ML17319A941

Auxiliary Feedwater Sys Automatic Initiation & Flow Indication, Technical Evaluation Rept

ML17319A941
Person / Time
Site:	Cook
Issue date:	04/27/1981
From:	Pandey S FRANKLIN INSTITUTE
To:	Kendall R NRC
Shared Package
ML17319A940	List: ML17319A941
References
CON-NRC-03-79-118, CON-NRC-3-79-118, RTR-NUREG-0737, RTR-NUREG-737 TER-C5257-292-2, TER-C5257-292-293, NUDOCS 8107090374
Download: ML17319A941 (20)

Text

TECHN JCAL EVALUATlON REPOR T AUXILIARYFEEDWATER SYSTEM AUTOlVIATIC INITIATIONAND FLOW INI3!CATION IND I AHA 8 M I CH I GAN ELECTRIC COMPANY DONALD C, COOK UNITS j AND 2 NRC DOCKET NO. 50-315 1 50-316 NRC TAC NO. 11686, 11687 FRC PROJECT C5257 NRC CONTRACT NO. NRC-03-79-118 FRC TASKS 292 293 Prepared by Franklin Research Center Author: S ~ Pand ey The Parkway at Twentieth Street Philadelphia, PA 19103 FRC Group Leader: K. S. Fertner Prepared for Nuclear Regulatory Commission Washington, D.C. 20555 Lead NRC Engineer: Rick Kendall April 27, 1981 This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or Implied, or assumes any legal liability or responsibility for any third party's use, or the results of such use, of any Information, apparatus, product or process disclosed ln this report, or represents that its use "by such third party would not Infringe privately owned rights.

Franldin Research Center A Division of The Franklin Institute Thc 8 ~,ann Fin iLJn Pa@ zy, Phl ~, r. tgtO) t2t>I 4-a treO

1

&R-C5257-292/293 CONTENTS Section Title Pacae INTRODUCTION 1.1 Purpose of Review 1.2 Generic Issue Background 1.3 Plant-Specific Background REVIEW CRITERIA TECHNICAL EVALUATION ~ 5 3.1 General Descr ipt ion of AFW System 3.2 Automatic Initiation.

3.2. 1 Evaluat ion

3. 2.2 Conclusion

3. 3 Flow Indication 3.3.1 Evaluation

3. 3. 2 Conclusion 10 3e4 Steam Generator Level Indication Description. 10 CONCLUSIONS 12 RE F ERE NC ES 13 Franklin Research Center A rtnrtsttee d nt ~ fehn4re Inst,ttat ~

TER-Cy257-292/293 1.. INTROD UCT ION 1.1 PURPOSE OF REVIEH The purpose of this review is to provide a technical evaluation of the emergency feedwater system design to verify that both safety~rade automatic initiation circuitry and flow indication are provided at D. C. Cook Units 1 and 2. In addition, the steam generator'evel indication available at D. C.

Cook is described to assist subsequent NRC staff review.

1. 2 GENERIC ISSUE BACKGROUND A post-accident design review by the Nuclear Regulatory Commision (NRC) after the March 28, 1979 incident at Three Mile Island ('INI) Unit 2 has established that the auxiliary feedwater (AEW) system should be treated as a safety system in a pressurized water reactor (PWR) plant. The designs of safety systems in a nuclear power plant are required to meet general design criteria (GDC) specified in Appendix A of the 10 CFR Part 50 (1).

The relevant design criteria for the AEW system design are GDC 13, GDC 20, and GDC 34. GDC 13 sets forth the requirement for instrumentation to monitor variables and systems (over their anticipated ranges of operation) that can affect reactor safety. GDC 20 requires that.a protection system be designed to initiate automatically in order to assure that acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences. GDC 34 requires that the safety function of the designed system, that is, the residual heat removal by the kFW system, be accomplished even in the case of a single failure.

