ML20112F278
| ML20112F278 | |
| Person / Time | |
|---|---|
| Site: | Big Rock Point File:Consumers Energy icon.png |
| Issue date: | 07/14/1998 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Hunter C (301) 415-1394 | |
| References | |
| LER No. 155/98-001 | |
| Download: ML20112F278 (10) | |
Text
B.2 LER No. 155/98-001 Event
Description:
Long-term unavailability of the liquid poison control system Date of Event:
July 14, 1998 Plant:
Big Rock Point Nuclear Plant B.2.1 Event Summary On March 27, 1998, during decommissioning activities at the Big Rock Point Nuclear Plant (Big Rock Point),
personnel made an unsuccessful attempt to discharge the contents of the plant's liquid poison control system (LPS) tank to a group of 0.25-m 3 (55-gal) drums. An air source was connected to the tank for expelling the liquid poison (sodium pentaborate) out of the tank via the discharge pipe. However, rather than the expected liquid poison, air flowed out of the LPS tank. Subsequently, a boroscope was used to inspect the internals of the LPS tank. This inspection revealed that the discharge pipe had totally corroded through; the corroded hole area at the interface was large enough to prevent pressurization of the LPS solution in the tank for subsequent discharge to the primary system. As a result, the LPS was incapable of fulfilling its design safety function-namely, to shut down the reactor in the event of an anticipated transient without scram (ATWS) event. Metallurgical analysis concluded that the pipe protective coating failed due to blistering, allowing the liquid-vapor environment/sodium pentaborate access to the carbon steel discharge pipe. The licensee postulated that failure of the discharge pipe occurred sometime between 1979 and 1984 (Ref. 1).
On August 29, 1997, Big Rock Point shut down permanently for decommissioning; the LPS is not required to be operable for decommissioning. The estimated conditional core damage probability (CCDP) associated with this condition at Big Rock Point is 6.5 x 10-.
This is an increase of 1.1 x 10 -over the nominal core damage probability (CDP) in a 1-year period for Big Rock Point of 5.4 x 10"'.
B.2.2 Event Description On March 27, 1998, an unsuccessful attempt was made to discharge the contents of the LPS tank to a group of 0.25-m3 (55-gal) drums. An air source was connected to the tank to expel the liquid poison out the discharge pipe.
Instead of the expected liquid poison discharge from the LPS tank, air flowed out. A subsequent boroscope inspection of LPS tank internals revealed that the discharge pipe had totally corroded through; the corroded hole area at the interface was large enough to prevent pressurization of the LPS solution in the tank for subsequent discharge to the primary system. Personnel subsequently removed the tank manway and confirmed that the discharge line was severed into two pieces, compromising the function of the system. The LPS is not required to be operable during decommissioning. However, the licensee postulated that the discharge pipe failure occurred between 1979 and 1984. Thus, the plant had operated at power for up to 15 years with the LPS unavailable.
Both ends of the severed discharge pipe were shipped to the Consumer's Energy laboratory for analysis. The lab stated that the phenolic coating was completely stripped from the pipe, except for the last 46 cm (18 in.) of pipe.
It was apparent that the break in the pipe was caused by corrosion. Visual inspection of the tank's inside walls B.2-1 NUREG/CR-4674, Vol. 27 B.2-1 Appendix B LER No. 155/98-001 NUREG/CR-4674, Vol. 27
I FR2 Nn 15~5/98-001Anedi revealed that the coating had failed or peeled off in many locations below the "liquid" line and was entirely gone from surfaces located above the liquid line. In another observation, red-oxide-colored rust was found on the surfaces that were above the liquid line, but generally not below the liquid line.
The purpose of the phenolic coating was to protect the tank and connecting piping surfaces from the sodium pentaborate, which would attain a slightly acidic solution. There were no surveillance or test requirements associated with the tank internals (i.e., inspection) or verifying (i.e., testing) that flow could exit the tank, although General Electric [the nuclear steam supply system (NSSS) vendor] stated that a means should be provided for periodically checking tank integrity. The licensee interviewed several people who have been employed at Big Rock Point for a long time, and none could recall that the manway flange on the LPS tank had ever been removed for either maintenance or inspection.
The licensee's evaluation of this failure concluded that a phenolic coating should not be expected to last 40 years.
According to a materials expert (the licensee's contractor), a baked phenolic coating was one of the best choices for this application in the early 1960s. However, the maximum expected service life would be only about 10 years. Additionally, the air space above the water line was a highly corrosive environment. This air space was enclosed and contained water vapor from the liquid. There was also an ample supply of oxygen for the air space, which was supplied during every refueling outage when the licensee's personnel performed procedure TR-26, "Poison System Crystallization Inspection."
