ML19296C495
| ML19296C495 | |
| Person / Time | |
|---|---|
| Site: | Rancho Seco |
| Issue date: | 02/11/1980 |
| From: | Webb C CALIFORNIA, STATE OF |
| To: | |
| References | |
| NUDOCS 8002260344 | |
| Download: ML19296C495 (15) | |
Text
$T UNITED STAiES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of:
)
)
SACRAMENTO MUNICIPAL UTILITY
)
DISTRICT
)
Docket No. 50-312 (SP)
)
(Rancho Seco Nuclear Generating
)
Station)
)
)
)
Prepared Direct Testimony of Clifford M. Webb Concerning Design Sensitivities of the Babcock and Wilcox Nuclear Steam Supply System February 11, 1980 Sponsored by the California Energy Commission 8002260
T Prepared Direct Testimony of Clifford M. Webb Concerning Design Sensitivities of the Babcock and Wilcox Nuclear Steam Supply System My name is Clifford M. Webb.
I am employed by the California Energy Commission ( "CE C " ) as a Project Manager in the Office of Projects Administration.
My resume has previously been submitted in response to discovery requests.
I have been active in the design and safety analysis of nuclear power plants since 1974.
I have worked as a supervising mechanical systems engineer on a Babcock and Wilcox series 205 nuclear power plant and I was a principal engineer on a study to optimize the emergency core cooling system for the General Atomic Company's High Temperature Gas Reactor.
Introduction This testimony primarily addresses three issues:
Additional Board Question No. 3,1[ CEC Issue 1-1, !
and CEC Issue 1-12.1!
1.
It appears from a Board Notification issued by R. H. Vollmer on December 5, 1979, that the basic design of the Once Through Steam Generator (OTSG) muy so closely couple primary system behavior to secondary system disturbances that gross disturbance of the primary system is inevitable for feedwater transients.
Further, it seems there are situations in which an operator may not be able to tell exactly what is wrong or what response is appropriate (e.g., over-cooling vis-a-vis a small-break LOCA).
a.
What changes in the system and procedures have been made to ameliorate this situation?
b.
What are the implications for safety or operating Rancho Seco before any uncertainties are resolved?
2.
Despite the modifications and actions of subparagraphs (a) through (e) of section IV of the Commission's Order, will reliance upon the High Pressure Injection System to mitigate pressure and volume control sensitivities in the Rancho Seco primary system result in increased challenges to safety systems beyond the original design and licensing basis of the facility?
3.
Despite or because of the modifications and actions of subparagraphs (a) through (3) of section IV of the Commission's Order of May 7, will Rancho Seco experience an increase in reactor trips resulting from feedwater transients that will increase challenges to safety s stems beyond the original design and licensing basis of the facilit ?
In addition, it will relate to the following Board Questions:
CEC 1-2, CEC 1-10, Hursh and Castro No. 21, and Hursh and Castro No. 24.
The TMI-2 accident and subsequent analyses by NRC and other groups have revealed that Babcock and Wilcox (B&W) nuclear steam supply systems (NSSS) are unusually sensitive to disruptions in the feedwater system.
In particular, the design of the once-through-steam generator (OTSG) makes the B&W NSSS highly vulnerable to undercooling and overcooling events.
The undercooling event challegnes the pressure relief and safety valves (which have been the subject of post-TMI " fixes").
The overcooling event can result in auto-matic activation of the high pressure injection (HPI) system.
During an overcooling event which activates the HPI system, reactor operators cannot easily determine whether the event is a feedwater transient or whether a small break loss-of-coolant accident (LOCA) may also be involved.
Accordingly, operators are required to treat the event as a small break LOCA until a definitive determination to the contrary can be made.
The operator must therefore trip the reactor coolant pumps (RCP), which results in a loss of forced circulation cooling to the core and reliance on natural circulation cooling.
