ML20032E888
| ML20032E888 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 04/27/1981 |
| From: | Joseph Kelly, David Williams BABCOCK & WILCOX CO. |
| To: | |
| Shared Package | |
| ML20032E886 | List: |
| References | |
| TASK-2.K.3.30, TASK-TM TAC-45859, NUDOCS 8111230445 | |
| Download: ML20032E888 (8) | |
Text
m Abnormal transient operating procedures for nuclear power plants J. J. Kelly, Jr., Supervisory Engineer Engineering Department Nuclear Power Generation Division Habcock & Wilcox Company Lynchburg, Virginia D. II. Williams Special Products Coordinator Arkansas Power & Light Little Rock, Arkansas Presented to American Power Conference Chicago, Illinois April 27-29,1981 The aims, objectives and methodology involved in symptoms and immediate actions. If a loss of producing abnormal transient operating procedures feedwater occurs, he is expected to recognize it, for nuclear power plants were discussed in detail at perform the appropriate immediate actions, and the American Power Conference in April,1980.*
then use the event-oriented loss-of-feedwater Abnormal Transient Operating Guidelines now procedure for determining follow-up actions. This exist in draft form for Arkansas Power and Light, approach has several inherent drawbacks:
and it is possible to detail a truly symptom-oriented
- 1. At time zero, the operator must correctly approach to transient managemcat. Using this diagnose the initiating event. He does this approach, the operator does not have t mentally, based on training or prior experience.
immediately diagnose the initiating casualty and After taking several actions, depending on this locate the event-specific procedure for that casualty.
instant evaluation, he then refers to the event-Instead, the operator can pick up and use one, oriented procedure that fits his diagnosis. If he simple procedure for all transients startmg with a were to treat a small steam line break inside the reactor trip. This paper describes the approach and reactor building, but actually had a small loss of provides several examples of the simplified decision coolant accident (LOCA) inside the building, he making process now available to the operator. Als would be tracking through the wrong procedure.
discussed is one possible approach to implementmg Ile would eventually recognize this these new guidehnes mto the existm, g procedure misinterpretation; however, by then he would be structure.
well into the transient and possibly confused.
Background
- 2. Procedures must be written to cover every conceivable initiating event. If the operator The traditional approach to transient and accident correctly diagnoses a loss of nonnuclear control has been to develop many " emergency" instrumentation power and no procedure covers procedures, each based en a postulated event such that event, his actions will be based only on as loss of main feedeater. The operator is then experience.
required to study this event and memorize its
- 3. If more than one event contributes to the
- " Engineering basis for operator control of nuclear power transient, the operator will find himself working stations in abnormal operations - closing the loop."
two or more procedures at the same tone. For E. A. Womack. J. J. Kelly, and N. S. Elliott, American Power instance, if a main steam safety valve failed to Conferepre. Chicago, Illinois. April 21-23.1980 (llabcock rescat following the loss of main feedwater, the
& Wilcox 111t-1151).
operator would have to use the loss of feedwater 1
8111230445 811116 PDR ADOCK 05000313 P
procalure and snmil steam line-break proenlure identify a transient. Similarly, some parameters (if available). These proentures may conflict and were conunon to all trasients. One event found he would have to decide a priority between them throughout the stud 3 reauor trip.
- with no convenient methm! of shifting Consequently, it was,
ts the key for between the two procedures. Writing a proenture entering the abnormal m,Jelines procedure, to combine these two events is possible;
- 2. Event trees for various initiating events
- and however, if just a few more failures are consequential failures were developed. These considered (e.g., the power operated relief valve included various multiple failures (including or spray valve remains open), the number of operator error), and therefore covered a large combinations of failures, along with possible number of possible scenarios. Event trees were initiating events, quickly increases. Even if studied to find repetitive patterns and conunon writing the appropriate procedures was end points. The study showed that although attempted, the operator's ability to pick the many failures can occur, the symptoms of correct. procedure would certainly diminish.
unbalanent heat transfer that result from these
.l. Ih cause of these limitations, most operators are failures followed a few common patterns or likely to use no specific procedure. They will use t rends.
