ML17305B338

Justification for Continued Operation - Potential for Small Break Loss of Coolant Accident Due to Tube Rupture in Reactor Coolant Pump Seal Cooler

ML17305B338
Person / Time
Site:	Palo Verde
Issue date:	01/18/1991
From:	ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR
To:
Shared Package
ML17305B337	List: ML17305B336 ML17305B338
References
NUDOCS 9101290348
Download: ML17305B338 (44)

Text

Justification for Continued Operation Potential for Small Break Loss of Coolant Accident Due to Tube Rupture in the Reactor Coolant Pump Seal 'Cooler Director Director

Nucl, regin ring PRB Chairman rrcl fety'ic 9101290348 910118 PDR

.ADOCK 05000528

~ P PDR

Executive Summary During review of NRC Information Notice No. 89-54 "Potential Overpressurization of the Component Cooling Water System," Arizona Public Service identified a scenario in which a break in the reactor coolant pump high pressure seal coolers (HPSC) could potentially result in a reactor coolant system (RCS) leak being released outside of the containment building.

The scenario involves a leak from the reactor coolant pump HPSC into:the lower pressure nuclear cooling water (NC) system.

The resulting leak could potentially overpressurize the NC system.

If this were to occur, and the NC containment isolation valves were unable to shut against the pressure or flow, and the operators were unable to identify the leaking seal cooler and isolate the leak with the seal cooler isolation valves, it could result in reactor coolant being discharged from the NC surge tank relief valve on the auxiliary building roof. APS has performed an analysis of this scenario and determined that continued operation is justified on the basis of the following:

There has never been a high. pressure seal cooler leak in an ABB/Combustion Engineering plant.

A search of INFO Nuclear Plant Reliability Data System (NPRDS), Nuclear Power Experience (NPE), and Licensee Event Reports (LER) data bases revealed only one instance of an inservice pressurized water reactor seal cooler tube leak. That leak occurred in 1970 at the Beznau Unit 1, a Westinghouse plant in Switzerland.

APS performed a structural evaluation of the RCP seal cooler heat exchanger using the methodology of leak before break outlined in NUREG/CR-4572 "NRC

'Leak-Before Break (LBB.NRC) Analysis Method for Circumferential Through-Wall Cracked Pipes Under Axial Plus Bending Loads," and the acceptance criteria of NUREG 1061 "Evaluation of Potential for Pipe Breaks."

The results of this evaluation are:

(1) the stresses in the RCS seal cooler piping (ASME Class I.

piping) are low enough that no mechanism (for example vibration, thermal cycling, etc.) could be identified which would result in propagation of an existing flaw (2) the austenitic stainless steel used in the seal cooler piping is resistant to corrosion and erosion/corrosion damage (3) any significant flaw in the piping will produce detectable leakage, with sufficient time for operator action to isolate the source of the leakage or shutdown and depressurize the RCS, prior to the flaw propagating to a critical size (a 0.84 inch circumferential crack which is equivalent to a 1.3 gpm leak).

The double ended shear of HPSC tubing was evaluated to address concerns over possible fuel failure by examining the spectrum of break sizes evaluated for a small break loss of coolant accident (LOCA). A failure of the RCP HPSC would correspond to a break size of 0.0043 ft'.

The smallest break size evaluated for small break LOCA analysis is 0.02 ft', and does not result in fuel failure.

This

4i S

break size bounds all break sizes less than 0.02 ft, and is therefore considered bounding for the subject event.

Based on this analysis, the high pressure seal cooler failure.event would not result in fuel failure.

An analysis of the radiological consequences of a postulated catastrophic (double ended shear) RCP seal cooler'leak was.performed using the highest current RCS activity level among the PVNQS,units and the highest iodine spike multiplier observed from trips in the previous year.

The results of this analysis demonstrated that the 2'hour cumulative thyroid dose at the exclusion area boundary would 'be 10.2 rem and the low population zone 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> cumulative thyroid dose would be less than 13 rem.

These values are a small fraction of the 10 CFR 100 dose limit of 300 rem.

A probabilistic risk assessment (PRA) of the worst case scenario was performed, without consideration of the leak before break analysis.

The PRA results indicate that. during the next 30 months (maximum anticipated time required to design and'mplement corrective action) the probability of having this event scenario at Palo Verde is 3.6E-4. 'This is considered a low probability for non core melt sequences and the potential risks imposed on public health and safety. during the JCO duration is, therefore, judged to be minimal.

Compensatory actions have been taken to, change operating procedures to require initiation of a plant shutdown within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of detecting. activity from the RCS into the NC system.

There are two methods available for. detecting, activity. The first method is an on-line radiation monitor which provides continuous monitoring of the NC system.

This. monitor will alarm in the control'oom within one hour (with current RCS activity. levels) for the minimum detectable leak required per NUREG 1061.

The second method is a once per, shift sampling of the NC system for activity.

Radiochemical analysis of the sample provides confirmation of the radiation monitor operation and is capable of detecting the minimum detectable leak required per NUREG 1061. Ifcontamination of the system from short half-life fission products (indicative of an. RCS leak) is detected actions willbe initiated during and following plant shutdown to locate and isolate the leak using the seal cooler isolation valves.

The ability to detect a leak within six hours (five hours maximum time between samples and'ne hour to,perform analysis) will ensure there is adequate time for operator action prior to the leak propagating to a point where the NC system would be overpressurized.

