NRC Generic Letter 1979-49
| ML031320243 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley, Millstone, Hatch, Monticello, Calvert Cliffs, Dresden, Davis Besse, Peach Bottom, Browns Ferry, Salem, Oconee, Nine Mile Point, Palisades, Indian Point, Kewaunee, Saint Lucie, Point Beach, Oyster Creek, Cooper, Pilgrim, Arkansas Nuclear, Prairie Island, Brunswick, Surry, North Anna, Turkey Point, Vermont Yankee, Crystal River, Haddam Neck, Ginna, Duane Arnold, Farley, Robinson, San Onofre, Cook, Yankee Rowe, Maine Yankee, Quad Cities, Humboldt Bay, La Crosse, Big Rock Point, Rancho Seco, Zion, Fort Calhoun, FitzPatrick, 05000000, Trojan, Crane |
| Issue date: | 10/05/1979 |
| From: | Kuzmycz G Office of Nuclear Reactor Regulation |
| To: | |
| References | |
| IN-79-022 GL-79-049, NUDOCS 7911070350 | |
| Download: ML031320243 (59) | |
0t UNITED STATES NUCLEAR REGULATORY
COMMISSION
WASHINGTON, D. C. 20555 October 5, 1979 TO ALL POWER REACTOR LICENSEES SUBJECT: SUMMARY OF MEETINGS HELD ON SEPTEMBER
18-20, 1979 TO DISCUSS A POTENTIAL
UNREVIEWED
SAFETY QUESTION ON INTERACTION
BETWEEN NON-SAFETY
GRADE SYSTEMS AND NSSS SUPPLIED SAFETY GRADE SYSTEMS (I&E INFORMATION NOTICE 79-22)I. Introduction A series of meetings was held with all four light water reactor vendors and the corresponding utilities to discuss the effect of I&E Information Notice 79-22 on nuclear power plant owners. I&E Information Notice 79-22, issued on September
14, 1979, notified the nuclear industry of a potential unreviewed safety question at Public Service Electric and Gas Company's Salem Unit 1 nuclear facility.
The meetings were held in the Bethesda offices of the NRC according to the following schedule: Westinghouse
-September
18, 1979 Combustion Engineering
-September
19, 1979 Babcock and Wilcox -September
20, 1979; a.m.General Electric -September
20, 1979; p.m.The Nuclear Regulatory Commission staff was seeking additional information from operators of all nuclear power plants on a potential unreviewed safety question involving malfunctions of control equipment under accident conditions.
This equipment consists of electrical components used for reactor and plant control under normal operating conditions.
Some of this equipment could be adversely affected by steam or water from certain pipe breaks, such as in the main steam line inside or outside plant containment buildings.
The consequences of a control system malfunction could result in conditions more or less severe than those previously analyzed.
The NRC staff intends to determine the degree to which the validity of previous safety reviews are affected and whether changes in design or operating procedures will be required.II. Background As part of the Westinghouse Environmental Qualification Program, IEEE 323-74 has been reviewed, in particular, sections dealing with environmental
9r0 CC?7191 1 0X08 5'0
interactions.
Westinghouse design philosophy is that if a component Is necessary to function in order to protect the public, it Is "protection" grade. Should a non-protection grade component perform normapl action in response to system conditions, it must be shown to have no adverse impact on protection grade component response.
If a component did not receiye a signal to change state, it was assumed to remain t'as ls'. Part of the environmental qualIfications require the demonstration that severe envtronments will not cause common failure of "protection" grade components.
An outgrowth of the environmental qualification program review was a determination if the severe environment can cause a failure of a non-protection grade corponent that was previously assumed to remain "as is" and alter the results of the design basis analysts, Westinghouse formed an Enivronmental Interaction Committee whose charter was to Identify, for all high energy line breaks and possible locations, the control systems that could be affected as a result of the adverse environment and whose consequential malfunction or failure could exceed the safety limits previously satisfied by accident analyses presented in Westinghouse plants' SARs. The Committee was also to establish, for any adverse interactions identified, recommendations to resolve the issue. The assumed ground rules for the investigations performed by Westinghouse are enumerated on page five of Enclosure
2. The investigation resulted in a compilation of potential control system consequential failures (due to environmental considerations)
which affected plant safety analyses.
The investigation considered seven accident scenarios and seven control systems interactions in a matrix form, as shown on page 6 of Enclosure
2. The accidents are: 1) small steam line rupture; 2) large steam line rupture; 3) small feedline rupture; 4) large feedline rupture; 5) small LOCA; 6) large LOCA; and, 7) rod ejection.The control systems are: 1) reactor control; 2) pressurizer pressure control;3) pressurizer level control; 4) feedwater control; 5) steam generator pressure control; 6) steam dump system control; and 7) turbine control.The Investigations identified potential significant system response interactions in the: a. steam generator power operated relief valve control system;b. pressurizer pressure control system;c. main feedwater control system; and, d. rod control system.III. Discussion A. The first in the series of meetings was with Westinghouse and utilities that own Westinghouse reactors.
The meeting was attended by seventy (70)persons representing the NRC, PSE&G along with nine other utilities, Westinghouse and the other three light water reactor vendors, utility owner groups, four A/E consultants, the ACRS, AIF and EPRI. The list of attendees is presented as Enclosure
1.Westinghouse's presentation is included as Enclosure
2.During the Westinghouse meeting, they identified, for all high-energy line
-3-breaks and possible locations, the control systems that could be affected as a result of the adverse environment and whose consequential failure could invalidate the accident analyses presented in Westinghouse plants' SARs.Recommendations were also presented for resolving the adverse interactions identified.
Westinghouse's investigation identified seven accidents and seven control systems that could possibly interact and presented them in a matrix form as shown in Enclosure
2, page 6. As can be seen the potential interactions that could degrade the accident analyses are in the: a. Automatic Rod Control System b. Pressurizer PORV Control System c. Main Feedwater Control System d. Steam Generator PORV Control System Westinghouse stated that the possible matrix interactions may increase as more detailed analyses are performed but the interactions will remain for all of their plants and the interactions may be eliminated only if conditions are such that plant specific designs mitigate the interactions because of: a. system layout;b. type of equipment used;c. qualification status of equipment utilized: d. design basis events considered for license applications;
and, e. prior commitments made by utility to the NRC.The Westinghouse analysis did not consider plant operators as part of the control systems nor was the time allotted for operator "inaction" considered.
The assumed operator action times, as stipulated in plant analysis, were used without modification.
Equipment in a control system or part of a control system was assumed to fail as a system in the most adverse direction for conservatism.
Westinghouse stated that the possible matrix interactions will remain for all of their plants and the interactions may be removed only if conditions are such that plant specific designs mitigate the interactions because of: a. system layout;b. type of equipment used;c. qualification status of equipment utilized;d. design basis events considered for license application;
and, e, prior commitments made by utility to the NRC.It should be noted that Westinghouse only analyzed accidents and not transients.
-4-Further, long-term investigations may be required to analyze the transient cases.Initial conditions and assumptions are shown on pages 5, 7, 9, 14, 15, 22, 23?'27, 28, 33, 37 and 38.Westinghouse presented their analyses for the four control systems identified as follows: A. Steam Generator Power Operated Relief Vale Control SVstem, The areas of concern for this system are: 1. multiple steam generator blowdown in an uncontrolled manner;2. loss of turbine driven auxiliary feedwater pump; and, 3. primary hot leg boiling following feedline rupture.The assumptions used are presented on page 15 of Enclosure
2. Potential solutions to the Steam Generator PORV Control System interaction problems were presented as both short term and long term. The short-term solutions are to: 1. Investigate whether the SG PORY Control System will operate normally or fail in a closed position when exposed to an adverse environment;
and, 2. modify the operating instructions to alert operators to the possibility of a consequential failure in the SG PORY Control System caused by an adverse environment.
