ML20027D206

From kanterella
Jump to navigation Jump to search
Forwards Input to NRC Review of Sandia Labs Rept on Evaluation of PRA
ML20027D206
Person / Time
Site: 05000000, Indian Point
Issue date: 10/08/1982
From: Mattson R
Office of Nuclear Reactor Regulation
To: Hanauer S
Office of Nuclear Reactor Regulation
Shared Package
ML20027A678 List:
References
FOIA-82-543 NUDOCS 8211030118
Download: ML20027D206 (22)
v • d • e


Text

)

rs

\\,..

L'"'

pm Rac,

UNITED STATES e

'o.,

NUCLEAR REGULATORY COMMisslON y*

<;=, (

g WASHINGTON, D. C. 20555

.g tg.....,/

OCT 0 81982 P.El'ORANDUM FOR:

Stephen H. Hanauer, Director Division of Safety Technology., NRR FROM:

Rcger J. Mattson, Director Division of Systcras Integration, NRR

SUBJECT:

REVIElf 0F SANDIA INDIAN POINT PROBABILISTIC SA.FETY STUDY EVALUATION In response to Mr. H. Denton's letter and your letter, both dated Septer.ber 8, 1982, enclosed are DSI inputs to the staff review of the Sandia Laboratories' report on the evaluation of the IPP PRA.

~

Our inputs cover the items identified in your letter dated September 8, 1982, categorized es 1nternal. events.

Item 5 and 6 of the internal events i.ere assigr.ed to Mechanical Engir.eering Branch as primary revicwer and these items will be addressed in the Division of Engineering's inputs to the subject review.

[naccorda1cewith'theAttachmentBtotheletterfronJ.Hannonto 50ven Varga, our inputs to the subject review are included initwo enclosures.

Enclosure A reflects connents that Sandia Laboratory can utilize for their final report raodificEtions and Enclosure B reflects cc=nents on potential utilizction of PRA in NRR action.

~

cy\\ <)j 01

~

Roger J. Mp' son, D' rector Integration Divisiono< Systems (gtorRegulation Office of Nuclear Re

Enclosure:

N '-

As stated v

cc:

See Next Page CONTACT:

C. Liang XE9401 3

boH /

' / <1 g/ jl 1

r

\\V

['..

Stephen ll,ananer d f

OCT 0 81982 cc:

H. Denton E. Case D. Eisenhut R. Vc11mer L. Rubenstein W. Houston O. Parr A. Thadeni S. Varga J. Meyer

'C. Graves i

W. Jensed k'. l'ennedy W. LeFave S. Israel S. l'ev: berry F. Cherny T. Sullivan 4

4 i

i i

i w

i 5

e 5

o 9

ENCLOSURE A 1.

Provide a position on the pipe breaks in internal fluid systems that lead to. core melt such as.the postulat.ed break'in'the component cooling water system which leads to core melt (Section 4.6 and Section 2.7.3).

We agree with the Sandia recommendation that the two units should implement modifications to improve the probability of recovering from a CCW system pipe break since the RCP seal LOCA appears in so many other scenarios. We have no comments regarding the assumptions made by Sandia in the CCW system pipe break analysis.

2. ecFeed and Bleed - (1) Provide a position on whether feed and. bleed is a viable heat renoval mechanism at the Indian Point plants (2)

Confirn the availability of procedures and training for feed and bleed cooling at Units 2 and 3.

(1)

Feed and bleed cooling effers a potential alternate nethod for reactor heat removal, in the event of a complete loss of

~

feedwater (main and auxiliary). However, the t:RC staff has not placed reliance on feed and bleed cooling because licensees and applicants generally meet the current auxiliary feedwater system reliability criterion, and are judged to have adequate means of renoving decay heat using the steam generators.

It should also be noted that no applicant or licensee has requested credit for feed and bleed cooling.

4

~

. -2 Even though neither the NRC staff nor PWR licensees and applicants place re~liance on feed and bleed cooling, it may be a viable technique depending on the following factors:

(a)

, theth. err.odynamiccharacteristicsof,theplant,"(b)the adequacy of operating procedures and training, and (c)

I pressurized thermal shock.

