ML20212B530

Forwards Summaries of Integrated Safety Assessment Program Topics 1.12, Control Room Habitability, 1.28, Reactor Coolant Pump Trip & 1.58, Steam Binding of Auxiliary Feed Pumps, to Facilitate Review of Project Analyses

ML20212B530
Person / Time
Site:	Haddam Neck File:Connecticut Yankee Atomic Power Co icon.png
Issue date:	07/29/1986
From:	Mroczka E, Opeka J CONNECTICUT YANKEE ATOMIC POWER CO.
To:	Charemagne Grimes Office of Nuclear Reactor Regulation
References
NUDOCS 8608070100
Download: ML20212B530 (16)

Text

,

CONNECTICUT YANKEE ATOMIC POWER COMPANY B E R L I N. CONNECTICUT P o box 270 HARTFORD. CONNECTICUT 06141-0270 TELEPHONE July 29,1986 Docket No. 50-213 B12145 Office of Nuclear Reactor Regulation Attn: Mr. Christopher I. Grimes, Director Integrated Safety Assessment Project Directorate Division of PWR Licensing - B U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Gentlemen:

l

[ Haddam Neck Plant l Integrated Safety Assessment Program Summaries of Public Safety Impact Model Project Analyses l

In a letter dated July 31,1985,(I) the NRC outlined the scope of issues to be

(;

evaluated Neck Plant. in Subsequently,in the Integrated Safety Assessment a letter Program dated February (ISAP())for 14,1986,2 the Haddam we identified a I selected number of topics for which we would provide the Staff with public safety risk oriented analyses.

In order to facilitate the Staff review of our project analyses, we are providing the Staff, in Attachment 1, with summaries of the following projects we have evaluated for public safety impact:

1) ISAP Topic No.1.12 " Control Room Habitability"

2) ISAP Topic No.1.28 " Reactor Coolant Pump Trip"

3) ISAP Topic No.1.58 " Steam Binding of Auxiliary Feed Pumps" It is noted that since we have not completed our analyses of the entire set of ISAP projects, the public safety impact scores are to be considere? oreliminary at this time. Upon completion of our analyses of the entire ISAP project set, including all five attributes, we will review our analyses and revise our public safety impact results, if necessary, to assure consistency in the ranking of the ISAP projects.

(1) H. L. Thompson letter to 3. F. Opeka, " Integrated Safety Assessment Program," July 31,1985.

(2) 3. F. Opeka letter to C.1. Grimes, " Integrated Safety Assessment Program Schedule for Implementation," dated February 14,1986.

lf9l lt '

0 8608070100 860729 I PDR ADOCK 05000213 L p PDR r _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ .

o .

As further public safety impact analyses are completed, we will promptly forward summaries to the Staff for review.

If you have any questions on this material, please feel free to contact my Staff.

Very truly yours, CONNECTICUT YANKEE ATOMIC POWER COMPANY J. E Deeen J. F. Opeka Senior Vice President A s)

By: E. droczka []

Vice Pr ent L

ISAP #1.12 Control Room Habitability Safety Issue There are five general areas in which control room habitability can affect public safety.

o Providing protection for the operators to assure their ability to function during an accident which results in release of radioactivity.

o Providing protection for the operators to assure their ability to fbnction following release of a toxic gas.

o Assuring the ability of the operators to function during a fire.

o Providing a comfortable working environment for the operators to reduce the likelihood of an operator error due to high temperatures or humidity.

o Providing a suitable control room environment to assure that transients do not occur as a result of equipment malfbnction caused by extreme humidities or temperatures.

Proposed Project The proposed HVAC system will include redundant air handling, refrigeration and air filtration units, redundant smoke and radiation detection systems and a new j control scheme capable of having the system operate in various normal and emergency modes. It will be capable of performing the following fbnctions:

a) Under normal conditions provide conditioned air to the control room using recirculation and outside air make-up.

l l b) During a radiation release, provide control room pressurization and 100% recirculated air.

CONfECTICUT YANKEE

,_ _ XNTEGRATED SWETY ASSESSMENT PROGRAM _ _ _ _ _

c) Subsequent to a fire or Halon release, or after the required Halon concentration to extinguish a fire is reached, provide 5,000 cfm direct exhaust to remove smoke, e) During an on-site accident which generates heavy concentrations of smoke, provide automatic isolation of the control room ventilation and recirculation without filtration.

