NRC Generic Letter 1979-49
| ML031320243 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley, Millstone, Hatch, Monticello, Calvert Cliffs, Dresden, Davis Besse, Peach Bottom, Browns Ferry, Salem, Oconee, Nine Mile Point, Palisades, Indian Point, Kewaunee, Saint Lucie, Point Beach, Oyster Creek, Cooper, Pilgrim, Arkansas Nuclear, Prairie Island, Brunswick, Surry, North Anna, Turkey Point, Vermont Yankee, Crystal River, Haddam Neck, Ginna, Duane Arnold, Farley, Robinson, San Onofre, Cook, Yankee Rowe, Maine Yankee, Quad Cities, Humboldt Bay, La Crosse, Big Rock Point, Rancho Seco, Zion, Fort Calhoun, FitzPatrick, 05000000, Trojan, Crane |
| Issue date: | 10/05/1979 |
| From: | Kuzmycz G Office of Nuclear Reactor Regulation |
| To: | |
| References | |
| IN-79-022 GL-79-049, NUDOCS 7911070350 | |
| Download: ML031320243 (59) | |
0t UNITED STATESNUCLEAR REGULATORY COMMISSIONWASHINGTON, D. C. 20555October 5, 1979TO ALL POWER REACTOR LICENSEES
SUBJECT: SUMMARY OF MEETINGS HELD ON SEPTEMBER 18-20, 1979 TO DISCUSSA POTENTIAL UNREVIEWED SAFETY QUESTION ON INTERACTION BETWEEN NON-SAFETYGRADE SYSTEMS AND NSSS SUPPLIED SAFETY GRADE SYSTEMS (I&E INFORMATIONNOTICE 79-22)I. IntroductionA series of meetings was held with all four light water reactor vendorsand the corresponding utilities to discuss the effect of I&E InformationNotice 79-22 on nuclear power plant owners. I&E Information Notice 79-22,issued on September 14, 1979, notified the nuclear industry of a potentialunreviewed safety question at Public Service Electric and Gas Company'sSalem Unit 1 nuclear facility. The meetings were held in the Bethesdaoffices of the NRC according to the following schedule:Westinghouse -September 18, 1979Combustion Engineering -September 19, 1979Babcock and Wilcox -September 20, 1979; a.m.General Electric -September 20, 1979; p.m.The Nuclear Regulatory Commission staff was seeking additional informationfrom operators of all nuclear power plants on a potential unreviewedsafety question involving malfunctions of control equipment underaccident conditions. This equipment consists of electrical componentsused for reactor and plant control under normal operating conditions.Some of this equipment could be adversely affected by steam or waterfrom certain pipe breaks, such as in the main steam line inside or outsideplant containment buildings. The consequences of a control systemmalfunction could result in conditions more or less severe than thosepreviously analyzed. The NRC staff intends to determine the degreeto which the validity of previous safety reviews are affected and whetherchanges in design or operating procedures will be required.II. BackgroundAs part of the Westinghouse Environmental Qualification Program, IEEE 323-74 hasbeen reviewed, in particular, sections dealing with environmental9r0CC?7191 1 0X08 5'0 interactions. Westinghouse design philosophy is that if a component Isnecessary to function in order to protect the public, it Is "protection"grade. Should a non-protection grade component perform normapl action inresponse to system conditions, it must be shown to have no adverse impacton protection grade component response. If a component did not receiyea signal to change state, it was assumed to remain t'as ls'. Part of theenvironmental qualIfications require the demonstration that severe envtronmentswill not cause common failure of "protection" grade components. An outgrowthof the environmental qualification program review was a determination ifthe severe environment can cause a failure of a non-protection grade corponentthat was previously assumed to remain "as is" and alter the results of thedesign basis analysts,Westinghouse formed an Enivronmental Interaction Committee whose charter wasto Identify, for all high energy line breaks and possible locations, the controlsystems that could be affected as a result of the adverse environment and whoseconsequential malfunction or failure could exceed the safety limits previouslysatisfied by accident analyses presented in Westinghouse plants' SARs. TheCommittee was also to establish, for any adverse interactions identified,recommendations to resolve the issue. The assumed ground rules for theinvestigations performed by Westinghouse are enumerated on page five ofEnclosure 2. The investigation resulted in a compilation of potentialcontrol system consequential failures (due to environmental considerations)which affected plant safety analyses. The investigation considered sevenaccident scenarios and seven control systems interactions in a matrix form,as shown on page 6 of Enclosure 2. The accidents are: 1) small steam linerupture; 2) large steam line rupture; 3) small feedline rupture; 4) largefeedline rupture; 5) small LOCA; 6) large LOCA; and, 7) rod ejection.The control systems are: 1) reactor control; 2) pressurizer pressure control;3) pressurizer level control; 4) feedwater control; 5) steam generator pressurecontrol; 6) steam dump system control; and 7) turbine control.The Investigations identified potential significant system response interactionsin the:a. steam generator power operated relief valve control system;b. pressurizer pressure control system;c. main feedwater control system; and,d. rod control system.III. DiscussionA. The first in the series of meetings was with Westinghouse and utilitiesthat own Westinghouse reactors. The meeting was attended by seventy (70)persons representing the NRC, PSE&G along with nine other utilities,Westinghouse and the other three light water reactor vendors, utilityowner groups, four A/E consultants, the ACRS, AIF and EPRI. The listof attendees is presented as Enclosure 1.Westinghouse's presentation is included as Enclosure 2.During the Westinghouse meeting, they identified, for all high-energy line
-3-breaks and possible locations, the control systems that could be affected asa result of the adverse environment and whose consequential failure couldinvalidate the accident analyses presented in Westinghouse plants' SARs.Recommendations were also presented for resolving the adverse interactionsidentified.Westinghouse's investigation identified seven accidents and seven control systemsthat could possibly interact and presented them in a matrix form as shown inEnclosure 2, page 6. As can be seen the potential interactions that coulddegrade the accident analyses are in the:a. Automatic Rod Control Systemb. Pressurizer PORV Control Systemc. Main Feedwater Control Systemd. Steam Generator PORV Control SystemWestinghouse stated that the possible matrix interactions may increase as moredetailed analyses are performed but the interactions will remain for all oftheir plants and the interactions may be eliminated only if conditions aresuch that plant specific designs mitigate the interactions because of:a. system layout;b. type of equipment used;c. qualification status of equipment utilized:d. design basis events considered for license applications; and,e. prior commitments made by utility to the NRC.The Westinghouse analysis did not consider plant operators as part of the controlsystems nor was the time allotted for operator "inaction" considered. Theassumed operator action times, as stipulated in plant analysis, were used withoutmodification. Equipment in a control system or part of a control systemwas assumed to fail as a system in the most adverse direction for conservatism.Westinghouse stated that the possible matrix interactions will remain for allof their plants and the interactions may be removed only if conditions aresuch that plant specific designs mitigate the interactions because of:a. system layout;b. type of equipment used;c. qualification status of equipment utilized;d. design basis events considered for license application; and,e, prior commitments made by utility to the NRC.It should be noted that Westinghouse only analyzed accidents and not transient Further, long-term investigations may be required to analyze the transient cases.Initial conditions and assumptions are shown on pages 5, 7, 9, 14, 15, 22, 23?'27, 28, 33, 37 and 38.Westinghouse presented their analyses for the four control systems identifiedas follows:A. Steam Generator Power Operated Relief Vale Control SVstem,The areas of concern for this system are:1. multiple steam generator blowdown in an uncontrolled manner;2. loss of turbine driven auxiliary feedwater pump; and,3. primary hot leg boiling following feedline rupture.The assumptions used are presented on page 15 of Enclosure 2. Potentialsolutions to the Steam Generator PORV Control System