ML19341B021

Summary of 801022 Meeting W/Util to Review Design of Flow Control Valves in Auxiliary Feedwater Sys,As Part of OL Review

ML19341B021
Person / Time
Site:	Farley
Issue date:	01/14/1981
From:	Kintner L Office of Nuclear Reactor Regulation
To:	Office of Nuclear Reactor Regulation
References
TAC-12391, TAC-12963, NUDOCS 8101300054
Download: ML19341B021 (15)

Text

.

,/

e

,'o,,

UNITED STATES NUCLEAR REGULATORY COMMISSION o

,E WASHINGTON. D. C. 20656

%,...../

JAN14tsM Docket

9. 50-364 APPLICANT: Alabama Power Company FACILITY:

Farley 2

SUMMARY

OF OCTOBER 22, 1980 MEETING REGARDING OPERATING LICENSE REVIEW On October 22, 1980, Mr. C. E. Rossi and Mr. T. G. Dunning of the Instrumentation and Control Systems Branch met with Alabama Power Company and contractor representatives (Mr. R. George, Mr. H. Bell, Mr. G. Lang) to review desigr. of the flow control valves in the auxiliary feedwate: system.

A sumary of thc review, prepared by Mr. Rossi and Mr. Dunning is enclosed.

L. L. Kintner, Project Manager Licensing Branch ;!o. 2 Division of Licensing

Enclosure:

As stated cc w/ enclosure:

See next page sionco OM

i 4

Dr. Wayne H. Jeas Assistant Vice President Engineering & Construction ggg Detroit Edison Company 2000 Second Avenue Detroit, Michigan 48226 cc:

Eu:ene B. Thomas, Jr., Esq.

David E. Howell, Esq.

LeBoeuf, Lamb, Leiby & MacRae 21916 John R 1333 New Hampshire Avenue, N. W.

Hazel Park,. Michigan

'48030 Washington, D. C.

20036 Mr. Bruce Little Peter A. Marquardt, Esq.

U. S. Nuclear Regulatory Commission Resident Inspector's Office Co-Counsel Th'e Detroit Edison Company 6450 W. Dixie Highway 2000 Second Avenue Newport, Michigan 48166 j

Detroit, Michigan 48226 Mr. William J. Fahrner Project Manager - Fermi 2 The Detroit Edison Company 2000 Second Avenue Detroit, Michigan 48226 4

Mr. Larry E. Schuerman Licensing Engineer - Fermi 2 Detroit Edison Company 2000 Second Avenue Detroit, Michigan 48226 Charles Bechhoefer, Esq., Chairman Atomic Safety & Licensing Board Panel U

S. Nt. clear Regulatory Commission Washington, D. C.

20555 Dr. David R. Schink-Department of Oceanography Texas A & M University College Station, Texas 77840 Mr. Frederick J. Shon Atomic Safety-& Licensing. Board Panel U. S. Nuclear Regulatory Commission Washington, D. C.

20555 i

6 ENCLOSURE REVIEW OF ALABAMA POWER COMPANY AUXILIARY FEEDWATER SYSTEM CONTROL AND PROTECTION LOGIC In a meeting at the Joseph M. Farley Nuclear Plant on October 22,1980, ICSB reviewed the control and protection logic for the Unit 2 Auxiliary Feedwater (AFW) System. Attendees included Alabama Power Company, Bechtel Corporation, and Westinghouse Electric Corporation. The following describes pertinent features of the AFW system and our cor.clusions on the adequacy of the system control and protection logic design.

AFW system (See Figure 1) consists of two nA.or driven auxiliary feedwater pumps and one turbine driven auxiliary feedwater pump. The two motor driven pumps discharge into a conoon header from which flow can be individually controlled to each steam generator by air operated flow control valves (one control valve per steam generator - valves 1 in Figure 1). The control of auxiliary feedwater flow 1s a manual operation by the control room operator.

i The turbine driven pump discharges into a separate header from which flow from the turbine driven pump can be individually'(manually) controlled to each steam generator. Air operated flow control valves are used with ont control valve per steam generator (valves 2 in Figure 1). The flows from the me' driven and turbine driven pumps feed a common line downstream of the control valves that connects to the main feedwater line to the steam generators.

One motor driven pump receives its power from the Train A power source whe las the second motor driven pump receives its power from the Train B power source.

