ML19296B833
| ML19296B833 | |
| Person / Time | |
|---|---|
| Site: | Rancho Seco |
| Issue date: | 02/11/1980 |
| From: | Matthews P Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19296B831 | List: |
| References | |
| NUDOCS 8002220209 | |
| Download: ML19296B833 (43) | |
Text
.
UullED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD in the flatter of
)
)
SACRAMENTO MUNICIPAL UTILITY
)
Docket No. 50-312 (SP)
DISTRICT
)
)
(Rancho Seco Nuclear Generating
)
Station)
)
NRC STAFF TESTIMONY OF PHILIP R. MATTHEWS ON RELIABILITY AND TIMELINESS OF THE EMERGENCY FEEDWATER SYSTEM (Board Question CEC 1-6)
Q.l.
Please state your name and your position with the NRC.
A.l. My name is Philip R. Matthevs.
I am an enployee of the U. S. Nuclear Regulatory Commission assigned to the Auxiliary Systens Branch, Division of Sy.tems Safety, Office of Nuclear Reactor Regulation. My position in the ASB is Section Leader responsible for the technical supervision of engineers conducting technical review of nuclear plant auxiliary systems, including emergency f6edwater systems.
Q.2.
Have you prepared a statement of professional qualifications?
A.2.
Yes. A copy of this statement is attached to_ this testimony.
8002220 g o7
. Q.3.
Please state the purpose of this testimony.
A.3.
The purpose of this testimony is to respond to Board Question CEC 1-6.
Board Question CEC _1-6 Will the modifications of Subparagraphs a-e of Section IV of the Commission's Order of May 7 still leave the Rancho Seco emergency feedwater system in a condition of low reliability?
Q.4.
Describe the Rancho Seco auxiliary (emergency) feed. vater (AFW) system and the functions it is intended to perfonn.
A.4.
The Rancho Seco AR4 system functions as an emergency sy. item for the removal of heat from the reactor coolant system when the main feed-water system is not available during emergency conditions, including small break LOCA cases. The AR4 system operates over a time period sufficient to either hold the plant at hot standby for several hours or to cool down the reactor coolant system to temperature and pressure conditions at which the low pressure decay heat re.aoval system can operate to remove reactor coolant system heat and AR4 system operation can tenninate.
The Rancho Seco AFW system consists of two independent but inter-connected subsystems (trains) each capable of supplying auxiliary feedwater to either or both steam generators under automatic or manual initiation and control.
The AFW system safety functional requirement is met if at least one train supplies water at a specified flow rate to at least one f the two steam generators following a demand for system operation,
. The primary water source for the AFW system is the condensate storage tank.
Two alternate water sources are the Folsum South Canal and an on-site reservoir.
Each AFW train contains a pump capable of delivering auxiliary feedwater flow against the maximum steam generator pressure to piping supplying both steam generators.
One AFW pump is motor driven; the other is a combination steam turbine driven - motor driven pump with both the turbine.and electric motor on a common shaft.
Each pump receives water from the condensate storage tank via separate pipes.
The pumps are interconnected at their dischcrge by a cross connection containing motor operated valves. This cross connection permits either pump to feed either or both steam genera-tors.
AFA flow to each steam generator is controlled by air operated ficw control valves.
SteaE supply for the turbine driven ArW pump is provided from the main steam lines downstream of each steam genera-tor.
Electric power for AFW system components in each train is supplied from separate busses which are backed up by separate diesel generators.
The AFW system is automatically initiated upon (1) loss of the reactor coolant pumps or (2) ma.n feedwater puap low pressure. These signals
'~
start both the turbine driven and the motor driven AFW pump and open the AFW flow control valves based on steam generator water level
'6
. signals. A reactor coolant system Safety Fear.ures Actuation signal will also automatically start the turbine driven AFW pump and open the AFW Safety Features Bypass valves.
The AFW system can also be manufally initiated by the operator from the control room.
Q.5.
What are the liRC staff AFW system acceptance criteria with respect to the capability of the AFW system to respond satisfactorily to main feedwater system transients?
