ML20031C438
| ML20031C438 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 10/02/1981 |
| From: | Hukill H METROPOLITAN EDISON CO. |
| To: | Stolz J Office of Nuclear Reactor Regulation |
| References | |
| RTR-NUREG-0737, RTR-NUREG-737, TASK-2.K.3.02, TASK-TM L1L-268, NUDOCS 8110070144 | |
| Download: ML20031C438 (8) | |
Text
-
Metropolitan Edison Company Post Of fice Box 480 Middletown, Pennsylvania 17057 Write /s Direct Dial Number October 2, 1981 LlL 268 wN P
(b 3
h[(,!)Jy Off'ce of Nuclear Reactor Regulation 6
Attn:
J. F. Stolz Chicf Divisi/ of Licet:3ing
~
Occrating Reactor Branch No. 4 E;
OCT. 0 1981 5. 9 "4
U. S. Nuclear Regulatory Commission
, 84 Washington, D.C.
20555
'2,
//*
Dear Sir:
s f
Three Mile Island Nuclear Station, Unit. 1 (TMI-1)
Operating License No. DPR-50 Docket No. 50-289 FORV Failures (NUREG 0737, Item II.K.3.2)
Enclosed please find the response to the balance of the subject questions which supplements our response of September 4, 1981 (Llt 254). This completes our response to your letter dated April 21, 1981 (items II.K.2.14 and II.K.3.2) on this subject.
Sincerely.
j
\\
- 1. D.
u ill Director, TMI-l llDh:04S:yjf Enclosttre cc:
R. Jacobs R. llaynes L. Barrett h
?ENalaing;gg C'\\\\
Metropohtan Edison Company is a Member of the General Pubnc Utihtios Systerr.
1._ _
t t
QUESTI0tlS #1 & 2 1.
According to WASH-1400, Appendix V, the failure probability for the PWR safety valve to reseat, based on PWR operating history, was estimated to t-
-2 be 10 with an error spread of 10.
In the event of PORV leakage, the staff noted that a B&W plant would be operating with the PORV block valve closed. This may result in a challenge ta safety valves.
Considering the fact that there is no block valve to terminate-any flow from a stuck-open safety valve, the licensee is to provide in:ormation on the failure rate of safety valves and perform an analysis of the probability of a stuck-open safety valve in order to assess the d1sirability of the mode of operation with the PORV block valve closed.
2.
The staff noted the rapid increase in primary system ' pressure following the closure of the PORV hlock valve in the incident at Crystal River 3 on February 26, 1980 resulted in lifting of a safety valve. Since the small break LOCA procedures include instructions on HPI termination and PORV block valve closure, the potential exists for actuating the safety valve.
during recovery from depressurization events. The licensee is to analyze depressurization events to detemine the probability of such events result-ing in a stuck-open safety valve.
RESPONSE
An analysis was performed to detemine the probability of a stuck open pressurizer safety valve using the post TMI setpoints on RC trip and PORV actuation. This probability is the product of the frequency of demand to open on the safety valve (s) times the probability of falling to reclose on demand.
Demands on the safety valves result from both overheating transients and from recovery from depressurization events.
Probability values were cal-culated for bath the initial condition of the PORV block valve closed and the initial condition of the PORV block valve open.
The probability of a stuck open safety valve givea the PORV initially isolated
-4 (PORV block valve closed) has t;een calculated to be approximately 4.5.d0 (median vr.1$e) per reactor year at,TMI-l for the first lif t.
If the PORV M"
had not been isolated the probability is approximately 4.3x10-4 (median value) per reactor year.
l
L..
l Three major paths or contributors to open safety valves were identified:
Path 1 - overheating event caused by total loss of feedwater, which results in a water (or two phase) relief demand on both safety valves, Path 2 -
depressurization and subsequent repressurization which results in a.
steam relief demand on a safety and Path 3 - a depressurization and subsequent i
repressurization which results in a water (or two phase) relief on a safety valve. The estimation of the failure rates used for safety valves to reclose j
is discussed in the respense to question 4.
