LR-N16-0242, Supplemental Response to Preliminary White Finding in Integrated Inspection Report 05000354/2016003; EA-16-184
| ML17003A319 | |
| Person / Time | |
|---|---|
| Site: | Hope Creek  |
| Issue date: | 01/03/2017 |
| From: | Carr E Public Service Enterprise Group |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| EA-16-184, LR-N16-0242 | |
| Download: ML17003A319 (10) | |
Text
PSEG Nuclear LLC P.O. Box 236, Hancocks Bridge, New Jersey 08038-0236 JAN 0 3 2017 I>SEG Nuclear LLC LR-N16-0242 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 Hope Creek Generating Station Renewed Facility Operating License No. NPF-57 Docket No. 50-354
Subject:
Supplemental Response to Preliminary White Finding in Integrated Inspection Report No. 05000354/2016003; EA-16-184.
References:
- 1. Hope Creek Generating Station Unit 1 -Integrated Inspection Report 05000354/2016003 and Preliminary White Finding, November 14, 2016.
- 2. LR-N16-0232, PSEG Response to Preliminary White Finding in Integrated Inspection Report No. 05000354/2016003; EA-16-184, dated December 14, 2016.
By letter dated November 14, 2016 (Reference 1), the U.S. Nuclear Regulatory Commission (NRC) issued Inspection Report 05000354/2016003 completed on September 30, 2016. The inspection report identified a preliminary White finding and associated apparent violation of Title 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," asserting that PSEG did not adequately implement an adverse condition monitoring procedure, specifically for performing monthly oil sampling of the High Pressure Coolant Injection (HPCI) system.
By letter dated December 14, 2016 (Reference 2), PSEG submitted additional information regarding the significance determination of the preliminary finding. The NRC staff raised several concerns regarding the changes made to the PRA model by PSEG, in particular with respect to the use of the condensate system to maintain sufficient core cooling. PSEG is providing information on system design, operator training and procedure guidance in order to address those concerns. The information is contained in Enclosure 1.
There are no regulatory commitments associated with this submittal. If you have any questions, please contact Mr. Thomas MacEwen at (856) 339-1097.
Si~---
Eric Carr Site Vice President Hope Creek Generating Station
LR-N16 - 0232 Page 2 ttm : Supplemental Information Submitted Pursuant to Inspection Report 05000354/2016003, Preliminary White Finding cc: Mr. D. Dorman, Regional Administrator, NRC Region I Ms. C. Parker, Project Manager- Hope Creek Mr. J. Hawkins, NRC Senior Resident Inspector- Hope Creek (X24)
Mr. P. Mulligan, Manager IV, NJ Bureau of Nuclear Engineering Mr. T. MacEwen - Hope Creek Commitment Coordinator (H02)
Mr. L. Marabella - Corporate Commitment Coordinator (N21)
LR-N 16-0242 Enclosure 1 Supplemental Information Submitted Pursuant to Inspection Report 05000354/2016003, Preliminary White Finding Contents 1.0 Introduction 2.0 Operator Response to Medium Break LOCA 3.0 PRA Modeling of Medium Break LOCA 4.0 Plant Response to Loss of TAGS Cooling 5.0 Conclusions
LR-N 16-0242 Supplemental Information Submitted Pursuant to Inspection Report 05000354/2016003, Preliminary White Finding 1.0 Introduction PSEG submitted additional information to the NRC on December 14, 2016, contesting the significance of a preliminary white finding for the Hope Creek High Pressure Coolant Injection (HPCI) system. The NRC staff raised several questions about the medium line break LOCA and the use of the condensate system to provide sufficient core cooling. The following information is provided in response to those questions.
The NRC staff was concerned that the probabilistic risk analysis (PRA) cut sets for plant response to a medium line break LOCA initiating event had been non-conservatively modeled in the PRA that was performed specifically for the significance determination process (SOP). The staff described an event that, on the surface, could seem challenging for the licensed operators to manage effectively. Additionally, the NRC staff was familiar with the simplistic and overly conservative treatment of medium line break LOCA in the original PRA model of record and the simplistic treatment in the NRC SPAR model.
PSEG undertook a detailed review of plant procedures, thermal-hydraulic responses, equipment design and PRA modeling approach. From that review, PSEG concludes that the original treatment of the medium line break LOCA in the PRA model of record was overly conservative and does not properly reflect the current operational strategies for mitigating this event as described in station procedures, and reinforced in training, both in the classroom and in the simulator. The PRA performed for the SOP, while still simplistic, provides a reasonable estimate of the risk increase and thus the conclusions submitted to the NRC on December 14, 2016 are valid.
