ML18136A108

Forwards Info Re NRC Requirements for Auxiliary Feedwater Sys

ML18136A108
Person / Time
Site:	Surry
Issue date:	09/25/1979
From:	Eisenhut D Office of Nuclear Reactor Regulation
To:	Proffitt W VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.)
References
NUDOCS 7910260427
Download: ML18136A108 (23)

Text

{{#Wiki_filter:Docket Nos.: 50-280 50-281

• UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D, C. 20555 Septem~er 25, 1979 e

REGULATORY DOCKEi.f.itE COPYJ Mr. W. L. Proffitt Senior Vice-President - Power Virginia Electric and Power Company P. 0. Box 26666 Richmond, Virginia 23261

SUBJECT:

NRC REQUIREMENTS FOR AUXILIARY FEEDWATER SYSTEMS AT SURRY POWER STATION, UNITS 1 AND 2 The purpose of this letter is to advise you of our requirements for the auxiliary feedwater systems at the subject facility. These requirements were identified during the course of the NRR Bulletins and Orders Task Force review of operating reactors in light of the accident at Three Mile island, Unit 2. Enclosure l to this letter identifies each of the requirements applicable to the subject facility. These requirements are of two types, (l) generic requirements applicable to most Westinghouse-designed operating plants, and (2) plant-specific requirements applicable only to the subject facility. contains a generic request for additional information regarding auxiliary feedwater system flow requirements. The designs and procedures of the subject facility shoul~ be evaluated against the applicable requirements specified in Enclosure 1 to detennine the degree

• to which the facility currently conforms to these requirements. The results of this evaluation and an associated schedule and corrmitment for implementation of required changes or actions should be provided for NRC staff review within thirty days of receipt of this letter. Also, this schedule should indicate your date for submittal of information such as design changes, procedure changes or Technical Specification changes to be provided for staff review.

You may also provide your response to the items in Enclosure 2 at that time. In addition to the requirements identified in this letter, other requirements v1hich may be applicable to the subject facility are expected to be generated by the Bulletins and Orders Task Force. Such requirements are those resulting from our review of the loss-of-feedwater event and the small break loss-of-coolant accident as described in the Westinghouse report \\~CAP-9600, 11 Report on Small ~ ~ppL~

Mr. W. September 25, 1979 areak Accidents for Westinghouse NSSS System." Our specific concerns include systems reliability (other than the auxiliary feedwater system), analyses, guidelines and procedures for operators, and operator training. W~ plan to identify, in separate correspondence, the requirements resulting from the additional items from the Bulletins and Orders Task Force review.

Enclosures:

As stated Sincerely, ,~-;;G,-,,.. . "7.,-"--";;: t ,.~.::..oarrell G. Eisenhut, Acting Director Division of Operating Reactors Office of Nuclear Reactor Regulation

e e Mr. W. L. Proffitt Virginia Electric and Power Company September 25, 1979 cc: Mr. Michael W. Maupin Hunton and Williams Post Office Box 1535 Richmond, Virginia 23213 Swem Library College of William and Mary Williamsburg, Virginia 23185 Donald J. Burke U.S. Nuclear Regulatory Commission Region II Office of Inspection and Enforcement 101 Marietta Street, Suite 3100 Atlanta, Georgia 30303

~:14.1

System Description

e ENCLOSURE 1 SURRY 1 & 2 AUXILIARY FEEDWATER SYSTEM X.14.1.l Configuration and Overall Design The auxiliary feedwater system (AFWS) is designed to supply water to the steam generators for reactor coolant system sensible and decay heat removal when the normal feedwater system is not available. The AFWS can be utilized during other periods, such as during startup and shutdown, in the event of malfunctions such as loss of offsite power and also in the event of an accident. The AFWS is designed to seismic Category I requirements and is tornado missile proof. A simplified flow diagram i~ shown on Figure 1. The system consists of two motor driven pumps (3A and 38) and one steam driven pump (2). Each motor driven pump has a net capacity of 350 gpm; the turbine driven pump has a net capacity of 700 gpm. Taps from each main steam line at a point upstream of the main steam isolation valves provide the source of steam to the turbine through two parallel valves, one motor and one air operated. The motor driven pumps are connected to separate Class IE 480VAC emergency buses.

e Normally, the pumps take suction from the emergency condensate storage tank, with a capacity of 110,000 gallons. This provides approximately five hours of operation at system design flow of one motor-driven pump. This tank is designed to seismic Category I requirements and is proUcted from

---

~-- ---- --**-

tornado missiles. Additional supplies for the AFW system are as follows:

1.

