B11666, Forwards Preliminary Summaries of Public Safety risk- Oriented Analyses of Listed Projects Being Evaluated in Integrated Safety Assessment Program

Forwards Preliminary Summaries of Public Safety risk- Oriented Analyses of Listed Projects Being Evaluated in Integrated Safety Assessment Program

ML20134L568
Person / Time
Site:	Millstone
Issue date:	08/26/1985
From:	Opeka J, Sears C NORTHEAST NUCLEAR ENERGY CO., NORTHEAST UTILITIES
To:	Charemagne Grimes Office of Nuclear Reactor Regulation
References
B11666, NUDOCS 8509030332
Download: ML20134L568 (14)

Text

___

NORTHEAST UTILITIES conoru On.c . . seiden sire.t. seriin. connecticut 1 cE[.UI.bs$ c P.O. 00X 270 es = a" = c~~

HARTFORD CONNECTICUT 06141-0270 L L J C,[^.* 72[C!l,C"", (203) 665-5000 August 26,1985 Docket No. 50-245 Bil666 Director of Nuclear Reactor Regulation Attn: Mr. Christopher I. Grimes, Chief Systematic Evaluation Program Branch U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Gentlemen:

Millstone Nuclear Power Station, Unit No.1 Integrated Safety Assessment Program Summaries of Public Safety impact Model Project Analyses In a letter dated July 31, 1985,(1) Northeast Nuclear Energy Company (NNECO) was requested to provide the Staff with summaries of the public safety risk oriented analyses of a selected number of projects we are evaluating in the Integrated Safety Assessment Program (ISAP).

In response to this request, and in accordance with our understanding of the ISAP process, we are providing the Staff with summaries of the following projects we have evaluated icr public safety impacts:

1) ISAP Topic N o. 1.01 - " Gas Turbine Generator Start Logic Modifications"

2) ISAP Topic No.1.16.2 " Modify CRD Pumps"

3) ISAP Topic No.1.24 " Emergency Power"

4) ISAP Topic No. 2.31 "LPCI Lube Oil Cooler Test Frequency" It is noted that since we have not completed our analyses of the entire set of ISAP projects, the public safety impact scores are to be considered preliminary at this time. Upon completion of our analyses of the entire ISAP project set, including all fise attributes, we will review our analyses and revise our public safety impact results, if necessary, to assure consistency in the ranking of the ISAP projects, h

P DO [

(1) 11. L. Thompson letter to 3. F. Opeka, " Integrated Safety Assessment Program," July 31,1985.

A

It should also be noted that ISAP Topic No. 2.31 was initiated based on the results of the Millstone Unit No.1 Probabilistic Safety Study (PSS). In response to the potential safety concern surrounding operation of the LPCI lube oil cooler solenoid valves, NNECO has modified the LPCI pump operability procedures to assure that the solenoid valves operate as intended and LPCI cooling remains available. The origin and completion of this particular procedure change represent an example of the process described in SECY-84-133 regarding PSS insights (SECY-84-133, Enclosure 1, page 5)

"The licensee will use the results of the PSA to identify plant design and operation weaknesses that warrant consideration in the integrated assessment..." and "In the event that either the licensee or the staff should determine during the course of a topic review that a difference warrants prompt action to protect the health and safety of the public, that action will be pursued expeditiously and independent of ISAP."

In addition, through the technical integration of issues and topics performed within the framework of the ISAP process, we have identified a close interrelationship between ISAP Topics 1.16.2 (Modify CRD Pumps), 1.16.1 (MPl/MP2 Backfeed), and 1.02 (Tornado Missile Protection) and are performing an integrated evaluation of the issues covered in each topic, as discussed in the write-up for each topic. We believe the above actions provide evidence that the ISAP concept functions effectively in practice by facilitating discovery of cost-effective changes and resource efficient modifications which will improve overall plant safety.

As further public safety impact analyses are completed, we will promptly forward summaries to the Staff for review.

If you have any questions on this material, please feel free to contact my staff.

