ML19242B534

Forwards Unsolicited Response to IE Bulletin 79-06A, Requesting That Holders of OLs for Westinghouse PWRs Respond to 13 Issues Resulting from TMI Incident

ML19242B534
Person / Time
Site:	Diablo Canyon
Issue date:	05/25/1979
From:	Gormly H PACIFIC GAS & ELECTRIC CO.
To:	Mattson R Office of Nuclear Reactor Regulation
References
NUDOCS 7908080675
Download: ML19242B534 (14)

Text

• /

$ Date ROUTING AND TRANSMITTAL. SUP h ([

TO: (Name, office symbol, room number, Initials Date culMing, Agency / Post)

2. NRC PDR /

2 Assesslor; Unit (P-50) J 3.

4.

S.

_ Mion File ,

Note ar . Rcturn

__ Approval For Clearance Per Conversation As Requested For Correction Prepare Repfy Circufate For Your information see Me Comment investi2ate sfgnature Coordination Justify _

REMARKS TO BE PLACED IN NRC PDP.

52/ 330 7,

DO NOT use this form as a RECORD of approvals, concurrences, disposals, clearances, and similar actions

! FROfA:(Name, org. symbol, Agency / Post) Roorn No.-- p!dg.

, P-ll22B

- Robert L. Tedesco, L" Task Force, Phons No.

Tt1I-2 i X28090

5041-Ic2 OPTIONAL FORIA 41 (Rev. 7-76)

1. U. S.cIC:1977-o-241-530/3228 Ed$YcIfu IN-11.206

s ".a y T ' r ,

Dei +r Dr. Matson:

Thank you for meetinc with ne yesterday. We will undertake to do as you suggested. I'or your inforr.ation, I have included a copy of our unsolicited response to 79-06A. As the staff clarifies its position, we will continue to be responsive.

/"\

Sincerely,

(

'( 'I .

\!um,O',$:t;7 H. J. Gormly / <-

l

/

J

)

a0 % wuauauuows F 9 6

S.z.. / 331 7908080G7f; .

m4

INTRODUCTION IE Bulletin 79-06A requested holders of operating licenses for

~

Westinghouse pressurized water reactors to respond to 13 issues resulting from the Three Mile Island incident. Though we do not yet have operating licenses for Diablo Canyon Units 1 and 2, we have elected to reply to Bulletin 79-06A.

The information in this letter comes from studies by PCandE and by Westinghouse, our NSSS supplier. The studies address the Diablo Canyon system transient response, plant equipment features, and operating procedures, with respect to the Three Mile Island events.

As these studies and the resulting plant modifications progress, we will send supplementary information. Commitments made in this and future letters will be implemented before power operation of the plant.

. fis s

-7 ^

hll , )9L

BULLETIN ITEM 1 Review the description of circumstances described in Enclosure 1 of I Bulletin 79-05 and the preliminary chronology of the TMI 2 3/28/79 accident i...iuded in Enclosure 1 to IE Bulletin 79-05A,

a. This review should be directed toward understanding: (1) the extreme seriousness and consequences of the simultaneous blocking of both auxiliary feedwater trains at the Three Mile Island Unit 2 plant and other actions taken during the early phases of the acci/ent; (2) the apparent operational errors which led to the eventual core damage; (3) that the potential exists, under certain accident or transient conditions, to have a water level in the pressurizer simultaneously with the reactor vessel not full of water; and (4) the necessity to systematically analyze plant conditions and parameters and take appropriate corrective action.

b. Operational personnel should be instructed to: (1) not override autematic action of engineered safety features unless continued operation of engineered safety features will result in unsafe plant conditions (see Section 7a.);

and (2) not make operational decisions based solely on a single plant parameter indication when one or more confirmatory indications are available, n~

c. All licensed operators and plant management and supervisors with operational responsibilities shall participate in this review and such participation shall be documented in plant records.

PCandE RESPONSE We have reviewed the available information from the Three Mile Island incident. Information and training sessions are being scheduled and will be documented for all operators and for supervisors with operational responsibilities.

