ML20135G973

Final ASP Analysis - Maine Yankee (LER 309-97-004)

ML20135G973
Person / Time
Site:	Maine Yankee
Issue date:	05/14/2020
From:	Christopher Hunter NRC/RES/DRA/PRB
To:
Littlejohn J (301) 415-0428
References
LER 1997-004-00
Download: ML20135G973 (11)

Text

Appendix B LER No. 309/97-004 B.5 LfER No. 309/97-004 Event

Description:

Reactor coolant system hot-leg recirculation valves subject to pressure locking because of post-LOCA thermal expansion of the trapped water Date of Event: January 22, 1997 Plant: Maine Yankee B.5.1 Event Summary Maine Yankee was shut down for refueling when engineers noted a plant design deficiency while conducting a piping system review in response to Nuclear Regulatory Commission (NRC) Generic Letter (GL) 96-06.

Personnel determined that the coolant trapped between the containment integrity check valve and the loop-fill motor-operated valves (MOVs) could cause the loop-fill MOVs to become pressure locked following a loss-of-coolant accident (LOCA). The LOCA could cause the fluid that is normally trapped between these valves to expand. This, in turn, could cause the pressure between the valves to exceed the torque available to open the MOVs (i.e., the valves could become thermally pressure locked). Hence, without sufficient leakage past the loop-fill MOVs, the valves would be rendered inoperable. The loop-fill MOVs are used for hot-leg recirculation to prevent the boron from precipitating in the core. Boron precipitation could lead to core damage by obstructing coolant flow through the core, thereby reducing the removal of decay heat.' The estimated increase in the core damage probability (CDP) over a 1-year period for this event (i.e., the importance) is 1.3 x 10-5. The base probability of core damage (the CDP) for the same period (i.e., 1 year) is 6.9 x 10-5. Uncertainty in the frequency of a large-break LOCA (none have occurred) and the likelihood of a MQV failing under post-LOCA conditions contribute to the uncertainty in this estimate.

B.5.2 Event Description On January 22, 1997, while Maine Yankee was shut down for refueling, engineers were conducting a piping system design review in response to a deficiency identified in licensee event report (LER) 309/96-022 (Ref. 2) and NRC GL 96-06 (Ref. 3). These engineers determined that the section of loop-fill piping between the containment integrity check valve (CH-72) and the loop-fill MOVs (RC-M- 15, 25, 35) was susceptible to thermal pressure locking following a LOCA (Fig. B.5. 1). Emergency operating procedures require this section of piping to be used for hot-leg recirculation 19 h after a large cold-leg break. This is because a large cold-leg LOCA allows a significant portion of safety injection flow from the cold-leg injection paths to bypass the core by flowing directly out the break. The result is boiling in the core, which causes the boron concentration to increase. At Maine Yankee, if the boiling persists for more than 19 h, the concentration of boron in the core can reach the saturation point, allowing precipitation to occur. Boron precipitation would further reduce or obstruct flow through the core and could lead to core damage because of insufficient decay heat removal. Boron precipitation is prevented by the timely switch to hot-leg recirculation. This ensures that injection flow will go through the core before flowing out the break in the cold leg.

NUREG/CR-4674, Vol. 26 B.5-1 B.5-1 NUREG/CR-4674, Vol. 26

Annendix Anna B LER No. 309/97-004 Pressure locking occurs when the fluid in the valve bonnet is at a higher pressure than the adjacent piping at the time of the valve opening. The two most likely scenarios for elevating the pressure in the valve bonnet relative to the pressure in the valve system follow.

I. Thermal pressure locking (or bonnet heatup) can occur when an incompressible fluid is trapped in the valve bonnet (e.g., during valve closure) or a section of piping bounded by a check valve (as in this case),

and the volume in the bonnet/piping is heated. The bonnet heatup scenarios include heating the valve bonnet by an increase in the temperature of the environment during an accident, or heatup because of an increase in the temperature of the process fluid on either side of the valve, etc. (Normal ambient temperature variation is not considered because it occurs over a long time, and pressure changes tend to be alleviated through extremely small amounts of leakage. Further, operating experience shows that normal temperature variations are not a source of pressure-locking events.)

