NRC Generic Letter 1979-49

NRC Generic Letter 1979-049: Summary of Meetings Held on 09/18/1979 Thru 09/20/1979 to Discuss a Potential Unreviewed Safety Question on Interaction Between Non-Safety Grade Systems & NSSS Supplied Safety Grade Systems (I&E Information Noti

ML031320243
Person / Time
Site:	Beaver Valley, Millstone, Hatch, Monticello, Calvert Cliffs, Dresden, Davis Besse, Peach Bottom, Browns Ferry, Salem, Oconee, Nine Mile Point, Palisades, Indian Point, Kewaunee, Saint Lucie, Point Beach, Oyster Creek, Cooper, Pilgrim, Arkansas Nuclear, Prairie Island, Brunswick, Surry, North Anna, Turkey Point, Vermont Yankee, Crystal River, Haddam Neck, Ginna, Duane Arnold, Farley, Robinson, San Onofre, Cook, Yankee Rowe, Maine Yankee, Quad Cities, Humboldt Bay, La Crosse, Big Rock Point, Rancho Seco, Zion, Fort Calhoun, FitzPatrick, 05000000, Trojan, Crane
Issue date:	10/05/1979
From:	Kuzmycz G Office of Nuclear Reactor Regulation
To:
References
IN-79-022 GL-79-049, NUDOCS 7911070350
Download: ML031320243 (59)

0t UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D. C. 20555 October 5, 1979 TO ALL POWER REACTOR LICENSEES

SUBJECT: SUMMARY OF MEETINGS HELD ON SEPTEMBER 18-20, 1979 TO DISCUSS

A POTENTIAL UNREVIEWED SAFETY QUESTION ON INTERACTION BETWEEN NON-SAFETY

GRADE SYSTEMS AND NSSS SUPPLIED SAFETY GRADE SYSTEMS (I&E INFORMATION

NOTICE 79-22)

I. Introduction A series of meetings was held with all four light water reactor vendors and the corresponding utilities to discuss the effect of I&E Information 79-22, Notice 79-22 on nuclear power plant owners. I&E Information Notice potential issued on September 14, 1979, notified the nuclear industry of a unreviewed safety question at Public Service Electric and Gas Company's Salem Unit 1 nuclear facility. The meetings were held in the Bethesda offices of the NRC according to the following schedule:

Westinghouse - September 18, 1979 Combustion Engineering - September 19, 1979 Babcock and Wilcox - September 20, 1979; a.m.

General Electric - September 20, 1979; p.m.

The Nuclear Regulatory Commission staff was seeking additional information from operators of all nuclear power plants on a potential unreviewed safety question involving malfunctions of control equipment under components accident conditions. This equipment consists of electricalconditions.

used for reactor and plant control under normal operating Some of this equipment could be adversely affected by steam or water outside from certain pipe breaks, such as in the main steam line inside or plant containment buildings. The consequences of a control systemthose malfunction could result in conditions more or less severe than previously analyzed. The NRC staff intends to determine the degree whether to which the validity of previous safety reviews are affected and changes in design or operating procedures will be required.

II. Background IEEE 323-74 has As part of the Westinghouse Environmental Qualification Program, been reviewed, in particular, sections dealing with environmental

9r0

CC?

7191 1 0X08 5'0

interactions. Westinghouse design philosophy is that necessary to function in order to protect the public, ifit a component Is Is "protection"

grade. Should a non-protection grade component perform normapl action in response to system conditions, it must be shown to have no adverse impact on protection grade component response. If a component did not receiye a signal to change state, it was assumed to remain t'as ls'. Part of the environmental qualIfications require the demonstration that severe will not cause common failure of "protection" grade components. An envtronments of the environmental qualification program review was a determinationoutgrowth the severe environment can cause a failure of a non-protection grade if corponent that was previously assumed to remain "as is"and alter the results of design basis analysts, the Westinghouse formed an Enivronmental Interaction Committee whose charter to Identify, for all high energy line breaks and possible locations, was the control systems that could be affected as a result of the adverse environment consequential malfunction or failure could exceed the safety limits and whose satisfied by accident analyses presented in Westinghouse plants' SARs. previously Committee was also to establish, for any adverse interactions identified,The recommendations to resolve the issue. The assumed ground rules for the investigations performed by Westinghouse are enumerated on page five Enclosure 2. The investigation resulted in a compilation of potential of control system consequential failures (due to environmental considerations)

which affected plant safety analyses. The investigation considered seven accident scenarios and seven control systems interactions in a matrix as shown on page 6 of Enclosure 2. The accidents are: 1) small steam form, rupture; 2) large steam line rupture; 3) small feedline rupture; 4) line feedline rupture; 5) small LOCA; 6) large LOCA; and, 7) rod ejection.large The control systems are: 1) reactor control; 2) pressurizer pressure

3) pressurizer level control; 4) feedwater control; 5) steam generator control;

control; 6) steam dump system control; and 7) turbine control. pressure The Investigations identified potential significant system response interactions in the:

a. steam generator power operated relief valve control system;

b. pressurizer pressure control system;

c. main feedwater control system; and, d. rod control system.

III. Discussion A. The first in the series of meetings was with Westinghouse and utilities that own Westinghouse reactors. The meeting was attended by seventy (70)

persons representing the NRC, PSE&G along with nine other utilities, Westinghouse and the other three light water reactor vendors, utility owner groups, four A/E consultants, the ACRS, AIF and EPRI. The list of attendees is presented as Enclosure 1.

Westinghouse's presentation is included as Enclosure 2.

During the Westinghouse meeting, they identified, for all high-energy line

-3- breaks and possible locations, the control systems that couldfailure be affected as a result of the adverse environment and whose consequential could invalidate the accident analyses presented in Westinghouse plants' SARs.

Recommendations were also presented for resolving the adverse interactions identified.

Westinghouse's investigation identified seven accidents and seven ascontrol systems that could possibly interact and presented them in a matrix form shown in Enclosure 2, page 6. As can be seen the potential interactions that could degrade the accident analyses are in the:

a. Automatic Rod Control System b. Pressurizer PORV Control System c. Main Feedwater Control System d. Steam Generator PORV Control System Westinghouse stated that the possible matrix interactions may increase as more the interactions will remain for all of detailed analyses are performed but are their plants and the interactions may be eliminated only if conditions such that plant specific designs mitigate the interactions because of:

a. system layout;

b. type of equipment used;

c. qualification status of equipment utilized:

d. design basis events considered for license applications; and, e. prior commitments made by utility to the NRC.

control The Westinghouse analysis did not consider plant operators as part of the The systems nor was the time allotted for operator "inaction" considered. used without assumed operator action times, as stipulated in plant analysis, were modification. Equipment in a control system or part of a control system was assumed to fail as a system in the most adverse direction for conservatism.

Westinghouse stated that the possible matrix interactions will remain for all are of their plants and the interactions may be removed only if conditions of:

such that plant specific designs mitigate the interactions because a. system layout;

b. type of equipment used;

c. qualification status of equipment utilized;

d. design basis events considered for license application; and, e, prior commitments made by utility to the NRC.

It should be noted that Westinghouse only analyzed accidents and not transients.

-4- Further, long-term investigations may be required to analyze the transient cases.

Initial conditions and assumptions are shown on pages 5, 7, 9, 14, 15, 22, 23?'

27, 28, 33, 37 and 38.

Westinghouse presented their analyses for the four control systems identified as follows:

A. Steam Generator Power Operated Relief Vale Control SVstem, The areas of concern for this system are:

1. multiple steam generator blowdown in an uncontrolled manner;

2. loss of turbine driven auxiliary feedwater pump; and,

3. primary hot leg boiling following feedline rupture.

The assumptions used are presented on page 15 of Enclosure 2. Potential solutions to the Steam Generator PORV Control System interaction problems were presented as both short term and long term. The short-term solutions are to:

1. Investigate whether the SG PORY Control System will operate normally or fail in a closed position when exposed to an adverse environment; and,

2. modify the operating instructions to alert operators to the possibility of a consequential failure in the SG PORY Control System caused by an adverse environment.