Each is evaluated below.

(a)

From a thermal-hydraulic standpoint feed and bleed appears to be a viable heat removal techanism at the Indian Point Plants. This was demonstrated by Westinghouse analyses documented in WCAP-9744 " Loss of Feedwater' Included Loss of Coolar.t Accidents,"

May 1980.

so The Safety Injection pumps for the Indian Point reactors are capable of providing core cooling water at reactor system pressures of up to 1470 psia.

For feed and bleed to be effective, the operator must take action to open the pressurizer PORVs to depr5ssurize the reactor system below 1470 psia so that the safety injection ptimp flow will match or

~

7 exceed decay heat boiloff i$ the core.

The llestinghouse anlayses indicate that the PORVs at Indien Point have sufficient capacity to depressurize the reactor system so that feed and bleed will be effective provided that both PORVs are

.=-

e-

T opened and taht the action occurs before secondary l

cooling is completely lost.

A loss of feedwater event at Indian Point would produce a reactor trip and would actuate the auxiliary feedwater system.

If the auxiliary feedwater system also failed to function, after the secondary inventory boils dry, a sustained loss of J

secondary heat transfer w;uld occur.

The reactor system pressure and temperature would remain relatively constant for the first 1500 seconds until all secondary cooling is lost. At e,c -

that time, the loss of secondary heat transfer from boiling in the steam generators would cause the

. primary systen to heat up.

For feed and bleed to be effective, the analyses '

indicate that both PORVs would have to be opened before significant primary system heating occurred since the PORVs do net have sufficient ca acity to removp both sensible and decay heat from the reactor coolant systen if at an elevated temperature.

In summary, the analyses indicate that the Indian Point reactors can be successfully cooled by feed and bleed provided that the operators can open both 6

.4

- PORVs at or before 1500 seconds following a complete loss of feedwater event.

Analyses indicate that feed and bleed would not be successful if the

. operator waited as long as 1750 second's to open the.

~

PORVs.

Both PORVs and at least one SI train would be required to be operable.

Although not specifically evaluated by Westinghouse for Indian Point, another means of feed and bleed cooling maj be available. This would involve the use of the.non-safety grade positive displacement charging pumps to force water into the reactor coolant system in the event of a complete loss of ec-feedwater. The charging pumps can inject against pressures in excess of the reactor coolant system safety valve setpoint so that no prior reactor system depressurization would be required for this I

mode of feed and bleed cooling.

Analyses for other plants indicte that an injection flow equivalent to that"of a.11 three charging pumps would be required.

We have not reviewed the flo'w capability for charging pumps taking sucti n from the refueling water storage tank or from the reactor building sump.

In the event that the Refueling Water Storage Tank water supply were exhausted, connection to the sump would be required.

~

,y

_5_

(b) The NRC staff discussed the availability of procedures and training for feed and bleed cooling with both Indian Point Units 2 and 3 licensees. The

. licensees have informed the NRC staff 'that some operator training for feed and bleed has been accomplished using reactor simulators.

Both

't licensees were asked to provide their procedures f6r staff evaluation. He are not aware of_ any feed and bleed procedures at Indian Point Unit 2.

Indian PointUnit3has;onlylimitedfeedandbleedcooling procedures, however these instructions are found only in the L6CA procedure, not in other accident or transient procedures where feed and bleed may;become wr -

necessary.

(The new symptom oriented Westinghouse emergency procedure guidelines will treat inadequate core cooling, including feed and bleed in a~ more integrated fashion.)

In our judgment there are nunerous human factors inadequacies in the present-Indian Point Unit 3 feed and bleed procedures.

You should confirm this with DHFS.

In summary, the feed l

l-and bleed procedures at Indian Point Units 2 and 3 l

are judged to be inadequate.

i It should be noted, that there is currently no specific requirement for procedures for feed and bleed ccoling at any PWR.

However, as a result of the TMI-2 accident, bulletins were sent to all PWR

~

licensees which require that inadequate core cooling procedures be made available for each plant. This is discussed further in Enclosure B.