2. Hydraulic pressure locking (or pressure trapping) can occur when an incompressible fluid is trapped in the valve bonnet and is followed by depressurization of the adjacent piping before valve opening.

Examples of hydraulic pressure-locking scenarios include back-leakage past check valves and system operating pressures that are higher than the system pressure when the valve is required to open, which did not occur in this event.

Pressure locking is of concern because the pressure in the space between the two disks of a gate valve can become pressurized above the pressure assumed when sizing the valve's motor operator. This could prevent the valve operator from opening the valve when required.

B.5.3 Additional Event-Related Information During the injection phase, Maine Yankee uses two charging pumps for high-pressure safety.injection (HPSI) of water from the refueling water storage tank (RWST) into each of the three reactor coolant system (RCS) cold legs via two cold-leg injection trains. A third charging pump is available as a spare, but it must be manually aligned (Fig. B.5. 1). During hot-leg recirculation, the charging pumps inject water through the loop-fill MOVs. A safety injection tank (accumulator) is available to inject water into each cold leg automatically if RCS pressure decreases below the pressure in its accumulator [about 1.4 MPa (200 psig)].

Low-pressure safety injection (LPSI) is provided by two residual heat removal (RHR) pumps, which also pump water from the RWST into each RCS cold leg. The two RHR pumps are also used for shutdown decay heat removal.'

The containment spray system provides for recirculation and containment cooling. On a containment spray actuation signal (CSAS), the spray system uses two spray pumps to deliver water through the RHR heat exchangers to two separate spray rings located inside containment. The water is supplied from the RWST or the containment sump following a recirculation actuation signal (RAS). A third spray pump is available as a spare, but it must be. manually aligned. On an RAS, the containment spray pumps provide water from the containment sump, through the RHR heat exchangers, to the charging pump suction (and to the spray rings if a CSAS exists).

B.5-2 NUREGICR-4674, Vol.

NUREG/CR-4674, Vol. 26 26 B.5-2

ADDendix B LER No. 309/97-004 ADDendix B LER No. 309/97-004 B.5.4 Modeling Assumptions Boron precipitation was only considered to be a mechanism for core damage in a break of an RCS cold leg because this allows a significant portion of safety injection water to bypass the core and flow directly out the break. Large- and medium-break LOCAs (LBLOCAs and MLOCAs) currently are not addressed by the models used in the Accident Sequence Precursor (ASP) Program. Therefore, it was necessary to construct a model specifically for this analysis. A latge-break LOCA event tree was created for the Integrated Reliability and Risk Analysis System (IRRAS) model based on the success trees in Maine 'Ankee's IndividualPlantExamination(IPE).1 The Maine Yankee IPE estimates the frequency of a large-break LOCA to be 2.7 x 104 /year; the frequency of a medium-break LOCA is 8.0 x 10O'per year. I The hot-leg fill valves were considered impacted in response to a LOCA during this period (i.e., the water is trapped between valves, and the increased temperature resulting from the LOCA heats the water). A 1-year condition assessment was conducted because this is typically the longest period analyzed by the ASP Program. Hence, a 70% plant availability provides a duration time of approximately 6130 h for this event.

Successful response to a large-break LOCA includes either of the following:

1. One HPSI train, one LPSI train, one accumulator, and successful switchover to cold-leg recirculation that requires at least one containment spray pump. Hot-leg recirculation is not addressed by the IPE; however, the LER for this event indicated that the switchover to hot-leg recirculation is required 19 h after a large cold-leg break.

2. No LIPSI trains, two LPSI trains, one accumulator, and successful switch-over to cold-leg recirculation.

Again, switchover to hot-leg recirculation is required 19 h following a laige cold-leg break.

Based on these combinations, an LBLOCA event tree was constructed (Fig. B.5.2).

The event tree for the LBLOCA event tree includes the following branches:

IE-LBLOCA. The initiating event is an LBLOCA. The frequency of an LBLOCA is estimated to be 2.7x 10'/year. This value is consistent with a survey of laige- and medium-break LOCA frequencies provided in the 1994 ASP report (see Appendix H.6 in Ref. 6 for additional information). A reactor trip is not a prerequisite for preventing core damage following an LBLOCA because void formations resulting from boiling terminate the fission process. Therefore, a reactor trip is not included in the event tree.

