Abnormal transient operating procedures for
nuclear power plants
J. J. Kelly, Jr., Supervisory Engineer
Engineering Department
Nuclear Power Generation Division
Babcock & Wilcox Company
Lynchburg, Virginia
D. H. Williams
Special Products Coordinator
Arkansas Power & Light
Little Rock, Arkansas
PGTP 81-3 1
Presented to
American Power Conference
Chicago, Illinois
April 27-29, 1981
The aims, objectives and methodology involved in symptoms and immediate actions. If a loss of
producing abnormal transient operating procedures feedwater occurs, he is expected to recognize it,
for nuclear power plants were discussed in detail at perform the appropriate immediate actions, and
the American Power Conference in April, 1980.* then use the event-oriented loss-of-feedwater
Abnormal Transient Operating Guidelines now procedure for determining follow-up actions. This
exist in draft form for Arkansas Power and Light, approach has several inherent drawbacks:
and it is possible to detail a truly symptom-oriented 1. At time zero, the operator must correctly
approach to transient management. Using this diagnose the initiating event. He does this
approach, the operator does not have to mentally, based on training or prior experience.
immediately diagnose the initiating casualty and After taking several actions, depending on this
locate the event-specific procedure for that casualty. instant evaluation, he then refers to the event
Instead, the operator can pick up and use one oriented procedure that fits his diagnosis. If he
simple procedure for all transients starting with a were to treat a smair-team line break inside the
reactor trip. This paper describes the approach and reactor building, but actually had a small loss of
provides several examples of the simplified decision coolant accident (LOCA) inside the building, he
making process now available to the operator. Also would be tracking through the wrong procedure.
discussed is one possible approach to implementing He would eventually recognize this
these new guidelines into the existing procedure misinterpretation; however, by then he would be
structure. well into the transient and possibly confused.
Background 2. Procedures must be written to cover every
conceivable initiating event. If the operator
The traditional approach to transient and accident correctly diagnoses a loss of nonnuclear
control has been to develop many "emergency" instrumentation power and no procedure covers
procedures, each based on a postulated event such that event, his actions will be based only on
as loss of main feedwater. The operator is then experience.
required to study this event and memorize its 3. If more than one event contributes to the
*"Engineering basis for operator control of nuclear power transient, the operator will find himself working
stations in abnormal operations - closing the loop," two or more procedures at the same time. For
E. A. Womack, J. J. Kelly, and N. S. Elliott, American Power instance, if a main steam safety valve failed to
Conference, Chicago, Illinois, April 21-23, 1980 (Babcock reseat following the loss of main feedwater, the
Soperator would have to use the loss of feedwater
8'd111240566617
PDR ADOCK 05000269
P PDR
p e t g - o
procedure and small-steam-line-break procedure identify a transient. Similarly, some parameters
(if available). These procedures may conflict and were common to all transients. One event found
he would have to decide a priority between them throughout the study was a reactor trip.
- with no convenient method of shifting Consequently, it was used as the key for
between the two procedures. Writing a procedure entering the abnormal guidelines procedure.
to combine these two events is possible; 2. Event trees for various initiating events* and
however, if just a few more failures are consequential failures were developed. These
considered (e.g., the power-operated relief valve included various multiple failures (including
or spray valve remains open), the number of operator error), and therefore covered a large
combinations of failures, along with possible number of possible scenarios. Event trees were
initiating events, quickly increases. Even if studied to find repetitive patterns and common
writing the appropriate procedures was end points. The study showed that although
attempted, the operator's ability to pick the many failures can occur, the symptoms of
correct procedure would certainly diminish. unbalanced heat transfer that result from these
4. Because of these limitations, most operators are failures followed a few common patterns or
likely to use no specific procedure. They will use trends.
training, experience, intuition, etc., to bring the 3. Actual operating transients were investigated,
plant under control. They will then choose what again looking for patterns. This time the
they think is the closest procedure to what is emphasis was on parameter trends and the time
happening and confirm their actions or see if available for operator action.
