NRC Generic Letter 1981-16

NRC Generic Letter 1981-016: Steam Generator Overfill

ML031080557
Person / Time
Site:	Beaver Valley, Millstone, Hatch, Monticello, Calvert Cliffs, Dresden, Davis Besse, Peach Bottom, Browns Ferry, Salem, Oconee, Mcguire, Nine Mile Point, Palisades, Palo Verde, Perry, Indian Point, Fermi, Kewaunee, Catawba, Harris, Wolf Creek, Saint Lucie, Point Beach, Oyster Creek, Watts Bar, Hope Creek, Grand Gulf, Cooper, Sequoyah, Byron, Pilgrim, Arkansas Nuclear, Three Mile Island, Braidwood, Susquehanna, Summer, Prairie Island, Columbia, Seabrook, Brunswick, Surry, Limerick, North Anna, Turkey Point, River Bend, Vermont Yankee, Crystal River, Haddam Neck, Ginna, Diablo Canyon, Callaway, Vogtle, Waterford, Duane Arnold, Farley, Robinson, Clinton, South Texas, San Onofre, Cook, Comanche Peak, Yankee Rowe, Maine Yankee, Quad Cities, Humboldt Bay, La Crosse, Big Rock Point, Rancho Seco, Zion, Midland, Bellefonte, Fort Calhoun, FitzPatrick, McGuire, LaSalle, 05000363, 05000355, Zimmer, 05000467, Fort Saint Vrain, Washington Public Power Supply System, Shoreham, Satsop, Trojan, Bailly, Atlantic Nuclear Power Plant, Cherokee, Marble Hill, Hartsville, Phipps Bend, Yellow Creek
Issue date:	07/31/1981
From:	Eisenhut D G Office of Nuclear Reactor Regulation
To:
References
GL-81-016, NUDOCS 8108240009
Download: ML031080557 (34)

July 31, 1981ALL LICENSEES OF OPERATING PLANTS AND HOLDERS OF CONSTRUCTION PERMITSGentlemen:SUBJECT: STEAM GENERATOR OVERFILL (GENERIC LETTER 81-16)(Formerly Issued July 1, 1981, as Generic Letter 81-16)In a letter dated March 28, 1980 from H.R. Denton, we informed you ofthe revised criteria to be used by the staff in evaluating reactoroperator training and licensing that could be implemented under thecurrent regulations. We also advised you that Commission review in thearea of operator training and qualification was continuing and itcould be expected to result in additional criteria.The NRC Office of Analysis and Evaluation of Operational Data has produceda report entitled, "AEOD Observations and Recommendations Concerning theProblem of Steam Generator Overfill and Combined Primary and Secondary--Side Blowdown," dated December 17, 1980, a copy of the report is enclosed.This report documents results of studies completed to date by the Officeof Analysis and Evaluation of Operational Data with regard to the steamgenerator overfill problem.This report expresses concerns In the following area: (1) increaseddead weight and potential seismic loads placed on the main steamlineand its support should this line become flooded; (2) the load placed onthe main steamlines due to the potential for rapid collapse of steamvoids resulting in water hammer; (3) the potential for secondary safetyvalves sticking open following discharge of water or two-phase flow;(4) the potential for rupture for weakend tubes in the once-through-steam-generator (OTSG) on B&W NSSS plants due to tensile loads causedtby the rapid thermal shrinkage of the tubes relative to the generatorshell.From the examining experiences of the Operator Licensing Branch, operatorsat nuclear power plants are aware of the need to avoid overfilling steamgenerators and not operating steam systems with water accumulatHowever, there may be a general lack of appreciation of theseriousness of situations that can arise from these eventsAUG 041OFlICE , i... ... .. ... .................... l.l..................... ..................... ..................... ....... .. ...SURNAMED .... 810824000? 61073BATE}PDR ADOCK 050000 0 *..................... ..................... ..................... ....................IDAE PDRR FORM .. 3 / .R. ....................... .. ..................... ....................NcoMal00>ce2 O FFICIA L R EC O RD C OPY *USGPO: 1980 -329-824

