ML032950331

Attachment to Generic Letter 88-017 - Loss of Decay Heat Removal

ML032950331
Person / Time
Issue date:	10/17/1988
From:	Crutchfield D Office of Nuclear Reactor Regulation
To:
C. Trammell
References
GL-88-017
Download: ML032950331 (41)

Text

ATTACHMENT TO GENERIC LETTER RECOMMENDED ACTIONS Expeditious actions and programmed enhancements are recommended concerning operation of the NSSS during shutdown coolina or during conditions where such cooling would normally be provided. The recommendations apply whenever there is irradiated fuel in the reactor vessel (RV). These recommendations are summarized below and discussed further in enclosure 2:

Expeditious actions:

The following expeditious actions should be implemented prior to operat-ing in a reduced inventory condition*:

(1) Discuss the Diablo Canyon event, related events, lessons learned, and implications with appropriate plant personnel.

Provide training shortly before entering a reduced inventory condition.

(2) Implement procedures and administration controls that reasonably assure that containment closure** will be achieved prior to the time at which a core uncovery could result from a loss of DHR coupled with an inability to initiate alternate cooling or addition of water to the RCS inventory.

Containment closure procedures should include consideration of potential steam and radioactive material release from the RCS should closure activities extend into the time boiling takes place within the RCS. These procedures and administrative controls should be active and in use:

(a) prior to entering a reduced RCS inventory condition for IISSSs supplied by Combustion Engineering or Westinghouse, and (b) prior to entering an RCS condition wherein the water level is lower than four inches below the top of the flow area of the hot legs at the junction of the hot legs to the RV for NSSSs supplied by Babcock and Wilcox, and should apply whenever operating in those conditions. If such procedures and administrative controls are not operational, then either do not enter the applicable condition or maintain a closed containment.

A reduced inventory condition exists whenever RV water level is lower than three feet below the RV flange.

• • Containment closure is defined as a containment condition where at least one integral barrier to the release of radioactive material is provided.

Further discussion and qualifications which the integral barrier must meet are provided in enclosure 2 and in the definitions provided in enclosure 3.

2 (3) Provide at least two independent, continuous temperature indications that are representative of the core exit conditions whenever the RCS is in a mid-loop condition* and the reactor vessel head is located on top of the reactor vessel. Temperature indications should be periodically checked and recorded by an operator or automatically and continuously monitored and alarmed. Temperature monitoring should be performed either:

(a) by an operator in the control room (CR), or (b) from a location outside of the containment building with provision for providing immediate temperature values to an operator in the CR if significant changes occur. Observations should be recorded at an interval no greater than 15 minutes during normal conditions.**

(4) Provide at least two independent, continuous RCS water level indica-tions whenever the RCS is in a reduced inventory condition. Water level indications should be periodically checked and recorded by an operator or automatically and continuously monitored and alarmed.

Water level monitoring should be capable of being performed either:

(a) by an operator in the CR, or (b) from a location other than the CR with provision for providing immediate water level values to an operator in the CR if significant changes occur. Observations should be recorded at an interval no greater than 15 minutes during normal condi-tions.**

(5) Implement procedures and administrative controls that generally avoid operations that deliberately or knowingly lead to perturba-tions to the RCS and/or to systems that are necessary to maintain the RCS in a stable and controlled condition while the RCS is in a reduced inventory condition.

If operations that could perturb the RCS or systems supporting the RCS must be conducted while in a reduced inventory condition, then additional measures should be taken to assure that the P.CS will remain in a stable and controlled condition. Such additional measures include both prevention of a loss of DHR and enhanced monitoring requirements to ensure timely response To-a loss of DHR should such a loss occur.

A mid-loop condition exists whenever RCS water level is below the top of the flow area of the hot legs at the Junction with the RV.

• • Guidance should be developed and provided to operators that covers evacuation of the monitoring post. The guidance should properly balance reactor and personnel safety.

3 (6) Provide at least two available* or operable means of adding inventory to the RCS that are in addition to pumps that are a part of the normal DHR systems. These should include at least one high pressure injection pump. The water addition rate capable of being provided by each of the means should be at least sufficient to keep the core covered.

Procedures for use of these systems during loss of DHR events should be provided. The path of water addition must be specified to assure the flow does not bypass the reactor vessel before exiting any opening in the RCS.

(7) (applicable to Westinghouse and Combustion Engineering nuclear steam supply system (NSSS) designs)

Implement procedures and administra-tive controls that reasonably assure that all hot legs are not blocked simultaneously by nozzle dams unless a vent path is provided that is large enough to prevent pressurization of the upper plenum of the RV. See references 1 and 2.

(8) (applicable to NSSSs with loop stop valves) Implement procedures and administrative controls that reasonably assure that all hot legs are not blocked simultaneously by closed stop valves unless a vent path is provided that is large enough to prevent pressurization of the RV upper plenum or unless the RCS configuration prevents RV water loss if RV pressurization should occur. Closing cold legs by nozzle dams does not meet this condition.

Programmed enhancements:

Programmed enhancements should be developed in parallel with the expedi-tious actions and they may replace, supplement, or add to the expeditious actions. For example, programmed enhancements may be used to change expeditious actions as a result of better understanding or improved procedures. This may lessen the initial impact of expeditious actions such as the speed with which containment closure must be achieved and may include consideration of such factors as the decay heat rate. Additional guidance is provided in enclosure 2. For example the first paragraph of section 2.2.2 and the first paragraph of section 3.3.2 illustrate the flexibility we have in mind as long as safety is adequately addressed.

We intend that programmed enhancements be incorporated into plant opera-tions as they are developed when this results in significant safety improvement or enhancement of plant operations with no decrease in safety.

Procedural and hardware modifications may be implemented without prior staff approval where the criteria of 10 CFR 50.59 are met, although it is our intent to review and/or audit such changes.

Programmed enhancements should be implemented as soon as is practical, but no later than the following schedule:

• Available means ready for use quickly enough to meet the intended functional need.

4 e

-a (1) Programmed enhancements consisting of hardware installation and/or modification, and programmed enhancements that depend upon hardware installation and/or modification, should-be implemented:

(a) by the end of the first refueling outage that is initiated 18 months or later following receipt of this letter, or (b) by the end of the second refueling outage following receipt of this letter, whichever occurs first. If a shutdown for refueling has been initiated as of the date of receipt of this letter, that is to be counted as the first refueling outage.

(2) Programmed enhancements that do not depend upon hardware changes should be implemented within 18 months of receipt of this letter.

We recommend you implement the following six programmed enhancements:

(1) Instrumentation Provide reliable indication of parameters that describe the state of the RCS and the performance of systems normally used to cool the RCS for both normal and accident conditions.

At a minimum, provide the following in the CR:

(a) two independent RCS level indications (b) at least two independent temperature measurements representa-tive of the core exit whenever the RV head is located on top of the RV (We suggest that temperature indications be provided at all times.)

(c) the capability of continuously monitoring DHR system perfor-mance whenever a DHR system is being used for cooling the RCS (d) visible and audible indications of abnormal conditions in temperature, level, and DHR system performance (2) Procedures Develop and implement procedures that cover reduced inventory operation and that provide an adequate basis for entry into a reduced inventory condition. These include:

(a) procedures that cover normal operation of the NSSS, the con-tainment, and supporting systems under conditions for which cooling would normally be provided by DHR systems.

5 (b) procedures that cover emergency, abnormal, off-normal, or the equivalent operation of the NSSS, the containment, and support-ing systems if an off-normal condition occurs while operating under conditions for which cooling would normally be provided by DHR systems.

(c) administrative controls that support and supplement the proce-dures in items (a), (b), and all other actions identified in this communication, as appropriate.

(3) Equipment (a) Assure that adequate operating, operable, and/or available equipment of high reliability* is provided for cooling the RCS and for avoiding a loss of RCS cooling.

(b) Maintain sufficient existing equipment in an operable or available status so as to mitigate loss of DHR or loss of RCS inventory should they occur. This should include at least one high pressure injection pump and one other system.

The water addition rate capable of being provided by each equipment item should be at least sufficient to keep the core covered.

(c) Provide adequate equipment for personnel communications that involve activities related to the RCS or systems necessary to maintain the RCS in a stable and controlled condition.

(4) Analyses Conduct analyses to supplement existing information and develop a basis for procedures, instrumentation installation and response, and equipment/NSSS interactions and response. The analyses should encompass thermodynamic and physical (configuration) states to which the hardware can be subjected and should provide sufficient depth that the basis is developed. Emphasis should be placed upon obtain-ing a complete understanding of NSSS behavior under nonpower opera-tion.

