ML19340E677
| ML19340E677 | |
| Person / Time | |
|---|---|
| Issue date: | 12/17/1980 |
| From: | Imbro E, Lanning W NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML19340E675 | List: |
| References | |
| TASK-AE, TASK-C005, TASK-C5 AEOD-C005, AEOD-C5, NUDOCS 8101150366 | |
| Download: ML19340E677 (28) | |
Text
-
AE00 OBSERVATIONS AND RECOMMENDATIONS CONCERNDG THE PROBLEM 0F STEAM GENERATOR OVERFILL AND COMBINED PRIMARY AND SECfsNDARY SIDE BLOWDOWN by the Office for Analysis and Evaluation of Operational Data December 17, 1980 Preoared by: Eugene V. Imbro Wayne D. Lanning l
NOTE: This report documents results of studies completed to date by the Office for Analysis and Evaluation of Operational Data with regard to a particular operating event. The findings and recomendations contained in this recort are provided in suoport of other ongoing NRC activities concerning this event. Since the studies are ongoina, l
the report is not necessarily final, and the findinas and recommend-ations do not represent the position or requirements of the respon-sible program office of the Nuclear Regulatory Commission.
N 01150 %
J TABLE OF CONTENTS
1.0 BACKGROUND
I 1.1 The Steam Generator Overfill Problem.
2 1.2 Steam Generator Level Control in Combustion Engineering NSSS Plants...........................
3 1.3 Steam Generator Level Control in Westinghouse NSSS Plants....
4 1.4 Stean Generator Level Control in Babcock & Wilcox NSSS Plants..
5 1.5 Steam Generator Overfill Experience...............
5 2.0 POTENTI AL EFFECTS OF STEAM GENERATOR OVERFILL.............
7 2.1 Hydraulic Forces.........................
7 2.2 Excessive Dead Weight Loads...................
7 2.3 Failure of Valves to Reseat.
8 2.4 Loss of Emeroency Feedwater Pump Turbine.............
8 2.5 Steam Generatcr Tube Rupture...................
9 2.6 Acceleration of Accumulated Water................
10 3.0 STEAM GENERATOR OVERFILL SCENARIOS..................
12 4.0 APPLICABILITY OF THE SINGLE FAILURE CRITERION........,....
18 5.0 COMBINED PRIMARY AND SECONDARY SIDE BLOWDOWN.............
20 6.0 AEOD RECOMMENDATIONS.........................
24 REFERENCES.....
26
AE00 OBSERVATIONS AND RECOMMENDATIONS CONCERNING THE PROBLEM OF STEAM CTU77A!;2 OVERT'LL
1.0 BACKGROUND
Steam generator water level in oressurized water reactors (PWR), with~
the exception of the Babcock & Wilcox (B&W) Nuclear Steam Supoly Sys-tem (NSSS) plants, is controlled by a three element level control sys-tem that regulates feedvater flow. The control system compares feed-water flow, steam fiow, and water level with a precrogrammed level set-coint. The error signal generated by the control system is used to control the position of the feedwater regulating valves and vary the speed of the main feedwater pumps. The B&W NSSS plants do not use steam generator level to control feedwater flow above 15 oercent power.
The feedwater flow in B&W NSSS olants is controlled by the Integrated Control System (ICS) and is based on meg 6 watt demand when coerating above 15 percent power. The ICS is not safety related.
Since the steam generators provide the heat sink for the Reactor Cool-ant System (RCS), the principal safety consideration related to stubs generator water level, until now, has been the need for sufficient water level to remove the energy generated by the reactor e.74 transferred to the reactor coolant system. Combustion Engineering (CE) and Westinghouse (W) NSSS plants have an insts!'ed safety grade reactor trip on low steam generator level to protect the KC0 ' rom the conse-ouences of loss of heat removal capability. The trip is an anticipatory
. trip in that loss of heat removal capability also causes the reactor to trip on high RCS pressure later in the transient. The BEJ f 41cices do not have a reactor trip on low steam generator level and rely on the high RCS pressure trip to protect the reactor on the loss of heat sink.
