice inspection of the small diameter pioing welds for the existins SDV Systems are examples of possible imorevements in these areas. We also recommend that the results of the actual work performed in these areas for all oceratino BWRs be thorouchly re-reviewed and re-oerformed as necessary to assure that the mechanical intecrity recuirements are met and that the current bases are acceotaDie. Finally we recommend that these standards be applied to future BWR CRD-HCU exhaust and SDV systems.
ey g w . -- -,we.< -- -v y e- e- w , y- w. w ,- - w w-r w-r- ei---+ o ..rr --e.=- =t- -w w
l
- 2. ' Assure that ' reliable and redundant break detection instruments such l I
as temperature, humidity, or radiation monitors are provided in the immediate j vicinity of the HCUs and SDV system oicing. t An important component of the SDV system fman-machine
- break isolation arrangement is reliable break detection. Accordingly, it is recommended that reliable (safety grade). break detection instruments be installed in the immediate ,
area of the control rod drive HCUs and SDV system piping. Detection based on high radiation, temoerature, and/or humidity conditions may be used for
.this purpose. These instruments should be covered by Technical Specification setooint and operability ' requirements and should be annunciated in the control room. . They should be redundant. To preclude a single failure from disabling the detection link in the man-machine isolation arrancement. Aeprocriate consideration should be given to adequate environmental qualification. Only ;
with such. break detection instruments can reliable and timely break diagnosis and actions by the coerator be assured.
+
- 3. Develoo and imolement acercoriate emeroency coerating orocedures and coerator training for costulated breaks in the CRD insert or exhaust oicino or the SDV system oicino.
Training provided should familiarize the control room operator with SDV break symotoms, indications, and diagnosis. The emergency procedures developed should' rehuire immediate reclosure of the ' scram outlet valves upon a detected ; break in the SDV system piping. Emergency operatino procedures should include all available mitigation steps if timely reclosuro of the scram outlet valves cannot be accomplished. The procedures should be supported by acercoriate analyses to demonstrate the most approcriate course of action (e.g., cossibly
. _ . . - . __ . _ .:_._ _ _ . . . ~ . . . _ . . . . _ - , _ . . _ - . _ . _
. - . . _ _ _ __ m . __ _ m . . _ . _ _ _ _ -
- 23 -
depressurizing the reactor via' the SRVs to_ reduce the CRD blowdown rate). Subsequent actions required to reclose the scram outlet valvee should be developed and provided. Procedures and trainino require? "or % .. term recovery if, the scram outlet valves cannot be reclosed for an indefinite period should be developed and implemented. These procedures should include . steps to prevent _7 or delay the oossible eventual loss of all ECCS by flooding or environmental damage. Finally,-' consideration should be civen to any special emergency procedures and trainino which may be recuired to terminate a reactor coolant blowdown which cannot be isolated by the scram outlet or manual isolation
-valves because of break location, environmental conditions or valve failure. ,
- 4. Consider improving the closure reliability of the scram outlet valves.
Various ways should be studied for imoroving the closure reliability of the scram outlet valves. Such studies should examine conceots for imoroving the reliability of control air supply (e.g., accumulators) and AC power suoply (e.g., individual alternate temporary er'ergency cower sucoly hookues) to the solenoid scram oilot valves. Any proposed improvements in closure reliability should carefully consider the possible negative impacts on scram reliability.
- 5. Prior to the initiation of any cressure boundary maintenance en the SDV system oicings reouire the manual isolation valve for each scram exhaust riser be closed; and before subsecuent startue. reouire accrocriate verification
! that the manual valves are recoened. i SDV pressure boundary maintenance or modification activities may not be orecluded by Technical Specifications from being performed in any roactor mode. However, such activities would normally be expected to take place durino periods when the reactor is in either SHllTDOWN or REFUEL.ING mode. Activities which result in a loss of SOV. pressure boundary intenrity minht be cerfor 'ed with only the scram outlet valves closed to isolate the SDV system oipino from the l^ l t, , . , - . _ . _ _ . _. _ . . _ , - . _ _ . _ _ _ . . _ , , - _ _ , , . _ . . _ _ _ , , . _ _ _ . , . _ , _ - . . , . . _ _ _ _ , . , _
l l
}
- 24 .
reactor coolant. Maintenance or modification procedures may not recuire that the HCU manual isolation valves also be closed. If the manual valves ; are not closed, the scram outlet valves would be maintained closed with both RPS channels energized and control air pressure apolied to each of the scram valve actuators. Under such circumstances, should a RPS trip condition (or loss of RPS power) or a loss of control air occur, an uncontrolled loss of reactor coolant outside crimary containment would result if the SDV oressure boundary were ocen at that time. Dependino uoan the circumstances, reclosure of the scram outlet valves may not be readily achievable. Accordinoly, to protect acainst such an uncontrolled loss of coolant, it is essential that ennual closure of the manual isolation valves be recuired. It should also be noted that noening the SDV system manual flush valves without an ooerator remaining on standby to assure immediate reclosine, if needed, is another pressure boundary maintenance which requires similar treatment.
- 6. For olants to be constructed consider locating the SDV system headers and HCUs at an elevation in the reactor buildino which would olace them above the too of the reactor core.
3y routing the CRD piping to and from the HCUs and SDV headers to a level above the top of the reactor core, the possibility of an unisolatable break which could drain reactor coolant from below the core would be substantially reduced. It would still be possible for an individual CRD insert or withdraw (scram outlet) line to break below the core level inside the crimary containment. However, only a break outside containment above the level of the too of the core could be cross connected by the flow contribution of all of the scram exhaust lines. Thus, with this arrancement it would he possible to terminate a break in the SDV system by bringing reactor system pressure down to atmospheric condi tions. Deactor water would not be able to drain outside primary containment to below the level of the too of the core.
. . = . .. . ._. . . . - - _ . _ - .
- 5. REFERENCES
- 1. " Report on the. Browns Ferry 3 Partial Failure to Scram Event on June 28,1980," July 30,1980, Office for Analysis and Evaluation of Operational Data, USNRC.
- 2. " Operation and Maintenance Instructions Control Red drive System for
- Browns Ferry Nuclear Plant," GER-9585/9586, June 1971.