The analyses show that there is a low probability of a tube leak developing in the RCP seal coolers and that the leak would be detectable long before it could propagate to a critical size or result in over pressurization of the NC system.

The compensatory action to shutdown the plant followed 'by.seal cooler isolation and RCS depressurization in the event of a detectable leak will prevent a catastrophic failure.

The analyses also 11

demonstrate that in the unlikely event of a catastrophic failure of the RCP seal cooler, based on current RCS activity levels and previously observed iodine. spike'evel, the radiological'consequences would be a small fraction of the 10 CFR 100 dose limits. The above, analyses and'ompensatory actions demonstrate that continued operation" until design changes. can. be implemented to correct the, problem does not involve a significant increase in risk to the health and safety of the public. The design and implementation of corrective action for this potential problem. is anticipated to be complete within, the next.

30 months.

111

4>

I. Equipment Description A. Shaft Seal S stem A mechanical seal arrangement is used to seal the reactor coolant pump shaft.

This seal arrangement acts as a pressure boundary between the RCS and the containment while minimizing RCS leakage along the pump shaft.

Mechanical seal operation depends on two basic elements.

These are a rotating seal face which is attached to the pump shaft and a,stationary seal. face attached to the pump body, A liquid Qlm is established between these two faces.

This Qlm layer acts to lubricate the faces thus preventing wear and also minimizes or prevents leakage.

The seal materials consist of carbon for the rotating ring and titanium carbide for the stationary ring.

'The CE-KSB pump uses a system of three seals (Figure 1) in series to accomplish sealing.

Each seal by itself, is capable of providing full sealing capabilities.

During normal

'operation however the pressure breakdown across the seals is divided.

Each of the two hydrodynamic seals provide for a 42% pressure drop (945 psid) with the vapor seal providing 16% (360 psid).

The pressure drop across the seals is established'y the use of throttling devices in a controlled leakage bypass system.

Controlled bleedoff leakage is normally 4 gpm and:is piped to the Volume Control'Tank.

This controlled bleedoff is referred to as staging flow.

High pressure, filtered seal water is normally provided to the seals from the charging

pumps, Seal injection water enters at a point below the water lubricated journal bearing, passes through a jet pump, and is directed to the high pressure cooler.

The injection water acts as the driving fiuid in the jet pump with the effiuent from the water lubricated journal bearing being the driven fluid. This promotes circulation through the high pressure cooler and aids in cooling the journal bearing.

The effiuent from the high pressure cooler enters the high pressure. side of the first seal and is divided into two flow paths.

The majority of the fiow is pumped through the journal bearing by the auxiliary impeller, thus providing cooling for the bearing. A portion of this water then leaks past the shaft into the RCS.

This prevents the ingress of contaminants from the RCS to the sealing system.

The second flow path, referred to as staging flow, provides pressure staging and seal cooling. The staging flow path around the seals is required for seal pressure distribution. The staging flow continues through -the two throttle coolers to the high pressure side of the third seal and then to the volume control tank (VCI').

Approximately 7 gpm of seal injection water at 120'F is normally provided. Of this, 4 gpm is for controlled leakage with the remainder flowing into the RCS as mentioned above.

I '

~

~

I

~

~

0 ~

0

~

e

1r

B. Hi h Pressure Cooler The High Pressure Seal Cooler (Figure 2) is composed of a 75 inch long, 12'nch

diameter, outer shell (NC pressure side)

- with.a seamless stainless

steel, continuous, helically wound,,1.25 inch outside diameter Schedule 80 internal tube (RCS pressure side).

The high pressure tubing-enters the bottom through a,sleeve which is seal welded on both the inside and. outside to,the tube.

The sleeve acts as a guide and brace for the high pressure tube.

The tube continues straight up,to the upper-section of the shell passing through another sleeve which guides and supports 'it..At the upper section of the shell the high pressure tube divides into two tubes helically wound: downward through supports running the entire length of the cooler,.and exits the shell'at.the bottom through a sleeve where the sleeve is again welded.to the tube both inside and.outside the. shell thus acting.

as.a guide and support.

The supports-and clamps prevent movement of the high pressure tubing.

Nuclear Cooling Water is introduced into.the cooler at the top and channeled 'to the bottom of the shell.

The nuclear cooling water channel has a number:of diffuser holes at the bottom which redirect the flow upward and past the high pressure helically wound tubing.

The nuclear cooling water exits the shell at the top.

The cooler is built in accordance with ASME Sec. III, 1974 Ed.

The primary (high pressure) coil is Class 1.

The secondary side (shell) is Class,3.

The internal tube support/coil clamps are designed and constructed in accordance with Subsection NF for component supports..

The HPSCs are provided with inlet and outlet isolation valves on the RCS side.

The isolation valves" are 1 inch, motor operated, globe valves.

The materials of construction are in. accordance with ASME Section III requirements for Class 1 valves with a, design pressure and temperature rating. of 2485 psi at 650'F.

Operability and function are not impaired, by SSE seismic loads.

Isolation of the seal coolers to prevent exceeding RCS leakage limits was not considered an accident mitigation safety function in the original design basis, therefore, the motor operator and power supply are not Class 1E qualified..

The motor operators are sized to close against a 2500 psi differential'pressure.

4k

,I

NUCLEAR COOL ING WATER OUTLET~~

~ NUCLEAR COOL.ING WATEP.

