ML20210B135
| ML20210B135 | |
| Person / Time | |
|---|---|
| Site: | Quad Cities  |
| Issue date: | 04/27/1987 |
| From: | Johnson I COMMONWEALTH EDISON CO. |
| To: | Murley T Office of Nuclear Reactor Regulation |
| References | |
| TASK-105, TASK-OR TAC-57979, NUDOCS 8705050239 | |
| Download: ML20210B135 (9) | |
Text
/m
.- N Commonwealth Edison
~
i / One First National Plaza. Chicago, lilinois
/ Address Reply tz Post Omce Box 767
\\d Chicago, Illinois 60690 0767 April 27, 1987 Mr. Thomas E. Murley, Director Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555
Subject:
Quad Cities Station, Units 1 and 2 Summary of Commonwealth Edison Review Brookhaven National Laboratory (BNL)
Probabilistic Risk Assessment (PRA)
Interfacing Systems LOCA Generic Issue #105, TAC 57979 NRC Docket No. 50-254/50-265
Reference:
Letter, J.A. Zwolinski to D.L. Farrar, request for CECO review of subject report, dated December 12, 1986.
Dear Mr. Murley:
Commonwealth Edison Company has completed a review of the subject BNL report. Our review concentrated primarily on the PRA aspects of the report (see Attachment 1).
We have also provided a cost estimate (Attachment 2) of the possible alternatives which are outlined in the report for Quad cities Station. Our other comments will be forwarded through the BWR Owner's Group organization.
. provides specific corr 2ents on the PRA aspects of the draft BNL report. First a description of our understanding of the basic j
approach of the study is presented, followed by a description of the l
multiple conservatisms which resulted from the simplifying assumptions.
I Several significant additional corrections and clarifications are also i
listed. Finally, we conclude that the BNL report results must be viewed as upper bounds on the core damage frequency and that the benefits of the i
corrective actions were overstated, r
l provides a cost estimate of the proposed BNL i
corrective actions for Quad Cities. A modification is required to install test taps to accomplish the suggested leak testing of the air operated check l
i 8705050239 870427 DR ADOCK 05000254
[00/
l PDR l
/
Mr. T. E. Murley April 27, 1987 valves. The estimate only applies to the core spray lines.
It should be noted that the dollar estimates are " ball park" numbers and do not include the costs associated with the expected radiation exposure during the modification installation and subsequent testing each refueling.
We appreciate this opportunity to comment on the BNL report. Please contact this office regarding any questions or comments.
Yours very truly, w
I. M. John Nuclear Licensing Administrator bs Attachmenta cc:
T. Ross - NRR I
l l
f I
300lK l
l
4 o,
p ATTACIDENT 1 s
i
" CECO Comments on Draft Brookhaven National Laboratory Interfacing LOCA Study /
Quad cities Station" According to the study's introduction, its objective is to provide technical support to the NRC to resolve the interfacing LOCA generic issue. The study seeks to determine the core melt risk due to failure of pressure isolation valves, and the value of corrective actions such as leakage testing. To do this, the study first reviews industry experience with check valve failure on low pressure lines connected to the reactor coolant system. Simplified event trees are presented for development of such events into large and small LOCA's, and for progression of the small LOCA's.
Most branch probabilities, like feedwater reliability and ECCS reliability, were taken from Brookhaven's review of the Shoreham pRA.
Human action reliability came from handbooks or NRC studies. Each of the three plants studied was reviewed for candidate lines for interfacing LOCA. For each of those lines, the event tree was evaluated for several initiating events. Each historical occurrence of check valve failure was considered as an initiating event, I
with its frequency derived from that limited historic data. The event tree node probabilities were modified somewhat, depending on the specific l
initiating event and the details of a given plant's design. The resulting small LOCA, large LOCA, and core damage frequencies were summed over all events for each line, and then those results were summed over all lines for each plant. Corrective actions were proposed, and their effects on valve failure probabilities were determined. The core damage values were then recalculated, and the core damage frequency reduction for each corrective action was reported. The total interfacing LOCA core l
damage frequency for Quad Cities, as currently operated, was calculated l
to be between 2.26 x 10-7/yr. and 9.59 x 10-6/yr., depending on the l
assumptions for conditional probability of pipe rupture, given an overpressurization. Annual leak testing of testable check valves in ECCS I
would reduce this core damage frequency between 26% and 86%. Leak i
testing after maintenance would improve CDP between 10% and 63%. The combined effect would be an improvement of between 27% and 92%.