Analysis of Public Safety Impact The Haddam Neck Probabilistic Safety Study (Connecticut Yankee (CY) PSS -

Reference 2) has identified the major accident sequences which result in subsequent release of radioactivity to the public. For these sequences, protection for the operator will not be required until the release has occurred (i.e., the core has melted and the containment has been breached). At this point, the public will be affected by the release and any subsequent operator actions will have- little impact on public safety. Therefore, the purpose of protection of the operators becomes one of personnel safety. Because CY is a single unit site, the operators will not be affected by radioactive releases from other units.

With respect to providing protection for the operators and assuring their ability to function after a release of a toxic gas, the CY Control Room Habitability Study (Ref. 1) reviewed the types and quantities of hazardous chemicals stored on site. The only chemical stored on site that has the potential to adversely affect control room personnel 10 sulfuric acid.

Calculations based on storage location, total tank failure, and worst case meteorological conditions show that concentration levels at the control room intake would be well below the toxicity limit. In addition, the control room would be advised of the spill and would be able to manually isolate the control room using the current HVAC system. In the event that the in-leakage from the system results in an adverse environment, the operators can use the self-contained breathing apparatus that is provided in the control room. This breathing apparatus could affect the operators ability to function under abnormal situations. However, the probability of a transient occurring that 2-CONNECTICUT YANKEE u XJTiOK@f@ Frpf567 4MSSMENT JFROGRAM

would require non-routine operator actions coincident with a spill is negligible.

Another aspect of this project is to assure the ability of the operators to function in the event of fire. Fires both inside and outside the control room have the potential to affect the operators. The control room is equipped with a fire detection system which will automatically release halon and isolate the control room on detection of a control room fire. The self-contained breathing apparatus available in the control room will allow the operators to remain in the control room to shut the plant down if required.

A fire outside the control room would have to be a sufficient size and location to produce enough smoke to reach the control room air intake. If a fire occurs, the control room operators are the first personnel notified. In the event of a fire that has the potential to affect the control room, the operators can manually isolate the control room using existing air intake dampers. If the operators are unable to adequately isolate the control room (i.e., the in-leakage of smoke becomes too high) the control room operator can use the self-contained breathing apparatus. In addition, whether the fire is inside or outside the control room, if the control room becomes uninhabitable at anytime, the operators have the ability to shut the plant down from outside the control room.

There are two additional issues on which control room habitability can impact public safety. The control room HVAC system is required to provide a comfortable working environment for the operators and a suitable environment to ensure the operability of control room equipment. The important control room components which are mest sensitive to temperature are the nuclear instrumentation and the wide-range gas monitor for the stack. In one instance, the loss of control room HVAC contributed to the failure of a nuclear instrumentation channel. Failure of a second channel during surveillance led to a reactor trip.

High temperatures and humidity could affect the operators' performance of 4

routine operations and operator error could result in a transient. However, there have been no recorded incidences of this at the plant.

CONNECTICUT YANKEE

_ IEEGRATED SAFETY ASSESSMEE PROGRAM _, _ .

i e .

Given one reactor trip (General Plant Transient) in 14 years of observed operation (0.07 event /yr), the contribution of control room HVAC failure to core melt frequency and public risk can be estimated. It is then assumed that the proposed project to upgrade control room HVAC would eliminate all such contributions to public risk.

Results The decrease in core melt frequency as a result of the decrease in the frequency of general plant transients is 1.2 x 10 /yr, a decrease from the current core melt frequency of 0.2%. All of the core melt sequences initiated by the general plant transient are in Consequence Category 5 (mean 3

consequence: 2.8 x 10 man-rem). The resulting increase in public risk as a result of installing the upgraded control room HVAC system is calculated as follows:

R = T x AP y xC f where R = total change in public risk, man-rems T = remaining plant life, 20 years APf = decrease in core melt frequency, 1.2 x 10 / year Cf = offsite public consequences associated with category 3

5 - 2.8 x 10 man-rems 3

R =(20 years)x(1.2 x 10 year ~ )x(2.8 x 10 man-rems)

= 0.1 man-rems This decrease in public risk corresponds to a rank of 0 on a scale of -10 to

+10 for the proposed control room HVAC upgrade.