(c)

Because the RCS may be at elevated pressure with cold safety injection fluid entering the cold legs then passing into the reactor vessel, there is a potential pressurized thermal shock concern during feed and bleed cooling.

These aspects are being evaluated Gnder'USI'A-49 with regard to reactor vessel damage during a variety of PTS scenarios.

Based on the' reviews to date, there does not appear to be any special or excessive PTS problems cc-associated with the Indian Point Units 2 and 3 reactor vessel during feed and bleed cooling, however the reviews are at a relatively early stage and further study may alter this judgement.

In summary, from a thermodynamic standpoint feed and bleed coo, ling appears to be a viable technique to remove core decay heat at In'dian Point Units 2 and 3, as long as proper operator actions are taken before about 1500 seconds. Also, there does not appear to be any overriding PTS concern.that woud nullify the viability of feed and bleed cooling.

However, the apparent lack of adequate energency procedures and only limited training leads the staff I

e.

u

~

to conclude that credit should not be given for feed and bleed cooling. However, just because adequate procedures are not present at the plants we do not believe no cred.it should be.given for'Ehis means of -

energy renoval.

If feed and bleed cooling has a relatively small impact on the overall risk assessment, then the staff considers it prudent to give no credit for this technique.

However, if feed and bleed cooling, or the absence of it, is a significant~ contribu' tor to overall risk, then we recommend a more careful evaluation of the emergency, procedures th'an has been performed to date.

ee-a (3)

Because of the relatively high core melt frequency for LOCA with failed switchover, provide a position on automatic switchover from ECCS injection to recirculation.

Based on our review of the Sandia evaluation of the Indian. Point Prcbabilistic Safety Study we have the following comments; (1)

(position) While automatic switchover is preferable to manual switchover because it lessens demands on the operator and certainplanthardwaredesigns(i.e.,wewouldpursue implementation of automatic switchover for a new 1,1 cense application), our position is that manual switchover continues to be acceptable for Indian Point, provided that the hardware design (e.g.,RUSTcapacity,NPSH,etc)andtheswitchover M

e

~

0-procedures are mutually compatible in forming an effective switchover design.

(2.) To assure our position is met, the adequacy of plant harGare-design (e.g. RWST capacity and level settings, pumps NPSH) should be checked, and switchover procedures should be reviewed to verify that sufficient time is available for switchover and to verify the adequacy of checks and procedures for recovery per the Sandia discussion.

3 (3)

Though we have not verified exact quantitative risk assessments in our rev'iew, we note a general consistency between Sandia, IPPSS, and staff internally generated probabilistic results such that the "ballpark" values have not resulted in a qualitative change in our position on the.

acceptability of manual switchover for Indian Point.

(4) Our position and recommendations for Indian Point are consi. stent with those taken in our similar SEP reviews (e.g.,

see Ginna SER input dated 7/30/82).

ProvideapositiononATUSsuccesscriterbn(Section4.4.1).

4.

Of concern are:

a) Definition of 3200 psi as core melt b) Operability of check valves if P 3200 psi c)

Impact of no AFW initiation with no PORVs r-,--

_.7-.,,-

y

~

_g, d)

Integrity of steam generator tubes at P 3200 psi On the basis of generic Westinghouse information supplied to NRC in 1979, credit would be given for integrity of the primary coolant system pressure boundary at pressures up to 3200 psia. There are no pl' ant specific data for Indian Point 2 and 3, regarding the operability of HPI and LPI check valves in the injection lines and the gate valve in the RHR letdown line.

Hence, it is recommended a

that it be assumed that these valves become inoperable if the maximum RCS pressure excee'ds 3200 p~sia during an ATl!S event.

Steam generator tube pitting'is the principal type of defect that has been experienced at Indian Point 2 and 3.

If it is assumed

== that the eddy current inspection technique will find any tubes degraded to beyond the Technical Specifications plugging limit, no tubes should fa.il with maximum RCS pressures up to 3800 psia.

There is, however, some uncertainty involved in the use of the eddy current inspection technique. Hence, it is reasonable to' assume' that a few tubes would be missed that would probably rupture-in the 3200 to 3800 psia range.,

It is emphasized that there are large uncertainties in a point failure value such as the 3200 psia limit specified above.

