ML20213E460
| ML20213E460 | |
| Person / Time | |
|---|---|
| Site: | Columbia  |
| Issue date: | 07/18/1983 |
| From: | Johnston W Office of Nuclear Reactor Regulation |
| To: | Novak T Office of Nuclear Reactor Regulation |
| References | |
| CON-WNP-0600, CON-WNP-600 NUDOCS 8307210395 | |
| Download: ML20213E460 (16) | |
Text
.
~
'JUL t 8 1983 Cocket !!os. 50-397
'!E10RA!!DU'1 FOR: Thomas ?!. ? ovak, Assistant Director for Licensing Division of Licensing FRCll:
!!illiam V. Johnston, Assistant Director Ifaterials, Chemical & Environmental Technology Division of Engineering
SUBJECT:
NASHIffGT0!! PUBLIC PO!!EP, SUPPLY SYSTE'1 ("PPSS), NASHIf!GT0?F
!!UCLEAR PROJECT MO. 2, UPDATE CF SAFETY EVALUATIO!! REPORT IUPUT Plant l fare: 'lashington !!uclear Project i'o. 2 Suppliers: !!estinghouse; (Turbine)
Licensing Stage: CL Uccket !!ueber: 50-397 Responsible Dranch & Project t'anager: LD d2; Rajender Auluck Revietter:
J. O. Schiffgens Description of Task: Safety Evaluation Report Input Peview Status: Confimatory The Component Integrity Section of the "aterials Engineering Reinch, Division of Engineering, has reviewed Section 3.5.1.3, " Turbine
!!issiles," in the Final Safety Analysis Peport (FSAR) for !?estinghcuse
!!uclear Project '!o. 2.
Based on information in the FSAR and the apolicant's agreecent to cur procedure for establishinq a ?!RC accroved turbine nafntenance progran (the June 15, 1993 letter from nouchey to Schvencer), we have prepared the attached update of our previous (July 13,1C82) Safety Evaluation Recort (SEft)
P input concerning turbine missiles.
\\D f
\\
g p/
tifilf an V. Johnston, Assistant Of rector Q
l'aterials, Chemical & Environrental ao Technology o
Division of Engineering i o
Enclosure:
As stated g
$a Distribution YS
[.
s t
a2 on El$WPPSS S
S.
a oc or h
A. Schhencer S. 3hatt R. Auluck J. Schiffgens
~
M {,-
JJ f f' 4'/* '_ 0E:FTEBik DE:f4T55
. O M SB DE:/,0:flCIT
Contact:
J. Scht f fgens v'
eh :bjp F K1e"cker BDLia.w WVJohnston X-2'3099 j
}d/}/83
$5/;j83 F/ :/83 6/27/83 f
+
, m m.a w u,..o OFFICIAL RECORD COPY-
ATTACHMENT 6
WASHINGTON NUCLEAR PROJECT NO. 2 DOCKET NO. 50-397 SAFETY EVALUATION REPORT UPDATED 6/83 MATERIALS ENGINEERING BRANCH COMPONENT INTEGRITY SECTION 3.5.1.3 Turbine Missiles
- 3. 5.1. 3.1 Review Basis 3.5.1.3.1.1 Introduction During the past several years the results of turbine inspections at operating nuclear facilities indicate that cracking to various degrees has occurred at the inner radius of turbine disks, particularly those of Westinghouse design.
Within this time period, there has actually been a 0estinghouse turbine disk failure at one facility owned by the Yankee Atomic Electric Company.
Furthermore, recent inspections of General Electric turbines have also resulted in the discovery of disk keyway cracks.
Stress corrosion has been identified by both manu-facturers as the operative cracking mechanism.
The staff has followed these developments closely.
Our primary safety objective is the prevention of unacceptable doses to the public from releases of radioactive contaminants that could be caused by damage to plant safety-related structures, systems, and components due to missile generating turbine failures.
Based on previous staff reviews and various estimates by others (Refs. I and 2) for a variety of plant layouts, the staff concludes that "if a turbine missile is generated" the probabiilty of unacceptable damage to safety-related structures, systems, and components is in the neighborhood of 10-3 or 10-2 per year depending on whether the turbine orientation is favorable or unfavorable.
In view of this and operating experience, 1
we-have shif ted the review emphasis to the prevention of missile generating turbine failures.