1.1 The Steam Generator Overfill Problem A new issue pertaining to reactor safety has been raised concern-ing steam generator water level; however, the concern in this case is the effect of excessive level. The steam generator overfill transient, the subject of this report, can be caused by the fail-ure of the three element level controller or the ICS. The control of steam generator level within the specified operating range was not thought to be important to the safety of the plant. Accord-ingly, the three element level control system provided on CE and W NSSS plants is not safety related and, therefore, not seismically or environmentally qualified.
We now believe that steam generator overfill can affect the safety of the plant in several ways, the more severe of which could lead to the postulation of steamline breaks, or simultaneous steamline break and steam generator tube rupture for BAV NSSS plants (LOCA outside containment), as credible ever,ts. The basis for these l
concerns is as follows: 1) the increased dead weight and poten-tial seismic loads placed on the main steamline and its succorts t
. should this l'6e become flooded; 2) the loads placed on the main steamlines due to the Dotential for rapid collapse of steam voids resulting in water hammer; 3) the potential for secondary safety valves sticking open following jischarge of water or two-chase flow; A) the potential inoperability of the main steamline isola; tion valves (MSIVs), main turbine stop and bypass valves, feed-water turbine valves, and atmospheric dump valves due to effects of water or two-phase flow; and 5) the potential for rupture of weakened tubes in the once through steam generator (OTSG) on B&W NSSS plants due to tensile loads caused by the rapid thermal shrinkage of the tubes relative to the generator shell. The above items have not have been considered in the plant design because the steam generator overfill transient has not been or.J of the events analyzed. The reason this has not been analyzed is that such plants either have control grade protective actions on high steam generator level to provide for protection of the turbine, or they rely on operator action to control level manually in the event that the normal level control system fails.
1.2 Steam Generator Level Control in Combustion Engineering NSSS Plants The CE NSSS plants in operation, typically, have a control grade turbine trip on high steam generator water level. The high level turbine trip is generally provided on a two cut of four logic. This trip is derived from the safety-related instrumentation used to provide the low level reactor trip. An additional protective
4 feature provided on CE plants, although control grade, is that the feedwater supply rate is ramped down to 5 percent of its full oower flow in one minute following reactor trio. Following a turbine and reactor trip from 100 percent power, the steam generator level may drop about 40 to 50 inches due to collapse of voids in the economizer and evaoorator sections of the generator.
However, if a control system malfunction causes the feed rate to continue at 100 percent the stcam generators would fill in about three minutes. A similar situation could also occur if while operating at full power the feedwater control system caused feedwater flow to increase to its maximum. Depending on the particular plant design, this could be as much as 25 percent greater than the normal flow at 100 percent power.
In this instance, the steam generator would also fill in a matter of minutes, however, the steam generators would not be water solid as in the first case.
The level would be two phase since the generators are steaming; i.e., no reactor or turbine trip is assumed. Clearly, a rapid operator action is necessary to prevent overfilling of the steam generators in the event of failure of control grade equipment.
l 1.3 Steam Generator Level Control in Westinghouse NSSS Plants i
l The Westinghouse NSSS plant design is similar to CE in that the 1
turbine trip on high steam generator level is also control grade, but it operates an a two out of three logic scheme. The high level trip, although control grade, is derived from the safety grade level in-strumentation used to generate the reactor trip on low steam generator water leve'l. Westinghouse NSSS plants trip the main feedwater pumps and close the feedwater regulating valves automatically on reactor
~
I
_g.
trip. This is accomplished by the non-safety crade feedwater control system. As in CE plants, a failure of feedwater control system on W plants can result in filling the steam generators in approximately three minutes.