If evident, close block valves in'the relief lines.

The long-term solutions are:

1. redesign the SG PORV Control System to withstand the anticipated environment;

2. relocate the SG PORVs and controls to an area not exposed to the environment resulting from ruptures in the other loops;

3. install two safety grade solenoid valves in each PORY to vent air on a signal from the protection system, thereby ensuring that the valve will remain closed initially or will close after opening; and,

4. install two safety grade MOVs in each relief line to block venting on signal from the protection system.

Westinghouse presented simil~ar analyses for the other three control systems along with the assumptions, areas of concern and potential solutions. These are presented in Enclosure 2.

a. Steam Generator PORY Control System pp. 14-21, Enclosure 2.

U. Main FeedwAter Control System pp. 22-26, Enclosure 2.

c. Pressurizer PORY Control System pp. 27-32, Enclosure 2.

d. Rod Control System pp. 37-42, Enclosure 2.

At the end of Westinghouse's presentation, the NRC staff caucused to discuss reconvened the meeting their future plans and actions. When all attendees CFR 50.54(f) letter, was opened to discussions of the impact of the NRC 10

vendor and utility plans, and staff plans.

Westinghouse stated that they would establish an action plan along the guidelines of NUREG-0578. Westinghouse also stated that their investigations need to evaluate were carried further than FSAR analyses and they would eliminate consequential failures on a realistic basis; this evaluation may are lower investigations some problems. Westinghouse stated that theirthemselves are sets of low probability subsets of SAR analyses which in determination probability. Westinghouse expressed doubts that a conclusive equipment can be made of the qualification status of all of the involved in 20 days.

Robinson plant representatives noted that their secondaries are open and problem. They indicated therefore breaks outside of containment present no will be to follow the their basic approach to answering the 20-day letter short-term Westinghouse recommendations.

Representatives of Salem also stated that their intent is to follow the short-term Westinghouse recommendations to satisfy the request of the 20-day letter.

Utility representatives stated that they will respond tomanner the 20-day letter in a suggested by by addressing the four control systems identified provides directions the Westinghouse recommendations unless the NRC staff stating their position to the contrary and further established guidelines on the problem along with their recommendations.

B. The second in the series of meetings was held with Combustion Engineering and utilities that own CE's reactors. The meetings were attended by 52 persons representing the NRC, all four light water reactor vendors, five utilities, The list of meeting attendees various consultants, the ACRS, AIF and EPRI.

is presented as Enclosure 3.

four control They explained the concerns presented by Westinghouse and the environment of systems that could be affected as a result of the adverse failure could invalidate a high energy pipe break and whose consequential the accident analysis of plant SARs.

Previous analyses did not specifically take control systems into account considered passive in the analyses.

in accident scenarios and the systems were control systems The staff explained its earlier understanding regarding the accidents were expected to be interaction in accidents as one in which contribute quick and the control systems did not have the time to significantly to the consequences. If most of industry reviewed their accident analyses according to the staff position on control system to further the scope contribution, then a need does, in fact, exist modes of the of accident analyses to include potential consequential failure

"-I

control systems, Industry representatives stated that in the only skim the surface in Accident reyiew withallotted 20 das, tshey could the inclusiQn system interactions. An lnttiql qpproaqh would Fe Qf a mechanistlcof control to determine wAht control system would be inyolyed and iwha nature would be necessary to initiate fifes rather th~an uslng an t type Qf hardfiare approach to determine the contribition of control Syste0s anaardtwca on accident consequences.

Combustion Engineeringts plans are to Identify the cause interactions and then look at resolutions to control the systems that could problem on a per plant basis since some solutions are plant dependent. The action followed ispresented as Enclosure 4 and isas follows: process to be

1. Identify those non-safety related control systems, inside containment, whose malfunction could adversely affect the and outside or transient when subjected to an adverse environment caused accident high energy pipe break. by a

2. Determine the limiting malfunctions and their impact energy pipe breaks for those control systems. during high

3. Determine the short term and long term corrective actions.

Combustion Engineering stated that in their plants, operaton systems isnot required inorder to mitigate the consequences of control analyzed inChapter 15. The analyses inChapter 15 include of the transients that these control systems respond normally to each transientthe assumption their operational mode is that which would be most adverse and that for under consideration. The consequences produced by any credible the transient of these control systems would be less severe than any which malfunction would produced by the mechanisms considered as causes of the transients be in Chapter 15. analyzed Some discussion followed dealing with the failure modes of and whether the failure mode is inthe most adverse direction control system design direction. Resolution of this topic was not obtained or in the addressed on a plant-by-plant basis. but will be Again utilities presented their concerns over the 20-day expected of them in this time frame. They stated that inletter and what is directions of the letter all components would have to be order to follow the if the non-safety grade system failure mode would aggrevate reviewed to determine consequences. the accident C. The third inthe series of meetings was held with Babcock that own B&W reactors. The meetings were attended by fifty-six and Wilcox and utilities persons representing the NRC, reactor vendors, seven utilities, (56)

consultants, the AIF and EPRI along with the Union of Concerned various Scientists.

-7- to the The NRC staff explained the background history leading up a generic

"20-day" letter and the fact that they consider the problem one common to all LWRs.

the letter The utility representatives stated that they will answer group, which themselves without specific participation of the ownersMost of the work, they consider germane only to TMI-2 related subejct. will the detailed action plans of which have not yet been established, engineers and be performed by the various utilities and their architect vendor.

consultants, with generic material supplied by the reactor be plant The utility representatives understand the environment to for control specific and will use that environment in their analyses component system failure. The system failure will include not only and cold shorts.

failure but also failure of transducers, wires, and hot of consequential The adequacy of fixes for the long-term and the combination20 days.

failures is not expected to be considered in the allotted evaluations Babcock and Wilcox representatives stated that in the topast, the trip, a time were performed for the sequence of events leading up systems have of about 5 to 10 seconds. Prior to that time the control of control no effect on the accident sequence or consequence. Failure possible the systems will be investigated in view of the severity ofconsequences, accident; if the control system failure increases the then that system will be considered.

in Enclosure 6 The approach proposed by B&W and the utilities is outlined and is as follows:

1. Evaluate the impact of IE 79-22 on licensing basis accident analyses.

2. Identify accidents which will yield the adverse environment.

3. Define inputs and responses used.

4. Verify conclusions and justify continued operation.

failure of The utilities will alert the plant operators to the potential information.

the plant control systems in total or in providing correct how The abnormal and emergency procedures will be reviewed to determine will affect failure of non-safety grade systems or improper information the prescribed operator action.

Electric D. The fourth and final in the series of meetings was with Generalby 52 and utilities that own GE reactors. The meeting was attended utilities, people representing the NRC, three reactor vendors, nine architect engineers, consultants, and the AIF. The list of attendees is presented as Enclosure 7.

the The NRC staff presented highlights of the previous meetings and concerns identified by Westinghouse. The staff stated that a to see if more sophisticated evaluation of the accident analysis is required the course and consequences of the accident are altered by consequential failure of non-safety grade control systems.

-8- General Electric representatives stated that their analyses have considered high energy pipe breaks in many locations and -

are more detailed since BWRs have a larger number of pipes inside and containment carrying radioactive liquids. The BWR leak detectionoutside capabilities are correspondingly greater. Special attention to separation criteria viz., various systems are in separate is given and inside a class 1 secondary as well as primary containment.cubicles The high energy line break is not considered a problem.

In 1970,

Dresden 2 experienced opening of a safety valve and a resulting and 340 F environment. The equipment was examined and the 10 psi qualifications were subsequently upgraded.

GE representatives stated that they performed sensitivity studies on their non-safety grade systems to determine if they are heavily upon during an accident. The studies revealed that there relied dependence upon those systems. was no heavy It must be noted that the GE non-safety grade system and comprise only approximately 25% of a typical plant total. components will perform their own analyses on BOP systems to satisfy The utilities the require- ments of the "20-day" letter.