-2 -July 31, 1981While this issue is being studied further, we request that you determinewhich scenarios are credible for your plant and that you include in youroverall training program, plant-specific information stressing theimportance of feedwater flow as well as the possible consequences ofsteam generator overfill. This information should be factored intoyour initial operator training programs and the operator requalificationprograms.Sincerely,original signed byDarrell G. LisenhultDarrell G. Eisenhut, DirectorDivision of LicensingOffice of Nuclear Reactor RegulationEnclosure:As statedIIqy,)I__Y~l 0t11 IOFFICED DL:ORAP t I D C DLfD/SA DHFS:D R L DSURNAME0 GHoiahan-sh htinikf GLi ...SHnauY .. b.i..AT. .6. /.8. 6 /5 /81 \ / u.8. G _ _ 81 _______~~~~~~~~~~~~~~~~~~~~~~~... .................... ... ... .... ........ d ................ ....... ................. ..................__..._______...1...__......A.8DATE'OR 31(6 8 -1 .... 0246 ..... .... 8*8NRC FORM 318 4le/801 NRCM 0240OFFICIAL RECORD COPY* USGPO: 1980-329 824 IALL POWER REACTOR LICENSEESDocket No. 50-348Farley Unit 1Docket No. 50-313Arkansas Unit 1Docket No. 50-368Arkansas Unit 2-Docket No. 50-317Calvert Cliffs Unit 1Docket No. 50-318 iCalvert Cliffs Unit 2Docket No. 50-293,Pilgrim Unit 1Docket No. 50-325'Brunswick Unit 1Docket No. 50-324'Brunswick Unit 2Docket No. 50-261H. B. Robinson Unit 2.Docket No. 50-10.Dresden Unit 1-' rI/Docket No. 50-247-Indian Point Unit 2Docket 50-286-Indian Point Unit 3,iDocket No. 50-155-Big Rock PointDocket No. 50-255 1-PalisadesDocket No. 50-409 6Z-LacrosseDocket No. 50-269Oconee Unit 1I'Docket No. 50-270-Oconee Unit 2/-Docket No. 50-287Oconee Unit 3Docket No. 50-334 1'-Beaver Valley Unit 1Docket No. 50-237-Dresden Unit 2Docket No. 50-249.'Dresden Unit 3Docket No. 50-254'-Quad-Cities Unit 1-Docket No. 50-265Quad-Cities Unit 2Docket No. 50-295Zion Unit 1-Docket No. 50-304 -Zion Unit 2Docket No. 50-213Connecticut Yankee (Haddam Neck)Docket No. 50-302;Crystal River 3Docket No. 50-335`-St. Lucie Unit 1Docket No. 50-250Turkey Point Unit3Z/Docket No. 50-251Turkey Point Unit 41~-Docket No. 50-321Edwin I. Hatch Unit 1p, --Docket No. 50-366Edwin I. Hatch Unit 2, Docket No. 50-315D. C. Cook Unit 1

-2 -'IDocket No. 50-316-D. C. Cook Unit 2Docket No. 50-344-TrojanDocket No. 50-333-FitzPatrickDocket No. 50-305-KewauneeVDocket No. 50-331'Duane ArnoldDocket No. 50-219-Oyster Creek UnitIVVDocket No. 50-29 v-Yankee-RoweDocket No. 50-3394Jf-Nbrth Anna 21Docket No. 50-309 Vy' Maine YankeeDocket No. 50-289Three Mile Islandyunit 1Docket No. 50-320 Ithree Mile Island Unit 2Docket No. 50-298Cooper StationDocket No. 50-220 "Nine Mile Point Unit 1-Docket No. 50-245Millstone Unit 1Docket No. 50-267 yFt. St. VrainDocket No. 50-272 VSalem Unit 1Docket No. 50-244 1.R. E. Ginna 1Docket No. 50-312 VRancho SecoDocket No. 50-206 V/San Onofre 1Docket No. 50-259 VBrowns Ferry Unit 1Docket No. 50-260 VBrowns Ferry Unit 2Docket No.Salem 250-311Docket No. 50-327-Sequoyah 1Docket No. 50-369McGuire 1Docket No. 50-364Farley 2/IDocket No. 50-336 /Millstone Unit 2Docket No. 50-296 V-Browns Ferry Unit 3Docket No. 50-346 v-Davis-Besse 1Docket No. 50-263.MonticelloVDocket No. 50-282 vv Prairie Island Unit 1Docket No. 50-306 /Prairie Island Unit 2Docket No. 50-271-Vermont YankeeDocket No. 50-338-North Anna 1Docket No.50-280Surry Unit 1* Docket No. 50-281-Surry Unit 221,VDocket No. 50-285'Ft. CalhounI /Docket No. 50-133 v'Humboldt Bay.Docket No. 50-277Peach Bottom 2-Docket No. 50-278 V/Peach Bottom 3Docket No. 50-266'Point Beach Unit 1Docket No. 50-301Point Beach Unit 2V

E B 2. "dI~-PLANTS UNDER CONSTRUCTION1. Cherokee 1/2/32. Beaver Valley 23. St. Lucie 24. Vogtle 1/25. River Bend 1/26.7.8.9.10.11.12.13.14.15.16.17.18.19.20.50-49.1, 4§;, 44j/50-412V50-38g V50-424 , 42 5A50-459$ 45950-3 8350-410\.50-423'/50-36'7 ./50-35ff,V353 V50-354,V355 a50-443~ 444\'/Forked RiverNine Mile PointMillstone 3.Bailly 2Limerick 1/2Hope Creek 1/2Seabrook 1/22Hartsville 1/2/3/4Phipps Bend 1/2Yellow Creek 1/2WPPSS 1/3/4/5Harris 1/2/3/4FNP50-51f,50-55-6,50-56t ,50-460 ,50-400,50-4375 f9,554-567508,401,526', 521513,402,*094030

