ML20236X738
| ML20236X738 | |
| Person / Time | |
|---|---|
| Issue date: | 02/28/1987 |
| From: | Spano A Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20195F761 | List:
|
| References | |
| FOIA-87-714, REF-GTECI-093, REF-GTECI-NI, TASK-093, TASK-93, TASK-OR IEIN-84-06, IEIN-84-6, IEIN-85-001, IEIN-85-1, NUDOCS 8712100197 | |
| Download: ML20236X738 (37) | |
Text
.
f ENCLOSURE 3 i
l 1
i REGULATORY ANALYSIS OF GENERIC SAFETY ISSUE 93
" STEAM BINDING OF AUXILIARY FEEDWATER PUMPS" A. H. Spano 50SI/DSRO February 1987 i
e WEI SS8'7-714 PDR ..
M" _ _ _ _ _ . - - _ _ _ - _ _ _ - - _ - - _ _ - - - - - - - - - - ---- - - - - - - - - , - - - - - -----___u - _ _ - - - - , _ - - - - _ - - -
1 .
I' CONTENTS j i
- 1. STATLi.ENT OF PROBLEM 1.1 Description of Issue :
1.2 Historical Background
- 2. OBJECTIVE 1
- 3. CURRENT SAFETY ASSESSMENT OF AFW PUMP STEAM BINDING 1 3.1 Updated Review of Plant Experience on Backleakage i 1
3.2 Risk Significance
- 4. ALTERNATIVE RESOLUTIONS 4.1 Proposals 4.2 Consequences !
4.2.1 Alternative 1 - No Action 4.2.2 Alternative 2 - Continuous Monitoring System Backfit
- 5. CONCLUSIONS
- 6. REFERENCES Appendix 1 Appendix 2 Appendix 3 e
h _ . _ _ _ . _ _
1.
Regulatory Analysis for Generic Issue 93
" Steam Bindino of Auxiliary Feedwater Pumps
- 1. STATEMENT OF PROBLEM 1.1 Description of Issue In a pressurized water reactor the Auxiliary Feedwater (AFW) system supplies feedwater to the steam generators whenever the main feedwater (MFW) flow is interrupted. In the event of an abnormal condition resulting in the loss of MFW, the AFW system serves as a vital backup safety system for ensuring the removal of decay heat. Under normal operating conditions, the idle AFW system is kept isolated from the high pressure (*1000 psig) steam system by a number of check valves and, in some systems, closed, remotely-operated valves.
l Generic Issue 93 is concerned with the potential disabling of the AFW pumps by steam binding as a result of the backleakage of hot water or steam past the iso-lation check valves interfacing the AFW and MFW systems. In the low pressure
- environment of the AFW system, the leaking subcooled water flashes into steam, j and a backflow mixture of steam and hot water may develop that forces itself upstream past other leaking check valves to one or more of the AFW pumps.
There, the continued buildup of the steam void content can lead to pump cavitation and consequent failure when the pumps are started up. The key significance of the issue arises from the potential vulnerability of most AFW systems to common mode steam binding failure of the redundant pumps of the system. The potential for such failure is inherent in the typical piping configurations used, which allow for cross connections between trains via common discharge headers, suction headers, and recirculation lines, with usually only a single check valve to prevent backleakage to the seco[nd or third pump (Figure 1).
l 1
-m.ame * . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _
' g Given the occurrence of backleakage, the probability of one or more of the pumps becoming steam bound will depend upon the effectiveness of the upstream check valves in stopping the backleakage. In this regard, check valve reliability involves correct design application of the type and size of check valve selected for installation in each AFW discharge line in order to ensure compatibility of valve performance with the local hydraulic conditions. Many of the check valves employed in existing systems rely solely on pressure differential (AP) for sealing. For the check valves interfacing the AFW and MFW systems, the AP across the seat is large and a good seal can nor= ally be expected, if the disc butts up squarely against the seat. In this con-nection, the need for periodic valve maintenance makes it important that the check valve design allow for correct disc-to-seat alignment in a relatively simple straightforward manner, and in a way that can be checked before the valve is reassembled. For the upstream check valves, where minimal AP conditions obtain, unless the check valve incorporates a mechanical (spring /
gravity) load to assist in sealing, the capability of the valve to stop the backflow of steam and hot water from a leaky inter, facing valve becomes questionable, as evidenced by the numerous instances of steam binding obse"ved in AFW systems with multiple check valves in series. In this connection, an upstream gate or globe valve operated normally closed can be expected to provide significantly better protection against backleakage than a non- '
mechanically loaded check valve. Approximately 40% of the operating PWRs (mostly CE and M W plants) have a normally closed remotely operated valve in the discharge lines. (Westinghouse plants typically operate with the remotely-operated control. valves normally open, which may reflect the vendor philosophy '
of simple control system design and reliance on the operator for subsequent throttling of AFV flow, in contrast to the approach taken in other plants where sophisticated control systems are employed for the programmed opening of the closed valve in controlling AFW flow.)
While these and other factors governing the likelihood of backleakage and potential steam binding are complex and plant specific, the simple fact that backleakage has occurred in a system is readily evidenceo by the affected AFW f i
I 1
3 pipes becoming hot. Thus, appropriate monitnring of the AFW piping temperature can alert the operator to the occurrence of backleakage and to the need for l
sitigative action to offset possible vapor binding of the pumps.
l 1.2 Historical Backaround l
The number of AFW pump steam binding events reported during the period 1981-1984 led to the issuance of a number of infomation notices and reports by NRC and the industry:
o In January 1984, IE Information Notice 84-06 and INPO Significant l
Event Report 5-84 were issued, describing the circumstances relating to approximately if steam binMng events that had occurred at H. B.
Robinson, Farley-1 and -2, Crystal River-3, and D.C. Cook-2 since 1981.
At Robinson and Farley, procedures were initiated for the periodic monitoring of pump casing temperatures and for the venting and cooling of pumps when required.
o In April 1984, INP0 issued a Significant Operating Event Report (50ER 84-3) analyzing the safety implications of the reported events at Farley, H. B. Robinson, and Surry 2, and making recommendations on the need to: (1) periodically monitor and record the AFW piping temperatures at least once per shift, or preferably on a continuous, instrumented basis because of the possibility of backleakage occurring rapidly (as had been observed at Farley); (2) review the capability of AFW system check valves to seat with low pressure differentials; and (3) include guidance on operating procedures and training for identifying and restoring the AFW system to full operability, including Special actions to be taken when one or more of the check valves are known to leak repeatedly.
o In July 1984, AEOD's case study of the safety implications of backleakage to the AFW system analyzed 22 LER-reported instances of steam binding or I
backleakage that occurred during 1981-1983 at six plants (five Westing-I
_ _____ ____-____ _ _ _ _ _ _ _ _ _ _ _ _ l
4 1
l house and one B&W designed plants) mit of a total of approximately forty-seven PWRs operating during the per;;#. surveyed.(I) While these statistics would suggest that the backleakage problem, with its potential for pump steam binding, is associated with a relatively small fraction of the PWRs, the AEOD report did note that the number of events reported may not t,e a reliable indicator of the actual number of events occurring, in that such occurrences might not have been deemed reportable by the plant technical specifications. Thus, under the post-January 19841.ER reporting I requirements (10 CFR 100 Part 50.73(a)(2)(vi)), a steam bound pump is not considered reportable if the redundant pump (s) are operable and available to perform the required function.