In keeping with this shift of emphasis, the staff has recently set turbine missile generation probability guidelines for determining (a) turbine disk ultrasonic inservice inspection frequencies, and (b) turbine control and overspeed pro-tection systems maintenance and testing schedules.
It should be noted that (a) no change in safety criteria is associated with this change in review emphasis, and (b) the major domestic turbine manufacturers are already in the process of establishing models and methods for calculating turbine missile generation probabilities for their respective turbine generater systems.
This shift of emphasis helps improve turbine generator system reliability by focusing on review and evaluation of the proba-bility of missile generating turbine failure, and in the process provides a logically consistent method for establishing inservice inspection and testing schedules.
Furthennore, it reduces con-siderably the analytical burden placed on licensees by eliminating the need for elaborate and ambiguous analyses of strike and damage probabilities, and at the same time better assures the protection of public health and safety by better maintaining turbine system integrity.
3.5.1.3.1.2 Criteria that Must be Met to Demonstrate Compliance With Regulations According to General Design Criterion 4 of Appendix A to 10 CFR Part 50, nuclear power plant structures, systems, and components important to safety shall be appropriately protected against dynamic effects, including the effcets of missiles.
Failures of large steam turbines' of the main turbine generator have the potential for ejecting large i
high energy missiles that can damage plant structures, systems, and components.
The overall safety objective of the staff is to assure l
that structures, systems, and components important to safety are adequately protected from potential turbine missiles.
Of those i
systems important to safety, this topic is primarily concerned l
with safety-related systems; i.e., those structures, systems, or l
components necessary to perform required safety functions and to
{
ensure:
i I
i
, 1.
The integrity of the reactor coolant pressure boundary, 2.
The capability to shut down the reactor and maintain it in I
a safe shutdown condition, or 3.
The capability to prevent accidents that could result in potential offsite exposures that are a significant fraction of the guideline exposures of 10 CFR Part 100, " Reactor Site Cri teria. "
Typical safety-related systems are listed in Regulatory Guide (RG) 1.117.
I The probability of unacceptable damage due to turbine missiles (P ) is 4
generally expressed as the product of (a) the probability of turbine failure resulting in the ejection of turbine disk (or internal structure) fragments through the turbine casing (P ), (b) the probability of ejected j
missiles perforating intervening barriers and striking safety related structures, systems, or components (P ), and (c) the probability of 2
struck structures, systems, or components failing to perfom their safety function (P I*
3 According to NRC guidelines stated in Section 2.2.3 of the Standard
.i Review Plan (SRP) NUREG-0800,and RG 1.115, the probability of unacceptable damage from turbine missiles should be less than or equel to about one chance in ten million per year for an individual plant, i.e., P 210-7 per year.
4 3.5.1.3.1.3 Past Procedure for Demonstrating Compliance with Regulations l
In the past, analyses for construction pemit (CP) and operating license
{
(0L) reviews assumed the probability of missile generation (P)) to be l
approximately 10-4 per turbine year, based on the historical failure l
rate (Ref. 1).
The strike probability (P ) was estimated (Ref. 3) 2 based on postulated missile si:es, shapes, and energies, and on avail-able plant specific infomation such as turbine placement and orientation, number and type of intervening barriers, target geometry, and potential
}
9 missile trajectories.
The damage probability (P ) was generally assumed 3
to be 1.0.
The overall probability of unacceptable damage to safety
~
rehted systems (P ), which is the sum over all targets of the product 4
of these probabilities, was then evaluated for compliance w'ith the NRC safety objective.
This logic places the regulatory emphasis on the strike probability; i.e, having established an individual plant safety objective of about 10-7 per year, or less, for the probability of unacceptable damage to safety related systems due to turbine missiles, this procedure requires that P be less than or equal to 10-3.
2 It is well known that nuclear turbine disks crack (Refs. 4 and 5) and that turbine stop and control valves fail (Refs. 6 and 7), and that disk ruptures can result in the generation of high-energy missiles (Ref. 8). Furthennore, analyses (Refs. 7 and 9) clearly denonstrate the large effects of inservice testing and inspection frequencies on missile generation probabilities (P ).
