ML19339B009
| ML19339B009 | |
| Person / Time | |
|---|---|
| Site: | Trojan File:Portland General Electric icon.png |
| Issue date: | 10/23/1980 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19339B007 | List: |
| References | |
| TAC-11715, TAC-44654, NUDOCS 8011060145 | |
| Download: ML19339B009 (22) | |
Text
' O dL SAFETY EVALUATION REPORT TROJAN NUCLEAR PLAflT IMPLEMENTATIONS OF RECOMENDATIONS FOR AUXILIARY FEEDWATER SYSTEMS I.
Introduction and 3ackground he Three itfle Island Unit 2 (NI-2) accident and subsequent investigations and studies afghlightad the imoortance of the Auxiliary Feedwatar System (AEiS) in the mitigation of transients and ac:1 dents. As sar of our assess::ent of the TMI-2 accident and related frrotications for operating plants, we evalua:ad ce AFW systems for all operating and near-tam operating ifesnse piants having nuclear steam supply systems (NSSS) desitoed by 'lestingneuse (NUREG-0611),
or Comoustion Engineering ("UREG-0635). Cur evalua fons of these systam designs are c:ntained in the NUREGs along with our rec:mmendations for eSch plant and ce c:ncerns wnich led to each recomendation. The cofectives of the evalua-
- fon wert 3: (1) identify neussary enanges in AFW system design or related peccecures in order to assure the safe coeration of these plants, and (2) to identify other sysam characteristics of the arf systems which, on a long tam basis, may reautre system modifications. To ace:molish dese objectives, we:
(1) Reviewed plant scacific AF.f systam designs in lign of cur ent regulatory requirements (SAP) and.
(2) Assessed ne relative reliacility of the various AFf systams under various loss of fatevater transfents (one of wnich was de initiating event of TMI-2) and other postulated failure conciticas by detsmining de otantial for AEf systam fatture due e c: mon causes, single ?oint vulnersoii!:ies, and human ar-or.
l 8 011 g g g g af 5-
. We concluded that the implementation of the recomendations identified during this review will considerably improve the reliability of the AFW systens for each operating plant.
The following generic recomendations did not apply to this plant: GS-1, GS-3, GS-8 and CL-1. The basis for these recomendations can be found in Appendix III of NUREG-0611, and the system description which detamined the specific reason for not applying these recomendations to this plant can be found in Appendix X of NUREG-0611.
II. Inclementation of Our Recorunendations A.
Short Tem Recomendations 1.
Reconsnendation GS-2 "The licensee should lock open single valves or multiple valves in series in the AFW systen pump suction piping and lock open other single valves or multiple valves in series that could interrupt all AFW flow. Monthly inspections should be perfomed to verify that these valves are locked and in the open position. These inspections should be proposed for incorporation into the surveillance requirements of the plant Technical Specifications. See Recommendation GL-2 for the longer-tem resolution of this concern."
In response, the licensee indicated in a letter dated December 31, 1979, j
that the valves in the supply 3 ping between the condensate storage 8
tank and the suction of the two existing AFW pumps are maintained in a locked open condition. The licensee stated that the Plant Operating Test (FOT: l which provides for a monthly vertffcation of the position of these valves was
revised to assure that these valves are included. In. addition, the monthly surveillance test of the AFW pumps which is required by the plant Technical Specifications assures that the suction supply is available. These measures are required only on an interim basis pending resolution and implementation of Reconenendation GL-2. For these reasons, we conclude that current plant Technical Specifications and revised procedures adequately cover our concern in this area, and are, therefore, acceptable pending verification of the Plant Operating Test procedure by the Office of Inspection and Enforcement.
2.
Recommendation GS-4
" Emergency procedures for transferring to alter-nate sources of AFW supply should be available to the plant operators.
These procedures should include criteria 'to inform the operator when, and in what order, the transfer to alternate water sources should take place. The following cases should be covered by the procedures:
- The case in which the primary water supply is not initially available. The procedures for this case should include any operator actions required to protect the AFW system pumps against self-damage before water flow is initiated; and,
- The case in which the primary water suoply is being depleted.