IV. NRC Comments The NRC staff stated that they understood the requests by regarding position and direction on the request found in the nuclear industry letter dated September 17, 1979 but would wait until the the NRC 10 CFR 50.54(f)

conclusion of the scheduled meetins with all four light water reactor vendors.

further stated a Commission Information paper would be preparedThe staff the staff's judgment regarding the magnitude of the concern discussing ness of industry's response for resolution of the problem. and the appropriate- More specific staff statements were made in terms of generating specific matrix of potential environmental interactions of a plant for each plant. The NRC requested that they be notified control system and the individuals that will perform them, either reactor of further analyses vendors, the owners groups, or the individual utilities.

The NRC noted that at this time, it is not evident which with what environmental interaction problems. The effectsutilities are faced all of the Westinghouse recommended short-term "fixes" may of implementing be contradicted by other sequences. Multiple failure analyses could be performed would take months and could not possibly be ready in 20 days. but this The NRC recommended that utilities check if qualified equipment to determine the magnitude of a total qualification program. is in place The staff advised the utilities to check the validity of their operating procedures in light of the steam environment around various the reliability of certain control valves in question; also, components and made of all information available in files of vendors, A/Es, use should be dealing with the problem. and consultants

-9- The staff is aware that sufficient time is not available to identify all of the potential interactions but some of the more obvious ones must be reviewed. For example, some utilities might choose to operate their plants in the ihterim period using a manual rod mode instead of the preferred automatic mode; also, the PORV block valves may be operated in the closed position. The determination of what systems are suspect and the possible 20-day solutions must be answered by each individual utility according to their plant design. Operator training would have to be stressed to make the operators aware that potential consequential failures may exist that would mask the real failure and give erroneous readings.

The staff stated that for the "20-day" letter response, the utilities should use engineering judgment and evaluations instead of detailed analyses that would be time consuming and might limit the utility response to a limited number of evaluations.

V. Conclusions The staff indicated that there were three possible options that could be followed in providing a short-term response.

1. Qualify equipment to the appropriate environment; this would take longer than 20 days and would, more likely, for most utilities be a long-term partial solution.

2. Short-term fixes should be in place pending long-term solutions.

It must be noted that in this situation some components that are relied upon to work properly might be wiped out by consequential failures under certain conditions and accident sequences.

3. The "worst case" plant should be selected and a bounding analysis performed to determine the time frame available for qualification of equipment.

The staff reiterated the presented recommendations, possible interim solutions that are plant specific, and in addition, requested the following:

1. Identify equipment and control systems which are either needed to mitigate the consequences of a high energy pipe break or could adversely affect the consequences of these events.

2. Check the locations, expected environment, and environmental qualifications of the equipment and control system identified in part 1.

3. If some of these are found not be qualified for the environmental conditions, propose an appropriate fix, i.e., design change, change in operating procedures, acceptable consequences argument based on your evaluation, etc. Provide a schedule for the proposed fix.

George Kuzmycz, Project Manager Division of Project Management

Mr.-William J. Cahill, Jr. 50-3

^ Consolidated Edison Company of New York, Inc. 50-247 cc: White Plains Public Library

100 Martine Avenue White Plains, New York 10601 Joseph D. Block, Esquire Executive Vice President Administrative Consolidated Edison Company of New York, Inc.

4 Irving Place

-New York, New York 10003 Edward J. Sack, Esquire Law Department Consolidated Edison Company of New York, Inc.

4 Irving Place New York, New York 10003 Anthony Z. Roisman Natural Resources Defense Council

917 15th Street, N.W.

Washington, D. C. 20005 Dr. Lawrence R. Quarles Apartment 51 Kendal at Longwood Kennett Square, Pennsylvania 19348 Theodore A. Rebelowski U. S. Nuclear Regulatory Commission P. 0. Box 38

- Buchanan, New York 10511

ENCLOSURE 1 MEETING ATTENDEES

NRC WESTINGHOUSE

D. RQss. K. Jordan D. Etsenhut -R.Sero J.'Heltemes R. Steitler G. Kuzmycz G. Lang J. Guttmann G. Butterworth W. Jensen V. Sluss S. Israel F. Noon G. Lainas V. Benaroya PSE&G Co.

R. Woodruff F. Librizzi A. Dromerick R. Mittl B. Smith J. Wroblewski M. Grotenhuis J. Gogliardi A.-Schwencer P. Moeller P. Norian R. Fryling F. Orr F. Odar VENDORS

T. Dunning N. Shirley - G.E.

W. Gammill W. Lindblad - G.E. Portland S. Salah R. Borsun - B&W

J. Stolz C. Brinkman - C.E.

Z. Rosztoczy T. Novak UTILITIES

J. Beard D. Waters - CP&L

M. Cliramak M. Scott - Con. Ed.

D. Tondi G. Copp - Duke Power C. Berlinger N. Mathur - PASNY

L. Kintner J. Barnsberry - S. Cal. Ed.

J. Mazetis K. Vehstedt - AEPSC

K. Mahan R. Shoberg - AEPSC

D. Thatcher E. Smith - VEPCO

J. Burdoin T. Peebles - VEPCO

P. Mathews P. Herrmann - Southern Co. Services M. Lynch R. Scholl W. House - Bechtel T. Martin - Nutech J. McEment - Stafeo M. Wetterhahn - Conner, Moore & Corber K. Layer - BBR

E. Igne - ACRS

P. Higgins - AIF

R. Leyse - EPRI

ENCLOSURE 2 VI EWIROI'ITAL QUALIFICATION

ACTIVITIES

(IEEE 323-74)

- SEISMIC TESTS

- AGITh PMROGP1

- ENVIROITAL BVELOPES

- ItNsmU.Ta ACa!RCIES

- E!NVIR3[ITTAL INTERACTIOS

i

HISTORY

ACRS CONCERNS

NRC ACTIONS/QUESTIONS

AREAS: SYSTEMS INTERACTIONS

INTERFACE CRITERIA (STANDARDIZATION)

HELB PROTECTION

INDUSTRY DESIGN PHILOSOPHY

IF A COMPONENT IS NECESSARY TO FUNCTION IN ORDER TO PROTECT

THE PUBLIC, IT IS "PROTECTION" GRADE. SHOULD A NON-PROTECTION

GRADE COMPONENT PERFORM NORMAL ACTION IN RESPONSE TO SYSTEM

CONDITIONS, IT MUST BE SHOWN TO HAVE NO ADVERSE IMPACT ON

PROTECTION GRADE COMPONENT RESPONSE. IF A COMPONENT DID NOT

RECEIVE A SIGNAL TO CHANGE STATE, IT WAS ASSUMED TO REMAIN

"AS IS".

- ENVIRONMENTAL QUALIFICATION

DEMONSTRATE THAT SEVERE ENVIRONMENT WILL NOT CAUSE COMMON

FAILURE OF "PROTECTION" GRADE COMPONENTS

- NEW QUESTION TO BE ADDRESSED

CAN THE SEVERE ENVIRONMENT CAUSE A FAILURE OF A NON-PROTECTION

GRADE COMPONENT THAT WAS PREVIOUSLY ASSUMED TO REMAIN "AS IS"

AND ALTER THE RESULTS OF THE DESIGN BASIS ANALYSES?

