ML18206A817

Enclosure 3 - Evaluation

ML18206A817
Person / Time
Issue date:	11/15/2018
From:	NRC/RES/DE
To:
Gardocki S
References
PRE-GI-020
Download: ML18206A817 (8)

Text

Staff Evaluation of Proposed Generic Issue PRE-GI-020:

Inadequate Procedures to Address Anticipated Operational Occurrences Initial Review The U.S. Nuclear Regulatory Commission (NRC) staff followed the process for the initial review of the proposed generic issue (GI), PRE-GI-020, Inadequate Procedures to Address Anticipated Operational Occurrences, in Management Directive (MD) 6.4, Generic Issues Program, dated January 2, 2015. Based on the information provided in the submittal, the GI Program staff determined that the proposed GI was not an allegation or a physical security issue. The GI staff asked the Office of Nuclear Reactor Regulation (NRR) to evaluate the proposed issue to determine whether it was an immediate safety concern. The NRR staff concluded that the proposed issue did not present an immediate safety concern (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18081A936). The NRR staff did not recommend any immediate actions at that time for operating nuclear power plant licensees. The evaluation provided the basis for allowing ongoing plant operations while the staff evaluated the proposed GI in accordance with MD 6.4. Concurrently, the GI Program staff performed an initial assessment of the proposed issue against the seven screening criteria described in MD 6.4.

Staff Evaluation The GI Program staff worked with the NRR staff, Region IV staff, and the NRCs Technical Training Center (TTC) staff in Chattanooga, TN, in assessing the proposed issue. The staff was supportive and provided crucial information necessary for the GI Program staff to complete the initial review. The GI Program staff concluded that the proposed issue does not meet all the seven screening criteria in MD 6.4; specifically, the proposed GI does not meet Criterion 1 (i.e., the issue affects public health and safety, the common defense and security, or the environment) because the increase in risk from the scenarios described in the proposed GI falls below the threshold described in Office of Nuclear Regulatory Research (RES) Office Instruction TEC-002, Revision 2, Procedure for Processing Generic Issues, dated September 26, 2011 (ADAMS Accession No. ML11242A033), necessary to continue in the GI process. The sections below explain the issue and provide the evaluation supporting the staffs conclusion.

Scope of the Generic Issue The proposed GI identified several anticipated operational occurrences (AOOs) and their possible adverse effects on plant operations. The submitters main concern was that licensees lack abnormal operating procedures to address unintentional mass additions from an inadvertent start of emergency core cooling system (ECCS) pumps. This type of event adds mass to the reactor coolant system (RCS), and the cold water also adds reactivity, resulting in an increase in reactor power, reactor level in boiling-water reactor (BWRs) or pressurizer level in pressurized-water reactor (PWRs), and reactor pressure. The submitter also identified additional events (other than just mass addition events), such as the inadvertent start of containment spray or auxiliary feedwater (AFW) pumps and the loss of main generator hydrogen sealing, that he believed required procedures.

Enclosure 3

To limit the scope of the GI, the staffs evaluation only addressed the following AOOs specifically identified in the submittal:

• inadvertent actuation of ECCS

- high-pressure core spray (HPCS) (BWR)

- high-pressure core injection (HPCI) (BWR)

- low-pressure core spray (LPCS) (BWR)

- low-pressure core injection (LPCI) (BWR)

- reactor core isolation cooling (RCIC) (BWR)

- high-pressure safety injection (SI) pumps

• inadvertent actuation of emergency feedwater (EFW) or AFW pumps

• loss of oil seal, resulting in a hydrogen leak from the main generator

• inadvertent actuation of containment spray pumps The proposed GI is primarily concerned that many plants do not have off-normal (abnormal) operating procedures to address an inadvertent start of ECCS equipment. Sections 15.5.1-15.5.2, Inadvertent Operation of ECCS and Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), describe the effects and actions required from a spurious start of ECCS equipment. Depending on the specific ECCS injection systems that inadvertently start, the temperature of the injected water, and the response of the automatic control systems, a significant increase in power level may result. Without adequate automatic reactor protection or proper and timely manual operator response, or both, an ECCS injection could lead to fuel damage, overpressurization of the RCS, or a loss of reactor coolant. Automatic reactor protective features exist to prevent the increase in transient power from reaching the point of core damage. The reactor is expected to trip on either a high water level, high flux, high-pressure, low-pressure, or SI signal.