FE$ z 7 1981PLANTS UNDER OL REVIEW1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.25.26.27.28.29.Clinton 1/2Byron 1/2Braidwood 1/2LaSalle 1/2Midland 1/2McGuire 2So. Texas 1/2ShorehamWaterfordGrand Gulf 1/2Diablo Canyon 1/2Susquehana 1/2St. Lucie 2Summer 1San Onofre 2/3Bellefonte 1/2Watts Bar 1/2Sequoyah 2Comanche Peak 1/250-461/46150-454, 45550-456/4 57I -50-373, 37450-325,33050- 37050-418, 49§50-322250-382t. I ,50-416/41750-275, 32350-387', 3885.0-38950-39550-36i, 362I I50-438, 43950-390, 39150- 32850-44T, 449/WPPSS-2Fermi 2Zimmer 1.Perry 1/2Palo VerdeCatawbaMarble HillWolf CreekCallaway50-391j50-34150-35<50-446, 44150-52', 52§, 53050-413, 4-1450-546, 54'750-48250-483, 4S6 AEOD OBSERVATIONS AND RECOMMENDATIONSCONCERNING THE PROBLEM OF STEAM GENERATOR OVERFILLAND COMBINED PRIMARY AND SECONDARY SIDE BLOWDOWNby theOffice for Analysis and Evaluationof Operational DataDecember 17, 1980Prepared by:Euaene V. ImbroWayne D. LanningNOTE: This report documents results of studies completed to date by theOffice for Analysis and Evaluation of Operational Data with regardto a particular operating event. The findings and recommendationscontained in this report are provided in support of other ongoingNRC activities concerning this event. Since the studies are ongoing,the report is not necessarily final, and the findinqs and recommend-ations do not represent the position or requirements of the respon-sible program office of the Nuclear Regulatory Commission.IDUEe'45J.L5~ 4036&

TABLE OF CONTENTS1.0

BACKGROUND

.........................* .1.1 The Steam Generator Overfill Problem. ...........1.2 Steam Generator Level Control in Combustion EngineeringNSSS Plants .. .. .. .. .. .. .. .. .. .. .. .. .. .1.3 Steam Generator Level Control in Westinghouse NSSS Plants ....1.4 Steam Generator Level Control in Babcock & Wilcox NSSS Plants ..123451.5 Steam Generator Overfill Experience ...2.0 POTENTIAL EFFECTS OF STEAM GENERATOR OVERFILL.2.1 Hydraulic Forces. .........2.2 Excessive Dead Weiqht Loads .......2.3 Failure of Valves to Reseat .......2.4 Loss of Emergency Feedwater Pump Turbine.2.5 Steam Generator Tube Rupture. ......2.6 Acceleration of Accumulated Water ....3.0 STEAM GENERATOR OVERFILL SCENARIOS ......4.0 APPLICABILITY OF THE SINGLE FAILURE CRITERION.5.0 COMBINED PRIMARY AND SECONDARY SIDE BLOWDOWN .6.0 AEOD RECOMMENDATIONS .............*.. ..* * ....** ....*

• a ..... ...* .....* ................* ..........................57778891012182024.........*

• 0..0 .....REFERENCES. .............. ............26 -

AEOD OBSERVATIONS AND RECOMMENDATIONSCONCERNING THE PROBLEM OF STEAM GENERATOR OVERFILL1.0

BACKGROUND

Steam generator water level in pressurized water reactors (PWR), withthe exception of the Babcock & Wilcox (B&W) Nuclear Steam Supply Sys-tem (NSSS) plants, is controlled by a three element level control sys-tem that regulates feedwater flow. The control system compares feed-water flow, steam flow, and water level with a preprogrammed level set-point. The error signal generated by the control system is used tocontrol the position of the feedwater requlating valves and vary thespeed of the main feedwater pumps. The B&W NSSS plants do not usesteam generator level to control feedwater flow above 1T percent power.The feedwater flow in BAW NSSS plants is controlled by the IntegratedControl System (ICS) and is based on megawatt demand when operatingabove 15 percent power. The ICS is not safety related.Since the steam generators provide the heat sink for the Reactor Cool-ant System (RCS), the principal safety consideration related to steamgenerator water level, until now, has been the need for sufficientwater level to remove the energy generated by the reactor and transferredto the reactor coolant system. Combustion Engineering (CE) andWestinghouse (W) NSSS plants have an installed safety grade reactortrip on low steam generator level to protect the RCS from the conse-quences of loss of heat removal capability. The trip is an anticipatory

-2 -trip in that loss of heat removal capability also causes the reactorto trip on high RCS pressure later in the transient. The B&W reactorsdo not have a reactor trip on low steam generator level and rely onthe high RCS pressure trip to protect the reactor on the loss of heatsink.1.1 The Steam Generator Overfill ProblemA new issue pertaining to reactor safety has been raised concern-ing steam generator water level; however, the concern in this caseis the effect of excessive level. The steam generator overfilltransient, the subject of this report, can be caused by the fail-ure of the three element level controller or the ICS. The controlof steam generator level within the specified operating range wasnot thought to be important to the safety of the plant. Accord-ingly, the three element level control system provided on CE andW NSSS plants is not safety related and, therefore, not seismicallyor environmentally qualified.We now believe that steam generator overfill can affect the safetyof the plant in several ways, the more severe of which could leadto the postulation of steamline breaks, or simultaneous steamlinebreak and steam generator tube rupture for B&W NSSS plants (LOCAoutside containment), as credible events. The basis for theseconcerns is as follows: 1) the increased dead weight and poten-tial seismic loads placed on the main steamline and its supports