training, experience, intuition, etc., to bring the
- 3. Actual operating transients were investigated, plant under control. They will then choose what again looking for patterns. This time the they think is the closest proenture to what is emphasis was on parameter trends and the time happening and confirm their actions or see if available for operator action.
they overlooked anything.
t Where necessary, computer simulations were run to complete the baseline and fill in gaps in To correct these deficiencies, it is necessary to undnstamh,ng plant response. Ih cause the step back from the traditional approach and output was mtended for use m develop, g m
examine what the operator is attempting to do
'#
- P" k *"" ""
I""
T""
"N @*
during reactor posttrip abnormal transient control.
"PP"""I to boundm.""' I""g safety analysis lie can best protect the health and safety of the assumptmns),
public by guarding the integrity of the core. To do this he must ensure the continuous removal of This investigation's conclusion was that the decay heat from the fission pnxlucts to the ultimate operator can track the removal of decay heat from heat sink. Ily adjusting the priorities and the core to the ultimate heat sink by monitoring concentrating efforts on maintaining proper heat just a few symptoms which reflect the " health" of r
transfer along this path, he can protect the core and the thermmlynamic process around the reactor minimize radioactive release. To give the operator cimlant system and its coupling to the secondary this capability, a concept of symptom-oriented (as side.
oPimsnl to event-oriented) procedures was investigatal. The symptoms are based on upsets in Symptoms identified heat transfer from the core to the coolant and from the coolant to the steam generators. The symptom.
The three symptoms of primary interest to the E
oriented proentures thus focus on core cooling first pressurized water reactor (PWH) operator are and on event identification second. The result of adaluate subcooling of the primary system this investigation is the Abnormal Transient inventory, inadequate primary to secondary heat Operating Guidelines ( ATOG).
transfer, and excessive primary to-secondary heat transfer. These symptoms are important for the F
Expected plant response following reasons:
To prmluce a symptom oriented procedure, ll&W
- l. Adequate prinuiry inventory subcooling. If the developed a thorough understanding of expected operator knows the primary fluid is in a liquid plant responses during many varial abnormal state, he is assured that it is available and transients. These transients includal classic capable of removing heat from the core and singsdar initiating events as well as additional transferring it to the steam generators. If single and multiple comimnent failures. The subcooling is lost, these issues are in doubt, and procedure was developal through the following he is therefore directal to me e every effort to s
steps (usually in parallel):
regain subcooling.
1, Existing plant casualty procalures were
,,ncing,,,,,,;ti, tin,,y,,,,,,,,,,,,,,,,;n,,,,,,,,,,,,,,
investigated for common symptoms. Few sm, gle of offsite power. exccanive main fe,dwater, small accam line alarms or parameters were found to uniquely break, and steam generator tube rupture.
2
- 2. Inadequate primary to-secondary heat transfer.
This symptom addresses the heat transfer q2400 Pos Tnp 9
couphng across the steam generators. It g
,-- y describes the ability of the system to keep the gg flow of energy moving from the reactor coolant Subcooled system to the ultimate heat sink. The operator I
Region monitors the relationship between the reactor f1600 J
Sew coolant cold leg temperature and steam 2
Steam Pre.sure 8
Region generator secondary side saturation temperature.
3 1200 timit Following a reactor trip, these two values should
]
j_____
be nearly equal under good heat transfer r
conditions. If this coupling is broken, the j 800 V
Saturation procedure outlines appropriate corrective actions y
Subcooled Margin to restore it, g 400 tine
- 3. Excessive primary to-secondary heat transfer. In a
400 450 500 550 600 650 this case, the symptom is mdicative of a Reactor coolant and s:eam outlet temperature, F secondary side malfunction (e.g., loss of steam pressure control or steam generator overfill). The g End Point Post Trip with Forced Circulation (T, and T g) e heat transfer is again unbalanced and the r.3 and for Natural Circulation (Tm) operator's attention is directed toward generic h Normal Operating Point. Power Operation (T,)
actions to restore this balance.