In the following write-up, PSEG describes the expected operator action using the procedural guidance that was in effect at the time HPCI was inoperable. It also provides information from component vendors and from MAAP analysis for the thermal hydraulic response of the plant. As a result, PSEG believes that the robust plant design coupled with the simple nature of the operator actions, make it highly unlikely that a medium break LOCA is a significant contributor to core damage when HPCI is unavailable. The PRA changes realistically model the plant and operator responses and the following discussion addresses the concerns raised by the NRC staff.
2.0 Summary of Operator Response to Medium Break LOCA The operator actions described below represent the expected response under post transient conditions where: a medium break LOCA has occurred, a 1.68 psig Drywell pressure LOCA signal is received, the Automatic Depressurization System (ADS) does not function due to being inhibited by the operator, HPCI is not available, and offsite AC power remains available to support Balance of Plant (BOP) functions. As described below, these actions are contained in plant procedures and are reinforced through classroom and simulator training where the primary emphasis is RPV level restoration and maintenance to avoid subjecting the RPV to an emergency depressurization transient.
On a 1.68 psig high drywell pressure isolation signal, the reactor scrams, the Safety Auxiliaries Cooling System (SACS) to Turbine Auxiliaries Cooling System (TACS) isolation valves will close, which results in the eventual loss of TACS cooling to the station air compressors, secondary condensate pump (SCP) lube oil coolers, turbine building chillers, and main turbine auxiliaries.
1 of 7
LR-N16-0242 The Emergency Instrument Air Compressor (EIAC) will be load shed, however station EOPs provide steps for restoration of the compressor. In addition, all three RFPs will trip due to loss of both main and aux lube oil pumps from LOCA load shedding of the 108272, 108313, and 1OB323 Motor Control Centers (MCCs). Under these conditions, the Main Steam Isolation valves (MSIVs) and Main Steam Line (MSL) drains do not receive an isolation signal, the SCPs and primary condensate pumps (PCPs) remain in service.
As directed by EOP-1 01, the operator will use Reactor Core Isolation Cooling (RCIC), Control Rod Drive (CRD) and Standby Liquid Control (SLC) to inject into the Reactor Pressure Vessel (RPV) to restore level. Upon recognition that RCIC, CRD, and SLC injection are insufficient to raise RPV level with a LOCA present, the Control Room Supervisor (CRS) will assess the availability of additional sources of RPV injection listed in EOP-1 01. For the conditions present, the CRS would order that the RPV be de-pressurized to the SCP injection pressure (pressure band 450-650 psig) using the main turbine bypass valves. The main turbine bypass valves are a listed depressurization system in EOP-1 01, and are prioritized ahead of emergency depressurization.
The lower end of the pressure band (450 psig) will maintain the cool down rate less than 100 degrees per hour for the first hour of depressurization. Concurrently, per the Transient Mitigation Strategies (OP-HC-103-102-1013) and the system operating procedure (SO.AD-0001) two of the SCPs would be secured to prepare for rotation of the pumps to support RPV injection with no TACS cooling.
When the in-service SCP begins to inject, the CRS will invoke the retainment override step in EOP-1 01 (RC/L-2), to raise RPV level to +90" in anticipation of losing the available injection system. The capacity of the SCP will enable the operator to restore the RPV level to 90" using post-scram RPV level control procedure guidance in OP.AB-0001. EOP steps to bypass the high RPV level shutdown of RCIC may be implemented to prevent an RPV high level shutdown of RCIC. However, with the SCP in service RCIC operation is no longer required to maintain RPV level. When RPV level reaches +90", injection would be secured to prevent filling the main steam lines. If desired to maintain the cool down rate at 100 degrees per hour, water in the RPV would be allowed to boil off with the main turbine bypass valves controlling pressure at -450 psig until the end of the first hour.
