The turbine-driven auxiliary feedwater pump is very important to the overall safety of a nuclear plant. Michael Powell, Jeff Taylor and Matt Wilcox explain how plants can recover if the pump fails to start at the beginning of a station blackout event.

main

The turbine-driven auxiliary feedwater (TDAFW) pump provides a critical safety function for most pressurised water reactors (PWRs) at the onset of an extended loss of all AC power (ELAP) or a station blackout. If all other auxiliary feedwater (AFW) pumps are unavailable due to the loss of electrical power, the steam- driven TDAFW pump injects water into the steam generators and maintains a heat sink to remove decay heat from the reactor core.

On 23 December 2014 the US Nuclear Regulatory Commission (NRC) submitted a proposed generic issue on the TDAFW control system (ADAMS Accession No.: ML14353A092, ‘Initial Screening Results for GI-016, Proposed Generic Issue on the Potential Loss of Turbine Driven Pumps due to Dependence on Electric Power’). This says: "In the event the governor loses its supply of electric power, the steam driven pump would cease to provide its safety function, leaving the reactor core without an adequate heat removal mechanism" during a loss of AC power event. With potentially limited staffing availability, uncertainty in site conditions and overall uncertainty of the event, it could be challenging for utilities to cope with a loss of TDAFW early in the ELAP event.

The Nuclear Energy Institute (NEI), also recognises the importance of the TDAFW pump: "The risk of core damage due to ELAP can be significantly reduced by assuring the availability of [AFW], particularly in the first 30 minutes to one hour of the event." (NEI 12-06 Rev. 0, ‘Diverse and Flexible Coping Strategies (FLEX) Implementation Guide’)

Most PWRs have a TDAFW pump, although a few rely on a standalone, diesel-driven auxiliary feedwater pump to provide the same safety function. The plants credit the TDAFW pump for the initial coping phase of an ELAP, during which it maintains a heat sink to dissipate decay heat from the reactor core.

As the event moves into the second phase of the ELAP (coping through portable equipment), plant staff will align a portable pump that is capable of injecting into the steam generators, essentially providing redundancy for the safety function of the TDAFW pump. All US utilities have conducted staffing studies that consider the potential for limited staff availability and uncertainties at the site. Through these staffing studies, utilities have established typical coping times to begin installing portable equipment to be within a six- to eight-hour time frame following event initiation. This coping time range is supported by both an analytical basis and a detailed staffing study, and has been audited and accepted by the US NRC as part of verifying compliance with the Mitigating Strategies Order (EA-12-049).

The key assumption in this six- to eight- hour coping time frame is that the TDAFW pump starts and operates during the event. If the TDAFW pump fails to start at the beginning of an ELAP event and there is a loss of feedwater, thermal-hydraulic analyses show that the steam generators will boil dry and the core could uncover in two hours or less (timing is highly dependent on reactor design).

Outside the US, approaches have been developed for the potential loss of the TDAFW pump. Most of these approaches use hardware solutions, where an alternate means of injecting into the steam generators is placed in a hardened, protected building, or additional redundancy is added via a new diesel- or steam-driven pump.

At least one country has evaluated and demonstrated a success path for using mobile equipment following a loss of feedwater to the steam generators at one hour into the event. This approach relies on a focused effort to completely depressurise the steam generators and then supply water to them directly from a fire truck.

The PWR Owners Group (PWROG) analysed the option of completely depressurising the steam generators as a sensitivity case (part of thermal-hydraulic analyses the group conducted to support implementation of NEI 12-06, above). The PWROG analysis showed that if the steam generators were empty, depressurisation would occur quickly and a low-pressure feedwater source, such as from the accumulator, would be able to inject to the steam generators.

Building on this case, Westinghouse performed additional analyses to answer the questions:

  • Does the timing of depressurising the steam generators affect how the accident progresses? (For example, would an early depressurisation gain any benefit from accumulator injection, or pose potential negative consequences?)
  • Would operating pressuriser relief valves (primary power-operated relief valves) help bring down primary pressure and allow for accumulator injection?
  • Is there an impact from depressurising a single steam generator and then feeding it, versus performing the same with all steam generators?
  • How much time does the plant operations’ staff have to hook up a low-pressure pump to prevent uncovering the core?
  • Are there any limitations to the low- pressure injection flow rate or head?

