ML14192A106

Safety Evaluation Supporting Util Commitment to Provide Auxiliary Feedwater Sys Reliability

ML14192A106
Person / Time
Site:	Robinson
Issue date:	12/02/1980
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML14192A105	List: ML14192A104 ML14192A106
References
NUDOCS 8101050113
Download: ML14192A106 (20)

Text

SAFETY EVALUATION REPORT H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT NO. 2 IMPLEMENTATIONS OF RECOMMENDATIONS FOR AUXILIARY FEEDWATER SYSTEMS

1. Introduction and Backaround The Three Mile Island Unit 2 (TMI-2) accident and subsequentinvestigations and studies highlighted the importance of the Auxiliary Feedwater System (APS) in the mitigation of transients and accidents.

As part of our assessment of the TMI-2 accident and related implications for ocerating plants, we evaluated the AFW systems for all operating and near-term operating license plants having nuclear steam supply systems (NSSS) designed by Westinghouse (NUREG-0611) or Combustion Engineering (MUREG-0635).

Our evaluations of these system designs are contained in the NUREGs along with our recommendations for each plant and the concerns which led to each recommendation.

The objectives of the evalua tion -ere to: (1) identify necessary changes in AFW system design or related proce-ires in order to assure the safe operation of these plants, and (2) to identify other system characteristics of the AFW systems which, on a long term basis, may require system modifications.

To accomplish these objectives, we:

(1) Reviewed plant specific AF-W system designs in light of current regulatory requirements (SRP)

and, (2) Assessed the relative reliability of the various AFW systems under various oss of feedwater transients (one of which was the initiating event of iI-2) and other postulated failure conditions by determining the potential for AFW system failure due to common causes, single point vulnerabilities, and human error.

10 5 0/3

-2 We concluded that the implementation of the recommendations identified during this review will considerably improve the reliability of the AFW systems for each operating plant.

The following qeneric recommendations did not apply to this plant:

GS-3, GS-8, GL-l and GL-4.

The basis for these recommendations can be found in Appendix III of NUREG-0611, and the system description which determined the specific reason for not applying these recommendations to this plant can be found in Appendix A of NUREG-0611.

II.

Implementation of Our Recommendations A. Short Term Recommendations

1. Recommendation GS-1 -"The licensee should propose modifications to the Technical Specifications to limit the time that one AFW system pump and its associated flow train and essential instrumentation can be inoperable. The outage time limit and subsequent action time should be as required in current Technical Specifications; i.e., 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, respectively."

In response, the licensee indicated in a letter dated May 15, 1980, that the H. B. Robinson Technical Specifications will be revised to allow for plant operation for up to seven days with one AFW pump inoperable and up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> with two AFW pumps inoperable. This proposed Technical Specification revision is not in compliance with our recommendation And is, therefore, unacceptable.

We require. the licensee to revise the H. B. Robinson Technical Specifications to

include the current Standard Technical Specification requirements; i.e. with one AFW pump inoperable, plant operation is limited to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with a subsequent action time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and, with two AFW pumps inoperable, plant shutdown is immediately initiated. We will report resolution of this item in a supplement to this SER,

2. Recommendation GS "The licensee should lock open single valves or multiple valves in series in the AFW system pump suction piping and lock open other single valves or multiple valves in series that could interrupt all AFW flow. Monthly inspections should be performed to verify that these valves are locked and in the open position. These inspections should be proposed for incorporation into the surveillance requirements of the plant Technical Specifications. See Recommendation.

GL-2 for the longer-term resolution of this concern."

In response, the licensee indicated in letters dated October 31, 1979, and May 15, 1980, that the valves in the supply piping between the condensate storage tank and the suction of each of the three AFW pumps are maintained in a locked open condition. Plant Operating Procedure OP-14A provides for a monthly verification of the position of these valves. In addition, the monthly surveillance test of the AFW pumps which is required by the plant Technical Specifications assures that the suction supply is available. These measures are required only on an interim basis pending resolution and implementation of Recommendation GL-2. For these reasons, we conclude that incorporation of a specific

-4 monthly valve position verification requirement in the plant Technical Specifications is not necessary, and therefore the licensee is in compliance with our recommendation pending verification of the surveil lance procedure by the Office of Inspection and Enforcement.

3. Recommendation G$ "Emergency procedures for transferring to alter nate sources of AFW supply should be available to the plant operators.

