ML19224C487

Submits Unsolicited Response to IE Bulletin 79-06A,re Sys Transients,Plant Equipment Features & Operating Procedures as Result of TMI Incident

ML19224C487
Person / Time
Site:	Diablo Canyon
Issue date:	05/25/1979
From:	Gormly H PACIFIC GAS & ELECTRIC CO.
To:	Ross D Office of Nuclear Reactor Regulation
References
FOIA-79-98 NUDOCS 7907020452
Download: ML19224C487 (13)

Text

, . .

y:<

)

May 25, 1979 n

Dear Dr. Ross:

i l

Thank you for meeting with me yesterday, and for your entre with

, " Dr. Patson.

Both conversations were i

helpful. As I indicated, pG&I: is committed to do at Diablo what is found necessary at the operating plants.

For your information I have enclosed a copy of o" unsolicited response to 79-OGA.

Sir erely f

R. J. Gormly

/

/

/

/

272 017 7907oeogg;>_

jidlSm M ?4-95

l l

l $* [h .,-

L Mll c ry ,p pa(r 5

l INIRCDUCTION IE Bulletin 79-06A requested holders of operating licenses for Westinghouse pressurized water reactors to respond to 13 issues resulting t' rom the Three Mile Island incident. Though we do not yet have operating j licenses for Diablo Canyon Units 1 and 2, we have elected to reply to I

t Bulletin 79-06A.

f The information in this letter comes from studies by PGandE and by Westinghouse, our NSSS supplier. The studies address the Diablo Canyon system transient response, plant equipment features, and operating procedures, with respect to the Three Mile Island events.

As these studies and the resulting plant modifications progress, we will send supplementary information. Cocnitments made in this and future letters will be implemented before power operation of the plant.

i 272 018

l BULLETIN ITEM 1 Review the desaription of circumstances described in Enclosure 1 of IE Bulletin 79-05 and the preliminary chronology of the TMI-2 3/28/79 accident included in Enclosure 1 ts IE Bulletin 79-05A.

a.

This review should be directed toward understanding: (1) the extreme seriousness and consequences of the simultaneous blocking of both auxiliary feedwater trains at the Three Mile Island Unit 2 plant and other actions taken during the early phases of the accident; (2) the apparent operational errors which led to the eventual core damage; (3) f that the potential exists, under certain accident or transient conditions, to have a water level in the pressurizer simultaneously with the reactor vessel not full of water; and (4) the necessity to systematically analyze plant conditions and parameters and take appropriate corrective action.

b. Operational personnel should be instructed to: (1) not override automatic action of engineered safety features unless continued operation of engineered safety features will result in unsafe plant conditions (see Section 7a.);

and (2) not make operational decisions based solely on a single plant parameter available, indication when one or more confirmatory indications are -

c.

All licensed operators and plant management and superviso 3 with operational responsibilities shall participate in this review and suca participation shall be documented in plant records.

PGandE RESPONSE We have reviewed the av ilable information from the Three Mile Island incident. Information and training sessions are being schedcled and will be documented respons ibilities .

for all operators and for supervisors with operational The sessions will present a detailed discussion and analysis of the events at Three Mile Island, emphasizing the serious effects of having both trainsinofthe early auxiliary event,feedwater secured, the consequences of operator actions the apparent operating errors, and the information available from other control room instrumentation during the transient.

Training will be provided to assure that operating personnel know the consequences of overriding safety functions, the necessity to use all available instrumentation before making an operating decision, and of the circumstances under which it is possible to have a low water level in the reactor without low pressurizer level.

272 019

BULLETIN ITEM 2 Review the aci, ions required by your operating procedures for coping with transients and accidents, with particular attention to:

z Recognition of the possibility of forming voids in the primary coolant system large enough to compromise the core cooling capability, especially natural circulation capability,

b. Operator action required to prevent the formation of such voids,

c. Operator action required to enhance core cooling in the event such voids are formed. (e.g., remote venting)

PGandE RESPONSE We are revising the emergency operating procedures to discuss the possibility of void formation in the vessel, how to recognize such a condition,

=nd the steps necessary to maintain core cooling with voids.