(5) Technical Specifications Technical specifications (TSs) that restrict or limit the safety benefit of the actions identified in this letter should be identi-fled and appropriate changes should be submitted.

• Reliable equipment is equipment that can be reasonably expected to perform the intended function. See Enclosure 2 for additional information.

6

'(6) RCS perturbations Item (5) of the expeditious actions should be reexamined and opera-tions refined as necessary to reasonably minimize the likelihood of loss of DHR.

Additional information and guidance are given in enclosure 2.

REFERENCES (1) C. E. Rossi, "Possible Sudden Loss of RCS Inventory during Low Coolant Level Operation," NRC Information Notice 88-36, June 8, 1988.

(2) R. A. Newton, "Westinghouse Owners Group Early Notification of Mid-Loop Operation Concerns," Letter from Chairman of Westinghouse Owners Group to Westinghouse Owners Group Primary Representatives (1L, 1A), OG-88-21, May 27, 1988.

I ENCLOSURE 1 TO GENERIC LETTER OVERVIEW AND BACKGROUND INFORMATION PERTINENT TO GENERIC LETTER 88-17 A

2 CONTENTS a ace 2.0 PERSPECTIVE.

4 2.1 Phenomena and Impact.

4 2.1.1 Pressurization.

5 2.1.2 Vortexing.

5 2.1.3 SG tube draining in plants with "U" tube SGs 6

2.1.4 RCS level differences.

6 2.1.5 DHR system effects.

7 2.1.6 Instrumentation 7

2.2 Time available for mitigation.

8 2.3 Generic Letter 87-12 review 9

3.0 NEEDED RESPONSE

... 10

4.0 REFERENCES

10

3 1.0 THE ISSUE Concern has been increasing for some time that an event involving the loss of decay heat removal (DHR)* while there is substantial core decay heat may pose a significant likelihood of a release due to a severe core damage accident.

Recently obtained probabilistic risk information and a survey of industry operations substantiate this concern.

Independent engineering evaluation of plant operation while cooling is provided by DHR systems leads to a similar conclusion.

Consideration of plant behavior points out several phenomena that had previously gone unrecognized and that potentially could lead to severe core damage in approximately one hour rather.than in the previously believed conservative time of more than four hours.

Plants are operating under conditions that have not been analyzed and in which plant response is not understood.

Evaluation of plant data shows that an unacceptably large number of events have occurred and continue to occur. If not mitigated, such events lead to core damage. Many of these events have involved a loss of DHR for one or more hours. A number of events have resulted in boiling in the core, a condition that has not been analyzed at most plants. Often, plant personnel were unaware of the real difficulty for some time during or after the event. Experience clearly substantiates that a problem exists.

Information obtained since the Diablo Canyon event of April 10, 1987 shows that many previously unrecognized mechanisms exist that exacerbate the prob-lem, and that are not represented in the PRA results. Some of these can realistically cause core uncovery or complete core voiding in less than half an hour; significantly less than the previously believed "conservative" boil down of water with uncovery of the top of the core in four hours. Our review of licensee responses to Generic Letter (GL) 87-12** and plant experience has clearly established that few procedures exist to avoid these scenarios.

Many licensees demonstrated in the GL 87-12 responses that they were not even aware that such scenarios exist.

Review of industry responses to GL 87-12 shows that most licensees are poorly prepared for reduced RCS inventory operation.

Procedures are incomplete, incorrect, or nonexistent. Little effective thought has been given to avoiding the initiation of accidents or to mitigating an accident once it has begun.

• Enclosure 3 provides a list of abbreviations and definitions.

• • GL 87-12 (ref. 1) requested licensees to describe operation of their plants under conditions where some of the water inventory had been removed from the reactor coolant system (RCS).

We have completed our review of these responses with assistance from the Idaho National Engineering Laboratory, and a NUREG/CR document describing that review is being prepared.

Further infor-mation is provided in Section 2.3 of this enclosure.

4

,The inability of containment to mitigate an accident is seldom addressed at any level of operating procedures, administrative controls, or training.

Instrumentation is often of low quality or inaccurate, and little provision is made for using equipment effectively. The responses establish that the problem is extensive, many disciplines are involved, many licensees are not adequately responding, and information is not being effectively shared within the industry.

2.0 PERSPECTIVE 2.1 Phenomena and Impact A number of phenomena have been recognized as affecting nuclear power plant operation when these plants are operating in a nonpower condition. Some of these phenomena can cause the time between loss of DHR and severe core damage to be as short as approximately one hour. Such phenomena also cause instru-mentation errors, loss of DHR, and unstable operation. These phenomena are of particular concern at operating conditions where the water level is below the top of the hot and cold legs. This level permits air to be distributed throughout the RCS. This complicates interpretation of the event. In addi-tion, the allowable operating band for water level is often only a few inches (too low, and DHR is lost; too high, and steam generator (SG) tubes do not drain or water floods the SGs and containment).

This is a challenging environment for the operators, and one with a high probability of failure. For example:

(1) The actual state of the RCS may differ from the analyzed state, and phenomena may occur that have been neither recognized nor analyzed. This can lead to RCS behavior that operators and advisors do not anticipate.

Of serious concern is the discovery of accident sequences that can cause core uncovery or complete core voiding in 15 or 20 minutes and severe core damage in approximately an hour from the time DHR is lost.

(2) Operators and advisors may not recognize the potential seriousness of the situation until unanticipated phenomena become obvious.

Corrective action may be further delayed because operators and advisors disbelieve the symptoms as indicated by available instrumentation.

(3) Changes in RCS state may cause viable mitigation paths to be unavailable.

(4) Failure to recognize the potential seriousness of the situation and lack of clear, appropriate procedures can lead to significant delay in obtain-ing resources needed to cope with the event.

We discuss a number of phenomena and related concerns in the subsections that follow. Although incomplete, these discussions will help to illustrate the magnitude and breadth of the issue.

We will discuss:

(1) pressurization (2) vortexing (3) SG tube draining in plants with U-tube SGs

5

-(4) RCS level differences (5) DHR system effects (6) instrumentation 2.1.1 Pressurization The principal concern is that a small pressurization can occur as a result of conditions unique to operation with a reduced RCS inventory - and this pres-sure increase can seriously affect plant safety.

Previously at least four hours were believed to be available between loss of DHR and core uncovery. We now know that these newly appreciated phenomena can cause core uncovery or complete core voiding in 15 or 20 minutes and severe core damage in approxi-mately an hour following loss of DHR.

A number of considerations are applicable (refs. 1 -

4), including:

(1) Inappropriate use of.SG nozzle dams can lead to complete core voiding within 15 or 20 minutes of loss of DHR. A similar phenomenon can occur when loop stop valves are inappropriately used.

(2) Cold leg openings can allow water to be ejected from the vessel following loss of DHR until sufficient water is lost that steam is relieved by clearing of the crossover pipes.

(3) Phenomena associated with pressure differences within the RCS may prevent injection water from reaching the reactor vessel (RV).

(4) Rapid RCS pressurization may prevent gravity feed of water from tanks that are anticipated to be available.

(5) Rapid pressurization may cause instruments to malfunction or provide misleading indications.

(6) Rapid pressurization may cause the RCS to respond in unanticipated ways.

(7) Small RCS pressure boundary openings at various locations (vents and drains both above and below the water level) may lead to instrument malfunctions or unanticipated RCS responses.

(8) Large RCS pressure boundary openings at various locations (SG manways, reactor coolant pump (RCP) bowl, loop stop valves, pressurizer manways) may lead to instrument malfunctions or unanticipated RCS responses.

(9) Steam generator secondary side inventory and openings may influence RCS behavior.

2.1.2 Vortexing Vortexing at the junction of the DHR system suction line and the RCS will occur if water level is too low, a situation to be avoided since this may introduce air into the DHR pump suction.

Small amounts of air may lead to Xs subtle changes that occur over a time of minutes to an hour or more, and may

6

,propagate to loss of DHR.

Large amounts of air may cause immediate loss of pump suction and hence loss of DHPR.

Vortexing may occur at levels higher than anticipated. For example, vortexing may initiate at the level required to drain SG tubes or if initiated, may continue while at a level where vortexing may not ordinarily initiate. This can lead to operation with unrecognized vortexing and suction of air into the DHR system.