These questions were answered by using the Combustion Engineering Nuclear Transient Simulation (CENTS) computer code with a plant model representative of a Combustion Engineering PWR with a large, dry containment. The CENTS computer code has been endorsed by the US NRC to perform ELAP analyses up to the transition from two-phase natural circulation flow to reflux cooling in the reactor coolant system.

Base case without recovery actions

Westinghouse performed a base case, assuming no actions during an ELAP with a loss of feedwater, to determine how long it takes for the core to uncover. The results were used to evaluate the success of follow-on actions, including their timing and whether or not the approach is reasonable. The base case confirmed that in an ELAP with a loss of feedwater at the start of the event, the steam generators dry out in around 50 minutes and the core uncovers just before two hours.

The analysis demonstrates that correct timing is essential for recovering feedwater to prevent fuel damage in this case, so it shows that recovering feedwater should be the main focus of the operator. But this is not the direction that the current Emergency Response Guidelines and FLEX Support Guidelines first steer operators towards. They initially assume that the problem is with the water source rather than the pump, and direct operators to align to alternate suction. Later in the procedure the operator is directed to again check the steam generator water level and flow, and if the flow is not adequate, to establish a low-pressure feedwater source. This later step also directs operators to depressurise the steam generators to below the shutoff head pressure of the source.

In current procedures, operators may take actions such as trying to restore power, beginning DC load shedding, performing initial plant assessments and beginning to stage all of the portable equipment, before executing the alternate steam generator feed strategy. While the procedures would eventually steer operators to depressurise the steam generators and feed them with a low-pressure water source, by the time the operators mobilise and deploy the pump it could be too late to prevent fuel damage.

Base case with recovery actions

Westinghouse then ran the same base case but modelled two key recovery actions: beginning at 10 minutes into the event, completely depressurising both steam generators at maximum rate; and starting at one hour into the event, restoring injection into one steam generator using a fire truck. This analysis showed that the steam generator injection flow was adequate to remove decay heat and cool the primary system. In fact, the steam generator filled and the flow eventually had to be throttled. The heat sink was restored in enough time to avoid activating the pressuriser safety valves, thereby conserving primary system inventory.

This case confirms that with a rapid steam generator depressurisation and injection from a low-pressure water source, the plant will be able to cope even if all feedwater is lost at the beginning of the event. However, the plant staff must ensure that the two critical actions – steam generator depressurisation and mobilisation of a low-pressure feed source – can be accomplished in a short period of time.

Sensitivity cases

Westinghouse then ran several sensitivity cases to determine the impact of steam generator depressurisation and low-flow injection timing on the overall ability to cope with the ELAP and loss of feedwater.

  • Sensitivity Case 1: steam generators were not depressurised until they were depleted of water inventory. In this sensitivity case, the primary temperature and pressure remained at no-load and saturated conditions and the steam generators took longer to dry out. In the base case, the rapid depressurisation resulted in heat removal from the primary system and in lower primary system temperatures and pressures. Once the steam generators emptied, temperature and pressure increased as the primary system absorbed the decay heat. In both this case and the base case, the core uncovers at roughly the same time; therefore, it was determined that there is no specific advantage to depressurising the steam generators early in the event.
  • Sensitivity Case 2: a smaller auxiliary steam generator feed pump with a flow of approximately 100 gallons per minute (6.3l/s) was modelled. This showed that while the onset of core uncovery was delayed, the core did eventually uncover; therefore, this approach does not increase in water inventory enough to absorb the decay heat. Based on this case, the auxiliary steam generator feed pump must be sized to remove, at a minimum, the
    decay heat generated by the core.
  • Sensitivity Case 3: the use of pressuriser power-operated relief valves to further reduce reactor coolant system pressure and to possibly achieve accumulator injection was evaluated. Power-operated relief valves would have little effect on pressure since the reactor coolant system is saturated,
    and in fact, reducing reactor coolant system pressure with power-operated relief valves would result in unnecessary inventory loss from the primary system. Therefore,it is recommended that additional reactor coolant system depressurisation is not initiated.
  • Sensitivity Case 4: loss of feedwater occurred at 30 minutes into the event. As expected, the longer the turbine-driven auxiliary feedwater pump operates, the lower the core will be on the decay heat curve and, subsequently, the more time the operators will have to execute this strategy.

