ML20053A636
| ML20053A636 | |
| Person / Time | |
|---|---|
| Site: | Midland |
| Issue date: | 04/26/1982 |
| From: | Davis P AFFILIATION NOT ASSIGNED |
| To: | Okrent D Advisory Committee on Reactor Safeguards |
| References | |
| ACRS-CT-1448, NUDOCS 8205270040 | |
| Download: ML20053A636 (5) | |
Text
_
P. R.
Davis P.O. Box 1604 "h
Idaho Falls, Ida.
83401 0
'A April 26,1982 g7 gp Dr. David Okrent Dept. of Energy and Kinetics j7pg g g. p UCLA Los Angeles, CA 90032
SUBJECT:
Evaluation of Auxiliary Feedwater System Reliability at the liidland Plants REFEREliCES:
1.
Letter, D. F. Fischer to P. R. Oavis, Subject; llidlant Plant Auxiliary Feed-water System Reliability, April 13, 1982 2.
11idland Plant Auxiliary Feedvater System Reliability Analysis, Pickard, Lowe, and Carrict Inc. Oct. 1980.
3.
Micianc Fiant AJxiliary Feec..ater Syster Reliability Analysis Evaluation, twREG/
CR-2368, S At4D 81 '?l 64, Dec.1981.
4.
Letter, R. Tedesco to J. Cook (CPCo), transmittal of Preliminary SER Draft section 10.4.9, Auxiliary feedwater System, Oct. 22,1931.
5.
Letter, J. Cook to H. R. Denton, Response to Open Items of Preliminary Draf t SER Sections 3.6.1 and 10.4.9.,11ov.12,1981.
6.
- Letter, J. Cook to H. R. Denton with enclosures (1) B&W System Analysis-LOFW and (2) PL.;G AFW Reliability Reanalysis-LOFW/ LOOP,11 arch 1,1982.
7.
Letter, R. Tedesco to J. Cook, llidland Plant Auxiliary Feedwater System Design, liar. 26,1982.
8.
Draft SER section; Auxiliary Feedwater System, Apr. 9, 1982.
Dear Dr. Okrent; Pursuant to the request in Reference 1, I have evaluated information contained in Ref-erences 2 thru 8.
As I see it, the issue involved can be reduced to two questions: 1.
How reliable is the liidland AFS?, and 2. How reliable does it need to be? The remainder of this letter provides my assessment of the answers to these questions.
I have divided the letter into two parts; Findings, which presents my conclusions revelant to the two questions posed, and Comments, which provides the more important comments which I have on some of the referenced documentation.
A. Findings:
1.
Ilhile several deficiencies appear to exist in the original flidland AFS reliability assessment (Reference 2) as noted in the Comment section following, I find the overall quantitative resulth very consistent with my own related experience in AFS reliability determinations, as well as other independent assessments of sim-ilar systems, fiotwithstanding Finding #5 following, I feel that the Reference 2 results represent a reasonable estimate of the Midland AFS reliability as deter-mined using conventional system reliability assessment methodology.
2.
With one exception, the re-analysis of the AFS reliability as provided in Reference 6 appears to produce reasonable results and no major deficiencies were found, al-though the information provided is sketchy.
The exception is the credit assumed for human recovery actions.
This aspect is discussed in item 4 follow' (b
03 DEbGNAiED ORIGI hl, S
RECEll/ED 4
Certified By b
MAY 2 019825 N
8205270o%
"TJe=gg ga 7, RDC yp r
e
-2 3.
I find the liRC justification'for an AFS reliability in the range of 10-4 to
<g 10-5 very weak based on the information provided, with only a brief discussion of it in the liattson to Denton memo attached to Reference 4.
It seems of questionable logic to require a specific plant safety system reliability based on a rather obscure connection between it and the probability of core melt related to the results of studies from other plants.
Since a comprehensive PRA for liidland does not exist, it is impossible to determine if the plant meets the fiRC proposed core melt criteria with the currently designed AFS and its associated reliability.
This is a perplexing situation (and one which will certainly occur for other plants) recuiring careful and thoughtful judgement.
4.
In the reference documentation, CPCo presents several arguments to support either an increased reliability for their AFS or a reduced dependence on it based on the existing design.
These argunents and my assessment of them are as follows:
a.
Human _ recovery a_ctions-In my opinion, only very limited credit, if any, sho;ld be given for recovery actions since: 1) The steam cenerators boil dry very quickly (20 to 25 min.) and I agree with the liRC that injecting water (especially cold AFS water) into dry or nearly dry steam generators is an undesireable condition.
The S.G. thermal shock failure potential is of concern, and the possibility of chugging when cold wter encounters hot surfaces can cause difficult problems, including failure of level control (Or failure of the F0GG system) from oscillating pressures.
Fu rthe rmore,
the accident scenario of most concern here is that initiated by loss of of f-site power.