Very truly yours, NORTHEAST NUCLEAR ENERGY COMPANY

. .b '

tt

3. F. Opeka Senior Vice President By: C. F. Sears Vice President cca J. A. Zwolinski

ISAP #1.01, Gas Turbine Start Imgia Modifications l #1.24 Emergency Power l

Safety Issue l The Millstone Unit 1 PSS model identified the fact that 30% of the predicted core melt frequency was due to loss of normal (LNP) events, with over half of the resulting sequences dominated by failure of gas turbine bus 14E. Further review shows that failure of the gas turbine generator constitutes over 11% of l the total C.M.F. by itself (i.e. approximately 745 of bus 14E unavailability).

Gas turbine failure is due to either start or run faults which are equally divided in terms of their contribution importance as shown in section 3.2.2 of the P.S.S. * ' **~

Because the gas turbine generator is one of the single most dominant contributors to core melt frequency, possible modifications to improve gas turbine reliability warrant consideration. Proposed areas for investigation have focused on two principal areas:

The potential for bypassing additional gas turbine equipment protective trips that are not presently bypassed during emergency operation.

O Evaluation of the existing gas turbine preventive maintenance (P.M.)

program to determine its effectiveness.

Due to the close interrelationship between Topics 1.01 & 1.24, we have chosen to evaluate these topics concurrently.

Proposed Project The proposed project addresses modifications or improvements in 4 areas as discussed below:

1. Startup Trips - Four of the gas turbine protective trips are associated with a tories of expected conditions during the starting I

l MILLSTONE UNIT 1 IhTEGRATED SAFETY ASSESSMENT PROGRAM

tequenca (i.e. turbina light-off). Two of th se startup trips  ;

indicate a major problem with unit start and cannot be bypassed without compromising the safety of site personnel. The protective trips that were proposed to be bypassed during emergency start conditions are:

O start speed not reached in 20 sec. (expected in 13 to 16 sec.)

0 generator excitation speed not reached in 60 sec. (expected 35 sec. after start speed achieved)

2. Operational Trips - There are 6 protective trips which are associated with steady state operation of gas turbine while it is running. All ~

but one of these trips is required to prevent severe mechanical damage of the gas turbine and associated hazardous conditions for site personnel. Accordingly, only the high lube oil temperature trip is proposed to be bypassed during emergency operations, while all other protective trips are retained.

3. Preventive Maintenance Program -

Potential areas for additional preventative maintenance will be determined based on inspections performed during refuel outages.

4. Generator Trips - The output breaker of the generator has 7 protective trips that are not presently bypassed. Two of the trips will be retained for generator protection and the remaining 5 trips will be bypassed under accident conditions, as is currently done on the Millstone Unit 1 emergency diesel generator. The trips proposed to be bypassed are:

0 loss of excitation 0

opening of the exciter breaker 0

negative sequence MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEhT PROGRAM

rcycrse power generator underspeed Analysis of Public Safety Impact Each of the 4 issues was looked at separately in order to learn whether or not it produced an impact on public risk and safety. The corresponding analysis was performed in several steps using Method A. The first step was to determine what effect, if any, the recomendations of a particular issue has on gas turbine performance. If any recommendation produced such an effect, a new gas turbine unavailability number was calculated. The calculation was based on the ,.

estimated change in gas turbine failure rate caused by implementation of the recomenJation. The last step was to requantify the Millstone Unit 1 PSS model using the new unavailability to determine the change in core melt frequency associated with the particular issue. The analyses for each issue are described below.

1. Startup Trips Based on a review of the Millstone Unit 1 component reliability data base developed as a part of the Millstone Unit 1 P.S.S., the 28 recorded start failures for the gas turbine generator may be broken down into the following categories according to the number of failures in each:

0 governor problems 7

• O causes unknown 6 speed control / switches 5 0

air start regulating valve 4 U

output breaker failure 3 0

operator error 1 MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEhT PROGRAM

spurious vibration trip 1 inverter failure 1 The proposal to bypass the gas turbine light-off speed and generator exitation speed trips will only affect the category for speed control / switch induced failures. In looking at the 5 recorded failures for this category, only 2 of them could possibly be prevented if the proposed startup trip bypass is implemented. The other 3 are related to failures of the speed controller which ultimately causes gas turbine trip for other reasons.