300,000 gallons from a non-seismic condensate storage tank.

2.

110,000 gallons underground storage tank - seismic Category I and missile protected.

3.

2-300,000 gallon Fire Main Supply Tanks (non-seismic Category I), Fire Main Supply Piping (seis~ic Category I).

---

*-**-- -----~

4.

A cross-connect to the other unit 1s water supply, consisting of the s*ame supplies listed in i, 2, and 3 above. Each of the three pumps discharge into two headers, aligned by manual valves. There are three lines from each header, and each line contains a motor operated valve located inside containment. The lines join downstream of the MOVs and form a common discharge line supplying each steam generator . via the associated main feed line. In the event of failure of one header, the supplies from the pumps may be isolated from the failed header by manual operated valves to assure steam generator water flow from the other* header. The motor operated va1 ves* (MOV)-'*i n the* system~fl ow-path a-re = *-- normally open, and fail as-is. The air operated valve in the turbine steam supply system is normally closed, and fails open; the parallel MOV is normally closed and fails as-is. The AFWS discharge lines of both units are cross connected but are isolated by normally closed MOV valves. Operator action will permit the AFWS of one unit to supply water to the steam generators of the opposite unit.

e X.14.1.2 System Design Classification The turbifle-pump trai~ and motor pump trains (pumps, valves, motors, piping) are seismic Category I and tornado missile proof (Class lE for electrical equipment). l X.14.1.3 Power Sources The motor driven pumps and valves are supplied from the Class lE A-C emergency buses; 3A from Emergency bus lH, 38 from emergency bus lJ. The air operated turbine pump steam admission valve is D.C. solenoid operated and fails open. The parallel MOV is powered by Class lE A-C power and fails as is. X.14:1.4 Instrumentation and Control The instrumentation and control power supplies are from the 120 VAC vital bus system. "There are four vital buses, two supplied from inverters connected to the emergency DC power supplies and two regulated power supplies connected to the AC emergency buses. X, 14. 1. 4. 1.Centro 1 s Steam generator level is controlled manually from either the main control room or the auxili**ary" shutdown-panel00by*-0p-erating the appr-op-ri-ate*,MGV, -in-* the AFW line. The valves are motor operated, are normally open and* fail as-is on loss of power. Class lE instrumentation is provided (level and flow indications). .Information Available to the Operator Except as noted, the following indications are available at both operating stat i or1~:

1.

MOV position indication '4 +.

2.

Air operateq valves position indication, turbine control system

3.

Auxiliary feedwater flow (Control Room only)

4.

SG level-wide range

5.

Auxiliary feed pump amperage (Control Room only)

6.

Breaker (motor driven pump) position

7.

Condensate (110,000 gal) tank level (Control Room only) Initiating signals for Automatic Operation

1.

The following signals start the motor driven pump motors:

a.

Low-Low level from any steam generator

b.

Undervoltage on transfer buses D & F

c.

Safety injection

d.

Trip of both main feed pumps

e.

Manual

2.

The following signals open the steam control valves starting the steam turbine:

a.

Undervoltage on the Station Service bus (2 out of 3 logic)

b.

Low-Low steam generator level-2 out of 3 steam generators

c.

