ML19224C385
| ML19224C385 | |
| Person / Time | |
|---|---|
| Issue date: | 06/18/1979 |
| From: | NRC COMMISSION (OCM) |
| To: | |
| References | |
| FOIA-79-98 PP-790618, NUDOCS 7907020257 | |
| Download: ML19224C385 (76) | |
Text
.
.w
, ']t
~
n j
sk
~? !
7
{
g
.t.
3h
/
N (Q
6, 4 TAB (EOFCONTENTS i
\\1
<q'
~
/
INTORDUCTICM Power ~1perated Relief Valve Considerations............................
Design...........................................................
Recommendations.................................................
LOCA Initiators..........................................
Frequency........................................................
Systems Considerations..............................
G e n e ral Co n c l u s i o n s.............................................
Conclusions and Recommendations in WARD-SR-3045-5..............
High Pressure Injection.............................................
Reactor Coolant Pressure Control....................................
Natural Circul:.cion in Westinghouse Plants.
(
Westinghouse Small Break Analyses..........
The Role of Noncondensable Gases in the RCS After LOCA..............
Role of the 0perator..........................
Finding and Recommendations..............................
-,,o t
,c J
2 / t.
'o07020;Ls7 4
kb) f ~ },C
TRANSIENTS AND NATURAL CIRCULATION IN WESTINGHOUSE PLANTS INTRODUCTION The safety analyses are generally carried out in time long enough to demonstrate stable plaat conditions and to indicate that the Reactor Coolant Boundary Pressure limit and the core damage limits are not violated in this early phase of analysis.
In view of TMI-2 occurrence, we decided to investigate the ability of Westinghouse designed plants to achieve and maintain natural circu-lation which may be the cily mode of core cooling that may be availaole if multiple failures were to be experienced.
The factors that we considered in this evaluation were as follows:
1.
Natural Circulation Tests 2.
Natural Circulation Occurrences from Loss of Offsite Power Events 3.
Impact of Severe Transients which could Ccuse Consequential Failures 4.
Potential for LOCA from Control Systems
?
b J,- b
~
~ 5.
Influence of Non-Condensibles 6.
Influence of Other Systems (e.g., Auxiliary Feedwater System Pressure Control) 7.
Operator Training We met with Westinghouse on April 23rd and again on April 26th to discuss these issues. These discussions also included the concerns raised by C. Michelson in a report entitled, " Decay Heat Removal During a Very Small Break LOCA for a 205-Fuel-Assembly," January 1978.
i The critical factors that influence natural circulation in Westinghouse designs are the break size, the secondary (i.e., steam generator) system characteristics.
and the emergency core cooling systems.
Our preliminary conclusions are that Westinghotse cesigned plants 1.
Would experience fewer challenges to PORV than the B&W designed plants.
The estimated frequency of challenges from anticipated transients is about 0.2 RY.
2.
Have more trips based on the steam generator conditions and therefore longer time is available for further actions.
2 [ (.I J ' t
- 3.
Have not experienced any stuck open PORVs in this country although such an event occurred in a plant designed by W in a foreign country.
4.
Have larger steam generator inventory and thus longer time to boil dry.
Preliminary estimates indicate time to boil dry ranges from 25 minutes to 45 minutes for W designed plants.
5.
Have higher reliability of auxiliary feedwater systems.
Some older plants' auxiliary feedwater system may be less reliable.
6.
Would have difficulty achieving a successful natural circulation cooldown mode for some small breaks if the auxiliary feedwater is unavailable for long time period.
Although our judgment is that the Westinghouse designed reactors would likaly undergo a tuccessful natural circulation, we recommend that further study be initiated to:
1.
Investigate the variation in design of ECCS and Auxiliary Feedwater Systems in the various Westinghouse designed plants to assure th. they have the necessary redundancy and diversity.
2.
Investigate the common cause failure potential of these systems.
l 0
f) ',.
_ 3.
More thoroughly evaluate the role of non-condansibles in natural circulation.
Although reflux Doiling mode of coolaown would occur for some. break sizes, some tests should be conducted to assess this impact of noncondensibles on this mode of heat transfer.
4_
Dete.mine if the challenges to PORV can be further reduced by additional early scrams and/or improved spray (pressurizer) designs.
Consideration should be given to the impact (i.e., increased numbers of scram) on safety such as increased challenges to safety systems like scram, auxiliary feedwater, and grid disturbances.
5.
Develop procedures for operators which include specific instructions on the actions to be taken and the bases for these actions if the plant response varies significantly from predicted response.
POWER OPERATED RELIEF VALVE CONSIDERATIONS Design All Westinghouse operating reactors are equipped with one to three power operated relief valves. Most plants have two, only Yankee Rowe has one, aid the rest have three.
The valves are designed to prevent the lifting of the pressurizer code safety valves 37d to allow the rector to remain on the '~na for load rejection transients.
The valves are not considered part plant's safety systems and therefore are not taken credit for in th. safety s
6
. a~ lysis or covered in the station Technical Specifications as far as we know.
Some plants have operated for extended periods wi'h the va;yes isolated due to seat leakage.
The PORV used on Wettinghouse plants is a spring loaded valve with an air actuating capability.
Air is supplied to the control diaphragm on top of the valve to initiate opening. This will cause the sprir
'orce on the valve stem and disc ta lessen and allow the valve to open.
Closure of the valve is initiated by venting air off the control diaphrag' causing cpring force tu positively seat the valve closed. The valve will close on loss of air.
Performance Data from operating U.S. plants shows that the PORVs have opened approximately 50 times for various reasons.
For each of these openings, the valve reseated correctly.
Preliminary reports indicate that a PORV on a foreign Westinghouse reactor did not close correctly after opening.
The cause for this malfunction is not known but could have been due to passing of a water slug.
We are continuing our search for informatin-on this event.
Table 1 is a preliminary list of all operating U S. Westinghouse reactors witn the number of PORV openings and reason associated with each.
This data ccmes from a recent survey of bestinghouse plants and is derived in scme cases frca plant records and in others from the utilities' and operators' recollection.
2 [ b b ' '.
' TABLE 1 Facility No. of Openings Reason Beaver Valley 1 7***
Note 2-1 Note 3-4 Note 5-1 Note 6-1
- 0. C. Cook 1&2 5
Note 1-1 Note 2-1 Note 3-2 Note 4-1 Farley 1 3
Note 3-3 Indian Point 2&3 0
Kewaunee 2
Note 1-2 North Anna 1 0
Point Beach 1&2 5
Note 1-2 Note 3-3 Prairie Island 1&2 3
Ncte 1-1 Note 2-1 Note 3-1 H. B. Robinson 2 1
Note 4-1 Salem 1 3
Note 4-3 Surry 1&2 4-6 Note 2 4-6 Trojan 1
Note 3-1 Turkey Point 3&4 10*
Note 1-1 Note 2-7 Note 3-2 Zir.n 32 3
Note 5-1 Note 1-1 Note 8-1 Note 3-1
/ / l)
J4b
am, 7-TABLE 1 (Continued)
Facility No. of Ooeninos Reason Coanecticut Yankee 3
Note 3-3 Gini.a O
San Onofre 1
Note 1-1 Yankee Rcwe C
Note 7 TOTAL = 51-53 Note 1:
Instrumentation or tech / error Note 2:
.'ntentional test Note 3:
T ansient response
- Numbers are approximate Note 4:
Cald shutdown water solid
- Data only back to 12/21/77 Note 5: Manual opening to control pressure on transient Note 6:
Cause unknown Note 7:
No automatic, several manual openings Note 8:
Loss of pressurizer spring flow.
PORVS opened.
Isolation val.es
(
shut, therefore, valves did not relieve.
s c / U
- >,., 6
. A summary of this data is contained in Tables 2 and 3.
At an April 23, 1979 meeting, Westirghouse stated tnat the following events could cause opening of the PORV:
1.
Rod withdrawal from low power 2.
Turbine governor or control valve closure 4.
Main steam isolation valve closura
(
This conclusion is based upon best estimate calculations performed by Wertinghouse.
They stated that they actuai.y did not expect PORV opening on a loss of offsite power based upon plant operating experience.
The pre-liminary data received by the staff appears to support this conclusion.
Of the 20 events listed in Table 3, six openings at Point Beach ano Connecticut Yankee occurred more than 5 yeard ago and have not occurred since (supposedly due to plant modifications or changes in procedures). This leaves 14 events which may be of the type whica could occur again.
(It should be noted that four of these are from Beaver Valle; '. which iridicates one of two things is true.
Either Beaver Valley performed a more thorough review of the plant l
an.
.g_
1 TABLE 2
SUMMARY
OF OPENING PORV DATA
?qstrument or Technician Error 9
Intentional Opening for Test 16 Intentional Opening for Pressure Control 2*
Cold Shutdown Water Solid 5
Cause Unknown 1
Transient-Automatic Response 20 All valves closed normally.
G
- Yankee Rcwe reports several manual openings but no reason given for opening.
O d'I0
am.
- TABLE 3
SUMMARY
OF AUTOMATIC TRANSIENT OPENINGS Facility Cause Prairie Island 1&2 Maintenance being performed on electro-hydraulic control oil system caused a turbine trip.
Control rods were in manual.
Pressure increased to 2285 psi.
Point Beach 1&2 Main steam isolation valve closure (3 times)
Turkey Point 3&4 Full load rejection (2 times)
D. C. Cook 1&2 Failure of crids I and II vital power supply inverters; lost 2 crids with safety injecton signal.
Both resulted in reactor trip and loss of pressurizer spray.