On September 13, 1979, the NRC issued a letter [2] to each PHR licensee that defined a set of short-term requirements specified in NUREG-0578 [3). It required that the AFH system have automatic initiation and single failure-proof design consistent with the requirements of GDC 20 and GDC 34. In addition, auxiliary feedwater flow indication in the control room shall be provided to satisfy the requirements set forth in GDC 13.

(.~>il ullu Franklin Research Center 4 Ma on d Thc FslnLLn Ins4Mt

TER-C5257-292/293 During the week of September 24, 1979, seminars were held in four regions of the country to discuss the impact of the short-term requirements. On October 30, 1979, another letter was issued to each PHR licensee providing additional clarification of the NRC staff short-term requirements without alter ing their intent [4] .

Post-TMI analyses of primary system response to feedwater transients and reliability of installed AiM systems also established that, in the long term, the AEW system should be upgraded in accordance with safety~rade require-ments. These long-term requirements were clarified in the letter of September 5, 1980 [5]. This letter incorporated in one document, NUREG-0737 [6], all TMI-related items approved by the commission for implementation at this time.

Section II.E.1.2 of NUREG-0737 clarifies the requirements for the AEW system automatic initiation and flow indication.

l. 3 PLANT-SPECIFIC BACKGROUND The Indiana a Michigan Electric Company responded to NRC requirements through letters [7-12], with supporting documents and logic diagrams, describing the AFM systems at the Donald C. Cook Units 1 and 2.

The Franklin Research Center (FRC) staf f star ted a review of the AFW systems at the Donald C. Cook Units on September 19, 1980, based on the cr teria described in Section 2 of this report. In a conference call among staff of the Licensee, FRC, and NRC on September 30, 1980, FRC requested more information, and the Licensee documented the additional information in a letter to the NRC dated December 10, 1980 [13].

IllllJL Franklin Research Center I ~l OA Ol Ihl FIOhll h MI4Mt

TER-C5257-292/293

2. REVIEW CRITERIA' To improve the reliability of the AFW system, the NRC required licensees to upgrade the system, where necessary, to ensure timely automatic initiation when required. The system upgr ade was to proceed in two phases ~ In the short term, as a minimum, control grade signals and circuits were to be used to auto-matically initiate the AEW system. This control grade system was to meet the following requirements of NUREG-0578, Section 2.1.7.a (3]:

'1. The design shall provide for the automatic initiation of the auxiliary feedwater system.

2. The automatic initiation signals and circuits shall be designed so that a single failure will not result in the loss of auxiliary. feedwater system function.

3. Testability of the initiating signals and circuits shall be a feature of the design.

4. The initiating signals and circuits shall be powered from the emergency buses.

5. Manual capability to initiate the auxiliary feedwater sys-tem from the control room shall be retained and shall be

~

implemented so that a single'failure in the manual circuits will not result in the loss of system function.

6. The ac motor-driven pumps and valves in the auxiliary feed-

~ater system shall be included in the automatic actuation (simultaneous and/or sequential) of the loads to the emer-gency buses.

7. The automatic initiating signals and circuits shall be designed so that their failure will not result in the loss of manual capability to initiate the AFH system from the control room."

In the long term, these signals and circuits were to be upgraded in accor-dance with safetygrade requirements. Specifically, in additfon to the above requirements, the automatic initiation signals and circuits must have indepen-dent channels, use environmentally qualified components, have system bypassed/

inoperable status features, and conform to control system interaction criteria/

as stipulated in IEEE Std 279-1971 (14].

Il)( Franklin Research Center

TER-C5257-292/293 The capability to ascertain the AFM system performance from the control room must also be provided. In the short term, steam generator level indica-tion and flow measurement were to be used to assist the operator in maintaining the required steam generator level during AFW system operation. This system was to meet the following requirements from NUREG-0578, Section 2.1.7.b:

"1. Safetygrade indication of auxiliary feedwater flow to each steam generator shall be provided in the control room.

2 ~ The auxiliary feedwater flow instrument ch'annels shall be powered from the emergency buses consistent with satisfyin'g the emergency power diversity requirements of the auxiliary feedwater system set forth in Auxiliary System Branch Technical Position 10-1 of the Standard Review Plan, Section 10.4.9 [Ref. 15 in this report]."