The foregoing situation is of particular concern because B&W NSSS's have historically been more prone to feedwater transients than other PWRs.
Moreover, the complex feedwater control system has a number of failure modes which result in overfeed and under-feed events.
This raises several concerns regarding the performance limitations of the B&W NSSS which is employed at Rancho Seco.
These are as follows:
2.
\\
1.
The high pressure injection system (HPI) is of ten being used to mitigate insufficient control of primary system pressure and temperature fluctuation caused by OTSG sensitivities.
This use of HPI, part of the emergency core cooling system, should not be favored. Such non-emergency use of HPI means that it no longer serves to alert operators to the presence of a LOCA or other serious low probability event.
This situation, which contributed to the accident at TMI, has not been remedied at Rancho Seco.
2.
Small break analyses performed since TMI have shown that HPI may not be capable of maintaining sufficient core cooling inventory wnen certain size breaks occur in the primary system and the reactor coolant pumps continue operating.
Since operators cannot easily discern whether a LOCA is present, let alone its size, they must now trip the RCP's whenever the HPI set point is reached because of the possible HPI underdesign.A!
Obviously, the absence of the RCP's means there is significantly less defense-in-depth.
3.
When the RCP's are tripped, the core must be cooled by natural circulation.
To date, natural circulation has never been used for core cooling at Rancho Seco, nor, to my knowledge, has it been successfully relied upon at any B&W facility following the occurrence of severe transient conditions.
4.
Natural circulation cooling is unreliable once significant voiding occurs in the primary system.
A severe overcooling event, such as may result from excess feedwater flow, may empty the pres-surizer and cause steam bubbles to form in the hot leg.
In addition, a serious overcooling event may result in flashing becausa of the rapid pressure loss experienced under these conditions.
4.
I&E Bull. No.79-05C, dated July 26, 1979.
3.
A The foregoing performance limitations inhibit the ability of the Rancho Seco system to cope with the design sensitivity of B&W NSSS.
The actions instituted since TMI at Rancho Seco do not eliminate or significantly reduce these sensitivities.
Ra ther,
the post-TMI actions are designed to mitigate the consequences of these sensitivities, not eliminate them.
In addition, the short-term actions such as the lower high pressure reactor trip set point, the anticipatory secondary side reactor trips, and improved reliability of the auxiliary feedwater system were designed primarily to compensate for the overheating transient event.
However, in mitigating overheating events, these measures may have increased the frequency and severity of overcooling events.
The f of this testimony will be on the need to eliminate the design sensitivities of the Rancho Seco NSSS in order to ensure that the defense-in-depth concept is maintained.
Thus, this testimony will deal with the following:
--The design sensitivities of the B&W NSSS;
--The consequences of these sensitivities, including the increased reliance on natural circulation to ensure adequate core cooling;
--The post-TMI-2 actions taken by SMUD, particularly that the design sensitivities of the Rancho Seco NSSS to overcooling events have not been eliminated or significantly reduced; and
--The need to reduce or eliminate the sensitivites of B&W systems.
4.
Discussion The defense-in-depth concept utilized in nuclear plant licensing demands that all reasonable steps be taken to ensure nuclear power reactor safety.
The TMI accident has shown that, at least in part because of inherent design sensitivities, unsafe conditions can result in B&W plants when feedwater transients occur.
Although post-TMI requirements have alleviated some failure modes and new operating instructions have been adopted for use during transients, the.5 ?nsitivity of B&W plants to feedwater transients has not be'n fixed.
This sensitivity is of particular concern because B&W facility's experience more feedwater transients than c/
other PWR systems (three per year versus two per year).1
- Moreover, the post-TMI actions will apparently increase reactor trips at B&W facilities.6/
Therefore, overcooling events are an increasing possibility.
I am concerned that the basic d( Agn sensitivities of the B&W NSSS have not been adequately addressed in the aftermath of TMI.
