ML17320A201

Modeling FLEX in Surry Power Station Internal Events and Flooding PRA

ML17320A201
Person / Time
Site:	Surry
Issue date:	11/15/2017
From:	Webster B Dominion Energy Co
To:
Schwab A
Shared Package
ml17312a356	List: ML17320A146 ML17320A193 ML17320A200 ML17320A201
References
Download: ML17320A201 (27)

Text

Modeling FLEX in Surry Power Station Internal Events and Flooding PRA Bill Webster - Dominion Energy

- 2017 PSA Paper Implementation of FLEX Strategies in Surry PRA by Aram Hakobyan, Craig Nierode 1

Overview Purpose - Discuss the benefit of crediting FLEX in the Surry Power Station internal events and flooding PRA models Discussion points Surry Features including key plant modification Internal Flooding Scenario FLEX Modeling - Flooding FLEX Modeling - SBO Key Assumptions Operator Actions Results/Data Sensitivities 2

Surry Power Station Surry Risk Profile (before FLEX implementation)

Transients SGTR Main Steam Line Break ISLOCA 1% 1%

2%

Medium LOCA 1%

2%

Rx Vessel Failure 3% Small LOCA 4% Internal Flooding 47%

Station Blackout 39%

Surry Unit 1 CDF Contributions CDF = 1.0E-05/yr

Internal Flooding Scenario

• Turbine Building (TB) Flooding

- Propagates to emergency switchgear room (ESGR)

- Causes complete loss of AC and DC power - T(0)

- Turbine-Driven Auxiliary Feedwater (TDAFW) pump is credited (starts and continues to run)

- Instrumentation for SG level control is not available (needs to be restored prior to SG overfill in approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />)

ESGR Dike Key Plant Modification

• FLEX plant modification installed UPS on Appendix R Remote Monitoring Panel (RMP)

- UPS provides 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> power to RMP after loss of power and ability to install portable 120V power for continued operation.

- RMP provides both units key instrumentation (steam generator level/pressure, RCS temperature, pressurizer pressure, Gammametrics) 7

Remote Monitoring Panel Surry FLEX Equipment

• BDB High Capacity diesel-driven pumps (2)

• BDB AFW pumps (3)

• BDB RCS Injection pumps (3)

• 120/240 VAC generators (3)

• 480 VAC generators (2)

• Other supporting equipment (e.g. hauling equipment)

Note: Equipment Stored in a protected structure on site

Surry Plant Features

• New low-leakage N-9000 Reactor Coolant Pump (RCP) seals

- No significant RCP seal leakage is expected upon loss of seal cooling

- RCS injection is not required for successful mitigation of an ELAP event

- Assumption is supported by MAAP analysis

• After 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, there is plenty of water inventory in the RCS

Surry Plant Features (cont.)

• Remote Monitoring Panel with uninterrupted power supply (UPS) system

- UPS external battery lasts 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />

- Power supply for instrumentation

• Diesel-driven fire pump

- Provides water supply to TDAFW pump from the FP tanks after depletion of emergency condensate storage tank (ECST)

FLEX Implementation (Internal Flooding)

• Operators perform the following steps

- Declare ELAP on loss of AC and DC power after ESGR is flooded, per ECA 0.0 - Loss of All AC Power

- Relocate from the Main Control Room to the Remote Monitoring Panel (RMP) per FSG 7 Loss of Vital Instrument or Control Power

- Start powering the RMP and vital instrumentation from the UPS system by turning the selector switch to BDB position

- Control TDAFWP locally to ensure no Steam Generator Overfill

- Initiate cooldown per ECA 0-0

FLEX Implementation (Internal Flooding)

• The UPS system is designed to provide uninterrupted power to the RMP for at least 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />

• Meanwhile, a BDB portable generator is brought from the on-site storage facility and connected to the existing electrical connections on the RMP

FLEX Internal Flooding FLEX Implementation (Station Blackout)

• Operators perform the following steps

- Determine whether power can be restored within 45 minutes

- Declare ELAP if power cannot be restored per ECA 0-0

- Load shed DC buses to preserve the charge on the DC batteries for vital instrumentation per FSG-4

• DC batteries are estimated to last 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> with successful load shed

FLEX Implementation (Station Blackout)

Bring in a BDB portable generator from the on-site storage facility and connect it to the existing electrical connections Relocate to RMP after batteries are depleted if DC load shed fails AFW flow rate is locally throttled to prevent SG overfill

FLEX - Station Blackout Analysis Assumptions

• Power restoration is not credited in the Internal Flooding scenario

• After battery depletion and loss of SG level control, SGs are overfilled and TDAFW pumps fails

• If DC bus load shed fails in the SBO scenario, there is not enough time to bring in and connect the portable generator before battery depletion, and relocation to RMP becomes necessary

• DC power is unavailable in the Flooding scenario with failed ESGR

Analysis Assumptions (cont.)

• No test and maintenance term is modeled for the portable generator because there are other generators that can be used to power vital instrumentation

• If TDAFW pump is unavailable or fails, it is assumed that mitigation is unsuccessful and core damage occurs

• If the RCP seals fail catastrophically (low probability event), then FLEX mitigation strategy is unsuccessful

Analysis Assumptions (cont.)

• No Phase III FLEX equipment is credited

• The PRA model was adjusted to account for the slight detrimental impact of the FLEX procedures.

• RCS makeup with a portable FLEX pump is not modeled

• Failure rate data for the BDB portable generator was assumed to be the same as that of Emergency Diesel Generator

- Additional portable generators are available but not modeled if failure occurs

- Sensitivity study performed to determine the impact of this assumption

Operator Actions Modeled

• Throttle AFW Flow

- For both Flooding and SBO events

- Failure results in SG overfill and loss of TDAFW pump leading to core damage

• Deep DC Load Shed

- Only for SBO event

- Failure results in early battery depletion and requires relocation to RMP

• Establish Remote Monitoring Panel

- For both Flooding and SBO events

- Failure results in core damage

Operator Actions Modeled (cont.)

• Establish Portable Generator Power to RMP or other 120/480 electrical connections

- For both Flooding and SBO

- Failure results in loss of long-term instrumentation leading to core damage

• Align AFW Suction to Fire Water

- For both Flooding and SBO

- Failure results in long-term heat removal leading to core damage

Results Transients SGTR Loss of Offsite Power ATWS 4% 3% 2% 1%

ISLOCA 4% Station Blackout 26%

Main Steam Line Break 7%

Medium LOCA 10%

Internal Flooding 17%

Rx Vessel Failure 11%

Small LOCA Surry Unit 1 CDF Contributions 15% CDF = 2.5E-06/yr

Results (cont.)

• CDF reduced by 75%

- From 1.0E-05/year to 2.5E-06/year

• Combined contribution to CDF from SBO and Flooding scenarios dropped from 86% to 43%

• Significant improvement on MSPI margins

• New significant contributors emerged

- SLOCA

- Reactor Vessel Failure

- MLOCA

Data Sensitivity

• Model two portable generators each capable of providing enough power supply for instrumentation

• EDG failure rate increased by a factor of 5 for every failure mode

• CCF modeled for every failure mode assuming non-staggered testing

• Results show minor CDF reduction

Conclusion

• Implementation of FLEX strategies in Surry PRA provided significant risk benefit.

• The main reason for this benefit was that Surry PRA was dominated by TB flooding propagating into ESGR, and Station Blackout scenarios

- Final CDF contributions from both scenarios dropped significantly

• The risk reduction was achieved without any credit for FLEX AFW or RCS pumps

• The use of EDG failure rates for portable generators is appropriate until enough test data have been obtained

27