A.S.
The AFW system acceptance criter'ia are contained in Reference 1, the flRC Standard Review Plan, Section 10.4.9 (SRP). The Rancho Seco AFW system has been reviewed against those criteria which relate to the capability of the AFW system to respond satisfactorily to main feedwater system transients. The results of this review indicate that the Rancho Seco AFW system design meets these criteria. These criteria are important to the system reliability.
The manner in which the Rancho Seco AFW system meets them is summarized below.
- 1) System capability to transfer heat loads from the reactor system to a heat sink under normal and a'ccident conditions assuming a single active failure and the capability to isolate components or subsystems if required so that the system safety function is maintained (GDC-44)I - this criterion is satisfied by (a) the use of redundant and independent mechanical, electrical and I The abbreviations in parenthesis following the functional criteria listed refer to thetNRC General Desigo Criteria (GDC), Regulatory Gt.ide (RG), or Standard Review Plan (SRP) from which the functional criteria are derived.
s
. instrumentation trains for the ABI system as described in my response to Question 1 above and (b) the provision of isolation valves and instrumentation and controls which permit operation of one ARI train when the other train is unavailable such as during test or main-tenance periods.
- 2) Use of appropriate design code requirements in system and compc-nent design to assure system quality (Reg. Guide 1.26, 1.29) -
this riterion is met by piping, valves and pumps being classified as Quality Class I, Seismic Class I.
- 3) Use of diverse motive power sources for pumps and valves to avoid dependence on only one type of power source (SRP 10.4.9, Branch Technical Position ASB 10-1) - this criterion is met by use of an AC powered motor driven pump in one AP.4 train and a turbine-driven pump with a DC powered steam admission valve in the other train along with use of air operated AR1 flow control valves.
- 4) Provision for periodic inservice inspection of systera piping and equipment (GDC 45) - this criterion is satisfied by implementa-tion of an AFW system inservice inspection program which has been reviewed and accepted by the staff.
- 5) Provision of instrumentation and controls to properly initiate, control and monitor system operation (GDC 19) - this cricerion is satisfied by arf system automatic initiation, steam generator
~.
. 1 evel controls and instrumentation for AFW water supply, AFW flow and steam generator level.
- 6) Provision for manual system initiation as backup to automatic initiation (Reg. Guide 1.62) - this criterion is satisfied by providing capability for manual contrcl of pumps and valves with appropriate operating procedures.
7)
Provisions for periodic functional testing of the system and esta-blishment of limiting conditions of operation to assure system
~
reliability daring plant operation (GDC 46) - this criterion is satisfied by impl6 mentation of Technical Specifications for the AFW system.
Q.6.
With specific reference to the Three title Island Unit 2 (TMI-2) incident, describe the origin and nature of any concern on the part of the NRC Staff that the reliability of the Rancho Seco AFW system s hould be improved.
A.6.
On April 2,1979, while post-accident recovery operations were taking place at TMI-2, a task group was appointed to perform a generic assessment of feedwater transients in B&W designed plants in light of operting experiences including the TMI-2 accident. The purpose o f the study was to determine the bases for continued safe operation of these plants in both the short-term and long-term. Based on the preliminary findings ofcthis task group, a document entitled "NRR Status Report on Feedwater Transients in B&W Plants," dated April 25, 1979, was prepared. This document ider,tified the sensitivity of the B&W plants to feedwater transients and the role that this sensiti-vity might play as a precursor or contributor to a iiiI-2 type accident.
(The complete findings of this task group were later published in NUREG-0560.)
The report identified several design differences that distinguished the B&N design from other PWR designs in its response to feedwater transients. The features of the B&W design which contributed to this sensitivity were:
(1) the design of the steam generators to operate with a;relatively small liquid volume in the secondary side which made changes in feedwater flow manifest itself quickly as changes in heat transfer from the primary system; (2) the lack of direct initiation of a reactor trip upon upsets in the secondary system such as loss of feedaater and turbine trip; (3) reliance on the Integrated Control System (ICS) to automatically regulate feedwater flow; (4) actu-ation of the FORV on certain anticipated transients before a reactor trip; and (5) a low steam generator elevation (relat've to the reactor vessel) for the lower loop plants which provides a small driving heat for natural circulation.