By tracking these basic symptoms the operator
] End Point - Post Trip with Natural Circulation (Tg can quickly focus on problems without checking a Figure 1 Basic pressureternperature (P-T) display large number of parameters. At the same time, by their nature the symptoms allow rapid elimination is also input. The saturation temperature for this of problem sources and continue to emphasize core input pressure is displayed as a vertical line. The protection. Additionally, the symptoms am so basic subcooled margin line accounts for potential that the procedure inherently covers many more instrumentation inaccuracies with the objective of initiating events than those first etudied. This assuring subcooling above that line.
happens because initiating events cause equipment A typical plant response to a reactor trip is to fail, and equipment failures affect these shown in Figure 2. For simplicity, only reactor symptoms. As the operator follows the procedure to treat the symptom hc will probably identify and
$2400 I
correct the cause.
2j Path of g
[]
ATOG display g2000 Tnot (,/
The information required to identify and track j
/
o 1600 y
these symptoms is already available in power plant control rooms. It simply consists of reactor coolant o
system hot and cold leg temperatures, reactor 5
_ Steam Pressure 1200
\\
/
coolant system pressure, steam generator pressure, j
_ n
- T eam PressureY cnd access to steam tables. The problem is how y
St these variables can be best displayed to give the j 800 Excursion
/
operator a simple and logical method of monitoring u
th-- symptoms of interest. The solution developed in 6 400 the ATOG is shown in Figure 1, which is basically 2
400 450 500 550 600 650 a pressure-temperature (P-T) display with a saturation curve included. The area above and to Reactor coolant and steam outlet temperature. F the left of this curve is the subcooled region. The Figure 2 Typical posttrip response trea below and to the right is the superheated coolant hot leg temperature is plotted. With the region. Reactor coolant system hot leg temperature reactor coolant pumps running (forced circulation)
(T ot) and cold leg temperature (Teoid) are input to and the comparatively small amount of energy h
this display and plotted as functions of reactor being added to the coolant by decay heat, the cold coolant system pressure. Steam generator pressure leg temperature is also expected to settle out close 3
to this hot leg temperature Additionally, because posttrip value. As long as T ot, Tcold, and SG T,.t h
the a T across the steam generator tubes is small, remain within a "posttrip window," the plant is both of these ternperatures should approach the responding normally.
saturation temperature of the secondary side of the With this type of display, the symptoms of steam generator (SG T,,t). The Figure also shows interest are highlighted and brought into focus for steam pressure moving from its pretrip value up to the operator. Consider the example in Figure 3.
the steam safety valve setpoint and back to its Combinations of these symptoms are also easily y 2400 y 2400 a
a I
[]
N Il C- )
2000 Path of f 2000 g
g y
/
T ot h
) 1600 3
2 16C 8
E 5
2
~
a 3
a g
h,1200 f,1200 **'" Limit
{
j A_.-----
f 3 800 k Saturation 8 800
/
I du0 I 400 400 4%
500 0
600 650 400 450 500 550 600 650 Reactor coolant and steam octiet temperature. F Reactor coolant and steam outlet temperature. F Figure 3A inadequate subcoohng margin:
Figure 3C Excessive primary to secomlary heat transfer:
Tnot is not progressing toward its target value, in SG Tut has decreased be;ow its estabhshed hmit.
fact, it has rapidly dropped through the subcooled Tnot and Tcoid have reached equal values but both margin hne. This condition is diagnosed as loss of have gone out of the posttrip window following SG adequate primary inventory subcooling, or simply Tut. This condition is diagnosed and treated as inadequate subcooling margin," and the excessive primary-to-secondary heat transfer.
procedure is written with directions to take care of inadequate subcoohng margin.
recognized. Consider the example in Figure 4, taken from the first twenty minutes of the TMI.2 a
[,
= 2400 transient.
As shown by these examples, the symptoms of j
- D h,0
/
interest can be combined simply and displayed on a t-
'j/
- 2000 cathode ray tube. With a relatively few number of l
l',", ' j/
input variables, the operator can monitor the real.