Manual

e X.14.1.5 Testing The systems are tested every 30 days in accordance with technical specifica-tion requirements. In addition to the periodic tests, operational tests are performed in accordance with surveillance tests following maintenance on a particular system or component. The instrumentation systems are tested periodically, per shift, every 30 days and every 18 months in accordance with technical specification requirements. X.14.1.6 Tech Specs X.14.2 The limiting condition of operation (LCO) permits plant operation if two of the three auxiliary feedwater pumps are operable. This could result in unrestricted plant operation if any of the three (including the steam driven pump train) remains inoperable. Reliability Evaluation Results X.14.2.1 Dominant Failure Modes Successful delivery of feedwater is considered to be the flow of at least 350 gpm to one (or more) of the three steam generators, for the transients considered here. Failure modes of. the AFWS were -ass-ess-ed--f-er-t-hree*-types -of *init*iating** transients. The dominant failure modes for each transient type are discussed below.

e e Loss of MFW with offsite power availabl~ The reliability analysis of the Surry AFWS based on this initiating transient did not identify any single failures or double failures which would fail the entire AFWS. Consideration was given to combinations of three failures such as a combination of one pump out for maintenance, coupleq with hardware failures in the other two lines. However, the dominant failure mode was assessed to be a common cause failure resulting from the failure to reopen all the manual pump discharge valves following test, coupled with the failure to either reopen at least one valve within approximately one-half hour after a demand on the AFWS, or to draw feedwater from the other unit 1s AFWS through the unit intertie connections. Loss of MFW with only onsite AC power available The response of the Surry AFWS to this transient should not be significantly different from that for the case discussed above. As such, it is again concluded that the dominant failure mode is the human error of failing to reopen the manual pump discharge valves after test, coupled with the failure to reopen one valve or to realign the other unit 1s AFWS within 30 minutes after an AFWS demand. Loss of MFW with only DC power available In this transient neither onsite or offsite AC power is available; thus the AFWS is reduced to the one steam-driven pump train. Failure of this train can occur in a number of ways. The results of this examination indicate that the dominant mode of failure is that the steam-driven train

e is out of service due to maintenance. The current Surry Technical Specifica-tions and LCOs permit the outage of one AFWS pump 1ndefinitely, so that the possibility of the steam train being out of service in a station blackout incident could be high. Revision of the Surry Technical Specifica-tions and LCOs to normally require the operability of all three trains except for limited maintenance outages (as in the standard Tech Specs) would improve the reliability of the AFWS substantially for this transient. X.14.2.2 Potential Dependencies X.14.3 The potential for a common-cause failure of the AFWS due to human error is, as discussed above, the most significant dependency found in this analysis. A second potential common-cause failure due to commonalities of equipment location was also noted; however, since the unit intertie system was installed specifically to alleviate this possible problem, this does not appear to be a significant concern. Recommendations for this Plant The short-term recommendations (both generic, denoted by GS, and plant-specific) identified in this section represent actions to improve AFW system reliability that should be implemented by January 1, 1980, or as soon thereafter -as-is-,-pr-acticable-. --In general,--they-invo-1-ve-upgrad-ingof Technical Spe,cifications or establishing procedures to avoid or mitigate potential system or operator failures. The long-term (both generic, denoted by GL, and plant-specific) recommendations identified in this*sec-tion involve system design evaluations and/or modifications to improve AFW system reliability and represent actions that should be implemented by January 1, 1981, or as soon thereafter as is practicable.

e X. 14.3. 1 Short-Term

1. Recommendation GS The licensee should propose modifications to the Technical Specifications to limit the time that one AFW system pump and its associated flow train and essential instrumention can be

2.

inoperable. The outage time limit and subsequent action time should be as required in current Standard Technical Specifications; i.e., 72 hours and 12 hours, respectively. Recomnendation GS Emergency procedures for transferring to alternate sources of AFW supply should be availabl~ to th~ plant operators. These procedures should include criteria to infonn the operator when, and in what order, the tT'ansfer to alternate water sources !,nould take place. The following cases should be covered by the procedures: t The case in which the primary water supply is not initially available. The procedures for this case should include any

• operator actions required to protect the AFW system pumps against self-damage before water flow is initiated; and,
• The case in which the primary water supply 1s being depleted.

