ML17263A568
| ML17263A568 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 03/30/1994 |
| From: | Mecredy R ROCHESTER GAS & ELECTRIC CORP. |
| To: | Andrea Johnson NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM), Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 9404070310 | |
| Download: ML17263A568 (26) | |
Text
- , accmxm xxo DOCuwX;m" Dj
- Swami j:OW SvSxmr 1
REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)
CESSION NBR:9404070310 DOC.DATE: 94/03/30 NOTARIZED: NO DOCKET FACXL:50-244 Robert Emmet Ginna Nuclear Plant, Unit 1, Rochester G
05000244 AUTH.NAME AUTHOR AFFILIATION MECREDY,R.C.
Rochester Gas 6 Electric Corp.
RECIP.NAME RECIPIENT AFFILIATION I
JOHNSON,A.R.
Project Directorate I-1
SUBJECT:
Forwards summary of conclusions of assessment of three NRC concerns discussed in 940128 telcon re SWS
& SWSOPX Xnsp 50-244/91-201 dtd 920130.
DXSTRIBUTION CODE:
A001D COPIES RECEIVED:LTR ENCL Z SIZE:
TITLE: OR Submittal:
General Distribution NOTES:License Exp date in accordance with 10CFR2,2.109(9/19/72).
D 05000244 A
RECIPIENT ID CODE/NAME PD1-3 LA JOHNSON,A INTERNAL: NRR/DE/EELB NRR/DRCH/HICB NRR/DSSA/SPLB NUDOCS-ABSTRACT OGC/HDS1 RNAL: NRC PDR COPIES LTTR ENCL 1
1 2
2 1
1 1
1 1
1 1'
1 0
1 1
RECIPIENT ID CODE/NAME PD1-3 PD NRR/DORS/OTSB NRR/DRPW NRR/DSSA/SRXB 0
LF~CB REG LE 01 NSIC COPIES LTTR ENCL 1
1 1
1 1
1 1
1 1
0 1
1 1
1 D
D D
D NOTE TO ALL"RIDS" RECIPIENTS:
PLEASE HELP US TO REDUCE WASTEI CONTACI'HE DOCUMENT CONTROL DESK, ROOM Pl-37 (EXT. 504-2065) TO ELIMINATEYOUR NAMEFROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!
TOTAL NUMBER OF COPXES REQUIRED:
LTTR 16 ENCL 14 D
~uziz/ zzze SiZyjjIII IIIIIIIIII zzudEE~~
izszzzx ROCHESTER GAS AND ELECTRIC CORPORATION i
'g Teart State o
89 EAST AVENUE, ROCHESTER N.K 14649-0001 ROBERT t: MECREOY Vice Pre/ident Clnna Nudear Production March 30, 1994 TELEPHONE AREACODE 7>>B 546 2700 U.S. Nuclear Regulatory Commission Document Control Desk Attn:
Allen R. Johnson Project Directorate I-3 Washington, D.C.
20555
Subject:
Additional Information Service Water System R.E.
Ginna Nuclear Power Plant Docket No. 50-244 Ref.
(a): Letter from R.C.
Mecredy (RG&E) to A.R. Johnson (NRC),
"Additional Information-Service Water System", dated July 27/
1993
Dear Mr. Johnson:
In a letter dated July 27, 1993 (Reference a)
RG&E provided responses to 20 questions requested by the NRC in a letter dated May 24, 1993 regarding the service water system and the SWSOPI inspection 50-244/91-201 dated January 30, 1992.
Following NRC review of reference (a),
RG&E was requested to respond to seven other concerns sent on November 16, 1993.
Information on four of those was provided and discussed with the staff and the concerns resolved to their satisfaction.
The three remaining concerns were discussed in a telecon with you on January 28, 1994 and, at your
- request, the conclusions of our assessment of each of these concerns have been summarized and are included in Attachment A.
Very truly yours, Robert C. Mecredy GAH'>>t Attachments
'I'::>> ',<<',PDR',ADOCK 05000244-'.", "I ~
i
I I
V
),J I '
u
\\
,/,
p, 'j ~",p
'-v
.il) l1
xc:
Mr. Allen R. Johnson (Mail Stop 14D1)
~
~
~
~
~
~
~
Project Directorate I-3 Washington, D.C.
20555 U.S. Nuclear Regulatory Commission
'Region I 475 Allendale Road King of Prussia, PA 19406 Ginna Senior Resident Inspector
I E
~
~
ATTACHMENT A uestion 1
"The bounding maximum flow case for single SW pump operation that the licensee evaluated using the computer flow model has not been clearly defined.