The procedure for this case should provide for transfer to.
the alternate water sources prior to draining of the primary water supply."
i
~
. In response, the licensee indicated in a letter dated December 31,1979,
~
that the case where auxiliary feedwater primary supply, the condensate storage tank, is not available is currently covered in existing plant DT..edures. The procedure for transferring auxiliary feedwater pump eupply from the condensate storage tank to the service water
.s contained in Trojan Emergency Instruction EI-5, Emergency aackup Core Heat Removal. We conclude that the licensee's response is acceptable.
3.
Recommendatien GS-5 "The as-built plant should be capable of providing the required AFW flow for at least two hours frem one AFW pump train, independent of any alternating current power source. If manual AFW system initiation or flow control is required following a complete lois of alternating current power, emergency procedures should be established for manually initiating and controlling the system under these condi-
'tions. Since the water for cooling of the lube oil for the turbine-driven pump bearings may be dependent on alternating current power, design or procedural changes shall be made to eliminate this dependency as soon as practicable. Until this is done, the emergency procedures should provide for an individual to be sta*.foned at the turbine-driven pump in the event of the loss of all 4;ternating current power to monitor pump bearing and/or lube oil temperatures. If necessary, this operator would operate the turbine-driven pump in a :.anual on-off made l
l l
l l
l 6
i I
I until alternating current pcwer is restored. Adequate lighting i
powered by direct current power sources and comunications at local 4
l stations should also be prvvided if manual initiation and control of the Al'4 system is needed. (See Recomendation GL-3 for the longer-term resolution of this concern.)"
In response to this reconsnandation, the licensee indicated in a letter dated December 31, 1979, that the turbine-driven AFW pump would be utilized to provide decay heat removal in the event of a loss of all AC power. However, this pump currently reites on an AC power depen-dent water source for bearing and jacket cooling. The licensee is implementing erargency procedures to provide the following:
a) Make every effort to restore AC power within 20 minutes.
ts) Provide a material " kit" for use by the operators whfen provides the necessary hardware to hook up temporary cooling water to the turbine driven AFW pump bearing lube oil cooler.
c) Provide a precedure that instructs the operator to hook up the temporary cooling system if AC power is not restored within 20 minutes, manually valve in the steam supply to the AFA pump turbine and align the condensate storage tank and AFW pump to feed the steam generators. The procedure will include a statement directing the operator to take portable lighting and portable comunication devices with him to the AFW pump operation station.
If the above measures are required, an individual will be stationed at the turbine-driven ptsnp to monitor pump bearing and/or lube oil temperatures.
Based on our review, we conclude that the licensee's response is not acceptable. We require the following additional infonnation from the licensee:
a) What is the basis for taking nc action for the first 20 minutes following station blackout? Indicate the time required for installing the tamporary " kit" and establishing AFW flow.
b) Provide a diagram of the temporary cooling system.
c) Where is the temporary cooling " kit" to be located and what admini-strative controls will be included to assure its availability.'
d) Verify that all necessary personnel have been trained in the pnsce -
dure for installing the temporary cooling system.
We will report resolution of this iten in a supplement to this SER.
4.
Reccemendation GS-6 "The licensee should confirm flow path avail-ability of an A'FW system flow train that has been out of service to perfom periodic testing or maintenance as follows:
- Procedures should be implemented to require an operator to detemine that the AR4 system valves are properly aligned and a second operator to independently verify that the valves are properly aligned.
. - The licensee should propose Technical Specifications to as.sure that prior to plant startup following a'n extended cold shutdown, a flow test would be performed to verify the normal ficw path from the primary AF4 system water source to the steam generators.
The flow test should be conducted with AFA system valves in their nornal - alignment."