Such vortexing and air entrainment may not be reflected by pump current and flow rate instrumentation until it is sufficiently severe that continued operation of the DHR system is jeopardized. As discussed in reference 4, even when vortexing is insufficient to perturb DHR system operation, it may upset the RCS level and level indica-tions and lead to inappropriate operator actions.

For example, the operators were controlling RCS level at Diablo Canyon to the range of 107'0" to107'8" immediately before the April 10, 1987 event, and they had drained the RCS to 107'0" before the.event to stay within this band.

DHP was lost when the instrumentation registered about 107'4". The Diablo Canyon licensee later reported to us that vortexing begins to occur at 107'5.5" and is fully developed at 107'3.5" with an RPR flow rate of 3000 gpm (the technical specification (TS) requirement at Diablo Canyon at the time of the event). This vortexing behavior was not understood on April 10.

2.1.3 Steam Generator Tube Draining in Plants Equipped With U-tube Steam Generators Operators frequently drain the RCS to the vicinity of vortexing to drain SG tubes.

For example, the RCS was drained to an elevation below 107'5.5" (top of the pressurizer surge line) to drain SG tubes at Diablo Canyon before the April 10 event.

Vortexing was later reported to initiate at 107'5.5". (See Appendix C of reference 4 for additional information.)

Alternate approaches exist to draining of SG tubes. These include:

(1) Introduce nitrogen via instrument connections located below the SG plena.

This may allow draining of SG tubes with most of the remainder of the RCS full.

(2) Provide nitrogen directly into the SG plena.

This may also allow drain-ing of SG tubes with most of the remainder of the RCS full.

(3) Use nitrogen from the RV to drain SG tubes. This often can be done at a higher RCS level than required to drain with nitrogen from the pressuriz-er.

2.1.4 Reactor Coolant System Level Differences When operating under mid-loop conditions, the critical level parameter is water level in the hot leg essentially at the junction with the DHR system suction line. The significance of this is often unrecognized in connecting level instrumentation and in operation. Yet a change in level of only a few inches can cause loss of DHR, and unrecognized and/or unanalyzed phenomena are more than sufficient to provide such a change.

For example, differences exist between actual level at the suction line and the indicated level because of such effects as:

I

7 (1) Flow from the injection point to the suction connection will cause a level change between these locations because a driving force is necessary to accomplish the flow. The level difference will not be discovered if instrumentation is not independent nor will it be found by calibration between shutdown level instrumentation and the pressurizer level instru-mentation.

(2) RHR return water momentum will result in a level buildup. This will not be found by cross checks between the shutdown level instruments and pressurizer level instrumentation.

Additional information is provided in references 3 and 4.

2.1.5 Decay Heat Removal System Effects DHR systems in a plant are seldom identical. Even changeover from one DHR system to another may result in loss of DHR due to minor differences in the systems. Changeover from one DHR system to the other can also cause a loss of DHR if it is improperly performed. For example, starting one DHR system while the other is running will increase flow rate, and can lead to entrainment of sufficient air to cause both DHR systems to be lost. The effect can occur as a result of:

(1) The increased DHR system flow rate can cause an increase in vortexing at single drop line plants.

(2) The increased flow rate can lead to a decreased level in the upper vessel and hot legs in plants equipped with one or more drop lines. This can occur because most of the pressure drop occurs between water injection locations and the hot legs, most of which is a common flow path and hence is affected by total flow rate; and by moving RCS inventory into a DHR system that was initially only partially filled.

Another problem exists with operator response to loss of a DHR system. If the loss were due to RCS conditions, the conditions may be such that it is likely other DHR system pumps also will be lost if they are started without correct-ing the cause of the initial loss.

Shutting off or starting a DHR system may be followed by a change in RCS inventory (1) if DHR piping drains into the RCS, (2) if air in the DHR system is displaced by water from the RCS, or (3) if air in the RCS is displaced by water from the DHR systems.

Similar behavior occurs when air ingestion is occurring and there is an increase or decrease in vortexing. Such a vortexing effect may occur when RHR flow rate changes, when RCS inventory is changed, or when inventory is transferred between systems as a result of the identified effect.

2.1.6 Instrumentation Instrumentation used for level indication needs careful analysis, installation, and protection from damage or changes which may influence instrumentation indication.

Level indications may easily be in error by half a foot or more.

Further, connection schemes, flow dynamics, entrapped air, or pressurization

8 may sIgnificantly and simultaneously affect all level instrumentation during operation with a lowered RCS inventory. These contribute to the mis-diagnosis of events and inappropriate operator response, which may exacerbate the problem.

Inaccurate level Indication has often led to or contributed to loss of DHR.

Many phenomena affect the instrumentation and should be considered in instru-ment design and installation as well as during plant operation. Failure to do so can lead to misunderstood level instrumentation response, operator mistrust of instrumentation, and inappropriate operator actions.

Another instrument related problem is the limiting of operator information by the common practice of disconnecting instrumentation in preparation for removing the RV head and for other operations commonly conducted during a refueling outage. Frequently, thermocouples in the RV will be disconnected well before the RV head is lifted.

Remaining resistance temperature device (RTD) instrumentation in the manifolds (typical of many plants) or the hot and cold legs will not reflect vessel temperatures in a loss of DHR system flow situation even if they are available, and DHR system temperature indication is meaningless if the DHR system pumps are inoperative.

2.2 Time Available for Mitigation The traditional approach to determining system response has been to conserva-tively calculate the time to uncover the core by assuming that RCS inventory heats to the boiling point and that the inventory is then boiled away. This typically has been calculated to take four hours. This traditional approach is nonconservative.

Boiling initiated at Diablo Canyon in 30 to 45 minutes following loss of DHR in the April 10, 1987 event. More importantly, this boiling caused RCS pressurization, an unanticipated condition. A different RCS configuration, such as blocked hot legs and an opening in the cold legs, could have quickly led to core uncovery following initiation of boiling, an unanticipated situation. Further, the loss of DHR at Diablo Canyon occurred at a low initial RCS temperature and with a decay heat generation rate less than half of that which could occur during loss of DHR accidents.

Clearly, core uncovery can occur much faster than previously believed, an occurrence the Westinghouse Owners Group (WOG) recently reported to Westing-house owners (ref. 3).

(The WOG report identifies boiling in less than 10 minutes.) Severe core damage can follow as soon as adiabatic heatup of the core reaches the point of rapid chemical reaction. There are two important conclusions:

(1) The time available for operators to respond to a loss of DHR can be far less than was previously believed.

Immediate actions are necessary to reasonably assure an adequate operator response during such conditions.

(2) This situation constitutes a previously unanalyzed plant condition that can realistically be encountered.

Generic Letter 88-17 provides guidance in correcting this situation.

9

• 2.3 *Generic Letter 87-12 Review GL 87-12 (ref. 1) permits for PWRs.

power plants when tion.

was transmitted to all licensees and holders of construction It requested information pertinent to operation of nuclear the RCS inventory is below that required for normal opera-Licensee responses were evaluated with respect to the following topics:

(1) interlocks (2) draindown operations (3) DHR operations (4) SG considerations (5) test and maintenance operations (6) RCS pressurization considerations (7) containment considerations (8) instrumentation and alarms (9) backup RCS cooling and makeup (10) analytic basis (11) training (12) Resources available to operator and the evaluations were conducted with consideration of such subjects as:

(1) understanding of issue (2) approach (3) adequacy (4) procedures and training (5) malfunction mitigative response The evaluation clearly established that most licensees did adequate preparation for reduced RCS inventory operation.

be summarized as follows:

not demonstrate The situation may (1) Accident initiation. The major reasons for such accidents is that industry has failed to adequately address the issue of operating the plants under conditions of reduced RCS inventory.

Plants are not well designed for reduced RCS inventory operation, plant behavior has not been adequately analyzed or understood, instrumentation is inadequate, and procedures sometimes are of poor quality or provide inadequate coverage.

(2) Prooression to core damage. Operators have been ill prepared for miti-gating an accident once it has initiated. Operators are expected to recover the normal DHR system or to provide alternate cooling before the condition becomes serious.

Yet, operators have not been given the tools to achieve this objective.

(3) Consequences. While the plant licensees generally have their hatch removed. Many licensees containment or to taking other core damage accident.

is in a reduced RCS inventory condition, containment open, often with the equipment have given little thought to closing the actions to mitigate the consequences of a

10

,Some.utilities have achieved a significant improvement in the past year, and are continuing to work on this issue. Those licensees best qualified to deal with loss of DHR during lowered RCS inventory conditions have active improvement programs.