It is the staffs view that g
sufficiently frequent turbine testing and inspection are the best means of assuring that the criteria on the probability of unacceptable damage to safety related structures, systems, and components P4 presented in Subsection 3.5.1.3.1.2 is met.
Therefore, it is prudent for turbine manufacturers to perfonn, and the NRC to review, analyses of turbine reliability, which include known and likely failure mechanisms, expressed as a function of time (i.e., inservice inspection or test intervals).
While the calculation of strike probability is not difficult in princi-ple, for the most part reducing to a straightforward ballistics analysis, it presents a problem in practice.
The problem stems from the fact that numerous modeling approximations and simplifying assumptions are required to make tractable the incorporation into acceptable models of available data on the (a) properties of missiles, (b) interactions of missiles with barriers and obstacles, (c) trajectories of missiles as they inter-act with and perforate (or are deflected by) barriers, and (d) identi-fiction and location of safety-related targets.
The particular approx-imations and assumptions made tend to have a large effect on the resulting value of P.
Similarily, a reasonably accurate specification 2
. of the damage probability (P ) is n t a simple matter due to the difficulty 3
of defining the missile impact energy required to render given safety-related systems unavailable to perfonn their safety function, and the difficulty of postulating sequences of events that would follow a missile producing turbine failure.
3.5.1.3.1.4 New Procedure for Demonstrating Compliance with Regulations The new approach places on the applicant the responsibility for demon-strating and maintaining a NRC specified turbine reliability by appropriate inservice inspection and testing throughout plant life.
This shift of emphasis necessitates that the applicant show capability to have volumetric (ultrasonic) examinations perfonned which are suitable for inservice inspection of turbine disks and shaft, and to provide reports for NRC review and approval which describe their methods for detennining turbine missile generation probabilities.
Westinghouse and General Electric, on behalf of applicants, are preparing reports for NRC review and approval which describe methods for determining turbine missile generation probabilities for their respective turbines.
The design speed missile generation probability is to be related to disk design parameters, material properties, and the inservice volumetric (ultrasonic) disk inspection interval (for example, see Ref. 9).
The destructive overspeed missile generation probability is to be related to the turbine governor and overspeed protection system's speed sensing and tripping characteristics, the design and arrangement of main steam control and stop valves and the reheat steam intercept and stop valves, and the inservice testing and inspection intervals for systems components and valves (for example, see Ref. 7).
Following the submittal of such reports to the NRC for review and approval, the manufacturer will provide applicants and licensees with tables of missile generation probabilities versus time (inservice volumetric disk inspection interval for design speed failure, and inservice valve testing interval for destructive overspeed failure) for their particular turbine, which are then to be used to establish inspection and test schedules which meet NRC safety objectives.
6-I l
j Due to the uncertainties involved in calculating P2 (see Section j
3.5.1.3.1.3 of this SER), the staff concludes that P analyses are 2
I
" ball park" or " order of magnitude" type calculations only.
Based on simple estimates for a variety of plant layouts (for examples, I
see Refs. I and 2), the staff further concludes that the strike and
)
damage probability product can be reasonably taken to fall in a characteristic narrow range which is dependent on the gross features of turbine generator orientation; (a) for favorably oriented turbine generators P P tend to lie in the range 10-4 to 10-3, and (b) for 2 3 unfavorably oriented turbine generators P P tend to lie in the 2 3 j
range 10-3 to 10-2.
For these reasons (and due to weak data, contro-versial assumptions, and modeling difficulties), in the evaluation of i
P, the staff gives credit for the product of the strike and damage 4
probabilities of 10-3 for a favorably oriented turbine and 10-2 for an unfavorably oriented turbine, and does not encourage calculations of them.
These values represent our opinion of where P P lie based 2 3 j
on calculations we have done and the results of calculations done by others.
j It is the staff's view that the NRC safety objective with regard to turbine missiles is best expressed in tenns of two sets of criteria applied to the missile generation probability (see Table 1).
One set of criteria is to be applied to favorably oriented turbines, and the i
l other is to be applied to unfavorably oriented tu'rbines.
