ML15245A157
| ML15245A157 | |
| Person / Time | |
|---|---|
| Site: | Oconee, Bellefonte  |
| Issue date: | 10/25/1979 |
| From: | Harold Denton Office of Nuclear Reactor Regulation |
| To: | Parris H TENNESSEE VALLEY AUTHORITY |
| Shared Package | |
| ML15245A156 | List: |
| References | |
| NUDOCS 7911290081 | |
| Download: ML15245A157 (16) | |
Text
RE(11 C
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 October 25, 1979 Docket No.:
50-438 and 50-439 Mr. H. G. Parris Manager of Power Tennessee Valley Authority.
500 Chestnut.Street, Tower II Chattanooga, Tennessee 37401 Dear Mr.
Parris:
SUBJECT:
10 CFR 50.54 REQUEST REGARDING THE DESIGN ADEQUACY OF BABCOCK
& WILCOX NUCLEAR STEAM SUPPLY SYSTEMS UTILIZING ONCE THROUGH STEAM GENERATORS (BELLEFONTE NUCLEAR PLANT)
Several hardware and procedural changes have been made to operating B&W plants to reduce the likelihood of recurrence of a TMI-type accid-nt. These changes have been in the area of auxiliary feedwater systems, integrated control system, reactor protection system, small-break loss-of-coolant accident analysis and operator training and procedures.
However, at this time, we are beginning to look more deeply into additional design features of B&W plants to consider if any further system modifications are necessary.
The use of once-through-steam-generators (OTSG) in B&W plants has an opera tional advantage in that it provides a small degree of steam superheat, as contrasted with the conventional saturated U-tube steam generator.
In addition, it provides for less water inventory thus making a steam line break less severe. However, the relatively low water inventory with.
the.presence of a liquid-vapor heat transfer interface in the active heat transfer zone closely couples the primary system to the steam generator conditions with a consequently high sensitivity.to feedwater-flow rate perturbations. Enclosure 1 to this letter addresses system problems and staff concerns in this area.
At present, we are investigating whether B&W plants are overlysensitive to feedwater transients, due to the OTSG concept, as coupled with the pressurizer sizing, ICS design, and PORV/reactor trip set points.
As part of the post TMI-2 effort, detailed analyses have been made of under cooling transients for B&W plants.
However, due to the sensitivity of the OTSG design, B&W plants have also been experiencing a number of relatively severe overcooling events.
7911290
Mr. H. G. Parris
- 2 For your information, NRC is initiating a researchi task to quantitatively assess B&W system designs, including the integrated control system, aimed at identifying obvious accident sequences leading to core dbmage having a high frequency as compared to the Reactor Safety Study, see Enclosure 2.
(A complete determination of risk will not be attempted). The objective of this assessment is to identify high-risk accident sequences (including TMI implications) utilizing event tree and simplified fault tree analyses.
Included will be estimation of release categories, approximate quantifi cation of expected frequency of selected event sequences and sensitivity studies for reliability of operator response. The study will focus on the risk implications of the sensitivity of the B&W design and on the potential interactions arising from the integrated -control system. We estimate this study sto be completed in about six months. We will use the Crystal River, Unit 3 plant as the referenced facility to be analyzed.
We have been holding generic discussions with Babcock and Wilcox Company.
concerning this matter. However, system sensitivity to feedwater transients involves balance-of-plant equipment and systems as well as the nuclear steam supply system, and such plant-specific characteristics must be considered.
We are also considering whether it is necessary to halt portions of the construction of B&W plants, pending the outcome of the reliability assess ment. As a preliminary consideration, we have identified those systems and componentsthat may be impacted by possible designichanges as a result of this study. Enclosure 3 is a prelimi'nary listing of such systems and components.
Under the authority of Section 182 of the Atomic Energy Act of 1954, as amended, and Section 50.54(f) of 10 CFR Part 50, additional information is requested to allow us to determine whether it is necessary to halt all or portions of the construction of your plant pending the results of our study. We request you provide:
a) Identify the most severe overcooling events (considering both anti cipated transients and accidents) which could occur at your facility.
These should be the events which causes the greatest inventory shrinkage. Under the guidelines that no operator action occurs before 10 minutes, and only safety systems can be used to 'mitigate the event, each licensee should show that the core remains adequately cool ed.
b) Identify whether action of the ECCS or RPS (or operator action) is necessary to protect the core following the most severe over cooling transient.identified. If these systems are required, you should show that its design criterion for the number of actuation cycles is adequate, considering arrival rates for excessive cooling transients.
