GNRO-2012/00102, Request to Revise the Standby Service Water Passive Failure Methodology

Request to Revise the Standby Service Water Passive Failure Methodology

ML12258A386
Person / Time
Site:	Grand Gulf
Issue date:	09/14/2012
From:	Mike Perito Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
GNRO-2012/00102, TAC 69404
Download: ML12258A386 (9)

Text

,.

~~Entergy Entergy Operatio ns, Inc.

P. O. Box 756 Port Gibson. MS 39150 Michael Perito Vice President. Operations Grand Gulf Nuclear Station Tel. (601) 437-6409 GNRO-2012/00102 September 14, 2012 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

Request to Revise the Standby Service Water Passive Failure Metho dology Grand Gulf Nuclear Station, Unit 1 Docket No. 50-416 License No. NPF-29

REFERENCES:

1. NRC Letter from Joseph D. Neighbors to John C. Brons Re:

Approval of Indian Point 3 Nuclear Power Plant Methodology Change for Postulating Service Water System Breaks (TAC No. 69404)

2. SECY-77-439, NRC Information Paper on Single failure Criterio n

dated August 1,1977 (ML060260236)

3. NUREG-0138, Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum from Director, NRR to NRR Staff, Issue No.7, Passive failures Following a Loss-of Coolant Accident, November 1976

Dear Sir or Madam:

Pursuant to 10 CFR 50.90, Entergy Operations, Inc. (Entergy) hereby requests approval of an amendment to Grand Gulf Nuclear Station, Unit 1 (GGNS) Facility Operating License No. NPF-

29. The proposed change would revise the Updated Final Safety Analysis Report (UFSAR) to describe the use of revised methodology for postulating single phase failures of the Standby Service Water (SSW) to be consistent with NRC guidance publish ed in References 2 and 3 which state that credible passive SSW failures that can result in a loss of fluid post-accident are limited to pump or valve seal leakage, not ruptures of SSW system piping. Grand Gulf requests approval by September 14, 2013 and requests an implementatio n date of 90-days from the receipt of the approved request to incorporate changes to the UFSAR There are no new commitments in this letter. If you have any questi ons or require additional information, please contact Christina L. Perino at 601-437-6299.

GNRO-2012/00102 Page 2 of 2 I declare under penalty of perjury that the foregoing is true and correct. Executed on September 14th , 2012.

Sincerely, MP/jas

Attachment:

Request to Revise the Standby Service Water Passive Failure Methodology cc: U.S. Nuclear Regulatory Commission ATTN: Mr. Elmo E. Collins, Jr. (w/2)

Region Administrator, Region IV 1600 East Lamar Boulevard Arlington, TX 76011-4511 U. S. Nuclear Regulatory Commission ATTN: Mr. Alan Wang, NRRlDORL (w/2)

Mail Stop OWFN 8 B1 Washington, DC 20555-0001 Dr. Mary Currier, M.D., M.P.H State Health Officer Mississippi Department of Health P. O. Box 1700 Jackson, MS 39215-1700 NRC Senior Resident Inspector Grand Gulf Nuclear Station Port Gibson, MS 39150

Attachment GNRO*2012/00102 Request to Revise the Standby Service Water Passive Failure Methodology

Attachment to GNRO-2012/001 02 Page 1 of 6 I. Summary Grand Gulf Nuclear Station (GGNS) proposes the utilization of limited size breaks (through-wall leakage cracks) in the analysis of passive failures of Standby Service Water (SSW) piping during the post-LOCA phase of an accident. Postulating passive pipe ruptures and heat exchanger tube ruptures, and pipe fitting (tee, elbow, reducer, etc) ruptures in the SSW piping is overly conservative. SECY 77-439 underscores the fact that the probability of failure of the service water piping during the critical 24-hour period after a LOCA is so low that it does not constitute a credible event. Additionally, crack locations and sizes postulated under the guidance of Standard Review Plan (SRP)

(NUREG 0800) Sections 3.6.1 and 3.6.2 are applicable and bounding in terms of the consideration of passive failures as addressed in SECY 77-439, and are thus applicable to the Grand Gulf Nuclear Station pipe failure analysis.

