ML051610268
| ML051610268 | |
| Person / Time | |
|---|---|
| Site: | Kewaunee  |
| Issue date: | 06/10/2005 |
| From: | Nuclear Management Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| NRC-05-072 | |
| Download: ML051610268 (33) | |
Text
ENCLOSURE 1 NUCLEAR MANAGEMENT COMPANY, LLC NMC RESPONSE TO NRC STAFFS' REQUEST FOR ADDITIONAL INFORMATION REGARDING EVALUATION OF LICENSE AMENDMENT REQUEST 213 TO KEWAUNEE NUCLEAR POWER PLANT, OPERATING LICENSE NO. DPR-43 DOCKET NO. 50-305 Electrical and Instrumentation Control Branch (EEIB)
Questions NRC Question #1:
Please discuss how you intend to determine the operability of the proposed auxiliary feedwater (AFW) suction trip.
NMC Response:
Initial operability of the suction trip is determined by the successful completion of post modification testing including in-field calibrations, circuit functional testing and AFW pump operating tests. The calibration procedures verify that the pressure switches and time delay relays operate within their specified setpoints and tolerances. The functional tests verify that the circuits operate as designed and trip the associated equipment. The AFW pump operating tests start individual and multiple pumps simultaneously to ensure that the pumps operate as designed. Please refer to the response for Plant Systems Branch (SPLB) Question #1 for additional information.
Operability on an ongoing basis for the AFW suction pressure trip is based on the Technical Specification (TS) requirements for surveillance testing of the suction pressure trip. These TS surveillance requirements were provided in license amendment request (LAR) 213, enclosures two and three.
NRC Question #2:
Is the proposed AFW suction trip a Limiting Safety System Setting (LSSS)?
Please justify your answer. If the proposed AFW suction trip is a LSSS, please answer question 3 below.
NMC Response:
Kewaunee's Nuclear Power Plant (KNPP) TS defines a LSSS as setpoints for automatic protective devices responsive to the variables on which Safety Limits have been placed.
These setpoints are so chosen that automatic protective actions will correct the most severe, anticipated abnormal situation so that a Safety Limit is not exceeded. KNPP TS also defines Safety Limits as the necessary quantitative restrictions placed upon those process variables that must be controlled in order to reasonably protect the integrity of certain physical barriers which guard against the uncontrolled release of radioactivity.
Page 1 of 33
The KNPP TS lists two Safety Limits, Reactor Core and Reactor Coolant System Pressure. The low suction pressure trip circuits are not designed to correct a severe anticipated abnormal situation so that a Safety Limit is not exceeded, but to supply AFW pump protection on a loss of suction. Therefore, the low suction pressure trip does not meet the definition of a LSSS and no response is necessary to Question #3.
Although Nuclear Management Company, LLC (NMC) has determined the low suction pressure trip circuitry is not a LSSS; the setpoints methodology is discussed in NMC's response to EElB Question #5.
NRC Question #3:
The standard technical specifications Bases define a Limiting Safety System Setting (LSSS) as an allowable value (AV). During reviews of proposed license amendments that contain changes to LSSS setpoints, the NRC staff identified concerns regarding the method used by some licensees to determine the AVs.
AVs are identified in the TSs as LSSS to provide acceptance criteria for determination of instrument channel operability during periodic surveillance testing. The NRC staff's concern relates to one of the three methods for determining the AV as described in the Instrument Society of America (ISA) recommended practice ISA-RP67.04-1994, Part II, "Methodologies for Determination of Setpoints for Nuclear Safety-Related Instrumentation."
The NRC staff has determined that to ensure a plant will operate in accordance with the assumptions upon which the plant safety analyses have been based, additional information is required regardless of the methodology used to establish LSSS values in TSs. Details about the NRC staff's concerns are available on the NRC's public website under the Agencywide Documents Access Management System Accession Numbers ML041690604, ML041810346, and ML050670025.
In order for the NRC staff to assess the acceptability of your May 5,2005, license amendment request related to this issue, the NRC staff requests the following additional information:
- b. In discussing the methodology used, address the following questions regarding the use of the methodology:
(1) Discuss how the methodology and controls you have in place ensure that the analytical limit (AL) associated with an LSSS will not be exceeded (the AL is a surrogate that ensures the safety limits will not be exceeded). Include in your discussion information on the controls you employ to ensure the trip setpoint established after completing periodic surveillances satisfies your methodology. If the controls are located in a document other than the TSs, discuss how those controls satisfy the requirements of 10 CFR 50.36.
Page 2 of 33
(2) Discuss how the TS surveillances ensure the operability of the instrument channel. This should include a discussion on how the surveillance test results relate to the technical specification AV and describe how these are used to determine the operability of the instrument channel. If the requirements for determining operability of the LSSS instrument being tested are in a document other than the TSs (e.g., plant test procedure), discuss how this meets the requirements of 10 CFR 50.36.
- c. In discussing the methodology, the following explicit regulatory commitments and proposed TS changes are requested by the NRC staff to complete its review of the methodology:
(1) To adopt the final Technical Specification Task Force (TSTF) TS changes adopted by NRC for plant TSs to come into conformance with the requirements of 10 CFR 50.36 for LSSS.
(2) To assess the operability of tested instrumentation based on the previous as-left instrument setting and accounting for the uncertainties associated with the test or calibration.
(3) To revise the TSs for the LSSS being changed by the license amendment request to incorporate a footnote in the TSs that states:
"The as-left instrument setting shall be returned to a setting within the tolerance band of the trip setpoint established to protect the safety limit."
NMC Response:
The response to Question #2 stated that the suction trip setpoints are not a LSSS.
Therefore, no response to Question #3 is required. However, it should be noted that Method #3 of ISA-RP67.04-1994 was not used in the development of the suction pressure trip setpoints. Please refer to the response to EElB Question #5 for additional information describing the setpoints methodology used.
NRC Question #4:
Plant analyses have demonstrated that the suction pressure trip combined with an additional suction water volume protect the AFW pumps by sensing loss of suction, tripping the associated AFW pump, and providing sufficient reserve water volume to allow the AFW pump to coast to a stop, thus preventing AFW pump damage. Is there a check valve or isolation valve between the Class 1 section and the non-Class 1 section of the suction piping to prevent loss of the reserve water volume through the non-Class 1 pipe break?
Page 3 of 33
NMC Response:
The following is a simplified elevation view of a portion of the condensate storage tank (CST) supply piping showing the Class I to non-Class I location at the Class I wall between the Auxiliary Building and Turbine Building.
ELEVATION OF TRIP SETPOINT AUXILIARY BUILDING TURBINE BUILDING I
PRESSURE TAP ELEVATTON ELEVATION OF MAXIMUM PROTECTED VOLUME CREDITED Figure 1 - Partial Elevation View of CST Supply Piping Non-Class I water supply from the CST is provided through the Turbine Building into the Class I piping within the Auxiliary Building. As shown above, the suction trip setpoints are established above the credited protected volume. No check valve or isolation valve is required to prevent a loss of fluid from the protected volume from a non-Class I break due to the difference in elevation. If there was a complete failure of the non-Class I piping, the break location remains at a higher elevation than the protected volume and the protected volume remains unaffected. Additionally, should the failure of the non-Class I piping occur, the suction pressure trip switches would sense the loss of CST supply head pressure and function to protect the pumps as designed. Therefore, there is no functional need for a check valve or isolation valve between the Class I section and the non-Class I section of the suction piping to prevent loss of the protected water volume through the non-Class I pipe break or to ensure the function of the suction pressure switches.
NRC Question #5:
The setpoint for the suction pressure trip should account for the piping pressure drop between the suction pressure switch location and the pump.
Since there are check valves in the piping between the two locations, the verification of the trip setpoint and the pressure drop would identify any check valve problems, too. Provide the setpoint calculation documentation of the auxiliary feedwater pump suction pressure trip channels and the auxiliary Page 4 of 33
feedwater pump runout protection (discharge pressure) channels for staff review.
NMC Response:
Setpoints Methodology The Kewaunee setpoints methodology is controlled under the Design Control process as described in plant procedures NAD-04.06, "Plant Setpoints Accuracy," and GNP-04.06.01, "Plant Setpoints Accuracy Calculation, Review and Approval Procedure." The basic methodology that is used in developing decreasing process setpoints is summarized from the procedures as follows:
- 1. Determine the Total Loop Error (TLE); The TLE is the Square Root Sum of the Squares (SRSS) of the measured and unmeasured uncertainties.
- 2. Determine the Nominal Trip Setpoints (NTSP); For a decreasing setpoints the NTSP is determined by adding the TLE to the Analytical Limit (AL) or Process Limit (PL).
NTSP = AUPL + TLE
- 3. Determine the Loop Drift (LD); The LD is the SRSS of the measured uncertainties.
- 4. Determine the Actual Plant Setting (APS); The minimum plant setting is determined by adding the LD to the NTSP. In most cases there will also be some Margin (M) added.
- 5. Determine the Setting Tolerance (ST) or As Left Tolerance (ALT); The STIALT is normally the same as the accuracy of the instrument or device.
