ML20055F811
| ML20055F811 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 07/03/1990 |
| From: | Caroline Hsu NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20055F810 | List: |
| References | |
| TASK-AE, TASK-E90-06, TASK-E90-6 AEOD-E90-06, AEOD-E90-6, IEB-88-004, IEB-88-4, NUDOCS 9007190224 | |
| Download: ML20055F811 (13) | |
Text
. _ _. _.
\\
AEOD ENGINEERING EVALUATION rep 0RT UNIT:
Sequoyah 1 EE REPORT NO.: AE00/E 90-06 NO.:
DOCKET 90-327 DATE: b 3 K3 W LICENSEE:
Tennessee Valley Authority EVALUATUR/CONTXT:
C. Hsu NSSS/AE:
Westinghouse /TVA
SUBJECT:
POTENTIAL FOR RESIDUAL HEAT REMOVAL SYSTEM PUMP DAMAGE EVENT DATE: December 5, 1989 (LER 89-031) 1
SUMMARY
Sequoyah 1 Licensee Event Report 89-031 describes a test in which a residual heat removal (RHR damage during a su)rveillance flow test. pump was running deadheaded with the pot The plant was in Mode I while the flow test was being performed.
Both the RHR pumps were operating, recircula-ting through the miniflow lines to the pump suctions.
Because one of the pumps had a higher developed discharge pressure than the other, the differential pressure forced the discharge check valve of the weaker pump to close.
The discharge check valve is located between the pump and the miniflow line.
As a result, pump flow was blocked; that is, the weaker pump was being deadheaded by the stronger pump.
Analysis showed that operating with no pump flow for longer than 10 minutes would cause pump damage.
The possibility exists that the weaker pump could be deadheaded and damaged during an actual event with safety injection (SI) initiation.
The loss of miniflow path was a unanalyzed plant condition that can significantly compromise plant safety.
The potential for deadheading RHR and other safety-related pumps due to pump-to-pump interaction during miniflow operation has been identified in NRC Bulletin 88-04.
problem in the RHR system in their response to the bulletin.The licensee The bulletin response was based on an inadequate review of the RHR pump test data.
Instead of comparing individual pump differential pressures, average pump differen-tials were compared.
Simultaneous testing of both RHR pumps was not performed because the average differential was within the acceptable limits and the pumps met the American Society of Mechanical Engineers (ASME)Section XI pump test requirements.
The design of the RHR system, with the miniflow line connected downstream of the pump discharge check valve, may leave the RHR pump without adequate nrntactinn gaintt du dh nding in the event tha di nharge check.aive closes during pump operation.
The valve can be forced to close as a result of an adverse pump-to-pump interaction.
The event shows that test data can be misinterpreted and incorrectly used in the evaluation of pump deadheading problems.
Our review identified five other plants that have similar RHR systems'.
This suggests that the potential problem may not have been identified by other plants with a similar RHR system configuration.
9007190224 900703,_,
ADOCK0500fg{<
FDR
~. _. -
)
2 INTRODUCTION This study was initiated to evaluate an eveM which occurred at Sequoyah 1 in December 1989. The event involved an RHR p op running deadheaded with the potential for pump damage during a surveillance flow test.
In the test, both the RHR pumps operated in parallel, taking suction from refueling water storage tank (RWST) as in the S1 mode, and discharging through the miniflow bypass lines. Because one of the pumps. is stronger than the other (i.e., has a higher developed head for the same flow), the discharge check valve of the weaker pump was forced to close by the 3ressure of the stronger pump. The condition resulted in no flow through t1e weaker pump since its miniflow bypass line is downstream of the discharge check valve. A centrifugal pump, generally, would be damaged in 10 to 12 minutes when running without flow.
It was determined by the licensee that the blockage of the miniflow bypass line was an unanalyzed plant condition that can significantly compromise plant.
safety. A schematic diagram of Sequoyah RHR system is shown in Figure 1.
This study reviews the event with respect to its potential safety signi-ficance and the generic implication to other operating plants.