These results must be interpreted very carefully. Although it appears that significant improvements result from the proposed corrective j
l actions, it must be noted that those are changes in what are already very i
small core damage numbers. Due to numerous conservatisms in the method, l
the values shown should be viewed as upper bounds, not best estimates.
I i
--n-,-,-
~.
,-_v,-,-
--,-,-,,-,,~_,.-n,--
_,-_,_n,-.~
. The most significant conservatism is in the pipe rupture probability. The BWR Owner's Group estimated the conditional probability for BWR ECCS pressure boundary rupture during an overpressurization event to be 3.0 x 10-5 Brookhaven chooses to treat this as a lower bound rather than as a realistic value, and they evaluated the event trees for three values-- 3.0 x 10-5, 10-3, and 10-1 Realistic evaluation of the strength of piping shows it to be much stronger than its nominal rating.
The results for a conditional probability of 10-1 should be rejected, and those for 10-3 should be treated as an upper bound. Using an ECCS Pressure boundary rupture probability of 3.0 x 10-5, Brookhaven calculates an interfacing LOCA core damage frequency of 2.26 x 10-7/yr. for Quad cities. Since a typical total core damage frequency for a plant is around 10-4, it can be seen that interfacing LOCA's represent an insignificant contribution (0.22%) to core melt frequency, and no corrective action should be required.
Even 2.26 x 10-7 is an upper bound estimate, considering numerous other conservatisms built into the study. They are enumerated below:
1.
Pipe ruptures are conservatively assumed to always be of sufficient size to represent large LOCA's, and large LOCA's not isolated immediately by the check valve are conservatively assumed to always result in core damage.
No justification is presented for these assumptions.
2.
A failure probability of 0.01 is assigned to check valve failure-to-close for a large pipe break, and it is assumed that the failure represents a large LOCA. This is conservative, for many failures, while not resulting in leak-tightness, would reduce the backflow and, therefore, the size of the LOCA.
3.
In the event tree, if pipe break occurs and the check valve does close, it is assumed, for some reason, that a small LOCA still results. Check valve closure would terminate the LOCA.
Some minor leakage, but no small LOCA, would result.
4.
If pipe rupture does not occur, it is assumed that a small l
LOCA always results, through pump seals, relief valves, or l
gasket failures. Many of these paths would restrict the i
leak to very small leakage rates. The assumption is conservative.
5.
The operator can normally isolate such a small LOCA with
(
the MOV's.
The study uses operator reliability at 30 minutes. Considering the number and size of available i
ECCS pumps, makeup is assured and the operator has much l
more than 30 minutes to terminate the leak. The operator reliability at 30 minutes, is much too low. Even allowing 60 minutes instead of 30 results in a factor of two improvement in the operator action reliability.
l
.. 6.
It is assumed that the ECCS loop in which the small LOCA occurs is unavailable. This is grossly conservative. The capacities of the ECCS pumps, especially the low pressure pumps, are many times larger than any small LOCA break flow.
Though some pump flow would go out the break, most would make it to the reactor.
Furthermore, ECCS flow going out the break would displace reactor leakage, and there would be little net leakage increase.
7.
Based on 600 gpm leakage flow, the study estimates two hours before an ECCS cubicle is filled to overflowing. Most leaks would be much smaller than 600 gpm, so using the human errce probability at 2 hr., for the reliability of manual depressurization to stop the leak, is very conservative.
8.
The study admits, on page 4-4, that it is a conservative assumption that if operators fail to depressurize in two hours, all ECCS are disabled by flooding.