Because of these features, the B&W designed reactors placed more reliance on the reliability and performance characteristics of the auxiliary feedwater system, the ICS, and the high pressure injection system ('HPI) to mitigate the consequences of transients such as loss of feedwater and small break loss-of-coolant accidents, than other PWR designs.
~ ~,
. The report concluded that at that time the staff did not have reasonable assurance that the B&W plants could continu? to operate without undue risk to the health and safety of the public and that the plants should be shutdown until the items identified as (a) through (e) on page 1-7 of the report '. vere completed to the satis-faction of the staff.
(Note:
Items (a) and (b) address actions required spec.fically for the emergency feed, vater systen).
The Commission was briefed on the contents of that report on April 25, 1979. On April 26 and 27, 1979, meetings were held between H.
Denton and representatives of the B&W licensees. As a result of these meetings, the licensees agreed to shutdown their facilities (or renain shutdown if already shutdown) until certain short-term action were completed.
The short-tenn design and procedural changes committed to by the Rancho Seco licensee were those identified above as items (a) through (e) on page 1-7 of the "NRR Status Report on Feedwater Transients in B&W Plants."
On the basis of these commitments the staff again met with the Com-mission on April 27, 1979. The substance of the meeting was to clarify those commitments to the Commission. It was during this meeting that the Commission directed the staff to prepare Confirma-tory Orders to formalize the agreements reached with the licensees.
d
These Orders were issued to each of the facilities between May 7 and 17, 1979. The Order for Rancho Seco was issued on May 7,1979.
Q.7.
Describe the actions taken by the NRC relative to the Rancho Seco AFW system following the Three Mile Island accident.
Include those actions taken at the Rancho Seco facility following the Conmission's Order of May 7,1979 to improve the reliability of the Rancho Seco AFW system.
A.7.
The actions taken and the manner in which these actions improved the reliability of the AFW system are summarized below:
- 1) The following actions improved AFW system reliability by assuring availability of AFW system operation and timely delivery of AFW flow to the steam generators upon demand and by reducing the likelihood of human error.
a) As required by Items 5 and 7 of IE Bulletin 79-05A and evaluated in Reference 2 the licensee reviewed the AR4 system valve line up procedure and confirmed that the valve positions required by the procedure do not defeat or compromise the AFW flow path to the steam generators. The AFW system valve positions were verified agair.st the procedure and are checked periodically in accordance with the Technical Specifications.
b
. b) As required by Item 8 of IE Bulletin 79-05A and evaluated in reference 2, the licensee confirmed that there are sur-veillance procedures in use to assure that two independent AFW system flow paths, each with 100% flow capacity are operable to meet the requirements of the Technical Specifi-ca tions.
c) As required by Item 11 of IE Bulletin 79-05A and evaluated in Reference 2, the licensee stated that all operating personnel have had training to make them aware of the seriousness and consequences of simultaneous blocking of both AFW system flow paths at TMI-2 and other actions taken during the early phases of the accident. The licensee further stated that maintenance personnel at Rancho Seco do not change valve positions and have been instructed that they do not have this au thori ty.
- 2) The following actions. established and implemented procedures and trained operators to take actions to maintain AFW system functional capability under abnormal plant operating conditions or following postulated failures that could adversely affect ooerability of the AFW system. These actions improved the reliability and time-liness of AFW flow delivery by reducing the likelihood of human error or delay in taking appropriate action to restore AFW system capability even under abnormal or failure conditions.