The procedure for this case should provide for transfer to the alternate water sources prior to draining of the primary water supply.

3.

e Recommendation GS The as-built plant should be capable of pro-viding the required AFW flow for at least two hours from one AFW pump train independent of any alternating current power source." If manual AFW system,initiation or flow control is required following a complete loss of alternating current power, emergency procedures should be established for manually initiating and controlling the system under these conditions. Since the water for cooling of the lube oil for the turbine-driven pump bearings may be dependent on alter-natin9 current power, design or procedural changes shall be made to eliminate this dependency as soon as practicable. Until this is done; the emergency procedures should provide for an individual to be stationed at the turbine-driven pump in the event of the loss of all alternating current power to monitor pump bearing and/or lube oil temperatures. If,1ecessary, this o'perator would operate the turbine-driven pump in an on-off mode until alternating current power is restored. Adequate lighting powered by direct current power sources and communications at local stations should also be provided if manual initiation and control of the AFW system is needed. (See. Recorrmendation GL-3 for the longer-tenn resolution of this concern.)

4.

Recorrrnendation GS The licensee should confinn flow path avail-ab i1 i ty of an AFW system fl ow train that has been out of service to perfonn periodic testing or maintenance as follows: Procedures should be implemented to require an operator to determine that the AFW system valves are properly aligned and a second operator to independently verify that

5.

e the valves are properly aligned. The licensee should propose Technical Specifications to assure that prior to plant startup following an extended cold shutdown, a flow test would be performed to verify I the normal flow path from the primary AFW *system water source to the steam generators. The flow test should be conducted with AFW system valves in their normal alignment. Recommendation GS The licensee should verify that the automatic start AFW system signals and associated circuitry are safety-grade. If this cannot be verified, the AFW system automatic initiation system should be modified in the short-term to meet the functional requirements listed below. For the longer term, the automatic initia-tion signals and circuits should be upgraded to meet safety-grade requirements as indicated in Recommendation GL-5. The design should provide for the automatic initiation of the auxiliary feedwater system flow. The automat-ic initiation -signals* and* circuits*should-be-desi*gned -- -- * -

• so that a single failure will not result in the loss of auxiliary feedwater system function.

Testability of the initiation signals and circuits shall be a feature of the design. The initiation signals and circuits should be powered from the emergency buses. Manual capability to initiate the auxiliary feedwater system from the control room should be retained and should be implemented so that a single failure in the manual circuits will not result in the loss of system function. The alternating current motor-driven pumps and valves in the auxiliary feedwater system should be included in the automatic actuation (simultaneous and/or sequential) of the loads to the emergency buses. The automatic initiation signals and circuits shall be designed so that their failure will not result in the loss of manual capability to initiate the AFW system from the control room.

6.

Recommendation - Procedures should be established to lock open and periodically verify open position of all manual AFWS valves inside containment.

7.

Recommendation-The licensee should require staggering of the periodic pump train tests (e.g., one train at North Anna is tested every 10 days rather than all three trains tested at once on a monthly basis). This reduces the potential for inadvertently leaving closed the dis-charge valves of all trains after test.

e 8. Recommendation - Emergency procedures should be available to the operators for operating the AFWS of one unit such that it is supplying water to the steam generator(s) of the opposite unit in the event that such an operating mode should be necessary. X. 14.3.2 Additional Short-Term Recommendations The following additional short-term recommendations resulted from the staff's Lessons Learned Task Force review and the Bulletins and Orders Task Force review of AFW systems:at Babcock & Wilcox-designed operating plants subsequent to our review of the AFW system designs at,!i-and C-E-designed operating plants. They have not been examined for specific applicability to this facility.

l.

