ML20059E033
| ML20059E033 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 01/04/1994 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20059E004 | List: |
| References | |
| NUDOCS 9401100218 | |
| Download: ML20059E033 (7) | |
Text
SR REOg f I UNITED STATES i ' + f'"gE NUCLEAR REGULATORY COMMISSION -
Ei f WASHINGTON. D.C. 20555-0001
%...../
SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO ALTERNATE MINIFLOW SYSTEM DESIGN AND OPERATION REASSESSMENT OF EMERGENCY CORE COOLING SYSTEM BND HIGH PRESSURE INJECTION SAFETY EVALUATION NORTHEAST NUCLEAR ENERGY COMPANY MILLSTONE NUCLEAR POWER STATION. UNIT NO. 3 DOCKET NO. 50-3NE 3 h-
1.0 INTRODUCTION
In March 1991, considerable damage was discovered in the alternate miniflow (AMF) system at the Shearon Harris Nuclear Power Plant (SHNPP). An NRC study indicated that this damage would have caused degradation in the SHNPP
, emergency core cooling system (ECCS) and impaired its capability to respond to
( a small break loss of coolant accident (SBLOCA).
In response to the SHNPP occurrence the NRC performed an audit of the design I and operability of AMF systems at other plants with similar AMF designs.
Millstone Unit 3 is one of these plants. This evaluation provides the NRC h findings from its audit of the Millstone Unit 3 ECCS in light of ;
considerations related to the SHNPP AMF occurrence. j
2.0 BACKGROUND
2.1 Alternate Miniflow System Desian l
( Several Westinghouse plants, including Millstone Unit 3, feature charging i pumps which, in addition to their charging function during normal plant !
operation, also serve as part of the ECCS high pressure injection (HPI) j system. The design provides a minimum recirculation flow (miniflow) path to i protect the charging pumps from deadheading when trying to inject into a i primary system when pressure is higher than the shutoff head of the pumps. i for some of the plants this miniflow function is satisfied by a non-safety '
grade path through the reactor coolant pump seal cooling system. This path allows sufficient flow during normal plant operation such that the charging pumps will not overheat or be damaged by some other deadheading consequence.
However, during a SBLOCA event, the safety injection signal would cause isolation of the normal miniflow path, and if the reactor coolant system were at a pressure higher than the pump shutoff head, the charging pumps would deadhead. Another concern associated with the miniflow design for some plants 9401100210 940107 I PDR ADOCK 05000423p p PDR 2
j was that the normal miniflow line could divert enough flow from the HPI discharge that the remaining injected flow would not satisfy licensing basis i accident analysis assumptions.
A number of plants with this design, including the SHNPP and the Millstone Unit 3 plant, addressed the concerns by altering the charging /HPI system '
design to include a safety related AMF system which would be made available whenever the normal miniflow path is isolated (see Figure 1). The AMF design features one path from the discharge piping of each charging /HPI pump back to :
the refueling water storage tank (RWST), consisting of two series motor operated isolation valves, (one normally open; one normally closed, but automatically opened by a safety injection signal), a spring loaded relief / control valve set slightly below the shutoff pressure of the pump, and '
associated piping. Functionally, the system was intended to be available when the charging /HPI pumps were called upon to operate in their ECCS mode and to permit adequate flow only when needed to protect the charging /HPI pumps from deadheading. The closure function of the relief / control valve was intended to prevent unnecessary diversion of ECCS water, and to prevent return of contaminated ECCS water to the RWST during the ECCS recirculation mode.
2.2 Shearon Harris Operatina Experience The SHNPP HPI design consists of two charging / safety injection (SI) pumps which perform the charging function during normal plant operation and the HPI function when the ECCS is actuated. A third charging /SI pump is available as a " swing" pump which may be aligned to either of the power trains and either of the AMF paths by manual action. Table 1 and Figure 1 provide design information for the SHNPP HPI and AMF systems.
Tests conducted at SHNPP during a March 1991 refueling outage discovered significant damage to both AMF paths. The damaged equipment and estimated ,
associated diverted flow rates are: (1) first path - failed relief / control valve actuation components, setpoint drift to 1100 psi and flow of 275 gpm, i and (2) other path - relief / control valve seat leakage, 50 gpm; broken drain i line, 500 gpm. A NRC special team inspection report (50-400/92-201, August 27,1992) attributed the damage to waterhammer in the AMF system, and to a design deficiency consisting of excessive piping length (up to 60 ft.) ,
associated with oversized relief / control capacity (275 gpm). A study by the NRC identified the design as suspect, and associated a conditional probability of core damage of 6.3. X 10'3 with the as-found AMF system. ,
Carolina Power & Light Company, the licensee for SHNPP modified the AMF at SHNPP to eliminate the relief / control valve. The modified system was reviewed '
and approved by the NRC. The licensee provided its own probabilistic assessment of the impact of the as-found degraded HPI (including updated input parameters and taking credit for alternate mitigation processes) which identified an estimated conditional probability of core damage of 1.28 X 10'5 .
