ML20027C074

Advises That Operator Action Necessary to Protect B&W Plants from Excessive Feedwater Transients.B&W Plants Do Not Employ High Steam Generator Level Turbine or Reactor Trips to Protect Against Transients

ML20027C074
Person / Time
Site:	Point Beach, Sequoyah, Arkansas Nuclear, Crystal River
Issue date:	09/12/1980
From:	Creswell J NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:	Michelson C NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
References
TASK-AE, TASK-E013 AEOD-E013, NUDOCS 8210120380
Download: ML20027C074 (34)

Text

- - - - -

24 UNITED STATES k

-[

g NUCLEAR REGULATORY COMMISSION 3

j waswiwarow, o.c.aossa AE0D/E013

\\o SEP 121980 This is an internal, pre-4

.t decisional document not P

necessarily representing a position of AE00 or NRC.

MEMORANDUM FOR:<

Carlyle Michelson, Director Office for Analysis and Evaluation of Operational Data l

FROM:

James S. Creswell Office for Analysis and Evaluation of l

Operational Data I

SUBJECT:

EXCESSIVE MAIN FEEDWATER TRANSIENT

-Discussion I have reviewed the status of B&W plants for protection from excessive feedwater transients. B&W does not employ high steam generator level turbine or reactor trips to protect for this transient. Operator action is required to provide this protection.

Transient Significance In the draft Arkansas Nuclear One, Unit 1, Abnormal Transient Operating Guidelines (AT0G) section on excessive main feedwater (enclosed), B&W states that:

Excessive main feedwater is defined as the sustained addition of more water to the steam generator than can be boiled off by the available core heat to make superheated steam. This mismatch between heat source and heat sink will cause the steam generator level to rise and will cool the reactor coolant down. The severity and rapidity of the transient ~will vary with the size of the mis-match. Under worst case conditions (i.e., maximum mismatch) the excessive main feedwater flow must be terminated within two minutes to prevent water spillage into the steam lines. Thus, this is a transient that may require fast operator action.

In establishing the significance of an unmitigated excessive feedwater transient, the guidelines state that:

I If the excessive addition of feedwater to the steam generator is not stopped, water will spill into the steam lines. The ability of the steam system to maintain its integrity with water spillage is not known therefore it is very important that the excessive feedwater transient is terminated before spillage occurs.

In addition, it is highly desirable to stop the RCS cooldown before the pressurizer is i

drained and ESAS actuates. This will significantly reduce the mag-nitude of the transient and number of operator actions required, as well as limi.t challenges of protection systems and allow for quicker recovery to stable plant conditions.

I U10120300 800912

~

l PDR MISC b

7.

i-

__'_1~___-------_---

~

55 Carlyle Michelson It.would appear that certain aspects of the transient - water spillage into

[

the steam lines - are unanalyzed.

B&W recognizes the demands that such a transient places on the operator.

They. state in the guidelines:

Excessive feedwater is probably the one transient the operator must react to faster than any other transient.

The excessive feedwater transient is not a low probability transient. B&W recognizes that there are several possible causes for the transient. They state:

Excessive main feedwater is a complex accident which can be caused by about 20 different equipment failures (operator error with the feedwater control in manual can also happen).

Previous Events At least one transient involving excessive feedwater at a B&W facility has occurred. On March 18, 1977, Crystal River Unit 3 experienced such a transient.

The operator recognized the excessive feedwater and took control to bring feedwater flow for the affected steam generator on scale (it was offscale high) in approximately 1 minutes. The reactor trip (85% power level due to startup testing) occurred a little before this time. The overfeeding started because feedwater pump "A" failed and went to full speed. The steam generator did not fill and water was not spilled into the steam lines.

No LER was filed on this event. A mention of a reactor trip was found in the April 1977 " Gray Book." A review of IE inspection reports revealed no mention of the event.

Status At the present time, 3 licensees, Florida Power and Light (Crystal River),

Arkansas Power and Light (ANO-1), and Sacramento Municipal Utility District j

(SF~~) have. formulated plans to install automatic features to prevent excessive fu ster events. NRC review of these modifications should begin by November 1980.

3

~

• ay understanding from talking to the licensing project managers for Oconee j

tvis Besse that licensees associated with these facilities have no plans

.ae installation of overfill protection.

' Jan es S. Creswell I

Office for Analysis and Evaluation j

of Operational Data

Enclosure:

As stated l

cc w

losure:

I b.

.anning -

H. Ornstein

[

N g

d APPENDIX A EXCESSIVE MAIN FEE 0 WATER

'2 1.0 GENERAL TRANSIENT DESCRIPTION Excessive main feedwater is a failure to control secondary pt,

p" inventory.

It is an overcooling transient that results in too ic

• f much primary to secondary heat transfer.

^4,

s I.

Excessive main feedwater is defined as the sustained addition of more water to the steam generator than can be boiled off by the

),,,

available core heat to make superheated steam.

This mismatch between heat source and hest sink will cause the steam generator le' vel to rise and will cool the reactor coolant down.

The severity and rapidity of the transient will vary with the size of

j..,

tile mismatch.

Under worst case conditions (i.e.,

maximum h,h.

mismatch) the excessive main feedwater flow must be terminated C

M within two min!stes to prevent water spillage into the steam 3<.

l,[

lines.

Thus, this is a transient that may require fast ocerator action.

':O '

Ori tdi-

.!3 it j p, As the reactor coolant temperature decreases, the RCS water J

a y,i..

fQ volune will shrink, dropping pressurizer level.

This in turn eQ.

-j,j,(

causes RCS pressure to drop.

In the secondary side, while at y@f,.

power, the excessive feedwater wil.L cause a loss of superheat and may cause a slight reduction of steam pressure. A reactor trip

• l I

'/d.

A-1

.LN '

' t *j i l

l l

~.

may occur on low pressure or high flux.

If a trip occurs and the excessive feedwater continues, the mismatch will be much larger 1

(less' core heat) and the steam generator fill rate and RCS cooldown rate will increase.

If the shrinkage of the RCS water

,p.

volune is sufficient to drain 'the pressurizer, the RCS will 9.2 i

j

.c rapidly approach saturation conditions and ESAS will occur.

A i}

1055 of subco.ol.ing_.n!a_tgin will_ require that the RC,, pumps be tripped and EFW be started.

EFW flow will make the overcooling U

j of the primary system worse.

However, EFW flow can be throttled,

I

]

j to obtain a gradual increase in SG level and thereby limit the overcooling, if the loss of subcooling margin is caused only by the overcooling it will be temporary. When the subcooling margin f

is restored HPI can be throttled and RC pumps can be restarted.

4 l

.t.

h:~-

j If the excessive addition of feedwater to the steam generator is.

j not stopped, water will spill into the steam lines.

The ability,.

4 1

of the steam system to maintain its integrity with water spillage 4

is not known therefore it is very important that the excessive feedwater transient is terminated before spillage occurs.

In

?y addition, it is highly desirable to stop the RCS cooldown before l,;

the pressurizer is drained and ESAS actuates.

This will

'.l l

-. }

significantly reduce the magnitude of the transient and number of operator actions required, as well as limit challenges of caia) protection systems and allow for que er recovery to stable plant i

}

conditions.

~~

N A-2

%+

j

.a a

---w.-

1

NkN[h

}'

c, s

h In g:neral, cain feedwater overfeed can happen in three ways:

,I f

1.

A f ailure of the Feedwater Control System to run back af ter

!l '

reactor trip.

2.

An operator error of feedwater control while in manual.

j 3.

Equipment failure when the plant is in automatic j'

ii operation.

e lj, a

[I

!il F

Excessive feedwater can occur at any time the main feedwater I

'?

l system is'in operation.

The plant may be tripped or at power.

i.

,!h The steam generators will fill at different rates depending on 1

kl.

what the plant power level is when the high flow begins.

The rate of fill of the generator will be greater when the reactor is F) hl at low power (or tripped) than at high power.

The overcooling 6,si effects on the reactor coolant systm will be greater at low

!(

II power.

The reasons are that at low power less core heat exists I

rft to boil off the additional feedwater and the feedwater system h

(valves and pumps) has a lot of capacity left to overmatch the f

p low reactor power.

At full load, the valves and pumps are near l

/

' i full capacity and cannot open much more to increase. feed flow.

