ML20199L073

Probabilistic Safety Study,Northeast Util Svc Company Evaluation of Probabilistic Safety Study Results

ML20199L073
Person / Time
Site:	Haddam Neck File:Connecticut Yankee Atomic Power Co icon.png
Issue date:	03/31/1986
From:	NORTHEAST UTILITIES SERVICE CO.
To:
Shared Package
ML20199L056	List: ML20199L054 ML20199L073
References
NUDOCS 8604100287
Download: ML20199L073 (8)

Text

. $.

I Docket No. 50-213 B12020 Haddam Neck Probabilistic Safety Study NUSCO Evaluation of PSS Results March,1986 8604100287 860331 PDR ADOCK0500g3-P

.)

. i.

During the development of the Haddam Neck Probabilistic Safety Study (PSS),

Northeast Utilities Service Company (NUSCO) obtained many new engineering insights into the expected performance of the Haddam Neck Plant during transient situations. Discussions of the major insights developed from the study are presented in this section which serves as the cornerstcne for Connecticut Yankee Atomic Power Company's (CYAPCO) efforts to reduce the overall calculated core melt frequency at the Haddam Neck Plant.

I.

Plant Changes Implemented as a Result of the PSS 1)

Removal of the Interdependence of the Emergency Diesel Generator on Common Motor Control Center-5 (MCC-5)

During efforts to integrate the PSS system reliability models, an interdependency between the emergency diesel generators (ED/G) and safety-related MCC-5 was highlighted.

This interdependence was LER 85-029.(a) letter dated November 8,1985(l) and was reported as discussed in 2

Specifically, the air-operated valves (AOV) which allow cooling water to the ED/Cs are operated by solenoid-operated valves (SOV).

Although the AOVs fail open on loss of air, the SOVs require AC power from MCC-5 to operate and open the AOVs.' A loss of offsite power coincident with a sustained interruption of power to MCC-5 could cause both diesels to overheat and subsequently fail if operator recognition and action does not take place. However, loss of offsite power and MCC-5 does not affect the ability of the diesel generators to start up. If one or both diesel generators start up, accept their emergency loads and properly reenergize MCC-5 as designed, the original AOV/SOV configuration would result in long-term diesel generator cooling availability.

Following discussions with the diesel manufacturer, immediate corrective actions were implemented to maintain one of the ED/G AOVs in the open position (air supply removed), monitor the effect on lube oil temperature of continuous service water flow to the jacket water heat exchangers and perform a service test after tube oil temperature equalized (testing was in accordance with the requirements of Technical Specification Section 4-5.a). Subsequently, the remaining AOV was also modified to permit continuous cooling water to the diesel engine. Permanent modifications were planned for the 1986 refueling outage to remove this interdependency and allow the AOVs to remain closed during normal plant operation.

The equipment / parts that will allow CYAPCO to install permanent modifications to this system are on order and are expected to be (1)

3. F. Opeka letter to C. I. Grimes, "Probabilistic Safety Study Finding,"

dated November 8,1985.

(2)

L censee Event Report 85-029 for the Haddam Neck

Plant,

" Interdependence of Emergency Diesel Generators and Common Motor Control Center," dated December 2,1985.

.a

., i -.

A 1

i !

delivered during the latter part of April 1986. Presently, the Haddam f;

~

Neck Plant is scheduled to start-up from the _1986 refueling outage during April 1986.

As such, the permanent modifications to the 1

-emergency diesel generators may not be fully implemented before the i

end of the current outage. However, as the planned modifications can 1'

be implemented with the plant in operation, CYAPCO will install the j

permanent modifications upon receipt of the necessary l

equipment / parts.

This information supersedes the schedule for.

resolution presented in the previously_ mentioned LER.~ In the interim, i

the short-term corrective actions (continuous service. water flow to j.

-the jacket water heat exchangers) will remain in place, ensuring the i

above-mentioned interdependency will not adversely affect the j

emergency diesel generator operation.

a.

j At the time of the discovery of this interdependency, all of the PSS i

system's models were being integrated to provide an overall.

j assessment of core melt frequency. A preliminary assessment of this j

particular sequence identified it as the dominant contributor to station l

blackout frequency and a major contributor to core melt frequency.