Prior to modifying the AMF the licensee tested the AMF one additional time with a water-filled system and found damage, from which the licensee concluded that the damage originally attributed to waterhammer may have been due to the hydraulic forces as well.
3.0 MILLSTONE UNIT 3 HPI/AMF OPERABILITY DETERMINATION :
Similar to SHNPP, the Millstone Unit 3 charging pumps serve two functions which include, charging during normal operation and HPI during the ECCS mode. 1' The Millstone Unit 3 HPI system also includes two intermediate head pumps with a lower shutoff head (about 1535 psid) and higher maximum flow (about 650 gpm) than the charging pumps (two pumps, about 2600 psid shutoff, 550 gpm maximum flow) . Important design parameters for these systems are compared in Table 1. !
The Millstone Unit 3 AMF system is similar to the SHNPP AMF in concept and objectives. Table 1 prcvides important design parameters for the two plants' AMF systems. In a letter dated March 11, 1993, Northeast Nuclear Energy Company (NNECO) identified differences between the Millstone Unit 3 AMF system and the SHNPP AMF system which NNEC0 used to show that Millstone Unit 3 is not vulnerable to the AMF damage experienced at SHNPP. NNECO identified oversized relief / control valve and excessive AMF flow as causes of the damage at SHNPP.
These diagnoses agree with NRC inspection findings from SHNPP. NNECO presented information about the Millstone Unit 3 AMF showing that its :
relief / control valve has a much lower capacity (rated at 96 gpm) than that for l the damaged SHNPP system. NNEC0 stated that this lower flow was not excessive and that the resulting hydraulic loads would not cause significant valve l damage or piping damage. Analysis performed by' NNECO and confirmed by j Westinghouse inoicated that significant valve chatter is not expected in the i lower flow AMF system.
- At a meeting on January 7,1993, attended by representatives of Westinghouse and four other licensees with plants having AMF designs similar to i Millstone's, the Comanche Peak representative referenced the cumulative AMF experience of the attending owners and a special test of the AMF run at the Comanche Peak Unit 2 plant. With regard to experience, none of the owners of the lower capacity AMF systems has experienced significant AMF damage.
Surveillance and maintenance information shows minor relief / control valve .
damage (e.g., bellows failure which would result in slight valve leakage, but I would not impact HPI performance) and setpoint drift which are corrected when l found.
The special test performed at Comanche Peak Unit 2 was more extensive than most surveillance tests and included monitoring of the piping system for vibration, strain, pressure, and flow. The relief / control valve operated as NNEC0 expected and did not chatter or cycle. Vibration and strain data were within NNECO's ranges of acceptance. This test was observed by NRC staff.
After the in-situ flow test the relief / control valve was bench tested. A minor disk ring manufacturing defect was found and corrected. A setpoint drift of about 4 percent was also observed and corrected. These results support NNEC0's stated conclusions and are consistent with the SHNPP special i inspection team findings.
NNECO concluded that the Hillstone Unit 3 AMF systems are operable. Because this determination is consistent with AMF experience and related NRC diagnoses, NNEC0's finding is reasonable and appropriate.
4.0 ACCEPTABILITY OF THE MILLSTONE UNIT 3 HPI SYSTEM DESIGN 4.1 Analysis of Postulat1 d Failures in the Millstone Unit 3 AMF System As discussed above, analytical and empirical information presented by NNECO indicate that the Millstone Unit 3 AMF is not vulnerable to the damage producing phenomena that were experienced at SHNPP. Since the damage producing phenomena are not present, it is expected that the AMF would normally perform its intended function in a highly reliable manner. However, if it were postulated that the AMF relief / control valves for the charging /HPI pumps fail in the fully open position permitting rated flow to be diverted (96 gpm each), the resuhing charging /HPI flow (454 gpm from each pump) would be sufficient to meet SBLOCA analysis assumptions. In addition, if it were postulated that one or both AMF relief / control valves were to fail fully open permitting rated flow (95 gpm each), and/or if it were further postulated that the drain lines in both AMF paths were to completely fail (about 500 gpm each), the resultant HPI injection flow, even with an added single failure, would still exceed that assumed in licensing basis LOCA analyses, because flow from the intermediate head HPI pumps to the reactor would not be diverted.
4.2 Surveillance The AMF system is part of the safety related high pressure injection system, and as such must be safety grade, with commensurate surveillance. The safety nature of this system is a position of the NRC and is implicitly accepted by industry by its very provision. Therefore, for the conclusions regarding continued operability determinations made by NNECO for the Millstone Unit 3 AMF system (and for similar AMF systems at other plants) an acceptable surveillance program for the AMF system must exist.
The AMF lines in the High Head Safety Injection (HHSI) system contain a spring-actuated valve in each train which is designed to self-actuate when AMF flow is required. The normal practice for valves of this general design would be to categorize them as relief type valves and as such would be set pressure tested at a normal 5-year or 10-year testing frequency in accordance with Section XI of the ASME Code. However, the staff has determined that these ;
valves perform the safety functions of opening to the HHSI system.