E P:

I Because the effects of excessive feedwater are different across the power range and because it can be caused by different failures, the rate of the Reactor Coolant System response will be I I, different depending on what has happened.

But all excessive i.

~~

h feedwater additions will look similar, hn Y

I A-3 L.:,

0.'

i a

I

.. - 7 y e.

~ ~ ~ - - - --.,_-... ~. -,..

a s

The P-T curve and sequence of events shown in Figure A-1 depict a I

typical main feedwater transient that is terminated by the ICS

[:'.

before water enters the steam liner or the pressurizer is

f.'

st drained.

The transient shown is also applicable if terminated I

- T

! 'r early by the operator.

C 1

l

[.

l i ! l

~

t The P-T curve and sequence of events shown in Figure A-2 depict j

[

. c,

{

an excessive main feedwater transient that is not terrninated

.\\

l before water enters the steamlines or before the pressurizer is

{

dra.ined.

The transient is initiated by a reactor trip from 100%

.i 1

l power with a f ailure of feedwater to runback on the A steam 1

generator, j

i I

,1 H

Several important points should be noted regarding this

1 j

transient:

~

gj The affccted steam generator can fill very rapidly, in this 9

l

-j case three minutes after the reactor trip. Thus, if the failure causing the excessive feedwater condition is not

)

corrected by the ICS the operator has little time available l

to prevent spillage into the steam lines.

c.

'l l

The operator is required to trip the RC pumps and raise i

0TSG levels to 95% on the operate range with EFW if the

..i. I

.}

subcooling margin is lost. The additional cooling from EFW g

1 worsens the transTent and, in this case, tne reduction in i

.EB.

'b steam pressure in OTSG B due to the EFW flow eventually

.9 results in SLBIC actuation, which finally terminates the 1.y y

A-4 4

m A

1

~

Figure A-1 EXCESSIVE FEEDVATER TERMiliATED'

. I' BY ICS

.2

' I:

2600

.hI 2400

'2200 y 00 l4 i

U 2000 2

i. _ _ _ a 2

a

' ['

1800 SUSC00 LEO 3

j SUPERHEAT Wy REGION REGION

,g.,

5 1600

{

' 117 Tj

.d.* t 2

1400

'j,}h.

]

AFFECTED SG g

,E 1200 STEAM PRESSURE W'

E 1:

.'h:,.

j 1000 END POINT POST TRIP WITH 4

FORCED CIRCULATION (TH0T &

EII Y

800

~1 2

SUBC00 LEO TCOLD) AND FOR NATURAL fy CIRCUL ATION (TCOLD) 3 MARGlH

- [4

!;fy 3

'600 LINE NORMAL OPERATING POINT-POWER

~.l4 '.

=

OPERATION (TH0T) 400 p END POINT POST TRIP WITH

' J NATURAL CIRCULATION (TH0T}

I I

t i

I 400 450 500 550 600 650 700 Md, Reactor Coolant Ane Steam Outlet Temperature-F 7

Reference Time

,,f,3 Points (Seconds)

Remarks T

0 Excessive feedwater addition begins.

.'4 f.J 1-2 0-60 Slight overcooling of RCS occurs' due to excessive feedwater addition. ICS pulls rods to compensate i

for reduction of Tave.

2 60 Reactor trip on high flux or. low pressure. (Note:

Depending on severity and power history, a reactor trip may or may not occur.)

2-3 60-200 RC P&T decrease due to loss of fission power and i -

higher than normal secondary inventory. The ICS initiates a feedwater runback and the MFW addition stops. Pressurizer level decreases because of reactor ccolant contraction.

3 200 Minimum pressurizer level reached.

3-4

>200 Normal system pressure restored by RCS reheating, operation of MU system, and pressurizer heaters.

Prirrary system is left in a stable, hot shutdown condition.

Figuro A-2 EXCESSIVE FEE 0 WATER NOT TERMINATEl 4;

BY ICS 2600 2400 POST TRIP

=a WINDOW a.

2200 3

SUBC00 LED

~

/,.

y 2000 REGION

. g,i -

2 SUPERHEAT a-

'p,.

O 1800 3

REGION 1600 J

3 UNAFFECTED SG

f, 1400 STEAM PRESSUR

-f w

'!e.

3 AFFECTED SG E

1200

'{..

STEAM PRESSURE

[

9. ' '.

y

_2 34_

5 END POINT-POST TRIF WITH j

1000

-h-- - -- -

hFORCEDCIRCULATION(T H0T I

.}.if g

800

\\

TCOLO) AND FOR NATURAL g

CIRCULATION (TCOLO)

~

3 NORMAL OPERATING POINT POWER 600 5

OPERATION (TH0T) r 1 END POINT-POST TRIP WITH 400 SUBC00 LED MARGIN LINE L..j NATURAL CIRCULATION (TH0T)

I f

f 1

l 400 450 500 550 600 650 700 T.

Reactor Coolant Ano Steam Outlet Temperature-F

.c.. -

Reference Time points (Seconds)

Remarks 1

0 Reactor trip from 100%. MFP A trips on preselect.

MFW block for OTSG A sticks open. ICS begins to open MFW cross-connect valves and overfeed OTSG A.

t 2

60 Operator senses rapidly decreasing pressurizer level t

and RCS pressure and starts HPI. OTSG A level 70%

y on operate range and increasing.

3 180 OTSG A full.

.i,-

4 250 Pressurizer empty. RCS rapidly approaches saturation.

i On loss of subcooling margin the operator trips RC pumps and EFW starts.

5 330 EFW flow ttf OTSG B causes steam pressure to decrease and initia4e SLBIC. Subsequent closure of MSBV's will stop the B MFP and terminate the excessive MFW to OTSG A.

6 410 The excessive MFW to OTSG A has terminated and the operator has terminated EFW to OTSG B at 95% on the operate range. Refill of the pressurizer by HPI has begun to repressurize the RCS and subcooling is regained.

o excessive MFW flow to OTSG A by stopping steam flow to the B MFW pump turbine.

However, the operator should throttle EFW flow to obtain a gradual level increase.

(see Part II.

Section l.E. "Best Methods for Equipment Operation").

Excessive MFW flow to OTSG A was allowed to continue for almost three minutes af ter the steam generator was full.

Thus, a significant quantity of water was spilled into the steam lines with the potential for severe consequences.

Since the consequences are not known, this discussion does not describe those effects.

Even though the operator started HPI early in the transient, the HPI flow was not sufficient to overcome the 8

shrinkage due to the cooldown and the pressurizer was drained.

Once the overcooling transient has been terminated, the RCS will reheat and the water volume will swell. Since a large

,f(' -

quantity of cold HPI water was added to the RCS, the e.%

'((jy

' operator must act to prevent the pressurizer from going l1.W

,vy,.

solid.

This will be discussed in more detail.

.,gge.

Jr..' -

,N

?>

hyn.

,Mg.-

Actual Plant Excessive Feedwater y'

'd *j On 3/18/77, an excessive feedwater transient occurred at an s

);,

operating plant.

The transient was not serious and the plant u...

M#[

ended in a good condition because the operator recognized what R.,

Rif 3 iS,j.

was going on and took control quickTy and the excessive feedwater

. ', m.ly;),.';

was terminated automatically by the ICS af ter reactor trip.

The steam generator did not fill and spill water into the steam Mk.

J p,i.

A-5 2.yg

,k.

!,IRI i-

o{

c lines; that is the most important limit for this transient.

The operator also turned HPI on and prevented the pressurizer from draining and that is another important limit.

Because the I

t-I cooldown was stopped before it got very far, the operator did not have to take drastic action to prevent filling tne pressurizer solid because of reactor reheat.

Af ter trip, the HPI was c t back.

[

~

The plant was operating at 75% in a power escalation sequence.

Because of the power escalation sequence, the overpower trip setpoint was set at 85%.

The overfeeding started because main feedwater pump "A" failed and went to full speed.

s

i. i,

.)

The plant data shows main feedwater abruptly increasing to full flow on generator "A" and within about 30 to 45 seconds, it's 1,

affects appear in other signals:

"A" generator level goes up, j

T,y drops (because of the inci eased heat transfer),

-z 6

3 s.g pressurizer level drops (oecause of shrinkage due to lowered j

T

),

and RC pressure lowers -(because of the lowered M

c q

pressurizer level).

