ML14184A108

Forwards NRC Requirements for Auxiliary Feedwater Sys & Requests That Plant Designs & Procedures Be Evaluated Against Applicable Requirements to Determine Degree of Conformity

ML14184A108
Person / Time
Site:	Robinson, Point Beach
Issue date:	09/21/1979
From:	Eisenhut D Office of Nuclear Reactor Regulation
To:	Jackie Jones Carolina Power & Light Co
References
NUDOCS 7910030833
Download: ML14184A108 (62)

Text

Distribution:

NRC PBR PMatthews LOCAL PDR SIsrael JRBUCHANAN, NSIC PDO'Reilly TERA GKuzniycz SEPTEMBER 2 1 979 ACRS(16)

MTaylor, RES NRR RDG Docket No.: 50-261 SB Rdg & Chron ORB-RDG ATTORNEY, OELD r ~I RE -'3)'

-Mr. J. A. J ORB Licen. Ass't.

Senior Vice-President ORB.Proj. Mgr.

Carolina Power and Light Conpany TJCarter 336 Fayetteville Street-GZech Raleigh, North Carolina '27602

,DEisenhut uF Ross

Dear Mr. Jones:

ORB # Br. Chief TNovak

SUBJECT:

NRC REQUIREMENTS FOR AUXILIARY FEEDWATER SYSTEMS AT H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT-2.

The purpose of this letter is to advise you of our requirements for the auxiliary feedwater systems at the subject facility. These requirements were identified during the course of the NRR Bulletins and Orders Task Force review of operating reactors in light of the accident at Three Mile.

Island, Unit 2. to this letter identifies.each of the requirements applicable.

to the subject facility. These requirements are of two types,*(l) generic requirements applicable to most Westinghouse-designed operating plants, and

'(2) plant-spedific requirements applicable only to the subject facility. contains a generic request for additional information regarding auxiliary feedwater system flow requirements.

The designs and procedures of the subject facility should.be evaluated against the applicable requirements specified in Enclosure 1 to-detennine the degree to which the facility currently conforms to these requirements. The result's of this evaluation and 'an associated schedule and commitment for implementation of required changes or actions should be provided for NRC staff review within thirty days of receipt of this letter-. Also, this schedule should indicate your date for submittal of information such as design changes, procedure changes or Technical Specification changes to be provided for staff review. You may also provide-your response to the items in Enclosure 2 at that time.

In addition to the requirements identified in this-letter, other requirements which may be applicable to the subject facility are expected to be generated by the Bulletins' and Orders -Task Force. Such requirements are those resulting.

from our review of the loss-of-feedwater event.and the small break loss-of-coolan accident as described in' the Westinghouse report WCAP-9600, "Report on Small U

OWW%09 le

,E nrs

Mr. J. A. Jones

- 2 Break Accidents for Westinghouse NSSS System."

Our specific concerns include systems-reliability (other than the auxiliary feedwater system), analyses, guidelines and procedures for operators, and operator training.

We plan-t.o identify, in separate correspondence, the requirements resulting from the additional items from the Bulletins and Orders Task Force review.

Sincerely, Darrell G. Ei-senhut, Acting Director Division of Operating Reactors Office of.Nuclear Reactor Regulation Enclosures.:

As stated B&OT/F B&OT/

B&0OT/F SIsrael PMatt Td'wY

- 9/lb/79 9/-/79 79 O.lf...

SURNAME, PO'Rei CF ASchwy*Djk D

9/....

FORM i18 (9.74 NZ= ! 0248 U.S. GOVERNMENT PRINTING OPFIC: 1978 285 769

p'j REG:

a UNITED STATES NUCLEAR REGULATORY COMMISSION 0

WASH INGTON, D. C. 20555 September 21, 1979 Docket No.: 50-261 Mr. J. A. Jones Senior Vice-President Carolina Power and Light Company 336 Fayetteville Street Raleigh, North Carolina 27602

SUBJECT:

NRC REQUIREMENTS FOR AUXILIARY FEEDWATER SYSTEMS AT H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT 2 The purpose of this letter is to advise you of our requirements for the auxiliary feedwater systems at the subject facility. These requirements were identified during the course of the NRR Bulletins and Orders Task Force review of operating reactors in light of the accident at Three Mile Island, Unit 2. to this letter identifies each of the requirements applicable to the subject facility. These requirements are of two types, (1) generic requirements applicable to most Westinghouse-designed operating plants, and (2) plant-specific requirements applicable only to the subject facility. contains a generic request for additional information regarding auxiliary feedwater system flow requirements.

The designs and procedures of the subject facility should be evaluated against the applicable requirements specified in Enclosure 1 to determine the degree to which the facility currently conforms to these requirements. The results of this evaluation and an associated schedule and commitment for implementation of requireO changes or actions should be provided for NRC staff review within thirty days of receipt of this letter. Also, this schedule should indicate your date for submittal of information such as design changes, procedure changes or Technical Specification changes to be provided for staff review. You may also provide your response to the items in Enclosure 2 at that time.

In addition to the requirements identified in this letter, other requirements which may be applicable to the subject facility are expected to be generated by the Bulletins and Orders Task Force. Such requirements are those resulting from our review of the loss-of-feedwater event and the small break loss-of-coolant accident as described in the Westinghouse report WCAP-9600, "Report on Small

Mr. J. September 21, 1979 Break Accidents for Westinghouse NSSS System."

Our specific concerns include systems reliability (other than the auxiliary feedwater system), analyses, guidelines and procedures for operators, and operator training.

We plan to identify, in separate correspondence, the requirements resulting from the additional items from the Bulletins and Orders Task Force review.

incerely, Darrell G. Eisen ut, Acting Director Division of Operating Reactors Office of Nuclear Reactor Regulation

Enclosures:

As stated cc:

w/enclosures See next page

Mr. J. A. Jones Carolina Power and Light Company cc: G. F..Trowbridge, Esquire Shaw, Pittman, Potts and Trowbridge 1800 M Street, N.W.

Washington, D. C. 20036 Hartsville Memorial Library Home and Fifth Avenues Hartsville, South Carolina 29550 Michael C. Farrar, Chairman Atomic Safety and Licensing Appeal Board Panel U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Richard S. Salzman Atomic Safety and Licensing Appeal Board Panel U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Dr..W.

Reed Johnson Atomic Safety and Licensing Appeal Board Panel U. S. Nuclear Regulatory Commission Washington, D. C. 20555

ENCLOSURE 1 X.6 (W)

H. B. ROBINSON AUXILIARY FEEDWATER SYSTEM X 6.1

System Description

X 6.1.1 Configuration Overall Design A simplified drawing of the H. B. Robinson auxiliary feedwater system (AFWS) is shown in Figure 1. Basically the system consists of two motor driven pumps located in the auxiliary building, each with a capacity of 300 gpm at 1300 psi. and a turbine driven pump located in the seismic portion of the turbine building with a capacity of 600 gpm at 1300 psi.