Beaver Valley 1 Turbine Trip, Rapid Load Reduction, Main steam isolation valve closure, Rapid Load Decrease.
Trojan High steam generator water level caused feedsater isolation and turbine trip /
Connecticut Yankee Loss of AC pcver (3 times 1968-1970)
Farley 1 Loss of main feedwater at 87% power pressure control en manual.
Reactor trip during startup, pressure control on manual.
Loss of circulating water and loss of 4160-Volt bus during lightning storm caused safety injection.
Caused overfill of pressurizer.
PORVs opened and shut about 4 times.
Zion 2 Rea tor trip and safety injection from 20% power.
Inspection of containment revealed pressurizer relief tank rupture discs blown due to apparent opening of PORVs and safeties.
l 0
)'; N
Ah>
. records or that the plant is esoecially susceptible to load reduction type events.)
The data indicates t at many openings are dua to operator erec'r while con-ducting tests or maintenance.
Several of these were at significant pcwer levels.
A large fraction of the events are due to ir.tentional testing during either the precperational testing period or prior to refueling (for low temperature overpressure protection).
At the request of the NRC staff, Westinghouse investigated the pcssibility of changes in the PORV setpoint and high pressure reactar trip setpoint to pre-vent PORV opening for transients. Westinghouse noted that the PORV is designed to prevent safety valve operation and would therefore have to be set below the safety valve setpoint by a ccrtain margin.
The adjustment of reactor trip setpcint, they contend, would cause reactor trips at full power if a pressure margin below PORV oper setpoint of 140 psid were allowed for the most severe transient (MSIV closura).
(See Table 4.) Even if this were successful, less than half of all PORV openings (those reported) wculd be precluded.
It is not apparent that this reduction is beneficial at the expense of ircreasing the number of spurious high pressure reactor trips.
~) l [ l J;O
~
t o
b e -
. TABLE 4
(
(%
/ / U*
- ).> a
A
. Recommendations The capability of the PORV to prevent safety valve opening should not be taken away if possible.
If a PORV were to stick open, it is isolabie assuming the operater knows it is open. A safety vaise cannot be isolated should it fail to reseat.
Therefore, we recommend that the valves not be isolated for the purpose of preventing their opening.
We do not believe that additional measures should be taken to minimize the opening of PORVs since there is a potential for this type of valtte to fail to reseat. Therefore, we recommend the following:
i.
1.
Conduct a more thorough survey of PORV opening data by review of plant records.
(It's difficult to believe that one plant would have so many more openings than others.)
2.
Have operating plants review test and maintenance procedures which have the potential for causing PORVs to open (loss pressurizer spray, ~ ;
repairs, etc.).
3.
Westinghouse investigate additional plant features to allow load rejection without opening PORV.
270 35J
db>
. 4.
Westinghouse utilities investigate upgrading of PORV controls so they would not be susceptib'e to single fai'ures causing opening.
5.
Utilities / Westinghouse confirm indications of PORV opening src adequate on Westinghouse reactors.
6.
Utilities investigate automatic closure of isolation va've when the reactor pressure is below DORV closure setpoint.
LOCA Initiators Loss-of-coolant accidents (LOCA) are those postulated accidents which result from the loss of reactor coolant at a rate in excess of the capability of the reactor coolant makeup system from breaks in the reactor coolant pressure boundary, up to and including a break equivalent in size to the double-ended rupture of the largest pipe of the reactor coolant system.
Besides a break in some piping in the reactor coolant system causing a LCCA, any of the power operated relief valves (PORV) or safety valves sticking open could also cause a LOCA of sufficiently large size (1.5" to 25" diameter) as to require ECCS action.
Thus a small LOCA could be initiated from the following scenarios:
(1) Random break in the primary system - considered under Appendix K calculations.
bE.)
b
~
. (2) Inadvertent opening of a PORV or safety valve - considered under transient analysis submitted in the plant safety analysis reports.
(3) PORV opening due to a mismat:h between heat generatian and heat removal capability and subsequently sticking open.
This specific scenario is not analyzed in the SARs.
A.
Frequency of Small LOCA 1.
Random Break in the Primary System The reactor safety study indicates the frequency of small LOCA
-3 (1/2 "-2") to be approximately 10 per reactor year.
2.
Inadvertent Or ing of PORV On the basis of current U.S. experience with 'd designed plants, the frequency of inadvertent opening of a PORV is approximately 0.2 per reactor year.
However, in no instance has the PORV failed to reclose.
The small LOCA analyses performed by Westinghouse shcw that no fuel failure is expected for a PORV stuck open.
3.
Trans*ent Causinq PORV Gpening 2 [ h 3 ) ',-
~ The transients which have a potential for opening PORV are:
a.
Rod withdrawal at low power condition b.
Closure of all MSIVs c.
Snme turbine trips d.
Loss of offsite power PORVs could also be challenged for other mismatch transients (e.g.,
loss of feedwater) if the pressurizer spray fails to function either from spray valve failure to open or the system in manual mcde of operation. On the basis of current U.S. experience with Westinghouse designed plants, the frequency of these challenges is expected to be less than 0.2 per reactor year.
If one conservatively includes the one known incident in another country of a PORV sticking open without taking credit for the reactor years of foreign experience with W designed plants, the expected frequency of a small LOCA following an anticipated transient is less than 0.01 per reactor year..
O fI:
saa
17 Systems Considerations During normal plant operation, the heat produced in the primary system is balanced by the heat remosad at the steam ger:erators which are suppl *ed with feedwater by the main feedwater pumps and discharge steam to the main turbine.
The capacity of this normal heat sink would be affected by valve closures in the main steam lines or loss of main feedwater flow.
Corrective actions are made to keep the primary and secondary system pressures, temperatures, and water inventories within acceptable limits in the event of loss of the normal heat sink.
These include reactor scram by the reactor protection system, reestablishment of a reduced feedwater flow by the auxiliary feedwater system, reactor system coolant makeup by the normal makeup system, and pressure relief and energy removal by power-operated relief valves, dump valves, or safety valves.
With loss of main feedwater flow, the secondary side steam pressure ir. creases.
I' the event involved only the loss of main feedwater, the secondary steam p.e sure could be controlled by the power-operated relief valves or the dump valves S. the nain condenser.
If these were not available, the pressure would increase to the set points of the steam generator safety valves whie.h reach full capacity at 103 percent of the set pressure.
The reduction in steam generatcr water levels because of a decrease in void fraction and flow out of the safety valves is eventually offset by reactor scram and initiation of the auxiliary feedwater system which typically has a ficw capacity frc n roughly 270
.>56
. 2-1/2 to 5 percent of main feedwater design flow rate.
The 2-1/2 percent flow capacity corresponds to a heat removal capability equal to decay heat at about 13 minutes after reactor scram.
The auxiliary feedwater system is used to supply feedwater under emergency conditions involving loss of the normal heat sink ficw as tell as during normal startup, rormal shutdown, and hot standby operation.
This system generally has at least two trains =nd is connected to the vital bus. The aux'liary feedwater system initiation time and capacity and the reactor scram time should be suc'i that the water levels in the steam generators being supplied following loss of main feedwater flow remain high enough to provide suf ficient neat transfer area to remove stored and residual heat without causing opening of the primary coolant system relief and safety valves.
The consequences of a temporary total (main plus auxiliary) loss of feedwater flow and the times available for corrective manual actions are affected by the steam generator secondary side water inventory and the type of signal used to obtain a reactor scram.
The U-tube type of steam generators used in Westinghouse plants have larger secondary size water inventories than once-through steam generators.
However, early initiation of reactor scram is still required to give large dryout times following the assumed total loss of feedwater flow.
For example, the dryout time for Westinghouse plants varies from about 57 to 74 seconds, if the reactor remains at full power following total loss of feedwater.
- However, most Westinghouse plants would be tripped at.3 to 15 seconds into the transient by a low-level signal from the steam generators coincident with a steam-feed ficw mismatch signal.
As a result, the dryout time is much larger.
The
,r
)Y*
. dryout times with this trip range from 25 to 45 minutes.
(See Table 1 for scram setpoints on W designed plants.
If a LOCA is considered to occur coincident with total loss of feedwater flow, the steam generetor dryout times would be larger since the break flow and injected ECCS water serve to remove decay heat and reactor scram might occur earlier in the vansient.
For small breaks (0.02 ft ), the steam generators 2
would serve to remove most of the decay heat and the increase in dryout time would be relatively small.
For large breaks, there would be a rapid depres-surization of the RCS.
In.nis case the break and ECCS injection ficws provide more than enough cooling to remove stored and decay heat and, in fact, the steam generators tend to act more as a heat source than heat sink during the transient.
The performance requirements of an AFW system would depend on the initiating event (e.g., loss of main feedwater).
For Westinghouse designed plants, Table 6 includes the characteristics of the auxiliary feedwater system.
All plants, except ene, have at least two auxiliary feedwater pumps.
Three plants have manually actuated auxiliary feedwater systems. A survey of utilities with Westinghouse reactors indicates that the parameters which actuate auxiliary feedwater systems are quite similar (with some, what seeu to be, minor variationt).
These parameters are as follows:
- r r,
,3 -l,, 3 J 'J v
(_
\\.,
/
% J,i.e <
t l
c Existing System N.'tC Proposed System
/
l
- m Safety Valve Setpoint M.