1 l
- - - - - -~ . -
. ?6 - -
. - ... . , , . . ._e. .
s 4 f. r gh .. . . . . mC . . . . ,
;. ( =
- 3 6.. N y
a 3 ..} g( . 0 F ', * ./ i.i .: a4.t.
*1 ~ . . . . $f~~' M
. ' ~. . . . , . ,'.~ 1, l - u==--m.m p: ,
s o
> , e
- e -
I i.: 4 . .,
.t
- v .m.
.% ,: i . % , . . . . . . . . _
9 n ,n .- :" - e a y. n
. . . . .E.+'3 .. . _. -.
, t 6.
t i . ._ ._ , ..=, 3 .,
*~ .a l*; **,'t ) .
r 1 LI*, m
> - ._. -+. . s s .1 s u i n a t.9 ,
v a h. ist
- E: :n ::: * : i .-a. g: pwt.:
') ,
- s . s . .; s a .:
e s .: : 2 . : = s t .u I i-
- [l t. L.m, . 1v .r a i s : ?. s i -. ( 4. : : <t t :.n, b, : 4, c
.1;,. e ' , f .. s
; .: v ., . , i. !
- 4. ,- : ,
N'p= .
) *' - '! ijg, r il? '! * ,i,i,7 E
- w cx , _
s.
.,*- '.s la ;,
. y N'
,i .
a ..
- c.s-
~.
- 3. , . os
--- -, y <* - , . -,
-=._ . . ,_ _, . _ _ _ . . _
,,,,4,,
,6
,e.,
. : b..~.".,...,.,. . 'u' , ,
s 4 **, , ' i. .7 ~ , , ,4, . ,%
, . . a . :*
e -*r. .m.em -*==, , c j ,,; -
- x :. ,,, . ), .L j
- v...
,. . a. '. ,4. ,, , {y ..
pi a ....y,x e l. . . , . g- t. s. ,, ,
. *. pe -, .e ,; 4j.
I 3, I Sp w e-- ;'; . g . . e .14 J ., I'l '. ' 4 i J '- - 'w-s)
,a J ti ,,-'; i i U ay atro, ~ '
4 p,..., (-. .s. .tu ! =,M.r.s u
. . f)- . .
yaiI ys;. Q h. g* '.'. ., O 4 *'
.' (-j !7 '.' N ;a_$z I , ,6* ' .!'.
- ) ' .
$.,ai !
i# .a * .=- - jh # '.l . S'Sl yt . . *N ts'.' e, 1 1.;. f;
~ T-y gs
.w^'.. .
%, '*, ' %**3.e* 4 e * , l
**E 'N .. 1 I
; [
"""g*.g ( ). .i w:* ' . .:-a
.a ,. .j. .%.I 3** - 3 s ,4 . - -; ,4 : :
p* < R2.,,,,. m sl* e,. , --- * . r, 2,, .. m - g. =.= **-
'1.U.,e s...j. * . , . -- l, . r$.. . -, .,s P" - . ,/
e, s., S
.I s e
's7. - 4,
... . l: . - . 4 3*o=== .
n f . h
- g ~ ee 9
g e , .l.,..l.4
. . . ,.. g D b N * }.g,
- 8 I
- s .
<.i-
.'.'r.. .,
a g' ,c. r' ., ..-- i
.a. ; .
. -, d ' l7 d, ' l? I,
*. l; 64 7 '
i 44'
-- es
*
- I y= ,
w .
?
4*
%" e#""'-
W' ' kk '
. .)1 ,8 '.:. ,..
gm
.A e.,A 1.*
_-3' ,.-.-- . ,t,i
, [ =- .*
, e. m.m a
g g . yu.e ab. g *e le m.m.e..
.se b- .1 , g ,[ ,' ,' * *se .,,,,,,f e'A . h &: ** s f ,? av . . ..
4 1.t! ..- -<., . .;
; ~.
'm-', I ' . .
i i*
-, ar
.t-
.: r s.,r- . c. o' . ,! ~, .
,.d..
=g, es ,
. 4* 8 e_
e m 4 d H. e- t
- m.o
, ._ _. ,. .g
- . .~,.
,,. e y.
s p.3 ,. .. .
~.
5.
. .e j
, , . :s
_ ,-. 3_._. i - 1s is ;c i s
! , ' ,,J . - . g~4
,l - - .?-. . 4 e
.m.___.
. . , . ._._._i___..
~ . v.a -- . , . . . - . . , ,
.,,..,_, .g ,
. , . . . .w t ..
.t*
... .. nr..... s .
e l} *i
- .,9y ,, . ., __
,-*- ;. 1 , ; ., ';l'? :
. , jv..-
,, ., i::. r ,. ..[ . ,, .
- .! c. n > , <, .
4.
.j - , A e ..i - lt;m'
.icure .
2-1 .loor - Plan .:. o: _, - levation
-+ t. * - -- - - " - rw.- .va,-- c- ~w ---.r " -- ? y -----?1--- *e+------+ . - - - =ce~
+
L'MIT 2
- -* 8f9)
W- .' r - n
- l %
133 %9 ** r v.o - , I
. - fennen e soor l cono a. 4 tw tC9 7. g.,,u,,, ,,, l
.S !, Q_
A .. _ . _ - _ ,_.
' ' , :(. ..,,),._f l'.L:* ,, r:
. . QW . /, % s. , 1"- e -,.,-
c
'f
//f 98' 'P#ld88 Jemf.'S %
* . -- . .JA ll s.,,
..:- ,v,
.~. v :s,a ,, - - - - m3 -
=-
a
- 4. ... * .;-
m : . -- ; W
- a, ,m,-
. . , - , , . c =-*i' .,
4 >4 l
' ,-g . '/l
/
- ere taree \
,s
._ ,j :"
i, ,
.s . ,
. . m ar.,,. . -
- x. .
., ,~', n. ., :a , p.
I lh ,
" '\
at as ' i* ,, .n as
, ,x, , .
L-,
, I .
- 2 - y eis t ,
, i -
. o
- 4 88M N.,JA dfDW 3 g e .
- s
. b. ,,, , . a . 2 s .
-l s . .,
/ 0
!,.r , - l, ,
h m , i
$ s 's.s. / ??.