The turbine-driven pump is not tornado missile protected. All three pumps take their primary suction from the seismic Category I condensate storage tank. The system is automatic ally started by signals identified in Section 6.1.4.3. The two motor driven pumps take suction from a common header and feed all three steam generators through lines which are cross-connected in the pump room as shown in Figure 1. There is a normally closed motor operated valve in each line to the steam generators. The AFWS discharge lines from the motor driven pumps connect to the main feed lines inside containment.

The turbine driven pump takes its source of water from the CST common header and feeds into the main feed.system through three normally closed motor-operated valves. The auxiliary feedwater lines

-2 from the turbine driven pump train connect to the feedwater regulating valve bypass lines for each individual steam generator outside containment.

The system was evaluated for high energy line breaks in the main steam, main feed lines and the AFWS itself. For the main feed and steam line breaks, at least one train of the AFWS will be able to feed at least one steam generator which is sufficient to safely shut down the.p1.ant.

Remote manual action would be required to isolate the affected steam generator and AFWS line feeding that generator.

For the high energy line break in the Auxiliary Feedwater System, the worst break is in the motor driven pump trains' cross connection line. In this case, since the pumps and associated motor operated valves are in the same room, these trains could be shorted out if the cross connection line is not isolated in time. The steam driven train is, however, still available to shut down the plant, provided the pump does not fail. If the pump fails, auxiliary feedwater flow would be lost, but main feedwater could still be used to supply water to the steam generators.

Sources of Water There are three sources of water for the auxiliary feedwater system.

The primary source is from a 200,000 gallon seismic Category I condensate storage tank (CST),of which 35,000 gallons are dedicated to the auxiliary feedwater system. This will last.a minimum of two

-3 hours. The CST is not protected against tornado missiles. All valves from the tank to the AFWS are normally open, and are local manually operated valves.

The secondary source of water as well as long term cooling is the seismic Category I service water system and the ultimate heat sink.

The piping for this system is buried or in the auxiliary building so it is protected against tornado missiles, however, the pumphouse which contains the service water pumps is not protected against tornado missiles. The valves connecting this system to the AFWS are locked closed manual valves.

Thus, it would take time to open these valves.

There is, however, sufficient time to open these valves before the condensate storage tank is depleted or the steam generators boil dry.

The back-up source of water is the non-seismic deep well system which has a capacity of 600 gpm. The valves that connect this system with the AFWS are manually locked closed valves.

-4 X.6.1.2 Components - Design and Classification Component Environmental Design Seismic Qualification Classification Category Motor Driven Pump Ambient ASME VIII I

Turbine Driven Pump ASME VIII I

Piping B1.1 I

Valves/Actuators B31.1 I

Control & Actuation System

-I Indication N.S.

Condensate Storage I

Service Water System I

Deep Well System N.S.

Main Steam Lines to I

Turbine Driven Pump (connects upstream MSIV)

Main Feed Lines from Main I

Feed Block Valves to Steam Generators N.S -

Non Seismic Category I X.6.1.3 Power Sources Each motor driven pump is supplied power from its respective emer gency bus which receives power from normal station transformers or separate diesel generators (DG).

The three motor operated discharge valves (MOV) in the motor driven pump trains are powered from the emergency buses. The valve for steam generator A is powered from emergency bus El or E2. The valve for steam generator (SG) B is

-5 powered from bus E2 and the valve for SG C is from bus El.

The MOV's are normally closed and fail-as-is. The instrumentation for these trains is taken off the station batteries.

The turbine driven pump is supplied steam from all three steam generators.

The steam is taken off upstream of the MSIV and passes through a motor operated valve, a check valve and goes into a common header which feeds the turbine. The motor operated valves take their power from the emergency buses.

The valves from SG B&C are connected to bus El, and the valve from SG A is connected to bus E2. The motor operated valves in the turbine pump discharge lines to the steam generator also take their power from the emergencX buses with valves for SG A&C from bus E2 and SG B from bus El.

The above MOV's are normally closed and fail-as-is.

The system does not meet' NRC's current power source diversity position with respect to the turbine driven pump train valves although manual actipn can be taken at the valves.

(See recommendation GS-5)

In addition, cooling to the lube oil coolers to the turbine driven pump is from the service water system, which takes its power from the emergency busses. Upon station blackout (loss of all AC),cooling is lost to the turbine which could result in a possible shaft seizure or wiped bearings in the turbine within a short time (approximately 10 to 20 minutes), thus resulting in the loss of all AFW flow. However, the lube oil cooling water piping and valves are arranged so that

-6 the lube oil cooler can be cooled by AFW pump flow; but the valve align ment must be changed (See Recommendation GS-5).

X.6.1.4 Instrumentation and Controls X.6.1.4.1 Controls The following AFWS manual controls are available in the control room:

1. Motor Driven Pump Start-Stop

2. Steam Inlet Line to Turbine - Motor Operated Valves Open-Close

3. AFW Discharge Line Motor Operated Valves - Open-Close All other valves as well as the above can be controlled at the local stations. Steam generator level is controlled manually at the motor operated discharge valves locally or in the control room by starting and stopping the pumps.

X.6.1.4.2 Information available to Operator The following information is available to the operator in the control room:

1. Motor Driven Pumps Start-Stop

2. Motor Operated Valves (All) Opened-Closed

3. Motor and Turbine Driven Pumps Discharge Pressure

4. Steam Generator Level

5. Steam Generator and Steam Header Pressure

-7 This information is also available at the local control stations.

The following alarms are located in the control room:

1. Condensate Storage Tank Low Level

2. Equipment on Local Control

3. Steam Generator(s) Low Low Level Alarms

4. Steam Generator High Level Alarm

5. Low AFW Pump Discharge Pressure Alarm and Trip

6. Loss of Lube Oil X.6.1.4.3 Initiation Signals for Automatic Operation The following signals initiate automatic operation of the AFWS:

1. Low-Low Level on Steam Generator

a. 2 out of 3 on one steam generator initiates the motor driven pump trains.

b. 2 out of 3 on two steam generators initiates the turbine pump train.

2. Loss of Both Main Feed Water Pumps starts Motor Driven.

Pump Trains.

3. Loss of Offsite Power starts motor driven pump trains.

-8

4. Safety Injection Signal starts motor driven pump trains.

5.

Loss of Voltage ( <70%) on buses 1 and 4 starts the steam driven pump train.

Steam inlet valves (MOV) are operated from buses El and E2 and therefore will open.

X.6.1.5 Testing The system is tested on a monthly bases with some exceptions. The pumps are run in recirculating mode monthly and the motor operated discharge valves are stroked monthly with the pumps off. All other valves in the system including the AFW pump turbine steam inlet valves are tested quarterly; however one steam inlet valve is operated monthly in conjunction with the monthly tests of the turbine driven pump.

All valves are checked at the end of the tests for correct positioning both in the control room and locally. The piping in the system is hydrostatically tested every 10 years. The system is tested as a whole during refueling cycle as part of the ECCS actuation test. The only pieces of equipment not tested on a periodic bases are the locked closed valves to the service water and deep well systems.