Mr. H. G. Parris
- 3 c) Provide a schedule of completion of installation of the identified systems and components.
d) Identify the feasibility of halting installation of these systems and components as compared to the feasibility of completing installation and then effecting significant changes in these systems and components.
e) Comment on the OTSG sensitivity to feedwater transients.
f) Provide recommendations on hardware and procedural changes related to the need for and methods for damping primary system sensitivity to perturbations in the OTSG, Include details on any design adequacy studies you have done or have in progress.
We are sending similar letters to all utilities holding construction permits for plants with B&W nuclear steam supply systems.
We request your reply by December 3, 1979. We believe that a meeting with you and the other utilities together with the staff and the Babcock and Wilcox Company to discuss this matter would be beneficial to allparties.
At that time, we will provide further details on the Crystal River Study.
We are scheduling such a meeting for November 6, 1979 at 10:00 a.m. in Room P-422 at our offices in Bethesda, 7920 Norfolk Avenue, Bethesda, Maryland.
Please call Dr. Anthony Bournia at (301) 492-7200 if you have any questions concerning this letter.
Sincerely, Harold R. Denton, Director Office of Nuclear Reactor Regulation
Enclosures:
As stated cc:
See next page
Mr. H. G. Parris cc:
Herbert S. Sanger, Jr., Esq.
General Counsel Tennessee Valley Authority 400 Commerce Avenue, El1B33 Knoxville, Tennessee 37902 Mr. E. G. Beasley Tennessee Valley Authority 400 Commerce Avenue, W10C131C Knoxville, Tennessee 37902 Mr. D. Terrill Licensing Engineer Tennessee Valley Authority 400 Chestnut Street Tower - I Chattanooga, Tennessee 37401 Mr. Dennis Renner Babcock & Wilcox Company P. 0.'Box 1260 Lynchburg, Virginia 24505 Mr. Robert B. Borsum Babcock & Wilcox Company Suite 420 7735 Old Georgetown Road
- Bethesda, Maryland 20014
.Primary System Perturbations Induced by Once Through Steam Generator I. Introduction B&' plants employ a once through st. m generator (OTSG) design, rather, than U-tube sleam generators which are used in other pressurized water reactors. Lach steam generator has approximately 15,000 vertical straight tubes, with the primary coolant entering the top at 603-608 F and exiting the bottom at about 555 0F. Primary coolant flows down inside the steam generator tubes, while the secondary coolant flows up from the bottom on the shell side of the OTSG. The secondary coolant turns to. stean about half way up, with the remaining length of the steam generatcr being used to superheat the steam.
The secondary-side heat transfer coefficient, in the stear spate of the OTSG, is much less than that in the bottom liquid section. Tris results in a heat transfer rate from the primarysystem which is quite sensitive to the liquid level in the steam generators.
If a feedwater increase event o:curs, the liquid-vapor interface rises, increasing the overall heat transfer. This decreases the outlet temperature below 5550F and initiaies an overcooling event, which can lead to primary system depressurization.
By contrast, if a feedwater decrease event occurs, the-overall heat transfer decreases, the outlet primary temperature increases, and a pressurization transient ensues.
In either of these cases, the response of tne primary system pressure and pressurizer level to a change in main feed ater flow rate (or temperature) is comparatively rapid. These rapic primary syster. pressure changes due to chances in feedwater conditions is known herein as system "sensitivity" and is
unique to the B&W OTSG design.
Following the incident at Three Mile Island, various actions were taken to increase the reliability of the auxil'ary feedwater systems and improve plant transient response. System modifications to increase the reliability of the AF may have resulted in more frequent AFW initiation. However, use of AFW results in introduction of cold (100 F vs. 4000F) feedwater into the more sensitive upper section of the steam generators. This may act to enhance system sensitivity.
Further system modifications -provide control-grade reactor trips based on secondary system malfunctions, such as turbine or feedwater pump trip. While these reactor trips do serve to reduce undercooling feedwater transients by reducing reactor power promptly following LOMFW, they may amplify subsequent overcooling.