,.~. rv J.re ,
f w,4,.,/ ., d - s.. ..:s
> , ;u.s.: . .,.s.
,,,,,-,,.?..- .
.:. ,l !
35j
&' .<-n' '
+~ ~ --* f.,m :. . . ;
d
/
'{ h .
_-m.&5 ,
; '.Y.d==- 1
.__ ,3,,
, A._rt ,-, .... >
> ,. . - -xi s ,r.. s ,-
~
t
+,js ,
.#M'F # **488'#3
- t..:,v - EL 513. O 2 < 3i I
l 1 , . _ 1 i
~igure 2-2 .cloor 21an ~10' Elevation t
i ( I i
9 6 4 4 4
. ?S .
Z y I z H
=5, =5. 2z
,f92 m
'.IQ g
.c-< Co u-
< r< .
luIiI I ly) t m Pj a ca 5 m, 60 mo e T I $[-5 om . o 2 we a
. <=
ws :5 g= f , hi' % $4 .: )
~
2N 5 i' sat
- m sd % A3 J y i
$ l k ~ ]" l !. -
si s ** ta!il
~
v=*' 's ~N
< =
~s ' i i j /N*$* s ciE} E'NSIi f 3 ,
f _ m_ m . , .x _ xx y g! ff4 I 46ff lI i I l) w> r t o[ m%' [j - i 1 a 6 { e/ e
- l l -l 4
{ lJ . Il i l l l{ }-jf*M ( e -5 h ' =:T- s~ I lE:: 3 :
# Al'ii ,o ' ', '. :gigg i i i s=i !
s k; N h 1
.l.f
' l. l l .1
- 4. 191' ..
$q i : -
I [t. i . -{e ...g
,Q
.1 e ;
-- ,. c, ,
p 1 l !h a f ,~ L . :. . . e- z~ " - 2 a : ik
; I !
a i :t r . g-s x;. ;.s-a W l-@3:-
% . x i -.'
I_ as" ,' J ,\ 'E 16 i F % g .. ., t s: :: :. of :! ;[ U el- i 5 e s Y." ND[ u. b l!te;.n I - d kIMa ., 3#
'2
< 'n{gy ff k _ $
$!gj N El $$3!
Ifh k.'i : f I 11l 4Ff <%g(! %; c eln -
< 8h.,/ek n ,
h A j' U WDN , 1
,W[ . . ,
h'f j M: I . 2 l t;: -3 p3 I. 'th"; ,! :
$$ I <C"~~ ,,
e/ i@ s .) f \Y! [!. O p: g 3 ap 1.,
/
=
33 j h
.5 g c t-s- h:.
I' i s - _ _ ,,_ _ _ _ _ , _ _ a g \ le l- .
r Accendix A RISK ASSE$5 MENT
. An estimate of the core uncovery risk from a break in the SDV system pioina [
(at'a plant like BF-3) minht be calculated'as follows: P, = P) xP'2 ! where,. ! P, = Probability of Core Uncovery/Rx/Yr P) = Probability of an unisolated SDY break /Rx/Yr l P2 = Probability of core uncovery followinc an.unisolated 50V break -
-t
-where, ,
t P) = (N x~P))) x (P12 ^~ E13) I 4 = Number of Rx scrams /Rx/Yr P)) = Probability of an SDV Break (n sumo cumo capl/Rx scram ! P Probability of not beine able (RPS or control air condition) 12 = to immediately reclose scram valves after a Rx scram /Rx scram ^ Probability of not reclosino (human or procedurall or being P)3 = unable to reclose (break consecuences) scram valves after a SDV break. . If we assume; j N=2 I
.P y = 10"#
P12 " IO P13 : = 10 P = 0.25 2 then P 0
= 10" !
1 l l 1 i e-
_ _ - , . . . . ._.m _ . . . _ . _ .
- h 8-A-2 l l
Discussion Based on BWR operating exoerience it would not be unreasonable to assume that at least two reactor scrams' (from; full pressure and temoerature) occur every
. year at'each plant. - It micht also be assumed that a break in a small line in the SDV system.(downstream of the scram outlet valves and upstream of the SDV system vent and drain valves), resultina in a substantial blowdown rate *,
(>> 100 ppm) can occur once in every in,non BWR reactor scrams. (A blowdown rate of this magnitude could result in eventual loss of the emergency makeup systems if not isolated.) For BWRs it also seems reasonable to assume that out of every ten reactor scrams, one would involve a RDS trio condition or power sucoly failure or a loss of control air suoply such that the scam outlet valves would not be able to be reclosed for an indefinite oeriod of time. Furthermore, should a break'in the SDV system occde, the additional abnormal plant symptoms and reactor system process conditions indicated in the control room could divert and continue to occupy the control room operstne's time and attention (e.a. , reactor water level drop) which could result in the scram valves being left open. - The break itself may also introduce additional failure modes to the break isolation arrangements (e.a., air line failure due a postulated pice whio of a ruptured SDV system line, environmental damage to the detection equipment, damage to the scram valve teflon seatina surfaces caused by prolonged blowdown). We would estimate that considerations such as these could contribute an additional one chance in ten of not isolating a break in the SDV system.
- Note: A break from a one inch Schedule 160 vent line is capable of passina aporoximately 400 gpm at 1,000 osi, while a two-inch Schedule 1 A0 drain line is capable of passing accroximately 1,500 com.
A-3 Finally, in the event of such an unisolated break in the SOV system, we would assume that there is a 75", chance that at least some ECCS equipment in the Reactor Buf1dina basement and emercency makeup inventory will be available to keep the core covered continuously and indefinitely even thouoh none of the equipment is qualified for environmental conditions including flooding. Although the above coint estimate is considered to be 10~ /Rx/Yr, wnich would make this event a significant contributor to risk, the uncertainty range may be such that the uncovery probability most likely lies within the range of 10" /Rx/Yr to 10~'/Rx/Yr. Consecuently 'it is difficult to conclude on the basis of these numbers alone that the existing plant desien configuration is safe, i.e., less than 10~ /Rx/Yr. If from these convolutions one were to conclude that the SDV pipe . break is a significant contributor to BWR core uncovery risk, it is believed that the risk can best be reduced by decreasinu the likelihood of a break in the 50V system pipina by an appropriate upgradina of the SDV system mechanical intecrity assurance basis. The risk can also be reduced in a sienificant althouoh less favorable or desirable way by imorovine the reliability of the break isolation arrangements. l
- , .. . . . - -- , . ~. . . . - . . . -
Accendix 3 IMSPECTIONREPORTFORLaSALLECOUNTYSTATIbN .