Big Rock Point's Technical Specifications allowed up to a 30% sodium pentaborate solution in the LPS tank.
The specifications for the LPS tank itself specified a 20% solution of sodium pentaborate. However, the licensee concluded that the difference in concentration would not make much of a difference in the corrosion rates.
The licensee's investigation of the piping failure found that the root cause of the discharge pipe coating failure was blistering degradation within the first 3-5 years of LPS operation because of inadequate curing of the phenolic coating. Thorough curing of phenolic coatings is essential for acceptable coating performance when used in immersion service. Once the coating had failed, and the solution/environment had access to the pipe surface, direct preferential corrosion attack of the carbon steel discharge pipe occurred at the sodium pentaborate liquid/vapor interface because a differential aeration (oxygen) concentration cell existed at the liquid/vapor interface. Thus, the discharge pipe was exposed to an aqueous/oxygen environment at elevated temperatures.
Corrosion attack will occur on carbon steel materials exposed to these conditions, and the corrosion reactions were accelerated by the elevated service temperatures [65.6-71.1 TC (150-160'F)]. The corrosion rate of carbon steel in a closed system water environment containing dissolved oxygen at 65.6-71.1 0 C (150-160 0 F) is approximately 0.038-0.041 cm/year (0.015-0.016 in. year).
The discharge pipe was specified as Schedule 40 with a 0.549-cm (0.216-in.) minimum wall thickness (MWT).
Typically, pipe wall thickness can vary from specified MWT up to 10% greater than specified MWT. Thus, the discharge pipe wall thickness was probably between 0.549-0.605 cm (0.216-0.238 in.). With pipe corrosion rates of 0.038-0.041 cm/year (0.015-0.016 in./year), throughwall corrosion should have occurred at the interface in 16 years, once the pipe was exposed to the service environment. At some short time after initial throughwall penetration, the corroded hole area at the interface was large enough to prevent pressurization of the LPS solution in the tank for subsequent discharge to the primary system. At this point, the liquid poison system B.2-2 NUREG/CR-4674, Vol. 27 At)oendix B
became inoperable. The licensee postulated that failure occurred between 1979 and 1984 (the plant was put into service in 1962).
B.2.3 Additional Event-Related Information The standby liquid control system (designated the LPS at Big Rock Point) was provided to inject a sodium pentaborate solution into the reactor vessel if the reactor could not be shut down with control blades. The LPS used nitrogen pressurized to 13.8 MPa (2000 psig) to rapidly inject its contents into the vessel; no pumps were necessary. The LPS consisted of a spherical 5.72-cm (2.25-in.) thick pressure vessel designed to American Society of Mechanical Engineers Boiler Pressure Vessel Code Sect. VIII, 1959 edition.
The tank was approximately 183 cm (72 in.) in diameter, with a nominal capacity of 3.86 m3 (850 gal). The internal surfaces of the tank, manhole neck, inside and outside of the outlet and dip tubes, along with all flange faces, were coated with a baked phenolic protective lining.
Upon initiation of the poison valves admitting 13.8 MPa (2000 psig) of nitrogen pressure to the poison tank, poison would be forced into the reactor within a few seconds.
This ensured a positive displacement of the solution when the reactor recirculation system was static, such as during refueling, when there was no initial driving head to establish a siphon through the discharge dip tube in the poison tank.
B.2.4 Modeling Assumptions While the current version of the plant-specific models [the standardized plant analysis risk (SPAR) models] used in the detailed analyses performed by the Accident Sequence Precursor (ASP) Program, was being developed, the Big Rock Point licensee announced plans to shut down the plant permanently for decommissioning. The ASP Program subsequently stopped the development of the most recent version of the model for Big Rock Point and concentrated on models for plants that were still operating. Because no current ASP Program model exists for Big Rock Point, this analysis used the models and the analysis results documented in the licensee's individual plant examination (IPE) for Big Rock Point (Ref. 2).
According to Ref 2, two sequences from the turbine trip ATWS event tree (sequences 12 and 13 in Fig. 1) contribute -90% of the overall ATWS contribution to the core damage frequency (CDF). These sequences include success of the main condenser as a heat sink and LPS failure. LPS failure is dominated by the operator failing to provide injection within 2 min (this operator action included tripping the reactor recirculating water pump and LPS initiation). If LPS failed to inject due to mechanical means, the operator action would remain applicable for the recirculating water pump trip action. With the pumps tripped and steam bypassed to the main condenser, for some sequences, the plant could survive the turbine trip without the reactor scram. In those cases, sufficient time would be available to pursue other means of inserting the control rods or providing alternate poison injection through the use of borax and boric acid batched through the condensate / makeup system and injected through the feedwater system.