-3 -should this line become flooded; 2) the loads placed on the mainsteamlines due to the potential for rapid collapse of steam voidsresulting in water hammer; 3) the potential for secondary safetyvalves sticking open following discharge of water or two-phaseflow; 4) the potential inoperability of the main steamline isola-tion valves (MSIVs), main turbine stop and bypass valves, feed-water turbine valves, and atmospheric dump valves due to effectsof water or two-phase flow; and 5) the potential for rupture ofweakened tubes in the once through steam generator (OTSG) on B&WIJSSS plants due to tensile loads caused by the rapid thermalshrinkage of the tubes relative to the generator shell. The aboveitems have not have been considered in the plant design becausethe steam generator overfill transient has not been one of theevents analyzed. The reason this has not been analyzed is thatsuch plants either have control grade protective actions on highsteam generator level to provide for protection of the turbine, orthey rely on operator action to control level manually in theevent that the normal level control system fails.1.2 Steam Generator Level Control in Combustion Engineering NSSS PlantsThe CE NSSS plants in operation, typically, have a control gradeturbine trip on high steam generator water level. The high levelturbine trip is generally provided on a two out-of four logic. Thistrip is derived from the safety-related instrumentation used toprovide the low level reactor trip. An additional protective

-4 -feature provided on CE plants, although control grade, is thatthe feedwater supply rate is ramped down to 5 percent of itsfull Dower flow in one minute following reactor triD. Followinga turbine and reactor trip from 100 percent power, the steamgenerator level may drop about 40 to 50 inches due to collapse ofvoids in the economizer and evaporator sections of the generator.However, if a control system malfunction causes the feed rate tocontinue at 100 percent the steam generators would fill in aboutthree minutes. A similar situation could also occur if while operatingat full power the feedwater control system caused feedwater flowto increase to its maximum. Depending on the particular plantdesign, this could he as much as 25 percent greater than thenormal flow at 100 percent power. In this instance, the steamgenerator would also fill in a matter of minutes, however, thesteam generators would not be water solid as in the first case.The level would be two phase since the generators are steaming;i.e., no reactor or turbine trip is assumed. Clearly, a rapidoperator action is necessary to prevent overfilling of the steamgenerators in the event of failure of control grade equipment.1.3 Steam Generator Level Control in Westinghouse NSSS PlantsThe Westinghouse NSSS plant design is similar to CE in that theturbine trip on high steam generator level is also control grade,but it operates on a two out of three logic scheme. The high level trip,although control grade, is derived from the safety grade level in-strumentation used to generate the reactor trip on low steam generatorwater level. Westinghouse NSSS plants trip the main feedwater pumpsand close the feedwater regulating valves automatically on reactor

-5 -trip. This is accomplished by the non-safety grade feedwater controlsystem. As in CE plants, a failure of feedwater control system on Wplants can result in filling the steam generators in approximatelythree minutes.1.4 Steam Generator Level Control in Babcock & Wilcox NSSS PlantsFor B&W NSSS plants there is a steam generator high level alarm (one outof one logic which is not safety grade) but this does not directly provideprotection against overfill. Some degree of level protection is providedby the ICS in that if the high level setpoint is reached (about 20 feet)the meaawatt demand signal to the feedwater controller is blocked. Thisprevents further increase of feed flow rate. The ICS does not automati-cally terminate the steam generator overfill transient, however. Theoutput from the steam generator high level signal is input into the In-tegrated Control System for B&W plants. During a steam generator overfill,this system pulls control rods to compensate for reduction of Tave and re-actor trip may occur on high flux or low pressure. Depending on the sever-ity of the transient and power history, a reactor trip may not occurimmediately. The ICS will initiate feedwater run back after reactor trip.For worst case conditions, operator action within two minutes isrequired to prevent water spillage into the steamlines. The operatorprobably has to act faster to prevent a steam generator overfilltransient than any other transient.1.5 Steam Generator Overfill ExperienceThere has been one incident which is believed to have resulted in some waterin the steamlines. This was the "liqht bulb incident" at Rancho Seco on

-6 -March 28, 1978. This event involved loss of non-nuclear instrumentationand subsequent inappropriate increase of main feedwater by theoperator. Subsequent to the event, the licensee performed structuralanalyses and visual inspection of the steamline hangers, Theinvestigation did not reveal any damage although the licenseewas reasonably sure that some water was carried-over into thesteamlines.There have been ten other events at B&W NSSS plants which resultedin high level alarms, but none has resulted in spilling of waterinto the steamlines. These include:PlantCrystal River 3Davis Besse 1Crystal River 3Davis Besse 1Davis Besse 1Three Mile Island-2Three Mile Island-2Rancho SecoArkansas 1Crystal River 3Date4/16/777/30/773/18/77a/29/773/25/784/23/7812/2/781/5/798/13/798/16/79Reference/SourceLER-77-29RO-NP-33-77-30trey Book, April 1977RO-NP-33-77-72RO-78-033LER-78-33 and 44LER-78-069LER-79-01IE Resident Inspector1E RO-IIIt should be noted that overfilling the steam generators to thehigh level alarm does not necessarily require a Licensee EventReport (LER). The above events were reported for other reasons.Consequently, an LER search did not find any failures ortransients related to excessive feedwater.