In accordance with the Grand Gulf licensing basis and as stated in the Grand Gulf Final Safety Analysis Report (FSAR), the SSW system was designed to provide a continuous flow of cooling water to those systems and components necessary for plant safety either during normal operation or under abnormal and accident conditions. During accident conditions, SSW must provide the cooling water necessary to allow the engineered safety features to perform their intended function when subjected to:

a. The single failure of any active component used during the injection phase of a postulated Loss-of-Coolant Accident (LOCA) or

b. The single failure of any active or passive component used during the long-term recirculation phase.

The Nuclear Regulatory Commission (NRC) Component Design Bases Inspection (CDBI) debrief provided the NRC's potential findings and conclusions. The proposed findings described at the debrief noted a discrepancy in FSAR Table 9.2-1 with the use of a 50.59 to change the table. NPEFSAR 87-0067 changed the FSAR using SECY 77-439 and NUREG 0138 as the basis for removing the requirements of passive failures of pipes, heat exchanger tubing and pipe fittings.

This submittal is not the result of changes to any accident analyses discussed in the UFSAR, since these analyses have previously assumed that only one pipe break or crack occurs at a time. The UFSAR which was revised in 1987 is consistent with NRC guidance published in SECY 77-439, which states that the implementation of the single failure criterion does not require significant ruptures of moderate energy piping subsequent to a LOCA, as this combined event would be extremely unlikely.

Currently Grand Gulf utilizes flow differential instrumentation between the discharge and return to detect leakages greater than 1200 gpm. For leakages less than 1200 gpm, an ONEP for low SSW basin level has been created. This criteria provides guidance that within 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> Operations is to begin monitoring SSW basin level when the SSW Basin low level alarm comes in. However, further evaluation has determined that the critical crack size for a moderate energy line break is 540 gpm and the time for monitoring can be extended out to 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (see Calculation on Page 6 of this attachment).

Attachment to GNRO-2012/00102 Page 2 of 6 The FSAR change made by NPEFSAR 87-0067, revised the description of passive failures in the SSW system to be consistent with the system capabilities and NRC guidance in the form of SECY 77-439.

II. Regulatory and Technical Considerations

1. General Design Criteria The General Design Criteria (GDC) which formed the basis for the Grand Gulf design was published by the Commission on July 11, 1967 and was subsequently made part of 10CFR50. Of these original GDC, only Criterion 41 applies to the SSW system. These criterion require that:

Engineered Safety Features ... shall provide sufficient performance capability to accommodate the failure of any single active component without resulting in undue risk to the health and safety of the public.

Criterion 41 (1967) did not require consideration of passive failures for engineered safety features and, no coincident Loss of Offsite Power (LOP) following a LOCA.

However, in 1971 the Commission issued a new GDC in Appendix A to 10CFR50.

Criterion 44 was specifically applicable to the Grand Gulf SSW system. This criterion states that:

A system to transfer heat from structures, systems, and components important to safety to an ultimate heat sink shall be provided. The system safety function shall be to transfer the combined heat load of these structures, systems, and components under normal operating and accident conditions.

Suitable redundancy in components and features and suitable interconnection, leak detection and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.

Within GDC 44 (1971), the single failure criterion is not specifically defined to encompass active and/or passive failures. Footnote 2 to Appendix A to 10CFR50 does, however, indicate that: "The conditions under which a single failure of a passive component in a fluid system should be considered in designing the system against a single failure are under development."

As further clarification of the single failure criterion for the SSW system, a review of NUREG 0800, Standard Review Plan, Section 9.2.1, Station Service Water System, does not require considerations of passive failures of the SSW under design basis conditions. However, the singular wording of footnote 2 to 10CFR50 Appendix A appears to indicate an element of jUdgment on the part of the staff when considering passive failure in fluid systems.

As noted in Section I, the postulated break in the 24 inch cooling water line to the Auxiliary Building during recirculation phase following a LOCA forms the design basis for Grand Gulf. The SSW system is capable of accommodating such a break while

Attachment to GNRO-2012/00102 Page 3 of 6 still fulfilling its intended safety function; but Grand Gulf does not believe that the size of the break postulated in the break analysis is representative of the type of break to be expected for SSW piping.