1.4 Steam Generator Level Control in Babcock & Wilcox NSSS Plants For B&W NSSS plants there is a steam generator high level alarm (one out of one logic which is not safety grade) but this does not directly provide protection against overfill. Some degree of level protection is provided by the ICS in that if the hich level setpoint is reached (about 20 feet) the megawatt demand signal to the feedwater controller is blocked. This prevents further increase of feed flow rate. The ICS does not automati-ca71y terminate the steam generator overfill transient, however. The output from the steam generator high level signal is input into the In-tegrated Control System for B&W plants. During a steam generator overfill, this system ou11s control rods to compensate for reduction of Tave and re-actor trip may occur on high flux or low pressure. Depending on the sever-ity of the transient and power history, a reactor trip may not occur l
immediately. The ICS will initiate feedwater run back after reactor trip.
For worst case conditions, operator action within two minutes is required to prevent water spillage into the steamlines. The operator probably has to act faster to prevent a steam generator overfill transient than any other transient.
1.5 Steam Generator Overfill Experience 1
There has been one incident which is believed to have resulted in some water in the steamlines. This was the " light bulb incident" at Rancho Seco on
. March 28, 1978. This event involved loss of non, nuclear instrumentation and subsequent inappropriate increase of main feedwater by the opera tor. Subsequent to the event, the licensee performed structural analyses and visual inspection of the steamline hangers. The investigation did not reveal any damage although the licensee was reasonably sure that some water was carried-over into the steamlines.
There have been ten other events at B&W NSSS plants which resulted in high level alarms, but none has resulted in spilling of water into the steamlines. These include:
Plant Date Reference / Source Crystal River 3 4/16/77 LER-77-29 Davis Besse 1 7/30/77 R0-NP-33-77-30 Crystal River 3 3/18/77 Grey Book, ADril 1977 Davis Besse 1 9/29/77 R0-NP-33-77-72 l
Davis Besse 1 3/25/78 R0-78-033 Three Mile Island-2 4/23/78 LER-78-33 and 44 Three Mile Island-2 12/2/78 LER-78-069 Rancho Seco 1/5/79 LER-79-01 Arkansas 1 8/13/79 IE Resident Inspector Crystal River 3 8/16/79 IE RC-II l
It should be noted that overfilling the steam generators to the high level alarm does not nt:essarily require a Licensee Event Report (LER). The above events were reported for other reasons.
Consecuently, an LER search did not find any failures or l
transients related to excessive feedwater.
i
. 2.0 p0TE!!TIAL EFFECTS OF STEAM GENERATOR OVERFILL 2.1 Hydraulic Forces When water enters the steamline, the steam is condensed and may produce a condensation-induced water hammer. Condensation of the steam results in a low pressure region which can accelerate a slug of water producing significant dynamic loads when the slug impacts at pipe locations where there is a change in direction or flow area. The dynamic loads produce axial forces and bending or torsional recments that can cause violent oipe movement with resultant damage to pipe hangers, restraints and valve operators.
Failure of the steamline hangers and restraints can result in inadecuate support and possible loss of valve operability or steamline integrity. Components which can be damaged in the steamline include the main steam isolation valves, safety valves, check valves, turbine stop valves, bypass valve:, etc.
2.2 Excessive Dead Weight Loads l
Continued overfill of the steam generator (s) will result in large quantities of subcooled water in the steamlines. The added weight of the water may exceed the design stress limits of the piping spring supports and can subject the steamline to severe deflections and stress. When the steamlines are filled with water for hydro-l static testing, the pipe hangers are pinned in order to prevent pipe movement and subsequent damage to the hangers.
l
?
?
4
. 2.3 Failure of Yalves to Resent The pressure pulses created by the hydraulic forces or slugs of water might result in opening of the safety valves on the steamlines. These valves could be recuired to relieve water or two-ohase flow durino a steam cenerator overfill. The valves-are not desianed for this environment and may fail to reseat.