A reexamination was made of small break and loss of feedwater events for B&W plants. This resulted in a modificaiion of operator procedures for dealing with a small break, which include prompt RCP trip and raising the water level in the steam generators to (95') to promote natural circulation. Both these actions are taken when a prescribed low pressure set point is reached in the reactor coolant system and for anticipated transients such as loss of feedwater these actions may amplify undesirable primary system responses.
In addition to the post-TMI changes discussed above, actions were also taken to reduce the challenges to the power operated relief valve (PORV) by raising the PORV set point and lowering the high pressure reactor trip. While these actions have been successful in reducing the frequency of PORY operation, they
have resulted in an increasd number of reactor trips. This occurs because the reactor will'now trip for transients it previously would have ridden through by ICS and PORV cperation.
The staff is concerned by the inherent responsiveness of B&W OTSG design. While some specific instances are presented in the next section of this paper, the staff concerns are also of a general nature. It is felt that good design practice and maintenance of the defense-in-depth concept, requires a stable well-be~haved system. To a large part, meticulous operator attention and prompt manual action is used on these plants to compensate for the system sensitivity, rather than any inherent design features.
The staff believes that the general stability of the B& plant control systems should be improved, and that plant response to OTSG feedwater perturbations be dampened.
II.
Recent Feedwater Transients On August 23, 1979 the staff met with the B&W licensees to discuss recent feedwater transients. One aspect which is of interest is the relationship of the operator.to the functioning of the main feedwater system. In at least one instance an operator manually opened -a block valve in series with a control valve (partly open but thought to be closed). This resulted in an overfeed condition.
In several recent events the feed flow was reduced to the point where the reactor tripped on high pressure. Subsequent overfeed reduced pressure to below 1600 psi, where HPI was initiated, reactor coolant pumps tripped, and auxiliary feedwater flow introduced into the top of the steam generators, which increased the severity of the cooldown transient.
It appears that in many cases the main feedwater control system does not react quickly enough or is not sufficiently stable to meet feedwater requirements.
Rather, the system will often oscillate from underfeedcto overfeed conditions, causing a reactor trip and sometimes a high pressure injection initiation. One undesirable element of this lack of stability is that overcooling transients on the primary side proceed very much like a small break LOCA (decrease in pressurizer level and pressure).
Thus, for a certain period of time the operators may not know whether they are having a LOCA or an overcooling event.
The same type of behavior can be initiated by the normal reactor control system. This was 'demonstrated by a December 1978 event at Oconee, where failure of a control*
grade T recorder led to reactor trip, a feedwater transie-t, and ESF actuation.
A partial list of recent B&W transients and their effects is contained in the Appendix to this report.
Role of the Pressurizer Level Indicator A major area of concern arising from the B&W OTSG sensitivity, is the response of pressurizer level indication.
Several B&W feedwater transients have led to los of pressurizer level indication. Most notatble was a November 1977 incident at Davis Besse where level indication was lost for several minutes. The arrival rate for this event appears to be on.the order of.1-.2 per reactor year, but could be on the increase due to the potential for more reactor trips and feed water transients resulting from post-TMI-2 system modifications. This is of concern because an overcooling event could empty the pressurizer, thereby creating the potential for forming a steam bubble in the hot leg which may interrupt natural circulation, following RCP trip on low pressure.
The staff feels that the uncertainties associated with two phase natural circulation are somewhat high for an event with a recurrence interval of. a few years.
Additionally, the staff believes that good design practice and adherence to the defense-in-depth concept, would require that plant operators be aware of the reactor's status during expected transients. A Tow-level off-scale reading on pressurizer level makes it impossible for the operators to assess system inventory and more difficult to differentiate between an accident and an excessive cooldown transient.
The staff feels that the frequency with which this situation occurs is undesirable.
Some concerns also exist with regard to the operation of the pressurizer heaters when loss of level takes place. Nonsafety grade control circuitry trips the heaters off when pressurizer level is low. If these nonsafety grade cutoffs should fail, the heaters would be kept on while uncovered. This situation has the potential of overheating the pressurizer to the failure point, as happened
.with a test reactor at Idaho Falls.
IV.
Role of ICS-MFW The ICS appears to paly a significant role in the plant's feedwater response.
The staff is currently reviewing an FMEA study on the ICS. However, review of operating experience suggests that the ICS often is a contributor to feedwater transients. In some cases the ICS appeared inadequate to provide sufficient plant control and stability.