The turbine driven pump receives steam flow from two of the three steam Power for the turbine driven pump steam admission valves (valves generators.

3 and 4 in Figure 1) and the associated turbine controls is derived from a battery / inverter power supply which is independent from the Train A and Train B power sources.

1

. The AFW flow control valves are maintained in the closed position during power operation. On initiation of the AFW system, the protection system causes the control valves to move to the full open position. S,ubsequent action is taken by the control room operator to override the protection system such that he can manually position the control valves to maintain the desired water level in the steam generators. There are three control components for each flow 1

control valve which the operator uses to effect these control actions. The first is a 3 position operating mode selector switch.

Its functions are:

1) to provide an air signal to close the valve in the " closed" position,

2) to vent the air from the valves pneumatic positioner to open the valve in the "open" position, and

3) to feed a control air signal to adjust the position of the valve in the

" modulate" position.

The second is an operating mode selector switch which is common to control circuits for tne tnree control valves fed from the same pump discharge header.

It operates in a manner similar to mode switenes for each individual valve. The third component is a manual loaoing station that varies tne control air signal to the flow control valves.

l The Auxiliary Feedwater System is automatically initiated on sicnals. indicative of

~

loss of main feedwater. For the motor driven pumps the initiating signals are:

1 1.

2/3 low low level in any single steam generator.

2.

Trip of both main feedwater pumps.

3.

Blackout sequet.;e (loss of offsite power).

4.

Safeguard sequence (safety injection signal).

i

- The current design is such that all of the above signals start the motor driven pumps automatically. The logic for opening the motor driven pump flow control valves, however, is such that the valves are opened by a signal indicating that a motor driven pump is running when the valve operating mode switch is in the "close" position. When the valve operating mode switch is in the

" modulate" position, only c afety injection signal will automatically fully open the valves.

The specific initiating signals for the turbine driven AFW pumps are:

1.

loss of offsite a.c. power.

2.

2/3 low low level in any two steam generators.

These signals automattcally start the pump and open the flow control valves regardless of the position of the valve operating mode switches. The turbine driven pump is started by opening steam admission valves to the pump turbine (valves 3 ar.d 4 in Figure 1).

As indicated above, the current protection system logic is such that the motor i

driven auxiliary feedwater pump flow control valves are not automatically fully opened following a low low steam generator level signal, a signal indicating trip of the main feedwater pumps, or a blackout sequence signal if the valve operating mode switches are in the " modulate" position.

In discussions of l

this feature, the applicant argued that administrative controls are adeouate to ensure that the valves are left open during plant operation above 10", power or i

l to ensure that valve operating mode switches are placed in the closed position l

such that the valves will automatically be opened. He also noted that administrative controls are relied on to ensure that other valves in the system are correctly positioned. For example, valves 5, 6, and 7 in Figure 1 are all remotely operated from the control room and must be in the open position for l

[_

F

-4 the Auxiliary Feedwater System to perform its function.

In our discussions we indicated that there is a significant difference in the use of the flow control valves from the use of the other valves in the system. The control valves are used to control flsw during plant startup and are modulated to the closed position when the main feedwater system is brought into use. Both the valves and their operating mode switches would be positioned at this time such that automatic initiation (opening of the flow control valves) for that portion of the AFW system providing flow from the motor driven pumps would not occur. The other system valves are open during startup which is their required position for subsequent operation to perm.f t AP4 system initiation. Administrative controls for these latter valves is appropriate whereas it is not for the ficw control valves. Our position was that the logic should be modified to automatically open the motor driven pump flow control valves for all protection system signals used to start the pumps regardless of the position of the valve operating mode switches. Our position was that this item should be implemented during the first refueling outage of Unit 2 on the basis that the administrative controls involving operating procedures could be strengthened during the interim period. Our position was that the operating procedure for unit startup should be modified to include the specific individual steps for aligning the AF4 system valves and other controls and a sign-off of the individual alignment steps. Currently, the startup procedure references steps within another prcr.edure for aligning the AP4 systems.

The control scheme for the flow control valves is shown in Figure 2.

Redundant solenoid valves SV-A and SV-C are used to open the flow control valves on AFW initiation. They are presently arranged to "de-energize to open" the valves.

