NRC Generic Letter 1981-16
July 31, 1981 ALL LICENSEES OF OPERATING PLANTS AND HOLDERS OF CONSTRUCTION PERMITS
Gentlemen:
SUBJECT: STEAM GENERATOR OVERFILL (GENERIC LETTER 81-16)
(Formerly Issued July 1, 1981, as Generic Letter 81-16)
In a letter dated March 28, 1980 from H.R. Denton, we informed you of the revised criteria to be used by the staff in evaluating reactor operator training and licensing that could be implemented under the current regulations. We also advised you that Commission review in the area of operator training and qualification was continuing and it could be expected to result in additional criteria.
The NRC Office of Analysis and Evaluation of Operational Data has produced a report entitled, "AEOD Observations and Recommendations Concerning the Problem of Steam Generator Overfill and Combined Primary and Secondary--
Side Blowdown," dated December 17, 1980, a copy of the report is enclosed.
This report documents results of studies completed to date by the Office of Analysis and Evaluation of Operational Data with regard to the steam generator overfill problem.
This report expresses concerns In the following area: (1) increased dead weight and potential seismic loads placed on the main steamline and its support should this line become flooded; (2) the load placed on the main steamlines due to the potential for rapid collapse of steam voids resulting in water hammer; (3) the potential for secondary safety valves sticking open following discharge of water or two-phase flow;
(4) the potential for rupture for weakend tubes in the once-through- steam-generator (OTSG) on B&W NSSS plants due to tensile loads caused tby the rapid thermal shrinkage of the tubes relative to the generator shell.
From the examining experiences of the Operator Licensing Branch, operators at nuclear power plants are aware of the need to avoid overfilling steam generators and not operating steam systems with water accumulat However, there may be a general lack of appreciation of the seriousness of situations that can arise from these events AUG 041 OFlICE
... ... .. ...
i
. ................... l.l..................... ..................... ..................... . . . . ...
,
.. . . .
SURNAMED .... 810824000? 61073 IDAE
BATE}PDR ADOCK 050000 PDR0 *.....................
....................... ..
..................... ..................... ....................
. .................... ....................
R3 .. /
FORM .R.
NcoMal00>ce2 O FFICIA L R EC O RD C OPY *USGPO: 1980 -329-824
- 2 - July 31, 1981 While this issue is being studied further, we request that you determine which scenarios are credible for your plant and that you include in your overall training program, plant-specific information stressing the importance of feedwater flow as well as the possible consequences of steam generator overfill. This information should be factored into your initial operator training programs and the operator requalification programs.
Sincerely, original signed by Darrell G. Lisenhult Darrell G. Eisenhut, Director Division of Licensing Office of Nuclear Reactor Regulation Enclosure:
As stated IIqy,)
Y~l 0t11 I
I__
OFFICED DL:ORAP t I D C DLfD/SA DHFS:D R L D
GHoiahan-sh htinikf GLi ... SHnauY b.i. ..
u.8.
SURNAME0
6. /.8. /5 /81
6 .AT. . \ /
~~~~~~~~~~~~~~~~~~~~~~~... G 81
.__..._______...1...__......A.8
_ _
....................
........ d................ .......
... ... .................
....
_______
.......
DATE'OR 31(6 8 -1.... 0246 ..... .... 8*8 NRC FORM 318 4le/801 NRCM 0240
OFFICIAL RECORD COPY
- USGPO: 1980-329 824
I
ALL POWER REACTOR LICENSEES
-' r Docket No. 50-348 Farley Unit 1 Docket No. 50-313 Docket No. 50-247 I/
Arkansas Unit 1 - Indian Point Unit 2 Docket No. 50-368 Docket 50-286 Arkansas Unit 2 -Indian Point Unit 3
,i
-Docket No. 50-317 Docket No. 50-155 Calvert Cliffs Unit 1 -Big Rock Point Docket No. 50-318 i Docket No. 50-255 1 Calvert Cliffs Unit 2 -Palisades Docket No. 50-293, Docket No. 50-409 6Z
Pilgrim Unit 1 -Lacrosse Docket No. 50-325' Docket No. 50-269 I'
Brunswick Unit 1 Oconee Unit 1 Docket No. 50-324' Docket No. 50-270
Brunswick Unit 2 - Oconee Unit 2
/
Docket No. 50-261 - Docket No. 50-287 H. B. Robinson Unit 2 Oconee Unit 3
.Docket No. 50-10. Docket No. 50-334 1'