- REGULATORY ENVIRONMENT TODAY

- POST-TMI/2 REACTION

- NUREG-0578

- ACRS PRESENTATIONS BY NRC

- -

ENVIRUNrnJfAL IWTERACTION CO"I¶TTEE

INWERACTION TO BE ADDRESSED:

A CONSEQUENTIAL FAILURE OF A COTROL SYSTEM DUE TO AN ADVERSE EN3VIRON1EBI

INSIDE OR OUTSIDE CQ¶AII4NFJ FOL.LWING AHI(fl ENERGY RUPTURE IMICH

NECATES A PROTECTIVE FUIJCTIaJ PERFOR-ED BY ASAFElY GRE SYSTEJb

0CIOTlEE OMER:

FOR ALL HIGI BJERGY LINE BREAKS AMD POSSIBLE LOCATIONS, IDEIfTIFY C1fTROL

SYSTEMS THAT COULD BE AFFECTED AS A RESULT OF THE ADVERSE EBNIROWElff AMI

VOSE CONSEUEWTIAL, f'FIWCrIOI OR FAILURE COULD IINALIDATE THE ACCIDET

ANALYSIS PRESETE INTHE PLAlf SAR. FOR AY ADVERSE IERACTIO[S IDENTIFIED,

ESTABLISH RECOMEMATIOJS TO RESOLVE THE ISSUE.

iASSU1D GROU{iDRULES FOR INVESTIG4TION

o 0fNTROL SYSTEMS (OR PARTS) 1NOT SUBJECT TO HIGH RGH

Y LINE BREAK

ElVIRONIRENT

- EQUIPOT1{F ASSUfED TO RE[IN'AS IS' OR OPERATE WITHIN SPECIFIED

ACCURACY, WHICHEVER IS MDRE SEVERE

o RANDOM FAILURES IN THE CONTROL SYSTEM ARE NOT POSTULATED TO OCCUR

COINCIDEfTf WITH THE STUDIED EVENT

o PROTECTION SYSTEfS AIE ASSU0ED TO FUNCTION CONSISTENT WITH REQUIREMENTS

OF IEEE-2?9-l971 (INCLUDING SING.E FAILURE INPROTECTION SYSTEfD.

e OPERATOR ACTION TIMlE ASSUMED OONSISTENT WITH SAR ASSUJPTIONS

o W14TROL SYSTE (OR PARTS) SUBJECT TO HIGH ENERGY LINE BREAK

ENVIRON1411T

- UNQUALIFIED EQUIPMNT ASSUED TO FAIL INMST ADVERSE DIRECTION

- QUALIFIED EQUIPPENq ASSUE) TO REiAIN 'AS IS' OR OPERATE

WITHIN SPECIFIED ACCURACY.

(QUALIFIED DESIGN CRI BE SHNJN 10 BE COWATIBLE WITH POSTULATED NVIR)fIE

Control Pressurizer Steam Generator Steam Reactor Pressure Level Feedwater Pressure Dump Turbine Accident Control Control Control Control Control System Control Small Steamline Rupture X X X

Large Steamline Rupture X

Small Feedline Rupture X X X X

Large Feedline Rupture X X X

Small LOCA X X X

Large LOCA

Rod Ejection PROTECTION SYSTEM-CONTROL SYSTEM POTENTIAL ENVIRONMENTAL INTERACTION

X - POTENTIAL INTERACTION IDENTIFIED THAT COULD DEGRADE ACCIDENT ANALYSIS

0 - NO SUCH INTERACTION MECHANISM IDENTIFIED

N

IDENTIFIED POTENTIAL CONCERJJS

SYSTEMATIC INVESTIGATION IDENTIFIED POTENTIAL ESNIRO(Y'ElTAL

INTERACTION IN:

- STEN-1 GENERATOR POWER OPERATED RELIEF VALVE CORTROL SYSTEM

- PRESSURIZER PRESSURE CONTROL SYSTE1I

- MAIN FEED WATER CONTROL SYSTEJ1

- ROD CONTROL SYSTEM

INTERACTION MODE AND POSSIBLE FIXES IDENTIFIED

o INVESTIGATION TO DATE LIMITED TO ItPACT OF ADVERSE EIIR -WfTON

COITROL SYSTEMS AlD POTENTIAL CCUSEOUEIJTIAL EFFECTS

o REMAINING AREA UNDER INVESTIGATION BY C(XlIITTEE ISTHE EFFECT OF

ADVERSE EUNVIROf',ENTS ON VALVE OPERATORS ASSOCIATED WITH 'INACTIVE'

VALVES LOCATED INPROTECTION SYSTENS

- NO OPERABILITY REQUIREIIENT ON VALVE THEREFORE IOQUALIFICATION

SPECIFIED FOR VALVE OR OPERATOR

- HAIEVER, ACCIDENT ANALYSIS ASSUlES VALVE STAYS 'AS IS'

PLANT APPLICABILITY OF COICERNS &RECCMEDATImNS

• IDENTIFIED CONCERNS ARE NOT GENERIC SINCE IMPACTED BY MANY PLANT

SPECIFIC PESIGFS'IS:

- SYSTEM LAYOUT

- TYPE OF EQUIFPiENT UTILIZED

- OUALIFICATION STATUS OF EQUIPFENT UTILIZED

- DESIGN BASIS EVENTS CONSIDERED FOR LICENSE APPLICATION

- CO(IMITIME11TS MUDE BY UTILITY TO NRC

RECCrTENATIO[JS

- UTILITY REVIEW OF IDENITIFIED CONCERS WITH RESPECT TO PLMIT

CHARACTERISTICS A"ID LICENSING COAMIT11ENTS

- FOLL0Cl-UP BY UTILITIES TO CONSIDER POTENTIAL FOR ADVERSE

ENIRMNTTAL INTERACTION FE1 CONTROL SYSTEMS AS YET UN-

REVIEWED BY WESTINGHOUSE

SAR FEEDLINE RUPTURE EVENT

- MAIN FEEDLINE RUPTURE OCCURS DOWNSTREAM OF FEEDLINE CHECK VALVE

- MAIN FEEDWATER SPILLS OUT RUPTURE

- SECONDARY INVENTORY SPILLS. THROUGH RUPTURED FEEDLINE

- PRIMARY BEGINS HEATUP DUE TO PARTIAL LOSS OF LOAD

- REACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR WATIER LEVEL IN

RUPTURED STEAM GENERATOR

- AUXILIARY FEEDWATER PUMPS INITIATED ON LOW LOW STEAM GENERATOR

WATER LEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP

- PRIMARY BEGINS COOLDOWN WHILE HEAT REMOVAL CAPABILITY OF SECONDARY

INITIALLY EXCEEDS DECAY HEAT GENERATED IN CORE

- PRIMARY BEGINS HEATUP WHEN SECONDARY INVENTORY NOT CAPABLE TO

REMOVE DECAY HEAT

- STEAM GENERATORS IN INTACT LOOPS BEGIN REPRESSURIZING DUE TO

AUTOMATIC OR MANUAL MAIN STEAMLINE ISOLATION

- STEAM DRIVEN AUXILIARY FEEDWATER PUMP OBTAINS STEAM FROM AT LEAST

TWO MAIN STEAMLINES. STEAMLINE ISOLATION INSURES SOURCE OF STEAM SUPPLY

- PRIMARY CONTINUES TO HEATUP UNTIL AUXILIARY FEEDWtATER BEING INJECTED

INTO INTACT STEAM GENERATORS IS SUFFICIENT TO REMOVAL DECAY HEAT

10

WESTINGHOUSE PROPRIETARY CLASS 2 W'(FtP-- .. 20o

.

. . _ - i i i: 2 i 1124V i I I W

l .00

Lb - I.

0

L"

_.._..

50.Go -

= 06 L"L

-J

Co 500.00 +

50. 00 *r1~-~:f~

t I 9 t~~~ '., .I

M. 00 1 r.,- I

. . . .

4 2+/-2.L+/-

. ..

2 '

SSo.00 -

_ . .

..

C

Lb

2

0.00 +

-

SLaA~

-4

550. 0*

50.00 -

• W.00 o6c I - .-

'+ < 41 T-

I

)

4. 0~. g C. C) OC-__

3

00

40 (

C:2 L h g g °oC- b o; o44- 40

rcu M IV

' Wr

5-10 Primary Temperature Transients Following a Feedline Rupture Assuming Worst Case Initial Conditions and Assunptlins for a

3-Loop Plant

If pROPRIETARY CLASS 2 WEsjNtG"OUSE

WJ L4A -.7-O

S t.

La cr e.