Other valves whic9 are subject to failure due to the cressure pulses and flow induced loads are le main steam isolation valves, the turbine stop valves and byoass valves and the atmospheric dump valves. Stuck open safety valves, atmosoheric dump valves or failure of the main steam isolation valves to close (when coupled with a downstream pipe break or stuck open byoass valves) could cause the secondary system to blowdown, exacerbating the crimary system overcooling transient initiated by steam generator overfill.
In addition the blowdown of a steam generator from the overfilled condition would result in an unanalyzed primary system cooldown and consecuential reactivity transient.
2.4 Loss of Emergency Feedwater Pump Turbine The preferred method of decay heat removal is via the steam generators which are supplied feedwater by the emergency feed-water system. Dependino on the system design, the pumps may be either turbine or motor-driven or a combination of the two. The effects of water carryover to the steamlines can adversely affect the turbine which provides the motive power to the turbine-driven
. emergency feedwater pump. The steamline for the eniergency turbine is usually connected to the main steamline uostream of the main steam isolation valves (MSIV). Hydraulic forces or liquid in the main steamline could be transmitted to the turbine causing it to trip, rendering a train of the emergency feedwater system inoperable.
Not 011y does the loss of the steam result in loss of the motive power for the turbine but a slug of water entering the turbine could severely damage it and render it inoperable or jeopardize the pres-sure boundary. This is a major safety concern for those plants in which all of the emergency feedwater pumps are turbine-driven, e.g., Davis Bessie, Haddam Neck, Turkey Point, Yankee Rowe, Calvert Cliffs, Oconee.
An additional concern is that a consecuential break in the steamline to the turbine-driven emergency feedwater train may produce a hostile environment for other safety-related systems located in close prox-imity to the steam supply line to the turbine.
In sc v! plants, the layout of the emergency feedwater system is such tNg, the redundant trains of the system are located in the same or adjacent vital areas.
Consequently, failures in the turbine-driven train could interact l
adversely with the motor-driven train rendering the emergency feed-l water system inoperable.
l l
2.5 Steam Generator Tube Rupture l
An additioral mechanism exists for steam generator tube ruptures in l
OTSGs. The overfill of the steam generator cools the tubes faster I
i than the shell of the steam generator. The vertical tubes are fastened on tack
.d at the upper and icwer tube sheet. Since the tubes are cooling f* ter than the shell, the tubes are subject to tensile stra 'es.
Worn or defective tubes could rupture creating a primary to secondary leak.
2.6 Acceleration of Accumulated Water In the design and layout of the main steamlines and attached piping, one of the najor considerations is the stress induced by themal expansion of the piping.
In order to keep these stresses within allowable limits, the piping in contain tent is sometimes provided with "U" bends to acconnodate the thermal expansion. The "U" bends, if they are situated in the vertical plane, could act as a manometer and trap liouid if the main steamlines start to fill with water during a steam generator overfill event. The opening of an atmospheric duma valve, secondary safety valve, bypass valve or any other valve downstream of the "U" bend would cause l
any trapped liquid to accelerate as a slug. The momentum of such l
a rapidly moving water slug could be sufficiently large that the l
forces generated as a result of changes of direction caused by 1
other bends in the piping or the valves could break pipe restraints l
and may cause a rupture of the steamline or valve (secondary side blowdown).
Starting of the turbine-driven auxiliary feed pump which is normally below the main steamlines could also cause the acceleration of an accumulated water column which is likely in the vertical piping. This then would have the potential for possible damage to the main steamline piping as above, but also could affect or poss ?ly rupture the steam ofoina to the turbine-driven auxil;.-v **edwater cump and could cause extensive damage to the turbine.
The acceleration of liquid trapoed in pioing systems may also occur in piping that does not have liquid traps. This could occur in horizontal lines cartially filled with, *auid.
The opening of a downstream valve in this case would cause a rapid flow of steam across the surface of the liouid resulting in possible I
wave formation at the free surface. This could be severe enough to cause the liquid to be swept up to form a water slug resulting in damage to oiping and equipment as described above.