These procedures should include criteria to inform the operator when, and in what order, the transfer to alternate water sources should take place. The following cases should be covered by the procedures:

The case in which the primary water supply is not initially available. The procedures for this case should include any operator actions required to protect the AFW system pumps against self-damage before water flow is initiated; and,

- The case in which the primary water supply is being depleted.

The procedure for this case should provide for transfer. to the alternate water sources prior to draining of the primary water supply."

In response, the licensee indicated in a letter dated October 31, 1979, that a new operating procedure has been developed to incorporate the proper means for transferring AFW supply to alternate sources for the two cases described above.

This procedure has been incorporated into the Plant Operating Manual as of January 1-,

1980.

We conclude that the licensee's response is ac:eptable, and therefore the licensee is in compliance with our recommendations pending verification of the operating procedure by the Office of Inspection and Enforcement.

4. Recommendation GS-5 -"The as-built plant should be capable of providing the required AF flow for at least two hours from one AFW pump train, independent of any alternating current power source. If manual AF system initiation or flow control is required following a complete loss of alternating current power, emergency procedures should be established for manually initiating and controlling the system under these condi tions. Since the water for cooling of the lube oil for the turbine driven pump bearings may be dependent on alternating current power, design or procedural changes shall be made to eliminate this dependency as soon as practicable. Until this is done, the emergency procedures should provide for an individual to be stationed at the turbine-driven pump in the event of the loss of all alternating current power to monitor pump bearing and/or-lube oil temperatures.

If necessary, this operator would operate the turbine-driven pump in a manual on-off mode until alternating current power is restored. Adequate lighting powered by direct current power sources and communications at local stations should also be provided if manual initiation and control of the AFW system is needed. (See Recommendation GL-3 for the longer term resolution of this concern.)"

In response to this recommendation, the licensee indicated in letters dated October 31, 1979, and May 15, 1980, that the turbine-driven pump can run for two hours.independent of any AC power supply. However, manual operator action is required to realign the cooling water valves

-6 for the lube oil cooler, open the main steam admission valves to the turbine and open the pump discharge isolation valves. An emergency instruction has been developed and implemented (issued November 30, 1979) to incorporate the above actions as part of the station blackout proce dure. We conclude that the licensee's response is acceptable, and therefore the licensee is in compliance with our recommendation pending verification of the procedure by the Office of Inspection and Enforce ment.

5.

Recommendation GS "The licensee should confirm flow path avail ability of an AFW system flow train that has been out of service to perform periodic testing or maintenance as follows:

- Procedures should be implemented to require an operator to determine that the AW system valves are properly aligned and a second operator to independently verify that the valves are properly aligned.

The licensee should propose Technical Specifications to assure that prior to plant startup following an extended cold shutdown, a flow test would be performed to verify the normal flow path from the primary AFW system water source to the steam generators.

The flow test shoulc be conducted with AFW system valves in their normal alignment."

In our position letter of March 7, 1980, we modified our requirements to the licensee as follows: "1) modify the operating procedures to require a second operat:; (differn.- from the first operator) to.

independently verify the proper valve alignment after the AFW system flow train has been out of service to perform periodic testing or main tenance, and 2) propose the following modification for the AFW system Technical Specification:

'Prior to startup following a refueling shutdown or any cold shutdown of longer than 30 days duration, conduct a test to demonstrate that the motor driven AF pumps can pump water from the CST to the steam generators."'

In response, the licensee indicated in a letter dated May 15, 1980, that: 1) Plant Operating Procedure OP-14A will be revised to require a second operator (different from the first operator) to independently verify proper valve position in the main AFW flow paths between the condensate storage tank and the steam generators following maintenance and testing. This requirement will be implemented prior to startup from the next refueling outage, and 2) following any plant cold shut down, both motor driven AFW pumps and the turbine driven AFW pump (as heat-up continues and sufficient steam pressure for turbine opera tion is available) are required to feed the steam generator inorder to initiate plant startup. Therefore, an AFW flow path from the conden sate storage tank to the steam generator is automatically verified.

We conclude that the licensee's response to these two recommendations is acceptable, and therefore the licensee is in compliance with our recommendation, pending verification of procedures by the Office of Inspection and Enforcement.

-8

6. Recommendation GS "The licensee should verify that the automatic start AFW system signals and associated circuitry are safety-grade.

If this cannot be verified, the AFW system automatic initiation system should be modified in the short-term to meet the functional require ments listed below. For the longer term, the automatic initiation signals and circuits should be upgraded to meet safety-grade require ments as indicated in Recommendation GL-5.