'I'he NRC staff has determined that, in the long term, the overall flowrate indication system for Westinghouse plants should include at least one auxiliary feedwater flowrate indicator for each steam generator. The safety-grade flow-rate indication system must satisfy the single failure criterion, be environ-mentally qualified; have as a design feature the capability to test the indi<<

cating channels, and conform to the control system interaction criteria, as stipulated in IEEE Std 279-1971.

The operator relies on steam generator level instrumentation, in addition tn auxiliary feedwater flow indication, to determine AFH system performance.

The requirements for this steam generator level instrumentation are specified in Regulatory Guide 1.97, Revision 2, "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident" (16] .

t, li~

U."ti Franklin Research Center A boa. a d Qr fs ~ir.s 4s4t~l ~

~

TER-C52 57-292/293

3. TECHNICAL EVALUATION 3.1 GENERAL DESCRIPTION OF AFW SYSTEM The Donald C. Cook Units 1 and 2 are Westinghouse-designed "four generating. plants. The AFW systems for the two units are essentially loop'uclear identical and are, by design, part of the engineered safety features (ESF).

The Licensee has proposed modifications of the AFW system to meet long-term 1

safety requirements. FRC's review is based on those proposod modifications.

For each unit, the AFW system consists of a steam-turbine-driven pump and two motor-driven pumps. The steam-turbine-driven pump supplies auxiliary feedwater flow to each of the four steam generators of its <<ssociated unit.

The two motor-driven auxiliary feedwater pumps supply two steam generators each (i.e., the east motor-driven pump supplies steam generators Nos. 2 and 3g and the west motor-driven pump supplies steam generators Nos. 1 and 4 FMO-211, -221, -231, and -241 (Unit 1 or Unit 2) are the steam generator supply valves from the turbine-driven auxiliary feedwater pump (TDAFP). These motor-operated valves are normally open, but each may be closed by the control room operator in the event of a feedwater or steam line break. They also may be throttled to regulate steam generator level. In the event of a steam line break and rapid depressurization of a steam generator, or upon detection of a high flow at the TDAFP, these valves are automatically driven to an intermed-iate position to prevent pump runout. On loss of power, the, valves fail as is.

FMO-212, -222, -232, and -242 (Unit 1 or Unit 2) are the steam generator "upply valves from the motor-driven auxiliary feedwater pumps (MDAFP). These motor-operated valves are normally closed and are opened and/or throttled as described above. The valves open automatically as a result of any of the signals which require MDAFP start-up for that unit. On loss- of power> the valves fail as is. A single failure (a safety bus blackout) will cause the failure of a MDAFp and prevent the associated motor-operated valves from opening. Ho~ever, the remaining MDAFp and TDAFp are capable of supplying water to their respective steam generators, 'thus satisfying the single failure criterion.

TER" C5257-292/293 Steam is supplied to the TDAFPs from the Nos. 2 and 3 steam generators of the associated unit. The steam is taken upstream of the main steam isolatiog'alves.

The TDAFP steam supply isolation valves (MCM-221 and -231) are normally open, allowing steam pressure to be available up to the trip-and-throttle (T&T) valve at each turbine. The motor-operated steam isolation valves (MCM-221 and -231) can be opened or closed from the control room; on loss of power, they fail as is. The T6T valve opens automatically when the TDAFP receives a start-up signal.

Each auxiliary feedwater pump has an emergency leakoff line and a test, line. The emergency leakoff line ensures a minimum flow through the pump to prevent pump overheating and possible damage. The test valves are normally closed. They are diaphragm type valves, spring actuated to fail closed on loss of air pressure. Should the test valves be left in the open position, an auto-matic start-up of the auxiliary feed pumps will automatically close them.