If evident, close block valves in'the relief lines.The long-term solutions are: 1. redesign the SG PORV Control System to withstand the anticipated environment;
2. relocate the SG PORVs and controls to an area not exposed to the environment resulting from ruptures in the other loops;3. install two safety grade solenoid valves in each PORY to vent air on a signal from the protection system, thereby ensuring that the valve will remain closed initially or will close after opening; and, 4. install two safety grade MOVs in each relief line to block venting on signal from the protection system.Westinghouse presented simil~ar analyses for the other three control systems along with the assumptions, areas of concern and potential solutions.
These are presented in Enclosure
2.a. Steam Generator PORY Control System pp. 14-21, Enclosure
2.
U. Main FeedwAter Control System pp. 22-26, Enclosure
2.c. Pressurizer PORY Control System pp. 27-32, Enclosure
2.d. Rod Control System pp. 37-42, Enclosure
2.At the end of Westinghouse's presentation, the NRC staff caucused to discuss their future plans and actions. When all attendees reconvened the meeting was opened to discussions of the impact of the NRC 10 CFR 50.54(f) letter, vendor and utility plans, and staff plans.Westinghouse stated that they would establish an action plan along the guidelines of NUREG-0578.
Westinghouse also stated that their investigations were carried further than FSAR analyses and they would need to evaluate consequential failures on a realistic basis; this evaluation may eliminate some problems.
Westinghouse stated that their investigations are lower probability subsets of SAR analyses which in themselves are sets of low probability.
Westinghouse expressed doubts that a conclusive determination can be made of the qualification status of all of the involved equipment in 20 days.Robinson plant representatives noted that their secondaries are open and therefore breaks outside of containment present no problem. They indicated their basic approach to answering the 20-day letter will be to follow the short-term Westinghouse recommendations.
Representatives of Salem also stated that their intent is to follow the short-term Westinghouse recommendations to satisfy the request of the 20-day letter.Utility representatives stated that they will respond to the 20-day letter by addressing the four control systems identified in a manner suggested by the Westinghouse recommendations unless the NRC staff provides directions to the contrary and further established guidelines stating their position on the problem along with their recommendations.
B. The second in the series of meetings was held with Combustion Engineering and utilities that own CE's reactors.
The meetings were attended by 52 persons representing the NRC, all four light water reactor vendors, five utilities, various consultants, the ACRS, AIF and EPRI. The list of meeting attendees is presented as Enclosure
3.They explained the concerns presented by Westinghouse and the four control systems that could be affected as a result of the adverse environment of a high energy pipe break and whose consequential failure could invalidate the accident analysis of plant SARs.Previous analyses did not specifically take control systems into account in accident scenarios and the systems were considered passive in the analyses.The staff explained its earlier understanding regarding control systems interaction in accidents as one in which the accidents were expected to be quick and the control systems did not have the time to contribute significantly to the consequences.
If most of industry reviewed their accident analyses according to the staff position on control system contribution, then a need does, in fact, exist to further the scope of accident analyses to include potential consequential failure modes of the
"-I control systems, Industry representatives stated that in the allotted 20 das, tshey could only skim the surface in Accident reyiew with the inclusiQn of control system interactions.
An lnttiql qpproaqh would Fe Qf a mechanistlc nature to determine wAht control system would be inyolyed and iwha t type Qf hardfiare would be necessary to initiate fifes rather th~an uslng an anaardtwca approach to determine the contribition of control Syste0s on accident consequences.
Combustion Engineeringts plans are to Identify the control systems that could cause interactions and then look at resolutions to the problem on a per plant basis since some solutions are plant dependent.
The action process to be followed is presented as Enclosure
4 and is as follows: 1. Identify those non-safety related control systems, inside and outside containment, whose malfunction could adversely affect the accident or transient when subjected to an adverse environment caused by a high energy pipe break.2. Determine the limiting malfunctions and their impact during high energy pipe breaks for those control systems.3. Determine the short term and long term corrective actions.Combustion Engineering stated that in their plants, operaton of control systems is not required in order to mitigate the consequences of the transients analyzed in Chapter 15. The analyses in Chapter 15 include the assumption that these control systems respond normally to each transient and that their operational mode is that which would be most adverse for the transient under consideration.
The consequences produced by any credible malfunction of these control systems would be less severe than any which would be produced by the mechanisms considered as causes of the transients analyzed in Chapter 15.Some discussion followed dealing with the failure modes of control system and whether the failure mode is in the most adverse direction or in the design direction.
Resolution of this topic was not obtained but will be addressed on a plant-by-plant basis.Again utilities presented their concerns over the 20-day letter and what is expected of them in this time frame. They stated that in order to follow the directions of the letter all components would have to be reviewed to determine if the non-safety grade system failure mode would aggrevate the accident consequences.
C. The third in the series of meetings was held with Babcock and Wilcox and utilities that own B&W reactors.
The meetings were attended by fifty-six
(56)persons representing the NRC, reactor vendors, seven utilities, various consultants, the AIF and EPRI along with the Union of Concerned Scientists.
-7-The NRC staff explained the background history leading up to the"20-day" letter and the fact that they consider the problem a generic one common to all LWRs.The utility representatives stated that they will answer the letter themselves without specific participation of the owners group, which they consider germane only to TMI-2 related subejct. Most of the work, the detailed action plans of which have not yet been established, will be performed by the various utilities and their architect engineers and consultants, with generic material supplied by the reactor vendor.The utility representatives understand the environment to be plant specific and will use that environment in their analyses for control system failure. The system failure will include not only component failure but also failure of transducers, wires, and hot and cold shorts.The adequacy of fixes for the long-term and the combination of consequential failures is not expected to be considered in the allotted 20 days.Babcock and Wilcox representatives stated that in the past, evaluations were performed for the sequence of events leading up to the trip, a time of about 5 to 10 seconds. Prior to that time the control systems have no effect on the accident sequence or consequence.
Failure of control systems will be investigated in view of the severity of the possible accident;
if the control system failure increases the consequences, then that system will be considered.
The approach proposed by B&W and the utilities is outlined in Enclosure
6 and is as follows: 1. Evaluate the impact of IE 79-22 on licensing basis accident analyses.2. Identify accidents which will yield the adverse environment.
3. Define inputs and responses used.4. Verify conclusions and justify continued operation.
The utilities will alert the plant operators to the potential failure of the plant control systems in total or in providing correct information.
The abnormal and emergency procedures will be reviewed to determine how failure of non-safety grade systems or improper information will affect the prescribed operator action.D. The fourth and final in the series of meetings was with General Electric and utilities that own GE reactors.
The meeting was attended by 52 people representing the NRC, three reactor vendors, nine utilities, architect engineers, consultants, and the AIF. The list of attendees is presented as Enclosure
7.The NRC staff presented highlights of the previous meetings and the concerns identified by Westinghouse.
The staff stated that a more sophisticated evaluation of the accident analysis is required to see if the course and consequences of the accident are altered by consequential failure of non-safety grade control systems.
-8-General Electric representatives stated that their analyses have -considered high energy pipe breaks in many locations and are more detailed since BWRs have a larger number of pipes inside and outside containment carrying radioactive liquids. The BWR leak detection capabilities are correspondingly greater. Special attention is given to separation criteria viz., various systems are in separate cubicles and inside a class 1 secondary as well as primary containment.
The high energy line break is not considered a problem. In 1970, Dresden 2 experienced opening of a safety valve and a resulting
10 psi and 340 F environment.
The equipment was examined and the qualifications were subsequently upgraded.GE representatives stated that they performed sensitivity studies on their non-safety grade systems to determine if they are heavily relied upon during an accident.