In nisponse, the licensee indicated in a letter dated December 31, c
1980, that: 1) In lieu of revising operating procedures to include second operator verification of AFW system "alve positions after performing periodic testing or maintenance, the licensee has committed to the 1/ ntification system cennected to all main AFW flow path valves 2
to monitor the position of the valves such that a condition where any single valve is out of position will be annunciated in the control room. We conclude that this response adequately complies with our concern for independent verifi-cation of proper AFW system va!;e alignment and i,s acceptable. 2) At least one of the two safety-grade AFW pumps is required presently to initiate plant startup from cold shutdown conditions. Therefore, an AFW ficw path from the condensate storage tank to the steam generators is auto-matically verified. Once the new non-safety electric motor-driven startup AFW pump is installed, the AFW pump Periodic Operating Test will be revised to include a step to verify the ability of each safety-grade AFW pump to feed all four steam generators following an extended l
plant outage. This change is required inorder to meet the current require-ments of Technical Specification 3.7.1.2 which requires that an AF4 flow path be maintained in Modes 1, 2 and 3.
The above test will verify the flow path. We conclude that this response is acceptable.
' 5.
Recommendation GS-7 "The licensee should veiify that the automatic start AP4 system signals and a.isociated circuitry are safety-grade.
If this cannot be verified, the AP4 system automatic initiation system should be modified in the short-tenn to meet the functional require-ments Itsted below. For the longer terin, the automatic initiation signals and circuits should be upgraded to meet safety-grade require-ments as indicated in Recomendation GL-5.
- The design should provide.for the automatic intiation of the auxfif ary feedwater system flow.
- The automatic initiation signals and circuits should be designed so that a single failure will not result in the loss of auxiliary feedwater system function.
- Testability of the initiation signals and circuits shall be a feature of the design.
- The initiation signals and circuits should be powered from the emergency buses.
- Manual capabi'ity to initiate the auxiliary feedwater system from the control room should be retained and should be imple-mented so that a single failure in the manual circu'ts will not result in the loss of system functicn.
- The alternating current motor-driven pumps and valves in the auxiliary feedwater system should be included in the automatic actuation (simultaneous and/or sequential) of the loads to j
the emergency buses.
- The autonatic initiation signals and circuits shall be designed so that their failure will not result in the loss of manual capability to initiate the AN system from the control room."
In response, the licensee in a letter dated December 31, 1979, stated that the Trojan AN pump auto start signals and associated circuits are safety grade.
We conclude that this response satisfies the " control grade" require-ments specified in the NUREG-0578 position and clarifications and is, therefore, acceptable. - Refer to GL-5 for long tem " safety grade" implementation of this item.
B.
Additional Short Tem Reconsnendations 1.
Reconsnandation "The licensee should provide redundant level indica-
.tions and low level alams in the control room for the AN system primary water supply to allow the operator to anticipate the need to
.ake up water or transfer to an alternate water supply and prevent a low pump suction pressure condition from occurring. The low level alarm setpoint should allow at least 20 minutes for operator action, assuming that the largest capacity AN pump is operating."
l l
l
. In response to this recomuner.dation, the licensee stated in letters dated December 31, 1979, and July 1,1980, that a new redundant condensate storage tank level indicator with a low-low level alaen set to provide more than 30 minutes for operator action to realign AFW pump suction will be provided by the startup of the piant following the next refueling outage. The new level instrumentation will be
?)wered from a separate battery backed instrument bus to that for the existing level alann. We conclude that the licensee's response is acceptable.
2.
Recommendation (*his recommendation has been revired from the original recommendation in NUREG-0611)
"The licensee should perfonn a 48-hour endurance test on all AFW system pumps, if such a test or continuous period of operation has not been accomplished to date. Folicwing the
~
48-hour pump run, the pumps should be shut down and cooled down and
~
then restarted and run for one hour. Test acceptance criteria should include demonstrating that the pumps remain within design limits with
' respect to bearing / bearing oil temperatures and vibration and that pump room ambient conditions (temperature, humidity) do not exceed environmental qualification limits for safety-related equipment in the room.