As described in Ref. 2, the turbine trip ATWS scenario would have been expected to proceed as follows: while the reactor was operating at 100% power with the turbine-generator on-line, a trip would occur (turbine stop valve closure and the generator output breaker opening). As the stop valve closed, pressure would rise within the main ADoendix B B.2-3 NUREG/CR-4674, Vol. 27
Appendix B stearnline and ultimately within the primary system. The pressure increase in the primary system would cause neutron flux levels to increase (as a result of a reduction in void volume), and initiate a reactor scram. The turbine bypass valve would also open to control pressure by sending steam directly to the main condenser (the bypass system and condenser were designed for 100% load rejection capability). The operators would respond to the turbine trip by verifying that a reactor scram occurred or by initiating manual scram actions for an automatic scram failure. If the automatic or manual scram actions fail, the operators would then trip the reactor recirculating water pumps and initiate LPS injection. Tripping the recirculating water pumps would reduce reactor power output to 60% (or 50%, if both pumps were tripped) of its previous value. If the LPS failed with the reactor depressurization system (RDS) inhibited, the main steam isolation valves (MSIVs) would close -4 min into the event, and the safety/relief valves (SRVs) would actuate to relieve steam into the containment. Operation of the emergency condenser and restoration of feedwater would extend the time until core damage occurred, provided that RDS was inhibited (Ref. 2, p.7.1.5-1 7). On the other hand, if LPS failed and RDS were not inhibited, blowdown of the reactor to allow injection of core spray [0.52 MPa (75 psig)] would occur within seconds following the actuation of the RDS. Reflooding of the reactor with cold core spray water was assumed to return the reactor to power, although with some degree of core damage (Ref. 2, p. 7.1.5-23).
Figure B.2.1 provides the ATWS-Turbine Trip event tree from the Big Rock Point IPE. Table B.2.1 identifies the ATWS sequences from Ref. 2 that have frequencies greater than the IPE truncation value of 1.0 - 109/year; Table B.2.2 provides the system names. Table B.2.3 provides the frequency for each sequence including the event initiator (e.g., turbine trip, complete loss of feedwater), and the reactor protection system failure that would result in an ATWS event. In Ref. 2, the licensee assumed that electrically-caused trip failures could be recovered by operator action to manually actuate the trip breakers. This assumption reduced the probability of failure-to trip by a factor of 3.0 compared to the value typically used in Probabilistic Risk Assessments.
In Ref. 2, the licensee's analysis assumed that operator actions associated with failing to actuate the LPS and failing to inhibit the RDS were strongly coupled [i.e., p(operator fails to inhibit RDS I operator fails to initiate LPS) = 1.0], because both actions are cued by the same signals and at the same time. For the condition of interest (LPS unavailable), the operator action to inhibit RDS should still be successful [p(operator fails to inhibit RDS)
= p(operator fails to initiate LPS)], although the LPS is in a failed state because of the nature of the LPS failure.
However, in terms of a core damage end state, this makes no difference because, as discussed previously, successfully inhibiting RDS following LPS failure merely delays the onset of core damage.
For each sequence listed in Table B.2.3, Ref. 2 reports the time available for the operators to actuate the LPS.
Based on this time, it was possible to identify the corresponding human error probability used in the sequence.
Assuming that the probability of LPS failure is dominated by operator action (this assumption seems reasonable-at least for the fast response sequences with very high human error probabilities that dominate the results), revised sequence frequencies, given that the LPS was failed, were calculated.
The event trees and fault trees developed by the licensee and the accompanying assumptions used to analyze ATWS initiators and the resulting accident sequences documented in detail in Sect. 7.1.5 of Ref. 2 were reviewed and considered appropriate for use in this analysis of the long-term unavailability of the LPS. The ATWS sequences with frequencies above the IPE truncation value of 1.0 x 10. per year (identified in Section 7.1.5 of Ref. 2) were then manipulated to estimate the increase in CDF for long-term LPS unavailability. Using this result, the increase in CDP associated with LPS unavailability for a 1-year period (the maximum unavailability I lq'l* N* I*/OR-I)Ol NUREG/CR-4674, Vol. 27 B.2-4
duration considered in the ASP Program) was then estimated. From the nominal ATWS sequence frequencies, the CDF contribution from ATWS was then used with the estimated overall CDF from the Big Rock Point IPE to estimate the CCDP.