The sessions will present a detailed discussion and analysis of the events at Three Mile Island, emphasizing the serious effects of having both trains of auxiliary feedwater secured, the consequences of operator actions early in the event, the apparent operating errors, and the information available from other control room instrumentation during the transient.

Training will be provided to assure that operating personnel know the consequences of overriding :afety functions, the necessity to use all available instrumentation before making an operating decision, and of the circuartances under which it is possible to have a low water level in the reactor without low pressurizer level.

117

. //a

b. JJJ

BULLETIN ITEM 2 Revicw the act, ions required by your operating procedures for coping with transients and accide : ts, with particular attention to:

a. Recognition of the possibility of forming voids in the primary coolant system large enough to ompromise the core cooling capability, especially natural circulation capability,

b. Operator action required to prevent the formation of such voids.

c. Operator action required to enhance core cooling in the event such voids are formed. (e.g., remote venting)

PCandE RESPONSE We are revising the emergency operating procedures to discuss the possibility of void formation in the vessel, how to recogniz2 such a condition, and the steps necessary to maintain core cooling with voids.

We are working with Westinghouse to decide whether additional analyses of other transients and accidents are needed, to prepare and carry . gy out training programs to assure increased operator understanding of the variation of key plant parameters following transient and accidents, and to identify any needed modifications in plant equipter.t or procedures.

The procedures will be revised to specify that the primary system pressure must be maintained above saturation. If primary system pressure

' drops below saturation, it will be increased as quickly as possibig and the pressurizer vented to the relief tank as necessary. Also, instrumentation will be installed in the control room which will continuously display the difference between primary system pressure and saturation pressure. An alarm will actuate when saturation pressure is being approached.

It must also be recognized that under some LOCA conditions there is no operator action that will prevent the formation of voids in the system.

The ECCS is designed to recover and adequately cool the core following various degrees of primary system voiding, depending on *.he bre ik size and location.

BULLETIN ITEM 3 For your facilities that use pressurizer water level coincilent with pressurizer pressure for automatic initiation of safety injection lato the reactor coolant system, trip the low pressurizer level setpoint bistables such that, when the pressurizer pressure reaches the low setpoint, safety injection would be initiated regardless of the pressurizer level. The pressu-ri7er level bistables may be returned to their normal operating positions during the pressurizer pressure channel functional survaillance tests. In addition, instruct operators to manually initiate safety injection wlen the pressurizer pressure indication reaches the actuation setpoint whether or not d.e level indication has dropped to the actuation setpoint. ,

}/[

PCandE RESPOSSE _

The pressurizer low level safety injection bistables will be placed in the tripped condition in operating modes 1, 2, and 3, except during functional testing and calibration of pressutizer level clannels. Only one level channel at a time may be placed in the normal condition. Also, we are instructing all our operating personnel to manually initiate safety injection on low pressurizer pressure regardless of level.

These interim changes will be replaced when permanent solutions are identified which will enhance safety and be reliable. Westinghouse is designing a system using revised logic to give the desired control response.

BULLETIN ITEM 4 Review the containment isolation inftiation design and proccdures, and prepare and implement all changes necessary to permit containment isolation whether manual or automatic, of all lines whose isolation does not degrade needed safety features or cooling capability, upon automatic initiation of safety injection.

G?'

yCandE RESPONSE The containment isolation systems isolate all nonsafety-related fluid systems penetrating the containment on a Phase A or Phase B containment isolation signal. Phase A is initiated by actuation of the safety injection system and isolates all nonessential process lines but does not affect safety inj ection, containment spray, component cooling, and steam and feedwater lines. Phase B is initiated by actuation of the containment spray system and isolates all remaining process lines except safety injection, containment spray, and auxiliary feedwater. In addition, the containment purge valves close on a high radiation or safety injection signal.

Containment isolation does not automatically reset by elimination or rosetting of the actuation signal. For example, resetting safety injection will not clear containment isolation; the isolation signal can only be cleared by manual controls on the main control board.