In the AEOD review of the backleakage experience no pattern or single major cause of check valve leakage could be identified, with the causes differing between recurrent events at a given plant' as well as between plants, and with check. valve leakage recurring even af ter a valve had been repaired or replaced. The report pointed out that the operating experience supported the conclusion that AFW systems operating with the !
remote *ey-operated valves run normally open (as in most Westinghouse j plants) may be more susceptible to steam binding than are the other ]
plants. Note was also made that some plants had already adopted {
procedures for the routine surveillance of the AFW piping temperature; the report went on to recomunend that such monitoring be made a general I requirement.
o Steam binding of AFW pumps was assessed to be a generic issue of high priority, and authorization for work on the issue was provided by !
memorandum from H. R. Denton to R. Bernero in October 1984, o In April 1985, to detemine the need for short tem corrective, action related to the problem of steam binding, IE requested the regional offices (Temporary Instruction E515/67-03) to conduct a survey of licensee responses to previous NRC and industry recommendations regarding 1
.-_._____.______.________________9
1 (i) the monitoring of pipe temperatures at least once per shift and (ii) the availability of procedures for detecting and correcting a steam l binding condition. Of the 58 units surveyed at the time, approximately half had both procedures and related training in place, while the others lacked either certain procedures or training or both.
o On the basis of this survey, II Bulletin 85-01 (issued October 29,1985) requested 28 licensees and all CP holders to develop and implement pro-cedures for monitcring AFW piping temperature on a recommended once per shift basis, for recognizing steam binding, and for restoring the AFWS to operable status should steam binding occur. The Bulletin also required that procedural controls were to remain in effect pending the adoption of an appropriate hardware fix substantially reducing the likeli--
hood of steam binding, or until superseded by action implemented as a result of resolution of Generic Issue 93.
The utility responses to Bulletin 85-01 indicated that various methods are being used to monitor piping temperatures. In most cases, the method involves simple touching of the pu:ap casing or pipe, such that if it is " hot" to the touch, the operator or shif t supervisor is notified, and recovery procedures are initiated (e.g., venting of pump casing, operating the pump and flushing out the affected discharge lines). At a number of plants, quantitative temperature readings are obtained using contact pyrometers, temperature sensitive color tape, or other pemanently attached temperature instruments with local readout. The monitoring frequency is generally once per shift, although some plants, depending on their previous backleakage experience, may conduct surveillance every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Still other plants have installed a continuous, instrumented monitoring system, with a control room alarm to alert the operator as to when the pipe temperature has risen above a given setpoint.
e
While use of the hand is as. reliable as any of the methods in regard to detecting a sensibly hot pipe, the continuous monitoring system is clearly the most effective one in regard to minimizing operator warning time and the time to start cooling procedures, and, thereby, minimizing the con-ditional probability of pump steam binding, given the occurrence of back-leakage. The usefulness of the system is further enhanced by locating the temperature reading locations appreciably downstream of the pump dis-charge points, in the vicinity of the interfacing check valves.
The advantaDe of the continuous monitoring system over the manual approach is also evident for the case where an interfacing check valve leaks repeatedly and severely enough to heat up the discharge path back to the pump in a time period short compared with an 8-hour surveillance period. Under such conditions, a pump could become steam bound long before the next shift check, with the probability for common mode failure of the redundant pumps increasing the longer it takes to connence cooling procedures. As discussed further below, for the relatively small number of plants where there have been multiple recurrences of backleakage, the installation by the utility of a continuous monitoring system has been instrumental in the plant operator being able to prevent pump steam binding pending repair of the leaky check valves, at the next maintenance outage.
o An additional development affecting the issue of AFW pump steam binding was the establishment, in the wake of the November 1985 water barner event at San Onofre 1,(2) of an industry sponsored effort to deal with l
the general problem of safety-related check valve failures in reactor systems. The Owners Groups Task Force (DGTF) concerned with this issue l l met with the NRC in November 1986 to present its proposed program of work.
This OGTF program essentially involves the issuance of the following two -
documents for use by the individual utilities in implementing their own .
check valve reliability improvement programs:
- 1 I
i . - _
l.
(a) An INPO report (50ER 86-3), issued October 15, 1986, to provide general guidance to the utilities on: (i) the kinds of check valve misapplication problems that can occur (e.g., selection of a valve size that does not match system flow conditions, valve installation with wrong orientation, wrong valve type); (ii) the detection of valve degradation or failure (e.g. , preventive maintenance with disassembly and visual inspection, periodic testing, use of acoustic / vibration analysis techniques, radiographic methods); and (iii) personnel training (e.g. , iii utilizing varfous maintenance /
testing methods). As a follovup to SOER 86-3, the industry program calls for the utilities to implement appropriate changes in their check valve maintenance and testing progrt.as, based on the 50ER guidance. It is also proposed that each utility identify the high risk check valves in its plant (e.g. , AFW system check valves) and include them in its program. -
(b) An
- Applications Guide" document to be prepared by the OGTF, to provide detailed information on the appropriate selection of various types of check valves, their physical location in the system, the effect of flow conditions in regard to the sizing of I check valves, etc. Tne Applications Guide is intended to serve as a basis for check valve design reviews by the individual utilities.
These would then be followed by utility implementation of j appropriate design modifications, as indicated by the results of I their design reviews. The Guide is scheduled for issuance by June 1987.
The OGTF has indicated to the staff that the end date for complete implementation of the industry program is expected to be 1991.
. l i
i
[.'
. 2. OBJECTIVE Section 10.4.9 of the SRP requires that an acceptable AFW system have an ]
unreliability of less than 30 4 per demand, as estimated using the methods !
and data presented in NUREG-0611 and NUREG-0635. Those methods did not 3 include specific consideration of steam binding of the AFW pumps as one of the common mode failure contributors to cystem unreliability. The regulatory i objective sought in connection with resolution of Generic Issue 93 is that steam binding should be a non-significant contributor to the overall AFW system unavailability, which may be interpreted here to mean a contribution of, say, less than 10% percent of the overall system unavailability.