I NLET r

~

~,

GUIDE AND SUPPORT SLEEVE OUTER SHEL'L TUBE SUPPORT CLAMPS HELICALLY WOUND SEAMLESS STAINLESS STEEL TUBING 0

SLEEVE SEAL WATER INLET SEAL WATER OUTLET MllQH !FIRKSSURK SERE.

C(L'KR Figure 2 4,

4l

C. Nuclear Coolin Water S stem The NC system circulates water in a closed loop to collect heat 'from the normal operating nuclear-related equipment and reject it.to the plant cooling (PW) water system.

Two pumps, two heat exchangers, one surge tank, one chemical addition tarik, and necessary piping, instrumentation, and controls comprise the components in the system.

The surge tank is located on the roof of the auxiliary building and establishes the net positive suction head pressure of the circuit. It serves as a: reservoir for expansion and contraction of the cooling water and as a convenient location to introduce makeup to compensate for any, system losses.

Makeup is provided by the demineralized water system and the makeup line is sized for a nominal Qow rate of 50 gal/min.

The surge tank is designed for a maximum pressure of 15 psig and has a relief valve with a setpoint of 10 pslg.

Chemicals for corrosion and pH control are added to the cooling water via the chemical addition tank.

To detect the level of radioactivity in the cooling water, the NC is equipped with a radiation monitoring system which is further described in Section IV.A.3.

The following components are cooled by the NC:

Reactor coolant pump seal: throttle coolers Reactor coolant pump HP coolers Reactor coolant pump thrust bearing oil coolers Reactor coolant pump. motor air and oil coolers Letdown heat exchanger Gas stripper Boric acid concentrator Radwaste evaporator package Waste gas compressors and aftercoolers.

Nuclear sampling coolers Fuel pool cooling heat exchangers Control element drive mechanism (CEDM), normal air cooling units (ACUs)

Normal chillers Auxiliaty steam vent condenser

4l

Auxiliary-steam radiation monitoring. system cooling. coil Steam generator blowdown (nonnuclear) sampling coolers The NC system provides. cooling water to the RCP throttle coolers, cooling the seal water to. the second and third stage seals. The seal water"Qows through 0.14 inch diameter tubing helically wound through, NC cooled Quid chambers integral to the assembly housing.

Postulation of a guillotine rupture of the throttle cooler tubing results in an estimate leak rate of only 2.1 ibm/sec.

Leakage of this small magnitude would not result in overpressurization of the NC system and can be isolated by the NC containment isolation valves.

The components, other than the HPSC, which contain and/or interface with. RCS fluid are located outside of containment and are isolable such that any consequences of a heat exchanger rupture'would, be within theexisting design basis.

A qualitative assessment of the impact of the.overpressurization of the NC system indicates

,that this postulated event does not-challenge the integrity of-the NC to Essential Cooling Water (EW) isolation valves. The initial in-leakage into the NC system of 58 ibm/sec would displace the gas in the NC surge tank in slightly less than one minute.

The NC system has 38 relief valves with a cumulative relief capacity of approximately 480 gpm, which slightly exceeds the in-leakage for the RCS seal cooler leak. Therefore, once the system goes solid the pressure will increase until the. pressure reaches

a. steady-state condition equal to the setpoint of the. highest set relief valve of 110 psig.

The pressure rating of the system'nd the NC/EW isolation valves are not exceeded.

The NC/EW,isolation valves were hydrostatically tested with the disc in the fully closed position to 165 psig.

The overpressurization willnot extend-into the safety-related EW system. Ifthe surge tank were to fail, the steady state pressure in the NC system would be even less.

II. Safety Function The only active safety function associated with the.nuclear cooling.water system is containment isolation, provided by the containment isolation valves and the connecting piping.

III. Postulated Event'cenario The design basis of the HPSCs as described in the Combustion Engineering Standard Safety, Analysis Report and the NRC Safety Evaluation Report was that any leakage from the RCS would be detected by. a combination of the nuclear cooling water system. radiation monitors and the high. surge tank level'switches.

Both high radiation and, surge tank level alarm in

~k

~i

the control room.

Once leakage is detected it would be-isolated using the HPSC isolation valves.

The possibility of a tube rupture in the seal cooler and its subsequent effect on the nuclear cooling water system was not considered in the design.

During a review of NRC Information Notice 89-54 it was determined that a catastrophic failure of a high pressure seal cooler tube could result. in overpressurization of the NC system and the potential existed for a leakage path outside of containment.

This failure would result in high pressure and temperature RCS Quid entering the low,pressure, low temperature Nuclear Cooling Water (NC) system piping. Figure 3 depicts a possible RCS leakage Qowpath outside containment via the NC system.:Most of the RCS leakage would flow from the RCP body through clearances between the, impeller hub and bearing sleeve, through a clearance between the bearing sleeve and stop seal, into a flow passage in the bearing sleeve, and through drilled clearances in the RCP seal housing. This leakage would then proceed to the HP Cooler via the HPSC inlet valve (and the associated jet pump).

Aparallel Qowpath would also be established past the journal bearing and the HPSC outlet valve.

Calculations using two phase choked flow models, assuming only the hydraulic resistance of the limiting restriction in the flow path, indicate the initial leakage flow rate through a doubled ended guillotine break of the tube would be approximately 58 ibm/sec.

Since containment isolation valves NC-401, 402 and 403 are not designed to isolate against RCS pressure, RCS fluid from the tube failure is postulated to flow into the NC system providing a potential release path. outside containment through the lowest set pressure relief valve (i.e,, PSV-72) located. on, the NC surge tank on the auxiliary building roof. This relief valve (set at 10'PSIG) discharges to,an open atmospheric scupper on the auxiliary building roof.