The periodic test requirements are as follows:

-9 AUXILIARY FEEDWATER SYSTEM Applicability Applies to periodic testing requirements of the turbine-driven and motor-driven auxiliary feedwater pumps.

Objective To verify the operability of the auxiliary feedwater system and its ability to respond properly when required.

Specification 4.8.1 Each motor driven auxiliary feedwater pump will be started at intervals not to exceed one month, run for 15 minutes, and determined that it is operable.

4.8.2 The steam turbine driven auxiliary feedwater pump by using motor operated steam admission valves will be started at intervals not to exceed one month, run for 15 minutes, and determined that it is operable when the reactor coolant system is above the cold shutdown condition. When periods of reactor cold shutdown extend this interval beyond one month, the test shall be performed immediately following reactor heatup.

10 4.8.3 The auxiliary feedwater pump discharge valves will be tested by operator action at intervals not greater than one month.

3 4.8.4 These tests shall be considered satisfactory if control board indication and subsequent visual observation of the eqyipment demonstrate that all components have operated properly.

X.6.1.5 Technical Specifications The following technical specifications apply to H. B. Robinson. The salient features are that one pump could be.out of service for an indefinite period of time with no limiting condition for operation on the plant, that the instrumentation for the system could be out for all trains without limiting condition for operation.

SECONDARY STEAM AND POWER CONVERSION SYSTEM Applicability Applies to the operating status of turbine cycle.

11 Objective To define conditions of the turbine cycle steam-relieving capacity.

Auxiliary Feedwater System and Service Water System operation is necessary to ensure the capability to remove decay heat from the core.

Speci fi cation 3.4.1 The reactor coolant shall not be heated above 3500 F unless the following conditions are met:

a. A minimum turbine cycle steam relieving capability of twelve (12) main steam safety valves operable.

b. Two of the three auxiliary feedwater pumps must be operable.

c. A minimum of 35,000 gallons of water in the condensate storage tank and an unlimited water supply from the lake via either leg of the plant Service Water System.

d. Essential features including system piping and valves directly associated with the above components are operable.

12

e. The main steam stop valves are operable and capable of closing in five seconds or less.

3.4.2 The specific activity of the secondary coolant system shall be < 0.10 pCi/gram DOSE EQUIVALENT 1-131 under all modes of operation from cold shutdown through power operation. When the specific activity of the secon.ary coolant system is

>0.10 pCi/gram DOSE EQUIVALENT 1-131, be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The specific activity of the secondary coolant system shall be determined to be within the limit by performance of the sampling and analysis program of Table 4.1-2.

3.4.3 If, during power operations, any of the specifications in 3.4.1 above cannot be met within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the operator shall initiate procedures to put the plant in the hot shutdown condition. If any of these specifications cannot be met within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the operator shall cool the reactor below 350 0 F using normal procedures.

X 6.2 Reliability Evaluation X 6.2.1 Dominant Failure Modes The system was analyzed for three cases:

(a) loss of feedwater with offsite power available;

13 (b) loss of feedwater with onsite AC power available;

. (c) loss of feedwater with only DC power available.

The dominant failure modes for each case are Fummarized below.

X 6.2.1.1 LOFW with Offsite Power available The dominant failure modes are as follows:

(1) loss of condensate storage tank supply due to failure of valves in the supply line plus failure to manually actuate backup service water supply by locally opening closed valves.

(2) one train out indefinitely for maintenance plus hardware and maintenance outages in other two trains.

X.6.2.1.2 LOFW with onsite_ C pwer available The system was analyzed assuming loss of offsite power, considering the possible loss of one of the diesel generators. The dominant failure modes for this case are similar to those discussed in the previous case.

X.6.2.1.3 LOFN with Only DC Power Available The system will fail in thelong-term due to reliance of turbine lube oil cooling on AC power without operator action to realign cooling water valves (See Section 6.1.3). In the short-term (6.45 minutes), unavail ability is dominated by maintenance and hardware failures of the turbine driven pump train and failure to manually open the steam and water MOVs which do not open without AC power.

-13 (b) loss of feedwater with onsite AC power available; (c) loss of feedwater with only DC power available.

The dominant failure modes for each case are summarized below.

X 6.2.1.1 LOFW with Offsite Power available The dominant failure modes are as follows:

(1) loss of condensate storage tank supply due to failure of valves in the supply line plus failure to manually actuate backup service water supply by locally opening closed valves.

(2) one train out indefinitely for maintenance plus hardware and maintenance outages in other two trains.

X.6.2.1.2 LOFW with Onsite AC power available The system was analyzed assuming loss of offsite power, considering the possibleloss of one of the diesel generators. The dominant failure modes for this case are similar to those discussed in the previous case.

X.6.2.1.3 LOFW with Only DC Power Available The system will fail in the long-term due to reliance of turbine lube oil cooling on AC power without operator action to realign cooling water valves (See Section 6.1.3). In the short-term (E45 minutes), unavail ability is dominated by maintenance and hardware failures of the turbine driven pump train and failure to manually open the steam and water MOVs which do not open without AC power.

15 X.6.3.1 Short-Tern

1. Recommendation GS The licensee should propose modifications to the Technical Specifications to limit the time that one AFW system pump ano its associated flow train and essential instrumention can be inoperable. The outage time limit and subsequent action time should be as required in current Standard Technical Specifications; i.e.,,72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, respectively.

2. Recommendation GS The licensee should lock open single valves cr multiple valves in series in the AFW system pump suction piping and lock-open other single valves or multiple valves in series that could interrupt all AFW flow. Monthly inspections should be performed to verify that these valves are locked and in the open position.

These inspections should be proposed for incorporation into the surveij1lanpe requirements of the plant Technical Specifications. See Recommendation GL-2 for thE longer-term resolution of this concern.

3.

Recommendation GS Emergency procedures for transferring to alternate sources of AFW supply should be available to the plant operators. These procedures should include criteria to inform the operator when, and in what order, the trarsfer to alternate water sources should take place. The following cases should be covered by the procedures:

16

• The case in which the primary water supply is not initially available. The procedures for this case should include any operator actions required to protect the AFW system pumps

,against self-damage before water flow is initiated; and,

• The case in which the primary water supply is being depleted.

The procedure for this case shoulJ provide for transfer to the alternate water sources prior to draining of the primary water supply.

4. Recommendation GS The as-built plant should be capable of pro viding the required AFW flow for at least two hours from one AFW pump train independent of any alternating current power source. If manual AFW system initiation or flow control is required following a complete loss of alternating current power, emergency procedures should be established for manually initiating and controlling the system under these conditions. Since the water for cooling of the lube oil for the turbine-driven pump bearings may be dependent on alter nating current power, design or procedural changes shall be made to eliminate this dependency as soon as practicable. Until this is done, the emergency procedures should provide for an individual to be stationed at the turbine-driven pump in the event of the loss of all alternating current power to monitor pump bearing and/or lube oil temperatures. If necessary, this operator would cperate the turbine-driven pump in an on-off mode until alternating current

0I

-17 power is restored. Adequate lighting powered by direct current power sources and communications at local stations should also be provided if manual initiation and control of the AFW system is needed., (See Recommendation GL-3 for the longer-term resolution of this concern.)

