ML20011F635
| ML20011F635 | |
| Person / Time | |
|---|---|
| Issue date: | 02/26/1990 |
| From: | Beckjord E NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | Morris B NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| References | |
| REF-GTECI-071, REF-GTECI-NI, TASK-071, TASK-71, TASK-OR NUDOCS 9003070066 | |
| Download: ML20011F635 (10) | |
Text
{{#Wiki_filter:- I p68 i o,, UNITED STATES y g NUCLEAR REGULATORY COMMISSION l 7,
- j WASHINGTON D. C. 20555
%, * " ' / mua MEMORANDUM FOR: Bill M. Morris, Director Division of Regulatory Applications, Office of Nuclent Regulatory Research FROM: Eric S. Beckjord, Director, Office of Nuclear Regulatory Research
SUBJECT:
GENERIC ISSUE 71, " FAILURE OF RESIN DEMINERALIZER SYSTEMS AND THEIR EFFECTS ON NUCLEAR POWER PLANT SAFETY" The prioritization of Generic Issue 71, " Failure of Resin Demineralizer Systems and Their Effects on Nuclear Power Plant Safety," shows that the issue has a LOW priority ranking. The evaluation of the subject issue is provided in the Enclosure. The enclosed prioritization evaluation will be incorporated into NUREG-0933, "A Prioritization of Generic Safety Issues," and is being sent to the regions, other offices, thr. ACRS, and the POR, by copy of this memorandum and its ~! enclosure, to allow ethers the opportunity to consnent on the evaluation. All comments should be sent to the Advariced 8ecctors and Generic Issues Branch, DRA, RES (Mail Stop NL/S.16?). contents of this memorandum, please contact Ronald Einrit (pertaining to the Should you have questions 492-3731). T71W_: /k Eric S. Beckjord, Director ( /1 Office of Nuclear Ngulctotv Rcearch L
Enclosure:
As stated r cc: T. Murley, NRR E. Jordan, AEOD W. Russell, Reg. I S. Ebneter, Reg. II A. Davis, Reg. III l R. Martin, Reg. IV J. Martin, Reg. V j CPDRh% i ACRS i w n 6I g L
f -{1 n it.; -4 i ..s. e,. .g l l .t I ( t .L i I ^ ,f' I -l I .'f g u .{ 4 't ENCLOSURE l PRIORITIZATION EVALUATION .i g- .u..- p
- f Systems and'Their Effects on- -
- Generic ~ Issue 71: Failure of Resin Demineralizer '4 1 huclear Power Plant Safety j i N I
- )
[' 4 ,.n i ( 'f ,[. > 'f ( 1. l" k I. l \\: l t-1: ~ I 4 ? b ' ',.~ + s s en ..n.----- -.,,,-.,a,
r. P L ISSUE 71: FAILURE OF RESIN DEMINERALIZER SYSTEMS AND THEIR EFFECTS ON NUCLEAR POWER PLANT SAFETY DESCRIPTION Historical Background Following a search of LERs which suggested that additional licensing attention was needed for certain ancillary power plant equipment, the available information t showed that failures of resin bed demineralizer sub-systems have occurred within the process systems (both nuclear and non-nuclear) of nuclear power plants. These process systems, by definition, do not directly perform any reactor protection or engineered safeguard functions, yet their failure could seriously impair the capability of safety grade systems to perform by rendering their redundant trains inoperable (i.e., causing a common mode failure). The chief concern is that it is possible that these types of events may not be bounded by the current licensing basis for nuclear power plants and could c.ause plants to be inadequately protected. The types of failures considered were: (1) introduction of resin into other areas of the syster., (either by breakthrough of the retin during normal operation or by improper recharging); (2) introduc-tion of gas'into other areas of the system by imperper recharging; and (3) loss of water chemistry. This issue was raised in e OSI memorandum issued in August 1982.616 Safety Significance Failures of resin demineralizers can be caused by operatcr error or by equipnent failure and have produced the following: (1) clogging of pump strainers (due to resin introduction into the system) and the sub3eouent tripping of the pumps; and (2) introduction of gas into systems (subsequently cousing pump trips) oue to improper demineralizer back-flushing. Systems conta1ning demineralizers are: PWR- _(a) Chemical and Volume Control System (b) Condensate and Feedwater System n (c) Component Cooling Water System l (d) Service Water System (e) Spent Fuel Pit Cooling and Purification System l BWR l (a) Condensate and Feedwater System (b) Reactor Water Cleanup System (c) Emergency Equipment Cooling Water System (d) Fuel Pool Cooling and Cleanup System Two failure modes were considered: (1) introduction of resin or gas into a system which subsequently causes one or more additional failures; and (2) loss 3.71-1