Since the magnitude of the break exceeds the capacity of the PSV-72 the design pressure of the surge tank (i,e. 15 psig) would'be exceeded.

In addition to the above, a postulated catastrophic high pressure cooler tube rupture may simultaneously initiate degradation of. the RCP'seals.of the affected pump because cooling and lubricating flow would be diverted to the break and any residual fluid remaining in the seal housing would be evacuated via the auxiliary impeller in the RCP seal housing.

However, this degradation does not increase. the radiological consequences of this event since the leakage is confined to containment.

This event would be a small break LOCA based'n the criteria specified in procedure 4XEP-XZZ01, "Emergency Operations" and the operators would respond by entering and executing the actions &om procedure 4XRO-XZZ08, "Small Loss of Coolant Accident."

RCP alarm response procedures would direct the operators to close the seal cooler isolation valves to terminate the event.

The valves are designed to operate against full RCS

pressure, however they do not receive emergency power. Iffor some reason the affected, HPSC could not be isolated, the RCS would be depressurized to allow the NC containment isolation valves to be closed isolating the leak.

4b t

BUR;NG SEAL INJECTION PSV-414-417 T::cR!PAL

'REL IEF VaLVE CSAS CLOSES

~

NC'eYS SUPPLY HlGH PRESSURE

,COOLER I

V118 UV 401

,...CSAS CLOSES M

M RCP SHAFT FIRST STAGE S" AL TO CBO AND VCT REACTOR COOLANT PUMP CYCLONE FILTER T02 I

C'

, CJ

<03' 402 PSV 72

,'ATMOSPHERE 0

AUX BLOG RCG ROOF TANK JOURNAL BEAR 1NG

'RC-450-453 LIMITING RESTRICTION JET

~

~

0.709 INCH ORILLED

.PUMP PASSAGE 'WAY

. TO I

IMPELLER SEAL INJECTION FROM CHARGING PUMPS REACTOR COOLANT Nl)QRI tPRKSStNRK

'COOLKIR'KAlL IIM4tECVljH AM@

lMC II'ILOR'%VRIES Figure 3

IV. Engineering Evaluations A. Structural Evaluation of HPSC The leak progression for -piping is the development of a through wall'rack which propagates in a circumferential direction.

To initiate this,progression, there must be; (1) a Qaw in,the piping, (2) a forcing function to stress. the pipe, (3) enough forcing function cycles to fatigue the pipe and cause the crack.

Flaws may be the result of manufacturing defects, corrosion, or man made during installation or,maintenance.

Temperature

changes, pressure

changes, and vibration are examples of forcing functions.

1. High Pressure Seal Cooler Design and. Manufacturing Evaluation - The seal coolers ere designed and constructed in accordance with ASME,Section IIISubsection NB (Class 1). for the primary side and Subsection ND (Class 3) for the cooling water side.

The design conditions are:

Primary Side:

Design Pressure Design Temperature 2500 psia 650'F Secondary Side:

Design Pressure Design 'Temperature 150 psig 250'F The seal. cooler speciQcation required design stress analysis in accordance with paragraph NB 3400 for loads associated with,design, normal, upset, emergency, faulted and test condi-tions.

In addition an analysis was performed demonstrating the cooler and internal tube bundle to be rigid and therefore not subject to cyclic fatigue due to vibration.

The specification required the vendor.to provide a manufacturing and testing records package to include certiQed milltest reports, radiographic evaluation reports,,hydrostatic test results,,non-destructive examination (NDE) results.and ASME Manufacturers Data Reports.

A listing of the contents of the records package and,a CertiQcate of Equipment were re-viewed by APS and, the acceptance criteria-were met. These ASME requirements for Class 1.components, provide assurance as to the high integrity of-the seal coolers.

Engineering has also 'reviewed the operational work history of the high pressure seal cool-ers.

The results of the review indicated that no tube leak problems to date have been reported for the seal coolers, in any of the:three units.

,9

Ol

ASME Section IIISubsection NB,. paragraph NB-3222,4, requires the performance of a cy-clic loading analysis on. Class I components.

Paragraph NB-3222.4 (d) allows exclusion of the fatigue analysis if six conditions are met.

The cooler design successfully met the code exclusion criteria, and therefore no additional analysis was required.

Engineering reviewed the calculations performed to support the exclusion, to determine the sensitivity of the calculation as it might apply to the. leak-before.-break (LBB) analysis. The exclusion analysis included the design thermal and mechanical loading'cycles, imposed on the cooler during the life of the plant. A conservative number, of plant. start-ups and shutdowns, loss of seal injection, and loss of cooling water events were assumed in the analysis.

A review of the type of loadings which might occur 'in the time period between detection of a leak and shutdown of the plant was performed.

Using the same criteria used in the original analysis it was determined that considerable design margin exists and no adverse cyclic loading is

.probable.

The high pressure cooler design report included a vibration analysis of the cooler assembly and of the tube bundle.

The cooler assembly was included in the overall model of the high pressure cooling water piping system.

The report indicated a minimum frequency of 35.2 Hertz for the piping.

This places the piping in the rigid frequency range.

Afinite element, vibration analysis of the cooler tube bundle was also included in the HPSC design.