interaction problemswere presented as both short term and long term. The short-term solutionsare to:1. Investigate whether the SG PORY Control System will operatenormally or fail in a closed position when exposed to an adverseenvironment; and,2. modify the operating instructions to alert operators to thepossibility of a consequential failure in the SG PORY ControlSystem caused by an adverse environment.If evident, close block valves in'the relief lines.The long-term solutions are:1. redesign the SG PORV Control System to withstand the anticipatedenvironment;2. relocate the SG PORVs and controls to an area not exposed to theenvironment resulting from ruptures in the other loops;3. install two safety grade solenoid valves in each PORY to vent airon a signal from the protection system, thereby ensuring that thevalve will remain closed initially or will close after opening; and,4. install two safety grade MOVs in each relief line to block ventingon signal from the protection system.Westinghouse presented simil~ar analyses for the other three control systemsalong with the assumptions, areas of concern and potential solutions. These arepresented in Enclosure 2.a. Steam Generator PORY Control System pp. 14-21, Enclosure U. Main FeedwAter Control System pp. 22-26, Enclosure 2.c. Pressurizer PORY Control System pp. 27-32, Enclosure 2.d. Rod Control System pp. 37-42, Enclosure 2.At the end of Westinghouse's presentation, the NRC staff caucused to discusstheir future plans and actions. When all attendees reconvened the meetingwas opened to discussions of the impact of the NRC 10 CFR 50.54(f) letter,vendor and utility plans, and staff plans.Westinghouse stated that they would establish an action plan along theguidelines of NUREG-0578. Westinghouse also stated that their investigationswere carried further than FSAR analyses and they would need to evaluateconsequential failures on a realistic basis; this evaluation may eliminatesome problems. Westinghouse stated that their investigations are lowerprobability subsets of SAR analyses which in themselves are sets of lowprobability. Westinghouse expressed doubts that a conclusive determinationcan be made of the qualification status of all of the involved equipmentin 20 days.Robinson plant representatives noted that their secondaries are open andtherefore breaks outside of containment present no problem. They indicatedtheir basic approach to answering the 20-day letter will be to follow theshort-term Westinghouse recommendations.Representatives of Salem also stated that their intent is to follow theshort-term Westinghouse recommendations to satisfy the request of the 20-dayletter.Utility representatives stated that they will respond to the 20-day letterby addressing the four control systems identified in a manner suggested bythe Westinghouse recommendations unless the NRC staff provides directionsto the contrary and further established guidelines stating their positionon the problem along with their recommendations.B. The second in the series of meetings was held with Combustion Engineering andutilities that own CE's reactors. The meetings were attended by 52 personsrepresenting the NRC, all four light water reactor vendors, five utilities,various consultants, the ACRS, AIF and EPRI. The list of meeting attendeesis presented as Enclosure 3.They explained the concerns presented by Westinghouse and the four controlsystems that could be affected as a result of the adverse environment ofa high energy pipe break and whose consequential failure could invalidatethe accident analysis of plant SARs.Previous analyses did not specifically take control systems into accountin accident scenarios and the systems were considered passive in the analyses.The staff explained its earlier understanding regarding control systemsinteraction in accidents as one in which the accidents were expected to bequick and the control systems did not have the time to contributesignificantly to the consequences. If most of industry reviewed theiraccident analyses according to the staff position on control systemcontribution, then a need does, in fact, exist to further the scopeof accident analyses to include potential consequential failure modes of the
"-Icontrol systems,Industry representatives stated that in the allotted 20 das, tshey couldonly skim the surface in Accident reyiew with the inclusiQn of controlsystem interactions. An lnttiql qpproaqh would Fe Qf a mechanistlc natureto determine wAht control system would be inyolyed and iwha t type Qf hardfiarewould be necessary to initiate fifes rather th~an uslng an anaardtwcaapproach to determine the contribition of control Syste0s on accidentconsequences.Combustion Engineeringts plans are to Identify the control systems that couldcause interactions and then look at resolutions to the problem on a per plantbasis since some solutions are plant dependent. The action process to befollowed is presented as Enclosure 4 and is as follows:1. Identify those non-safety related control systems, inside and outsidecontainment, whose malfunction could adversely affect the accidentor transient when subjected to an adverse environment caused by ahigh energy pipe break.2. Determine the limiting malfunctions and their impact during highenergy pipe breaks for those control systems.3. Determine the short term and long term corrective actions.Combustion Engineering stated that in their plants, operaton of controlsystems is not required in order to mitigate the consequences of the transientsanalyzed in Chapter 15. The analyses in Chapter 15 include the assumptionthat these control systems respond normally to each transient and thattheir operational mode is that which would be most adverse for the transientunder consideration. The consequences produced by any credible malfunctionof these control systems would be less severe than any which would beproduced by the mechanisms considered as causes of the transients analyzedin Chapter 15.Some discussion followed dealing with the failure modes of control systemand whether the failure mode is in the most adverse direction or in thedesign direction. Resolution of this topic was not obtained but will beaddressed on a plant-by-plant basis.Again utilities presented their concerns over the 20-day letter and what isexpected of them in this time frame. They stated that in order to follow thedirections of the letter all components would have to be reviewed to determineif the non-safety grade system failure mode would aggrevate the accidentconsequences.C. The third in the series of meetings was held with Babcock and Wilcox and utilitiesthat own B&W reactors. The meetings were attended by fifty-six (56)persons representing the NRC, reactor vendors, seven utilities, variousconsultants, the AIF and EPRI along with the Union of Concerned Scientist The NRC staff explained the background history leading up to the"20-day" letter and the fact that they consider the problem a genericone common to all LWRs.The utility representatives stated that they will answer the letterthemselves without specific participation of the owners group, whichthey consider germane only to TMI-2 related subejct. Most of the work,the detailed action plans of which have not yet been established, willbe performed by the various utilities and their architect engineers andconsultants, with generic material supplied by the reactor vendor.The utility representatives understand the environment to be plantspecific and will use that environment in their analyses for controlsystem failure. The system failure will include not only componentfailure but also failure of transducers, wires, and hot and cold shorts.The adequacy of fixes for the long-term and the combination of consequentialfailures is not expected to be considered in the allotted 20 days.Babcock and Wilcox representatives stated that in the past, evaluationswere performed for the sequence of events leading up to the trip, a timeof about 5 to 10 seconds. Prior to that time the control systems haveno effect on the accident sequence or consequence. Failure of controlsystems will be investigated in view of the severity of the possibleaccident; if the control system failure increases the consequences,then that system will be considered.The approach proposed by B&W and the utilities is outlined in Enclosure 6and is as follows:1. Evaluate the impact of IE 79-22 on licensing basis accidentanalyses.2. Identify accidents which will yield the adverse environment.3. Define inputs and responses used.4. Verify conclusions