Dresden Unit 1 -Beaver Valley Unit 1 Docket No. 50-237 Docket No. 50-302;
-Dresden Unit 2 Crystal River 3 Docket No. 50-249. Docket No. 50-335`
'Dresden Unit 3 -St. Lucie Unit 1 Docket No. 50-254' Docket No. 50-250
- Quad-Cities Unit 1 Turkey Point Unit 3 Z/
-Docket No. 50-265 Docket No. 50-251 Quad-Cities Unit 2 Turkey Point Unit 4
1~-'
Docket No. 50-295 'Docket No. 50-321 Zion Unit 1 Edwin I. Hatch Unit 1 p, -
- Docket No. 50-304 - -Docket No. 50-366 Zion Unit 2 Edwin I. Hatch Unit 2 Docket No. 50-213 , Docket No. 50-315 Connecticut Yankee (Haddam Neck) D. C. Cook Unit 1
- 2 -
Docket No. 50-316 Docket No. 50-344
'I
Docket No. 50-305 V
-Trojan - Kewaunee
-D. C. Cook Unit 2 Docket No. 50-331 IV Docket No. 50-333 V Docket No. 50-29 v
- FitzPatrick - Yankee-Rowe
'Duane Arnold Docket No. 50-267 y Docket No. 50-3394Jf Docket No. 50-219 -Nbrth Anna 2
- Oyster Creek Unit 1 Ft. St. Vrain Vy Docket No. 50-272 V Docket No. 50-311 Docket No. 50-309 Salem 2
' Maine Yankee Salem Unit 1 Docket No. 50-289 y Docket No. 50-244 1. Docket No. 50-327 R. E. Ginna 1 - Sequoyah 1 Three Mile Island unit 1 I Docket No. 5 0-312 V Docket No. 50-369 Docket No. 50-320
Mile Island Unit 2 Rancho Seco McGuire 1 three Docket No. 50-206 V/ Docket No. 50-364 Docket No. 50-298 Farley 2 Cooper Station San Onofre 1 Docket No. 50-220 " Docket No. 50-259 V
Nine Mile Point Unit 1 Browns Ferry Unit 1 /I
- Docket No. 50-245 Docket No. 50-260 V
Millstone Unit 1 Browns Ferry Unit 2 Docket No. 50-336 /' Docket No. 50-296 V
'Millstone Unit 2 -Browns Ferry Unit 3 Docket No. 50-263 V Docket No. 50-346 v
. Monticello - Davis-Besse 1 Docket No. 50-282 v Docket No. 50-271 v Prairie Island Unit 1 -Vermont Yankee 21, Docket No. 50-306 / Docket No. 50-338 Prairie Island Unit 2 -North Anna 1 Docket No. 50-285 I/ Docket No. 50-280
'Ft. Calhoun Surry Unit 1 V
Docket No. 50-133 v
- Docket No. 50-281
'Humboldt Bay - Surry Unit 2
.Docket No. 50-277 Docket No. 50-266 Peach Bottom 2 'Point Beach Unit 1
- Docket No. 50-278 V/ Docket No. 50-301 V
Peach Bottom 3 Point Beach Unit 2
EB 2."dI~-
PLANTS UNDER CONSTRUCTION
1. Cherokee 1/2/3 50-49.1, 4§;, 44j/
2. Beaver Valley 2 50-412V
3. St. Lucie 2 50-38g V
4. Vogtle 1/2 50-424 , 42 5A
5. River Bend 1/2 50-459$ 459
6.
7. Forked River 50-3 83
8. Nine Mile Point 2 50-410\.
9. Millstone 3. 50-423'/
10. Bailly 2 50-36'7 ./
11. Limerick 1/2 50-35ff,V353 V
12. Hope Creek 1/2 50-354,V355 a
13. Seabrook 1/2 50-443~ 444\'/
14.
15. Hartsville 1/2/3/4 50-51f, 5f9, 526', 521
16. Phipps Bend 1/2 50-55-6, 554
17. Yellow Creek 1/2 50-56t , -567
18. WPPSS 1/3/4/5 50-460 , 508, 513, *09
19. Harris 1/2/3/4 50-400, 401, 402, 403
20. FNP 50-437
0
FE$ z 7 1981 PLANTS UNDER OL REVIEW
1. Clinton 1/2 50-461/461
2. Byron 1/2 50-454, 455
3. Braidwood 1/2 50-456/4 57
4. LaSalle 1/2 I -
50-373, 374
5. Midland 1/2 50-325,330
6. McGuire 2 50- 370
7. So. Texas 1/2 50-418, 49§
8. Shoreham 50-3222
9. Waterford 50-382 t. I ,
10. Grand Gulf 1/2 50-416/417
11. Diablo Canyon 1/2 50-275, 323
12. Susquehana 1/2 50-387', 388
13. St. Lucie 2 / 5.0-389
14. Summer 1 50-395
15. San Onofre 2/3 50-36i, 362 I I
16. Bellefonte 1/2 50-438, 439
17. Watts Bar 1/2 50-390, 391
18. Sequoyah 2 50- 328
19. Comanche Peak 1/2 50-44T, 449
20.
21. WPPSS-2 50-391 j
22. Fermi 2 50-341
23. Zimmer 1. 50-35<
24. Perry 1/2 50-446, 441
25. Palo Verde 50-52', 52§, 530
26. Catawba 50-413, 4-14
27. Marble Hill 50-546, 54'7
28. Wolf Creek 50-482
29. Callaway 50-483, 4S6
AEOD OBSERVATIONS AND RECOMMENDATIONS
CONCERNING THE PROBLEM OF STEAM GENERATOR OVERFILL
AND COMBINED PRIMARY AND SECONDARY SIDE BLOWDOWN
by the Office for Analysis and Evaluation of Operational Data December 17, 1980
Prepared by: Euaene V. Imbro Wayne D. Lanning NOTE: This report documents results of studies completed to date by the Office for Analysis and Evaluation of Operational Data with regard to a particular operating event. The findings and recommendations contained in this report are provided in support of other ongoing NRC activities concerning this event. Since the studies are ongoing, the report is not necessarily final, and the findinqs and recommend- ations do not represent the position or requirements of the respon- sible program office of the Nuclear Regulatory Commission.