The analysis resulted in a first fundamental frequency of 33.08 Hz, confirming the rigidity of the tubing conflguration, Since the design of the cooler minimizes the fatigue cycles it is very unlikely that any flawed tubing inside the reactor coolant pump seal cooler would develop a leak or break.

Conservatively, a fatigue crack was still assumed to be present for the leak-before break scenario.

2. Potential High Pressure Seal'Cooler Degradation Mechanisms - Two potential damage mechanisms were evaluated for applicability to the seal coolers.

Stress corrosion cracking and erosion/corrosion of Type 347 austenitic stainless steel tubing were determined not to be damage mechanisms which would degrade the integrity of the coolers.

Stress corrosion cracking (SCC) is a damage mechanism that requires the simultaneous action of a corrosive agent and a sustained tensile stress.

SCC may occur in combination with hydrogen embrittlement, whereby the atomic hydrogen interacts with the metal to induce subcritical crack growth leading to fracture. Austenitic stainless steels are generally considered immune to hydrogen embrittlement.

The HPSC tubing material is manufactured to the ASME SA-213 TP 347 specification for seamless tubing. The Type 347 material is a solution annealed, carbide stabilized, austenitic stainless steel which provides superior resistance to SCC and hydrogen embrittlement.

Additionally, strict chemistry controls on the RCS are maintained to limitthe presence of halogens and dissolved, oxygen.

Chemicals for corrosion control and pH are also added.to the nuclear cooling water system via the NC chemical addition tank.

10

li 4i

Erosion/corrosion is a Qow assisted form of corrosion.

This form'f degradation occurs primarily in carbon steel'pplications as a result of the generation of a passive film (e,g.magnetite) on. the internal surface of the pipe, which can be removed by the flowing water.

Important parameters influencing this phenomena are material properties, hydrodynamics, and water chemistry. Austenitic stainless steels are considered very resistant to erosion/corrosion compared'to carbon steel. because of the. their stable chromium oxide surface Qlm. The Quid Qow velocity through the seal, cooler tubing is only approximately 9 ft/sec.

Primary water chemistry. requirements include maintaining pH above 6.9 and dissolved oxygen below 0.1 ppm (steady state).

Consideration of these parameters indicates that the seal: cooler tubing is not likely to be subject to erosion/corrosion;

3. Leak-Before-Break Evaluation - If a leak were to develop by some preexisting flaw or unidentified mechanism the low stresses in the. piping would result in a,stable crack, up to a leak rate of approximately 1.3 gallons per minute (gpm).

This stable crack size was determined using the methodology of NUREG/CR-4572 "NRC Leak-Before Break (LBB.NRC) Analysis Method for Circumferential Through-Wall Cracked Pipes Under Axial Plus Bending Loads,"

which includes loads during normal'operation and. a, safe shutdown earthquake.

NUREG 1061 "Evaluation of Potential for Pipe Breaks,"

requires the application of a factor of safety of'.two to the critical crack size to arrive at a leakage crack size.

The resulting leak rate including,this safety factor is 0.8 gpm.

Recognizing that the tubing would leak before breaking, NUREG 1061 requires that the leak detection system utilized be capable of detecting a leak equivalent to one tenth of the leak rate expected'rom the leakage crack size.

In this case that value would be 0.08 gpm.

On-line radiation monitoring and -chemical sampling are capable of detecting leakage at this level.

The Nuclear Cooling Water System is a closed loop cooling system which.provides cooling water to numerous heat exchangers that contain radioactive water.

The NC system is constantly monitored by an on-line radiation monitor (RU-6) which alarms in the control room when the cooling water activity reaches a maximum preset level of 7E-'6 uci/cc. The radiation monitor is capable of detecting an RCS in-leakage of 0.08 gpm within one hour after the leak begins. IfRU-6 is out of service chemical sampling willbe performed which will detect this in-leakage rate within a period of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of leak initiation.

B. Radiolo ical Evaluations A conservative evaluation~of the radiological. consequences of a postulated guillotine rupture of the high pressure seal cooler tubing has been, performed.

This evaluation used a

constant, continuous reactor, coolant leakage rate to the atmosphere of 58 ibm/sec and accident. dose parameters (iodine spiking factors, reactor coolant activities corresponding to one percent failed fuel, no operator action to isolate the break etc.) as specified in the Standard Review Plan (SRP) for, Chapter 15 accident analyses.

The evaluation assumed a

11

I C,

I

100% of the leakage was released to atmosphere and took no credit for iodine partitioning factors.

This evaluation, indicates that Exclusion Area Boundary (EAB) cumulative dose would exceed regulatory limits of 10'CFR 100 for dose to the thyroid within the first 30 minutes of the event. If iodine partitioning factors were considered in this analysis the results would be less than the 10 CFR 100 limits.

A more realistic evaluation of the consequences of the postulated guillotine rupture of the seal cooler tubing was performed using PVNGS speciQc or existing conditions rather than the conservative parameters speciQed in the SRP. This evaluation utilized an iodine spiking factor of 40, iodine 131 dose equivalent concentration of 8.OE-2 uci/ml and a maximum number of failed fuel pins currently estimated to exist at any-of the 3 PVNGS Units of 8; all based on actual PVNGS data.

An initial;, continuous reactor coolant leak rate to the atmosphere of 58 ibm/sec (i.e. no credit taken for reduced leak rate due to system depressurization), no.operator action, n'o,partition factor, and accident (SRP specified) X/Q values were conservatively used.