The design should provide for the automatic intiation of the auxiliary feedwater system flow.

- The automatic initiation signals and circuits should be designed so that a single failure will not result in the loss of auxiliary feedwater system function.

Testability of the initiation signals and circuits shall be a feature of the design.

- The initiation signals and circuits should be powered from the emergency buses.

- Manual capability to initiate the auxiliary feedwater system from the control room should be retained and should be imple mented so that a single failure in the manual circu ts will not result in the loss of system function.

The alternating current motor-driven pumps and valves in the auxiliary feedwater system should be included in the automatic actuation (simultaneous and/or sequential) of the loads to the emergency buses.

The automatic initiation signals and circuits shall be designed so that their failure will not result in the Toss of manual capability to initiate the AFW system from the control room.

In response, the licensee in a letter dated December 31, 197F, state that the H. B. Robinson AFWS has been designed to include the following:

"1. The auxiliary.feedwater system is automatically initiated as a result of:

a. Safety injection initiation

b. Loss of offsite power

c. Loss of two main feedwater pumps

d. 2/3 steam generator level channels sensing low-low level (15%) on 1/3 steam generators will automatically start both motor driven AFW pumps and open discharge valves

e. 2/3 level channels sensing low-low level on 2/3 steam generators will automatically start the steam driven AFW pump and open discharge valves.

2. The automatic initiation signals and circuits are designed so that a single failure will not result in the loss of auxiliary system 'unction.

-10

3.

Testability of the initiating signals and circuits is possible.

Automatic initiation of the auxiliary feedwater system is assured by the Safeguard Protection Logic System and is verified by the Periodic Testing Program. Manual initiation of the system is also assured by the Periodic Testing Program.

4. The initiating signals and circuits are powered from the emergency buses El and E2.

5. Manual capability to initiate the auxiliary feedwater system from the Control Room is possible with a single failure in the manual circuits and will not result in the loss of system function.

6. The AC motor driven pumps and valves in the auxiliary feedwater system are automatically sequenced onto the emergency buses following a loss of all power.

7. Manual capability to initiate the AFWS from the Control Room is still possible when failures occur in the automatic initiating signals and circuits.

The automatic initiating signals and circuits were installed when the plant was built in accordance with safety grade requirements."

We conclude that this response satisfies the "control grade" require ments specified in the NUREG-0578 position and clarifications and is, therefore, acceptable. We conclude that the licensee is in compliance with this recommendation. Refer to GL-5 for long term "safety grade" implementation of this item.

7. NRC Short Term Plant Specific Recommendation No. 7 -"The licensee should propose modifications to the Technical Specifications to provide for periodic testing.of the normally locked closed service water and deep well manual valves."

In response, the licensee indicated in a letter dated May 15, 1980, that operability of the normally locked closed service water and deep well manual valves is demonstrated by quarterly periodic testing. This test includes manually cycling the valves. In addi tion, the test procedures are incorporated into the inservice inspection (ISr) program.

8. NRC Short Term Plant Specific Recommnendation No. 8 -"The licensee should propose modifications to the Technical Specifications to provide for monthly testing of all steam admission valves to the turbine pump.

In response, the licensee indicated in a letter dated October 31, 1979, that all motor operated steam admission valves are currently tested on a monthly basis by Periodic Test 22.1 in accordance with the Technical Specification surveillance requirements of Section 4.8.2..4e conclude that the licensee's response is acc.otatbl.

and therefore, the licensee is in compliance with this recmnendation.

-12 B. Additional Short Term Recommendations

1. Recommendation - "The licensee should provide redundant level indica tions and low level alarms in the control room for the AFW system primary water supply to allow the operator to anticipate the need to make up water or transfer to an alternate water supply and prevent a low pump suction pressure condition from occurring. The low level alarm setpoint should allow at least 20 minutes for operator action, assuming that the largest capacity AFW pump is operating."

In response to this recommendation, the licensee stated in a letter dated October 31, 1979, that the existing condensate storage tank is equipped with redundant level indication and one low level alarm for Control Room indication and annunciation. The low level alarm allows approximately 35 minutes for operator actions. In addition, the licensee stated that the system will be modified by the installation of a redundant low level alarm as soon as the necessary equipment becomes available.

In our position letter of March 7, 1980, to the licensee we stated that this response was acceptable for the short term.

