ML20090H752
| ML20090H752 | |
| Person / Time | |
|---|---|
| Site: | Callaway, 05000000 |
| Issue date: | 03/13/1984 |
| From: | Dozinel P TRACTIONEL (FORMERLY SOCIETE DE TRACTION ET D'ELECTRI |
| To: | Eisenhut D Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML19271F257 | List: |
| References | |
| NUDOCS 8405040187 | |
| Download: ML20090H752 (19) | |
Text
_
a Mucje-g t w..+
ha.nr faC: lone
. o\\, s s m a Societe de Traction et d'Electnote d
,Mf4kb'"
tractlertel
,J.j; ego.,
w, Your ref.
73961B011 ec sW of Mcensing MM TE/NUPR/PD/ DAN Nuclear Regulatory Commission Tel. direct 02/234. 4 7. 6 6 Washington DC 20 555 Standard 02/234 4111 17026 Brussels. March 13th 1984
/N
Dear Mister Eisenhut,
f As a representative of the belgian utilities to the Westinghouse owners' Group I have received a copy of your letter of November 15 1983 relating to the approach introduced in the Borselle reactor to cope with a SGTR accident.
After having seen both a stuck PORV incident and a SGTR in PWR's of Westinghouse design it is our strong belief that the SI initiation by a coincidence between low pressure and low pressurizer level should not be reintroduced and that SI should be initiated by a low pressure signal only.
I hereto attach a note supporting this position.
Yours sincerely T RA CT I O N E L l
m f
Y P.
DOZINEL Deputy Manager
'e -
' t.
)
treettemet L
A.
INTRODUCTION Most operating systems were conceived before the TMI event.
This event has clearly changed the emphasis from large 7
S, LOCA's to anticipated and abnormal plant transients and fi'^
required some changes in the reactor protection systems
( TMI action plan ).
The recommended changes depend largely on the basic protection concepts which differ widely for different reactor vendors.
B.
KWU versus Westinghouse design concept.
Some very important differences in the derign concept exist between KWU and Westinghouse plants especially for addressing small LOCA's (-inclusive SGTR ) such as :
W designed plants have two distinct containment isolation phases called A and B depending on the containment pressure.
For a given containment pressure treshold ( typically 10 %
of design pressure )
isolation phase A is triggered upon generation of a SI signal.
In this phase some vital control systems continue to function and enable the operator to control the-plant to achieve and maintain a safe shut down by means of e.g : CVCS ~ systems ( + pressurizer spray )
primary coolant pumps which keep running
- containment pressurized air available for pneumatic operated valves.
- component cooling remains available.
And those are the systems used to mitigate the consequences of small loca's and abnormal plant transitions.
Only when the containment pressure reaches the treshold of 1
l 50 %
isolation phase B is reached wherein operator looses control of many systems and the programmed large LOCA sequence takes over.
ll g
-i r
,4
The KWU designed plants have only 1 isolation phase which corresponds to the B phase for Westinghouse plants and which is triggered by a SI signal.
This is the main reason why a SI signal generation in case of small LOCA's should be avoided in KWU plants but not in Westinghouse plants.
Westinghouse plants generally have much smaller pressurizers for a given power rating than equivalent KWU reactors.
Hence for many small break loca's or SGTR the low level treshold is not reached in KWU reactors and only larger breaks which need high pressure safety injection may lead to emptying the pressurizer.
Westinghouse plants are not equipped with N - 16 detectors on the steam lines and are not programmed to start an automatic depressurization sequence when a SGTR occurs as is the case for KWU reactors.
This feature in KWU reactors starts initigating the consequences of a SGTR very early and can reduce the loss of coolant such that a high capacity SI injection may not be needed and that a CVCS system can maintain a high RCS inventory.
For Westinghouse designed plants a turbine trip follows immediately upon reactor scram.
For KWU plants a delay of 20 seconds is built in to extract a large amount of heat from the RCS ensuring a sufficient degree of subcooling during the depressurzation following a SGTR.
For Westinghouse plants, the subcooling has to be achieved by MPSI ( preferabl'y in conjunction with pressurizer spray )
combined with steam discharge from the intact steam generator once the faulted steam generator is identified.
- These differences are illustrated in table 1 by comparing a SGTR scenario in KWU and Westinghouse plants.
r C.
Impact of application of the low pressurizer pressure-low pressurizer level coincidence trip in Westinghouse reactors In our plants
,'fo,r many,small break loca transients the application of a-l'ow pressurizer level - lov pressurizer pressure coincidence ~ trip will hardly change anything.
Because of the smaller pressurizer size the low pressurizer level setpoint will be reached before the low pressurizer pressure setpoint for SI generation is reached ( ef events in Ginna, Doel ref paper by E.
STUBBE and H.
MICHIELS presented at the Jackson Wyoming conference Sept 83 fig. 4 attached ).
However many reactor transients have identified unreliable level readings ( cf Doel )
because the level signal derived from adP cell is calibrated only for nominal water conditions ( densities ) and cannot be used when the pressurizer conditions deviate from nominal conditions transient;(
e.g.
by filling up with cold HPSI water during a combined with spray ).
Furthermore in case of a large LOCA (
e.g.
rupture of surge-line
). whereby one level reading column may be destroyed the design of the level reading cell should then be such as to indicate low level in order to trigger SI signal.
The application of the coincidence trip is specially intended to cope with smaller loca's or steamgenerator tube ruptures in KWU reactors.
These transients are by nature slow transients which allow sufficient time for judicious operator intervention.
However the plant should be sufficiently protected for larger LOCA's which need automatic SI. injection.
Hence any change in trip setting for SI injection to accomodate slow transients should not compromise the response to faster transients.