2500 l-
" L Margin needed pt.;
.l.
L and Safety between PORY
, j lProposedPORy Vcives to
!< $4tPoint avoid safeties 245C.
1if*ing
^
g l.
T l~
< High Pressure Trip l-
~
2400
' with nominal errors l
i i
o pressure above reactor
' I trip setpoint for MSIV
_C l
closure 4
w PORY setpoint l
5 2350.
m
.g ce l
~,
I
'C'nange in
/
\\
2300
( pressure for 1 50% load rejec-l tion l
l liign pressure trip l7 u,
2E ~~
{
Noninal l
h'ormal I with ncainal errces Control control range l
Range of
, of pressure Pressure p
o 2200 -.
1.'DTES:
1, Ncafnal error in pressure chennel + 25 psi 2.
Ucainal error in high pressura triF channel 3% of sn'n or,25,nsi 3.
Pressure increase for a.
5051ccd rejcctica + C0 psi b.
100% lo:d rejection + 110 ;:si c.
USIY clocure + 150 p i :t
- h!gh pressure tri; ::t;:ir.t
,) l ql n
'ca:1usien
?.cysed ;ys toa uill resui t-in a i+vtor trip at n:H r e.12e
~
I
~
. TABLE 5 SCRAM SETPOINTS ON WESTINGHOUSE REACTORS 270 vu
. g.
A Ay w\\> Obs, V c,
'f
,@ eDg TQ<>
%fl<
TEST TARGET (MT-3) l.0 if a*4 0 23 t= 32 l"nl2.2 E at b !!?. lljll~2.0~~
g.g
_t,
l.25 1.4 ip.6 N_d$r,4
+1(['S
.e.,_
s m.
O 4", i ep
(
ob
%,)h<.f;>f/}t %,;'f h
////
k IMAGE EVALUAT!ON TEST TARGET (MT-3) 1.0 lf a E3 12 [32 12.2 is E3 "1 bN l,l l!id i VlI.25 1.4 1.6 ll
==
4%
6,?a?,%
%+#b4 abn*%.9 z
'v 0}
A"*&, ~ * %
<g '
s
'\\
?/
\\% 'fik r$c '&> 'vjpo,.
- $Y Ry>j>
%;+fE h %,0
/
4 9
TEST TARGET (MT-3) 1.0 l[ 31 m LA
'INl 2.2 f!
-- a L
'36
=7 i
m 1.25 i 1.4 "li.6 l
I 6.
k,, ?,,%
'%?.b,y o-ge a;;v
\\
g'\\?&
%l>
h Q
k g@*e> \\
/,
%j y
ll,,//
A
\\'
'%f+,',9
/% g kNN IMAGE EVALUATION N
TEST TARGET (MT-3) 1,0 g; 27 [12 5, IU 8
-1
~u f!!$Me I2 l,l
'"l=1.8
- lli, 1.25 1.4 1.6
_. =
=
6" w
N' %s'4 8;:#e%
%s$,/><hje),
4:chN e ~
w
,; w o
my go
/,f
<lL *
\\
.s.
. TABLE 6 AUXILIARY FEE 0 WATER SYSTEMS No. of Plants No. of Pumos Auto / Manual 17 3
17 Auto 7
2 5 Auto, 2 Manual 1
1 1 Manual 27, cui l,1 L
. 1.
Low steam generator level (s) 2.
Safety injection 3.
Loss of power 4.
Loss of main feed pumps Because of the importance of the auxiliary feedwater system in mitigating consequences of transients and small L CA events, we were concerned that one auxiliary feedwater pump on Yankee Rowe migi.t be insufficient to provide reasonable assurance of its availability on demand.
Therefore, we investigated the Yankee Rowe design to determine if additional backup capability was available.
/
Each steam generator contains about 3000 gallons of feedwater at full power;
\\
therefore, about 12,000 gallons of feedwater are available for RCS energy removal.
Yankee-Rowe has calculated that this quantity of water is sufficient to remove energy for about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (with scram delay of approximately 15 seconds, time to boil dry would be appr eximately 45 minutes.
If the emergency boiler feedwater pump (a steam driven, reciprocating, 80 gpm source of auxiliary feedwater) is not available, t.ien the charging pumps (3, motor-driven, powered from the diesel generators) are available for steam generator makeup via two paths:
(1) a normally removed spoolpiece, and (2) via locked closed valves into the blowdown lines.
Since the charging pumps are not needed for safety injection (the Yankee Rowe SIS uses three LPSIPs and three HPSIPs), their use for auxiliary feedwater in no way affects SIS performance.
(The three coolant charging pumps can deliver about 100 gpm into the SGs via the spoolpiece flowpath, and about 100 gpm via the bottom bicwdown flo path).
271 002
~
. The licensee's SIS can also be used to deliver water to the steam generators via the bottom blowdown line. However, this source would not be available during LOCA events since the SIS is utilized for ECC.
Since thr TMI-2 event, the licensee has permanently installed the spool piece so that the charging pumps can supply water to the feed header after cpening two va?ves in the injection path. This mode of feed would be the plants first backur if the emergency boiler feedwater pump failed.
Geraral Conclusions 1.
Westinghouse plants have a relatively long time to steam generator dryout assuming loss of all feedwater.
2.
Most Westinghouse plants appear to have redundant and automatic auxiliary feedwater system capability.
3.
The reliability and performance af Westinghouse plant auxiliary feedwater systems need to be evaluated in greater detail due to their important role in decay heat removal and reactor safety.
This evalt.ation should as a minimum consist of the following:
a.
Consider upgrade of manual AFW systems to automatic.
'} $l 00>
b.
Review designs for potential common mode failures and eliminate them (ptmp su-tion strainers, loss of air, power, etc.).
~
c.
Verify AW capacity assumed in the accident analysis and LOCA calcula-tions is conservative with respect to the AFV system capability.
d.
Review control room indications to insure that adequate auxiliary feedflow indication is provided for the operator (not only pump discharge pressure and pump speed).
e.
Review emergency procedures for switching between AFW pump suction sources.
f.
Review procedures addressing automatic initiation of AFW and verifica-tion of proper operation.
g.
Review design for annunciations in the control room for all automat.,
start signals for AFW.
4.
Yankee Rowe backup capability to supply feedwater should be carefully reviewed te '9termine if this supply of water has the necessary capa-bility and the length of time required before this flow can be diverted to the steam generator.
2f}
O)r
. Westinghouse Advanced Reactors Division prepared a report for DOE on " Common Cause Failure Experience in PWR Auxiliary Feedwater Systems for Large Breeder Reliability Analysis," WARD-SR-3045-5 dated August 1978.
Unfortunately, we did not have time to review the report, however, we believe th'e conclusions (reproduced here) of the study provide some additional guidance into the types of common moce failures that may result in failure of auxiliary feedwater system.
The study covered failure experience in all PWR auxiliary feedwater systems during calendar years 1974, 1975, and 1976.
CONCLUSIONS AND RECOMMENDATIONS IN WARD-SR-3045-5 A list of conclusions is presented below about AFWS failure experience in I
PWRs.
Recommendations are made for application to large breeder plants.
1.
Failures in the AFWS account for about 3% of all PWR failures.
The number of AFWS failures per plant dropped f om 1.26 in 1974 to 1.00 in 1976, an encouraging sign.
About one out of six of the AFWS failures reviewed could be considered a CCF.
System f.slures dominated the CCF:,
while hardware failures dominated non-CFs. Also, design inadequacies and operations / maintenance errors were the main cause of both CCFs and non-CCFs.
A strong system integration effort in the design stage of large breeders is reco.nended to help avoid CCFs.
nI r
f I,
() -) J
. 2.
Common mode failures were defined to be a special sub-class of CCF; they accounted for most of the CCFs reviewed.
3.
A number of CCFs were related to failure to assure the required supply of condensate water to the AFWS pumps according to technical specifications.
Increased design attention to this part of the AFWS is recommended.
4.
A special effort should be made in design to properly label all temporary equipment as such on all flow diagrams, drawings, etc., especially with regard to the suction strainers in the AFWS.
Details of the plan for removal of temporary equipment should be written into the startup and operating procedures by design.
5.
Thirteen out of 17 CCFs occurred in the first 2 years of e ation.
Extra attention to systems testing before startup and during the first 2 yea. s of operation is recommended to avoid CCFs.
6.
In large reactor plants p;anning more than one reactor unit at the same site, accommodations could be made to permit interconnection of AFWS systems of different units as additional safety capability. A design / safety study is recommended to determine whether to design large breeder plants to accommodate interconnection of AFWS betaeen reactor units at the same site.
n r,
[
bU
. 7.
A number of failures were observed to occur during or shortly after earlier mali anctions of the equipment had, supposedly, been fixed.
Earlier replacement of troublesome equipment would help to reduce the number of failures.
8.
Valves, switches, ana relays dominated the equipment failures.
Special design and quality assurance attention should be consicered for switchs s and relays during equipment specification and manufacturing.
9.
The combination of one steam turbine-driven AFWS pump and redundant motor-driven pumps provides good prctection against accidents in large fast breeder plants.
Such adundancy and diversity already exists in most FWRs by using normally open/ fail open valves, by designing one subsystem to be independent of AC power, and by arranging pumps so that each steam generator is fed by at least two pumps.
It is recommended that similar redundancy and diversity (and flexibility) be provided in the valves and piping of the AFWS for breeder reactors.