As a result, the above-mentioned short-term modifications were l

implemented to remove the interdependency.

Thus the core melt frequer:cy value of 5.5 x 10-4/ reactor-year 'does not include the contribution from this scenario.

2.

Mitigation of the Effects of the Loss of MCC-5 as a Transient Initiator i

As part of the overall PSS effort, the frequency and consequences of -

the loss of MCC-5(3) as an initiating event were also considered.

System reliability calculaticns were performed using fault tree analysis to estimate the frequency of occurrence of loss of MCC-5.

Failure modes and effects analyses were performed to determine the j-consequences of the loss of MCC-5. Walkdowns of the plant with the operating staff at Haddam Neck identified the means of identifying the transient as well as possible means of recovering the system and/or mitigating the effects of its loss..

i i

The scenario is initiated by a de-energization of MCC-5 resulting from i

any of a number of causes. A large fraction of the de-energization of MCC-5 events (95 to 99 percent) are potentially recoverable.

However, as a result of the loss of MCC-5 there is a loss of semi-vital AC power along with a trip of both main feedwater pumps on sensed i

Iow-suction pressure. Subsequently, the reactor trips on feed flow -

steam flow mismatch. The loss of MCC-5 also causes the loss of the i

control air compressors, loss of closed cooling water pumps for i

compressor cooling and loss of most of the important motor-operated valves including safety injection, core deluge, containment spray, pressurizer relief, loop isolation, and chemical and volume control systems valves.

I i'

(3) This component is not required to meet the single failure criterion as described in the " United States Atomic Energy Commission Safety Evaluation by the Division of Reactor Licensing", dated July 1,1971.

4

-,-w

,...+,.,,-c-,-

.,--.e m-c

._-.u

.__-.-y

_...,y,,,

.._.,,..*g,___,-v.

.,_w--w-m-r

+

.e.----m.,9+,

,4....,,,m.

,y,._

O 4 6 The loss of semi-vital AC power, in addition to causing the loss of important instrumentation such as steam generator pressure and auxiliary feedwater flow, automatically starts the stand-by charging pump and isolates letdown makeup to the volume control tank (VCT).

The charging pump main tube oil pumps stop on loss of MCC-5, although the auxiliary lube oil pumps would be available.' Automatic switch-over of charging pump suction from the VCT to the refueling water storage tank (RWST) fails as the VCT level goes down. Within several minutes of initiation, the VCT is drained. Without operator intervention, both charging pumps would cavitate and be damaged soon thereafter. With the loss of MCC-5, many alarms would be received in the control room. Because of the eventual loss of control air, all AOVs would fail in their safe position, but automatic control would be lost. Auxiliary feedwater would be available because the AOVs would fail open, but their position could not be controlled from the control Likewise, the positive displacement (metering) charging pump room.

would not be controllable.

Component cooling water flow to the reactor coolant pump (RCP) thermal barrier would be lost because the AOV fails closed on loss of air or loss of semi-vital AC power. Hence, all RCP seal cooling is potentially lost. On the secondary side, the loss of air results in the eventual closing of the main steam trip valves. The turbine bypass valves (steam dump to condenser) as well as the atmospheric steam dump valve would not be available.

Preliminary evaluation of the above scenario identified this transient as one of the dominant contributors to the core melt frequency. As a result, a project assignment using " emergency" work-order procedures was initiated to eftect plant design changes necessary to trip the charging pumps on loss of MCC-5 (specifically loss of semi-vital AC power). Manual realignment of charging suction to the RWST would ensure reactor coolant system make-up capability during this scenario.

The PSS identified possible means of mitigating the accident including the potential for recovering MCC-5, and the cross-tie of service air to control air along with compressor cooling using the well water system.

With air restored, auto-control of the charging metering pump as well as control room operation of auxiliary feedwater flow would be available. The draft symptom-based Emergency Response Guidelines are also undergoing evaluation to incorporate means of identification and mitigation of this transient.

As of this writing, the above described plant modifications and associated procedure changes arc in the process of being implemented, j

Our objective is to complete this effort prior to plant start-up.