In addition, there are significant uncertainties in the estimates of maximun system pressures.

It shculd be noted that the Westinghouse results presented in reference 1 through 3 are for generic plants and that the sensitivity studies used to estimate the effects of

factors such as loss of PORVs were not centered on a plant corresponding to Indian Point 2 or 3.

The analyses of references 1,.2 and 4 indicate the following:

(1)

Failure of the turbine trip for the loss of feedwater ATWS event results in maximum system pressure well in excess of 3260 psia.

A peak pressure of over 3600 psia is estimated.

(2)

If auxiliary feedwatEr is' not'available during the loss of load or loss of feedwater ATWS events, a feed and biced process is not possible because of the low head ( 1500 psia)

HPI and the early dryout ( 150 seconds) of the steam

  • o-generators.

It is assumed that the charging pumps do not have a sufficient combined capacity to meet the feed and bleed requirements.

I The analyses of reference 3 indicate relatively low maximum system pressures if the turbine trip occurs, auxiliary feedwater is initiated within one minute and the power-operated relief valves (PORVs) actuate.

ForalossofloadATWSe' vent (designatedEvent A) a maximum system pressure of 2975 psia is reached at about 120 seconds..

For the loss of feedwater event (designated Event B) a maximum system pressure of 2857 psia is reached at about 106 seconds.

If both PORVs fail or are blocked the maxir.ua system pressure is estinated to increase to about 3300 psia for Event A ard about 3060 psia for Event B.

liith both PORVs blocked, an e

,m

a additional one minute delay in initiation of auxiliary feedwater results in an estimated maximum system pressure of about 3430 psia for Event A and 3170 psia for Event B.

Additional delays in initiation of the auxiliary feedwater could result in an additional increase in maximum system pressure of a few hundred psi and large reduction in RCS inventory.

Note that extended delay in auxiliary feedwater flow result in RCS pressures a

remaining at roughly, 2500 psia as the RCS water boils off.

Although this system condition results in a subcritical reactor and negligible fissien p.ower in a few hundred seconds, the high decay heat rates and expulsion of water through the safety ar.d relief valves during the first part of the event cause a rapid reduction

    • in ' system inventory.

No machine calculations of system inventory for extended loss of feedwater were found.

However, is is estimated that auxiliary feedwater should be initiated well before 10 minutes to prevent core melt due to boiloff alone.

References (for Item No. 4) 1)

MCAP-8330 Westinghouse Anticipated Transients Without Trip Analysis, August.1974.

2) llCAP-8404 Anticipated Transients llithout Trip Analysis For Westinghouse Pl!Rs with 44 Series Steam Generators, September 1974.

9

-y--

3)

Anticipated Transients Without Scram for Westinghouse Plants, December 1979.

4). WCAP-9744 Loss of Fecdwater Induced Loss of Coolant Accident Analysis Report, May 1980.

7.

Use of main feedwater for decay heat removal.

Provide a position on what conditions main feedwater should be considered a viable mode of decay heat removal in the event of loss of all AFW. This

  • should include recovery from events initiated by loss of main feedwater and the condensate booster pumps to supply feedwater to a, depressurized steam generato'r.

Viability should t'e considered in a 20 to 40 minute time frame or whatever is supportable given

  • omnavailability of AFW.

In light of other studies, the 0.5 value Sandia assumes for the

~

irrecoverable main feedwater following a complete loss of main feedwater followed by a failure of AFW appears to be conservative by a factor of about five. Theprecursor, study (NUREG/CR-2497) which is referenced in the Sandia report (Table C.1) assumes,a value of 0.5 for recovery of main feedwater following a loss of main feedwater event.

This is based on the precursor study author's judgement that 50 percent of the losses of main feedwa'ter events identified in NUREG-0611 were recoverable in the. short term.

According to EPRI survey of transients involving total or partial loss of the main feedwater function, EPRI NP-801, July 1978 "ATW5:

A Reappraisal Part III Frequency of Anticipated Transients" the frequency of events affecting both main feedwater pumps is estimated to be about 0.13/RY.