Further information on the review criteria, licensee responses, and review of licensee responses will be reported in a NUREG document within the next few months.

3.0 NEEDED RESPONSE Direct loss of DHR is an important initiator of accidents and its loss could cause a release of radioactive material due to a core damage accident. The problem is exacerbated by weakness in procedures for restoration of core cooling, weakness in administrative controls, and by a large likelihood of failure to mitigate a release should the core be damaged.

Actions to minimize the initiation and consequences of loss of DHR take two forms:

(1) Expeditious or immediate actions, which can be implemented quickly and at little direct cost, but which may affect plant operations under some circumstances and cause an operational cost. These actions will signifi-cantly reduce the likelihood of a significant release of radioactive material for the potential core damage accidents of concern here.

(2) Programmed enhancements or longer term actions, which involve development of understanding, procedures, training, and minimal additional instrumentation. When implemented, these qwill modify some immediate actions and may reduce impact on plant operations caused by the immediate actions, although other impacts may result in some plants.

Expeditious actions will reduce the likelihood of a release due to a core damage accident. They will essentially assure the containment will be closed prior to the time significant core damage could occur if DHR is lost. Addi-tional benefits will ensue because the frequency of loss of DHR accidents will be reduced and operator response to such accidents will be improved.

The longer term programmed enhancements attack the root cause of accident initiation and provide enhanced mitigative response.

4.0 REFERENCES

(1) F. J. Miraglia, "Loss of Residual Heat Removal (RHR) while the Reactor Coolant System (RCS) is Partially Filled (Generic Letter 87-12),' Letter to all licensees of operating PWRs and holders of construction permits for PWRs, July 9, 1987.

(2) C. E. Rossi, "Possible Sudden Loss of RCS Inventory During Low Coolant Level Operation," NRC Information Notice No. 88-36, June 8, 1988.

11

.(3)

.R. A. Newton, Westinghouse Owners Group Mid-Loop Operations Concerns," Letter to W. Hodges, NRC, from Chairman ot Westinghouse Owners Group, OG-88-24, June 20, 1988. Letter transmits R. A. Newton,

'Westinghouse Owners Group, Early Notification of Mid-Loop Operation Concerns," Letter to Westinghouse Owners Group Primary Representatives (OL, IA) from Chairman, Westinghouse Owners Group, OG-88-21, May 27, 1988.

(4) U. S. Nuclear Regulatory Commission, "Loss of Residual Heat Removal System, Diablo Canyon, Unit 2, April 10, 1987," NUREG-1269, June 1987.

ENCLOSURE 2

• a01 REGo4 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 Docket No.

(Document name: Murley ltr)

(Utility Address)

SUBJECT:

LOSS OF DECAY HEAT REMOVAL We have just issued Generic Letter 88-17 which addresses loss of decay heat removal (DHR) during nonpower operation.

This letter was issued because of the potential serious consequence of loss of shutdown cooling concurrent with significant core decay heat. Further, it is our belief that the industry as a whole has not aggressively responded to resolve the concern following its identification in our earlier Generic Letter 87-12. In particular, the industry's response to the Generic Letter 87-12 was deficient in the areas of (1) prevention of accident initiation, (2) miti ga-tion of accidents before they potentially progress to core damage, and (3) control of radioactive material if a core damage accident should occur.

Generic Letter 88-17 prescribes expeditious actions which should immediately ease the concern; and parallel, but longer term, programmed enhancements which effectively address the root cause of the problems and permit greater flexi-bility in operation.

We consider this issue to be of high priority and request that you assure that your organization addresses it accordingly.

Sincerely, Thomas E. Murley, Director Office of Nuclear Reactor Regulation cc: See next page

ENCLOSURE 2 TO GENERIC LETTER GUIDANCE FOR MEETING GENERIC LETTER 88-17

2 CONTENTS Page 1.0 OVERVIEW.

1.1 Introduction.

1.2 Approach..

S*

S S

S 3

S S

• S S

S S

S S

3 S

S S

S S

3 2.0 GUIDANCE AND STAFF POSITION INFORMATION - EXPEDITIOUS ACTIONS.

2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 Diablo Canyon Event Containment Closure.

RCS Temperature...

RCS Water Level RCS Perturbation.

RCS Inventory Addition Nozzle Dams Loop Stop Valves...

0 0

0 5

55 7

.59

. 10 10 3.0 PROGRAMMED ENHANCEMENTS.

S S

S S

S S

S S

S S

• 11 3.1 3.2 3.3 3.4 3.5 3.6 Instrumentation Procedures.

Equipment.

Analyses.

Technical Specifications RCS Perturbations.

11 14 15 16 17 17

4.0 REFERENCES

1

• . 19

3 1.0 OVERVIEW 1.1 Introduction Events have occurred for years that jeopardize core cooling during nonpower operation. These events often have not been taken seriously because of the impression that the low heat generation rate associated with nonpower opera-tion allows considerable time to restore core cooling before core damage begins, and there is a wide range of means available to the operators to restore core cooling. The general industry position seems to have been that the likelihood of a release of radioactive material due to a core damage accident during nonpower operation was so low as to be negligible when com-pared with the likelihood associated with full power operation.

Significant new information has been generated within the past year, notably as a result of the Diablo Canyon event of April 10, 1987, the licensee's efforts following that event, and work conducted by the Westinghouse Owners Group (WOG).

(See, for example, refs. 1 -

7.) We now know that several previously unrecognized phenomena need to be addressed. An immediate response is necessary to deal with this new information. Generic Letter 88-17 requests information from each licensee of a pressurized water reactor (PWR) regarding the licensee response to this need.

This enclosure provides information relative to the actions identified in the letter. The information is not intended to cover all topics, nor does it represent the only solutions we will accept in response to actions identified in the letter. It should be used for guidance. If better solutions are found than illustrated in the enclosure, they should be considered and discussed with us. Our initial objective is to obtain reasonable solutions quickly.

The next objective is to develop a more comprehensive solution which may take longer to develop. Portions of the latter solution may already exist for some plants, and it may thus be feasible to implement some progranned enhancements on a schedule that meets the expeditious actions identified in GL 88-17.

A number of terms are used in the material that follows that are unique to this issue. Other terms will be more familiar, but the meaning may be more precise as applied to the DHR issue. We suggest you review the definitions provided in Enclosure 3 to avoid misunderstandings.

1.2 Approach We are using an approach that couples immediate response and a development program to achieve:

(1) an immediate reduction in the likelihood of a release of radioactive material due to a core damage accident - which we call expeditious actions, and (2) a longer term reduction in core damage likelihood - defined as programmed enhancements.

4

'The approach addresses the three key aspects which influence this issue:

(1) Prevent accident initiators from occurring.

This addresses the root cause. Although some aspects have been incorpo-rated into expeditious actions when the effect on core damage likelihood is immediate and plant implications are understood, effective initiation rate reduction will require an extended effort at many plants. Conse-quently, initiation rate reduction is addressed in the programmed en-hancement recommendations.

(2) If an accident initiates, provide in-depth mitigation capability to prevent core damage.

Comprehensive mitigation planning is also a longer term subject, and is addressed in the programmed enhancement recommendations with some consid-eration provided in the expeditious actions.

(3) Provide a closed containment before the core uncovers if a loss of DHR occurs.

This is the primary expeditious action because it can be implemented immediately and it provides effective protection against a release.

Control of accident initiation, mitigation of an initiated accident to prevent core damage, and prevention of the release of radioactive material involve the following five topics which are important to safety:

(I) instrumentation (2) procedures (3) maintenance and testing (4) equipment (5) analyses A sixth topic, technical specifications (TSs), will be affected by certain changes in the above.

We have carefully considered the unique aspects of nonpower operation and their implications using various methods of addressing the issues. We believe that flexibility in equipment selection and operation will be highly effective under the less demanding physical conditions that exist during nonpower operation.

Consequently, with respect to the issue as addressed in GL 88-17, we will accept the following for resolving the items identified in the letter:

(1) Containment closure in lieu of the comparable power operation requirement of containment isolation.

(2) Reliable equipment in lieu of the comparable safety grade classification.

(3) Realistic thermal-hydraulic and mechanical analysis methods (with suit-able safety factors in a few situations) rather than the evaluation model methods and multiple conservatisms that are often used for evaluation of power operation.

5

.(4)

Realistic equipment response (with suitable safety factors in a few situations) in lieu of conservative assumptions.