they overlooked anything. 4. Where necessary, computer simulations were run
To correct these deficiencies, it is necessary to underting lansoe Becas th
step back from the traditional approach and
examine what the operator is attempting to do output was intended for use in developing
during reactor posttrip abnormal transient control. operating guidelines, realistic input was used (as
He can best protect the health and safety of the opposed to bounding safety analysis
public by guarding the integrity of the core. To do assumptions).
this he must ensure the continuous removal of This investigation's conclusion was that the
decay heat from the fission products to the ultimate operator can track the removal of decay heat from
heat sink. By adjusting the priorities and the core to the ultimate heat sink by monitoring
concentrating efforts on maintaining proper heat justCosqetli
a few symptoms awhich
ue
reflect
sth
thee "health"
o of
transfer along this path, he can protect the core and the thermodynamic process around the reactor
minimize radioactive release. To give the operator coolant system and its coupling to the secondary
this capability, a concept of symptom-oriented (as side.
opposed to event-oriented) procedures was
investigated. The symptoms are based on upsets in Symptoms identified
heat transfer from the core to the coolant and from
the coolant to the steam generators. The symptom- The three symptoms of primary interest to the
oriented procedures thus focus on core cooling first pressurized water reactor (PWR) operator are
and on event identification second. The result of adequate subcooling of the primary system
this investigation is the Abnormal Transient inventory, inadequate primary-to-secondary heat
Operating Guidelines (ATOG). transfer, and excessive primary-to-secondary heat
transfer. These symptoms are important for the
Expected plant response following reasons:
To produce a symptom-oriented procedure, B&W 1. Adequate primary inventory subcooling. If the
developed a thorough understanding of expected operator knows the primary fluid is in a liquid
plant responses during many varied abnormal state, he is assured that it is available and
transients. These transients included classic capable of removing heat from the core and
singular initiating events as well as additional transferring it to the steam generatbrs. If
single and multiple component failures. The subcooling is lost, these issues are in doubt, and
procedure was developed through the following he is therefore directed to make every effort to
steps (usually in parallel): regain subcooling.
1. Existing plant casualty procedures were *Included as initiating events were loss of main feedwater, loss
investigated for common symptoms. Few single of offsite power, excessive main feedwater, small steam line
alarms or parameters were found to uniquely break, and steam generator tube rupture.
2
2. Inadequate primary-to-secondary heat transfer.
This symptom addresses the heat transfer 2400 P
coupling across the steam generators. It
describes the ability of the system to keep the 2
flow of energy moving from the reactor coolant Subcooled
system to the ultimate heat sink. The operator Region
monitors the' relationship between the reactor 0 1600 S
coolant cold leg temperature and steam E S
generator secondary side saturation temperature. 1200 Limit
Following a reactor trip, these two values should
be nearly equal under good heat transfer . 800
conditions. If this coupling is broken, the Saturation
procedure outlines appropriate corrective actions Subcooled Margin
to restore it. - L0ne
3. Excessive primary-to-secondary heat transfer. In 400 450 550 600 650
this case, the symptom is indicative of a Reactor coolant and steam outlet temperature, F
secondary side malfunction (e.g., loss of steam
pressure control or steam generator overfill). The End Point - Post Trip with Forced Circulation (Thot and TCOId)
heat transfer is again unbalanced and the and for Natural Circulation (Tcold)
operator's attention is directed toward generic
actions to restore this balance.
By tracking these basic symptoms the operator End Point - Post Trip with Natural Circulation ('hot)
can quickly focus on problems without checking a Figure 1 Basic pressure-temperature (P-T) display
large number of parameters. At the same time, by ;
their nature the symptoms allow rapid elimination is also input. The saturation temperature for this
of problem sources and continue to emphasize core input pressure is displayed as a vertical line. The
protection. Additionally, the symptoms are so basic subcooled margin line accounts for potential
that the procedure inherently covers many more instrumentation inaccuracies with the objective of
initiating events than those first studied. This assuring subcooling above that line.