Recol'11Tlendation - The licensee should provide redundant level in~ di'cattons and __ low level alarms in the control room for the AFW _ system primary water supply to allow the operator to anticipate the need to make up water or transfer to an alternate water supply and prevent a low pump suction pressure condition from occurring. The low level alarm setpoint should allow at least 20 minutes 2,_ for operator action, assuming that the largest capacity AFW pump is operating. Recorrrnendation - The licensee should perform a 72-hour endurance test on al 1 AFW system pumps, if such a test or continuous period of operation has not been accomplished to date. Following the 72.;..hour pump run,

• the pumps should be shut down and cooled down and th~n restarted and

---

-~-~~------ ---------

e run for one hour. Test acceptance criteria should include demonstrating that the pumps remain within design limits w1th respect to bearing/ bearing oil temperatures and v1bration and that pump room ambient condi-tions ( tem~erature, humidity) do not exceed environmental qualification limits for safety-related equipment 1n the room.

3.

Recommendation - The licensee should implement the following requirements as specified by Item 2.1.7.b on page A-32 of NUREG-0578: 11Safety-grade indication of auxiliary feedwater flow to each steam generator shall be provided in the control room. The auxiliary feedwater flow instrument channels shall be powered from the emergency buses consistent with satisfying the emergency power diversity requirements for the auxiliary feedwater system set forth in Auxiliary Systems Branch Techn-nical Position 10-1 of the Standard Review Plan, Section 10.4.9. 11

4.

Recommendation - Licensees with plants which require local manual realignment of valves to conduct periodic tests on one AF~ system train and which have only one remaining AFW train available for operation, should propose Technical Specifications to provide that a dedicated individual who is in communication with the control room be stationed at the manual valves. Upon instruction from the control room, this operator would re-align the valves in the AFW system train from the test mode to its operational alignment. X-14.3.3 Long-Term Long-term recommendations for improving the syste~1 are as follows:

1.

Recommendation.GL At least one AFW system pump and its associated flow path and essential instrumentation should auto-matically initiate AFW system flow and be capable of being operated independently of any alternating current power source for at least

2.

~ two hours. Conversion of direct current power to alternating current is acceptable. Recommen*dati on - GL The licensee should upgrade the AFW system automatic initiation signals and circuits to meet safety-grade requirements.

3.

Recommendation - The AFWS flow control valves for both the motor and turbine pump trains_are AC-powered,- normaJl~_open, faiJ_as-is motor operated va*lve-s-,wh-ich--,*are,,loe::ated -ins-ide-*contaiAment-.-~--Also,, ma-Ruacl, norm-ally open valves are located inside containment. The AFWS design should be reevaluated, including the possibility of relocating the valves outside containment, assuming an accident insjde containment which necessitates AFWS operation and which creates a containment environment (humidity, radiation) that precludes access to the valves. The reevaluation should consider the following:

a.

A possible common mode failure (environmentally induced) causing spurious cloiure or failure of the MOV 1 s in a throttled position.

b.

An AFWS line break downstream of the MOV 1s and failure of the MOV 1s to operate.

MOV-GLOBE VALVES FROM OTHER UNITS AFW SYS MAIN FEED I I I I I I I I I S/G - STEAM GEN FP - FIRE PROT SYS B-- PUMP M - NORMALLY CLOSED l><J - NORMALLY OPEN FO - FAIL OPEN FC - FAIL CLOSED V2 VJ V5 ~ - AIR OPERATED V.ALVE (OPEN) _g _ MOTOR OPERATED VALVE (CLOSED) MOTOR OPERATED VALVES FAIL AS-IS -{)f- - CHECI< VALVE (ALLOW FLOW LEFT TO RIGHTI VB V6 V9 } TO OTHER UNIT AFW SYSTEM ---""~ r ______ J FO I I TURBINE FROM SGB ')......:.1-r:KJ.--t~.-.~ STEAM I 1-------1....al--~--' SUPPLY FROMSGC ),-~ 1 -oa---t)I---' I INSIDE I OUTSIDE CONTAINMENT FW MOV OPEN SIGNALS