As the event progresses, the in service SCP would be secured if still running and RPV injection transferred to Core Spray then RHR as pressure is lowered to below their respective shut off heads. If MSIVs are no longer open, the operator can use the MSL drains as directed by OP.AB-0001 to further reduce RPV pressure since RPV Level 1 conditions have not been reached. In addition, the operator can then place one of the remaining two SCPs in service to restore RPV level to +90 inches while RPV depressurization continues. When RPV pressure reaches 350 psig, Core Spray and/or Low Pressure Coolant Injection (LPCI) is/are placed in service for RPV level control, and the level band would be restored to the normal level band of 12.5" to 54". The lower limit for RPV pressure is -140 psig at the end of the second hour to maintain the 100 degree per hour cooldown rate. . It should be noted that throughout this hypothetical event, if secondary plant equipment failed depressurization, then using ADS could be a possible success path for depressurization. The original Hope Creek PRA simplistically assumed that operators had a maximum time to use ADS of 6 minutes for a medium LOCA or 24 minutes for a steam medium LOCA. In actuality, there are variety of scenarios in which ADS could be used for successful emergency depressurization Between the second and third hours after shutdown, RPV pressure will be lowered to below the shutdown cooling interlock pressure of 82 psig and RHR can be placed in shutdown cooling to achieve cold shutdown.
2 of 7
LR-N16-0242 3.0 PRA Modeling of Medium Break LOCA Introduction The sequence of interest is a medium water LOCA with HPCI unavailable. After transient initiation, once operators recognize that HPCI is unavailable and RCIC is not adequate to maintain water level, operators will reduce RPV pressure using TBVs for SCP injection. If this is not successful procedure guidance is provided to depressurize using ADS to allow Core Spray and/or LPCI injection for sequence success. SCPs may be a long-term low pressure injection source with hotwell makeup from the CST. This is conservatively not considered. Implementation of these actions are contained in plant EOPs and are included in operator training.
Hope Creek PRA Model of Record The original PRA model of record showed a very high contribution to the risk increase from water MLOCA sequences. Five of the top nine risk increase cutsets, summing to a risk increase of about 1.8E-6/yr. or 2.4E-7 for a 49 day period, were from water MLOCAs. The reason for this risk increase was twofold. First, the model assumed that all water MLOCAs with HPCI failed and an operator failure to depressurize using ADS resulted in certain core damage. Second, the probability of the operator failure to depressurize using ADS (PRA event: ADS-XH1-VF-MLDEP, Probability = 3.4E-2) was calculated based on 6 minutes to depressurize.
PRA Performed in Support of the SOP PSEG created an application specific PRA model for the SOP (HC-ASM-003) which removed the extreme conservatisms in the PRA model of record. This model credited secondary depressurization using the TBVs and injection using the SCPs. Use of the TBVs and SCPs was modeled, along with generic equipment failure rates and operator failure rates. With this adjusted modeling approach, the risk increase from medium LOCA scenarios is probabilistically insignificant. However, upon taking a more detailed review of this PRA, it was found that the model did not take into account possible two failures. These include the possibility that the SCPs could fail due to isolation of TACS and the possibility that the MSIVs could close due to low RPV level (possible following a water LOCA, not likely following a steam LOCA). Since the SCP failure or MSIV closing were not modeled and could lead to higher quantitative risk calculations, PSEG undertook an even more detailed analysis.
MSIV Closure The current PRA model assumes that the MSIVs close for all MLOCA-WA sequences, which is conservative. If the MSIVs close, the ability to reduce pressure with the TBVs is not available, and the sequence success relies entirely in the use of ADS for depressurization. This treatment is included in the current SOP results for MLOCA-WA sequences. MSIV closure is dependent on two things- maintaining lA and PCIG to keep them open, and being able to reduce pressure using TBVs prior to hitting -129" when MSIVs go shut. For the large MLOCAs (approximately 5" to 7.4" diameter), the depressurization from the LOCA is adequate to allow SCPs to inject prior to core damage without the explicit need for ADS. For the mid-size MLOCA sizes (approximately 3 to 5 inches), RPV level drops to -129" quickly and operators have a very short window to perform the TBV actions. It is likely in the PRA that the TBV pressure reduction cannot be credited for such mid-size MLOCA breaks. For the small MLOCAs (approximately 1 to 3 inches), the time to -129" is much greater and allows operators adequate time to perform the TBV actions with a similar HEP to 3 of 7
LR-N16-0242 the existing ADS HEP for MLOCA-WA (-1E-2). An engineering judged factor of 0.5 may be applied to represent the conditions that may result in MSIV closure (i.e., failure to remain open during the MLOCA-WA) during the MLOCA-WA sequences and would reduce the dominant MLOCA-WA SOP cutsets using TBVs for pressure reduction. This factor accounts for the plant response that may cause the MSIVs to close (e.g., drift close, delayed restoration of lA or PCIG) as well as accounting for the spectrum of MLOCA break sizes that may cause RPV water level to drop below -129" prior to operator TBV manipulation for pressure reduction.