Specifically, the valves perform two control functions: (1) by opening to prevent the HHSI pumps from deadheading following a safety injection signal, and (2) by closing to assure adequate HHSI flow for emergency core cooling, both of which have a significant effect on overall plant safety. Because these relief / control valves at several plants have been shown to perform poorly during various plant system actuations and tests, the staff has determined that in order to properly assure these safety functions, the testing should be performed rare frequently than would be required for relief valves whose function is that of system overpressure protection. Therefore, the staff has determined that, as a minimum, these valves should be tested to assure operational readiness as follows:
l I
.j (1) A minimum of one of the valves should be set pressure tested each fuel ;
cycle. Both valves should be tested within two fuel cycles.
(2) If one valve fails a set pressure test, the other valve should be tested.
(3) An immediate assessment of valve operability should be made following any system actuation requiring valve discharge, including a visual inspection to determine that there is no physical damage and that the relief valve has reset. Both valves should then be set pressure tested, inspected and refurbished as necessary at the next shutdown of sufficient duration to perform these activities.
In a submittal dated March 11, 1993, NNECO committed to perform testing of the li AMF relief / control valves at- a frequency which agrees with item (1) above. By telephone discussion on December 28, 1993, NNECO committed to modify procedures in order to require the testing of the other valve as stated in item (2) above and to require the assessment, testing, inspection and refurbishment as stated in item (3) above. The staff finds these commitments to surveillance acceptable. i 4.3 Millstone Unit 3 HPI System Desian Conclusions Based on our assessment of the impact of AMF failures on performance of the Millstone Unit 3 HPI system as discussed in Section 4.1, and with the '
implementation of an acceptable AMF system surveillance program as discussed in Section 4.2, we conclude that the Millstone Unit 3 HPI system continues to meet applicable criteria and continues to be acceptable as previously found in the Millstone Unit 3 Safety Evaluation Report (SER), NUREG-1031, and 4 supplements supporting operation of Millstone 3.
- 5. CONCLUSIONS j Based on the NRC staff audit of the Millstone Unit 3 history of operability !
determinations as discussed in Section 3, we conclude that NNECO's finding of j past and present AMF operability is reasonable and appropriate. Based on our .,
reassessment of the Millstone Unit 3 HPI design and surveillance program as discussed in Section 4, we. conclude that the HPI system continues to be acceptable. j Attachments: !
Table 1 J Figure 1 ]
Principal Contributors: C. Jackson G. Hammer Date: January 4, 1994
TABLE 1 i
i COMPARISON OF HPI AND AMF DESIGN PARAMETERS r i
MILLSTONE UNIT 3 VS. SHEAR 0N HARRIS Mill s' cone Shearon High Pressure Safety Injection Charging Pumps Number 2 2 (also 1 in reserve)
- Shutoff Pressure, psid 2600 about 2600 Maximum Flow, gpm ' 560 650' SI Pumps
- Number 2- 0 ' l' Shutoff Pressure, psid 1535 N/A' Maximum Flow, gpm _650-670 N/A j Alternate Miniflow Number of Lines per Ch'g Pump 1 1 Line Size, in. 2 2
- AMF Line Length, ft. 15-20 30 - 60 (estimated) _
- Number of Flow Path Turns
. few (3 - 4) several MOV Isolation Valves per Line 2 2 :
Relief / Control Valves per Line 1 1 R/C Valve Size, in. 1-1/2 x 2 1-1/2 x 2-1/2 ,
R/C Valve Orifice Area, sq. in. .129 .222 No Yes R/C Valve Bellows R/C Valve set Pressure, psi 2200 2300
- R/C Valve Stamped Capacity, gpm 96 277 Drain Line Diameter, in. 3/4 3/4 Broken Drain Line Postulated Flow, gpm 500 500
- - most important items for comparison
% r- = ,- , , - * ' r , - -* N e
h s,!
i l
l r
M 8HiNxi4-s44 -
l
'5:Cs-ie2 (SEAL wTR m j.. . r-cdo.: !!
.__ sy;- l 4 7. ICs-214i 6, r mst ' s !!Z .,
- s's !
I PLey g
ir ,N f
M
[^ {A*SA w
! *sg l i
.C3-10l: CHt/s;
/ 'j j
g "c-s4s *PK 3
[kl l:b i 3 i
- f 2 iI t
@c i se
~
i=~$
- i 1
j M
~.
I IcC-196!
y ii >! 14
- t. 2 gs w
y E ..
-i : 1 m m r,
l
- : 1' l - i
- l -
HMSI -
! I i C n v as
! ! l l'UFF
! ! j 19~9 .16-58l >
g iCS-755
, pic. . g p: ,
l g 1C3-752 -l
( TJ . w1CS-754 . .! f.
- 6Q -~ W .!
ICS-75: ICS-74 w1C5-736 Fig.1. charging /safetyinjection system ,
I 1
___ ]