- 6. Determine the Loop Allowable Value (AV) or As Found Limit (AFL); For the loop AVIAFL, the LD is subtracted from the APS.
AVIAFL = APS - LD
- 7. Determine the lnstrument Drift (ID); The ID is the SRSS of the measured uncertainties associated with a particular instrument or device.
- 8. Determine the lnstrument AS Found Limit (AFL); The instrument AFL is the calibration point of interest Desired Value (DV) plus or minus the ID. (Note: in this case, DV equals A PS)
AFL = DV +/- ID Page 5 of 33
- 9. Since instruments are calibrated individually, the instrument AFL can be used as the point at which, if exceeded, an operability determination must be made. If the STIALT is exceeded the instrument must be adjusted to within the STIALT.
Low Suction Pressure Trip The instrument piping taps for the AFW pump suction switches are located more than 100 feet upstream of the suction check valves for the AFW pumps and more than six feet above the suction piping where the check valves are located. Therefore, the suction pressure trip switch will not sense any pressure changes at the location of the AFW pump suction check valves.
The calculation accounts for the difference in elevation between the tap and the switch.
The elevation difference between the AFW pump inlet suction and the suction pressure tap is approximately seven feet. The elevation difference between the bottom of the protected water volume and AFW pump inlet is approximately five feet.
The process limit is above the volume of water designated to provide a sufficient amount of water to prevent a loss of suction caused by a failure of the non-Class I portion of the CST supply piping to the AFW pumps. The CST supply piping enters the Class I Auxiliary Building and then drops approximately one foot to the start of the protected volume as shown in Figure 1. The instrument taps for the low suction pressure switches are approximately 0.5 feet above the top of the designated protected volume of water. Since the tap location and water level corresponding to the suction pressure trip setting are above the Class I protected volume an adequate supply of water to the AFW pumps following the trip is ensured.
The AFW pumps are capable of operating with their suction pressure sub-atmospheric.
Operating in sub-atmospheric conditions has the potential to damage the AFW pumps due to a loss of seal leak off which lubricates and cools the pump's packing. This setpoint ensures the AFW pump suction pressure is equal to or greater than atmospheric pressure, preventing any potential pump damage under sub-atmospheric suction conditions. Because of the need to prevent the pump suction pressure from becoming sub-atmospheric, the process limit of the suction pressure trip at the location of the suction pressure trip tap is 5.8 psig. This setpoints bounds the setpoints required to protect the pumps from a loss of the normal suction supply., "AFW Suction Pressure Trip Setpoint Determination," depicts the method and parameters used to determine the setpoints for the AFW pump low suction pressure trip. The specific parameters are presented for illustrative purposes only and may change using the KNPP approved methodology.
Low Discharge Pressure Trip For the discharge pressure switch setpoints, two-pump operation at run out was considered the worst-case operation. Two-pump operation at run out was considered because it presented a scenario where a single failure of a protective device would allow two pumps to operate (one motor driven pump and turbine driven pump) for up to 105 seconds. Under this scenario, two pumps could operate for up to 105 seconds in a Page 6 of 33
main steam line break (MSLB) with a loss of offsite power event until the turbine driven AFW pump trips off by full closure of its steam admission valve.
The starting point for establishing the discharge pressure trip setpoints is the Total Developed Head Shop Test AFW pump curve (see Figure 2). The calculated net positive suction head available (NPSHA) curve is laid onto the pump curve. The intersection of the NPSHA and net positive suction head required (NPSHR) curves establishes the maximum flow for which the pumps can operate without being subject to cavitation.
The pump manufacturer has indicated that once cavitation begins, the pump should not be operated beyond ten percent from the Total Developed Head Shop Test curve. The points where the maximum flow intersects with the Total Developed Head Shop Test curve and the Total Developed Head ten percent degraded curve establishes the upper and lower pressure (head) setpoints band. The AFW pump discharge pressure associated with the point halfway between the Total Developed Head Shop Test curve and the Total Developed Head ten percent Degraded curve is chosen to be the corresponding low discharge pressure trip process limit. The process limit is then used in the setpoints determination as described below. The low process limit value was determined to be 853 psig., "AFW Discharge Pressure Trip Setpoints Determination," depicts the method and parameters used to determine the setpoint for the AFW pump low discharge pressure trip. The specific parameters are presented for illustrative purposes only and may change using the KNPP approved methodology.
NRC Question #6:
What interlocks are provided to prevent lockout of the motor-driven AFW pumps when the automatic start signals and the low pressure trip signals coincide? What interlocks are provided for switch-over from condensate water tank water source to the safety class service water source such that the pump trip signal will not interrupt the AFW pump operation. Provide detailed drawings of these interlock designs.
NMC Response:
There are no automatic interlocks provided to prevent lockout of the AFW pumps when the automatic start signals and the low suction pressure trip signals coincide. The AFW pumps will not start if there is a suction pressure trip signal as shown in Enclosure 3.
Automatic interlocks to prevent a lockout of the AFW pumps from a coincident automatic start and trip signal are not designed into the protection system because each pump train is protected by a dedicated low suction pressure and low discharge pressure set of switches. Therefore, this design is not susceptible to a lockout of all AFW pumps from a common mode failure of a multiple signal logic scheme.
There are, however, two manual methods of aligning the circuit to allow starting the pump if a suction pressure trip exists. 1) Locally, bypassing the circuit by positioning the NormalIBypass switch to the "BYPASS" position, then from the Control Room Page 7 of 33
position the control switch to "STOP" (this resets the time delay relay and allows the pump to be started). 2) Positioning the Service Water (SW) supply motor operated valve (MOV) control switch to "OPEN" aligning the SW supply to the associated AFW pump. When the MOV is fully open, the suction pressure trip circuit is defeated. Then, from the Control Room, position the control switch to "STOP" (this resets the time delay relay and allows the pump to be started). In either case, once the control switch has been positioned to the "STOP" position, the AFW pump can be started by placing the control switch in the "START" position.
There are no interlocks provided to prevent lockout of the AFW pumps when the automatic start signals and the low discharge pressure trip signals coincide.
The discharge pressure trip time delay relay starts timing out as soon as a motor driven AFW pump is started due to the initial low discharge pressure. An additional 45 second time delay relay is included in the turbine driven AFW pump circuit to permit the steam admission valve to open and the turbine to come up to full speed. If the discharge pressure switch is already in a tripped condition, the time delay relay will start timing out as soon as the motor starts or the turbine 45-second time delay relay times out.
Discharge pressure increasing above the discharge pressure switch reset before the time delay relay times out will allow the AFW pump to continue running. If the time delay relay times out prior to the discharge pressure switch resetting, the AFW pump will trip. The discharge pressure time delay relays are set for five seconds.
If a discharge pressure trip condition exists, there is one method of aligning the circuit to allow starting the pump. 1) Locally, bypass the circuit by positioning the NormalIBypass switch to the "BYPASS" position, then from the Control Room, position the control switch to "STOP" (this resets the time delay relay and allows the pump to start). The AFW pump can now be started by placing the control switch in the "START position.
The " A AFW pump suction and discharge pressure trips can be defeated if the Dedicated Shutdown Panel (DSP) RemoteILocal switch is placed in the "LOCAL" position. This defeats both suction pressure and discharge pressure trip circuits and resets the trip relays at the same time. The " A AFW pump can then be started from the DSP. This is shown in Enclosure 3; however, DSP operation does not apply to the "B" or turbine driven (TD) AFW pumps suction and discharge pressure trip circuits.
Plant operating procedure E-0-06, "Fire in the Alternate Fire Zone," directs plant operation during conditions when the " A AFW pump is controlled from the DSP. E-0-06 is entered when a fire in the plant causes the inability to monitor or control major plant parameters from the Control Room that are necessary for safe shutdown of the plant.
When E-0-06 is entered, one of the Control Room operators is directed to the DSP to take control of those components controlled from the DSP, the "A" AFW pump being one of them. The first step performed at the DSP is to place all the "Local/Remote" switches to the "Local" position, thus defeating the " A AFW pump's suction and discharge pressure trips. Licensed operators are trained on the actions contained in E-0-06 in initial and continuing training, in the classroom, the simulator, and the plant.
Page 8 of 33
Both the AFW Pump discharge pressure indicators and the AFW Pump flow indicators have local and Control Room indication. The AFW flow indication meets the requirements of NUREG 0737, item II.E.1.2, part 2, as described in a letter from Wisconsin Public Service corporation) to the NRC, which was accepted by the NRC in a safety evaluation(*) dated March 14, 1983. The local discharge pressure and flow indicators are direct mechanical indicators and, as such, do not require any environmental qualifications. The electronic circuits for the Control Room indications are powered from BRD-115, a non-safeguards auxiliary cabinet with an uninterruptible power supply that includes a backup power supply from non-safeguards battery "DM and an alternate supply from safeguards motor control center which, in turn, are powered by Emergency Diesel Generator "B" if a loss of off-site power occurs.