For example, consideration should be given to providing redundant (and diverse) valves downstream from the turbine-driven pump.
Flexibility should be provided where practical to permit each pump to supply any of the steam generators, possibly via the use of header lines.
Care must be taken to avoid introduc-ing new CCF mechanisms with this approach.
Maximum flexibility and diversity of access should be emphasized for feedwater supply to the AFWS pumps.
7 pn' 9 / )6 dO' L
. 10. While periodic testing appeared to be effective in detecting non-CCF's, it was less effective for discovering CCF's.
This may be because the tests are not designed to test large systems but individual subsystems or components.
It is recommended t>.at LWR experience be reviewed with tne AFWS testing program during and after startup. The objective is to determine which test are effective in revealing failures, whether the AFWS can be impacted by the testing of other systems, desired frequency of testing, how much testing is worthwhile, and the overall relationship between periodic testing and CCF in the AFWS.
11.
A definition should be prepared and documented for each keyword in the ORNL-NSIC data bank.
It is recommended the definitions be developed by i
parsonnel who enter the data into the data bank.
This would help to maintain consistency of entries by different personnel over long periods of time, and to clarify what is filed under each keyword.
One area where it would be especially helpful is in failure-related entries, especially
" common mode failure."
12.
Review of LWR operating data and reportable occurrences appears to be an excellent way to factor CCF experience and failure experience in general into the design / build / operate process for large breeder reactors.
It is recommended this effort be extended to include more data for the AFWS and to include other plant systems.
!s rs rd U
<~ -' 4
// !
U
. High Pressure Injection (HPI)
High Pressure Injection (HPI) is required to mitigate consequences of small LOCA. Westinghouse reactors are quite similar, with several exceptions, regarding those signals which initiate the high pressure injection system.
The breakdown of initiation signals for these plants is as follows:
Signal No. of Plants (25 total)
High containment pressure 24 Lcw pressurizer pressure r ! incident with low pressurizer level 23 Low pressurizer or RCS pressure 2
(
High steam generator differential pressu.3 22 High steam flow coinci tent with low-low T
r low steam generator pressure 14 AV Low steam generator (or steam line) pr essure 8
We note in our review that one reactor does not nave a high containment pressure safety injection signal, and that three reactors do not have safety injection signals generated on any steam system parameter.
Recommendations 1.
We have not yet determined the frequency of challenges to the HPI system for Westinghouse reactors, however, we believe that this should be done to evaluate the need for ECCS to mitigate anticipated transients.
oli nnO
/. / !
Uue
.s.
. 2.
Further investigation is needed regarding the need for additional safety injection signals (high containment pressure and low steam pressure) for several of the older operating reactors.
3.
Confirm that all W designed plants initiate HPI on low pressure as required by Bulletin OGA.
Reactor Coolant Pre sure Control During natural circulation and other unanticipaed events (e.g., THI-2),
pressure control can be used to mitigate or improve system response.
The reactor coolant system pressure is controlled by the heaters located in the lower portion of the pressurizer and the spray into the upper steam space.
Steam relief for large transients is provided by the power operated relief valve (s) and pressurizer safety valves.
Several banks of the heaters are proportionally controlled to correct small pressure variations.
They will maiatain the pressurizer at the saturation temperature for the normal system operating pressure of 2250 psia.
These variations will be due to normal heat losses to ambient and heat losses due to the continucus pressurizer spray flow.
The remaining heaters (backup heaters) are turned on when the pressurizer pressure controller signal deniands approximately 100 percent prcportional heater pcwer.
cs D
. The spray nozzle is located on the top of the pressurizer.
Spray is initiated when the pressure controller spray demand signal is above a given setpoint.
The spray rate increases proportionally with increasing spray demand signal until it reaches a maximum value.
The pressurizer heaters and spray also control pressure for system transients.
Power operated relief valves limit system pressure for large positive pressure transients and are sized to prevent actuation of the high pressure reactor trip for large load rejections (within plant design capability) and also prevent opening of the pressurizer safety valves.
j Table 7 shows the basic elements of pressure control on a typical Westinghouse reactor.
A loss of offsite pcwer would probably result in loss of power to the pressurizer heaters. 'lestinghouse has stated that they recommend to their customers that heaters have a power-hookup capability to a vital bus within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
This is based on the system's capability to maintain pressure assuming an upper bound heat loss to ambient from the pressurizer of 200 kW.
This should be confirmed by additional analysis / testing.
',) ] h
4 8
i= j e m-p.
t, 3:
s u'..
fG B
d,.
=>
m g
~
-5 s
m
+
I b
Y g
g r
s 3
+
9 M
3 kh ~
N e
e-
+
I C
1 O
o.
e e
8 i
n tre h
43 Q
O F'*
N4
+3 N
t.)
~
MU
+
O CO N
LA*
N w ff
==
O D
m' m
N Mum.
l N
c, e_
e E.
/
i t
1 M
Eb N
O E
g.
ga N
O NW c;-
N e
o th N
W
>--c--N 9
~
e A
[
e
,e e==
N w
J N-e Os 4
3 l
~-
j i
A c-i o
e-*
r%
>4 m
s U
w O CL.
t
.?d L Lv
=
[
_ ~
,3,3 g
o o
-s..
C sp.e N
b CL (% LW La.
y*
,
- A
(
,g
, g,e,
f g
e e
O e
f' g.
~e i),,_
d/I
=ee--
e.-
e m==
=w e.-
e e
e+
4
. NATURI.!. CIRCULATION IN W PLANTS Tests Under norr21 subcooled ccad:?. ions in the primary system, natural circulation is maintained in the Westinghouse designed plants because of the density gradient between the core side leg and the steam generator primary leg.
Generally, in W designs the bottom of the steam generator tube sheet is approximately 18 feet above the top of the active fuel and this provides a driving forte for maintaining natural circulation.
Three tests have been conducted on Westinghouse PWRs demonstrating the system performance during natural circulation:
Point Beach (2 loop, 1518 KWth),
Zion Unit 1 (3 loop, 3250 K4th), and Connecticut Yankee (4 loop, 1825 Kdth).
Each conducted natural circulation tests to verify proper system performance.
The results from the tests generally show that the initial core ATs increased for about 15 minutes, then decreased to a steady state value for the remainder of the test. Figure 1 was presented to the staff during the April 26, 1979 meeting.
This curve shows the results of natural circulation tests.
(It could not be confirmed if this data is from the tests described below.)
Point Beach The natural circulation test was accomplished by securing both reactor coolant pumps and allcwing the density difference between the cold coolant in the cold
D e
~a l
{
l I
i I
f' i
f S
T 3!
I S
y NE
.OT s
I TD e
AN j
.LA U
CS f
~
RN 1
5 IO CI I
. t...
T LA t
AL h,
p n
y e
I t
f l
i
?
f, g.
1
/-
h}
h g.
t n n n k
8
. 7**.
o o o i i i h
t t t a a a
' h',,
/.-
l l l u u u t t l
c c c s s a l l l
x e e c a a a T T i C C C j
5 t
/.'
1 p p e p p p o o r o o o
/',
I o o o o o o
' L L e L L L p
h f
4 3 2 4 3
~
T.
f' N
k d.
- OC i
I, f,
..G h
l
.'*. /
!{
8
[
k.
~ ~.:
- U,
~
mI
[
\\.
[
}
6 5
4 3
2
[
I
' h reEo=,,a " xod I,
r i
N s' -
g l
h.
i b.
\\
I t
- ~
. leg and reactor vessel downcomer and the hot coolant at the top of the core and the hot leg tn become the driving force in removing heat from the core.
There were three ways in which natural circulation was verified:
circulation indicated on the flow instrumentation; a temperature difference indicated by the hot leg and cold leg RTDs; or when the incore thermocouples stabilize at a temperature.
The pumps were secured at essentially zero power.
The reactor thermal output was increased by control rod withdrawal.
The amount of heat removed from the steam generators was determined by measuring the "boildown" rate.
Feed-water flow to both steam ger.erators was secured when they indicated a elatively high level. Steam sas being dumped through the atmospheric dump valves in pressure control.
(
The thermocouples were the best indication of natural circulation. When the power increases were stopped, the thermocouple readings would increase to a new value and stabilize. At approximately 6% power, the average thermocouple temperature was 600 F.
The table below summarizes the test results.
Loop A Loop B Core Power
+T
% Flow AT
% Flow 34.6 Kdt (s2.39) 13 F
- 13. Es 17 F S.8%
63.2 MWt (s4.2%)
19 F 15.3%
22 F 9.5%
c,. -
i s
. Connecticut Yankee The test was conducted by tripping all RC?s from a hot standby condition (reactor shutdown).
The reactor had just been shutdown (s1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> earlier) following a month of operation at about 70% power. The steam generators were initially filled to a relatively high level and when the test was initiated, the SC level was allowed to drop due to boiloff from energy removal. When the level reached a predetermined minimum, feed flow was initiated and the steam generator level was rapidly restored to its initial value.
The resulting cooldown of the RCS (from the rapid addition of feedwater) gave a measure of loop transfer time by tracking the " cold slug".
Two methods of measuring natural circulation were used in the test:
the Icop transport time method utilizing the AT between the time the " cold slug" was felt at the T RTD and c
the T RTD.
The other method was an analytical method utilizing calculated g
decay heat, known piping loss coefficients and heat losses, and measurea ATs.