The licensee should provide a sumar/ of the conditions and results of the tests.. The summar/ should include the following: 1) A brief description of the test method (including flow schenatic diagram) m
and how the test was instrumented (i.e., where and how bearing tempers-tures were measured). 2) A discussion of how the test conditions (pump flow, head, speed and steam temperature) compare to design '
operating conditions. 3) Plots of bearing / bearing oil temperature vs. time for each bearing of each AFW pump / driver demonstrating that tenperature design limits were not exceeded. 4) A plot of pump room ambient temperature and humidity vs. time demonstrating that the pump room amoient conditions do not exceed environmental qualiff-cation limits for safety-related equipment in the room. 5) A state-ment confirming that the pump vibration did not exceed allowable limits during tests.
- The licensee provided the results of the endurance tests for both the turbine-driven and diesel-driven AFW pumps in a letter dated July 25, 1980. The results included: (1) a description of the test method and how the tests were instrumented, (2) a description of how the test conditions compared to design operating conditions, (3) plots
,of bearing or bearing oil temperatures vs. time for each bearing demonstrating that limits were not exceeded, (4) plots of pump room ambient temperature and humidity vs. time, and (5) a statement confiming that the pump vibration did not exceed allowable limits during the tests.
We have reviewed the test method and test results and conclude that no design limits were exceeded during the 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> tests. We, there-fore, conclude that the Itcensee has met this recommendation, and the AFW pumps ara acceptable for long term operation.
3.
Reconsnendation "The licensee should implement the following reoutre-ments as specified by Item 2.1.7.b on page A-32 of NUREG-0578:
" Safety-grade indication of auxiliary feedwater flow to each steam generator shall be provided in the control room.
The auxiliary feedwater flow instrument channels shall be powered from the emergency buses consistent with satisfying the emergency power diversity requirements for the auxiliary feedwatei system set forth in Auxiliary Systems 3 ranch Technical Position 10-1 of the Standard Review Plan, Section 10.4.9." -
The if censee indicated in a letter dated Cecember 31,1979, that control room indication of AFW flow to each steam generator is already provided.
We conclude that this response satisfies the " control grade" requirements specified in the NUREG-0578 position and clarifi-cations and is, therefore, acceptable.
The " safety-grade" requirements for this reco.unendation are still under review. Our evaluation of this matter will be centained in a supplement to this SER.
l l
i i
. 4.
Recommendation _
" Licensees with plants which require local manual realignment of valves to conduct periodic tests on one AFW system train and which have only one remaining AF4 train available for operation, should propose Technical Specifications to provide that a dedicated individual who is in corzunication with the control room be stationed at the manual valves. Upon instmetion from the control room, this operator would re-align the valves in the AF4 system train from the test mode to its operational alignment."
In response to this reconsnandtfon, the licensee stated in a letter dated December 31, 1979, that manual realignment of local valves is not required when conducting periodic operating tests. We, therefore, conclude that this reconsnendation does not apply to Trojan.
C.
Lono Term Reconinendations 1.
Recommendation GL-2
" Licensees with plants in which all (primary and alternate) water supplies to the AFW systems pass thrcugh valves in a single flow path should install redundant parallel ficw paths (piping and valves).
Licensees with plants in which the primary AFd system water supply passes through valves in a single ficw path, but the alternate APd system water supplies connect to the AP4 system pump suction piping downst*eam of the above valve (s), should install redundant valves parallel to the above valve (s) or provide automatic opening of the valve (s) from the alternate water supply upon icw pumo suction pres-sure.
The licensee should propose Technical Specifications to incorporate appropriate periodic inspections to verify the valve positions."
In response to this recommendation, in letters dated December 31,1979, and July 1,1980, in lieu of the long tenn requirements presented above for assuring AFW pump protection ir. the event of an inadver-tently closed valve on the primary AF4 supply from the condensate storage tank, the Itcensee stated that prior to startup from the next refueling outage, low suction pnssure alarms and safety-grade automatic trip of the auxiliary feedwater pumps on low suction pressure will be installed. Operator action can then be taken locally to manually open the nomal supply valve or remotely to open the altermate supply (service water system) valves as necessary. In addition, control room position indication for the single locked open primary AFW supply line suction valve will also be installed.