Various aspects of these approaches are discussed in the remainder of this enclosure.

2.0 GUIDANCE AND STAFF POSITION INFORMATION - EXPEDITIOUS ACTIONS 2.1 Diablo Canyon Event 2.1.1 Recommendation Discuss the Diablo-Canyon event, related events, lessons learned, and impli-cations with appropriate plant personnel. Provide training shortly before entering a reduced inventory condition.

2.1.2 Discussion We believe the lessons learned from the Diablo Canyon event are important, and that all personnel involved in plant operations during DHR system operation conditions should be aware of the event and more importantly the significance, with emphasis upon knowledge and insight developed as a result of the event.

For example, how many plant personnel are aware that cold leg injection may be ineffective under some shutdown conditions, and that they should use hot leg injection to effectively provide core cooling under those conditions?

(See ref. 6.)

Many licensees accomplished this recommendation within a few months of the Diablo Canyon event. However, recently developed insight is important and warrants coverage, and was not covered during the early implementation of the recommendation. The above illustration concerning effective water injection is a good example -

the knowledge was only recently disseminated on an industry-wide basis.

2.2 Containment Closure 2.2.1 Recommendation Implement procedures and administrative controls that reasonably assure that containment closure will be achieved prior to the time at which a core uncovery could result from a loss of DHR. These procedures and administrative controls should be active and in use:

(a) prior to entering a reduced RCS inventory condition for nuclear steam supply systems (NSSSs) supplied by Combustion Engineering or Westinghouse, and (b) prior to entering an RCS condition wherein the water level is lower than four inches below the top of the flow area of the hot legs at the junction of the hot legs to the RV for IISSSs supplied by Babcock and Wilcox,

6

-and should apply whenever operating in those conditions.

If such procedures and administrative controls are not operational, then either do not enter the applicable condition or maintain a closed containment.

2.2.2 Discussion The expeditious action item addressing containment closure is a preliminary action that immediately and effectively reduces the likelihood of a release while providing the flexibility to have the containment building open under appropriate conditions. A wide range of times is available in which to close the containment building depending upon the state and configuration of the RCS.

The expeditious action that we will accept in lieu of analytically determined times includes prescribed times that reasonably assure containment closure in compliance with the recommendation. These times may be modified as soon as suitable analyses provide better estimates of the time between loss of DHR and core uncovery. Although relaxation of times and other programmed enhancement developments may relax containment closure actions, and may be implemented without staff approval subject to the provisions of 10 CFR 50.59, it is not our intention that containment closure provisions be eliminated. We recommend that containment closure considerations remain in effect whenever irradiated fuel is located in the RV unless the decay heat rate is so low that the fuel cannot overheat if completely voided of water.

We will accept containment closure actions which include all of the following:

(1) Containment closure is not necessary if the reactor vessel (RV) and surrounding pool contain no irradiated fuel.

(2) Containment penetrations, including the eauipment hatch, may remain open provided closure is reasonably assured within 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of initial loss of DHR -

but see the time modifications which are discussed below for some configurations. Emergency procedures which require initiation of closure activities should be operational.

Once initiated, closure activities may not be terminated until controlled and stable DHR has been restored and the RCS has been returned to a controlled and stable condition.

(3) The following modifications should be met for nuclear steam supply systems (NSSSs) supplied by Westinghouse (W) and Combustion Engineering (CE):

(a) The 2.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> requirement in item 2 is replaced by 30 minutes (W) or 45 minutes (CE) if openings totaling greater than one square inch exist in the cold legs, reactor coolant pumps (RCPs) (connecting into the cold leg water space) and crossover pipes of the RCS.

This 30 or 45 minute time requirement may be increased to two hours if a vent path from the upper RV is provided which is sufficiently large (with a suitable safety factor) that core uncovery cannot occur due to pressurization resulting from boiling in the core.

(4) As soon as suitable procedures and instrumentation are available and implemented, completion of containment closure following initiation of closure activities may be delayed. This may be done on the basis of reliable temperature information obtained during a transient event provided the containment is closed prior to reaching an RCS temperature

7

-of 2000F as displayed by the larger of two valid indications of temperature at the top of the core or immediately above the core. The location of such temperature measurements should be at the approximate highest temperature regions expected as a result of measurements obtained during normal power operation or should be representative of those locations.

Reasonable assurance of containment closure should include consideration of activities which must be conducted in a harsh environment. For example, once boiling initiates in the RCS, a large volume of steam may be entering containment, potentially leading to high containment temperature and Increased pressure. The 200 F temperature identified above provides assurance that containment is closed prior to the existence of such conditions.

There are several differences in the recommendations for different vendor designed NSSSs. These have been developed from differences in operational history involving loss of DHR and from our appraisal of the implications of loss of DHR. For example, the B&W design is not sensitive to phenomena which can cause a pressure difference to develop between the hot and cold legs in the CE and W designs. Therefore, water is not forced from the RV due to a pressure difference in the BAW design and the allowable times for containment closure reflect this difference. Similarly, the specified water level at which containment closure procedures must be operational is lower in the B&W design than in the other two vendor designs because BW does not encounter the draining difficulties, and the B&W operational history reflects less likelihood of losing DHP systems. There are a number of other considerations which apply as well, including that B&W designs seldom involve lowering level to a value commonly used in the other designs, and there is little question whether injection water will reach the core in the B&W design.

2.3 RCS Temperature 2.3.1 Recommendation Provide at least two independent, continuous temperature indications that are representative of the core exit conditions whenever the RCS is in a mid-loop condition and the reactor vessel head is located on top of the reactor vessel. Temperature indications should be periodically checked and recorded by an operator or automatically and continuously monitored and alarmed.

Temperature monitoring should be performed either:

(a) by an operator in the control room (CR), or (b) from a location outside of the containment building with provision for providing immediate temperature values to an operator in the CR if significant chances occur. Observations should be recorded at an interval no greater than i5 minutes under normal conditions.**

• • Guidance should be developed and provided to operators that covers evacuation of the monitoring post. The guidance should properly balance reactor and personnel safety.

8 2.3.2 Discussion The near term concerns are that boiling may force water from the RV and significantly decrease the time available between loss of DHR and initiation of core damage, that operators should have a direct indication of the condition of the RCS, and that operators should be able to determine the effectiveness of actions taken in response to a loss of DHR.

Temperature is the only variable that can be measured that will directly track the approach to boiling in the RV. Although level can be used as an indication of the adequacy of core coverage, often the available range of level indication does not correspond to the range for which information is necessary. Temperature can assist in bridging that gap. Temperature is also useful as an aid in determining the response necessary to a loss of DHR.

Consequently, we intend that temperature be provided to the operators over as wide a range of plant conditions as is feasible and for which its indication is valuable in guiding operator actions.

The region of most concern is when the RCS is in condition where inventory is low. Minor perturbations in RCS level may cause loss of DHR and temperature increase rate with a low inventory will be faster than under other conditions.

Consequently, as minimum coverage with respect to expeditious actions while the RV head is located on top of the RY, we recommend that operations be conducted to minimize unavailability of temperature indication during reduced RCS inventory operation and that temperature indication be provided whenever operating in a mid-loop condition.

2.4 RCS Water Level 2.4.1 Recommendation Provide at least two independent, continuous RCS water level indications whenever the RCS is in a reduced inventory condition. Water level indications should be periodically checked and recorded by an operator or automatically and continuously monitored and alarmed. Water level monitoring should be capable of being performed either:

(a) -by an operator in the CR, or (b) from a location other than the CR with provision for providing immediate water level values to an operator in the CR if significant changes occur.

Observations should be recorded at an interval no greater than 15 minutes during normal conditions.**

2.4.2 Discussion We believe reliable, accurate RCS water level information must be provided to the operators whenever approaching or operating in a condition where a loss of level can lead to loss of DHR. Level information is necessary under loss of

• • Guidance should be developed and provided to operators that covers evacuation of the monitoring post. The guidance should properly balance reactor and personnel safety.

9 DHR conditions since it provides an indication of core coverage and, if sufficient venting capacity exists, of the time to core uncovery. It is also useful in mitigation of a loss of DHR accident.

At a minimum, the low limit of the range of level indication must be below the level necessary for operation of DHR systems.

Desirable is a low limit that indicates level to the bottom of the core.

Where provision of two independent level indications is not practical in the short term, we will accept a single indication. However, these conditions are unacceptable in the longer term, where we believe at least two independent indications must be provided in the CR.