Resolution of this issue is viewed from the following perspective: Given the fact that interfacing check valves separating the AFW and MFW systems can be expected to fail on occasion, with the resulting backleakage of steam and hot water posing a challenge to the isolatability of the standby AFW system, we consider cost-effective actions that can assur,e that the operator can be appropriately alerted in time to prevent steam bi'n' ding of the pumps, or, if
. steam binding has already occurred, to restore the system to full operability on an appropriately timely basis.
In this regard, the issuance of IE Bulletin 85-01 requesting the development l and implementation of procedures for the periodic monitoring of the AFW piping temperature and for system restoration constituted an important step forward in dealing with the potential for steam binding. In comparison with the earlier surveillance period of effectively once a month when the pumps were tested, the Bulletin requirements for a once a shift monitoring period provided for a reduction in the steam binding-related average unavailability of the pumps by a factor of about 90 (3 shifts / day x 30 daystoonth).
On the basis of the operational experience on backleakage obtained ince systematic monitoring of the AFW pipes was started in 1984-1985 by most of the licensees, we analyzed the adequacy of the Bulletin requirements in meeting the above stated objective and whether additional requirements are needed.
1
.g.
- 3. CURRENT SAFETY ASSESSMENT OF PUMP STEAM BINDING 3.1 Updated Review of Plant Experience on Backleekage A search of the LER and Nuclear Plant Reliability Data System (NPRDS) files for infonnation on steam binding-related failures of AFW pumps indicated a total of just two events (occurring in early 1984) that were not reported in the AE00 study. However, the absence of such nported events is not considered meaningful in the light of the post January 1,1984 LER rule not requiring the reporting of individual component failures, or in the light of the voluntary basis for utility reporting of component failures to the NPRDS.
To obtain a current picture of plant experience on AFW hackleakage and steam binding as a basis for an asmessment of the risk posed by steam binding under conditions where the AFW niping temperature is monitored on a systematic basis, pertinent information en recent backleakage occurrences during the period since monitoring stcrted was obtained via an informal survey of the NRC resident inspectors at plants, data derived from staff visits to various plants, as well as by several telephone conversations with plant engineering personnel, as arranged by the PMs. The information obtained is presented in Appendix 1.
These data show that the backleakage experience varies widely among the plants surveyed, with the dominant majority of the operating PWRs indicating a low, backleakage event frequency of from zero to a few events per year, and a much smaller group of about a half dozen plants indicating a significantly higher annual backleakage event frequency. It is noted, in particular, that although some backleakage has been experienced in about 20% of the operating plants l during the survey period, no steam binding of AFW pumps appears to have resulted, indicating that the monitoring procedures were effective in catching these backleakages early enough to prevent any subsequent stems binding of the l
AFW pumps. l 1
l 3
l 1 - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
,.~..
.- 3.2 Risk Significance In assessing the safety implications of the backleakage experiersce observed in' plants with monitoring procedures, the survey results suggest an appropriate division of the operating PWRs into two categories: (A) plants experiencing a low frequency of. backleakage events (defined as one involving the detection of a hot pipe or pump, followed by operator actior. to cool'the pump), and (8) plants exhibiting a relatively high frequency of such events.
Approximately 56 PWRs, or about 89% of the operating plants surveyed are found to fit into the low frequency group, i.e. , less than about 1 event / year. In.
comparison, the remaining group of seven PWRs appears to have had a back-leakage event frequency that is greater by a factor of 10-100. In the following value-impact analysis we will consider these two groups separately.
Category A Plants _
A measure of the public risk posed by steam binding of the AFW pumps can be obtained on a core melt frequency risk level by examining the dominant i accident sequences affected by unavailability of the AFW system. <
An estimate is obtained of the increase in core melt frequency (ACMF) due to the increase in AFW system unavailability resulting just from steam binding of the pumps. For nach accident init'ation of interest, we have:
ACMF4=F4
- AQgpg3 *QFB >
where, F
4
= Accident initiating event frequency for each initiator i of primary ,
interest, i.e., direct loss of all main feedwater (LMFW),. loss of the offsite power (LOSP), and loss of all AC (Station Blac,kout).
The last is a much lower probability event than the other two (by a factor of at least 10 2), and will accordingly be neglected in this analysis;
4 i
AQg pg3 = Increase in AFW system unavailability due solely to steam j
binding, assuming non-recovery of the steam bound AFW pumps i within a 30-min. time. period to prevent core uncovery, as discussed below; Q FB = Unavailability of feed and bleed (F&B) as an alternative method for decay heat removal, given that steam generator cooling is not available.
With the loss of main feedwater the steam generators start to boil dry, with the rate of fall-off of t5e steam generator water level depending on the initiating event. In the LOSP-induced LMFW case, the reactor and reactor coolant pumps (RCPs) are automatically tripped, stopping the further i production of heat from fission and RCP operation that has to be removed via the steam generators. The resulting rate of depletion of the steam generator secondary water is consequently significantly lower than it would be for the direct LMFW event, where the reactor may not be tripped until pressurizer i
pressure reaches a preset high point, or steam gener tor level drops to a j preset low point, generating a safety signal that scrams the reactor and actuates the AFW system. Operation of the RCPs following a LMFW event may continue until manually tripped by the operator later in the transient. The steam generator dryout time also depends on the steam generator inventory, which for the B&W once-through design is a factor of 3 to 5 times smaller than that for U-tube steam generators for equivalent plant sizes.
If the AFW system fails to respond adequately because the pumps are steam bound, the steam generator secondaries will dry out, at which point the transfer of decay heat from the primary system ceases and the system j temperature rises to the saturation temperature, corresponding to the pressure setpoint where the PORVs open, releasing steam to the pressurizer relief tank. Unless F&B is initiated in time, or unless MFW or AFW is recovered, the continued loss of primary system coolant through the PORVs will lead to core uncove ry. Reference 6 shows the estimated times to core uncovery for station
blackout sequences, where the AC-independent AFW pumps are not available (e.g.,
because of steam binding). These uncovery times vary between about 100 minutes for Westinghouse and CE plants down to about 45 minutes for B&W plants. To preclude core uncovery, it is necessary that an auxiliary fetdwater pump be started about the time of steam generator dryout for low head safety injection pumps, and somewhat later for plants with high head safety injection pumps. This results in a limiting time of approximately 30 min. for both CE and Westinghouse plants with low head pumps and for R&W plants with high head ,
safety injection p eps. Thus, it will be assumed that, if FAB is not available, I core uncovery can still be avoided if at least one of the steam bound AFW pumps can be recovered within 30 minutes after loss of all feedwater.