The defense-in-depth concept demands that efforts must eventually focus on steps which eradicate or reduce B&W systems ' unique sensitivities, not just those which seek to offset control the consequences of those sensitivities.
I.
The Babcock and Wilcox Nuclear Steam System is More Sensitive to Feedwater Transients Than Other PWR Systems.
The B&W NSSS utilized at Rancho Seco uses a unique OTSG.
Unlike other PWR's which use a U-tube steam generator, the B&W OTSG utilizes vertical, straight tubes.
The primary coolant enters 5.
NUREG-0560, p.ld, Ch.
3.
6.
See NRC Memorandum entitled, " Primary System Perturbations Induced by Once Through Steam Generator", attached as Exhibit 1.
5.
the top of the OTSG at slightly above 600 *F, flows down inside the steam generator tubes, and exits the bottom at about 550*F.
The secondary coolant (f eedwater) flows in the opposite direction outside the tubes, absorbing heat from the primary coolant.
The secondary coolant enters at approximately 400*F and turns to steam about half-way up the OTSG.
As it travels the remaining length c f steam generator, this steam absorbs more heat and becomes "superieated".
The superheated steam is then fed to a turbine for power pr.oduction.
A detailed discription of the OTSG is contained in the Rancho Seco FSAR, Section 4.2.2.2.
While this steam generator design has certain operational advantages in that it provides a degree of steam superheat, it has certain distinct disadvantages under transient conditions.
First, the B&W steam generator contains a smaller volume of feed-water than the U-tube designs.
It therefore becomes fi. led more quickly than other designs and, when feedwater flow is lost, it boils dry more quickly.
Upon a complete loss of feedwater flow, the B&W OTSG will boil dry in approximately one minute.2!
This is relatively rapid by comparison to U-tube steam generators, which would maintain at least some cooling capacity for about 15 minutes.8/
Thus, because of the small feedwater capacity of the OTSG, small differences in feedwater flow result in large fluctuations in the OTSG liquid level.
This particularly concerns me because the complex B&W control feedwater system has a number of failure modes 7.
At full power, the OTSG can boil dry in less than 30 seconds.
See NUREG-0560, Table 1, pp. 2-7.
8.
The Palisades Combustion Engineering plant can remove stored and decay heat with no makeup for approximately 16 minutes after a reactor trip.
See NUREG-0560, pg. 6-3.
6.
A A ' gf O
I f
%g,f9,
,zzz,/ 4 4 re, q
g
\\\\\\Y/
IMAGE EVALUATION
\\
TEST TARGET (MT-3) 1.0 I: 3 'n
'32 lii!l 2.2 l,
36 l,l f ' EM ll 1.8 a-1.25 1.4
! I.6
\\__
6" MICROCOPY RESOLUTION TEST CHART aD s p,%/z/,
/S4%
+;s;..fh n
,,' 6
=e
~3 7.x v ::-
Q
'e f9'
>:Qs'"
t
' c,t i.
which result in overfeed and underfeed.
With respect to the B&W system, the NRC staff has stated:
"The system will often oscillate from underfeed to overfeed conditions, causing a reactor trip and sometimes a high pressure injection initiation".
Exh. 1, pg.
4.
The sensitivity of OTSG liquid level to feedwater flow is compounded by yet another concern:
the system heat transfer is determined by the liquid level in the OTSG.
As I mentioned previously, the feedwater turns to steam as it flows up through the OTSG.
The liquid in feedwater side of the OTSG absorbs much more heat than the steam.
This is because the heat transfer coefficient depends on whether there is liquid or steam present on the shell sides of the heat transfer tubes.
Therefore, if the OTSG liquid level drops, the heat transfer in the OTSG drops with it, and, if it drops too far, the primary system can be undercooled.
Conversely, if the liquid level rises in OTSG, the amount of heat transferred from the primary system to the secon';ry system can increase greatly.
If the liquid level in the OTSG becomes excessive, the primary system can become over-cooled.A[
See Exhibits 1 and 2, attached.