Recommendation GS The licensee shouli confirm flow path avail

5.

ability of an AFW system flow train that has been out of service to perform periodic testing or maintenance as follows:

• Procedures should be implemented to require an operator to determine that the AFW system valves are properly aligned and a second operator to independently verify that the valves are properly aligned.

• The licensee should propose Technical Specifications to assure that prior to plant startup following an extended cold shutdown, a flow test would be performed to verify the normal flow path from the primary AFW*system water source to the steam generators. The flow test should be conducted with AFW system valves in their normal alignment.

6. Recommendation GS The licensee should verify that the automatic start AFW system signals and associated circuitry are safety-grade., If this cannot be verified, the AFW system automatic initiation system shoul be modified in the short-term to meet the functional requirements listed below. For the longer term, the automatic initiation signals and circui should be upgraded to meet safety-grade requirements as indicated in

-18 Recommendation GL-5.

The design should provide for the automatic initiation of the auxiliary feedwater system flow.

The automatic initiation signals and circuits should be designed so that a single failure will not result in the loss of auxiliary feedwater system function.

Testability of the initiation sIgnals and circuits shall be be a feature of the design.

The initiation signals and circuits should be powered from the emergency buses.

Manual capability to initiate the auxiliary feedwater system from the control room should be retained and should be implemented so that a single failure in the manual circuits will not result in the loss of system function.

The alternating current motor-driven pumps and valves in the auxiliary feedwater system should be included in the automatic actuation (simultaneous and/or sequential) of the loads to the emergency buses.

The automatic initiation signals and circuits shall be designed so that their failure will not result in the loss of manual capability to intiate the AFW system from the control room.

7. The licensee should propose modifications to the Technical Specifications to provide for periodic testing of the normally locked closed service water and deep wel-l manual valves.

8. The licensee should propose modifications to the Technical Specifications to provide for monthly testing of all steam admission valves to the turbine pump.

X.6.3.2 Additional Short-Term Recommendations The following additional short-term recommendations resulted from the staff's Lessons Learned Task Force review and the Bulletins and Orders Task Force review of AFW systems:at Babcock & Wilcox-designed operating plants stosequent to our review of the AFW system designs at W-and C-E designed operating plants. They have not been examined for specific applicability to this facility.

1, Recommendation - The licensee should provide redundant level in" dicatjons and low level alarms in the control room for the AFW system primary water supply to allow the operator to anticipate the need to make up water or transfer to an alternate water supply

,and prevent a low pump suction pressure condition from occurring.

The lw level alarm setpoint should allow at least 20 minutes for operator action, assuming that the largest capacity AF pump is operating.

-20

2. Recommendation -

The licensee should perform a 72-hour endurance test on all AFW system pumps if such a test or continuous period of operation hasnot been accomplished to date. Following the 72-hour pump run, the pumps should be shut down and cooled down and then restarted and run for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Test acceptance criteria should include demonstrating that the pumps remain within design limits with respect to bearing/bearing oil temperatures and vibration and that pump room ambient conditions (temperature, humidity) do not exceed environmental qualification limits for safety related equipment in the room.

3. Recommendation - The licensee should implement the following requirements as specified by Item 2.1.7.b on page A-32 of.

NUREG-0578:

"Safety-grade indication of auxiliary feedwater flow to each steam generatc.- shall be provided in the control room.

The auxiliary feedwater flow instrument channels shall be powered from the emergency buses :consistent with satisfying the emergency power diversity requirements for the auxiliary feedwater system set forth in Auxiliary Systems Branch Techn nical Position 10-1 of the Standard Review Plan, Section 10.4.9."

4. Recommendation - Licensees with plants which require local manual realignment of valves to conduct periodic tests on one AFW system train and which have only one remaining AFW train available for

21 operation, should propose Technical Specifications to provide that a dedicated individual who is in communication with the control room be stationed at the manual valves. Upon instruction from the control room, this operator would re-align the valves in the AFW system train from the test mode to its operational alignment.

X.6.3.3 Long-Term Long-term recommendations for improving the system are as follows:

1. Recommendation GL Licensees with plants in which all (primary and alterna'e) water supplies to the AFW systems pass through valves in a single flow path should install redundant parallel flow paths (piping and valves).

Licensees with plants in which the primary AFW system water supply passes through valves in a single flow path, but the alternate AFW system water supplies connect to the AFW system pump suction piping downstream of the above valve(s), should install redundant valves parallel to the above valve(s) or provide automatic opening of the valve(s) from the alternate water supply upon low pump suction pressure.

The licensee should propose Technical Specifications to incorporate appropriate periodic inspections to verify the valve positions.

22

2.

Recorrendation.GL At least one AFW system pump and its associated flow path and essential instrumentation should auto matically initiate AFW system flow and be capable of being operated independently of any alternating current power source for at least two hours. Conversion of direct current power to alternating current is acceptable.

3. Recommendation GL The licensee should upgrade the AFW system automatic initiation signals and circuits to meet safety grade requirements.

4. None of the AFW water sources are protected against tornado missiles. The licensee should complete an evaluation con sidering a postulated tornado plus a single active failure to determine any AFW system modifications or procedures necessary to assure a sufficient AFW water supply or assure that the plant can be brought to a safe shutdown condition in such an event.

RECIRC DEEP

,W ELL F

LC MOV FA MO)V MOV LC FA mov RECIRC MOV FA FAIASSMF

~~-40, t>"ALYLOE Mov LC FA MOV FA SERV ICE WATER B

RECIRC MFW BYPASS FA M

(

VFA MFW BYPASS O

LEGEND.

Co FA

- FAIL AS IS MFW OPE NORALLYBYPASS

-OENLL NOMLLYE MOV -OTO OPRAED DVALVE Auxiliary Feedwater System H.B. Robinson

Basis for Auxiliary Fee6water System Flow Requirements As a result of recent staff revieis of operating plant Auxiliary Feed water Systems (AF1S),

the staff concludes that the design bases and criteria provided by licensees for establishing AFWS requirements for flow to the steam generator(s) to assure adequate removal of reactor decay heat are not well defined or documented.

We require that you provide the following AFWS flol: design basis infor mation as applicable to the design basis transients and accident con ditions for your plant.

1. a. Identify the plant transient and accident conditions considered in establishing AFWS flow requirements, including the following events:

1)

Loss of Main Feed (LMFW)

2) LMFW w/loss of offsite AC power

3) LMFW w/loss of onsite and offsite AC power

4)

Plant cooldown

5) Turbine trip with and without bypass

6)

Main steam isolation valve closure

7)

Main feed line break

8) Main steam line break

9) Small break LOCA

10)

Other transient or accident conditions not listed above

b. Describe the plant protection acceptance criteria and corres ponding technical bases used for each initiating event identi fied above.

The acceptance criteria should address plant limits such as:

Maximum RCS pressure (PORV or safety valve actuation)

- Fuel temperature or damage limits (DNB, PCT, maximum fuel central temperature)

- RCS cooling rate limit to avoid excessive coolant shrinkage

- Minimum steam generator level to assure sufficient steam generator heat transfer -surface to remove decay heat and/or cool down the primary system.