~

" 3.2 AUTOMATIC IHITIATIOH 3.2.1 EVALUATIOH The automatic initiation signals and circuitry for the AFW systems at D. C. Cook Units 1 and 2 comply with the general functional requirements of IEEE Std 279-1971 [14]. The following signals are used for auxiliary feedwater automatic initiation:

A. Turbine-Driven Auxiliary Feedwa ter Pump

l. low-low steam generator water level in any two of the four steam generators (possible loss of feedwater or steam line .break)

2. undervoltage of reactor coolant pumps (RCP) bus (anticipation of loss of offsite power)

B. Motor-Driven Auxiliary Feedwater Pumps

l. low-low steam generator water level in any one of the four steam generators

2. undervoltage of RCP bus (two out of four logic)

3. any safety injection actuation signal derived from:

TER"C5257-292/293

a. low pressurizer pressure

b. high differential pressure between steam lines

c. high steam flow in two steam lines, coincident with either low-low Tavg or low steam line pressure (Unit 1 only)

d. low steam line pressure (Unit 2 only)

e. high containment pressure

4. blackout safeguards sequence

5. loss of main feedwater pumps.

The TDAFP can also be started manually from the local hot shutdown panel or remotely frora the control room; the HDAFP can also be started manually.

The automatic initiation signals and circuits for the AFH systems at the D. C. Cook plant comply with the single failure crite'rion of IEEE Std 279-1971. The initiating signals and associated circuitry that actuate the AFH system are the same as those used to initiate the reactor trip and the ESFs. They are powered from the essential buses. A two-train concept is used for redundancy, and the Licensee has stated that the channels which provide the AFW system automatic initiation signals are independent and physically separated. In addition, no single failure within the manual or automatic i.iitiation systems will prevent initiation of auxiliary feedwater by manual or automatic means. In case of safety bus blackout, the motor-driven pumps start in sequence onto the diesel generators with the remainder of the blackout t

lnad. For safety injection coincident with safety bus blackout, the motor starts in sequence with the remainder of the safety injection loads.

The AFW system and components are tested in accordance with technical specification requirements. During each work shift, the sensors used in auto-P matic initiation circuits, the steam generator water level indicators, and the 4-kV bus loss of voltage and undervoltage detectors are checked for operation by crosschecking between channels. The channel functional tests for logic trip circuits and trip set points are performed once a month. The auxiliary feedwater pumps are tested monthly by manual initiation from the control room. '

operability of the auxiliary feedwater pumps and power-operated valves are 'he 9() FranMin Research Center

TER-C5257-292/293 checked, at least once every 18 months during shutdown, by verifying that the pumps and associated valves operate automatically upon receipt of each auxil-fary feedwater actuation test signal (including blackout signal) that simu-lates emergency operation of the system.

The Licensee has stated that the automatic initiation signals for the AEW system that are generated by the ESF actuation system are designed as a minimum in accordance with IEEE Stds 279-1971 and 323-1974 (17]. Adequate environ-mental qualification of the 'circuits and components is reviewed separately by 1

NRC staff and is beyond the scope of the present FRC task.

There are no bypasses at the system level during periodic testing of the AFW system automatic initiation circuits for the D. C. Cook plant. The status of process analog channels and trip circuits during surveillance testing is indicated on the ESF bypass panel in the control room. No interaction between the AEW system safety and control functions was found; The operating bypasses associated with the automatic initiation logic are:

A. Turbine-Driven Auxiliary Feedwater Pump There are no bypasses in the TDAFP logic which prevent automatic initiation.

B. Motor-Driven'uxiliary Feedwater Pump There are two bypasses in the MDAFP automatic initiation logic.

1. The P-ll interlock in the reactor protection system (RPS) logic is used to allow the manual block of the safety injection actuation signal generated by low pressurizer pressure. This interlock is reset automatically when pressurizer pressure goes above 1915 psig for Unit 1 and 2010 psig for Unit 2.

2. The P-12 interlock in the RPS 1'ogic is used to allow th'e manual block of the safety injection actuation signal generated by (a) high steam flow in two steam lines coincident with low steam line pressure in Unit 1 and (b) low steam line pressure in Unit 2. This interlock (both units) is reset automatically when primary system temperature is above the low-low Tavg set point of 541 oF.

lln llll Franklin Research Cenrer

TER-C5257-292/293 The remaining signals that generate a safety injection actuation (which automatically starts the HDAFPs) and the automatic HDAFP start-up signals listed earlier do not have operating bypasses.