On AFW initiation, the removal of power to either pilot solenoid valve causes the flow control valve to open. When the AFW system is in use, the loss of a single train power source would open all of the AFW flow control valves

. Manual resulting in full auxiliary feedwater flow to the steam generators.

control of the control valves from the control room would be precluded under these conditions.

The applicant presented analyses indicating that if all AFW control valves were inadvertantly opened with the three auxiliary feedwater pumps in cperation at hot shutdown, the reactor coolant system cooldown rate wouTd be approximately 180 F/hr. With Operator action to control flow within~10 minutes (by 0

closing the motor operated valves or turning off the pumps), the reactor coolant system would cool down 30 F and safety injection would not be actuated.

0 Without prompt operator action, safety injection would be initiated in approximately 13 minutes and the st am generators would be filled in approximately 36 minutes, assuming the steam generator levels are initially at their full load values. There would be approximately 27 minutes between the time the high high steam generator level alarm is actuated and the time the steam generators are filled.

Our position was that the logic and failure modes of the solenoid valves should be modified such that the loss of a single power supply will not cause the

. control valves to fail open.

The manual control stations,for all of the AFW control valves are presently powered from a single train power source. Loss cf this power source causes the valves to fail open and a loss of the cape 'lity to modulate AFW flow using any of the control valves. Our position was that the power distribution should be modified such that the manual control stations associated with the turbine driven AFW pump are powered from the power source used for the turbine driven pump steam admission valves and related controls. This power is derived from a battery / inverter which is independent of the Train A and Train B supplies.

This would ensure that the loss of a single power source would not eliminate the

. capability of controlling AFW flow from both the motor and turbine driven p umps.

While the failure modes with the current design (i.e., loss of power to one of the redundant pilot solenoids used to fully open the control valves or loss of power to the manual control stations) cause undesirable transients resulting in inadvertent plant cooldowns, such failures are considered unacceptable with respect to the safety function of controlling auxiliary feedwater flow following its initiation by the protection system. Other actions which could be taken to limit auxiliary feedwater flow, e.g., closure of block valves, controlling the turbine driven pump speed, tripping pumps etc., are not considered an acceptable alternative in the long term. These actions do, however, provide the basis to conclude that it is acceptable to permit plant operation until the first refueling outage of Unit 2 at which time modifications should be implemented to resolve these concerns.

There is one additional aspect of the flow control valve power source dependence which is worthy of mention. As was previously noted, the two motor driven pumps are supplied power from Train A and Train B power sources, respectively. However, the capability to control AFW flow supplied by the motor driven pumps is dependent on the Train A power source that provides power to the manual control stations. There does not appear to be any simple modification which would permit the system to incur a loss of either the Train A or Train 8 power source and still retain the capability to modulate flow We conclude that the turbine driven pump and associated from these pumps.

flow control provide the capability to satisfy the redundancy requirements for this aspect of the design in order to satisfy the single failure criterion.

.- Design features are provided to limit AFW flow in the event of feedline or steam line break. Orifices are installed 'n the auxiliary feedwater lines to ensure that innediately following initiation of the AFW system all auxii'ary feedwater does not flow to a steam generator affected by either a feedline or steam line break. Two motor operated valves (valves 5 and 6 in One Figure 1) are provided in the AFW lines from the motor driven pumps.

valve in each line is powered from Train A and the second from Train B.

These valves are normally open and would be closed by operator action to stop flow going to the affected steam generator following either a feedline or steam line break. The redundancy provided to assure that such breaks can be isolated compensates for the fact that the flow control valves could not be relied upon for this action since they are dependent on a single power source to modulate or effect closure. However, the overriding consideration is probably the fact that the flow control valves fail open on loss of air.

This will be discussed later. We may note that our position with respect to modifying the power source for flow control valves associated with the turbine pump will at least ensure that if power is available to operate that pump that same power source will permit the flow control valves to be closed such that the turbine driven pump could supply the balance of the l

steam generator for line break events.

l The steam admission valves for the turbine driven AFW pump shown in Fig 1 areair controlled. Valves 3 & 4 require air to open and valve 8 is l

i air to close. As previously noted, the electrical controls for these valves i

are ;;owered from a battery / inverter supply which is independent from both ae Train A and Train B power sources. -The instrument air system is not safety l

grade. Since valves -3 & 4, require air to open, these valves have safety grade accumulators which are isolated from the normal non-safety grade air supply by two check valves in series (only one is shown in Figure 1).