Events, such as an HPCS, HPCI, ECCS, and RCIC inadvertent pump start and injection into the reactor vessel, are considered mass addition events. All licensed plants currently analyze these events and summarize the analyses of these events in the transient and accident analyses chapter of their updated final safety analysis reports. In these analyses, licensees are required to demonstrate that all of the following design safety acceptance criteria are met:

• Pressure in the RCS and main steam system should be maintained below 110 percent of the design values.

• Fuel cladding integrity should be maintained.

• A more serious plant condition should not be generated without other faults occurring independently.

Therefore, the evaluations in the licensees design-basis documents should show that the plants are designed to successfully mitigate the effects of mass addition events.

One scenario of particular concern identified in the proposed GI involved the BWR designs with an HPCS in which the injected water sprays directly into the fuel region of the reactor vessel. In this case, the power excursion will be more readily seen. BWRs are typically designed with a high water level trip setpoint that will automatically stop the injection without operator action.

However, there are some abnormal mass addition events that automatic reactor protection features do not fully address. In these cases, control room operators will be required to take manual actions to terminate or mitigate the abnormal conditions before the time when critical operator actions are assumed to occur in the plants safety analyses. For example, once ECCS SI pumps start in a PWR, they are not stopped by receipt of an automatic signal and will continue to operate until control room operators take manual actions to secure the pumps. The sections below provide the staffs evaluation of the different types of events specifically identified in the scope of the proposed GI.

Anticipated Operational Occurrences Involving the Inadvertent Actuation of High-Pressure Core Spray in a Boiling Water Reactor-6 Design The NRC regional inspector made the following statement in the proposed GI:

I wrote a violation on this based on the studies done at NRR on the potential for fuel damage at BWR-6 designs when High Pressure Core Spray (HPCS) is inadvertently started at full power, because this system sprays directly inside the shroud on the fuel and for this particular site the analysis shows that fuel damage can occur within approximately 30 seconds if the pump is not stopped.

Based upon information from a licensee that was provided to an NRC exam team staff during a licensing exam, the submitter believed that, without timely action, this type of event can quickly lead to potential fuel thermal limit challenges. Therefore, immediate action would be required by operators to secure the pump promptly before any important safety parameters are challenged.

The GI staff consulted with the NRC training and simulator staff in the NRCs TTC. The staff reviewed the scenario of inadvertent injection into the reactor vessel at 100-percent power from the HPCS in a BWR. If operators do not take action to secure the HPCS flow, the automatic reactor protection system would scram the reactor once the power level reaches the high-power setpoint. Hence, contrary to the statement made in the proposed GI submittal, the staff found that this specific event would not lead to core damage by itself unless an additional failure occurred, such as an anticipated transient without SCRAM (ATWS) in conjunction with the inadvertent HPCS injection. Staff in NRR were not able to locate any studies which showed fuel damage in 30 seconds for an inadvertent HPCS event. The GI staff consulted with the regional inspector who submitted the proposed GI, and he agreed with the TTC staff finding that no core damage will occur upon inadvertent injection from the HPCS. Therefore, the GI staff concluded that there is no significant concern with an inadvertent HPCS injection, as long as the automatic reactor protection features operate as designed and control room operators take the required actions as credited in the licensees safety evaluations in their licensing and design bases.

Anticipated Operational Occurrences Involving Inadvertent Actuation of Emergency or Auxiliary Feedwater The proposed GI also mentions AOOs that relate to the inadvertent start of AFW pumps. In PWRs, these pumps add water into the steam generators but not directly into the reactor vessel.

The amount of AFW addition is limited based on the possible flow of the pump at steam generator secondary side pressure. The amount of AFW flow addition, compared to the large amount of normal feedwater flow, is relatively small. PWRs have experienced these types of events, and the net effect was a slightly lower temperature of feedwater entering into the steam generator. The lower feedwater temperature allows more heat transfer from the reactor coolant; therefore, the reactor coolant returning to the reactor vessel has a slightly lower temperature.

The lower water temperature adds some positive reactivity to the fuel, and the fuel will produce slightly higher power. The effects of this transient are more severe during reactor startup when normal feedwater flow is much less and steam generator levels are at their highest level.

However, the power increase is not enough to raise the power to a high-power reactor trip setpoint. The AFW flow will continue until the reactor operator secures the pumps. Normal feedwater flow control will receive feedback from steam generator level instrumentation and reduce flow accordingly to maintain steam generator levels in the normal operating band, In addition, NUREG 0800 (SRP), Chapter 15.1.1-15.1.4, Decrease in Feedwater Temperature, Increase in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Steam Generator Relief or Safety Valve, addresses a number of events which are expected to occur with moderate frequency, such as an unplanned increase in heat removal by the secondary system, e.g., because of an inadvertent start of AFW pump.