IDUE e'45J.L5~ 4036&
TABLE OF CONTENTS
1.0
BACKGROUND
. . . . . . . . . . . . . . . . . . . . . . . . . *. 1
1.1 The Steam Generator Overfill Problem. . . . . . . . . . . . 2
1.2 Steam Generator Level Control in Combustion Engineering NSSS Plants .. .. .. .. .. .. .. .. .. .. .. .. .. . 3
1.3 Steam Generator Level Control in Westinghouse NSSS Plants . . . . 4
1.4 Steam Generator Level Control in Babcock & Wilcox NSSS Plants . . 5
1.5 Steam Generator Overfill Experience . . . *.. . . * *. . . . * 5
2.0 POTENTIAL EFFECTS OF STEAM GENERATOR OVERFILL. * . . . . * * a . . . 7
2.1 Hydraulic Forces. . . . . . . . . . .. . . . * . . . . .
7
2.2 Excessive Dead Weiqht Loads . . . . . . . * . . . . . . . . . . .
7
2.3 Failure of Valves to Reseat . . . . . . . . . . . . * . . . . 8
2.4 Loss of Emergency Feedwater Pump Turbine. . . . . . . . . . . . 8
2.5 Steam Generator Tube Rupture. . . . . . . . . . . . . . . . . . 9
2.6 Acceleration of Accumulated Water . . . . . . . . . . . . . * * 0 10
3.0 STEAM GENERATOR OVERFILL SCENARIOS . . . . . . 12
. 0 . . . . .
4.0 APPLICABILITY OF THE SINGLE FAILURE CRITERION. 18
5.0 COMBINED PRIMARY AND SECONDARY SIDE BLOWDOWN . 20
6.0 AEOD RECOMMENDATIONS . . . . . . . . . . . . . 24 REFERENCES. . . . . . . . . . . . . .. . . . . . . . . . . .. 26 -
AEOD OBSERVATIONS AND RECOMMENDATIONS
CONCERNING THE PROBLEM OF STEAM GENERATOR OVERFILL
1.0
BACKGROUND
Steam generator water level in pressurized water reactors (PWR), with the exception of the Babcock & Wilcox (B&W) Nuclear Steam Supply Sys- tem (NSSS) plants, is controlled by a three element level control sys- tem that regulates feedwater flow. The control system compares feed- water flow, steam flow, and water level with a preprogrammed level set- point. The error signal generated by the control system is used to control the position of the feedwater requlating valves and vary the speed of the main feedwater pumps. The B&W NSSS plants do not use steam generator level to control feedwater flow above 1T percent power.
The feedwater flow in BAW NSSS plants is controlled by the Integrated Control System (ICS) and is based on megawatt demand when operating above 15 percent power. The ICS is not safety related.
Since the steam generators provide the heat sink for the Reactor Cool- ant System (RCS), the principal safety consideration related to steam generator water level, until now, has been the need for sufficient water level to remove the energy generated by the reactor and transferred to the reactor coolant system. Combustion Engineering (CE) and Westinghouse (W) NSSS plants have an installed safety grade reactor trip on low steam generator level to protect the RCS from the conse- quences of loss of heat removal capability. The trip is an anticipatory
- 2 -
trip in that loss of heat removal capability also causes the reactor to trip on high RCS pressure later in the transient. The B&W reactors do not have a reactor trip on low steam generator level and rely on the high RCS pressure trip to protect the reactor on the loss of heat sink.
1.1 The Steam Generator Overfill Problem A new issue pertaining to reactor safety has been raised concern- ing steam generator water level; however, the concern in this case is the effect of excessive level. The steam generator overfill transient, the subject of this report, can be caused by the fail- ure of the three element level controller or the ICS. The control of steam generator level within the specified operating range was not thought to be important to the safety of the plant. Accord- ingly, the three element level control system provided on CE and W NSSS plants is not safety related and, therefore, not seismically or environmentally qualified.
We now believe that steam generator overfill can affect the safety of the plant in several ways, the more severe of which could lead to the postulation of steamline breaks, or simultaneous steamline break and steam generator tube rupture for B&W NSSS plants (LOCA
outside containment), as credible events. The basis for these concerns is as follows: 1) the increased dead weight and poten- tial seismic loads placed on the main steamline and its supports
- 3 -
should this line become flooded; 2) the loads placed on the main steamlines due to the potential for rapid collapse of steam voids resulting in water hammer; 3) the potential for secondary safety valves sticking open following discharge of water or two-phase flow; 4) the potential inoperability of the main steamline isola- tion valves (MSIVs), main turbine stop and bypass valves, feed- water turbine valves, and atmospheric dump valves due to effects of water or two-phase flow; and 5) the potential for rupture of weakened tubes in the once through steam generator (OTSG) on B&W
IJSSS plants due to tensile loads caused by the rapid thermal shrinkage of the tubes relative to the generator shell. The above items have not have been considered in the plant design because the steam generator overfill transient has not been one of the events analyzed. The reason this has not been analyzed is that such plants either have control grade protective actions on high steam generator level to provide for protection of the turbine, or they rely on operator action to control level manually in the event that the normal level control system fails.