The containment isolation valves have the following centrol features:

1. The val"es will remain closed if the containment isolation signal is reset.

2. The containment isolation signals override all other automatic control signcls.

3. Each valve can be opened or closed manually af ter the containment isolation signals are reset.

S2/ 335

BULLETIN ITEM 5 Tar facilities for which the auxiliary feedwater system is not automatically initiated, prepare and implement immediately procedurer voich require the stationing of an individual (with no other assigned concurrent duties and in direct and continuous communication with the control room) to promptly initiate adequate auxiliary feedwater to the steam ganerator(s) for thost transients or accidents the consequences of which can be limited by such action.

PCandE RESPONSE The auxiliary fe< dwater sysrem at Diablo Canyon is initiated automatically.

BULLETIN ITEM 6 For your facilities, prepare and implement immediately procedures which:

a. Ideatify'thome plant indications (such as valve discharge piping temperature, -

valve position indication, or valve discharge relief tank temperature or precsure ir.dication) which plant operators may utilize to determine that pressurizer power operated relief valve (s) are open, and

b. Direct the plant operators to manually close the power operated relief ck valve (s) when reactor coolant system pressure is reduced to below the

. point for normal automatic closure of the power operated relief valve (s) and the valve (s) remain stuck open.

PCandE RESPONSE

"'iese valves have position indicating .ights on the main control board. How'ver, we are revising our procedures to emphasize the other available irlications from which an open pressurizer power relief value may be inferred. These include: relief valve discharge line temperature and pressurizer relief tank level, pressure, and temperature. Our procedures will include instructions to clo;e the motor-opdrated stop velves ahead of the reflief valses whenever the celief valves fail to close automatically. The pressurizer power relief valves have a completely redundant automatic inter-loci. signal that will close the valves if the pressure drops to 2185 psig.

BULLETIN ITEM 7 - --

D2/ 7, 3 6 Review the action directed by the operating procedures and training instructions to ensure that:

a. Operators do not override automatic actions of engineered safety features, unless continued operation of engineered safety features sill result in

unsafe plant conditions. For example, if continued operation of engineered safety features would threaten reactor vessel integrity, then the HPI should be secured (as noted in b(2) below).

b. Operating procedures currently, or are revised to, specify that if the high pressure injection (HPI) system has been automatically actuated because of low pressure condition, it must remain in operation until either-(1) Both low pressure injection (LPI) pumps are in operation and flowing for 20 minutes or 1cnger; at a rate which would assure stable plant behavior; or (2) The HPI system has been in operation for 20 minutes, and all hot and cold 'ag temperaturce are at least 50 degrees below the saturation temperature for the existing RCS pressure. If 50 degrees subcooling cannot be maintained af ter HFI cutof f, the HPI shall be reactivated.

The degree of subcooling beyond 50 degrees F and the length of time HPI is in operation shall be limited by the pressure / temperature considerations for the vessel integrity.

c. Operating procedures currently, or are revised to, specify that in the event of HPI initiation witn reactor coolant pumps (RCP) operating, at least one RCP shall remain operating for two loop plants and at least two RCPs shall remain operating for 3 or 4 loop plants as long as the pump (s) is providing 'fL:

forced flow.

d. Ooerators are provided additional information and instructions to not rely upon pressurizer level indication alone, but to also examine pressurizer pressure and other plant parameter indications :in evaluating plant conditions, e.g. , water, inventory in the reactor primary system.

PCandE RESPONSE

a. We ace revising our emergency operating procedures to emphasize that an automatic safety injection signal is nut to be overriden without a full evaluation of the circumstances and unless a more bazardous condition would result if safety injection were to continue. For example, in the case of very small LOCA's and secondary side line breaks, which lead to primary system heatup transiencs, extended safety injection could lead to lifting of the pressurizer power operated relief valves. Another example would be secondary side line breaks leading to primary system cooldown where continued safety injection cc.uld exceed reactor vessel pressure criteria.

The revised emergency operating procedures will include instructions for stopping safety injection before such occurrences, while keeping the plant stable.

527 337-

b. We are revising our procedures to meet the intent of this requirement.

For example, Westinh touse has recc= mended the following criteric for terminating high-head safety injection following a small-break LOCA:

A. Wide range RCS pressure > 2000 psi, _ad B. Wide range RCS pressure increasing, and C. Narrow range level indication in at least one steam generator, and D. Prcssurizer level > 50%.