p of water chemistry control which affects corrosion rates. The first failure mode can be caused by operator error or by equipment failure and has the poten-tial of affecting the following systems: PWR (a) High Head Safety Injection System (b) Condensate and Feedwater System (c) RHR System (d) Containment Spray System (e) Chemical and Volume Control System (f) Component Cooling Water System (g) Spent Fuel Pit Cooling and Purification System @LR (a) Sensor Output from Reactor Protection System (b) Condensate and Feedwater System (c) RHR System (d) Containment Cooling System (e) Reactor Water Cletnup System (f) Emergency Equipment Cooling Water System {g) Fuel Pool Cooling and Cleanup System Since some of these systems perform a safety function or support systen.s which perform a safety function, their failure could reduce the ability of a plant to maintain safe shutdown conditions. The following are a few exanples of where dcmineralizer failures have caused a loss of safety grade equipment. (1) F011cwing a review of a TMI-2 event that occurred in September 1977 during hot functional testing prior to fuel loading, it was concludec: that, had the reactor been fueled and at power when the event occurred, there might have been core uncovery followed by fugl damage.61G TMI-2 has a full-flow, condensate polishing system in the condensate and feedwater system and, as a result of its malfunction, resin from the system was carried over into l l the plant's demineralized water system from which it migrated to all other parts of the plant, including the nuclear steam supply system and the l turbine. The most significant result was that the resin clogged the i strainers to all of the circulating pumps in the nuclear service closed cooling water system causing them to trip. This removed essential cooling water from all related reactor pressure and ESF systems and components and also all non-essential nuclear systems and components, i.e., RCPs, spent fuel coolers, instrument air compressors, and after-coolers. The loss of l coolant to the RCPs caused the pumps to trip and the pressurizer heaters to. shut off resulting in depressurization of the reactor coolant system. It was concluded that the net result of the polishing system malfunction was the potential loss of primary system heat removal capability, i.e., forced convection using RCPs, natural circulation cooling, and feed-and-bleed l using HPSI pumps. (2) During RHR operation at cold shutdown at San Onofre Unit 2, there was a system malfunction or operator error while reprocessing of a demineralizer subsystem.1172 During this operating mode, the demineralizers of the related CVCS were lined up with the RHR to accomplish RCS cleanup and 3.71-2
pressure control. Backflushing of one of the related filters was initiated and, during this process, by either system malfunction or operator error, nitrogen gas used during this procedure passed through the subsystem into the suction lines of all the RHR pumps with resultant loss of operability. The RHR pumps are also the LPSI pumps. In this case, redundant systems important to protection of the facility during an accident, as well as orderly cold shutdown of the plant from 350'F, were rendered inoperable. (3) At Pilgrim 1 there was a system malfunction which caused an improper recharging of a demineralizer in the RWCS.117s This resulted in resin entering the RCS and caused the indicated flow rate input to the APRM flow bias trip settings to read high, thus providing a non-conservative input to two trip functions. In this case, a demineralizer problem affected the ability of a safety system to perform its function. The loss of the ability to shut down or te wintain a safe shutdown condition for the reactor is considered of highest safety significance and the ef fect demineralizer failures could have on public risk associated with core-melt will be evaluated below. The loss of spent fuel cooling and water cleanup capability is assumed to be of much less safety significance due to the long lead time available to restore cooling. Therefore, it is not considered a large contributor to risk and is not evaluated below. The second failure mode (1 css of water chemistry control) has the potential.of changing the corrusion rate for the affected system. However, since a loss of water chemistry and the subsequent cher.ge in corrosion rate do not lead to imitediate faileres, do not affect