When T,y began to drop, the ICS pulled i

rods to try and keep temperature steady. The operator sensed the l

change in plant conditions almost imediately and quickly 14 diagnosed the problem and took the right kind of action.

_He aq

.tried to cut back feed flow.

He did this by manually reducing a

m the feedwater demund; this did not work (more about this later).

4 M

i 1

.g

.)

A-6 el 4.

-=W

m-DRAFT He then put rod control into manual to try to raise T,y, and he also started HPI to bring back the pressurizer level.

The

)

reactor then tripped at 85% power because of the -low overpower trip setting.

When the reactor tripped, the ICS switched into track and controlled the feedwater on level; because of the high steam generator level, the " A" main feedwater valve closed stopping the transient (the "A" startup flow also closed down) and the "B"

generator startup and main valves controlled to maintain the level after trip. When the plant tripped, the large inventory of cold water in the " A" generator cooled down the reactor coolant considerably (illustrating the effect of removing 8

..T -

the core heat to boil off the water).

The reactor steam N

sgenerator heat transfer interplay is shown well by this example.

After the

trip, the reactor pressure increased and the pressurizer level increased; this is largely due to HPI.

in

- Qf

ig.

A look at steam pressure shows a very slight reduction (before r*

- g;...

trip) because of the cooling and condensing effect of the excessive feedwater on the steam in the generator.

This I N:[.

illustrates the magnitude of steam pressure loss to be expected i. "'U

}f h;-

because of excessive feedwater; a greater loss would indicate an

~{ 5{,}

additional failure that the operator would have to correct for.

s jv3,,)

The reason "A" pressure is lower than "B"

af ter trip is mostly

-Er l

because of one mis-set safety valve; the water in the generator wouldhavesomepressurereduct11neffect,butitwouldbesmall.

4[ g.,

The lower steam pressure did have some effect on overcooling, but because it was only about 100 psi low, the effect was small.

u 4w).;

A-7 4Q,b"

.y a-

+

w

F-

u. A... a'E4 v.

j, This steam pressure loss was mostly an inconvenience; if it h6d W

i been greater (about 200 psi),

the pressurizer could have

[*[

drained.

hi

..?

When the transient was over, the "A" steam generator was about 1/2 full.

It took about two minutes to increase the level about 200 inches; most of the filling took place before. trip when a high reactor power (75% to 85%) was available to boil the water; off.

The steam generator level increase was about 150" during '

this time (or about 3/4 of the total increase).

If a main

~

feedwater failure had occurred af ter trip, the rate of level rise would have been much faster. Excessive feedwater is probably the.

t one transient the operator must react to f aster than any other s

transient.

The steam generator can fill and water can spill into 5

i i

the steam lines in., little as 3 to 4 minutes (after trip). The operator must act fast to stop feedwater and the equipment he n

chooses to use is important.

He should understand that the I

I equipment he elects to use may be the component that failed b

i 4

I

~

causing excessive feedwater and therefore may not respond.

Thus k

g he must be prepared to switch to an al' ternate device if necessary m{

to terminate feed flow.

T 'i i

E g

3

~

When the operator tried to correct this accident, he made the a

right choice of action 3 cut back feeowater Cut the equipment he M

used did not respond. Te used the ICS feeawater demand to try to 4

run back the feed pump and valves. A post trip review showed g'?*

i A-8 n

.m

.g f

9 s

that the feedpump controller had failed.

It was essentially dead, and no signal would have made it respond.

Excessive main feedwater is a complex accident which can be caused by about 20 different equipment failures (operator error with the feedwater control in manual can also happen).

The ICS can have several failures.

The acci _nt can be too fast to try to figure out what failure has occurred.

Therefore, the best way to correct a very fast overfill is to use the direct controls to trip both main feedwater pumps.

Adequate time will be available to regain MFW or EFW to at least one SG.

Tripping both MFW pumps is the fastest method to stop excessive MF,W flow and should prevent water entering the steam lines for even the most severe MFW transient.

However, for much slower f.ill rates, or if a pump should fail to trip, the operator should isolate feedwater to the SG with the high, increasing level by closing the MFW control and. isolation valves.

The following figures show actual plant data from the above

+,

transient.

Note the large disparity between levels and feedwater f

flowrates for the two steam generators.

This magnitude of c.in mismatch should, and did, facilitate rapid recognition and response by the operator.

M

=w A-9 t

meee

Figure A-3.

ACTUAL PLANT RESPONSE DURING dN EXCESSIVE MAIN FEEDWATER TRANSIENT (RCS AND FEED FLOW PARAMETERS)

.a t,

m O

.3 g

a.

LEGEND t

er

~

u RC PRESS a.

er 140 Ni POWER I

100 120 2250

******""*******'~*..%*-...

T 90 g

..t

=

e-100

- 2200 80 f

"N. s.

P2R LEVEL

% ^-

~,s 80 2150 580 yo 2l00 60 T.N.\\

-. ~.

60 N.

2050 570 50

.K' to s

s'-

K.

e 20

- 2000 no l

. s 0

- 1950 560 30 d

-20

- 1900 20 i

(jI

-50

- 3:50 550 iO t

\\.

p.

-60 18100

\\

0 8'

t f

f 9

f f

t t

t f

f 9

9 9

t O

30 60 90 120 150 180 210 240 Rx Trip LEGEND

....f..

MAIN FDW FLW A 3

.a -

6 T,

g S

MAIN FDW FLW 8 n-g~

_._.. STARTUP FDW FLW A

- (

E *.

a e 3'5

.5 g

,e

...STARTUP FDW FLOW B 41 th.

a =

l.6 - u I\\

A g/

l.

3 b

i lg; i.2 V

i j

i

. t. " '

g;g.;

i,0

[

j f

e 0.8 2

I

.t.

i I

.j l

l

? '.

0. 6

(

j [.

l l

l 0.u -I

.g if

^

s O.2 I

. c.~2

.I

0. 0 - 0 7- i v il,

37 r

e e _

i e

fgo.

0 30 60

.r4 120 150 180 21:.

240

%A "t,.u.

Tisc. Sec w..

7.*

.g.

'.1Y EU.

'4T: '

.p,

.V

4 Figure A-4.

ACTUAL PLANT RESPONSE DURING AN EXCESSIVE MAIN FEEDW5TER TRANSIENT

~ ~

(STEAM GENERATOR PARAMETERS) 1050 -

bs 450 -

k, \\g 3fg g

\\

r PRESS

\\

1000 400 i

\\

S/G

'N 4

\\

5 A

350 a

\\

,f S/G A PRESS s

.=

950 300

~~,

q

.250 900 200 l

' m.-d i

1. 2 150

_N T

j,

3fg 850 100

'I

\\

LEVEL B f a

50 N

800 i

i 30 60 90 120 150 180 210 240 a

s?

Rx Trip y <.

M

~

t..

. -1s.:

M.s..

)*

i 2.>.

.s.,

A e se e.

e

~

DRAFT 2.0 OPERAT_0R ACTIONS SUMMAR_Y_

~

~

Immediate Actions Attempt to close feedline isolation valves if he overfill is slow and the affected generator is obvious.

Trip running MFW pump to stop fast overfills.

Start EFW and verify operation; control EFW to limi overcooling.

~

Start HPI if pressurizer level is less than 40" nd RCS

=.

pressure is decreasing.

Follow remainder of Part 1, Section 111.C.

~'

3; 4-

-t Identifyino Symptoms

- Excessive feedwater is an overcooling transient as shown below:

2600 2400

!m U

Y PO3T TRIP

~

h 2200 plN008 e.

.t- - -

'a G

5 2000 i

b-5 5U0C00Lt0

'E} f 1900 REC 10N

$UPERH[AT 3 A,

~

5 1600

[::

REGION

,D

=

1400 l

=~

l E

a F' li 1200

- STEAN PRES 3URE l

t INO POIN1.PDST TRIP #814 TORCEO

,_k,,,,,

,,)

gCIRCULA110N(T a,

j 1000

- Lluti g

H0T EIC0t 0) AND j

a00 FOR NATURAL CIRCULATION tigg(g) 9 g

NORMAL OP[4ATING P0lNT.PDtER es h,T 5

600 hOPERAil0N(T ygy) n.

ex

?.

1. 00

~

j I.tND POINT POST TRIP tifH

,0 l..thalURAL CIRCUL ATION f TH0il di

. xc_.'

