ML19260A239
| ML19260A239 | |
| Person / Time | |
|---|---|
| Site: | Washington Public Power Supply System |
| Issue date: | 10/25/1979 |
| From: | Harold Denton Office of Nuclear Reactor Regulation |
| To: | Strand N WASHINGTON PUBLIC POWER SUPPLY SYSTEM |
| References | |
| NUDOCS 7911080290 | |
| Download: ML19260A239 (16) | |
Text
@
r
/
'o, UNITED STATES Ei,c<
j NUCLEAR REGULATORY COMMISSION E
W ASHING TON, D. C. 20555
- gs o'
)
%."....[
October 25, 1979 Docket No.: 50-460 and 50-513 Mr. N. O. Strand Managing Director Washington Public Power Supply System P. O. Box 968 3000 George Washington Way Richland, Washington 99352
Dear Mr. Strand:
SUBJECT:
10 CFR 50.54 REQUEST REGARDING THE DESIGN ADEQUACY OF BABC0CK
& WILC0X NUCLEAR STEAM SUPPLY SYSTEMS UTILIZING ONCE THROUGH STEAM GENERATORS (WPPSS 1 & 4)
Several hardwa9 and procedural changes have been made to operating B&W plants to reduce the likelihood of recurrence of a TMI-type accident. These changes have been in the area of auxiliary feedwater systems, integrated control system, reactor protection system, small-break loss-of-coolant accident analysis and operator training and procedures.
However, at this time, we are beginning to look more deeply into additional design features of B&W plants to consider if any further system modifications are necessary.
The use of once-through-steam-generators (OTSG) in B&W plants has an opera-tional advantage in that it provides a small degree of steam superheat, as contrasted with the conventional saturated U-tube steam generator.
In addition, it provides for less water inventory thus making a steam line break less severe. However, the relatively low water inventory with the presence of a liquid-vapor heat transfer interface in the active heat transfer zone closely couples the primary system to the steam generator conditions with a consequently high sensitivity to feedwater-flow rate perturbations. Enclcsure 1 to this letter addresses system problems and staff concerns in this area. At present, we are investigating whether B&W plants are overlysensitive to feedwater transients, due to the OTSG concept, as coupled with the pressurizer sizing, ICS design, and PORV/ reactor trip set points.
As part of the post TMI-2 effort, detailed analyses have been made of under-cooling transients for B&W plants. However, due to the sensitivity.of the OTSG design, B&W plants have also been experiencing a number of relatively severe overcooling events.
1296 163 7911 080
Mr. N. O. Strand For your infor ation, NRC is initiating a research task to quantitatively assess B&W system designs, including the integrated control system, aimed at identifying obvious accident sequences leading to core damage having a high frequency as compared to the Reactor Safety Study, see Enclosure 2.
( A complete determination of risk will not be attempted). The objective of this assessment is to identify high-risk accident sequences (including TMI implicatient) utilizing event tree and simplified fault tree analyses.
Included will be estimation of release categories, approximate quantifi-cation of expected frequency of selected event sequences and sensitivity studies for reliability of operator response. The study will focus on the risk implications of the sensitivity of the B&W design and on the potential interactions arising from the integrated control system. We estimate this study to be completed in about six months. We will use the Crystal River, Unit 3 plant as the referenced facility to be analyzed.
he have been holding generic discussions with Babcock and Wilcox Company concerning this matter. However, system sensitivity to feedwater transients involves balance-of-plant equipment and systems as well as the nuclear steam supply system, and such plant-specific characteristics must be considered.
We are also considering whether it is necessary to halt portions of the construction of B&W plants, pending the outcome of the reliability assess-ment. As a preliminary consideration, we have identified those systems and components that may be impacted by possible design changes as a result of thi s study. Enclosure 3 is a preliminary listing of such systems and components.
Under the authority of Section 182 of the Atomic Energy Act of 1954, as amended, and Section 50.54(f) of 10 CFR Part 50, additional information is requested to allow us to determine whether it is necessary to halt all or portions of the construction of your plant pending the results of our study. We request you provide:
a)
Identify the most severe overcooling events (considering both anti-cipated transients and accidents) which could occur at your facility.
These should be the events which causes the greatest inventory shrinkage. Under the guidelines that no operator action occurs before 10 minutes, and only safety systems can be used to mitigate the event, each licensee should show that the core remains adequately cooled.
b)
Identify whether action of the ECCS or RPS (or operator action) is necessary to protect the core following the most severe over-cooling transient identified. If these systems are required, you should show that its design criterion for the number of actuation cycles is adequate, considering arrival rates for excessive cooling transients.