happens because initiating events cause equipment A typical plant response to a reactor trip is
to fail, and equipment failures affect these shown in Figure 2. For simplicity, only reactor
symptoms. As the operator follows the procedure to _
treat the symptom he will probably identify and c 2400
correct the cause. Path of
ATOG display
The information required to identify and track
these symptoms is already available in power plant 0 1600
E
control rooms. It simply consists of reactor coolant
system hot and cold leg temperatures, reactor 1200 Steam Pressure
coolant system pressure, steam generator pressure,
and access to steam tables. The problem is how 1 800 Steam Pressure
these variables can be best displayed to give the
operator a simple and logical method of monitoring
the symptoms of interest. The solution developed in .2 400
the ATOG is shown in Figure 1, which is basically
a pressure-temperature (P-T) display with a
saturation curve included. The area above and to Reactor coolant and steam outlet temperature, F
the left of this curve is the subcooled region. The Figure 2 Typical posttrip response
area below and to the right is the superheated coolant hot leg temperature is plotted. With the
region. Reactor coolant system hot leg temperature reactor coolant pumps running (forced circulation)
(That) and cold leg temperature (Tcold) are input to and the comparatively small amount of energy
this display and plotted as functions of reactor being added to the coolant by decay heat, the cold
coolant system pressure. Steam generator pressure leg temperature is also expected to settle out close
3
* 0e
to this hot leg temperature. Additionally, because posttrip value. As long as Thot, Tcold, and SG Tat
the A T across the steam generator tubes is small, remain within a "posttrip window," the plant is
both of these temperatures should approach the responding normally.
saturation temperature of the secondary side of the With this type of display, the symptoms of
steam generator (SG Tsat). The Figure also shows interest are highlighted and brought into focus for
steam pressure moving from its pretrip value up to the operator. Consider the example in Figure 3.
the steam safety valve setpoint and back to its Combinations of these symptoms are also easily
th peaoraonie the exmleiFgre3
L.0 2400 -. - 2400
240
2000 - Path of 1 2000
ThoT -'ath of
T hot
0 1600 - 61600
E I
a1200 - 10
8) soo
*~ 2400.ran4ient
4 1200 0 5 600 650 Pressu
~200 .cahod
Reactor coolant and steam outlet temperature, FRecocolnadst ry tbe0Wih0 reaivl fe
mouete nubefo
prtrF
Figure 3A Inadequate subcooling margin:Fiue3 Exesv rm y-oecna h ttasf :
Thot is Onot progressinga) toward its target value; int
1600 time~~~~~~
prgesino600tasin.I oesc
fact, it has rapidly dropped through the subcooled htadToav rec deq lvlusbt oh
margin line. This condition is diagnosed as loss ofhaegn ouoftepsriwndw olwngS
adequate primary inventory subcooling, or simply 1201200SSteamPPressure
,t.Ticodinis ia oed nd raed s
"inadequate subcooling Limi margin," and theexesv theopeatorhasa cotinuuscompeterecodio
prm yt-co la h ttanf.
procedure is written with directions to take care of
inadequate subcooling margin.reonzdCosdrtexapeiFgue4tkn
Reco dispaat ars steam oulttmeauef ecor eahatrcoolant anstemotytteprtem Foo
Figure~V (beadqaecuaoln mrin iue 0 Excssie iary-to-e pcondartnfer
transien80
2400 -
fact,~ ~ ~ ~~o ~~~~ nderl eecton
~h itir haeailydopdvhogetesbooenht.n cofln reced
Tdhav seamquet
eulow tmealfntrensF
vntalsbtoh
Figutre3 dislay arranmntsecofdr haiat thsfe:
2000 -cahdratueWiharltvlfenubro
S40 paameerseae
undmeTa imlsteti bew itsealished wiith
adqutC1 priar invetor sucoideo
~~~~~~~~~~Path ofinuvaibeteoeaocamoiothral ondton iusediagnose mafnteaedns
Thot 400I Isimlareffcveness outill thelottig Tht4
windo folicptnS
0 1600 Reacor ootnt nd tea oulettemeraureFfpramt.ic cneition isdiagne and rated pat
