ML19247E430
| ML19247E430 | |
| Person / Time | |
|---|---|
| Site: | Crystal River, Rancho Seco  |
| Issue date: | 04/21/1981 |
| From: | Thadani A Office of Nuclear Reactor Regulation |
| To: | Lainas G NRC |
| Shared Package | |
| ML19247E428 | List: |
| References | |
| TASK-2.K.2.13, TASK-TM TAC-45202, NUDOCS 8105110215 | |
| Download: ML19247E430 (11) | |
Text
.
me.r-u-t%:.-:
r..
t a t :.. '
'A,o UNITED sTATss
..,7 ~-
NUCLEAR REGULATORY COMMISSION
,i
., o, e
usmwcu. a. c ::m
- s
=, >~~ :. t ::
q,
- e.
Acril El,1981 NOTE TO., Gus Lainas TEC!':
Ashok Thadani SU53ECT:
FREQUEMCY OF EXCESSIVE C00LDC'nN EVENTS CHALLENGING VESSEL INTEGRITY REF. 1,:
Memorandum # rom *f. Taylor to E. Fabi: Gc.+td October 29, 1980 In res:ense to ycur re:uest of last Friday, Acril 17, the enclosure prevPies a very preliminary (weekend effo:-t) assessment of the likelihood c? a uvere over coling event which rN d chall'enge the pressure vessel it:tsgri ty.
Although our quick asseJ: ment suggests that the likelihood of cve~.coling events such as the one that cccurred at Rancho Seco is icwar (t5an that estimated in Reference 1) due to the assumed hardware codifications impicented at the S&W plants (this assumption should be verified by DL), ther; #s considerable uncertainty in the hardware and hunan error rs at ansumed in this hasty analysis. TLis assessment
, suggests that -he likelibcod of severe overt cling events is not so high as to re;uire precipitou: action, but I strongly urge j eu to consider The preli.inary rature Of this analysis and initiate a program t:: m0ra
'syste:aticlily erotimate. tne likelihood Of severe Over:00 ling events.
/
.o
.i ;
Ashd.7 C. Thadani ief Relia:2:'. i ty & Risk Assess: rent Branch DivisiCn of Saf S*.'j Iechn0lo$.y IInCICsure:
rrei;cic:ary Assessment T. ".urley M. Ernst
- 5. 3ernero M. Taylor l
$/WI/021 1 i
4
- . ~~. n - v e f_
- -eise,ine_.v se.e.s.. v.e + 8.a._
w Evcessive Cccidcan Events Challenging Vessel Integrity l k/ break Excessive cooldewn events in FWRs can Occur in a variety of wtys--
feedwater in the primary system, leak / break in the secondary system, and exces l
Of ccncern are those evants that could challenge the pressure ves ficw.
ile achieving primary U
integrity by cooling the plant down to about 250 F wh Protection against challenging 1003-1500 psi.
system pressures above rouchly (which are not terminatec t
the pressure vessel in:egrity far these ty;es of even s peratcr action.
by automatic isolation of the steam genera:Or}..is de;encent on O i
ves in the These actions are initia*ed by the pressure-temperature lim t cur Mcwever, the emergency Operating procedures are icchnical Specificiations.
integrity,
. generally not explicit in treating pressure vessel m
tor wcuid Following initiation cf a severe depressuritation event, the opera ECCS and feedwater assure that ccre cooling systems were functicning such as These acticns ceuld
.;,u to continued cocidewn and to the steem generatcrs.
Subsecuently, the cperator wcula try repressurization of she primary system.
by closing the FORV block valves to terminate the source of the depreszuri:ation This action wouic cr iscla:ing the steam generatcrs as conditions indicate.
l ca challenging stcp the coolccwn and, if perfccmed scen enough, sculd prec u If severe pressure vessei cociing is nct stoc;ec the pressure vessel integrity.
by terminating in time, the Operator must centrol the prirary systen pressure pening the FORV.
HPSI, using pressuricer sprays, increasing ietdown ficw, or o These acticns are complicated by:
H
t 2
. O pr0:edures inrica*ing best app. >ach for c:ntrolling a highly dynamic N
1.
situation.
Mine set af ter TMI-2 acr.ident to keep MPSI cperating.
2.
Normal pressurizer spray is unavailable because RCPs are tripped 3.
fellcwing an SIS.
- uxiliary pressuri er spray may not be available because of interlocks 4
with SIS.
ECR'.' c:ntrols may not be convenient and the rapid pressure respense would 5.
tend :: result in :ee-saw control. ~
~
Re;ressurizatica may be very rapid depending en the transient dynamics.
5.