It was found that both methods gave reasonably consistent results.
1.
Loco Transport Time Method:
3.18% flow (each loop) 2.
Analytical Method:
3.29% flow (each loop)
Zion Unit 1 With the reactor critical and at a steady state condition of approximately 2%
reactor power, the reactor coolant pumps were tripped. When steady state q ~I j G, v, n>
L i
t
. conditions were reached, data was collected.
The SG 1evel was maintained by continuous feeding with the auxiliary feed system.
A'. ter data was. collected, reactor power was increased in 2% steps to 6% and data was collected following each step after steady state was achieved (approximately 10 minutes). Main condenser hotwell level and secondary storage tank level were monitored to aid in the determination of a steady state condition.
After all test data was ccMlected, the reactor was brought subcritical and the control rods were inserted to permit a cooldown rate of 50 F/hr.
Durir, the test, none of the temperature limitations stated in the purpose were exceeded.
By extrapolating the data, a reactor power of approximately 7% could be achieved by natural circulation before core exit thermocouple temperatures reached an unacceptable value (s620 F).
The measured RCS flow during the test was comparable to earlier predictions (F".n
- 3.28% flow at 1% power, 5.20% flow at 4.0% power).
LOOP Scenario and Data The W plants would be expected to enter a natural circulation conditicn following a loss of offsite power (LOOP) without operator action.
The reactor would automatically scram due to either the turbine trip or on the blackout signal.
In either case, the steam generator inventory is conserved and the reactor is shut down early thus avoiding significant RCS mismatches (heat input-heat output).
As the RCPs coast down, and feed flow drops, the RCS heats up to develop the aT necessary to support natural s irculation.
The pressurizer level initially drops (rapidly) due to the RCS cont.uction, then, p,
cjs u,.
. as the RCS heats up, the level rises.
The W analyses predicts this later insurge to result in a lift of the PORV(s), but experience has shown this not to occur.
(It is thought that the modeling of the pressurizer steam-to-wall heat transfer plays a significant role in the prediction of pressurizer pres-sure vs liquid level during an insurge and the models may conservatively assume a low heat transfer rate, thus increasing the predicted pressure.)
The steam generator secondary side level remains above the minimum level necessary to support heat transfer (and natural circulation) for greater than 30 minutes without any AFW. The steam generator pressure is controlled by either the atmospheric dump valves (which may, in some plants, be automatically actuated as part of the steam dump control system) or by the code safety
('
valves.
In either case, energy is removed from the secondary by steaming the steam generators. The rate of steaming is carefully controlled (if manually performed) to control the RCS temperature and pressure.
There have been a number of sustained LOOP events (and resulting natural cir-culation cooling) in W plants.
However, the staff has not received data from the Farley plants and this information is necessary for a balanced assessment oT the W predictions vs actual 15 Tant. per im mu%c.
n.
cx= futded that we
-~
request all relevant inf armation pertaining to actual LOOP events and resulting natural circulation on all W plants.
271 013
1
. Pressure Control Once natural circulation is achieved, the system pressure control is by two techniques (without pressurizer heaters).
1.
Controlling the system temperature by controlling the rate of energy removal from the SGS, or 2.
Controlling the liquid level in the pressurizer to account for the cooling off of the liquid, steam, and metal.
Eventually, if the pressurizer heaters are not restored, the pressurizer must be taken water-solid to control system pressure since the pressurizer itself cools off due to alibient heat losses. Westinghouse states that the heat losses to the ambient are small and Westinghouse recommends to their customers that pressurizer heaters should have backup capability from a vital pcwer supply within 3 h
'%t the olants be surveyed to assess their pressurizer backup power source capability.
Westinghouse Small Break Analyses The staf f has the following understanding concerning small break analysis results for Westinghouse reactors.
,,-.)
n,
//
U4 i' i
40-Westinghouse has submitted a generic topical report that contains small break sensitivity studies and analyses (Ref.1) for typical 2-Looo, 3-Loop, and 4-Loop plants.
These analyses considered various break locations and single fail-ures, and covered a range of break sizes from 2 inches in diamter to 1 ft,2 The consequences were shown to be in conformance with 'he criteria of 10 CFR 50.46, Paragraph b and to be less limiting than events analyzed in the large break spectra which are also included in this report.
The staff reviewed and approved this report as part of the Westinghouse ECCS Evaluation Model (Ref. 2).
In response to a staff request on a specific 4-loop plant application
[
(Ref. 3), Westinghouse 2xtended this break size spectrum analyses to include breaks down to and including the size at which makeup flow will match break discharge flow (3/8-inch to 7/16-inch diameter break size).
These analyses shcwed that as the break diameter decreases, the liquid inventory of the system increases and therefore adequate core cooling will be maintained.
For cold leg breaks up to 2 inches in diameter, no core uncovery was predicted, the consequences conformed to the requirements of 10 CFR 50.46, paragraph b, and results were less limiting than those analyses in the generic topical report (Ref.1).
The analysis of small breaks in Westinghouse designed plants is performed with the WFLASH Code (WCAP-8200, Revision 2) which was developed to assess ECCS response to primary coolant loss for breaks up to 0.5 ft2 (9.6 in DIA) in the r > r-f O>
. primary system.
The plant mathematical models contained in the code, and their use of loss-of-coolant accident (LOCA), have been reviewed by the staff and found acceptable in licensing applications (Ref. 2).
The code is capable of describing the primary system depressurizatior transient for LOCAs including the development of coolant two phase and phase separation when coolant conditions appropriate for such phenomena occurs in any rtion of the primary system.
System hydraulics are also modeled for consideration of the presence of two phase homogeneous and heterogeneous coolant conditions.
Primary system flow through coastdown and on into natural circulation is also accounted for when the primary coolant loop pumps are tripped.
Westinghouse has analyzed the potential effects of gas blanketing the steam generator tubes.
In past discussions with the staff related to the D. C. Cook Cocket, Westinghouse has stated that there is the equivalent of 12 cubic feet (at 1200 psi) of noncondensable gas dissolved in the primary system coolant.
Though it is highly unlikely that all this gas would come out of solution, all of the gas was distributed among the steam generator tuces. Calculations using the WFLASH computer code show that for the break sizes in question primary system circulation is maintained throughout the transient ar.d boiling occurs in the core.
An increase of about 1-1/2 percent in void fraction in the core would be sufficient to overccme the 3 inches of noncondensable gas in the steam generator tubes and maintain natural circulation. Westinghouse i
U /_.
. has stated that condensation heat transfer coefficients used in the LOCA arolysis include the influence of noncondensable gases.
In the small break analyses presented in the SARs, it is assu$ed the plant is initially in an equilibrium condition operating at 102% of licensed pcwer.
After the break occurs, it is assumed the SIS stops the normal feedwater flow and initiates emergency feedwater flow. When the reactor coolant system depressurizes to 600 psia, the accumulators begin to inject water into the reactor coolant system. The reactor coolant pumps are assumed to be tripped at the initialization of the accident and the effects of pump coastawn included in the analyses.
(
The results of the analyses presented in the SARs show that varying degrees of core uncovery by the reactor coolant mixture occurs for the spectrum of breaks analyzed. However, the peak cladding temperatures remain well below the 10 CFR 50.46 Part b criteria and little cladding damage occurs. The analyses are generally terminated at around 2000 seconds for the limiting break size.
By this time, a fairly stabilized core condition has been achieved. Methods of achieving cold shutdown are not addressed.
Westinghouse also analyzes the consequences of an accidental deprcssurization of the reactor coolant system due to an inadvertent opening of a pressurizer safety valve in the SARs.
This event is considered a transient and no core 271 022
. uncovery or fuel damage is predicted to occur, and thus satisfies the criterion of no fuel damage for transients. The reactor is assumed to be operating at a combination of power, temperature, and pressure that results in the minimum initial margin tc DNB.
Reactor trip occurs on overtemperature AT or low pressurizer pressure. The analysis in the SAR are generally terminated in less than 100 seconds by which time the event has turned around.
Methods of achieving cold shutdown are not included in the analyses.
Based on the anal: as presented in Westinghouse Topical Reports that have generic applicability and information provided in the SARs, the staff's present understanding of the small t,reaks in Westinghouse plants has been as follcws:
\\
1.
Conformance with the requirements of 10 CFR 50.46(b) although core uncovery occurs for all breaks larger than approximately 2 inches in diameter.
2.
Small breaks are less limiting than large breaks.
3.
Breaks smaller than 2 inches do not result in core uncovery and are less limiting than those identified in the generic topical using Appendix X assumptions.
4.
For breaks less than 2 inches, reduction in core inventory varies inversely with break size.
271 023
. 5.
Inadvertent opening of a pressurizer safety valve is an analyzed transient and result; in no core uncovery or fuel failure (minimum DNBR not reached).
REFERENCES 1.
WCAP 8340, Westinghouse Emergency Core Cooling System-Plant Sensitivity Studies.
2.
Letter, Vassallo (NRC) to Eiche1dinger (W), dated May 30, 1975, Approving Westinghouse ECCS Evaluation Model.
3.
D. C. Cook Unit 2 (Docket No. 50-316), FSAR Amendment No. 78, Appendix Question 212.34, Octobe-1977.
The Role of Noncondensable Gases in the RCS After LOCA There are a number of sources of noncondensable gas that should be considered in evaluating the effects of noncondensable gas on post-LOCA behavior of a PWR. The magnitude of these sources and the amount that could be released is dependent to some extent on specific plant parameters, but to a much greater extent on the size of the postulated break.