Evaluation of each of the factors in the ACHF equation above is obtained as follows:
(a) Loss of MFW Event Frequency: Most of these events constitute either short term or partial losses of feedwater (ex. , loss of one MFW pump, with another pump available for continued feedwater operation). A staff estimate (3) based on a search of the LER files indicated a frequency of between 1 and 3 LMFW events per reactor year (RY), with a small fraction of these being
! non-recoverable in time to prevent steam generator dryout: specifically, a frequency in the range 0.1-0.4/RY for such non-recoverable LMFW occurrences.
. A different analysis of the experience on total losses of MFW in 36 PWRs over a period of 213 reactor years indicated a mean annual frequency of 0.15 events /RY. ) A different type of estimate for this quantity was derived from a detailed fault tree analysis of the Oconee MFW system.(5) The results yielded a frequency estimate of 0.64 non-recoverable LMFW events per RY, which is about a factor of three to four higher than that derived from plant data.
For purposes of this analysis, we shs11 use the Oconee value as a conservative generic estimate for PWRs in general. ,
.~ ~
(b) LOSP Event Frequency: On loss of of fsite power, the motor-driven MFW pumps are lost and there is a prompt trip of the reactor and reactor coolent pumps. In the context of the 30-min time constraint assumed above for recovery of the steam bound AFW pumps, the frequency of a 30-min. LOSP event is about 0.045/RY.(6)
(c) AQg pyg: For the Category A plants, an upper bound estimate of the unavailability of the AFW system for 30 min. or more caused by steam binding of the pumps is provided in Appendix 2. The result is AQAFWS < 4x10 7/d.
4 (d) Unavailability of Feed and Bleed Cooling: An analysis of the credit to be given to the use of feed and bleed techniques as an alternate means of decay heat removal has been provided as part of the regulatory analysis of Generic Issue 124 on AFW system reliability,0) and the results obtained have been utilized in the present analysis of the related issue of AFW steam binding.
In this analysis, an examination is made of the following factors affecting the failure probability of feed and bleed techniques for various PWRs:
(1) Hardware failure, including for different vendor-designed systems questions of the failure probability of the relevant high pressure injection (HPI) systems, the adequency of the HPI pump dis-charge pressure for lifting the pressurizer safety valves, and failure probability of the PORV components that may be available; (2) Thermal-hydraulic failure, which relates to the time window available for feed and bleed before steam generator dryout occurs or primary system saturation is reached; (3) Decisional human error probability, which arises in connection with the decisional conflict between operator reluctance to us1! feed and j bleed methods and the need to initiate feed and bleed during the time window available to the operator; ,
J
j . ._ _ , . _ _ _ ~_ _
l .
I-t I
(4) Procedural human error, which can arise in the implementation l of feed and bleed procedures following the decision to use such methods.
The calculational results obtained for the net feed and bleed failure probability for two Westinghouse, two CE, and three B&W plants varied between 0.42 and 0.53, with an average value of 0.47. In the present analysis of the risk impact of AFW steam binding, a generic value of 0.5 is used.
(f) Core Melt Frequency: Combining the above evaluated factors making up the LOMF and LOSP dominant accident sequences, one obtains for the Category A plants an upper bound for the AFW pump steam binding contribution to CHF of:
ACHF = (0.64/RY + 0.045/RY) * (4 x 10 7/d) * (0.5) = 1.4 x 10 7/RY, which is negligible in the context of a safety goal criterion of 1x10 4/RY.
Category B Plants ,c.
e, This group of plants has experienced multiple instances of backleakage into the AFW system; it is comprised of the two Farley units, the two McGuire units, the two Catawba units, and Diablo Canyon-2 (see Appendix 1). As a result of the recurrences of valve leakages, continuous monitoring systems l
with control room alarms were installed in these plants. Since installation of this equipment, there apparently have been no occurrences of actual steam binding of the AFW pumps, the instrumentation acting to provide sufficiently early indication to the operator of the onset of backleakage and need for recovery action, such that steam binding can be prevented with a high degree of assurance.
(a) Farley Units 1 and 2: The problem of backleakage in thes,e two reactors goes back to 1983. As a result of the numerous instances of back-leakage that occurred in 1983, the utility initiated procedures for monitoring the AFW piping temperature by a rover every four hours, in addition to the continuous monitoring provided by the installation of temperature detectors located both in the vicinity of the interfacing check valves and near the
. gr, .
pump' discharges. The monitoring procedures have been effective in preventing steam binding of the pumps in spite of recurrent instances of backleakage.
Valve leakage repairs in one or more of the eight interfacing check valves in each unit have been performed at a rate of about four repairs a year, in a continuing effort to resolve the underlying problem of check valve leakage.
Progress in this direction appears to have been made recently as a result of vendor proposed modification in the valve Maintenance procedures used at Farley, in which the valve relapping method was changed to provide a circular line seating area rather than an angular band, and the hinge pin bushing tolerances were tightened to reduce disc play. In the two-month period since the revised maintenance procedures were put into effect in Farley-1 late in 1986, no backleakage has been observed in that reactor.
(b) McGuire Units 1 and 2: Backleakage problems have been experienced in these reactors for several years, with numerous instances of steam binding of the AFW pumps occurring especially in 1984. The incorrect installation of the turbine driven pump discharge check valves at 90' to the correct i direction, which led to an increase in the probability of pump steam binding given the occurrance of backleakage, was corrected in 1985. The installation in 1985 of a continuous monitoring system with the temperature sensors located near the interfacing check valves allowed for early corrective action by the operator in the event of backleakage. The incidence of valve leakage at McGuire appears to be associated with the monthly testing of pumps, whereby an opened interfacing check valve may not seal after the pump is secured. If this occurs the ensuing backleakage is detected by the monitoring system and the operator attempts a reclosure of the valve. The operators are sensitive to the possibility that a valve may not close properly and accordingly are prepared to implement corrective action. No pump steam binding events have apparently occurred since early 1985, although there have been continuing instances of valve leakage. .
.~~ .
l (c) Catawba Units 1 and 2: These are sister plants to the McGuire reactors, with similar AFW systems and check valves, and with temperature j sensors for continuous monitoring instelled near the interfacing check valves. l In both Catawba units there has been a pattern of almost continuous leakage through one or more of the interfacing check valves, and this has necessitated 4 extended periods of operation of the AFW pumps to flush out the backleaked hot water and cool the discharge lines. At Catawba, there is the growing realization that one of the major causes of the valve leakage appears to be related to the bonnet-hinged design of some of the swing check valves used.
These require very precise alignment of the bonnet to the body, both vertically and in angular orientation, in order to obtain proper seating.
Unfortunately, the design of the valve precludes making a check that the disc is seating correctly until the valve has been reassembled and installed, and the system placed in operation. At Catawba a program is underway to replace the installed check valves with valves of a different type.