Some of the utility descriptions of feedwater transients (as summarized in the minutes of a meeting on August 23, 1979) emphasized the role of the operator in operating the MFW system.
The following sequence illustrates the type of event and system response which the staff feels could potentially occur.
- 1. Reactor at'100% power.
- 2. Reactor trip, from arbitrary cause (does not matter).
- 3. Plant stabilizes in hot shutdown, for a few minutes, heat rejection to condenser (and/or secondary dump valves).
- 4.
(not uncommon to B&WPcauses overcooling; pressurizer level shrinks, pressure reaches.160 psi, RS actuates; RCP tripped; AFW on. (Possible RCP seal failure).
- 5. Operator manually controls AFW (possibly MFW instead or in addition, if MFW n'c-isolated such that OTSG level comes up to 951 of operating range.
This massive addition of cold water may lead to emptying of pressurizer and interruption of natural circulation (or, the hot leg may flash due to depressurization and interrupt natural circulation even if pressurizer does not empty).
- 6. HPI delivers cold water; no heat transfer-in OTSG; vapor from core leads to system repressurization; steam may condense or PORV may lift.
- 7. No pump restart criteria available, circulation may not be reestablished.
It appears that an upgraded safety quality ICS, which is designed to balance power to OTSG level in a better fashion, could reduce the sensitivity, illustrated in the above sequence.
Role of ECCS and Auxiliary Feedwater it is known that some feedwater transients result in overcooling to the extent that the HPI actuation setpoint is reached. Traditionally, the operator isolates letdown and turns on an extra makeup pump following trip so as to avert this actuation. If this manual action is not performed quickly enough, or if the cooldown transient is too 'severe, the HPI set point will be reached and the pump
-automatically started. Following procedures, the operator would then trip all ma coolant pumps and utilize recovery procedures based on the plant symptoms. If the incident was actually a feedwater event and not a small LOCA, he would then presumably go to the loss of forced circulation procedures. When pressure has recovered such that the coolant system has become S00F subcooled, the operator can secure HPI. One problem is the difficulty in differentiating between a smal
break LOCA and an.excessive feedwater transient. The operator would be forced to assume a small LOCA until proven otherwise. However, following the small break procedures and introducing cold auxiliary feedwater, may increase the severity of an overcooling event. Initiation of AFW and delivery to the OSTG, especially if accompanied by filling to the high level required by new pro cedures (950) will continue the cooldown and depressurization. Thus, the AF system acts to increase the responsiveness of the reactor to feedwater transients where excessive cooldown is occurring.
VI, Conclusions The staff believes that the current B&W plants are overly responsive to feedwater transients because of the OTSG design, pressurizer sizing and PORY and high pressure trip set point. Some of the sensitivity also arises from inadequacies in the ICS to deal with expected plant perurbatiors.
Regardless of the reasons, B&W plants are currently experiencing a number of feedwater transients which the staff feels are undesirable. The staff believes that modifications should be considered to reduce the plant sensitivity to these events and thereby improve the defense-in-depth which will enhance the safety of the plant.
SUMMARY
FACILITY TRANSIENT DATE DESCRIPTION CR-3 8/16/79 (0259 Reactor Trip on High-P ressure -4 to 3 RCP. A-S/G underfed -72% Pwi 8/16/1 (1125)
Reactor Trip-on High Pressure -3 RCP -A-SIG underfed
-45%
Pwr.
8/17/79 (0706)
Reactor Trip on High Pressure -.3 RCP -A-S/G underfed -48%Pwr.
8/11/19 (1825)
Reactor Trip on Hfigh Pressure -3 RCP
-A S/G underfed -26%
Pwr.
8/02/79 (0202)
Reactor Trip on Low-Low Level in both S/G -.
10% Pwr.
AtIO-1 8/13/79 (1149)
-Antic.
Trip did notwork
-Rx Trip on HI Press - 15 Oconee-1 6/11/19 (0333)
Reactor Trip on Anti. Trip (tofu) 99% Pwr.
6/11/79 (0752)
Reactor Manually Tripped when FWPT "1" Tripped Oconee-2 5/07/79 (0346)
Reactor Trip on High Pressure feedwater oscillations 18% Pwr.
6/03/79 (2046)
Reactor Trip on High Pressure feedwater oscillations 30% Pwr.