This would require additional changes in the trip levels or operating procedures (
e.g.
reducing the containment pressure treshold for containment isolation ) in such cases as vapor space breaks ( stuck open PORV). which are accomnanied hv a hinh nra==ne4=av l atra l
_ 4 _
D.
CONCLUSION The above arguments should strenghten the position not to apply the KWU fix i.e.
not to restore the low pressurizer pressure - low pressurizer level coincidence trip in Westinghouse reactors.
1 f
W '. ' '
. TABLE 1 : Typical scenario ~for a single tube SGTR event.
.p
' Sequence of main events KWU original concept Westinghouse concept
~
Detection of the event' Automatic by N16 sensors
- High radiation alarm after about 15 seconds in air ejectors
- blowdown sampling after about 60 seconds Initial depressurization Preprogrammed ( fast )
by loss of RCS coolant
.of the RCS
( slow )
Reactor scram by N 16. sensors (15 see) by low pressurizer pressure
( after about 300 see ).
Turbine trip 20 sec. after reactor by reactor scram scram Pressurizer level slow ( compenated by fast, due to small size
~Secrease CVCS ) for large pressu-pressurizer empties in about rizer 300 sec.
_ Safety injection signal does not occur by using on low pressurizer pressure coincidence trip logic
( after about-400 sec. )
L' RCS cooldown CVCS injection + steam HPSI + steam discharge from discharge from intact identified intact SG.
\\
'Make-Up of RCS coolant CVCS only HPSI + pressurizer spray Pressure egalisation preprogrammed by tripping the HPSI across break
( operator ) after about 600 seconds.
x The time delays are only indicative to illustrate the chronology of the events.
PREPRINT OF PAPER TO BE PRESENTED AT THE ANS TOPICAL MEETING ON ANTICIPATED AND ABNORMAL PLANT TRANSIENT IN LIGHT WATER REACTORS SEPTEMBER 26-29,1983/ JACKSON, !1YONING l
r BY I
E.J. STUBBE TRACTIONEL L
H.SABLON E.B.E.S.
l l
l t
I ANALYSIS AND SIMULATION OF THE DOEL-2 STEAM GENERATOR TUBE RUP EVENT E.J. STUBBE, J.M. CHALAH *T TRACTIONEL, Brussels H. MICHIELS, H. SABLON :
E.B.E.S., Doel ABSTRACT Severe plant transients, following a steam generator tube rupture (SGTR), have a relatively high probability of occurrence and may entrain a certain risk to the population and the plant (class IV accident). The SGTR event which occurred at the DOEL-2 plant in June 1979, presents many interesting phenomena which are analysed based on the on-site data recordings on one hand, and a detailed numerical simulation, using the RELAP-5 code, on the other hand.
This event stimulated a revision of the emergency procedures, led to considerable improvements in the operator control over safe-guard systems and highlights the importance of operator training.
The numerical results do enhance the understanding of the observed f
phenomena and complement the plant recorded data.
The RELAP-5 code is capable of simulating such transient.
- 1. IffrRODUCTIOl Severe plant transients, following a SGTR have been observed in several power plants (ref. 1) and may occur with a relative high probability due to serious steam generator tube degradation.
Since this event is a class IV accident which breaches several protective barriers of the plant, there is a certain risk involved for the po-pulation. Furdaermore, plant experienct has learned that a difficult decision making process is required at almost every phase of such transient to maintain the power plant under full control.
i The SGTR event that occurred at the DOEL-2 power plant (2 loop 392 i
MWe PWR) illustrates the different phases which have been mastered as prescribed and which affected neither the environment nor the installation.
~
2.
The ahatomy of the transient presented in chapter 2 is based on the on-site data recordings and a detailed numerical simulation of the transient by means of the computer code RELAP-5 MOD 1.
The impact of this event on the emergency procedures and on some system con-trols is discussed in chapter 3.
- 2. ANATOMY OF THE DOEL-2 SGTR EVENT 2.1. Chronology of the events and operator actions Figure 1 illustrates the evolution of the most important parameters as reconstructed from the plant recordings.
The plant was' at the end of the heat-up phase following a cold shut-down of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> with the reactor sWocritical (Decay heat : 6 MWth),
both primary pumps running (2 x 2.5 MWth) and both steam generators (SG) isolated (MSIV closed).
- Initiating event : figure 1 between points A and D At 19.20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> on June 29th 1979, a quick lev'cl decrease in the pressurizer and a pressure decrease of 2.5 bar/ min in the RCS was observed. While the pressurizer level went off-scale low (B), a quick level increase was observed in the B-loop SG (C).
When the automatic measurement channels of the SG blowdown loops recorded a maximum activity level, the operator diagnosed within a few minutes the cause of the event to be a SGTR in the B-loop SG.
- Mitigation phase : figure 1 between points D and L
. start-up of a third charging pump to maximize water inventory
. opening of the intact SG A atmospheric steam dump valve (D)
. the operator tripped the primary pump of affected loop
. at 117 bar, the safety injection signal was generated which initiated the high pressure safety injection (HPSI) at 105 Far
. low level in SG A (G) actuated the steam valves of both SG to the turbopump which starts injecting AFW (H).
The steam dis-charge from the affected SG B is stopped 8 min, later (I).
. to reduce the break flow ra*.e, the operator restarted the prima-ry pump of affected loop and utilized full pressurizer spray (J).
This operation was stopped when the pressurizer level went off-scale high (K). This caused the primary pressure to increase l
from 75 bar to the shutoff head of the HPSI (L).