2. Describe the analyses and assumptions and corresponding technical justification used with plant condition considered in l.a. above including:

a. Maximum reactor power (including instrument error allowance) at the time of the initiating transientnor-.accident.

b. Time delay from initiating event to reactor trip,.

c. Plant parameter(s) which initiates AFWS flow and time delay between initiating event and introduction of AFWS flow into steam generator(s).

d. Minimum steam generator water level when initiating event occurs.

e. Initial steam generator water inventory and depletion rate before and after AFWS flow commences -

identify reactor decay heat rate used.

f. Maximum pressure at which steam is released from steam generator(s) and against which the AFW pump must develop sufficient head.

g. Minimum number of steam generators that-must receive AFW flow; e.g. 1 out of 2?, 2 out of 4?

h. RC flow condition -

continued operation of RC pumps or natural circulation.

1.

Maximum AEW inlet temperature.

j.

Following a postulated steam or feed line break, time delay assumed to isolate break and direct AF flow to intact steam generator(s).

AFW pump flow capacity allowance to accommodate the time delay and maintain minimum steam generator water level.

Also identify credit taken for primary system-heat removal due to blowdown.

k. Volume and maximum temperature of water in main feed lines between steam generator(s) and AFWS connection to main feed line.

1. Operating condition of steam generator normal blowdown following initiating event.

m. Primary and secondary system water and metal sensible heat used for cooldown and AFW flow sizing.

n. Time at hot standby and time to cooldown RCS to RHR system cut in temperature to size AFW water source inventory.

3. Verify that the AFR4 pumps in your plant will. supply the necessary flow to the steam generator(s) asdetermined by items 1 and 2 above considering a single failure. Identify the margin in sizing the pump flow to allow for pump recirculation flow, seal leakage and pump wear.

RECIRC DELI' WELL FA LC FA MMOV MO I

O LC FA F

A MOV RECIRC MOV FA LC MOV IFA IMov FA SERVICE WATER 7J RECIRC MFW BYPASS FFA O E MOV BYPASS LEGEND CO FA FAIL AS IS MFW

-OPEN NORMALLY BYPASS S-NORMALLY CLOSED MO\\/ - MOTOR OPERATED VALVE LC

- LOCKED CLOSED Auxiliary Feedwater System IH.B. Robinson

Basis for Auxiliary Feecwater System Flow Requirements As a result of recent staff review:s of operating pliant Auxiliary Feed water Systems (AFWS), the staff concludes that.he design bases and criteria provided by licensees for establishing AFWS requirements for flow to the steam generator(s) to assure adequate removal of reactor decay heat are not well defined or documented.

We require that you provide the following AFWS flo'; design basis infor mation as applicable to the design basis transients and accident con ditions for your plant.

1. a. Identify the plant transient and accident conditions considered in establishing AFWS flow requirements, including the following events:

1)

Loss of Main Feed (LMFW)

2)

LMFW w/loss of offsite AC power

3) LMFW w/loss of onsite and offsite AC power

4) Plant cooldown

5) Turbine trip with and without bypass

6) Main steam isolation valve closure

7) Main feed line break

8) Main steam line break

9) Small break LOCA

10) Other transient or accident conditions not listed above

b.

Describe the plant protection acceptance criteria and corres ponding technical bases used for each initiating event identi fied above.

The acceptance criteria should address plant limits such as:

Maximum RCS pressure (PORV or safety valve actuation)

Fuel temperature or damage.limits (DNB, PCT, maximum fuel central temperature)

- RCS cooling rate limit to avoid excessive coolant shrinkage

- Minimum steam generator level to assure sufficient steam generator heat transfer surface to remove decay heat and/or cool down the primary system.

2. Describe the analyses and assumptions and corresponding technical justification used with plant condition considered in l.a. above including:

a. Maximum reactor power (including instrument error allowance) at the time of the initiating transient-or-.accident.

b. Time delay from initiating event to reactor trip.

c. Plant parameter(s) which initiates AFWS flow and time delay between initiating event and introduction of AFWS flow into steam generator(s).

d. Minimum steam generator water level when initiating event occurs.

e. Initial steam generator water inventory and depletion rate before and after AFWS flow commences - identify reactor decay heat rate used.

f. Maximum pressure at which steam is released from steam generator(s) and against which the AFW pump must develop sufficient head.

9. Minimum number of steam generators that-must receive AFW flow; e.g. 1 out of 2?, 2 out of 4?

h. RC flow condition - continued operation of RC pumps or natural circulation.

i. Maximum AFW inlet temperature.

j.

Following a postulated steam or feed line break, time delay assumed to isolate break and direct AFW flow to intact steam generator(s). AFW pump flow capacity allowance to accommodate the time delay and maintain minimum steam generator water level.

Also identify credit taken for primary system->heat removal due to blowdown.

k. Volume and maximum temperature of water in main feed lines between steam generator(s) and AFWS connection to main feed line.

1. Operating condition of steam generator normal blowdown following initiating event.

m. Primary and secondary system water and metal sensible heat used for cooldown and AFN flow sizing.

n. Time at hot standby and time to cooldown RCS to RHR system cut in temperature to size AFW water source inventory.

3. Verify that the AFW pumps in your plant will. supply the necessary flow to the steam generator(s) asdetemined by items 1 and 2 above considering a single failure. Identify the.margin in sizing the pump flow to allow for pump recirculation flow, seal leakage and pump wear.

1 pd1tN REGj4 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 0z September 21, 1979 Docket No.: 50-261 Mr. J. A. Jones

'Senior Vice-President Carolina Power and Light Company 336 Fayetteville Street Raleigh, North Carolina 27602

SUBJECT:

NRC REQUIREMENTS FOR AUXILIARY FEEDWATER SYSTEMS AT H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT 2 The purpose of this letter is to advise you of our requirements for the auxiliary feedwater systems at the subject facility. These requirements were identified during the course of the NRR Bulletins and Orders Task Force review of operating reactors in light of the accident at Three Mile Island, Unit 2. to this letter identifies each of the requirements applicable to the subject facility. These requirements are of two types, (1) generic requirementsapplicable to most Westinghouse-designed operating plants, and (2) plant-specific requirements applicable only to the subject facility. contains a generic request for additional information regarding auxiliary feedwater system flow requirements.

The designs and procedures of the subject facility should be evaluated against the applicable requirements specified in Enclosure 1 to determine the degree to which the facility currently conforms to these requirements. The results of this evaluation and an associated schedule and commitment for implementation of requireO changes or actions should be provided for NRC staff review within thirty days of receipt of this letter. Also, this schedule should indicate your date for submittal of information such as design changes, procedure changes or Technical Specification changes to be provided for staff review. You may also provide your response to the items in Enclosure 2 at that time.

In addition to the requirements identified in this letter, other requirements which may be applicable to the subject facility are expected to be generated by the Bulletins and Orders Task Force. Such requirements are those resulting from our review of the loss-of-feedwater event and the small break loss-of-coolant accident as described in the Westinghouse report WCAP-9600, "Report on Small

Mr. J. September 21, 1979 Break Accidents for Westinghouse NSSS System."