CONNECTICUT YANKEE IEEGRATED SAFETY ASSESSMENT PROGRAM

f-Reference

1. "Haddam Neck Plant - Post TMI Requirements - Response to NUREG-0737,"

Enclosure 1, W. G. Counsil Letter to D. G. Eisenhut, dated July 1, 1981.

2. J.F. Opeka letter to C.I. Grimes, "Haddam Neck Plant Probabilistic Safety Study - Sumary Report and Results," Docket No. 50-213, dated March 31, 1986.

CONFECTICUT YANKEE INTEGRATED SAFETY ASSESSMENT PROGRAM

ISAP #1.28 Reactor Coohnt Pump Trip Safety Issue Small break loss-of-coolant accidents (LOCAs) are one of several categories of events which, if not successfully mitigated, will lead to core melt. Generic evaluations made by the PWR vendors have shown that either delayed trip or continuous operation of the reactor coolant pumps (RCPs) during a small break LOCA may result in insufficient core cooling (Reference 1). The RCPs at the Haddam Neck Plant (Connecticut Yankee (CY)) do not automatically trip on a loss-of-coolant accident, however, the CY Emergency Operating Procedures direct the operator to trip all of the RCPs when the reactor coolant system pressure drops to 1700 psig. The addition of automatic circuitry to trip the pumps has the potential to reduce the frequency of those core melt sequences which are initiated by small breaks by increasing the reliability of tripping the pumps and reducing the dependence on operator action.

Proposed Project The proposed project is the design and installation of circuitry which would automatically trip all four reactor coolant pumps on detection of a small break LOCA.

Analysis of Public Safety Impact In 1984 CYAPCO submitted a topical report (Reference 2) to the NRC which documented a small break LOCA analysis for CY. This analysis showed that tripping of the RCPs produced a slightly higher peak clad temperature (although well below the criteria limit of 2300 F) than that for the case with RCPs running. Among the reasons for this are the high capacity of the high-pressure safety injection (HPSI) pumps, the forced convection cooling provided by the RCPs which reduces the magnitude of the clad temperature rise, and the elimination of the loop seal effect characteristic of cold leg breaks with the RCPs tripped. The conclusion of the analysis, however, was that with or without the RCPs running the HPSI pumps are capable of providing sufficient

injection flow to cool the core for all small break LOCAs. This analysis did CONNECTICUT YANKEE

' XRTMfMLM $PF267 ABW3WW @ROGRAM

. * {

not evaluate the charging pumps as a means for mitigating small break LOCAs.

The charging pumps will automatically start on a safety injection signal if offsite power is available and can be manually started after a loss of offsite power.

The CY Probabilistic Safety Study (PSS) credited the charging pumps as an alternate means (in lieu of use of the HPSI pumps) of injection and as the only method of high pressure recirculation after a small break LOCA. The Best Estimate LOCA Analysis for CY (Reference 3) shows that the charging pumps are adequate for all small break LOCAs except a small spectrum of break sizes in the loop 2 cold leg.l However, this analysis was performed assuming all four RCPs are tripped. On a reactor scram (with or without a safety injection signal), RCPs 1 and 3 trip automatically when the generator separates from the grid 52 seconds after turbine trip. Unless there is a loss of offsite power or battery 'B' fails coincident with the small break LOCA, RCPs 2 and 4 will continue running until they are manually tripped by the operator.

Although the best estimate analysis was performed assuming that the RCPs are tripped as required by the current Emergency Operating Procedures, it is expected that the charging pumps with two RCPs running would be able to mitigate all small break LOCAs in all locations. To give an upper-bound estimate of the reduction in core melt frequency, a postulated automatic trip is assumed as a back-up to the operator manually tripping the pumps. An estimated unavailability of this automatic trip is combined with the human error probability associated with the operator failing to trip the RCPs. This combined unavailability was then used to calculate a new core melt frequency.

Results The upper-bound change in core melt frequency as a result of the postulated automatic RCP trip is a decrease of 2.6 x 10-5/ year. All of the core melt Alternate measures were implemented during the 1986 refueling outage and were approved by the NRC to mitigate the consequences of breaks in the narrow range of concern.