.a.n ate oc
#~ .,'s, UNITED STATES
! ~' ,
, NUCLEAR REGULATORY COMMISSION
{ ,.. I REGION til o,, y jf 7se RocstvtLT AcAo g
- Ce 4g oLIN tu.vN. rLuNois sois7 W3 tc61 .
Docket No. 50-373 Docke: No. 50-374 Commonwealth Edison Company ATTN: .4 . Cordell Reed Vic'e President Post office Sox 767 Chicago, IL 60690 Gentlemen: Thank you for your letter dated February 3,1981, informing us of the steps you have taken to correct de noncompliance which we brought to your atten:1on in Inspection Report No. 50-373/30-48; 50-374/S0-30 forwarded by our letter dated January 9, 1981. We will examine these matters during a subsequent inspection.
!n your letter you requested us to reconsider (1) whether the meeting of January 29, 1981 should be classified as an Enforcement Conference and (2) de Severity Level of the noncompliance. We have reconsidered the natter and continue to believe the Severity Level selection is correct and the meeting was an Enforcement Conference.
The Severity Level of these v'.olations was not increased fo: repeating a pre-vious violation. It was our determination that the eroblems relaced to centrol rod drive eice suseension svstems resulted from cegracation of nanagement control systems designec to assure proper plant construction (Severity level IV). Although a close call, we believed it was not a Severity Level III viola-tion, i.e., lack of quality assurance yrogram implementation related to a single work activity as shown by multiple program implementation violations that were not identified and corrected by more than one quality assurance / quality control checkpoint relied upon to identify such violations.
*he meeting is considered an Enforcement Conference because of your noncern-pliance history related to large and small bore pipe suspension systems.
Had the new enforcement p,olicy not been in effect at the time of this inspection, these items would have been infractions and your history would have prompted an Enforcement Conference. Under the new policy we continue to look at past history, so de same concitsien was reached. Aldough we took the position that de " clock started" at the time of issuance of de revised enforcement policy with respect to counting multiple violations of Severity Level I, II, or III items of nonce.pliance, it is necessary that the history before. issuance of the Polic7 be considered in the determination of when to hold an Inforcement Conference.
) ] f . - .
I l Commonwealth Edison-Company MAR 3 ;gg You have stated a desire to meet with us to discuss enforcement. We will contact you in.the_near future to arrange such a meeting.
. Sincerely, James G. Keppler :
Director t ec w/ltr.dtd 2/3/81: ' cc w/ encl: J. S. Abel, Director of Nuclear Licensing L. J. Burke, Site Construction Superintendent T. E. Quaka, Quality Assurance Supervisor R. H. Holyoak, Statica Superintendent B. B. Stephenson Project Manager Central Files Reproduction Unit NRC 20b AECD , Resident Inspector, RIII PER Local PDR'
-NSIC TIC Dean Hansell, Office of
' Assistant Attorney General r
. 4 f .. 'L9
,J.'s.'llh o *C~ %m .0 (
0' 3y\*[ R:!I R:!I e ?T RII: R!!I RII" R IL f
'm ;g ~& j' p.%
Sardi s
/> %'
nm./jp.- Dani_1scf Spessard f.s/: aan Davis Keppler
- 2225/31 -{ g ,,
g/M ,- - [4 L .'.. ? '
Commonwealth Edison cee Ortt Naticeal D'a23. ONCa;c !!heois
- Accress Aecey :c: 70s: C tice Ecx 767
,- ' Chicago, minois 5063c recruary 3, 1981 Mh. James G. <eppler,'Directc; Girecterate of Inspe :icn anc Enfo:cemen: - Regicn III U.S. Nuclear Regulatory Commission 799 Rocsevelt Road Glen Ellyn, IL 60137 Suoject: LaSalle County Station NRC Inspection Report 50-373/30 48 and 50-37A/30 NRC Coc<et Nos. 5C-373/374 Des: H:. Kepple::
In response to :ne su: Ject inspection recc:: transmi;;ec cy you: letter cated January 9, 1981, attacnec are replies Oc :neThe apparent items of noncompliance in :ne Notice Of Viciation. attacnec replies incluce our evaluation of quality assurance pr: gram anc management cont:ci system ima:evements wni:n will :e implemen:ec Oc precluce furtner viciations of :nis ype. The primary reason for tne violati:n was inacequate followup of corrective actions icentifisc in our reply :s your This previous inspection : sport 50-373/S0-20 anc 50-37a/30 13. inacequate fcil:wup occur sc cecause One LaSalle C:unty P:: ject Construction Managsment cic no: recogni:e tneir responsi:ility to7nis folicwup enei: contrac:c:'s cesign cont:ci ec::ective actions. was :ne only LaSalle County C:nstruction Management cent:clie: contractor wi n extensive esign anc analysis responsi:lli:y. 011ec Design and analysis are nc:mally nanclec py =cntrac: :s ::n: Engineering :;anization; :nerefore, cy tne LaSalle Construe:1cn County P:cjectincorrectly assumec :ne cesign anc analysis Management cc: rec:ive ac icns would ce followee cy P: Ject Engineering. Tnis lack of respcnsicility fo: con :ci of centract:: cesign activities is unique to this spe,cifi: contrac:c:. We agree :na: Our followuc nas not acequate to assure timely co;;ee:ive actions to deficiencies As we identifisc statec in in our the meeting venc : quality assurance program by tne NRC. on January 29, 1981, C:mmenweal:n E:is:n nac performec an auci: cf tne venco: in May, 1960, in anien ceficiencies were icentifisc anc in Novem er, 1980 C take nac seneculec a reaucit of :ne vence A1:ncugn Our stecs to ec::ect nis inacecuate rescense :: : ate. f=110wup was not timely, it cic not represent a cread:cwn in Our Quality Assurance pr: gram, o f. t%>ph'h'(DTU{) - 4c gp ns .o o. q;p,) \\pp
4' . I n . j
\
)
1
. g .
