ML17278B133
| ML17278B133 | |
| Person / Time | |
|---|---|
| Site: | Columbia  |
| Issue date: | 12/11/1986 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML17278B132 | List: |
| References | |
| TAC-62181, NUDOCS 8612170149 | |
| Download: ML17278B133 (10) | |
Text
~ ~
~ 0
~p,fl AEONS "o
Cy O
C O
"+*+~
SAFETY UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 FVALUATION BY THE OFFICF. AF NUCLFAR REACTOR REGULATION SUPPOR ING AMFVDMENT NO. 34 TO FACILITY OPERATING LICFNSE NO. NPF-21 WASHINGTON PUPLIC POWER SUPPLY SYSTEM WPPSS NUCLFAR PROJECT NO.
2 DOCVET NO. 50-397
1.0 INTRODUCTION
0'0.'P)Q MbL Ala NIA IXIa a
bQ NMg WQ IQ.0 Although large steam turbines and their auxiliaries are not safety-related
'ysteIIIs as defined by NRC regulations, failures that occur in these, turbines can produce large, high er eroy missiles.
If such missiles were to strike and damage aslant safety-related structures, systI.ms, and com-
- ponents, they could render them unavailable to perform their safety.
'unctions.
Consequently, General Desian Criterion 4, "Environmental and Missile Design Bases," of Apoendix 0, "General Desiqn Criteria for Nuclear Power Plants," to 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities," requires, in part, that structures,
- systems, aIId components important to safety be appropriately protected against the effects of missiles that might result from such failures.
The snecific guidelines involving evaluation of the effects of turbine failure on the
'publ'ic health and safety follow Regulatory Guide 1. 115, "Protection Agains Low-'Traiectory Turbine Missiles,"
and three essentiallv independent'Standa Review Plan (SRP) Sections 10.2 "Turbine Generator,"'0.2.3 "Turbine Disk
'Integrity," 3.5. 1.3 "Turbine Missiles," and 2.2.3 "Evaluation of Potential Accidents."
In a letter dated August 18,
- 1986, Washington Public Power Supply System (the licensee) requested a license amendment to the WNP-2 Technical Speci-fications.
Specifically, the licensee requested that the turbine valve
'est interval as specified in 3/4.3.8 be revised from weekly to monthly.
The turbine valves of the turbine overspeed protection system are tested periodically to,ensure their reliability and functionality in c'ase of a turbine overspeed event.
A turbine overspeed event. may, lead to fracture
=
of the turbine disc and, thus, missile generation. 'n WNP-2, there. are
'our high pressure turbine throttle valves and governor valves, six low
'pressure turbine reheat stop valves and interceptor, valves.
The standard Westinghouse Technical Specifications recommend that these valves be teste weekly.
The weekly test was based on historical ex'perience in the fossil plant turbines, and its importance to the safety of turbine operation has
'ever been clearly defined.
Since implementation nf the his oric recom-mended test interval, improved valve design and an increase i.n the knowledge concerning turbine valve reliability miti'Gated the original reasons for frequent valve testing.
For these
- reasons, in 1982, Westinghouse conducted a study (WCAP-10161} to determiI.e the impact of extending the testing interval of turbine valves for the Farley Nuclear Power Station.
The study showed that the impact of a monthly testing interval will not significantly increase the probability of turbine missile qeneration, and that the acceptance criteria would be met with less frequent testing.
t rd
2.0 DISCUSSION The licensee used the Westinghouse
- report, WCAP-10161, as a primary refer-ence in the submittal of WNP-2.
The staff reviewed methodology and results of the report as a primary source to determine the acceptability of the extended valve testing interval.
WNP-2, a boiling water reactor, uses a
Westinghouse turbine generator which consists of one high pressure turbine and three low pressure turbines.
There are four methods of turbine overspeed protection.
They are:
- The digital electrohydraulic (DEH) control system (governor)
- The overspeed protection controller
- Electrical overspeed trip
- Mechanical overspeed trip I
The DEH system maintains the turbine speed within 2-3 rpm of the rated speed and it consists of an electronic governor using solid state control combining with a high pressure hydraulic system.
The system includes electrical con-trol circuits for speed control, load control, and turbine valve positioning.
The control system includes an overspeed trip mechanism, steam admission
- valves, emergency stop valves, crossover intercept valves, and an initial'ressure regulator.