1.2 Steam Generator Level Control in Combustion Engineering NSSS Plants The CE NSSS plants in operation, typically, have a control grade turbine trip on high steam generator water level. The high level turbine trip is generally provided on a two out-of four logic. This trip is derived from the safety-related instrumentation used to provide the low level reactor trip. An additional protective
- 4 -
feature provided on CE plants, although control grade, is that the feedwater supply rate is ramped down to 5 percent of its full Dower flow in one minute following reactor triD. Following a turbine and reactor trip from 100 percent power, the steam generator level may drop about 40 to 50 inches due to collapse of voids in the economizer and evaporator sections of the generator.
However, if a control system malfunction causes the feed rate to continue at 100 percent the steam generators would fill in about three minutes. A similar situation could also occur if while operating at full power the feedwater control system caused feedwater flow to increase to its maximum. Depending on the particular plant design, this could he as much as 25 percent greater than the normal flow at 100 percent power. In this instance, the steam generator would also fill in a matter of minutes, however, the steam generators would not be water solid as in the first case.
The level would be two phase since the generators are steaming;
i.e., no reactor or turbine trip is assumed. Clearly, a rapid operator action is necessary to prevent overfilling of the steam generators in the event of failure of control grade equipment.
1.3 Steam Generator Level Control in Westinghouse NSSS Plants The Westinghouse NSSS plant design is similar to CE in that the turbine trip on high steam generator level is also control grade, but it operates on a two out of three logic scheme. The high level trip, although control grade, is derived from the safety grade level in- strumentation used to generate the reactor trip on low steam generator water level. Westinghouse NSSS plants trip the main feedwater pumps and close the feedwater regulating valves automatically on reactor
- 5 -
trip. This is accomplished by the non-safety grade feedwater control system. As in CE plants, a failure of feedwater control system on W
plants can result in filling the steam generators in approximately three minutes.
1.4 Steam Generator Level Control in Babcock & Wilcox NSSS Plants For B&W NSSS plants there is a steam generator high level alarm (one out of one logic which is not safety grade) but this does not directly provide protection against overfill. Some degree of level protection is provided by the ICS in that if the high level setpoint is reached (about 20 feet)
the meaawatt demand signal to the feedwater controller is blocked. This prevents further increase of feed flow rate. The ICS does not automati- cally terminate the steam generator overfill transient, however. The output from the steam generator high level signal is input into the In- tegrated Control System for B&W plants. During a steam generator overfill, this system pulls control rods to compensate for reduction of Tave and re- actor trip may occur on high flux or low pressure. Depending on the sever- ity of the transient and power history, a reactor trip may not occur immediately. The ICS will initiate feedwater run back after reactor trip.
For worst case conditions, operator action within two minutes is required to prevent water spillage into the steamlines. The operator probably has to act faster to prevent a steam generator overfill transient than any other transient.
1.5 Steam Generator Overfill Experience There has been one incident which is believed to have resulted in some water in the steamlines. This was the "liqht bulb incident" at Rancho Seco on
- 6 -
March 28, 1978. This event involved loss of non-nuclear instrumentation and subsequent inappropriate increase of main feedwater by the operator. Subsequent to the event, the licensee performed structural analyses and visual inspection of the steamline hangers, The investigation did not reveal any damage although the licensee was reasonably sure that some water was carried-over into the steamlines.
There have been ten other events at B&W NSSS plants which resulted in high level alarms, but none has resulted in spilling of water into the steamlines. These include:
Plant Date Reference/Source Crystal River 3 4/16/77 LER-77-29 Davis Besse 1 7/30/77 RO-NP-33-77-30
Crystal River 3 3/18/77 trey Book, April 1977 Davis Besse 1 a/29/77 RO-NP-33-77-72 Davis Besse 1 3/25/78 RO-78-033 Three Mile Island-2 4/23/78 LER-78-33 and 44 Three Mile Island-2 12/2/78 LER-78-069 Rancho Seco 1/5/79 LER-79-01 Arkansas 1 8/13/79 IE Resident Inspector Crystal River 3 8/16/79 1E RO-II
It should be noted that overfilling the steam generators to the high level alarm does not necessarily require a Licensee Event Report (LER). The above events were reported for other reasons.
Consequently, an LER search did not find any failures or transients related to excessive feedwater.
2.0 POTENTIAL EFFECTS OF STEAM GENERATOR OVERFILL
2.1 Hydraulic Forces When water enters the steamline, the steam is condensed and may produce a condensation-induced water hammer. Condensation of the steam results in a low pressure region which can accelerate a slug of water producing significant dynamic loads when the slug impacts at pipe locations where there is a change in direction or flow area. The dynamic loads produce axial forces and bending or torsional moments that can cause violent pipe movement with resultant damage to pipe hangers, restraints and valve operators.