La tta C3

1500.0 I I i! IJ: '. v i t 1 iHI

I111 I I !i ,1- : H iI . -

V;

1250.0

C-

0

-J

1000.

40

750.00

C.

n 500.00

250.00

2:

I iIIH :,

! o!o I

0.0 0

I I I 111111I i I111!1;

ZD 0 0-

CD O 0C C= 00 C CDCr~ -=]~

6U 4 00O

rc ,

0 eu . . f.W. .

O00

OD .0 4='_ .. . 00 3 CD

O C; * ,'

AAC 4U apc TIME (SEC)

Folloving a

5-ll Primary Temperature and Stena Cenerator Pressure and reedline Rupture Assuming Worst Case Initial Conditioos Assumptions for a 3-Loop Plant

I2 WESTINGHOUSE PROPRIETARY CLASS Z

Af- q23

270Id% . U I . . . . ..

V- 260 0. 0

250 0.0

240 0.0

230i

.0

220t es:

210(

LA

200( D.0

0.. I90C).0

~.0

t80C

1700

2000.0

1750. 0

LaJ

x_j

1500.0

I-

0 La

1250.

4-)

1000.00

C-

750.00

500.00

Co CD . -. _~ = o 0 C =

o o o  := CDo c=___

., 00 00=-E

0D c.x: -

00o o :c o 00 oc .- O0 O: Ic - ' --.

.

_0* E . C>Qt cX . . L O 0. f~-:

o om . - ,

OD CO C>Gz =)

CDJ C3cUm=t=

c~C. -,V

AjenT-L% - ~~j

0 0 0T Z .

5-12 Pressurizer Pressure and Water Vo1=e Following a Feedline Rupture JlAssuming Worst Case Initial Conditions and Assumptions for a

3-Loop Plant

13 SlESTINGHOUSE PROPRIETARY CLASS 2 C - qz3o i *: . . iii. I. I. I I . .I . .I I -I I.

1.2000 . IT

S

1.O090-I-I

-

75000 +

E -:

(.j s. .50000

x F:

W t-l

.25000

0.0

-. 10000 i.I i :I I'iili i iHl t i II i ! 'H;H ! i i

40.000 . I. 44 .I . ....

HH 4I I klliF  !;;

I I i

30.000 +

M

0

20. 000

-

~La,=

W- -

cr

, -

10.000

_~

---

A I I

0.0- _ -

A/--

-SO. 000 48_ O

.

O 0

CD

........

OC. =

.

o 5ocr,

. .

60

I 11s_ 0 00 *.e O

0 00C*_

C00> O 0 e-C 0C 0>c~zz = 0 c0 cr z-%P1Q O D

OU OC. D

0 0 CF

w C~ ena~iA;'~ rN in0 en D

5-13 Vessel Mass Flow Rate and PressUrizer Insurge Following a Feedline Rupture Assuming Worst Case Initial Conditions and Assumptions for a 3-Loop Plant

14 STEAM GENERATOR POWER OPERATED

RELIEF VALVE (PORV) CONTROL SYSTEM

FEEDLINE RUPTURE OCCURS IN MAIN OR AUXILIARY FEEDWATER LINES IN

AUXILIARY BUILDING BETWEEN CONTAINMENT PENETRATION AND CHECK VALVES

MAIN FEEDWATER SPILLS OUT RUPTURE

SECONDARY INVENTORY SPILLS INTO AUXILIARY BUILDING THROUGH RUPTURED

FEEDLINE

REACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR WATER LEVEL IN RUPTURED

STEAM GENERATOR

AUXILIARY FEEDWATER PUMPS INITIATED ON LOW LOW STEAM GENERATOR WATER

LEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP.

STEAM GENERATORS IN INTACT LOOPS BEGIN REPRESSURIZING DUE TO AUTOMATIC

OR MANUAL MAIN STEAMLINE ISOLATION

ADVERSE ENVIRONMENT INSIDE AUXILIARY BUILDING IMPACTS STEAM GENERATOR

PORV CONTROL SYSTEM POTENTIALLY CAUSING THE VALVES TO INADVERTENTLY OPEN

OR FAIL TO CLOSE DUE TO AN ENVIRONMENTAL CONSEQUENTIAL FAILURE

STEAM GENERATORS THAT SUPPLY STEAM TO TURBINE DRIVEN AUXILIARY

FEEDWATER PUMP DEPRESSURIZE TO ATMOSPHERIC PRESSURE VIA FAILED

OPEN STEAM GENERATOR PORV'S, CAUSING TURBINE DRIVEN AUXILIARY

FEEDWATER PUMPS TO-STOP

IF SINGLE ACTIVE FAILURE ASSUMED IS A MOTOR DRIVEN AUXILIARY FEEDWATER

PUMP, ALL AUXILIARY FEEDWATER IS LOST TO ALL STEAM GENERATORS

PRIMARY BEGINS TO HEATUP RAPIDLY DUE TO LOSS OF SECONDARY HEAT SINK

AND HOT LEG BOILING COMMENCES

TIME OF OPERATOR ACTION TO MANUALLY CLOSE VALVES IN AUXILIARY FEED-

WATER LINE TO RUPTURED STEAM GENERATOR OR TO MANUALLY BLOCK STUCK

OPEN STEAM GENERATOR PORV'S DETERMINES SEVERITY OF ACCIDENT RESULTS

I'S

STEAM GBERATOR POW' CO[ROL SYSTEM

,ASSoUPPTIONS:

• FEEDLINE RUPTURE OUTSIDE CONTAINIlENT

o WORST SINGE ACTIVE FAILURE ASSUWED INSAEWLRDS TRAIN

• FSR INITIAL ITIOIS

• ADVERSE ENVIRONJI IWACTS SG POW CODflRL SYSTEM RESULTING

INCONSEQUENTIAL FAILURE

e STEAM GECRATOR RPO AO]TREL SYSTEM DIRECTS VALVES TO ByVE TO

OPEN POSITIO

OPERATOR ACTION NOT ASSUMF FOR AT LEAST 20 MINUTES

STEAM GENERATOR PORV

SINGLE FSAR INITIAL CONSEQUENTIAL

LOCATION FAILURE OPERATOR

FAILURE CONDITIONS FAILURE DIRECTION ACTION

OPEN

(

1 SAFEGUARDSI "I - -fl TRAIN

BEST ESTIMATE

INSIDE AUX. -

BUILDING

NONE

FEEDLINE BREAK .

(

OUTSIDE AUX.

• 1 BUILDING- - -

I INSIDE

CONTAINMENT

i?

STEAM GEERATOR POWER OPERATED CELIEF VALVE

CON[ROL SYSTEM

AREAS OF CONCERN:

- PILTIPLE STEAM MEFATOR BLOWW INAN UNCONTRL E]MNIER

- LOSS OF TURBINE DRIVES AUXILIARY FEEITIATER PUP

- PRIiRY HOT LEG BOILING FOLLOWING FEEDLINE RUPTUSKR

STEAM GENERATOR PORV CONTROL SYSTEM

POTENTIAL SOLUTIONS

SHORT TERM

- INVESTIGATE WHETHER SG PORV. CONTROL SYSTEM WILL OPERATE NORMALLY

OR FAIL IN CLOSED POSITION WHEN EXPOSED TO ADVERSE ENVIRONMENT

- MODIFY OPERATING INSTRUCTIONS TO ALERT OPERATOR TO THE POSSIBILITY

OF A CONSEQUENTIAL FAILURE IN THE SG PORV CONTROL SYSTEM CAUSED BY

ADVERSE ENVIRONMENT, IF EVIDENT, CLOSE BLOCK VALVES IN RELIEF LINES

LONG TERM

- REDESIGN SG PORV CONTROL SYSTEM TO WITHSTAND ANTICIPATED ENVIRONMENT

- RELOCATE SG PORV'S AND CONTROLS TO AN AREA NOT EXPOSED TO THE

ENVIRONMENT RESULTING FROM RUPTURES IN OTHER LOOPS

- INSTALL TWO SAFETY GRADE SOLENOID VALVES ON EACH PORV TO VENT AIR

ON SIGNAL FROM THE PROTECTION SYSTEM, THEREBY ENSURING THAT THE VALVE

WILL REMAIN CLOSED INITIALLY OR CLOSE AFTER OPENIUG

- INSTALL TWO SAFETY GRADE MOV'S IN EACH RELIEF LINE TO BLOCK VENTING

ON SIGNAL FROM PROTECTION SYSTEM

I

I

I

I

I

I

I SAF~rY VRLVes I

I

I

I

I

I

I

I

I

'TUflOIN.

fT f A'?A

L eve L

mFW

I <

colfvrAriv1eNrT

WALL

Il

(

C

ID

Figure 6. Auxiliary Feedwater System (Four-Loop Plant) ID

W.