There is the possibility that this type of damage could be caused unknowingly by plant operators as a result of opening the atmospheric dump valves, turbine bypass valves, or starting the steam-driven auxiliary feedwater turbines all of which may be normally done during hot shutdown or normal cooldown. Clearly, the operators need to be cautioned.aout the possibility of accumulated water and the consequences of slug acceleration.
Of course, this type of damage could also be caused by secondary i
side repressurization which could open a safety or relief valve and could not be intercepted by the plant operators.
l 3.0 STEAM GENERATOR OVERFILL SCENARIOS There are a number of failures (B&W identified 20 equipment failures) by which the main or emergency feedwater system may cause steam generator overfill and consequential excessive heat removal from the reactor coolant. Excessive steam generator inventory, particularly in the B&W plants, will result in a decrease in temperature in the reactor coolant system, reduction of reactor coolant volume and, consequently, a pressurizer oressure and level decrease that may cause actuation of the emergency core cooling systen. The reactivity increase due to the negative moderator temperature coefficient will cause an increase in the reactor power level. Reactor trip may result from high neutron flux or low pressurizer pressure.
If offsite power is lost, natural circulation is required to remove decay heat through the steam generators.
Voids may occur in the primary coolint systems due to the rapid cooldown and system shrinkages that could adversely affect natural circulation.
In the event that the steam generators are not available as a heat sink, the feed-and-bleed method can be used.
In this mode of operation the pressurizer power coerated relief valve is opened to remove mass and energy from the RCS. The lost inventory is then replenished by the make-up or the emergency core cooling system.
Another potential consequence of an overfill for the OTSG, may be a combined, primary and secondary side blowdown caused by the rupture of a steam generator tube (s) due to tube /shell thermal differential expansion and a simultaneous secondary break or stuck open secondary safety valve also occurring as a direct cc 4 sequence of the overfill, t
l
~
. The course of an excessive feedwater transient resulting in water in the steamlines is dependent ucon operator recognition and corrective actions. This is assuming that no credit is given for the non-safety grade equipment which may terminate feedwater flow. Actually, operator oversights and errors have been a significant contributor to the frequency of excessive feedwater transients, primarily while the feedwater is in manual control. Correct operator actions are predicated on the ocerator distinguishing between excessive feedwater and other overcooling transients. High staam generator level and high main feedwater flow rate should indicate to the coerator that an excessive feedwater transie'it 1,s in progress. Failure to identify the transient before the steam generator high level alarm is annunciated may oreclude adequate time (less than two minutes for some plants) for the operator to prevent the level from reaching the steamlire.
The analyses in the SARs generally assume that the feedwater is reduced at the high level limit to prevent overfill.
If the feed-water is not teminated, the steamline isolation valves, safety valves, bypass valves, turbin ! stop valves, and steam admission valves and other components for the turbine-driven emergency feed-wt.er train can be subjected to significant forces due to the interaction of the steam and water. The resultant pressure pulse (s) can cause damage to any of these components and prevent their intended operation to mitigate the event. The safety valves may open and vent two-ohase flow for which they were not designed.
In order to remove decEy heat throuch the steam generators, energy must be removed from the secondary side by venting through the
. safety valves, atmospheric dump valves or bypass line to the condenser.
If the main steam isolation valves are closed, the path must De through the safety valves or atmospheric dump valves.
The two-phase flow may damage these valves and as a result, a valve may stay open, allowing the entire contents of the overfilled steam generator to blowdown to the atmosphere. The consequences of this failure can be extremely serious in com-bination with a steam generator tube ructure, e.g., simultaneous blowdown of the primary and secondary systems outside of con-tainment.
For the event in which the dead weight of tM water or condensation-induced water hammer results in failure of the steamline hangers, the steamline may sag and deflect resulting in excessive loads on compo-nents and possible maloperation or rupture.