The studies revealed that there was no heavy dependence upon those systems.It must be noted that the GE non-safety grade system and components comprise only approximately
25% of a typical plant total. The utilities will perform their own analyses on BOP systems to satisfy the require-ments of the "20-day" letter.IV. NRC Comments The NRC staff stated that they understood the requests by the nuclear industry regarding position and direction on the request found in the NRC 10 CFR 50.54(f)letter dated September
17, 1979 but would wait until the conclusion of the scheduled meetins with all four light water reactor vendors. The staff further stated a Commission Information paper would be prepared discussing the staff's judgment regarding the magnitude of the concern and the appropriate- ness of industry's response for resolution of the problem.More specific staff statements were made in terms of generating a plant specific matrix of potential environmental interactions of control system for each plant. The NRC requested that they be notified of further analyses and the individuals that will perform them, either reactor vendors, the owners groups, or the individual utilities.
The NRC noted that at this time, it is not evident which utilities are faced with what environmental interaction problems.
The effects of implementing all of the Westinghouse recommended short-term "fixes" may be contradicted by other sequences.
Multiple failure analyses could be performed but this would take months and could not possibly be ready in 20 days.The NRC recommended that utilities check if qualified equipment is in place to determine the magnitude of a total qualification program.The staff advised the utilities to check the validity of their operating procedures in light of the steam environment around various components and the reliability of certain control valves in question;
also, use should be made of all information available in files of vendors, A/Es, and consultants dealing with the problem.
-9-The staff is aware that sufficient time is not available to identify all of the potential interactions but some of the more obvious ones must be reviewed.
For example, some utilities might choose to operate their plants in the ihterim period using a manual rod mode instead of the preferred automatic mode; also, the PORV block valves may be operated in the closed position.
The determination of what systems are suspect and the possible 20-day solutions must be answered by each individual utility according to their plant design. Operator training would have to be stressed to make the operators aware that potential consequential failures may exist that would mask the real failure and give erroneous readings.The staff stated that for the "20-day" letter response, the utilities should use engineering judgment and evaluations instead of detailed analyses that would be time consuming and might limit the utility response to a limited number of evaluations.
V. Conclusions The staff indicated that there were three possible options that could be followed in providing a short-term response.1. Qualify equipment to the appropriate environment;
this would take longer than 20 days and would, more likely, for most utilities be a long-term partial solution.2. Short-term fixes should be in place pending long-term solutions.
It must be noted that in this situation some components that are relied upon to work properly might be wiped out by consequential failures under certain conditions and accident sequences.
3. The "worst case" plant should be selected and a bounding analysis performed to determine the time frame available for qualification of equipment.
The staff reiterated the presented recommendations, possible interim solutions that are plant specific, and in addition, requested the following:
1. Identify equipment and control systems which are either needed to mitigate the consequences of a high energy pipe break or could adversely affect the consequences of these events.2. Check the locations, expected environment, and environmental qualifications of the equipment and control system identified in part 1.3. If some of these are found not be qualified for the environmental conditions, propose an appropriate fix, i.e., design change, change in operating procedures, acceptable consequences argument based on your evaluation, etc. Provide a schedule for the proposed fix.George Kuzmycz, Project Manager Division of Project Management Mr.- William J. Cahill, Jr. 50-3^ Consolidated Edison Company of New York, Inc. 50-247 cc: White Plains Public Library 100 Martine Avenue White Plains, New York 10601 Joseph D. Block, Esquire Executive Vice President Administrative Consolidated Edison Company of New York, Inc.4 Irving Place-New York, New York 10003 Edward J. Sack, Esquire Law Department Consolidated Edison Company of New York, Inc.4 Irving Place New York, New York 10003 Anthony Z. Roisman Natural Resources Defense Council 917 15th Street, N.W.Washington, D. C. 20005 Dr. Lawrence R. Quarles Apartment
51 Kendal at Longwood Kennett Square, Pennsylvania
19348 Theodore A. Rebelowski U. S. Nuclear Regulatory Commission P. 0. Box 38-Buchanan, New York 10511 NRC D. RQss.D. Etsenhut J.'Heltemes G. Kuzmycz J. Guttmann W. Jensen S. Israel G. Lainas V. Benaroya R. Woodruff A. Dromerick B. Smith M. Grotenhuis A.-Schwencer P. Norian F. Orr F. Odar T. Dunning W. Gammill S. Salah J. Stolz Z. Rosztoczy T. Novak J. Beard M. Cliramak D. Tondi C. Berlinger L. Kintner J. Mazetis K. Mahan D. Thatcher J. Burdoin P. Mathews M. Lynch R. Scholl ENCLOSURE
1 MEETING ATTENDEES WESTINGHOUSE
K. Jordan-R. Sero R. Steitler G. Lang G. Butterworth V. Sluss F. Noon PSE&G Co.F. Librizzi R. Mittl J. Wroblewski J. Gogliardi P. Moeller R. Fryling VENDORS N. Shirley -G.E.W. Lindblad -G.E.R. Borsun -B&W C. Brinkman -C.E.Portland UTILITIES D. Waters -CP&L M. Scott -Con. Ed.G. Copp -Duke Power N. Mathur -PASNY J. Barnsberry
-S. Cal. Ed.K. Vehstedt -AEPSC R. Shoberg -AEPSC E. Smith -VEPCO T. Peebles -VEPCO P. Herrmann -Southern Co. Services W. House -Bechtel T. Martin -Nutech J. McEment -Stafeo M. Wetterhahn
-Conner, Moore & Corber K. Layer -BBR E. Igne -ACRS P. Higgins -AIF R. Leyse -EPRI
ENCLOSURE
2 VI E WIROI'ITAL
QUALIFICATION
ACTIVITIES (IEEE 323-74)-SEISMIC TESTS-AGITh PMROGP1-ENVIROITAL
BVELOPES-ItNsmU.Ta ACa!RCIES-E!NVIR3[ITTAL
INTERACTIOS
i HISTORY ACRS CONCERNS NRC ACTIONS/QUESTIONS
AREAS: SYSTEMS INTERACTIONS
INTERFACE
CRITERIA (STANDARDIZATION)
HELB PROTECTION
INDUSTRY DESIGN PHILOSOPHY
IF A COMPONENT
IS NECESSARY
TO FUNCTION IN ORDER TO PROTECT THE PUBLIC, IT IS "PROTECTION" GRADE. SHOULD A NON-PROTECTION
GRADE COMPONENT
PERFORM NORMAL ACTION IN RESPONSE TO SYSTEM CONDITIONS, IT MUST BE SHOWN TO HAVE NO ADVERSE IMPACT ON PROTECTION
GRADE COMPONENT
RESPONSE.
IF A COMPONENT
DID NOT RECEIVE A SIGNAL TO CHANGE STATE, IT WAS ASSUMED TO REMAIN"AS IS".
