ML20112F469
| ML20112F469 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 12/30/1999 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Hunter C (301) 415-1394 | |
| References | |
| LER No. 315/99-031 | |
| Download: ML20112F469 (8) | |
Text
1 Issue No. 135: LER No. 315/99-031 Event
Description:
Valves Required to Operate Post-Accident Could Fail to Open Due to Pressure Locking/Thermal Binding Date of Event:
December 30, 1999 Plant:
Donald C. Cook Nuclear Plant, Units 1 and 2 135.1 Event Summary In LER 315/99-031 (Ref. 1), the licensee reported that a preliminary calculation review determined that valves which provide a suction path from the containment sump to the emergency core cooling system (ECCS) pumps and the valves which align residual heat removal (RHR) to the upper containment spray (CTS) header were susceptible to pressure locking following a postulated loss-of-coolant accident (LOCA). According to the LER, the calculated additional forces due to pressure locking were sufficient to exceed the capability of the respective valve actuators. Consequently, these valves may be incapable of opening under accident conditions.
The estimated increase in the core damage probability (CDP) over a one-year period (i.e., the importance) due to the pressure locking conditions is 3.7x10-5/year. The uncertainty associated with the functionality of the valves in light of their potential to fail due to pressure locking contributes to the uncertainty in this frequency estimate.
135.2 Event Description Pressure locking is a phenomenon in which water trapped in the bonnet cavity and in the space between the two disks of a parallel-disk gate valve or a flexible-wedge gate valve is pressurized above the pressure that was assumed when sizing the valve's motor operator. This prevents the valve operator from opening the valve when required. Water can enter a valve bonnet during normal valve cycling or when a differential pressure moves a disk away from its seat, creating a path to either increase fluid pressure or fill the bonnet with high-pressure fluid. A subsequent increase in the temperature of the fluid in the valve bonnet will cause an increase in bonnet cavity pressure due to thermal expansion of the fluid. Whether situations lead to a valve pressure locking scenario depends upon: (a) the fluid pressure when the bonnet cavity was filled, (b) temperature changes from when the fluid entered the bonnet cavity, and (c) the local line pressure compared with the bonnet cavity pressure at the time the motor-operated valve (MOV) is called upon to operate.
Thermal binding occurs due to different thermal expansion and contraction characteristics of the valve body and the disc. If the valve is closed while the system is hot, thermal binding can occur when the system cools due to the differences in thermal contraction.
References 2 and 3 provide additional details on the pressure locking phenomena and test and maintenance conditions that may lead to pressure locking.
According to Reference 1, at Cook, four valves of both units were identified as susceptible to pressure locking. They are: ICM-305, ICM-306, IMO-330, and IMO-331. ICM-305 and ICM-306 are two normally closed MOVs located outside the reactor building in the two pipes between the RHR pump suction and containment recirculation sump. The RHR sump suction is connected to the refueling water storage tank (RWST) as well. The valves in the pipe from the RWST to the RHR pump suction are
LER 315/99-031 normally open. There are no check valves that would prevent RWST water from reaching the normally closed MOVs. Therefore, the upstream side of these MOVs will be in contact with water from the RWST. The other side of the MOVs communicates with the containment recirculation sump. During a LOCA or a feed-and-bleed cooling scenario, hot water will reach these MOVs. This hot water will heat up the valve body and the water trapped in the valve bonnet relatively rapidly. As a result, the pressure inside the valve bonnet will increase and pressure locking conditions will set in.
After this, thermal equilibration and valve bonnet depressurization will begin. That is, unless the valve is not demanded to open immediately, it will start cooling down and the pressure inside the valve would start dissipating gradually (Ref. 3). Thermal equilibration and valve bonnet depressurization will continue until the operator attempts to open this valve to establish sump recirculation.
IMO-330 and IMO-331 are the RHR to upper containment spray (CTS) shutoff valves. These valves are normally closed. In the event of a LOCA or feed-and-bleed cooling, depending upon the size of the LOCA or the rate of feed-and-bleed, containment spray may be demanded. The containment spray function is accomplished using the two containment spray pumps dedicated to that function. If both these pumps fail, then the RHR pumps can be used to perform the containment spray function. In order to use the RHR pumps to spray the containment, IMO-330 and IMO-331 must be opened.