400 450 500~

550 Ecc 650 TOG a

l-n Reactor Coolant Ane Steas Outtet Temperateie.T

--( %,

FIGURE A-5 i

A-10

\\

- lr t.

l

%Y

.:TC.

.:n.

. ~...... -

~

DR1 4

Other identifying synptoms to distingui:h excessive

~'t feedwater from other overcooling transients are:

4

- High sieam generator level

- High main feedwater flowrate I.

i' t

j g: Rapid excessive feedwater transients, e.g.,

large MFW flowrate after reactor trip, will result id the pressui izer I

[

being in a near-drained condition by the time T / pres h

exceed the post-trip window.

Drainage and RCS saturation will occur very quickly after the post-trip window i

l boundaries are exceeded (dotted path in Figure A-5) and i

j water will enter the steam lines.

Therefore, it is very

'i important that the operatJr recognize the overcooling s

s transient _before the window boundaries are exceeded b I

checking MFW flowrates and SG levels.

He should discover that excessive feedwater is in progress in Step 5.0 of Part 1,Section II, " Vital System Status Verification",

t 1

pl l

i

!I l

t The previous section discussed three of the many pe utble i

i examples for excessive main feedwater transients.

I i

However, it can be seen from that discussion that s

h the primary transient of concern is the rapid filling of a steam generator y

'{

that is not automatically terminated early by the ICS.

I SLBIC actuation will occur too late to prevent water l

in the steam lines and drainage I

of the pressurizer.

]erefore, such a transient requires rapid i

response by the operator.

In addition, the operator must

{

exercise caution whenever feedwater is in manual contro l

A-il

.1 i

s

- - - - - ~

7

DRAFT

?

prevent large feedwater mismatches from developing.

Historically, oversights while in manual control have been a significant contributor to the frequency of excessive feedwater transients.

This section will discuss how operator actions in accordance with.

Part I will terminate the overcooling transient and provide recovery to stable shutdown conditions.

The assumed transient i

.will be the same as that used for the second transient discussed l

ir. the previous section.

A reactor trip occurs (for whatever i

t reasons) and MFP "A" is automatically tripped.

The "B" MFP runs

'i back to the low speed stop and the ICS opens the cross-connect valves to allow feeding of both steam generators.

However, the main feedwater valve for the "A" steam generator sticks open and thus allows a continuous excessive feedwater flow, to that generator on the order of 8,000 gpm. This transient was selected i'

because the ICS will not correct the excessive feedwater addition

i '

and the "B" MFP will provide flow to the "A"

steam generator i

longer.if uncorrected since water in the "A" side steam lines f

will not affect operation of the "B" MFP turbine.

l l

l l

After performing the imediate actions of Part I, Section 1, the operator will verify vital system status in accordance witn l

Section II.

Step 5.0 of Section It requires the operator to a

Verify that feedwater has runback.

He should check steam generator levels and feedwater flow rates and note that level and A-12 t

! l.

f.

i--., -- _ _ _

• • y+=.w.

_ge.,. -

l

9 I

l flow for the OTSG " A" are high.

The corrective action noteo is i

to trip the running feedwater pump and start and verify proper

!.i operation of the EFW system.

These actiuns will terminate the t

excessive feedwater and return the plant to stable conditions.

i ji.

.h

.i '

A 3'

However, for illustrative purposes it is assumed the oper= tor

?i i

f ails to note the abnormal cond.tions at this time.

Step 15.0 of 3

Section Il requires the operator to verify that primary lto secondary heat transfer is not excessive.

The operator.should k

I note by RCS response on the P-T curve that an overcooling 4

transient is in progress (see Section I.B of Part II) and J

I'

?

therefore primary-to-secondary heat transfer is excessive.

He E

~

does not need to concern himself at this time whether the

.h e

T overcooling is due to excessive feedwater, loss of steam pressure N

control, or loss of feedwater heaters. The procedure directs him to Section III.C of Part I.

k g

4i$

%V Step 1.0 of III.C. requires the operator to start HP1 if M

9 pressurizer level goes below 40" and RCS pressure is decreasing. r

+h While full HPI flow will not maintain pressurizer level during

n this magnitude of shrinkage due to overcooling, it will slow down 73 the rate of pressurizer level decrease and provide additional time for the operator to terminate the overcooling transient

~

before the pressunizer drains (see Figure A-6).

If RB pressure and temperature are normal, which will be the case for this A-13 1

particular transient, the operator is directed to Step 5.0 of Section !!!.C.

t' Steps 5.0, 5.2, 5.3, and 5.4 of III.C effectively isolate the steam generators from most failures that would cause overcooling and indeed, by isolating MFW in Steps 5.3 and 5.4, this particular overcooling transient will be terminated.

SLBIC will not have actuated due to the excessive main feedwater thus the operator will be directed to Step 7.0.

OTSG " A" level is high therefore the operator will perform the aqtions under Step 7.1.

Maintaining RCS temperature at the present value by lowering the TBS setpoint will prevent filling the pressurizer solid due to RCS reheating and swell and is especially important since RCS inventory has been increased due to HPI.

However, HPI is still in progress and must be throttled or stopped when the Subcooling Rule is satisfied.

Establishing EFW flow to maintain OTSG levels will restore stable primary to secondary heat transfer.

If the operator follows the guidelines in an expeditious manner and performs the actions such that MFW is isolated within two to three minutes following reactor -trip, he will probably prevent water entering the steam lines and drainage of the pressuri2'er.

In fact, the RCS will probably stay within the post trip window A-14 i

l X.. c.,

--e--..---

w,,

U,liL w

and recovery to stable shutdown conditions can be quickly I

achieved.

, 1f, however, the cooldown is allowed to continue to 1'

the point of pressurizer drainage, the RCS will rapidly approach i

saturation conditions and further operator actions and

-1 precautions are in order.

. q'n

.s t

y f :1 Id l

When the subcooling margin is lost the operator vill trip the RC w

i 1

% i.

pumps, verify EFW initiates, and begin to raise SG levels.

For Q h this particular transient these actions will worsan the 3

{C(

overcooling by removing pump heat input and adding cold EFW (decreasing the heat source and increasing the heat sink).

4; c(!j However, the operator should immediately throttle EFW flow to' s

jf obtain a steady, gradual increase in SG 1evel thus minmizing the 1.9 1,g overcooling due to EFW.

(See " Be s t Methods for Equipment p

i Operation" in Part II,Section I.E).

..w h

St.BIC actuation, which eventually terminated MFW flow in the second transient discussed in 1.0 of this Appendix, will probably

-\\

.j,' )

not occur witn EFW throttled since steam pressure should not

'i-C q

decrease significantly.

However, by this time the operator

'3 should recognize the overcooling transient.

He will follow Section ll!.C of Part I and, in Steps 5.3 and 5.4, terminate the

?

excessive MFW.

~

-r A-15 a

M a

W g,M h6ey h

With the Mrco31ing transient terminated, HPl flow will overcome the shrinkage of the RCS and rapidly recover RCS pressure and pressurizer level.

The operator must again respond to prevent HP1 refill, and reactor coo". ant swelling due to reheating, from filling the pressurizer.

He shoald preform the following actions:

Lower the TBS setpoint to a value, near the corresponding saturation pressure for the existir.g cold leg ter.iperature.

This will limit RCS heatup and thus limit the resultant swell of the RCS inventory.

(If SLBIC has actuated, the MSBV's will be ~ shut therefore the operator must control steam pressure with the MADV's.)

Throttle HPI as soon as the subcooling margin is regained.

This action Will rediice the injection rate and allow a more gradual, st ble recovecy of pressurizer level.

Throttling should be accomplished by using one HPI pump (prdferably' ~_

the normal mak'eup pump) and one injection line (preferably.

the normal makeup nozzle with the thermal sleeve). -

When pressurizer level returns on-scale low (with the RCS above the subcooled margin) and is increasing the operator

'\\

should terminate HPI and re-align for normal makeup / letdown operation.

i If desired, the operator can return the plant to normal post-trip conditions by gradually increasing the TBS

~

[

setpoint and regulating RCS pressure with makeup and pressurizer heaters. He should also restart RCP's once the subcooling margin is restored:

A-16

, /

m-

...-...n.r,-

m-..

- ~ - - - - - - ~. - -

.~

t The excessive feedwater transients discussed herein all invol,e a reactor trip.