KNPP was originally licensed to be in compliance with the Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, IEEE STD 279-1 968. As such, that standard's section 4.17 Manual Actuation only refers to having the means for manual initiation of protection system action. Additionally, failure in an automatic protection circuit shall not prevent the manual actuation of protective functions; and manual actuation shall require the operation of a minimum of equipment.
Regulatory Guide 1.62 and IEEE STD 279-1971, section 4.17 (Manual Initiation), go further in discussing manual initiation "at the system level," and specifically delineating the single failure requirements.
The protective action of ANV pump trip on low suction or low discharge pressure is intended and designed to provide protection to the individual pumps, at the component and train level, and not at the system level. As such, the manual initiation of protective action, to restart a pump with pump suction provided from a safety related source (i.e.,
service water), is also provided at the component and train level, to correspond to the pump trip protective actions.
Since each protective circuit is designed and installed as an independent and separate circuit, as a whole they meet the single failure criterion in that there is no single failure within the manual, automatic or common portions of the protection system that could prevent initiation of protective action by manual or automatic means. This requirement of Regulatory Guide 1.62 is met by this design.
As previously discussed, the manual protective system actuation uses the operation of a minimum of equipment. Opening the SW suction supply valve to the ANV, pump and taking the ANV pump control switch to STOP resets the low suction pressure trip. The AFW pump will then start by any automatic start signal or by manually starting the pump from the pump control switch in the main Control Room.
The plant protection system control circuits are designed to automatically start the ANV pumps when required. Means for manual initiation exist for each AFW pump. The change to the control circuitry to add an AFW pump low suction pressure trip does not impede the ability to meet the above requirements. The AFW pump suction pressure trip circuits protect the AFW pumps from a loss of normal water supply. Each AFW pump low suction pressure trip circuit is separate and independent from the others and will not cause any other AFW pump to trip.
Page 9 of 33
The manual methods of aligning a circuit to allow an AFW pump to start (i.e., placing the "Local/Bypass" switch to "Bypass" or opening the AFW pumps SW suction supply MOV) refer to actions that can be taken if an AFW pump tripped on low suction pressure and the AFW pump is required to be restarted. With the AFW pump tripped, operators can manually align the safety related water supply to the AFW pump from the Control Room to allow starting the associated pump. When the SW valve is fully open, the low suction pressure trip circuit is disabled. After the circuit is disabled, the trip relay must be reset from the associated Control Room AFW pump control switch. The AFW pump can then be started by any automatic start signal or by manually starting the pump. This circuit allows for automatic trip of the AFW pump on low suction pressure and manual restart of the pump after the trip relay is reset.
During manual actuation to provide protective action after a low suction pressure trip, a SW MOV supply valve contact is used to disable the low suction pressure trip signal when the safety related water source is aligned to the AFW pump. The normal configuration for the low suction pressure trip circuit is to protect the pump when the normal water supply is aligned. When the safety related water supply is aligned, the low suction pressure trip feature is not applicable and is not required. Control Room indication is provided when the AFW pump service water supply valve is open, and thus the low suction pressure protection is unneeded.
The local bypass switch in each AFW pump room may also be used under maintenance action to manually bypass the low suction pressure trip circuit when calibration or testing is being performed. When the switch is placed to bypass, an alarm in the Control Room alerts operators that the circuit is bypassed. There is an independent bypass switch for each AFW pump low suction pressure trip circuit. During the maintenance activities for each AFW pump, the suction pressure trip circuit is removed from service independent of the other AFW pumps' trip circuit and concurrently with its associated AFW pump's train.
Page 10 of 33
Operator Licensinq and Human Performance Section (IOHS)
Questions NRC Question #I :
For the steam generator tube rupture (SGTR) and main steam line break (MSLB) scenarios, what are the local operator actions as well as the Control Room operator's actions to address each scenario? What differences will there be in manipulating the AFW system locally and from the Control Room for both scenarios?
NMC Response:
The initial operator response is to diagnose the specific event that is in progress. All licensed operators are trained to diagnose the symptoms of SGTR and MSLB. For a MSLB, the symptoms are steam generator (SG) pressure decreasing in an uncontrolled manner, or any SG completely depressurized. For a SGTR, the symptoms include affected radiation monitor readings abnormal, any SG narrow range (NR) level increasing in an uncontrolled manner and SG NR level or SG feedwater (FW) flow response abnormal prior to a reactor trip. The actions necessary to isolate AFW to an affected SG are contained in multiple locations in the Integrated Plant Emergency Operating Procedure (IPEOP) network, including the E-0, "Reactor Trip or Safety Injection (E-0)," quick reference foldout page. E-0 is the standard entry point for the IPEOP network.
Regardless of the event location or type, a local operator is dispatched to the AFW Pumps upon entry into E-0, E-2, "Faulted SG Isolation," or E-3, "Steam Generator Tube Rupture." For a MSLB, the operator priorities are to verify the Main Steam Isolation Valve (MSIV) is closed for the affected SG, then systematically isolate the faulted SG from AFW by closing the Motor Driven (MD) AFW pump discharge throttle valves, AFW-2A or AFW-29, for the affected SG, followed by the AFW train cross-connect valves, AFW-1 OAIAFW-109, for the affected SG. The controllers and actuators for AFW-2A and AFW-29 are not safety related. If AFW-2A or AFW-29 were to fail open, the operator will stop any AFW pump feeding a faulted SG. The isolation sequence for a SGTR is similar except that the operator is directed to check ruptured SG NR level is on-scale, then stop feed flow to the ruptured SG.
The specific local operator action that may be required is to:
Locally throttle the manual discharge isolation valve (either AFW-3A for the " A MDAFW pump, AFW-39 for the "B" MD AFW pump, or AFW-2C for the TDAFW pump) as required to maintain the affected AFW pump discharge pressure above the low-pressure trip setpoints.
Page 11 of 33
This action would only be necessary during a MSLB or a SGTR that is coincident with a failure of one of the following:
Discharge valves AFW-2AlAFW-29 for the AFW Pump supplying the intact SG fails, A single active failure occurs that renders the MDAFW pump supplying the intact SG inoperable.
If any AFW pump has tripped due to low discharge pressure, the following sequence is initiated per A-FW-059, Abnormal Auxiliary Feedwater System Operation:
- 1. The operator will close the discharge valve (AFW-2A or -29) on the affected pump from the Control Room. This is the normal sequence for starting AFW.
- 2. If the valves in the first action cannot be closed remotely, the local operator previously dispatched will close and then open the associated manual discharge isolation valve (AFW-3A or -39) to a preset position. The discharge valves on the TDAFW pump cannot be throttled from the Control Room. If the TDAFW pump were needed, the local operator would be dispatched to close and then open the TDAFW pump's manual discharge isolation valve (AFW-2C) to a preset position.
- 3. Once the discharge valves on the affected AFW pumps have been throttled to the preset position by the manual discharge isolation valves, the Control Room operator will restart the required pump.
- 4. Following pump restart, the Control Room operator will adjust the appropriate discharge valves (AFW-2A and/or AFW-2B) or direct the local operator to throttle the local discharge isolation valves (AFW-3A and/or AFW-39) as necessary to establish desired AFW flow from the MDAFW pumps. If throttling of the TDAFW pump is necessary, the Control Room operator will direct the local operator to throttle the local discharge isolation valve (AFW-2C) as necessary to establish desired AFW flow. The procedure directs that AFW pump discharge pressure be maintained above the discharge pressure trip setpoints when re-establishing flow.
Effectively, there are no differences in the response of the AFW system due to the manipulation of the AFW system flow from the pump discharge valves (operated from the Control Room) or the pump manual discharge isolation valves (operated locally).
The flow of the AFW system is maintained as required in response to either the SGTR or the MSLB.
NRC Question #2:
On June 8,2005 during a telephone conference between the NRC (F. Lyon, et.
al) and KNPP (T ~ r e e 6,
et. ai), the NRC withdrew Human Factors ~uestion
- 2.
Page 12 of 33
NRC Question #3:
Provide the time validation data that addresses the length of time it takes for the operator to perform the requested AFW system manipulation activities locally for both SGTR and MSLB. Compare that time validation data to the times required to complete SGTR and MSLB activities in the current licensing and design-basis.
NMC response:
Methodology Operator time validations were performed in accordance with operations department instruction titled, "Emergency Operating Procedure Validation process." The process included development of scenarios on the simulator to obtain operator response times for MSLB and SGTR design basis events involving local manual operator actions. The scenarios were then performed in the simulator with an operating crew, and subsequently time validated local manual actions in the plant. The simulator validation method described in the instruction was selected for each of the four scenarios. The simulator method was used to more accurately demonstrate operator responses, identify discrepancies between procedures and Control Room hardware, and identify discrepancies between procedures and the operator's performance.
In order to determine the operator response time, the four scenarios were performed in the simulator. The scenarios included two MSLB events and two SGTR events. The initial events chosen were based on the design basis events described in Updated Safety Analysis Report (USAR) chapter 14. However, the event initial conditions and assumptions were modified to provide limiting cases from the perspective of local operator actions with respect to maintaining AFW pump operation.