This more realistic evaluation results in radiological consequences which are a small fraction of 10 CFR 100 limits. The EAB 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> cumulative thyroid dose would be 10.2 rem and the Low Population Zone (LPZ) 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> cumulative thyroid dose would be less than 13 rem. 'The control room doses were calculated to be 1.9 rem thyroid dose for the duration of 30 days.

An evaluation of the consequences of small leakage through the high pressure seal cooler tubing has also been performed, recognizing that leak before break criteria can be demonstrated.

This evaluation was based on a

constant leak rate of 1.3 gpm.to conservatively bound the maximum stable crack size leak rate analyses.

This evaluation assumed reactor coolant activity corresponding to one percent failed fuel, a partition factor coefficient for iodine species of 0.01, and accident X/Q values.

The results demonstrate that for this most realistic scenario evaluated, the radiological consequences are well below 10 CFR 20 and 100 limits. The EAB 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> cumulative thyroid dose would be on the order of 1.7E-5 rem and the LPZ 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thyroid dose on the order of 4.1E-5 rem.

Due to uncertainties in the failed fuel predictions,, the spiking factor, and to eliminate any undue risk to the public, PVNGS operations will monitor failed fuel and RCS I-131 dose equivalent concentration levels. If these values exceed a level of 2E-1 uci/cc RCS I-131 dose equivalent, engineering will reevaluate the JCO and if deemed necessary add compensatory actions.

This activity level will ensure offsite doses willbe limited to a smaH fraction of 10 CFR 100 limits.

Based on these evaluations, it is concluded that although the consequences of a postulated guillotine rupture of the seal cooler tubing using SRP speciQed parameters exceeds regulatory limits, the more realistic evaluation of this postulated event using actual and specific PVNGS data demonstrates radiological consequences below 10 CFR 100 limits. An evaluation of small leakage based on the application of leak before break, demonstrates radiological consequences below 10 CFR 20 limits, 12

~ >

L

D. Probabilistic Risk Assessment RA of Catastro hie HPSC Tube Ru ture This scenario is evaluated from the standpoint of event likelihood and probability of failure to isolate the break.

The radiological evaluation using worst case assumptions and postulated guillotine rupture of the high pressure seal cooler tube indicates that EAB cumulative dose would exceed the regulatory limits of 10 CFR 100 to the thyroid within the Qrst 30 minutes of the event.

The associated worst case scenario is. evaluated in this section.

1. Event, Likelihood - The likelihood of a seal cooler tube break is, evaluated by review of both generic failure data and prior operating experiences based on the NPRDS and LER data bases.

Generic failure rates for heat exchangers and small bore piping (( 3 inch) range between 5E-5 and 4E-4 per year. These generic failure rates are characterized by lack of tube rupture evidence and thus utilize expert opinion. A value of 1E-4 per year is chosen as the best estimate frequency for a RCP seal cooler tube break.

This corresponds to one in ten thousand years.

NPRDS search showed no prior US PWR RCP seal cooler tube failure in approximately 25 million RCP Operating hours.

There was one known seal cooler tube leak event in Beznau Unit 1 (Switzerland).

The RCP manufacturer is Westinghouse.

Tube failure and degradation mechanisms. are dependent on material, age, chemistry and Qow"conditions, etc..

The seal coolers at Palo Verde are made of the austenitic stainless steel, which is resistant to IGSCC and erosion/corrosion damage.

These coolers have been in service since the mid-80s and no existing tubing flaws from design, manufacturing, and installation which could potentially lead to a seal, cooler tube failure.have been identified. Potential-age degradation on tube or welds should not be a consideration because of relatively short in-service hours of these coolers compared to some other PWR plants.

Even though uncertainties exist in the tube break estimate because of no prior occurrence, differences in PWR seal cooler design, and age, the 1E-4 per year per High Pressure Seal Cooler estimate should conservatively reflect our current state of knowledge on failure frequency.

2. Mitigation - The High Pressure Seal Cooler tube leak or break is isolable via closure of both MOVs on each cooler.

Motive power is supplied by non-class 1E power.

If offsite power is available -during the event and fast bus transfer is successful, the operators can close these valves and isolate the break. The combined probability for failing to diagnose the event and terminate the break= low resulting in exceeding the Part 100 limit is 1.2E 1. The human error rate used for this event is about 1E-2 and some uncertainty exist in this estimate because of procedural considerations.

This is acceptable because human error rate does not dominate the 13

4t ig>

above conditional probability.

The above assessment assumed the RCPs will not fail from excessive vibration due to loss ofjournal bearing cooling and staging Qow.

3. Total Calculated Frequency ofExceeding the Part 100 Limit-'The total frequency for exceeding the offsite Part 100 dose limit is calculated by considering the number of RCP High Pressure Coolers, the likelihood of having a tube break, and the plant's capability to mitigate.

Results are as follows:

For each Unit: 4.8E-'5 per year.(about one in twenty thousand years), or For Palo Verde site: 1.44E-4 per year (about one in seven thousand years)

During the next 30 months (maximum anticipated time required to design and implement corrective action) the probability of having this event scenario at Palo Verde is 3.6E-4.

This is considered a low probability for non core melt sequences and the potential risks imposed on"public health and safety during the JCO duration is, therefore, judged to be, minimal.

V.

Safety Evaluation.

An analysis of the double ended shear of a HPSC tube was performed by the Safety Analysis group.

This evaluation was performed to address two concerns.