In general, a steamline break at no load conditions results in a more severe reactivity i
transient than when the reactor is at power due to the increased steam generator inventory. Steamline breaks are analyzed in the SARs. For some plants, the steamline break inside containment is not the design basis accident for containment overpressurization design. However, the increased steam generator inventory at overfill l
condtions may result in higher containment pet.k pressures and greater return to power than that analyzed in the SAR.
l
._ Overfilling of the steam generator may also occur as ( consequence of a steam generator tube rupture accident. Operator intervention during the course of events is necessary to ensure that the rising water level due to the leakage of reactor coolant into the affected steam generator is tenninated before it reaches the main stear line.
The rate of level rise will be further increased in the steam generator after reactor trip due to a reduction of steam flow.
In some plants, the operator is responsible for regulating the feedwater flow to the affected steam generator, reducing the steam pressure below the set point of the safety relief valves, and isolating the steam generator to minimize radiation releases to the atmosehere. Failure of the operator to take correct action in the correct sequence or an equipment failure could result in the overfill of the steam generator, inadvertant closure of the MSIVs and opening of the safety or relief valves. The stean generator tube rupture accident then evolves into a more serious loss of coolant accident outside of Drimary Containment.
An excessive feedwater transient when the reactor is just critical i
l and at no load appears to result in a more severe overcooling transient with a larger reactivity feedback to the primary system than when the reactor is at full power. Steam generator overfill occurring l
during power escalation and increasing load appears more probable at this time since the feedwater is usually in manual control. The severity and rapidity of the transient will vary depending on core
- life and core heat /feedwater flow mismatch. The primary system transient may mask the symptoms of continued feedwater flow and delay termination of the secondary side trcnsient resulting in accumulation of water in the steamlines.
Main steamlines that have "U" bends that can fill with water or main steamlines that can remain partially filled following a steam generator overfill event have a potential for rupture due to the forces generated by the acceleration of the trapped water in the piping.
This acceleration can be caused by the opening of atmospheric dump valves, turbine byoass valves, turbine-driven feed pump steam admission valves, drain valves or lifting of secondary safety valves. Following the termination of the steam generator overfill, some of these valves most likely will be opened by the plant operator to maintain the plant in a hot shutdown condition or to cooldown the plant.
If the operator is unaware that water has accumulated in the main steamline, he could initiate a main steamline rupture or cause severe damage to the auxiliary feedwater pump turbine by opening valves that are normally used to control and stabilize the plant following a reactor trip.
If the steam system is repressurizing, the operator will not be able to intercept safety or relief valve openings which could cause similar damage.
In summary, overfilling the steam generator can be the initiator or the consequence of another transient resulting in a combination of concurrent transients / accidents. These include a primary overcooling
9 l transient, reactivity transient, a steamline break accident, steam generator tube rupture (s), and loss of the steam generators as a heat J
sink. The accident scenario can also include additional cascading events considering a single failure at or a seismic event concurrent with the overfill transient.
}
4
)
. 4.0 APPt.ICASILITY OF THE SINGLE FAILURE CRITERICN A large portion of the defense-in-depth available at nuclear ocwer plants to mitigate the consequences of accidents or transients is achieved by redundancy.
In PWRs, redundancy is generally achieved by designing each safety-related system such that it is comprised of two identical 100 percent capacity subsystems. Therefore, the failure of any active cortponent will not disable a carticular safety funct4 n.
Systems whose function is not the mitigation of accidents or t ansients, such as those provideo solely for power generation, are not provided with any degree of redundancy. Failure of any of these systems (e.g.,
the turbine lube oil cooling system) while it could necessitate a plant shutdown, would not affect the health and safety of the public.
In this category of systems provided for power generation is found the feedwater control system. Failure of this syste= can result in a steam generator overfill as described previously. However, failure of this system also has broader implications; namely, how the failure of non-safety-related systems can affect a previously analysed accident or transient.
It has been generally assumed that during an accident, fail-ure of non-safety grade equipment will not adversely impact the plant.