Table 8 summarizes the magnitudes of postulated sources of noncondensable gases that might be released into the RCS of a 3000 ffd PWR having an RCS g
271 024
. 3 volume of 10,000 ft, prepressurized fuel rods and ECCS acce'aulators.* The values in Table 8 are approximate, and are presented primarily to indicate the relative magnitudes of the various sources.
It should be noted that the noncondensable gas sources given in Table 8 do not rc resent the amounts that would remain in the reactor coolant system since significant amounts would be discharged to containment through the break.
As evident from Table 8, there are some :curces such as the zirconium - H O 2
reaction and free nitrogen in ECCS accumulators which could be dominant.
However, for a small break which does not result in (a) core uncovery with resulting zirconium - H O reaction and fuel rod rupture, and (b) in RCS pres-2 sures below the N perating pressures in the ECCS accumulators, the total 2
potential source of noncondensables would be relatively small.
For this case, the potential sources of noncondensables for the 3000 Rdg ' R of Table 8 would 3
be about 400 ft of H at STP due to hydrogen dissolved in the RCS to suppress 2
radiolysis during normal operations, the small source due to air dissolved in the ECCS water infected into the RCS and a fraction of the values indicated for H nd 02 produced by radiolysis of injected ECCS water.
For large breaks 2
resulting in eventual RCS pressures well below the cperating pressures of the accumulators, core-wide metal-water reactions of up to say
- The possible effects of N 2 introduced by failures of the UHI system of W plants has not been included since there are no operating reactors with a UHI system at this time.
271 025
... 0.3% such as predicted in ECCS performance calculations and attendant fuel rod ruptures, there w3uld be very large increases in the poter tial amount of noncondensable gases released in the RCS.
As noted in the provisions systems considerations discussion, for small breaks where the heat removed by the break flow and ECCS injection is small, the. eat rejected to the steam generator following the LOCA can be a large part of the decay heat produced in the reactor core.
Under these circumstances, the amount of noncondensable gases released to the RCS is of concern with respect to stoppage of naturai circulation in the RCS and reduction in steam condensa-tion heat transfer coefficients in the steam generators.
Both etfects could lead to reduction in the heat tranfer from the RCS to the steatr generators and, hence, influence the response to the postulated LOCA.
On the other hand.
for large breaks, the break flow plus ECCS injection removes nearly all of 'he decay heat and the steam generators act more as a heat source than a heat sink following the postulated LOCA.
In this case, reduction in heat transfer between the steam generator and the RCS by the presence of noncondensable gases is not of priacipal concern.
For these large breaks where relatively large amounts of noncondensable gases could be released as indicated by Table 8, the riincipal concern is to supply sufficient ECCS cooling water to sustain adequate core cooling.
During scme time periods after the postulated occurrence of a n.all break, the primary coolant sides of the steam generators are partially or completely drained, the RCS pumps have stopped, and natural circulation flow has stopped.
During these periods, the heet transfer from the RCS to the steam generator 2/1 026
. secondary side occurs through steam condensation.
The break flow and safety injection for these small breaks cannot remove much decay heat.
Herce, the heat transfer in the steam generators is the dominant mechanism for decay heat removal. Some noncondensable gas would come out of solution Ehile the steam generators are partially drained ar.J collect in the upper portions of the steam generator U-tubes (see Figure 2a).
After the steam generators drain completely, the steam moving to the steam generators to be condensed would transport noncondensable gases from other parts of the system to the steam generators (see Figure 2 b).
Since the noncondensable gases are not removed at the condensing surface, this mechanism would lead to some additiunal accumulation of noncondensat s in the steam generators.
s For small breaks, the potential source of noncondensab!e gases is re;atively small.
If it is assumed that the total amount of hydrogen dissolved in.olu-tion collects in one steam generator, the average mass fraction of hydrogen in the hydrogen-steam mixture in the steam generator would be much less than 0.1%
for a steam generator primary side pressure of 1250 psia. On the basis of experiments giving the effects of noncondensable gaacs on steam condensation on the outside of cylindrical tubes or flat plates, this mass fraction would have a small effect on the heat transfer coefficient.
However, no experimental data giving the effect of noncondensable gases on steam condensation were found for the geometries and conditions predicted to occur on the primary side of U-tube type steam generators for small breaks.
It is also noted that if 271 027
' significant metal-water reaction occurs, much larger quantities cf hydrogen would be available to cause redpctions in the condensing heat transfer coefficient.
Hence, it ic recommended that experiments bc conducted to obtain information pertinent to the effect of noncondensable gases on steam condensa:. ion for U-i.ite geometries and conditions pertinent to small break LOCAs.
(
271 028
... TABLE 8 POTENTIAL SOURCES OF NONCONDENSABLE GAS IN RCS OF 3000 MW PWR t
GAS SOURCE VOLUME OF GAS AT STP*
COMMENT H
H dissolved in RCS ano 1000 ft3 Based on 50 cc of H at STP 2
2 2
pressurizer to suppress dissolved.
1000 gms H O 2
radiolysis during normal operation H
Hydrogen produced by 1 x 103 Volume based on reaction of 2
Zirconium - H O reaction 0.3% of all Zircaloy in core.
2 He Helium initially in 1.1 x 103 Volume based on precharging of prepressurized fuel rods fuel rods at 70 F with Helium at 450 psia and assumption that claddings of all rods rupture.
i
- sion Fission gas in fuel rocs 0.6 x 10" ft3 Based on fission gas in Gas all fuel rods in core at end of equilibrium cycle and assumption that claddings of all fuel-rods rupture.
N N dissolvea in H O in 2 x 10" ft3 Based on normal operating 2
2 2
ECCS accumulators pressure of 600 psia and total water volume in 3
accumulator at 4000 ft.
N N in free gas volume in 56 x 103 ft3 Based on normal N 2
2 2
accumulators pressure of 600 psia and total free N volume of 2
3 4000 ft.
Air Air dissolved in 8WST 0.5 ft / min.
Based on H O at 100 F d
2 saturated with air at atmos. pressure.
H plus Raciolysis of injected 20 ft3/ min.
Based on I molecule H 2
2 (shortly af ter shutdown) 271 029
9
. TABLE O (Continued)
GAS SOURCE VOL!aME OF GAS AT STP*
COMMENT 2
2 4 ft / min. (1 day per 200*V gamma radiation 3
0 ECCS H O after shutdown) and 1 molecule 02 ker 400*# gamma radiation, 10% of the gamma radia-tion absorved bj ECCS solution.
(see R.G. 1.7)
- T = 32 F, P = 14.7 psia 6
-si-gw-r.,..
.i.
j.
.l.
=c :
.+
3
=
.s j
J q@..g,.1,',.f',.}-
. ?.:;
-}
. > ce.?
c M.;
, b
.E.
- 9 @
- .',7.5 i N
f
'I
,;; ;{. ')
,$ k
\\hl i-i.
.s %.
.: yo;..
\\
',)
/
l l~,,
p.~.i @T2.,
\\, 'h
)s,(lp/
l
. 14 - r N)
.r
'ryj F '
j
..,.c.x'c
'.i.Nh.,.
63 rf 1
" c. M q
,j/
/
3 4
g c. :
g e
/
0 i j
- p -q=. -
p-g su-f
\\
T,.,
- s. h Ls:. r. -~.
\\)\\
N
- j / '-
/
h
.i G.
,7.. ?.,7 iP
~,\\ l '. hLj
-.L. - -
C'C,-
o
/ )
j 6
n>
C o
y o,
s
~
~
\\
K 1
e
- f
.~* *'.
},f (/ /
'. ~ ~ ~
--- f.
'/.
' \\ CL I
v
.- </( // y S
/c
~
J
..s.:..
- I CL
~-
j
- c. w! ~
^- - :.
. (-
.t
~., $ ','.,
._.M-..
-4
....,.... o.: ; -.,..
- ..e.
- 1 c,-.:.
r
.,_..-S.....y._,...+-
. : :;..+.;.- s :. ; - :.~.s'm-a -a::- :...w =v
. e.e:e e.'
.=o,,
g..
1... ?
w.:..i~'
- a Ea~~.: s ' *- i - ; - ? - * Y H 1 -
a)
Steam & Noncondensable Gas b)
Steam Generator Primary Side Drained, Bubble in Primary Side of Steam Steam Condensable Gas and Condensate Generator Causing Stoppage of on Primary Side.
Natural Circulation Flcw.
Figure 2 -
Generators During Small Brea( Events.
Steam and Noncondensable Gas in Primary Side of U-Tube Steam 271 Os,
. FINDINGS AND RECCMMENDATIONS Findings and recommendations are presented for subsequent action by the reactor vendors, licensees, and the NRC based upon the results of the' review performed by the Task Group.
Plant Design Plant Comoarisons Finding A preliminary comparison of W plant designs against B&W plant designs shows that:
1.
W system response is slower because of higher steam generator inventory (i.e., W designs are more tolerant of events which result in loss of feedwater).
Steam generator dryout time is considerably longer.
2.
W designs have earlier scram signal generation based on steam generator conditions.
3.
PORV could open later and for fewer transients.
4.
If aux feed injection were delayed significantly beyond 8 minutes (TMI-2 scenario) and similar actions as TMI-2 were to occur, 'd designed 271 032
. plants would also experience significant core damage.