The licensee further notes that the new electric motor-driven AP4 pump will be provided with a separate flow path from the conden-
. sate storage tank to the pump suction. We conclude that the licensee's response is acceptable.
2.
Recommendation GL-3 "At least one APA system pumo and its associated flow path and essential instrumentation should automatically initiate AFW system flow and be capable of being operated independently of any AC pcwer source for at least two hours. Conversion of DC power to AC power is acceptable. "
}
In response to this recomendation, the licensee indicated in letters dated December 31, 1979, and July 1,1980, that' the turbine-driven auxiliary feedwater pump and its associated systems will be modified to automatically initiate AFW ficw and operate for at laast two hours independent of AC power sources. The modifications are proceeding in two parts. First, the cooling water system for the turbine-driven pump will be modified to provide a closed cycle self-cooling water system which circulates auxiliary feedwater from the pump discharge through the lube oil bearing coolers and back to the pump suction.
This system will replace the current bearing cooling arrangement supplied from the service water booster pumps. Second, the present motor-operated steam admission valves will be replaced with solenoid-operated pneumatic control valves. These valves will fail open on loss of the nomal AC power dependent air supply. A passive seismic Categorv,
T backup air supply accumulator will be included to provide remote steam acknission control valve operability on loss of AC power. The valves will fail as-is on loss of the backup air supply. With the above modifications, we conclude that auxiliary feedwater can be auto-matically supplied to the steam generators by the turbine-driven AFW pump train in a loss of all AC power condition. Based on our review, we find the licensee's response acceptable.
3.
Recomendation GL-4
" Licensees having plants with unprotected normal AFW system water supplies should evaluate the design of their AFW systems to detemine if automatic protection of the pumps is l
______-_ necessary following a seismic event or a torna'do. The time available before pump damage, the alarms and indications available to the control room operator, and the time necessary for assessing the problem and taking action should be considered in determining whether operator action can be relied on to prevent pump damage. Consideration should be given to providing pump protection by mea e such as automatic switch-over of the pump suctions to the alternate safety-grade source of water, automatic pump trips on low suction pressure, or upgrading the normal source of water to meet seismic Category I and tornado protec-tion requirements."
The concern raiseu in this recomendation is similar to that of Recom-mandation GL-2, namely, providing automatic protection for the AFW pumps in the event of loss of normal suction supply for what e,er reason. We consider the measures provided by the licensee and discussed in this SER under Recomendation GL-2 to be acceotable, and these same features to also satisfy the requirements of this item.
4.
Recommendation GL-5 "The Itcensee should upgrade the AP4 system automatic initiation signals and circuits to meet safety-grade requirements."
In response to this recommendation, the licensee stated in a letter dated December 31, 1979, that with the exception of the main feed-water trip signals, the present AFW system automatic initiation
. signals are safety grade. 'de will review the licensee's design in detail and our evaluation will be contained in a supplement to this SER.
5.
Recommendation "A motor-driven pump is currently being installed or is planned to be installed by the licensee. Present plans are for a non-safety grade motor-driven pump system. Based on past experience of the problems associated with the speed contrel (overspeed trips) of both the diesel and turbine-driven pumps and other Licensee Event Reports on the Trojan AFd system, the licensee should further review the proposed installation te detennine if the motor-driven pump should be safety grade and automatically actuated by the AP4 automatic start logic."
In response to this reconmendation, the ifcensee stated in a letter dated December 31, 1979, that it is felt that upgrading the new motor-driven AFW pump to safety grade or automatic start is not
~
. justified. In lieu, the licensee proposes to develop a procedure which will provide for manually switching the motor-driven pump to an emergency AC bus and manually starting this pump in the event normal suction supply from the condensate storage tank to the safety-grade AF4 pumps is unavailable or both safety-grade AF4 pumps fail to operate.
These actions can be accomplished from the control room, and closely parallel the operator actions that would be necessary to verify that the motor-driven pump had auto started. The licensee concludes that
the design for the n.stor-driven pug as presented including the above procedure will substantially enhance AFW system reliability for the case of loss of main feedwater and loss of offsite power.