However, since non-safety grade equipment is not seismically or environmentally qualified, there is no basis to assume that it will not fail or that it will fail in a manner which does not adversely impact the olant.
. Since the nuclear steam supply system and all the emergency safety features are seismically and environmentally cualified, the occur-rence of a seismic event will not directly result in an accident caused by failure of these systems and features. There is, however, th-ootential for overfilling one or more steam generators. The seismic analysis of the main steamline does nat assume the lines are filled with water. Therefore, main steamlines may not survive I
seismic after-shocks following a seismically-induced steam generator overfill.
A steamline break inside containment with an overfilled stean generator would challenge the containment integrity and cause a severe overcooling transient not previously analyzed.
1 Usually, the Single Failure Criterion is applied only to safety-related systems to assure redundancy and performance of their safety functions.
It aopears reasonable that the assumed single failure following a loss of coolant accident (e.g., steam generator tube rupture) could be in the feedwater control system causing a steam generator overfill.
The resulting event, which has not been analyzed in the SARs, may lead to a combined blowdown of primary and secondary systems as discussed in Section 5 of this report.
l
{
. 5.0 COMBINED PRIMARY AND SECONDARY SIDE BLOWDOWN The combined primary and secondary side blowdown can be postulated 1/
to occur by a number of different scenarios.-
One of the scenarios that has been addressed already in this report is possible only for B&W plants because of their OTSG. This scenario starts with the postulation of a failure in the feedwater control system that results in a steam generator overfill. The overfill may cause a rupture of defective steam generator tubes due to the differential themal gradients existing between the steam generator shell and the tubes in the overfilled condition. Another consequence of the overfill (or a postulated single failure) could be a stuck open secondary safety valve or a steamline break. The combination of these two events resulting from a single initiating event could result in a LOCA outside containment.
For PWRs whose high pressure injection (HPI) pumps have a shutoff head above the PORY setpoint another scenario could be postulated as a result of a steam generator overfill that could lead to a combined I
primary and secondary side blowdown.
In this scenario, the steam generator overfill is postulated to cause the blowdown of a steam generator from the overfilIed condition either through a steamline l
break or stuck open secondary safety valve. This overcooling tran-sient, imoosed on the primary system as a result of the steam l
l generator blowdown, may caur,e the primary system pressure to decrease to a level where 'iPI is automatically initiated.
. The termination of HPI relies on operator action, and while sufficient time exists for the operator to terminate HPI, his failure to do so could result in discharging water through the PORVs possibly causing them to stick open.
The return to power caused by the feedback from the negative moderator coefficient will also act to increase the pressurizer leval. This situation could be further exacerbated if the operator trips the reactor coolant Dumos. This operator error may occur if the ooerator mistakes the secondary side transient for a small break loss of coolant accident (SBLOCA). The response of the primary system to the SBLOCA is generally similar to that which could result from the postulated secondary side transient. The RCP trip, reouired by SRLOCA procedures, would result in the loss of some beat removal capability from the primary system that Could cause a faster rise in pressurizer level and Drimary system pressure imposing an additional cha11ence to the PORVs.
The above scenarios were postulated assuming the steam generator overfill as the initiating event. Other scenarios for combined primary and secondary side blowdown can be postulated if the steam generator overfill is assumed to be the single failure subsequent to the initiating event. An example of such an event would be a SBLOCA, caused by the failure of a RCP seal, for example. The usual analysis is done assuming the failure of the single safety-related component causing the most adverse effect. Typically, this component is a diesel generator. This postulated failure causes a loss of one train of r,afety equipment since offsite power is assumed to be
- lost concurrent with the initiating event.
If instead, the single failure chosen was a failure in the non-safety-related feedwater regulating system causing a steam generator overfill, the result could be a combined primary and secondary side blowdown. This assumes that the steam generator overfill causes a secondary side leak.
Another mechanism that can be postulated as a cause of combined primary and secondary side blowdown could be a large steamline break causing the failure of a small instrument line on the primary coolant system, such as those used to measure steam generator differential pressure, resulting from direct or deflected high energy jet impingement.