~ * * *** d. .dS .* ". *. S ***
. . .* .a. S * .S " s*. ". ".S a. d. 4
- v. ,, .
. . ?. .". S *y *. C *... * * .*. .% *.y
- w* *. . .' *. . S d *
.h. *. W *. ". *..* ,
- I
*** . .. ~.'".'S
. '/ . ^. . .S *. .d " C ' ,
*C
. d.*.**.""..d.".*.
S e V *. *. #. *. */ : '. *. V 8. ' . .**. V *. *. w .a a.
- 5. S a. ., .e .g e..
u g ..
., ar}- 2 C,. , '. ..,, / o u *. x y '. .a .' .". 9e d . .". *. S *.'N~.,. *.
S .
*..*. a.
. v..a 4 n . w. a.
..a.V.40,., 5 ,/ e 0 . 3 *. 4. .. .. . .. . .
'a D 4... t a s e A. .c w.. . m. y. t .o *. 4.1 -
. .s y. .w 4. a. A.
. . . a. ........$.4,..a.
. 4.. ...
. 4 , . . . . . . . . . .
- . m. a. ...s 4
..w . .3. .4 . .. 0,1 -y...... .
w .s ..1 ..../ o .c. , 1.0, .. ...
..y.a*...........y.'.'.'.....
**** *****"* *** "*.d**
... . . . . ...W S .". 0 ". .' .d .*** **.*..* r.S .. .' .'. *. " *. d. . .S.
.# .' .* S *. *...* * ".." ". *..*.*. *. .'".".#.*.s*'..'*.*.
- a. n. . ..c .. . .. a.... a...q. y
- O . .. # * */ " e *.1'.' S *. ' d. *. Wa5 ".m.."..a.e.# .p. . a. a. . a. e. . *.y . c *.4 .. '] . ". k..a. a. .o .a. . o. ,
. # #
- h. e . .,. g y
. ..f . .. . . .
.w
.y a... 4 .m A. .. 3..yy 1 .J 4..s.w.J.7.4 . . . a.
- s. e. c t.s ' .a. m. .o s... 4 e.n ..+ .. .
- n.s .' .s . 4 .a...s, y e . a. s y. a. e... .
- v.1 1..] .
. eQg a. s . . ~
j c q a. . J. *k...
*. a. a. *. d . .... s .
.t4.C J.. .25 m. ..
v 1 n.a..] .,
. . $Q, ,1 0, 2 7. , .s. s.3*#.
- a. .r..# *. *. a. a.
4.,*.*. *...* S S S .# ~6". " *. .** *. .. S *. V e ."#. *= */.' e V a. .'
- g.p...
y ..y. .
*/a. ,/ ..... 9
. . ..] .f r . . . g ,
.m C. ?.eed .
,r.4
. ... , 2. .. a. s a. m.
ib o 027C5
~
J i l l l l l
' Enclosure Rescense te Notice of Viciation
. l The items of apparent noncompliance identified in A;cencix i 1981, are responcec'to in the l A of the NRC lette catec-January 9, l following paragraphs.
ITEM 1 10 CFR 50, Appendix S, Criterion II, states that, "The applicant sna11 estaclisn at the earliest practicacle time consistent ni:n
- ne senecule for accomplishing the activities, a quality assurance p;cgram . .
." and Criterion I, states tnat, "The tne applicant may celegate to c:ners, sucn as centrac:crs, . . .
ac k of estaclisning and executing the quality assurance p;cgram
. . 4 , but sna11 retain responsibill:y :nerefore."
Commonwealth Edison Company Topical Repc:: CE-1A, "Cuality Assurance P:cgram for Nuclear Generating Station," Revision la, catec Septemce: 9, 1980, states in Section 2 tnat, "The quality assurance programs of Commonweal:n Ecison Ccmpany, Aren1:ect Engineers anc Nuclear Steam Supply Sys: Sm vencors include ne quality
- ne requirements of ASHE Section III A :icle NCA-c000, assurance criteria for nuclear power plants for Appencix S c anc 10 CFR 50 "Cuality Assurance Criteria for Nuclear Power Plant,"
- ne mancatory requirements of ANSI NAS.2, "Cuali:y Assurance P cgram Requirements for Nuclear Pcwer Plants" anc ANSI N13.7, ?lants."
"Stancarcs for Acministrative Control for Nuclear Powe The requirements are implementec ey means of cetailec cuality p ccecures delineating the means of cetailec Ouality In p;ccecures acci:1cn, celineating tne specific me:nocciogy to se usec.
incivicual contractor's, facricator's and vencer's cuality Assu:ance programs will incluce :ne applicacle portions of :ne Coce Stanca:cs anc Appencix S as Oney affect :ne tac 41 p cgram."
" Contrary Oc tne acove, Rese:cr Centrol. ace Inc.,
Orive(desi:ner
- ssten- cie ancac:
installer cf ecrtions of :ne C:ntro naye a caeer -rec-im rent accressee ene areas of crenni ;; ten interfaces, cesien cont c1, anc cccument con::cl. In acci :cng tne n ecram asse _ac<ec cetal ec imc;ement nc crocecures f:r cesien. installation, anc :nscec:lon ac:ivi;;es; CORRECTIVE ACTION TAKEN AND RESULTS ACHIEVE 0 Sasec on Auci: 1-80-95 (performed Novemce: 11, 1980 of ancas-cull: Novemoe 12, 1980) Dy CECO QA and CECc Construction review 12, 1980 was issued crawings, a stco *crw letter catec Novemce: inc., ecverinc :ne my P cject Construction to Wesc c; Centrols, installation anc inscection or safety reaa:ec CR0 ::::en cic;ng sovemce: 13, so;ca ;s. -a enraccec s;;c .c:4 .e;;3: =as EFb0 to Ge2c*Sr COntreis, Inc., coverino 911 Safe:v r_e l a t e d
- 2-
= aria ==-'a- we-K since further review of tne deficiencies nctec in ene Novemce: 12, 1980 Stop Work Letter were ceterminec to Oe tne responsicility of React 0: Controls, Inc., San Jose
. Engineering organization. Subsequently, a letter f Om W. H.