These criteria, which require that certain system parameters be carefully monitored, assure that the primary system is at least 50 subcooled and stable before safety injection can be terminated. Thus, the intent of Bolletin Item 7.b. is met without making subcooling a direct consideration

'in the procedures.

Por those LOCA conditions where both the high-head and low-head safety injection systems would operate and deliver water to the primary system, the Procedures will call for continued operation of both systems.

c. We are working with Westinghouse on this matter.

Westinghouse has not fully evaluated all of the cases covered by the NRC recommendation. Although Westinghouse recommends that the emergency '!;f operating procedures for LOCA and steam break accidents remain unchanged and that all reactor coolant pumps be tripped, we have explained more clearly in the procedures the conditions under which the pumps should be manually tripp.d.

These conditi ,are that the safaty _sectica pumps are operational, that the primary rystem pressure is decreasing, and that the pressure is below the safety injection actuation setpoint.

The procedures have also been changed to say that the pumps should be tripped because of c,ertain containment isolation or ECCS sequencing actions (for example, isolation of component cooling).

It should be noted that all design basis accident analyses assume loss of off-site power causing loss of all reactor coolant pumps.

d. Existing procedures and training emphasize that operators should not rely upon a single parameter to terminate safety injection. Also, we are evaluating modified procedures provided by Westinghouse which requira checking of several parameters during an accident.

t 527 338

BULLETIN ITEM 8 Review all safety-related valve positions, positioning requirecer s and positive controls to assure that valves remain positioned (open or closed) in a manner to ensure the proper operation of engineered safety features. Also review related procedures, such as those for maintenance, testing, plant and system startup, and supervisory periodic (e.g., daily / shift checks,) surveillance to ensure that such valves are returned to their correct positions following necessary manipulations and are maintained in their proper positions during all operational modes.

PGandE RESPONSE We have reviewed the procedures covering the positihning of safety-relatec valves and have found the procedures adequate. They include the follow-ing features:

a. Critical manual valves are sealed in position and a check list is used for inspection.

b. When the Engineered Safety Features System operates, the misalignment of any remotely-operated criticci valve in the system will be shown by a

' . T.

monitor light on the main control board.

c. All safety-related valves which are operated remotely and whose' purpose is to open or close (rather than throttle flow) have position . indicating lights on the main control board. Valves with pow 2r removed from their motor operators during normal operation have continuously energized position indicating lights on the main centrol board which are redundant to those in b. above.

d. All surveillance test procedures include checklists for returning the system to normal.

e. A surveillance test is required after a)) maintenance to show that the valves work.

f. Quality Ccatrol procedures require that any safety-related operations performed on one shift are verified on the following shift.

BULLETIN ITEM '

Review your oi rating modes and procedures for all systems designed to transfer potentially radioactive gases and liquids ,ut of the m imary containment to assure that undesired pumping, venting or other release of radioacilec liquids and gases will not occur inadvertently.

?7Q

~

C"i d[t J!

In particular, ensure that such currence would no; be caused by the resetting of engineered safety features instrumentation. List all such systems and indicate:

a. Whether interlocks exist to prevent transfer when high radiation indication exists, and

b. Whether such systems are isolated by the containment isolation signal.

c. The basis on uhich continued operability of the above features is asaured.

PCandE RESPONSE Any safety injection signal causes Phase A containment isolation (see response to Item 4). Resetting the safety injection signal will not cause automatic resetting of the containment isolation signal. The containment isolation signal car, only be reset manually by the operator. Plant procedures will instruct the cperator to prevent automatic starting of unwanted systems when he r sets manually the containment isolation signal.

The table below lists all the systems uhich can move potentially radioactive gases and liquids out of containment. It also shows whether chese g, systems are isolated by a high radiation signal or a containment isolation signal. Each system shown will be tested periodically to verify that it works properly.