Itte

• rlf, I'lt, C

(

to

<0

Figure 7. Auxiliary Feedwater System (Three-Loop Plant) "II

MAIN FEEDWATER CONTROL SYSTEM

SMALL FEEDLINE RUPTURE OCCURS IN MAIN OR AUXILIARY FEEDWATER LINES

IN AUXILIARY BUILDING BETWEEN CONTAINMENT PENETRATION AND CHECK

VALVES

MAIN FEEDWATER AND POSSIBLY SECONDARY INVENTORY SPILLS INTO AUXILIARY

BUILDING THROUGH SMALL FEEDLINE RUPTURE

ADVERSE ENVIRONMENT CAUSED BY RUPTURE IN FEEDLINE IMPACTS MAIN

FEED-

WATER CONTROL SYSTEM LOCATED IN AUXILIARY BUILDING

FEEDWATER CONTROL SYSTEMi MALFUNCTIONS SUCH THAT ALL STEAM GENERATORS

AT LOW LOW STEAM GENERATOR WATER LEVEL AT TIME OF REACTOR TRIP

RESULTS OF ACCIDENT WITH ABOVE CONDITIONS AT TIME OF REACTOR.TRIP

MORE SEVERE THAN THOSE PRESENTED IN MANY SAFETY ANALYSIS REPORTS

3 FEE]YRATER OONTROL SYSTEM

ASSUPTIONS:

• StALL FEEDLINE RUPTURE OUTSIDE CONTAINIENT INAUXILIARY BUILDING

o WORST SINGLE ACTIVE FAILURE ASSUIUD ISSAFEaD TRAIN

c FSAR INITIAL CONDITIONS

o ADVERSE ENVIROENT IFPPACTS MAIN FEERIATER WONTRIL SYSTEM

RESULTING INCONSEOLENTIAL FAILURE

• MIN PfEE[ATER CWTROL SYSTEM DIRECTS FCV's ININTACT LOOPS TO

MJVE TO THE CLOSED POSITION

OPERTOR ACTION 1NT ASSU'fE FOR AT LEAST 20 MINUTES

FEEDWATER CONTROL

SINGLE FSAR INITIAL CONSEQUENTIAL FAILURE OPERATOR

SIZE LOCATION FAILURE CONDITIONS FAILURE DIRECTION ACTION

INSIDE AUX.-TRAN N

BUILDING

ON

SMALL OUTSIDE AUX.

BUILDING

INSIDE

FEEDLINE BREAK

CONTAINMENT

LARGE

a2 MAIN FEEDWATER CONTROL SYSTEM

AREAS OF CONCERN

- ALL MAIN FEEDWATER LOST TO INTACT STEAM GENERATORS FOLLOWING

SMALL FEEDLINE RUPTURE

- PRIMARY HOT LEG BOILING FOLLOWING FEEDLINE RUPTURE

IAIN FEEIATER ONTROL SYSTEMV

POTENTIAL SOLUTIONS

SHORT TERM

- I1VESTIATE WHETHER MIN FEERAER CU'TROL SYSTEM WILL FAIL OR

OPERATE NORYA[LY WHEN EXPOSED TO ADVERSE EaVIRONIMnT

- TAKE CREDIT FOR OPERATOR ACTION PRIOR TO ALL SG'S REACHING LaW-LOW

LEVEL TRIP SETPOINT FOLLOWlING Sf4PLL FEEDLINE RUPTURE

LONG TERN

- ISOLATE FEENTER CONTROL SYSTEfl FROM THE ADVERSE DIVIRONPS'4 RESULTING FRO)MPIPE RUPTURES INOTHER LOOPS

- REVISE LICENSING CRITERIA TO PERMIT BULK BOILING INTHE RCS PRIOR

TO TRANSIE4T ITURJ UTYI

- INSTALL ON RETURN VALVE INMAII FE MATER LINE INSIDE CONTAINfMENT.

POSSIBILITY OF A SfTLL FEEDLINE RUPTURE INSIDE CONTAINEN-T BEPWEEN

CHECK VALVE AND STEAM GENERATOR REQUIRES QUALIFICATION OF STEAM

FLOW TRMIS[ITTER TO PREVENT MVILFUXTI014 OF FEEUdATER COOTR0L SYSTEM

PRESSURIZER POWER OPERATED RELIEF VALVE (PORV) CONTROL SYSTEM

- FEEDLINE RUPTURE OCCURS IN MAIN FEEDLINE INSIDE CONTAINMENT BETWEEN

STEAM GENERATOR NOZZLE AND CONTAINMENT PENETRATION

- MAIN FEEDWATER SPILLS OUT RUPTURE

- SECONDARY INVENTORY SPILLS INTO CONTAINMENT THROUGH RUPTURED FEEDLINE

- REACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR WATER LEVEL IN RUPTURED

STEAM GENERATOR

- AUXILIARY FEEDWATER PUMPS INITIATED ON LOW LOW STEAM GENERATOR WATER

LEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP

- ADVERSE ENVIRONMENT INSIDE CONITAI.NMENT IMPACTS PRESSURIZER PORV

CONTROL SYSTEM POTENTIALLY CAUSING THE VALVES TO INADVERTENTLY OPEN OP.

FAIL TO CLOSE DUE TO AN ENVIRONXENT CONSEQUENTIAL FAILURE

- PRIMARY PRESSURE DECREASES DUE TO STUCK OPEN PRESSURIZER PORV'S

- HOT LEG BOILING COMMENCES

- TIME OF OPERATOR ACTION TO MANUALLY CLOSE BLOCK VALVES IN

PRESSURIZER PORV RELIEF LINES DETERMINES SEVERITY OF ACCIDENT

RESULTS

PRESSURIZER POW CONTROL SYSIEN

ASSUWTIOrNS:

FEEDLINE RUPTUIE OCCURS INSIDE JNTAINTEK

• WORST SINGE ACTIVE FAILURE ASSUPED IS SAFEGARDS TRAIN

-o FSAR INITIAL CONDITIONS

o AWERE ENVIRONM3fT IPPACTS PRESSURIZER POW CONTRDL SYSTEM

RESULTING INCONSEQUElUTIAL FAILURE

o PRESSURIZER POW CONTROL SYSTEM DIRECTS RELIEF VALVES TO ME

TO OPE1 POSITION

OPERATOR ACTIOI NOT ASSUE FOR AT LEAST 20 MINWES

PRESSURIZER PORV

CAN AFFECT SINGLE FSAR INITIAL CONSEQUENTIAL FAILURE OPERATOR

LOCATION PORV'S FAILURE CONDITIONS FAILURE DIRECTION ACTION

>20 MIN.