and justify continued operation.The utilities will alert the plant operators to the potential failure ofthe plant control systems in total or in providing correct information.The abnormal and emergency procedures will be reviewed to determine howfailure of non-safety grade systems or improper information will affectthe prescribed operator action.D. The fourth and final in the series of meetings was with General Electricand utilities that own GE reactors. The meeting was attended by 52people representing the NRC, three reactor vendors, nine utilities,architect engineers, consultants, and the AIF. The list of attendeesis presented as Enclosure 7.The NRC staff presented highlights of the previous meetings and theconcerns identified by Westinghouse. The staff stated that a moresophisticated evaluation of the accident analysis is required to see ifthe course and consequences of the accident are altered by consequentialfailure of non-safety grade control system General Electric representatives stated that their analyses have -considered high energy pipe breaks in many locations and are moredetailed since BWRs have a larger number of pipes inside and outsidecontainment carrying radioactive liquids. The BWR leak detectioncapabilities are correspondingly greater. Special attention is givento separation criteria viz., various systems are in separate cubiclesand inside a class 1 secondary as well as primary containment.The high energy line break is not considered a problem. In 1970,Dresden 2 experienced opening of a safety valve and a resulting 10 psiand 340 F environment. The equipment was examined and the qualificationswere subsequently upgraded.GE representatives stated that they performed sensitivity studies ontheir non-safety grade systems to determine if they are heavily reliedupon during an accident. The studies revealed that there was no heavydependence upon those systems.It must be noted that the GE non-safety grade system and componentscomprise only approximately 25% of a typical plant total. The utilitieswill perform their own analyses on BOP systems to satisfy the require-ments of the "20-day" letter.IV. NRC CommentsThe NRC staff stated that they understood the requests by the nuclear industryregarding position and direction on the request found in the NRC 10 CFR 50.54(f)letter dated September 17, 1979 but would wait until the conclusion of thescheduled meetins with all four light water reactor vendors. The stafffurther stated a Commission Information paper would be prepared discussingthe staff's judgment regarding the magnitude of the concern and the appropriate-ness of industry's response for resolution of the problem.More specific staff statements were made in terms of generating a plantspecific matrix of potential environmental interactions of control systemfor each plant. The NRC requested that they be notified of further analysesand the individuals that will perform them, either reactor vendors, the ownersgroups, or the individual utilities.The NRC noted that at this time, it is not evident which utilities are facedwith what environmental interaction problems. The effects of implementingall of the Westinghouse recommended short-term "fixes" may be contradictedby other sequences. Multiple failure analyses could be performed but thiswould take months and could not possibly be ready in 20 days.The NRC recommended that utilities check if qualified equipment is in placeto determine the magnitude of a total qualification program.The staff advised the utilities to check the validity of their operatingprocedures in light of the steam environment around various components andthe reliability of certain control valves in question; also, use should bemade of all information available in files of vendors, A/Es, and consultantsdealing with the proble The staff is aware that sufficient time is not available to identify all ofthe potential interactions but some of the more obvious ones must bereviewed. For example, some utilities might choose to operate theirplants in the ihterim period using a manual rod mode instead of thepreferred automatic mode; also, the PORV block valves may be operated inthe closed position. The determination of what systems are suspect andthe possible 20-day solutions must be answered by each individual utilityaccording to their plant design. Operator training would have to be stressedto make the operators aware that potential consequential failures may existthat would mask the real failure and give erroneous readings.The staff stated that for the "20-day" letter response, the utilities shoulduse engineering judgment and evaluations instead of detailed analyses thatwould be time consuming and might limit the utility response to a limitednumber of evaluations.V. ConclusionsThe staff indicated that there were three possible options that could befollowed in providing a short-term response.1. Qualify equipment to the appropriate environment; this would takelonger than 20 days and would, more likely, for most utilities bea long-term partial solution.2. Short-term fixes should be in place pending long-term solutions.It must be noted that in this situation some components that arerelied upon to work properly might be wiped out by consequentialfailures under certain conditions and accident sequences.3. The "worst case" plant should be selected and a bounding analysisperformed to determine the time frame available for qualificationof equipment.The staff reiterated the presented recommendations, possible interim solutionsthat are plant specific, and in addition, requested the following:1. Identify equipment and control systems which are either needed tomitigate the consequences of a high energy pipe break or couldadversely affect the consequences of these events.2. Check the locations, expected environment, and environmentalqualifications of the equipment and control system identifiedin part 1.3. If some of these are found not be qualified for the environmentalconditions, propose an appropriate fix, i.e., design change, changein operating procedures, acceptable consequences argument based onyour evaluation, etc. Provide a schedule for the proposed fix.George Kuzmycz, Project ManagerDivision of Project Management Mr.- William J. Cahill, Jr. 50-3^ Consolidated Edison Company of New York, Inc. 50-247cc: White Plains Public Library100 Martine AvenueWhite Plains, New York 10601Joseph D. Block, EsquireExecutive Vice PresidentAdministrativeConsolidated Edison Companyof New York, Inc.4 Irving Place-New York, New York 10003Edward J. Sack, EsquireLaw DepartmentConsolidated Edison Companyof New York, Inc.4 Irving PlaceNew York, New York 10003Anthony Z. RoismanNatural Resources Defense Council917 15th Street, N.W.Washington, D. C. 20005Dr. Lawrence R. QuarlesApartment 51Kendal at LongwoodKennett Square, Pennsylvania 19348Theodore A. RebelowskiU. S. Nuclear Regulatory CommissionP. 0. Box 38-Buchanan, New York 10511 NRCD. RQss.D. EtsenhutJ.'HeltemesG. KuzmyczJ. GuttmannW. JensenS. IsraelG. LainasV. BenaroyaR. WoodruffA. DromerickB. SmithM. GrotenhuisA.-SchwencerP. NorianF. OrrF. OdarT. DunningW. GammillS. SalahJ. StolzZ. RosztoczyT. NovakJ. BeardM. CliramakD. TondiC. BerlingerL. KintnerJ. MazetisK. MahanD. ThatcherJ. BurdoinP. MathewsM. LynchR. SchollENCLOSURE 1MEETING ATTENDEESWESTINGHOUSEK. Jordan-R. SeroR. SteitlerG. LangG. ButterworthV. SlussF. NoonPSE&G Co.F. LibrizziR. MittlJ. WroblewskiJ. GogliardiP. MoellerR. FrylingVENDORSN. Shirley -G.E.W. Lindblad -G.E.R. Borsun -B&WC. Brinkman -C.E.PortlandUTILITIESD. Waters -CP&LM. Scott -Con. Ed.G. Copp -Duke PowerN. Mathur -PASNYJ. Barnsberry -S. Cal. Ed.K. Vehstedt -AEPSCR. Shoberg -AEPSCE. Smith -VEPCOT. Peebles -VEPCOP. Herrmann -Southern Co. ServicesW. House -BechtelT. Martin -NutechJ. McEment -StafeoM. Wetterhahn -Conner, Moore & CorberK. Layer -BBRE. Igne -ACRSP. Higgins -AIFR. Leyse -EPRI ENCLOSURE 2VI E WIROI'ITAL QUALIFICATIONACTIVITIES(IEEE 323-74)-SEISMIC TESTS-AGITh PMROGP1-ENVIROITAL BVELOPES-ItNsmU.Ta ACa!RCIES-E!NVIR3[ITTAL INTERACTIOSi HISTORYACRS CONCERNSNRC ACTIONS/QUESTIONSAREAS: SYSTEMS INTERACTIONSINTERFACE CRITERIA (STANDARDIZATION)HELB PROTECTIONINDUSTRY DESIGN PHILOSOPHYIF A COMPONENT IS NECESSARY TO FUNCTION IN ORDER TO PROTECTTHE PUBLIC, IT IS "PROTECTION" GRADE. SHOULD A NON-PROTECTIONGRADE COMPONENT PERFORM NORMAL ACTION IN RESPONSE TO SYSTEMCONDITIONS, IT MUST BE SHOWN TO HAVE NO ADVERSE IMPACT ONPROTECTION GRADE COMPONENT RESPONSE. IF A COMPONENT DID NOTRECEIVE A SIGNAL TO CHANGE STATE, IT WAS ASSUMED TO REMAIN"AS IS".