Applicants l
l and licensees, with turbines from manufacturers who have had reports describing ti,eir methods and procedures for calculating turbine missile generation probabilities reviewed and accepted by the NRC, are expected l
to meet the set of criteria appropriate to their turbine orientation, as shown in Table 1.
i j
3.5.1.3.1.5 Alternative Procedure for Demonstrating Compliance with Regulations Applicants and licensees, with turbines from manufacturers who have not yet submitted reports to the NRC describing their methods and procedures t
.--,-_,.___...-,,....-._,,._,.__,._,...,-g
.._.__..._....-_m.,__
.m_,
,y.--.
for calculating turbine missile generation probabilities or who have submitted reports which are still being reviewed by the NRC, are expected to meet the following alternative criteria, regardless of turbine orientation:
A.
The inser~vice inspection program employed for the steam turbine rotor assembly is to provide assurance that disk flaws that might lead to brittle failure of a disc at speeds up to design speed will be detected.
The turbine rotor design should be such as to facilitate inservice inspection of all high stress regions, including disk bores and keyways, without the need for removing the disks from the shaf t.
The volumetric inservice inspection interval for the steam turbine rotor assembly is to be estab-lished according to the following guidelines:
1.
The initial inspection of a new rotor or disk should be performed before any postulated crack is calculated to grow to more than 1/2 the critical crack depth.
If the calculated inspection interval is less than the scheduled first fuel cycle, the licensee should seek the manu-facturer's guidance on delaying the inspection until the refueling outage.
If the calculated inspection interval is longer than the first fuel cycle, the licensee should seek the manufacturer's guidance for scheduling the first inspection at a later refueling outage.
2.
Disks that have been previously inspected and found to be free of cracks or that have been repaired to eliminate all indications should be reinspected using the same criterion as for new discs, as described in (1), calcu-l lating crack growth from the time of the last inspection.
i 1
I l
L
9-3.
Disks operating with known and measured cracks should be reinspected before 1/2 the time calculated for any crack to grow to 1/2 the critical crack depth.
The guidance described in (1) should be used to set the inspection date based on the calculated inspection interval.
4.
Under no circumstances is the volumetric inservice inspection interval for LP disks to exceed approxi-mately 3 years or 2 fuel cycles.
1 Inspections during these refueling or maintenance shutdowns should consist of visual, surface, and volumetric examinations, according to the manufacturer's procedures, of all normally a
inaccessible parts such as couplings, coupling bolts, LP turbine shafts, blades, and disks, and HP rotors.
Shafts and disks with cracks of depth near to or greater than 1/2 the critical crack depth are to be repaired or replaced.
All cracked couplings and coupling bolts should be replaced.
8.
The inservice inspection and test program employed for the ss ra ce hat flaws r com one t fa lu es n h o er peed sensing and tripping subsystems, in the main steam control and stop valves, reheat steam intercept and stop valves, or extraction steam non-return valves that might lead to an overspeed condition above the design overspeed will be detected.
The inservice inspection program for governor and overspeed protection systems operability should include, as a minimum, the following provisions:
1.
For typical turbine governor and overspeed protection systems, at approximately 3 year intervals, during 4
y-
+-----.--.---w,-
..-,-.,m,
.--_,-,._.--..m y
--_.------,,-r refueling or maintenance shutdowns, at least one main steam control valve, one main steam stop valve, one reheat intercept valve and one reheat stop valve, and one of each type of steam extraction valves are to be dismantled and visual and surface examinations conducted of valve seats, discs, and stens.
Valve bushings should be inspected and cleaned, and bore diameters should be checked for proper clearance.
If any valve is shown to have hazardous flaws or excessive corrosion or improper clearances, the valve is to be repaired or replaced and all other valves of that type dismantled and inspected.
2.
Main steam control and stop valves, reheat intercept and stop valves, and steam extraction non-return valves are to be excrcised at least once a week during normal operation by closing each valve and observing directly the valve motion as it moves smoothly to a fully closed position.
3.
At least once a month during normal operation each com-partment of the electrohydraulic governor system (which modulates control and intercept valves), and the mechanical overspeed trip mechanism and backup electri-cal overspeed trip (both of which trip the main steam control and stop valves, and reheat intercept and stop valves) are to be tested.
On line test failures of any one of these subsystems require repair or replacement of failed components within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the turbine is to be isolated from the steam supply until repairs are completed.
. i 3.5.1.3.2 Evaluation For Washington Nuclear Project No. 2, the steam and power conversion system generates steam in a direct cycle BWR and converts it to electric power in a turbine generator manufactured by Westinghouse Electric Corp-oration.