This would appear to make human recovery actions par-ticularly difficult since plant elevators would be inoperable, lighting and communications would likely be limited, etc.
Also, if liidland is sim-ilar to other plants, keys must be obtained to gain access to AFS pump rooms, and in many cases, repair procedures must be found and followed.
b.
Feed and Bleed operation to suoplement AFS-CPCo argues (Reference 6) that HPIS operation in conjunction with PORV cycling can cool the core in the event of AFS failure.
Indeed, B&W plants do have high pressure feed and bleed capability.
However, the NRC has recently concluded that feed and bleed should be performed only at relatively low pressure to avoid pressurized thermal shock.
It is not clear (Shearon to Kniel meno of Iiar.
31,1981, " Status of Feed and Bleed for Emergency Decay Heat Removal) if B&W PORV relief capability is sufficient to reduce the primary pressure.
This appears to be an open issue, but certainly feed and bleed could be a last ditch option for flidland although perhaps no~tunder conditions assuring i
retention of primary system integrity.
c.
Cross tie of emergency AC buses-CPCo (Reverence 6) proposes to change the system design such that either the A or B emergency diesel driven AC power source can provide power to the AFS notor driven pump.
However, the pro-posed change would require human action in the event the normally connected AC train becomes unavailable.
The f4RC rejects this proposal (Reference 7),
claiming "possible reduction in reliability of the diesel generator buses inherent in the switching capability between vital buses..."
The NRC pos-ition is not explained further.
It seems to me the emergency AC bus cross-tie could provide an enhanced AFS reliability if it were made automatic and were designed such that emergency AC power reliability was not compromised.
As I recall, just such a system has been proposed recently by C.E. (ACRS decay heat removal sub-committee meeting of !! arch 16) and appeared to have been favorably received by fiRC staff.
l
?.
- d. BJW Analysisof System Respor se to AFS-B&W provided an analysis of plant V.
response to transients requiring AFS actuation.
Conservatisms were listed.
illustrating the potentially longer times available to actuate the AFS and its enhanced cooling capability.
Generally, the effect of these conservatisms is unquantified.
I don't feel that these contentions have a particularly significant bearing on the AFS reliability (see following comments).
5.
As I see it, the current situation can be sumarized as follows: CPCo contends that their AFS reliability meets the fiRC criterion, which they imply may be mis-applied for flidland, and further, the addition of a third pump train would impose a " severe hardship" on the schedule (Reference 5).
fdRC does not accept CPCo's arguments for either improved reliability or exemption from the fiRC criteria.
The third pump thus remains a f1RC requirement (Reference 7).
My cwn inclination is to tend ty.ards the f;RC position to the extent that an irarove-r.ent in the Midlard ACS reliatility is prchability warriHie~d.~ i basi Wis On tre
~
Toll ~oidn~g factors; ITAccording to recent f1RC data evaluations, AFS failure probabilit) could be as high as 10-3/ demand, significantly higher than any reliability calculation I have seen for any AFS.
While there seems to be some question about the definit-iveness and application of these data (I have not reviewed the data), they suggest that AFS reliability calculated by conventional methodology and data may be optim-istic, 2) The AFS is demonstrably a very important safety system, and its importance in plant recovery from a wide array of relatively likely abnormal events cannot be understated, and 3) I am personally aware of the failure of a 2-train AFS system at a plant ( a third train has been added).
Fortunately, the failure occurred at very low core peser and ample time was available to restore the system.
The knowl-edge of this failure is obviously not a valid reason to condemn all 2-train designs, but it tends to inspire apprehension relative to 2-train AFS reliability.
While I tend to concur with the f1RC that increased reliability is probably warranted for the Ilidland AFS, I do not agree with the apparent flRC position that a third punp]istherequiredfix.
It seems to me two other possibilities exist:
1 Provide an auto.atic, non-degrading system to switch to the operating emer-gency power bus (see item 4.c above).
- 2) Provide a cross-tie between the discharge of liidland Unit 1 and Unit 2AFS.
This would appear to offer substantial AFS reliability increases in all cases considered, and is not suggested in any of the referenced documentation.
It would seem to be an inexpensive modification ( a cross-tie between the systems already exists on the suction side, based on Fig. 4 of Ref. 2).
This modification would have to be made with appropriate attention to valve locations and actuation logic, but my preliminary assessment of potential designs seems to indicate feasibility without excessive design effort or degradation in the reliability of either system.
With the proposed midification, either unit experiencing loss of feedwater without loss of off-site power (Case #1 of those considered) would have avail-abic four independent AFS trains rather than two with the current design.
For the loss of off-site power case (p2), successful operation of any two (possibly any one as discussed next) of the four trains would cool both cores.
This would improve the current situation which requires successful operation of 1 of 2 trains for both systems. lio apparent improvement would occur for the loss of all AC power case (#3) under present feedwater flow requirement assunptions.