135.3 Modeling Assumptions Risk Impact of pressure locking in ICM-305 and ICM-306 In the event of a LOCA or a feed-and-bleed cooling scenario, valves ICM-305 and ICM-306 must be opened to establish sump recirculation. If these valves fail to open, then sump recirculation cannot be established. The following sequences were considered. The summary of probabilities and frequencies used to quantify these sequences are provided in Table 1 of this issue:
Sequence 1 - Small LOCAs (Stuck Open PORVs or SRVs, RCP seal LOCAs, or small pipe breaks) and feed-and-bleed cooling scenario A small LOCA or a feed-and-bleed cooling scenario occurs; Sump recirculation is required due to inability to establish RHR cooling prior to depleting RWST; Sump recirculation fails due to pressure locking of ICM-305 and ICM-306; and Cross-tie of the RWST from the affected unit to the unaffected unit fails.
Small LOCA occurs. Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995 (Ref. 7) indicates that the frequency of small LOCAs (includes stuck open PORVs or SRVs, RCP seal LOCAs, and small pipe breaks) is 9x10-3/critical year.
Transient or loss of offsite power event occurs. According to Reference 7, the frequency of a loss of offsite power is 0.046/ critical year; the frequency of a total loss of feedwater flow is 0.085/critical year; and the frequency of total loss of condenser heat sink events (power conversion system) is 0.12/critical year. This adds up to a total frequency of 0.25/critical year.
AFW fails, resulting in feed-and-bleed cooling. From the Cook standardized plant analysis risk (SPAR) model, the failure probability of the AFW system is 1.1x10-4. Therefore, the estimated frequency of a
LER 315/99-031 feed-and-bleed event requiring recirculation is 1.1x10-4x 0.25, or about 2.8x10-5/critical year.
Small LOCA or a feed-and-bleed cooling scenario occurs. Since the frequency of a small LOCA is 9.0x10-3 and the frequency of a feed-and-bleed cooling scenario is about 2.8x10-5/critical year, the sum of these two frequencies is about 9x10-3/critical year.
Sump recirculation is required due to inability to establish RHR cooling prior to depleting RWST. In the event of a small LOCA at a PWR, if the RCS can be depressurized using secondary heat removal and high pressure injection prior to depleting the RWST inventory, RHR cooling can be established and sump recirculation would not be needed. This success path is not modeled in the Cook IPE. That is, according to the Cook IPE, even though it has a RWST with an inventory of approximately 350,000 gallons, sump recirculation is required for all small LOCAs.
Since this is overly conservative, and because: (a) depressurization and establishing RHR is a viable action for the Cook plant, (b) the operator action needed to depressurize and establish RHR is incorporated to the Cook plant emergency operating procedures, and (c) the operators are trained in the use of this EOP (Ref. 12), this analysis credited the capability to stabilize the RCS by depressurizing and establishing RHR cooling. Furthermore, during actual U.S. small LOCA events {Fort Calhoun (1992),
Calvert Cliffs (1994), TMI-2 (1979), Robinson Unit 2 (1975), and Arkansas Nuclear One (1981) (Ref. 5, 6, 7, 8)}, the operators were able to depressurize and establish RHR prior to depleting the RWST inventory.
Based on the SPAR model, this analysis used a probability of 0.004 for failing to cool down the RCS and establish RHR cooling after a small LOCA.
Sump recirculation fails due to pressure locking of ICM-305 and ICM-306. During a small LOCA or a feed-and-bleed cooling scenario, if sump recirculation is demanded, it will be demanded after several hours. When the small LOCA or the feed-and-bleed function starts, the hot RCS water that collects in the sump would enter the RHR suction to the recirculation sump. When the hot water comes into contact with a valve, it will initially heat up the valve body and, in turn, the water trapped inside the valve bonnet.
Note that the sump suction MOVs are located outside of the containment. Therefore, after the initial heat up, if time is available, the valves and the water column inside the pipe from the valve to the containment would start to cool down. During this period, the pressure inside the valve bonnets will dissipate. The pressure dissipation may occur due to leak paths through the valve gaskets. (Whether such leak paths existed is unknown.)