If a feedwater excursion occurs while at power I.

that does not result in an automatic reactor trip, the operator j

should attempt to locate the failure causing excessive feedwater and correct it while at power if possible. A manual reactor trip I.

would result in a much larger mismatch between heat source ai 1 7-i heat. sink and thus make the transient more severe.

^ ' ' '

B 14 I, i

[' :.

l

.I i

' ' fs!

e

$i.I th

i; Ji

)

ii 1-i

,i,I a

i f'

t 1

I h

1, 4

i

.;I

,d N

r I

si i

..i 8

kba i

w

.A i -9 ' dH l ' -y k Ys .i .A \\i 'l ijl 9 s J A-17 [32.s7 i;:~ A = J ~ g,. A l.x -. i i v,

DRAFT 3.0 EXCESSIVE MAIN FEEDWATER WITH OTHER PLANT FAILURES introduction Tt.e previous section describes excessive main feedwater in general, but did not discuss other failures that might also happen at the same time. This section will show what symptoms to look for when other equipment fails and will show what steps the operator should take to restore the heat transfer from the cgre to the steam generators. The event that was chosen for similation starts with the reactor at 100% power; a failure in feedwater system allows main feed to run away in one generator; automatic ICS corrective action to control main feedwater does not happen: the plant is tripped automatically on high flux or low pressure, and excessive feedwater continues. All the data that is shown st3rts from the time of plant trip. Remember that all feedwater transients will not startfrom high power. They may look different than the examples used. The reason for these examples is to provide understanding, so close study af the effects is required. Branch Discussion Figure A-7 has separate f ailure branches for loss of reactor inventory control (high and low), loss of secondary inventory control (high and low), and loss.af seconaary pressure control. Significant failuies in RC pressure control, such as those due A-IS E h

DRk to overcooling or excessive HPI, are adequately covered by these branches therefore separate branches specifically for loss of P.C l pressure control are not shown. Minor failures, such as loss of l pressurizer heaters, are discussed at the end of the main transient path. This section will discuss each of these 1-additional failure branches and illustrate how operator actions i ! in accordance with the procedures in Part I and wt,th the "Bes I i l Methods for Equipment Operation" in Part 11, Section 1.E, will restore proper control of the parameter in question. ? I' i These branches are structured to address the particular function failure in question even though the excessive feedwater transient ' t may still be in progress. However, since some additional I i j i failures result in further overcooling of the RCS, actions to l.l l correct such f ailures may also correct the excessive feedwater condition. In any case, it should be understood that Figure A-7 and 'this discussion are provided as tools to promote familiarity with expected plant responses. Another valuable tool to l facilitate operator recognition and i,dentification of overcooling l transients is Figure 21, " Overcooling Diagnosis Chart," in Part ' ^ II, Section 1.C. The operator should become familiar with this I chart. I y i Figure A-6 is providFd to show key distinguishing parameters for

j excessive main feedwater that have a time dependency important to l

the operator in identifying both the type and severity of il e i A-19 i 5 ~$ l

1 s~. DRAFT transient. The parameter plots show typical responses to a large excessive main feedwater transient. Arrows, where used, show the effect of other failures and operator actions on tne time relationship. One item of particuler note on Figure A-6 is the effect of large excessive feedwater transients on steam pressure in the unaffected generator. The pressure is reduced because the primary system has been cooled so rapidly that the unaffected SG becomes, temporarily, a heat source and loses heat (and 'thus pressure) to the primary system. s Loss of Reactor Inventory Control (Hich) A loss of reactor inventory control (high) exists whenever makeup or HPI flows are excessive causing the pressurizer to fill and overpressurizing the RCS for the existing plant conditions. Severe excessive feedwater transients involving large mismatches between feed flow and primary heat input will result in RCS cooldowns and shrinkages that cannot be compensated for by full HPI flow. Thus, while the excessive feedwater transient is in progress, pressurizer level will continue to drop, although full HP! flow will slow the rate of level drop. This can be seen in Figure A-6 where manual initiation of HP! early in the transients (before automatic initiation by ESAS) shif ts the curves for RCS pressure and pressurizer level to the right, i.e., more time is available before pressurizer drainage occurs. However, for A-20

~ DR n-i 1 5 smaller feedwater transients, and when the excessive feedwater has been terminated, full HPt flow will overwhelm the coolant shrinkage and result in a rapid increase in pressurizer level and i i RCS pressure. Rapid operator response will be required to 6.. l prevent a solid pressurizer and RCS overcressurization, b i It ,i Thc operator should perform the following actions to restore 'i proper RCS inventory and pressure control: l .[ 1) Throttle HPI as soon as the subcooled margin is restored and-RCS pressure is increasing. Throttling should be 1 accomplished using one HPl pump (preferably the normal J makeup ptsnp) and one injection line (preferably the one utilizing the normal makeup nozzle with the thermal sleeve). j! Y 2) If the RCS is reheating, and thus swelling, lower the TBS 3 .y i (or ADV if the MSBV's are shut) setpoint to a value near ,1 8 1 the corresponding saturation pressure for the existing cold i ';j leg temperature. This will stop the RCS heatup and swell. .] i if desired, he can then gradually increase the setpoint to f j allow a gradual heatup while controlling pressurizer l n level. t d. [ g

5..

3) When pressurizer level returns on-scale low (with the RCS above the subcooled margia) and is increasing, the operator should terminate HP! and re-alian for normal makeup /ietdown

'j i 'i operation. ~ i e e A-21 4

~ DRAFT ~ NOTE: Throughout Part I the operator is required to throttle HP1 4 35 soon as the subcooling margin is restored and to reduce TBS or ADV setpoints to maintain -RC temperature.

Thus, adhering to these guidelines will prevent a loss of RCS inventory control.

This is discussed in more detail in Part II, Section I.E., "Best Methods for Equipment Operation." Loss of Reactor Inventory Control (Low) A loss of reactor inventory control (low) exists whenever makeup or HPI flow is insufficient to overcome a primary leak rate or the, coolant contraction rate, resulting in drainage of the pressurizer. As stated previously, full HPI flow will be insufficient to maintain pressurizer level during severe excessive main feedwater transients, but will rapidly refill and repressurize the RCS once the overcooling is terminated. Too little makeup or HPI flow, while undesirable, is not a major concern for this particular transient. If the overcooling is terminated before the pressurizer empties, the RCS will reheat and the resultant swell will restore pressurizer level. If the overcooling continues ESAS will actuate and. HPI will initiate. It is extremely unlikely that at_least one HPl pump w i 'i l not start, however should that occur,7he RCS will lose subcoolin;: margin. The operator will trip the RC pumps and EFW will start. A-22

.. ~ gnu 5)h 2 V t Control of EFW to attain and maintain 95% level on the operate range will provide adequate core cooling while the problem with HPl is being corrected. The operator should throttle the EFW flowrate to obtain gradual SG level increases and limit further overcooling. l t i i 1 !l iI Following the actions specified in III. A of Part I will restore i primary system inventory control and subcooled margin.

1 r

I i Loss of Secondary Inventory Control (High) i A loss of secondary inventory control (high) exists whenever significantly more feedwater (main or emergency) is being j injected into one or both steam generators than is required by !\\ existing plant conditions. It is an overcooling transient and is very.similar to the main initiating event covered in this section (excessive main feedwater). However, there are basic differences in definition and plant response. Excessive main feedwater was defined in Section 1.0 of this j Appendix as basically supplying more feedwater than could be boiled off to make superheated steam. The definition for Ji! excessive emergency feedwater must differ slighcly in that 1) the ( steam generator 'Ts at saturation conditions and 2) more importantly, whenever EFW initiates it will provide more flow than can be boiled off in order to raise SG levels to the !li A-23 l l 'l l I

appropriate setpoint. However, the rate at which EFW builds SG 1evels can 'e excessive and overcool the primary system. In

addition, excessive emergency feedwater will cause depressurization of the affected SG to a mucn larger extent than excessive main feedwater.