The first MSLB time validation scenario assumed the plant was at beginning of cycle operating at 100 percent power with a break inside containment. In this scenario, the AFW pumps trip on low discharge pressure to prevent pump run out. In order to recover from the event, the intact SG needs to be restored as a heat sink to allow safety injection (SI) to be terminated. No credit was taken for proper operation of AFW-2A and AFW-2B, the AFW pump discharge flow control valves. Therefore, local action to throttle the AFW pump discharge valves, AFW-3A and AFW-3B, was required in order to restart the AFW pumps.
The second MSLB scenario assumed hot shutdown conditions. The MSLB occurred outside containment with a failure of a MSlV to close. The limiting break location is in the turbine building, since this creates an adverse environment and normal access to safeguards alley and the AFW pumps may not be possible. No credit was taken for proper operation of the AFW-2A and AFW-2B valves. As an additional challenge, no local operator action to throttle the discharge valves was credited. This was done to show the procedural guidance is adequate if the operators are unable to locally throttle the AFW pump discharge valves. Even though local operator action was not credited in this scenario, in order to support the turbine building MSLB event timing, diverse routes to the AFW pump room were timed and a limiting time was identified.
Page 13 of 33
For the SGTR, the first scenario began with the plant operating at 100 percent power. A failure of the ANV pump to the intact SG is assumed to occur, which requires local operator action to throttle the TDAFW pump discharge valve, AFW-2C, to maintain discharge pressure above the trip setpoints. SG pressures are expected to remain high enough to prevent the AFW pumps from initially tripping; however, during E-3 implementation, a rapid cooldown is required. During this rapid cooldown, the potential exists to reduce SG pressure sufficiently to cause the AFW pumps to trip if their discharge valves are not throttled. No credit was taken for proper operation of AFW-2A and AFW-2B. Therefore, local action is required to throttle the AFW pump discharge valves, AFW-3A and AFW-3B, to maintain the AFW pumps operating during cool down.
The second scenario assumed the plant was at hot shutdown conditions. Coincident with the SGTR was a loss of offsite power (LOOP). This scenario also assumed a failure of the motor-driven AFW pump for the intact SG, which results in use of the TDAFW pump to feed the intact SG. The SG water level in the intact SG remains within the NR level indication initially; however, during the rapid cooldown, SG pressure may decrease sufficiently to cause the TDAFW pump to trip if its discharge valve is not throttled. Therefore, local operation action to throttle the AFW pump discharge valves is required to ensure the intact SG remains a heat sink so SI can be terminated and break flow can be terminated.
Simulator scenario performance Three-man teams of licensed operators, including a senior reactor operator as the team leader in each session, conducted the scenarios. In addition, an operations instructor participated in development and execution of all four scenarios. The operators performed the scenarios using the proposed post-AFW modification IPEOPs. Each simulator scenario was timed starting at the initiation of the event and was stopped when the appropriate termination criteria were achieved. Significant events and procedure transitions were recorded.
Local operator actions Operator routes were determined based on the assumptions that the turbine building was inaccessible and the operator was at some remote location within their normal realm of responsibility. Safe paths were mapped and walked down prior to timing.
Each route timing included the route itself, the valve operation from full open to closed to 3/4 turn open, and the system response from pump start to delivering flow to the SG.
The time for the limiting route was approximately 8 minutes. Adding in a 50 percent margin (for any obstacles that may be encountered) of 4 minutes, the total time is approximately 12 minutes.
Main steam line break results For the MSLB event, the criteria to establish the intact SG as a heat sink, and terminate SI flow prior to requiring primary system bleed and feed. These criteria are based on plant specific conditions and are not time based. Entry into FR-H.1, "Response to Loss Page 14 of 33
of Secondary Heat Sink," may be required and is acceptable during the efforts to restore AFW flow to the intact SG.
For time validation of a MSLB inside containment the simulator scenario showed there was a limiting time of 6 minutes and 30 seconds, between dispatching an operator to the AFW pumps and the step to check if entry into FR-H.l was required. The time validation showed that it would take an operator approximately 6 minutes to reach the AFW pumps from a remote location and throttle the valves. In this scenario, all required criteria were met.
Performance of the second MSLB scenario showed approximately 12 minutes between the time the NAO was dispatched and the time SW was aligned to the AFW pumps per FR-H.l prior to the need to establish bleed and feed (complete loss of SG water inventory). Since the intact SG can be established as a heat sink, SI termination criteria are met and the operators are able to proceed with additional recovery actions. This demonstrates acceptable results for the scenario.
Steam Generator Tube Rupture results The design basis SGTR is the double-ended rupture of a single SG tube. The operator is required to terminate break flow within 49 minutes of event initiation. In order to terminate break flow, the intact SG must be established as a heat sink, and the Reactor Coolant System (RCS) must be cooled and depressurized.
In order to maintain AFW flow to the intact SG, the NAO needs to be available to throttle the ANV pump discharge valve prior to beginning the rapid cooldown per E-3. During the first SGTR scenario, there was 17 minutes and 1 second from the time the NAO was dispatched until the AFW discharge valves were directed to be throttled to maintain discharge pressure just prior to the rapid cooldown. During the second SGTR scenario, the time available was 16 minutes and 13 seconds. The bounding operator response time for the limiting route to ARN pump room of 7 minutes and 59 seconds (adding 4 minutes for a 50 percent margin totaling 11 minutes and 59 seconds) falls within the available time (actual operator response time is expected to be approximately 5 minutes and 53 seconds with an additional 50 percent margin totaling 8 minutes and 50 seconds where the normal access routes would be available). Both scenarios were completed within the required time of 49 minutes to terminate SGTR break flow. Therefore, the local operator action to throttle AFW pump discharge valves can be completed without having an effect on the ability to complete SI termination within the required time.
As an interim action, an operator will be maintained available outside of the turbine building to perform the local manual actions of throttling AFW pump discharge valves as required. This interim action will remain in place until the turbine building MSLB HELB study has been completed and demonstrates that interim action is no longer required.
NRC Question #4:
What additional activities (training, pre-briefs, walkthroughs, communications, etc.) will be incorporated with the implementation of the new operator actions?
What is the completion date for these additional activities?
Page 15 of 33
NMC Response:
All operators will attend training on the procedure changes required for this license amendment. In addition, simulator walkthroughs will be conducted for all licensed personnel. These walkthroughs will focus on the diagnosis and required operator actions related to MSLB and SGTR. Particular emphasis will be placed on the additional procedure steps required to maintain and/or restore AFW flow. All NAOs will be trained on the use of diverse pathways that may be required to access the AFW pumps in an accident situation. All qualified NAOs will also conduct walkthroughs of local actions that may be required to maintain or restore AFW flow. These walkthroughs will include use of any valve operators or other tools required to support the evolution. Support personnel, such as Radiation Protection Technicians and Security, will likewise be trained on the interfaces between their groups and Operations to support this task. All training requirements will be completed prior to exceeding 350°F in the RCS.
The potential requirement for manual operator actions has been entered into the KNPP Operator Workaround Program as a Priority One condition. This requires a summary of the condition at each pre-shift brief until the potential for manual actions has been removed. This action is currently in place and briefings are being conducted twice daily at pre-shift briefings.
Page 16 of 33
Plant Svstems Branch (SPLB) Questions NRC Question #I:
Please describe the worst-case scenario and assumptions that establish the basis for the low suction pressure trip setpoints, and explain how the actual values of the low suction pressure trip setpoints were arrived at for these postulated conditions. Also, please describe post-modification system flow tests that will be completed to confirm that the low suction pressure trip setpoints are adequate to: a) prevent damage to the auxiliary feedwater (AFW) pumps, and b) prevent undesirable AFW pump trips from occurring.
NMC Response:
One consideration for establishing the low suction pressure setpoints is based on a catastrophic failure of the non-Class I suction piping to the A W pumps. The CST supply to the AFW pumps is a common line and a failure of the non-Class I portion of this line could cause a common mode failure affecting all three AFW trains. The potential failure of the non-Class I piping is postulated to result in gaslair ingestion into the pumps, thus leading to gaslair binding and potential catastrophic failure of the AFW pumps. To protect the pumps, a Class I protected volume is being installed within the Auxiliary BuildingIClass I structure. This protected volume allows the pumps to coast down with adequate water volumelsupply to prevent airlgas ingestion. Upstream of the protected volume, train specific suction pressure trip switches are installed to trip the associated trains pump if a loss of non-Class I suction piping occurred. The suction pressure switches are actuated above the water levellvolume where the credited protected volume begins (See Figure 1). Based on the credited protected volume, the elevation difference of the protected volume with respect to the pumps suction location and the suction pressure switch setpoints, the suction pressure trip will adequately protect the AFW systemlpumps on a loss of the non-Class I AFW pump supply line.
The worst-case scenario for establishing the low suction pressure setpoints is for pump protection against sub-atmospheric conditions at the pump packing. See SPLB Question #4 for further details.
Please refer to the response to EElB Question #5 for the setpoints determination basis.