This inicudes a closure of all MSIV frequency of A.05/RY, so that.the frequency of total loss of MFW' events which potentially are not recoverable in the short term (approx. I hour) is about 0.08/RY.

In flRC surveys (flDREGS-0611 and 0635) of feedwater related events, the combined results indicate a frequency of about 0.48/RY for events effecting both MFW punps.

Twelve of these events can be judged to be irrecoverabl,e in the short term (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />). Thus the frequency of potentially ir' recoverable events is about 0.12/RY which is consistent with the EPRI result.

sn-Since the Indian Point Plants have procedures for reinstating MFW l

in the event that AFW is not available the frequency of irrecoverable losses of MFW used in the Sandia analysis can be reduced from 0.5 to about 0.1 to 0.15.

This is based on many Westinghouse studies that substantiate a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> recovery time before the potential for core damage exists.

In fact the lower number (0.1) could be more appropriate for the Indian Point Plants since they have no condensate suction strainers which caused five of the complete losses of liFW identified in the NRC surveys and t

they also have procedures for depressurizing the steam, generators and feeding with the condensate pumps.

It should be noted that the WASH-1400 study suggests a value of 0.03/RY for the frequency of irrecoverable !!FW events.

O

f f

8.

Section 4;2 and 2.2.1 capability of containment spray and fan coolers under core melt conditions (core melt systems interactions) are apparently underestimated.

1)

Do you concur with Sandia conclusion?

If so, why?

Basically yes but with some reservations and comments given below.

2)

For items ycu disagr~ee with, provide quantitative alternatives if available._

We disagree with the allocation to release categories and offer an alternative under the 4.2 comments. More generally we do not think that Sandia should assign release categories to accident damage states as is done in Section 5.

These assignments are sometimes inconsistent with staff containment failure analysis.

3)

What do you think the uncertainties are?

impact - increase / decrease, frequency / probability?

how much - small -2 large >,10.

The uncertainties in this erea will be small if external events are included.

If excluded they will be large but probably not much greater than a factor of ten.

e J

0-Comments on Section 2.2.1 The Sandia review implies that in the IPPSS no credit is taken for CSRS. An example was quoted of sequences 43 and 46 in IPPSS event tree 2.

The tree defines the.CSRS system to be operating but the plant damage states (AEF and AE) imply that no credit is.taken for the CSRS.

Sandia consider the above to be justified because of:

1)

CSRS and LPRS share comm6n system and LPRS has high unavailabj lity 2)

LPRS/CSRS sump pumps may be clogged with core debris, we-

+

lle consider it approprite to neglect CSRS under these circumstances for following reason:

For early melt ("E" sequences) the ECC fails in injection, also for sequences 43 and 46 the CSIS fails so that njl RWST water is pumped into containment.

Under these circumstances, water availability in j-the sump would be limited and a reflux path may be difficult to achieve. The CSRS would therefore be unable to operate due to lack of water.

This would be applied to all early melt sequences with l

failure of CSIS.

f;0TE:

The above is a more appropriate reason than clogged pumps.

For the core debris to be bicun from the cavity into the sumps, a y.

high pressure blowdown at vessel failure is needed ("T" sequences)

"A" and "S" sequences may not have sufficient energy to blow debris into sumps.

The Sandia review considers that more credit is given in the IPPSS for the CSIS than may be justified.

In particular, Sandia feels the plant damage states characterized by C and L are not possible.

This is based on depletion of the RWST water during injection and failure of the LPRS/CSRS, which share common systems.

Sandia does '

not give credit for refilling the RWST and extending the CSIS mode.

Plant damage states _SLFC, ALFC, SLC and ALC become SLF, ALF, SL and,'

AL.

  • cit must be made clear that the above is the only justifiable reason for the assumption.

We would not expect clogging of the sump pumps for late sequences.

Under these circumstances, the core debris is discharged under water into the cavity; and the potential for release of significant debris from the cavity would be limited.

Comments on Section 4.2,

Plant damage states ALC, and SLC, are move fo overpressure failure categories due to reasons discussed in Section 2.2.1.

It is importan.t to again emphasize tht this should not be justified by clogged pumps.

h

NOTE:

The allocation of AE, AL, AEF, and ALC to release category Z-1 i: conservative - we suggest 2RW for AE, Al & ALC and 8A for AEF.