We are working with Westinghouse to decide whether additional.

analyses of other transients and accidents are needed, to prepare and carry cut training programs to assure increased operator undetstanding of the variation of key plant parameters following transient and accidents, and to iacatify any needed modifications in plant equipment or procedures.

The procedures will be revised to specify that the primary system pressure must be scintained above saturation. If primary system pressure urcps below saturation, it will be increased as quickly as possible and the pressurizer vented to the relief tank as necessary. Also, instrumentation will be inctalled in the control room which will continuously display the

-1:lerence between pri=ary system pressure and saturation pressure. An alarm will actuate when saturation pressure is being approached.

It must also be recognized that under some LOCA conditior.s there is no operator action that will prevent the formation of voids in the system.

The ECCS is designed to recover and adequately cool the core following various degrees of primary system voiding, depending on the break size and location.

BULLETIN ITEM 3 For your facilities that use pressurizer water level coincident with pressurizer pressure for automatic initiation of safety inj ection into the reactor coolant system, trip the low pressuriser level setpoint bistables such that, when the pressurizer pressure reaches the low setpoint, safety inj ection would be initiated regardless of the pressurizer level. The pressu-rizer level bistables may be returned to their normal operating positions during the pressurizer pressure channel functional surveillance tests. In adcition, instruct operators to manually initiate safety injection when the pressurizer cressure indication reaches the actuation setpoint whether or not the level

't.-! cation has dropped to the actuation setpoint.

272 020

l '

PGandE RESPONSE The pressurizer low level safety injection bistables will be placed in the tripped condition in operating modes 1, 2, and 3, except during functional testing and calibration of pressurizer level channels. Only one level channel at a time may be placed in the normal condition. Also, we are instructing all our operating personnel to manually initiate safety injection on lov pressurizer pressure regardless of level.

These interim changes will be replaced when permanent solutions are identified which will enhance safety and be reliable. Westinghouse is I designing a system using revised logic to give the desired control response.

ByLLETIN ITEM 4 Re d ew the containment isolation initiation design and procedures, and prepare and implement all changes necessary to permit containment isolation whether manual or automatic, of all lines whose isolation does not cegrade needed safety features or cooling capability, upon automatic initiation of safety injection.

PGandE RESPONSE The containment isolation systems isolate all nonsafcty-related fluid systems penetrating the containment on a Phase A or Phase B containment 1sclation signal.

Phase A is initiated by actuation of the safety injection system and isolates all nonessential process lines but does not affect safety injection, contain=ent spray, component cooling, and stea= and feedwater lines. Phase B is initiated by actuation of the containment spray system and isolates all remaining process lines except safety injection, containment spray, and cuxiliary feedwater.

In addition, the containment purge valves close on a high radiation or safety injection signal.

Containment isolation does not automatically reset by elimination or resetting of the actuatien signal. For example, resetting safety injection will not clear containment solation; the isolation signal can only be cleared by manual controls on the main control board.

features: The containment isolation valves have the following control 1.

The valves will remain closed if the containment isolation signal is reset.

2.

The containment isolation signals override all other automatic control signals.

3.

Each valve can be opened or closed manually af ter the containment isolation signals are reset.

272 021

i f

i BULLETIN ITEM 5 For facilities for which the auxiliary feedwater system is not automatically initiated, prepare and implement immediately procedures which require the utationing of an individual (with no other assigned concurrent duties and in direct and continuous communication with the control room) to l promptly initiate adequate auxiliary feedwater to the steam generator (s) for those transients or accidents the consequences of which can be limited br

, such action.

PGandE RESPONSE The auxiliary feedwater system at Diablo Canyon is initiated automatically.

BULLETIN ITEM 6 For your tacilities, prepare and implement i= mediately procedures which:

a.