Thus, when compared to other PWRs, the B&W NSSS design is doubly sensitive.
Small changes in feedwater flow cause relatively large changes in OTSG liquid level; and small changes in OTSG liquid level cause relatively large changes in the rate of heat 9.
The sensitivity of the Bancho Seco system was emphasized by a Rancho Seco operator.
Mr. Morisawa stated:
"Feedwater does, you know, it is a big deal.
But you can drop pressure like crazy by just adding a little bit of cold water."
Morisawa Deposition, pg. 15.
7.
transfer from the primary system.
These sensitivities closely tie the primary system temperature and pressure to events in the secondary system, especially feedwater transients.
This increases the likelihood of both undercooling and overcooling.10/
II.
Ram 1&ications of B&W Design Sensitivities The ramifications of B&W design sensitivities are well docu-mented and need not be discussed at length herein.
I have enclosed as Exhibit 1 an NRC Staff Memorandum, " Primary System Perturbations Induced by Once Through Steam Generator", which describes my major concerns.
I have also enclosed, as Exhibit 2, excerpts from recent NRC sponsored analysis of the consequences of the sensitivi-ties to the ACRS on January 8, 1980.
However, there are several problems which I wish to emphasize.
First, the frequent use of the HPI system, especially without a LOCA, cannot be favored.
Use of emergency core cooling systems in situations where a LOCA has not occurred deprives operators of LOCA indication.
It may also condition operators to routinely manipulate these systems.
The TMI-2 accident was largely the result of such operator manipulation of HPI.
New procedures and training since TMI have sharpened operator awareness of the danger of turning off HPI too soon following transients.
However, this may now lead to other undesirable conditions.
For instance, continued operation of HPI without a LOCA may exacerbate other conditions by filling the primary system completely and raising primary system pressure to relief and/or safety valve limits.
By maintaining a high reactor vessel pressure, violation of technical specifications (meant to protect the reactor 10.
The NRC presentation to the ACRS on January 8, 1980 summarized these sensitivities.
See Exhibit 3, attached.
8.
m from embittlement caused by low temperatures and high pressures) may occur.
This is of particular concern at Rancho Seco, which has atypical reactor vessel weldments that are more sensitive to such conditions.11/
In addition, prolonged use of HPI may result in extensive overboarding of coolant that may eventually exceed the capacity of the relief tanks that receive excess HPI flow.
Furthermore, in a severe overfeed situation such as those discussed in Exhibits 1 and 2, the sensitivity of the OTSG may cause pressuru in the primary system to fall below 1600 psi, thereby initiating HPI.
This would require operators to trip the RCP 's.12/
I have several concerns related to this procedure.
First, reactors are designed and licensed to use the RCP's as the prim'ry means of providing core cooling.
A reactor operating procedure which eliminates use of the RCPs for a certain class of events cannot be favored since it means one of the defense-in-depth mechanisms to ensure core cooling has been lost.
11.
The routine use of HPI may have an additional danger.
At the depositions of SMUD operators, it was revealed that operators may routinely start HPI prior to reaching 1600 psi.
Comstock Dep.
56.
This could be a problem if a small break LOCA is present.
The start of HPI will delay reaching the 1600 psi sr.t point and delay tripping the RCPs.
If RCPs thus continue to run longer than other-wise would have been the case, more liquid may be lost through the break than HPI can make up and the eventual RCP trip at 1600 psi may come too late to avoid a partial core uncovering.
I am unable to analyze the dangers of this scenario but suggest that analysis should be made to ensure that SMUD's procedures are consistent with the purposes of I&B Bull.79-05C.
12.
Current procedures at Rancho Seco and other PWRs demand that operators manually trip the RCPs whenever a pressure loss reaches the safety features set point (1600 psi).
I&E Bull.79-05C.
When the pumps are tripped, the primary coolant must circulate naturally, without mechanical force.