Figure 38 Los ofxprimaryetpsemonyaryoheectransfer:ebll ofahealth
'D 1200 _ Steam Pressure asnsiderathsedecreasing.nAFiguoeganizatio
Thol isrincreasing
TtLisnt pgs t sa l nta imit. has dcreas boisetablished
between the twowisbgrowingearger.lThesecondarytissATf
This cone
mg800 no ongr
- fe porcwio follons,
rmoinghea ad hs lst oulin wih inctere sympt eombrin tfed pyand displayed of
U thecathodry.ayhisbeondition
isldiagnosedeandutreated
trnfr as ossof(indeuat)rimryto-ecndayeat
400 -fudmnapaaeeshvbendvlpdwt Path minptovrige
is the
ipto rbesc thssypertos
operaoraindevelonitor the neal
mntor mthiral
400 450 500 550
transer 600 650 thep iserto rduceathoninomaio iomlt soethingo
Reactor coolant and steam outlet temperature, Fofprmtichneoidcaenovalpat
Loss of anite xcssv prima ry-to-secondary heat transfer:
Figure 3B th4 nieeet hs eodalw nta
That as SG Tsat is decreasing. A AT
is incre8sing ncrrcieatos
digoipstvefebc
between the two is growing larger. The secondary is TGognztn
anNal.eetino usqen afntos
no longer removing heat and has lost coupling with Oc h yposaeietfe n ehdo
the primary. This condition is diagnosed and treated
as loss of (inadequate) primary-to-second.ary heat
Posttrip
2400 Window
2
2000/ 2000
1/2
a ~1 22
1600 1600
E 2n U 4 E0 a
m .5 . V) 9
1200 Steam Pressure 2 10
Limit 15
C
8 800 800 Steam Pressure
00
Saturation Limit Saturation
400 Subcooled Margin 4
Line
_ _ _ 400_ __-_ I _ I W
400 450 500 550 600 650 400 450 500 550 600 650
Reactor coolant and steam outlet temperature, F Reactor coolant and steam outlet temperature, F
Figure 4A 0 to 5 minutes: Figure 4C 8 to 15 minutes:
At time zero the reactor has tripped on loss of Steam pressure and temperature have recovered to
feedwater. At 1 minute Thot and Tcold are essentially their normal posttrip values. A substantial cooling
the same temperature. At 2/ minutes the ESFAS of the primary is also in progress.
pressure setpoint is reached and high pressure
injection (HPI) is automatically started. At 31/2
minutes subcooling margin is lost, and at 41/2 . 2400
minutes the operator stops HPI. By the time 5 a
minutes have elapsed the RCS is beginning to heat .
up. Secondary pressure and temperature are below . 2000
limits. The primary-to-secondary AT is -50 F.a
o 1600
2400
C 1
2000
2000 - - -- --- -- -- - - 20
1600
aC
8 teaSteam Pressure
1600 Li Saturation
2 8
0 400
800800----imi
Limit 400 450 500 550 600 650
-Reactor F coolant and steam outlet temperature,
8 800 -- - - - - - --
Saturation Figure 4D 15 to 20 minutes:
T Primary-to-seconary heat transfer (coupling) is
,now almost completely restored. Thot and Tcold are
fe tapproaching their normal posttrip values. However,
400 450 500 550 600 650 the inadequate subcooling margin is evident.
Reactor coolant and steam outlet temperature, F design bases for, and the use of, the procedures.
Figure 4B 5 to 8 minutes: Figure 5 outlines the organization of Part . The
The primary continues to heat up along the immediate actions are common to every reactor trip
saturation line while secondary temperature and and must be performed regardless of the cause. The
pressure *drop. At 8 minutes the primary-to- vital system status verification is a short checklist
secondary AT -80 degrees. Also, auxiliary used to determine a baseline for possible operator
feedwater is first directed to the steam generators. actions. This checklist considers instrumentation
useful to the operator. The Abnormal Transient power supplies, engineered safety features
Operating Guidelines. consist of two parts. The first activation system (ESFAS) status, steam line break
part is procedural guidance to be used in the protection system status, etc. Included in this
control room during transients. The second part, a checklist is a requirement to monitor the ATOG
much larger volume, is a training aid explaining the display. If everything is normal, the plant has
5
intent as to why various steps are taken in Part 1.