Our specific concerns include systems reliability (other than the auxiliary feedwater system), analyses, guidelines and procedures for operators, and operator training.

We plan to identify, in separate correspondence, the requirements resulting from the additional items from the Bulletins and Orders Task Force review.

incerely, Darrell G. Eisen ut, Acting Director Division of Operating Reactors Office of Nuclear Reactor Regulation

Enclosures:

As stated cc: w/enclosures See next page

Mr.

J. A. Jones Carolina Power and Light Company cc:

G. F..Trowbridge, Esquire Shaw, Pittman, Potts and Trowbridge 1800 M Street, N.W.

Washington, D. C. 20036 Hartsville Memorial Library Home and Fifth Avenues Hartsville, South Carolina 29550 Michael C. Farrar, Chairman Atomic Safety and Licensing Appeal Board Panel U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Richard S. Salzman Atomic Safety and Licensing Appeal Board Panel U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Dr.-W. Reed Johnson Atomic Safety and Licensing Appeal Board Panel U. S. Nuclear Regulatory Commission Washington, D. C. 20555

ENCLOSURE 1 X.6 (W)

H. B. ROBINSON AUXILIARY FEEDWATER SYSTEM X 6.1

System Description

X 6.1.1 Configuration Overall Design A simplified drawing of the H. B. Robinson auxiliary feedwater system (AFWS) is shown in Figure 1. Basically the system consists of two motor driven pumps located in the auxiliary building, each with a capacity of 300 gpm at 1300 psi. and a turbine driven pump located in the seismic portion of the turbine building with a capacity of 600 gpm at 1300 psi.

The turbine-driven pump is not tornado missile protected. All three pumps take their primary suction from the seismic Category I condensate storage tank. The system is automatic ally started by signals identified in Section 6.1.4.3. The two motor driven pumps take suction from a common header and feed all three steam generators through lines which are cross-connected in the pump room as shown in Figure 1. There is a normally closed motor operated valve in each line to the steam generators. The AFWS discharge lines from the motor driven pumps connect to the main feed lines inside containment.

The turbine driven pump takes its source of water from the CST common header and feeds into the main feed system through three normally closed motor-operated valves. The auxiliary feedwater lines

-2 from the turbine driven pump train connect to the feedwater regulating valve bypass lines for each individual steam generator outside containment.

The system was evaluated for high energy line breaks in the main steam, main feed lines and the AFWS itself. For the main feed and steam line breaks, at least one train of the AFWS will be able to feed at least one steam generator which is sufficient to safely shut down the plant. Remote manual action would be required to isolate the affected steam generator and AFWS line feeding that generator.

For the high energy line break in the Auxiliary Feedwater System, the worst break is in the motor driven pump trains' cross connection line. In this case, since the pumps and associated motor operated valves are in the same room, these trains could be shorted out if the cross connection line is not isolated in time. The steam driven train is, however, still available to shut down the plant, provided the pump does not fail. If the pump fails, auxiliary feedwater flow would be lost, but main feedwater could still be used to supply water to the steam generators.

Sources of Water There are three sources of water for the auxiliary feedwater system.

The primary source is from a 200,000 gallon seismic Category I condensate storage tank (CST),of which 35,000 gallons are dedicated to the auxiliary feedwater system. This will last a minimum of two

-3 hours. The CST is not protected against tornado missiles. All valves from the tank to the AFWS are normally open, and are local manually operated valves.

The secondary source of water as well as long term cooling is the seismic Category I service water system and the ultimate heat sink.

The piping for this system is buried or in the auxiliary building so it is protected against tornado missiles, however, the pumphouse which contains the service water pumps is not protected against tornado missiles. The valves connecting this system to the AFWS are locked closed manual valves. Thus, it would take time to open these valves.

There is, however, sufficient time to open these valves before the condensate storage tank is depleted or the steam generators boil dry.

The back-up source of water is the non-seismic deep well system which has a capacity of 600 gpm. The valves that connect this system with the AFWS are manually locked closed valves.

-4 X.6.1.2 Components - Design and Classification Component Environmental Design Seismic Qualification Classification Category Motor Driven Pump Ambient ASME VIII I

Turbine Driven Pump ASME VIII I

Piping B1.1 I

Valves/Actuators 831.1 I

Control & Actuation System I

Indication N.S.

Condensate Storage I

Service Water System I

Deep Well System N.S.

Main Steam Lines to I

Turbine Driven Pump (connects upstream MSIV)

Main Feed Lines from Main I

Feed Block Valves to Steam Generators N.S -

Non Seismic Category I X.6.1.3 Power Sources Each motor driven pump is supplied power from its respective emer gency bus which receives power from normal station transformers or separate diesel generators (DG). The three motor operated discharge valves (MOV) in the motor driven pump trains are powered from the emergency buses. The valve for steam generator A is powered from emergency bus El or E2. The valve for steam generator (SG) B is

00

-5 powered from bus E2 and the valve for SG C.is from bus El.

The MOV's are normally closed and fail-as-is. The instrumentation for these trains is taken off the station batteries.

The turbine driven pump is supplied steam from all three steam generators.

The steam is taken off upstream of the MSIV and passes through a motor operated valve, a check valve and goes into a common header which feeds the turbine. The motor operated valves take their power from the emergency buses.

The valves from SG B&C are connected to bus El, and the valve from SG A is connected to bus E2. The motor operated valves in the turbine pump discharge lines to the steam generator also take their power from the emergency buses with valves for SG A&C from bus E2 and SG B from bus El.

The above MOV's are normally closed and fail-as-is.

The system does not meet NRC's current power source diversity position with respect to the turbine driven pump train valves although manual actipn can be taken at the valves.

(See recommendation GS-5)

In addition, cooling to the lube oil coolers to the turbine driven pump is from the service water system, which takes its power from the emergency busses. Upon station blackout (loss of all AC),cooling is lost to the turbine which could result in a possible shaft seizure or wiped bearings in the turbine within a short time (approximately 10 to 20 minutes), thus resulting in the loss of all AFW flow. However, the lube oil cooling water piping and valves are arranged so that

-6 the lube oil cooler can be cooled by AFW pump flow; but the valve align ment must be changed (See Recommendation GS-5).

X.6.1.4 Instrumentation and Controls X.6.1.4.1 Controls The following AFWS manual controls are available in the control room:

1. Motor Driven Pump Start-Stop

2. Steam Inlet Line to Turbine - Motor Operated Valves Open-Close

3. AFW Discharge Line Motor Operated Valves - Open-Close All other valves as well as the above can be controlled at the local stations. Steam generator level is controlled manually at the motor operated discharge valves locally or in the control room by starting and stopping the pumps.

X.6.1.4.2 Information available to Operator The following information is available to the operator in the control room:

1. Motor Driven Pumps Start-Stop

2. Motor Operated Valves (All) Opened-Closed

3. Motor and Turbine Driven Pumps Discharge Pressure

4. Steam Generator Level

5. Steam Generator and Steam Header Pressure

-7 This information is also available at the local control stations.