This scenario (except operator actions) is judged to have much lower likelihood in W plants as compared to B&W plants.
Recommendations Evaluate various transient sequences with the potential for depressurization and flashing in the primary system. Methods for improving the likelihood of success in dealing with such transients should be investigated.
These should include:
1.
Imprcving the interpretation of existing instrumentation and the procedures used by the operators.
This is underway following the bulle'.i,s.
Bulletin responses should e review 3d to determine the instructions on long term operator actions take into consideration the TMI-2 type scenarios.
2.
Developing improved instrumentation to sense and infer flashing in the primary system so that a more reliable indication of water level on the reactor vessel would be provided to the ope ator.
3.
Developing improved operator training and procedures emphasizing the basic importance of primary system inventnry and subcooling, and interpreta-tion of diverse instrument readings. More extensive use of simulators is strongly recommended.
fl
() f '3
. 4.
Improving automatic actions of protection system, engineered safety features, and other safety-related equipment to decrease the dependence on operator actions during the early part of the transient.
Steam Generator and feedwater Systems Finding The W steam generators have much larger water inventories than those associated with B&W plants. As a result, the W steam generator blows down (on loss of feedwater) much more slowly; e.g., about 25 minutes or longer as compared to approximately 1-2 minutes.
This leads to a slower increase in primary pressure on loss of main feedwater in W plants.
The auxiliary feedwater system would further limit the overpressure excursion by retaining heat rejection to the steam generators and prevent PCRV opening for most trans!ents.
Auxiliary (Emergency) Feedwater Systems Investigate means to make the auxiliary feedwater system mcre reliable on plants which may not have adequate redundancy and diversity.
271 034
. Plant Control Systems Find The plant control systems play an essential part in plar.'. operations and the prevention of transient situations that intreduce chaisenges to the plant safety system. The design requirements and critccia for plant control feature are not well defined with regard to NRC regulations.
On Westinghouse designs, control and protection action in some cases may not be completely caarate although we have not reviewed the design details of these plants.
Recommendation
(
l.
Conduct an evaluation of plant control systems to define those.ystems where failure may impact safety.
For completeness, the effort would require the functional description of control systems currently used for all phases of plant operation. The functional description would have to define the variable (s) controlled, the type of control, the scope of operation, the characteristics of the control, and the design bases for the controls.
Most of this information is not currently supplied in I.
SARs.
The information should also be supplemented with an FMEA for the
[
control systems as a means of assessing these systes which impact safety.
1 2.
Conduct an evaluation of plant monitoring systems to define those systens where failure to faulty display of information to the operator may impact plant safety.
The evaluation would also assess the adequacy of current 271 035
plant monitoring systems to reflect the safety status of the core (e.g.,
boiling in the core) and the operational status of systems which impact safe operation of the plant.
This effore would require the definition and description of all monitored variables, monitoring systems (including the plant process computer), and the use of these systems by the operator to control the plant. A definition of the des:gn bases for these systems would also be required.
As a result of the TMI-2 accident, the evaluation of monitoring systems would focus extra attentin.: upon specific monitoring systems, such as the
[
pressurizer level indication.
The pressurizer level irdicator has been used as an indicator of the adequacy of water in the reactor vessel. A more direct and more easily interpreted indication of water inventory i-the primary system would make operation inference and actions more reliable.
The need for additional automation in the monitorir._ and display of plant variables and the operational status of systems important to safety would also be assessed.
For example, the status of valves, such as the powered operated relief valves could be displayed to the operator.
3.
Define and establish design criteria for thosa equipments and systems which are inportant to the plant operation but which are not required to be Class 1E.
271 036
4
' Power Operated Relief Valve Finding AllWplantshavepower-operatedreliefvalvesmanufacturedby The number of PORVs on each plant range from one to three.
The valves play an important function in providing primary system relief to avoid unnecessary reactor trips from ioad rejection events or opening of the code safety valves.
In the past, they have been considered part of the control system.
Recently, they have been undergoing a transition to a safety system category in relation to overpressure control during shutdown and startup.
k' As related to the TMI-2 accident, the failure to close a PORV turned a loss of feedwater event into a small i.CCA.
This was not immediately apparent to the operators because of a lack of direct indication and because the operator possibly thought he had a steam generator tube failure event on his hands.
Recommendation A more direct and positive indication of valve position is needed.
the longer term, consideration to upgrade valve and the associated control and power equipment to safety grade and greater valve reliability should be the goal.
271 037
...act a more thorough survey of PORV opening data by review of plant records.
Means should be given careful consideration to reduce the number of times the PORV would be required to operata during the life of a plant. Consideration should be given to:
1.
minimizing PORV opening due to load rejection events; 2.
automatic closure of PORV block valve on pressures lower than PCRV reset.
In addition, means should be evaluated to placing automatic features on the valve system to autcmatically close the block valve in the event that the PORV
(
did not reseat after the reseat setpoint is reached.
Pressurizer Level Indication Finding The study has shown that the level instrumentation provides a reasonably accurate indication of the water inventory in the pressurizer.
The important point developed, hs,ever, is that the inventory in the pressurizer has no relationship to the inventory in the primary system when plant operating conditions are conducive to voiding in the primary system (e.g., during small breaks).
Procedures, Technical Specifications, and operator training have not reiated level indication to its real perspective.
271 038
. Recommendation it is believed that recent I&E bulletins will provide for the proper precondi-tions concerning pressurizer level readings as indicative of primary system inventory under degraded conditions and direct operators to consider other appropriate parameters in detarmining their corrective actions.
The need is identified for consideration of better and more appropriate instru-mentation to appraise the operator of true plant conditions.
Direct indication of subcooling and void indicators have been suggested for consideration in the long term.
Plant Resoonse to Feedwater Tyce Events Findings On the basis of our preliminary survey, we find that a power operated relief valve (PORV) has not stuck open on W plants in this country.
There have been about 50 occasions in which the pressurizer relief valves have actuated.
PORV is believed to have stuck open for a short time on a W designed plant in a foreign country.
Thus, conservatively, the probability of PORV sticking open
-2 may be approximately 2 x 10 per demand.
\\s-271 039
. Recommendation Given a transient in a PWR, the guiding objective for the operation must be to retain primary system inventory and subcooling. Automatic systems must be designed to accomplish this function without taking the plant into other limiting conditions (e.g., overpressure).
The operator should primarily see that mitigating systems are operating and appropriate isolation has been accomplished.
It is imperative that immediate attention be given to scram and auxiliary feedwater functio;1.
Design Aids to Imorove Ooerator Resconse Finding k
A review of the TMI-2 accident reveals that several incorrect and inappropriate operator actions were taken, and that at least as many opportunities for worth-while operator action were missed.
Recommendation There will always be a residuum of possible but not postulated and analyzed situations.
To address this, and as an attempt to extend the defense-in-depth concept, we should study ways to make the operator a more effective recovery agent or incident / accident mitigator.
Such a study should look for ways to (1) prevent (inhibit) inappropriate actions, and (2) prcmote productive interven-tion.
An element of the study that could serve both purposes would be an 271 040
. investigation of ways to furnish the cperator with correct, current, and digestible information regarding principal plant conditions (processes, systems, equipment).
The means whereby the operator would best employ this information should also b4 considered.
Ooerations Training Finding Oparator training programs have evolved over the last 10 to 15 years from a concerntrated on-the-hob training with little time allotted to formal training, to the present structured, formal, NRC approved programs.
We believe that si-tors have had a significant affect on the quality of operator training
..ce it permits the operator to experience abnormal and emergency transient events.
The NRC Operator Licensing Branch (0LB) has conducted examinations utilizing simulators for about 4-5 years and finds that this examination is much more demanding on the applicant (and examiner) than a normal " walk-thru" dialogue. Consequently, a better evaluation of an individual's cc.Tpetency can be made using a simulator.
However, training programs have under emphasized non-standard passive conditions (misaligned systems), cossible failure of engineered safeguard equipment when called upon and multiple failures.
271 041
. Recommendations Simulator training programs should be reviewed as to scope and content to assure that they address those operator errors that contributed to the THI-2 accident.
Simulator models should be modified to include multiple failures and ECCS malfunctions.
Means should be developed to better evaluate a senior applicant's ability to direct activities during abnormal or emergency operations.
(
Training on protecting the core should be emphasized on all plants.
This includes means to recognize that an adequata heat sink, primary system inventory, and an intact primary and secondary system exist.
Refresher training on emergency procedures should be increased.
Requalification programs should require simulator training.
Emphasis in requalification programs must be placed on evaluating operator and senior operator response during abnormal and emergency conditions.
All simulator training programs should include drills on:
1.
Natural circulation to as low a temperature as possible.
2.
ECCS actuation respense failures with progra.rced malfunctions.
271 042
. Operating Procedures Findings Operating and emergency procedures are developed in accordance with Regulatory Guide 1.33, Appendix A, Quality Assurance Program Requirements (Operation) and Sections 5.3.2 and 5.3.9 of ANSI 18/ANS 3.2, entitled " Administrative Controls and Quality Assurance for Operation of Nuclear Power Plants."
Normal operating procedures involve use of checklists and is a controlled evaluation with final conditions as goals to achieve.
Abnormal and emergency proccdures are completely different.
The operator now is working with automatic responses and may have to take manual actions.
Consideration when writing the k
procedures should be given to the real time that it takes for systems to respond.