Because of the sensitivities induced by the OTSG, the Rancho Seco system can reach 1600 psi more quickly and more often that other systems and, indeed, under circumstances where no LOCA has occurred.
9.
a a
Second, these procedures force reliance on natural circulation cooling.
Natural circulation cooling demands operator judgments rec, airing a high degree of understanding of the analytical bases of the associated procedures.
Rancho Seco has never used natural circulation cooling and, to my knowledge, natural circulation has never been demonstrated in any B&W plant following a severe overcooling event.
Nevertheless, natural circulation will be relied upon at Rancho Seco whenever the HPI sitpoint is reached.
To rely so heavily on a less effective cooling method, especially one requiring a high degree of operator competence, for relatively frequent events does not seem wise.
Whenever new and additional operating procedures are required, the potential for operator errors or unexpected situations is increased.
Natural circulation conditions do not easily forgive operator errors.
Since an undisputed lesson of TMI is that operating errors do occur, the design sensitivities ~ which increase the opportunity and consequences of such errors should be eliminated.
- Third, the increased reliance on natural circulation in B&W plants is of particular concern because the B&W plant sensitivi-ties that lead to tripping the RCPs may also lead to flashing (voiding) in the primary system.
Natural circulation is not reliable under these conditions.13/
As noted earlier, primary pressure can f
quickly during overcocling events.
This causes the primary coolant to shrink substantially, lowering the level in the pressurizer below its measurement range and, for severe occurrences, emptying the pressurizer completely.14/
13.
Both the Licensee and the NRC Staff have admitted that this is true.
See Licensee's Answer to CEC Request for Admission No. 36; NRC Sta ff 's Answer to CEC Request for Admission No. 35.
14.
See Exhibit 2.
10.
The emptying of the pressurizer is extremely undesirable since it may form voids or bubbles in other reactor locations (such as the high point of the steam generator hot leg).
This could possibly occur even if the primary system had not reached saturation conditions.
Operators may not be alerted to the instabilities caused by such voiding, since they have been instructed that HPI may be secured when 50*F subcooling is verified.
Il coolant empties from the pressurizer, creating a bubble in the
'aot leg, natural circulation may be undependable.
Furthermore, when the pressurizer empties, operators lose knowledge of primary coolant inventory and the ability to recognize further degredation due to abnormal conditions.
In addition, recent analysis suggests that the pressure decline from overcooling can be so rapid as to cause flashing in the hot leg, again making natural circulation cooling unreliable.15/
If natural circulation cannot be achieved af ter stabilization of primary system conditions, core pressur2 will rise until the relief or safety valves are lifted to prevent overpressurization.
This will, of course, discharge heat from the primary system.
However, during this time both forced and natural circulation will be unavailable.
Operating without either of these core cooling methods violates the defense-in-depth philosophy.
To me, this seems 15.
See Transcript of ACRS meeting on January 8, 1980, pg.
43.
11.
clearly unwise, particularly since such overcooling events are in my mind anticipated events.15/
III.
The Post TMI-Fixes The dangers described in the preceding section all relate at least in part, to the B&W reactor systems' design sensitiv1-ties.
Since TMI, ef forts have been made to control the consequences cf some of the sensitivities in an ef fort to provide reasonable assurances of safety (e.g.,
the set point for the PORV has been increased, the high pressure reactor trip has been reduced, and an anticipatory secondary side hardwire reactor trip has been installed).
But, as described above, anticipated events can lead to considerably less defense-in-depth than seems wise, notwithstanding these measures.
None of the post-TMI fixes which have been installed so far--and certainly none of the fixes required by the NRC's May 7 Order--addressed measures to reduce or eliminate the basic design sensitivities of B&W reactor systems.
This is surprising since B&W design sensitivities were identified in April, 1979, and are mentioned in the May 7 Order itself.
The NRC staff has recognized the need for correcting B&W design.