CONNECTICUT YANKEE EM1RM1@ 3FjETY ASSESSMENT PROGRAM

sequences affected by this change are in consequence category 5 (mean 3

consequence: 2.8 x 10 mn-rems). The resulting public risk is calculated as follows:

R = T x AP g xC y where R = total change in public risk, man-rems T = remaining plant life - 20 years AP = change in core melt frequency - 2.6 x 10 -5/ year f

C = offsite public consequences associated 1

3 with category 5 - 2.8 x 10 man-rems R = (20 years)x(2.6 x 10-5 year-1)x(2.8 x 103 man-rems)

= 1 man-rem This decrease assumes, however, that all small break sizes and locations cannot be mitigated by the charging pumps with the RCPs running. It is unlikely that further LOCA analyses would show this to be so for more than a small fraction of the cases. Also, as noted previously, when the HPSI pumps are used to mitigate small-break LOCAs, having the RCPs running has been shown to be beneficial in certain cases. Therefore the installation of an automatic RCP trip after a small break LOCA is a zero on a scale of -10 to 10.

CONNECTICUT YANKEE

{ 6 #fR@fMM _-

References

1. " Generic Assessment of Delayed Reactor Coolant Pump Trip during Small Break Loss-of-Coolant Accidents in Pressurized Water Reactors," NUREG-0623, November 1979.

2. W.G. Counsil letter to W.A. Paulson, "Haddam Neck Plant - Small Break LOCA Topical Reports," dated August 23, 1984.

3. J.F. Opeka letter to C.I. Grimes, "Haddam Neck Plant Probabilistic Safety Study - Summary Report and Results," Docket No. 50-213, dated March 31, 1986.

I I

4 CONNECTICUT YANKEE TN@gg[ sin $TFM A%T@SLENT ffROGRAM

ISAP 1.58 Steam Binding of Auxiliary Feedwater Pumps Safety Issue The Auxiliary Feedwater (AFW) System is an important safety related system that provides cooling water to the steam generators with loss of main feedwater flow. Because of the connection of the AFW piping to the main feedwater system, the potential exists to fail the AFW system due to steam binding caused by the leakage of heated main feedwater into the AFW system. The systems are isolated by various combinations of check valves and motor operated valves.

The heated main feedwater can leak into the AFW system, flash to steam in the pumps and AFW discharge lines and result in steam binding of the AFW pumps.

The potential for common mode failures is present whenever one pump is steam-bound, because the pumps are connected to common piping with only a single check valve to prevent back-leakage of water to the second pump. At the Haddam Neck Plant (Connecticut Yankee (CY)) a temperature sensor is attached to the auxiliary feedwater common header from the discharge of the AFW pumps .

This plant feature was installed after both AFW pumps became inoperable due to steam binding at CY. The location of this thermocouple is such that it can detect leakage from the main feedwater system discharge paths into the auxiliary feedwater main header, but its ability to detect leakage from the steam generators through the normally closed motor-operated valve MOV-35 is questionable. MOV-35 is in the auxiliary feed pump enclosure and it is only a few yards from the discharge of the AFW pumps,, but many hundreds of feet from the temperature sensor.

Proposed Project This issue was recommended for prioritization by the Office of Safety Integration (NRC) [ Reference 1] after a review of the report from the Office for Analysis and Evaluation of Operational Data (NRC) [ Reference 2] on vapor binding of the Auxiliary Feed Pumps.

The proposed project would involve installation of an additional temperature detecting device and the associated control room alarms and indications in the CONNECTICUT YAfEEE

vicinity of MOV-35. An alternative solution may be implementation of surveillance requirements for the same location. This solution may not be as effective as suggested by previous operating experience.

Analysis of Public Safety Impact Several conservative assumptions are made in performing this calculation. It is assumed that the existing temperature sensor cannot detect any leakage past MOV-35. It is further assumed that the steam binding events occurring throughout the industry in 1983, although higher in number than other years, are typical of all years.

A total of 3 comon cause events (failure of more than one pump) were reported in 1983. Of all events reported only one involved leakage past a normally closed motor-operated valve and secured check valves. A generic common cause rate can be calculated based on an average expected 15 system demands per year and 47 plants [ Reference 2]:

Q = 1yr-I /(47 plants x 15 demands /yr) = 1.4E-3 per demand The unavailability of the auxiliary feedwater system depends on the initiating event and the support state in the CY PSS model [ Reference 3].