Whether fuel failure would be expected to occur as a, result of the small break LOCA created by the tube failure, and whether the refueling water tank volume was sufficient to allow an orderly cooldown and depressurization.

The double ended shear of HPSC tubing,was evaluated to address concerns over possible fuel failure by examining.the spectrum of break sizes evaluated for a small break loss of coolant accident (LOCA), A failure of the RCP HPSC'would correspond to a break size of 0.0043 ft'. The smallest break size evaluated for small break LOCA analysis is 0.02 ft',

and does not result in fuel failure. This break size bounds all break sizes less than 0.02 ft',

and is therefore considered bounding for the subject event.

Based on this analysis, the high pressure seal cooler failure event would not result in fuel failure.

The'adequacy of the Refueling Water Tank (RWT)',to provide makeup water for this event

.. was-evaluated by assuming a constant leak rate of 58 ibm/sec,over an event duration of 18.33 hours3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br />.

The cooldown interval following trip includes 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> at hot standby conditions, 9;33'ours of.cooldown by natural circulation at a nominal cooldown rate of 23

'F/hour, and 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. of cooldown to less than 212 'F (i.e., subcooled conditions), utilizing the shutdown cooling system at a nominal cooldown rate of 27.6 'F/hour.

Establishing subcooled conditions corresponding to 14.7 psia in the RCS willterminate the leak due to the static head of the break elevation. The assumption that the RCS has to be fully 14

'J it

depressurized represents a considerable amount of conservatism since the leak may.be isolated using the NC containment isolation valves at a pressure of 50 psia (lowest set pressure of NC relief valve inside containment).

This evaluation results in an integrated

'leak of 3,827,300 lbms, which represents an RWT ESF inventoiy demand of 464,000 gallons.

In addition, the RCS cooldown to 212'F requires an increase in the RCS inventory of 194,000 lbms, or approximately 23;600 gallons, for a total RWT 'inventoiy demand of 487,600 gallons.

Technical Specification 3.1.2.6 speciGes a minimum RWT inventory of

~ 600,000 gallons, based on an RCS average temperature of 565'F,,with 481,000 gallons of this volume reserved for ESF requirements.

Hence, the RWT inventory is adequate.

This evaluation conservatively evaluates RWT makeup water requirements, since no credit is taken for the reduction in leak rate as the RCS is depressurized, and a cooldown rate of less than 29 'F/hour is assumed instead of the allowed cooldown rate of 75 'F/hour.

The inventory demand on the Condensate Storage Tank (CST) for a natural circulation cooldown interval of 13.33 hours3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br /> has been evaluated at 168,000 gallons, in response to NRC Branch. Technical'osition RSB 5-1, "Design Requirements of the Residual Heat Removal System," Rev. 1. This volume includes sufficient inventory for RCS sensible heat removal, steam generator inventory"makeup,'and decay heat removal until shutdown cooling entry conditions are established.

The CST minimum required volume of 300,000 gallons is therefore adequate to meet this demand.

VI. Compensatog Measures To ensure that any leak of the seal cooler heat exchanger will be detected in a timely fashion the following compensatory measures (Only applicable in Modes 1 through 4) have been put in place:

1. Chemistry procedures (74CH-XC16, "Sampling and Analytical Schedule,"

and 74DP-9ZZ05, "Abnormal Occurrence Checklist") have been changed to provide for backup grab samples to be taken at least every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (not to exceed 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />) with RU-6 operable.

This method will detect in-leakage lower than:0.08 gpm and also provides a confirmation of RU-6 operation.

'If RU-6 is out of service the backup samples will be taken at least eveiy 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (not to exceed 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />).

2. The radiation monitor RU-6 alarm response procedure (74RM-9EF41, "Radiation Monitoring System Alarm Response" ) and chemistry procedure (74DP-9ZZ05) has been modified to require speciQc:actions be taken to quickly identify the source of the in-leakage to the NC system.

3. In the event manual sampling detects short lived fission product activity (indicative of Reactor Coolant Leakage in the NC system) or a radiation monitor alarm is received and 15

Oi

'1 1,

manual sampling detects short lived fission product activity an orderly plant shutdown to Mode 3.will commence within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and the plant willbe brought to Mode 5 within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Sampling will continue during, shut down to monitor the leakage and to determine the source of the leakage.

IfRCS in-leakage is determined not to be the source the plant will not be shutdown and sampling shall continue to determine the source.

Manual samples will be taken at least every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (not to exceed 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />) to ensure. that no RCS leakage in the NC system would go undetected by the radiation monitor due to a possibly higher background activity.

4. PVNGS operations willmonitor failed fuel'and RCS I-131 dose equivalent concentration levels. Ifthese values exceed a level of 2E-1 uci/cc, RCS I-131 dose equivalent, engineering will reevaluate the JCO and if deemed necessary add compensatoty

measures, VII.Justification for Continued Operation Continued operation of PVNGS until the implementation of a permanent design change to eliminate the possibility of HPSC tube leak resulting in releases outside of containment is provided by the following analysis and compensatory action.

The first barrier. to such an occurrence is the high pressure tubing in the HPSC.

This tubing is Schedule 80 austenitic stainless steel pipe with excellent erosion/corrosion resistance.

The engineering analysis of the structure of the seal cooler determined that the stresses present in the tubing are low enough that no mechanism could be identified which could cause or propagate a crack.

Thus 'no failure of the piping would be anticipated.