Identify those plant indications (such as valve discharge p;oing temperature, valve position indication, or valve discharge relief tank temperature or pressure indication) which plant operators may utilize to determine that pressurizer power operated relief valve (s) are open, and ,

c. Direct the plant operators to r.anually close the power operated relief block valve (s) when rea: tor coelant system pressure is reduced to below the set point for normal automatic closure of the power operated relief valve (s) and the valve (s) remain stuck open.

PGandE RESP 0FSE These valves have position indicating lights on the main control board. However, we are revising our procedures to e=phasize the other available indications from which an open pressurizer power relief valve may be inferred. These include: relief valve discharge line temperature and pressurizer relief tank level, pressure, and temperature. Our procedures will include instructions to close the motor-operated stop valves ahead af the reflief valves whenever the relief valves fail to close automatically. The pressurizer power relief valves have a completely redundant automatic inter-lock signal that will close the valves if the pressure drops to 2185 psig.

EULLETIN ITEM 7 Review the action directed by the operating procedures and training instructions to ensure that:

a.

Operators do not override automatic actions of engineered safety features, unless continued operation of engineered safety features will result in 272 022

unsafe plant conditions. For exacple, if continued operation of engineered safety features would threaten reactor vessel integrity, then the HPI should be secured (as noted in b(2) below).

c.

Operating procedures rurrently, or are revised to, specify that if the high pressure inject on (HPI) system has been automatically actuated because of low pressure condition, it must remain in operation until either:

(1) Both low pressure injection (LPI) pu=ps are in operation and flowing for 20 minutes or longer; at a rate which would assure stable plant behavior; or (2 ', The HPI system has been in operation for 20 minutes, and all hot and cold leg temperatures are at least 50 degrees below the saturation temperature for the existing RCS pressure. If 50 degrees subcooling cannot be maintained after HPI cutoff, the HPI shall be reactivated.

The degree of subcooling beyond 50 degrees F and the length of time HPI is in operation shall be limited by the pressure /teeperature considerations for the vessel integrity.

Opersting procedures cur._atly, or are revised to, specify that in the event of HP1 initiation with reactor coolant pumps (RCP) operating, at least one v.1 shall remain operating for two loop plants and at least two RCPs shall retain operating for 3 or 4 loop plants as long as the pump (s) is providing forced flow, d.

Operators are provided additional information and instructions to not rely upon pressurizer level indication alone, but to also examine press'urizer pressure and other plant parameter indications ;in evaluating plant conditions, e.g., water, inventory in the reactor primary system.

PGandE RESPONSE U-are revising our emergency operating procedures to emphasize that an automatic safety injection signal is not to be overriden without a full evaluation of the circumstances and unless a more hazardous condition would result if safety injection were to continue. For example, in the case of very small LOCA's and secondary side line breaks, which lead to primary system heatup transients, extended safety injection could lead to lifting of the pressurizer power operated relief valves. Another example would be secondary side line breaks leading to primary system cooldown where continued safety injection could exceed reactor vessel pressure criteria.

The revised emergency operating procedures will include instructions for stopping safety injection before such occurrences, while keeping the plant stable.

272 023

r

b. We are revising our procedures to meet the intent of this requirement.

For example, Westinghouse has recommended the folioving criteria for terminating high-head safety injection following a small-break LOCA:

{

A. Wide range RCS pressure > 2000 psi, and B. Wide range RCS pressure increasing, and '#

C. t Narrow range level indication in at least one steam generator, and D. Pressurizer level > 50%.

These criteria, which require that certain system parameters be carefully monitored, assure that the primary system is at least 50 subcooled and stable before safety injection can be terminated. Thus, the intent of Bulletin Item 7.b. is met without making subcooling a direct consideration in the procedures.

For those LOCA conditions where both the high-head and low-head safety injection systems would operate and deliver water to the primary system, the Procedures will call for continued operation of both systems.

c. We are aorking with Westinghouse on this matter.