Section I It also describes, using many graphic examples, the
Immediate Actions expected plant response information gathered
Sectin 11during the guideline development stage. Part Il has
Section s r been written to aid the operator's trainig and is
Vital system status verification
important to the guidelines because an intelligent,
Section III capable operator is a basic part of the plant
A. Treatment of lack of adequate subcooling margin operating structure in which the guidelines are built
B. Treatment of lack of primary-to-secondary heat transfer (i.e., the guidelines try to optimize the operator's
C. Treatment of too much primary-to-secondary heat transfer effectiveness instead of minimizing his impact).
Cooldown procedures
* Large LOCA Guideline
o Normal NormalOnce written, the potential guidelines were tested
* Saturated RCS
o HPI cooling on a PWR simulator by imposing multiple
o Solid water cooldown casualties and using the guidelines to recover.
Guideline credibility was also established by back
Figure 5 ATOG - organization of Part I checking the guidelines against event tree paths
and benchmarking event tree paths and computer
responded as designed andmeme to a steady post- simulations against actual plant transients. The
trip condition. No further action is required. event trees were also reviewed by the utility
However, if the operator diagnoses an imbalance in operators to take advantage of their plant
one of the basic symptoms, he is directed to the experience. The draft guidelines were sent to the
appropriate section for follow-up actions. These plant site for walk-through drills to test their
sections treat the symptoms and do not require the applicability. Feedback from the operator to the
operator to determine the cause. It is expected, plant designer served to greatly reduce
however, that as he treats the symptoms he will communication errors and increase confidence in the
find the original problem. final guidelines.
Treating the symptoms will allow returning the An important final step in validation involves
plant to a stable condition. This stable condition implementing the guidelines into the plant
could very well be abnormal compared to what the procedures system. This implementation tests the
operator normally sees. Accordingly, various guidelines' scope and appropriateness since they
cooldown procedures are provided to give him must be a workable part of the overall plant
guidance on long-term recovery from these possible procedures system or their worth diminishes.
conditions. Existing posttrip procedures must be checked
Figure 6 outlines the organization of Part II. against the guidelines to determine the following:
Intended to give the operator a thorough onaP RsmltrbNmoigmlil
understanding of Part I, it conveys the writer's 1.oNecesscons utside t d opment
Volume 1 procedure in the same time frame. This assures
Fundamentals of reactor control for abnormal transients that, although everything may not be
A. Heat transfer considered, the adoption of ATOG does not
B. Use of P-T diagram decrease in any area the adequacy of procedures
C. Abnormal transient diagnosis and mitigation
D. Backup cooling methods
E. Best methods of equipment operation previous procedures may be found good but not
F. Stability determination necessary, and either be deleted or relegated to a
level of instruction. The goal is to
Volumelower
Appendices - selected transientssimplicity. 2. Actions that should be included in an instruction
feedwater raset
A. Excessiveseecte
AppEnces
B. Loss of feedwater for longer term action. Current posttrip
C. Steam generator tube rupture procedures include many necessary follow-up
D. Loss of off-site power actions that are not appropriate for ATOG, but
E. Small steam line break must be included somewhere. Three actions,
F. LOCA identification of these items, determination of
organization of Part 1o the form in which they should be given, and
Figure 6 ATOG -
optimization of the interface between the form in
6
which they are given and the ATOG, are Summary
necessary to make ATOG a workable part of the
overall plant procedure system. Again, the goal Busing theAbnoraTran ent ating
is to maximize simplicity.
3. Any posttrip procedures not accommodated by by monitoring reactor posttrip parameters for only
ATOG, but which must remain intact. One goal a small number of symptoms and taking corrective
of ATOG is to eliminate these procedures, but action as directed by the procedure. The guidelines
that goal has not yet been proven consistently allow him to use one simple procedure for all
attainable. Any such procedures identified must transients which start with a reactor trip. The
be entered in a manner compatible with ATOG unique feature of this approach is that it provides a
implementation. common starting point, independent of initiating
Althoughevent, and leads the operator through a step-by
plant, preliminary work indicates that portions step procedure to regain stable plant conditions
ork
all of the procedures, the as th o rtin s of without having to identify either the cause of the
rallofte prcdueuha foloinayb transient or any additional posttrip malfunctions.
replaced by the ATOG:
* Reactor-turbine trip
* Degraded electrical power
o Loss of coolant/RC pressure
* Steam supply system rupture
* Loss of steam generator feedwater
* Steam generator tube rupture
of reactor cooling flow - RCP trip byLoss