Failure of the steamline hangers and restraints can result in inadequate support and possible loss of valve operability or steamline integrity. Components which can be damaged in the steamline include the main steam isolation valves, safety valves, check valves, turbine stop valves, bypass valves, etc.
2.2 Excessive Dead Weight Loads Continued overfill of the steam generator(s) will result in large quantities of subcooled water in the steamlines. The added weight of the water may exceed the design stress limits of the piping spring supports and can subject the steamline to severe deflections and stress. When the steamlines are filled with water for hydro- static testing, the pipe hangers are pinned in order to prevent pipe movement and subsequent damage to the hangers.
N
-- 8-
2.3 Failure of Valves to Reseat The pressure pulses created by the hydraulic forces or slugs of water miqht result in opening of the safety valves on the steamlines. These valves could be required to relieve water or two-Dhase flow durinq a steam generator overfill. The valves are not designed for this environment and may fail to reseat.
Other valves which are subject to failure due to the pressure pulses and flow induced loads, are the main steam isolation valves, the turbine stop valves and bypass valves and the atmospheric dump valves. Stuck open safety valves, atmospheric dump valves or failure of the main steam isolation valves to close (when coupled with a downstream pipe break or stuck open bypass valves)
could cause the secondary system to hlowdown, exacerbating the primary system overcooling transient initiated by steam generator overfill. In addition the blowdown of a steam generator from the overfilled condition would result in an unanalyzed primary system cooldown and consequential reactivity transient.
2.4 Loss of Emergency Feedwater Pump Turbine The preferred method of decay heat removal is via the steam generators which are supplied feedwater by the emergency feed- water system. Dependinq on the system design, the pumps may be either turbine or motor-driven or a combination of the two. The effects of water carryover to the steamlines can adversely affect the turbine which provides the motive power to the turbine-driven
-9- emergency feedwater pump. The steamline for the emergency turbine is usually connected to the main steamline upstream of the main steam isolation valves (MSIV). Hydraulic forces or liquid in the main steamline could be transmitted to the turbine causing it to trip, rendering a train of the emergency feedwater system inoperable.
Not only does the loss of the steam result in loss of the motive power for the turbine but a slug of water entering the turbine could severely damage it and render it inoperable or jeopardize the pres- sure boundary. This is a major safety concern for those plants in which all of the emergency feedwater pumps are turbine-driven, e.g., Davis Bessie, Haddam Neck, Turkey Point, Yankee Rowe, Calvert Cliffs, Oconee.
An additional concern is that a consequential break in the steamline to the turbine-driven emergency feedwater train may produce a hostile environment for other safety-related systems located in close prox- imity to the steam supply line to the turbine. In some plants, the layout of the emergency feedwater system is such that the redundant trains of the system are located in the same or adjacent vital areas.
Consequently, failures in the turbine-driven train could interact adversely with the motor-driven train rendering the emergency feed- water system inoperable.
2.5 Steam Generator Tube Rupture An additional mechanism exists for steam generator tube ruptures in OTSGs. The overfill of the steam generator cools the tubes faster
- 10 -
than the shell of the steam generator. The vertical tubes are fastened on each end at the upper and lower tube sheet. Since the tubes are cooling faster than the shell, the tubes are subject to tensile stresses. Worn or defective tubes could rupture creating a primary to secondary leak.
2.6 Acceleration of Accumulated Water In the design and layout of the main steamlines and attached piping, one of the major considerations is the stress induced by thermal expansion of the piping. In order to keep these stresses within allowable limits, the piping in containment is sometimes provided with "U" bends to accommodate the thermal expansion. The "U"
bends, if they are situated in the vertical plane,.could act as a manometer and trap liquid if the main steamlines start to fill with water during a steam generator overfill event. The opening of an atmospheric dump valve, secondary safety valve, bypass valve or any other valve downstream of the "U" bend would cause any trapped liquid to accelerate as a slug. The momentum of such a rapidly moving water slug could be sufficiently large that the forces generated as a result of changes of direction caused by other bends in the piping or the valves could break pipe restraints and may cause a rupture of the steamline or valve (secondary side blowdown).
Starting of the turbine-driven auxiliary feed pump which is normally below the main steamlines could also cause the acceleration of an accumulated water column which is likely in
- 11 -
the vertical piping. This then would have the potential for possible damage to the main steamline piping as above, but also could affect or possibly rupture the steam piping to the turbine-driven auxiliary feedwater pump and could cause extensive damage to the turbine.
The acceleration of liquid trapped in piping systems may also occur in piping that does not have liquid traps. This could occur in horizontal lines partially filled with liquid. The opening of a downstream valve in this case would cause a rapid flow of steam across the surface of the liquid resulting in possible wave formation at the free surface. This could be severe enough to cause the liquid to be swept up to form a water slug resulting in damage to piping and equipment as described above.