-ENVIRONMENTAL
QUALIFICATION
DEMONSTRATE
THAT SEVERE FAILURE OF "PROTECTION" ENVIRONMENT
WILL NOT CAUSE COMMON GRADE COMPONENTS
-NEW QUESTION TO BE ADDRESSED CAN THE SEVERE ENVIRONMENT
CAUSE A FAILURE OF A NON-PROTECTION
GRADE COMPONENT
THAT WAS PREVIOUSLY
ASSUMED TO REMAIN "AS IS" AND ALTER THE RESULTS OF THE DESIGN BASIS ANALYSES?-REGULATORY
ENVIRONMENT
TODAY-POST-TMI/2 REACTION-NUREG-0578
-ACRS PRESENTATIONS
BY NRC
--ENVIRUNrnJfAL
IWTERACTION
CO"I¶TTEE INWERACTION
TO BE ADDRESSED:
A CONSEQUENTIAL
FAILURE OF A COTROL SYSTEM DUE TO AN ADVERSE EN3VIRON1EBI
INSIDE OR OUTSIDE CQ¶AII4NFJ
FOL.LWING
A HI(fl ENERGY RUPTURE IMICH NECATES A PROTECTIVE
FUIJCTIaJ
PERFOR-ED
BY A SAFElY GRE SYSTEJb 0CIOTlEE OMER: FOR ALL HIGI BJERGY LINE BREAKS AMD POSSIBLE LOCATIONS, IDEIfTIFY
C1fTROL SYSTEMS THAT COULD BE AFFECTED AS A RESULT OF THE ADVERSE EBNIROWElff AMI VOSE CONSEUEWTIAL, f'FIWCrIOI
OR FAILURE COULD IINALIDATE
THE ACCIDET ANALYSIS PRESETE IN THE PLAlf SAR. FOR AY ADVERSE IERACTIO[S
IDENTIFIED, ESTABLISH
RECOMEMATIOJS
TO RESOLVE THE ISSUE.
iASSU1D GROU{iDRULES
FOR INVESTIG4TION
o 0fNTROL SYSTEMS (OR PARTS) 1NOT SUBJECT TO HIGH RGH Y LINE BREAK ElVIRONIRENT
-EQUIPOT1{F
ASSUfED TO RE[ IN 'AS IS' OR OPERATE WITHIN SPECIFIED ACCURACY, WHICHEVER
IS MDRE SEVERE o RANDOM FAILURES IN THE CONTROL SYSTEM ARE NOT POSTULATED
TO OCCUR COINCIDEfTf WITH THE STUDIED EVENT o PROTECTION
SYSTEfS AIE ASSU0ED TO FUNCTION CONSISTENT
WITH REQUIREMENTS
OF IEEE-2?9-l971 (INCLUDING
SING.E FAILURE IN PROTECTION
SYSTEfD.e OPERATOR ACTION TIMlE ASSUMED OONSISTENT
WITH SAR ASSUJPTIONS
o W14TROL SYSTE (OR PARTS) SUBJECT TO HIGH ENERGY LINE BREAK ENVIRON1411T
-UNQUALIFIED
EQUIPMNT ASSUED TO FAIL IN MST ADVERSE DIRECTION-QUALIFIED
EQUIPPENq ASSUE) TO REiAIN 'AS IS' OR OPERATE WITHIN SPECIFIED
ACCURACY.(QUALIFIED
DESIGN CRI BE SHNJN 10 BE COWATIBLE
WITH POSTULATED
NVIR)fIE
Control Pressurizer Steam Generator Steam Reactor Pressure Level Feedwater Pressure Dump Turbine Accident Control Control Control Control Control System Control Small Steamline Rupture X X X Large Steamline Rupture X Small Feedline Rupture X X X X Large Feedline Rupture X X X Small LOCA X X X Large LOCA Rod Ejection PROTECTION
SYSTEM-CONTROL
SYSTEM POTENTIAL
ENVIRONMENTAL
INTERACTION
X -POTENTIAL
INTERACTION
IDENTIFIED
THAT COULD DEGRADE ACCIDENT ANALYSIS 0 -NO SUCH INTERACTION
MECHANISM
IDENTIFIED
N IDENTIFIED
POTENTIAL
CONCERJJS SYSTEMATIC
INVESTIGATION
IDENTIFIED
POTENTIAL
ESNIRO(Y'ElTAL
INTERACTION
IN:-STEN-1 GENERATOR
POWER OPERATED RELIEF VALVE CORTROL SYSTEM-PRESSURIZER
PRESSURE CONTROL SYSTE1I-MAIN FEED WATER CONTROL SYSTEJ1-ROD CONTROL SYSTEM INTERACTION
MODE AND POSSIBLE FIXES IDENTIFIED
o INVESTIGATION
TO DATE LIMITED TO ItPACT OF ADVERSE EIIR -WfT ON COITROL SYSTEMS AlD POTENTIAL
CCUSEOUEIJTIAL
EFFECTS o REMAINING
AREA UNDER INVESTIGATION
BY C(XlIITTEE
IS THE EFFECT OF ADVERSE EUNVIROf',ENTS
ON VALVE OPERATORS
ASSOCIATED
WITH 'INACTIVE'
VALVES LOCATED IN PROTECTION
SYSTENS-NO OPERABILITY
REQUIREIIENT
ON VALVE THEREFORE
IO QUALIFICATION
SPECIFIED
FOR VALVE OR OPERATOR-HAIEVER, ACCIDENT ANALYSIS ASSUlES VALVE STAYS 'AS IS'
PLANT APPLICABILITY
OF COICERNS & RECCMEDATImNS
- IDENTIFIED
CONCERNS ARE NOT GENERIC SINCE IMPACTED BY MANY PLANT SPECIFIC PESIGFS'IS:
-SYSTEM LAYOUT-TYPE OF EQUIFPiENT
UTILIZED-OUALIFICATION
STATUS OF EQUIPFENT
UTILIZED-DESIGN BASIS EVENTS CONSIDERED
FOR LICENSE APPLICATION
-CO(IMITIME11TS
MUDE BY UTILITY TO NRC RECCrTENATIO[JS
-UTILITY REVIEW OF IDENITIFIED
CONCERS WITH RESPECT TO PLMIT CHARACTERISTICS
A"ID LICENSING
COAMIT11ENTS
-FOLL0Cl-UP
BY UTILITIES
TO CONSIDER POTENTIAL
FOR ADVERSE ENIRMNTTAL
INTERACTION
FE1 CONTROL SYSTEMS AS YET UN-REVIEWED BY WESTINGHOUSE
SAR FEEDLINE RUPTURE EVENT-MAIN FEEDLINE RUPTURE OCCURS DOWNSTREAM
OF FEEDLINE CHECK VALVE-MAIN FEEDWATER
SPILLS OUT RUPTURE-SECONDARY
INVENTORY
SPILLS. THROUGH RUPTURED FEEDLINE-PRIMARY BEGINS HEATUP DUE TO PARTIAL LOSS OF LOAD-REACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR
WATIER LEVEL IN RUPTURED STEAM GENERATOR-AUXILIARY
PUMPS INITIATED
ON LOW LOW STEAM GENERATOR WATER LEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP-PRIMARY BEGINS COOLDOWN WHILE HEAT REMOVAL CAPABILITY
OF SECONDARY INITIALLY
EXCEEDS DECAY HEAT GENERATED
IN CORE-PRIMARY BEGINS HEATUP WHEN SECONDARY
INVENTORY
NOT CAPABLE TO REMOVE DECAY HEAT-STEAM GENERATORS
IN INTACT LOOPS BEGIN REPRESSURIZING
DUE TO AUTOMATIC
OR MANUAL MAIN STEAMLINE
ISOLATION-STEAM DRIVEN AUXILIARY
PUMP OBTAINS STEAM FROM AT LEAST TWO MAIN STEAMLINES.