B.2.5 Analysis Results Table B.2.3 identifies the IPE CDF for ATWS sequences, 3.7 x 10i/year (Column 5), as well as the ATWS CDF, given the unavailability of LPS, estimated using the IPE, 1.5 x 10"5/year (Column 7). Since LPS unavailability only impacts ATWS sequences, the difference between the IPE CDF for ATWS sequences and the ATWS CDF, given the loss of LPS is ACDF s=CDFA
- CDFAM I LPSI, 1.5 x lO1/Iyear - 3.7 x 10-6/year = 1.1 x 10-5/year This value can be used in conjunction with the overall IPE CDF (5.4 x 10-5/year) to estimate the LPS unavailability. The overall conditional CDF (conditional frequency of subsequent core damage given the failures observed during an operational event), given the unavailability of LPS, is the significance of CCDFroTAL
= CDFrorAL + ACDFAs 5.4 x 10-5/year + 1.1 x 10-5/year = 6.5 x 10-5/year For a 1-year period, the associated CCDP is CCDP = I - eCCDF... x 1
=1-e 6 5 x 1O 5/yer x lIyear = 6.5 x 10-5 The nominal CDP for the same period is CDP = 1 - e CDFIrA x 1 ya
= 1 -
e 10- 5/,wr xI year = 5.4 x 10-5 B.2-5 NUREG/CR-4674, Vol. 27 Apnendix B B.2-5 NUREG/CR-4674, Vol. 27
I 1*'!
NI,. 1( iO*Qflfl11Aoni J,*I~V
-f~'tl Using these two values, the increase in CDP (importance) is ACDP = CCDP - CDP = 6.5 x 10 5.4 x 10'
= 1.1 x 10-5 The two dominant sequences, 12 and 13 (see Fig. B.2. 1), together contribute about 80% to the increase in CDP (event importance) for this condition. Recall that according to Ref. 2, sequences 12 and 13 contribute -90% of the overall ATWS contribution to the CDF. The contribution of these two sequences decreases because the human errors, which are more likely in sequences 12 and 13, are factored out.
Sequences 12 and 13 both consist of
"* A turbine trip
"* Postulated failure of automatic and manual reactor scram Successful opening of turbine bypass valve to send steam directly to main condenser
"* Failure of recirculating water pump trip (no credit taken for manual trip in Ref. 2)
"* Successful opening of the SRVs Failure of LPS to inject liquid poison.
Up to this point, the two sequences are identical. The last top event in the event tree, Secure Core Cooling, addresses maintaining the integrity of the containment to prevent releases of radioactivity (Ref. 2). During the response to an ATWS-related sequence, if the containment pressure should rise above 0.069 MPa (10 psig), the operator is instructed by the emergency operating procedures to terminate injection to the reactor vessel. If LPS fails, terminating makeup to the reactor coolant inventory will uncover the core, voids will induce subcriticality, and the amount of steam entering the containment will be limited, thereby preventing overpressurization. There are two possible scenarios for Sequence 12. If, following LPS failure, the operator successfully terminates coolant injection and inhibits RDS, core damage will occur with the reactor at high pressure. If the operator fails to inhibit RDS, then RDS actuation and core spray operation are assumed to occur. If the operator should subsequently terminate core spray, core damage will occur to an intact containment with the reactor at low pressure. If the operator takes no action either to inhibit RDS or to terminate core spray (Sequence 13),
containment pressurization will continue with the amount of steam entering containment equivalent to the rate at which core spray is being added to the reactor vessel. As containment pressure and reactor pressure rise, coolant flow to the reactor (through core spray) will slow. If containment pressure should rise to 0.59 MPa (85 psig), the reactor pressure will exceed the shutoff head of the fire pumps, and the coolant flow to the reactor will stop altogether. In this case, core damage would occur with the reactor at low pressure, but with the containment pressurized to near its capacity.
NUREG/CR-4674, Vol.27 B.2-6 NUREG/CR-4674, Vol. 27 Il.Jl,V.
l...J~f--l lII ADoendix B B.2-6
B.2.6 References
- 1. LER No. 155/98-001, "Liquid Poison Tank Discharge Pipe Found Severed during Facility Decommissioning," August 6, 1998.
- 2. Big Rock-Point Probabilistic Risk Assessment, Vols. 1, 2, and 3, submitted via letter from P. M. Donnelly, Consumers Power, to Document Control Desk, Nuclear Regulatory Commission, dated May 5, 1994.
B.2-7 NUREG/CR-4674, Vol. 27 ADvendix B LER No. 155/98-001 B.2-7 NUREG/CR-4674, Vol. 27
LER No. 155/98-001 Appendix B U
U
- 2 Ii U
'a U.