2.0 POTENTIAL EFFECTS OF STEAM GENERATOR OVERFILL2.1 Hydraulic ForcesWhen water enters the steamline, the steam is condensed and mayproduce a condensation-induced water hammer. Condensation of thesteam results in a low pressure region which can accelerate aslug of water producing significant dynamic loads when the slugimpacts at pipe locations where there is a change in direction orflow area. The dynamic loads produce axial forces and bendingor torsional moments that can cause violent pipe movement withresultant damage to pipe hangers, restraints and valve operators.Failure of the steamline hangers and restraints can result ininadequate support and possible loss of valve operability orsteamline integrity. Components which can be damaged in thesteamline include the main steam isolation valves, safety valves,check valves, turbine stop valves, bypass valves, etc.2.2 Excessive Dead Weight LoadsContinued overfill of the steam generator(s) will result in largequantities of subcooled water in the steamlines. The added weightof the water may exceed the design stress limits of the pipingspring supports and can subject the steamline to severe deflectionsand stress. When the steamlines are filled with water for hydro-static testing, the pipe hangers are pinned in order to preventpipe movement and subsequent damage to the hangers.

N-- 8-2.3 Failure of Valves to ReseatThe pressure pulses created by the hydraulic forces or slugsof water miqht result in opening of the safety valves on thesteamlines. These valves could be required to relieve wateror two-Dhase flow durinq a steam generator overfill. The valvesare not designed for this environment and may fail to reseat.Other valves which are subject to failure due to the pressurepulses and flow induced loads, are the main steam isolation valves,the turbine stop valves and bypass valves and the atmosphericdump valves. Stuck open safety valves, atmospheric dump valvesor failure of the main steam isolation valves to close (whencoupled with a downstream pipe break or stuck open bypass valves)could cause the secondary system to hlowdown, exacerbating theprimary system overcooling transient initiated by steam generatoroverfill. In addition the blowdown of a steam generator fromthe overfilled condition would result in an unanalyzed primarysystem cooldown and consequential reactivity transient.2.4 Loss of Emergency Feedwater Pump TurbineThe preferred method of decay heat removal is via the steamgenerators which are supplied feedwater by the emergency feed-water system. Dependinq on the system design, the pumps may beeither turbine or motor-driven or a combination of the two. Theeffects of water carryover to the steamlines can adversely affectthe turbine which provides the motive power to the turbine-driven

-9-emergency feedwater pump. The steamline for the emergency turbineis usually connected to the main steamline upstream of the mainsteam isolation valves (MSIV). Hydraulic forces or liquid in themain steamline could be transmitted to the turbine causing it totrip, rendering a train of the emergency feedwater system inoperable.Not only does the loss of the steam result in loss of the motive powerfor the turbine but a slug of water entering the turbine couldseverely damage it and render it inoperable or jeopardize the pres-sure boundary. This is a major safety concern for those plants inwhich all of the emergency feedwater pumps are turbine-driven,e.g., Davis Bessie, Haddam Neck, Turkey Point, Yankee Rowe,Calvert Cliffs, Oconee.An additional concern is that a consequential break in the steamlineto the turbine-driven emergency feedwater train may produce a hostileenvironment for other safety-related systems located in close prox-imity to the steam supply line to the turbine. In some plants, thelayout of the emergency feedwater system is such that the redundanttrains of the system are located in the same or adjacent vital areas.Consequently, failures in the turbine-driven train could interactadversely with the motor-driven train rendering the emergency feed-water system inoperable.2.5 Steam Generator Tube RuptureAn additional mechanism exists for steam generator tube ruptures inOTSGs. The overfill of the steam generator cools the tubes faster

-10 -than the shell of the steam generator. The vertical tubes arefastened on each end at the upper and lower tube sheet. Since thetubes are cooling faster than the shell, the tubes are subject totensile stresses. Worn or defective tubes could rupture creatinga primary to secondary leak.2.6 Acceleration of Accumulated WaterIn the design and layout of the main steamlines and attached piping,one of the major considerations is the stress induced by thermalexpansion of the piping. In order to keep these stresses withinallowable limits, the piping in containment is sometimes providedwith "U" bends to accommodate the thermal expansion. The "U"bends, if they are situated in the vertical plane,.could act as amanometer and trap liquid if the main steamlines start to fillwith water during a steam generator overfill event. The openingof an atmospheric dump valve, secondary safety valve, bypassvalve or any other valve downstream of the "U" bend would causeany trapped liquid to accelerate as a slug. The momentum of sucha rapidly moving water slug could be sufficiently large that theforces generated as a result of changes of direction caused byother bends in the piping or the valves could break pipe restraintsand may cause a rupture of the steamline or valve (secondaryside blowdown).Starting of the turbine-driven auxiliary feed pump which isnormally below the main steamlines could also cause theacceleration of an accumulated water column which is likely in

-11 -the vertical piping. This then would have the potential forpossible damage to the main steamline piping as above, butalso could affect or possibly rupture the steam piping to theturbine-driven auxiliary feedwater pump and could causeextensive damage to the turbine.The acceleration of liquid trapped in piping systems may alsooccur in piping that does not have liquid traps. This couldoccur in horizontal lines partially filled with liquid. Theopening of a downstream valve in this case would cause a rapidflow of steam across the surface of the liquid resulting in possiblewave formation at the free surface. This could be severe enough tocause the liquid to be swept up to form a water slug resultingin damage to piping and equipment as described above.There is the Dossihility that this type of damage could becaused unknowingly by plant operators as a result of opening theatmospheric dump valves, turbine bypass valves, or startina the steam-driven auxiliary feedwater turbines all of which may be normallydone during hot shutdown or normal cooldown. Clearly, theoperators need to be cautioned about the possibility ofaccumulated water and the consequences of sluq acceleration.Of course, this type of damage could also be caused by secondaryside repressurization which could open a safety or relief valveand could not be intercepted by the plant operators.