Note that in the base case it was assumed that both steam generators were depressurised, but only one steam generator would be fed from the low-pressure water source.The operators could select to depressurise only one steam generator due to staffing limitations. While a specific case was not run to model depressurising only one steam generator, it would be similar to Sensitivity Case 1, where neither steam generator was depressurised until they emptied. Once both steam generators were empty, feeding only one steam generator was adequate and both loops cooled down due to natural circulation (the loop with the steam generator being fed led the cooldown of the other loop).

In summary, between the base cases and sensitivity cases that were run, it was confirmed that operators can be successful in recovering from a ELAP/LOFW at most plants if plant personnel are able to install a portable feedwater source within approximately one hour of the initiation of the loss of feedwater event (operators may have more time, depending on decay heat production at the time), and then depressurise the steam generator rapidly to allow the portable feedwater source to inject. The auxiliary portable feed pump must be sized to provide a flow rate high enough to remove the decay heat being generated by the core.

Strategy implementation

These analyses demonstrate that by using FLEX equipment and connections, plant staff can prevent core uncovery for a loss of feedwater event, even if it happens at the time of reactor trip. The analyses also demonstrate that time is of the essence for this event, and that the plant staff must be focused on connecting equipment rapidly and quickly depressurising the steam generators. To implement this strategy on a plant- specific basis, there are items that need to be addressed, including:

  • Plant staff must be able to quickly deploy and connect a low-pressure, moderate-flow pump. Other alternatives could be credited such as a pre-staged, passively driven pump (for example, an air-driven pump). Such pumps exist but do not generate high-discharge head, so steam generator depressurisation would be critical.
  • The plant must have the capability to depressurise the secondary side with minimal operators, preferably using DC power from the control room.
  • The plant must ensure that nitrogen from the accumulator or safety injection tank does not inject into the primary system and affect natural circulation
  • (in the analysis conducted, this did not occur because the reactor coolant system remained relatively full).
  • A modification to the current FLEX Support Guidelines to address this targeted recovery strategy for a symptom-based loss of feedwater event must be made.
  • A potential modification to the emergency operating procedures to address this targeted recovery strategy for a general loss of feedwater event, not just an LOFW with ELAP, may need to be made.
  • If the steam generators are fed with cold water after they heat up, an analysis of steam generator integrity may need to be conducted.
  • Reactor coolant pump seal integrity may need to be reviewed if the portable pump is not deployed before the steam generator dries out and the reactor coolant system heats up.

Conclusions

The TDAFW pump has been shown to be very important to the overall safety of the plant, and this is borne out by probabilistic risk assessment, where availability of the TDAFW pump significantly affects core damage frequencies. In fact, at one plant, the core damage frequency increases by a factor of 15 when the TDAFW pump is out of service. Current control system issues have elevated the TDAFW pump to the NRC Generic Issues programme.

The implementation of FLEX assumed that a TDAFW pump would be operating at the beginning of the event. If the TDAFW pump does not start at the beginning of an ELAP event, there is a success path that has been demonstrated through an analytical basis to completely depressurise at least one steam generator and then inject flow at a flow rate that at least matches decay heat, using the FLEX connections and equipment that already exist. Since time is of the essence for this strategy to be successful, there would need to be some modifications to existing EOPs and even FSGs to implement it. With these few modifications, a significant safety enhancement can be made at the plant and a significant reduction in the plant’s core damage frequency.

About the authors

Michael Powell, Director Fukushima Initiatives, Arizona Public Service
Jeff Taylor, Product Manager, Westinghouse Electric Company
Matt Wilcox, Senior Engineer, Westinghouse Electric Company