]
~~/
time progression of the transient. If one such g
2 P/
display is used for each reactor coolant system loop E
3
,e (because of possible asymmetric loop conditions),
{ 1200 **'Nl,*"
/
the operator has a continuous, complete record of r
.N._
./ /
the entire event. This record allows initial fgoo
} /[/
diagnosis, positive feedback on corrective actions, and early detection of subsequent malfunctions.
aj K-Other display arrangements of basically the same fundamental parameters have been developed with y
y y
similar effectiveness, still relying on basic patterns
,gg 3g gg Reactor coolant and steam outlet temperature. F of parametrlC change to mdicate an overall plant Figure 3B Loss of primary to-secondary heat transfer:
Thot is increasing as SG Tut is decreasing. A AT between the two is growing larger. The secondary is ATOG organizat. ion no longer removing heat and has lost couphng with Once the symptoms are identified and a method of tne primary. This condition is diagnosed and treated as loss of (inadequate) primary-to-secondary heat monitoring those symptoms developed, the next transfer.
step is to reduce this mformation mto somethm.g 4
2400 w
s 2400 I
4 o
- i 12000 1/2
~
/
1 g
1600
)3 1600
,,3
[
l
$ 5 l
3 9
~
ipoo _ Steam Pressure a
,,10 y,00 3
E Lwnst
)
____.._\\.____
- :::= = = = = - --
800
~~~~'~~~~~
. Steam Pressure 800 Lturation y
Lint Saturation N
g 400 Subcooled Marg n 3 400 tme a
g a
a i
400 450 500 550 600 650 400 450 500 550 600 650 Reactor coolant and steam outlet temperature. F heactor coolant and steam outlet temperature. F Figure 4A O to 5 mint.tes:
Figure 4C 8 to 15 minutes:
At time zero the reactor has tripped on loss of Steam pressure and temperature have recovered to feedwater. At % minute Tnot and Tcoid are essentially their normal posttrip values. A substantial cooling the same temperature. At 2% minutes the ES/AS of the primary is a!so in progress.
i pressure setpoint is reached and hig5 pressure injection (HPI) is automatically started. At 3%
minutes subcooling margin is lost, and at 4%
y 2400 minutes the operator stops HPl. By the time 5 9
d
__ S minutes have elapsed the RCS is beginning to heat I
up. Secondary pressure and temperature are below
&2000 limits. The primary-to-secondary AT is -50 F.
3s E 1600
,3 g2400 g
g f **
I
!! sl h1200 i
15
{#0
~
f 20 g
/
g 800 Steam Pressure
] 1600 3
[
h U
Saturation f400 S
5 7 h1200 Steam Pressure 4b 6b0 400 500 550 600 m
Reactor coolant and steam outlet temperature, F 800
~~~~~~~~~
^2 Figure 4D 15 to 20 minutes:
f Primary-to-secondary heat transfer (coupling) is E 400 now almost completely restored. Tnot and Teoid are approaching their normal posttrip values. However, 400 450 500 550 600 650 the inadequate subcooling margin is evident.
Reactor ecolant and steam outlet temperature, F design bases for, and the use of, the procedures.
Figure 48 5 to 8 minutes:
Figure 5 outlines the orgaaization of Part I. The The primary continues to heat up along the immediate actions are common to every reactor trip saturation line while secondary temperature and and must be performed regardless of the cause. The pressure drop. At 8 minutes the primary-to-Vital system status verification is a short checklist secondary AT -80 degrees. Also, auxiliary feedwater is first directed to the steam generators.
used to determine a baseline for possible operator actions. This checklist considers m.strumentation useful to the operator. The Abnormal Transient power supplies, engineered safety features Operating Guidelines consist of two parts. The first activation system (ESFAS) status, steam line break part is procedural guidance to be used in the protection system status, etc. Included in this control room during transients. The second part, a checklist is a requirement to monitor the ATOG much larger volume, is a training aid explaining the display. If everything is normal, the plant has 5
~
intent as to why various steps are taken in Part I.
Section i It also describes, using many graphic examples, the immediate Actions expected plant response information gathered during the guideline development stage. Part II has been written to aid the operator's training and is t I s stem status venfication important to the guidelines because an mtelligent, Section ill capable operator is a basic part of the plant A. Treatment of lack of adequate subcooling margin operating structure in which the guidelines are built B. Treatment of lack of primary-to-secondary heat transfer (i.e., the guidelines try to optimize the operator's C he tment ft much primary-to-secondary heat transfer effectiveness instead of minimizing his impact).