3. 2. 2 CONCLUSION Based on the evaluation documented in Section 3.2.1, it is found that the initiation signals, logic, and associated circuitry of the AFH systems at D. C. Cook Units 1 and 2 comply with the long-term safety~rade requirements of Section 2.1.7.a of NUREG-0578 (3) and the subsequent clarification issued by the NRC.

3. 3 FLOH INDICATION 3 ~ 3. 1 EVALUATION Flow indication is used to ascertain the performance of the AFH systems at the D. C. Cook plant. The APrf system flow indication consists of individual sensors, currant loop circuitry, and individual meters for each of the four auxiliary feedwater lines, one to each steam generator. The major equipment used in the indication system is individual differential pressure transmitters, individual dc power supplies, and individual dc ammeters. The auxiliary feed-water flow indicators (FFI-210, FFI-220 FFI-230, and FFI-240) are fed from the balance-of-plant (BOP) inverter in each unit (non-class 1K), which is an uninterruptible power source fed by the CD battery of Unit 1 and the AB battery of Unit 2 (safety-related station batteries). One instrument channel per steam generator is provided. The flov indication instruments are located on Panel SG in the main control room and on the appropriate hot shutdown panel for each unit. Also, each pump has a discharge pressure indicator (FPI-244>

FPI-253, FPI-254) in the control room. The pressure indicators are powered by the same source as the flow indicators. Operability of this power source (BOP inverter) is required by the Technical Specifications.

The present transmitters, located outside containment, are control grade.

The Licensee has stated that the existing transmitters vill be qualified or replaced vith ones qualified to the outside containment requirements of IEEE Std 323-1974 by January 1, 1981.

I I II UIJIJ FranMin Research Center

~ ~

TER-C5257-292j293 The ~ system flow indication by itself does not satisfy'he single failure criterion; however, each flow channel is backed by steam generator i ~

level indicators. Testing of the AEW system flow indication is provided in accordance with the D. C. Cook plant Technical Specifications. Under surveil-lance requirements, the auxiliary feedwater pumps are started at least once every 31 days using the pump recirculation lines and the flow is checked.

The AEW system flow indication channels are calibrated during refueling outages.

The flow channels have no control functions and are used for indication only. The indication error is not greater than +5.5\.

3. 3. 2 CONGLU!>>ION Based on the review detailed in the previous section, it is concluded graders that the flow channels of the AFW systems at D. C. Cook Units 1 and 2 comply with the long-term safetygrade requirements of Section 2.1.7.b of NUREG-0578 and the subsequent clarification issued by the NRC, with the exception of the.

flow transmitters, which are control

3. 4 STEAM GENERATOR LEVEL INDICATION DESCRIPTION The D. C. Cook steam generator level instrumentation is described here to document the in-place hardware for subsequent NRC evaluation. The instrumentation consists of three safetygrade narrow-range level channels and one non-safety-grade wide-range level channel per steam generator. The narrow-range level channels are designed as part of the ESF and meet the single failure criterion. The three narrow-range level indicators are used in the RPS in a 2 out of 3 coincidence logic. The testing of narrow-range channels is performed under Technical Specification surveillance requirements'n a shift (channel check), monthly (functional test), and refueling outage (calibration) basis.

The Licensee stated that the wide-range channel is not used in any protec-tion system and therefore is not designed to meet safety-grade criteria.

uuu Franklin Research TER-C5 257-292/293 All steam generator level measurement systems are supplied from the vital instrument buses, which are Class 1E uninterruptible power sources. There~ are four independent vital instrument buses: Channels 1, 2, 3, and 4.