The following alarms are located in the control room:

1. Condensate Storage Tank Low Level

2. Equipment on Local Control

3. Steam Penerator(s) Low Low Level Alarms

4. Steam Generator High Level Alarm

5. Low AFW Pump Discharge Pressure Alarm and Trip

6. Loss of Lube Oil X.6.1.4.3 Initiation Signals for Automatic Operation The following signals initiate automatic operation of the AFWS:

1. Low-Low Level on Steam Generator

a. 2 out of 3 on one steam generator initiates the motor driven pump trains.

b. 2 out of 3 on two steam generators initiates the turbine pump train.

2. Loss of Both Main Feed Water Pumps starts Motor Driven Pump Trains.

3. Loss of Offsite Power starts motor driven pump trains.

8

4. Safety Injection Signal starts motor driven pump trains.

5. Loss of Voltage ( <70%) on buses 1 and 4 starts the steam driven pump train. Steam inlet valves (MOV) are operated from buses El and E2 and therefore will open.

X.6.1.5 Testing The system is tested on a monthly bases with some exceptions. The pumps are run in recirculating mode monthly and the motor operated discharge valves are stroked monthly with the pumps off. All other valves in the system including the AFW pump turbine steam inlet valves are tested quarterly; however one steam inlet valve is operated monthly in conjunction with the monthly tests of the turbine driven pump.

All valves are checked at the end of the tests for correct positioning both in the control room and locally. The piping in the system is hydrostatically tested every 10 years. The system is tested as a whole during refueling cycle as part of the ECCS actuation test. The only pieces of equipment not tested on a periodic bases are the locked closed valves to.the service water and deep well systems.

The periodic test requirements are as follows:

9

-9 AUXILIARY FEEDWATER SYSTEM Applicability Applies to periodic testing requirements of the turbine-driven and motor-driven auxiliary feedwater pumps.

Objective To verify the operability of the auxiliary feedwater system and its ability to respond properly when required.

Specification 4.8.1 Each motor driven auxiliary feedwater pump will be started at intervals not to exceed one month, run for 15 minutes, and determined that it is operable.

4.8.2 The steam turbine driven auxiliary feedwater pump by using motor operated steam admission valves will be started at intervals not to exceed one month, run for 15 minutes, and determined that it is operable when the reactor coolant system is above the cold shutdown condition. When periods of reactor cold shutdown extend this interval beyond one month, the test shall be performed immediately following reactor heatup.

10 4.8.3 The auxiliary feedwater pump discharge valves will be tested by operator action at intervals not greater than one month.

4.8.4 These tests shall be considered satisfactory if control board indication and subsequent visul observation of the equipment demonstrate that all components have operated properly.

X.6.1.5 Technical Specifications The following technical specifications apply to H. B. Robinson. The salient features are that one pump could be.out of service for an indefinite period of time with no limiting condition for operation on the plant, that the instrumentation for the system could be out for all trains without limiting condition for operation.

SECONDARY STEAM AND POWER CONVERSION SYSTEM Applicability Applies to the operating status of turbine cycle.

- 11 Objective To define conditions of the turbine cycle steam-relieving capacity.

Auxiliary Feedwater System and Service Water System operation is necessary to ensure the capability to remove decay heat from the core.

Specification 3.4.1 The reactor coolant shall not be heated above 350oF unless the following conditions are met:

a. A minimum turbine cycle steam relieving capability of twelve (12) main steam safety valves operable.

b. Two of the three auxiliary feedwater pumps must be operable.

C.

A minimum of 35,000 gallons of water in the condensate storage tank and an unlimited water supply from the lake via either leg of the plant Service Water System.

d. Essential features including system piping and valves directly associated with the above components are operable.

-12 e,

The main steam stop valves are operable and capable of closing in five seconds or less.

3.4.2 The specific activity of the secondary coolant system shall be < 0.10 pCi/gram DOSE EQUIVALENT 1-131 under all modes of operation from cold shutdown through power operation. When the specific activity of the secondary coolant system is

>0.10 pCi/gram DOSE EQUIVALENT 1-131, be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The specific activity of the seco.ndary coolant system shall be determined to be within the limit by performance of the sampling and analysis program of Table 4.1-2.

3.4.3 If, during power operations, any of the specifications in 3.4.1 above cannot be met within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the operator shall initiate procedures to put the plant in the hot shutdown condition. If any of these specifications cannot be met within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the operator shall cool the reactor below 350 0 F using normal procedures.

X 6.2 Reliability Evaluation X 6.2.1 Dominant Failure Modes The system was analyzed for three cases:

(a) loss of feedwater with offsite power available;

13 (b) loss of feedwater with onsite AC power available; (c) loss of feedwater with only DC power available.

The dominant failure modes for each case are summarized below.

X 6.2.1.1 LOFW with Offsite Power available The dominant failure modes are as follows:

(1) loss of condensate storage tank supply due to failure of valves in the supply line plus failure to manually actuate backup service water supply by locally opening closed valves.

(2) one train out indefinitely for maintenance plus hardware and maintenance outages in other two trains.

X.6.2.1.2 LOFW with Onsite AC power available The system was analyzed assuming loss of offsite power, considering the possible loss of one of the diesel generators. The dominant failure modes for this case are similar to those discussed in the previous case.

X.6.2.1.3 LOFW with Only DC Power Available The system will fail in the long-term due to reliance of turbine lube oil cooling on AC power without operator action to realign cooling water valves (See Section 6.1.3). In the short-term (6:45 minutes), unavail ability is dominated by maintenance and hardware failures of the turbine driven pump train and failure to manually open the steam and water MOVs which do not open without AC power.

13 (b) loss of feedwater with onsite AC power available; (c) loss of feedwater with only DC power available.

The dominant failure modes for each case are Fummarized below.

X 6.2.1.1 LOEW ith Offsite ower available The dominant failure modes are as follows:

(1) loss of condensate storage tank supply due to failure of valves in the supply line plus failure to manually actuate backup service water supply by locally opening closed valves.

(2) one train out indefinitely for maintenance plus hardware and maintenance outages in other two trains.

X.6.2.1.2 LOFW with Onsit A power available The system was analyzed assuming loss of offsite power, considering the possible loss of one of the diesel generators. The dominant failure modes for this case are similar to those discussed in the previous case.

X.6.2.1.3 LO W with Only DC Power Available The system will fail in the long-term due to reliance of turbine lube oil cooling on AC power without operator action to realign cooling water valves (See Section 6.1.3). In the short-term (6 45 minutes), unavail ability is dominated by maintenance and hardware failures of the turbine driven pump train and failure to manually open the steam and water MOVs which do not open without AC power.

15 X.6.3.1 Short-Term

• Recommendation GS The licensee should propose modifications to the Technical Specifications to limit the time that one AFW system pump ano its associated flow train and essential instrumention can be inoperable. The outage time limit and subsequent action time should be as required in current Standard Technical Specifications; i.e.,,72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, respectively.