At 103 percent of rated
- speed, the overspeed protection controller activates the solenoids and closes the governor and intercept valves to, arrest, the overspeed before the turbine reaches the maximum trip setting.
The mech-"
anical overspeed trip mechanism trips the turbine prior to 111 percent of rated speed.
The mechanism will trip all steam valves thereby excluding (all
~
steam from entering the turbine.
The electrical overspeed trip, which H set at about 4 rpm lower than the mechanical overspeed trip setting, will energize the solenoid trip which in turn closes all steam valves.
Probabilistic Evaluation The probability of turbine missile generation (P) due to a turbine overspeed event is calculated by multiplying the probability of turbine overspeed (Pz) by the conditional probability of turbine missile generation (Pz),
given a turbine overspeed event.
Three cases of turbine overspeed event that could generate turbine missiles were considered:
design overspeed, intermediate overspeed and destructive "overspeed.
The total probability of turbine missile generation (P ) is the
'sum of the probability of missile generation in each of the oversp$ ed events; therefore, P
is the sum of P~P~ at design overspeed, P~P~ at inter-mediate, overspeed, aid PzPz at destructive overspeed.
In WCAP-10161, the staff evaluated the fault tree construction, fault tree quantification, and derivation of missile generation probability.
"3-Calculation Of Turbine Overs eed Probabilit The turbine overspeed probability was calculated based on a fault tree analysis of the turbine,overspeed protection system logic.
The primary failure modes of the system were the failures of electrical and mechanical control components, trip circuitries and valves.
Three fault trees were constructed for each of ~the three turbine overspeed conditions discussed above.
Three valve testing intervals were considered in the computation:
yearly,,monthly, and weekly.
To account for uncertainties, two sensitivity calculations were made using 50 percent and 95 percent confidence limits
- for each of the test intervals.
- Hence, the fault tree for each of the overspeed events was quantified six times.
I'he fault trees were not> modeled as detailed as that of a full-scale prob-abilistic risk assessment study.
For example, the basic event, "servo circuitry failure", was "not further expanded to include the failure of components such as relays,
- switches, and contacts.
The failure modes of some basic events could have been expanded to include more failure con-ditions.
For example, the failure modes of valves did not include the operator failure to return the valves to original position after maintenance In fact, human error was", not included in any of the failure modes in the fault trees.
However, the staff believes that the fault tree construction, in general, is sufficiently detailed in the context of this analysis.
-'System separation with sufficient steam supply is a precondition for any overspeed event.
This i,'s represented in the fault trees by an "and" gate under the top event, and the trees have been quantified for three separa-tions per year.
For any'verspeed event to occur, a system separation is necessary, that is, loss'f load accompanied by or due to opening of the generator output breaker-'.
To quantify the fault trees, the licensee used the component failure rates
,from different sources:," (1) field incident report;:. (2) oUtage data system; (3) previous reports and, service histories of turbines; (4) a panel of five engineers; (5) 1982 survey of owners of operating Westinghouse nuclear turbines; and (6) summary of a Westinghouse Generic reliability data bank search.
This search included sources from IEEE-500, MASH-1400, and NUREG reports on LERs.
Based;on these
- sources, the staff believes that the licensee has adequately quantified the fault trees.
The result shows that the design overspeed probability, using a 95 percent confidence bound, is 4.7 x 10-and 5.3 x 10-per demand, per system separa tion for weekly and monthly valve testing intervals respectively.
The intermediate overspeed probability is 5 x 10-~ and 1. 1 x 10-6 per year for weekly and monthly valve', testing intervals, respectively.
The destructive overspeed probability is;, 2.8 x 10-and 7.8 x 10-per year for weekly and monthly valve testing iqtervals, respectively.
I
0 ~
k I
I
Calculation of Conditional Missile Generation Probabilit The oonditional probability of missile generation was calculated for each of the overspeed cases.
The licensee assumed that a destructive overspeed event will always result in missile gener ation.
Thus, the conditional probability of missile generation due to destructive overspeed is 1.
Hence the probability of missile generation due to destructive overspeed is 7.8 x 10-per year.
The licensee assumed that the conditional missile generation probability due to intermediate overspeed will be at least one order of magnitude lower
'han that of the destructive overspeed event, i.e.,
10-~ per year.
The staff judges that the intermediate overspeed probability would lie between 1 and 10-~ per year and that 10-~ per year would fall within the uncertainty limits.
- Hence, the probability of missile generation of
- 1. 1 x 10-~ per year is acceptable.