The licensee's submittal dated July 27,
- 1993, stated
'Cases have, been examined with both loss of and no loss of offsite power and for cases where two CCW heat exchangers were receiving service water flow for the one pump case.'he licensee should be able to show that a single SW pump will operate in an acceptable flow condition following loss of offsite power with maximum flow to all safety and non-safety
- loads, unless administrative controls are in place to limit the flow to individual components.
The concern is that the single operable SW pump available following the design basis single failure may not remain operable to support diesel generator operation for safe shutdown."
ASSESSMENT OF A SERVICE WATER PUMP FAILURE COMBINED WITH A LOSS OF OFFSITE POWER WITHOUT SAFETY INJECTION The case assumed that only two service water pumps are initially available as allowed by the Technical Specifications.-""It is also assumed that a safety injection signal does not occur concurrent with the loss of offsite power (LOOP).
The concern is that the single operable service water pump may not remain operable to support emergency diesel generator (EDG) operation for safe shutdown.
Summar of Results A Design Analysis has been performed to show that" the system flow to the diesel generators in this configuration exceeds the flow necessary to maintain the jacket water and lube oil temperatures within their existing temperature control limits.
The SW pump flow is also within the range of flow on the pump curve.
Our assessment also shows, that this situation is accounted for in our procedures.
The existing procedures contain the necessary indications to alert operators of the operation of only one service water pump, and the guidance to bring the plant to a safe shutdown condition.
Based upon the procedural
- guidance, operation in this condition would be of relatively short duration.
ATTACHMENT A ASSESSMENT OF A SERVICE WATER PUMP FAILURE COMBINED WITH A LOSS OF OFFSITE POWER WITHOUT SAFETY INJECTION Summar of Assessment 1 ~
During this event the flow from the single pump would be maximized, with some reduction in flow to components that rely on service water cooling.
Essential service water loads such as the diesel generators, component cooling water heat exchangers, containment recirculation fan coolers, and spent fuel pool heat exchangers would receive a reduced flow.
2.
In determining the service flow through the system for the postulated
- case, the service water system hydraulic model, which RGGE has developed for system design
- purposes, was utilized in conjunction with the KYPIPE Computer Code.
The resultant flow through the system is depicted on the attached figure 1.
Pump flow is 7632 gpm, diesel generator "A" flow is 237 gpm, diesel generator "B" flow is 201 gpm, CCW Hx "A" flow is 1134
- gpm, CCW Hx "B" flow is 980
- gpm, containment recirculation fan cooler flow is in the range 574 to 716 for the 4 units.
Other flows are as shown on the diagram.
3 ~
In the event. of a complete LOOP as described and analyzed in the UFSAR (grid failure) while the reactor is at power, the reactor is tripped, and the 4160 V buses lose power.
The reactor coolant
- pumps, main feed
- pumps, and main condensate pumps (4160 V buses 11A and 11B) are shed.
The diesel generators are started concurrent with load shedding on the vital buses 14,16,17,and 18.
The exception to this is that the breakers for the component cooling water pumpsg containment spray pumps, and motor control centers 1C and 1D (from buses 14 and 16) are not tripped.
They immediately receive power when the buses are energized.
When the diesel generators come up to speed and close onto the
- buses, the undervoltage relays reset, allowing operators to"manually load any of the loads that are required, such as charging pumps and pressurizer heaters.
The automatic load sequencer is not activated unless a safety injection signal is present.
The two motor driven auxiliary feed pumps and the turbine driven auxiliary feed pump automatically start following the LOOP and reactor trip (based on the bus undervoltage protection scheme).
With no,SI signal, the selected service water pumps would restart after a
40 second time delay.
As the steam system pressure subsequently increases, the steam system atmospheric relief valves are automatically opened to atmosphere.
(Steam bypass to the condenser is not assumed to be available due to loss of the circulating water pumps).
As the steam flow rate through the atmospheric relief valves may not be sufficient to remove the necessary decay
- heat, the steam generator self-actuated safety valves may temporarily liftto augment the steam flow.
As the no-load temperature of
~
~
ATTACHMENT A ASSESSMENT OF A SERVICE WATER PUMP FAILURE COMBINED WITH A LOSS OF OFFSITE POWER WITHOUT SAFETY INJECTION 4 ~
the reactor coolant is reached in the steam generators, the steam system atmospheric relief valves are used to dissipate the residual heat and to maintain the plant at the hot shutdown condition, while the steam generators are being fed from auxiliary feed water.