At the Cook plant, water in the RWST is used for injection into the core as well as for spraying the containment to mitigate containment pressure increases. As a result, the RWST may deplete relatively rapidly. However, each of the two Cook units is equipped with an ice condenser as well as a CTS system for containment heat removal. The ice condenser doors open at 0.5 psig. If the containment pressure exceeds 2.5 psig, the CTS system actuates. Reference 11 points out that for pipe breaks less than 2" (Reference 11 analyzed 1" and 1/2 breaks), the sprays will not initiate until the ice depletes. Given that breaks greater than 2" are defined as medium LOCAs, it is reasonable to assume that for most small LOCAs, CTS will be demanded several hours after a small LOCA occurs. Due to the relatively long durations (several hours), the valve bonnets would have time to depressurize before the valves would be demanded. Ref. 2 provides actual pressure locking events during which the valves could be opened after allowing time for bonnet depressurization.
Therefore, this probability was assumed to be LOW.
There is a finite probability of incurring permanent damage to valves as a result of pressure locking. If a
LER 315/99-031 permanent damage occurs to a valve, then it cannot be opened even after cooling down. Ref. 2 discussed 12 events involving approximately 25 valves that were subjected to actual pressure locking conditions. In one of these events, (Ginna, 1969) the MOV incurred permanent structural damage to the valve due to pressure locking. In several other events, the documented experience show that the valves could be opened after bonnet depressurization. Using 1 failure in 25 demands and using the Bayesian update, the probability of causing permanent damage to the valve due to pressure locking is estimated to be about 0.06 (=11/2 / 26).
This probability is considered as an upper bound since, in spite of the large number of other LERs that document conditions where valves were susceptible to pressure locking conditions in plants similar to Ginna, we could not find any other events where actual valve structural damage occurred as a result of pressure locking.
Considering the LOW probability for the event failing to depressurize the bonnet during a small LOCA and the 0.06 probability for the event causing permanent damage to valve as a result of pressure locking, an upper bound of 0.1 was used as the failure probability for failing to establish sump recirculation after a small LOCA due to pressure locking.
Cross-tie of the RWST from the affected unit to the unaffected unit fails. In the event of sump recirculation failure, the RWST of the unaffected unit can be cross-tied to provide inventory to the RCS until RHR can be established. The Cook plant has two RWSTs, one dedicated to each unit, and these RWSTs have cross-tie capability. Technical Specifications require maintaining a minimum RWST inventory in a given unit, even when it is shut down to ensure its capability to feed the second units ECCS during a fire event. During a small break LOCA, in the event the suction from the containment recirculation sump fails due to the MOV failure, the cross-tie can be aligned to add borated water to the RCS. The additional RWST inventory of 350,000 gallons will provide ample time to continue depressurizing and cooling down during discharge flows that are typically encountered from stuck-open PORVs or pressurizer safety valves.
In the absence of significant details on the steps that the operators would follow to align the second units RWST, a probability of 0.34 was used for the failure probability for this action. In Accident Sequence Precursor (ASP) program analyses, a recovery probability of 0.34 has been used for those failures that appear recoverable during the period available at the failed equipment, rather than from the control room, given that the equipment was accessible (Ref. 9).
Using the frequencies and probabilities, the frequency of Sequence 1 was estimated as follows:
(Frequency of small LOCAs or feed-and-bleed cooling scenarios: 9.0x10-3/critical year) x (Criticality factor: 0.79) x (Probability of requiring sump recirculation: 0.004) x (Probability of failing sump recirculation due to pressure locking of the sump recirculation valves: 0.1) x (Probability of failing to establish the cross-tie from the unaffected unit: 0.34) = 9.7x10-7/year Sequence 2 - Medium or large LOCA Medium or Large LOCA occurs; Sump recirculation is required due to inability to establish RHR cooling prior to depleting RWST; Sump recirculation fails due to pressure locking of ICM-305 and ICM-306; and
LER 315/99-031 Cross-tie of the RWST from the affected unit to the unaffected unit fails.
Medium or large LOCA occurs. According to Reference 7, the frequency associated with large pipe breaks is 5.0x10-6/critical year. The frequency of a medium pipe break is 4.0x10-5/critical year.