1296 164
. c) Provide a schedule of completion of installation of the 4dentified systens and components.
d) Identify the feasibility of halting installation of these systems and components as compared to the feasibility of completing installation and then effecting significant changes in these systems and components.
e) Comment on the OTSG sensitivity to feedwater transients.
f) Provide recommendations on hardware and procedural changes related to the need for and methods for damping primary system sensitivity to perturbations in the OTSG.
Include details on any design adequacy studies you have done or have in prcgress.
We are sending similar letters to all utilities holding construction permits for plants with B&W nuclear steam supply systems.
We request your reply by December 3,1979. We believe that a meeting with you and the other utilities together with the staff and the Babcock cnd Wilcox Company to discuss this matter would be beneficial to all parties.
At that time, we will provide further details on the Crystal River Study.
We are scheduling such a meeting for November 6,1979 at 10:00 a.m. in Room P-422 at our offices in Bethesda, 7920 Norfolk Avenue, Bethesda, Maryland.
Please call Dr. Anthony Bournia at (301) 492-7200 if you have any questions concerning this letter.
Sincerely, A
Harold R. Denton, Director Office of Nuclear Reactor Regulation
Enclosures:
As stated cc:
See next page 1296 165
Mr. N. O. Strand cc:
"r. B. D Redd Jerome E. Sharfman United Engineer: ' Constructors, Inc.
Atomic Safety and 30 South 17th St reet
' itensing Aereal Board Philadelphia, Pernslylvania 19101
.. S. *;u c l e a r. r; s l a t c ry C o r.mi s s i on Nicholas S. Reynolds, Esq.
Washington, D. C.
20555 DeBevoise & Liberman 1200 Seventeenth St., N. W.
Washington, D. C.
20036 Mr. E. G. Ward Senior Project Manager Babcock & Wilcox Company P. O. Box 1260 Lynchburg, Virqinia 23505 Robert Lazo, Esq., Chairman Atomic Safety and Licensing Board U. S. Nuclear Regulatory Commission Washington, D. C.
20555 Dr. Donald P. deSylva Associate Professor of Marine Science Rosenthiel School of Marine and Atrospheric Science University of Miami Miami, Florida 33149 Dr. Marvin M. Mann Atomic Safety and Licensing Board U. S. Nuclear Regulatory Commission Washington, D. C.
20555 Richard S. Salsnan, Chairman Atomic Safety and Licensing Appeal Board U. S. Nuclear Regalatory Commission.
Washington, D. C.
20555 Dr. John H. Buck Atomic Safety and Licensing Appeal Board U. S. Nuclear Regulatory Commission Washington, D. C.
20555
ENCLO3URE 1
~
~
Primary System Perturbations Induced by Once Through Steam Generator I.
Introduction,-
Bh' plants employ a once through st..m generator (OTSG) design, rather than U-tube steam generators whi:h are used in other pressurized water reactors.
Each steam generator has approximately 15,000 vertical straight tubes, with the primary coolant entering the top at 603-608 F and exiting the bottom at about 555 F.
Primary coolant flows down inside the steam generator tubes, while the secondary coolant flows up from the bottom on the shell side of the CTSG. The secondary coolant turns to steam about half way up, with the remaining length of the steam generator being used to supernest the steam.
The secondary-side heat transfer coefficient, in the stear space of the OTSG, is much less than that in the bottom liquid section. Tnis results in a heat transfer rate from the primary system which is quite sensitive to the ".iquid level in the steam generators.
If a feedwater increase event occurs, the liquid-vapor interface rises, increasing the overall heat transfer. This decreases the outlet temperatur! below 555 F and initiates an overcooling event, which can lead to primary system depressurization. By contrast, if a feedwater decrease event occurs, the'overall heat transfer decreases, the outlet primary temperature increases, and a pressurization transient ensues.
In either of *,hese cases, the resconse of tne crimary system pressure and pressurizer level to a change in min feedanter flow rate (or temperature) is comparatively rapid. These rapid prir.ary syster pressare chances due to char.ges in feedwater conditions is knowr. herein as syster " sensitivity" and is b
j
2 unique to the B&W OTSG design.
Following the incident at Three Mile Island, various acticas were taken to increase the reliability of the auxil'.iry feedwater systems and improve plant transient response. System modifications to increase the reliability of the AFW may have resulted in more frequent AFW initiation. However, use of tFW re;ults in introduction of cold (100 F vs. 400 F) feedwater into the mora sensitive 0
upper section of the steam generators. This may act to enhatre system sensitivity.