. a) As required by Item (a) of Reference 3 and evaluated in Item a.1 of Reference 4, the licensee reviewed procedures, revised them as necessary and conducted training to ensure timely and proper starting of motor driven AFW pumps from vital AC buses upon loss of offsite power.
b) As required by Item (a) of Reference 3 and evaluated in Item a.2 of Reference 4, the licensee revised procedures and trained operators to station an operator at the necessary valves and in phone communication with the control room during.AFW system surveillance test periods to be able to quickly restore AFW system to its normal valve alignment upon an AFW system demand. The ifcensee has also incorporated independent veri-fication of valve position following surveillance testing or maintenance of the AFW system, c) As required by Item (a) of Reference 3 and evaluated in Items a.3 and b. of Reference 4, the licensee implemented procedures and trained operators to provide for initiation of the AFW system and control of steam generator water level independent of the Integrated Control System (ICS) in the event that ICS fails.
d) As required by Item (a) of Reference 3 and evaluated in Item a.6 of Reference 4, the licensee revised procedures and
' ~.
- trained operators to provide alternate soLrces of water, other than the condensate storage tank, to the suction header of the AFW pumps.
- 3) The following actions improved AFW system reliability by (1) providing the operator with improved instrumentation and annun-ciation to assure timely and consistent verification of proper ARI system operation, and (2) reducing the likelihood of human error or delay in taking appropriate back-up action to establish AFW system operation if the AFW system fails to operate upon occurrence of plant conditions requiring it to operate.
a) As required by Item (a) of Reference 3 and evaluated in Item s a.5 and a.7 of Reference 4, the licensee (1) installed flowneters on each AFW system flow path; thus providing the control room operator with an indication and means to verify AFW flow to each steam generator and (2) provided indication for all plant conditions requiring automatic arf system initiation on an annunciation panel in the control room. The panel also indicates when the motor driven AFW pump has been manually initiated.
b) As required by Item (a) of Reference 3 and evaluated in Item a.8 of Reference 4, the licensee conf'rmed that his existing e
. procedures specifically direct the operators to immediately verify that the AFW system is operating properly following occurrence of plant conditions requiring automatic AFW system initiation and control.
4)
The following actions along with the periodic surveillance functional testing of the AFW syitem performed in accordance with the Technical Specifications confirm the system design reliability by demonstrating that system components continue to meet their design requirements, a) As required by Item-(a) of Reference 3 and evaluated in Item a 4 of Reference 4, the licensee verified that the Technical Specification requirements for the AFW flow rate are in accordance with the accident analysis.
The Technical Specifi-cation requires capability to supply feedwater-at a flow rate corresponding to a reactor' decay heat level of 4.5 per cent of full reactor power, This requires a total flow rate to either or both steam generators of 760 gpm, The licensee verified by test that each of the two AFW pumps is able to deliver at least 780 gpm to the steam generators, b) As required by Item (a) of Reference 3 and evaluated in Item a,9 of Reference 4, the licensee verified by test that the air operated AFW flow control valves will fail (1) to the 50%
~.
e
. open position upon loss of electrical power to electric to pressure converter and (2) to 100% open position upon loss of air; thus maintaining an open AFM flow path to the steam generators following either loss of electric power or air.
c)
In June,1979, following the plant shutdown ordered by Reference 3, the licensee completed a 40 hour4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> continuous operational test of both the motor driven AFW pump (P-319) and the dual (turbine-motor) driven AFW pump (P-318) using the turbine drive. These tests demonstrated that the pumps can operate satisfactorily for an extended period of time
_and remain within design limits with respect to bearing and bearing oil temperatures and vibration. The 40 hour4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> time period is considerably longer than the time normally required to reduce reactor coolant system temperature and pressure to the point where the low pressure decay heat removal system can commence operation. At this point operation of the AFV system would no longer be required.
Q.8.
In light of the actions taken at the Rancho Seco facility in response to NRC Bulletins issued as a result of the TMI-2 incident and the Commission's May 7, 1979 Order, is the Rancho Seco AFW system now acceptably reliable? If so, why?
A.8.