OPEN

YES

YES

1 SAFEGUARDS

TRAIN

YES

(

NONE

INSIDE

NO

FEEDLINE

(

OUTSIDE

CONTAINMENT

3o

'-

PRESSURIZER POWER OPERATED RELIEF VALVE CONTROL SYSTEM

AREAS OF CONCERN

- CONTROL SYSTEM ENVIRONMENTAL FAILURE CAUSES SMALL LOCA IN

STEAM SPACE Of PRESSURIZER DUE TO SECONDARY HIGH ENERGY LINE

RUPTURE

- HOT LEG BOILING OCCURS FOLLOWING FEEDLINE RUPTURE

PRESSURIZER PORV CO[fL SYSIEJ

EUPTENTIAL SOLUTIONS

SHORT TERM

o INVESTIGATE WHETHER PRESSURIZER ORV CONTROL SYSTEM WILL FAIL OR

OPERATE NORW4-LY WHEN E*OSED TO ADVERE ENIFROttET.

o M)DIFY OPERATING INSTRUCTIOlS TO ALERT OPERATOR TO THE POSSIBILITY

OF A CONSEQUENTIAL FAILURE Ill THE PRESSURIZER PORV CONTRL SYSTEM

CAUSED BY ADVERSE ENVIRONJ19IT. IF EVIDENT, CLOSE BLOCK VALVES IN

RELIEF LINES.

LONG TERM

o REDESION PRESENT CONTROL SYSTEM TO WITHSTA ifr4ICIPATED

EW IROI 4PENT

• INSTALL M)V IN SERIES WITH EXISTING MVN BLOCK VALVE.

INSTALL PR[TECTION GRADE CIRCUITRY TO CLOSE VALVES

FOL[DWING ADVERSE CONTAINMY ENTVIRONf4NT.

• INSTALl TWO SAFEIY 90XE SOL840ID VALVES ON EACH PORV

TO VENT AIR ON SIGIAL FROM PROTECTION SYSTEM.

o UPGRADE CONTROL LOGIC, M)V BLOCK VALVE AND SOLENOID

OPERATOR TO CLOSE FOLLOWING ADVERSE CONTAINI'ENT

ENVI RUNMX&.

iONiIKWL  ?

- SIG\AL Fotw CONRL SYSTLm AFEIY CON-MOL

.VALVES GRADE AIR

SUPPLY

ELE.aCTRICALLY CONQ LED

SOLENOID OPE:.'7.O S

33 SAR INTERMEDIATE STEAMLINE RUPTURE EVENT

- INTERMEDIATE STEAMLINE RUPTURE OCCURS UPSTREAM OF MAIN STEAMLINE

ISOLATION VALVES

- COLD LEG TEMPERATURE GRADUALLY DECREASES DUE TO APPARENT

EXCESSIVE LOAD INCREASE

- NUCLEAR POWER INCREASES DUE TO MODERATOR FEEDBACK COEFFICIENTS

(ASSUMES EOL CORE CONDITIONS)

- REACTOR TRIP OCCURS ON OVERPOWER DELTA-T FUNCTION

- TURBINE TRIP OCCURS DUE TO REACTOR TRIP

- STEAMLINE ISOLATION OCCURS AUTOMATICALLY OR MANUALLY CLOSED

- RUPTURED STEAMLINE BLOWS DOWN TO CONTAINMENT PRESSURE. STEAMLINES

IN ISOLATED LOOPS EXPERIENCE SLIGHT INCREASE IN PRESSURE

WESTINGHOUSE PROPRIETARY CLASS 2 34

1.2000

_

- 1.0000

= .80000

A: 4 La CD .60000

° .20000

0.0

-

1.200' 0

La

1.00010

° .8000I 3

.6000i 3 LU"

D < )

o.c4000

.2000( )

0.0

2500. 0 I I I

2000.0

X 1000.00

Z 0.0

tj -1000.0

La

= -2000.0

-2500.0

500.00 I I I I

04o.

O0

300.00

L0

g100.00

0.0

CD C

A C0-

0~

0)

=0

6 0 6

0 0

in 00

c0; 0o o t: 40

eu TIME (SEC)

FIGURE 3.2-4 - TIME DEPENDENT PARAMETERS 3 LOOP, 100%

POWER BREAK AREA - 0.22 FT2

3sP

WESTINGHOUSE PROPRIETARY CLASS 2

600. 00

't 550.00

e- 500.00

I- 450.00

E ta 400 0

> 35000

ec 300.00

M50.00 I i i 4 I i I I

600.00 I I I i i I

a. 550 00

.2 1500.00

LWJIA.

>

oc v-

450.00

., 400.00

.a o 350. 00

300.00

250.00 1t I-I I

1400.0 .i - IIi III.

1z50.0

L: Li

1000.00

CcJ LM 750. 00 -- - i i I - .

500. 00

i>

0-

> 250.00

0.0

2500.0

t_

Z250.0

m 2000.0

Qn _ 1750.0

x _; 1500.0 i iii

,f a-fi t250.0

a: 1000.00

750.00

500.00 -i i . I

O > C > CD r } o5 o

0

o . W . 0 o u CD

0

vi Co o vi - _

TIME (SEC)

FIGURE 3.2-5 - TIME DEPENDENT PARAMETERS 2 LOOP, 10000

POWER BREAK AREA = 0.22 FT

36 WESTINGHOUSE PROPRIETARY CLASS 2

. 4AeCA. i~LI

1.0-0

ox .80000

<

e =- . 60000

IN S

W~ CD. .4A0o Mo000

0.0

1100.0 I I 1 I I

1000.00

900.00

vi 4,800.00

Lj 700.00

< GM0.00 7 SWD.

200.00 00

ft00.00

?00.00

I I

100.00 I r - I- I i F

3.5000 . i I I I I 4 Li 3.0000

e2.5000

29 LA. 1.5000

.50000 7- n n V. w O EJ 4 MC

• o0il > o0C0 - O

TI£E (SEC)

FIGURE 3.2-6 - TIME DEPENDENT PARAMETERS 3 LOOP, 100-

POWER BREAK AREA = 0.22 FT2

37 ROD CONTROL SYSTEM

- INTERMEDIATE STEAMLINE RUPTURE (0.1 TO 0.25 SQUARE FEET PER LOOP

FROM 70 TO 100 PERCENT POWER) OCCURS INSIDE CONTAINMENT

- ROD CONTROL SYSTEM IN AUTOMATIC MODE

- ADVERSE ENVIRONMENT FROM STEAMLINE RUPTURE IMPACTS EXCORE DETECTORS

AND ASSOCIATED CABLING

- ENVIRONMENTAL CONSEQUENTIAL FAILURE OCCURS IN ROD CONTROL SYSTEM

WHICH CAUSES CONTROL RODS TO BEGIN STEPPING OUT PRIOR TO REACTOR TRIP

- MINIMUM DNBR FALLS BELOW 1.30 (GREATER THAN 1.1) PRIOR TO A REACTOR

TRIP ON OVERPOWER DELTA-T FUNCTION WHICH EXCEEDS LICENSING CRITERIA

IN MANY SAFETY ANALYSIS REPORTS

31 ROD CONTROL SYSTEM

ASSUMPTIONS

- INTERMEDIATE STEAMLINE RUPTURE OCCURS INSIDE CONTAINMENT

- ADVERSE ENVIRONMENT IMPACTS ROD CONTROL SYSTEM COMPONENTS

PRIOR TO REACTOR TRIP

- WORST SINGLE ACTIVE FAILURE ASSUMED IS SAFEGUARDS tRAIN

- FSAR INITIAL CONDITIONS

- ADVERSE ENVIRONMENT IMPACTS ROD CONTROL SYSTEM RESULTING

IN CONSEQUENTIAL FAILURE

- ROD CONTROL SYSTEM DIRECTS CONTROL RODS TO WITHDRAWAL

ROD CONTROL SYSTEM

CAN AFFECT

SYSTEM PRIOR

TO TRIP SINGLE FSAR INITIAL CONSEQUENTIAL

SIZE LOCATION < 2 MIN. FAILURE CONDITIONS FAILURE FAILURE RESULTS.