- Safety injection cancelling phase
- figure 2 between points L and R the operator tried to cancel the SI-signal in order to reduce further the primary pressure. A pressure reduction was needed to reduce the break mass flow rate, to avoid activating the safety valves of the affected SG and be able to switch to the shutdown cooling system (below 28 bar).
However, a circuit logic fault did regenerate an SI signal after reset.
About 20 min. elapsed before the concerned bistables were flicked over manually and 3 HPSI pu=ps were stopped (M).
- A.o M.
3
. after checking the subcooling margin the last HPSI pump was stopped (N) and pressure dropped to 65 bar (O).
the containment isolation, generated by the SI-signal, elimina-ted the compressed air supply in the reactor building, hence preventing to open the let-down line.
About 20 min. elapsed before the air supply was restored and the pneumatic isolation valve on the letdown line was opened (P).
. after stopping a charging pump (Q), the pressure decreased to the point where the residual heat removal system can be coupled to the RCS (R).
- Long term behaviour : about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> after the break occurred the temperature in the steam phase of the affected SG was still 180*C, which prevented a reduction of the primary pressure below 10 bar to avoid a dilution risk. To further avoid flooding of the main steam line and to eliminate any risk of sudden steau collapse on the hot steam-cold water interface, nitrogen was injected in the steam line, while draining water through a drainline into a li-quid waste reservoir.
2.2. Numerical simulation of the transient 2.2.1. gbjgetivgs A thermal hydraulic analysis of this event was performed by means of the computer code RELAP-5 MOD 1 CYCLE 14 (ref. 2) with the fol-lowing objectives
- to improve, by numerical means, the understanding of the different phenomena occurring during such event and the interpretation of the various recorded data
- to evaluate the mass and energy balance at various stages during the transient and the evolution of the coolant inventory in the RCS
- to evaluate the break flow rate, and the radioactive releases to the atmosphere from the faulted SG i
- to assess the capability of the RELAP-5 code and their users to simulate such transients, and thereby dispose of a qualified nu=e-rical tool to evaluate the impact of operator actions on the transient.
2.2.2. Ngaalisatigg The simulation period of 2700 s, started at the estimated time of tube rupture (to = 19 hr 20 min. : fig. 1, point A) and ended at the pressure recovery af ter stopping the pressurizer spray (fig.
1, point L). The final nodalisation, including SG secondary, consists of 136 volumes, 140 junctions and 145 heat slabs.
q Some special models were incorporated such as :
- steam generator tube break model : A valve junction, between SG B primary and secondary was simulated with a control valve adjusted to yield the recorded initial level rise in the affected SG (fig. 1 e)
- auxiliary feedwater systems : Two motordriven pumps and one tur-bine driven feedwater pump were simulated (control block)
- charging and let-down system
- pressurizer spray and heaters : The spray system had to be simula-ted by separate spray lines to each pressurizer volume in order to overcome water hang-up in the pressurizer caused by too high in-terface drag.
- high pressure safety injection system : Four pu=ps delivering 50 %
to the downcomer and 25 % each to both cold legs were simulated by 3 time-dependent junctions with tabulated flow delivery curves in function of a compensated RCS backpressure.
- steam generator atmospheric steam dump valve Figure 2 illustrates the activation sequer.:e of the various systems.
2.2.3. o1 gussign_gf_th _g3=3rigal_ggs31tg 3
3 The figs. 3 to 7 illustrate the comparison between calculated data (RELAP : solid line) and the plant recorded data (dashed line).
- The calculated pressure evolution (fig. 3) compares favourably with the recorded data. The initial decompression follows closely the recorded values until the pressurizer is empty. At 600 s the calculated pressure drop results from excessive condensation of hot pressurizer steam on the subcooled primary fluid. This dis-crepancy may result from a code defiency in condensation modelling but also from the condensing heat transfer reduction in the pre-sence of hydrogen at the interface.
- When the RPSI is activated (1200s), the calculated pressure at which the RCS stabilizes is about 4 bar below the recorded pres-sure. This is caused by underestimating the shutoff head of the HPSI (105 bar used for safety calculations) and eventual instru-ment error (+_1. 5 %).
- Fig. 4 illustrates the evolution of the collapsed water level in the pressurizer.
The discrepancies are due, firstly to the limi-ted range for the recordings, but mainly due to the calibration error of the level gauge beyond nominal conditions.
For the pres-surizer conditions at 2400 s, the A P level gauge, calibrated for nominal conditions, indicates a full pressurizer, because of the heavier weight of the cold water.
By applying the necessary cor-rections for density, a 100 t level reading should correspond to a collapsed water level at 68 %,
close to the calculated level.
5.
- Figures 5 and 6 illustrate the pressure and water level in the intact SG.
The discrepancy in the water level is caused by under-estimating the steam discharge rate and uncertainties in the timing of the AFW motorpump for this steam generator.
2.3. Detailed analysis of some important phenomena 2.3.1. Break Fig. 7 illustrates the evolution of the calculated flow rates through the break and EPSI injection.
Initially the break flow is about 15 kg/s (300 gpm). Post examination of the failed tube re-vealed a longitudinal crack of about 7 cm long located in the innermost row of tubes at the beginning of the U bend. The cause is considered to be stress corrosion cracking enhanced by excess ovality.
2.3.2. ggglag3_igygntory_in_the_RCS,,ef fect_of_gressurizer_sgray
- Although the water level in the pressurizer went off scale low (600 s), the calculations suggest that at no time steam void forsation occurred in the loops or stagnant regions of the RCS.
Such risk was minimized by keeping at least one primary pump running.