Operator error probabilities I
were salculated from HUREG/CR-1278 assuming AT0G procedures and scopes were in place in the control room and no conflicting information was being displayed to the operator (e.g., mislabeled instrumentation in control room, Crystal, River and Rancho Seco, NNI-X and Y separation).
The first event path (overheating event) median probability is 3.9x10~4/Rx yr.
which dominates the results of both (isolated and not isolated) cases.
For the case in which the PORV was not isolated, Path 3 contributes the remainder j
(roughly 4.8x10-5/Rx yr.) and Path 2 is negligible.
For the PORV isolated case Path 3 median probability is 5.2x10-5 while Path 2 is 8x10-6 (the PORV I
is no longer available to hold these transients off safeties) with Path 1 the same as the PORV not isolated case.
f
^
Due to the dominance of Path 1 there is little difference between the PORV isolated and not isolated cases, if however the contribution from Path 1 is
~
eliminated from both cases there is a 25% increase in stuck open safety valve i
from PORV isolated vs. not isolated case.
In either case the values of 4.3 and
~4
-3 4.5x10 per reactor year do not appreciably impact the median valu2 of lx10 per reactor year for small break LOCA probabilities.
4 l
1 i
i 1
l-f
L QUESTION #3 The licensee did not address a failure in the Integrated Control. System (ICS) that could terminate main feedwater and not initiate auxil[ary feedwater. Under these conditions, the high pressure reactor trip would not prevent the PORV from being actuated.
The licensee is to provide an evaluation of the FORV opening probability due to ICS failures and incorporate it into the calculation of the small-break LOCA probability due to a stuck-open PORV.
~
RESPONSE
A search was conducted to identify commonalities between the control functions i
for main feedwater and emergency feedwater.
This examination of potential commonalities was grouped into three categories:
a) ICS Modules, b) Senso,r Inpats and c) Fower Sources.
EFWS initiation is not ICS related but EFW flow control (valves EFV-30 A and-B) are ICS controlled (with manual override from control room).
Group A - There are no shared ICS modules between the emergency feedwater control and the main feedwater control.
Module failures that could terminate main feedwater do not have any impact on emergency feed-water control.
Group B - There sre common parameter (sensor) inputs to both EFW and MFW, these being steam generator pressure and steam generator level.
If the steam generator pressure signal fails low, the affected control valve (EFV-30 A or B) will remain closed (fails high has no effect on EFW). The effect on MFW of this failure, however, is to increase feedwater flow (to a max. of approximately 110%), not to terminate it.
Failure (in the high directicn) of a steam generator level input to the ICS will cause the affected EFW flow control valve to remain closed and prevent flow to the affected generator if EFW were demanded.
The other train of EFW would not be affected.
The effect of this failure reduces total feedwater flow which may result in an increase-
-in RC pressure and eventual RC trip' on high pressure (without a PORY
^
actuation).
Once the reactor is tripped' control of feadwater reverts to the low steam generator level control circuit which is independent of steam generator operate level.
The control room now has a manual station for EFW control, thereby minimizing the consequences of an effective loss of feedwater (minimal feedwater flow but no initiate signal from either AP or pump status).
Sensor failures must be coupled with other failures in order to stop feedwater to one generator. Failures due to censor faultc leading to complete loss of feedwater to both steam generators are of negligible probability.
Group C - Power Sources - The 120 VAC ATA battery backed buss supplies power to all ICS (and NNI inputs to ICS) modules and as such is a commonality between main feedwater and emergency feedwater centrol.
Power d Lutributien from this buss down to module supply level followsnormalconventions][I.g.,twosteamleveltransmitters,one supplied f rom X power source, one from the Y source (both X and Y are supplied from ATA buss)_7. A probable cause of any two simultaneous failures (e.g., X and Y) in different power cistributions involves failure of the ATA supply.