Further system modifications provide control-grade reactor trips based on While secondary system n.alfunctiors, such as turbine or feedwater pump trip.
these reactor trips do serve to reduce undercooling feedwater transients by reducing reactor power promptly following 1.0MFW, they may amplify subsequent overcooling.
A reexamination was made of small break and loss of feedwater events for B&W plants. This resulted in a modification of operator procedures for dealing with a small break, which include prompt RCP trip and raising the water level in the steam generators to (95:;) to promote natural circulation. Both these actions are taken wheri a prescribed low pressure set point is reached in the reactor coolant system and for anticipated transients such as loss of feedwater these actions may amplify undesirable primary system responses.
In addition to the post-TMI changes discussed above, actions were also taken,'
t7 reduce the challenges to the power operated relief valve (PORV) by raising While these the PORV set point and lowering the high pressure reactor trip.
actions have been successful in reducing the frequency of PORV operation, they 1296 168 have resulted in an increased number of reactor trips. This occurs because the raactor will' now trip for transients it previously would have ridden through by ICS and PORV operation.
The staff is concerned by the inherent responsiveness of B&W OTSG design. While some specific instances are presented in the next section of this paper, the staff concerns are also of a general nature.
It is felt that good design practice and maintenance of the defense-in-depth concept, requires a stable well-behaved system. To a large part, meticulous operator attention and prompt manual action is used on these plants to compensate for the system sensitivity, rather than any inherent design features.
The staff believes that the general stability of the B&W plant control systems should be improved, and that plant response to OTSG feedwater perturbations be dampened.
II.
Recent Feedwater Transients On August 2:
'9 the staff met with the B&W licensees to discuss recent feedwater trans. nts. One aspect which is of interest is the relationship of the operato.- +^
functioning of the main feedwater system.
In at least one instance an opere..t.,r manually opened a block valve in series with a control valve (partly open but thought to be closed). This resulted in an overfeed condition.
In several recent events the feed flow was reduced to the point where the reactor tripped on high pres:;ure. Subsequent overfeed reduced pressure to below 1600 psi, where HPI was initiated, reactor coolant pumps tripped, and auxiliary feedwater flow introduced into the top of the steam generators, which increased the severity of the cooldown transie4 1296 169
- 4.,
It appears that in many cases the main feedwater control system 'does not reaci quickly a nough or is not sufficiently stable to meet feedwater requirements.
Rather, che system will often oscillate from underfeed to overfeed conditions, One reactor trip and sometimes a high pressure injection initiation.
causit.9 und'esirable element of this lack of stability is that overcooling transients on the primary side proceed very much like a small break LOCA (decrease in pressurizer level and pressure). Thus, for a certain period of time the operators The same may not know whether they are having a LOCA or an overcooling event.
This type of ~ behavior can be initiated by the normal reactor control system.
was demonstrated by a December 1978 event at Oconee, where failure of a control-recorder led to reactor trip, a feedwater transient, and ESF actuation.
grade T,yg A partial list of recent B&W transients and their effects is contained in the Appendix to this report.
III.
Role of the Pressurizer Level Indicator _
A major area of concern arising from the B&W OT5G sensitivity, is the response of pressurizer level indication. Several B&W feedwater transients have led to loss of pressurizer level indication. Most notatble was a November 1977 incident The arrival at Davis Besse where level indication was lost for several minutes.
rate for this event appears to be on.the order of.1.2 per reactor year, but could be on the increase due to the potential for more reactor trips and feed-This is of water transients resulting from post-TMI-2 system modifications.
concern because an overcooling event could empty the pressurizer, thereby creating the potential for forming a steam bubble in the hot leg which may interrupt The staff feels that natu-al circulation, following RCp trip on low pressure.
the uncertainties associated with two phase natural circulation are somewhat high for an event with a recurrence interval of a few years.
1296 i70
5-Additionally, the staff believes that good design practice and adherence to the defense-in-depth concept, would require that plant operators be aware of the reactor's status during expected transients. A low-level off-scale reading on pressurizer level makes it impossible for the operators to assess system inventory and more difficult to differentiate between an accident and an excessive cooldown transient. The staff feels that the frequency with which this situation occurs is undesirable.
Some concerns also exist with regard to the operation of the pressurizef heaters when loss of level takes place.
Nonsafety grade control circuitry trips the heaters off when pressurizer level is low.
If these nonsafety grade cutoffs should fail, the heaters would be kept on while uncovered.
This situation has the potential of overheating the pressurizer to the failure point, as happened
.with a test reactor at Idaho Falls.
IV.,
Role of ICS-MFW
~
The ICS appears to paly a significant role in the plant's feedwater response.