all parts of the system et the same rate, and f.an he detected and corrected prior to having any $f gnificant impact, this failurc mode is not considered a significant contributor to puolic risk and is not considered ;urther below. l Therefnre, based on the above, the rest of this evaluation will address the failure mode of resin or gas introduction into a system which then leads to immediate failures of other safety systems. Possible Solutions i Possible solutions include hardware and administrative changes. Specifically, a combination of the following could be done: (1) install filters on the outlet of all demineralizer units which would stop resin from entering the system l through the demineralizer outlet nozzle; and (2) evaluate current procedures, job aids, and training to discern where improvements can be made to enhance operator capability and further reduce the chances for human error which result l in resin or gas intrusion into a system during demineralizer recharging. PRIORITY DETERMINATION Assumptions No provision has been made in the safety analysis of the existing LWRs to account for the effects or consequences of demineralizer problems or failures. Therefore, by considering the possibility of demineralizer failures, the additional risk these present to the public must be determined. The system 3.71-3
m -. l l f ailure probabilities used were those summarized in NUREG/CR-280064 and are based upon the Oconee 3 PRA for PWRs and the Grand Gulf 1 PRA for BWRs. The number of plants affected by this issue was conservatively assumed to be all operating and planned plants (78 PWRs and 39 BWRs) and their remaining lifetime was assumed to be 30 years. Frequency Estimate The frequency of demineralizer failures was estimated using data from an LER search for the period June 1982 through June 1984. LERs prior to 1982 were not searched since old data do not reficct current operating practice and improvements in procedures, training, etc., subsequent to THI-2 and, therefore, may not be an accurate estimate of failure rate. From the LER search, it was determined that there were 15 events involving abnormalities caused by demineralizer-related problems. Of these 13 events, 2 led to degradation of a safety system. (See References $16, 1172, 1173.) An additional LER search covering the years from 1984 through 1987 was performed to identify LERs that involved demineralizer systems; no additional LERs were identified that involved demineralizers which caused a degradation of a safety system. The operating span from 1982 through 1987 comprised 277 PWR years of operating experience. Hence, for FWRs, the frequency of safety system failure due to demineralizer problems is 2 failures in 277 PWR years or 7.2 x 10 8 failure /RY. Fct BWns, there were no recorded LERs involving the loss of safety systems resulting from dcmineralizer prot lems. Hcwever, the event described at San Onofretm could have occurred in a BWR, Hence, for BWRs, it was assumed that one failure occerred over the time span of 165 BWR years or 6,2 x 10 8 failure /RY. In the 1984 through 1987 LER assessment, 3 events involving BWRs were found to have occurred wh ch resulted in either an automatic or manual scram. These i scrams were the result of high main steam line radiation readings which were believed due to either resin or corrosion particles. It is conceivable that all 3 could have resulted from resin particTes. Assuming 3 transient events in the 116 BWR years rescits in 0.026 transient per BWR year due to demineralizer i failures. PWRs are not susceptible to these same occurrences. However, a PWR scram was found which resulted from a demineralizer fault. In the TMI-2 accident 626 the loss of feedwater resulted in a scram. With one transient trip in 227 PWR years, a transient frequency of 3.6 x 10 3 event /RY results from demineralizer-related events. Consequence Estimate Demineralizer system failures and their resulting impact on other plant systems cannot, by themselves, lead to a core-melt or containment failure. They can, however, remove some of the systems which provide lines of defense against such core-melt and containment failure events or result in transient-induced scrams. In the case of PWRs, the systems which provide a line of defense and which could be rendered inoperable due to a demineralizer failure are: High Head Safety Injection System (for reactor shutdown); Condensate and Feedwater System (for normal decay heat removal); RHR System (for shutdown decay heat removal); and Containment Spray System (for containment pressure and temperature control). For 8WRs, the systems are: Reactor Protection System (for reactor shutdown); Condensate and Feedwater System (for normal decay heat removal); and RHR System (for shutdown decay heat removal and containment cooling). 3.71-4