Thus, the staff has stated:
16.
Recent NRC I&E inspections review of even normal operational B&W plant transients have indicated void formation in the hotter regions of the reactor vessel.
According to the NRC staff "there are a number of potential concerns that could arise" if this is bale.
See Exhibit 4, attached, at p.
1.
12.
It is felt that good design practice and maintenance of the defense-in-depth concept, requires a stable well-behaved system.
To a large part, meticulous operator attention and prompt manual action is used on [B&W]
plants to compensate for system sensitivity, rather than any inherent design features.
The staff believes that modifications should be considered to reduce the plant sensitivity to these events and thereby improve the defense-in-depth which will enhance the safety of the plant.
Ex. 1, pp. 3 and 7.
I believe that the May 7 Order cannot be viewed as adequate since that Order not only failed to implement any changes to reduce the Rancho Seco design sensitivities, it also failed even to require that such sensitivities be studied.
At a minimum, that Order should have established a strict schedule for study of design modifications to reduce or eliminate the design sensitivities, with a requirement that either the NRC or a licensing board operating at NRC's direction, decide which design changes, if any, should subsequently be implemented.
I do not call for massive design modifications which would require expenditures of millions of dollars in return for only marginal safety benefits.
I do believe, however, that identification of possible design changes is essential so that a rational decision can be made as to whether changes should be required.
IV.
Conclusiqn It is a matter lagely of common sense, not technical argument, that the design sensitivities of B&W NSSS's should be eliminated.
13.
a With respect to new facilities and those under construction, the NRC is apparently studying measures to remove the sensitivities 12/
and taking steps to ensure that design options remain available.18/
With respect to operating B&W facilities, elimination of design sensitivities is a more complex matter, if only because of the economic factors which are involved.
But, never theles s, I strongly feel that the sensitivities need to be addressed since they increase both the frequency and severity of challenges to reactor safety.
These sensitivities weaken the defense-in-depth concept, the cornerstone of nuclear plant licensing.
I have no easy solutions to this problem.
Indeed, I believe the NRC, the Licensee, and Babcock a.:d Wilcox may not fully uider-stand all the variables that affect the B&W NSSSbS!.
But I believe strongly that these sensitivities cannot be tolerated in the long term, and I urge the Board to make an explicit finding to that effect.
At the very least, the Board should direct the Licensee to begin analyzing measures to remove the sensitivities, rather than continuing to cope with them.
17.
See Exhibit 1.
18.
E.g.,
NRC Letter to TVA, dated October 25, 1979 re Bellefonte Nuclear Plant.
19.
Some measures to remove the sensitivities have been suggested.
See Transcript of ACRS meeting on January 8,
- 1980, pgs. 49-50.
14.
r UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION Before the Atomic Safety and Licensing Board In the matter of:
)
)
SACRAMENTO MUNICIPAL UTILITY
)
Docket No. 50-312(SP)
DISTRICT
)
)
(Rancho Seco Nuclear Generating
)
Station)
)
)
AFFIDAVIT OF CLIFFOP.D M.
WEBB Clifford M. Webb, being duly sworn according to law, deposes and says as follows:
I have prepared and am familiar with the attached document entitled " Prepared Direct Testimony of Clifford M.
Webb".
The opinions set forth therein are my own and, to the best of knowledge, the facts set forth therein are true and correct.
b h.
Dated:
February 11, 1980 3
CLIFFOR TM. WEBB Sworn and subscribed before me this lith day of February, 1930.
\\1ttu WE_tht%A QtaryPublic
- w ea m %.w 1---
{[
MARY McDEARMID l
I flOT/RY Fij0LeC CAtlECfiN14 4 ;
41 l
~~
P:! nopal Office m UC.7Af/EMO Ceumy ",
f.ty Comn.iss.on Erytes Feb. 20.1980
% ~.- ;T ; ~;z ;:+wc z ;. ; H.,..,>