HPSI. The existing IRRAS fault tree for the HPSI system is used for this event tree branch. A system failure, by itself, does not lead to core damage. Howeve4 most HPSI system components (e.g., pumps, valves, piping) are required for successfuil recirculation.

LPSI-1. The fault tree for this event was constructed assuming that the break occurs in one of the three RCS cold legs. Therefore, one of three injection paths is assumed to be unavailable with all injection flow from NUREG/CR-4674, Vol. 26 B.5-3 NUR G/CR-4674, Vol. 26

LER No. 309/97-004 Apni Appendix B LPSI-2. The fault tree for this event is the same as the LPSI-1I fault tree except that both RHR pumps and both injection trains are required for success.

AlI. The fault tree for this event was also constructed assuming that the break is in one of the RCS cold legs.

Therefore, the contents of one accumulator are assumed to flow directly out the break. Success for this branch occurs if one of the two intact loop accumulators injects borated water properly. An accumulator is assumed to operate correctly if the associated accumulator MOV remains open and the corresponding check valve opens as designed.

Cold-Leg Recirculation. Success for this branch implies that at least one containment spray train operates to supply water to the suction of the HPSI system from the containment sump. At least one HPSI train must also operate and inject water into one of the two intact RCS cold legs.

Cold-Leg Break. Success for this branch implies that the LOCA occurred in one of the RCS hot legs, because hot-leg recirculation would not be required to prevent core damage following a hot-leg break. This analysis assumes an equal likelihood that the LBLOCA will occur in a cold leg or hot leg (i.e., LEAK-IN-COLD-LEG

= 0.5).

Hot-Leg Recirculation. Success requires at least one of the three loop-fill MOVs to open and one of the two cold-leg injection paths to be isolated. Because the required components for successful hot-leg and cold-leg recirculation are essentially the same (such as HPSI pumps, RWST isolation valves), it is assumed that if cold-leg recirculation failed, then hot-leg recirculation will not be successful either, leading to core damage.

Predicting with certainty the containment environment 19 h following an LBLOCA is difficult. The location of the loop-fill valves and the temperature of the containment heat sink will greatly influence the status of the loop-fill MOVs. Additionally, because of the piping configuration, if any one of the loop-fill valves opens, the pressure will be relieved on all three valves. As a result, the nominal failure probabilities (3.0 x 10~) for the loop-fill MOVs (HPR--MOV-CC-HOTA, -HOTB, -HOTC) were not adjusted. However, the loop-fill MQV common-cause failure probability (HPR-MOV-CF-HOT) was adjusted from its nominal probability.

Based on the licensee discussion in the event report, there were two possible failure mechanisms for each loop-fill MOV. The event report' indicated that "... based on engineering judgement it has been determined that [a LOCA induced] pressure increase [in the adjacent piping] could render the loop-fill valves inoperable either by physically damaging the valves or hydrostatically locking the valve disk in place." The event report also indicated that check valve leakage on the opposite end of the affected pipe run could prevent any impact on the loop-fill MOVs (i.e., the probability of the valves becoming pressure locked = 0.0). Lacking more explicit detail, all three of these possibilities were considered equally likely to occur. If a loop-fill MOV was damaged (probability = 0.33), it was assumed that the valve would not open when required (i.e., the probability of the valves failing to operate = 1.0). If a loop-fill MOV disk was hydrostatically locked in place (probability = 0.33), there was assumed to be some chance of the motor torque overcoming the pressure lock as the hot water that expanded into the disk cavity cooled. According to the FSAR4 , in the worst case, the containment temperature will peak within 10 s at -135TC (275'F) [the initial temperature was 41 T (105*F)].

After 19 h the temperature is predicted to be -82T0 (180'F). This is about one-half of the peak temperature.

Therefore, it was assumed that the probability of the motor torque being insufficient to overcome the loop-fill NUREG/CR-4674, Vol. 26B.- B.54

LER No. 309/97-004 LRN.399-0 Appendi B MOV disk pressure given that the valves would initially have been hydraulically pressure locked was essentially 0.5. As a result, the common cause failure probability for the three loop-fill valves was set to

[(0. 0 x 0. 33) +(1.0 - 0.33) +(0.5 x 0. 33)]' = 0. 1.