Procedure ES-0.1, Reactor Trip
- Response, is used to bring the plant to hot shutdown conditions.
[UFSAR 15.2.5]
Plant operation with 2 service water pumps generally maintains service water header pressure between 55-60 psig.
In the event of a transient condition that resulted in a large drop in header
- pressure, such as operation with only one service water pump without isolation of the non-essential
- loads, low pressure alarm limits have been established at 50 psig to verify and take corrective action if at least 1 service water pump is not operating in each loop.
Procedures dictate that the operators perform leak checks of the system, examine loop separation, and finally, if deemed necessary, manually trip the reactor at 40 psig (Procedure AP-SW.l).
In the case postulated, and upon restart of only one pump following the 40 second time delay, the service water header low pressure alarms would annunciate.
Entry into the above procedure, as well as operator knowledge and training on the service water
- system, would either result in a manually initiated plant trip or isolation of the unnecessary service water loads.
Reactor Trip Response procedure ES-0.1 would be used to bring the plant to hot shutdown conditions. If it is determined not to trip the reactor in the interest of greater safety, operators would increase service water header pressure by isolating service water loads, and this condition would be alleviated within a relatively short period of time.
5.
Our review of plant emergency procedures has shown that they are conservative with respect to providing service water flow to the EDGs.
The emergency procedure that would be entered following the complete loss of offsite power (ECA-O.O) contains initial steps to verify that at least one service water pump is running for each associated running EDG.
If
- not, then the affected EDG would be tripped.
. Although our analysis demonstrates that adequate cooling would be provided to both EDGs with one service water
- pump, the emergency procedure provides conservative guidance.
Control board lights are present to indicate the number of running service water pumps.
Subsequently, if only one EDG is running with only one service water pump running on that electrical train, operators are directed to manually perform service water isolation.
In addition, RG&E has previously developed a
procedure which provides for alternate cooling to the EDGs through the use of the city water system, in the event that
AJTTACHMENT A ASSESSMENT OF A SERVICE WATER PUMP FAILURE COMBINED WITH A LOSS OF OFFSITE POWER WITHOUT SAFETY INJECTION service water is unavailable.
Service water header pressure would be a direct indication that actions would be required to ensure equipment is protected.
Since accident conditions do not exist in this case, a reduction in service water flow to components significant to accident mitigation, such as containment recirculation fan coolers or component cooling water heat exchangers, is not critical to event mitigation.
6.
RGGE has performed a design analysis to determine the minimum service water flow values for diesel generator jacket water cooling and lube oil cooling, which would maintain their fluid temperatures within the range of their existing control limits for normal operation.
The analysis assumed a range of EDG
- loading, up to full load.
The EDG loading following a LOOP without SI is approximately 740 KW for the EDG that has the service water pump loaded on it.
The other EDG, if running, would have approximately 450 KW.
The continuous full load rating of the EDG is 1950 KW.
Therefore, the service water flow necessary to provide adequate cooling for the postulated event is well below the flow necessary at full load conditions.
It was determined that a service water flow of 140 gpm at the maximum of 80 F lake temperature is sufficient to maintain the fluid temperatures within their control limits, with the EDG loaded up to 1500 KW.
- Hence, there is additional margin since the EDG would be initially loaded to approximately only 740 KW.
7.
There is also additional margin beyond this when lake temperature is below 80 F.
Lake temperature is much cooler than 80 F, typically less than 60 F, for all but about 3
months during the summer.
It is during these months when three service pump operation is initiated.
Hence, the failure of a service water pump during these times would"still leave two available pumps.
In the single pump configuration postulated the service water hydraulic model determined the minimum diesel generator flow to be 201 gpm for D/G "B". (Flow to D/G "A" was 237 gpm).
In addition, there is a 10 degree F
margin between the EDG temperature control limits and the point at which the diesel generator is manually shut down as a result of inadequate cooling to the diesel generators.
8.
Therefore, there is adequate flow to supply the diesel generators with cooling water flow with a single service water pump in operation before operator actions would be taken to isolate unnecessary loads on the service water system.
This would increase flow to the diesel generators while also reducing total service water pump flow requirements.
Isolating these loads or regaining a second SW pump would be necessary before the EDG could be loaded to its continuous
i
ATTACHMENT A ASSESSMENT OF A SERVICE WATER PUMP FAILURE COMBINED WITH A LOSS OF OFFSITE POWER WITHOUT SAFETY INJECTION full load rating.