-ENVIRONMENTAL QUALIFICATIONDEMONSTRATE THAT SEVEREFAILURE OF "PROTECTION"ENVIRONMENT WILL NOT CAUSE COMMONGRADE COMPONENTS-NEW QUESTION TO BE ADDRESSEDCAN THE SEVERE ENVIRONMENT CAUSE A FAILURE OF A NON-PROTECTIONGRADE COMPONENT THAT WAS PREVIOUSLY ASSUMED TO REMAIN "AS IS"AND ALTER THE RESULTS OF THE DESIGN BASIS ANALYSES?-REGULATORY ENVIRONMENT TODAY-POST-TMI/2 REACTION-NUREG-0578-ACRS PRESENTATIONS BY NRC
--ENVIRUNrnJfAL IWTERACTION CO"I¶TTEEINWERACTION TO BE ADDRESSED:A CONSEQUENTIAL FAILURE OF A COTROL SYSTEM DUE TO AN ADVERSE EN3VIRON1EBIINSIDE OR OUTSIDE CQ¶AII4NFJ FOL.LWING A HI(fl ENERGY RUPTURE IMICHNECATES A PROTECTIVE FUIJCTIaJ PERFOR-ED BY A SAFElY GRE SYSTEJb0CIOTlEE OMER:FOR ALL HIGI BJERGY LINE BREAKS AMD POSSIBLE LOCATIONS, IDEIfTIFY C1fTROLSYSTEMS THAT COULD BE AFFECTED AS A RESULT OF THE ADVERSE EBNIROWElff AMIVOSE CONSEUEWTIAL, f'FIWCrIOI OR FAILURE COULD IINALIDATE THE ACCIDETANALYSIS PRESETE IN THE PLAlf SAR. FOR AY ADVERSE IERACTIO[S IDENTIFIED,ESTABLISH RECOMEMATIOJS TO RESOLVE THE ISSU iASSU1D GROU{iDRULES FOR INVESTIG4TIONo 0fNTROL SYSTEMS (OR PARTS) 1NOT SUBJECT TO HIGH RGH Y LINE BREAKElVIRONIRENT-EQUIPOT1{F ASSUfED TO RE[ IN 'AS IS' OR OPERATE WITHIN SPECIFIEDACCURACY, WHICHEVER IS MDRE SEVEREo RANDOM FAILURES IN THE CONTROL SYSTEM ARE NOT POSTULATED TO OCCURCOINCIDEfTf WITH THE STUDIED EVENTo PROTECTION SYSTEfS AIE ASSU0ED TO FUNCTION CONSISTENT WITH REQUIREMENTSOF IEEE-2?9-l971 (INCLUDING SING.E FAILURE IN PROTECTION SYSTEfD.e OPERATOR ACTION TIMlE ASSUMED OONSISTENT WITH SAR ASSUJPTIONSo W14TROL SYSTE (OR PARTS) SUBJECT TO HIGH ENERGY LINE BREAKENVIRON1411T-UNQUALIFIED EQUIPMNT ASSUED TO FAIL IN MST ADVERSE DIRECTION-QUALIFIED EQUIPPENq ASSUE) TO REiAIN 'AS IS' OR OPERATEWITHIN SPECIFIED ACCURACY.(QUALIFIED DESIGN CRI BE SHNJN 10 BE COWATIBLE WITH POSTULATED NVIR)fIE Control Pressurizer Steam Generator SteamReactor Pressure Level Feedwater Pressure Dump TurbineAccident Control Control Control Control Control System ControlSmall Steamline Rupture X X XLarge Steamline Rupture XSmall Feedline Rupture X X X XLarge Feedline Rupture X X XSmall LOCA X X XLarge LOCARod EjectionPROTECTION SYSTEM-CONTROL SYSTEM POTENTIAL ENVIRONMENTAL INTERACTIONX -POTENTIAL INTERACTION IDENTIFIED THAT COULD DEGRADE ACCIDENT ANALYSIS0 -NO SUCH INTERACTION MECHANISM IDENTIFIED NIDENTIFIED POTENTIAL CONCERJJSSYSTEMATIC INVESTIGATION IDENTIFIED POTENTIAL ESNIRO(Y'ElTALINTERACTION IN:-STEN-1 GENERATOR POWER OPERATED RELIEF VALVE CORTROL SYSTEM-PRESSURIZER PRESSURE CONTROL SYSTE1I-MAIN FEED WATER CONTROL SYSTEJ1-ROD CONTROL SYSTEMINTERACTION MODE AND POSSIBLE FIXES IDENTIFIEDo INVESTIGATION TO DATE LIMITED TO ItPACT OF ADVERSE EIIR -WfT ONCOITROL SYSTEMS AlD POTENTIAL CCUSEOUEIJTIAL EFFECTSo REMAINING AREA UNDER INVESTIGATION BY C(XlIITTEE IS THE EFFECT OFADVERSE EUNVIROf',ENTS ON VALVE OPERATORS ASSOCIATED WITH 'INACTIVE'VALVES LOCATED IN PROTECTION SYSTENS-NO OPERABILITY REQUIREIIENT ON VALVE THEREFORE IO QUALIFICATIONSPECIFIED FOR VALVE OR OPERATOR-HAIEVER, ACCIDENT ANALYSIS ASSUlES VALVE STAYS 'AS IS'
PLANT APPLICABILITY OF COICERNS & RECCMEDATImNS* IDENTIFIED CONCERNS ARE NOT GENERIC SINCE IMPACTED BY MANY PLANTSPECIFIC PESIGFS'IS:-SYSTEM LAYOUT-TYPE OF EQUIFPiENT UTILIZED-OUALIFICATION STATUS OF EQUIPFENT UTILIZED-DESIGN BASIS EVENTS CONSIDERED FOR LICENSE APPLICATION-CO(IMITIME11TS MUDE BY UTILITY TO NRCRECCrTENATIO[JS-UTILITY REVIEW OF IDENITIFIED CONCERS WITH RESPECT TO PLMITCHARACTERISTICS A"ID LICENSING COAMIT11ENTS-FOLL0Cl-UP BY UTILITIES TO CONSIDER POTENTIAL FOR ADVERSEENIRMNTTAL INTERACTION FE1 CONTROL SYSTEMS AS YET UN-REVIEWED BY WESTINGHOUSE SAR FEEDLINE RUPTURE EVENT-MAIN FEEDLINE RUPTURE OCCURS DOWNSTREAM OF FEEDLINE CHECK VALVE-MAIN FEEDWATER SPILLS OUT RUPTURE-SECONDARY INVENTORY SPILLS. THROUGH RUPTURED FEEDLINE-PRIMARY BEGINS HEATUP DUE TO PARTIAL LOSS OF LOAD-REACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR WATIER LEVEL INRUPTURED STEAM GENERATOR-AUXILIARY FEEDWATER PUMPS INITIATED ON LOW LOW STEAM GENERATORWATER LEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP-PRIMARY BEGINS COOLDOWN WHILE HEAT REMOVAL CAPABILITY OF SECONDARYINITIALLY EXCEEDS DECAY HEAT GENERATED IN CORE-PRIMARY BEGINS HEATUP WHEN SECONDARY INVENTORY NOT CAPABLE TOREMOVE DECAY HEAT-STEAM GENERATORS IN INTACT LOOPS BEGIN REPRESSURIZING DUE TOAUTOMATIC OR MANUAL MAIN STEAMLINE ISOLATION-STEAM DRIVEN AUXILIARY FEEDWATER PUMP OBTAINS STEAM FROM AT LEASTTWO MAIN STEAMLINES. STEAMLINE ISOLATION INSURES SOURCE OF STEAM SUPPLY-PRIMARY CONTINUES TO HEATUP UNTIL AUXILIARY FEEDWtATER BEING INJECTEDINTO INTACT STEAM GENERATORS IS SUFFICIENT TO REMOVAL DECAY HEAT 10WESTINGHOUSE PROPRIETARY CLASS 2W'(FtP-- ..20o..._ i i i: -2 i 1124V i I I WLbL"0-J= 06L"LCol .00-I._.._..50. Go -500.00 +50. 00M. 00* t r1~-~:f~ I 9 t~~~ '., .I1.......I 4 2 '..LbC 2-SLaA~SSo.00 -_ ..0.00 +-4550. 0*50. 00 -*W.00I -o6cI3 40 (00 C:2 L ho; o4 4-T- :)4. 0~ .