2.5 RCS Perturbation 2.5.1 Recommendation Implement procedures and/or administrative controls that generally avoid operations that deliberately or knowingly lead to perturbations to the RCS and/or to systems that are necessary to maintain the RCS in a stable and controlled condition while the RCS is in a reduced inventory condition.

If operations that could perturb the RCS or systems supporting the RCS must be conducted while in a reduced inventory condition, then additiornal measures should be taken to assure that the RCS will remain in a stable and controlled condition. Such additional measures include both prevention of a loss of DHR and enhanced monitoring requirements to ensure timely response to a loss of D W should such a loss occur.

2.5.2 Discussion This expeditious action item should eliminate a major cause of accident initia-tion during reduced RCS inventory operation.

Preliminary procedures and/or administrative controls will be accepted as an expeditious action response. We believe complete consideration of this issue is necessary in the longer term.

2.6 RCS Inventory Addition 2.6.1 Recommendation Provide at least two available or operable means of adding inventory to the RCS that are in addition to pumps that are a part of the normal DHR systems. These should include at least one high pressure injection pump. The water addition rate capable of being provided by each of the means should be at least sufficient to keep the core covered.

Procedures for use of these systems during loss of DHR events should be provided. The path of water addition must be specified to assure the flow does not bypass the reactor vessel before exiting any opening in the RCS.

2.6.2 Discussion Sufficient equipment should exist in most plants, but there is little assurance it is available or provided for in the procedures and/or administrative controls. The expeditious action recommendation increases assurance of sufficient accident mitigation capability.

10 2.7 -Nozzle Dams 2.7.1 Recommendation (applicable to Westinghouse and Combustion Engineering nuclear steam supply system (NSSS) designs) Implement procedures and administrative controls that reasonably assure that all hot legs are not blocked simultaneously by nozzle dams unless a vent path is provided that is large enough to prevent pressuri-zation of the upper plenum of the RV. See references 5 and 6.

2.7.2 Discussion Addressing closure of RCS legs addresses a major contributor to short term core damage.

The prohibited configuration, if it existed, could force water out of the RV within half an hour of loss of DHR.

We recommend that licensees consider removing a pressurizer manway (if analy-sis shows this to provide a sufficient vent path) or otherwise create a suitable opening if a pressurization potential exists so as to limit the pressurization which could follow loss of DHR while nozzle dams and the RV head are in place.

Similarly, hot leg nozzle dams should be removed before removing cold leg nozzle dams or hot leg nozzle dams should be removed before, or as quickly as is practical following, closure of the open vent path from the upper RV.

A part of the concern is that nozzle dams may not have sufficient strength to withstand the pressure that may result under accident conditions. Loss of a nozzle dam while pressurized under loss of DHR conditions could cause rapid RV voiding.

2.8 Loop Stop Valves 2.8.1 Recommendation (applicable to NSSSs with loop stop valves)

Implement procedures and administrative controls that reasonably assure that all hot legs are not blocked simultaneously by closed stop valves unless a vent path is provided that is large enough to prevent pressurization of the RV upper plenum or unless the RCS configuration prevents RV water loss if RV pressurization shoula occur.

Closing cold legs by nozzle dams does not meet this condition.

2.8.2 Discussion Hot leg stop valves should be opened before opening cold leg stop valves or hot leg stop valves should be opened before, or as quickly as is practical following, closure of the open vent path from the upper RY.

Loop stop valves may be used in combinations sufficient to prevent loss of water through cold legs under postulated conditions of RV pressurization and, when this configuration is in place, the timing requirements of item 2 of Section 2.2.2 may be applied.

'3.O 'PROGRAMMED ENHANCEMENTS 3.1 Instrumentation 3.1.1 Recommendation Provide reliable indication of parameters that describe the state of the RCS and the performance of systems normally used to cool the RCS for both normal and accident conditions.

At a minimum, provide the following in the CR:

(a) two independent RCS level indications (b) at least two independent temperature measurements representative of the core exit whenever the RV head is located on top of the RV (We suggest that temperature indications be provided-at all times.)

(c) the capability of continuously monitoring DHR system performance whenever a DHR system is being used for cooling the RCS (d) visible and audible indications of abnormal conditions in temperature, level, and DHR system performance 3.1.2 Discussion 3.1.2.1 RCS level Inadequate determination of RCS level has been involved in many potentially serious events. This situation must be corrected.

We strongly believe independence is important.

This includes the connections to RCS, where difficulties with blockage have been encountered in both the liquid and reference connections.

Ike recognize that it may be difficult to provide independence in isolated instances. Consequently, if the recommendation for independence results in an unnecessary hardship, we will consider compensatory means.

For example, if a common tap is used for the liquid lea, a means of periodic draining or flushing capable of detecting blockage might be proposed as a means of diminishing the potential impact of the dependency.

Introducing a small flow into the sensing line at the instrument and checking whether this perturbs the level indication is another way of checking.

Unfortunately, such techniques may have the potential of causing erroneous level indications. Similarly, a careful investigation of the implications of determining level at a single location should be performed, and a contrast obtained with the information obtained if more than one location were used.

Phenomena and instrumentation behavior that are of concern include:

(1) response time (2) instrument level inadequacies that may not be identified by static instrumentation calibrations

12 i(3)

DHR air entrainment influence (4) DHR flow rate influence (5) RCS drain location and drain rate impact influence (6) RCS level, such as the potential for error because a high water level blocks the pressurizer surge line connection to the RCS, the inability of air spaces to communicate if the legs are full, or erroneous level indication because a portion of the RCS fails to drain as anticipated (7) the measured water level at one location may differ from that at the suction line (8) level may be affected by pressure difference between the RCS and the containment building atmosphere.

These phenomena may be addressed by such actions as:

(1) instrumentation error analysis (2) complete review of the instrumentation design (3) quality control and followup review of the installation (4) maintenance, including calibrations and operational checking.

We also note that ordinary plastic tubing does not meet our concept of reliable instrumentation, and its use may not be accepted as a component in instrumentation systems.

3.1.2.2 RV Temperature Mary plants have no indication of RCS state if DHR is lost because temperature is determined by sensors located in the DHR system.

Numerous licensees have demonstrated they do not understand that most RCS temperature indicators are inoperative under the conditions of concern. As a result, there have been occurrences of unrecognized boiling in the RCS. This is unacceptable because under some nonpower operation configurations boiling may force water out of the RCS and cause core uncovery in a short time. There are other implications as well. These include:

(1) Boiling involves a mode change. A licensee encountering boiling in the manner discussed here is often in violation of TSs.

(2) Temperature is valuable in guiding DHR restoration actions and in moni-toring the effectiveness of recovery actions.

(3) Knowledge of the RCS is necessary to guide actions such as containment closure and declaration of emergency levels.

(4) Knowledge of temperature may allow operational flexibility, such as the ability to remove DHR systems from operation.

13

'Accurate temperature indication is valuable even if the RY head is removed, and we prefer this be provided to the operators. Consequently, we suggest that licensees investigate ways to provide temperature even if the head is removed, particularly if a lowered RCS inventory condition exists because of the short time that may occur between loss of DHR and initiation of boiling, and the need for operator guidance which a knowledge of temperature can make possible.

3.1.2.3 DHR System Performance Many CR displays provide only limited DHR system performance information to the operators. Flow rate is generally provided. DHR pump motor current often is provided, although the indication may be on a back panel and not in the operator's normal range of vision. Motor current trend information is seldom provided. Also rare is pump noise monitoring and a sensitive pump suction pressure indication, both of which could provide early indication of an approach to loss of DHR due to air ingestion and inadequate RCS level.

Our recommendation is broadly stated as a continuous monitoring of the DHR system(s).

We expect each licensee to consider the individual plant configuration and instrumentation, and to provide sufficient information to the operators that an approaching malfunction is clearly indicated. In some cases, available instrumentation may be sufficient.

In others, new instrumentation may be necessary.

Provision of pump motor current is a cood example of useful information.

A simple indication of instantaneous motor current can be useful, but a display which shows a historical trace is more valuable since "noise' due to air ingestion is readily seen, and may be one of the earliest indications of an approach to inadequate pump suction conditions.

Noise monitoring at the DHR pump and sensitive pressure determination in the pump suction pipe are additional examples of potentially sensitive indications.

Also of interest is a performance monitor that senses several parameters and provides an integrated DHR system performance indication (we are not-aware of the existence of such a monitor, although we have seen indications of its consideration as a development instrument).