Conditional Probability of MLOCA Break Size As described above, the MLOCA-WA represents a spectrum of break sizes. For the larger MLOCAs, the depressurization due to the break is adequate to reduce pressure to the Core Spray shutoff head. For the smaller MLOCAs, adequate time is available to depressurize to the SCP shutoff head prior to reaching -129". A conditional probability could be calculated based on break size frequency for the MLOCA-WA spectrum to represent the different responses based on break size. This would be a basic event separate from the MSIV failure to remain open basic event described above and inclusion of such a new basic event would result in reduced importance of the MLOCA-WA sequences. The break size considerations are conservatively included in the 0.5 factor discussed in the MSIV Closure section.
Pressure Reduction using TBVs as a Separate Action The sensitivity case conservatively assumed that the failure to reduce pressure using the TBVs is the same as the failure to depressurize using ADS. They are lumped into the same basic event in the PRA. Plant EOPs show that these two actions are performed as unique, separate steps at different times in the accident sequence. It is acknowledged that since the same crew is performing these actions and these actions are included in the same EOP leg, there is a dependency between these actions that should be included. The dependency is judged to be small relative to the individual ADS and TBV HEPs, especially if a conservative screening HEP is selected for the TBV HEP. A realistic approach would be to model the pressure reduction using TBVs as a single basic event, and model the emergency depressurization using ADS as a single basic event. The addition of the TBV basic event would reduce the dominant MLOCA-WA SOP cutsets involving a failure to depressurize using ADS. Cutsets for MLOCA-WA where previously only failure to depressurize basic events were present would not include the failure of MSIVs to remain open and failure to reduce pressure using TBVs.
Effect on SOP Results If the 0.5 factor for MSIVs fail to remain open during the sequence, the five dominant MLOCA-WA cutsets would include the events that include a MLOCA-WA and the failure of the MSIVs to remain open. Using the 1.8E-6 risk increase from the PRA model of record, this failure scenario risk increase is (1.8E-6
- 0.5) = 9E-7/yr. The additional contribution to CDF for these scenarios where MSIVs remain open (probability also equal to 0.5) would include the failure to reduce pressure using TBVs. If a conservative screening value of 0.1 is used for the HEP failure to reduce pressure using the TBVs on the MLOCA-WA sequences, the contribution becomes (1.8E-6 *
=
0.5*0.1) 9E-8/yr. The CDF contribution from these five MLOCA-WA cutsets, using the conservative factors described above, is 9E-7/yr + 9E-8/yr = 1E-6/yr. Using 0.5 as a split fraction for failure to depressurize through the MSIVs is conservative for the reasons described above and because the PRA model does not explicitly credit using MSL drains for pressure control.
4 of 7
LR-N16-0242 For 49 days, the contribution to delta CDF for the MLOCA-WA sequences is calculated to be 1.3E-7, which would be considered a bounding calculation. However, PSEG agrees that the calculation in HC-ASM-003 contains potentially non-conservative modeling approaches and should be reviewed before it is incorporated into the updated PRA model of record. Adding this 1.3E-7 to the previous risk calculations submitted to the NRC on December 14, 2016 would not change the conclusion. A more detailed modeling approach would certainly yield less than a 1.3E-7 risk increase because of the conservatisms in the failure to depressurize human error calculations.
Therefore, PSEG's best available calculation for the risk increase associated with HPCI unavailability is reflected in the values submitted on December 14, 2016.
4.0 Plant Response to Loss of TACS Cooling Primary Condensate pumps:
The motor stators are air cooled.
The upper bearing is in an oil reservoir which is air cooled.
The lower bearing is a ball bearing and will continue to operate until the grease reaches its drop point and the oil melts out of the grease.
The pump packing receives injection water from Condensate Transfer.
The pump bearings are cooled and lubricated by process fluid, and will continue to be cooled as long as the pump is in service.
The Primary Condensate pumps will continue to operate for their mission time even with the loss of T ACS or Condensate Transfer.
Secondary Condensate pumps:
The motor stators are air cooled. The ventilation system will continue to operate, but will have decreased cooling capacity due to a loss of chilled water, stemming from the loss of TACS. The decreased ventilation cooling is minor compared to the loss of bearing oil cooling, and is considered bounded by the oil heat-up.