< 4 1'+g40rcug C. C) O C- __g °oC- bM IV ' Wr5-10 Primary TemperatureAssuming Worst Case3-Loop PlantTransients Following a Feedline RuptureInitial Conditions and Assunptlins for a IfWEsjNtG"OUSEWJ L4ApROPRIETARY CLASS 2-.7-OLaS t.cr e.a Latt C3V;C-0-JC.40:2:n1500.01250.0I I ! i IJ: '. v i t I111 1 iH I I I !i , 1- : H iI .-1000.750.00500.00250.000.0I I I 111111 I i I 111!1; ! I i IIH I o!o :,0CD0O 0C C= ZDOD 0 4='_CD ... .00 C CDCr~eu ..f.W. .O C; * ,'AAC 4U apcO0000 36U 4 -=]~0 0-00O rc ,TIME (SEC)5-ll Primary Temperature and Stena Cenerator Pressure Folloving areedline Rupture Assuming Worst Case Initial Conditioos andAssumptions for a 3-Loop Plant I2WESTINGHOUSE PROPRIETARY CLASS ZAf- q23V-270260250Id%240230ies:LA0..220t210(.I ....U ..0. 00.00.0.0D. 0).0~.0200(I90Ct80C17002000.01750. 01500.0LaJx_j0C-I-La4-)1250.1000.00750.00500.00o o o :=o 00 oc .-* E ...L_0 cX C>Qtc~C. -,VCo CD .-._~ =00o o :co o m -.,o 0 C =CDo ., c=___O 0. f~-:CDJ C3 cUm=t=AjenT-L% -00 0=-E0D 0 c.x: -O0 O: Ic -' .--.OD CO C>Gz =)0 0 0T Z .~~j5-12 Pressurizer Pressure and Water Vo1=e Following a Feedline RuptureJlAssuming Worst Case Initial Conditions and Assumptions for a3-Loop Plant 13SlESTINGHOUSE PROPRIETARY CLASS 2C -qz3o....I -I.1.20001.O090-S i * : .....iii I I I I I I I.T II-I-:E -:x F:(.j s.W t-l75000 +.50000.250000.0-. 1000040.000i. I i iili :I I' i iHl t i I I i ! 'H;H ! i i44 HH I I 4 klli I I I F I !;; i........30.000 +M0-,=~LaW- -cr, -_~20. 00010.0000.0--SO. 000_---------------- I -I.........I _ 11s 0 00 *.e...o 60 4 _C >8000O 0O CD OC. =O 0 e-CC~ en a~iA;'~0C 0> c~zz =0 0 CF wrN in0 0 c cr z-%P1QO0OOU00C*_ DOC. Den D5-13 Vessel Mass Flow Rate and PressUrizer Insurge Following aFeedline Rupture Assuming Worst Case Initial Conditions andAssumptions for a 3-Loop Plant 14STEAM GENERATOR POWER OPERATEDRELIEF VALVE (PORV) CONTROL SYSTEMFEEDLINE RUPTURE OCCURS IN MAIN OR AUXILIARY FEEDWATER LINES INAUXILIARY BUILDING BETWEEN CONTAINMENT PENETRATION AND CHECK VALVESMAIN FEEDWATER SPILLS OUT RUPTURESECONDARY INVENTORY SPILLS INTO AUXILIARY BUILDING THROUGH RUPTUREDFEEDLINEREACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR WATER LEVEL IN RUPTUREDSTEAM GENERATORAUXILIARY FEEDWATER PUMPS INITIATED ON LOW LOW STEAM GENERATOR WATERLEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP.STEAM GENERATORS IN INTACT LOOPS BEGIN REPRESSURIZING DUE TO AUTOMATICOR MANUAL MAIN STEAMLINE ISOLATIONADVERSE ENVIRONMENT INSIDE AUXILIARY BUILDING IMPACTS STEAM GENERATORPORV CONTROL SYSTEM POTENTIALLY CAUSING THE VALVES TO INADVERTENTLY OPENOR FAIL TO CLOSE DUE TO AN ENVIRONMENTAL CONSEQUENTIAL FAILURESTEAM GENERATORS THAT SUPPLY STEAM TO TURBINE DRIVEN AUXILIARYFEEDWATER PUMP DEPRESSURIZE TO ATMOSPHERIC PRESSURE VIA FAILEDOPEN STEAM GENERATOR PORV'S, CAUSING TURBINE DRIVEN AUXILIARYFEEDWATER PUMPS TO-STOPIF SINGLE ACTIVE FAILURE ASSUMED IS A MOTOR DRIVEN AUXILIARY FEEDWATERPUMP, ALL AUXILIARY FEEDWATER IS LOST TO ALL STEAM GENERATORSPRIMARY BEGINS TO HEATUP RAPIDLY DUE TO LOSS OF SECONDARY HEAT SINKAND HOT LEG BOILING COMMENCESTIME OF OPERATOR ACTION TO MANUALLY CLOSE VALVES IN AUXILIARY FEED-WATER LINE TO RUPTURED STEAM GENERATOR OR TO MANUALLY BLOCK STUCKOPEN STEAM GENERATOR PORV'S DETERMINES SEVERITY OF ACCIDENT RESULTS I'SSTEAM GBERATOR POW' CO[ROL SYSTEM,ASSoUPPT IONS:* FEEDLINE RUPTURE OUTSIDE CONTAINIlENTo WORST SINGE ACTIVE FAILURE ASSUWED IN SAEWLRDS TRAIN* FSR INITIAL ITIOIS* ADVERSE ENVIRONJI IWACTS SG POW CODflRL SYSTEM RESULTINGIN CONSEQUENTIAL FAILUREe STEAM GECRATOR RPO AO]TREL SYSTEM DIRECTS VALVES TO ByVE TOOPEN POSITIOOPERATOR ACTION NOT ASSUMF FOR AT LEAST 20 MINUTES STEAM GENERATOR PORVSINGLELOCATION FAILUREFSAR INITIALCONDITIONSCONSEQUENTIALFAILUREFAILUREDIRECTIONOPERATORACTIONOPEN(1 SAFEGUARDSI "I --flTRAINBEST ESTIMATEINSIDE AUX. -BUILDINGNONE(FEEDLINE BREAK .OUTSIDE AUX.BUILDING- --I INSIDECONTAINMENT i?STEAM GEERATOR POWER OPERATED CELIEF VALVECON[ROL SYSTEMAREAS OF CONCERN:-PILTIPLE STEAM MEFATOR BLOWW IN AN UNCONTRL E] MNIER-LOSS OF TURBINE DRIVES AUXILIARY FEEITIATER PUP-PRIiRY HOT LEG BOILING FOLLOWING FEEDLINE RUPTUSKR STEAM GENERATOR PORV CONTROL SYSTEMPOTENTIAL SOLUTIONSSHORT TERM-INVESTIGATE WHETHER SG PORV. CONTROL SYSTEM WILL OPERATE NORMALLYOR FAIL IN CLOSED POSITION WHEN EXPOSED TO ADVERSE ENVIRONMENT-MODIFY OPERATING INSTRUCTIONS TO ALERT OPERATOR TO THE POSSIBILITYOF A CONSEQUENTIAL FAILURE IN THE SG PORV CONTROL SYSTEM CAUSED BYADVERSE ENVIRONMENT, IF EVIDENT, CLOSE BLOCK VALVES IN RELIEF LINESLONG TERM-REDESIGN SG PORV CONTROL SYSTEM TO WITHSTAND ANTICIPATED ENVIRONMENT-RELOCATE SG PORV'S AND CONTROLS TO AN AREA NOT EXPOSED TO THEENVIRONMENT RESULTING FROM RUPTURES IN OTHER LOOPS-INSTALL TWO SAFETY GRADE SOLENOID VALVES ON EACH PORV TO VENT AIRON SIGNAL FROM THE PROTECTION SYSTEM, THEREBY ENSURING THAT THE VALVEWILL REMAIN CLOSED INITIALLY OR CLOSE AFTER OPENIUG-INSTALL TWO SAFETY GRADE MOV'S IN EACH RELIEF LINE TO BLOCK VENTINGON SIGNAL FROM PROTECTION SYSTEM IIIIIIIIIIIIIIIISAF~rY VRLVesfT f A'?AL eve L'TUflOIN.mFWI <colfvrAriv1eNrTWALL Il(CIDIDFigure 6. Auxiliary Feedwater System (Four-Loop Plant) Itte*rlf,I'lt,C(to<0"IIFigure 7. Auxiliary Feedwater System (Three-Loop Plant)