It was further assumed that the operator cannot recover the hot-leg recirculation configuration if the loop-fill MOVs fail because of thermal pressure locking. Therefore, the operator nonrecovery probability (HPR-XHE-NOREC-HL) was set to TRUE (1.0).

B.5.5 Analysis Results The increase in the CDP over a 1-year period for this event is estimated to be 1.3 x 10'~. The nominal CDP over the same 1-year period for all sequences is 6.9 x 10'. There is substantial uncertainty in this estimate because of the uncertainty in the frequency of an LBLOCA (none have occurred) and the likelihood of MOVs failing under post-LOCA conditions. The dominant core damage sequence for this event (Sequence 3 on Fig. 2) involves the following events:

" a postulated LBLOCA in one cold leg,

" success of the HPSI system,

" success of the LPSI system,

• success of the accumulator system,

" success of the cold-leg recirculation configuration, and

" a failure of the hot-leg recirculation configuration.

This sequence accounts for almost 100% of the total contribution to the increase in the CDP. No other initiating events are affected by a failure of the hot-leg recirculation configuration.

If the loop-fill MQVs are considered disabled for the long-term following a LOCA, given that they become hydrostatically pressure locked, then the increase in CDP as a result of this event over a 1-year period swells to 3.9 x 10'. Conversely, if the drop to 22*C (180*F) in containment 18 h after a LOCA is assumed to be sufficient in all cases to allow the motor torque to overcome any pressure locking in all three loop-fill MOVs, then the increase in CDP as a result of this event drops to 5.2 x 10 -6.

Definitions and probabilities for selected basic events are shown in Table B.5. 1. The conditional probabilities associated with the highest probability sequences are shown in Table B.5.2. Table B.5.3 lists the sequence logic associated with the sequences listed in Table B.5.2. Table B.5.4 describes the system names associated with the dominant sequences. Minimal cut sets associated with the dominant sequences are shown in Table B.5.5.

B.5.6 References

1. LER 309/97-004, Rev. 0, "RCS LoDop-Fill Header MOV Overpressure," February 24, 1997.

2. LER 309/96-022, Rev. 0, "Containment Primary Component Cooling Piping Design Inadequacy Due to Lack of Thermal Relief Valves," August 19, 1996.

NUTlEGICR-4674, Vol. 26 B.5-5 NUTREG/CR-4674, Vol. 26

Avvendix Apni B LER No. 309/97-004

3. NRC Generic Letter 96-06, "Assurance of Equipment Operability and Containment Integrity During Design-Basis Accident Conditions," September 30, 1996.

4. Maine Yankee Atomic Power Company, FinalSafety Analysis Report.

5. Maine Yankee Atomic Power Company, Individual PlantExamination.

6. R. J. Belles et al., Precursors to Potential Severe Core Damage Accidents: 1994, A Status Report, USNRC Report NUREG/CR-4674 (ORNL/NOAC-232), Vol. 21, December 1995.

NUREGICR-4674, Vol. 26B.6 B.5-6

tD

=

Q.r

'Tj c!ti"  :

Vl

=

0 s*

Je:

<§.

I "O

I'll a

u.

s*

=.!.J1 =*

er

r" Figure removed during SUNSI review.

i-I'll ct 13 t""'

I t!j

z

?

c...i

°'-I

< -...I i

I

°' f

LER No. 309/97-004 ADDendix B B ~ a a

- a -- N a

NJ 4 go I* tol 0 1- 0 - -

0 0

w 0

0 C) z 0

w

-J it N

0

.J.

a.0 C

.00 0<

I 0

RX c w

Fig. B.5.2 Dominant core damage sequence for LER No. 309/97-004.