2. SECY 77-439 As further clarification for defining the types of passive failures to be considered for fluid system in nuclear power plants, in a memo from the staff to the Commissioners (SECY 77-439), NRC has concluded that:

".. , on the basis of the licensing review experience accumulated in the period since 1969, it has been judged in most instances that the probability of most types of passive failures in fluid system is sufficiently small that they need not be assumed in addition to the initiating failure in application of the single failure criterion to assure safety of a nuclear power plant."

Elsewhere, the SECY 77-439 report asserts that:

"In the study of passive failures, it is current practice to assume fluid leakage owing to gross failure of a pump or valve seal during the long term cooling mode following a LOCA (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater after the event) but not pipe breaks. No other passive failures are required to be assumed."

The SECY-77-439 report continues:

" ... an example of the application of a passive failure requirement is the approach to long-term recovery subsequent to a loss-of-coolant accident. Applicants are required to consider degradation of a pump or valve seal and resulting leakages in addition to initiating failure (LOCA)."

3. Formulation of Passive Failure Criteria A review of NRC regulations relative to passive failures indicates that whereas consideration of passive failure is required for high energy systems (SRP Section 6.3, Emergency Core Cooling System), the passive failure criteria is more relaxed for moderate energy lines (in particular for the Standby Service Water system, refer to SRP Section 9.2.1). Furthermore, although limited size breaks in moderate energy lines have been required, they have been taken as initiating events and not coincident with LOP and LOCA. The intent has been to eliminate or reduce the risk of affecting the operation of a system important to safety as a result of breaks in other moderate energy systems nearby.

However, if piping failures in a moderate energy fluid system such as Grand Gulf's Standby Service Water system piping are to be evaluated, questions arise as to available guidance regarding the location and size of the postulated failure.

Enveloping passive failures in fluid systems are those which result in the loss of structural integrity of the system, i.e., a pipe break of undefined size. A review of industry standards for piping has shown that in determining the criteria for postulating passive failures in fluid systems, it is important to distinguish pipe failures as initiating

Attachment to GNRO-2012/001 02 Page 4 of 6 events. A crack in a moderate energy line which is evaluated according to criteria in SRPs 3.6.1 and 3.6.2 is considered as an initiating event. To satisfy General Design Criterion 44, current NRC correspondence SECY 77-439 requires the consideration of a long term passive failure during post-LOCA recirculation in addition to the initiating event (in this case a LOCA). However, when supported by an analysis, the long term passive failure is limited to the "maximum flow through packing or mechanical seal rather than based on complete severance of the piping." (Ref.

SECY 77-439). Further, no passive failures need be postulated in the short term (up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the initiating event).

Again, the NRC does provide guidance for the evaluation of pipe breaks to support their review of a licensee's conformance with General Design Criteria 44 in NUREG 0800, Standard Review Plan (SRP) Sections 3.6.1 and 3.6.2. These sections address the review of postulated ruptures of piping systems and the evaluation of the impact of the dynamic effects associated with postulated rupture on structures, system and components important to safety.

It should be re-emphasized that the review under SRP sections 3.6.1 and 3.6.2 does not deal with individual system design requirements necessary to ensure that the system performs as intended, but rather considers the protection necessary to assure the operation of such systems in the event of nearby piping failures. In addition, the criteria for evaluating postulated breaks in piping considers breaks only as single initiating events occurring during normal plant conditions and not as passive failures postulated during the recirculation phase of plant cooldown following a LOCA.

Since the SRP Section 3.6.1 and 3.6.2 criteria primarily are concerned with the protection of essential plant features from the dynamic effects associated with postulated pipe ruptures, only those portions of the SRP Criteria dealing with the size and location of postulated ruptures can be considered appropriate for use in this review of passive failure in the Grand Gulf SSW piping.

The Grand Gulf SSW system is considered a moderate energy fluid system. The definition of a moderate energy fluid system adopted by NRC is presented in SRP 3.6.1 as a system that experiences an operating temperature of 200°F or less and a maximum operating pressure of 275 psig.

The break type postulated in the SRP on the basis of stress and fatigue for all seismically analyzed moderate energy systems is a leakage crack which is described as a circulator opening of or equal to that of a rectangle one-half pipe diameter in length and one-half pipe wall thickness in width. The leakage crack is considered applicable to all moderate energy fluid system piping and branch runs exceeding a nominal pipe size of 1 inch.