U 04 U
'4 a
Ma
'S U
U I 9
9-00>>o>>
uu
ýCOý
>Q>>eo>ýtu>
00-0 0
0---0
0------
ag
~
~
1W--------------
vN Inqwv
~w L
I I
1 A.
-J 0 a.)
I o
0 I.
I-Fig. B.2.1 Dominant core damage sequences for LER No. 155/98-001 (Source: Big Rock Point Probabilistic Risk Assessment, Vols. 1, 2, and 3, submitted via letter from P. M. Donnelly, Consumers Power, to Document Control Desk, Nuclear Regulatory Commission, dated May 5, 1994, Fig. 7.1.5.3-2). [Under CLASS, IC denotes sequences involving loss of scram function and loss of coolant inventory, IV denotes sequences involving loss of scram function and loss of all reactivity control; and OK denotes transient terminated].
LER No. 155/98-001 Appendix B B.2-8 NUREG/CR-4674, Vol. 27 H
I I
Table B.2.1. Sequence Logic for Dominant Sequences for LER No. 454/98-018 Sequence number Class' Logic 3
IC A-TT, /MC, /RC, /RW, LI, AB, /SC 4
ID A-TT, /MC, /RC, /RW, LI, AB, SC 8
IV A-TT, /MC, /RC, FW, /SV, LI, IR, SC 9
IV A-TT, /MC, /RC, FW, SV 12 IC A-TT, /MC, RC, /SV, LI, IR, /SC 13 IV A-TT, /MC, RC, /SV, LI, IR, SC 17 iC A-TT, MC, /RC, /FW, /SV, /EC, /LI, IR, /SC 18 IV A-TT, MC, /RC, /FW, /SV, /EC, /L1, IR, SC 26 IC A-TT, MC, /RC, FW, /SV, /EC, LI, KR /SC 27 IV A-TT, MC, /RC, FW, /SV, /EC, LI, IR, SC "1 C denotes sequences involving loss of scram function and loss of coolant inventory, IV denotes sequences involving loss of scram function and loss of all reactivity control, and OK denotes transient terminated.
Table B.2.2. System Names for LER No. 454/98-018 B.2-9 NUREG/CR-4674, Vol. 27 System name Logic AB Alternate boron injection through the feedwater system A-TT ATWS - turbine trip EC Emergency condenser FW Main feedwater IR Operators manually insert control rods LI Liquid poison injection (specifically, the LPS system)
MC Bypass valve to main condenser RC Recirculation pump trip SC Secure core cooling SV Safety / relief valve Appendix B B.2-9 NUREG/CR-4674, Vol. 27
I V D Im -- */QR..flfl A
e i*
Table B.2.3. Requantification of Dominant ATWS Sequences Considering LPS Failure Sequence Human frequency /
Time Sequence error HEP =
available for frequency probability conditional injection from IPE (HEP) frequency Initiator Sequence Class" (min)
(per year)
(from IPE)
(per year)
Turbine trip 12 IC 2
1.7 x 10-6 3.0 x 10-1 5.7 x 10' 13 IV 2
1.7 x 10' 3.0 x 10" 5.7 x 10' 17 IC 12 2.5 x 10' 1.0 x 10.2 2.5 x 10' 18 IV 12 2.5 x 10' 1.0 x 10.2 2.5 x 10" Spurious 12 Ic 2
7.4 x 10" 3.0 x 10"'
2.5 x 10' bypass valve opening 13 IV 2
7.4 x 10-8 3.0 x 10' 2.5 x 10' Complete loss 8
IV 2
7.5 x 10' 3.0 x 10' 2.4 x 10' of feedwater 9
IV 2
7.5 x 10' 3.0 x 10' 2.4 x 10.
Spurious MSIV closure No sequences with CDFs > 1.0 x 109/year Loss of main 3
IC 12 2.4 x 10-9 condenser 4
IV 12 2.4 x 10-9 Loss of station 3
IC 8
7.9 x 10.9 power 4IV 8
7.9 x 10-9 Loss of instrument air 26 27 IC 12 4
I I
IV 12 Total 7.9 x 10.-
7.9 x 10-'
3.7 x 10-6 I
al C denotes sequences involving loss of scram function and loss of coolant inventory, I V denotes sequences involving loss of scram function and loss of all reactivity control, and OK denotes transient terminated.
NUREG/CR-4674, Vol. 27 B.2-10 Appendix B
! 17'D 1NJ,,-. I*;K/QRi'XT1 B.2-1 0 NUREG/CR-4674, Vol. 27