Donalcson to J. Millett was written on Novemce: 17, 1980 to identify all the open items recuiring resolution. The " Action Item Lista encompassed the NRC findings anc open items, CECO audit fincings, the S. R. Shelton letter cated Novemce 6, 19S0, and tne CECO CA trend analysis lette: Cated Novemcer la, 1980. In response to tne Stop Work lettes and tne action item list, Reactor Controls. Inc., haS tot 911V " Viewed t 9e !
- 0 4 /O" crocram. As a result, impiamentation instruction anc a gj manual taltnca were written accressino areas where their u,-/QC c : cram neecec imcrovemen:. Tne QA Manua; accenca con;ains an incex anlen incicates enere each point of tne la point criteria are accressed. The instruction cock is incexec to p;cvice a c: css reference to the Reactor Cont:01, Inc., QA Manual anc tne la point criteria. Egggif!: items icenti'lec in tne noncomoliance report are ciscussec ceicw:
- 1. Orcani:stional Interface:
Reactor Cont:01s, Inc., has precarec tne following p;ccecures :: icentify various c:;anizational interfaces:
- 1) QA 1 3-1 Instruction For ;nte: faces 3etween Engineering anc Stress Analysis.
- 2) QA 1 6-3, Instructions for Document Transmittal for Approval.
- 3) RSDA-1, prececure for Review of Cesien c Stress Sontvsis *ecerts Suom;::ec cv vencors or succon: 2::::s.
Accitionally, it has ceen establisned inat tne responsicility for tne transmittal of engineering anc cesign information will be vested with tne Engineering anc Construction Manager for Reactor Cont:cis, Inc., anc tne cognizant LaSalle County Project C:nstruction Engineer.
- 2. Desien Centrol: .
1 l Reactor C:nt:cis, Inc. , nas cevelopec tne fol17 wing procecures to cont:cl cesign:
- 1) QA 1 3-1, Interfaces :etween Engineering anc S :ess Analysis; ;A 1 3-2, 0: awing Changes.
. i
- 2) R50A-1, P:ccedure for Review of Design or Stress Analysis Reports Su:mittec ey vencers c: Succontractors.
. 3) QA 1 5-2, Encineerinc 0:awines anc Encineerinc cnence Noticest QA 1 6-2, ECCL contro;.
- 3. Occument Cont:c1:
Reactor Cont:cis, Inc., has recently institutec a computerizec system for controlling dccuments wnicn have been reviewed and approved for use oy their P:cject Engineer. All documents wnich constitute tne Engineering Controlled Checklist (ECCL) will now ce incluced in tne ecmputerized system. The following p;ccedures implement Reactor Cont:ci's cocument control system.
- 1) QA 1 3-2 Orawing changes
- 2) Q A 1 5-2 Engineering crawings anc engineering enange notices
- 3) QA151 P:ccecure cont:cl
- 4) CA161 Occumen: cent ci neaccuarters
- 5) CA 1 6-2 E :L control
- 6) QA 1 6-3 Occument transmittal fc: app:: val.
- 7) CA 1 6-4 Occument control site /shcp
- 8) QA 1 6-5 Occument control system (computer) 4 Installation anc nscection:
Reacter centrels. inc. nas develecee ca i = ?_ insta;;a;;On of C0mConen; succerts 50 furtner cover t9e instaa2ation anc inscection of :ne CRC 010inC suCC0!~.5, ReaCOCT COntro;s. Inc.. is alSC CeveaOcinq a final waa<cOwn
!?Ececure :o ce usec ror rinal inscec:::n anc ver:f; in;s a:::n of tne as-culi: CRO cloinc anc succor: system.
- procecure w;il encompass tne recu;;emen;s or IE Sulletin 79-14. i 1
i The LaSalle County P:cject construction Engineer anc the Site Oc Suoerviso :eviewec tne preliminary crafts of ne implementation procecures anc :ne ;A vanual accenca in San Oose Cecemce 9, 1950 l t
l
. o l
- l 1
1 1
-A -
tnrougn Decemcer 12, 1980, in c:de; to cetermine that all open , items were ceing accressac. Comments on these procedures anc I tnel: response to the action 1:em list were given to Reac c: Cont:cis at nat time. The formal transmittal of :nese procecures was receivec on site January 12, 1981, anc a:e . currently ceing processec tnrough the formal review by CECO anc l S&L. A preliminary review anc follow-up of implementation procecures anc :ne QA Manual was performec by the NRC Region III and Region IV inspectors cetween January 12, 1981, anc January 15, 1981, in San Oese anc at Eart!cuake Engineering Systems (EES). Reactor Cont:cl's analys'.s sC) con:rac;or , in aan r:anciscc. i; mas exo.aanec to tne anspectors.anas we hac not yet initiatec formal review anc, tnerefe:e, no approval of any Reac:c: Cont:ci's procscures h&c caen given. Scme crocedures were still ceinc cevelcoec. The NRC inspectors acxnow_ecge: :nis anc :ncaca:ac cne : review was solely to keep aoreast of the Reae:c: Con :ci, Inc.,/ CECO corrective action progress. All items raisec curing this NRC inspection were eitner in p cgress or were ceing reviewed and ressivec. Tne cesi:n ene acceetance criteria for stiffness. ceflectien. < ecue-cv, leacine cemeinattens. are currentiv eeine eviewee v eu .-- Re3CiO? Controis, ReaC:c Cont:cis is coinc Onysic31 ;gs;;ne ;s clamos ano unistru: Ma;eriaa. Inese ;es; resu Os slaa ce cmparec tc cne catcuta:ec values usec cy EES in :ne CR0 pipe support analysis. Sargent & Luncy is revising specification J-2922 to incorporate ECNs M-283-LS &nc H-285-LS in an Amencment. These previously transmi::ec ECNs centainec in :ne cesign info:mation necessary for RCI to comclete One analysis. CORRECTIVE ACTION TO AVOIO FUP:HER NCNCCNFL!ANCE I The contract wl:n Reactor Cont:cis is unicue. No otner on-site f contracto: has extensive cesign and analysis responsicility ' coupled with the normal material supply anc erection centrac:. The civision of :ssponsibility witnin CECO, tnat is, Engineering is responsicle for cesign wnereas Construe:Lon is responsicle for acministratidn of cntracts wni:n contain major fiele erection, leac to amoiguous control of :ne cesign po::icn of Reactor Cont:cis scope of work. As a :esult some of :ne caen items from NTC Report 50-373/30-20; 50-37A/80-13 were act acequately followec up to assure successful corrective action prio: to tne NRC inscection recorced in Reco:: 30-373/80 A8; 50-373/30-30. To rescive tnis p;ccir.m, LaSalle County P:cjec: Construction nas oeen given :ne responsioill:y fo: :ne overal; acmints::ation of Rese:c: Control's :on::act. P:cjec: Engineering anc S&L will provi:e assistance anc informa:Lon y y -