The i

. accumulators have a capacity such that the steam admission valves can be maintained in the open position for approximately two hours. Air can be locally manually re-aligned to the steam admission valves from two seismically qualified air compressors which are supplied power from Train A & B, respectively. The normal air supply is composed of three air compressors any one of which can be powered from safety grade power sources.

The diesel generator capacity is such that only one of these compressors could be supplied power along with other required emergency loads under maximum load conditions.

The use of two series check valves to isolate the turbine driven pump steam admission valve accumulators from the normal air supply differs from the Unit 1 design. The Unit I design utilizes a check valve and a solenoid operated valve, which closes by action of a pressure switch on low pressure, for the isolation. There is presently no way to independently verify by testing the operability of each check valve in the Unit 2 design.

The advantage of the Unit I design, i.e., diversity and the fact that it is easier to verify its operability by testing, appears to make it a more reliable system for performing the required safety function. Our po-ition was that the design for the isolation function should be the same for both

'its.

We also requested information on the design basis for the isolation

. tem to address a rapid and a slow depressurization of the normal air system as well as the method of independently testing the redundant means for isolating the accumulators from the normal air supply. We requested that the concerns contained in IE Bulletin No. 80-01 related to the check valve seat material also be addressed.

In view of the importance of the steam generator atmospheric power operated relief valves to effect decay heat removal using the AFW. system, we reviewed

. the power operated relief valve controls. The three power operated relief valves (one per steam generator) are air operated, with air required to open the valves.

In the event of a loss of the normal instrument air supply, the two seismic qualified air compressors p.eviously discussed can be used to provide air to modulate these valves. Control devices are provided near the air compressors which are used to modulate the relief valves on loss of the normal air supply.

Details on the design of these features were requested for review. The electrical power source for the automatic pressure controls associated with all three valves is from the same trein power source.

In view o'. this, the applicant was asked to provide information on the power source for the condenser steam dump valve controls to determine the extent to which the two means of controlling steam generator pressure are independent. While it would be desirable that a Joss of an instrunent bus would not fail the atmospheric power relief capability for all three steam generators,a simple solution does not exist which could be implemented I

in a way that it is consistent with distribution of power sources at the l

front end of the system; i.e., AFW controls. Our conclusion with respect l

to this aspect of the design is that in the short term following an AFW l

initiation event, the safety valves will probably lift due to the low capacity of the atmospheric relief valves.

In the longer term the bypass to the condenser would probab?? be effective as a means of controlling steam l

generator pressure for the more probable events that do not preclude its In the longer tern,for events in which the condenser dump is not use.

available, the manual control scheme using local controls at the seismic Class 1 i

air compressors would provide an acceptable means to control the atmospheric relief valves,if normal control is precluded. Hence, we believe it is desirable that there should be some independence between the power sources used for the atmospheric relief controls and those for the condenser bypass l

centrols, whicn is the point of our outstandino reouest for information.

Throughout our evaluation of the AFW system we have taken the approach that the safety function does not end at the point of establishing full AFW flow to the steam generators.

In addition, it is an integral safety function to be able to utilize those control features, namely the flow control valves, to subsequently maintain the desired steam generator level as is done during normal plant startups.

In the absence of specific acceptance criteria for those systems, we have exercised our judgment upon whtrh we based our conclusiors. Certainly the fact that a number of valves in the AFW system are dependent upon the non-safety related instrument air system is a weak point in the design. However, barring a mechanical failure, there apoears to be a sufficient basis to assume it 1s available for a-broad spectrum of events.

If it is not available, there are alternative actions that can be taken to ensure safe shutdown.

In any case, short-term actions required to initiate the TFW system are not dependent upon its availability.

As a final comment, we note that our positions will likely result in a major-redesign of the control system. The're are some aspects of the present design I

which we have not addressed herein that do not appear to be well engineered l

from a human factors view point. We will request that the Human Factors Branch look at future design modifications resulting from this review.

l l

l t

e tM 0

k t

O i

H vO t

r

' o,',

t 0i t t N s O 0

A a 0 t

u D

I I

A t

af T(

8 r o D u t.