We have reviewed the licensee's response and conclude that it is incomplete. Licensee's final conclusions as to the feasibility of supplying emergency power to the new motor-driven pump should be provided, together with details as to how this would be done, in order that we may assess the complexity of the evolution and the amount of time it would take for the necessary manual operations to be performed.
The capability of a diesel-generator to start the motor-driven pump should be discussed.
Reliability studies for other AFW systems employing a manually started pumo suggest t'at a significant improvement in reliability is achieved by automatic starting. Licensee should present additional justification for manual (emergency power) alignment and for manual starting from a reliability star.dpoint, including a discussion of gains in reliability that could result by providing emergency power from one or both diesel-generators.
We will report our resolution of this matter in a supplement to this SER.
r
-18a-6.
Recommendation - A pipe break in certain locations of the turbine driven auxiliary feedwater pump discharge piping may affect both AFW trains, since portions of this piping pass through the diesel driven pump room. The motor driven pump to be installed should be located such that a break in the AFW system (not associated with the motor driven pump train) could not affect the motor driven pump. Also the licensee should 1) install the motor pump with appropriate valves in the pump discharge line connections to meet the high energy line break criteria in SRP 10.4.9 and 1
Branch Technical Position 10-1; namely, the AFWS should maintain the capability to supply the required AFW flow to the steam generator (s) assuming a pipe break anywhere in the AFW pump discharge lines plus a single active failure or 2) describe how the plant can be brought to a safe shutdown condition by use of other available systems following such a postulated event.
In response to this recomunendation, the licensee stated in a letter dated December 31, 1979, that based on the Trojan Nuclear Plant Analyses of Pipe System Breaks Outside Containment, PGE-1004, rupture of that portion of the turbine-driven auxfif ary feedwater pump dis-charge piping passing through the diesel-driver; pump room is no?.
considered a credible event because of:
The quality control associated with the fabrication and installa-a.
tion of this safety-grada piping; b.
The periodic inspection required for the AFW' system; c.
The low usage factor associated with the operation of the system; d.
The low operating temperature of the system; and The strict administrative controls associated with system operation.
e.
The licensee further noted that the above mentioned pipe break report is based on the current AFW system design which requires use of the safety grade pumps for plant startup and shutdown. With the addition
. of the third non-safety grade motor-driven startup pump, the already low usage factor for the safety-grade pumps will be further reduced.
In addition, the licensee stated that the piping in question is a straight run with no teminal ends, branch connections or high combined stress points. For the reasons stated above, the licensee indicated that it was unreasonable to postulate breaks in this section of piping.
In our position letter to the licensee dated May 14, 1980, we stated that the licensee's response was unacceptable and that adequate protection for the diesel-driven AFW pump from postulated ructure of the turbine-driven AFW pump discharge piping located in the diesel-driven pump room should be provided. We further required that the licensee assure that the new motor-driven AF4 pump train is separate from the existing AFW pump. trains to assure that a break in the AFW system (not associated with the motor-driven pump train) could not affect the motor-driven pump. In lieu of the above, the licensee
'could describe the means for achieving a safe shutdown condition by use of other available systems following such a postulated event.
In response to our position, the licensee stated in a lotter dated July 25, 1980, that in accordance with our position, positive protec-tion will be provided for the diesel-driven AP4 pump from postulated rupture of the turbine-driven AFW pump discharge line. The modified
21-system design will include a guard pipe encasing that portion of the turbine-driven pump discharge line which passes through the diesel-driven pump room. In addition, the new motor-driven AP4 pump discharge line will connect to the existing turbine-driven and diesel-driven AFW pug discharge lines with check valves and failed closed gate valves to assure separation and isolation. These modifications will be completed by resumption of power operation for Cycle 4 in 1981.
Based on our review of$e licensee's response, we conclude that the proposed modifications are acceptable.
D.
Easts for Auxi13ry Feedwater System Flow Recuirements (Enclosure 2 to NRC Letter Dated October 3,1979)
We have myiewed the licensee's response on this subject which was pro-vided in a letter dated February 5,1980, and find it acceptable.
I
=
w-erv