The placement and orientation of the turbine generator is unfavorable with respect to the station reactor buildings; that is, there are safety related targets inside the low trajectory missile strike zone.
The turbine is a tandem-compund type (single shaft) with one double-flow high pressure turbine, three double-flow low pressure turbines, and a rated rotational speed of 1800 rpm.
The major portion of manufacture was performed during 1975.
A turbine failure resulting in the rupture of the turbine casing is approximately equivalent to a main steam line failure outside contain-ment. For a BWR such a failure releases primary coolant steam and radioactivity to the environment.
Hence, regardless of the probability of turbine missiles striking safety related structures, systems, or components, the criteria of NUREG-0800, SRP Section 15.6.4 must be satisfied in order to demonstrate compliance with the criteria set forth in Section 3.5.1.3.1.2 of this SER.
3.5.1.3.2.1 Destructive Overspeed Failure Prevention The turbine generator has a turbine control and overspeed protection system which is designed to control turbine action under all normal or abnormal conditions and to ensure that a turbine trip from full load will not cause the turbine to overspeed beyond acceptable limits so as to minimize the probability of generating turbine missiles, in accordance with the requirements of GDC 4 The turbine control and overspeed protection system is, therefore, essential to the overall safe operation of the plant.
l Turbine control is accomplished with an electrohydraulic control (EHC) system.
The EHC system consists of an electronic governor using solid i
. state control techniques in combination with a high pressure hydraulic actuating system.
The system includes electrical control circuits for steam pressure control, speed control, load control, and steam control valve positioning.
There are four methods of turbine overspeed control protection:
the normal i
1 speed governor (EHC), the overspeed protection controller (OPC), the mechanical overspeed trip mechanism, and the electrical overspeed trip.
The EHC modulates the turbine control valves to maintain desired speed load characteristics within 2 to 3 rpm of desired speed.
The primary function of the OPC is to avoid excessive turbine overspeed.
At 103 percent of rated speed, the OPC solenoids open, closing the governor and intercept valves to arrest the overspped before it reaches the trip setting of 111 percent of rated speed.
After turbine coastdown to i
synchronous spped, the digital system takes control and maintains the turbine generator at synchronous speed.
The mechanical overspeed sensor trips the turbine stop, control, and combined intermediate valves by deenergizing the hydraulic fluid systems whn 111 percent of rated speed is reached, thereby maintaining turbines speed below 120 percent of rated speed and causing unit coastdown to turning gear operation.
The electrical backup overspeed sensor trips these same valves when 111.2 percent of rated speed is reached by independently deenergizino the hydraulic fluid system.
These overspeed trip systems can be tested while the unit is online.
The staff has reviewed these systems and has concluded that the turbine generator overspeed protection system' meets the guidelines of NUREG-0800, l
SRP Section 10.2 and can perform its design safety function.
The overspeed protection controller, the mechanical overspeed trip mechanism and electrical overspeed trip are to be inspected and tested periodically during reactor operation.
The manner and frequency of the inspection and testing will take into consideration the manufacturers recommendations in conjunction with the plant generating reouirements.
Accordingly, the applicant's inservice inspection and testing program O
. for the main steam control and stop valves and reheat intercept and stop valves includes the following:
(1) At least once per 40 months, at least one main steam control valve, one main steam stop valve, one reheat intercept valve, and one reheat stop valve are to be dismantled and inspected.
(2) At least once a week, the main steam control and stop valves and reheat intercept and stop valves are to be exercised by closing each and observing the valve motion.
Westinghouse is in the process of completing an anglysis of turbine missile generation probabilities at destructive overspeed which can serve as a basis for evaluating the adequacy of the applicant's overspeed pro-tection system inspection and testing program.
This analysis is due to be completed by June 1983.
When their report is completed and submitted. to the NRC, it will be reviewed and evaluated by the staff.
Until then, the NRC alternate criteria, described in Section 3.5.1.3.1.5 of this SER apply to the Washington Nuclear Project No. 2.
3.5.1.3.2.2 Design Speed Failure Prevention Failures of turbine disks at or below the design speed, nominally, 120 percent of nonnal operating speed, are caused by a non-ductile material failure at nominal stresses lower than the yield stress of the material.