(d) Diablo Canyon-2: Here some backleakage occurred over a period of several months as a result of a small crack in the seal weld surrounding the disc of one of the interfacing check valves. The leakage was stopped following a welding repair of the valve performed during the plant cutage in late 1985. In this as in the other cases of plants with recurrently leaky j check valves, the availability of the continuously monitoring system with 7 control room alare allowed for timely mitigation of the effects of backleakage and prevention of pump steam binding.
For the Category.B plants, an upper bound estimate of the steam binding contribution to core melt frequency can be obtained on the basis of the analytical model described above, modified with regard to two factors: the hot pipe event frequency, Agp, and the probability that a pump becomes steam bound, given a hot pipe event, p(SB/HP) (see Appendix 2). .
4 1
)
f.
i.
I As shown in Appendix 2, AQgpy3=4x10 S/d, and accordingly ACMF=(0.69/RY)*
(4x10 5/d)*(0.5)=1.4x10 8/RY, which is a factor of 10 [,reater than the ACHF estimate for the Category A plants, but which is also small compared with the safety goal criterion of 1x10 4/RY. 1 l 1
- 4. ALTERNATIVE RESOLUTIONS i
4.1 Proposals Two alternative resolutions were considered by the staff in reaching its proposed resolution of Generic Issue 93:
- Alternative 1 - No Action: In this case, where the objective stated above in Section 2 has been achieved within the framework of the existing Bulletin 85-01 requirements, it is proposed that the Bulletin requirements remain in place, with allowance for appropriate modification as discussed below in Section 5, but that no further requirements be defined and that I the issue be closed out. j l
- Alternative 2 - Backfit Requirement: This would seek to reduce the steam binding contribution to AFW system unavailability by requiring all plants to install a continuous monitoring system with control room alarm. At the present time eleven operating PWRs and two cps (South Texas 1 and 2) have such monitoring systems in place, so that the proposed j requirement would impact about 52 licensees and 16 applicants.
4.2 Consequences l 4.2.1 Alternative 1 - No Action As shown in Appendix 3, estimates of the public risk posed by steam' binding i
of the AFW pumps may be made based on an approach similar to that employed in the analysis for Generic Issue 122.1.(8) These results, together with those
l :
t
. - 18 -
I for tne estimated impact on AFW5 unavailability and core melt frequency are presented in Table 1.
Table 1 Current Assessment of Risk Impact From AFW Pump Ste m Bindino Category A Plants Category B Plants Risk Level (56 PWRs) (7 PWRs)
AFW5 Unavailability <4x10 7/D 4x10 8/0' Core Melt Frequency 1.4x10 7/RY 1.4x10.sfgy Public Risk
- 36 person-rem 44 person-rem
- Integrated over remaining lifetime of all PWR plants.
These results indicate that the the risk to the public arising from steam ,
binding of the AFW pumps is negligible for both the Category A and B operating f
plants.
i I 6 4.2.2 Alternative 2 - Continuous Monitoring System Backfit i l (a) Risk Reduction Benefit j
\
An estimate of the reduction in AFW system unavailability provided by installation of continuous monitoring systems in 52 of the operating PWRs can be obtained as follows. As described in Appendix 2, the probability, j p(SB/HP), for operator failure to provent pump steam binding given detection of.a hot pipe, can be reasonably set at 0.1 for the typical Category A plant case where the pipe is monitored locally near the pump once each shi.ft, and at 3x10.s for the Category B case, where there is a continuous monitoring system in place, with control room alam and detection point near the interfacing check
valve. This factor of 30 reduction in p(SB/HP) is also reflected in a factor of 30 reduction in AQAFWS, ACMF, and in the public risk. Thus, the riesidual risk after backfit would be about I person-rem, with the risk reduction benefit amounting to about 35 person-rems.
(b) Costs Two major costs elements are considered in this analysis: the cost for the monitoring system instrumentation and installation, and the related mainte-nance costs integrated over the remaining plant lifetime. It is assumed that the backfit is implemented by the plant personnel and not by an AE, tLat there are four trains of instrumentation, that the signals from the temperat ure i
sensors can be tied into an existing plant computer system and existing tror,b'le alarm in the control room, and that the installation does not affect plant operation time. -
(i) Cost of Monitoring System Engineering support
$15,000 (overhead; design; vendor specs; drawings; etc.)
Equipment
$30,000 (temperature sensors, including one full set of j
- replacements; electronic signal transmission)
)
{
Installation $40,000 (field materials, labor, testing)
Total = $85,000 per plant (ii) Maintenance 6
4 l
l I
_ . . = -
. - . - . l
4
'. It is assumed that the additional effort required for maintenance of the monitoring system amounts to 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> per year at a cost rate of 20 $/ hour, i.e. , an annual personnel cost of 400 $/ year. At the current time, the average remaining lifetime of the licensed plants is estimated to be 30 years, so that assuming a discount rate of 4%,
we have for the lifetime personnti cost, Cpg = (400 $/ year) (1.04)30-1 = $6.9x108 per reactor.
(0.04)(1.04)30 Thus, the total system plus maintenance cost per reactor adds up to about
$92,000 per reactor. For a total of 52 operating reactors to comply with the backfit requirement, the total cost to the industry for the licensed plants alone would amount to about (52)(92,000), er about 5 million dollars.
(c) Cost / Benefit Ratio j The overall cost benefit ratio is seen to be about $5M/35 person-rems or about i 140,000 dollars per person-rem averted. This value does not justify the instal-lation of continuous monitoring systems at the Category A plants. (We note too i that consideration of averted onsite costs would not significantly affect this I conclusion. Thus, assigning an onsite cost of 4 billion dollars per core melt,
. and using ACHF=1.4x10 7/RY, a mean remaining lifetime of 30 years, and a total Category A population of 56 reactors, we obtain an estimated industry averted l cost of: (1.4x10 7 CM/RY)x(30 Y)x(56 R)x(4x108 $/CM)=$0.9M, which is only a small part of the direct cost of $5M for the proposed fix.) ;
4
- 5. CONCLUSIONS j I
The foregoing results on the estimated risk due to steahl binding of the AFW pumps were derived using a conservative, upper bound analytical appranch based on the backleakage experience obtained in operating PWRs over the past one to two years, during which time systematic monitoring of the AFW piping I
temperature was performed. The results show clearly that for both categories of plants the steam binding contribution to AFW system unavailability and the related risk to the public are currently at a negligible level.
In this regard, we note, too, that for an appreciable number of plants, the AFW systems characteristics (e.g., the long runs of uninsulated piping, the use of separate suction lines from the water source to the pumps, the use of mechanically-loaded upstream check valves, or the possibility for cross connecting the AFW systems between units as a safety backup) may be such as to provide for an intrinsically low vulnerability of the AFW system to potential failure from steam binding. Operation with the remotely-operated valves run normally closed may be expected to provide some additional assurance against the possibility of pump steam binding if an interfacing check valve did leak.