-12 -3.0 STEAM GENERATOR OVERFILL SCENARIOS.There are a number of failures (B&W identified 20 equipment failures)by which the main or emergency feedwater system may cause steam generatoroverfill and consequential excessive heat removal from the reactorcoolant. Excessive steam generator inventory, particularly in theB&W plants, will result in a decrease in temperature in the reactorcoolant system, reduction of reactor coolant volume and, consequently,a pressurizer pressure and level decrease that may cause actuationof the emergency core cooling system. The reactivity increase dueto the negative moderator temperature coefficient will cause an increasein the reactor power level. Reactor trip may result from high neutronflux or low pressurizer pressure. If offsite power is lost, naturalcirculation is required to remove decay heat through the steam generators.Voids may occur in the primary coolant systems due to the rapid cooldownand system shrinkages that could adversely affect hatural circulation.In the event that the steam generators are not available as a heatsink, the feed-and-bleed method can be used. In this mode of operationthe pressurizer power operated relief valve is opened to remove massand energy from the RCS. The lost Inventory is then replenished bythe make-up or the emergency core cooling system.Another potential consequence of an overfill for the OTSG, may bea combined, primary and secondary side blowdown caused by the ruptureof a steam generator tube(s) due to tube/shell thermal differentialexpansion and a simultaneous secondary break or stuck open secondarysafety valve also occurring as a direct consequence of the overfill.

-13 -The course of an excessive feedwater transient resulting in water inthe steamlines is dependent upon operator recognition and correctiveactions. This is assuming that no credit is given for the non-safetygrade equipment which may terminate feedwater flow. Actually, operatoroversights and errors have been a significant contributor to the frequencyof excessive feedwater transients, primarily while the feedwater isin manual control. Correct operator actions are predicated on theoperator distinguishing between excessive feedwater and other overcoolingtransients. High steam generator level and high main feedwater flowrate should indicate to the operator that an excessive feedwater transientis in progress. Failure to identify the transient before the steamgenerator high level alarm is annunciated may preclude adequate time(less than two minutes for some plants) for the operator to preventthe level from reaching the steamline.The analyses in the SARs generally assume that the feedwater isreduced at the high level limit to prevent overfill. If the feed-water is not terminated, the ste~amline isolation valves, safetyvalves, bypass valves, turbine stop valves, and steam admissionvalves and other components for the turbine-driven emergency feed-water train can be subjected to significant forces due to theinteraction of the steam and water. The resultant pressure pulse(s)can cause damage to any of these components and prevent theirintended operation to mitigate the event. The safety valves mayopen and vent two-phase flow for which they were not designed. Inorder to remove decay heat through the steam generators, energymust be removed from the secondary side by venting through the

-14 -safety valves, atmospheric dump valves or bypass line to thecondenser. If the main steam isolation valves are closed, the:path must be through the safety valves or atmospheric dump valves.The two-phase flow may damage these valves and as a result, avalve may stay open, allowing the entire contents of theoverfilled steam generator to blowdown to the atmosphere. Theconsequences of this failure can be extremely serious in com-bination with a steam generator tube rupture, e.g., simultaneousblowdown of the primary and secondary systems outside of con-tainment.For the event in which the dead weight of the water or condensation-induced water hammer results in failure of the steamlinp hangers, thesteamline may sag and deflect resulting in excessive loads on compo-nents and possible maloperation or rupture. In general, a steamlinebreak at no load conditions results in a more severe reactivitytransient than when the reactor is at power due to the increasedsteam generator inventory. Steamline breaks are analyzed in theSARs. For some plants, the steamline break inside containmentis not the design basis accident for containment overpressurizationdesign. However, the increased steam generator inventory at overfillconditions may result in higher containment peak pressures and greaterreturn to power than that analyzed in the SAR.

-15 -Overfilling of the steam generator may also occur as a consequenceof a steam generator tube rupture accident. Operator interventionduring the course of events is necessary to ensure that the risingwater level due to the leakage of reactor coolant into the affectedsteam generator is terminated before it reaches the main steamline.The rate of level rise will be further increased in the steamgenerator after reactor trip due to a reduction of steam flow.In some plants, the operator is responsible for regulating thefeedwater flow to the affected steam generator, reducing the steampressure below the set point of the safety relief valves, andisolating the steam generator to minimize radiation releases to theatmosphere. Failure of the operator to take correct action in thecorrect sequence or an equipment failure could result in the overfillof the steam generator, inadvertant closure of the MSIVs and openingof the safety or relief valves. The steam generator tube ruptureaccident then evolves into a more serious loss of coolant accidentoutside of primary containment.An excessive feedwater transient when the reactor is just criticaland at no load appears to result in a more severe overcooling transientwith a larger reactivity feedback to the primary system than whenthe reactor is at full power. Steam generator overfill occurringduring power escalation and increasing load appears more probable atthis time since the feedwater is usually in manual control. Theseverity and rapidity of the transient will vary depending on core