Westinghouse has not fully evaluated all of the cases covered by the NRC recommendation. Although Westinghouse recommends that the emergency operating procedures for LOCA and steam break accidents remain unchanged and that all reactor coolant pumps be tripped, we have explained more clearly in the procedures the conditions under which the pt should be manually tripped.

These conditions are that the cafety injection pumps are operational, that

- the primary system pressure is decreasing, and that the pressure is below the safety injection actuation setpoint.

The proc.edures have also been changed to say that the pumps should be tripped because of certain containment isolation or ECCS sequencing actions (for example, isolation of component cooling).

It should be noted that all design basir accident analyses assume loss of off-site power causing loss of all reactor coolant pumps.

d.

Existing procedures and training emphasize that operators should not rely upon a single parameter to ter=inat< safety injection. Also, we are evaluating modified procedures provided by Westinghouse which require checking of several parameters during an accident.

272 024

l f BULLETIN IIEM 8 Review all safety-related valve positions, positioning requirements and positive controls to assure that valves remain positioned (open or closed) in a manner to ensure the proper operation of engineered safety features. Also review related procedures, such as those for maintenance, testing, plant and system startup, and supervisory periodic (e.g. , daily /shif t checks,) surveillance to ensure that such valves are returned to their correct positiols following necessary manipulations and are maintained in their proper pis: tions during all operational modes.

_PGandE RESPONSE Wa have reviewed the procedures covering the positioning of safety-related valves and have found the procedures adequate. They include the follow-ing features:

a.

Critical manual valves are sealed in position and a check list is used for inspection.

b. When the Engineered Safety Features System operates, the misaligncent of any remotely-operated critical valve in the system will be shown by a monitor light on the =ain control board.

c.

All safety-related valves which are operated remotely and whose purpose is to open or close (rather than throttle flow) have position indicating lights on the mair control board. Valves with power removed from their motor operators during normal operation have continuously energized pos. tion indicating lights on the =ain control board which are redundant to those in b. above.

d.

All surveillance test procedures include checklists for returning the system to normal.

e.

A surveillance test is required af ter all =aintenance to show that the valves work.

f.

Quality Control proceuares require that any safety-related operations perforced on one shif t are verified on the following shif t.

BULLETIS ITEM 9 Review your operating modes and procedures for all systems designed to transfer potentially radioactive gases and liquids out of the primary containment to assure that undesired pumping, venting or other release of radioactive liquids and gases will not occur inadvertently.

2f2

~

In particular, ensure that such an occurrence would not be caused by

resetting of engineered safety features instrumentation. List all such

20s and indicate:

a. Whether interlocks exist to prevent transfer when high radi:2 tion indication exists, and

b. W:lether such syste=s are isolated by the containment isolation signal.

c. The basis on which continued operability of the above features is assured.

,PGaadE RESPONSE Any safety injection signal causes Phase A containment isolation (see rerponse te Ite: 4). Resetting the safety injection signal will not cause automatic resetting of the containnent isolation signal. The contain=ent isolation s! inal can only be reset =anually by the operator. Plant procedures will instruct che operator to prevent automatic starting of unwanted systems when he resets

=anually the containment isolation signal.

The table below lists all the systems which can =ove potentially railcactive Cases and liquids out of containment. It also shows whether th se syste=s are isolated by a high radiation signal or a containment isolation sf7nal. Each syste= shown will be tested periodically to verify that it works nroperiv.

HI RAD CONT ISO SYSTEM SIGNAL SIGNAL Steam Generator Blowdown Yes Yes-A Steac Generator Sa=ple Yes Yes-A "ain Staa= No Yes-B

_<LS Sa=ples No Yes-A Pressurizer Sa=ples No Yes-A C7CS Normal Letdown No Yes-A uJCS Excess Letdown No Yes-A RCP Seal Leakoff No Yes-A Accu =ulator Samples No Yes-A SIS Test No Yes-A CC4 From RCP's No Yes-B CCU from Vessel Support Coolers No Yes-B CCW from Excess Letdown EX No Yes-A Containment Su=p Discharge No Yes-A RCDT Discharge No Yes-A Containment Purge Exhaust Yes Yes-i RCDT & PRT Gas to Vent Header No Yes-A RCDT & PRT Gas to Analyzer No Yes-A 272 026

BULLETIN ITEM 10 Review and modify as necessary your maintenance and test procedures to ensure that they requAre:

a. Verification, by test or inspection, of the operability of redundant safety-related syste=s prior to the removal of any safety-related system from service.

b.