DISCUSSION The RHR system performs both a normal plant function and an accident mitigation function. The normal function is to transfer heat from the reactor coolant system (RCS) to the component cooling system during the low temperature and pressure phase (RCS at 350 degrees F. and 425 psig) of plant cooldown.
The C"9 system will maintain the plant in the cold shutdown condition unt, ne plant is restarted.
During normal plant operation, the RHR system is aligned to perform its accident mitigation function of low pressure core injection (LPCI).
During the injection phase following a loss of coolant accident, it will supply water from the RW5T to the vessel.
It provides long term recirculation core cooling following the injection phase by aligning the pumps to take fluid from the -
containment sump, cool it by the RHR heat exchangers, and supply the vessel directly or via the SI pumps, i
The RHR system is also used during refueling to transfer water between the RWST and the refueling cavity.
A minimum flow bypass line is provided for each pump to recirculate fluid L
through the residual heat exchanger and return the cooled fluid to the pump suction should these pumps be started with their emergency injection flow paths closed. Once flow is established to the RCS, the bypass line is automatically closed.
This bypass line prevents deadheading of the pumps and permits pump testing during normal operation.
The protection provided by the miniflow bypass lines is especially important to the low pressure emergency core cooling system (ECCS) pumps during a postulated small break loss-of-coolant-accident (LOCA). A small break LOCA would cause an SI initiation signal which would automatically start all of the high and low pressure ECCS pumps.
In the initial phase of the occident, the reactor pressure is expected to remain relatively high (i.e., well above the shutoff. head of the low
4 1
j Miniflow Bypass NOTE Line
- A - Proposed Location For The Check Valve.
A l
N To Cold leg Resdual Heat R:sidual Heat Rermal Pump 1
P 1 P J b J L~
mm m
{
z.1 i
F:om RWST To %
Water Storage Tank
-M From Containment 4
i
' Recirc. So.np w
1 r 1 P J h - _.. _ _ __
J L Reedual Heat Reedual Hest A
Removal mp Exchanger N
~
j To Cold leg
{
i J L From Hot leg Miniflow Bypass Line l
4 l
Rgure 1. Residual Heat Removal System - Minimum Flow Lineup i
i
=
l i
i
4 pressure ECCS pumps).
During this early period, the low pressure ECCS injection valves would be closed with pumps running; only che miniflow bypass line valves would be open, injection flows would not commence until RCS pres-sure decreased below the opening pressure of the injection valves.
If the miniflow lines were blocked during the first several minutes of a small break LOCA, the low pressure ECCS pumps would operate deadheaded until the injection valves opened and injection flow was established.
Pump operation without minimum flow could cause significant pump damage or failure in a short period of time. Miniflow bypass capability is, therefore, considered an essential pump protection feature.
The loss of miniflow capability constitutes an unanalyzed plant condition that could potentially damage the RHR pumps and the plant would lose, or partially lose, its core heat removal capability.
On December 5,1989, while performing a surveillance flow test, the licensee declared the B train of ECCS inoperable due to an LPCI pump failing its test.
Both the RHR pumps were being tested concurrently with the pumps taking suction from the RWST, as in an SI o)eration, and discharging through the miniflow bypass lines.
Because of t1e difference in the discharge pressures of the two pumas, the discharge check valve of the 1A pump was forced closed by higher disc 1arge pressure of the IB pump.
This condition resulted in no flow through the 1A pump, since the miniflow bypass line is located down-stream of the discharge check valve; that is, the 1A pump was running deadheaded.
Previous licensee's evaluation had determined that the RHR pumps could be run without flow (deadheaded) for about 10 minutes without sustaining damage.
Since both RHR pumps are started and aligned to discharge to a common line (interconnection) when initiated by a SI signal, the possibility exists that the 1A pump could be deadheaded during such an SI initiation.
The licensee's initial corrective action was to place the 1B pump's control switch in the
" Pull-to-Lock" position to prevent the pump from starting on an SI initiation.
The plant also entered a limiting condition for operation (LCO) as required by the plant technical specifications.