- During the HPSI period between 1200 s and the start of the pres-surizer spray, the coolant inventory was stable. Although the cold water addition from the HPSI and the charging system excee-ded the break flow rate (fig. 7), the primary coolant contraction caused by a RCS cooling rate of about 1.2*C/ min, created an almost constant volumetric water inventory (fig. 4). Hence the HPSI system was not able to refill the pressurizer.
- Although the operator tried to reduce the pressure by using the pressurizer spray the only benefit of this action was to refill the pressurizer (fig. 4, fig. 7).
This indicates the importance of using the pressurizer spray, and hence the importance of keeping at least one primary pump running during such event.
- The calculations indicate that, contrary to the opinion of the operator, the pressurizer did maintain a steam space.
A cold calibrated level gauge could help the operator to control better the pressurizer level, since water solid conditions would occur for a reading of about 85 % on this gauge.
2.3.3. geelggyg_gg_3hg_egigggy_sysseg_ggg_agggg33g_s3 sag _gggggg3g5
- From the time the steam dump valve to atmosphere opens, the intact SG acts as an efficient heat sink for the RCS.
The affected SG constitutes a heat source, except during the short time period the steam admission valves to the turbine driven pump opens aute=ati-cally. During this time period of about 7 minutes, about 1 ten of contaminated steam discharged from the affected SG.
6.
- For such relative slow transients, the structural sensible heat accounts for roughly 15 Y of the net energy balance during the initial cooldown phase. Detailed simulation of the structural components is hence important, especially for simulating the pressurizer behaviour.
- For the affected steam generator, there exists no efficient coo-ling mechanism.
While the U tube bundle may be immersed in cold water leaking from the break and injected by the AFW system, the steam dome has no cooling mechanism other than thermal conduction via steam generator shell and internals, hence Jreating a very strong temperature stratification, while this SG acts as a second pressurizer. Such condition could eventually lead to sudden steam collapse if the stratification is disturbed accidentally.
- 3. IMPACT OF THE TRANSIENT ON PROCEDURES AND PLANT CONTROL SYSTEMS 3.1. Isolation of the affected steam generator Although the procedures did specify the isolation of the affected SG as soon as the cause is diagnosed, no check-list of actions was available.
In this event, the operator forgot to close the vapour discharge line to the turbopump which caused the only release of contaninated steam to the atmosphere
(+ 1 ton). New procedures do present a more detailed check-list.
3.2. Primary pump control According to the operating procedures, the operator should reduce the primary pressure to a level below the safety valve setpoint of the steam generators ( Of 70 bar). Since the RCS pressure was hanging up at the shutoff head of the HPSI (105 bar) the operator started the second pump to have full pressurizer spray capacity and hence to achieve the reco= mended pressure reduction.
Fig. 3 shows the temporary pressure drop during pressurizer spray.
However, the benefit of such action was to refill the pressurizer (fig. 4) and not to reduce the pressure, as the pressure rose to the shutoff head of the RPSI when spray was stopped.
This event clearly illustrates the importance of the pressurizer spray in order to increase the water inventory in the RCS, and shows the advantage of keeping the primary pumps running in order to be able to use the pressurizer spray, rather than the PORVS.
Keeping the primary pumps running further reduces the potential of steam void formation outside the pressurizer and minimizes the risk of pressurized thermal shock in the downcomer vessel wall.
The procedures have since been changed to stop the HPSI while creating a controlled pressure reduction in the RCS by using the pressurizer spray with only the primary pump of the intact loop, or the PORVS, if the primary pumps have been shut down on an initial pressure drop below 87 bar (cavitation risk) or if external power is not available.
7.
3.3. Pressurizer level control This event illustrates that the normal pressurizer level gauges are unreliable when pressurizer fills up with subcooled water. This experience learned the necessity to interpret the pressurizer level reading in combination with either cold calibrated gauges and more reliable pressurizer pressure and temperature readings (cfr. TMI).
Automatic EPSI is no longer activated by the normal pressurizer level gauge.
3.4. Safety injection control Although the prevailing procedures instructed the operator to suppress manually the safety injection signal on diagnosing a SGTR, a circuit logic fault disabled the manual resetting, such that about 20 min. elapsed before the concerned bistables were forced in the resetting mode. This circuit logic has ceen changed and the procedures now instruct the operator to stop HPS1 if the pressurizer level is within scale and the degree of subcooling is larger than 23*C.
Purthermore, generation of a SI signal automa-tically isolated the ccmpressed air supply in the containment whereby the vital isolation valves returned to fail-closed posi-tion (LOCA philosophy) and disabled among others the manual PORV operation, the letdown system, the cold pressurizer spray and the component cooling to the thermal shield on the primary pumps.
Since the event highlights the importance of the compressed air supply, this system now is disabled only on phase B isolation i.e.
when containment pressure reaches 50 % of the design pressure.
3.5. Temperature and pressure control of affected steam generator For such event, the operator was instructed to keep the primary pressure slightly above the pressure of the affected SG in order to keep control of the boron concentration in the RCS and hence to avoid a dilution risk.
Furthermore, the leak rate should be mini-mized to reduce the activity release in secondary system and to prevent flooding of the main steam lines. The only way to have any control on such situation, is to discharge steam to the con-densor (if available) or to the atmosphere and thereby reduce the temperature (avoid waterhammer), the pressure (reduce leak rate),
and the water level (avoid flooding) in the affected steam genera-tor. This procedure has been accepted by the safety authorities for such events af ter evaluation of the risk involved.
1
~
conclusion
- The incident has been controlled as prescribed and has affected neither the environment nor the installation, although the ope-rator 'was faced to make important decisions based on training experience'and skill.
- The procedures have been reviewed to better instruct the opera-tor on how to cope with the different situations that may occur following a SGTR.