The level instrumentation for the steam generators is tabulated below:

A. Steam Generator No. 1 BLP-110, Channel 4 Indicator BLP-ill, Channel 2 Indicator-Recorder BLP-112, Channel 3 Indicator BLI-110,'hannel 4 Indir:ator-Recorder B. Steam Generator No. 2 BLP-120, Channel 4 Indicator BLP-121, Channel 1 Indicator-Recorder BLP-122, Channel 3 Indicator BLI-120,>> Channel 4 Indicator-Recorder C. Steam Generator No. 3 BLP-130, Channel 4 Indicator BLP.-131, Channel 1 Indicator-Recorder BLP-132, Channel 3 Indicator BLI-130,>> Channel 4 Indicator-Recorder D. Steam Generator No. 4 BLP-140, Channel 4 Indicator BLP-141, Channel 2 Indicator BLP-142, Changel 3 Indicator-Recorder BLI-140,>> Channel 4 Indicator-Recorder Note: Asterisk indicates wide-range level indicator.

All indicator and recorder elements have D'Arsonval movements, which obtain their energy from the transducer system and require no further energy to drive the indicating devices. The chart motors of the recorders, which are not required for recorder pen indication, are fed from non-safety-grade BOP control buses.

All narrow-range channels have a range of 144 inches and begin to indicate at 431 inches of water.

0

~ - tll)ll FranMin Research Center A WI Zbo f<onU(n

TER-C5 257-292/293

4. CONCLUSIONS The FRC review of the p. C. Cook Units 1 and 2 AFW system automatic nitiation circuits and flow instrumentation concludes that these systems comply with the long-term safety-grade requirements with the exception of the flow transmitters, which are presently control grade.

00l) Franklin Research Center h Orvsion d The Fionkhn ln3otug

TER-C5257-292/293 5>> REFERENCES

1. Code of Federal Regulations, Title 10, Office of the Federal Register, National Archives and Records Service, General Services Administration, Revised January 1, 1980.

2. NRC generic letter to all PMR Licensees regarding short-term requirements resulting from Three Mile Island Accident, September'3 I 1979 ~

3. NUREG-0578, "'IXI-2 Lessons Learned Task Force Status Report and Short-Term Recommendations," USNRC, July 1979.

4. NRC generic letter to all PMR Licensees clarifying lessons learned short-term requirements, October 30, 1979..

5. NRC generic letter to all PHR Licensees regarding short-term requirement resulting from Three Mile Island Accident> September St 1980.

6. NUREG-0737, "Clarification of MI Action Plan Requirements," USNRCg November 1980.

American Electric Power Company letter from J. E. Dolan to B. R.

Denton (NRC), August 9, 1979.

8. American Electric Power Company le t tec from J. E. Dolan to H. R.

Denton (NRC), October 24, 1979.

9. American Electric Power Company letter from J. E. Dolan to H.,R.

Denton (NRC), December 7, 1979.

10. American Electric Power Company letter from J. E. Dolan to H. R.

Denton (NRC), December ll, 1979.

American Electric Power Company letter from J. E. Dolan to H. R.

Denton (NRC), December 20, 1979.

12. American Electric Po~er Company letter from J. E. Dolan to H. R.

Denton (NRC), May 23, 1980.

13. American Electric Power Company letter from R. S. Hunter to H. R.

Denton (NRC), December 10, 1980.

14. IEEE Std 279-1971, Criteria for Protection Systems for Nuclear Power Generat ing Stations, Institute of Electrical and Electronics Engineers, Inc., New York, New York.

15. NUREG-75/087, Standard Review Plan Section 10.4.9, Rev. 1, USNRCg no date.

00 Franklin Reseereh Center h Ms on d Thc Fi ~ iA'n 4>wwo

TER-C5257-292/293

16. Regulatory Guide 1.97 (Task RS 917-'4) < "instrumentation for Light-Nater-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident,'ev. 2, USNRC, December 1980.

17. IEEE Std 323-1974, qualifying Class lE Equipment for Nuclear Po~er Generating Stations, Institute of Electr ical and Electronics Engineers, Inc., New York, New York.

IllllfFranhlin Research censer A Drvlhoh of As'slhl'.h fhs'Ishg