Therefore, the frequency of a medium or large LOCA is 4.5x10-5/critical year.
Sump recirculation is required due to inability to establish RHR cooling prior to depleting RWST. For medium and large LOCAs, the RWST depletes relatively rapidly. Therefore, it was assumed that sump recirculation was essential for success. Therefore, this probability was assumed to be 1.0.
Sump recirculation fails due to pressure locking of ICM-305 and ICM-306. Per the Cook IPE (Ref. 4),
only 30 minutes would be available between the occurrence of a medium LOCA and the need for sump recirculation. For a large LOCA, the time available would be even less. Therefore, it was assumed that there is insufficient time to equilibrate the pressures within the MOVs. No additional information was available regarding testing and maintenance practices which determine the window of vulnerability of these valves to pressure locking. It was assumed that the valves were vulnerable to pressure locking throughout the year. Consequently, the valves were assumed to fail with a probability of 1.0 Cross-tie of the RWST from the affected unit to the unaffected unit fails. For medium and large LOCAs, the RWST would deplete relatively rapidly. Therefore, it was assumed that there would be insufficient time available to establish the cross-tie. Furthermore, even if the RWST of the unaffected unit is cross-tied, during a medium or a large LOCA it is essential to have sump recirculation to avert core damage.
Hence, this probability was assumed to be 1.0.
Using the frequencies and probabilities, the frequency of Sequence 2 was estimated as follows:
(Frequency of medium or large LOCAs: 4.5x10-5/critical-year) x (Criticality factor: 0.79) x (Probability of requiring sump recirculation: 1.0) x (Probability of failing sump recirculation due to pressure locking sump recirculation valves: 1.0) x (Probability of failing the cross-tie from the unaffected unit: 1.0) = 3.6x10-5/year The above frequency exceeds the ASP program precursor threshold of 1.0x10-6. In addition, since the estimated frequencies of other sequences considered above and the frequencies associated with the pressure locking condition of valves IMO-330 and IMO-331 (discussed below) are well below 3.6x10-5, this sequence is considered as the dominant contributor to risk.
Risk Impact of pressure locking in IMO-330 and IMO-331 IMO-330 and IMO-331 are the RHR to upper containment spray shutoff valves. These valves are normally closed. In the event of a LOCA or a feed-and-bleed cooling event, (depending upon the size of the LOCA or the rate of feed-and-bleed), containment spray may be demanded. The containment spray function is accomplished using the two containment spray pumps dedicated for that function. If both these pumps fail, then the RHR pumps can be used to perform the containment spray function. In order to use the RHR pumps to spray the containment, IMO-330 and IMO-331 must be opened.
Therefore, the sequence of interest is:
Sequence 3:
Initiating event that requires containment spray occurs;
LER 315/99-031 Containment spray from the containment spray system fails; and Alternate spray from the RHR fails due to pressure locking of valves IMO-330 and IMO-331.
Initiating event that requires containment sump spray occurs. Each of the two Cook units is equipped with an ice condenser as well as a CTS system for containment heat removal. The ice condenser doors open at 0.5 psig. If the containment pressure exceeds 2.5 psig, the CTS system actuates. Reference 11 points out that for pipe breaks less than 2" (Reference 11 analyzed 1" and 1/2 breaks) the sprays will not initiate until the ice depletes, adding to the sump inventory. Given that breaks greater than 2" are defined as medium LOCAs, it is reasonable to assume that CTS is essential for large and medium pipe breaks only. However, if it is conservatively assumed that all LOCAs except RCP seal LOCAs and stuck-open PORVs and pressurizer safety valves require CTS, using the frequencies associated with large pipe breaks (5.0x10-6/critical year), medium pipe breaks (4.0x10-5/critical year), small pipe breaks (5.0x10-4/ critical year) the estimated total frequency of LOCAs that demand CTS is approximately 5.5x10-4/critical year (Ref. 7, Table 3-1). The feed-and-bleed cooling scenario has a negligible contribution to this frequency.
Containment sump spray from the containment spray system fails. From the Cook IPE (Ref. 4), the probability of failure for the CTS to inject is 2.5x10-4/demand. The probability of failure for CTS to perform recirculation was estimated to be 6.65x10-4/demand. Therefore, the probability of failing CTS during either injection or recirculation is 9.1x10-4/demand.
