ML13322A031
| ML13322A031 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 10/26/1988 |
| From: | Medford M Southern California Edison Co |
| To: | NRC Office of Administration & Resources Management (ARM) |
| Shared Package | |
| ML13322A032 | List: |
| References | |
| NUDOCS 8811010436 | |
| Download: ML13322A031 (26) | |
Text
Enclosure SAFETY INJECTION SYSTEM UPGRADE PLAN SAN ONOFRE NUCLEAR GENERATING STATION, UNIT 1 INTRODUCTION In 1981, San Onofre Unit 1 experienced the common mode failure of both trains of safety injection due to failure of the two hydraulically operated feedwater pump discharge valves. As a result of this failure, several system modifications were implemented, extensive startup testing was performed, an interim surveillance program was established, and a commitment to study and implement additional design modifications was made. Since the time of the valve failures and this commitment, the original problem and potential design modifications have been exhaustively evaluated.
By letter dated December 22, 1986, SCE provided the results of a detailed report which concluded that additional modifications to the safety injection system would not be cost effective. This conclusion was based on the results of studies and modifications completed to date, the significant cost of additional modifications and the results of Probabilistic Risk Assessment studies which demonstrate that the value of the modifications do not justify the cost.
Subsequent to submittal of the December 1986 evaluation, the NRC requested that SCE evaluate other enhancements which could be made to the safety injection system to improve its reliability. In order to improve the cost effectiveness, it was suggested that SCE include possible improvements that were not necessarily safety related or single failure proof. The main concern of the NRC relates to the fact that both trains of the existing safety injection system rely on coordinated operation of several hydraulically operated valves which realign the feedwater pumps from feedwater service to safety injection service.
-2 As a result of the NRC's request, SCE studied a number of alternative enhancements which could be made to the safety injection system. Four alternatives were identified which offered some promise to.provide improvement to the system at reasonable cost. These alternatives, which were discussed with the NRC in meetings on December 16, 1987 and March 16,1988, are as follows:
A. Installation of a new safety related third train of.safety injection which is independent of the two existing trains.
B. Installation of a new non-safety related third train of safety injection which is independent of the two existing trains.
C. Installation of a new non-safety related.feedwater pump, allowing one of-the existing pumps to be dedicated to safety injection service with no realignment of its valves required.
D. Installation of-piping and appropriate check.valves to bypass both sets of feedwater pumps and.hydraulic valves and installation of appropriate valves and sequencer signals to automatically initiate both trains of charging on a safety injection actuation signal.
As discussed in the March 16 meeting, SCE has determined at this time that the enhanced charging/safety injection bypass option (alternative D above) is
.the preferred option. This option is described in more detail in Section III below. In order to better understand the benefits associated with this option, a brief description of the existing safety injection system is first provided in Section II.
II. EXISTING SAFETY INJECTION SYSTEM A. System Description The existing San Onofre Unit 1 safety injection system consists of two independent pumping trains, as shown in Figure 1. Each pump
-3 train consists of two pumps in series: a low pressure safety injection pump and a high pressure pump, which serves as a main feedwater pump during normal plant.operation. The two safety injection pumps take suction from the refueling water storage tank (RWST) through locked-open manually operated valves. Each safety injection pump discharges through a check valve.to a hydraulic.valve (HV-853A or B), which opens on a safety injection signal.
Each main feed pump takes suction from a safety injection pump and discharges through a check valve to a hydraulic valve (HV-851A or B).
HV-851A and B are interlocked with HV-854A and B, respectively. The HV-851A and B valves cannot open unless the associated condensate valves (HV-854A and B) are closed. This prevents unborated water addition to the RCS.
From HV-851A and B, injection water flows to a common header which supplies three separate injection lines via motor-operated isolation valves (MOV 850A, B, C). These motor operated valves open on a safety injection signal.
Flow then passes through check valves which prevent RCS backflow to the safety injection system. From each check valve, flow is directed to its respective -reactor coolant system cold leg.