In summary, operational experience shows that inadvertent actuation of emergency or AFW pump events do occur in PWRs and BWRs. The excursions result in power escalation but do not cause an escalation from a Condition II event to a Condition III event unless another failure occurs simultaneously (e.g., an ATWS).

Anticipated Operational Occurrences Involving Inadvertent Actuation of Containment Spray or a Loss of Main Generator Hydrogen The proposed GI mentions other AOOs, such as an inadvertent actuation of containment spray.

All safety-related equipment inside containment is expected to function during a design-basis accident in which the atmosphere inside containment experiences high heat, humidity, and spray from leakage in the primary system. Because equipment is rated to perform in adverse environmental conditions, the actuation of containment spray at power should not adversely affect any safety-related equipment necessary for the safe shutdown of the plant. A spray down of containment may cause a failure of some unprotected nonsafety-related equipment needed for normal operation; the failure of such equipment may result in a reactor trip. However, a subsequent cooldown should proceed as designed without complications using safety-related equipment.

The proposed GI also mentions AOOs associated with the failure of the main generator hydrogen seal oil system, which can result in the release of hydrogen to the environment. The hydrogen release may cause an explosion and fire that may cause multiple failures of surrounding equipment. Typically, the main generator is located in the turbine building or outside if there is no turbine building. Typically, there is no safety related equipment in the near vicinity of the main generator that is required for safe shutdown of the plant. Hence, the unit will experience an immediate loss of load, resulting in a turbine trip and subsequent reactor trip.

The main condenser would most likely be a casualty of the failure; therefore, normal feedwater would be lost. The operators would stabilize and cool down the reactor using AFW, steam generator safety valves, and power-operated relief valves.

Therefore, AOOs such as containment spray actuation at power and the loss of main generator hydrogen will not, by themselves, cause an escalation from a Condition II event to a Condition III event without an additional failure (e.g., ATWS).

Anticipated Operational Occurrences Involving Spurious Actuation of High-Pressure Safety Injection Systems in BWRs For BWRs, the inadvertent actuation of emergency feedwater from HPCI or RCIC while the reactor is operating at 100-percent power will add water into the reactor vessel along with normal feedwater. One concern is an overfill condition. If the water level is allowed to increase unabated, water will eventually flow into the main steam lines, and the water/two-phase flow would eventually enter into the automatic depressurization system (ADS)/safety relief valve (SRV) lines and into the steam supply lines to the HPCI and RCIC pumps. The water/two-phase flow could jeopardize the operation or pressure integrity of the ADS/SRVs along with operation of HPCI and RCIC. In addition, similar to PWRs, the injection of relative cool water into the reactor core results in the addition of positive reactivity to the fuel, which increases the reactor power output from the fuel. Controlling the flow rate of normal feedwater maintains the level of water in the reactor vessel. Sensing an increase in the water level, the normal feedwater control valve should respond to reduce flow accordingly to maintain the water level in normal operating band. If the reactor water level does not increase to the automatic pump shutoff trip setpoint, manual operator actions will be required to secure the pumps.

In one of the most limiting scenarios, the Pennsylvania Power and Light (PP&L) calculation EC-013-0788, Revision 2, Inadvertent Reactor Vessel Injection Resulting from Spurious Operation of the HPCI or RCIC Systems, dated October 30, 1996 (ADAMS Accession No. ML18026A468), evaluates a fire that induces a fault that starts the RCIC/HPCI pumps and adversely affects the high-level RCIC/HPCI pump trip logic. This particular fault would require operators to take manual actions. The study stated that RCIC will not cause a problem until 20 minutes, which should be sufficient time for operators to depressurize the system using the ADS or to manually secure the RCIC pump. Once the reactor vessel is depressurized, any concern with an inadvertent and uncontrolled injection by RCIC is relieved. However, using the ADS to rapidly depressurize the reactor vessel is not the most preferred method because of the stresses that would be applied to the vessel materials. A spurious HPCI actuation would be more of a concern. The calculation determined that the water level will reach the lower lip of the steam line in 3.05 minutes, which would require operators to respond more promptly. Although the chances of a fire affecting both the actuation of the HPCI pump and the automatic high level trip of the pump is remote, this calculation demonstrates the importance of an appropriate operator response in a timely manner. Each plant has a unique design. Some BWR plants with HPCS are designed with the ability to flood the main steam lines with no consequences, whereas plants with HPCI may have a concern with water entering the main steam lines. Each licensee has to analyze its plant configuration for such failure modes.