The actions described in my response to Question 7 above are considered by the staff to have improved the reliability of the Rancho Seco AFW system sufficiently to warrant continued plant operation. These
. actions resolved staff concerns about (1) PWR plant generic AFW system operational availability problems as addressed in IE Bulletin 79-05A and (2) B&W plant specific AFW system reliability problems as addressed and evaluated in Reference 4.
These actions improved overall AFW system reliability by increasing systen operational availability by use of improved system testing and valve line up procedures; by imple-menting procedures and training to assure proper operator action to maintain AFW system capability, if necessary, under abnomal plant conditions or postulated failures, thus reducing the likelihood of operator error; by providing the operator with improved infomation on the system operating conditions; and by verifying the design capability of major AFW system components.
Also, as discussed below, the licensee is evaluating areas for further improvements in AFW system reliability.
Q.9.
Are any additional actions planned at the Rancho Seco facility to further enhance the reliability of the A W system?
Identify these additional actions and time frame within which they will be imple-mented.
A.9.
As part of the long term requirements of the Reference 3 Order. the if censee has submitted for NRC review the results of a reliability analysis of 'the Rancho Seco AN system (Reference 5). This analysis has been done on a more systematic basis than previous AFW system reviews and uses event tree and fault tree logic to determine any
~ ~.
. significant potential contributors to AFW system reliability under This evaluation is various loss of main feedwater conditions.,
still under review by the staff. However, the review has proceeded sufficiently for the staff to basically agree with the overall con-clusion in the analysis about the comparative reliability of the Rancho Seco AFW system relative to that of other PWR plants. The analysis concludes that the Rancho Seco AFW system reliability relative to that of Westinghouse PWR operating plants, is 1) in the medium to high reliability range in the event of loss of main feedwater 2) in the low to medium reliability range ln the event of loss of uain feedwater with loss of offsite power 3) in the medium reliability range in the event of loss of main feedwater with coincident loss of both onsite and offsite AC electric power.
It should be noted that the Staff did not require that this analysis attempt to establish absolute quantitative reliability goals.
The primary reason for this is that there is considerable uncertainty in the component failure rate and human error data base that must be used in such an analysis.
The primary value of such reliability analyses is:
- 1) to identify, through the development of reliability-based insight, any dominant contributors to AFW s{ stem unreliability.
. 2) to permit assessment of the relative reliability of the arf system of one plant against that of other plants by using the same analysis technique, event scenarios, assumptions and failure ra te da ta.
As a result of this analysis, the licensee has committed to imple-ment additional AFW system design and procedural modifications to further improve system reliability as follows:
1)
Provide a safety grade AFW automatic initiation and control system design that is independent of the Integrated Control System to be installed during the first refueling outage of 1981. This t.ll incorporate into the AFW system design the caoability presently requiring operator action as discussed in Item (2c) in my response to Question 7 above.
This change will also satisfy the long term requirement of f4RC Staff Lessons Learned recommendation 2.1.7.a (ftUREG 0578).
- 2) Provide the capability for automatically loading notor driven AFW pump P-319 onto its associated nuclear service bus; thus providing automatic starting of this pump in the event of loss of offsite
- k
power. This is planned to be accomplished by the end of the plant outage scheduled for January,1980. This will incorporate into the design automatic capability which presently requires operator action.
as discussed in item (2a) in the response to Question 7 above.
- 3) Revise the AFW system piping and provide a remote operated valve instead of local manual operated FWS-055. This will permit one AFW train to remain operable when the other is under test and permit the control room oper'ator to restore an AFW train that is under test back to operable status instead of requiring the stationing of a special operator as described in Item (2b) in my response to Question 7 above. This modification is planned for the first refueling outage of 1981.
4)
Incorporate into the Technical Specifications a requirement to operationally verify AFW flow capability from the condensate storage tank to the steam,enerators following extended cold shutdown of the plant. This procedure will be initiated following the plant shutdown scheduled for January,1980.
- 5) Upgrade the existing condensate storage tank level indication and low level alarm to safety grade requh ?ments. This is planned for the first refueling outage of 1981.