9.
The feedwater unavailability which is used in the study does not include allowance for recovery of feedwater. Since recovery of feedwater is likely, the Brookhaven assumption is conservative.
10.
The study assumes an unavailability of 0.1 for condensate system as a source of makeup after depressurization. A 10%
probability that operators cannot put water in a depressurized reactor using the condensate system is conservatively high.
11.
For a large pipe break, it is assumed that due to the large flow, an MOV cannot be used to isolate the break if pipe rupture has occurred and the check valve fails to close. The reason given is that the MOV's are not designed to operate under blowdown conditions. This is a conservative assumption.
12.
The Cooper incident involved a check valve which was prevented from fully closing by a broken sample probe. In the event tree models for that kind of event, it is assumed that the check valve is worthless in preventing a large LOCA, should pipe rupture occur. This is a very conservative assumption. The event described on page 3-5 indicates that the broken probe held the check valva partially open, not fully open. Considering the small size of sample probes, some credit should be taken for the check valve limiting the size of the LOCA.
m 13.
The treatment of feedwater interfacing LOCA's is overly conservative. The initiating event frequency of 10-3 for San-Onofre-type events seems high, based on the event complexity.
Furthermore, attention to the event and its
-consequences has certainly reduced the probability of its recurrence.
Furthermore, the event tree employs a large LOCA unavailability for ECCS, and it makes ECCS unavailability the first branch of the event tree. With isolation, much less makeup is required, so the first branch of the tree should be isolation. The model, as shown, conservatively overestimates the core melt frequency.
14.
Item #6 criticized, as conservative, the assumption that the BCCS loop in which the small LOCA occurs is unavailable. In 4
the discussion of Quad Cities features on page 4-23, it is stated that because the LPCI cross-tis valve is normally open, it is assumed that not just one but both loops of LPCI i
are unavailable for a LPCI small LOCA. Therefore, for Quad l
Cities the needless conservatism is compounded.
15.
On page 4-25, it is stated that because at Quad Cities the LPCI testable check valves are not leak tested, it is assumed that the probability that a check valve is in a failed state i
is increased by a factor of ten.
Yet, no evidence is presented as to the testing practices at the plants where failures have occurred. This should be investigated before making such a conservative assumption for Quad Cities.
The above items enumerate significant conservatisms that are built into the report. There are also a number of things that appear to be errors. They are enumerated below:
1.
Page 4-3 and 4-4 discuss operator action after two hours to depressurize the reactor and stop the leak. Before using the human error probability of 5 x 10-4 at two hours, the study divides it by the probability of failure to isolate, which is 10-2 The reason given is that this event tree is conditional upon the operators having already failed to isolate the small LOCA.
This reasoning is not correct.
Those two actions are separate operator actions governed by separate procedural steps and taking place on different time scales. They should be treated independently. 5 x 10-4, rather than 5 x 10-2, should be used for the human error failure probability for depressurization.
,-,,.,,n,-,
r
.. 2.
It was pointed out earlier that the study assumes that an MOV cannot be closed under blowdown conditions. Yet, in deriving initiating event probabilities for the case where a check valve is already stuck open, it is assumed that procedural error could lead to inadvertent opening of the MOV, leading to overpressurization. A closed MOV upstream of a failed check valve has a larger delta p across it than a valve closing into a blowdown stream.
It is inconsistent to assume 100% failure in the one case and 100% success in the other, and the assumptions in this report introduce conservatism in both cases. Some realistic probability of success should be used in both cases.
3.
The Browns-Ferry-1/ Hatch-2-type event involves a testable check valve held open by reversal of air supply to the operator. The ways in which this situation can lead to overpressurization are developed in Section 4.1.2.
These include failure of the MOV to fully reclose after test, rupture of the MOV disk, inadvertent opening of the MOV due to operator error during a logic test, and opening of the MOV by a spurious signal. Probabilities for each of these events are developed in the text and displayed in Table 4.5.