1. SAME LOGIC THAT STARTS TURB DRIVEN PUMP

2. SAME LOGIC THAT STARTS MOTOR DRIVEN PUMP FP FP UGS UNDER GROUND---~

SUPPLY UGS 110 K GAL ~----1>e:t------1ABOVEGROUND MOTOR DRIVEN START 1_ BOTH MN FD PUMPS TRIP

2. ONE S/G LO LO LEVEL

3. TRANSFER BUS UNDER VOLTAGE

4. SAFETY INJ.

~--------~~--------~~----~, TURB DRIVEN START

1. STA SER BUS UNDER VOLTAGE

2. 2/3 S/G's LO LO LEVEL Auxiliary Feedwater System

. Surry Nuclear Station Figure 1

ENCLOSURE 2 e '".

• e Basis for Auxiliary Feedwater

~ystem Flow Reauirements A$ a result of recent staff reviews of operating plant A~xiliary Feed-water Systems (AFl~S), the staff con-::1 udes that the design bases and criteria provided by licensees for establishing AFWS requirements for flow to the steam generator(s) to assure adequate removal of reactor decay heat are nqt well defined or documented. We require that you provide the following AFWS flow design basis infor-mation as app1Jcab1e to the design basis transients and accident con-ditions for your plant.

1.

a.

Identify the plant transient and accident conditions considered in establishing AFWS flow requirements, including the following events:

1)

Loss of Main Feed (LMFW)

2)

LMFW w/loss of offsite AC power

3)

LMFW w/loss of onsite and offsite AC power

4)

Plant cooldown

5) Turbine trip with and without bypass 6~

Main steam isolation valve closure

7)

Main feed line break

8)

Main steam line break

9)

Small break LOCA

10)

Other transient or accident conditions not listed above

b.

Describe the plant protection acceptance criter_ia_ and corres-ponding technical.bases used for each initiating event identi-fied above. The acceptance criteria should address plant 1 imi ts such as:

e e - Maximum RCS pressure (PORV or safety valve actu~tion) - Fuel temperature or damage limits (Dil3, PCT, maxfr"::.irn fuel central temperature) RCS cooling rate limit to avoid excessive coolant shrinkage - Minimum steam generator level to assure sufficient steam generator heat transfer surface to remove decay heat and/or I cool down the primary system.

2.

Describe the analyses and assumptions and corresponding technical justification used with plant condition considered in l.a. above including:

a.

Maximum reactor power (including instrument error allowance) at the time of the initiating transient or accident.

b.

Time delay from initiating event to reactor trip.

c.

Plant parameter(s) which initiates AFWS flow and time delay between initiating event and introduction of APn3 flow into steam generator( s).

d.

Minimum steam generator water level when initiating event i o.ccurs.

e.

Initial steam generator water inventory and depletion rate before and after AFWS.flow corrmences - identify reactor decay heat rate used.

3 -

f. Maximum pressure at which steam is released fro."11 steam generator(s) and against Hhich the AFW pump must develop sufficient head.

g.

Minimum number of steam generators that.must receive AFW flow; e.g. l out of 2?, 2 out of 4?

h.

RC flow condition - continued operation of RC pumps or natural circulation.

i. Maximum AFW inlet temperature.

j. Following a postulated steam or feed line break, time delay assumed to isolate break and direct AFW flow to intact steam generator(s).

AFW pump flow capacity allowance to accormnodate the time delay and maintain minimum steam generator water level. Also identify credit taken foT primary system~heat removal due to blowdown.

k.

Volume and maximum temperature of water in main feed lines between steam generator(s) and AFWS connection to main feed line.

l. Operating condition of steam generator nonnal blowdown following initiating event.

m.

Primary and secondary system water and metal sensible heat used for cooldown and AFW flow sizing.

n.

Time at hot standby and time to cooldown RCS to RHR system cut in temperature to size AFW water source inventory.

e**

3.

4 -,. Verify that the AFW pumps in your plant will supply the necessary f 1 O\\*I to the steam generator(s) as determined by items 1 and 2 above considering a single failure. ldentitY the margin in sizing the pump flow to allow for pump recirculation flow, seal leakage and pump wear. .::,}}