-16 -life and core heat/feedwater flow mismatch. The primary systemtransient may mask the symptoms of continued feedwater flow anddelay termination of the secondary side transient resulting inaccumulation of water in the steamlines.Main steamlines that have "U" bends that can fill with water ormain steamlines that can remain partially filled following a steamgenerator overfill event have a potential for rupture due to the forcesgenerated by the acceleration of the trapped water in the piping.This acceleration can be caused by the opening of atmosphericdump valves, turbine byDass valves, turbine-driven feed pump steamadmission valves, drain valves or lifting of secondary safetyvalves. Following the termination of the steam generator overfill,some of these valves most likely will be opened by the plant operatorto maintain the plant in a hot shutdown condition or to cooldownthe plant. If the operator is unaware that water has accumulatedin the main steamline, he could initiate a main steamlinerunture or cause severe damage to the auxiliary feedwater pump turbineby opening valves that are normally used to control and stabilizethe plant following a reactor trip. If the steam system isrepressurizing, the operator will not be able to intercept safety orrelief valve openings which could cause similar damage.In summary, overfilling the steam generator can be the initiator orthe consequence of another transient resulting in a combination ofconcurrent transients/accidents. These include a primary overcooling

-17 -transient, reactivity transient, a steamline break accident, steamgenerator tube rupture(s), and loss of the steam generators as a heatsink. The accident scenario can also include additional cascadingevents considering a sinqle failure and/or a seismic event concurrentwith the overfill transient.

-18 -4.0 APPLICABILITY OF THE SINGLE FAILURE CRITERIONA large portion of the defense-in-depth available at nuclear powerplants to mitigate the consequences of accidents or transients isachieved by redundancy. In PWRs, redundancy is generally achievedby designing each safety-related system such that it is comprised oftwo identical 100 percent capacity subsystems. Therefore, the failureof any active component will not disable a particular safety function.Systems whose function is not the Mitigation of accidents or transients,such as those provided solely for power generation, are not providedwith any degree of redundancy. Failure of any of these systems (e.g.,the turbine lube oil cooling system) while it could necessitate aplant shutdown, would not affect the health and safety of the public.In this category of systems provided for power generation is found thefeedwater control system. Failure of this system can result in a steamgenerator overfill as described previously. However, failure of thissystem also has broader implications; namely, how the failure of non-safety-related systems can affect a previously analysed accident ortransient. It has been generally assumed that during an accident, fail-ure of non-safety grade equipment will not adversely impact the plant.However, since non-safety grade equipment is not seismically orenvironmentally qualified, there is no basis to assume that it will notfail or that it will fail in a manner which does not adversely impactthe plant.

-19 -Since the nuclear steam supply system and all the emergency safetyfeatures are seismically and environmentally qualified, the occur-rence of a seismic event will not directly result in an accidentcaused by failure of these systems and features. There is, however,the, Dotential for overfilling one or more steam generators. Theseismic analysis of the main steamline does not assume the linesare filled with water. Therefore, main steamlines may not surviveseismic after-shocks following a seismically-induced steam generatoroverfill. A steamline break inside containment with an overfilledsteam generator would challenge the containment integrity and causea severe overcooling transient not previously analyzed.Usually, the Single Failure Criterion is applied only to safety-relatedsystems to assure redundancy and performance of their safety functions.It appears reasonable that the assumed single failure following aloss of coolant accident (e.g., steam generator tube rupture) couldbe in the feedwater control system causing a steam generator overfill.The resulting event, which has not been analyzed in the SARs, maylead to a combined blowdown of primary and secondary systems asdiscussed in Section 5 of this report.

-20 -5.0 COMBINED PRIMARY AND SECONDARY SIDE BLOWDOWNThe combined primary and secondary side blowdown can be postulatedI/to occur by a number of different scenarios. One of thescenarios that has been addressed already in this report is possible-only for B&W plants because of their OTSG. This scenario starts withthe postulation of a failure in the feedwater control system that resultsin a steam generator overfill. The overfill may cause a rupture ofdefective steam generator tubes due to the differential thermal gradientsexisting between the steam generator shell and the tubes in the overfilledcondition. Another consequence of the overfill (or a postulated singlefailure) could be a stuck open secondary safety valve or a steamlinebreak. The combination of these two events resulting from a singleinitiating event could result in a LOCA outside containment.For PWRs whose high pressure injection (HPI) pumps have a shutoff headabove the PORV setpoint another scenario could be postulated as aresult of a steam generator overfill that could lead to a combinedprimary and secondary side blowdown. In this scenario, the steamgenerator overfill is postulated to cause the blowdown of a steamgenerator from the overfilled condition either through a steamlinebreak or stuck open secondary safety valve. This overcooling tran-sient, imposed on the primary system as a result of the steamgenerator blowdown, may cause the primary system pressure todecrease to a level where HPI is automatically initiated.