There is the Dossihility that this type of damage could be caused unknowingly by plant operators as a result of opening the atmospheric dump valves, turbine bypass valves, or startina the steam- driven auxiliary feedwater turbines all of which may be normally done during hot shutdown or normal cooldown. Clearly, the operators need to be cautioned about the possibility of accumulated water and the consequences of sluq acceleration.
Of course, this type of damage could also be caused by secondary side repressurization which could open a safety or relief valve and could not be intercepted by the plant operators.
- 12 -
3.0 STEAM GENERATOR OVERFILL SCENARIOS.
There are a number of failures (B&W identified 20 equipment failures)
by which the main or emergency feedwater system may cause steam generator overfill and consequential excessive heat removal from the reactor coolant. Excessive steam generator inventory, particularly in the B&W plants, will result in a decrease in temperature in the reactor coolant system, reduction of reactor coolant volume and, consequently, a pressurizer pressure and level decrease that may cause actuation of the emergency core cooling system. The reactivity increase due to the negative moderator temperature coefficient will cause an increase in the reactor power level. Reactor trip may result from high neutron flux or low pressurizer pressure. If offsite power is lost, natural circulation is required to remove decay heat through the steam generators.
Voids may occur in the primary coolant systems due to the rapid cooldown and system shrinkages that could adversely affect hatural circulation.
In the event that the steam generators are not available as a heat sink, the feed-and-bleed method can be used. In this mode of operation the pressurizer power operated relief valve is opened to remove mass and energy from the RCS. The lost Inventory is then replenished by the make-up or the emergency core cooling system.
Another potential consequence of an overfill for the OTSG, may be a combined, primary and secondary side blowdown caused by the rupture of a steam generator tube(s) due to tube/shell thermal differential expansion and a simultaneous secondary break or stuck open secondary safety valve also occurring as a direct consequence of the overfill.
- 13 -
The course of an excessive feedwater transient resulting in water in the steamlines is dependent upon operator recognition and corrective actions. This is assuming that no credit is given for the non-safety grade equipment which may terminate feedwater flow. Actually, operator oversights and errors have been a significant contributor to the frequency of excessive feedwater transients, primarily while the feedwater is in manual control. Correct operator actions are predicated on the operator distinguishing between excessive feedwater and other overcooling transients. High steam generator level and high main feedwater flow rate should indicate to the operator that an excessive feedwater transient is in progress. Failure to identify the transient before the steam generator high level alarm is annunciated may preclude adequate time (less than two minutes for some plants) for the operator to prevent the level from reaching the steamline.
The analyses in the SARs generally assume that the feedwater is reduced at the high level limit to prevent overfill. If the feed- water is not terminated, the ste~amline isolation valves, safety valves, bypass valves, turbine stop valves, and steam admission valves and other components for the turbine-driven emergency feed- water train can be subjected to significant forces due to the interaction of the steam and water. The resultant pressure pulse(s)
can cause damage to any of these components and prevent their intended operation to mitigate the event. The safety valves may open and vent two-phase flow for which they were not designed. In order to remove decay heat through the steam generators, energy must be removed from the secondary side by venting through the
- 14 -
safety valves, atmospheric dump valves or bypass line to the condenser. If the main steam isolation valves are closed, the:
path must be through the safety valves or atmospheric dump valves.
The two-phase flow may damage these valves and as a result, a valve may stay open, allowing the entire contents of the overfilled steam generator to blowdown to the atmosphere. The consequences of this failure can be extremely serious in com- bination with a steam generator tube rupture, e.g., simultaneous blowdown of the primary and secondary systems outside of con- tainment.
For the event in which the dead weight of the water or condensation- induced water hammer results in failure of the steamlinp hangers, the steamline may sag and deflect resulting in excessive loads on compo- nents and possible maloperation or rupture. In general, a steamline break at no load conditions results in a more severe reactivity transient than when the reactor is at power due to the increased steam generator inventory. Steamline breaks are analyzed in the SARs. For some plants, the steamline break inside containment is not the design basis accident for containment overpressurization design. However, the increased steam generator inventory at overfill conditions may result in higher containment peak pressures and greater return to power than that analyzed in the SAR.
- 15 -
Overfilling of the steam generator may also occur as a consequence of a steam generator tube rupture accident. Operator intervention during the course of events is necessary to ensure that the rising water level due to the leakage of reactor coolant into the affected steam generator is terminated before it reaches the main steamline.
The rate of level rise will be further increased in the steam generator after reactor trip due to a reduction of steam flow.
In some plants, the operator is responsible for regulating the feedwater flow to the affected steam generator, reducing the steam pressure below the set point of the safety relief valves, and isolating the steam generator to minimize radiation releases to the atmosphere. Failure of the operator to take correct action in the correct sequence or an equipment failure could result in the overfill of the steam generator, inadvertant closure of the MSIVs and opening of the safety or relief valves. The steam generator tube rupture accident then evolves into a more serious loss of coolant accident outside of primary containment.
An excessive feedwater transient when the reactor is just critical and at no load appears to result in a more severe overcooling transient with a larger reactivity feedback to the primary system than when the reactor is at full power. Steam generator overfill occurring during power escalation and increasing load appears more probable at this time since the feedwater is usually in manual control. The severity and rapidity of the transient will vary depending on core
- 16 -
life and core heat/feedwater flow mismatch. The primary system transient may mask the symptoms of continued feedwater flow and delay termination of the secondary side transient resulting in accumulation of water in the steamlines.