For plants that operate the valves normally open, a shift in the valve mode of operation would necessitate plant-specific evaluations of the potential negative effect on the AFW function of valves failing to open on demand, as well as the impact on AFW control system operations. In any event, in the light of the low steam binding risk level obtained in the approximately '
thirty-seven plants that do operate with the valves normally open, there is clearly little risk reduction incentive for those plants to consider changing i their valve mode of operation simply on the basis of potential steam binding.
J The Staff believes that the cost-benefit results associated with the backfit alternative considered above clearly support a recommendation for selecting the alternative resolution of no action, as defined above, and to close out j this issue with no additional expenditure of NRC resources.
Finally, in the light of the staff's findings on the current low level risk posed by Generic Issue 93, for plants that have not experienced backleakage over a period of at least several months of operation, utility review of the problem may indicate that an appropriate reduction in the frequency ef monitoring, (ex. , from once per shift to once per week) would be useful from an overall safety point of view in allowing incassed emphasis en other areas
._________a
. gg .
of maintenance and surveillance. In this case, to keep the risk low the plant operators should continue to be aiert to the possible development of a leaky check valve or valves, especially as the plant ages, and be ready to increase the monitoring frequency as appropriate to assure that the AFW pumps do not become steam bound. The probability of unexpected check velve leakage problems can be expected to be reduced when the proposed industry program on improvement in check valve reliability is implemented.
1 e
1
NFW n
e
$Nr - & SB i'
.f As
- % M G-c d 'U"" " ;; M W , , Ss 4 1
M
% Ss. b o -
ME NW Callaway
,_ w r=
v -r (w)
- < d M
" ' W
- 60sf W Hfy wer$
- *(N Y } }V ,
- *: Nh ~,gp ,. ,
5 E sg ,,
5' SG A M^ '
(C g -
l ess-a
~
p dg_% = g ,
A cyssa nse ap_fg N k--
~
MD ll M SG 8 Ademeur u S EFT L. 4s V E Crystal River
- ' ' f, ar ksenwu4r g% E ,
rp n um swny Tigure 1. Simplified ATW System Configuration.s 1.ine t.bickening to the right of the interf acing chech valves
/
denotes high pressure.
l i
- 6. REFERENCES (1)
- Steam Binding of Auxiliary Feedwater Pumps," AEOD/C404, W. D. Lanning, July 1984.
(2) " Loss of Power and Water Hammer Event at San Onofre, Unit 1, on November 21, 1985," NUREG-1190, Jaunary 1986.
(3) 61emorandum from A. Thadani to 0. Parr, " Auxiliary Feedwater System - CRGR Package," November 9, 1984.
(4) "ATWS: A Reappraisal, Fart 3: Frequency of Anticipated Transients,"
Electric Power Research Institute, EPAI NP 2230, January 1982.
(5) "A Probabilistic Risk Assessment of Oconee Unit 2,* Electric Power Research Institute, NSAC-60, June 1984.
l (6) " Evaluation of Station Blackout Accidents at Nuclear Power Plants,"
NUREG-1032, May 1985.
(7) Backfit Analysis - Auxiliary Feedwater System Reliability, Generic Issue 124, Memorandum from S. Diab to W. Minners, September 23, 1986.
(8) Generic Issue 122.1, " Potential Inability to Remove Decay Heat".
NUREG-0933, June 1986.
(9) " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications - Final Report," A. D. Swain, H. E. Guttman, NUREG/CR-1278, August 1983.
l 1
APPENDIX 1 Survey of AFW System Backleakage Experience Monitoring Number of(b)
Cossnerical MonitoringI ") Frequency Hot Pipe T IC)
Plant Vendor Operation Method (Per shift Occurrences (Years)
ANO-1 B&W 07/74 t 1 0 1.7 AND-2 CE 12/78 LR0 1 0 1.7 Beaver Valley-1 W 06/76 t 1 0 1.7 Byron-1 W 09/85 t 1 0 1 Callaway W 12/84 t 2 0 1.7 i Calvert Cliffs-1 CE 01/75 LR0 1 0 1.7 Calvert Cliffs-2 CE 12/76 LR0 1. 0 1.7 Catawba-1 W 01/85 CR0 Continuous Multiple 1.7 Catawba-2 W 08/86 CR0 Continuous Multiple 0.6 01/77 1 0 1 Crystal River-3 P4W t Davis Besse B&W 08/77 t 1 0 1.7 D.C. Cook-1 W 02/75 t, LRO, C 1 Few (15 ) 1.7
. D.C. Cook-2 W 03/78 t, LRO, C 1 Few (15 ) 1.7 Diablo Canyon-1 W 11/84 CR0 Continuous 0 1.7
- ! Diablo Canyon-2 W 10/85 CR0 Continuous Multiple 1.7
! Farley-1 W 08/77 CR0 Continuous Multiple 1.7 Farley-2 W 05/81 CR0 Continuous Multiple 1.7 Ft. Calhoun CE 08/73 LR0 1 0 1.7 1 0 1 Ginna ~W 12/69 t Haddam Neck W 08/67 CR0 Continuous Few (15 ) 1.7 06/73 1 0 1.7 Indian Point-2 W t 1 ,0 1 Indian Point-3 W 04/76 t W 04/74 t 2 ,0 1.7 Kewaunee i
1 f
Survey of AFW System Backleakage Experience (Cont.)
Monitoring Number of fD) . s Commerical MonitoringI ") Frequency Hot Pipe T E01 P,],a3 Vendor Operation Method (Per Shift Occurrences (Years)
Maine Yankee CE 11/72 t 1 0 1.7 McGuire-1 W 09/81 CRO,C Continuous Multiple 1.7 McGuire-2 W 05/83 CRO,C Continuous Multiple 1.7 M111 stone-2 CE 11/75 t 1 0 1 ,
M111 stone-3 W 02/86 CRO,t Continuous Few (15) 0.7 N. Anna-1 W 04/78 t 1 0 1.7 4 N. Anna-2 W 08/80 t 1 0 1.7 Oconee-1 B&W 05/73 t 1 0 1.7 Oconee-2 B&W 12/73 t 1 0 1.7 Oconee-3 B&W 09/74 t 1 0 1.7 Palisades CE 12/71 t .., 1 0 1.7 Palo Verde-1 CE 06/85 t 1 0 1 Palo Verde-2 CE 09/86 - - 0 0.3 Point Beach-1 W 11/70 t 1 0 1 Point Beach-2 W 08/72 t .1 0 1 Prairie Island-1 W 12/73 t 2 0 1 Prairie Island-2 W 12/74 t E O 1 Rancho Seco b&W 10/74 t 1 0 1.7 Robinson-2 W 09/70 t 1 0 1.7 Salem-1 -W 12/76 LR0 1 0 1.7 Salem-2 W 06/81 LR0 1 0 1.7 San Onofre-1 W 07/67 t 2 0 1.7 San Onofre-2 CE 09/82 t 1 0 1.7 San Onofre-3 CE 09/83 t 1 O 1.7 Sequoyah-1 W 07/80 t 1 .0 1.7
. l Survey of AFW System Backleakaoe Experience (Cont.)