The pump mechanical seal is cooled by pump discharge water. The mechanical seals will continue to be cooled as long as the pumps remain in service.
The bearings for both the pump and motor are cooled by the lubricating oil which is cooled by TACs.
- 1) The heat exchanger removes 42,300 Btu/hr. EG-020
- 2) Kingsbury uses 320 F bearing metal temperature for the temperature that a babbitted bearing will fail. Assuming a 20 F difference between metal and oil temperature, we will use 300 F oil temperature to represent failed bearings.
- 3) The secondary condensate pump oil reservoirs hold 37 gallons. Lube Screen
- 4) Density of Exxon Teresstic 46 is 7.25 lb/gal. Internet
- 5) Specific Heat for Exxon Teresstic 46 is 0.472 Btu/Lb F. Internet
- 6) Assume the starting oil temperature is 100 F.
- 7) Using Q=mcdT, it will take 36 minutes for the bearings of the secondary condensate pump/motor to fail if TACs cooling is removed. This is conservative because it assumes no radiant heat loss or changes in the convection heat loss due to higher oil temperatures. NOTE: In 2004, Exelon did a study of an Auxiliary Feed pump at Byron Station, which has many similar design features, operating with its cooling water isolated. The study concluded that the pump would not fail. The study determined that 5 of 7
LR-N16-0242 as the oil temperature rose, the oil got thinner; therefore, more flow, and more convection cooling. Also as the oil temperature rose, radiant heat dispersal from the oil system rose. Ultimately, oil temperature stabilized at a new equilibrium temperature below the Babbitt failure temperature.
The Secondary Condensate pumps will continue to operate for at least 36 minutes with the loss of TAGS.
Station Air Compressors:
The station air compressors have high pil temperature trip at 135 F. Using Q=mcdT, it will take 3 minutes for the oil temperature to reach the high oil temperature trip setpoint if TAGs cooling is lost.
Following the trip of the in-service air compressor, the standby air compressor will start and will run for an additional 3 minutes. Hope Creek also has an installed Emergency Instrument Air Compressor. The EAIC is not cooled by TAGS, however it is locked-out on a high drywell pressure signal. Procedure guidance is provided to the operators to restore the EIAC following a lock-out. The estimated time to restore the EAIC to service is 47 minutes. Based on these times, the instrument air system will be unavailable sometime after 6 minutes, following depressurization of the system air receivers, until the EIAC is restored at approximately 47 minutes.
Impact of loss of Instrument Air:
- The Condensate demineralizers at Hope Creek use motor operated isolation valves, and will remain in service on a loss of instrument air.
- The minimum flow valves for the Secondary Condensate pumps will fail open, protecting the pumps from a dead head condition. The minimum flow line connects inboard of the pump discharge check valve. With SCP in service, the discharge check valves on the idle pumps would still enable SCP flow to the RPV. Operators also have the ability to manually isolate the min flow lines in the Turbine Building to ensure full SCP flow to the RPV under these conditions.
- The startup level control valve will fail closed, however, condensate flow can established to the RPV using the SCPS and the AE-HV-17 44 #6 FWH outlet bypass valves. These MOVs would be open and closed by the control room operator to batch feed the RPV to maintain the required RPV level band. This would result in a flow path through the idle RFPs. If required, lAW Attachment 14 of HC.OP-AB.ZZ-0001, the operator can open AE-HV-1786 (which bypasses the RFPs) for RPV level restoration if needed.
- The outboard MSIVs will fail closed, however a depressurization pathway to the main condenser is still available via the MSL drains.
The condensate system flowpath to the reactor vessel will still be available and functional without instrument air.
6 of 7
LR-N16-0242 5.0 Conclusion The Hope Creek PRA model has been corrected to include actions that operators would take in accordance with procedural guidance and training, to provide sufficient core cooling using all available means. The model, when accounting for these procedurally driven and trained actions, is a more accurate representation of the actual probability of core damage under the given conditions. The actions to reduce pressure using Turbine Bypass Valves is separate and distinct from Emergency Depressurization, and therefore should be treated as a separate and distinct operator action with corresponding probabilities of success, including human performance error probabilities.
The plant and operator response, as described above, and in the December 14, 2016 letter, represent a more correct assessment of the impact on CDF as compared to the SPAR model.
PSEG requests that the NRC use the most correct means available to assess the significance of the subject event. PSEG has concluded that the above assessment provides this means.
7 of 7