26 B.5-8 NUREG/CR-4674, Vol.Vol. 26 B.5-8

Annendi~x B nnend B LER No. 309197-004 LER No. 309/97-004 Table B.5.1. Definitions and Probabilities for Selected Basic Events for LER No. 309/97-004 Modified Event Base Current for this name Description probability probability Type event IE-LBLOCA Initiating Event-Large-break 4.4 E-008 4.4 E-008 NEW No LOCA l-PR-MOV-CC-HOTA Failure of MOV RC-M-15 (Loop- 3.0 E-003 3.0 E-003 NEW No Fill) to Open for Hot-Leg Recirculation HPR-MOV-CC-HOTB Failure of MOV RC-M-25 (Loop- 3.0 E-003 3.0 E-003 NEW No Fill) to Open for Hot-Leg Recirculation HPR-MOV-CC-HOTC Failure of MOV RC-M-35 (Loop- 3.0 E-003 3.0 E-003 NEW No Fill) to Open for Hot-Leg Recirculation HPR-MOV-CF-HOT Common-Cause Failure of Hot- 7.9 E-005 1.0 E-O00I NEW Yes Leg Recirculation MOVs____

HPR-XHE-NOREC-HL Operator Fails to Recover Hot- 8.0 E-00 1 1.0 E+000 NEW Yes

_____________Leg Recirculation TRUE LEAK-IN-COLD-LEG Large-Break LOCA Occurs in 5.0 E-O001 5.0 E-00 I NEW No One of the Three RCS Cold Legs I______ I___I B.5-9 NUREG/CR4674, Vol.

NRCC-64 o.2 26

LER No. 309/97-004 ADDendix B Appendix B LER No. 309/97-004 Table B.5.2. Sequence Conditional Probabilities for LER No. 309/97-004 Event tree name I J Sequence number Conditional core damage probability Core damage probability Importance (CCDP-CDP)

Percent contribution'm j j ~(CCDP) (CDP) ______ _____

LBLOCA 03 1.3 E-005 1.4 E-007 1.3 E-005 99.9 Total (all sequences) 1 8.2 E-005 1 6.9 E-00 5 1 1.3 E-005 Tercent contribution to the total importance.

Table B.5.3. Sequence Logic for Dominant Sequences for LER No. 309/97-004 Event tree name Sequence Logic number LBLOCA 03 /HPI, /LPSI-l1, /A 1, /COLDLEG,

__________ _________RCSCOLD, HOTLEG Table B.5.4. System Names for LER No. 309/97-004 System name Logic Al Failure of One of Two Accumulators (Assumes a Cold-

___________Leg Break)

COLDLEG Failure of Cold-Leg Recirculation HOTLEG Failure of Hot-Leg Recirculation HPI No or Insufficient Flow From the HPSI System LPSI-1 LPSI Fails When One of Two Pumps Are Required IRCSCOLD LBLOCA Occurs in One of the Three RCS Cold Legs J B.5-10 NUIIEG/CR-4674, Vol.

NUREG/CR-4674, Vol. 26 26 B.5-10

Avvendix B LER LER No.No. 309/97-004 309/97-004 Appendix B Table B.5.5. Conditional Cut Sets for Higher Probability Sequences for LER No. 309/97-004 Cut set Percent Change in number contribution CCDP Cut setsb (importance)a LBLOCA Sequence 03 1.3 E-005 17 97.4 1.3 E-005 I LEAK-IN-COLD-LEG, HPR-MOV-CF-HQT, HPR-XH-E-NOREC-HL I Total (all sequences) 1.3 E-005 aThe change in conditional probability (importance) is determined by calculating the conditional probability for the period in which the condition existed and subtracting the conditional probability for the same period but with plant equipment assumed to be operating nominally. The conditional probability for each cut set within a sequence is determined by multiplying the probability that the portion of the sequence that makes the precursor visible (e.g., the system with a failure is demanded) will occur during the duration of the event by the probabilities of the remaining basic events in the minimal cut set. This can be approximated by 1 - e-", where p is determined by multiplying the expected number of initiators that occur during the duration of the event by the probabilities of the basic events in that minimal cut set. The expected number of initiators is given by It, where I is the frequency of the initiating event (given on a per-hour basis), and t is the duration time of the event. This approximation is conservative for precursors made visible by the initiating event.

The frequency of interest for this event is ý,Lo. = 4.4 x 10-8/h. The duration time for this event is 6130 h (8760 h x0.7).

bBasic event HPR-XHE-NOREC-HL is a type TRUE event. This type of event is not normally included in the output of the fault tree reduction process, but it has been added to aid in understanding the sequences to potential core damage associated with the event.

NUREG/CR-4674, Vol. 26 B.5-1 1 B.5-11 NLTREG/CR-4674, Vol. 26