Main steamlines that have "U" bends that can fill with water or main steamlines that can remain partially filled following a steam generator overfill event have a potential for rupture due to the forces generated by the acceleration of the trapped water in the piping.
This acceleration can be caused by the opening of atmospheric dump valves, turbine byDass valves, turbine-driven feed pump steam admission valves, drain valves or lifting of secondary safety valves. Following the termination of the steam generator overfill, some of these valves most likely will be opened by the plant operator to maintain the plant in a hot shutdown condition or to cooldown the plant. If the operator is unaware that water has accumulated in the main steamline, he could initiate a main steamline runture or cause severe damage to the auxiliary feedwater pump turbine by opening valves that are normally used to control and stabilize the plant following a reactor trip. If the steam system is repressurizing, the operator will not be able to intercept safety or relief valve openings which could cause similar damage.
In summary, overfilling the steam generator can be the initiator or the consequence of another transient resulting in a combination of concurrent transients/accidents. These include a primary overcooling
- 17 -
transient, reactivity transient, a steamline break accident, steam generator tube rupture(s), and loss of the steam generators as a heat sink. The accident scenario can also include additional cascading events considering a sinqle failure and/or a seismic event concurrent with the overfill transient.
- 18 -
4.0 APPLICABILITY OF THE SINGLE FAILURE CRITERION
A large portion of the defense-in-depth available at nuclear power plants to mitigate the consequences of accidents or transients is achieved by redundancy. In PWRs, redundancy is generally achieved by designing each safety-related system such that it is comprised of two identical 100 percent capacity subsystems. Therefore, the failure of any active component will not disable a particular safety function.
Systems whose function is not the Mitigation of accidents or transients, such as those provided solely for power generation, are not provided with any degree of redundancy. Failure of any of these systems (e.g.,
the turbine lube oil cooling system) while it could necessitate a plant shutdown, would not affect the health and safety of the public.
In this category of systems provided for power generation is found the feedwater control system. Failure of this system can result in a steam generator overfill as described previously. However, failure of this system also has broader implications; namely, how the failure of non- safety-related systems can affect a previously analysed accident or transient. It has been generally assumed that during an accident, fail- ure of non-safety grade equipment will not adversely impact the plant.
However, since non-safety grade equipment is not seismically or environmentally qualified, there is no basis to assume that it will not fail or that it will fail in a manner which does not adversely impact the plant.
- 19 -
Since the nuclear steam supply system and all the emergency safety features are seismically and environmentally qualified, the occur- rence of a seismic event will not directly result in an accident caused by failure of these systems and features. There is, however, the, Dotential for overfilling one or more steam generators. The seismic analysis of the main steamline does not assume the lines are filled with water. Therefore, main steamlines may not survive seismic after-shocks following a seismically-induced steam generator overfill. A steamline break inside containment with an overfilled steam generator would challenge the containment integrity and cause a severe overcooling transient not previously analyzed.
Usually, the Single Failure Criterion is applied only to safety-related systems to assure redundancy and performance of their safety functions.
It appears reasonable that the assumed single failure following a loss of coolant accident (e.g., steam generator tube rupture) could be in the feedwater control system causing a steam generator overfill.
The resulting event, which has not been analyzed in the SARs, may lead to a combined blowdown of primary and secondary systems as discussed in Section 5 of this report.
- 20 -
5.0 COMBINED PRIMARY AND SECONDARY SIDE BLOWDOWN
The combined primary and secondary side blowdown can be postulated I/
to occur by a number of different scenarios. One of the scenarios that has been addressed already in this report is possible
-only for B&W plants because of their OTSG. This scenario starts with the postulation of a failure in the feedwater control system that results in a steam generator overfill. The overfill may cause a rupture of defective steam generator tubes due to the differential thermal gradients existing between the steam generator shell and the tubes in the overfilled condition. Another consequence of the overfill (or a postulated single failure) could be a stuck open secondary safety valve or a steamline break. The combination of these two events resulting from a single initiating event could result in a LOCA outside containment.
For PWRs whose high pressure injection (HPI) pumps have a shutoff head above the PORV setpoint another scenario could be postulated as a result of a steam generator overfill that could lead to a combined primary and secondary side blowdown. In this scenario, the steam generator overfill is postulated to cause the blowdown of a steam generator from the overfilled condition either through a steamline break or stuck open secondary safety valve. This overcooling tran- sient, imposed on the primary system as a result of the steam generator blowdown, may cause the primary system pressure to decrease to a level where HPI is automatically initiated.
I .