STEAMLINE
ISOLATION
INSURES SOURCE OF STEAM SUPPLY-PRIMARY CONTINUES
TO HEATUP UNTIL AUXILIARY
FEEDWtATER
BEING INJECTED INTO INTACT STEAM GENERATORS
IS SUFFICIENT
TO REMOVAL DECAY HEAT
10 WESTINGHOUSE
PROPRIETARY
CLASS 2 W'(FtP-- ..20o..._ i i i: -2 i 1124V i I I W Lb L" 0-J= 06 L"L Co l .00-I._.._..50. Go -500.00 +50. 00 M. 00* t r1~-~:f~ I 9 t~~~ '., .I 1.......I 4
2 '..Lb C 2-SLaA~SSo.00 -_ ..0.00 +-4 550. 0*50. 00 -*W.00 I -o6c I 3 40 (00 C:2 L h o; o4 4-T- :)4. 0~ .< 4 1'+g 40 rcu g C. C) O C- __g °oC- b M IV ' Wr 5-10 Primary Temperature Assuming Worst Case 3-Loop Plant Transients Following a Feedline Rupture Initial Conditions and Assunptlins for a If WEsjNtG"OUSE
WJ L4A pROPRIETARY
CLASS 2-.7-O La S t.cr e.a La tt C3 V;C-0-J C.40:2: n 1500.0 1250.0 I I ! i IJ: '. v i t I111 1 iH I I I !i , 1- : H iI .-1000.750.00 500.00 250.00 0.0 I I I 111111 I i I 111!1; ! I i IIH I o!o :, 0 CD 0 O 0C C= ZD OD 0 4='_CD ... .00 C CDCr~eu ..f.W. .O C; * ,'AAC 4U apc O00 00 3 6U 4 -=]~0 0-00O rc , TIME (SEC)5-ll Primary Temperature and Stena Cenerator Pressure Folloving a reedline Rupture Assuming Worst Case Initial Conditioos and Assumptions for a 3-Loop Plant I2 WESTINGHOUSE
PROPRIETARY
CLASS Z Af- q23 V-270 260 250 Id%240 230i es: LA 0..220t 210(.I ....U ..0. 0 0.0 0.0.0 D. 0).0~.0 200(I90C t80C 1700 2000.0 1750. 0 1500.0 LaJ x_j 0 C-I-La 4-)1250.1000.00 750.00 500.00 o o o :=o 00 oc .-* E ...L_0 cX C>Qt c~C. -,V Co CD .-._~ =00o o :c o o m -., o 0 C =CDo ., c=___O 0. f~-: CDJ C3 cUm=t=AjenT-L% -00 0=-E 0D 0 c.x: -O0 O: Ic -' .--.OD CO C>Gz =)0 0 0T Z .~~j 5-12 Pressurizer Pressure and Water Vo1=e Following a Feedline Rupture JlAssuming Worst Case Initial Conditions and Assumptions for a 3-Loop Plant
13 SlESTINGHOUSE
PROPRIETARY
CLASS 2 C -qz3o....I -I.1.2000 1.O090-S i * : .....iii I I I I I I I.T I I-I-:E -: x F: (.j s.W t-l 75000 +.50000.25000 0.0-. 10000 40.000 i. I i iili :I I' i iHl t i I I i ! 'H;H ! i i 44 HH I I 4 klli I I I F I !;; i........30.000 +M 0-,=~La W- -cr , -_~20. 000 10.000 0.0--SO. 000_---------------- I -I.........I _ 11s 0 00 *.e...o 60 4 _C >8 0 0 0 O 0 O CD OC. =O 0 e-C C~ en a~iA;'~0C 0> c~zz =0 0 CF w rN in 0 0 c cr z-%P1Q O 0 O OU 00C*_ D OC. D en D 5-13 Vessel Mass Flow Rate and PressUrizer Insurge Following a Feedline Rupture Assuming Worst Case Initial Conditions and Assumptions for a 3-Loop Plant
POWER OPERATED RELIEF VALVE (PORV) CONTROL SYSTEM FEEDLINE RUPTURE OCCURS IN MAIN OR AUXILIARY
LINES IN AUXILIARY
BUILDING BETWEEN CONTAINMENT
AND CHECK VALVES MAIN FEEDWATER
SPILLS OUT RUPTURE SECONDARY
INVENTORY
SPILLS INTO AUXILIARY
BUILDING THROUGH RUPTURED FEEDLINE REACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR
WATER LEVEL IN RUPTURED STEAM GENERATOR AUXILIARY
PUMPS INITIATED
ON LOW LOW STEAM GENERATOR
WATER LEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP.STEAM GENERATORS
IN INTACT LOOPS BEGIN REPRESSURIZING
DUE TO AUTOMATIC OR MANUAL MAIN STEAMLINE
ISOLATION ADVERSE ENVIRONMENT
INSIDE AUXILIARY
BUILDING IMPACTS STEAM GENERATOR PORV CONTROL SYSTEM POTENTIALLY
CAUSING THE VALVES TO INADVERTENTLY
OPEN OR FAIL TO CLOSE DUE TO AN ENVIRONMENTAL
CONSEQUENTIAL
FAILURE STEAM GENERATORS
THAT SUPPLY STEAM TO TURBINE DRIVEN AUXILIARY FEEDWATER
PUMP DEPRESSURIZE
TO ATMOSPHERIC
PRESSURE VIA FAILED OPEN STEAM GENERATOR
PORV'S, CAUSING TURBINE DRIVEN AUXILIARY FEEDWATER
PUMPS TO-STOP IF SINGLE ACTIVE FAILURE ASSUMED IS A MOTOR DRIVEN AUXILIARY
FEEDWATER PUMP, ALL AUXILIARY
IS LOST TO ALL STEAM GENERATORS
PRIMARY BEGINS TO HEATUP RAPIDLY DUE TO LOSS OF SECONDARY
HEAT SINK AND HOT LEG BOILING COMMENCES TIME OF OPERATOR ACTION TO MANUALLY CLOSE VALVES IN AUXILIARY
FEED-WATER LINE TO RUPTURED STEAM GENERATOR
OR TO MANUALLY BLOCK STUCK OPEN STEAM GENERATOR
PORV'S DETERMINES
SEVERITY OF ACCIDENT RESULTS
I'S STEAM GBERATOR POW' CO[ROL SYSTEM ,ASSoUPPT
IONS:* FEEDLINE RUPTURE OUTSIDE CONTAINIlENT
o WORST SINGE ACTIVE FAILURE ASSUWED IN SAEWLRDS TRAIN* FSR INITIAL ITIOIS* ADVERSE ENVIRONJI
IWACTS SG POW CODflRL SYSTEM RESULTING IN CONSEQUENTIAL
FAILURE e STEAM GECRATOR RPO AO]TREL SYSTEM DIRECTS VALVES TO ByVE TO OPEN POSITIO OPERATOR ACTION NOT ASSUMF FOR AT LEAST 20 MINUTES
PORV SINGLE LOCATION FAILURE FSAR INITIAL CONDITIONS
CONSEQUENTIAL
FAILURE FAILURE DIRECTION OPERATOR ACTION OPEN (1 SAFEGUARDSI "I --fl TRAIN BEST ESTIMATE INSIDE AUX. -BUILDING NONE (FEEDLINE BREAK .OUTSIDE AUX.BUILDING-
--I INSIDE CONTAINMENT
i?STEAM GEERATOR POWER OPERATED CELIEF VALVE CON[ROL SYSTEM AREAS OF CONCERN:-PILTIPLE STEAM MEFATOR BLOWW IN AN UNCONTRL E] MNIER-LOSS OF TURBINE DRIVES AUXILIARY
FEEITIATER
PUP-PRIiRY HOT LEG BOILING FOLLOWING
FEEDLINE RUPTUSKR
PORV CONTROL SYSTEM POTENTIAL
SOLUTIONS SHORT TERM-INVESTIGATE
WHETHER SG PORV. CONTROL SYSTEM WILL OPERATE NORMALLY OR FAIL IN CLOSED POSITION WHEN EXPOSED TO ADVERSE ENVIRONMENT
-MODIFY OPERATING
INSTRUCTIONS
TO ALERT OPERATOR TO THE POSSIBILITY
OF A CONSEQUENTIAL
FAILURE IN THE SG PORV CONTROL SYSTEM CAUSED BY ADVERSE ENVIRONMENT, IF EVIDENT, CLOSE BLOCK VALVES IN RELIEF LINES LONG TERM-REDESIGN SG PORV CONTROL SYSTEM TO WITHSTAND
ANTICIPATED
ENVIRONMENT
-RELOCATE SG PORV'S AND CONTROLS TO AN AREA NOT EXPOSED TO THE ENVIRONMENT
RESULTING
FROM RUPTURES IN OTHER LOOPS-INSTALL TWO SAFETY GRADE SOLENOID VALVES ON EACH PORV TO VENT AIR ON SIGNAL FROM THE PROTECTION
SYSTEM, THEREBY ENSURING THAT THE VALVE WILL REMAIN CLOSED INITIALLY
OR CLOSE AFTER OPENIUG-INSTALL TWO SAFETY GRADE MOV'S IN EACH RELIEF LINE TO BLOCK VENTING ON SIGNAL FROM PROTECTION
SYSTEM
I I I I I I I I I I I I I I I I SAF~rY VRLVes fT f A'?A L eve L'TUflOIN.mFW I <colfvrAriv1eNrT
WALL
Il (C ID ID Figure 6. Auxiliary Feedwater System (Four-Loop Plant)W.