Since the speed trips will only be bypassed under accident conditions, it will ~

still be possible to have a gas turbine failure during a normal test start.

The 834 valid starts or start attempts that were used to calculate the original gas turbine start failure rate, consist of mostly normal test starts.

Consequently, the 2 observed failures could have occurred either during normal start or simulated accident start and may not always be preventable. '

Conservatively assuming that there is a 50% chance the failures occurred during a simulated accident start, then 1 of them could be prevented through speed trip bypass. This lowers the total number of gas turbine start failures from 28 to 27 and reduces gas turbine unavailability by approximatelly 3 5%.

After re-quantifying the P.S.S. model to reflect the change in gas turbine unavailability, the total core melt frequency was reduced by 2 x 10-6/ year.

Nearly all of the reduction is due to changes in plant damage states that result in early and intermediate core melt times (e.g. TE1 and TI1).

, Accordingly, a multiplier of 0.5 was used to calculate the Man-Rem equivalent dose reduction as follows:

6 R = (2 x 10'0/yr.) (0.5) (3 x 10 Man-Rem) (25 yr.)

= 75 Man-Rem

2. Operational Trips MILLSTONE UNIT 1 IhTEGRATED SAFETY ASSESSMEfff PROGRAM

l Tha high lube oil temperaturo trip is byptssed undar cocid:;nt conditions and

! thus no further evaluation has been performed.

3. Gas Turbine Preventive Maintenance Program 1

j A review of the gas turbine reliability data base failures led to the preliminary conclusion that a better preventive maintenance program could have

precluded some of the governor start failures and all of the air start a

regulating valve failures. However, in light of recent modifications that were j perforined on the gas turbine air start system, these latter failures are not l expected to recur. Also, scheduled preventative maintenance of the air start

system has been added to the existing program so that any further program improvement will not affect these types of start failures. ~

) Governor related start failures could potentially be eliminated for 3 of the 7

! recorded failure events in this category. The present gas turbine preventative maintenance program requires a monthly check on the governor oil level with all j other preventative maintenance scheduled to be performed during refueling l1 outages. Optimistically, the gas turbine failures could be reduced frem 28 to j 25 if an effective preventative maintenance program could be implemented for the governor. With such failures eliminated altogether the gas turbine

) unavailability could be reduced by as much as 115.

4 Re-quantification of the PSS model results in a potential C.M.F. reduction of 6 f x 10 0/yr. due to more frequent governor p.m.. Since the plant damage states

are identical to those mentioned earlier (i.e. TE1 and TI1), a 0.5 multiplier l is used to calculate public risk as shown below

6 R = (6 x 10-0/yr.)(0.5)(3 x 10 Man-Rem)(25 yr.)

225 Man-Rems l

4

4. Generator Trips j

Over the 12-1/2 year period of recorded data for the gas turbine, there have l been 3 start railures related to output breaker closure failure. However, none of these faiures were due to trips that the bypass proposed is intending to i

l 1

MILLSTONE UNIT 1 i

IhTEGRATED SAFETY ASSESSMEE PROGRAM

{ tW

i prev:nt. In crd2r to calculeto cn cffect on gas turbine un",vailability, it is conservatively assumed that the proposed bypass of 5 out of 7 trips will prevent the occurrence of one such trip over the remaining life of the plant.

This assumption results in the same public risk reduction of 75 Person-Rem that was calculated for the startup trip bypass which prevents one trip as well.

Results i

The results of the above analysis can be best summarized as shown in the following table:

Man-Rem Score (out Snecific Chanae Radnetton -

of 10) ~

Bypass of 2 startup trips 75 Man-Rem 0.2 Implementation of more comprehensive governor P.M.

program 225 Man-Rem 0.6 Bypass of 5 generator 75 Man-Rem 0.2 trips Collectively, the scores of all 3 gas turbine modifications / improvements result in total score of 1.0 for the project.