O H l

t Ll At' v

r 1

W se o

d nO " o, i

i g

V O C t

t -

g AvN ohuk rVt n H v *" xO Lti At k

e t

i l

it tG A

C H C "

l

L O Ot k

t C L ot ut L h o v ""

,o t t

rA t

k t

t L

Ar ul Ls o

V A A O P

rA t

C 4

U t

4 aO

" u o

A Ps C

M F

r L

L 4

Av( oovI 4

V(

t C

i

,6

]

D C u C u

M [A N

t f

t t

L s

B kM I

uo L

O A

mo

,t

,i k

t L

I A

l

. i i

f l

G A s I

ur u

ue 7

O

/

N 5

s

=

D oE 38 t.

M o

=

K t

F g

?

C g

O o'eu O

M r

MO L

1 V

s &

Os t

f e T t L t

N H

O

(

O I

$ f u W

O H

A $ t I

O o

4 l

T O<

LN tN rt 5

V A N tn O A LH O l

gX LN O

L>

F F At C

L 1 v ru l

oL A t N h

N N

N N

M V O L H L H C l

5 O A l A O L

V AuY d

g e

P i.

a L

d Ot L ao t

g s

f 4

s t L n

u y

,0 0

g s

N f I

7 h

4u

,6 W

isu S

yY y

A l

o H

t s s

tt t

O ca 0

t I a u s

• t At o s.

c 1 1

, i 5 O s lAt wys f

g u

t sur S

iog

l i

g H t I

g L

s ue

t y

I g

V G rnt dl u, O

e s.

i Wg L

l O

A ots :tu 21 s

s LN a-

- O e h FF Lx O

g V M us LN O

vt y

t f

e L

L. uHr i

t a

L l

L u s

A A MsC i

l J

OuJe a

I 1

)

u y

I 2

J A

O O

i L

L X

X l) s

\\/

o t

t v

L 3

A V

l1 O

i

%O li 4(

s a

l o

o A

L L

p t

4f u

a I

L e

t l

A u a A

j o

I i

R W

^

A t

n Wt t

L O

L N

r O

C L

v l

O IVt u

C g, 1

D i

i o

C6 I

u t

e g

h 8L i

u V

a M, H l

a p N

O 5

t t

o T 1 y

L s

A d 4 [h t

lJ hg

~

o4 N

g{

N C

C

) N/

L q;8 e

M g8 L

O

~

u M

g e n t

a t

l A o,m

~

L o

D i.t f

p I

g u

!llI[(

t G

=

b f

C i

u X

s s

u a u o

h t.

A

. oi f

~u, i.

xMm

J t <d a

~2 n

0%

JW 4 4}- J o)l m

3 2u S 3

~

• J F TM 2 70 7 Fd G s 7

2+

C,9d?oG N'

H U

Ds Ig g si d

w O

i d

%h!!

- f e@-s c:

a pq s

f e2 m,,,

=

)

k R}b 5

D l

P ug}!,

I se~! ; 4 +1 4"

ih i

l r

pse

_s:

= oM P E b

M D

4

4. u

(

--+ $

<g 3 (y h

.Ph.$,S O

6

'I

.t 5*IE e'

C

=?

a G

D u 1 Q

u%

2

e 9

MEETING

SUMMARY

DISTRIBUTION Docket File D. Muller NRC PDR R. Ballard JAN 14 EMH incal PDR W. Regan C NSIC ]

D. Ross 6tc P. Check TERA R. Satterfield NRR Reading

0. Parr LB #2 File F. Rosa H. Denton W. Butler

'2 l

E. Case W. Kreger

[~,

D. Eisenhut R. Houston

["

R. Purple T. Murphy

._5 B. J. Youngblood L. Rubenstein A. Schwencer T. Speis FM F. Miraglia W. Johnston Y

l EQ J. Miller J. Stolz

i co G. Lainas S. Hanauer Fi Il m

R. Vollmer W. Gammill o

i J. P. Knight F. Schroeder R. Bosnak D. Skovholt F. Schauer M. Ernst R. E. Jackson R. Baer Project Manager d'

-fr C. Berlinger.

}

Licensing Assist (nt MService K. Kniel Attorney, OELD G. Knighton I&E (3)

A. Thadani ACRS (15)

D. Tondi R. Tedesco D. Vassallo G. Lear J. Kramer V. Noonan P. Collins S. Pawlicki D. Ziemann V. Benaroya Z. Rosztoczy W. Haass NRC

Participants:

Others:

[E. hk e_(1 V 61f3 (D. A s Fav'&

BCC: Applicant & Service List L

-