- 21 -
while sufficient The termination of HPI relies on operator action, and to do so time exists for the operator to terminate lIPI, his failure possibly causing could result in discharging water through the PnRYs them to stick open.
nenative moderator The return to power caused by the feedback from the level. This coefficient will also act to increase the pressurizer trips the reactor situation could he further exacerbated if the operator operator mistakes coolant pumps. This operator error may occur if the coolant accident the secondary side transient for a small break loss of (SBLOCA). The response of the primary system to the SBLnCA is generally secondary side similar to that which could result from the postulated would result transient. The RCP trip, required by SRLOCA procedures, primary system in the loss of some heat removal capability from the primary that could cause a faster rise in pressurizer level and PORVs.
system pressure imposing an additional challenge to the generator overfill The above scenarios were postulated assuming the steam primary and secondary as the initiating event. Other scenarios for combined overfill is assumed side blowdown can be postulated if the steam generator event. An example to be the single failure subsequent to the initiating of a RCP seal, of such an event would be a SBLOCA, caused by the failure failure of the single for example. The usual analysis is done assuming the Typically, this safety-related component causing the most adverse effect.
causes a loss component is a diesel generator. This postulated failure is assumed to be of one train of safety equipment since offsite power
- 22 -
lost concurrent with the initiating event. If instead, the single failure chosen was a failure in the non-safety-related feedwater regulating system causing a steam generator overfill, the result could be a combined primary and secondary side blowdown. This assumes that the steam generator overfill causes a secondary side leak.
Another mechanism that can be postulated as a cause of combined primary and secondary side blowdown could be a large steamline break causing the failure of a small instrument line on the primary coolant system, such as those used to measure steam generator differential pressure, resulting from direct or deflected high eneigy Jet impingement.
Conversely, a primary line break inside the steam generator cubicle could also result in failures of level instrumentation lines on the shell side of the steam generator due to direct or deflected jet impingement.
The above scenarios are a few of the ways that a combined primary and secondary side blowdown can be mechanistically postulated to occur.
Although some are less probable than others; namely, those resulting from pipe breaks, it is the view of AEOD that the simultaneous primary and secondary side blowdown is a credible event and should be analyzed.
Operating procedures also need to be developed and operators need to be trained to recognize and respond to this event. This is particularly important since the effects of the secondary side blowdown may mask the primary side blowdown, or vice versa, such that operators may not
- 23 -
immediately recognize the fact that a combined blowdown is in progress.
This may result in operators unknowingly taking improper actions in their attempts to mitigate the event and stabilize the plant. Before operating procedures can be developed, however, guidelines need to be established for the analysis of the event and the analysis must be completed. With this in hand, the response of the primary and secondary system can be defined in sufficient detail to allow immediate operator recognition of the event and to develop the proper sequence of remedial actions that the operator must take to bring the plant to a safely shutdown condition. The response of the primary and secondary side to the combined blowdown can also be Programmed into the simulators to facilitate operator training.
- 24 -
6.0 AEOD RECOMMENDATIONS
Prior operational experiences have challenged the steam generator level instrumentation and feedwater control systems resulting in safety-related implications of unanalyzed steam generator transients and accidents. The lack of safety grade equipment to either prevent or mitigate steam generator overfill and the potential seriousness of the consequential event have prompted AEOD to recommend that the event be considered as an
2,3,4/
Unresolved Safety Issue.
NRR has agreed that steam generator and reactor overfill transients warrant
5/
treatment as an Unresolved Safety Issue. However, consideration of combined blowdown of the primary and secondary systems was not included in their Unresolved Safety Issue based on overall low probability of the event and credit for operator actions. AEOD maintains the position that until analyses of the event are performed and evaluated for safety significance, the event should be either categorized as a separate Unresolved Safety Issue or included as a part of an existing Unresolved Safety Issue or considered a potential Unresolved Safety Issue pending analytical results. AEOD believes the analyses are required to ascertain system response before operator actions and procedures can be evaluated and appropriate training provided.
AEOD is holding in abeyance a final recommendation concerning the categorization of this issue pending the completion of a prompt scoping study of the problem and the results of an analytical study of a representative plant. The analyses should include the potential
- 25 -
for and system response to combined blowdown of the primary and secondary systems as a result of various consequential combinations of steam generator overfill, steam generator tube rupture, and primary or secondary side leaks.
In the interim until procedure revisions based upon analytical results can be considered, an audit should be conducted to determine whether operators are even aware of such potentially serious situations as steam generator overfill, initiating operation of steam systems having water accumulation, or combined blowdown of the primary and secondary systems from whatever cause. Should an audit uncover that such subjects are not covered in training programs nor in procedures, and thus, in general, operators have no awareness or background on such situations, then AEOD
would recommend that consideration should be given to initiation of interim actions to develop at least an awareness that these situations are possible.
I I
- 26 - I.
REFERENCES
1. Letter from C. Michelson, ACRS Consultant, to Dr. D. Okrent and Dr. M. Plesset dated June 28, 1979.
2. Memo from C. Michelson, Director, AEOD, to Chairman Ahearne dated August 4, 1980.
3. Commission Meetinq of October 16, 1980 concerning Unresolved Safety Issues.
4. Commission Meeting of November 10, 1980 concerning ATWS.
5. Memorandum from H. Denton, NRR, to Commissioners, NRC, NInclusion of Steam Generator transients as an Unresolved Safety Issue (Addendum to SECY-80-325)," dated November 7, 1980.