This is due primarily to the condensing actio,. introduced by spraying EFW in near the top of [ the tube bundle (into the steam space) and due to tne lower EFL' temperatures, i Thus, even when the EFW system performs as designed, it can cause ove'. cooling of the primary system, particularly when achieving l the natural circulation level setpoint ( 20 f t) with low decay heat, lherefore, Section I.E of Part 11 states that the operator should throttle EFW to obtain a gradual increase in SG levels and to maintain SG pressurer. This will minimize the overcoolign effects on the primary system. This action should only be i required when the natural circulation setpoint is in effect since EFW cannot cause significant overcooling while attaining the low level setpoint for forced circulation. i Should EFW flow control fail, the operator should recognize the overcooling as well as high EFW flos and SG level higher than the appropriate setpoint. Following the actions in Part I, Section III.C for excessive primary to secondary heat transfer will A-24 .m = % em. e se * - e+---u I

, i ~, terminate the runaway EFW. Step S.0 of Ill.C requires the operator to close the EFW regulating valves. He should not restore EFW to the generator with high level until the failure ~ causing runaway EFW has been identified and corrected. I Restoration of EFW to the " good" generator will provide On removal. He should align the EFW system to allow feeding of *he i good generator with both EFW pumps. i i I Figure A-6 shows the impact of excessive main feedwater overcooling compounded by overcooling due to excessive EFW, The curves for RCS pressure and pressurizer level will shif t to the 3 f. j

left, i.e., pressure reduction and drainage of the pressurizer i-

) will occur faster. i i +. i i Loss of Secondary Inventory Control (Low) } } A loss of secondary inventory control (low) exists whenever too l little fecdwater is being supplied to the steam generators resulting in too little primary to secondary heat transfer and i . g overheating of the RCS. This is an unlikely event since the . a# } initial condition was excessive main feedwater with too much primary to secondary heat transfer. In any case, should a total loss of both main and emergency feedwater subsequently occur, the operator will have morc time available for corrective actions due to Tiitial SG inventory increase caused by the l excessive main feedwater transient. A detailed discussion is provided in Appendix 8. " Loss of Main Feedwater". l l A-25 l i ]

^ DRMT Los: of Steam Pressure Control A loss of steam pressure control exists whenever one or both steam generators undergo a pressure reduction significantly below the TBS reseat setpoint. It is an overcooling transient and will look similar (on the P-T curve) to an excessive feedwater transient, it can be caused by excessive emergency feedwater (discussed earlier) or by an unplanned steam flow through stu'ck open valves or a pipe break. improper EFW flow control will also result in a SG pressure reduction. si The operator will isolate both SG's and then monitor their U re toective levels and pressures. If both SG's stabilize, I ir$dicating a steam leakage path downstream of the MSBV's, he can restore EFW to both. If only one SG stabilizes he will restore CFW to that SG for DH removal and allow the broker. SG to boil ,l. dry. In the highly unlikely. event that neither SG stabilizes, the operator must pick one for DH removal while trying to locate b the leakage path. One SG may be broken and the other may have a [u,j leaking MSSV or MADV. ,r. .[&. 1- .' t. lp.;Q It should be noted that the overcooling caused by the excessive

.1 :

l i.t.l feedwater coupled with the overcooling due to loss of. secondary

r.o.

'[ pressure control may be too rapid and -too severe to prevent l Tf'. pressurizer drainage and saturation of the RCS. Figure A-6 shows ths . f,..r the impact of excessive feedwater overcooling compounded oy overcooling due to loss of steam pressure Cor. trol. The curves M.,' ) g A-26 v\\. -).,- .n

y-og: for RCS pressure and pressurizer level will :,hif t to the ;af t, j l'. i.e., pressure reduction and drainage of the pressurizer will i occur faster. When the overcooling transient is terminated, the l, operator must react to prevent overpressurization of the RCS and possible violation of NDT limits. ^ l ~ I ' I f f i l e I ~ I. 4 O E a I}I 4 l f I s I i l l 4 l i l 1 A-27 i: .1 - ---a

Figure A-6 TIME RELATIONSHIP OF KEY PARAMET. ?$f* ^,'I 4.lsk:'

• * 'n.~..

3,. . is p-

• • .h

. u. t . y 'e i

i. 'y

9. -

h I/ M(,1. 2500 200 m TERMINATED e L* 4 ?* 9EFORE 6 M PRESSURllER TERMihATED I4 *;'( ~, ORAINS y 3000 sEFORE PREssutiz[R .'.j.'; g / ' 120 ORAINS o, ( = 2 ~ s- / a- = 1. m. /

'~

a 1500 41 LOSS OF STEAM ggggy / PRESS.00NTRO 4 + ypg I LOSS OF STEAM EARLY p..)' EXCESS EFW (MANUAL) - PRES $. CONTROL p 4 NPI -4 n EXCES$ EFW (MANUAL) 3000 t t t DRAlNED t t ..J,'. ; O' I 2 3 0 1 2 3

• [; -

Time, Minutes Time. Minutes

C.

1 ,f, 600 1800 AFFECTED SG

.a N

^ f

• • j t

.' lhti 3 n = \\ UNAFFECTED SG

• g g

{0UETOQVER ,% [ - 100 ! 1000 00 LED PRIMART) .yc. s 2 TERMINATED E 2.;);,.. ) st' ORE to PRE 55URIZER = 200 ORAINS 300 .o. t. s .q.i. 0 800 O I 2 3 0 1 2 3 Time, Minutes Time, Minutes j

+ /* bureg% +- UNITED STATES [.e O'$ NUCLEAR REGULATORY COMMISSION 'N P. 'E6 WASHINGTON. D. C. 20555 En E 7 i%: yt'Np/ AUG 2 91980 ....= r MEMORANDUM FOR: Harold R. Denton, Director Office of Nuclear Reactor Regulation FROM: Carlyle Michelson, Director Office for Analysis and Evaluation of Operational Data

SUBJECT:

CONCERNS RELATING TO THE INTEGRITY OF A POLYMER COATING FOR SURFACES INSIDE CON-TAINMENT (IE DRAFT BULLETIN N0. 80-21) We recently reviewed a draft IE bulletin which indicated that various batches of a polymer coating manufactured by CON-CHEM, Inc. for use inside containment could fail when subjected to Design Basis Accident conditions. The draft IE bulletin requested licensees, in part, to evaluate and reply as to "...what engineered safety systems, e.g., clogged sump, could be affected in the event the polymer lost its bonding characteristics in a post-accident period." AE0D recommended to IE that this particular item be expanded as follows: Include all plant systems which take suction from the containment sump during accident mitigation and whose components might be adversely affected by the presence of unbonded polymer coating flakes which can pass through the sump screen. Of particular interest are the pump seal water systems, including filters or cyclone separators a:id the pump seals which might become clogged 1 by paint flakes. Consideration should also be given to adverse effects of paint flakes on instrumentation such as flow meters which might lead to incorrect operating decisions or automatic control malfunction. The general concern, as noted above, is associated with paint flakes, fiberous insulation, or other debris which can pass through the sump screen, yet will not pass through the more restrictive clearances present in the systems taking suction from the sump during the recirculation phase of accident mitigation. Since there may be a need for long-term reliability for these systems, such as RHR, it becomes necessary to develop confidence that existing components and instrumentation will function routinely and reliably in the presence of such debris. Q@h fW h. \\ O ~

. /_. ,7 e ./

~

Harold R. Denton ; I l Of particular concern to AE00 is the prevalent use of cyclone separators as ^ filters in the seal water systems associated with pumps which can take' suction i ia from the containment sump. In a typical arrangement, the cyclone separator l is attached to the pump discharge nozzle by a 3/4 inch pipe nipple. The clean j + water discharge from the separator is routed through pipes or tubes to the pump shaft seals. The dirty water discharge is returned to the pump suction. j The jet nozzle in the separator has a 1/8 inch diameter throat. The seal - water is typically injected at the midpoint of the shaft seal' with a portion of the flow passing inward and the remainder outward. The seal clearances ) are almost nil. Water-lubricated pump bearings may use similar arrangements. l Since the sump screens may have a very coarse mesh compared to the 1/8 inch l . jet nozzle in the separator, it is apparent that the sump water must not contain any debris which could clog the jet. In addition, if the censity of the debris is even close to that of water, or if it has a propensity to be carried by the j flow, the debris which passes through the jet may not be separated by the cen-trifugal action of the separator. In this case, the debris will_ pass on to the l pump seals and become lodged in the seal clearances. This could greatly reduce t the seal water flow and lead to seal f ailure. This becomes a potential common [ mode failure for all systems which use pumps having such an arrangement and which l -take suction from the sump during accident mitigation. e i We are bringing this situation to NRR's attention because of its applicability to the ongoing work on " unresolved safety issues." However, a review of available ,information did not confirm that this concern was being specifically addressed .by an established issue, such as A-43 (Containment Emergency Sump Performance), .yet we believe that it warrants careful review and resolution. l -In view of the close relationship of this concern to the NRR unresolved safety l issues and to the proposed IE bulletin, we anticipate that NRR will be working j closely with IE on the evaluation of the responses.to Bulletin 80-21. Following completion of this evaluation, we would appreciate knowing NRR's views regarding the seriousness of this concern and whether it will be specifically addressed and resolved as part of an ongoing activity, such as a specific unresolved safety l

ssue.