HI RAD CONT ISO SYSTEM SIGNAL SIGNAL Steam Generator Blowdown Yes Yes-/

Steam Generator Sample Yes Yes-A Main Steam No Yes-B RCS Samples No Yes-A Pressurizer Samples No Yes-A CVCS Normal Letdown No Yes-A CVCi Excess Letdown No Yes-A RCP Seal Leakoff No Yes-A Accumulator Samples No Yes-A SIS Test No Yes-A CCW From RCP's No Yes-B CCW frc= Vessel Support Coolers No Yes-B CCW from Excess Letdown HX No Yes-A Containment Sump Discharge No Yes-A RCDT Discharge No Yes -A Containment Purge Exhaust Yes Yes-A RCDT & PRT Gas to Vent Header No Yes-A RCDT & PRT Gas to Analyzer No Yes-A h3!

a L ,

7/C

.j

EULLETIN ITEM 10 Review and modify as necessary your maintenance and test procedures to ensure that they ':equire:

a. Verification, by test or inspection, of the operability of redundant safety-related systems prior to the removal of any safety-related system from service.

b. Verification of the operability of all safety-related systems when they are returned to service following maintenance or testing.

c. Explicit notification of involved reactor operational personna: shenever a safety-related system is removed from and returned to s e rvic e .

PG_andE RESPONSE We have reviewed our maintenance and test procedures and are making minor revisions to ensure that, before a safety-related component is removed from service, the redundant system is operable. This will be accompl shed through checklists in the test proced.tres and in the clearance request procedures.

m:

The procedures require the Shift Supervisor to give written authorization before equipment is removed from service and to acknowledge in writing its return to service.

Tests to show that equipment works properly after maintenance are also required (see answer to item 8).

BULLETIN ITEM 11 Review your prompt reporting procedures for NRC notification to assure that NRC is notified withir. one hour of the time the reactor is I.ot in a controlled or expected condition of operation. Further, at that time, an open continuous communicacion channel shall be established and maintained with NRC.

PGandE RESPONSE We are revising our Administrative and Emergency procedures to provide the notification requirements contained in I E Bullet 1n 79-06A.

The Res . JC Inspector at Diablo Canyon has a separate direct communicatica lin. .n Eegion V headquarters.

Ll! 541

BULI,ETIN ITEM 12 Review operating modes and procchures to deal with significat -

a.aounts of hydrogen gas that may be generated auring a transient or other accident that would either ~ remain it ude the primary system or be released to the containtent. -

PGandE RESPONSE The nethods for removing hydrogen from the reactor coolant system are:

1. Hydrogen can be stripped from the reactor coolant to the pressurizer vapor space by pressurizer spray operation if the reactor coolant pump is operating.

2. Hydrogen in the pressurizer vapor space can be vented by power-operated relief valves to the pressurizar relief tank.

3. Hydrogen can be removed from the reactor coolant system by the letdown line and stripped in the volume control tank where it enters the waste gas system.

4. In the event of a LOCA, hydrogen would vent with the steam to the containment. ]fy The principal means of dealing with hydrogen in the primary system continues to te the prevention of hydrogen generation by the many design features and operating limits which limit the operacing pressures and temperatures in the system. We are reviewing our operating procedures and training to be certain that hydrogen in the primary system is carefully considered.

As we receive more detailed information on hydrogen formation in the primary system at Three Mile island, we will continue to evaluate the plant equipment and procedures.

We have reviewed the systems and procedures related to hydrogen in the containment building. These are described and evaluated in Chapters 6 and 15 of the Diablo Canyon Final Safety Analysis Report. The preliminary informa-tion from Three Mile Island shows no long-tern ratc of hydrogen production and accamulation in the containment exceeding the accu ~ts for which our containment control system was designed. This is true even though the preliminary estimates of clad reaction at Three Mile Island significantly exceed those upon which t e Diablo Canyon design criteria were based. This supports the expected-case calculations of long-term hydrogen production in our Safety Analysis Report.

Our preliminary conc? asion is that the Three Mile Island accident has not shown that additional containment hydrogen control systems are needed at Diablo Canyon. We will continue to review out systems and procedures as we get more complete information.

527 342

BULLETI., ITEM 13 Propose changes, as required, to those technical specifications which must be modified as a result of your implementing the above items and identify design changes necessary in order to effect long-term resolutions of these items.

PGandE RESPONSE The only T2chnical Specification changes requi md will be those involved with implementation of item 3 of this Bu11ctin, We will submit proposed changes when a perranent solution has been identified.

• .r$' 1 y

J//w i lPi 3