Monitoring Number of(b)
Plant Vendor Commerical Monitoring (a) Frequency Hot Pipe Operation _ Method T IC)
(Per Shift Occurrences fYears3 Sequoyah-2 W 12/81 t 1 0 St. Lucie-1 CE 05/76 1.7 t 1 St. Lucie-2 CE 0 1.7 06/83 t Summer 1 0 W 11/82 1.7 LR0 1 Surry-1 W 0 1.7 07/72 LR0 Surry-2 1 0 W 03/73 1.7 LR0 1 THI-I B&W 0 1.7 06/74 LR0 Trojan 1 0 W 12/75 1 '
LR0 1 Turkey Point-3 W 0 1. 7 11/72 t f Turkey Point-4 1 0 W 06/73 1. 7 t 1 Waterford-3 0 1.7 CE 03/85 LR0 1 Wolf Creek-1 W 0 1.7 06/85 CR0 Yankee Rowe Continuous 0 W 11/60 1.7 t 1 Zion-1 W 0 1.7 06/73 t 1 Zion-2 W Few (15) 1.7 12/73 t 1 Few (15) 1.7 Explanatory Notes (a) i readout; c = check performance after each use of an (b)
A " hot" AFV pump / pipe occurrence is defined as one resulting in the operator affected AFW pump to vent, flush, discharge or paths. otherwise cool down one or more of the discussion for each plant case); "Few" refers to the repo,r,,ted "few""
occasions, especially associated with monthly pump tests, when a check valvecheck ature may not c f seal correctly, as revealed by a post pump test pipe tem pipe occurren(ce)s.or these cases; "few" is interpreted to mean five hot few occasions when backleakage was obtained in going 4
ation under conditions where the steam generator pressure level. is low and a low Ap condition across the check valve may allow some leakage of s (c) the start of systematic monitoring called for under represents the period going back from the end of 1986 to at least the time when the regional survey was conducted in April 1985 .
. APPENDIX 2 Analysis of Steam Bindina Contribution to AFW System Unavailability An upper bound estimate of AQgpyg, the contribution to AFW system unavail-ability caused by steam binding of the pumps, may be derived from the backleakage experience obtained in the Category A plants. For this, we have MAFWS * #p ECM E NR, where, assuming a constant failure rate model, q,= 0.5ASB t is the AFV pump unavailability due to steam binding averaged out over the surveillance period t(= 8 bpur shift), A SB is the pump steam binding failure rate, with ASBt " 1;
- P CM is the probability for common mode steam binding failure of the redundant AFW pumps, given that the first pump is steam bound; and
- P NR represents the probability of non-recovery of at least one steam bound pump prior to dyout of the steam generators.
An estimate of the pump steam binding failure rate, A SB may be obtained in terms of the measureable rate of occurrence of a hot pump, Agp, using
)
i ASB
- E(I E)bP where p(SB/HP) is the probability- that a pump becomes steam bound, given that a hot pump (or hot pipe downstream of the pump) is detected, and AHP is the number of hot pipe detection events per year (Ngp) divided by the number of hours in a ,
year (8760), i.e. , Agp = Ngp/8760 per hour.
i l __ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _
~ * '
. ~.
4 If a pipe is found to be " hot, procedures are in place whereby the operator can' initiate timely action to cool the pump and related discharge paths. The
- threshold temperature for initiating such action varies from plant to plant, with the threshold temperature typically about 20 to 30F above ambient, i.e. ,
a sufficient rise in temperature as to clearly signal the occurrence of backleakage. Under these conditions, the detection of a hot pipe would not in itself signify the existence of a pump steam binding condition, especially if the monitoring point is appreciably down stream of the pump region.
Accordingly, the probability of the operator failing to restore the pump and discharge lines to an ambient temperature condition before.the pump becomes vapor bound say be expected to be reasonably low. This expectation is reflected in the fact that the plant survey results show that while backleak-age occurrences have been numerous, there have been no reported instances of pump steam binding during the period since systematic monitoring started. It is judged that this failure probability may be conservatively set at less than one chance in ten, so that p(SB/HP) = 0.1.
For the 56 Category A plants exhibiting a low backleakage frequency, the survey results (Appendix 1) indicate a total of 30 hot pipe detections over a total J l
period of 73 reactor years (RY), which yields AHP = 30/(73/RY)(8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> per year) = 5x10 5/hr, so that A3g = (0.1)(5x10.s/hr) = 5x10.s/hr, and qp=(0.5)
(5x10 8/hr) ,(8 hr)=2x10.s per demand.
With regard to pCH, an estimate for the common mode failure probability may be based on the approach used in the prioritization of the steam binding issue.
This used the fact that of the 13 pump steam binding events reported in 1983, three involved the cosmon mode failure of a second pump, but none of a third It was arbitrarily assumed that the common mode steam binding failure pump.
of a third pump would be 0.1, given that the first two pumps were a'Iready steam bound. In this analysis we will assume that the probability of failure of the third pump is unity. Hence, P cm = (3/13)(1) = 0.2.
l l
I l
With regard to PNP, two different estimates were obtained for the probability of not recovering at least one of the steam bound pumps within the 30-minute time period specified in Section 3.2: one based on estimates provided by reactor operators from four different plants, and one based on an approach along the lines of Swain's methodII) for human reliability analysis (HRA).
The estimated times obtained from four plants were 10 min. ,15 min. ,15 min. ,
and 20 min. , fmm which one obtains a mean time of 15 min. , with a standard deviation of 3.5 min. Assuming these times fit a Gaussian distribution centered about a mean of 15 min., and assuming conservatively that 3 to 5 min.
are expended before the recovery procedure is started, the probability that recovery would not be completed within the remaining time to 30 minutes is seen to be P NR 12x1[.
l
)
For the HRA based estimate, the event description asstanes that the AFW pumps have been started up on a safety actuation signal subsequent to a loss of MFW transient, and that at time zero the reactor operator trips all running AFW pumps in response to the control panel indications of low suction pressure; and temperatures, low discharge pressures, and rapid fluctuations in pump motor current, all of which are, for the experienced operator, symptomatic of vapor binding of the pumps.