To reduce the likelihood of RHR pump deadheading under S1 conditions, the licensee revised the emergency operating 3rocedure twice. Once on December 6 and again on December 8, 1989. On Decem>er 6, 1989, the licensee revised Emergency Instruction E-0, " Reactor Trip or Safety injection," to require operators to reset an SI signal and then stop both the RHR pumps if the RCS pressure at that time is above 180 psia, This revision constituted a substan-tial change in the procedure.
Previously, the procedure required operators to first verify that RCS pressure is stable at, or increasing above,180 psig prior to stopping the RHR pumps.
This revision would actually require operators to stop the RHR pumps earlier in a transient whenever the RCS pressure was above 180 psig, even if the RCS pressure was falling rapidly due to an LOCA.
Subsequent to this change, the NRC expressed a concern to the licensee about the adequacy of the safety evaluation performed to determine whether the change involves an unreviewed safety question which is one of the requirements of 10 CFR 50.59. The NRC also discussed with the licensee the corrective measures taken by the some other Westinghouse plants in their responses to oulletin co-v4.
rollowing tnis aiscussion, the licensee revised the procedure again on December 8, 1989. This revision changed the provision i
a d
~
5 for stopping both the RHR pumps per previous revision, to requiring operators to stop only one of the RHR pumps.
I NRC Bulletin 88-04, ' Potential Safety-Related Pump loss," identified the potential for deadheading RHR and other safety-related pumps that have a common miniflow line or other piping configurations that could develop pump-to-pump interaction, during miniflow operation. The concern is that the stronger pump in a system could deadhead the weaker pump during low flow, 3arallel pump operation through the miniflow bypass line.
Upon receipt of the j
)ulletin, the licensee of Sequoyah plant performed evaluations on the safety-3 related pumps including the RHR pumps and responded to the bulletin in August i
1988.
The 5. ponse concluded that the potential problem identified in the bulletin did not exist for the RHR pumps at the Sequoyah plant.
This conclusion was based on an inadequate evaluation of the RHR pump test data that were obtained from tests performed in 1987 and 1988.
The pum) differen-tial pressure data used for comparison in the evaluation were not aased on the readings from individual tests.
Instead, the average of differential pressures measured from several tests were used.
The data was averaged to eliminate statistical variation associated with significant data scatter.
The average differential pressure fell in the acceptable range of less than the 11.1 psi limit.
This led the licensee to conclude that the stronger pump would not prevent flow in the weakec g!mp.
Simultaneous testing of both the RHR pumps was not performed.
Based on individual pressures obtained from a test in late 1988, the actual dncharge pressure difference between the two RHR pumps was 17 psi.
Thus, the average rhethod was not adequate to detect or predict a pump-to-pump interaction problem.
This indicated the licensee's failure to recognize the siph ficance of the data and a lack of understanding of the bulletin's intent, h1 NRC inspection team investigation subsequent to the event of December 1989, concluded (Ref.1) that, had the proper analysis been performed on the same data that was averaged, the licensee would have concluded that the problem did exist on Unit I at the ti;ne of the bulletin response.
Continual monitoring and evaluation of the pump-to-pump differen-tial pressure was included in the licensee's corrective actions to preclude an adverse pump-to-pump interaction.
Subsequent to the NRC team investigation, the licensee committed to install a check valve in the discharge section of the pipe, down stream of the minimum flow line. This modification is expected to be completed by the next refueling outage.
To assess the generic implication of the probiem at Sequoyah 1, we reviewed the RHR design of nineteen other operatino Westinohouse plants.
We found five other plants with piping configuration and valve alignment identical to that of the RHR system at Sequoyah plant.
The five plants are Diablo Canyon, Salem, Seabrook, Catawba, and South Texas.
The design of the RHR system at these plants consists of two parallel pumps with the miniflow line connected downstream of the pump discharge check valve. The valves in the cross-connection between the discharge lines are normally open.
This suggests a l
potential generic concern. The miniflow line of the RHR system at these plants would not provide its intended function to protect pumps when the l
discharge check valve is closed.
Such a condition could occur due to adverse pump-to-pump interaction during miniflow operation of the pumps.