The Browns Ferry scenario is included in those probabilities under " inadvertent opening... during a logic test."
It is already covered in the first four entries in Table 4.5.
For some reason, an additional event appears separately in the table for the Browns Ferry Scenario, and the values for f(OP), LOCA probability, and core damage frequency dwarf the contributions from the first four entries. Because the scenario is already included in the detailed calculations, the separate entry for Browns Ferry Scenario is in error and should be deleted. Furthermore, the values shown for that scenario are erroneous. The probability of the testable check valve being open due to reversed air supply is calculated to be 1.47 x 10-3 The frequency for the Browns Ferry Scenario is shown to be 7.35 x 10-4 Since the Browns Ferry Scenario includes a testable check valve open due to reversed air supply, it suggests that 50% of all such testable check valve failures lead to overpressurization due to inadvertent valve opening, which makes no sense. The values calculated by combining check valve failure l
probability with MOV inadvertent opening probability are realistic and should be used. Note that this same error is i
repeated for many other scenario's, and that the results of including these redundant, erroneous probabilities dominate the results. Removing them will substantially reduce the calculated LOCA frequencies and core damage frequencies.
... 4.
In'Section 4.3.a it is stated that because Quad cities has an additional check valve in the feedwater line, there is an order of magnitude improvement in the results for HPCI/RCIC compared to Peach Bottom. However, comparison of Tables 4.15 and 4.6 show no difference, except for the Cooper-type event.
The Quad Cities table must be corrected to show lower LOCA and core damage values. Furthermore, for Cooper-type events, Quad cities' extra check valve should get even more credit, since a broken sample probe is not a check valve common mode failure.
5.
The discussion on pages 4-25 of LpCI MOV's at Quad Cities is not clear. Much higher failure rates for MOV's are used in Table 4.14 for Quad Cities than in Table 4.5 for Peach Bottom. These higher values must be better explained.
6.
There is an error in the event tree in Figure 4.1 which makes the study difficult to understand. The first node after 1
i occurrence of a pipe rupture is labeled " Isolation" and has r
node probabilities that do not sum to 1.0.
In fact, this node represents isolation by the check valve, with failure probability of 0.01.
To agree with the textual discussion and the tables of results, the upper branch of the node then should have another node representing isolation by the operator closing the MOV.
That node also would have failure probability of 0.01.
7.
The basis for the branch probability at node U (SSS, HPCI, &
RCIC) in Figure 4.6 is not given, and it should be provided.
8.
In Table 4.6, the MOV failure values shown for RCIC and HPCI for rupture and transfer open are double the probability used for LPCI.
No justification is provided. Also, small LOCA's have a probability of zero, for some unexplained reason.
Because of the large number of conservative assumptions, and because of the significant errors indicated above which, if left uncorrected, introduce substantial conservatisms, the results of this study should only be treated as upper bound estimates for core damage frequency. It should also be noted that a study which overestimates core damage frequency will also overestimate the benefits of proposed corrective actions. The discussion above suggests that this study should be revised. Revision of this study to j.
remove excessive conservatism will show interfacing LOCA's to be an j
insignificant contributor to a plant's overall core damage frequency.
Furthermore, the risk is so low, that no corrective actions can be justified.
I 9391D i
~.
. s
- e es
" Cost Estimate for Proposed BNL Corrective Actions at Quad Cities Station /
Core Spray Check Valve Test Tap" Engineering
- Design Drawings
$ 25,000
- Material Spec.
- Repair Program Seismic Analysis
- Modification Program Construction (Per Line)
$ 6,000
- Fab 16 man-hrs.
- Install 48 man-hrs.
- NDE/ Test 40 man-hrs
- Misc. (Insulation) 26 man-hrs
- Supervision 40 man-hrs.
170 Materials (Per line)
$ 1,700
- Valves
$ 600 each (2)
- Pipe & Fit $ 300
- Weld
$ 100
- Misc Tools $ 100
$1,700 Total Cost $40,400 per unit (2 lines) 300lK