However, depending upon the actual date of plant start-up, completion of the wo-k may occur carly during the upcoming cycle. Since their work will be completed either prior to start-up or shortly thereafter, we have elected to credit these modifications in the PSS calculations.

The calculated core melt frequency of 5.5 x 10-4 per reactor-year does include some residual contribution from this accident scenario, but the plant design / procedural changes described above have removed most of the contribution of this scenario.

1

e o s

' l II.

Engineering Insights Obtained from the PSS 1)

Adverse Break Size and Location in the Reactor Coolant System (RCS) j During performance of the "Best Estimate LOCA Analysis" (NUSCO-150),' a small range of break sizes in loop 2 cold leg of the RCS was identified for which safety injection flow - in the high-pressure recirculation mode may be insufficient to prevent core uncovery in the i

absence of modifications to facility operating procedures and/or system (e.g., valve) realignment.

The specific break sizes and locations involved are breaks of 0.045 ft.2 to 0.02 ft.2 in the cold leg 4

pump discharge line for RCS Loop 2 and breaks less than 0.045 f t.2 in the Loop 2 charging line and connected piping.

For Loop 2 breaks greater than or equal to 0.045 ft.2 (equivalent diameter = 2.9 inches), the RCS, with all accident mitigation pumps activated in the injection mode, will depressurize to 165 psia (150 psig)

I and below prior to initiation of core uncovery and also prior to the depletion of 100,000 gallons of RWST inventory.

Low-pressure recirculation using the residual heat removal (RHR) pumps would j

follow.

i For Loop 2 cold leg breaks less than or equal to 0.02 ft.2 (equivalent diameter =

1.9 inches), one charging pump and only one of two charging flow control valves is sufficient in the high pressure recirculation mode to prevent core uncovery.

(The high pressure recirculation mode commences by aligning the charging pump suction to the discharge of the RHR pumps when RCS pressure is above 165 psia. The sole delivery point is to the Loop 2 cold leg.)

Breaks located directly in the charging line or connected piping i

downstream of the check valves for sizes 0.045 ft.2 and smaller may also produce results analogous to the Loop 2 cold leg breaks discussed above since for these breaks the RCS pressure also remains above i

165 psia while the charging flow provides insufficient flow to prevent core uncovery.

l The frequency of these breaks was estimated in the PSS by multiplying the (generic) frequency of various size LOCAs times the conditional probability that a break of a given size occurred in the adverse location. This conditional probability was derived by totalling up the number of pipe segments in the affected location and dividing by the total number of pertinent pipe sections of the given size range throughout the RCS. A pipe segment is defined as a section of pipe between major discontinuties (e.g., valves, reducers, etc). In the PSS, approximately 9% of the medium break LOCAs and 1% of the small break LOCAs are estimated to occur in adverse locations.

The-definition of a pipe segment and the methodology used for quantification is consistent with WASH-1400.

As a result of this discovery, evaluation of the feasibility of utilizing additional sources of borated water to extend the injection phase and/or using other available injection paths, such as the loop-fill

header or auxiliary pressurizer spray, are being evaluated. This issue is being addressed in separate correspondence.

2)

Best Estimate LOCA Analysis J

In support of the PSS, plant-specific thermal-hydraulic analyses were i

performed for a wide spectrum of potential core uncovery events. The results are summarized in the " Connecticut Yankee (Haddam Neck Plant) Best Estimate LOCA Analysis," NUSCO-150.

The major i

findings of the analysis are summarized as follows:

For large breaks (area > 0.2 ft.2), success of emergency core o

cooling in the injection phase requires only one low-pressure safety injection pump providing flow through one core deluge valve.

J j

o For medium breaks (0.2 f t.2 2 area 20.02 ft.2), success requires only one high-pressure safety injection (HPSI) pump providing flow to 3 of 3 unfaulted loops (or 2 HPSI pumps to 2 of 3 unfaulted loops).

=

For medium-small breaks (0.02 ft.23 area 3 0.003 ft.2), success o

j requires only one charging pump or one HPSI pump for mitigation.

For small breaks (area < 0.003 ft.2), success requires steam o

generator heat removal capability in addition to either one HPSI pump or one charging pump for mitigation.

o " Feed-and-bleed" cooling requires one charging pump and I

one pressurizer PORV, or one HPSI pump and two PORVs.