l Please let me know should you require clarification or additional information. l l c Carlyle Michelson, Director Office for Analysis and Evaluation of Operational Data 1 cc: ACRS E. Jordan i C. Berlinger. N. Moseley E. Case W. Reinmuth .K. Cornell D. Ross R. DeYoung W. Rutherford W. Dircks F. Schroeder L D. Eisenhut-V. Stello I S. Hanauer H. Thornburg R. Bernero R.~Vollmer m Z 5

.**.a ,e g o UNITED STATES g g NUCLEAR REGULATORY COMMISSION o E WASHINGTON D.C.20555 k,..... AUG 2 71980 i MEMORANDUM FOR: Harold R. Denton, Director Office of Nuclear Reactor Regulation j FROM: Carlyle Michelson, Director Office for Analysis and Evaluation of l Operational Data l

SUBJECT:

TIE BREAKER BETWEEN REDUNDANT CLASS 1E BUSES - POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 T Based on a review of the enclosed Licensee Event Report (LER No. 80-005/03L-0 for Point Beach Unit 2) and subsequent clarification of the event by the licensee,* it can be concluded that the design of Point Beach Nuclear Plant, Units 1 and 2, under certain conditions, allows manual interconnection of i redundant electrical load groups and thereby parallels their standby power l sources. i i Further, the fact that it took the plant operators approximately five (5) weeks to discover that the electrical distribution system line-up was not in the proper configuration raises a possible generic concern regarding the adequacy of proced-ural and administrative controls. In this instance, the lack of procedures to include the monitoring of the status of the plant electrical distribution system during plant operation, through several shift changes, prevented the detection of the human error committed. Each unit of Point Beach Nuclear Plant has tie breakers that interconnect redundant Class lE buses; one between 4160V Class lE buses and another between 480V Class 1E buses (see enclosed one line diagram). The tie breakers had been provided for F flexibility in operation of the distribution systent. They are designed to auto-matically open (when closed) upon loss of normal ac power supply to the bus'es. l The control scheme of a tie breaker is such that it cannot be closed when both t the normal feeder breakers to the buses are closed. Interlocks are provided that will prevent closure of a normal feeder breaker if the tie breaker is closed. Interlocks are also provided between the emergency diesel generator output breakers l and the 4160V tie breaker that will prevent closure of the diesel generator breaker if the tie breaker is closed. All these design features insure that redundant l power sources are not operated in parallel when redundant load groups are inter-l connected. However, the plant design does not prevent the closure of the 4160V tie breaker when the 4160V Class 1E buses are supplied power by the emergency-diesel generators. This is contrary to the requirements of Position 4(d) of f i I I l

• clarification (wpsobtainedbytelephoneconversationsbetweenthe l

licen ee, hg project anager, and a staff member of AE00. t .\\ [sb ~

e Harold R. Denton, Regulatory Guide 1.6,* which states that if manual connection of redundant load groups is possible, then at least one interlock should be provided to prevent parallel operation of standby power sources. We believe that the design of the interconnection between redundant safety-related electrical load groups at Point Beach Nuclear Power Plant, Units I and 2, should be reviewed and modified, as required, to assure that it fully complies with the requirements of Regulatory Guide 1.6. We also believe that the generic concern regarding procedural controls to reduce human errors could be addressed in the modification or development of procedures that will assure that at shift change-overs the plant operators, who will be taking over control,are fully aware of the plant status. d f>1 Carlyle Michelson, Director Office for Analysis and Evaluation of Operational Data

Enclosures:

As Stated cc w/ enclosures: S. Hanauer D. Eisenhut D. Ross t V. Stello' l T. Novak R. Clark G. Lainas F. Rosa E. Jordan D. Ziemann C. Berlinger C. Trammell P. Wagner AEOD Members

• Regulatory Guide 1.6, " Independence Between Redundant Standby (Onsite)

Power Sources and Between Their Distribution Systems."

/ddkj >- Wisconsin Electnc mcoww 231 W. MICHIGAN. P.O. 80X 2046. MILWAUKEE. WI 53201 June 27, 1980 Mr. J. G. Keppler, .,gional Director

• Office of Inspectiot and Enforcement, Region III U. S. NUCLEAR REGULATORY COMMISSION 799 Roosevelt Road Glen Ellyn, Illinois 60137

Dear Mr. Keppler:

DOCKET NO. 50-301 POINT BEACH NUCLEAR PLANT UNIT 2 LICENSEE EVENT REPORT NO. 80-005/03L-0 Enclosed is Licensee Event Report No. 80-005/03L-0 with an attachment which provides a description of an event reportable in accordance with Technical Specification 15.6.9.2.B.3, " Observed inadequacies in the implementation of administrative or procedural controls which threaten to cause reduction of degree of redundancy provided in reactor protection systems or engineered safety feature systems." t This event was originally reported 5.n accordance with Technical Specification 15.6.9.2.A.6 and immediate notification per the " red phone" was made. After completing a thorough investi-gation of the event and its impact, it has been determined that the event did not require either a 24-hour written notification or " red phone" notification. Very truly yours, r,, C. W. Fay, Director Nuclear Power Department Enclosure Copy to NRC Resident Inspector - Point Beach Nuclear Plant h ^^^~ - ~' ja

s. raw

.. e., -.. m. LICENSEE EVrNT REPORT CONTROL 8 LOCK: l l l l l l lh (PLE ASE PRINT OR TYPE ALL REQUIREO INFORMATION) lo lil l WII I P IB lH \\ 2 l@l0 l 0 l -l 0 l Ol 0 l 0 l 0 l-l 0 l O l@l 411 l 1l1 Il l@l sicArs @ l l e e e uC Nsis COOi is is uCahsa NuMesa a 2. vCahst Tvre ao CON *T f'6TI'l ZRc"' l L l@] 0 l 5 l0 l 0 l 0 l 3 l 0 l 1 l@l 0 l6 l 0 l 9 l 8 l0 l@l 0 l 6 l 2 l 7 l 8 l 0 l@ 8 to 69 DOCEtt NUMS ER 68 69 EVENT QATg 74 7% REPORT DATE 80 EVENT OESCRIPTION ANO PROB A8LE CONSEQUENCES h ITTTI I At 1415 hours on 06-09-80, during a training walkdown of the safeguards l ~ PT31 1 electrical supply cabinets, it was noted that the tie breaker between l ithe A05 and AO6 safeguards buses was shut. This is an improper l i O i. i lTTO I electrical lineup. In the event that the single breaker tying buses l closure of both l (Tpn l AOS and AOG together fails to open on a loss of AC, 'This l 10121 I emergency Diesel generator output breakers would be prevented. ~ 10181 i event is reportable per Technical Specification 15.6.9.2.B. 3 l .o 04 ' CO E SU8C Of COMPONENT Coot sus COE 5 E l El B l@ W@ W@ lC lKl.T lB lR lK l@ W@ y @ 10191 r s 9 to it 12 83 - 18 19 20 SE OutNTI AL OCCUR R E NCE REPORT . REvislON gm Rn EvfNTvtaR R(POR T NO. CODE TYPE NO. @,a(g l288l0l (-.-l l0 l0 l5 l y l0l3l lL] b l01 22 23 24 26 27 28 29 30 31 32 AE N aT PL T Mtf MOURS $8 IT POR 8. SuPPLiE MANuP CTQRER lXl@lXl@ [Z_l@ [_Z_J@ l0 l0 l0 l0 l y@ W@ lN l@ l W II l2 l0 l@ 33 34 3% 36 Ji 40 48 42 43 44 47 CAUSE OESCRIPTION ANO CORRECTIVE ACTIONS h litOIIThe improper electrical lineuo orobably occurred after the loss of AC I m Itest conducted on 05-02-80 but prior to unit return to critical on 1 l05-12-80. Upon discovery of the improcer lineum, the correct lineue I i 2 g Iwas promptly established. To prevent recurrence of this event, the I g Ibreaker will be uniquely identified and a procedure chance imolemented.I STA % POWER OTH ER ST ATUS DISCO R DISCOvtRY CESCRIPTION [TTTl W@ l1 l 0 l 0 l@l N/A l (_A_J@l Operator observation l A TivtTY CO TENT RELgastD Of RELt Ast AMOUNT Of ACTivtTY LOCATION OF RELEAst Ii ls l l Z l @ W@l N/A l l N/A l PERSONNEL EsPOS ES 10 i 0 10 l@i Z i@ DESCRIPTION i NUW8tR TYPE i N/A i.i2i PERSONNE L INJURit$ NUM8Em DESCRIPTION i o i,ii i O i 0101@i N/A 83 F S 9 11 12 TYPE DE5CR PT ON l 191 W@l N/A 't to 8 9 to NRC USE ONLY oesCRiPriON @ "'"2 AM l lltlllllIIlI]{ issue 2lal h\\ Newspaper