Post modification testing includes in-field calibrations, functional testing, and both individual and simultaneous AFW pump starts to ensure that the low suction pressure protective trip functions as required. Pump protection for low suction pressure conditions are verified by the calibration of the individual pressure switches and the performance of a functional test of the circuit. These actions ensure that the circuit and actuating equipment performs as designed. To ensure undesirable AFW pump trips do not occur, each individual pump will be tested. The station has completed testing of each individual MDAFW pump and a simultaneous start of the two MDAFW pumps at cold shutdown. The station will complete testing of the TDAFW pump and a simultaneous start of all three AFW pumps at hot shutdown conditions. This ensures Page 17 of 33
that the suction pressure trip circuits allow the pumps to start and operate through any suction pressure transient due to the simultaneous start up.
AFW system hydraulic analysis was completed and concluded that with SG pressures above approximately 650 psia, the pumps will not run out and trip off from low discharge pressure. All design basis events, except for the MSLB, result in SG pressures greater than 750 psia. This ensures there is adequate margin to prevent the pumps from tripping off.
For the MSLB event, the SG pressures may go below 650 psia. For pump operation, manual operator action is taken to isolate the faulted SG and throttle the A M pump flows. For the MDAFW pumps, the AFW-2A12B discharge control valve may be utilized, if available. For all pumps, the discharge isolation valves (AFW-3A, 3B and 2C) may be manually throttled at the associated pump. Post modification testing was performed to determine the initial throttle position for the AFW discharge valves prior to pump start.
This testing was completed with depressurized SGs. Utilizing depressurized SGs to determine the initial throttle position to maintain adequate discharge pressure is the limiting case to ensure the ARN pump will not trip off. There are no licensing basis events where KNPP would be feeding a totally depressurized SG for decay heat removal. The initial throttle position with a totally depressurized SG provided approximately 1,100 psig discharge pressure. With increased SG pressure, the pump discharge pressure will also increase. The initial throttling position determined by testing ensures there is adequate margin to prevent the pumps from tripping off. After the associated pump is started, the discharge valve is then throttled as required to feed the SGs to maintain levels.
The required worst case limiting safety analysis operational point for the ARN systemlpumps is to supply a minimum of 176 gpm of flow to the SGs. Each pump also has a small recirculation flow of up to approximately 60 gpm. At 240 gpm of flow, the discharge pressure the pump develops is greater than 1200 psig. The setpoints for the low discharge pressure switch is below 900 psig. This pressure differential gives over 300-psig margins for operation. When the operator is required to take local operator action, the initial point the operator is directed to place the valve is at greater than 1,000-psig pump discharge pressure. At 1,000 psig pump discharge pressure each AFW pump is capable of delivering greater than 280 gpm. Once the pump is started, the operators will further throttlelreduce flows to the SGs to maintain SG levels. As any event proceeds, the required AFW flow is reduced due to the exponential drop in decay heat.
NRC Question #2:
Low AFW pump suction pressure trips were not installed previously to provide the necessary protection for low net positive suction head because of sub-atmospheric conditions at the suctions of the AFW pumps and instead, low AFW pump discharge pressure trips were installed to provide the necessary protection. Please explain why the sub-atmospheric conditions that exist at the AFW pump suctions no longer pose a problem.
Page 18 of 33
NMC Response:
The discharge pressure switches will continue to be utilized for pump protection when inadequate NPSH is available. The AFW pumps are suction side flow limited due to the suction line losses, which causes inadequate available NPSH. The discharge pressure switch set points were increased to trip the pumps before they get into a suction limited run out condition. The following illustration provides a graphical representation of the methodology used to select the discharge pressure trip settings.
Figure 2 - Illustration of Pump Parameters Used for Discharge Pressure Setting Determination n
4 W
I L L 0
+
LL The method used to determine the flow rate at which the pumps are tripped was selected per calculation at a flow rate where available NPSH (NPSHA) equals required NPSH (NPSHR) for two pump operation, as shown in Figure 2. At this selected flow rate, the pump suction pressure is slightly above atmospheric pressure. Three-pump operation is not a factor because there would have to be multiple equipment failures to operate with more than two pumps operating in run out conditions, which is outside of licensing basis. This method is conservative because the only time multiple pumps may operate for any extended period of time in this flow range is on a faulted line or uncontrolled feeding of a depressurized SG. Due to the physical location of the suction pressure trip switches well upstream of the pumps' suction and tripping the pumps at a lower flow rate, the suction pressure losses affecting the suction pressure switch function are reduced. Therefore, sub-atmospheric conditions that existed at the ANV pumps' suction in the past that could impact the performance of the suction pressure switches no longer pose a problem.
TOTAL DEVELOPEO HEAD SHOP TEST
-FLOWRATE TO PROTECT PUMP NPSHA CALCULATED NPSHR SHOP TEST FLOW The affect of the additional piping is less than 0.5-psi pressure difference from the original system to the modified configuration at 260 gpm of flow per pump with three pump operation. This small difference in system resistance is minimal and does not significantly affect the total system performance or total system curve.
Page 19 of 33
NRC Question #3:
Please describe the worst-case scenario and assumptions that establish the basis for the additional AFW pump suction water volume that is being established, including confirmation that the Kewaunee design criteria for safety-related applications will be satisfied in all respects. Also, please describe post-modification system flow tests that will be completed to confirm that the water volume is adequate and that system flow instabilities will not occur.
NMC Response:
The worst-case scenario for a loss of suction supply to the AFW pumps is a catastrophic failure of the non-Class I suction piping with a coincident failure of an AFW Pump suction pressure switch trip circuit. The failure of the suction pressure trip circuit causes one AFW pump to continue to run after the suction-piping break while the other two pumps are coasting down normally. This scenario is the worst case scenario for AFW pump protection following the postulated suction side break since it maximizes the protected suction water volume flow rate and hence time to depletion of the protected water volume. The worst-case suction break scenario was used to establish the suction side required protected water volume.
The following assumptions were used in determining the required protected suction water volume for the worst-case suction side scenario. High AFW flow is assumed at a conservative value of 260 gpm per pump. The suction pressure trip actuation time and the AFW pump coast down time with consideration for the one AFW pump operating at high flow are included. Linear flow (260 gpm to 0 gpm) during pump coast down is assumed. Actual coast down flow is expected to drop off exponentially with time based on pump affinity laws, fluid flow characteristics, and the expected SG pressures which would cause the AFW pump discharge check valves to close once the speedlpump head is reduced. For additional conservatism, the installed protected suction volume of 688 gallons is larger than the calculated required volume of 499 gallons. The suction piping design also includes a loop seal downstream of the credited protective volume and upstream of the pump inlet suction header piping. The loop seal is installed to ensure the entire credited protected volume can be utilized to ensure that the AFW pumps will not ingest gaseslair to protect them from airlgas binding.
The development and the review of the design was in accordance with the KNPP modification process. As part of this process, design reviews ensured that applicable design criteria for safety related applications were incorporated into the design. No known exceptions to the design criteria were identified.
The testing to verify the system operation is conservative. Each individual pump trip circuit is calibrated and tested to ensure it will function properly. All protective circuits are tested for functionality in accordance with Generic Letter 96-01 requirements to ensure they will allow the pumps to operate in accident conditions and protect the pumps when required. Each individual pump will have a timed coast down test performed at bounding flow rates prior to declaring the pumps operable. The MDAFW Page 20 of 33
pumps were tested with low SG pressures. A simultaneous start of the two MDAIW pumps at cold shutdown and all three AFW pumps at hot shutdown conditions will be performed to ensure the suction pressure trip circuits allow the pumps to start and operate through a suction pressure transient due to the simultaneous start up. During pump startup or operation on a loss of CST supply water, system flow instabilities may occur. However, because the transient is short, the physical design ensures that the pumps will have an adequate water supply and will not ingest airlgas and remain protected.
NRC Question #4:
Please describe the worst-case scenario and assumptions that establish the basis for the low discharge pressure trip setpoints, and explain how the actual values of the low discharge pressure trip setpoints were arrived at for these postulated conditions. Also, please describe post-modification system flow tests that will be completed to confirm that the low discharge pressure trip setpoints are adequate to: a) prevent damage to the AFW pumps, and b) prevent undesirable AFW pump trips from occurring.
NMC Response:
The worst-case scenario for establishing the discharge pressure switch trip setpoints is at two pump operation with high AFW flow rates because the AFW system configuration is suction supply (NPSHA) limited. The NPSHA limiting condition is because the suction line has large pressure losses from the CST to the pumps relative to the NPSH required at higher flows to a depressurized SG. Please refer to the response to SPLB Question #2 for additional information and assumptions that establish the basis for the low discharge pressure trip setpoints. Also, please refer to the response to EElB Question #5 for the setpoints determination methodology.
The post modification testing includes in-field calibration of the discharge pressure switches, a functional test of each low discharge pressure trip switch loop, and flow tests of each pump. The normal equipment operability surveillance for each pump is completed to ensure it can meet the performance requirements, and includes an actual verification the operator can position and throttle the discharge isolation valves under depressurized SG conditions on the MDAFW pumps. During pump operationltesting, additional system and pump performance data will be collected and comparedlbenchmarked against the AFW system flow model for verification of analysis.