For the long term, we require the licensee to provide the following: 1) verify that the H. B. Robinson Station design will consist of redundant condensate storage tank level indicators as well as redundant level alarms inside the control room after the system modification is completed; 2) verify that the above level indications and alarms

S

-13 will be redundant all the way from the detectors at the condensate storage tank to the readouts and alarms inside the control room.

Power supplies for the level indication and alarms should be redun dant. Since the condensate storage tank is a seismic Category I water source, the entire water level indication and alarm system shoule also in the long term (111/80) be designed to safety grade requirements including the use of Class 1E circuitry and power supplies.

The licensee in a letter dated May 11, 1930, agreed to meet the above two requirements. However, the licensee stated that full upgrading of the level indicators and alarms as described in require ment (2) above will be accomplished as part of the requirements of Regulatory Guide 1.97, Revision 2 as applicable to operating plants, which is scheduled for implementation by June 1, 1982. This proposed implementation schedule does not meet the required implementation date of January 1, 1982, for long term modifications resulting from efforts related to NUREG-0660, "NRC Action Plan Developed as a Result 'of the TMI-2 Accident," paragraph II.E.1.1.

We require the licensee to commit to meet this date. We conclude that the licensee's response is not acceptable, and therefore, the licensee is not in compliance with this recommendation. We will report resolution of this item in a supple ment to this SER.

-14

2. Recommendation (This recommendation has been revised from the original recommendation in NUREG-0611 - "The licensee should perform a 48-hour endurance test on all AFW system pumps, if such a test or continuous period of operation has not been accomplished to date. Following the 48-hour pump run, the pumps should be shut down and cooled down and then restarted and run for one hour. Test acceptance criteria should include demonstrating that the pumps remain within design limits with respect to bearing/bearing oil temperatures and vibration and that pump room ambient conditions (temperature, humidity) do not exceed environmental qualification limits for safety-related equipment in the room.

The licensee should provide a summary of the conditions and results of the tests. The summary should include the following: 1) A brief description of the test method (including flow schematic diagram) and how the test was instrumented (i.e., where and how bearing tempera tures were measured). 2) A discussion of how the test conditions (pump flow, head, speed and steam temperature) compare to design operating conditions. 3) Plots of bearing/bearing oil temperature vs. time for each bearing of each AFW pump/driver demonstrating that temperature design limits were not exceeded. 4) A plot of pump room ambient temperature and humidity vs. time demonstrating that the pump room ambient conditions do not exceed environmental qualifi cation limits for safety-related equipment in the room. 5) A state ment confirming that the pump vibration did not exceed allowable limits during tests.

-15 The licensee indicated in letters dated October 31, 1979, and May 15, 1980, that the tests will be performed in accordance with the above requirements by the end of the next refleling outage.

Based on the above commitment, we conclude that this reccimendation is adequately met pending review of and concurrence with the test results by the Office of Inspection and Enforcement, and is, therefore, acceptable.

3. Recommendation -

"The licensee should impleinent the following -equire ments as specified by Item 2.1.7.b on page A-32 of NUREG-0578:

"Safety-grade indication of auxiliary feedwater flow to each steam generator shall be provided in the control room.

The auxiliary feedwater flow instrumenr channels shall be powered from the emergency buses consistent with satisfying the emergency power diversity requirem-nts for the auxiliary feedwater system set forth in Auxiliary Systems Branch Technical Position 10-1 of the Standard Review Plan, Section 10.4.9.."

The licensee indicated in a letter dated December 31, 1979, that control room indication of AFW flow to each steam generator has been installed. We conclude that this response satisfies the "control grade" requirements specified in the NUREG-1578 position and clarifi cations and is, therefore, acceptable.

The "safety-grade" requirements for this recommendation are still under review. Our evaluation of this mater will be contained in a supplement to this SER.

-16

4.

Recommendation -

"Licensees with plants which require local manual realignment of valves to conduct periodic tests on one AFW system train and which have only one remaining AFW train available for operation, should propose Technical Specifications to provide that a dedicated individual who is in communication with the control room be stationed at the manual valves. Upon instruction from the control room, this operator would re-align the valves in the AFW system train from the test mode to its operational alignment."

The H. B. Robinson AFW system consists of three AFW pumps headered into three trains to feed the three steam generators, and the surveil lance procedures allow testing of only one pump at a time. Therefore, the capability to deliver at least 100% of the required AFW flow is maintained, as two trains would still be available. We conclude that this recommendation does not apply to H. B. Robinson.

C. Long Term Recommendations

1. Recommendation GL "Licensees with plants in which all (primary and alternate) water supplies to the AFW systems pass through valves in a single flow path should install redundant parallel flow paths (piping and valves).