The staff is currently reviewing an FMEA study on the ICS. However, review of operating experience suggests that the ICS often is a contributor to feedwater transients.
In some cases the ICS appeared inadequate to provide sufficient plant control and stability. Some of the utility descriptions of feedwater transients (as sumarized in the minutes of a meeting on August 23,1979) empnasized the role of.the operator in operating the MFW system. The following sequence illustrates the type of event and system response which the staff feels could potentially occur.
1.
Reactor at'100% power.
2.
Reactor trip, from arbitrary cause (does not matter).
3.
plant stabilizes in hot shutdown, for a few minutes, heat rejection to condenser (and/or secondary dump valves).g6 }7)
4. Overfeed transient -(MFW) (not unconraon to B&W) causes overcooling; pressurizer level shrinks, pressure reaches 160 psi, R5 actuates; RCP tripped; AFW on. (Possible RCP seal failure). 5. Operator manually controls AFW (possibly MFW instead or in addition, if MFW n' t isolated such that OTSG level comes up to 95% of operating range. This massive addition of cold water may lead to emptying of pressurizer and interruption of natural circulation (or, the hot leg may flash due to depressurization and interrupt natural circulation even 4f pressurizer does not empty). 6. HPI delivers cold water, no heat transfer in OTSG; vapor from core leads to system repressurization; steam may condense or PORY may lift. 7. No pump restart criteria available, circulation may not be reestablished. It appears that an upgraded safety quality ICS, which _is designed to balance power to OTSG level in a better fashion, could reduce the sensitivity, illustrated in the above sequence. V'. Role of ECCS and Auxiliary Feedwater it is known that some feedwater transients result in overcooling to the extent that the HPI actuation setpoint is reached. Traditionally, the operator isolates letdown and turns on an extra makeup pump following trip so as to avert this actuation. If this manual action is not perfomed quickly enough-or if the cooldown transient is too ~ severe, the HPI set point will be reached and the pumps automatically started. Following procedures, the operator would then trip all mair - coolant pumps and utilize recovery procedures based on the plant symptoms. .I f the incident was actually a feedwater ever.: and not a small LOCA, he would then presumably go to the inss of forced circulation procedures. When pressure has 0 recovered such that tne coolant system has become 50 F ' -5 cooled, the operator can secure HPI. One problem is the difficulty in differentiat.ing between a small 1296 172
break LOCA and an. excessive feedwater transient. The operator would be forced to assume a small LOCA until proven otherwise. However, following the small break procedures and introducing cold auxiliary feedwater, may increase the severity of an overcooling event. Initiation of AFW and delivery to the OSTG, especially if accompanied by filling to the high level required by new pro-cedures (95%) will continue the cooldown and depressurization. Thus, the AFW . system -acts to increase the responsiveness of the reactor to feedwater transients where excessive cooldown is occurring. VI. Conclusions The staff believes that the current B&W plants are overly responsive to feedwater transients because of the OTSG design, pressurizer sizing and PORV and high pressure trip set point. Some of the sensitivity also arises from . inadequacies in the ICS to deal with expected plant perturbatior.s. Regardless of the reasons, B&W plants are currently experiencing a number of feedwater. transients which the staff feels are undesirable. The staff believes that modifications should be considered to reduce the plant sensitivity to these events and thereby improve the defense-in-depth which will enhance the safety of the plant. t i296 173
~ APPENDIX FEEDWATER TRANSIENT $UMMARY FACILITY TRANSIENT DATE DESCRIPTION CR-3 8/16/79 (0259 Reactor Trip on liigh Pressure - 4 to 3 RCP, A-S/G underfed -72% Pwr. Reactor Trip on lii h Pressure - 3 RCP - A-S/G underfed - 45% Pwr. 8/16/79(1125) 9 8/17/79 (0706) Reactor Trip on fligh Pressure - 3 RCP - A-S/G underfed - 48%Pwr. .8/17/79 (1825) Reactor Trip on liigh Presse e - 3 RCP - A S/G underfed - 26% Pwr. 8/02/79 (0202) Reactor Trip on Low-Low Level in both S/G - 10% Pwr. AND-1 8/13/79 (1749) Turbine Trip - Antic. Trip did not work - Rx Trip on ill Press - 75% Oconee-1 6/11/79 (0333) Reactor Trip on Anti. Trip (LOFW) - 99% Pwr. 6/11/79(0752) Reactor Manually Tripped when FWPT "18" Tripped Oconee-2 5/07/79 (0346) Reactor Trip on liigh Pressure - feedwater oscillations - 18% Pwr. 6/03/19 (2046) Reactor Trip on liigh Pressure - feedwater oscillations - 30% Pwr. Rancho Seco 7/12/79 (1714) Reactor Trip on Antic. Trip (LOFW) - 100% Pwr. Davis-Desse NONE e CB N 4 i
ENCLOSURE IREP - INITIAL PLANT STUDY We have attempte'd to develop a general framework for the conduct of a liniited risk assessmen? of a B&W reactor aimed at identifying any unique risk-impacting sequences relative to the Reactor Safety Study. An absolute detemination of risk is not intended. We have selected Crystal River 3, a plant owned and operated by Florida Power Corporation, for analysis. The architect-engineer for this Babcock and Wilcox reactor was Gilbert Associates. It began connercial op'eration in March 1977. The project, as presented in Figure 1, will require the following tasks: 1. A survey of the LER files as now established in ORNL and A0 reports, as well as the Sandia and Fluor-Zion systems interactions studies to identify interactions and common mode failures which have occurred in similar plants. This survey should parallel construction of system logic models and event trees since it will ensure that actual experience is incorporated into the assessments performed. 2. Event trees for loss-of-coolant accidents and transient conditions. Specific attention will be given to more frequent LOCAs and these will include a feed-water transient tree which incorporates experience at B&W plants and will explore the post-TMI modifications. Emphasis will be given toward under-standing the human coupling interaction between systems at the event tree sequence level.