- 6) Upgrade the existing control room indication of AFW flow to each steam generator to safety grade requirements. This change
~~
. will also satisfy the long tem requirement of fiRC Staff Lessons Learned recommendation 2.1.7.b (NUREG 0578). This change is planned for the first refueling outage of 1981.
The staff agrees that these modifications will improve AFW system reliability.
Upon completing its review of the AFW system reliability analysis, the Staff will identify and recomend any further actions it considers neces-sary to improve AFW system reliability.
Q.10. Pending completion of the additional measures identified in your response to Question 9 above, indicate why continued operation of the Rancho Seco plant is acceptable.
A.10. The AFW system design and procedural changes accomplished thus far have improved overall system reliability by improving system avail-ability for operation upon demand; improving procedures and training to enable operators to take actions, if necessary, to maintain system functional capability under abnormal plant conditions; providing to the operator improved information of the system operating condition; and verifying the design capability of major system components.
It is considered that these changes have improved AFW system reliability sufficiently to assure safe plant shutdown following loss of main feedwater.
The measures identified in my response to Question 9 above primarily incorporate into the AFW system design capabilities which now exist but presently require operator action to implement. The proposed changes will reduce continued dependence on operator action and thus reduce the likeli-hood of operator error in the long tecm.
REFERENCES, 1.
NRC Standard Review Plan (NUREG 75/087), Section 10.4.9, " Auxiliary
~
Feedwater System" 2.
" Evaluation of Licensee Responses to IE Bulletins79-05A and 79-05B, SMUD, Rancho Seco Nuclear Generating Station, Docket No. 50-312, transmitted by NRC letter of November 23, 1979 to SitVD 3.
Conmission Order dated May 7,1979 - Docket No. 50-312 4.
" Evaluation of Licensee's Compliance with the NRC Order dated May 7, 1979, Sacramento Municipal Utility District Rancho Seco Nuclear Generatin9 Station" Docket 50-312, transmitted by NRC letter of June 27, 1979 to SMUD.
~
5.
" Auxiliary Feedwater System Reliability Analysis for the Rancho Seco Nuclear Generating Station Unit No.1," dated December,1979, trans-mitted by SMUD letter of December 17,1979 to NRC.
O W
k
Octobcr 16, i W 9 Philip R. Matthews Professional Qualifications I am employed by the U.S. Nuclear Regulatory Commission as a' Section in the Auxiliary Systems Branch, Division of Systems Safety, O Nuclear Reactor Regulation.
cal personnel engaged in analysis and safety evalua feedwater, component cooling water, service water, new and spent fuel storage and handling.. plant ventilating and air conditioning, and fire protection systems.
I attended the University of falifornia, Berkely, California and received Subsequently, I have a. Bachelor of Science degree in Chemistry in 1947.
completed several graduate courses in mechanical and nuclear engine In 1947, I commenced work at the Knolls Atomic Power Laboratory, Gen I worked there until 1968 on various Electric Co., Schenectady, N.Y.
naval nuclear submarine and surface ship propulsion power plant projects.
I had technical and management responsibility for nuclear plant mechani-cal n'nd fluid systems design, testing, performance evaluation, proto-type and shipboard reactor plant start-up and sea trials.
In 1958, I transferred to the General Electric Co., Nuclear EnergyI was Division in San Jose, California.
the Atomic Power Eq,f pment D2partment responsible for quality assurance of APED purchased eagineered equipment and installation of APED equi at BUR nuclear ~ plant sites.
I foined the Nuclear Regulatory Commission in 1973 as a nuclear engi In 1975, I assumed my present duties as in the Office of Standards.
In this position, I Section Leader in the Auxiliary Systems Branch.
have' had two cajor special assignments; namely,1) t of nucicar plant fire protection guidelines following the 1975 fire at Browns Ferry Nuclear Plant and 2) in 1979, to dire operating nuclear pla'nts with ltestinghouse and Combustion Engineer designed reactors and provide specific recommendations for improving Auxiliary Feedwater System reliability.
~~.