Verification of the operability of all safety-related systems when they are returned to service following maint. nance or testing.

c.

Explicit notification of involved reactor operational personnel whenever a safety-related system is recoved from and returned to service.

PGandE RESPONSE We have reviet;ed our maintenance and test procedules and are making minor revisions to ensure that, before a safety-related component is removci from service, the redund ant system is operable. This will be accomplished through checklists in the test proceAtres and in the clearance request procedures.

Tha crocedures require the c. tift Supervisor to give written authorization before equipment is removed from service and to acknowledge in writing itt return to service.

Tests to show that equipment works properly after maintenance are also required (see answer to item 8).

BULLETIN ITEM 11 Review your prompt reporting procedures for NRC notification to assure a that NRC controlled is notified or expected within of condition one hour of the time the reactor is not in operation. Further, at that time, an open continuous co==unication channel shall be established and maintained with NRC.

PGandE RESPONSE We are revising our Administrative and E=ergency procedures to provide the notification requirements contained in I E Bulletin 79-06A.

The Resident NRC Inspector at Diablo Canyon has a separate direct cottunication link with Region V headquarters.

272 027

BULLETIN ITEM 12 Review operating modes and procedures to deal with significant amounts of hydrogen gas that may be generated during a transient or other accident that would either re=ain inside the primary system or be released to the containment.

PGandE RESPONSE The methods for removing hydrogen from the reactor coolant system are:

1.

Hydrogen can be stripped from the reactor coolant to the pressurizer vapor space by pressurizer spray operation if -the reactor coolant pump is operating.

2. Hydrogen in the pressurizer vapor space can be vented by power-operated relief valves to the pressurizer relief tank.

3. Hydrogen can be removed from the reactor coolant system by tha letdown line and stripped in the volume contrcl tank where it enters the waste gas system.

4. In the event of a LOCA, hydrogen would vent with the cteam to the containment.

The principal means of dealing with hydrogen in the primary system continues to be the prevention of hydrogen generation by the many design features and operatins limits which limit the operating pressures and temperatures in the system. We are reviewing our aperating procedures and training to be certain that hydrogen in the primary system is carafully considered.

<a we receive more detailed information on hydrogen formation in the primary system at Three Mile Island, we will continue to evaluate the plant equipment and procedures.

We have reviewed the systems and procedures related to hydrogen in the containment building. These are described and evaluated in Chapters 6 and 15 of the Diablo Canycp Final Safe"/ Analysis Report. The preliminary informa-tion from Three Mile Island shows n, long-term rate of hydrogen production and accumulation in the containment exceeding the amounts for which our containment control system was designed. This is true even thcugh the preliminary estinates of clad reaction at Three Mile Island significantly exceed those upon which the Diablo Canyon design criteria were based. This supports the expected-case calculations of long-ter= hydrogen production in our Safety Analysis Report.

Our prelim 1. nary conclusion is that the Three Mile Island accident has not shown that additional containment hydrogen control systems are needed at Diablo Canyon. We will continue to review our systems and procedures as we get more complete information.

'c '/ -? 02o

'N .. . .

t

&;L W N ITEM 13 Propose changes, as required, to those technical specifications

ust be modified as a result of your implementing the above items and identify design changes necessary in order to effect long-ters resolutions of Aesa ite=s.

I h RESPONSE The only Technical Specification changes required will be those

.t

.vcived with implementation of item 3 of this Bulletin. We will submit rwposed changes when a permanent solution has been identified.

W e

272 029