However, based on a rough calculation, it appears that either
4 ~
turbine pump (at 885 gpm each, per Ref. 3) could supply sufficient flow to cool both cores after about 150 sec (well before S.G. dryout, see Ref. 6) assuming an even flow split and vaporization of all water ( a reasonable ass-umption, see Ref.I.). Thus, some potential gain in AFS reliability is conceivable for even Case #3( Q
/
I note that this cross-connecting of safety systems at multiple unit sites already exists at present sites for emergency diesel generators.
B. C0ftiENTS:
- 1. Reference 2-
- a. Pg. 5 et. seq.- The comparisons here between flidland and other AFS reliability results is confusing and of questionable validity.
The other reliability results are stem as a function of various tires, while the liidland case is "on demand".
It is tct clear vihat such co garisons csan.
Furthernore, the basis for, cata sources, methodology used, success criteria assumed, human intervention asumptiont i etc. are not provided for the other assessments.
- b. Pg. 33-The description of " plant specific data" here in conjunction with the data descriptions in Appendix D do not provide a definitive explanation of the actual data used.
Are the data for B&W plants, tiidland manufacturer specific components, generic PWRs, etc.?
- c. Pg. 57,58,59 (Tables 8.B.2, 3, and 4)- Turbine failure is given three different values in these tables, and the reasons are not clear.
Turbine failure data I have seen and used does not distinguish for the the status of off-site or on-site AC power, and these tables seem to imply.
As a result, failure prob-abilities for all but the Table 8.B.4 value seem much too high.
(Appendix D quotes only the Table 8.B.4 value.)
l
- d. Pg. 67, third para.- It is stated here that only one AFWS turbine driven pump failure was found in LERs for the period from Jan.1972 to Apr.1978.
I am i
aware of three such failures at a single plant during this period, and LERs were prepared for all of them.
(The turbine which failed happened also to be of the same manufacturer as the liidland turbine).
- e. Pg. 94, Fig.12 and accompanying text-It would be helpful if the state of the i
core could be provided for the various failure modes considered here.
It is l
not obvious which kinds of failures lead to inadequate core cooling.
- f. Appendix D-This Appendix contains a confusing mix of demand failures and hourly failure rates, In some cases only one or the other is given, while both appear needed for a complete assessment.
Also, it is not clear what the basis for selection of the value used in the assessment is.
Further, the source of data for the quoted data sources needs to be provided.
Pg. 27-It is stated here that the AFWS actuation signal was beyond the boundary 9
of the analysis.
The basis for and effect of this limitation needs explanation.
(1) in inis regard, it should be noted that all four liidland AFS pumps at both units apparently have about twice the necessary capacity (alluded to in Ref. 6).
While this excess capacity does not influence system reliability when assessed with con-ventional methods (i.e.-no credit given for partial system success), it may mean that any one pump has sufficient flow for cooling both cores. This would further enhance reliability improvements for the proposed discharde cross-over nodification.
P. R. Davis t April 27,1982 B. 'C0f TENTS (Cont.):
's
- 2. Reference 3-
- a. This reference purports to be a review of the PLG study of the !!idland AFS reliability (Reference 2).
However, l' find it to be little more than an overview of the PLG results and of little value in assessing the validity of the PLG result.
- 3. Reference 4-no connent except as noted in the previous section (Findings).
- 4. Reference 5-no con ents.
l
- 5. Reference 6-
- a. B&W enclosure-This assessment appears to assume that two-phase natural circulation (eitter cc-current or reflux) will always be a viable.echanism to cool the ccri.
i: nile s Te experiaental ecidence e>ists to support this conclusion, some questions still remain (non-condensible gas effects).
- b. Bau enclosure, pg. 3, item 2-The 600 psi injection pressure stated here appears much too low.
- c. BOW enclosure, Fg. 4, item 9-1.0 times the 1971 ANS decay beat standard is said to be used (for " realistic" simulation of decay heat).
The existence.
of actinides as well as activated structures in the vessel can increase the ANS decay heat value by several percent.
(The increased power level ass-1 umed for Midland, some 13% above its maximum power according to page 6,under' 4
Conservatisms, should more than offset this increase, however).
- d. S&W analysis, pc. 4, item 3.-
The table here indicates that the S.G. will experience inventory boil-off in 100 sec.. This seems extremely fast, and would virtually eliminate any consideration of human recovery action if dry S.Gl conditions must be prevented.
i
- 6. References 7 and 8-no comme,nts.
1 hope information contained in this letter is of use to your subcommittee in its upcoming deliberations on the safety of the ffidland plant.
If you have any questions, l
please call.
i l
Sincerely, h
t P. R. Davis
,-en-nm
-,nm---.-
--,r,,p-,
w,
,-.-ew-
--n--------nn.
-,n---n------
+n,e
-- - - - -,c