- Some plant automatic actions have been changed to have a better j
. operator control on vital systems such as the HPS1 and the compressed air supply.
- The important lessons learned from this event are
, maintain at least one primary pump, if possible, to control the water inventory in the RCS by means of the pressurizer spray
. do not rely only on the normal pressurizer level gauge to con-trol the pressurizer water inventory in off-normal conditions.
. to maintain' full control over the affected steam generator, the operator should completely isolate this un'it and operate the steam dumps valve if conditions warrant it.
- The numerical analysis. enhanced the understanding of various phe-
]
nomena and yielded complementary information concerning':the evo-lution of the RCS water inventory and the releases from the RCS and the SG.
- The RELAP-5 code can be used as a reliable tool to simulate such j
event provided the users have a thorough understanding of the code models and their ibnitations, and dispose of a good data j
base to simulate the various components and their characteristics.
E A detailed simulation of the structural sensible heat is impor-tant.
REFERENCES
- 1. Analysis of steam generator tube rupture events at OCONEE and
)
GINNA INPO 82-030 November 1982.
- 2. RELAP-5 MOD 1 Code Manual V.H. RANSOM et al.
NUREG/CR-1826, EGG-2070 November 1980 i
EVOLUTION OF SOME IMPORTANT SYSTEM PAR A Mt i tMO u uru n o en a. s.w...
FI G.1' y
99 A 0 20 __
21 72 23 ' I h' 3 250 250
'c /
. TRinC05
\\
200 HOT LEG 200 N
TEMPE R ATURE i
X-150 gg AA 150 gg bor 125
'1
/
h4 RE ACTOR p,
Ki 75 COOLANT 75 PRESSURE g
p 50 50 3
25 25 ft 100 100 I
l t
% fevel
%iever 9
25
'V -
A 25 LPC A/ PR11 PRE 55URIZ ER WATER LEVEL 0
l O
- J B
50 50 bar bor
, *** NSG-8 PR/MS&A
~~
30 PR/MS&B STEAM h
GENE R ATOR
(
3 PRESSURES 20 SG. A 10 1
15 3.5 e
SG-B l
j m
30 t
30 I
e l
15 f
2.5 fC 8
SG.A LR/Fw9A
-m 20 LR / Fw98 e
20 I
f m
STE A M I
GENERA 1DR f
I 1.5 WATER 15 LEVELS r
.D g
'O G ]'
to i
I i[
05 I
-l c5 17 16 19 20 21 22 21 tthri 24
m,
' FIG. 2 : i)0EL 11 STEAll GEriERATOR TUBE RUPTURE : SYSTEil 0PERATI0ri CHR0dOLOGY TINC (SEC) 0.0 1000.0 2000 0 3000 0 i i i e 1
, i e i, i e, I i.,, f,,
,it-V4 fj)Wu.Dd BREAX e
CV 1 2
12 5 3
633 s Letdown d' 5
>2
-.c 12315 E
Hp5!
8-~~~~~~-~~~--~~~~---------
a (200s CL Dump A B
u!23 2 ige s DrtSU.
McQIer 13 2230s
,5 pray 2453 22 sis 3
- o. -- e 22863
'0003 Discharge A
-- g 1462s 19003 3
c.r SIMUL ATION c
Moto A
PL ANT D ATA NI81 8
x ptANT COMDUTED DATA 1998 us2 s n
y AFW<
o ESTIMATED Turbo A o
Trio u_e2 s ojos B
&# PLANT Cor1PUTER SATURATCD 3
s s
0.0 10 20 30 40 50
- t,. ts.20 hr TINC (t11N)
Fid. 3 : PRESSURE EVOLUTION IN HOT LEG (LOOP-A) (PRA-RC11)
- ae
_ _ _, _ ; DLANT DATA
- QCL AD GCSULTS s
s s
9 -....-....x 3
'i
's '
[."..
\\
..g..
8
\\
Oo-g
--- _- ;_-.. g
=~
/
-o
..... %c,,..
y.
y.
\\
a.
\\
l
(:
\\
n
\\
l
..4....
a.
y I
9 i
0.0 (wn o 17 tin o i mo u teon 9
'mu o i liff' 1 %IT t
FIG. 4 : WATER LEVEL lit P:lESSURIZER (LRCA/PR11) o 6
c.
8 l i I
9 I
.,2-g l
l
~
I x
Uo u
. m g-g.
l l
x o
a I
~
m a
w
>l 1
u un 3;<
g p_
i a
tJ>
. If Wo' 4 d-7 sss i
N l.
o s __. -
g.
a N.
rdo.o 250.0 te50.0 2150.0 scoo.o o.o TIME (SEC1 l
FIG. 5 : PRESSURE 111 litTACT S.G.A (2 flS 04 A)
~oo 7 s' g
-(N
\\
N
\\
\\
\\
Co
~
h n-h o
\\
o o
s
'3 O
(
's s' 9h-x,
~
\\ ' %,
N I
n I
i, l
n r-o.o 600.o 1200.0 iecc.o 29'm 3
.vm o IINE f5EC1
77
~
- y, p
~
FIG. 6 : WATER LEVEL lii IdTACT S.G. A~ (2 FW 9 A) 4 M
v.
g.
ng.
~.
. i...
k m
4
- p a.
w g
i-j"-
,s' a
d d*
k'
_2 _.______---_-I
~
g
, s.
i
/
O
/
t
'N
/
~\\/
4 w*
g.
a.
O.
- 0. 0 '
fd0.0 12h0.0 1850.0 '
2150.0 3000.0 Iltic (SEC)
FIG. 7.: COOLANT ADDITION AiiD DEPLETION RATES FOR THE RCS
't
~ i _. antAK r1 Ass noW RATC
~
TOTAL HDSI r1 ASS TLOW RATC
______ NET CWAAGING MASS fl0W QATC j
w s-s.