A review of one responses to sdC 6uiletin 68-04 from the aoove five plants, indicated that the responses were similar to that from Sequoyah with the exception of Diablo w
t 6
Canyon. Diablo Canyon performed the minimum flow test with both pump running and observed the pump interaction discussed in NRC Bulletin 88-04.
Emergency operating procedures were revised to require securing of one pump following an SI initiation to avoid the loss of both RHR pumps in the interim. A design modification to install a check valve per loop downstream of the minimum flow line is scheduled for the next outage.
For three other plants where the RHR systems do not have pump-to-pump interaction (the valves in the cross-connection are normally closed), the miniflow lines are located downstream of the discharge check valves.
For these RHR systems, the potential does not exist for the pump deadheading due to discharge pressure differential developed during miniflow parallel pump operation. However, the RHR pump could still become deadheaded if the pump operates when the RCS pressure is higher than the pump discharge pressure and tie isolation check valve in the injection line leaks or fails open. Under these conditions, the pump discharge check valve is forced to close by the higher pressura of the RCS, blocking both the normal and bypass pump discharge flow paths. Both the industry and NRC recognized the check valve failures and studies are ongoing to resolve this concern.
The check valve failures have caused such problems as water hammer, system overpressurization, and steam binding of pumps.
The problem regarding failures of the isolation check valve in the LPCI line has been identified and evaluated in an AEOD case study (Ref.
2). The study concluded that the probability for simultaneous failure of independent and diverse isolation barriers between the high-pressure RCS and the low-pressure piping of an ECCS is significantly higher than previously assumed.
FINDINGS AND CONCLUSIONS Each low pressure ECCS pump in a PWR is provided with a miniflow bypass line.
The miniflow bypass line provides an alternative flow path for the centrifugal pump when the pump is operating with no discharge flow, as when its associated i
discharge or injection valve is closed, in this way, the miniflow bypass line prevents overheating or possible damage to the pump when it is running in an otherwise deadheaded condition.
Pump damage or possible failure could occur within a few minutes (10-12 minutes) if a pump were operated with no flow through the pump, that is, with the pump Nd-henaed and without any flow in the miniflow bypass line. A prolonged high pressure condition in the RCS, which would attend a small break LOCA, would be expected to result in the low pressure ECCS pumps operating deadheaded for at least several minutes if minitlow protection was unavailable.
Although Bulletin 88-04 has addressed the pump-to-pump interaction problem during miniflow operations, the licensee of Sequoyah did not identify the potential purp deadheading problem existing in the RHR system in their response to the bulletin.
The licensee failure to recognize the significance of the test data and lack of familiarity with the bulletin were the causes of the failure to identify the problem initially.
The evaluation of the pump-to-pump interaction was ba.;ed on an average of the pump-to-pump differential pressure data rather than pressure readings from individual tests. Testing with both pumps running was not performed oecause it appeared that the average differential pressure was within the acceptable limits and the pumps were
7 determined operable in accordance with ASME Section XI pump testing require-ments.
l Sequoyah has revised emergency operating procedure to require operators to i
trip one of the RHR pumps following an SI initiation whenever the RCS pressure is above 180 psig.
This action is to ensure that the RHR pumps are not run in parallel on miniflow for longer than the time allowable for a pump running i
deadheaded without damage.
Efforts to improve the pump-to-pump differential pressure monitoring and evaluation are also underway.
The corrective action taken by Sequoyah requires operators' actions to 1
overcome the design problem.
This reliance on administrative control to ensure protection of pumps against deadheading could add complication to the plant operations during engineered safety feature (ESF) actuation.
In addition, the timely operators' actions needed in the ESF actuations could compromise the availability of the RHR system.
Recognizing that the operator action cannot always be assured, the Sequoyah and Diablo Canyon licensees committed to install check valves downstream of the minimum flow line to resolve this concern.
This potential pump-to-pump differential pressure problem may not have been identified by other plants with a similar RHR system design in their review of Bulletin 88-04 due to inadequate evaluation similar to that at Sequoyah.