2. Recommendation GS The licensee should lock open single valves cr multiple valves in series in the AFW system pump suction piping and lock-open other single valves or multiple valves in series that could interrupt all AFW flow. Monthly inspections should be performed to verify that these valves are locked and in the open position.

These inspections should be proposed for incorporation into the survei.lance requirements of the plant Technical Specifications. See Recommendation GL-2 for thE longer-term resolution of this concern.

3.

Recommendation GS Emergency procedures for transferring to alternate sources of AFW supply should be available to the plant operators. These procedures should include criteria to inform the operator when, and in what order, the trarsfer to alternate water sources should take place. The following cases should be covered by the procedures:

16

• The case in which the primary water supply is not initially available. The procedures for this case should include any operator actions required to protect the AFW system pumps

,against self-damage before water flow is initiated; and,

• The case in which the primary water supply is being depleted.

The procedure for this case should provide for transfer to

-the alternate water sources prior to draining of the primary water supply.

4. Recommendation GS The as-built plant should be capable of pro viding the required AFW flow for at least two hours from one AFW pump train independent of any alternating current power source... If manual AFW system initiation or flow control is required following a complete loss of alternating current power, emergency procedures should be established for manually initiating and controlling the system under these conditions. Since the water for cooling of the lube oil for the turbine-driven pump bearings may be dependent on alter nating current power, design or procedural changes shall be made to eliminate this dependency as soon as practicable. Until this is done, the emergency procedures should provide for an individual to be stationed at the turbine-driven pump in the event of the loss of all alternating current power to monitor pump bearing and/or lube oil temperatures. If necessary, this operator would cperate the turbine-driven pump in an on-off mode until alternating current

17 power is restored. Adequate lighting powered by direct current power sources and communications at local stations should also be provided if manual initiation and control of the AFW system is needed,, (See Recommendation GL-3 for the longer-term resolution of this concern.)

Recommendation GS The licensee shouli confirm flow path avail

5.

ability of an AFW system flow train that has been out of service to perform periodic testing or maintenance as follows:

• Procedures should be implemented to require an operator to determine that the AFW system valves are properly aligned and a second operator to independently verify that the valves are properly aligned.

• The licensee should propose Technical Specifications to assure that prior to plant startup following an extended cold shutdown, a flow test would be performed to verify the normal flow path from the primary AFW*system water source to the-steam generators. The flow test should be conducted with AFW system valves in their normal alignment.

6. Recommendation GS The licensee should verify that the automatic start AFW system signals and associated circuitry are safety-grade. If this cannot be verifie', the AFW system automatic initiation system shoul be modified in the short-term to meet the functional requirements listed below. For the longer term, the automatic initiation signals and circui should be upgraded to meet safety-grade requirements as indicated in

-18 Recommendation GL-5.

The design should provide for the automatic initiation of the auxiliary feedwater system flow.

The automatic initiation signals and circuits should be designed so that a single failure will not result in the loss of auxiliary feedwater system function.

Testability of the initiation signals and circuits shall be be a feature of the design.

The initiation signals and circuits should be powered from the emergency buses.

Manual capability to initiate the auxiliary feedwater system from the control room should be retained and should be implemented so that a single failure in the manual circuits will not result in the loss of system function.

The alternating current motor-driven pumps and valves in the auxiliary feedwater system should be included in the automatic actuation (simultaneous and/or sequential) of the loads to the emergency buses.

The automatic initiation signals and circuits shall be designed so that their failure will not result in the loss of manual capability to intiate the AFW system from the control room.

7. The licensee should propose modifications to the Technical Specifications to provide for periodic testing of the normally locked closed service water and deep well manual valves.

8. The licensee should propose modifications to the Technical Specifications to provide for monthly testing of all steam admission valves to the turbine pump.

X.6.3.2 Additional Short-Term Recommendations The following additional short-term recommendations resulted from the staff's Lessons Learned Task Force review and the Bulletins and Orders Task Force review of AFW systems:at Babcock & Wilcox-designed operating plants stosequent to our review of the AFW system designs at W-and C-E designed operating plants. They have not been examined for specific applicability to this facility.

1.

Recommendation - The licensee should provide redundant level in*

dications and low level alarms in the control room for the AFW system primary water supply to allow the operator to anticipate the need to make up water or transfer to an alternate water supply and prevent a low pump suction pressure condition from occurring.

The low level alarm setpoint should allow at least 20 minutes for operator action, assuming that the largest capacity AF pump is operating.

-20

2. Recommendation -

The licensee should perform a 72-hour endurance test on all AFW system pumps if such a test or continuous period of operation hasnot been accomplished to date. Following the 72-hour pump run, the pumps should be shut down and cooled down and then restarted and run for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Test acceptance criteria should include demonstrating that the pumps remain within design limits with respect to bearing/bearing oil temperatures and vibration and that pump room ambient conditions (temperature, humidity) do not exceed environmental qualification limits for safety related equipment in the room.

3. Recommendation - The licensee should implement the following requirements as specified by Item 2.1.7.b on page A-32 of NUREG-0578:

"Safety-grade indication of auxiliary feedwater flow to each steam generate. shall be provided in the control room.

The auxiliary feedwater flow instrument channels shall be powered from the emergency buses consistent with satisfying the emergency power diversity requirements for the auxiliary feedwater system set forth in Auxiliary Systems Branch Techn nical Position 10-1 of the Standard Review Plan, Section 10.4.9."

4. Recommendation - Licensees with plants which require local manual realignment of valves to conduct periodic tests on one AFW system train and which have only one remaining AFW train available for

-21 operation, should propose Technical Specifications to provide that a dedicated individual who is in communication with the control room be stationed at the manual valves. Upon instruction from the control room, this operator would re-align the valves in the AFW system train from the test mode to its operational alignment.

X.6.3.3 Long-Term Long-term recommendations for improving the system are as follows:

1. Recommendation GL Licensees with plants in which all (primary and alterna'.e) water supplies to the AFW systems pass through valves in a single flow path should install redundant parallel flow paths (piping and valves).

Licensees with plants in which the primary AFW system water supply passes through valves in a single flow path, but the alternate AFW system water supplies connect to the AFW system pump suction piping downstream of the above valve(s), should install redundant valves parallel to the above valve(s) or provide automatic opening

• of the valve(s) from the alternate water supply upon low pump suction pressure.

The licensee should propose Technical Specifications to incorporate appropriate periodic inspections to verify the valve positions.

22

2. Recommendation.GL At least one AFW system pump and its associated flow path and essential instrumentation should auto matically initiate AFW system flow and be capable of being operated independently of any alternating current power source for at least two hours. Conversion of direct current power to alternating current is acceptable.

3. Recommendation GL The licensee should upgrade the AFW system automatic initiation signals and circuits to meet safety grade requirements.

4. None of the AFW water sources are protected against tornado missiles. The licensee should complete an evaluation con sidering a postulated tornado plus a single active failure to determine any AFW system modifications or procedures necessary to assure a sufficient AFW water supply or assure that the plant can be brought to a safe shutdown condition in such an event.