The impact of the proposed design change is calculated by first identifying the significant accident sequences for which the frequencies will be measurably affected by the above increase in the unavailability of the AFW. Next the net increase in the frequency of the various plant damage states is calculated.

Note that this calculation excludes sequences with high AFW unavailability, such as those caused by adverse steamline or feedline breaks, or those that require manual AFW control. The following is a summary of the total frequencies of significant sequences as a function of the plant damage state for each event tree that can be potentially affected by this design modification.

ET3 - Small LOCA Pr(SG Cooling) = 5.0E-5 CONNECTICUT YANKEE

freq(SEC) = 1.3E-7 Yr-ET4 - Steam Generator Tube Rupture Pr(SG Cooling) = 5.6E-5 ,

freq(V2) = 2.2E-7 yr-I freq(SEC) = 9.7E-7 yr-l ET9 - General Plant Transient Pr(AFW) = 4.06E-3 freq(TEC, TLC) = 9.3E-7 yr-l E10 - Total Loss of Main Feedwater Pr(AFW) = 4.06E-3 freq(TLC, TEC) = 6.8E-6 yr-l E12 - Loss of Offsite Power Pr(AFW) = 4.06E-3 freq(TLC, TEC) = 1.5E-5 yr-l E14 - Loss of Offsite Power and one EAC and the associated DC bus Pr(AFW) = 4.06E-3 freq(TLC, TEC) = 4.0E-6 yr-l freq(TL) = 5.6E-7 yr-l freq(TE) = 5.3E-8 yr-E16 - Insufficient Flow of Service Water Pr(AFW) = 4.06E-3; Pr(AFW) = 6.7E-3 w/o Instrument Air freq(TE) = 5.1E-7 yr-l E23 - Consequential Small LOCA freq(Initiating Event) = 1.0E-3 yr-l Pr(SG Cooling) = 5.0E-5 freq(SEC) = 5.0E-7 yr-l E26 - Loss of Offsite Power and LOCA freq(Initiating Event) = 2.8E-4 yr -l j

CONNECTICUT YANKEE n

l Pr(SG Cooling) = 4.06E-3 i freq(SEC) = 1.2E-6 yr-l The above frequencies are grouped as follows:

freq(SEC, TEC, TLC) = 1.3E-7 + 9.7E-7 + 9 3E-7 + 6.8E-6 + 1.5E-5

+ 4.0E-6 + 5.0E-7 + 1.2E-6 = 2.95E-5 yr -l freq(V2) = 2.2E-7 yr freq(TE) = 5.6E-7 + 5.1E-7 = 1.1E-6 yr-l freq(TL) = 5.6E-7 yr-l The impact of the proposed design modification is approximated by noting that the maximum decrease in the AFV unavailability in the dominant sequences above in given by:

1.4E-3/4.06E-3 = .34 The decrease in frequencies are thus:

freq(SEC, TEC, TLC) = .34 x 3.0E-5 = 1.0E-5 yr-l freq(V2) = .34 x 2.2E-7 = 7.5E-8 yr-l freq(TE) = .34 x 1.1E-6 = 3.7E-7 yr-l freq(TL) = .34 x 5.6E-7 = 1.9E-7 yr-l Results The frequencies calculated above are converted into averted public risk in Man-Rems.

R freq(V2) x C xT 2= 2

= 7.5E-8 yr-l x 1.6E+6 Man-Rem x 20 yr

= 2.4 Man-Rem Similarily,

_4-CONNECTICUT YANKEE .

J

l l

R3 = 3.7E-7 x 2.2E4 x 20 = 16.3 Man-Rem R4 = 1.9E-7 x 8.4E41 x 20 = .32 Man-Rem R5 = 1.0E-5 x 2.8E+3 x 20 = .56 Man-Rem Total = 19.6 Man-Rem This Man-Rem total is equivalent to a score of 0.4 on the CY ISAP scale.

References:

1. NUREG - 0933, "A Prioritization of Generic Safety Issues," GI-93, December 1984.

2. AE0D/C404, " Steam Binding of Auxiliary Feedwater Pumps", July 1984.

3. J.F. Opeka letter to C.I. Grimes, "Haddam Neck Plant Probabilistic Safety Study - Summary Report and Results," Docket No. 50-213, dated March 31, 1986.

l l

l CONNECTICUT YANKEE wiercPvE055Anr#552Jewek@nwRMrmucL__-_ _ _ A