e. The consequences associated with these events can be estimated by considering the following scenario. While at full power, a malfunction in the plant requires the plant protection system to automatically shut down the plant. However, a demineralizer problem has caused the loss of f Jnction of one of the safety systems which can be affected by demineralizers. Other safety systems are assumed to fail with probabilities as defined in the Oconee and Grand Gulf PRAs leading to a core-melt with containment failure. Since this event could result in a loss of core cooling, containment cooling, or containment spray, it is considered to be bounded by the PWR 2 and BWR 2 release categories which 6 and 7.1 x 106 man-rem / event, have estimated dose consequences of 4.8 x 10 respectively. The transient-related accidents Tra for BWRn and T3 for PWRs are expected to result in BWR release categories 1, 2, 3, and 4, and in PWR release categories 3, 5 and 7, respectively 64 To estimate the reduction in risk associated with the elimination of demineralizer failures, two calculations were involved: (1) the additional probability of reaching a core-melt due to domineralizer failure which rendered a safety injection system inoperable; and (2) the reduction in core-melt frequency resulting from a reduction in transient-induced scrams. The first was done by assuming that the effect of demineralizer failure contributed directly to the probability of core-melt by adding directly to the failure probability of those systems that can be affected by demineralizer failures. This contribution was calculated by examining the dominant accident sequences for PWRs and BWRs (using the Oconee-3 and Grand Gulf PRAs as representative of these plants) and, for those sequences that involve systems whose performance could by affected by demineralizer problems, adding to that system an annual unavailability of 2 x 10 6 for PWRs and 1.4 x 10 6 for B'/Rs. This then would represent the incremental increase in the frequency of a core-melt accident for the plant. The values calculated for these in weases in frequency are 6.4 x 10 P/RY and 8.8 x 10 8/RY for PWRs and BWRs, respectively. The transient reductions were based upon the frequency reduction values given previously. The transient reductions resulted in a reduction in core-melt accident frequency of I x 10 9/RY for PWRs and 8 x 10 8/RY for BWRs. The risk reduction associated with resolution of this issue is calculated below. PWRs: . System Failure Risk Reduction = (6.4 x 10 8/RY)(4.8 x 106 man-rem / event)(30 years) = 9.2 man-rem / plant Transient Risk Reduction PWR-3 = (0.5)(9.9 x 10 20/RY)(5.4 x 106 man-rem / event)(30 years) = 0.008 man-rem / plant PWR-5 = (0.0073)(9.9 x 10 10/RY)(1 x 100 man-rem / event)(30 years) = 2.2 x 10 4 man-rem / plant PWR-7 = (0.5)(9.9 x 10 20/RY)(2.3 x 108 man-rem / event)(30 years) = 3.4 x 10 6 man rem / plant Total PWR dose reduction = 9.3 man-rem / plant 3.71-5
t b BWRs: System Failure Risk Reduction = (8.0 x 10 8/RY)(7.1 x IOC man-rem / event)(30 years) = 15.1 man-rem / plant Transient Risk Reduction BWR-1 = (0.01)(1.4 x 10 8/RY)(5.4 x 10G man-rem /cvent)(30 years) = 0.022 man-rem / plant 6 man-rem / event)(30 years) BWR-2 = (1,0)(7.8 x 10 8/RY)(7.1 x 10 = 16.6 man-rem / plant l BWR-3 = (0.5)(2 x 10 9/RY)(5.1 x 100 man-rem / event)(30 years) = 0.15 man-rem / lant BWR-4=(0,5)(2x10g/RY)(6.1x106 man-rem / event)(30 years) = 0.018 man-rem / plant Total BWR dose reduction = 32.0 man-rem / plant In addition, since hardware fixes are assumed to be part of the solution of this issue, the occupational dose associated with the installation of these fixes must be considered. The addition of 6 strainers per plant on the outlet of demineralizers is atsumed as the hardware fix. The occupational dose received ft om the installation of demineralizer strainers can be estimated as follows: (1) it is assuned that the installation of each strainer involves 40 man-hours of labor in the radiation tone; and (2) from Chapter 12 of the Oconee 3 and Grand Gulf 1 