Itte*rlf, I'lt, C (to<0"II Figure 7. Auxiliary Feedwater System (Three-Loop Plant)
MAIN FEEDWATER
CONTROL SYSTEM SMALL FEEDLINE RUPTURE OCCURS IN MAIN OR AUXILIARY
LINES IN AUXILIARY
BUILDING BETWEEN CONTAINMENT
AND CHECK VALVES MAIN FEEDWATER
AND POSSIBLY SECONDARY
INVENTORY
SPILLS INTO AUXILIARY BUILDING THROUGH SMALL FEEDLINE RUPTURE ADVERSE ENVIRONMENT
CAUSED BY RUPTURE IN FEEDLINE IMPACTS MAIN FEED-WATER CONTROL SYSTEM LOCATED IN AUXILIARY
BUILDING FEEDWATER
CONTROL SYSTEMi MALFUNCTIONS
SUCH THAT ALL STEAM GENERATORS
AT LOW LOW STEAM GENERATOR
WATER LEVEL AT TIME OF REACTOR TRIP RESULTS OF ACCIDENT WITH ABOVE CONDITIONS
AT TIME OF REACTOR.TRIP
MORE SEVERE THAN THOSE PRESENTED
IN MANY SAFETY ANALYSIS REPORTS
- 3 FEE]YRATER
OONTROL SYSTEM ASSUPTIONS:
- StALL FEEDLINE RUPTURE OUTSIDE CONTAINIENT
IN AUXILIARY
BUILDING o WORST SINGLE ACTIVE FAILURE ASSUIUD IS SAFEaD TRAIN c FSAR INITIAL CONDITIONS
o ADVERSE ENVIROENT
IFPPACTS MAIN FEERIATER
WONTRIL SYSTEM RESULTING
IN CONSEOLENTIAL
FAILURE* MIN PfEE[ATER
CWTROL SYSTEM DIRECTS FCV's IN INTACT LOOPS TO MJVE TO THE CLOSED POSITION OPERTOR ACTION 1NT ASSU'fE FOR AT LEAST 20 MINUTES
CONTROL SINGLE FSAR INITIAL CONSEQUENTIAL
FAILURE OPERATOR SIZE LOCATION FAILURE CONDITIONS
FAILURE DIRECTION
ACTION INSIDE AUX.-TRAN
N BUILDING-ON SMALL OUTSIDE AUX.BUILDING;INSIDE FEEDLINE BREAK CONTAINMENT
LARGE
a2 MAIN FEEDWATER
CONTROL SYSTEM AREAS OF CONCERN-ALL MAIN FEEDWATER
LOST TO INTACT STEAM GENERATORS
FOLLOWING SMALL FEEDLINE RUPTURE-PRIMARY HOT LEG BOILING FOLLOWING
FEEDLINE RUPTURE
IAIN FEEIATER ONTROL SYSTEMV POTENTIAL
SOLUTIONS SHORT TERM-I1VESTIATE
WHETHER MIN FEERAER CU'TROL SYSTEM WILL FAIL OR OPERATE NORYA[LY WHEN EXPOSED TO ADVERSE EaVIRONIMnT
-TAKE CREDIT FOR OPERATOR ACTION PRIOR TO ALL SG'S REACHING LaW-LOW LEVEL TRIP SETPOINT FOLLOWlING
Sf4PLL FEEDLINE RUPTURE LONG TERN-ISOLATE FEENTER CONTROL SYSTEfl FROM THE ADVERSE DIVIRONPS'4 RESULTING
FRO)MPIPE
RUPTURES IN OTHER LOOPS-REVISE LICENSING
CRITERIA TO PERMIT BULK BOILING IN THE RCS PRIOR TO TRANSIE4T
ITURJ UTYI-INSTALL ON RETURN VALVE IN MAII FE MATER LINE INSIDE CONTAINfMENT.
POSSIBILITY
OF A SfTLL FEEDLINE RUPTURE INSIDE CONTAINEN-T
BEPWEEN CHECK VALVE AND STEAM GENERATOR
REQUIRES QUALIFICATION
OF STEAM FLOW TRMIS[ITTER
TO PREVENT MVILFUXTI014 OF FEEUdATER
COOTR0L SYSTEM
PRESSURIZER
POWER OPERATED RELIEF VALVE (PORV) CONTROL SYSTEM-FEEDLINE RUPTURE OCCURS IN MAIN FEEDLINE INSIDE CONTAINMENT
BETWEEN STEAM GENERATOR
NOZZLE AND CONTAINMENT
-MAIN FEEDWATER
SPILLS OUT RUPTURE-SECONDARY
INVENTORY
SPILLS INTO CONTAINMENT
THROUGH RUPTURED FEEDLINE-REACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR
WATER LEVEL IN RUPTURED STEAM GENERATOR-AUXILIARY
PUMPS INITIATED
ON LOW LOW STEAM GENERATOR
WATER LEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP-ADVERSE ENVIRONMENT
INSIDE CONITAI.NMENT
IMPACTS PRESSURIZER
PORV CONTROL SYSTEM POTENTIALLY
CAUSING THE VALVES TO INADVERTENTLY
OPEN OP.FAIL TO CLOSE DUE TO AN ENVIRONXENT
CONSEQUENTIAL
FAILURE-PRIMARY PRESSURE DECREASES
DUE TO STUCK OPEN PRESSURIZER
PORV'S-HOT LEG BOILING COMMENCES-TIME OF OPERATOR ACTION TO MANUALLY CLOSE BLOCK VALVES IN PRESSURIZER
PORV RELIEF LINES DETERMINES
SEVERITY OF ACCIDENT RESULTS
PRESSURIZER
POW CONTROL SYSIEN ASSUWTIOrNS:
FEEDLINE RUPTUIE OCCURS INSIDE JNTAINTEK* WORST SINGE ACTIVE FAILURE ASSUPED IS SAFEGARDS
TRAIN-o FSAR INITIAL CONDITIONS
o AWERE ENVIRONM3fT
IPPACTS PRESSURIZER
POW CONTRDL SYSTEM RESULTING
IN CONSEQUElUTIAL
FAILURE o PRESSURIZER
POW CONTROL SYSTEM DIRECTS RELIEF VALVES TO ME TO OPE1 POSITION OPERATOR ACTIOI NOT ASSUE FOR AT LEAST 20 MINWES
PRESSURIZER
PORV CAN AFFECT SINGLE LOCATION PORV'S FAILURE FSAR INITIAL CONDITIONS
CONSEQUENTIAL
FAILURE FAILURE OPERATOR DIRECTION
ACTION>20 MIN.OPEN YES YES 1 SAFEGUARDS
TRAIN YES NONE INSIDE ((NO FEEDLINE OUTSIDE CONTAINMENT
'-3o PRESSURIZER
POWER OPERATED RELIEF VALVE CONTROL SYSTEM AREAS OF CONCERN-CONTROL SYSTEM ENVIRONMENTAL
FAILURE CAUSES SMALL LOCA IN STEAM SPACE Of PRESSURIZER
DUE TO SECONDARY
HIGH ENERGY LINE RUPTURE-HOT LEG BOILING OCCURS FOLLOWING
FEEDLINE RUPTURE
PRESSURIZER
PORV CO[fL SYSIEJ EUPTENTIAL
SOLUTIONS SHORT TERM o INVESTIGATE
WHETHER PRESSURIZER
ORV CONTROL SYSTEM WILL FAIL OR OPERATE NORW4-LY WHEN E*OSED TO ADVERE ENIFROttET.
o M)DIFY OPERATING
INSTRUCTIOlS
OF A CONSEQUENTIAL
FAILURE Ill CAUSED BY ADVERSE ENVIRONJ19IT.