Alternate spray from the RHR fails due to pressure locking in IMO-330 and IMO-331. In the absence of additional information on testing and maintenance practices to determine the window of vulnerability of these valves due to pressure locking, it was assumed that the valves were vulnerable to pressure locking throughout the year. Consequently, the valves were assumed to fail with a probability of 1.0.
Using the frequencies and probabilities, the frequency of Sequence 3 was estimated as follows:
(Frequency of initiating events that require containment spray: 5.5x10-4/critical-year) x (Criticality factor: 0.79) x (Probability of failing CTS: 9.1x10-4) x (Probability of failing alternate spray from RHR due to pressure locking: 1.0) = 4.0x10-7/year Since this frequency is below the ASP program precursor threshold of 1.0x10-6, this sequence was screened out from further consideration.
135.4 Analysis of Results The total change in core damage frequency (CDF) associated with this issue is approximately 3.7x10-5/year. The risk significance associated with this issue is dominated by Sequence 2. This sequence is highlighted in the attached event trees (Figures 1 and 2). It consists of a postulated scenario in which MOVs ICM-305 and 306 fail to open due to pressure locking following a medium or a large LOCA. The estimated CDF associated with this sequence was 3.6x10-5/year. The frequencies of the other Sequences associated with ICM-305 and 306 as well as that associated with IMO-330 and IMO-331 were negligible compared to this frequency. The uncertainty associated with the functionality of the valves in light of their potential to fail due to pressure locking contributes to the uncertainty in this frequency estimate.
LER 315/99-031 135.5 References
- 1.
LER 315/99-031, Interim-Valves Required to Operate Post-Accident Could Fail to Open Due to Pressure Locking/Thermal Binding, January 31, 2000.
- 2.
U.S. Nuclear Regulatory Commission, Operating Experience Feedback Report - Pressure Locking and Thermal Binding of Gate Valves, NUREG 1275, Vol. 9, March 31, 1993.
- 3.
U.S. Nuclear Regulatory Commission, Precursors to Potential Severe Core Damage Accidents:
1996, NUREG/CR-4674, Vol. 23, December 1995.
- 4.
Donald C. Cook Nuclear Plant Units 1 and 2, Individual Plant Examination, Revision 1, October 1995.
- 5.
LER 285/92-023, Rev. 0, Reactor Trip Due to Inverter Malfunction and Subsequent Pressurizer Safety Valve Leak, August 3, 1992.
- 6.
LER 317/94-007, Rev. 1, Reactor Trip Caused by Closure of Turbine Stop Valves, August 18, 1994.
- 7.
J. P. Poloski, et al., Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.
- 8.
LER 313/80-015, Rev. 2, RCP Seal of RCP C Failure, April 13, 1981.
- 9.
U.S. Nuclear Regulatory Commission, Precursors to Potential Severe Core Damage Accidents:
1996, NUREG/CR-4674, Vol. 25, December 1997.
- 10.
WASH-1400, Reactor Safety Study, 1975.
- 11.
C.J. Shaffer and D.V. Rao, Confirmatory Calculations of the D.C. Cook Sump Water Level, SEA 97-3703-A: 5, January 5, 1997.
- 12.
Communications between Sunil D. Weerakkody, U.S. Nuclear Regulatory Commission and Brad Smalldridge, American Electric Power, March 16, 2000.
LER 315/99-031 Table 1 for Issue No. 135: Summary of Failure Probabilities and Initiating Event Frequencies Parameter Small LOCA or Feed-and-Bleed Cooling Medium LOCA or Large LOCA Initiating event frequency 9x10-3/critical year (sum of small LOCA and feed-and-bleed cooling event frequencies) 4.5x10-5/critical year (sum of large and medium LOCA frequencies)
Criticality factor 0.79 0.79 Probability of failing to cross-tie RWSTs prior to depleting RWST 0.34 1.0 Probability of failing to depressurize RCS and establish RHR before depleting RWST
.004 N/A Probability of failing to open MOVs ICM-305 or ICM-306
.1 1.0 Probability of failure of containment spray system 9.1x10-4 9.1x10-4