Although the accident analyses have shown that additional injection flow is not necessary, one of the two centrifugal charging pumps, G8A or G8B, is automatically started to augment safety injection flow. The other charging pump is locked out by the sequencer to ensure its availability for recirculation. With the safety injection system actuation signal, one charging pump begins operation, valves MOV/LCV1lOOB and D are opened taking suction from the RWST, and MOV/LCV1100C is closed to isolate the volume control tank. This results in the flow of borated water from the RWST through MOV 883 to the loop A cold leg via the regenerative heat exchanger. Refer to Figure 2.
-4 After a sufficient quantity of water has been transferred from the RWST through the break and to the containment sump, the recirculation system is manually activated. The recirculation mode is manually initiated by starting recirculation pumps G45A and B and opening recirculation pump discharge valves MOV 866A and B. In addition, the RWST isolation valve MOV 883 is closed. This provides suction to the charging pumps from the recirculation pumps. Valves MOV 18, 19, 356, 357 and 358-are opened and the flow path to each of the RCS cold legs is regulated by appropriate adjustment of FCV 1115D, E and F. Both charging pumps are operated to provide cold leg recirculation to the reactor coolant system. Refer to Figure.3.
B. Safety Analysis The analysis shows that the existing safety injection system is capable of limiting the consequences of a spectrum of loss of.
coolant accidents (LOCAs) to within acceptance criteria. The primary acceptance criterion is the peak clad temperature.of.2300*F in accordance with the Interim Acceptance Criteria.
The large break LOCA was analyzed most recently in the Cycle.8 Reload Safety Evaluation Revision 2 submitted to the NRC by letter dated April 15, 1981.
The safety injection flow used in the analyses considered loss of offsite power, one line of injection blocked, one train of injection operating, and one line of injection spilling to containment. This condition resulted in the minimum flow delivered to the primary system. The flow rate used in the analyses was 720 lb/sec at 0 psig RCS backpressure and delivery of water to the reactor coolant system was initiated at 26.9 seconds after the safety injection actuation signal.
(The corresponding values adjusted to 50 psig RCS/containment backpressure are.
700 lb/sec and 26.7 seconds.)
This delay includes diesel generator startup time, signal delays, valve opening time and the injection line and partial cold leg filling time. Once flow reaches the reactor vessel, there is a 0.9 second free fall time for the water
to fall from the nozzle to the lower plenum, a 42.0 second time to refill the lower plenum and 9.3 seconds to reflood the core to the 1 1/2 foot-level.
-Once reflood reaches this level, sufficient steam generation and water entrainment occurs to turn the peak clad temperature around. The'peak clad temperature was determined to be 2272 0F.
A spectrum of small break LOCAs was analyzed and provided by letter dated July 28, 1981.
The general characteristics of the small break LOCA transients for SONGS 1 are similar to those of the Westinghouse standard plant. However, the consequences are more favorable since the safety injection flow is so much greater for SONGS 1.
Initially, after the small break LOCA, the RCS depressurizes rapidly to the steam generator safety valve setpoint. The pressure remains relatively constant at this value until sufficient mass has been.
discharged through the break to clear the loop seal.
Safety injection has been initiated but the subcooled liquid break flow exceeds the safety injection flow so that a net loss of mass occurs from the system.
When the loop seal clears, steam is vented out the break and the system further depressurizes. Core uncovery occurs just prior to loop seal clearing. It is during the time of the core uncovery that the peak clad temperature occurs.
For the Westinghouse standard plant, the peak clad temperature occurs during a subsequent uncovery of longer duration. For SONGS 1 there is no significant subsequent core uncovery due to the high safety injection flow and consequently the peak clad temperature resulting from a small break LOCA is much lower for SONGS 1 than for a standard plant.
After the loop seal drains, steam flows from the break for a period of time. The safety injection flow exceeds the break flow when steam is flowing out the break, so the system is refilled during this time. When the system is filled to a sufficient level, subcooled liquid-flows-from the-break. Since,the subcooled liquid
-6 break flow is greater than-the safety injection flow, the level will drop again until steam is again being discharged from the break. A period of alternating steam-water discharge exists until the RCS has depressurized to the point where safety injection flow matches the subcooled break flow. For breaks in this range, the steam generators are effective as heat sinks only until the loop seal clears and then the break is capable of removing all the decay heat.