.#-w- ,+ w ..r .- - , , - - , . - - . . - s -. _ _-
l i I as necessary but all'cesign anc engineering information ! transmittee to Reactor Controls will be transmittec witn tne knowleoge-of the-LSC P:cjec Construction Engineer to the Reactor Cont:ci,.Inc., Engineering.anc Construction Manager. Similarly, Reactor Control's engineering anc cesign information will be transmitted from the Reactor Control Engineering and Construction Manage to the LSC P:cject Construction Engineer. The previously discussec Amencment to soecification J-2922 will incluce all outstancing ECNs, thus incorporating all cesign anc tecnnical information in one package. The establishment of tne single line :ssponsioility anc interface between React.c: Controls, Inc... Engineering and Construction Manage: and LSCS Project Construction Engineer comoinec with the amencec specification encompassing. outstanding ECNs snoulc imp:cve cesign control. - In accition, review, approval, anc implementation of Reactor Control procecures previously referenceo will provice tne QA/CC cont:cis necessary for cesign, cocument control, installation anc inspection. DATE WHEN FULL. COMPLIANCE WILL 3E ACHIEVED Full compliance is expectec to ce achievec generally in acco:cance witn tne following senecule:
- 1. Suomittal, Review, anc App cval of Procecures 2/2/31 - 2/6/81
- 2. Reactor Control, Inc., Training anc Implementation 2/2/31 - 2/6/81 (of f site) 2/9/91 - 2/13/91 (on site) ,
- 3. Partial _ Life - Occument Cont:ci, QC Inspection, HCU Bracing Detailing anc Material Purenase.
2/6/81 A. Partial Life - CEA Installation 2/13/81
- 5. Partial Life - CRD HCU Bracing E:ection
~
2/13/S1
'6. Implementation Audit in San Jose
- 7. Implementation Aucit - 31te
- 3. Lift 5:00 Work 2/20/81 y- g. ., - , .,.-,w- . - , - - , .__e,p
-_ . . - = . . - . . . -
A
' r In this regarc, we shall provice a copy of the .RCI cocumentation package after'. final CECO. approval has been given in order to l expecite your. review. We request, therefore, that you
. verification review ce timely so that work can De reinitiatec on this project on tne senecule definec aoove. 1 ITEM 2 10 CFR 50, Appendix B, Criterion xvIII, states that, "A ;
comprehensive system of plannec and periccic audits shall ce r
~
carriec out .to verify compliance with all aspects of tne quality assurance program ancito determine tne effectiveness of tne ! program." Commonwealth Ecison Company Topical Report CE-1-A, " Quality Assurance Program for Nuclear Cenerating Stations", Revision 14, catec Septemcer 9, 1980, states in Section la tnat, "Aucits will f oe performec by Commonwealtn Edison Company anc/or its , contractors, suocontractors anc venco s to verify tne s implemer:ation anc effectiveness of quall;y prog:ams unce: :neir cognizance" anc "Aucits will be performec selectively at various ; stages of contracts on a varying frequency, casso on the nature ano safety significance of tne wc:x being cone to verify como11ance anc cetermine tne ef fectiveness of p:ccecures, inspections, tests, p:ccess cent:cis anc cocumenta:icn." Contrary to the aoove, audits of Reactor Controls, Inc. , acceared to be inacequate in :nat tnere was no systematic evaluation of contracto; performance anc aucit fincings ee e no: resc1vec in a timely manner. > I CORRECTIVE ACTION TAKEN AND RESULTS ACHIEVED
- 1. As incicated in Commonwealtn Ecison's lette: o f June 6, .380, responcing to noncompliance items in report 50-373/50-20 anc 50-37A/80-13, an estaolisnec program of Audits anc surveillances does exist for RCI on-site and off-site activicies. RCI's off-site activities nac caen periccically reviewed curing ,
.scheculec aucits'in May, 1977, witn follow up and close out June, 1977; in March, 1979, witn follow up anc close out June, 1979; in March, 1980, with follow up and close out June througn August, 1980. This'plannec evaluation 3:ccess for off-site activities was in accition to A on-site aucits of RCI in 1977 4 in 197S, 8 in 1979, anc 10 in 1980, as well as numerous surveillance of on-site activities. The s :veture of the RCI many on-site reviews necessitate organization is sucn :na evaluation of cocuments precarec off-site anc as suen, cu on-site audits anc su:veillances were incirectly reviewing cff-site activities.
g **'M=y9CaTg*gy'*9" 7 g *r W' a 39 greyet y .p, 9, go .,-,,4 g9 g,yq,,9 97 99,._.qps,- >,,,..g99,.p g.,-ig..w99,.p%-g,94,,.p.We,ye. e 9 q W Tg**wase*mes-4g-,-w 4,-=-r wwp t e- *'Br"E8'-Ilse-88N**-*P-9*'- "
- V
..t ,
\
1 l
- 2. The CECO aucit of RCI anc Earthquake1980, Engineering Systems (EES) reviewec in cetail tne concucted on maren 25, 26, anc 27, RCI design, cesign con :ci, and cesign persennel7:ur qualifications items of
. for-the cont:ci :cc crive (CRD) piping hangers. closec out :nr:ugn noncepmpliance were icentified and-late review.cf RCI management commitments and documents transmitted to :ne site. C:mmonwealtn Ecison nas always hac an estaclisnec program for monitoring cc :ective action anc ultimately c1: sing out :ne aucit noncompliances wnen resolvec to our satisfaction.