I .-21 -The termination of HPI relies on operator action, and while sufficienttime exists for the operator to terminate lIPI, his failure to do socould result in discharging water through the PnRYs possibly causingthem to stick open.The return to power caused by the feedback from the nenative moderatorcoefficient will also act to increase the pressurizer level. Thissituation could he further exacerbated if the operator trips the reactorcoolant pumps. This operator error may occur if the operator mistakesthe secondary side transient for a small break loss of coolant accident(SBLOCA). The response of the primary system to the SBLnCA is generallysimilar to that which could result from the postulated secondary sidetransient. The RCP trip, required by SRLOCA procedures, would resultin the loss of some heat removal capability from the primary systemthat could cause a faster rise in pressurizer level and primarysystem pressure imposing an additional challenge to the PORVs.The above scenarios were postulated assuming the steam generator overfillas the initiating event. Other scenarios for combined primary and secondaryside blowdown can be postulated if the steam generator overfill is assumedto be the single failure subsequent to the initiating event. An exampleof such an event would be a SBLOCA, caused by the failure of a RCP seal,for example. The usual analysis is done assuming the failure of the singlesafety-related component causing the most adverse effect. Typically, thiscomponent is a diesel generator. This postulated failure causes a lossof one train of safety equipment since offsite power is assumed to be

-22 -lost concurrent with the initiating event. If instead, the singlefailure chosen was a failure in the non-safety-related feedwaterregulating system causing a steam generator overfill, the result couldbe a combined primary and secondary side blowdown. This assumes thatthe steam generator overfill causes a secondary side leak.Another mechanism that can be postulated as a cause of combined primaryand secondary side blowdown could be a large steamline break causing thefailure of a small instrument line on the primary coolant system, such asthose used to measure steam generator differential pressure, resultingfrom direct or deflected high eneigy Jet impingement.Conversely, a primary line break inside the steam generator cubicle couldalso result in failures of level instrumentation lines on the shell sideof the steam generator due to direct or deflected jet impingement.The above scenarios are a few of the ways that a combined primary andsecondary side blowdown can be mechanistically postulated to occur.Although some are less probable than others; namely, those resultingfrom pipe breaks, it is the view of AEOD that the simultaneous primaryand secondary side blowdown is a credible event and should be analyzed.Operating procedures also need to be developed and operators need tobe trained to recognize and respond to this event. This is particularlyimportant since the effects of the secondary side blowdown may maskthe primary side blowdown, or vice versa, such that operators may not

-23 -immediately recognize the fact that a combined blowdown is in progress.This may result in operators unknowingly taking improper actions intheir attempts to mitigate the event and stabilize the plant. Beforeoperating procedures can be developed, however, guidelines need tobe established for the analysis of the event and the analysis mustbe completed. With this in hand, the response of the primary and secondarysystem can be defined in sufficient detail to allow immediate operatorrecognition of the event and to develop the proper sequence of remedialactions that the operator must take to bring the plant to a safelyshutdown condition. The response of the primary and secondary sideto the combined blowdown can also be Programmed into the simulatorsto facilitate operator training.

-24 -6.0 AEOD RECOMMENDATIONSPrior operational experiences have challenged the steam generator levelinstrumentation and feedwater control systems resulting in safety-relatedimplications of unanalyzed steam generator transients and accidents. Thelack of safety grade equipment to either prevent or mitigate steamgenerator overfill and the potential seriousness of the consequentialevent have prompted AEOD to recommend that the event be considered as an2,3,4/Unresolved Safety Issue.NRR has agreed that steam generator and reactor overfill transients warrant5/treatment as an Unresolved Safety Issue. However, consideration ofcombined blowdown of the primary and secondary systems was not includedin their Unresolved Safety Issue based on overall low probability ofthe event and credit for operator actions. AEOD maintains the positionthat until analyses of the event are performed and evaluated for safetysignificance, the event should be either categorized as a separateUnresolved Safety Issue or included as a part of an existing UnresolvedSafety Issue or considered a potential Unresolved Safety Issue pendinganalytical results. AEOD believes the analyses are required to ascertainsystem response before operator actions and procedures can be evaluatedand appropriate training provided.AEOD is holding in abeyance a final recommendation concerning thecategorization of this issue pending the completion of a prompt scopingstudy of the problem and the results of an analytical study of arepresentative plant. The analyses should include the potential

-25 -for and system response to combined blowdown of the primary and secondarysystems as a result of various consequential combinations of steamgenerator overfill, steam generator tube rupture, and primary or secondaryside leaks.In the interim until procedure revisions based upon analytical resultscan be considered, an audit should be conducted to determine whetheroperators are even aware of such potentially serious situations as steamgenerator overfill, initiating operation of steam systems having wateraccumulation, or combined blowdown of the primary and secondary systemsfrom whatever cause. Should an audit uncover that such subjects are notcovered in training programs nor in procedures, and thus, in general,operators have no awareness or background on such situations, then AEODwould recommend that consideration should be given to initiation ofinterim actions to develop at least an awareness that these situationsare possible.

-26 -I II.REFERENCES1. Letter from C. Michelson, ACRS Consultant,Dr. M. Plesset dated June 28, 1979.2. Memo from C. Michelson, Director, AEOD, todated August 4, 1980.to Dr. D. Okrent andChairman Ahearne3. Commission Meetinq of October 16, 1980 concerning Unresolved SafetyIssues.4. Commission Meeting of November 10, 1980 concerning ATWS.5. Memorandum from H. Denton, NRR, to Commissioners, NRC, NInclusion ofSteam Generator transients as an Unresolved Safety Issue (Addendum toSECY-80-325)," dated November 7, 1980.