Operational experience has documented several occasions of water injection from these systems. For example, on September 24, 2017, the HPCI system at Browns Ferry Nuclear Plant, Unit 3, unexpectedly injected into the reactor vessel during a normal inservice testing (IST) flow rate surveillance at 100-percent reactor power. The inadvertent injection resulted in a reactor power increase to approximately 107 percent on the average power range instrumentation. The licensee determined that a failed yoke nut on the Limitorque SMB-4T actuator of the HPCI injection valve (motor-operated valve 3-73-44) allowed the valve to partially open and pass flow to the feedwater system and into the reactor vessel. The transient did not reach the high-power reactor trip setpoint of 118-percent reactor power. When the operators tripped the HPCI turbine 5 minutes into the event, reactor power returned to normal. No automatic reactor protection system actuations occurred or were required at the observed increase in the power level. The licensee confirmed that no fuel thermal limits were exceeded.

NRC regional staff assessment found that the conditional core damage probability (CCDP) was greater than 1x10-6. Therefore, the NRC chartered a Region II special inspection team to investigate the event. An NRC special inspection was held in October 2017. The inspectors concluded that, although the actions performed by the operating crew were adequate, the overall response time was delayed. The evaluation stated, in part, that operations supervision did not clearly understand the expected plant response during the surveillance and the misunderstanding delayed the operations crew from performing a timely identification and correction of the transient (ADAMS Accession No. ML17333A173).

The above operational experience illustrates that inadvertent injection from HPCI and RCIC have and continue to occur. The NRCs Division of Inspection and Regional Support (DIRS) closely monitors operational experience reports and, as necessary, follows with special inspections to identify any deficiencies in the operator responses. The followup inspections have not identified a generic concern in regards to how licensees are responding to these type events.

Anticipated Operational Occurrences Involving Spurious Emergency Core Cooling System Actuation, such as High-Pressure Safety Injection Lastly, the proposed GI identifies AOOs caused by an inadvertent actuation of ECCS SI pumps.

Typically, high-pressure SI pumps in PWRs have a discharge pressure higher than normal RCS pressure. Among the possible AOOs mentioned in the proposed GI, the NRC staff determined this type of AOO has the most risk-significant consequences because a spurious ECCS SI pump injection in a PWR has the potential to fill the pressurizer water solid. Because automatic system actuations that would stop an ECCS SI pump injection do not exist, manual operator actions are required to mitigate the transient. If operators fail to respond correctly or in a timely manner, the pressurizer safety valves (PSVs) or the pressurizer power operated relief valves (PORVs) will actuate to prevent overpressurization of the primary RCS. Because the PSVs are typically not qualified for water discharge, the PSVs are postulated to fail open upon passing liquid. The PSV discharge piping has no isolation valves; therefore, the failed open PSV creates a condition similar to a small-break loss-of-coolant accident (SBLOCA) incapable of being isolated, which is a design-basis Condition III event. This example illustrates how the failure of operators to correctly respond could cause a Condition II event to escalate to a Condition III event. The escalation of this Condition II event to a more serious event is not a desired outcome and violates the NRCs nonescalation criterion, as described in SRP Sections 15.5.1-15.5.2.

Even though this event violates the nonescalation criterion, the event eventually leads to a condition similar to an SBLOCA, which is an analyzed event in the licensees design basis. For such events, the licensee must demonstrate that it maintains the safety design criteria in Title 10 of the Code of Federal Regulations (10 CFR) 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors, in regard to maintaining peak cladding temperature, maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long-term cooling.

The staffs review of other mass addition scenarios described in the submittal yields similar results. The addition of cold unborated water during mass addition events would lead to an increase in reactivity caused by dilution of the RCS, high water level in the pressurizer, and overpressurization of the RCS. Automatic reactor protection features would scram the reactor before the power reaches a point that challenges the fuel limits. Hence, the events by themselves would not lead directly to core damage unless another failure occurred in conjunction with the inadvertent injection into the reactor vessel.