This failure, however, results in the EFW control valves going to the half open position. This loss of ATA buss also produces turbine bypass valve closures and a auto transfer to another source of power for the atmospheric dump valses which minimizes the concern at inadequate steam supply to run EFW turbine.
Loss of all power to the ICS therefore does not initiate a total loss of feedwater event; combinntions of various power faults may result in such a condition but the probabilities of such are smali.
In summary, there are no single failures among ICS modules, sensor inputs or power supplies that result in a termination of main feedwater and prevention c.f emergency feedwater flow that were identified from this analysis. There are combinations of sensor and/or power failures that m -
L..
i p
can result in a total loss of feedwater, however the magnitude of
}
the probability of such events is felt to be small enough so as.to
. y be considered already included in Category 3 (of LIL 102 ' report) which accounts for initiating ' events that are _possible but have not yet occurred in the cumulative B&W operating experience.
9 l
4 e
I J
e i
n 4
e '
1 i
t e
i l-r e
i r
l l
i i
a I
t m.
- t we se-, -w e es w-e 7 v.w me,---
++-s, yv-w.~.---<
-e-i,,
,.-.,,-,----bw.,ev%.,,.--m.., - - -
-,-e+wve.w.,+.
, -, e
+,e,.,.-..-
- ~ -
._. = _ _
L..
~
QUESTION #4 The licensee is to previde a safety valve failure rate'that is failure to reseat (remains in a full open po'sition) based on operating experience.
RESPONSE
1 The entire B&W operating experience was examined to provide a value for failure of the pressurizer safety valve to reseat. There have been only 2 lifts of pressurizer safety valves in the B&W experience, one at Rancho Seco on March 20, 1978 the other at Crystal River on February 26, 1980.
~The Rancho Seco demand was steam relief while the Crystal River was 2 phase /.
water relief.
In both cases the safety valve reseated, j
The B&W operating experience for main steam safety valves was then examined to arrive at a failure rate for the pres %surizer safety valves (for steam 4
relief), the reasoning behind using the experience is given below.
The l
failure rate of the pressurizer safety valve to reciose given water relief was estimated to be 10 to 1000 times larger than the value obtained for steam, relief.
This was then used as a prior distribution (gamma) with the Crystal River event 0 failures in 1 demand as the evidence in the bayesian update pro-T cedure. As soon as the EPRI valve test data on water relief becomes available, the values will be recalculated.
I J
s There have been approximately 2850 main steam safety (individual valves) demands in the ctenulative B&W operating experience..There has not been any failures 'to
~
rescat (remains in a full open position). There have been instances most notably TMI-2 (April 23,1978) in which a safety valve (s) did not reseat at i
proper blowdown but in none of these instances did blowdown exceeded 50%.
The
'%t a,.,,,
-,-_,--,.-,-.~.-_.-.-----c
4.
failure rate was calculated based cn 0 failures in 2850 using ~ a chi-square
' 50% confidence level which resulted in a value of 2.4x10-4/d.
Failure
~
rates for pressurizer safety valves (PSV) can be deduced by examining the failure rates of the main steam safety valves' (MSSV).
The primary reason this can be done is that the design principles on which each operates is the same, i.e., they both work against the closing force of a spring, and they both depend on the addition of a sudden opening force when they reach c,
'the setpoint.
Some differences (theffirst two would indicate that the PSV may have a better failure rate than the MSSV while the last one would indicate.
the MSSV would possess-a better failure rate) which may influence the failure rates are:
The fluid passing through a PSV should be of a higher quality (less a.
suspended solids) than the fluid passing through a MSSV.
b.
The PSV is all stainless steel where as the MSSV is mainly carbon steel subject to rusting thus further introducing foreign material.
The PSV has a variable back pressure and requires a more sophisticated c.
design which in turn has more chance of failures than the MSSV which has essentially constant stack pressures.
Additionally, the PSV is a ASFE Class 1 component vs. ASME Class II for MSSV.
G
.