RELIEF LINES.TO ALERT OPERATOR TO THE POSSIBILITY
THE PRESSURIZER
PORV CONTRL SYSTEM IF EVIDENT, CLOSE BLOCK VALVES IN LONG TERM o REDESION PRESENT CONTROL SYSTEM TO WITHSTA ifr4ICIPATED
EW I ROI 4PENT* INSTALL M)V IN SERIES WITH EXISTING MVN BLOCK VALVE.INSTALL PR[TECTION
GRADE CIRCUITRY
TO CLOSE VALVES FOL[DWING
ADVERSE CONTAINMY
ENTVIRONf4NT.
- INSTALl TWO SAFEIY 90XE SOL840ID VALVES ON EACH PORV TO VENT AIR ON SIGIAL FROM PROTECTION
SYSTEM.o UPGRADE CONTROL LOGIC, M)V BLOCK VALVE AND SOLENOID OPERATOR TO CLOSE FOLLOWING
ADVERSE CONTAINI'ENT
ENVI RUNMX&.
iONiIKWL ?-SIG\AL Fotw CONRL SYSTLm CON-MOL GRADE A IR SUPPLY AFEIY.VALVES ELE.aCTRICALLY
CONQ LED SOLENOID OPE:.'7.O
S
33 SAR INTERMEDIATE
STEAMLINE
RUPTURE EVENT-INTERMEDIATE
STEAMLINE
RUPTURE OCCURS UPSTREAM OF MAIN STEAMLINE ISOLATION
VALVES-COLD LEG TEMPERATURE
GRADUALLY
DECREASES
DUE TO APPARENT EXCESSIVE
LOAD INCREASE-NUCLEAR POWER INCREASES
DUE TO MODERATOR
FEEDBACK COEFFICIENTS (ASSUMES EOL CORE CONDITIONS)
-REACTOR TRIP OCCURS ON OVERPOWER
DELTA-T FUNCTION-TURBINE TRIP OCCURS DUE TO REACTOR TRIP-STEAMLINE
ISOLATION
OCCURS AUTOMATICALLY
OR MANUALLY CLOSED-RUPTURED STEAMLINE
BLOWS DOWN TO CONTAINMENT
PRESSURE.
STEAMLINES
IN ISOLATED LOOPS EXPERIENCE
SLIGHT INCREASE IN PRESSURE
PROPRIETARY
CLASS 2 34 1.2000-_ 1.0000 A: 4= .80000 La CD .60000° .20000 0.0 1.200'1.0001 La° .8000I.6000i LU" D < o.c4000.2000(0.0 2500. 0 2000.0 X 1000.00 Z 0.0 tj -1000.0 La= -2000.0-2500.0 500.00 04o. O0 300.00 L0 g100.00 0.0-0 0 3 3))I I I I I I I 0- A C 0) 6 0 CD C 0~ =0 0 0; c 0o o 6 in t: 0 00 40 eu TIME (SEC)FIGURE 3.2-4-TIME DEPENDENT
PARAMETERS
3 LOOP, 100%POWER BREAK AREA -0.22 FT 2
3sP WESTINGHOUSE
PROPRIETARY
CLASS 2 600. 00't 550.00 e- 500.00 I- 450.00 E ta 400 0> 35000 ec 300.00 M50.00 600.00 a. 550 00.2 1500.00 LWJIA.> 450.00 oc v-., 400.00.a o 350. 00 300.00 250.00 I i i 4 I i I I I I I i i I L: Li CcJ LM i> >0-1400.0 1z50.0 1000.00 750. 00 500. 00 250.00 0.0 1t I I-I.i -IIi III.-- -i i I -.t_-i i .I i iii 2500.0 Z250.0 m 2000.0 Qn _ 1750.0 x _; 1500.0 ,f a-fi t250.0 a: 1000.00 750.00 500.00 O > C > CD r }o .W .0 o vi -_o5 o o u vi 0 0 CD Co TIME (SEC)FIGURE 3.2-5 -TIME DEPENDENT
PARAMETERS
2 LOOP, 10000 POWER BREAK AREA = 0.22 FT
36 WESTINGHOUSE
PROPRIETARY
CLASS 2.4AeCA. i~LI 1.0-0 ox<e =-IN S W~ CD..80000.60000.4A0o Mo000 0.0 1100.0 1000.00 900.00 vi 4,800.00 Lj 700.00< GM0.00 SWD. 00 200.00 ft00.00?00.00 100.00 3.5000 Li 3.0000 e 2.5000 29 LA. 1.5000.50000 n n I I 1 I I 7 I I I r -I- I i F.i I I I I 4 7 -V. w 0il 4 MC 0C0 O EJ
- o > o -O TI£E (SEC)FIGURE 3.2-6 -TIME DEPENDENT
PARAMETERS
3 LOOP, 100-POWER BREAK AREA = 0.22 FT 2
37 ROD CONTROL SYSTEM-INTERMEDIATE
STEAMLINE
RUPTURE (0.1 TO 0.25 SQUARE FEET PER LOOP FROM 70 TO 100 PERCENT POWER) OCCURS INSIDE CONTAINMENT
-ROD CONTROL SYSTEM IN AUTOMATIC
MODE-ADVERSE ENVIRONMENT
FROM STEAMLINE
RUPTURE IMPACTS EXCORE DETECTORS AND ASSOCIATED
CABLING-ENVIRONMENTAL
CONSEQUENTIAL
FAILURE OCCURS IN ROD CONTROL SYSTEM WHICH CAUSES CONTROL RODS TO BEGIN STEPPING OUT PRIOR TO REACTOR TRIP-MINIMUM DNBR FALLS BELOW 1.30 (GREATER THAN 1.1) PRIOR TO A REACTOR TRIP ON OVERPOWER
DELTA-T FUNCTION WHICH EXCEEDS LICENSING
CRITERIA IN MANY SAFETY ANALYSIS REPORTS
31 ROD CONTROL SYSTEM ASSUMPTIONS
-INTERMEDIATE
STEAMLINE
RUPTURE OCCURS INSIDE CONTAINMENT
-ADVERSE ENVIRONMENT
IMPACTS ROD CONTROL SYSTEM COMPONENTS
PRIOR TO REACTOR TRIP-WORST SINGLE ACTIVE FAILURE ASSUMED IS SAFEGUARDS
tRAIN-FSAR INITIAL CONDITIONS
-ADVERSE ENVIRONMENT
IMPACTS ROD CONTROL SYSTEM RESULTING IN CONSEQUENTIAL
FAILURE-ROD CONTROL SYSTEM DIRECTS CONTROL RODS TO WITHDRAWAL
ROD CONTROL SYSTEM CAN AFFECT SYSTEM PRIOR TO TRIP SIZE LOCATION < 2 MIN.SINGLE FAILURE FSAR INITIAL CONDITIONS
CONSEQUENTIAL
FAILURE FAILURE RESULTS.FSAR BASE[RODS FAIL RODS OUT YES PBF RESULTS INDICATE NO RODS IN FAILURE YES 1 NO 1 SAFEGUARDS
(TRAIN YES NO INSIDE CONTAINMENT
NO SMALL TO INTERMEDIAT
I NO OUTSIDE CONTAINMENT
STEAMBREAK
LARGE
-' -40 ROD CONTROL SYSTEM AREAS OF CONCERN-CONTROL ROD WITHDRAWAL
DUE TO CONTROL SYSTEM ENVIRONMENTAL
CONSEQUENTIAL
FAILURE (POWER RANGE EXCORE DETECTOR AND ASSOCIATED
CABLING)-MINIMUM DNBR FALLS BELOW 1.30 PRIOR TO REACTOR TRIP
41 ROD CONTROL SYSTEM POTENTIAL
SOLUTIONS SHORT TERM DETERMINE
IF THE ADVERSE ENVIRONMENT
CAN IMPACT EXCORE DETECTORS
AND ASSOCIATED
CABLING PRIOR TO REACTOR TRIP FOLLOWING
INTERMEDIATE