These tests along with the analysis will confirm that the low discharge pressure trip setpoints are adequate to: a) prevent damage to the AFW pumps, and b) prevent undesirable AFW pump trips from occurring.
The design for the discharge pressure switch has a time delay relay installed in the trip circuit to ensure the pumps can start. This time delay will ensure the pumps start reliably. The discharge pressure trip setpoints utilizes the KNPP approved methodology, as described in NMC1s response to EElB Question #5, which also adds margin.
Page 21 of 33
The design of each suction pressure trip switch has a time delay relay installed in the trip circuit to allow for suction pressure transients of pump starts. This time delay will allow the pumps to operate reliably during pump starts. The time delay relay testing is discussed in SPLB Question #I.
The suction pressure trip setpoints also utilizes the KNPP approved methodology, as described in NMC's response to EElB Question #5, which adds margin.
The suction pressure trip switch setting is at a pressure/level well above the suction pressure trip switch pressure tap for a loss of CST supply piping (See figure 1).
The suction pressure trip switch setting is also utilized to prevent sub-atmospheric operation of the pump packing. The suction pressure trip switch trip location utilizes a 46 percent CST level to determine the flow rate per pump at which three pump operation may cause the packing to go sub-atmospheric. For three-pump operation, this flow is 295 gpm per pump. When the AFW pumps start on a heat up transient or normal operation, the AFW flows are below 295 gpm. The operation of the plant is normally well above 46 percent CST level per operating procedures. Normally the CST is kept above 65 percent. At 60 percent, there is a Control Room annunciator and the operators are directed to fill the CST per Annunciator Response Procedure. This operational level also adds to the margin available.
For low-level CST operation, there is also margin. By the time the operator would be feeding the SG at the end of available CST volume, the operator would be significantly throttling back on SG flows because decay heat and required AFW flows reduce exponentially with time. The margin is maintained at low CST level due to the throttling performed by the operator, the IPEOPs direct the operators to switch over AFW suction supply to Class I essential heat sink (SW) prior to 12 percent CST level. To switch over to SW, the only action that is required by the operator is to reposition a switch, one for each pump's suction supply, which is located in the Control Room on the control boards. The low CST level used for this evaluation is less than six percent. Because of the throttling and the extreme low level used for input to the evaluation, there is margin available to prevent the AFW pump from tripping off during plant operation.
For a discussion of the discharge pressure trip circuit's minimum margin to pump trip, see NMC's response to SPLB Question #l.
NRC Question #5:
The submittal indicates that one of the essential functions of the AFW system is to prevent thermal cycling of the steam generator tube sheets upon a loss of the main feedwater pumps. With respect to the proposed changes, please explain what impact a depressurized or faulted steam generator event will have on steam generator tube sheet thermal cycling considerations, including a discussion of the limiting assumptions upon which the conclusions are based.
Page 22 of 33
NMC Response:
In all transients and accidents, except the Loss of Normal Feedwater (LONF) transient and the MSLB accident, there is sufficient AFW flow to remove the core residual heat, stored energy, and reactor coolant pump heat such that the SG tube sheet remains covered with water at all times during the Design Basis Event (DBE). With the tube sheet remaining covered, there are no concerns with thermal cycling. SG tube sheet integrity is ensured in these events by maintaining a water level in the SG wide range.
In the current IPEOPs, 'SG integrity assessment includes verifying that there is at least five percent wide range level in the SG. At five percent level in the SG wide range level the SG tube sheet is covered with water.
In the MSLB accident, the faulted SG blows down and the water inventory is depleted from that faulted SG. The recovery actions for the MSLB event include isolating the faulted SG and aligning the AFW system to the intact SG so that the intact SG is established as a heat sink. The faulted SG is not fed by the AFW system following the design basis event, after the faulted SG is empty, and thus thermal cycling of the tube sheet is not a concern.
Similarly, in some LONF transients, where it is assumed that only one SG is fed by the AFW system, the unfed SG water inventory is depleted such that the tube sheet in that SG is uncovered. These LONF transients, where only one SG is fed by the AFW system in the analysis, show that one SG as a heat sink is adequate to remove the RCS heat. Thus, there is no need to align the AFW system to the empty SG. Thermal cycling of the tube sheet is not a concern since AFW flow to an empty SG is not required for heat removal.
For a loss of heat sink condition like a LONF or MSLB event, the IPEOPs instruct operators to select the best SG for cooling. The best SG in these cases is the un-faulted SG that has been supplied with AFW and, subsequently, has maintained a water inventory. In the LONF and MSLB events, it is evident to the operators which SG is the best available SG for cooling and recovery and that SG will continue to be fed or aligned so that it can be fed by the AFW system. The dry SG would not be fed by the AFW system, consistent with IPEOP instructions, to prevent any thermal cycling of the tube sheet.
The proposed AFW system changes do not impact the limiting assumptions considered in the above analyses. Therefore, the AFW system will continue to meet its essential function to prevent thermal cycling of the SG tube sheet upon a loss of the main feedwater pumps.
Page 23 of 33
NRC Question #6:
Because the AFW pumps could trip on low discharge pressure during steam generator depressurization events, local operator action is proposed to manually throttle AFW pump flow using the pump discharge isolation valves.
These valves are manually operated gate valves and are not designed for throttling fluid flow. Please describe flow testing that will be performed to demonstrate the capability to adequately throttle AFW flow for the most challenging conditions that can occur during the postulated depressurization events.
NMC Response:
Post-Modification testing was performed to show the operator can:
- 1) Initially position the discharge isolation valve, and
- 2) Start the MDAFW pump without tripping it off, and
- 3) Throttle the discharge isolation valves under depressurized SG conditions.
The throttling of the MDAFW pump discharge valves is bounding because the TDAFW pump turbine requires SG pressure to operate, therefore there is less differential pressure across the TDAFW pump discharge valve when throttling. This test demonstrated the capability to adequately throttle AFW flow for the most challenging conditions that can occur during the postulated depressurization events.
The performance capability of the TDAFW pump below normal operating SG pressures was evaluated. At SG pressures below 345 psia, there is insufficient energy to drive the TDAFW pump turbine at 3600 rpm with 290 horsepower.
The most limiting DBE for TDAFW pump operation is the MSLB with Offsite Power at end-of-life from hot zero power. In this event, the SG pressure in the intact SG drops below 345 psia as a result of the event, and the SG level in the intact SG remains in the narrow range. When the SG remains in the narrow range, the operator is instructed to control/throttle AFW flow to maintain the intact SG level between 4 percent and 50 percent narrow range level. At this condition, the AFW system control may include stopping or starting pumps. Because the faulted SG has been isolated and the intact SG is an available heat sink, the operator is able to terminate SI flow to the RCS.
Additional testing will be performed to determine the TDAFW Pumpnurbine performance capability at low SG pressures. These tests will be conducted during plant heat up. The test data will be used to verify the TDAFW pump capabilities and will confirm that the pump will continue to perform its safety functions. In addition, the test results will be used to train the operators or change operating procedures for improved operator guidance, as necessary.
Page 24 of 33
NRC Question #7:
Please provide a complete listing of all postulated accidents, transients, and occurrences that could be affected by the proposed changes along with a brief summary of the potential impact and any actions that are required as a consequence. Also, please confirm that the limiting cases that are discussed in the submittal bound these other postulated situations in all respects.
NMC Response:
The following is a complete listing of postulated accidents, transients, occurrences, and design basis requirements that could be affected by the proposed change to the AFW system design. These postulated accidents, transients, occurrences, and design basis requirements are derived from the KNPP USAR design basis accidents, transients and USAR design basis functions. They represent the accidents, transients, occurrences, and additional design basis requirements that credit the AFW system.
USAR Safety Analysis Loss of AC Power Loss of Normal Feedwater (LONF)
LONF Anticipated Transients Without Scram (ATWS)
Steam Generator Tube Rupture (SGTR)
Small Break Loss of Coolant Accident (SBLOCA)
Large Break LOCA Main Steam Line Break (MSLB)
Additional USAR-Described Design Basis Requirements Seismic Design Requirements For Safe Shutdown Equipment (KNPP Response to GL 87-02, Seismic Qualification Users Group)
Equipment Protection Requirements - High Energy Line Break (HELB) MSLB outside containment and HELB Main Feedwater Line Break (MFLB) outside containment 10 CFR 50, Appendix R Requirements 10 CFR 50.63, Station Blackout (SBO) Requirements Other Occurrences Feedwater Line Break (FLB)
Tornadoes and other external events Except for MSLB, SGTR, and FLB, the proposed AFW system modification has no impact on these accidents, transients, occurrences, or additional design basis requirements since the SG pressures remain greater than 750 psig throughout the conditions described in their respective USAR described safety analyses. An AFW pump trip on low discharge pressure is not expected when the SG pressure remains above approximately 635 psig (which corresponds to an AFW pump discharge pressure of 886 psig). In addition, parameters important to the safety analysis including AFW system automatic start, system response time, fluid temperature, and flow rate are not impacted by the proposed AFW modification.
