U-603796, Submittal of Supporting Documentation for December 19, 2006 Regulatory Conference
| ML063610187 | |
| Person / Time | |
|---|---|
| Site: | Clinton  |
| Issue date: | 12/12/2006 |
| From: | Simpson P AmerGen Energy Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| U-603796 | |
| Download: ML063610187 (20) | |
Text
- 1 Amera M An Exelon Company Clinton Power Station R. R. 3, Box 228 Clinton, IL 61727 U-603796 December 12, 2006 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-001 Clinton Power Station, Unit 1 Facility Operating License No. NPF-62 NRC Docket No. 50-461
Subject:
Submittal of Supporting Documentation for December 19, 2006 Regulatory Conference
Reference:
Letter from C. Pederson (NRC) to C. M. Crane (Exelon Generation Company, LLC), "NRC Inspection Report 05000461/2006011 (DRS): Preliminary Greater Than Green Finding For Clinton Power Station," dated November 29, 2006 In the referenced letter, the Nuclear Regulatory Commission issued an inspection report with respect to the Reactor Core Isolation Cooling (RCIC) water storage tank at the AmerGen Energy Company, LLC (AmerGen) Clinton Power Station (CPS), Unit 1. This report concluded that the minimum water level to preclude vortex formation and subsequent air entrainment into the High Pressure Core Spray (HPCS) system pump suction line would not support that HPCS would be capable of performing its safety function. Using the Significance Determination Process (SDP), the NRC has preliminarily determined that this finding is "Greater than Green," based on a determination that the HPCS pump would fail due to significant air entrainment in the HPCS suction line when the water level in the RCIC water storage tank decreased prior to the transfer from the RCIC water storage tank to the suppression pool.
As a result, a Regulatory Conference is scheduled for December 19, 2006. The NRC encouraged in the referenced letter that supporting documentation be submitted at least one week prior to the conference. This letter provides the NRC with the requested supporting documentation.
Attachment 1 provides a document entitled, "SA-1578, Revision 2, 'Significance Determination Process (SDP) Evaluation for CPS HPCS RCIC Storage Tank Suction Vortexing."' This evaluation has calculated changes in core damage frequency (CDF) and large early release frequency (LERF) using the CPS PRA model and is based upon crediting the time delay provided by the RCIC water storage tank volume and the impact of operators throttling HPCS injection flow. Attachment 2 provides a discussion of additional 00
December 12, 2006 U.S. Nuclear Regulatory Commission Page 2 of 2 conservatisms in the SDP analysis due to either manually or automatically transferring the HPCS suction to the suppression pool.
As part of the Regulatory Conference on December 19, AmerGen plans to present results from recent scale model testing conducted at the Alden Research Laboratory, Inc., in Holden, MA. This testing was performed to further characterize the potential for vortexing and air entrainment in the HPCS suction piping. Once completed, the final test report and supporting evaluation will be submitted to the NRC. It is currently anticipated that this information will be submitted by December 18, 2006.
If you have any questions concerning this letter, please contact me at (217) 937-2800.
Patrick R. Simpson Regulatory Assurance Manager AmerGen Energy Company, LLC JLP/blf Attachments: (1) SA-1578, Revision 2, "Significance Determination Process (SDP)
Evaluation for CPS HPCS RCIC Storage Tank Suction Vortexing" (2) Discussion of Conservatisms in SDP Analysis cc: Regional Administrator, USNRC, Region III NRC Resident Inspector, Clinton Power Station A. M. Stone, USNRC Region III
U-603796 ATTACHMENT 1 SA-1578, Revision 2, "Significance Determination Process (SDP) Evaluation for CPS HPCS RCIC Storage Tank Suction Vortexing"
RM Documentation Approval RM DOCUMENTATION NO. SA- 1578 REV: 2 PAGE NO. I STATION: Clinton Power Station UNIT(S) AFFECTED: Unit I
. . .. . .. .. . . .. ,.'.... - 'h TITLE: Significance Determination Process (SDP) Evaluation for CPS HPCS RCIC Storage Tank Suction Vortexing
SUMMARY
This Significance Determination Process (SDP) risk evaluation analyzes a past condition in which the HPCS suction piping design from the RCIC Storage Tank could have resulted in sufficient vortex-induced air ingestion into the HPCS pump to cause failure of the pump. While it Is believed that HPCS would have remained functional throughout the transfer of pump suction from the RCIC Storage Tank to the suppression pool, as demonstrated through design analysis, there are analytical uncertainties. As a result, the HPCS suction piping Internal to the RCIC Storage Tank was modified in August 2006 to ensure that unacceptable vortexing could not occur. This risk evaluation is for the condition that existed prior to the finding,
[ I Review required after periodic Update
( X I Internal RM Documentation [ I External RM Documentation Electronic Calculation Data Files: See body of the documentation.