This conclusion was based upon a review of the original ASME Class I stress report(s) for loading associated with design, normal, upset, emergency, faulted, and test conditions.

The conclusion is further supported by the cumulative operating experience of pressurized water reactors.

Only one previous seal cooler leak could be found during a review of the data bases for nuclear plant reliability data system, nuclear plant experience data base, and licensee event report data base.

This event was not a catastrophic failure but a small leak and occurred at a Westinghouse plant in Switzerland during 1970.

There have been no high pressure seal cooler, leaks experienced at ABB/Combustion Engineering plants.

If a leak were,to develop by some preexisting Qaw.or unidentified mechanism the low stresses in the piping would result in a stable crack up to a leak rate of approximately 1.3 gallons per minute (gpm). This stable crack size was determined using the methodology of NUREG/CR-4572 "NRC Leak-Before Break (LBB.NRC)

Analysis Method for Circumferential Through-Wall Cracked Pipes Under Axial Plus Bending Loads,"

which includes loads during normal operation and a safe shutdown earthquake.

NUREG 1061 "Evaluation of Potential for Pipe Breaks," requires the application of a factor of safety of two to the critical crack size to arrive at a leakage crack size.

The resulting leak rate

il

including this safety factor is 0.8 gpm.

Recognizing that the tubing would leak before breaking, NUREG 1061 requires that the leak detection system utilized be capable of detecting a leak equivalent to one tenth of the leak rate expected f'rom the leakage crack size.

In this case that value would be.08 gpm which, would be detected by the on-line radiation monitor and cause an alarm in the control room within one hour, or if RU-6 is out of service, by manual samphng within 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of its inception.

The radiation monitor (RU-6) in the Nt system provides continuous monitoring of activity in the NC system and would detect this leak rate and alarm in the control room within one hour.

As an additional precaution, routine samples of the NC system will be taken until a permanent design change is implemented.

The routine sampling can detect leakage below 0.08 gpm. Ifthe continuous radiation monitor becomes unavailable the sampling frequency willbe increased to at least once every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (not to exceed 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />).

Thus all of the requirements of the NUREG are met for conflrming that a leak before break scenario would 'be the expected prior to tubing failure.

In the event that short half-life Qssion product activity (indicative of a leak f'rom the RCS) is detected in the NC system, the affected unit will commence shutdown and cooldown within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> unless it can be determined that the leak is from some other source which can be isolated.

This action will ensure that should there be some flaw or unknown mechanism, existing which could cause crack propagation in the cooler, further degradation would be arrested prior to tubing rupture.

If a leak were to develop the operators could reasonably be expected to identify the affected pump either by seal cooler inlet temperature, which alarms in the control room, or by NC flow indications from the safety grade How transmitters which have indicators in the control room.

Following identification of the affected seal cooler the cooler could be isolated from the control room using the seal cooler inlet and outlet isolation valves.

These valves are not safety grade but are designed to operate against full RCS differential pressure in order to isolate a seal cooler leak.

The double ended shear of HPSC tubing was evaluated to address concerns over possible fuel failure by examining the spectrum of'break sizes evaluated for a small break loss of coolant accident (LOCA). A failure of the RCP HPSC would correspond to a break size of 0.0043'ft'. The smallest break size evaluated for small break LOCA analysis is9.02 ft',

and does not result in fuel failure. This break size. bounds all break sizes. less than 0,02 ft',

and is therefore considered bounding for the. subject event.

Based on this analysis, the high pressure seal cooler failure event would not resul't in fuel failure.

An evaluation of the radiological consequences. of the postulated catastrophic failure of a HPSC tube was also performed.

Using the extremely conservative values for RCS activity and iodine spiking factors of the Standard Review Plan the evaluation results exceeded the 10 CFR 100 limits.

However, performing a realistic evaluation using the highest current 17

IOi

values of PVNGS activity and.the highest iodine spiking factor due to a trip observed in the last year produced offsite doses of less than 10.2 rem for the exclusion area boundary 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> thyroid dose and less than 13 rem for the low population zone 24.hour cumulative thyroid dose.

This evaluation demonstrates that the health and safety of the public would not be adversely impacted by continued. operation since an analysis of the catastrophic rupture of the tubing using actual plant data showed consequences which are a

small'raction of the 10 CFR 100,limits..

A probabilistic risk assessment (PRA)'f the worst case scenario was performed.

The

.PRA results indicate that during the next 30 months (maximum anticipated, time required

'to design and implement corrective action) the probability of having:this event scenario at Palo Verde is 3.6E-4. This is considered a,low'robability for non.core melt sequences and the.potential risks imposed on public health and safety during the JCO duration is, therefore, judged to be minimal.

In summary the above analyses and actions demonstrate that: (1),the probability of a leak occurring in the HPSC is very small, (2) if in the unlikely event a HPSC leak did occur it would be, detected quickly and the unit would.commence a shutdown and cooldown within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, (3). operations personnel can be expected to determine the location of a leak and have the ability isolate the affected. cooler,.effectively stopping the leak, (4) even, if a catastrophic failure were to occur, based on.the actual PVNGS RCS activity levels and iodine spiking experience the radiological consequence would be only a"small fraction of the 10 CFR 100 limits. These. facts provide assurance that continued operation, until a design change to correct the problem can be 'implemented, does:not adversely affect the health and safety of the public. The:design and implementation of corrective action for this potential:

problem is anticipated to be complete within the next 30 months, 18,

i~ )

3, A