Conversely, a primary line break inside the steam generator cubicle could also result in failures of level instrumentation lines on the shell side of the steam generator due to direct or deflected jet impingement.
The above scenarios are a few of the ways that a combined primary and secondary side blowdown can be mechanistically postulated to occur.
Although some are less probable than others; namely, those resulting from pipe breaks, it is the view of AIOD that the simultaneous primary and secondary side blowdown is a credible event and should be analyzed.
Operating procedures also need to be developed and operators need to be trained to recognize and respond to this event. This is particularly important since the effects of the secondary side blowdown may mask the primary side blowdown, or vice versa, such that operators may not l
l l
- immediately recocni:e the fact that a combined blowdown is in progress.
This may result in operators unknowingly taking improper actions in their attempts to mitigate the event and stabilize the plant. Before operating procedures can be developed, however, guidelines need to be established for the analysis of the event and the analysis must be completed. With this in hand, the response of the primary and secondary system can be defined in sufficient detail to allow immediate operator recognition of the event and to develop the proper sequence of remedial actions that the operator must take to bring the plant to a safely shutdown condition. The response of the primary and secondary side to the combined blowdown can also be programmed into the simulators to facilitate operator training.
I l
l l
l
. 6.0 AE00 REC 0mENDATIONS Prior operational experiences have challenged the stean generator level instrumentation and feedwater control systens resulting in safety-related implications of unanalyzed steam generator transients and accidents. The lack of safety grade eauionent to ef ther prevent or mitigate steam -
generator overfill and the potential seriousness of the conseouential event have promoted AEOD to recommend that the event be considered as an 2,3,4/
Unresolved Safety Issue.
NRR has agreed that steam generator and reactor overfill transients warrant 5/
treatment as an Unresolved Safety Issue.-
However, consideration of combined blowdown of the primary and secondary systems was not included in their Unresolved Safety Issue based on overall low crobability of the event and credit for opsratcr actions. AEOD maintains the position that until analyses of the event are performed and evaluated for safety significance, the event should be either categorized as a separate Unresolved Safety Issue or included as a part of an existing Unresolved Safety Issue or considered a potential Unresolved Safety Issue pending analytical results. AE00 believes the analyses are required to ascenain
(
system response before operator actions and procedures can be evaluated l
and appropriate training provided.
l AE00 is holding in abeyance a final recomendation concerning the categori:ation of this issue pending the completion of a prompt scooing study of the problem and the results of an analytical study of a representative plant. The analyses should include the potential
. for and system response to combined blowdown of the primary and secondary systems as a result of various consequential combinations of steam generator overfill, steam generator tube rupture, and primary er secondary side leaks.
In the interim until procedure revisions based upon analytical results can be considered, an audit should be conducted to determine whether operators are even aware of such potentially serious situations as steam generator overfill, initiating operation of steam systems having water accumulation, or combined blowdown of the primary and secondary systems from whatever cause. Should an audit uncover that such subjects are '^+,
covered in training croarams nor in procedures, and thus, in general, operators have no awareness or background on such situations, then AE00 would recommend that consideration should be given to initiation of interim actions to develop at least an awareness that these situations are possible.
l 1
l l
~
REFERENCES l
1.
Letter from C. Michelson, ACRS Consultant, to Dr. D. Okrent and Dr. M. Plesset dated June 28, 1979.
2.
Memo from C. Michelson, Director, AEOD, to Chairman Ahearne dated August 4,1980.
3.
Commission Meeting of October 16, 1980 concerning Unresolved Safety Issues.
4.
Commission Meeting of November 10, lieu concerning ATWS.
5.
Memorandum from H. Denton, NRR, to Commissioners, NRC, " Inclusion of Steam Generator t'.'ansients as an Unresolved Safety Issue ( Addendum to SECY-80-325)," dated November 7,1980.
l l
l l
I I
l l
'