oon,

'~6 voV -s e sa as ao ; e9 so C. W. Fay 414/277-2811 o NAME OP PREPARER ,,gyg

I S.J q e i' ' ATTACHMENT TO LICENSEE EVENT REPORT NO. 00-005/03L-0 l Wisconsin Electric Power Company le t i. Point Beach Nuclear Plant Unit 2 ' ~i i Docket No. 50-301 f With the unit at 100% steady state power, it was noted at 1415 hours on June 9, 1980 that the safeguards buses were improperly energized. Instead of the AOS bus being independently supplied by the A03 bus, it was supplied by the A06 bus via the 1 bus tie breaker. A05 and A06 are the two high voltage ' safeguards i buses for the unit. The discovery of the improper electrical I lineup was made during a training walk-down, and proper lineup was promptly restored following discovery of the improper lineup. l Shutting the tie breaker between the A05 and A06 buses I threatened to cause a reduction in. the degree of redundancy provided by engineered safety feature systems. In order for the break'er to cause problems, the following l sequence of events would have to occur. First, there would have i to be a total loss of off-site power, that is all four tie lines l would have to be knocked out of service. Then, the bus tie j breaker would have to fail to open. This would be another compo-i nent failure since the breaker is designed to open automatically on a loss of AC. At this point, the emergency diesel generators j 1 would not automatically phase to the Unit 2 safeguards buses; however, they would phase to Unit 1. This is due to the fact that a failure of this single breaker to open during a loss of j. AC accident would prevent both emergency diesel generators from auton.atically supplying power to their respective Unit 2 buses because of an interlock. The output breakers for each emergency diesel generator are interlocked to the tie breaker between the A05 and A06 buses. Thus, a failure of the A05 and A06 buses' tie breaker to open automatically on loss of AC would prevent i the emergency diesel generator output breakers from closing. This l single component failure coupled with loss of AC would prevent both i emergency diesel generators from automatically supplying power to their associated safeguards buses during a loss of AC accident. The operator would immediately know that the diesels did not phase in on Unit 2 and must either recognize that the i bus tie breaker failed to open and manually open it, or manually i synchronize the diesels to their buses. Sufficient time, approxi-mately one to two hours, would exist to do this since the steam driven auxiliary feed pump would be operating and supplying water to the steam generators for decay heat removal. Condensate tank water and. service water would be available for steam generator feedwater. The primary system temperature, pressure, and level would not significantly change since the steam generator atmospheric dumps would be maintainirg temperature and there would be no letdown. Loss of power to the letdown motor-operated valve and/or all charging pumps will secure letdown by inftlating closure.of the . orifice valves. -l-1 l' _.1,_ i

.r e ,e e

• I 3

I Thus, sufficient time, indicators, and options are available to the operator to mitigate any adverse consequences of this low probability event. The diesels were available to supply power at all timest the automatic feature could be prevented only if the closed tie breaker would have failed to open. The improper electrical lineup has been attributed to personnel error and is postulated as occurring subsequent to the performance of the loss of AC test conducted on May 2, 1980, but prior to the unit returning critical on May 12, 1980. The unit was shut down for refueling during this time period. The breaker cannot be closed once the unit is electrically lined up properly and loaded witho'ut going through a rather elaborate sequence of events. To prevent future recurrence of this event, the electrical layout board will be modified to provide unique identification of the A05 and A06 buses' tie breaker. This modification will also include like tie breakers between o'ther safeguards buses. Also, procedures will be changed to include an electrical lineup check after performance of the loss of AC test and prior to return to power. This event is being reported in accordance with Technical Specification 15.6.9.2.B.3. The event was discussed with the NRC Resident Inspector on the morning of June 10 and " red phone" notification was made at 0845 hours the same day. A 24-hour written report was also submitted on June 10. After performing a complete evaluation of the event it was determined that this e*sent did not require either " red phone" notification or a 24-hour ~ report. i l l l = l

..A l ~ n.!!. g a 4 e W m .I W g C

• =4

.1 - I* k[ ( l A :: } e 3 3

-o 2

c-i

]

3e i . C .= ? - <.,t., i g U,M = =. 7:- h U a> g, 44 j p *.:, =, - ./s.,

h. N.

. h.. . f' z a ai .I i =. 3- '4 f> 4, I O' l t- . 4- ~ s ,t 8 W s ,g d.;, a T .h js se wif - .e ,.h..>> g.- t,f C. 4 9 t 4 j ~ c 9p, b., j' { -- oc a 3 a e .a .c J:i Y D'.. n l 8g .h o a 33 s etc i,f,

• ?

y c-4

• 7 Q=.".

7 J > *. s".. O 3. = r Q D l y ] e4 y e 0=w 0 0, ..u G@. cQ b, 2 e i- ~ d Tp. . j 4 3,

A c,

t- { i * ;- 34:*

• 2 4 c'g

.f 4 b U. U ..'. j)

s..

~ 2 U.',- a i. If g CL ~ 'i .c g c 3 ~ 3C vr .p 3e C-- -O-I g. c ~

s. =

5 n, - .Ir. o s e - r. m 4 o a 4 CF

i. 5--DO-

-C .,T 'lt 3 J[ Qo- "'-}Y ' i %-c 9C a: 3.:: ::, ./ 3,. . 4% r ,.up' 0 2'" j.%- 3, <)- =

o.S c.

s. ts f >g eq > t g-

2.{-

g =

• a g,

g. g. W z O O , *I '. E

• 3,.'$

,g 3, .t.. ,c es e* qN wy u=, O. I,.,. t >d a- % s, - .i-.. O-h -O -- e* 9' e 39 3 { r r'i 8L DJ C U I [( d y e s n,,, Of t. n.~. ,s, p u.*-

oi a mag [ g#og UNITED STATES j NUCLEAR REGULATORY COMMISSION n { ,i WASHINGTON, D. C. 20565 f / JAN 3 01981 l Facility: Sequoyah 1 Event: Loss of Unit 1 Annunciation i Date of Event: January 26, 1981 Discussion: The event began with the loss of (non-class 1E) which supplies power to Unit 1 and common annunciators only (Unit 2 has a separate inverter for its annunciators). Inverter failure was due to a capacitor shorting that led to two wave-shaping SCR failures also. As a result of this, the output breaker of the inverter tripped. Alternate manual transfer was i available and was used three minutes later to re-energize the annunciators. t (The inputs to the inverter are from Class 1E 125 V de battery bus and 600 V ac bus). e Licensee had overlooked the review of such an event in their response to IEB 79-27 (IE had also overlooked this). Licensee will be doing this review now and will also address other means of supplying annunciator power. This inverter is also by the same manufacturer as the Class IE inverters. l The inverters have ben subject to several failures in the past. Licensee has been working on improving the relability of all inverters. (Ongoing i NRC review on inverter failures is continuing). The loss of this particular inverter does not affect safe operation of the i plant -- however, the operator would be without annunciators. There is an alarm recorder that will (and did) monitor the loss of the bus. The IEB 79-27 review and subsequent operator training on such an event would in# prove the situation. i i w_ _. -- Matthew Chiramal Office for Analysis and Evaluation of Operational Data i l l [ l N )d k .}}