STEAMLINE RUPTURE.-REMOVE NIS SIGNAL FROM POWER MISMATCH CIRCUIT IN ROD CONTROL SYSTEM (PROCESS CONTROL CABINET)-EMPLOY MANUAL ROD CONTROL LONG TERM-USE CONTAINMENT
PRESSURE TRIP AND QUALIFY EXCORE DETECTOR TO LESS SEVERE ENVIRONMENT (ALSO REQUIRES QUALIFYING
CABLING FROM DETECTOR TO PENETRATION)
-QUALIFY EXCORE DETECTOR TO STEAMLINE
BREAK ENVIRONMENT
420 0 F CURVE ALSO REQUIRES QUALIFYING
CONNECTION
AND CABLING FROM EXCORE DETECTOR TO PENETRATION
EXCORE NUCLEAR -POWER TURBINE POWER REFERENCE TAVG -MEASURED TAVG -POWER MISMATCH IMPULSE (TO ROD SPEED CONTROLLER
COMPENSATED
TAVG ERROR ROD CONTROL SYSTEM SIMPLIFIED
SCHEMATIC
"-I ENCIOSURE
3 MEETING ATTENDEES NRC D. Ross T. Novak G. Kuzmycz S. Lea1s D. Tondi w. Jensen J. Guttmann J. M~zetis S. Israel C. Berl1nger Z. RosztQczy F. Orr J. Heltemes J. Rosenthal M. Cliramal J. Joyce R. Scholl T. Dunning J. Burdoin R. Woodruff S. Salah K. Mahan H. Rood D. Thatcher B. Morris S. Sands T. Houghton D. Tibbitts R. Reil G. Lainas E. Conner P. Norian R. Daigle Co Brintnan W. B~jrchill J. westhayen C. Kl1ng P. Delozier C. Faust Westinghouse R. Borsum i B&W N. Shirley -GE G. Llebler -Fla. P&L Co.R. Marusich -Consumers Power Co.R. Kacich -Northeast Utilities J. Regan -Northeast Utilities R. Olson Baltimore G&E Co.H. O'Brien -TVA R. Harris NUSCO G. Falibota -Bechtel E. Inge , ACRS P. Higgins -AIF R. Leyse -EPRI
ENCLOSURE
4 ACTION PROCESS FOR I&E INFORMATION
NOTICE NO. 79-02* IDENTIFY THOSE NON-SAFETY
RELATED CONTROL SYSTEMS (BOTH INSIDE & OUTSIDE CONTAINMENT)
WHOSE MAL-FUNCTION COULD ADVERSELY
AFFECT THE ACCIDENT OR TRANSIENT
WHEN SUBJECTED
TO ADVERSE ENVIRONMENT
CAUSED BY A HIGH ENERGY PIPE BREAK!* DETERMINE
THE LIMITING MALFUNCTIONS
DURING HIGH ENERGY PIPE BREAKS FOR THOSE CONTROL SYSTEMS.* DETERMINE
THE IMPACT OF THE MALFUNCTION
OF THOSE SYSTEMS.* DETERMINE
SHORT TERM ACTIONS IF NECESSARY.
- DETERMINE
LONG TERM ACTIONS IF NECESSARY.
ENCLOSURE
5 MEETING ATTENDEES
9/20/79AM NRC D. Ross T. Novak G. Kuzmycz R. Capra S. Lewis D. Tondi T. Dunning Z. Rosztoczy W. Jensen J. Mazetis S. Israel J. Rosenthal M. Fairtile J. S. Ckesumal M. Cleramal R. Scholl J. Beard J. Joyce D. Thatcher D. DiIanni G. Lainas B. Morris S. DtAb R. Leipe -EPRI P. Higgins -AIF T. Martin NUTECH E. Roy -Bechtel T. Reitz -G/C Inc.E. Weiss -Union Concerned Scientists R. Pollard -UCS 1&W R. Borsum J- Tvylor H. Roy E. Kane S. Eschbach B. Short M. BonaeA G. BrAzill B. Karrasel R. Wright D. Hallman B. Day -Brown Boveri Reaktorbau C. Faust -Westinghouse L. Stalter -Toledo Edison F. Miller -Toledo Edison T. Myers -Toledo Edison R. Gill -Duke Power T. McMeekin -Duke Power P. Abraham -Duke Power K. Canady -Duke Power R. Dieterich
-SMUD E. Good -FPC B. Simpson -FPC C. Hartman Met Ed P. Trimble -Arkansas P&L R. Hamn -Consumer P. Co.
ENCLOSURE
6 UT I L I T Y / B &W P RO G RAM E VAL UAT E I MPAC BAS I S ACC I DE N T C 0 N S E Q U E N T I A L E F FE CTS ON NON S Y S T E M S.T O N L I C E'N S I N G ANAL YS E S DU E E N V I R O N M E N T A L-S A F E T Y G R A D E T O C O N T R O L I DE N T I F Y L I C E N S I N G BAS I S AC C IDE NTS WH I CH CAUS E AN ADVE RS E E N V I RONME NT FO R EACH P LANT.D E F I N E S A F E T Y A N A L Y S I S I N P UT S AN D RE S P O N S E S U S E D D U R I N G L I C E N S I N G B A S I S A C C I D E N T S.V E R I F Y S A F E T Y CON CL US I ON S O R ACT I ONS J U S T I F C O N T I NU E D O P E R ANAL Y RE CO Y I N G S I S M M E N D A T I 0 N.
ENCLOSURE
7 MEETING ATTENDEES
9/20/79PM NRC D.T.G.R.D.T.D.J.C.D.R.W.T.V.J.W.J.J.T.G.P.Ross Novak Kuzmycz Frahm Tondi Dunning Lynch Joyce DeBevec Thatcher Scholl Hodges IppolIto Rooney Rosenthal Jensen Guttman Hannon Keven Lainas Norian N. Shirley L. Youngborg J. Cleveland C. Sawyer P. Marriott L. Gifford D. Rawlins -W C. Faust -W R. Borsum -&W T.W.C.G.T.J.T.L.J.S.J.R.L.C.R.R.M.V.Rogers -Pacific Gas & Elec.Mindich Phil. El. Col Cowan -Phil. El. Co.Edwards -Phil. El. Co.Scull Phil .E1. Co.Knubel -JCP&L Co.Tipton -JCP & L Co.Rucker -Boston Ed.Vorees -Boston Ed.Maloary -Boston Ed.Sheppard -CPCo.Hoston -CPCo.Mathews -Southern Co. Services Verprek -PSE&G Rajoram -PASNY Rogers -TVA Wiesburg -TVA Bgnum -TVA C. Feltman -Bechtel M. David -Bechtel T. Martin -NUTECH P. Higging -AIF
Mr. Robert H. Groce 50-29 cc Mr. Lawrence E. Minnick, President Yankee Atomic Electric Company 20 Turnpike Road Westboro, Massachusetts
01581 Greenfield Community College 1 College Drive Greenfield, Massachusetts
01301