MAIN FEEDWATER CONTROL SYSTEMSMALL FEEDLINE RUPTURE OCCURS IN MAIN OR AUXILIARY FEEDWATER LINESIN AUXILIARY BUILDING BETWEEN CONTAINMENT PENETRATION AND CHECKVALVESMAIN FEEDWATER AND POSSIBLY SECONDARY INVENTORY SPILLS INTO AUXILIARYBUILDING THROUGH SMALL FEEDLINE RUPTUREADVERSE ENVIRONMENT CAUSED BY RUPTURE IN FEEDLINE IMPACTS MAIN FEED-WATER CONTROL SYSTEM LOCATED IN AUXILIARY BUILDINGFEEDWATER CONTROL SYSTEMi MALFUNCTIONS SUCH THAT ALL STEAM GENERATORSAT LOW LOW STEAM GENERATOR WATER LEVEL AT TIME OF REACTOR TRIPRESULTS OF ACCIDENT WITH ABOVE CONDITIONS AT TIME OF REACTOR.TRIPMORE SEVERE THAN THOSE PRESENTED IN MANY SAFETY ANALYSIS REPORTS
- 3FEE]YRATER OONTROL SYSTEMASSUPTIONS
- * StALL FEEDLINE RUPTURE OUTSIDE CONTAINIENT IN AUXILIARY BUILDINGo WORST SINGLE ACTIVE FAILURE ASSUIUD IS SAFEaD TRAINc FSAR INITIAL CONDITIONSo ADVERSE ENVIROENT IFPPACTS MAIN FEERIATER WONTRIL SYSTEMRESULTING IN CONSEOLENTIAL FAILURE* MIN PfEE[ATER CWTROL SYSTEM DIRECTS FCV's IN INTACT LOOPS TOMJVE TO THE CLOSED POSITIONOPERTOR ACTION 1NT ASSU'fE FOR AT LEAST 20 MINUTES FEEDWATER CONTROLSINGLE FSAR INITIAL CONSEQUENTIAL FAILURE OPERATORSIZE LOCATION FAILURE CONDITIONS FAILURE DIRECTION ACTIONINSIDE AUX.-TRAN NBUILDING-ONSMALL OUTSIDE AUX.BUILDING;INSIDEFEEDLINE BREAKCONTAINMENTLARGE a2MAIN FEEDWATER CONTROL SYSTEMAREAS OF CONCERN-ALL MAIN FEEDWATER LOST TO INTACT STEAM GENERATORS FOLLOWINGSMALL FEEDLINE RUPTURE-PRIMARY HOT LEG BOILING FOLLOWING FEEDLINE RUPTURE IAIN FEEIATER ONTROL SYSTEMVPOTENTIAL SOLUTIONSSHORT TERM-I1VESTIATE WHETHER MIN FEERAER CU'TROL SYSTEM WILL FAIL OROPERATE NORYA[LY WHEN EXPOSED TO ADVERSE EaVIRONIMnT-TAKE CREDIT FOR OPERATOR ACTION PRIOR TO ALL SG'S REACHING LaW-LOWLEVEL TRIP SETPOINT FOLLOWlING Sf4PLL FEEDLINE RUPTURELONG TERN-ISOLATE FEENTER CONTROL SYSTEfl FROM THE ADVERSE DIVIRONPS'4RESULTING FRO)MPIPE RUPTURES IN OTHER LOOPS-REVISE LICENSING CRITERIA TO PERMIT BULK BOILING IN THE RCS PRIORTO TRANSIE4T ITURJ UTYI-INSTALL ON RETURN VALVE IN MAII FE MATER LINE INSIDE CONTAINfMENT.POSSIBILITY OF A SfTLL FEEDLINE RUPTURE INSIDE CONTAINEN-T BEPWEENCHECK VALVE AND STEAM GENERATOR REQUIRES QUALIFICATION OF STEAMFLOW TRMIS[ITTER TO PREVENT MVILFUXTI014 OF FEEUdATER COOTR0L SYSTEM PRESSURIZER POWER OPERATED RELIEF VALVE (PORV) CONTROL SYSTEM-FEEDLINE RUPTURE OCCURS IN MAIN FEEDLINE INSIDE CONTAINMENT BETWEENSTEAM GENERATOR NOZZLE AND CONTAINMENT PENETRATION-MAIN FEEDWATER SPILLS OUT RUPTURE-SECONDARY INVENTORY SPILLS INTO CONTAINMENT THROUGH RUPTURED FEEDLINE-REACTOR TRIP OCCURS ON LOW LOW STEAM GENERATOR WATER LEVEL IN RUPTUREDSTEAM GENERATOR-AUXILIARY FEEDWATER PUMPS INITIATED ON LOW LOW STEAM GENERATOR WATERLEVEL. TURBINE TRIP OCCURS ON REACTOR TRIP-ADVERSE ENVIRONMENT INSIDE CONITAI.NMENT IMPACTS PRESSURIZER PORVCONTROL SYSTEM POTENTIALLY CAUSING THE VALVES TO INADVERTENTLY OPEN OP.FAIL TO CLOSE DUE TO AN ENVIRONXENT CONSEQUENTIAL FAILURE-PRIMARY PRESSURE DECREASES DUE TO STUCK OPEN PRESSURIZER PORV'S-HOT LEG BOILING COMMENCES-TIME OF OPERATOR ACTION TO MANUALLY CLOSE BLOCK VALVES INPRESSURIZER PORV RELIEF LINES DETERMINES SEVERITY OF ACCIDENTRESULTS PRESSURIZER POW CONTROL SYSIENASSUWTIOrNS:FEEDLINE RUPTUIE OCCURS INSIDE JNTAINTEK* WORST SINGE ACTIVE FAILURE ASSUPED IS SAFEGARDS TRAIN-o FSAR INITIAL CONDITIONSo AWERE ENVIRONM3fT IPPACTS PRESSURIZER POW CONTRDL SYSTEMRESULTING IN CONSEQUElUTIAL FAILUREo PRESSURIZER POW CONTROL SYSTEM DIRECTS RELIEF VALVES TO METO OPE1 POSITIONOPERATOR ACTIOI NOT ASSUE FOR AT LEAST 20 MINWES PRESSURIZER PORVCAN AFFECT SINGLELOCATION PORV'S FAILUREFSAR INITIALCONDITIONSCONSEQUENTIALFAILUREFAILURE OPERATORDIRECTION ACTION>20 MIN.OPENYESYES1 SAFEGUARDSTRAINYESNONEINSIDE((NOFEEDLINEOUTSIDECONTAINMENT
'-3oPRESSURIZER POWER OPERATED RELIEF VALVE CONTROL SYSTEMAREAS OF CONCERN-CONTROL SYSTEM ENVIRONMENTAL FAILURE CAUSES SMALL LOCA INSTEAM SPACE Of PRESSURIZER DUE TO SECONDARY HIGH ENERGY LINERUPTURE-HOT LEG BOILING OCCURS FOLLOWING FEEDLINE RUPTURE PRESSURIZER PORV CO[fL SYSIEJEUPTENTIAL SOLUTIONSSHORT TERMo INVESTIGATE WHETHER PRESSURIZER ORV CONTROL SYSTEM WILL FAIL OROPERATE NORW4-LY WHEN E*OSED TO ADVERE ENIFROttET.o M)DIFY OPERATING INSTRUCTIOlSOF A CONSEQUENTIAL FAILURE IllCAUSED BY ADVERSE ENVIRONJ19IT.RELIEF LINES.TO ALERT OPERATOR TO THE POSSIBILITYTHE PRESSURIZER PORV CONTRL SYSTEMIF EVIDENT, CLOSE BLOCK VALVES INLONG TERMo REDESION PRESENT CONTROL SYSTEM TO WITHSTA ifr4ICIPATEDEW I ROI 4PENT* INSTALL M)V IN SERIES WITH EXISTING MVN BLOCK VALVE.INSTALL PR[TECTION GRADE CIRCUITRY TO CLOSE VALVESFOL[DWING ADVERSE CONTAINMY ENTVIRONf4NT.* INSTALl TWO SAFEIY 90XE SOL840ID VALVES ON EACH PORVTO VENT AIR ON SIGIAL FROM PROTECTION SYSTEM.o UPGRADE CONTROL LOGIC, M)V BLOCK VALVE AND SOLENOIDOPERATOR TO CLOSE FOLLOWING ADVERSE CONTAINI'ENTENVI RUNMX&.