I Method of Review: X ] Detailed [ I Altemate C] Review of External Document This RM documentation supersedes: SA-1 578 rev I in Its entirety.
Prepared by: Anthny a bl print Sig n Date Reviewed by: Vince Andersen Print Sign Date 12J210 Approved by: Gregory Krueger Date Print Print Date
PROBLEM STATEMENT This Significance Determination Process (SDP) risk evaluation analyzes a past condition in which the HPCS suction piping design from the RCIC Storage Tank could have resulted in sufficient vortex-induced air ingestion into the HPCS pump to cause failure of the pump.
The High Pressure Core Spray System (HPCS) at Clinton utilizes two suction sources, the preferred source is the Reactor Core Isolation Cooling (RCIC) Storage Tank, and the alternate source is the suppression pool. Level instruments are provided to detect RCIC Storage Tank low level or suppression pool high level and transfer HPCS suction to the suppression pool. The tank level instruments had a past condition where they were set too low so as to allow vortexing of the flow of water into the HPCS system before the suction transfer would have been completed (IR 429583). This vortexing phenomena could have caused sufficient air entrainment into the water flow passing into the HPCS system to fail the pump. While it is believed that HPCS would have remained functional throughout the transfer of pump suction from the RCIC Storage Tank to the suppression pool, as demonstrated through design analysis, there are analytical uncertainties. As a result, the HPCS suction piping internal to the RCIC Storage Tank was modified in August 2006 to ensure that unacceptable vortexing could not occur.
This risk evaluation is for the condition that existed prior to the finding. The SDP applies to the HPCS system. The design of the RCIC system is such that the vortexing-induced failure potential identified for HPCS does not apply to RCIC.
BACKGROUND The RCIC Storage Tank provides the preferred supply of clean water for the RCIC and HPCS systems. The RCIC Storage Tank at Clinton was nominally sized to provide approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of reactor inventory makeup for reactor decay heat boil-off.
Longer term core coolant makeup needs are met by the suppression pool which provides a much larger volume of water for accident response. The suppression pool also has the advantage that it can reuse water returning to the pool from safety relief valve discharge and from reactor inventory lost through Loss of Coolant Accidents (LOCAs).
The suction transfer for HPCS (and also for RCIC) from the primary source (i.e., the RCIC Storage Tank) to the suppression pool is accomplished via level instruments that sense low RCIC Storage Tank level or high suppression pool level and send signals to the HPCS suction valves. In either condition it is desirable to complete the suction transfer. The HPCS RCIC Storage Tank low level suction transfer is supplied by a one out of two logic from two RCIC Storage Tank level transmitters. The RCIC system has the same logic arrangement but uses separate level instruments. The high suppression pool level suction transfer is also supplied by a one out of two logic from two suppression pool level transmitters, again with separate level transmitters for each system.
Both the design basis and the PRA analysis for Clinton rely on the suppression pool volume for long term core cooling success. As such, failure of HPCS to transfer to the suppression pool is a PRA modeled failure of the HPCS system. HPCS is an important 2
system in the Clinton PRA because, due to its high flow capacity over the full range of reactor pressure, it is capable of averting core damage in most PRA scenarios.