Rancho Seco 7/12/79 (1714)
Reactor Trip on Antic. Trip (tOFW) 100% Pwr.
DDavis-Besse NONE
ENCLOSURE IREP.
INITIAL PLANT STUDY We have attempted to develop a general framework for the conduct of a limited risk assessment of.a B&W reactor aimed at identifying any unique risk-impacting sequences relative to the Reactor Safety Study.
An absolute determination of risk isnot intended. We have selected Crystal River 3, a plant owned and operated by Florida Power Corporation, for a nalysis. The architect-engineer for this Babcock and Wilcox reactor was Gilbert Associates. It began commercial operation in March 1977.
The project, as presented in Figure 1, will require the following tasks:
1.A survey of the LER files as now established in ORNL and AO reports, as well as the Sandia and Fluor-Zion systems interactions studies to identify interactions and coamon mode failures which have occurred in similar plants.
This surveyshould parallel construction of syster logic models and event trees since it will ensure that actual experience is incorporated into the assessments performed.
- 2. Event trees for loss.-of-coolant accidents and transient conditions.
Specific attention will be given to more frequent LOCAs and these will include a feed watte hich t
o rporates experience at B&W plants and will wtr transient tree which incorprtsepswl e
ie oadudr explore the post-TMI modifications.
Emphasis will be given toward under standing the human coupling interaction between systems at the event tree sequence level.
.3. Fault trees for the key systems identified in the event trees. They will be constructed to the component level and will include control, actuation, and electric power considerations.
Hunan errors will bF included as well as the ability of the operator to cope in the time span available. Our preliminary opinion is that simplified fault trees will be required for the following systems:
auxiliary feedwater and secondary steam relief, high pressure emergency core cooling in the injection and recirculation modes, low pressure emergency core cooling in both injection and recirculation modes, containment spray and containment heat removal systems and a limited studyof loss of AC power, considering the 480 and l160 busses and the edergefcy diesel genertors with limited analysis of high voltage switch yard faults. Separate fault trees will probably be required for ECCS and AFWS initiation logic and the system trees must include the contribution from auxiliary systems such as instrument air, ventilation, component cooling, etci, and controlinduced failures. Truncation of the fault trees will be permitted provided a written basis is provided. This basis will present the rationale why no coupling of cutsets or event sequences is expected from further development of the tree.
- 4.
An investigation of the adequacy of high pressure-low pressure interfaces.
Analysis of the physical phenomena associated with dominant sequences to obtain estimates of the ma seitude of releases fro e
tne containent. This will aid in categorizing releases irto apprzp-izte release categories.
To conduct a program of this magnitude in a short time period, delays assoc iated with acquiring and transferring information must be minimized.
Optimally, the event tree and fault tree analysts should share a common location during the initial portion of the project.
As the fault trees progress below the top logic, however, the analysts should be located at or near the site with immediate access to as-built drawings and procedures as well as a representative of the plant operations staff. This will permit verification of engineering and procedural details and will minimize information transfer and print re production. Access should also be arranged between the fault tree analysts at the site, the remaining team in Bethesda, the architect-engineer, and the vendor.
In addition to basic plant data, deterministic calculations may be required to understand the behavior of the plant under off-normal conditions. This may also involve real-time simulation at an appropriate simulator to the extent possible. The arrangements with the vendor should cover this possibility and it may be desirable to have confirmatory calculationsmade by one of the NRC contractors on a selected basis
FIGUIRE~ I ANALYSIS OF EVN TE ACCIDENT EVEN TRE PROCESSES CONSTRUCT IONASNED FAULTTREECATEGORIZATION LICENISING FAT -TR EETIOH TIFICATION F EV N RECOHMtEIIDATlOtiS CONSTUCTIO TRE EQENE DFTFAUItllI*C As NEFIWI,)
ANALYSIS OF SHAYR HIGH PRESSURE o Eu LOW PRESSURE fIT.
?4RR AND PEER REVIEW
ENCLOSURE 3 PRELIMINARY IDENTIFICATION OF SYSTEMS AND COMPONENTS THAT MAY BE IMPACTED BY DESIGN CHANGES HPI System EFW System DHR System CFT System RCS Pressure Control System Makeup/Letdown System SG Pressure Control System Steam Generator Pressurizer Quench Tank Control Room Layout RCS Piping