The time available for operator action depends en the plant status prier to the If the plant is at pcwer (>300), the dacay heat will delay the pressure ev ant.
vessel cocid:wn to critical temperatures by a facter of about 2, c:mpared to the 1:w decay hea ::t.dition (hot standby. However, it is assumed that not
)
r r.= *. '. r.a..-a,
- 3.,,s. sy. n - $. 2.., n e o -..,eniy a5o... c..
.c 3r. n.e.
- k.e n c
3
..... s s..
o
~ ~.
i ts.
- ugh estimates were mate of the initiating frecuencies fcr var ous even Only small LCCAs need be considered.because large LCCAs will preclude re;res
- r O
e
the primary system. Small-small LOCAs (<2-inch) which have a frepuency of abcut 10~' - 10 '/RY will either depressurize very slowly or repressuri:e with full
~,
~
ECCS operational. The primary system temperature will be_hele up by heat renoval through the' steam generatcrs unless the steam generatcr isclation fails (assumed unavailability <10~ /D). Thus, a small-smali LOCA is not considered a major contributor to pressure vessel challence. A small LOCA (2-inch and up) has an estimated frequency of 3 x 10 4/RY (WASH-1400) and could result in a challenga to the pressure vessel integrity sometime during the depressurization transient depending en the relative rates of cccidevn and primary system depressurization. The small LOCAs cf interest are assumed to be relatively slew events (>I heur) which would permit operator action.
Larce steam /feedwater line treaks have an estimated frequency of 10 /RY based cn Ref. 1.
These events are potentially capable Of achieving critical vessel temperatures depending en isclation of the steam generatcr (both inlet and outlet lines) and its initial water inventory. B&W plants have a very small 5.5. inventcry wnich may preclude achieving critical vessel temperatures if feedwater is not added to the faulted steam generator. The large steam /feedwater line breaks the: ;1 inately get to critical vessel temperatures are assumed to be mcderately fast (s30 minutes).
Smail sterm/feedwater line breaks, including unisciated stuck-open relief valves,
-2
~3 have an assumed frequency of 10
- 10 /RY (similar to LCCAs) and their response snould be relatively sitw ( 1 hcur tc get to critical vessel temperatures).
The availabil,ity of block valves for the steam generater relief valves and
_4.
inst usentation indicating a stuck-open relief valve is un:ertain. Therefore, a c:nditional pr bability of 0.1/D was assumed for isolating a stark-cpen relief valve.
~
Transients initiated by failure of the feedwater control system could result in severe overcooling events as shown by the Rancho Seco incident uf March 1:78.
The critical characteristic ci this event is that adepuate control room rendout of steam cenerator conditions and primary system was lost for over an hour which precluded the operater from.taking appropriate action. We believe that if adequate primary system and steam cenerator information are available to the operator in the centrol room, the operator failure.to terminate a severe ever coling event, caused by feedwater controller failare, is significantly reduced.
The sepuence Of interest is a comm n cause failure like less of instrument and contrti power which initiates the transient and " blinds" the operator.
/
Frict to the Rarcho Seco event, in E&W plants, one of the NNI buses supplied power to the integrated c:ntrol system (ICS), which controls feedwater (main and auxiliary) and steam generator pressure control, and certain vital primary system ai d steam generator instruments. As a result, the less of this one bus cruid initiate severe transients and ha per the operator response.
A : rding to Ref. 2, there have been 29 NNI/ICS power failures in about 23 rea: tor-years of Operation which yields an estimate of the failure rate of 1/RY. Since p wer was not restored for ever an heur in the Rancho Se c event, the ocint estimate for the con:itional probability of not restering power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and having a significant transient is 1/29 Or 0.033/D. This estimate may have a large uneartainty.
Thus, the Observed frecuency for severe over-
- ling transients which might challenge the pressure vessel integrity was 0.03/RY e
1 5
f:r the E&W designed plants prior to the assumed implementati0n of the instrument channel modifications discussed below.
Af ter the Crystal River event of February 1950, the staff reccamended that at least two redundant channels Of vital instrumentation be pr:vided in the c:ntroi room (Ref. 2). Implementaticn of this re:Onmendaticn would preclude ICS failure and less of instrumentation when one NN!/ICS bus fails. There is a possibility A
of ccam:n cause failure of two control and instrumentation power buses.
review of LERs cn inverter failures in Ref. 3 indicated that there have been f ur situatiens when two inverters were lost cu ~of'l'0 inverter failures. This yields a crude estimate Of the ecnditional feilure of a setend inverter given the less cf one inverter of 0.03/D. Using these estimates and assuming two
~3 separate instrument channels yields an estimated frg;uency of 10 /RY fer severe tver:coling transient: which might challenge the pressure vesset integrity.