Since 1979, the staff has known of the stress corrosion cracking problems in low pressure rotor disks of Westinghouse turbines.
Westinghouse has developed and implemented procedures for inservice volumetric inspection of the bore and keyway areas of low pressure turbine disks.
They have also prepared and submitted reports for NRC review which describe their methods for determining turbine disk inspection intervals and relating them to missile generation probabilities due to stress corrosion cracking.
These reports are currently under staff review.
Until reviews and evaluations are completed the NRC alternate criteria, described in Section 3.5.1.3.1.5 of this SER, apply to the Washington Nuclear Project No. 2.
I
.,------e
. +. - -, -.. - - - -
. L
(
3.5.1.3.3 Summary The staff has reviewed the WNP-2 facility with regard to the turbine missile issue and concluded that the probability of unacceptable damage to safety-related structures, systems, and components due to turbine missiles is acceptably low (i.e., less than 10 7 per year) provided that the total turbine missile generation probability is such that con-i formance with the criteria presented in Table 1 is. maintained, through-out the life of the plant, by acceptable inspection and test programs.
In reaching this conclusion, the staff has factored into consideration the unfavorable orientation of the turbine generators.
Even if cracks initiate in the WNP-2 turbine disks at the beginning of service life, it is estimated that they will not grow to a depth of one half the critical crack depth within 3 years of startup.
For these reasons, the staff is allowing the applicant up to three years from i
initiation of power output to propose a revised turbine maintenance program (which establishes, with NRC approved methods, inspection and testing procedures and schedules) and obtain NRC approval of their program.
In response to an NRC request, the applicant has agreed to:
1.
submit for NRC approval, within three years of obtaining an operating license, a turbine system main.tenance program based on the manufacturer's calculations of missile generation prob-l abilities, or volumetrically inspect all low pressure turbine rotors at the second refueling outage as stated in Section 3.5.1.3.1.5 of this SER, and every other (alternate) refueling outage thereafter until some other maintenance program is approved by the staff, l
and l
I l
o 2.
ccnduct turbine steam valve maintenance (following initiation of power output) in accordance with NRC recommendations as stated in Section 3.5.1.3.1.5 of this SER.
Based on our review and this agreement, we conclude that the turbine missile risk for the proposed plant design is acceptable and meets the requirements of General Design Criterion 4 3.5.1.3.4 References 1.
S.H. Bush, " Probability of Damage to Nuclear Components Due to Turbine Failure," Nuclear Safety,14, 3, (May-June) 1973, p. 187.
2.
L. A. Twisdale, W. L. Dunn, and R. A. Frank, " Turbine Missile Risk. Methodology and Computer Code," EPRI Seminar on Turbine Missile Effects in Nuclear Power Plants, Palo Alto, California, October 25-26, 1982.
3.
See NUREG-0800, Standard Review Plan Section 3.5.1.3, " Turbine Missiles," Rev. 2, July 1981 for a description of the evaluation procedure previously recommended by the staff.
4 NUREG/CR-1884, " Observations and Comments on the Turbine Failure i
at Yankee Atomic Electric Company, Rowe, Massachusetts," March 1981.
5.
Preliminary Notification of Event or Unusual Occurrence -- PN0 -
III 104 -
" Circle in the hub of the eleventh stage wheel in the main turbine" at Monticello Nuclear Power Station, Nov. 24, 1981.
6.
Licensee Event Report No.82-132, Docket No. 50-361 - " failure of turbine stop valve 2VV-2200E to close fully" at San Onofre Nuclear Genc : ting Station, Unit 2, Nov. 19, 1982.
7 J. J. Burns, Jr., " Reliability of Nuclear Power Plant Steam Turbine Overspeed Control Systems," 1977 ASME " Failure Prevention and Pelia-bility Conference," Chicago, Illinois (Sept.) 1977, p. 27.
m 8.
D. Kalderon, " Steam Turbine Failure at Hinkley Point A," Proc.
Insta. Mech. Engrs., 186, 31/72,1972, p. 341.
9.
W. G. Clark, Jr., B. B. Seth, and D. H. Shaffer, " Procedures for Estimating the Probability of Steam Turbine Disc Rupture from Stress Corrosion Cracking," ASME/IEEE Power Generation Conference Oct. 4-8,1981, St. Louis, Missouri.
6