III. UPGRADED SAFETY INJECTION SYSTEM A. System Modifications The upgrade of the safety injection system will consist of two separate sets of modifications which would enhance the existing safety injection system. These modifications are -shown on Figure 4. The first set of modifications will provide bypass piping around the feedwater pumps such -that the safety injection pumps can.
provide water to the reactor -coolant system in the event of any single or multiple failures of hydraulic valves. This bypass path with a safety injection pump would be similar to a modern low pressure safety injection (LPSI) system.. The second set of modifications will provide automatic actuation and alignment of both trains of charging during the injection phase. This charging path would be similar to a modern high pressure safety injection (HPSI) system. The specific modifications are shown in Figure 4 and described below.
- 1. Enhanced Charging The modifications associated with this upgrade are as follows:
- a. Install second valve (MOV/LCV 1100E) on suction line from volume control tank.
-7
- b. Install check valves downstream of MOV 356, 357 and 358.
- c. Add signals from sequencer to close MOV 1100E, start both charging pumps, close FCV 1112, open MOV 18 and 19, open FCV 1115D, E and Frand open MOV 356, 357 and 358.
In addition to these modifications, detailed engineering of this system will be required to ensure there is sufficient NPSH for the charging pumps for all postulated modes of operation; i.e., both pressurized and depressurized reactor coolant system. If sufficient NPSH is not available with the existing system, then additional modifications will be required.
Examples of potential additional modifications are:
- d. Install larger suction piping (and valves) from the RWST to the charging pumps.
- e. Install booster pump(s) in the suction line.
- f. Replace charging pump motors with larger motors.
All. of the modifications would.be safety related, Seismic Category A.
The purpose of these modifications would be to provide injection from the charging pumps when there is a safety injection actuation signal.
At normal reactor coolant system operating pressure of 2100 psia, two charging pumps can provide 22 lb/sec flow. At depressurized conditions of 50 psi, the post-LOCA containment pressure, one charging pump can provide 46 lb/sec and two pumps can provide 66 lb/sec. Therefore, with these modifications, the charging pumps would be available to automatically provide injection for both small break and large break LOCAs.
An added benefit of these modifications is that it will improve the switchover to post-injection recirculation. The sequencer signals added to the valves in item "c" above will alleviate the operators from manually having to manipulate these valves.
Thus, once the operator starts the recirculation pumps and opens the pump discharge valves, flow will already be directed to the reactor coolant system cold legs.
- 2. Safety Injection Bypass The modifications associated with this upgrade are as follows;
- b. Install 2 check valves in each bypass piping.
c.". Install check valve between HV 851A and B and connection.
to bypass piping.
- d. Install check valve between HV 853A and B and connection.
to bypass piping.
All of these modifications would be safety related, Seismic Category A.
The purpose of these modifications would be to provide a path for safety injection in the event of any single or multiple failures of the hydraulic valves. The shutoff head of the safety injection pumps is about 150 psi.
Therefore, this bypass would be effective for large break LOCAs where the reactor coolant system is completely depressurized. With a backpressure of 50 psi, the post-LOCA containment pressure, the flow from one safety injection pump would be 565 lb/sec and the combined flow from two safety injection pumps would be 584 lb/sec.
-9 An added consideration in the design of the upgrades is assurance that the modifications provide protection against injection of unborated condensate water into the reactor coolant system. Such an occurrence could lead tola lack of shutdown reactivity. As noted in Section-II.A above, the existing safety injection system includes interlocks on the safety injection discharge (HV 851) valves to prevent them from opening until the condensate valves (HV 854) are closed. In addition, each of the condensate pumps receives a trip signal.
from the sequencer on the same train on a safety injection actuation signal.
The upgraded system will maintain the existing interlock between the HV 851 and HV 854 valves. In addition, the new check valve between the HV 853 valves and the connection to the bypass piping will prevent condensate from being injected through the bypass piping in the event the condensate valve (HV 854) fails to close.
B. Safety Analysis In order to determine how effective the above upgrades to the safety injection system are, analyses were performed for both large.and small break LOCAs. These analyses assume that there are failures of the hydraulic valves in both trains of the existing safety injection system such that neither train delivers any flow to the reactor coolant system.