9 l

l I

l MILLSTONE UNIT 1 l IhTEGRATED SAFETY ASSESSMEW PROGRAM t

l

ISAP #1.16.2 Modify CHD Paps Safety Issue Following an AC blackout event or serious fire that incapacitates both emergency AC buses, the Isolation Condenser (IC) is the only available system that is capable of preventing core melt. The IC and its associated makeup system fbnction to remove core decay heat independent of AC power. Makeup to the IC is provided by the diesel driven fire pump which can also be used to meet long term vessel makeup requirements that are caused by primary system shrinkage and/or minor leakage out of system. Lining up the diesel pump for vessel makeup requires operators to connect a fire hose in the Turbine Building to the Feed.iater heater drain. However, if a serious fire occurred in this '

building the Feedwater heater drains may not be accessible for some time. The occurrence of such an event would require a Control Rod Drive (C.R.D.) pump to be used for makeup in place of the diesel pump. The power cables to the C.R.D.

pumps, however, have to pass through the Turbine Building and may be damaged as a result of the same fire.

The Hillstone Unit 1/ Unit 2 Backfeed project (ISAP #1.16.1) addresses the issue of being able to power a C.R.D. pump from Unit #2 through connections that do not have to pass through the Turbine Building. In the analysis of the above project, it was assumed that a design modification for C.R.D. pump self-cooling would already be implemented. Such cooling is required after a Turbine Building Fire since the backfeed project does not include powering T.B.S.C.C.W.

or Service Water, both of which are necessary for C.R.D. pump cooling.

The proposed project to modify C.R.D. pump cooling is strongly linked to the backfeed project. Without the concurrent implementation of both projects, the backfeed alone'will not provide the benefits that are described in the backfeed project writeup (ISAP Topic No. 1.16.1).

Proposed Project The proposed project involves modification of the C.R.D. pumps to permit self-cooling in the event that all service water is lost, following a MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM

ccreenhous2 fira. During normal plant operation, tha C.R.D. pump be: ring end gear box are cooled by T.B.S.C.C.W. which relies on service water to provide the ultimate heat sink. The proposed modification would allow manual

realignment of the C.R.D. motor cooling piping to the pump discharge flow to permit self-cooling.

1 i Analysis of Public Safety Impact 1

The analysis for the backfeed project assumes that C.R.D. pump self-cooling 4 will be available. Consequently, the public risk reduction associated with

! implementation of the backfeed project is dependant on implementing the C.R.D.

pump modifications first. No separate analysis was performed for this latter project since it is implicitly part of the backfeed project and should receive ~

! the same score.

Results T

l By itself, the proposed C.R.D. pump modification would have a score of zero.

Conversely, the backfeed project will not accomplish its intended purpose j without implementation of C.R.D. pump self-cooling along with the project. The 1

results for CRD pump modification are the same as those for the backfeed project, if both projects are implemented together.

j j

f i

i i .

l i

i i

i 4

I i

MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEUr PROGRAM

ISAP #2.31 LPCI Imbe Oil Cooler T:st Frequency Safety Issue Millstone Unit 1 Probabilistic Safety Study has identified that one of the major contributors to Low Pressure Coolant Injection (L.P.C.I.) system unavailability is the failure of the solenoid valve controlling L.P.C.I. pump motor bearing lube oil cooling. The L.P.C.I. pumps are used both for injection into the R.P.V. (to maintain or restore water level) and for long term cooling in the Alternate Shutdown Cooling mode (See Sections 3.2.20 and 3.2.23 of Millstone Unit 1 P.S.S.). The L.P.C.I. system unavailability especially in the Alternate Shutdown Cooling mode is a dominant contributor to the core melt frequency. Therefore, any improvement in the L.P.C.I. system reliability will

~

offer a significant reduction in public risk.

As shown in Figure 1, flow from L.P.C.I. discharge is used in cooling lube oil for the pump motor bearings. The flow is admitted to the oil reservoir cooling coil through the solenoid valve 1-LP-52A(B). The valve is normally closed and automatically opens on the pump start signal. One valve in each L.P.C.I. train allows cooling flow for both L.P.C.I. pumps in the train.