O d
w.
T O.
~..BRCAK
~._ T(
_______.a_.
' \\_._/~__
,C_V_C $_'_ _ _j i
HPS!
o f*
11A A-o...a I
I i
1 O.0 600 0 I200.0 t800 0 2400 0 3000 0 TINC (SEC) f Li
- /
j,.
(
Carolina Power & Light Company OG-114 February 17, 1984 Mr. Darrell G. Eisenhut Director Division of Licensing, NRR Nuclear Regulatory Connission Washington, DC 20555
Dear Mr. Eisenhut:
The Westinghouse Owners Group (WOG) and Westinghouse have carefully evaluated your letter of November 15, 1983, and the proprietary report on the Borse11e reactor.
On the basis of this review, the WOG and Westinghouse have determined that coincident signals of low pressurizer pressure and low pressurizer level for initiation of SI should not be reinstated in Westinghouse reactors. The reasons for this conclusion are as follows:
1.
The arguments advanced for reinstating the coincident signal logic in the Borse11e reactor are not directly relevant to Westinghouse reactors because of inherent differences in design.
{
a.) Coincident signal logic would not prevent SI actuation for Westinghouse reactors following tube failures which are sufficiently large to cause reactor trip on low pressurizcr pressure. For smaller failures, a normal plant shutdown is possible which would prevent SI actuation, without use of coincident logic, and would also avoid an unnecessary reactor trip.
b.) Automatic protection for a steam generator tube rupture (SGTR) is provided in the Borselle reactor. This includes reactor trip on high radiation in a steam line, trip of the turbine after a prescribed interval, and automatic initiation of chemical and volume control system (CVCS) auxiliary spray. Westinghouse reactors depend on operator action to recover from an SGTR event. Manual response to SGTR events is preferred, as discussed below.
c.) Actuation of the automatic protection system on high secondary side activity may lead to reactor trip following small tube leaks which would otherwise not occur. As noted above, a controlled plant shutdown may be beneficial for such events.
In addition, actuation of an automatic protection system during events other than steam generator tube failures, such as a spurious high radiation alarm, or multiple failure event, may adversely impact plant safety and availability.
c,, r v - n v 4 4
1DR 9
1508g:12
- v. w w n 411 Fayetteville street
- P. O. Bos 1551 e Raleigh. N. C. 27602
^
0G-114 g
Mr. Darrell G. Eisenhut
-2 February 17, 1984
{
d.) Although coincident signal logic in combination with an automatic protection system similar to that in the Borse11e Reactor design may prevent SI actuation for smaller tube failure events, it would not prevent SI actuation for larger tube failures in Westinghouse reactors, such as the Ginna incident.
Hence, manual actions would still be required for event diagnosis and SI termination. Since the larger tube failures are of most concern, the coincident signal logic and automatic protection system would be of little benefit.
e.) The Borse11e reactor has special design features to limit the thermal stresses associated with injecting CYCS auxiliary spray into the pressurizer. Westinghouse plants do not have these features and use of CVCS auxiliary spray for reactor coolant system (RCS) depressurization causes high thermal stresses in the pressurizer nozzles. For this reason CVCS auxiliary spray is the third alternative (after normal pressurizer spray and use of pressurizer power operated relief valves (PORVs)) for RCS depressurization in a Westinghouse reactor, f.) An SI signal apparently trips power to the reactor coolant pumps (RCPs) in the Borse11e reactor (p. 6 of report). The desire to maintain forced circulation is one of the reasons cited for wanting to reinstate coincident signals for SI. An SI signal does not trip the RCPs in Westinghouse reactors.
g.')~The concerns expressed about depleting the contents of the HPSI storage tanks (pp 8 & 10) apparently stem from having tanks of limited capacity in Borse11e. In contrast, the capacity of the refueling water storage tank, which is the source of SI water in a Westinghouse reactor, is many times greater than the amount of SI needed during an SGTR.
2.
Reinstatement of the former coincident signals for initiating SI in Westinghouse plants would degrade the protection against a stuck-open PORY without improving the ability of operators to respond to SGTRs. This was the reason for changing from the coincident logic after the TMI event.
It is consistent with the WOG and NRC operating philosophy, which emphasizes core cooling under all conditions, to rely on manual actions to terminate SI after proper diagnosis of an SGTR event, rather than to assume manual actuation of SI as protection against a pressurizer' steam space break.
1508'g:12 l
]
e OG-114 Mr. Darrell G. Eisenhut February 17, 1984 i
i It is'noted that there is an anomaly for the vapor space break since there is a reliance on manual operator action to initiate SI although the stated operating philosophy for Borse11e is to not take manual operator action in the first 30 minutes. Westinghouse and the WOG cannot agree with such a philosophy that emphasizes one accident condition over another and is highly prescriptive to a specific transient. In addition, there seems to be little or no consideration in the proposed Borse11e recovery strategy for multiple events, or failures, which are an integral part of the WOG emergency response guidelines (ERGS) development program.
An improved version (Rev. 1) of the ERGS for responding to an SGTR has recently been completed and will soon be incorporated into plant-specific emergency procedures at. Westinghouse plants. These ERGS incorporate lessons learned from the Ginna SGTR and have been extensively reviewed by the WOG and validated on the'Seabrook simulator. The ERGS describe operator actions to respond to many of the specific concerns expressed in the Borse11e report.