- 3.
Fault trees for tne key systems identified in the event trees. They will be constructed to the component level and will include control, actuation, and electric power considerations. Human errors will be included as well as the ability of the operator to cope in the time span available. Our preliminary opinion is that simplified fault trees will be required for the following systems: auxiliary feedwater and secondary steam relief, high pressure emergency core cooling in the injection and recirculation modes, low pressure emergency core cooling in both injection and recirculation modes, containment spray and containment heat removal systems and a limited study of loss of AC power, considering the 480 and 4160 busses and the emergency diesel generators, with limited analysis of high voltage switch-yard faults. Separate fault trees will probably be required for ECCS and AFWS initiation logic and the system trees must include the contribution from auxiliary systems such as instrument air, ventilation, component cooling, etc., and control-induced failures. Truncation of the fault trees will be permitted provided a written basis is provided. This basis will present the rationale why no coupling of cutsets or event sequences is expected from further development of the tree. An investigation of the adequacy of high pressure-low pressure interfaces.. ~ 4. 5. Analysis of the physical phenomena associated with cominant sequences to obtain estimates of the magnitude of releases fror tne containment. This will aid in categorizing releases into apprccriate release categories. 1296 175
To conduct a program of this magnitude in a short time period, delays assoc-iated with acquiring and transferring information must be minimized. Optimally, the event tree and fault tree analysts should share a common location during the initial portior. of the project. As the fault trees progress below the top logic, however, the analysts should be located at or near the site with immediate access to as-built drawings and procedures as well as a representative of the plant operations staff. This will penmit verification of engineering and procedural details and will minimiza information transfer and print re-production. Access should also be arranged between the fault tree analysts at the site, the remaining team in Bethesda, the architect-engineer, and the vendor. In addition to basic plant data, deterministic calculations may be required to understand the behavior of the plant under off-normal conditions. This may also involve real-time simulation at an appropriate simulator to tho extent possible. The arrangements with the vendor should cover this possibility and it may be desirable to have confi- ory calculations made by one of the NRC contractors on a selected basis 4 t e 1296 176
FIGilRE 1 T ANALYSIS OF EVEtlT TREE ACCIDENT PROCESSES C0tlSTRUCTI0tl AS NEEDED LER SURVEY PUI,L TOGETilER EXISTIt1G lilFO 9 ALREADY C0til'II.ED if CATECORIZATI0tl ) LICEllSING FAULT TREE 4- ) QUAtlTIFICATI0li 0F EVENT REC 0tRIENDATIONS C0tlSTRUCT10tl TREE SEQUEllCES T DETEIU11tilSTIC CALCULATI0llS BY VEllDOR ^8 " ~ AtlALYSIS OF
SUMMARY
REPOR1 IIICil PRESSURE - 0F RESULTS LOW PRESSURE INT. I O I NRR AND PEER REVIEW N G t
ENCLOSURE 3 PRELIMINARY IDENTIFICATION OF SYSTEMS AND COMPONENTS THAT MAY BE IMPACTED BY DESIGN CHANGES HPI System EFW System DHR System CFT System RCS Pressure Control System Makeup / Letdown System SG Pressure Control System Steam Generator Pressurizer Quench Tank Control Room Layout RCS Piping f 1296 178}}