Licensees with plants in which the primary AFW system water supply passes through valves in a single flow path, but the alternate AFW system water supplies connect to the AFW system pump suction piping downstream of the above valve(s), should install redundant valves parallel to the above valve(s) or provide automatic opening of the valve(s) from the alternate water supply upon low pump suction pres sure.

-17 The licensee should propose Technical Specifications to incorporate appropriate periodic inspections to verify the valve positions."

In our position letter of March 7, 1980, to the licensee we also gave the licensee the option of installing safety grade position indication and alarm for these valves and stated the criteria and requirements that should be met if this option was taken.

In response to this recommendation, in a letter dated May 15, 1980, in lieu of the requirements presented above, the licensee indicated that the present AFW system design provides for automatic AFW pum, protection by tripping them in the event of low suction pressure for any reason including inadvertent closure of the single locked open valve on the normal supply line from the condensate storage tank.

Each AFW pump discharge line is equipped with two pressure detectors.

Low pressure at either detector will annunciate an alarm in the control room. Low pressure at both detectors will stop the pump.

Operator action can then be taken locally to manually open either the normal supply valve or alternate supply valves as necessary. We conclude that the licensee's response is acceptable and therefore, the licensee is in compliance with this recommendation.

2) Recommendation GL At least one AFW system pump and its associated flow path and essential instrumentation should.automatically initiate AFW system flow and be capable of being operated independently of any AC power source for at least two hours.

Conversion of DC power to AC power is acceptable.

-18 In response to this recommendation, the licensee indicated in a letter dated October 31, 1979, that the turbine driven auxiliary feedwater pump is capable of operating for two hours without dependence on any of the existing AC power supply sources.

In a letter dated May 15, 1980, the licensee.provided additional information on this plant design feature.

Specifically, the licensee referred to his February 1, 1980 letter describing the capability provided by the new separate, independent, dedicated shutdown system. This system.is being installed to.meet current plant fire protection criteria but includes provisions for shutdown during station blackout. The system will be provided with its own separate independent redundant dedicated AC power supply, and will be operated from a Dedicated Shutdown panel located in the turbine building. Control of the turbine driven pump shutoff valves can be transferred from the existing remote control signals to local control from a new transfer panel also located in the turbine building. Manual transfer of lube oil cooling for the turbine driven AFW pump from the service water system to AFW water cooling is also required. We find the licensee's response unacceptable as manual actions are still required to initiate AFW syst.'m flow following a loss of the normal and existing backup AC power sources, and therefore the licensee is not in compliance with this recommendation. We require that the licensee assure automatic

X initiation of AFW system flow under station blackout conditions.

This includes automatically opening the turbine steam admission valve and pump discharge valves, and providing bearing lube oil cooling witbout operator action. Once flow has started, credit for manual control of steam generator level using dedicated AC or DC powered equipment can be given. We will provide a further evaluation of this subject in a supplement to this SER.

3. Recommendation GL "The licensee should upgrade the AFW system automatic initiation signals and circuits to meet safety-grade require ments."

In response to this recommendation, the licensee stated in letters dated October 31, 1979, December 31, 1979, and May 15, 1980, that the present AFW system automatic initiation signals are safety grade.

We will review the licensee's design in detail and our evaluation will be contained in a supplement to this SER.

4. Additional Long Term Recommendation - "None of the AFW water sources are protected against tornado missiles. The licensee should complete an evaluation considering a postulated tornado plus a single active failure to determine any AFW system modifications or procedures neces sary to assure a sufficient AFW water supply or assure that the plant can be brought to a safe shutdown condition in such an event."

In response to this recommendation, in a letter dated June 12, 1980, the licensee has submitted an evaluation of the capability of the AFW system to assure sufficient water supply to the steam generators

-20 considering the consequences of postulated tornado missile damage to the system water sources concurrent with a single active failure.

We note that the AFW system is seismic Category 1 and that seismic Cate gory I primary and backup water sources are available.

Based on our review of this evaluation we conclude that the licensee has not satisfactorily demonstrated that sufficient AFW water supply can be assured considering postulated multiple tornado generated missiles as required by current licensing practice. It is our position that the licensee provide positive means of missile protection for one of the three AFW water supply sources.

We will provide a further evaluation of this subject in a supplement to this SER.

D. Basis for Auxiliary Feedwater System Flow Requirements We have reviewed the licensee's response on this subject and find it acceptable.