The pump flowrate of 7632 gpm (a flowrate near'the pump runout flow) is acceptable for short term, non-continuous operation.
It is concluded that the current Technical Specification, which requires two service water
- pumps, one on bus 17 and one on bus 18, to be operable when above cold
- shutdown, is consistent with the service water design and licensing basis.
1
~
~
~
4
~
I
~
~
~ ~
ATTACHMENT A ASSESSMENT OF A SERVICE WATER PUMP FAILURE COMBINED WITH A LOSS OF OFFSITE POWER WITHOUT SAFETY INJECTION uestion 2
"Similar to the case above, failure of non-seismically qualified piping downstream of valves 4613 and 4670 following a seismic event coincident with a loss of offsite power may cause failure of the diesel generators due to inadequate cooling.
We are assuming that these valves isolate only on an SI signal coincident with a loss of offsite power."
Summar of Results The guidance used to establish our licensing basis does not require an assumed full diameter break, but rather that cracks be considered in moderate energy piping.
Nonetheless, we have examined the potential effect of a full diameter break and conclude that the beyond-design basis case above can be dealt with within the existing abnormal procedures and would not result in conditions that would prevent the safe shutdown of the plant nor cause imminent risk of diesel generator or SW pump component failure.
Summar of Assessment 1.
The potential failure of service water system piping was evaluated as part of SEP Topic III-5.B.
UFSAR section 9.2.1.3 states that a passive failure would probably result in a leak rather than a full break, and established a leak rate of 585 gpm.
The full break flow, based on the hydraulic analysis, was found to be over 5000 gpm.
The regulatory guidance used in the SEP review was Standard Review Plan 3.6.1 and 3.6.2 as well as Branch Technical Position (BTP)
MEB 3-1 and ASB 3-1.
As defined in that guidance, and as superseded'n part by GL 87-11 (Reference
- a. below), it is stated that "Leakage cracks should be postulated in fluid system piping designed to nonseismic standards as necessary to satisfy B.3.d of BTP ASB 3-1" (Reference BTP MEB 3-1 Rev.
2, June
- 1987, paragraph B.2.c.(3),
page 3.6.2-16).
This is also described in the current revision of the UFSAR (Rev.
10) in sections 3.6.2.3.2.2 and 3.6.2.3.2.3 under Moderate-Energy Fluid System Piping.
This crack would result in a relatively minor diversion of service water flow (less than 1000 gpm),
and can be accommodated within the bounds of the previous Question g1.
The break size and flowrate assumed in the SEP analysis (585 gpm) is less than that determined previously to result (956 gpm) through that 10 inch line, as shown on the flow diagram from the assessment of the previous question.
A'ZTACHMENT A ASSESSMENT OF A SERVICE WATER PUMP FAILURE COMBINED WITH A LOSS OF OFFSITE POWER WITHOUT SAFETY INJECTION 2 ~
It is not apparent that it is credible that a seismic event of a magnitude that could cause a double-ended rupture of the 10 inch service water pipe downstream of isolation valves 4613 and 4670 would not also result in a safeguards actuation and automatic isolation of these valves.
The probability of occurrence of the Design Basis Earthquake (4.0E-4) combined with the failure of a service water pump to run (2.54 E-5) is very remote (1.0E-9).
However, if this set of circumstances did occur, the Ginna plant emergency and abnormal procedures do provide the necessary guidance for operators to isolate the leak prior to risk of failure to either the operating service water pump due to runout flow or failure of the diesel generators due to inadequate cooling.
3 ~
4 ~
Valves 4613 and 4670 are motor operated butterfly and gate valves, respectively, located at the diesel generator room B
and turbine building wall.
A SW hydraulic computer model analysis was run, simulating the postulated set of conditions, to determine the service water system flow. It was determined that the service water pump flow would run out to 8316
- gpm, and the break flow out the 10 inch pipe was found to be 4564 gpm from one direction and an additional 707 gpm from -the other cross-tied service water header.
Flow to the diesel generators was found to be 146 gpm to D/G "A" and 131 gpm to D/G "B".
Following the break the service water header pressure would drop to 10-15 psig.
Plant response and operator actions would be similar to items 3.and 4. of the Question gl above.
Procedure AP-SW.l would be entered based on the low service water header pressure and would dictate immediate manual actions to isolate the break (which could be performed using 4613 and 4670) and manual trip of the reactor (on less than 40 psig service water header pressure).