There are many PWR plants with RHR systems that have miniflow lines connected downstream of the pump discharge check valves.
For those plants, the miniflow line of the RHR system cannot provide its intended function to protect the RHR pumps against deadheading in the event the discharge check valve closes during pump operations.
The discharge check valve can be forced to close as a result of an adverse pump-to pump interaction or by high pressure flow from the RCS past a leaking isolation check valve in the injection line.
REFEREilCES 1.
Inspection Report 50-327/90-01 and 50-328/90-01, U.S. Nuclear Regulatory Commission, Region II, February 7, 1990.
2.
Peter Lam, "0verpressurization of Emergency Core Cooling Systems in Boiling Water Reactors," AE00 Case Study Report C502, U.S Nuclear Regulatory Commission, September 1985.
l l
l
IN 90-XX 1
UNITED STATES NUCLEAR REGULATORY COMMISSION i
0FFICE OF NUCLEAR REACTOR REGULATION WASHINGTON, D. C. 20555
^
1 July 1990 I
NRC INFORMATION NOTICE NO 90-XX:
POTENTIAL FOR RHR PUMP DAMAGE i
Addressees:
All holders of operating licenses or construction permits for nuclear power reactors.
Purr.ose t This information notice is provided to alert addressees to. potential problems with the RHR pumps having the miniflow bypass line downstream of the pump discharge check valve.
It is expected that recipients will review the information for applicability to their t.
3s and consider actions, as
d l
appropriate, to avoid similar problems.
Howe
. suggestions contained in f
l this information notice do not constitute NRC requirements; therefore, no.
,pecific action or witten response is required.
Descriotion of Circumstances:
l l
On December 5, 1989, at Sequoyah 1, with the plant in Mode 1, an RHR pump was running dead-headed with the potential for pump damage during a surveillance flow test.
In the test, both the RHR pumps operated in parallel, taking suction from RWST, as in the SI mode, and discharging through the miniflow recirculation lines.
!?ccause one of the pumps had a higher developed discharge pressure than the other, the discharge check valve of the weaker i
pump was forced to close by the pressure of the stronger pump.
The condition resulted in no flow through the weaker pump since its miniflow recirculation inne is downstream or the discnarge check valve.
The licensee's analysis i
E
l I
e 2
showed that 'perating with no pump flow for longer than 11 minutes would cause pump damage.
Since both RHR pumps are started and aligned to discharge to a common line (cross-connection) when initiated by a safety injection signal, the possi-f bility exists that the weaker pump could be dead-headed during an actual event with SI initiation.
The licensee's initial corrective action was to place the stronger pump's n @ ol, witch in the " Pull-to-Lock" position to prevent the pump from startitg en aa 51 initiation.
The plant also entered an LCO as required by the plant technical specifications.
To eliminate the likelihood i
of RHR pump dead-heading under SI conditions, the licensee subsequently revised the emergency operating procedure to require operators to check if one RHR pump should be stopped.
If the RCS pressure is greater than 180 psig and both RHR pumps are running, then one RHR pump is to be stopped and placed in standby.
The applicable system operation instruction also was revised to require that the RHR pumps are not run in parallel on miniflow for longer than 10 minutes. The licensee also committed to install a check valve downstream of the minimum flow line in each train to resolve the hardware concern and to alleviate reliance on operator action in this regard.
NRC Bulletin 88-04, " Potential Safety-related Pump Loss," addresses safety related pumo loss due to deadheading caused by numn-to-numn intaraction during miniflow operation. The concern is that the stronger pump in a system could deadhead the weaker pump during miniflow, parallel pump operation.
The licensee responded to the bulletin in August 1988.
The response concludta the deadheading problem identified in the bulletin did not exist for the RHR pumps at Seouovah plant.
Subseouent to the December 5, 1989 ovant, the licensee conducted a review of the evaluation performed in response to the bulletin and found that the differential pressure hetween the two RHR pumps calculated to support the conclusion was not based on the readings from individual pump tests.
Instead, the average of differential pressures measured from several tests was used.
The data was averaged to eliminate statistical variation associated with significant data scatter.