It is nur understanding that Westinghouse and Combustion Engineering plants have a power supply for the feedwater control er separate from at least two vital instrument power supplies. This power supply separation : upled with the thermal inertia in Westingh use and CE plants should result in a much lower probability :f severe overen: ling transients.
The probability of. e 0;eratnr successfully controlling a severe overt: cling event de: ends en several fatters--training, rapidity of the transient, acility to terminate :00ldown, capability of centrciling primary system pressure, The follcwing crude estimates of availableins}rumentati:n,mindset,etc.
t
_S.
human error probabilities (HE?) were made on the assumption that the cperator is trained to stay within the pressure-temperature limi*s and maintain adecuate primary system subczoling.
1.
Able to terminate subcooling transient, instrumentation is available, and transient takes more than 30 minutes.
-3 The-HE?.s essumed to be 2 x 10 /D' based on WASH-1400 analysis of switchever from infection to recirculation. This action is censidered to
~
be ecuivalent since the operator woula se triined to isolate faulted steam generat:", etc.
2.
Centrol of primary system pressure after pressure vessel cccled dcwn to critical temperatures, instrumentation available, an transient take.s mere tnan 20 minutes.
-2 The HE? is assumed to be 3 x 10 /D since this action requires dynamic control n the part' of the operator which is more complicated than item 1 a5 ve.
2.
Centrol of primary sysium pressure after pressure vessel c cled down to critical temperature, instrumentation available, and a time frame less than 20 minutes.
O
+*
7 The HEP is assumed to be 0.3/D based en a high stress situaticn and human error evaluatiens presented in Ref. 4.
4 Inadequate instrumentation to monitor transients 2.nd over 30 minutes to respond.
The HE? is assumed to be 0.5/D assuming the operator is trained to monitor pressure-temperature limits.
A sum.ary of the estimated probabilities fer sequ-'ences that micht challenge the pressure vessel integrity is presented in Tatie 1.
There is an uncertainty of 7 to 10 in the HEDs and an uncertainty of a facter of 3 in the initiating fr6quencies. The probability of having a critical []aw. si:e in the pressure vessel has not been included in these assessments. Similarly, other sequences involving single failures of compenents which might inhibit operator action or autamatic features that would limit the event have not been developed.
O O
D
t j
0 Y
s y
R e
y
/
y y
Y el 7
g 4
g f/
/
t R
ct 5
f f
ni 6
0 2
b 4
el 0
1
~
ui 1
0 0
0 0
qb 1
x 1
1 1
g W ea n &
Sb x
3 x
x x
i B o
l r
3 5
2 9
6 o o P
,o t
0 c
1 r d e e x
v r o a 3
p e m r o e c ve s s ec f
n o er y e t
f D
D D
D i f S
r
/
/
/
/
l i
E o
2 2
2 3
i d
I b
T t
~
l
'0 P
a:
0 0
0 6
6 a n I
b g L
rl 1
1 1
ei 0
0 o
i i
p x
x x
x r s 0
O p e A
3 3
3 3
d B
r O
e f R
w o P
o l
e C
E s
e u N
v a E
a c U
I:
e Q
b 0
o 5
F
,t s
, +
t l
n Y
ye 1
R t
i n
Y Y
/
y Y
Y c s E
y
(
R 3
g R
e n L
t o
l f
c
/
/
j / /
p a B
i n t
0 2
2 3
x r A
e a r
~
~
1
~
E t
T l
p 0
0 0
0 0
l e
1 1
1 1
1 e
f r
n x
2 x
x f
I 3
0 3
3 1
)
)
r r
y n
n e
e b
g g
t t
i i
s a
a gd / r s
s u
w w
nel e e
e b) sow d
d
- n d
d i
e e
l uro eg e
e oat p s
s ei f
f ocn u
u rs
)
/k
/k c
ot b
b h e ma ma rt cn td 2"
ae ae en e
e o
(
cr er vef m n
w tb Oiou o
t E
's_ b
(
s s
r
(
(
C e
e enst en l n rass W
W A
gi li eron B
B W
C rl al vtl i
O a
m e
L
.L S
S
t
.g.
t References 1.
Mercrar.dum from M. Taylor to S. Fabic dated October 29, 1950.
2.
Transient Res'por.se of Babccck and Wilecx-Designed Reacters, NUREG.0557, May 1980.
3.
Mencrandum from J. Knight to E. 71ensam undated (Inverter Failures).
4 Handbeck cf Hu ;an Reliability Analysis with Emp' asis en Nuclear Pcwer Plant Applications, NUREG/CR-1278, Octobe[19ED.
h 6
/
e
-er