Sandia assumes fan cooler failure in core melt environment, hence AEF, AEFE, SEFI, SLFI, TEFI SEFE, TEFE, SLFCI, ALFCI, and ALF all go into overpressurization failure categories.

Hote that Sandia does not consider fan cooler failure likely. The calculations indicate even with this conservative assumption risk-is not dranatically influenced.

Note this is because external events ere included and they dominate risk.

If the above changes were made considering only internal-events significant changes in e.e - risk would occur as per ZPSS.

e O

o**

a S

e S

e

ENCLOSURE B 1.

Provide a position on the pipe breaks in internal fluid systems that lead to core melt such as.the postulated break' ii1 the component cooling water (CCW) system which leads to core melt (Section 4.6 and 2.7.3 of the IPPSS).

The event sequence for a pipe break in the CCW system is important because the Indian Point units do not r.eet our current criteria identified in SRP Section~9.2.2.

To meet today's requirements the CCU system must have passive component redundancy in addition to the active redundancy of the' Indian Point designs.

It could be argued that passive redundancy exists to some degree since city mtater is available to cool the charging pumps (Units 2 and 3) and the high pressure injection pumps (Unit 2).

'Our passive components redundancy requirement is not based on any,

[

l mechanistic failure mode such as a complete pipe rupture t,ut rather l

on defense in depth.

For op'erating plants such as Indian Point we would review such piping, systems against a mechanistic failure mode such as a pipe crack as identified in SRP Siction 3.6.1.

If it could be shown safe shutdown could be achieved under these conditions, that would be acceptable.

Ue recommend that positive steps be taken by the licensees to I

improve the capability cf initiating backup cooling water ficw to -

the charging pumps or high pressure injection pumps in the event of l

_g_

CCW system failure.

Permanent piping connections and procedures are necessary with consideration given to remotely operated valves.

This change is necessary because of the RCP seal LOCA problem

~

as.sociated.w.ith other failure modes, not just a CCW pipe break.

2.

Feed and bleed operator guidelines have been developed as part of the Westinghouse owners group response to NUREG-0737 Item I.C.l.

These guidelines are currently under review by the NRC staff. The a

guidelines will be developed into plant emergency procedures under a schedule which will be developed as discussed in SECY-82-111,

" Requirements for Emergency Pesponse Capability," March 11, 1982.,

In addition,. item 2.1.9, position 3.2 of the short term Lessons

==- Learned Task Force (NUREG-0578) required all licensees to have procedure in place by January 31, 1980 for detecting and mitigating inadequate core cooling.

This was also implemented by Bulletin 79-05C and 79-06C issued July 26, 1979.

It is not clear to the staff that the apparent lack of feed and bleed cooling procedure,s at Indian Point Unit 2 and 3 is in compliance with the requirements stated in the above referenced bulletins.

!!e recommend 01E perform a careful evaluation of the procedural cdequacy aspects, from the standpoint oc the inadequate core cooling requirements.

7.

Use of main feedwater for decay heat removal.

Provide a position on 5that conditions main feedwater should be considered a viable

  • 5

._3 j

mode of decay heat removal in the event of loss of all AFW. This should include recovery from events initiated by loss of main feedwater and the condensate booster pumps to supply feedwater to a depressurized. steam generator.. Viability s.hould be c'onsidered in a.

20 to 40 minute time frame or whatever is supportable given unavailability of AFW.

The main feedwater system should be considered a viable mode of decay heat removal (assuming AFH failure) for any transient (such as reactor trip, turbine trip, ' closure of liSIV's, loss of condenser-vacuum, or loss of r.jain feedwater) that does not result in a loss of offsite power, containmen't isolation or a feedwater systen failure affecting both pumps that cannot be remedied within about s5>one hour.

It should not be considered viable for accident type events such as LOCA, steam line break, feedwater line break or steam generctor tube rupture since the MSIVs and feedwater isolation must stay closed.

e

.

Retrieved from "https://kanterella.com/w/index.php?title=ML20027D206&oldid=4618697"