The differential pressure data were obtained from tests r+-H S 1987 and 1988.
Because the average differen-tial pressure fell in the acceptable range of less than the 11.1 psi limit at
1 Sequoyah, the licensee concluded, in response to the bulletin, that deadheading of the RHR pumps was not an issue.
Simultaneous testing of both the RHR pumps was not performed at that time.
Based on individual pressures
)
obtained from those tests, the actual discharge pressure difference between j
the two RHR pumps was approximately 17 psi, which did exceed the limit.
The licensee concluded that the averaging method is inadequate to detect or predict a pump-to-pump interaction problem.
i Discuulon:
This event illustrates failures of licensee to detect or predict the poten-tial pump dead-heading problem in the RHR system in their response to Bulletin i
88-04.
In the event of a small break LOCA which did not depressurize the RCS below the shutoff head of these pumps within a very shu i period, the pump could become damaged and unavailable to perform their safety functions.
It appears that the differential pressure between the two RHR pumps calculated by averaging differential pressures measured from several tests may not represent the actual pressure difference between the pumps.
Ths averaging method may eliminate data scatter, but is inadequate to detect pump-to-pump interaction problems.
It should be noted that the miniflow line in the RHR system is to provided bypass flow path for inservice testing for pumps and/or for protection against operation of pumps at shutoff heads.
Check valves or other components should not obstruct this minimum flow path and cause deadheading of the pump.
The l
design of the miniflow line connected downstream of the pump discharge check l
valve will leave the pump without adequate protection against deadheading when the discharge check valve is closed.
Such a condition could occur due to j
adverse pump-to-pump interaction during miniflow parallel pump operation upon Si actuations.
Reliance on administrative control to ensure protection of pumps against pump deadheading could compromise the availability of the RHR.
system.
No specific action or written response is required by this information notice.
If you have any questions about this matter, please contact the technical i
contact listed below, the Regional Administrator of the appropriate regional t
office, or this office.
Charles E. Rossi, Director Division of Operational Event Assessment Office of Nuclear Reactor Regulation Technical
Contact:
Chuck Hsu. AE00 (301) 492-4443 P
l I
3 Sequoyah, the licensee concluded, in response to the bulletin, tha' deadheading of the RHR pumps was not an issue.
Simultaneous testing of both f
the RHR pumps was not performed at that time.
Based on individual pressures obtained from those tests, the actual discharge pressure difference between the two RHR pumps was approximately 17 psi, which did exceed the limit.
The
)
licensee concluded that the averaging method is inadequate to detect or predict a pump-to-pump interaction problem.
Discussion:
This event illustrates failures of licensee to detect or predict the poten-tial pump dead-heading problem in the RHR system in their response to Bulletin 88-04.
In the event of a small break L.0CA which did not depressurize the RCS below the shutoff head of these pumps within a very short period, the pump could become damaged and unavailable to perform their safety functions.
It appears that the differential pressure between the two RHR pumps calculated by averaging differential pressures measured from several tests may not represent the actual pressure difference between the pumps.
The averaging method may eliminate data scatter, but is inadequate to detect pump-to-pump interaction problems, it should be noted that the miniflow line in the RHR system is to provided bypass flow path for inservice testing for pumps and/or for protection against operation of pumps at shutoff heads.
Check valves or other components should not obstruct this minimum flow path and cause deadheading of the pump.
The design of the miniflow line connected downstream of the pump discharge check valve wii, leave the pump without adequate protection against deadheading when the discharge check valve is closed.
Such a condition could occur due to adverse pump-to-pump interaction during miniflow parallel pump operation upon SI actuations.
Reliance on administrative control to ensure protection of pumps against pump deadheading could comprom se the availability of the RHR
- system, i
j No specific action or written response is required by this information notice.
)
If you have any questions about this matter, please contact the technical l
contact listed below, the Regional Administrator of the appropriate regional office, or this office, i
Charles E. Rossi, Director Division of Operational Event Assessment Office of Nuclear Reactor Regulation Technical
Contact:
Chuck Hsu, AE00 (301) 492-4443 l
l l
+