Cooldown procedures Guide ine validat. ion
. Large LOCA Once written, the potential guidelines were tested tu ted RCS on a PWR simulator by imposing multiple e HPl cooling e Solid water cooldown casualties and using the guidelines to recover.
Guideline credibility was also established by back checking the guidelines against event tree paths Figure 5 ATOG - organization of Part I and benchmarking event tree paths and computer responded as designed and come to a steady post-simulations against actual plant transients. The trip condition. No further action is required.
event trees were also reviewed by the utility llowever, if the operator diagnoses an imbalance in operators to take advantage of their plant one of the basic symptoms, he is directed to the experience. The draft guidelines were sent to the appropriate section for follow-up actions. These plant site for walk-through drills to test their sections treat the symptoms and do not require the applicability. Feedback from the operator to the operator to determine the cause. It is expected, plant designer served to greatly reduce however, that as he treats the symptoms he will communication errors and increase confidence in the b
find the original problem.
final guidelines.
Treating the symptoms will allow returning the An important final step in validation involves plant to a stable condition. This stable condition implementing the guidelines into the plant could very well be abnormal compared to what the procedures system. This implementation tests the operator normally sees. Accordingly, various guidelines' scope and appropriateness since they cooldown procedures are provided to give him must be a workable part of the overall plant guidance on long-term recovery from these possible procedures system or their worth diminishes.
conditions.
Existing posttrip procedures must be checked Figure 6 outlines the organization of Part II.
against the guidelines to determine the following:
Intended to give the operator a thorough understanding of Part I, it conveys the writer's
- 1. Necessary actions outside the development program scope but needed for a posttrip Procedure in the same time frame. This assures volume 1 Fundamentals of reactor cor trol for abnormal transients that, although everything may not be A. Heat transfer considered, the adoption of ATOG does not B. Use of P-T diagram decrease in any area the adequacy of procedures C. Abnormal transient diagnosis and mitigation gP gg D. Backup cooling methods E. Best methods of equipment operation Previous procedures may be found good but not F. Stability determination necessary, and either be deleted or relegated to a lower level of instruction. The goal is to volume 2 maximize simplicity.
d " "
"d','7y,~,,S
- 2. Actions that should be included in an instruction e, 3 e
er for longer term action. Current posttrip B. Loss of feedwater C. Steam generator tube rupturY procedures include many necessary follow-up D. Loss of off site power actions that au not appropriate for ATOG, but E. Small steam line break must be includt d somewhere. Three actions, E LOCA identification of these items, determination of the form in which they should be given, and Figure 6 ATOG - organization of Part ll optimization of the interface between the form in 6
3
which they are given and the ATOG, are Summary necessary to make ATOG a workable part of the overall plant procedure system. Again, the goal By using the Abnormal Transient Operating is to maximize simplicity.
Guidelines, the opcrator can enhance plant safety
- 3. Any posttrip procedures not accommodated by by monitoring reactor posttrip parameters for only ATOG, but which must remain intact. One goal a small number of symptoms and taking corrective of ATOG is to eliminate these procedures, but action as directed by the procedure. The guidelines that goal has not yet been proven consistently allow him to use one simple procedure for all attainable. Any such procedures identified must transients which start with a reactor trip. The be entered in a manner compatible with ATOG unique feature of this approach is that it provides a implementation.
common starting point, independent of initiating event, and leads the operator through a step-by-Although plant procedurea vary from plant t step procedure to regain stable plant conditions plant, prehminary work indicates that portions of without having to identify either the cause of the all of the procedures, such as the followmg, may be transient or any additional posttrip malfunctions.
replaced by the ATOG:
- Reactor-turbine trip
- Degraded electrical power
- Loss of coolant /RC pressure
- Steam supply system rupture
- Iess of steam generator feedwater
- Steam generator tube rupture
- Loss of reactor cooling flow RCP trip n
a 7