Recovery actions are presented in two phases. In the first phase, operator actions'are directed toward equalizing primary and affected steam generator pressure and terminating SI to stop primary-to-(
secondary leakage. At the completion of this first phase, releases from the affected steam generator would have stopped and all f* mediate safety concerns would be resolved. The second phase of the recovery cools and depressurizes both the RCS and affected steam generator to cold shutdown conditions. Three alternative methods are described in the ERGS for completing this phase. The cooldown to cold shutdown is unaffected by coincident signal SI actustion logic or prior actuation of SI. Pressure in the affected steam generator would remain greater than that in the intact steam generators since it would have been isolated. This is a necessary condition to maintain subcooling in the reactor coolant system.
It is not clear with the information presented whether or not the recovery strategy proposed for Borse11e could maintain the subcooling margin necessary to avoid SI initiation.
.Recent analysis work sponsored by the WOG has identified criteria by which operators can distinguish between an SGTR and a small-break LOCA, such that RCPs will be kept running for an SGTR and manually tripped for a LOCA. One report describing these analyses has been transmitted to the NRC and a second report will be transmitted within 30 days. Plant specific procedures containing these criteria for keeping RCPs in operation during an SGTR wf11 soon be in effect, h
1508g:12
- o OG-114 Mr. Darrell G. Eisenhut
-4, February 17, 1984 It is our conclusion that there is no benefit to be gained by restoration of the low pressurizer pressure - low pressurizer level coincident f
signal for initiation of safety injection in Westinghouse-supplied i
reactors in the U.S.
We trust that this letter answers the specific question asked in your letter of November 15 and provides sufficient background information to enable you to concur with our conclusion.
Yery truly yours, ff h
~j j ' - ~
, ~..
J. J. Sheppard, Chaiman Westinghouse Owners Group cc: WOG Reps Analysis S/C Procedures S/C H. V. Julian B. Monty R. Surman E. Volpenhien
(
1508g:12
=
-(
[ \\,, 3 N
1 i
g
" [
a w
s A Caretas eewer a LigM Casapeny,
OG-114
^
s.
w u
\\ \\
s i
s 3
February 17, 1984 t
g 1, s.
q l
Mr. D:rrell G. Eis A. hut, Dfrutor
'\\
$,,(
f Lt l
DivisionofLicend.w,PCtRQ l
f.'*. c1c r l'.:platcry Csasission s
s L*2shtr.gton, DC 20 % 5 j
8' t
Dear Mr. Eisenh.:
t:
x t @
4
\\
\\
-3.-*
i 3
The L'estin; house Owners Croup.(WNi) and Westinghouse have carefully D,
15, 19 0 eed the proprietsey report ce evaluated ycur letter of November th2 Uctsolle reactor.
.x g,
c On the basis of this' review, the WOG and Westie,$ouse have determi'ned._
j l
that cof acidat sic-als of low rrossurizcr pressure and low pressurfrerA l
icycl for in;tistica of 51 should rot be reinstated in Westinghouw ~
l l
reactors. The rer. sons for this,c6ncf}ition are as follow't:
The arc ~~enN advanced for/rejnstating the'cofscident s1 nal logick l
3 i
1.
fn the Cor:411a reactor are'et directly releva 4t to Westinghouse j
l j'
reactors bcNau:;e of inherent (differences in destp.
l 1
l a.) Coincident signal logic would not prevent $1 actuation for
[
l Westinchouso reactors following tabe failures shich are sufficTently largs to cause reactoe,'tNo.on low pressurizer j
pressure. f*cr walter fatlures, a normal pWint sMtdow1 is 5 w
I
\\
possible which would prevent $l ectu tion,Without ust M x.
i coincident 90gic, and would'also avofd anf3nnecessary reacter q V
trip.
q b.) Automatic protection for a steam generater tebe rupture ($GTR) s
+
is rovided in the Borse11e reactor. This includes reactor trip,~
s on tigh radistfon in a steam line, trip of the turbin6tf ter a I
preseribed interyal, ar.d automatie laitiation of chemical and' volume controt system (CVCS) auxiliary spray. Westin$ouse l
reactors d gend on operator action torrecover from an $4TR event. Mandal response to $GTR events.ls preferred, as discussed below.
stem on high secondary 5
c.) Actuatton of the automat fc protection sy'ollowing small tube
[
side activity may lead to reactor trip f 1eaks which would otherwise not occur. As noted above, a i
contro11ed plant shutdown may be benef fetal for such" events.
In addition, actuation of as automatic protection system during 5
i events etuer t>an steam' generator tube'feIlures, such as a i
spur,tous high radiation alarm, 4r multfp1gatture event, may adversely impact plat.t safety'and availabt,11ty.'x
[
s
,f hN Y
8" i
C l
1508g.12
/$#/
I'\\
.... w
. c a... m,......,., c.
w e m.mygumumb.,
-7
, +i w
___m__,_._
a QG-114
.J -
February IF. 1984 y:.4.',sj' HP,',$erfs 1,14, tttenhet
.,,,, e
' &,. 4.).fthood cefacfdont signal legie in i
i ith an f
A-
'l,
.e'
":.u - ; a4eastic protectfon system s' allar. cash nst en w i
to that in the Borse11e I'
e,
l-
?'
Re ': tor desfon may prevent $1 actuation for sea 11er tube failure
/
7.sven's, it would not prevent 51 actuation for Isrger tube
.~
fallves in Westin;5 cuts reactors, such.ss the Gfnna incident.