FSARs, the dose rate in the areas where demineralizers are present is approximately 100 millirem /hr when the plant is shutdown. Therefore, the occupational dose received froM the installation of 6 outlet strainers is (40 man-hrs)(6)(0.1 rem /hr) = 24 man-rem / plant. Since these occupational doses are less than the risk reduction dose consequences, it appears there may be some henefit to implementing such fixes. The impact of additional strainers on increased occupational dose due to maintenance was assumed to be negligibic. Cost Estima_to The costs associated with resolution of this issue involve hardware additions (demineralizer outlet strainers) to mitigate the consequences of demineralizer failures, procedure changes, and additional operator training. It is assumed that all of the fixes can be done during normally scheduled downtime; therefore, the cost of replacement power is not a factor. The costs which must be considered for each plant are: (a) Hardware Fixes $600,000 [ Assumed to be the addition of 6 outlet strainers per plant] (b) Procedural Changes $ 12,000 [ Assumed to require one man-month per plant] l l l 3.71-6
{ .~ I l j ~ (c)' Additional Operator Training $ 90,000 [ Assumed to take 1 man-week /RY or ($3,000/RY)(30 yr. )] TOTAL: $700,000 Additional maintenance and NRC costs to monitor implementation are assumed negligible. However, it is also possible that a reduction in demineralizer problems will also reduce undesired plant shutdowns and thus save a utility the cost of replacement power. From the LER search, it was determined that, of the 15 events reported involving demineralizers, two caused plant shutdowns to correct the problem. It is assumed that half of these could be avoided by the better training procedures and mitigation ef fects of demineralizer outlet filters. Therefore, based on the LER data, a plant will avoid [(1)(30 yrs)/(75)(2.5 yrs)) = 0.16 shutdown / plant due to demineralizer problems over its lifetime. This results in a cost savings to the plant of (0.16 shutdown) ($500,000/ shutdown) = $80,000/ plant over its lifetime. (Each shutdown is assumed to last 1 day at a cost of $500,000/ day.) Therefore, the total presenLcost per plant to resolve this issue is estimated to be $(700,000 - 80,000) = $620,000. Value/ Impact Assessment Based on an estimated risk reduction of 9.3 man" rem / plant for pWRs and 3P. man-rem / plant for BWRs, the value impact scores are given by: (1) PWRs: 9.3 man-rem / plant b ~_ $0.62M/ plant 5 15 man-rem /$M (2) BWRs: 3, 32 man-reth/ plant $0.62M/ plant 5 52 man-rem /$M Other Considerations -(1) The assumptions used in this evaluation regarding f requency and consequence estimates were conservative, in that, the BWR occurrence frequencies of transients and failures are high estimates and the bounding of non-transient accidents by BWR-2 and PWR-2 releases results in public dose estimates that are high; therefore, the value/ impact scores are considered to be high estimates. (2) Many demineralizer failures can and are detected (via water chemistry, etc.) prior to their af fecting other equipment. (3) Generally, a demineralizer failure affects only one system. This is not enough to prevent a plant from performing its safety functions. In the one case at THI-2 where more than one system was affected,L W the plant was in the preoperational testing phase, prior to certification that the plant condition (equipment and procedures) was suitable for power operation. =: 3.71-7
ri 1 (4) fixes following the 1MI-2 failure appear to have reduced the frequency of occurrences. j CONCL USION Based on the above value/ impact scores, this issue has a LOW priority ranking. REFERENCES 64. NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," U.S. Nuclear Regulatory Commission, february 1983, (Supplement 1) May 1983, (Supplement 2) December 1983, (Supplement 3) September 1985, (Supplement 4) July 1986. 516. Memorandum for W. Johnston and L. Rubenstein from T. Speis, " failure of Resin Demineralizer Systems and Their Effects on Nuclear Power Plant Safety," August 6, 1982. 1172. Letter to R. Engelken (NRC) from H. Ray (Southern California Edison Company), " Docket No. 50-361, Licensee Event Report, Numbers 82-002 and 82-003, San Onofre Nuclear Generating Station, Unit 2," March 30,1982. 1173. Letter to R. Haynes (NRC) from C. Mathis (Boston Ediron Ccmpany), " Docket No. 50-293, Licesse DPR-35," September 15, 1981. t i I l 3.71-8}}