In summary, to postulate passive breaks in the Standby Service Water System during the recirculation phase of plant cooldown, the follOWing methodology should be employed: for seismically designed portions of the service water leakage cracks (1'2 pipe diameter x 1'2 pipe wall thickness) should be postulated to occur at any point on the pipe. This crack size is taken to envelope and bound other passive failures to be taken into consideration.

Attachment to GNRO-2012/001 02 Page 5 of 6

4. Probabilistic Risk Assessment (PRA)

To support the use of limited size breaks for GGNS SSW, the likelihood of catastrophic failures has been reviewed. The use of Probabilistic Risk Assessments (PRAs) has been utilized by the NRC and utilities as a state-of-the art tool in predicting the consequences of specific events on nuclear power plant safety.

The GGNS Revision 3 PRA model uses both generic and plant specific data per ASME/ANS PRA Standard. However, the PRA model does not analyze pipe rupture data for internal events PRA models with the exception of Internal Flooding PRAs 1 .

As a result, information in the table below has been obtained directly from the PRA model or from EPRI Report TR-1021086, "Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessments," which develops estimates of piping system failure rates for use in PRAs of accident sequences induced by internal flooding and high-energy line breaks. Utilizing Table ES-2 from the EPRI report for Class 3 BWR Service Water system with river water sources and applied to various SSW A pipe lengths, an annual frequency of 9.10 x 10-03 is obtained. This annual frequency was then converted to a probability in order to provide a comparison between similar data.

The likelihood of failure associated with SSW is summarized in the table below.

SSW hardware failures considers all failures for a single train of SSW such as pump fail to start on demand, pump fail to continue running, or failure of the isolation valve associated with that train.

Failure Probability SSW Hardware Failures 9.15E-04 SSW Failure (pipe rupture) 2.49E-05 It is clear that the most likely failure of SSW is dominated by the hardware failures associated with the system. In addition, when combined with the annual frequency associated with a large LOCA, as defined in PRA-GG-01-001 S06, the likelihood of SSW failure during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period after a LOCA is 2.92E-08/year for hardware failures or 7.95E-10 for pipe ruptures. The results are summarized below and include a frequency calculation associated with all LOCAs at GGNS.

Description Frequency Large LOCA with SSW pipe failure 7.95E-10/year All LOCAs with SSW pipe failure 1.04E-08/year Large LOCA with SSW hardware failure 2.92E-08/year All LOCAs with SSW hardware failure 3.82E-07/year Therefore, the probability of failure of the service water piping during the 24 period after a LOCA is so low that it does not constitute a credible event when compared to service water hardware failures.

1 The GGNS Internal Flooding PRA Model is currently in DRAFT form only. However, the references used for that analysis have been reviewed to obtain an estimated pipe length for SSW A which is used in this evaluation. Specifically, 4'10" of 1",12'3" of 2",92' of 2 112", 343' of 3",

189'10" of 4", 161 '3" of 12", 65'9" of 18", 330'1" of 20" and 36'6" of 24" line was used in calculating the annual frequency for a rupture of SSW A resulting in a 100 gpm release.

Attachment to GNRO-2012/001 02 Page 6 of 6

5. Safety Evaluation Based on the arguments presented in this paper with regard to the use of moderate energy piping failure criteria as delineated in SRP Sections 3.6.1 and 3.6.2 and SECY 77-439, Entergy feels that passive failure of piping, heat exchanger tubes and pipe fittings exceeds the requirement of single failure criteria. In summary, Grand Gulf would consider a single passive failure of the SSW system would be a pump seal or valve leakage after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> during a LOP/LOCA.

6. Calculation of assessment of critical crack in the SSW piping.

The largest pipe is 24 inch schedule 40 pipe. It is a thickness of 0.375 inches. The SSW operating pressure is 110 psig. Putting this in the moderate energy pipe break equation:

Q= (0.6)~( 0.:;5)(~)( ~~)7.48052X60)

The time that it would take for the volume of inventory left is Time = (397763 + 1115480)gallons = 46 hours5.324074e-4 days <br />0.0128 hours <br />7.60582e-5 weeks <br />1.7503e-5 months <br /> g~l )(60 min)

( 540 mm hour Therefore operator response would not have to occur for 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.