4
. i Hence, manual ections would still be required for event dia';nis8s and 51 termination. Since the larger tube feftures are of most concern, the coincident signal logic and automatic t'
protect.% systee would be of little benefit.
e.)TheBorse11ereacterhasspecialdesignfeaturesteIfmitthe
,.therc'al stresses associate.1 with tr.jecting CYCS auxfifery spray into the pressurf ter. Westin@ouse plants do no'. have these features and use of CYCS auxiliary spray fa rcacter coofant systen (f.CS) de;tessurizatfon ceuses ht;h thernal stresses in the ;ressurfrer no:zics. rcr this renen CVCS auxiliary spray of pressurizer pcwer operated relief valves (PORVs)) pr is t.e third alternative (after nereal.pressurfrer s
/
for RCS
(
L.
depressurfasticn.in e Westinghouse reactor.
+,,
..,,g' ' ~
f.) An SI signal aparently trips power to the reactor coolant pumps 4-(RCPs) in the C rselle reactor (p. 4 of report). The de.fre te
_l T
'.'i.d maintain forced circulation is cne of the rest...s ef ted (e
?
W.,,
n 1:. wanting'to reinstate chincident signals for $1. An $1 signef
- i, *4'*, 'does not trfp the RCPs in Westinghouse reacters.
lc 3.)TbsconcerntexpressedaboutdepletingthecontentsoftheNPSI
~
4 t
storage tanks (pp 8 410) apparently stas from having tanks of i
e limited capacity in forse11e. In contrast, the especity of the f
G refueling water storage tank, which is the source of $! water fa i
a Westin; house reactor, is many times greater than the amount of f
_ ll needed during an SGTR.
3.
Refastatement of the former coincident signals for initiating 5! in l
Westinghouse plants would degrade the protection against a stuck-open PORY without taproving the ability of operators to respond to SGTRs. This was the reason for changing from the coincident logic after the 1N! event.
t It is consistent uith the WOB and NRC operatfng philosophy, whfeh emphastres core cooling under all conditicas, to rely on manual actions to terefnete 51 after proper diagnosts of an $GTR event, I
rather than to assume manual actuation of 51 as protection against e i
presserteer steen space break.
1900g:It
- l
muusam mmuumur -
m--
(
1 06-114 It, Darrell 6. Elaenhet
.3-February 17, 1964 b
It is noted that there fs en enemely for the vapor space break slace there is a relfance on manual erster actfen to inttiste 51 althou$ the stated operating ilosophy for Sorsr.11e is to not take manuti operator action in the irst 30 minutes. Westir*house and the WO3 cannot agree with such a philosophy that emphet' res one accidealt ccndition over another and is highly prescript tu to a specif fe transient. In addition, there seems to its little or no considerativi f a the proposed Sctselle recovery strategy for suitfple escots, or failur#:s. which are an inteyal part of the WOS
(
emergency response guidelines (ERGS) development progree.
An taproved version (Rev.1) of the ER6s for responding to en 96ft has recentTy been completed and %111 soon be incorporated Inte f.
plant-spectffe e:acrgency procedwes at Westinghouse plants. Dese ger,s incorporate testens learned free the Ginna %iR and have been r
satsastvely rd2ved tay the WOG and validated.on tiie taabrook
.i slaulatcr. 'the ERGS describe operator actions to respond to many of 4
the speciffc concerns empressed in the terse 11e report.
In the f trat phase.
Recweery actions are presented in two phases.
/
aperator acttens are directed toward equeligtog prleary and affeetad
=
g steen generator pressute end terstnatin 51 to stop primary-to-
+
secondary leakage. At the compietfen e this first' phase, rel(vases from the affected steam generator owld have stopped and all famediate safety concerns woeld be resolved. De second phase of f
the recovery cools and depressurtres both the (C5 and affected steen L
i generator to cold shutdown conditions. Bree alternative methods are described in the ERGS for coupleting tMs phase. De cooldown to cold shutdown fs unaffected by cefncident signal 51 actuetten 4
logic or prior actuation of 51. Prestwe in the affected steam generator wovid remain yester than that i.i the intact steam generators since it wou d have been 15 elated. his is a necessary condition to estatain subcooling in the reactor coolant sy>,es.
It 4
?
is not clear with the information presented Aether er not the recevery strategy proposed for terselle cools maintain the 4
subceoling mart'n necessary to aseid $1 initiation.
2 Recent analysis vert sponseres by the im 44a 1dontifled criteria o
by which operators can etstingelsh betweee an % TR and a small-broek LOCA, such that RCPs elli be kept running for en SGTR and manuelty tripped for a LOCA. One repert desceibing these snaiyses has been transeitted to the IIIC and a second repert vi11 to transeitted j
within M de Plant 6pectf fc procedores centsintag these criteria
)
for keeptas ps in operetten dertag an 1sm util.eca te in effect.
,qs
,1 a
1600 :12 3
4
m, 4
- f
- i.
i) hf,.f;. - -..,'l.fr,Berre11'S.Efsenhet retruary 17. 1984 W1$
sN U,
Mer l
fp.-j;
_. n, g s :.
' jo.:
1,
( -
It is our conclusion that there is no benefit to be gained by restoration of the lou pressurtzer pressure - low pressurfrer level coincident sips 1 fcr inttf ation of safety injection in Westinghovie-supp11ed
' re::ters in the U,$. We trust that this letter answers the spectffe
..questien a:ked in your letter of November 15 and provides sufficient
.back F ound infcrestion to enable yes to concur uith our conclusIos.
[
very trois peers.
91.l.k.._ _Y y'T J. J. Sheppere. Chaineen Westinghouse Owners e,y
.1 y
. ect W6G asps f, 4 Analysis 5/C
[..
Precedures 5/C
.c' II. V. Julien
- 5. Monty 1
R. Suroes
?!"
,4 E. Velpentfee l,
,I
?
>). <.f..;..
i
.