The licensee calculated the conditional probability of missile generation given a design overspeed event assuming a 5-year inspection interval of
,low pressure turbine discs.
The conditional probability was calculated to be 5. 2 x 10-~ per year.
The probability of missile generation due to design overspeed is 2.8 x 10-6 per year.
Total Probabilit of Turbine Missile Generation Adding the probability of missile generation in all three overspeed
- events, the total probability is about 3 x 10-per year assuming the monthly testing of turbine valves, three system separations per year, and 95 percent
,confidence limit.. The three system separations give a total turbine missile
'generation probability of 9 x 10-per year.
Regulatory Guide 1.115 specifies that the probability of unacceptable damage from turbine missiles should be less than 1 x 10-~ per year.
This prob-ability is the product of three probabilities:
a) missile generation, b) missile striking safety equipment and structures, and c) damaged equip-ment failing to perform their safety function.
Historically, analyses
'assumed the missile generation probability to be-about 10-4 per year.
The missile strike probability was estimated on the basis of postulated missile
- sites, shapes, and energies, and on plant specific information such as turbine orientation and target geometry.
The damage probability was generally assumed to be 1.0; therefore, it necessitated that strike prob-
,ability be made less than or equal to 10-a per year so that the unacceptable damage probability would 'be within 10-~ per year.
However,'he strike probability calculation involves numerous modeling approximations and
'implifying assumptions that are required to incorporate available data
~
'1 II
~
h 3.0 into acceptable models.
This has become an academic exercise rather than a practical engineering analysis.
Also, operating experience shows that nuclear turbine disc cracking, turbine stop and control valves failure, and disc rupture are the primary causes in the generation of missiles.
Therefore, in view of operating experience and NRC staff objectives, the staff has shifted emphasis in the reviews of the turbine missile issue from the strike and damage probability to the missile generation prob-ability.
(Ref: Safety Evaluation Report related to the operation of Hope
'reek Generating Station, Supplement No. 6, Appendix U, NUREG-1048).
The
. staff believes that maintaining an initial small value of missile genera-tion probability through turbine testing and inspection is a reliable means of ensuring that the objectives precluding turbine missiles and unacccept-able damage to safety-related structures,
- systems, and components can be met.
The staff has limited the missile generation probability to 1 x 10-s per year for turbines with the rotor axis located parallel to plant struc-tures as in the case of MNP-2.
The turbine missile generation probability at WNP-2, 9 x 10-per year, is within the limit;.therefore, monthly valve testing is acceptable on the basis of the probabilistic evaluation.
ENVIRONMENTAL CONSIDERATION 4.0 This amendment involves a change in the installation and use of a facility component loc'ated within the restricted area as defined in 10 CFR Part 20 and changes in surveillance requirements.
The staff has determined that this amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released
- offsite, and that there is no significant increase in individual or cumula-tive occupational radiation exposure.
The Commission has previously issued a proposed finding that this amendment involves no significant hazards consideration and there has been no public comment on such finding.
Accord-ingly, this amendment meets the eligibilitycriteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).
Pursuant to 10 CFR 51.22(b),
no environmental impact statement or environmental
'assessment need be prepared in connection with the issuance of this amendment.
CONCLUSION The Commission made a proposed determination that the amendment involves no significant hazards consideration which was published in the Federal Register (51 FR 33960) on September 24, 1986, and consulted with the state of Mashington.
No public comments were received, and the state of Washington did not have any comments.
Me have concluded, based on the considerations discussed above, that:
(1) there is reasonable assurance that the health and safety of the public will"not be endangered by operation in the proposed
- manner, and (2) such activities will be conducted in compliance with the Commission's regula-tions -and the issuance of this amendment will not be. inimical to the
~
common defense and security or to the health and safety of the public.
Principal Contributor:
J.
- Tsao, NRR Dated:
December 11, 1986
0 ~
~I J
l t
AlKNDNENT NO. 34 TO FACILITY OPERATING LICENSE NO. NPF-21 WPPSS NUCLEAR POJECT NO, 2
DISTR IRUTIOQ'.
'ocket No. 50-397 NRC PDR Local PDR PRC System NSIC BMD-3 r/f JPradfute (2>
EHylton (1>
EAdensam
- Attorney, OELD Clli1es RDiggs JPartlow EJordan BGrimes LHarmon TBarnhart (4)
EButcher
L 4
1