this program was comp 11ec witn Commonwealth Ecison celieves that ; curing the close out of this~audd*
- 3. Commonwealth Ecison QA coes acknowiecge tne fact that CA cid not fcilow up'and verify effective close out of tne 1: ems icentifisc in April, curing NRC inspector Yin's audit of RCI (San Jose) For 1980 (NRC Report 50-373/30-20 anc 50-374/30 13).
ceficiencies identified cy the NRC at off-site venco: loca:icns, i: nas ceen tne practice, fc engineering relatec items, tna; anc tne Commonweal:n Ecison Engineering organi:stion responc to, ce :esponsi:le for, follow up and close cut of the ceficien item. Commonwealtn Edison engineering :esponcec :o tne NRC ci:ations incicating satisfac:::y resolution hac :een acnievec. In :nese cases, Quality Assurance wculc no nave initia:ec inis any follow-up action to assure satisfac: cry resciution. p: clam is new resolvec with :ne clear icen:ifica:icn contract of tne cognizan: C:ns::uction Enginee: as overal acminis::a:o:. A. In light of RCI's failure to initiate anc complete ace uate cor:se:1ve actions as c:mmitted in CECO's response of June 6,tne 1980, QA recogni:es :ne need to estaclisn a system Oc track cc::ective action commitments for NRC Regicn III Off-Site venc;; inspections.anc verify proper resolution. Tnis woule :e in acci:icn to our normal p;actice of moni cring f 11:w uo p :gress for on-site ceficiencies. In an effort :: provice Onis coverage, :ne Quality Assurance Department has estaclisnec :y Memorancum #17 cated January la, 1981, a p cgram vnien recuires site QA track all NRC items w1:n a montnly status reco: suomittee to One Manager of QA. This monitoring process is expected to assure timely completien of ecmmi:tec cc::ective action anc shoulc imc:cve the effectiveness of the Commonweal:n Edison GA p cgram in tnis area.
- 5. Relative to tne specific matters of concern identifiec of RCI, San :y Mr.
Jose, immeciate Yin curing nis Novemcer, 1780, auci action was taken ey tne Commonwealtn Ecison Engineering I' organization wnen 1: was cate: mined that follow uo acti:n was not aceouately ccm letec. Separately, Site QA and P::Jee: f Construction nac been pursuing resciuti:n of on-site auci:21, 193C On Oct:ce: I ceficiencies prio: :: Mr. Yin's ::1p :: RCI.
J
. t
- i
..s.
site QA sch'eduled an' audit of RCI's on-site organization fe: the week of Novemce: 10. This aucit was to include formal review of corrective'ac:lon taken cy RCI in response to earlie: CECc
. on-site aucits. That aucit icentifisc inacequate cc::ee:1ve action.cy RCI on; Ceco items. As a result, installation anc inspection' for. all Safety Relatec CR0 Pipe Suoports was stoppec on Novemoe 12, 1980. Tnis "stop work" was later exoanced to incluce all related Engineering activities in San Jose. Thewith stop wo:x will remain in place.until' F;oject Construction, tne concurrence of. Commonweal:n Ecison QA,~is satisfied :nat ,
acequate cc::sctive action has oeen completed. 6.. When Commonwealth Ecison was advised my RCI tha: they nad prepared, in craft form,.what they consicerec tne majori:y of prececares necessary to resolve Commonwealth Ecison anc NRC concerns, ne Site QA Supe:intencent anc the cognizan: P: ject Cons:ruction Engineer performed an intensive review of the craf t cocuments a:-San Jose. . Comments were p:cviced anc in :ne case of- tne cesign interf ace cocument, Octal rewrite of procecure was rec mmendec. The incorporation of all comments nas oeen comoletec and submittal of requi ec documents began the secenc ween of lanuary. Following review and approval of One necessary - p:ccecures, site QA plans to review the co;;ective action on site anc.in San Jose prio to allowing RCI to re: urn to work. This will te followed my an extensive aucit of RCI's implementation cotn :n' site and off site p:0motly after returning to work. CORRECTIVE ACTION TO AVOIO FURTHER NCNCCMPLIANCE In accition to the Commonweal:n Edison QA/QC P: gram enanges accressac in ITEM 1, and tne implementation of Quality Assurance Department Memorancum #17 which was ciscussec acove, the
~
Commonwealtn.Ecison QA Department nas esen :sorgani:sc to ,' improve tne effectiveness of QA management levels in accressing Quality concerns. Each of tne cons::uction sites now nas nree - supervisory level personnel, 2 QA Supervisors anc a QA This Superintancent ratne chan a QA Superviso: as in One past. change shoulc allow tne Site QA c:ganization to follow on-site i anc off-site Quality Items more cicsely. More management attention to significant quality matters anc consequen:1y quicke: resolution of Quality Related P:colems is expectec. This focusing of the attention of the responsible CECO Fieleas Engineer en tne QA/QC activities associa:ec with a p cjec: well as :ne acminist:ative enanges mace in tne concue: of activi:les my the Ceco QA Depa:: ment will p;svent recurrence of . tne ceficiencies icentifisc. G e
- .,.ee -e.,,-s,9w *, * , - - '- -
. . . .~ . . . . ~. -. .- . . .- - - _ . . - . .
4
].
s', e >
. c. <
1 c 9 DATE WHEN FULL COMPLIANCE WILL SE ACHIEVED , The administrative changes in the conduct of review of on-site contrac:or'QA activi:les has been implemented,.inclucing tne acci:1cn of a Site QA Superintencent. Finai review anc acceptance of One RCI QA/QC P:cgram changes will De completec as
~
cefinec in ITEM.l. Thework CECc promptly after tne stop c QA ce verifica:icn nas ceen.liftec. auci: of RCI' a f g + 0 e i i l 1 02798.
' l 4 ,
4 -. . . . . - . _ . . _ . . _ . . . _ _ . . . . _ - , _ . _ . . . . _ . . . , . . - . _ . . . . . , . _ . . . . . _ . _ , . . . _ . , . _ . - . ._ . - -....}}