FSAR BASE

RODS OUT [RODS FAIL

YES PBF RESULTS

INDICATE NO

YES RODS IN FAILURE

1 NO

1 SAFEGUARDS

TRAIN

(

YES NO

INSIDE NO

CONTAINMENT

INO

SMALL TO

INTERMEDIAT

OUTSIDE

STEAMBREAK CONTAINMENT

LARGE

-

' -

40

ROD CONTROL SYSTEM

AREAS OF CONCERN

- CONTROL ROD WITHDRAWAL DUE TO CONTROL SYSTEM ENVIRONMENTAL

CONSEQUENTIAL FAILURE (POWER RANGE EXCORE DETECTOR AND

ASSOCIATED CABLING)

- MINIMUM DNBR FALLS BELOW 1.30 PRIOR TO REACTOR TRIP

41 ROD CONTROL SYSTEM

POTENTIAL SOLUTIONS

SHORT TERM

DETERMINE IF THE ADVERSE ENVIRONMENT CAN IMPACT EXCORE DETECTORS AND

ASSOCIATED CABLING PRIOR TO REACTOR TRIP FOLLOWING INTERMEDIATE STEAMLINE

RUPTURE.

- REMOVE NIS SIGNAL FROM POWER MISMATCH CIRCUIT IN ROD CONTROL SYSTEM

(PROCESS CONTROL CABINET)

- EMPLOY MANUAL ROD CONTROL

LONG TERM

- USE CONTAINMENT PRESSURE TRIP AND QUALIFY EXCORE DETECTOR TO LESS

SEVERE ENVIRONMENT (ALSO REQUIRES QUALIFYING CABLING FROM DETECTOR

TO PENETRATION)

0

- QUALIFY EXCORE DETECTOR TO STEAMLINE BREAK ENVIRONMENT 420 F CURVE

ALSO REQUIRES QUALIFYING CONNECTION AND CABLING FROM EXCORE DETECTOR

TO PENETRATION

EXCORE

NUCLEAR -

POWER

POWER MISMATCH

IMPULSE

TURBINE

POWER (

TO ROD

SPEED

REFERENCE CONTROLLER

TAVG -

COMPENSATED TAVG

ERROR

MEASURED

TAVG -

ROD CONTROL SYSTEM

SIMPLIFIED SCHEMATIC

"-I

ENCIOSURE 3 MEETING ATTENDEES

NRC

D. Ross R. Daigle T. Novak Co Brintnan G. Kuzmycz W.B~jrchill S. Lea1s J. westhayen D. Tondi C. Kl1ng w. Jensen P. Delozier J. Guttmann J. M~zetis C. Faust Westinghouse S. Israel i R. Borsum B&W

C. Berl1nger N. Shirley - GE

Z. RosztQczy F. Orr G. Llebler - Fla. P&L Co.

J. Heltemes R. Marusich - Consumers Power Co.

J. Rosenthal R. Kacich - Northeast Utilities M. Cliramal J. Regan - Northeast Utilities J. Joyce R. Olson Baltimore G&E Co.

R. Scholl H. O'Brien - TVA

T. Dunning J. Burdoin R. Harris NUSCO

R. Woodruff G. Falibota - Bechtel S. Salah E. Inge , ACRS

K. Mahan P. Higgins - AIF

H. Rood R. Leyse - EPRI

D. Thatcher B. Morris S. Sands T. Houghton D. Tibbitts R. Reil G. Lainas E. Conner P. Norian

ENCLOSURE 4 ACTION PROCESS FOR I&E INFORMATION NOTICE NO. 79-02

• IDENTIFY THOSE NON-SAFETY RELATED CONTROL SYSTEMS

(BOTH INSIDE & OUTSIDE CONTAINMENT) WHOSE MAL-

FUNCTION COULD ADVERSELY AFFECT THE ACCIDENT OR

TRANSIENT WHEN SUBJECTED TO ADVERSE ENVIRONMENT

CAUSED BY A HIGH ENERGY PIPE BREAK!

• DETERMINE THE LIMITING MALFUNCTIONS DURING HIGH

ENERGY PIPE BREAKS FOR THOSE CONTROL SYSTEMS.

• DETERMINE THE IMPACT OF THE MALFUNCTION OF THOSE

SYSTEMS.

• DETERMINE SHORT TERM ACTIONS IF NECESSARY.

• DETERMINE LONG TERM ACTIONS IF NECESSARY.

ENCLOSURE 5 MEETING ATTENDEES 9/20/79AM

NRC 1&W

D. Ross R. Borsum T. Novak J- Tvylor G. Kuzmycz H. Roy R. Capra E. Kane S. Lewis S. Eschbach D. Tondi B. Short T. Dunning M. BonaeA

Z. Rosztoczy G. BrAzill W. Jensen B. Karrasel J. Mazetis R. Wright S. Israel D. Hallman J. Rosenthal M. Fairtile J. S. Ckesumal M. Cleramal B. Day - Brown Boveri R. Scholl Reaktorbau J. Beard C. Faust - Westinghouse J. Joyce D. Thatcher D. DiIanni G. Lainas L. Stalter - Toledo Edison B. Morris F. Miller - Toledo Edison S. DtAb T. Myers - Toledo Edison R. Gill - Duke Power T. McMeekin - Duke Power R. Leipe -EPRI P. Abraham - Duke Power P. Higgins - AIF K. Canady - Duke Power T. Martin NUTECH R. Dieterich - SMUD

E. Roy - Bechtel E. Good - FPC

T. Reitz - G/C Inc. B. Simpson - FPC

E. Weiss - Union Concerned Scientists C. Hartman Met Ed R. Pollard - UCS P. Trimble - Arkansas P&L

R. Hamn - Consumer P. Co.

ENCLOSURE 6 UT I L I T Y / B &W P RO G RAM

E VAL UAT E I MPAC T O N L I C E'N S I N G

BAS I S ACC I DE N T ANAL YS E S DU E T O

C 0 N S E Q U E N T I A L E N V I RO N M E N T A L

E F FE CTS ON NON - S A F E T Y G R A D E C O N T RO L

S Y S T E M S.

I DE N T I F Y L I C E N S I N G BAS I S

AC C IDE NTS WH I CH CAUS E AN

ADVE RS E E N V I RONME NT FO R

EACH P LANT.

DEF I NE S A F ET Y A NAL YS I S

I N P UT S AN D RE S P O N S E S

US ED DU RI NG L I CEN S I NG

B A S I S A C C I D E N T S.

V E R I F Y S A F E T Y ANAL Y S I S

CON CL US I ON S O R RE CO M M E N D

ACT I ONS J U S T I F Y I N G

C O N T I NU E D O P E R A T I 0 N.

ENCLOSURE 7 MEETING ATTENDEES 9/20/79PM

NRC

D. Ross N. Shirley T. Novak L. Youngborg G. Kuzmycz J. Cleveland R. Frahm C. Sawyer D. Tondi P. Marriott T. Dunning L. Gifford D. Lynch J. Joyce D. Rawlins - W

C. DeBevec C. Faust - W

D. Thatcher R. Borsum - &W

R. Scholl W. Hodges T. Rogers - Pacific Gas & Elec.

T. IppolIto W. Mindich Phil. El. Col V. Rooney C. Cowan - Phil. El. Co.

J. Rosenthal G. Edwards - Phil. El. Co.

W. Jensen T. Scull Phil .E1. Co.

J. Guttman J. Knubel - JCP&L Co.

J. Hannon T. Tipton - JCP & L Co.

T. Keven L. Rucker - Boston Ed.

G. Lainas J. Vorees - Boston Ed.

P. Norian S. Maloary - Boston Ed.

J. Sheppard - CPCo.

C. Feltman - Bechtel R. Hoston - CPCo.

M. David - Bechtel L. Mathews - Southern Co. Services T. Martin - NUTECH C. Verprek - PSE&G

P. Higging - AIF R. Rajoram - PASNY

R. Rogers - TVA

M. Wiesburg - TVA

V. Bgnum - TVA

Mr. Robert H. Groce 50-29 cc Mr. Lawrence E. Minnick, President Yankee Atomic Electric Company

20 Turnpike Road Westboro, Massachusetts 01581 Greenfield Community College

1 College Drive Greenfield, Massachusetts 01301