Based on information provided by licensees to the NRC regional staff, many nuclear power plants do not have specific procedures to address the inadvertent operation of ECCS injection into the RCS or a spurious AFW injection into the steam generators (ADAMS Accession No. ML18158A138 (not publicly available)). Those licensees without procedures rely on the knowledge and skill of the operators to diagnose the AOOs and take correct action if such AOOs occur in their plants. NRC regional inspector observed during inspections that some licensed plant operators are not adequately trained on these type events. If the operators fail to take the required actions in a timely manner, then the condition could potentially escalate into a more serious event, specifically in the case of an inadvertent high-pressure SI in PWRs.

Evaluation against the Generic Issue Program Seven Screening Criteria Of the several scenarios in the proposed GI submission, the staff determined that the most risk-significant scenario in the proposed GI description was an inadvertent ECCS injection that fills the pressurizer water solid and challenges the PSVs.

The GI program staff reviewed the information from a recent NRC backfit safety evaluation at Byron Station and Braidwood Station, in which the licensee appealed an NRC backfit determination to assess the risk associated with AOOs resulting from inadvertent actuation of ECCS SI pumps. Specifically, in the NRCs document, titled An Assessment of Core Damage Frequency for Byron/Braidwood Nuclear Power Plants Supporting Backfit Appeal Review Panel, dated August 11, 2016 (ADAMS Accession No. ML16214A199), the NRC staff evaluated the increase in risk from a pressurizer overfill condition that leads to a water discharge through the PSVs and subsequently challenges the PSV. The NRC concluded that such a scenario would not qualify as a compliance backfit if a plants licensing basis did not reflect a commitment to procedures to mitigate such AOOs. In addition, the NRC staff reviewed the probabilistic risk assessment (PRA) in the document, which concluded that the PSV failure scenario can be bounded by the SBLOCA analysis in the plants design basis. Therefore, the NRC staff concluded that an adequate protection backfit was also not justified. The PRA study also calculated the risk benefit to only be a 1.5x10-7 change in core damage frequency (CDF) if all additional requirements are imposed to preclude such an event. Therefore, the PSV failure scenario does not result in a significant enough risk to plants to warrant a backfit for substantial increase in safety.

The first of the seven screening criteria described in MD 6.4 states that the issue affects public health and safety, the common defense and security, or the environment. If available, the GI Program staff will use a quantification of the risk to determine whether the issue significantly adversely affects the safety of a nuclear facility. RES Office Instruction TEC-002 provides a threshold value to use in determining whether the change in CDF is a significant safety concern for an issue to continue in the GI Program. Figures A1 through A3 in TEC-002 illustrate several graphs for the staff to use in determining whether the increase in risk meets the threshold to continue. Figure A2, reproduced below, shows the threshold for the change in CDF to continue.

For this evaluation, the GI Program staff used the most risk-significant scenarios described in the proposed issue (e.g., an inadvertent ECCS injection leading to a failed open PSV) to determine whether the increase in risk met the threshold. The previous PRA evaluation performed to support the Byron Station and Braidwood Station backfit appeal determination calculated the baseline CDF for a PSV failure at 1.4x10-5, and the maximum benefit in CDF from implementing additional requirements to preclude this event was only 1.5 x10-7. Figure A2 shows that a proposed increase typically would have to show a change in CDF of 1 x10-6 or even 1 x10-5 to continue in the program depending on the baseline CDF. Based on the findings from the NRCs evaluation of a PSV failure, the resultant point on the graph in Figure A2 would fall in the zone to exclude an issue from further consideration in the GI Program.

RES Office Instruction TEC-002 Figure A2. Generic Issues Program Numerical Core Damage Frequency Criterion for Reactor Issues

• Change in CDF represents the resulting increase in the CDF from a proposed generic issue Based on this review, the staff concludes that the issue would not meet Criterion 1. The staff also reviewed the issue against the other six criteria, and concluded that the issue would meet them, as documented in Enclosure 1. However, an issue must meet all seven screening criteria to proceed to the next stage in the GI Program.

Conclusion Based on the information obtained from the NRC staffs evaluation performed for a failed open PSV, the GI Program staff determined that the AOOs described in the proposed GI would not pose a significant enough risk contribution to the safety of a nuclear plant to meet the risk threshold in the GI program guidelines. Therefore, the GI program staff finds that the proposed GI does not meet Criterion 1 (i.e., the issue affects public health and safety, the common defense and security, or the environment). Because the proposed GI does not meet all of the screening criteria described in MD 6.4, the GI Program staff concluded that the proposed issue should not continue in the GI Program and should be screened out of the GI Program.