The operator (s) must obtain this knowledge at a simulator or by reviewing plant recorder response. Additional "what if" conditions should be investigated.
Recommendations Emergency procedures shoulf ce written with real time as an aid for the operator to study and memorize. When real incidents occur, the operators must critique themselves and the procedure after stable conditions have been achieved.
This will give credence to the procedure and allow all operators to gain additional knowledge from the event.
~
271 043
. Procedures that address multiple failures should be written to accommodate events similar to TMI.
Examples are (a) comolete loss of power; (b) loss of vital instrumentation and power supplies; (c) reactivity anomalies; and (d) complete loss of feedwater.
Procedures must be readily available for the operator to use.
Alarm procedures may be hung on guard rails in front of the console so the operator can readily flip an index to the correct response.
Emergency procedures should be indexed for quick retrieval and use.
Human Factors Findings The operator has been trained to believe his instrumentation.
He will continue to perform this function until be may suspect an erroneous reading; however, he must be trained that the indication may be erroneous or misleading under certain conditions and not to rely on a single instrument.
If the operator has additional manual functions to perform, he may reduce his observations on other system parameters that may lead him to " tunnel vision."
This vas noticed in the TMI-2 accident when an operator kept looking at only high pressurizer level.
Human factors engineering has been disregarded in the design and layout of the control rooms.
The location of instruments and controls in many pcwer plints 271 044
. often increases the likelihood of operator error or, at the least, prevents him from efficiently carrying out the normal, abnormal, and emergency actions required o' him.
Recommendations The operator must understand his responsibility as auditor during abnormal and emergency conditions.
If he is alone and conditions require multiple manual controls, he must realize that he cannot effectively monitor the entire console by himself and he r ist be aware that he may develop "tunnei vision." When two operators are in the control room, one must observe proper plant response and the other must utilize procedures and perform the role of a " checker." The senior operator must direct the activities, not act as another operator.
We must utilize other automatic means of recording events during emergencies.
A voice tape recorder should be used to provide a record for the events.
Critiques should be made immediately after any major events.
This should include all recorder charts alarm printouts.
The individuals involved should prepare their report before leaving the station.
More emphasis on human factors engineering should be placed on the design and layout of control rocms.
Mimics, system identification and location of instru-ments should be analyzed to improve operator response during an abnormal or emergency operation.
271 045
. Licensing Basis and Regulations Analysis of Feedwater and Other Transients Finding The analysis of feedwater and other anticipated operational transients should be performed on a more far-ranging as well as realistic basis to include interactions of the control systems, consequcntial failures of equipment not designeo to cope with the event, single failures to safety features, and operator actions based upon available information on plant parameters and procedures.
The availability of the auxiliary feedwater system is presumed in the analysis, which does not consider possible failure modes that might preclude its availability.
In addition, the models should include the capability to predict voiding in the reactor coolant system under dynamic conditions.
The effects of both off and onsite power should be explicit in the analysis. The analyses should be extended to the time where stable reactor cooling is assured including the natural circulation cooling mode.
The event should be terminated without it resulting in an accident, i.e., a less frequent type of event.
Recommendation The W operating plants should be reanalyzed according to the above finding.
The sensitivity of essential equipment and systems should be evaluated.
271 046
... Small Break LOCA Analysis Finding Additional analyses of small breaks should be performed in.the very small 2
break range; i.e., < 0.05 ft. The evaluation should include considerations of input assumptions regarding such aspects as the auxiliary feedwater systen, off and onsite power, equipment operability under accident modes, operator actions based upon available information on plant parameters and procedures.
The calculational codes should include the capability to predict voiding in the reactor coolant system under dynamic conditions.
Calculations suggest voiding in the coolant system with a rising level in the pressurizer would occur for some small breaks.
The analyses should extend to the period that the plant is being cooled in a stable mode' including natural circulation where applicable, and should include other events like a main steam like break and steam generator tube rupture.
For some small breaks, the noncondensables would be generated and if the plant is cooled using material circulation, reflux boiling mode of heat transfer would have be depended on.
Recommendation The operating plants should be reanalyzed according to the above finding.
The effectiveness of reflux boiling mode of heat transfer should be verfied experi-mentally using facilities at INEL.
271 047
... Analysis Codes Finding The computer codes generally used for transient and small break LOCA analyses are complex and do not always include provisions for extending the calculations to cover the event duration through the time period until stable cooling is achieved.
In some cases, conservative bounding types of assumptions and models are used that may mask out real: tic system and equipment behavior.
Many of the vendor codes have not been reviewei in detail by the NRC.
R ecor.T.enda ti on W should review and modi'y as appropriate applicable computer codes to ensure that the results obtained are acceptable with regard to the above.
Further the codes, together with their experimental verification, should be submitted for review by the NRC.
It is expected that such efforts might take of the order c.f sevaral years to complete.
Audit Calculations by NRC Finding The NRC has only a limited independent calculational capability to perform audit calculations for transients and LOCA events.
Current LOCA capability is the ability to perform analyses on only portions of the event with reliance 271 048
... placed on hand calculations for the balance of the event.
The transient analysis capability is limited to PWRs with U-tube type steam generators.
, Recommendation NRC should develop independ nt capability to perform quick engineering type of calculations for transients and small-break LOCAs.
This effort should be coordinated with the research group on a short term basis. Audit calculations should be performed for selected transients and for the small break LOCA.
General Conclusion
(
As stated, the purpose of this report was to make an early assessment concerning those measures which might be necessary to prevent a recurrence of the TMI-2 event at 'd designed facilities. !!any actions have been taken since the TMI-2 event by the staff and industry to ensure that such recurrence would not take place.
It is also realized that there are ongoing activities to further improve the safety margins in these plants as this report is being published.
It is further realized that W designed plants are much less sensitive to loss of feedsater events than the B&W designed plants and the likelihood of similar events is lower at the W plants. Thus, this report is to be treated as a status report.
It is quite certain that other actions will be required as the overall review of the 1MI-2 accident progresses.
271 049
. There are, however, clear actions that should be taken now that are discussed as recommendations that deal with design, operation and licensing.
These actions have in part either been taken or are in the process of being taken while others are being treated with those actions indicated in the I&E Bulletins.
On the basis of the totality of the results of this interim review, the general conclusion can be made that there appears to be no major design feature of the W plant that is significant to be of great concern to the health and safety of the general public.
This does not preclude actions already being implemented due to the recent Bulletin actions as well as those that will be required later.
In addition, we find that improvements are required with regard to operator training and actions, equipment reliability on some plants, and the evaluation of transients and small break LOCAs. We believe implementation of the recommendations stated in this report would further increase the safety margins in the W plants.
Role of the Coerator We discussed with Westinghouse the role of the operator on a Westinghouse reactor in a post accident situation such as TMI-2 and specifically the cooling at the core using natural circulation.
Prior to THI 2, all Westinghouse procedures (recommendations to utilities) assumed that natural circulation was occurring.
No specific guidance is provided to the operator with respect to confirmation that natural circula-tion is underway.
The procedures do apparently tell the operator to maintain 271 050
. pressure. We have not seer these procedural guidelines ourselves but were given this int by Westinghouse at an April 24 meeting here in Bethesda. Westinghouse indicated that they had already started a program to review and revise their procedures.
These revisions should be seen in the utility bulletin responses - such as telling the operator to confirm a PORV shut status before throttling down on HPI flow. They confirmed that pressurizer level was clearly not the lone parameter which must be monitored by the operator for the stuck open PORV scenario on that it was not in indication of system inventory (would be reading quite high) and that they were taking action to insure that their guidelines did not rely on pressurizer level alone.
Since control room simulators have played an important role in operator training 1
in the past, we asked Westinghouse what tne capability of their simulator was for reproducing a TMI-2 type avent.
They indicated that the Zicn simulator does not have this capability but they are considering the need for any changes in the simulator programs.
Recommendations 1.
Procedures are important to the operator training and decisionmaking process following the course of a transient or accident. We have not reviewed specific procedures from Westinghouse reactors, but believe that this should be done. We note a comment from EPRI NP-309 which summarizes a study of plant procedures and operator interviews regarding procedures.
Those who felt that there had been too little a:phasis on procedures 271 051
... outnumbered those who felt that too much stress had been placed on proc 0-dures by roughly two to one.
Some specific comments from operators were:
'ho procedure does not spell out what valves or controls to use Some procedures are too brief and proceed on the wrong sequence We believe that NRC should play a more important role in review of pr:cedure content and their correlation with safety analysis assumptions.
Specifically, with regard to procedures on natural circulatio.1, we believe positiva guidance must be given to the operator to verify adeauate flow and what direction to take if adequate flow / cooling is not be achieved.
An action sequence diagram (provided by CE) such as that in Figure suggests the thought process for genaratir.g a natural circulation procedure.
Parameter values /'imits (core AT, pressure, etc.) must be provided to the operator in the form of a procedure, so he can go through this type of process. We recemr:,cid that Westinghouse and their customers provide these procedures within 1 month.
2.
We believe that simulator operation as a valuaale part of operator training.
Quoting again from EPRI NP-309, " Operators regard simulators as the best vehicle for obtaining operational training...it helps you to see casualty modes." We recommend that Westinghouse reactor utilities be required to participate in a stuck-cpen-PCFN-recognition and natural circulation 271 052
capability upgrade program on control room simulators.
This will apparently require progra:ning of at least the Zion simulator.
271 053
A 6.
- Figure _
I 271 054