iONiIKWL ?-SIG\AL FotwCONRL SYSTLmCON-MOLGRADE A IRSUPPLYAFEIY.VALVESELE.aCTRICALLY CONQ LEDSOLENOID OPE:.'7.O S 33SAR INTERMEDIATE STEAMLINE RUPTURE EVENT-INTERMEDIATE STEAMLINE RUPTURE OCCURS UPSTREAM OF MAIN STEAMLINEISOLATION VALVES-COLD LEG TEMPERATURE GRADUALLY DECREASES DUE TO APPARENTEXCESSIVE LOAD INCREASE-NUCLEAR POWER INCREASES DUE TO MODERATOR FEEDBACK COEFFICIENTS(ASSUMES EOL CORE CONDITIONS)-REACTOR TRIP OCCURS ON OVERPOWER DELTA-T FUNCTION-TURBINE TRIP OCCURS DUE TO REACTOR TRIP-STEAMLINE ISOLATION OCCURS AUTOMATICALLY OR MANUALLY CLOSED-RUPTURED STEAMLINE BLOWS DOWN TO CONTAINMENT PRESSURE. STEAMLINESIN ISOLATED LOOPS EXPERIENCE SLIGHT INCREASE IN PRESSURE WESTINGHOUSE PROPRIETARY CLASS 2341.2000-_ 1.0000A: 4= .80000La CD .60000° .200000.01.200'1.0001La° .8000I.6000iLU"D < o.c4000.2000(0.02500. 02000.0X 1000.00Z 0.0tj -1000.0La= -2000.0-2500.0500.0004o. O0300.00L0g100.000.0-0033))I I II I I I0- A C 0) 6 0CD C 0~ =0 00; c 0o o6int:00040euTIME (SEC)FIGURE 3.2-4-TIME DEPENDENT PARAMETERS 3 LOOP, 100%POWER BREAK AREA -0.22 FT2 3sPWESTINGHOUSE PROPRIETARY CLASS 2600. 00't 550.00e- 500.00I- 450.00E ta 400 0> 35000ec 300.00M50.00600.00a. 550 00.2 1500.00LWJIA.> 450.00oc v-., 400.00.ao 350. 00300.00250.00I i i 4 I i I II I I i i IL: LiCcJ LMi> >0-1400.01z50.01000.00750. 00500. 00250.000.01t I I-I.i -IIi III.-- -i i I -.t_-i i .Ii iii2500.0Z250.0m 2000.0Qn _ 1750.0x _; 1500.0,f a-fi t250.0a: 1000.00750.00500.00O > C > CD r }o .W .0o vi -_o5 oo uvi00CDCoTIME (SEC)FIGURE 3.2-5 -TIME DEPENDENT PARAMETERS 2 LOOP, 10000POWER BREAK AREA = 0.22 FT 36WESTINGHOUSE PROPRIETARY CLASS 2.4AeCA. i~LI1.0-0ox<e =-IN SW~ CD..80000.60000.4A0oMo0000.01100.01000.00900.00vi 4,800.00Lj 700.00< GM0.00SWD. 00200.00ft00.00?00.00100.003.5000Li 3.0000e 2.500029 LA. 1.5000.50000n nI I 1 I I7I II r -I- I i F.i I I I I 47 -V. w0il 4 MC 0C0O EJ
- o > o -OTI£E (SEC)FIGURE 3.2-6 -TIME DEPENDENT PARAMETERS 3 LOOP, 100-POWER BREAK AREA = 0.22 FT2 37ROD CONTROL SYSTEM-INTERMEDIATE STEAMLINE RUPTURE (0.1 TO 0.25 SQUARE FEET PER LOOPFROM 70 TO 100 PERCENT POWER) OCCURS INSIDE CONTAINMENT-ROD CONTROL SYSTEM IN AUTOMATIC MODE-ADVERSE ENVIRONMENT FROM STEAMLINE RUPTURE IMPACTS EXCORE DETECTORSAND ASSOCIATED CABLING-ENVIRONMENTAL CONSEQUENTIAL FAILURE OCCURS IN ROD CONTROL SYSTEMWHICH CAUSES CONTROL RODS TO BEGIN STEPPING OUT PRIOR TO REACTOR TRIP-MINIMUM DNBR FALLS BELOW 1.30 (GREATER THAN 1.1) PRIOR TO A REACTORTRIP ON OVERPOWER DELTA-T FUNCTION WHICH EXCEEDS LICENSING CRITERIAIN MANY SAFETY ANALYSIS REPORTS 31ROD CONTROL SYSTEMASSUMPTIONS-INTERMEDIATE STEAMLINE RUPTURE OCCURS INSIDE CONTAINMENT-ADVERSE ENVIRONMENT IMPACTS ROD CONTROL SYSTEM COMPONENTSPRIOR TO REACTOR TRIP-WORST SINGLE ACTIVE FAILURE ASSUMED IS SAFEGUARDS tRAIN-FSAR INITIAL CONDITIONS-ADVERSE ENVIRONMENT IMPACTS ROD CONTROL SYSTEM RESULTINGIN CONSEQUENTIAL FAILURE-ROD CONTROL SYSTEM DIRECTS CONTROL RODS TO WITHDRAWAL ROD CONTROL SYSTEMCAN AFFECTSYSTEM PRIORTO TRIPSIZE LOCATION < 2 MIN.SINGLEFAILUREFSAR INITIALCONDITIONSCONSEQUENTIALFAILUREFAILURE RESULTS.FSAR BASE[RODS FAILRODS OUTYESPBF RESULTSINDICATE NORODS IN FAILUREYES1 NO1 SAFEGUARDS(TRAINYESNOINSIDECONTAINMENTNOSMALL TOINTERMEDIATI NOOUTSIDECONTAINMENTSTEAMBREAKLARGE
-' -40ROD CONTROL SYSTEMAREAS OF CONCERN-CONTROL ROD WITHDRAWAL DUE TO CONTROL SYSTEM ENVIRONMENTALCONSEQUENTIAL FAILURE (POWER RANGE EXCORE DETECTOR ANDASSOCIATED CABLING)-MINIMUM DNBR FALLS BELOW 1.30 PRIOR TO REACTOR TRIP 41ROD CONTROL SYSTEMPOTENTIAL SOLUTIONSSHORT TERMDETERMINE IF THE ADVERSE ENVIRONMENT CAN IMPACT EXCORE DETECTORS ANDASSOCIATED CABLING PRIOR TO REACTOR TRIP FOLLOWING INTERMEDIATE STEAMLINERUPTURE.-REMOVE NIS SIGNAL FROM POWER MISMATCH CIRCUIT IN ROD CONTROL SYSTEM(PROCESS CONTROL CABINET)-EMPLOY MANUAL ROD CONTROLLONG TERM-USE CONTAINMENT PRESSURE TRIP AND QUALIFY EXCORE DETECTOR TO LESSSEVERE ENVIRONMENT (ALSO REQUIRES QUALIFYING CABLING FROM DETECTORTO PENETRATION)-QUALIFY EXCORE DETECTOR TO STEAMLINE BREAK ENVIRONMENT 4200F CURVEALSO REQUIRES QUALIFYING CONNECTION AND CABLING FROM EXCORE DETECTORTO PENETRATION EXCORENUCLEAR -POWERTURBINEPOWERREFERENCETAVG -MEASUREDTAVG -POWER MISMATCHIMPULSE(TO RODSPEEDCONTROLLERCOMPENSATED TAVGERRORROD CONTROL SYSTEMSIMPLIFIED SCHEMATIC