Under this assumption, the safety injection bypass is the primary means for mitigation of a large break LOCA and the enhanced charging is the primary means for mitigation of a small break LOCA. This would make SONGS 1 with the upgraded safety injection system similar to a Westinghouse standard 3 loop plant. Table 1 gives a comparison of SONGS 1 and standard plant characteristics.
Figure 5 graphically compares the safety injection delivery curves for the Westinghouse standard 3 loop plant, the existing SONGS 1 safety injection system,
-10 and the upgraded SONGS 1 safety injection system. The figure illustrates the similarity between the upgraded system and the standard plant.
Specific LOCA analyses for the upgraded system are provided in the following sections.
- 1. Large Break LOCA To evaluate the upgraded safety injection system for a large break LOCA, the flow characteristics and timing of the upgraded system were compared against the existing system. Assumptions made in this evaluation were:
- a. Due to hydraulic valve failures, both trains of safety injection using the feedwater pumps are assumed to fail.,
- b. There is not an additional single failure concurrent with the hydraulic valve failures.
- c. -For timing purposes, it is assumed that offsite-power ist available.
- d. Flow is provided by both safety injection pumps through the bypass and both charging pumps.
Table 2 provides a comparison of the timing for core reflood to the 1 1/2 foot level at which time peak clad temperature would be turned around by steam generation and water entrainment, for the upgraded and existing safety injection systems.
For the existing system, the design basis analysis (1 train of safety injection, loss of offsite power), shows that reflood to 1 1/2 feet core level occurs at 79.1 seconds. For the upgraded system (2 trains of safety injection bypass, 2 trains of charging, no loss of offsite power), reflood to 1 1/2 feet core
level occurs at 73.4 seconds. The corresponding peak clad temperatures are 2272 0F for the existing system and estimated 2192*F for the upgraded system. Therefore, the upgraded.,system will ensure that the peak clad temperature remains withinthe.
acceptance criterion of 2300.F for the large break LOCA.
- 2. Small Break LOCA To evaluate the proposed upgraded safety-injection system, SCE performed small break LOCA analyses using the RETRAN-02/Mod 4 computer code. The code which has been used to perform the licensing basis small break LOCA analyses for SONGS 1 is the Westinghouse WFLASH code. In order to validate the use of RETRAN for this analysis, a benchmark analysis was performed:to compare WFLASH and RETRAN results for the existing safety injection system. This analysis is described in Appendix A, RETRAN SBLOCA Model Benchmark-Comparison with WFLASH SONGS 1.
The results demonstrate that the RETRAN code is able to very accurately simulate the-small break LOCA events for SONGS 1.
This is shown by comparison of transient system parameters and core mixture level predicted by the different methodologies.
For the upgraded safety injection system, analyses were performed for 3 inch, 4 inch and 6 inch break sizes.
Assumptions made in these analyses were:
- a. Due to hydraulic valve failures both trains of safety injection using the feedwater pumps are assumed to fail..
- b. There is not an additional single failure concurrent with the hydraulic valve failures.
- c. For timing purposes, it is assumed that offsite power is available (although the results indicate that this does not significantly affect the consequences).
-12
- d. Flow is provided by both charging pumps (no flow is assumed from the safety injection bypass - shutoff head of safety injection pumps is not reached for analysis period).
The analyses are described in Appendix B, Evaluation of an Improved Safety Injection System with RETRAN-02/Mod 4, SONGS 1. In each case, the analysis was simulated beyond the time of loop seal clearing, core uncovery, core recovery and the point in time when safety injection flow exceeded the break flow. The results show that the core is adequately protected.
with the upgraded safety injection system. The only core uncovery occurs during loop seal clearing and hence peak clad temperatures are expected to be similar to those previously reported.
IV. PROBABILITY In order to assess the benefits associated with the upgraded safety injection system, an evaluation was performed using.probabilistic risk assessment (PRA) techniques. The SONGS 1 safety injection system has been modeled to permit an assessment of the contribution to core melt probability. This model was modified to include the modifications associated with the upgraded system to permit a comparison of the results.
Table 3 shows a comparison between the existing and upgraded systems of the annual probability of core melt. Within the uncertainties of the PRA, these results are essentially the same. Table 4 shows a similar comparison for several different assumptions for the probability of failure of the hydraulic safety injection valves. As can be seen in this table, the higher the value assumed for valve failure, the better the upgraded system becomes.