Initiation of feed-and-bleed is required approximately 40 minutes.

I following the loss of all steam generator feedwater.

I o For station blackout, core damage would not occur for over j

i i

eight hours, even assuming catastrophic failure of all. reactor r

coolant pump seals.

3)

Additional Findings The following additional insights are also of interest:-

There are eight potential paths for high. pressure / low pressure o

interfacing systems LOCA; however, the overall contribution to core melt frequency is low.

o Pipe ruptures in the letdown line outside containment but upstream of the flow control orifices, although relatively low in frequency, have only one potential means of isolation (LD-MOV-200).

Failure of the MOV to close either automatically or manually could potentially result in an unisolated LOCA outside containment; the sequence could possibly be risk dominant. As

)

j part of the Integrated Safety Assessment Program (ISAP),

i l

i

o e.. evaluations are underway to determine whether a proposed design change to add an additional containment isolation valve outside containment for other reasons might be more appropriate if relocated inside containment.

o A reliability analysis of the auxiliary feedwater system has found the unavailability of automatic initiation of the system to be dominated by failures of air-operated (and particularly solenoid-operated) valves. Changes to periodic testing frequencies of.the valves are under. consideration.

In addition, a - potentially significant common cause failure of the system due to the nonrestoration of manual valves following preventive maintenance has been identified and is under evaluation, o Failure of SW-MOV-5 and 6 to open on demand are found to be dominant contributors to RHR system unavailability in the LOCA recirculation mode of core cooling, Based on current procedures, the testing of the main steam trip.

o valve transmitters was found not to be systematic in that testing of all four channels is not assured.

The fans for cooling the charging pump lube oil coolers offer a o

potential means of providing cooling independent of component cooling water; however, no information on the design adequacy has been found nor are there any testing or maintenance procedures for the fans.

The diesel-driven fire pump provides an AC independent means o

of containment spray during station blackout should containment heat removal be necessary; however, a single motor-operated valve (MOV-31) outside containment would have to be opened manually. This feature of an AC-independent containment spray pump is important in minimizing the offsite public consequences resulting from core melt due to station blackout.

On a best estimate basia, the RCS loop isolation valves have o

been found to provide a reasonable means of mitigating the effects of steam generator tube ruptures.

o Due to the diversity and redundancy of containment heat removal features (four fan coolers, six pumps for spray), the overall availability of containment heat removal systems for mitigating the impact of core damage accidents was found to be exceptional.

The overall reliability of main feedwater/ auxiliary feedwater o

post-trip (non-loss of feedwater events) was likewise found to be exceptional.

III.

Discussion of RCS Piping Ductility The PSS results are based on LOCA frequencies derived. from the experience of pressurized water reactors, as quantified in WASH-1400.

r 3

o. The actual LOCA frequencies at Haddam Neck are expected to be lower than the values used in the PSS since the piping material is austenitic stainless steel while the PWR population includes plants which use ferritic carbon steel. Stainless steel provides superior ductility and toughness and is not susceptible to brittle fracture at low temperatures. Thus, the PSS results include an unquantified conservatism in terms of the actual LOCA frequencies.

IV.

Discussion of Haddam Neck Plant-Specific Simulator Experience The plant-specific control room simulator for the Haddam Neck Plant became available during the last month of the study. Additional benefits will be realized in the future as the results of the PSS are incorporated into the training of operators on the simulator.

V.

Future NUSCO Actions As stated previously, NUSCO is currently reviewing the results of the PSS to determine the best alternatives available to reduce the core melt frequency at the Haddam Neck Plant. Completion of these analyses will result in either a clarification of the system success criteria, identification of weaknesses or recommendations for posible hardware and/or emergency operating procedure changes. When these are completed we will requantify the Haddam Neck PSS models reflecting the net effects of these changes.

As new issues are identified during our review of the PSS, we plan to either:

a)

Implement a project assignment corresponding to the identified issue, if the issue is deemed to have a high level of importance to plant safety, or b)

Evaluate the issue and any resultant projects within the framework of the ISAP, and implement modifications to the plant / procedures on a schedule commensurate with the results of the ISAP evaluation.

i l