3.1.2.4 Visible and Audible Abnormal Condition Indication Alarms are sometimes provided, although they may be inappropriate for the application -

such as an alarm on high flow rate or high pump motor current, neither of which directly addresses loss of DHR. Alarms are seldom provided which indicate an approach to a loss of DHR condition.

We expect both audible alarms and a panel indication when conditions exist which jeopardize continued operation of a DHR system, as well as when DHR is lost. For example, pump motor current could be monitored continuously and an alarm set at the time steady operation is obtained which would provide an abnormal indication if motor current dropped by of the order of 1O (a smaller percentage might be selected if sufficient to exclude extraneous alarms). A similar provision could be made with a sensitive pump suction pressure indication in the DHR drop line.

We have provided general guidance in this recommendation.

We expect licehsees to select existing instrumentation and abnormal indications

14

.ard, 'if necessary, to add instrumentation based upon a practical approach for their plant configuration.

3.2 Procedures 3.2.1 Recommendation Develop and implement procedures that cover reduced inventory operation and that provide an adequate basis for entry into a reduced inventory condition.

These include:

(a) procedures that cover normal operation of the NSSS, the containment, and supporting systems under conditions for which cooling would normally be provided by DHR systems (b) procedures that cover emergency, abnormal, off-normal, or the equivalent operation of the NSSS, the containment, and supporting systems if an off-normal condition occurs while operating under conditions for which cooling would normally be provided by DHR systems.

(c) administrative controls that support and supplement the procedures in items (a), (b), and all other actions identified in this communication, as appropriate 3.2.2 Discussion We note that procedures that adequately cover operation under all shutdown conditions for which cooling would normally be provided by DHR systems will cover both entry into and operation in a reduced inventory condition.

3.2.2.1 Entry Into Emergency Procedures We define normal and emergency procedures in Enclosure 3 to be consistent with power operation procedures.

Nonpower operation involves unique conditions that do not exist in power operation, and conditions for entry into emergency procedures need to be defined. The usual entry condition during power operation is reactor trip or existence of conditions which should have resulted in reactor trip. Several appropriate conditions exist for nonpower operation.

We expect entry criteria to include consideration of all of the following:

(1) Accidental loss of a system that is operating to cool the RCS (2) Unsuccessful attempt to start a system when the system was to be used for RCS cooling and the RCS was not being actively cooled by another DHR system (3) Uncontrolled and significant loss of RCS inventory (4) Uncontrolled and significant break in the RCS coolant boundary (5) Any valid symptom of loss of control of the state of the RCS, such as uncontrolled temperature increase, uncontrolled pressurization, or the attainment of values of these parameters which are sufficiently high that action Is required that is not contained within normal procedures.

15 (6) Significant core damage expected (7) Any valid symptom of significant core damage observed 3.3 Equipment 3.3.1 Recommendation (a) Assure that adequate operating, operable, and/or available equipment of high reliability is provided for cooling the RCS and for avoiding a loss of RCS cooling.

(b) Maintain sufficient existing equipment in an operable or available status so as to mitigate loss of DHR or loss of RCS inventory should they occur.

This should include at least one high pressure injection pump and one other system. The water addition rate capable of being provided by each equipment item should be at least sufficient to keep the core covered.

(c) Provide adequate equipment for personnel communications that involve activities related to the RCS or systems necessary to maintain the RCS in a stable and controlled condition.

3.3.2 Discussion We have been prescriptive in the expeditious action recommendation. We will accept more flexibility in the longer term, including considering such options as linking heatup rate and PCS configuration to both the DHR operational requirements and the operability and availability of backup cooling equipment.

For example, if heatup rate permits and other considerations such as boron concentration are satisfactorily addressed, licensees may consider not operating normal DHR systems for long times, or may consider using other means of cooling the RCS if suitable precautions are taken while normal DHR systems are not available. Such an approach would require TS changes.

Where appropriate, licensees should develop procedures for gravity makeup from storage tanks and for the use of SGs to provide cooling. Recognized areas where it would be inappropriate are where RCS pressure is too high for gravity feed from storage tanks, where other means of makeup are not required to exist, or where the pressure necessary to force steam into contact with SG tubes to initiate cooling also causes significant loss of RCS inventory. It would be appropriate to consider SG cooling if the RCS pressure which thereby resulted was sufficiently low that gravity makeup remained viable but would not be viable if SG cooling did not exist.

Loss of DHR due to unplanned activation of the autoclosure interlock function is not consistent with provision of reliable equipment. You should investi-gate this feature if installed in your plant and should consider changes to obtain a reliable heat removal system consistent with other requirements. We encourage removal of this feature on the basis of our review of operating experience provided suitable compensatory measures are taken.

At present, we recommend the Diablo Canyon approach as a model for guidance (refs. 3 and 4).

We have received a report funded by the Westinghouse owners group that addresses this topic (ref. 8), but we have not yet reviewed the document.

16 Equipment (such as a DHR system) is reliable only if its support requirements are reliably met (electrical power, cooling). Support requirements necessary for reliable operation should be considered in meeting the programmed enhancement recommendations of this letter.

Operation of equipment in a manner that would increase the likelihood of its malfunction should be addressed.

For example, many TSs require a high DHR system flow rate when core cooling requirements can be met at a lower rate.

The high rate contributes to the likelihood that air will be ingested and cause a loss of DHR.

Such operating techniques are inconsistent with reliable operation and should be addressed in meeting the longer term recommendations of this letter.

3.4 Analyses 3.4.1 Recommendation Conduct analyses to supplement existing information and develop a basis for procedures, instrumentation installation and response, and equipment/NSSS interactions and response. The analyses should encompass thermodynamic and physical (configuration) states to which the hardware can be subjected and should provide sufficient depth that the basis is developed. Emphasis should be placed upon obtaining a complete understanding of NSSS behavior under nonpower operation.

3.4.2 Discussion The Westinghouse owners group has funded an analysis program which we consider an excellent start toward meeting this recommendation.

That program covers areas such as:

(1) thermal/hydraulic modeling with consideration of noncondensibles for 2, 3, and 4 loop plants (2) heatup rate, time to saturation, maximum pressurization, effect of water in SGs, vapor venting, liquid venting, and time to core uncovery (3) influence of SG nozzle dams (4) mitigation actions including gravity makeup to the RCS, forced makeup to the RCS, use of SGs, safety injection, and bleed and feed.

Important results are already being achieved in the Westinghouse program, and are being factored into plant operations, with a significant impact on safety.

Of note is the independent discovery of the potential impact of improper use of nozzle dams, which is discussed in reference 6, and the increased understanding of plant behavior during nonpower operation.

Another area that should be considered in reaching a complete understanding of behavior during nonpower operation involves level instrumentation.

Areas that should be considered include response times, RHR air entrainment, RHR flow rate, draining location and rate, range (RCS connection location and impact upon instrumentation indication), and RCS level (such as potential for error

17 due to a hot leg level high enough to block the pressurizer surce line connection to the RCS or the influence of a full hot leg due to inability of air spaces to communicate).

See enclosure 1, Section 2.1 for additional information.

3.5 Technical Specifications 3.5.1 Recommendation Technical specifications (TSs) that restrict or limit the safety benefit of the actions identified in this letter should be identified and appropriate changes should be submitted.

3.5.2 Discussion Typical potential impacts include TSs that control containment; DHR system flow rate; the autoclosure interlock; equipment operability, operation, and availability; and instrumentation.

One objective we wish to achieve is a simplification of TSs as nonpower operation is investigated.

Consequently, we will consider alternatives to placing requirements in TSs when such alternatives achieve the same purpose.

For example, procedures requiring certain DHR equipment to be available before an operation is initiated may be sufficient, and such specifications then would not appear in TSs.

3.6 RCS Perturbations 3.6.1 Recommendation Item 2.5 of the expeditious actions should be reexamined and operations refined as necessary to reasonably minimize the likelihood of loss of DHR.

3.6.2 Discussion Where systems or components require lowered RCS inventory for maintenance or testing, reasonable attempts should be made to conduct such activities when decay heat is low, other activities have a low likelihood of interfering, and extra precautions are available to mitigate transients should any occur.

Extra precautions include such items as additional equipment to maintain RCS inventory, a closed containment, and an enhanced ability to close containment should loss of DHR occur.