-13 V. CONCLUSION Upgrades to the safety injection system have.-been identified which provide a bypass around the feedwater pumps and valves for low head injection and automatic initiation of charging for high head injection.,
These upgrades have been shown to be able to mitigate the consequences of both large break and small break LOCAs. The analyses indicate that the Interim Acceptance Criterion of 2300*F is met for all break sizes.,
A PRA study indicates that the difference in the core melt probability between the upgraded system and existing system is too close to call at lower probability of failure values of the safety injection valves.
However, the benefits of the upgraded system increase as the assumption for hydraulic valve failure gets higher.
Based on the above, it is concluded that the upgrades to the safety injection system will provide an improvement to the safety injection system and the ability to mitigate a LOCA.
JLR:9613F
Table 1 Comparison of Plant Characteristics for San Ohofre Unit 1 and Generic Westinghouse 3 Loop PWR Generic 3-Loop SONGS 1 Core Power (MWT) 2652 1347 Number of Coolant Loops 3
3 Peak Linear Power (kw/ft) 12.2 13.7 Total Peaking Factor 2.32 2.89 Fuel Array 17 x 17 14 x 14 Number of Fuel Assemblies 157 157 Core Length (ft) 12 10 Accumulator Water Volume (ft3) 1025 Fuel Cladding Material Zircaloy Stainless Steel RCS Volume (ft3) 9190 6940 SG Safety Valve Setpoint (psia) 1090 1000
Table 2 Large Break LOCA Plant Performance Evaluation Upgraded System Existing System (2 SI Pumps + 2 Chg Pumps)
(1 MFW/SI Pump)
Flow @ 50 psia 650 lb/sec 700 lb/sec. (584 SI)
(66 Chg)
SI Delay Time (sec) 17.3 (No LOP) 26.9 (LOP)
(Pumps, Valves, Line Fill)
Free Fall Time (sec) 0.9 0.9 (Nozzle to Lower Plenum)
Lower Plenum Refill Time (sec) 45.2 42.0 Core Reflood to 1-1/2' Level (sec) 10.0.
9.3.
Total (sec) 73.4 79.1 PCT (OF) 2192 2272
Table 3 Probabilistic Risk Assessment Results For Safety Injection System Upgrade Break Size Annual Probability of Core Melt Existing Plant Enhanced Charging/
Safety Injection Bypass Large LOCA 4.2 x 10-7 2.2 x 10-7 (Break >6")
Medium LOCA 9.4 x 10-7 2.8 x 10-8 (3"<Break<6")
Small LOCA 6.2 x 10-6 5.5 x 10-6 (3/8"<Break<3")
Total 7.6 x 10-6 5.7 x 10-6
Table 4 Probabilistic Risk Assessment Results For Safety Injection System Upgrade Probability of Failure of Safety Injection Valves Total Annual Probability of Core Melt Existing Plant Enhanced Charging/
Safety Injection Bypass 3 x 10-3 7.6 x 10-6 5.7 x 10-6 1 x 10-2 8.2 x 10-6 5.8 x 10-6 5 x 10-2 1.5 x 10-5 5.8 x 10-6
Figure 1 Existing Safety Injection System CONTAINMENT p
OUTSIDE INSIDE SAFETY H
INJECTION PUMPS PUMPS 914 FT M
HV-853A G-3A COLDLEG G-50A (EAST) 913 MOV-850C HV 854A HV-852A FT M
SIS PUMP RECIRC FROM TO TOLOOP CONDENSATE FEEDWATER PUMPS SYSTEM 912 HV-854B HV-852B FT Mi TOLOOPA p
COLDLEG p
H H
MOV-850A HV-853B HV-851 B G-3B G-508 (WEST)
FROM CHARGING SYSTEM
Figure 2 Existing Charging System Alignment During Injection Phase RUST VOLUME, CONTROL TANK FCV-lll2 mV 1100 C CHARING TO LOOP A v~C isMyns o,
NOVA NV835 v
11 00 L P Nov 19LOOP 8
1115 F SI SIGNAL FROM SEQUENCER LOOP C
Figure 3 Charging System Alignment During Recirculation Phase RST VOLUME CONTROL TANK FCV-1ll2 Nv 1100 C CHASING TO LOOP A M6V 8 83 Nv 18 FCV 1115 D' Nov 1100 B G-ANV 356 RCLPS LOOP B v 1100 D G-8B 351157 357,LOOP 8