"-IENCIOSURE 3MEETING ATTENDEESNRCD. RossT. NovakG. KuzmyczS. Lea1sD. Tondiw. JensenJ. GuttmannJ. M~zetisS. IsraelC. Berl1ngerZ. RosztQczyF. OrrJ. HeltemesJ. RosenthalM. CliramalJ. JoyceR. SchollT. DunningJ. BurdoinR. WoodruffS. SalahK. MahanH. RoodD. ThatcherB. MorrisS. SandsT. HoughtonD. TibbittsR. ReilG. LainasE. ConnerP. NorianR. DaigleCo BrintnanW. B~jrchillJ. westhayenC. Kl1ngP. DelozierC. Faust WestinghouseR. Borsum i B&WN. Shirley -GEG. Llebler -Fla. P&L Co.R. Marusich -Consumers Power Co.R. Kacich -Northeast UtilitiesJ. Regan -Northeast UtilitiesR. Olson Baltimore G&E Co.H. O'Brien -TVAR. Harris NUSCOG. Falibota -BechtelE. Inge , ACRSP. Higgins -AIFR. Leyse -EPRI ENCLOSURE 4ACTION PROCESS FOR I&E INFORMATION NOTICE NO. 79-02* IDENTIFY THOSE NON-SAFETY RELATED CONTROL SYSTEMS(BOTH INSIDE & OUTSIDE CONTAINMENT) WHOSE MAL-FUNCTION COULD ADVERSELY AFFECT THE ACCIDENT ORTRANSIENT WHEN SUBJECTED TO ADVERSE ENVIRONMENTCAUSED BY A HIGH ENERGY PIPE BREAK!* DETERMINE THE LIMITING MALFUNCTIONS DURING HIGHENERGY PIPE BREAKS FOR THOSE CONTROL SYSTEMS.* DETERMINE THE IMPACT OF THE MALFUNCTION OF THOSESYSTEMS.* DETERMINE SHORT TERM ACTIONS IF NECESSARY.* DETERMINE LONG TERM ACTIONS IF NECESSAR ENCLOSURE 5MEETING ATTENDEES 9/20/79AMNRCD. RossT. NovakG. KuzmyczR. CapraS. LewisD. TondiT. DunningZ. RosztoczyW. JensenJ. MazetisS. IsraelJ. RosenthalM. FairtileJ. S. CkesumalM. CleramalR. SchollJ. BeardJ. JoyceD. ThatcherD. DiIanniG. LainasB. MorrisS. DtAbR. Leipe -EPRIP. Higgins -AIFT. Martin NUTECHE. Roy -BechtelT. Reitz -G/C Inc.E. Weiss -Union Concerned ScientistsR. Pollard -UCS1&WR. BorsumJ- TvylorH. RoyE. KaneS. EschbachB. ShortM. BonaeAG. BrAzillB. KarraselR. WrightD. HallmanB. Day -Brown BoveriReaktorbauC. Faust -WestinghouseL. Stalter -Toledo EdisonF. Miller -Toledo EdisonT. Myers -Toledo EdisonR. Gill -Duke PowerT. McMeekin -Duke PowerP. Abraham -Duke PowerK. Canady -Duke PowerR. Dieterich -SMUDE. Good -FPCB. Simpson -FPCC. Hartman Met EdP. Trimble -Arkansas P&LR. Hamn -Consumer P. C ENCLOSURE 6UT I L I T Y / B &W P RO G RAME VAL UAT E I MPACBAS I S ACC I DE N TC 0 N S E Q U E N T I A LE F FE CTS ON NONS Y S T E M S.T O N L I C E'N S I N GANAL YS E S DU EE N V I R O N M E N T A L-S A F E T Y G R A D ET OC O N T R O LI DE N T I F Y L I C E N S I N G BAS I SAC C IDE NTS WH I CH CAUS E ANADVE RS E E N V I RONME NT FO REACH P LANT.D E F I N E S A F E T Y A N A L Y S I SI N P UT S AN D RE S P O N S E SU S E D D U R I N G L I C E N S I N GB A S I S A C C I D E N T S.V E R I F Y S A F E T YCON CL US I ON S O RACT I ONS J U S T I FC O N T I NU E D O P E RANAL YRE COY I N GS I SM M E N DA T I 0 ENCLOSURE 7MEETING ATTENDEES 9/20/79PMNRCD.T.G.R.D.T.D.J.C.D.R.W.T.V.J.W.J.J.T.G.P.RossNovakKuzmyczFrahmTondiDunningLynchJoyceDeBevecThatcherSchollHodgesIppolItoRooneyRosenthalJensenGuttmanHannonKevenLainasNorianN. ShirleyL. YoungborgJ. ClevelandC. SawyerP. MarriottL. GiffordD. Rawlins -WC. Faust -WR. Borsum -&WT.W.C.G.T.J.T.L.J.S.J.R.L.C.R.R.M.V.Rogers -Pacific Gas & Elec.Mindich Phil. El. ColCowan -Phil. El. Co.Edwards -Phil. El. Co.Scull Phil .E1. Co.Knubel -JCP&L Co.Tipton -JCP & L Co.Rucker -Boston Ed.Vorees -Boston Ed.Maloary -Boston Ed.Sheppard -CPCo.Hoston -CPCo.Mathews -Southern Co. ServicesVerprek -PSE&GRajoram -PASNYRogers -TVAWiesburg -TVABgnum -TVAC. Feltman -BechtelM. David -BechtelT. Martin -NUTECHP. Higging -AIF Mr. Robert H. Groce 50-29ccMr. Lawrence E. Minnick, PresidentYankee Atomic Electric Company20 Turnpike RoadWestboro, Massachusetts 01581Greenfield Community College1 College DriveGreenfield, Massachusetts 01301