The pump runout flow exceeds the range of 7600 gpm shown on the pump curve.
The flow to diesel generator "B" is slightly less (9 gpm) than the calculated flow equivalent to the existing temperature alarm limits (item 6. for previous Question g1),
yet these values are judged to provide reasonable assurance that catastrophic failure of these components would not occur within the operator's time constraints to isolate the break and take mitigative actions.
Relative to the temperature limits for the diesel generator, the required flow of 140 gpm calculated in our analysis was based upon the diesel generator being loaded to 1500 KW and a limiting lake water temperature of 80 F, whereas, additional margin is available since the diesel generator load would be approximately 740 KW and lake temperature during times of the year when 2 service water pumps operate is closer to 55 F.
Relative to the SW pump runout flow, the pump curve extends
A'ZTACHMENT A ASSESSMENT OF A SERVICE WATER PUMP FAILURE COMBINED WITH A LOSS OF OFFSITE POWER WITHOUT SAFETY INJECTION out to 7600 gpm representing a range for continuous operation without cavitation.
For short term operation at higher flows, the onset of cavitation would be expected, however imminent pump failure at 8300 gpm would not be expected.
Since the service water system design provides added NPSHA margin beyond the NPSHR predicted from the pump curve, and since this is a cold water application where interstage flashing is not a
primary concern under these circumstances, there is reasonable assurance that a pump failure would not occur.
Reference (a): Generic Letter 87-11, Relaxation of Arbitrary Intermediate Pipe Rupture Requirements, dated June 19, 1987
~
~
I
VALIDATIONOF COMPUTER HYDRAULIC FLOW MODEL "The basis for the licensee concluding is acceptable for evaluation of configurations is not clear.
The describe the configurations that were that the computer flow model single operating SW pump licensee does not clearly validated to test data."
Summar of Results Prior to the 1993 refueling outage, the original NUS model was
- checked, modified, and validated as described in our response to question 8 submitted in our letter dated July 27, 1993.
Test data was used to evaluate the specific model inputs which included the following:
SW pump performance data I
Containment recirculating fan cooler hydraulic data Diesel generator cooler hydraulic data
- Containment recirculating fan motor cooler hydraulic data The final validation, by taking plant data in the 2
SW pump operational
- mode, provided for ll flow readings and 31 pressure gage readings.
This provided an extensive validation of the model as compared to the total system available.
Benchmarking the model to actual plant operating data confirmed that the model is acceptable for design review and evaluation for all system configurations including a single SW pump configuration.
In fact, the'odel was used to provide essential data for evaluation of the planned replacement of the containment recirculating fan coolers (CRFCs) during the 1993 refueling outage for various system configurations.
As part of our normal engineering process, the model has been updated subsequent to the CRFC replacement.
Post modification tests were run in the one SW pump configuration and the two pump configuration with the non-safety related components isolated.
Flow and pressure data were taken for various components and model input data was revised appropriately.
In addition, another benchmark was made in the three pump normal operation configuration.
At that time pump flow readings were also taken with clamp-on flow devices, which provided for 13 flow and 31 pressure checks on the model output in that configuration.
The model was also run in the one pump configuration and it provided correlation to within about 2%
for all major flowpaths and within about 104 for major pressure data.
RGGE -is confident that the SW system hydraulic model in conjunction with the Kypipe computer code has been checked against sufficient test data and validated to the extent necessary to be used to evaluate any applicable system configuration.
~
~
'0
~
~
~
~
~
~
~
~
~
~
~
~
~
~ ~
~
~
y r
~ r 0 ~
~
~
~
~'.
lel iN~
NF~~'.
. fiQ SN SF~
iSF~
iSF~
,6 Q
Q
~ ~ ~
~'
~
t gr r
~. ~
T i
~
cQ
~
~
~ 0
O.
rp 4
0 g
1
'I c
1
- ~
1\\
t
~
~
~
~
'gp
~ ~
~
~
I
~
~'
~ ~
CS'
~y'.
eel NF~
iSP~
. iSF~
NQ NF~
SF~
SF~
~
~ ~
~ ~ ~
~'
~
Q Q
~ ~ ~
~
~
Q t$
et ~
~ s 3
~ ~
e
~'
~
@i'
~
~ ~
Cgi
~
~
)
e i ~
C
0; j
S J
Kd g 1 E
Al h
J h.".
k D
C F
ID
)
e