1115 F From Recirculation Pumps LOOP C
- S I
VOLUNE CONTROL TANK NoV 1100 C *FCV-1l2 CHARGING TO LO P A NOV 1100 0111 MOV883NO
-88C 1115 E*
NOVN83 V 1100 3 a~
NO~V 3569 NOJV 1100 0 G
-88 No1 11,15 (
01E SI SIGNAL FROM SEQUENCER Loo t 11IS F9 LOOi c HV 854 NV 854 *liv 852 FEEIMATER PUMP HV 853 853 RCS Figure 4 Proposed Safety Injection F
om51fetSystem Upgrades TO RCS F ?.mn.Safety -Injection Pump IS
Figure 5 Comparison of San Onofre Unit 1 Safety Injection Delivery Curves With Generic Westinghouse 3 Loop PWR 2800 2600 2400 2200 CHARGING + SAFETY INJECTION PUMPS EXISTING SAFETY INJECTION SYSTEM (I) 2000
...--- GENERIC 3-LOOP PLANT 1800 1600 1400
'I) 1200 1000 800 C) 600 400 200 0
100 200 300 400 500 600 700 800 PUMP FLOW (LB/SEC)
ALTERNATE UPGRADE PROPOSED MODIFICATION OF THE RESIDUAL HEAT REMOVAL SYSTEM FOR BACKUP TO THE RECIRCULATION SYSTEM SAN ONOFRE NUCLEAR GENERATING STATION UNIT 1
Objective This modification would provide a second, separate recirculation flowpath for post-LOCA cooling to the core that is independent from the existing recirculation pumps and heat exchanger. The normal function of the RHR system would not be impacted, since the new flowpath is isolated during normal operation.
Description As shown in blue on the drawing, the existing Recirculation System consists of two recirculation pumps located in the containment sump and a heat exchanger.
The pumps provide the spilled RCS coolant and injected borated water to the suction of the charging pumps and the refueling water pumps. The charging pumps deliver the recirculated water to the RCS cold legs and the refueling water pumps deliver the water to containment spray.
The existing RHR System is shown in green on the drawing. The RHR System is not required currently for post-LOCA cooldown. The proposed modification to the RHR System is shown in red on the drawing. A new flowpath from below the post-LOCA flood level in the containment sphere to the suction of the RHR pumps would be provided. To complete the cooling path, a new discharge line would be installed that connects to the existing safety injection line, downstream of the check valve to the Loop B cold leg. This ensures that flow from the RHR pumps, cooled by the RHR heat exchanger, would satisfy all design requirements for the SONGS 1 recirculation function.
Benefits This modification provides a backup system for the existing recirculation pumps which have been identified as significant contributors to the frequency of core melt. Using the RHR pumps in a separate recirculation flowpath significantly reduces the core melt probability due to loss of recirculation.
PROPOSED RHR/RECIRC MODIFICATION SAN ONOFRE UNIT 1 PZR RED INDICATES PROPOSED ADDITION P
CHRG INJECTION CHRG INJECTION c
SSI CHRG INJECTION RWST CHRG NORMAL CHARGING CNT SPRAY CHRG INJECTION RiECIRC HT EXCH CNT SPR~AY PUMPS C
PERECIRC PUPS CNT SUMPRHR/RECIRC SUMP
W IMPACT OF RHR/RECIRC MOD ON CORE MELT FREQUENCY SAN ONOFRE UNIT 1 1OE-3 /YR 3.3E-4-2.5E-4 7.7E-5 u
1.OE-4
/YR z
LJ
'i 1.
3 E
-5 1.OE-5
/YR-C3E 3.1E-6 3.4E-6 1.OE-6
/YR
[
ALL SIZES SMALL-SMALL SMALL MEDIUM & LARGE OF LOCA LOCA LOCA LOCA CURRENT CONFIGURATION A
WITH RHR/RECIRC MODIFICATION