The total loss of all feedwater to the steam generators constitutes an emergency situation, for which the operator wuuld direct two or three people (e.g. , a process engineer anc one or two auxiliary operators) to proceed directly to the nearby AFW pump rooms, ascertain that the pump casings and piping are hot, and, if so, proceed with the recovery procedures. It is estimated that no more than about 2 minutes are typically needed for the auxiliary operators (A0s) and process engineer to reach the pump rooms, l including the time to unlock various secured doors by using their baidge keys and entering the appropriate identification numbers into the control console.
With two or three people forming the recovery team, the probability of a key badge not being available or the wrong identification number being used may be
~
expectedtobenegligiblysmall(i.e.,<108). It is noted that communication
with the control room operator can be readily accomplished by means of a nearby extension telephone. The established recovery procedures are simple and few in number, typically involving such tasks as: l I
(i) venting the pumps and piping at various locations and flushing out the l pumps by opening the pump discharge drain lines which empty into floor. f sumps; f (ii) closing the vents and drain lines after ascertaining that only water l 1s exiting from the vents and drains; (iii) informing the operator that the venting is complete and that the pumps are refilled; (iv) the operator starting the pumps and checking to see that the j discharge pressures and pump motor currents are at the correct level !
and holding steady; and (v) the operator slowly opening the discharge MOVs to cool down the AFW j lines and provide feedwater to the steam generators. j I
It should also be noted that the process engineer and A0s perfoming these tasks are highly trained and skilled, and have previously perfomed these tasks j not infrequently in other instances of pump cavitation by air or vapor bindirg, Utilizing Swain's tables for a two-branch event tree with th9 options of: (a) )
the A0 uses procedures but not the check-off feature and fails te open or close the vents / drains, or (b) the A0 uses the procedures and check-off features but still fails to open or close the vents / drains, one obtains corresponding human error probabilities of 6x10 and 2x10-3 for the two options, or an overall estimated probability of about 3x10~3 for not carrying out the recovery procedures correctly.
Both kinds of estimates are seen to be of the order of 10~3 and comparable in magnitude; we judge that error factors of the order of 10 to be app 1'icable for j l
each estimate. It any event, for purposes of this analysis of AFW system unavai16bility due to steam binding, we shall conservatively assume an upper
l l
bound probability for rion-recovery of a pump within 30 minutes equal to pH R
- 1 0.1.
I Hence, for the Category A plants we obtain AQg gy3<(2x10 5)(0.2)(0.1)=4x10 7/d, which indicates thet the steam binding contribution to over:11 AFW system unavailability for these plants is negligible compared with the SRP unreli-ability criterion of <1x10 4 l
It is to be noted that this upper bound estimate of AQgpy3 applies to both two pump and three-pump AFW systems, in that it incorporates the assumption that the common mode failu-e probability for the third pump is unity.
For the Category B plant, we will assume that a hot pipe event occurs as often as once per shift, so that AHP = 0.13/hr, i.e., e.., frequency about 3000 times greater than that for the Categ*>ry A plant. With regard to p(SB/HP), it account is taken of (1) the availability of the continuous monitoring system for automatically alerting the operator when backleakage occurs, (ii) the placement of the temperature sensors near the point of valve leakage, which allows for earlier initiation of corrective action than if the detection point were nearer the pump, and (iii) the anticipatory attitude of the operator for taking needed action for an event that occurs frequently, a reasonably conservative assumption for probability of operator failure to take action in time to prevent pump steam binding is judged to be in the range of 10.s ge go. , or taking a geometric mean, we have p(58/HP) equal to 3x10.s. Accordingly, the failure rate for pump steam binding is A 3 , = (3x10.s) (0.13/hd = h1Wr.
Under conditions where there is a continuous monitoring system in pTace, the time period, t, used in calculating the mean pump steam binding unavailability, g = 1/2 A ggt , can be interpreted to be the time between the sounding of the p
control room alarm and the completion of the restorative action by the operator.
Estimates of this time obtained from plant operations personnel indicate a
mean of 15 minutes for such corrective action. For present purposes, we will assume this time to be equal to I hr. , whence q =p2x10 8/ demand and Q gpg3 =
(2x10 4/d) (0.2)(0.1) = 4x10 8/d. !
In sunnary we have:
Parameter Category A Plants _ Category B Plants Hot pipe frequency, A gp Ex10 5/hr 0.13/hr p(SB/HP) 0.1 3x10.s Steam binding f requency, A SB 5x10 8/hr 4x10 4/hr 6 Pump unavailability, o p 2x10.s/ demand 2x10 4/nr Common mode failure probability, Pg , 0.2 0. 2 Pump non-recovery, PNR 0.1 0.1 AFWS unavailability AQ 4x10 8/ demand AFWS 4x10 7/ demand I
l i
b O
e
4 APPENDIX 3 Estimate of Offsite Health Consequences The risk estimate developed below follows along the same lines as previous staff estimates for related safely issues involving failure of the AFW system (e.g., Reference 6).
The LDMF and LOSP accident sequences associated with AFW system failure both involve a core melt with no large breaks initially in the reactor coolant pressure boundary, and until the core melts through the lower head, the reactor is likely to remain at high pressure with a steady discharge of steam and gases emanating from the PORV. These are the conditions likely to produce significant levels of hydrogen ger.aration and combustion l
The Zion and Inoian Point PRA studies used a 3% probability for containment failure due to hydrogen burn (the " gamma" failure mode of WASH-1400). We shall also use a value of 3%. With regard to probability of contairsent failure to isolate (the " beta" failure mode), tho Oconee PRA(5) figure of 0.53% will be used here. If the containment does not fail by hydrogen burn or non-isolation, it will be assumed to fail by base sat melt-through (" epsilon" failure).
The PWR release categories for the different failure modes are as defined in WASH-1400. The whole body dose is calculated using the CRAC code, based on an assumed uniform population density of 340 persons per square mile (the mean for U.S. sites), a 50-mile radius, and a central, midwest plains meteorology.
The results are:
Failure Release CRAC Dose . Percent Consequences Mode Catego ry (Person-Rem) Probability (Person-Rem) gamma PWR-2 4.8x20f 3% 1.4x10 bete PWR-5 1.0x10 3
0.5% 0.05x10 5 epsilon PWR-7 2.3x10 D6.5% 0.02x10 Weighted Mean Consequences per core melt = 1.5x105 person-rems
9 35 -
For the 63 PWRs currently operational, the estimated mean remainihg lifetime is 30 years. (For a total of 80 licensees and CP holders, the estimated mean remaining lifetime is about 32 years). For the integrated exposure we obtain:
Remaining Consequences Integrated I
ACMF Reactor Years Per Core Melt Exposure Category A 1.4x10 '/RY 1.7x108/RY 1.5x105 parson-ress 36 person-remi (56 plants)
Category B 1.4x10.s/RY 2.1x10s/RY 1.5x105 person-rees 44 person-rem (7 plants) 4 09 06
!