Activities which industry experience shows to have a potential impact on operation, such as electrical tests that could lead to closure of DHR system suction valves, are not to be conducted during lowered inventory operation if they can be reasonably conducted at another time. If such testing must occur, then additional precautions should be taken to respond if an impact to DHR or to the RCS occurs.

Activities that could perturb the RCS inventory or could lead to a loss of DHR given a single malfunction, such as the partially open valve which initiated

18

,inventory loss at Diablo Canyon on April 10, 1987, should not be conducted during lowered inventory operation unless the symptoms of such a single failure have been considered and precautions are provided to compensate if the symptoms occur.

For example, the symptoms of the open valve at Diablo Canyon were an increase in water level in the tank that received the draining water and a de-crease in water level in the chemical and volume control system (CVCS) tank.

Precautions would have included identification of the expected response of those tank levels, specifically observing those tank levels during and following initiation of the *operation, and assuring that additional independent ways of adding makeup water to the RCS were readily available.

Control room personnel should be informed immediately before initiating an operation which could perturb the RCS or a system which is necessary to maintain the RCS in a stable and controlled condition while a reduced RCS inventory condition exists. They should also be immediately informed of any unanticipated activity or symptom associated with the operation which could affect the RCS or DHR, and should be. informed when the operation is ended.

We note that recent plant difficulties have occurred when licensees were improving instrumentation. Typically, there may be more temporary connections than usual, tubing runs may not be well located and controlled, and operators may not be familiar with the new instruments and may discount the results, in part because the instruments may not have been declared operational. We also note that maintenance personnel may not be sensitive to the use of tubing or of openings into the RCS.

We believe it important that licensees recognize the potential for perturbation of instrument indications. These should be addressed as part of the overall issue of perturbation of the RCS.

19

4.0 REFERENCES

(1) U.S. Nuclear Regulatory Commission, "Loss of Residual Heat Removal System, Diablo Canyon, Unit 2, April 10, 1987," NUREG-1269, June 1987.

(2) F. J. Miraglia, 'Loss of Residual Heat Removal (RHR) while the Reactor Coolant System (RCS) is Partially Filled (Generic Letter 87-12)," Letter to all licensees of operating PWRs and holders of construction permits for PWRs, July 9, 1987.

(3) J. Shiffer, "Removal of RHR System Autoclosure Interlock Function,"

Letter to NRC from PG&E, Aug. 4, 1987.

(4) J. Shiffer, "Removal of RHR Suction Valve Autoclosure Interlock Func-tion," Letter to NRC from PG&E, Jan. 19,.1988.

(5) C. E. Rossi, "Possible Sudden Loss of RCS Inventory During Low Coolant Level Operation," NRC Information Notice No. 88-36, June 8, 1988.

(6) R. A. Newton, "Westinghouse Owners Group Early Notification of Mid-Loop Operation Concerns," Letter from Chairman of Westinghouse Owners Group to Westinghouse Owners Group Primary Representatives (IL, 1A), OG-88-21, May 27, 1988.

(7) Pacific Gas and Electric Co., "April 10, 1987 RHR Event, Unit 2, Diablo Canyon Power Plant," Volumes 1 and 2, April and May, 1987.

(8) N. L. Burns et al., "Residual Heat Removal System Autoclosure Interlock Removal Report for the Westinghouse Owners Group," WCAP-11736, Revision 0.0, Feb. 1988.

ENCLOSURE 3 TO GENERIC LETTER 88-17 ABBREVIATIONS AND DEFINITIONS

2 I

B AO 1.0 ABBREVIATIONS BNL B&W CE CET CFR CR DHR FR FSAR GI GL gpm ICC LER NRC NSAC NSSS NUREG NUREG/CR PORY PRA PRT psi PWR RCP RCS rem RHR RTD RV SG TS USI w

Brookhaven National Laboratory Babcock and Wilcox Combustion Engineering core exit thermocouple (also used to describe in-core thermocouples)

Code of Federal Regulations control room decay heat removal (used in a general sense to describe the process or system)

Federal Register final safety analysis report generic issue generic letter gallons per minute inadequate core cooling licensee event report Nuclear Regulatory Commission Nuclear Safety Analysis Center nuclear steam supply system Nuclear Regulatory Commission document designation NUREG prepared by a contractor pressure-or power operated relief valve located on the pressurizer probabilistic risk assessment or probabilistic risk analysis pressurizer relief tank pounds per square inch pressurized water reactor reactor coolant pump reactor coolant system roentgen equivalent man residual heat removal (used in the specific sense of the DHR system used in Westinghouse plants) resistance temperature device reactor vessel steam generator technical specification unresolved safety issue Westinghouse

3

• 2;C *DEFINITIONS For purposes of this letter, the following definitions apply:

(1) Action - Responsive acts which are recommended in the letter. There are two types of actions:

(a) Expeditious action - An action recommended in the letter that should be implemented prior to operating In a reduced inventory condition.

(b) Programmed enhancement -

An action which is to be implemented at a later date. Generally, such actions can only be implemented after development work has been done. We anticipate implementation concurrent with development and outage availability.

(2) Available -

Ready for use within a short enough time to meet the intended need, but not necessarily operable because physical manipulations may be needed to realize an operable status.

(3) Closed containment - A containment that provides at least one integral barrier to the release of radioactive material.

Sufficient separation of the containment atmosphere from the outside environment is to be provided such that a barrier to the escape of radioactive material is reasonably expected to remain in place following a core melt accident. This can be accomplished by providing reasonable assurance that the following conditions are met:

(1) The equipment hatch door is closed and held in place by a sufficient number of bolts such that no gaps exist in the sealing surface, (2) A minimum of one door in each airlock is closed, and (3) Each penetration providing access from the containment atmosphere to the outside atmosphere shall be closed by a valve or blind flange.

Closure by a valve or blind flange used for containment isolation during power operation meets this specification. Closure by other valves or blind flanges may be used if they are similar in capability to those provided for containment isolation. These may be constructed of standard materials and may be justified on the basis of either normal analysis methods or reasonable engineering judgement.

(4) Containment - See Closed containment.

(5) Emergency Procedures - That set of emergency, abnormal, off-normal, or Theebquivalent procedures that cover operation of the nuclear steam supply system (NSSS), the containment, and supporting systems if an off-normal condition occurs while operating under conditions where heat would normally be removed by DHR systems. These procedures provide coverage using a symptom based philosophy and organization similar to that used for response to off-normal conditions originating during power

4

...A operation. They cover all aspects of operation where responsibility rests with the operators, including provision of a closed containment, restoration of decay heat removal (DHR) by a broad range of meanand maintenance or replenishment of reactor coolant system (RCS) inventory.

Plant specific features are considered, such as relative elevations of water sources (for gravity drain to the RCS) and presence of high eleva-tions in DHR suction pipes (which may affect attempts to restart DHR systems, particularly if the RCS has reached a boiling condition).

(6) Independent -

Not vulnerable to the same factors as another entity that as the same purpose.

For example, if a common tap is used for the liquid leg of two liquid level instruments, then they are dependent if the common tap can be plugged by debris or if unrecognized phenomena can influence the indicated water level so that it is not representative of level at the location of interest.

(7) Inventory - See Reduced RCS inventory.

(8) Normal procedures - The set of procedures that provide guidance and instructions to the operators which cover normal operation of the NSSS, the containment, and supporting systems under conditions during which heat may be removed by DHR systems. These procedures cover operation with a water-solid RCS (if this is a normally allowed mode of operation),

with a level in the pressurizer, RCS drain down, operation when RCS level is below the pressurizer instrumentation range, operation under reduced inventory conditions; operation while at mid-loop, and refill oftIheS.

Containment, RCS state, and equipment criteria that must be satisfied before entering the conditions where these procedures apply and during the existence of these conditions are included, either as entries in the procedures, as administrative controls referenced in the procedures, or by other suitable means which provide reasonable assurance that the entry conditions are met.

(9) Mid-loop -

The condition that exists whenever the RCS water level is lower than the top of the flow area at the junction of the hot legs with the RV.

(10) Procedures - See Normal procedures or Emergency procedures.

(11) RCS inventory - See Reduced inventory or Mid-loop.

(12) Reduced inventory or Reduced RCS inventory -

An RCS inventory that results 1n a reactor vessel water level lower than three feet below the RV flange.

(13) Reliable - The condition of having a high, but reasonable, expectation of being able to perform the intended function. Ordinary plastic tubing does not meet our concept of reliable instrumentation nor does a DHR system in which inadvertent operation of the autoclosure interlock is likely to occur.