Page 25 of 33
Operator actions to take the plant to the final, desired conditions will consider the higher AFW discharge pressure trip setpoints and the potential to trip the AFW pumps during cool down. It is expected the manual actions from the Control Room are successful in operating the AFW pumps at low SG pressures. However, since manual actions from the Control Room to throttle the MDAFW pump discharge flow control valves rely upon the availability of non-safety related equipment, revised procedures will prescribe local manual operator actions to ensure AFW pump availability if the non-safety related equipment is unexpectedly lost.
For the MSLB (inside and outside containment) events, the following potential impact, and actions apply:
In the MSLB DBE the operators isolate AFW flow to the faulted SG. Automatic actions by Systems, Structures or Components (SSCs) during the design basis event include:
safety injection system automatic start with injection flow to the RCS, AFW system automatic start with flow delivered to the SGs, reactor trip, main steam isolation, main feedwater isolation, containment spray automatic start (inside containment MSLB), and containment fan coil units automatic start (inside containment MSLB).
Actions by the operators include: restoration of the intact SG as a heat sink, establishing AFW flow to the intact SG, and termination of SI to the RCS. These actions by the operators are taken to maintain hot (or intermediate) shutdown conditions or to cool down and depressurize the plant to cold shutdown conditions so that the residual heat removal (RHR) system can provide cooling for the RCS. Operator response actions for the MSLB involve using the IPEOPs and all available equipment to take the plant to the final, desired shutdown conditions. Actions for the MSLB will consider the higher AFW discharge pressure trip setpoints and the potential to trip the AFW pumps during cool down. It is expected the manual actions from the Control Room are successful in operating the MDAFW pumps at low SG pressures. However, since manual actions from the Control Room to throttle the AFW pump discharge flow control valves rely upon non-safety related equipment, revised procedures will prescribe local manual operator actions to ensure AFW pump availability if the non-safety related equipment is unexpectedly lost.
Time to establish the intact SG as a heat sink may be impacted by the higher discharge pressure trip setpoints and potential need for local operator actions for AFW system valve throttling.
In the USAR described analyses the SG pressures are less than 600 psig during these MSLB events. At these depressurized SG conditions, the AFW pumps are expected to trip on low discharge pressure. However, the impact of a loss of AFW flow upon the USAR-described analysis is in the reduction of steamlwater inventory available for discharge out of the faulted SG. The USAR-described MSLB analysis does not credit AFW flow in limiting the effects of the break upon reactor coolant temperatures or in affecting the reactor core response or containment pressure response. Rather, the analysis credits three AFW pumps at full flow as a conservative analysis assumption.
The trip of the AFW pumps during a MSLB would result in a response bounded by the current safety analysis.
Page 26 of 33
For the SGTR event the following potential impact and actions apply:
Radiological Consequences Analysis (30 minutes) - The automatic actions by SSCs during the DBE safety analysis for radiological consequences due to a SGTR include:
SI system automatic start with injection flow to the RCS, AFW system automatic start with flow delivered to the SGs, and reactor trip. The plant response evaluated by the SGTR safety analysis credits no actions by the operating staff in the determination of the worst-case radiological consequences. This portion of the safety analysis assumes the radiological release ends at 30 minutes. This safety analysis assumes essentially constant and conservatively high pressures in the primary and secondary sides of the SG having the ruptured tube. This results in a conservatively high primary to secondary break flow. The 30-minute safety analysis also assumes a continuous radiological release from the plant through the affected SGs atmospheric relief valves. The plant design, including automatic SSC actions, as credited in the 30-minute analysis, ensures that the radiological consequences of the event remain within prescribed limits. This analysis documents the acceptability of the KNPP design and establishes the KNPP licensing basis for radiological consequences resulting from a SGTR. It should be noted that this analysis does not consider the impact of operator actions. It simply establishes a maximum allowed radiological release for the event.
Supplemental Thermal Hydraulic Analysis (49 Minutes) - The SGTR event requires a cool down within a specific time frame (49 minutes based on SGTR supplemental thermal hydraulic analyses) to ensure that radiological releases as assumed in the 30-minute SGTR safety analyses remain bounding.
Actions by the operators include: isolating the ruptured SG, ensuring that the non-ruptured SG is established as a heat sink, ensuring that AFW flow continues to the non-ruptured SG, termination of SI, and cool down, de-pressurization of the RCS to terminate the break flow and to ultimately ensure the RHR system can provide cooling for the RCS. Actions for the SGTR event include using the IPEOPs and all available equipment to take the plant to the final, desired shutdown conditions. Actions for the SGTR must consider the higher AFW discharge pressure trip setpoints and the potential to trip the AFW pumps during cool down. Time to break flow termination (for SGTR) and time to establish the intact SG as a heat sink could be impacted by the higher discharge pressure trip setpoints and potential need for local operator actions for AFW system alignment and AFW valve throttling.
The SGTR event requires a cool down within a specific time frame (49 minutes based on SGTR supplemental thermal hydraulic analyses) to ensure that radiological releases as assumed in the 30-minute SGTR safety analyses remain bounding. Absent any operator intervention, the reduction in SG pressure may cause the AFW pumps to trip on low discharge pressure during the cool down of the non-ruptured SG. It is expected that manual actions from the Control Room are successful in operating the MDAFW pumps at low SG pressures. However, since manual actions from the Control Room to throttle the AFW pump discharge flow control valves rely upon the availability of non-safety related equipment, revised procedures will prescribe local manual operator actions to ensure AFW pump availability if the non-safety related equipment is unexpectedly lost.
Page 27 of 33
For the FLB inside containment postulated occurrence, the potential impact and actions that apply are similar to those of the MSLB except that the intact SG remains pressurized during the FLB event.
Based on the evaluation of the potential impact of the proposed changes it is concluded that the limiting cases of the postulated accidents, transients, occurrences, and design basis requirements that could be affected by the proposed AFW changes are the SGTR and the MSLB cases. The MSLB and SGTR cases bound the other postulated accidents, transients, and occurrences in all respects.
FLB Evaluation An evaluation of the FLB accident was performed. The purpose of the evaluation of the FLB event was to determine if the FLB is bounded by existing design basis events in the current KNPP safety analyses and addressed by existing IPEOPs. The evaluation considers the effects of the AFW system modification.
USAR Section 14.1.10, LONF states, in the introduction section, the following:
"A LONF (from a pipe break, pump failure, valve malfunctions, or loss of off-site power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core."
In the LONF design basis safety analysis (USAR Section 14.1.lo) the FW pipe break that causes the LONF is considered a FLB upstream of the FW check valve. This pipe failure would result in the loss of normal FW similar to the loss of FW caused by a FW pump trip, valve malfunction, or loss of AC power, and thus the pipe failure is appropriately addressed by the current LONF safety analysis. Because the FLB is upstream of the FW check valve, the break would not result in a loss of SG inventory or in the depressurization of the affected SG since the check valve effectively isolates the SG from the FLB.
Loss of SG inventory and SG depressurization are expected for the typical FLB. The typical FLB accident, caused by a feedwater pipe failure is not a DBE expressly described in the KNPP USAR (chapter 14) safety analyses. Rather, the FLB accident was discussed in a letter from Wisconsin Public Service Corporation (WPSC) to the N R C ~
to support information regarding the KNPP AFW system flow requirements.
A main feed line break will result in the following plant transient:
Loss of FW flow to the SGs Complete blow down of one SG within a short time if the rupture occurs down stream of the last non-return valve in the main or AFW piping to the SG Possible spilling of AFW out the FLB if the AFW branch line is connected to the Main Feedwater (MFW) line near the break.
Page 28 of 33
Piping and valves are provided so that each of the AFW pumps can supply either or both SGs. This system design feature allows for terminating or limiting the amount of AFW that is delivered to a faulty loop or spilled thru the break to ensure that sufficient flow is delivered to the remaining effective SG.
The double-ended rupture of a MFW pipe downstream of the MFW line check valve was analyzed. This accident is not considered a DBE but was analyzed to determine the capability of the AFW system in handling the accident.
The LONF transient, described in section 14.1.10 of the KNPP USAR, is a limiting DBE with respect to AFW system response time and AFW system flow rate capability, and as described in the KNPP USAR, addresses the reactor1 plant response to a feedwater line break. At the current KNPP rated reactor power (1772 MWth) two AFW pumps are required to mitigate the consequences of the LONF DBE. This LONF analysis conservatively assumes an abrupt stopping of MFW flow to both SGs and a considerable time delay (approximately 55 seconds) before the reactor trips on low-low SG level. In addition, the AFW system is conservatively delayed in the LONF analysis for 13 minutes.
The MSLB accident, described in USAR Section 14.2.5, is a limiting DBE from the perspective of SG depressurization, reactor cool down, containment pressurization, and tripping of the AFW system on low discharge pressure during the DBE. The break area of the MSLB large break (1.4 sq ft break area) bounds the break area of a FLB large break (complete severance of the main FW pipe). The FLB mass and energy release path is through the feedwater ring and feedwater ring J-tubes in the SG. The FLB break area is determined to be approximately 0.92 sq ft based on the total J-tube flow area.