The L.P.C.I. pumps are started on a monthly basis for a surveillance test.  !

However, in these tests the pumps are run only for a short time (5-10 minutes),

which does not confirm that the solenoid valves 1-LP-52A(B) have opened to allow cooling flow to the lube oil. Note, the L.P.C.I. pumps can function for a limited time without cooling to the' motor bearing lube oil. The operation of the solenoid valve is indirectly inferred during refuelling when the L.P.C.I.

, pumps are run for extended periods of time.

Due to infrequent confirmed testing of the solenoid valves, the Millstone Unit 1 P.S.S. calculated a high probability of the valve failing to open. This high failure probability reflects the fact any failure of the valve since last refueling outage would go undetected until the next outage. The high unavailability of the valve is a dominant contributor to the L.P.C.I. system unavailability (especially in the Alternate Shutdown Cooling mode), which in turn is a major contributor to the core melt frequency and therefore to the MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM

l public risk.

Fr W Project The proposed project calls for only a change in the surveillance testing procedure of the L.P.C.I. system. The proposed change is for the operator to confirm opening of the solenoid valve 1-LP-52A(B) during monthly testing of the L.P.C.I. pump. The opening of the valve can be confirmed by checking pressure of water for lube oil cooling.

Analysis of Public Safety Impact The public safety impact of this proposed project was evaluated using Method A. ~

Confir1 nation of the solenoid valve 1-LP-52A(B) operation during monthly testing (as opposed to at refueling) decreases the unavailability of the valve from 2.75 x 10-2 to 1.25 x 10-3 on demand (based on WASH-1400 failure data for the solenoid valves). The effect of this on L.P.C.I. system unavailability in the injection mode is not significant. This is because for injection purpose, only one of two L.P.C.I. system trains is needed for success. Therefore, failure of the L.P.C.I. system requires failure of either valves in both trains (1-LP-52A and B) or failure of one valve in a train in conjunction with some other failure in the second train. Due to multiple failures (two component cutsets),

effect of a change in valve failure probability on L.P.C.I. system unavailability is small and therefore not quantified.

As discussed in Section 3.2.24 of Millstone Unit 1 PSS, operation of both L.P.C.I. trains in Alternate Shutdown Cooling mode is required for success.

. Therefore, failure of either of two solenoid valves 1-LP-52A or B will fail successful operation of Alternate Shutdown Cooling.

Results Reducing the failure probability of the valve 1-LP-52A(B) from 2.75 x 10-2 to 1.25 x 10-3 on demand decreases the unavailability of Alternate Shutdown Cooling from 0.148 to 9.55 x 10-2 . The lower unavailability of Alternate Shutdown Cooling decreases the core melt frequency from 8.07 x 10-N to 6.86 x MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMENT PROGRAM

F 10~N per yc;r; e drop of 1.1 x 10-* per year (13% decrease). About 80% of the improve ~ent in core melt frequency is in plant damage states SI1 and TI1 (see Section 2.2 of Millstone Unit 1 PSS for definition of plant damage states) and the remaining is in plant damage states AL2, SL2 and TL2. By increasing surveillance testing of the valve 1-LP-52A(B), public risk decreases by 5500 person-rem over the remaining life of the plant. A score of 10 out of 10 is assigned for this project.

t MILLSTONE UNIT 1 INTEGRATED SAFETY ASSESSMEfE PROGRAM

=7- Q oom,.

((.),i [><3-E k- -[><]-l>k]-C><} - $,Er2 i

AIB) L P - SI A(BI IP-52A(Bi LP-5J A(81 L P-73 A(8) L P-6SAtel AfD)

-- tP-62AfDI

(><1 - C><3-L P-87A(8)

{><3 - N3,',

L P-ISA A(88 A0i'?"

O N0 fort

- [><d-[> <]-[><]- foO'S - [><] -

L P-54 A(8) L P-74 A(BI LP-56AfD) fg[p* LP-63NBA FIGURE I LPCI SYSTEM DIAGRAM LPCI PUMP COOLING 4

9

.J