Based on the larger break area, the mass and energy release and SG depressurization for MSLB bound the FLB.
A typical FLB accident is considered bounded by the current safety analysis that documents the Kewaunee plant response to a MSLB and to a LONF. Comparison of the typical FLB accident with the existing LONF and the MSLB safety analyses, described below, supports this conclusion:
The LONF safety analysis assumes a relatively long time (approximately 55 seconds) to reactor trip on low-low SG level. The LONF transient assumes the reactor is at full power following the loss of main feedwater flow for approximately 55 seconds. The typical FLB accident generates a SI signal early in the event on either low steam line (SL) pressure or high containment pressure. This SI signal trips the reactor and automatically starts the AFW system. Reference 1 shows that the SI signal is generated at 20 seconds following the FLB. As a result of the earlier reactor trip time in the FLB event, the reactor sensible and decay heat removal requirements are less for the FLB event than for the LONF event.
- 2. In the MSLB accident, both SGs are affected by the break and subsequently depressurize. In the FLB accident, only the faulted SG depressurizes. The un-faulted SG is isolated from the break by closure of the MSlV on the unaffected steam line and the main steam non-return check valve on the affected side steam line. Because it is isolated from the break, the un-faulted SG remains Page 29 of 33
pressurized, with adequate water inventory, during the FLB accident. Having a SG pressurized precludes the need to throttle AFW flow to maintain AFW pump discharge pressure above the discharge pressure trip setpoints and allows the AFW system to be aligned remotely from the Control Room while establishing and maintaining safe (hot) shutdown.
- 3. The LONF transient conservatively assumes an 800 second (13 minute) delay for the AFW system response. As a result of the FLB, the AFW system automatically starts on SI but the AFW pumps may trip on low discharge pressure due to the faulted SG being depressurized. If the AFW pumps trip, alignment of the AFW system to the intact SG can be accomplished remotely from the Control Room since the un-faulted SG remains pressurized. Since the AFW system is capable of removing the RCS heat in the LONF transient where the heat removal requirements are greater (full reactor power assumed for 55 seconds) and the AFW system delay time is large (assumed to be 13 minutes),
the AFW system is judged capable of removing RCS heat in the FLB accident where reactor decay heat levels are less and the intact SG is pressurized, with adequate water inventory, and is available as a heat sink.
- 4. The MSLB accident has a more severe reactor core cool down and a more severe containment pressure response than the FLB accident and bounds the FLB accident with respect to these parameters.
- 5. FLB accident generates an SI signal, similar to the MSLB accident. SI flow to the RCS can be terminated based on IPEOP criteria of RCS sub-cooling and the intact SG is an available heat sink with adequate water inventory.
Evaluation of the existing licensing basis and a review of the previous assessment of the FLB confirm that the FLB accident is appropriately addressed within the existing safety analyses for the LONF transient and the MSLB accident. The AFW system modification does not affect the existing safety analyses and does not affect the FLB results of a previous FLB analysis performed for KNPP. The typical FLB event, although not a design basis event for KNPP, is considered acceptable and remains bounded by the existing safety analyses for LONF and MSLB.
Current KNPP licensing basis also includes the postulated FLB high energy line break (HELB)-analysis described in USAR Section 10A which demonstrates that the equipment necessary to mitigate the effects of the FLB are appropriately protected from the effects of the break. There are no explicit safety analyses of the FLB HELB showing detailed plant response (e.g. AFW system and SG pressure response). Because the FLB HELB is a FLB outside of containment, the postulated break is upstream of the FW line check valve. Thus, since the affected SG is isolated from the break by the check valve, it will not blow down through the break and will not depressurize. The FLB HELB analysis is bounded by the typical FLB accident and is appropriately bounded (as is the FLB accident) by USAR Section 14 LONF and MSLB safety analyses.
Page 30 of 33
The FLB event operator response is covered by the instructions contained in IPEOP E-2 "Response to a Faulted SG." Response to a MSLB or a FLB event involves using Emergency Operating Procedure (EOP) E-2. E-2 was revised and time validated based on the AFW modification. Based on the results of the time validation, E-2 continues to adequately address both the MSLB and FLB events including considerations for the AFW system modification.
As described in the above FLB evaluation, for the MFLB to result in a depressurization of the respective SG with a resultant impact on the AFW System, the break would have to be located in containment downstream of the MFW line check valve. For a FLB event such as this, the indications and operator response would be largely indistinguishable from a MSLB inside containment and E-2 would be implemented to mitigate the event. In determining the limiting times for operator action, the limiting break location is a MSLB in the Turbine Building coincident with a MSlV failed in the open position. As such, the timings for local operator actions associated with the MFW Break in Containment are bounded by the MSLB in the Turbine Building.
For conditions requiring a plant cooldown in conjunction with the IPEOPs, the IPEOPs will contain a step to maintain AFW Pump discharge pressure >I000 psig. These steps are considered "continuous action steps" and as such will govern the necessary adjustments to discharge flow control valves to maintain sufficient margin to AFW pump discharge pressure trip setpoints. During normal cooldown evolutions, the operators will manipulate AFW-2A and/or AFW-2B to balance pump discharge pressures and flows. If a malfunction were to occur such that local throttling of AFW-3A or AFW3B was required, the operator would enter A-FW-05B, "Abnormal Auxiliary Feedwater System Operation." A-FW-05B can be entered based on conditions either inside or outside of the IPEOPs. This procedure directs the throttling of the appropriate valves to maintain AFW pump discharge pressure greater than the discharge pressure trip setpoints.
Additionally, for all loss of heat sink events, the IPEOPs instruct operators to verify that there is at least 5 percent wide range level in the SG where AFW flow is being restored or provide other guidance. FR-H.1, requires the operators to check SG integrity.
Specifically, the operator will check both SGs not faulted or ruptured, then check wide range level in SGs >5 percent (20 percent for adverse containment conditions). If either SG is faulted or ruptured or the minimum specified level is not present, the operator will maintain feed flow between 60 gpm and 100 gpm to the best available SG (i.e., one that is not faulted or ruptured) until wide range level is greater than the minimum specified.
When level is greater than the minimum, feed flow may be increased consistent with the available source of feedwater.
Page 31 of 33
NRC Question #8:
The Kewaunee licensing basis currently allows ten minutes for the operators to take action from inside the Control Room to align the AFW pumps to take suction from the safety-related service water system in the event that the non-safety-related condensate storage tanks and related flow path are not available. However, because steam generator depressurization events can cause the AFW pumps to trip on low discharge pressure, manual operator actions from outside the Control Room are proposed in order to throttle AFW pump flow and avoid any further pump runout conditions; thereby allowing AFW to be restored. Also, as discussed in Question No. 6, the valves that will be used for throttling AFW flow are not designed for that particular purpose.
Because the proposed action represent a significant departure from the existing plant licensing basis and credits the use of valves that are not optimal for the required application, the proposed changes in this regard can not be viewed as a permanent solution. Please discuss actions that will be taken to fully restore the existing plant licensing basis so that operator actions from outside the Control Room need not be credited, and propose a schedule for completing these actions. Also, consistent with the response to this question, please propose a license condition that will assure that this matter is fully resolved in a timely manner.
NMC Response:
KNPP management recognizes the importance of providing additional improvements to the AFW system to eliminate the need for crediting local manual operator actions outside of the Control Room. To address this condition, additional AFW pump discharge system resistance under depressurized SG conditions is required. The actions required involve additional modifications to the AFW system; however, the specific means to resolve this low probability condition have not been finalized. The actions may include the installation of any number of a combination of passive or active equipment, such as flow restricting orifices or venturii, remotely operated valves, or turbine throttling controls.
Design and procurement of specialized safety grade equipment requires careful selection and analysis and potentially involves significant long lead times for equipment delivery. Due to AFW system TS operability requirements during at power conditions and the significant out of service time required, installation of the changes need to be scheduled during a plant shutdown of sufficient duration, such as a refueling outage.
Due to the extended forced outage, the specific timeframe for the 2006 refueling outage has not yet been determined. This presents additional uncertainties in assessing and ensuring that the present conditions can be remedied in the next refueling outage (RFO). Therefore, we propose to implement necessary upgrades to the AFW system to eliminate the need to credit the local manual operator actions no later than the completion of the first RFO after the 2006 KNPP RFO.
Page 32 of 33
The proposed license condition is as follows:
The need for local manual operator actions as described in the License Amendment Request submitted May 5,2005, and supplemented on June 9,2005, shall be eliminated no later than completion of Kewaunee RFO R-29.
References:
(') Letter from E.R. Mathews (WPSC) to D.G. Eisenhut (NRC), Auxiliary Feedwater System Flow Indication, NUREG 0737, Item E. 1.2," dated June 15, 1981.
(2) Letter from Steven A. Varga (NRCO to C.W. Geisler (WPSC), dated March 14, 1983.
(3) Letter from E.R. Mathews (WPSC) to Darrell Eisenhut (NRC) entitled " Information Regarding Auxiliary Feedwater System Flow Requirements" dated August 14,1981.
Page 33 of 33