Postulated HPCS system failure due to storage tank suction vortexing is mitigated by the following circumstances:
- First, when operators recognize that extended HPCS operation will be required, throttling HPCS flow would become a high priority for them. This makes reactor water level control much easier and, coincidently, reduces the HPCS flow rate below the levels at which suction vortexing would occur.
- Second, initial operation of HPCS to refill the RPV from Level 2 to Level 8 will delay the time that HPCS suction vortexing could occur. The delay time provides additional opportunities for recovery.
- Third, suppression pool high level transfer will cause the HPCS suction to transfer before RCIC Storage Tank low level causes HPCS suction vortexing for some scenarios in which the operators otherwise fail to act. This impact is conservatively being ignored for purposes of this analysis.
The delay time provided by the water volume in the HPCS tank provides additional opportunities for recovery. For the transient cases (i.e. non-LOCA non-ATWS), the RCIC Storage Tank volume provides approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of RPV decay heat boil-off makeup. HPCS minimum flow valve operation with flow to the suppression pool reduces this time, but several hours of operation from the RCIC tank are still provided. The extra time improves the likelihood that operators will be successful in performing key (per the.
PRA) operator actions such as RPV emergency depressurization. The additional time available for operator actions (e.g., manual RPV depressurization) is not credited in the PRA model. Successful low pressure ECCS injection with suction from the suppression pool would reduce the risk impact of the HPCS vortex issue. (For some LOCA scenarios the time provided by using the RCIC Storage Tank volume will allow the reactor to depressurize on its own, thus eliminating the need for this operator action.) The extra time also improves the potential for operator recovery of minor hardware failures (e.g.,
manually opening Motor Operated Valves that failed to stroke automatically).
RISK EVALUATION Guidance for performing Significance Determination Process risk evaluations is provided in T&RM ER-AA-600-1041 "Risk Metrics SDP & Event Analysis". Risk significance is determined based on the change in core damage frequency (CDF) or Large Early Release Frequency (LERF) for the degraded condition compared to the condition without the degradation existing. The ACDF and ALERF calculations take into account the fraction of a year the condition existed. In this particular analysis, because the degraded condition allowing potential HPCS vortexing existed for several years, the exposure period is taken to be an entire year (consistent with T&RM ER-AA-600-1041 and the NRC SDP process).
The change in core damage frequency is calculated as follows:
3
AODF =CDF, -ODFo Where:
CDF1 = annual average CDF calculated with the specified SCC at its degraded unavailability and considering nominal maintenance unavailabilities (i.e. average-maintenance model) for other systems CDFo= base CDF considering nominal maintenance unavailabilities (i.e.
average maintenance model) for other systems The change in LERF is calculated using the same approach.
The CPS PRA current model of record, CL06A, is used in this risk evaluation. The base risk results from the Clinton 2006A PRA model (using a 3E-1 1/yr accident sequence frequency quantification truncation limit for CDF and a 5E-1 1/yr truncation limit for LERF) are as follows:
- CDFo=1.16E-5/yr
- LERFO = 5.25E-7 /yr.
CDF1 and LERF 1 for this risk evaluation are determined by modifying the CL06A model to best represent the vortexing failure phenomena. The PRA parameter in the CL06A model that best represents failure of the level instruments to cause a HPCS suction transfer from the RCIC Storage Tank to the suppression pool is HRITKCCLSZ, "COMMON CAUSE FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE".
Setting this failure parameter to a 1.0 failure probability in the PRA is equivalent to having the HPCS tank level instruments set too low to protect the HPCS pump from vortexing-induced failure.
Setting this event to 1.0 in the CL06A basic event database file (CL06A.BE) represents failure of these transmitters. A review of the HPCS fault tree model shows that failure of this event appropriately leads to failure of the entire HPCS function in the PRA. This modeling is consistent with the fact that the CPS RCIC Storage Tank does not hold sufficient water for core coolant makeup to meet the PRA 24-hour mission time.
To maintain manageable models, typical PRA modeling techniques assume equipment failures occur at t = 0; deviations from this general modeling assumption are taken in certain cases (e.g. time phased recovery of offsite power). As the tank level transmitter failure mechanism is not a significant contributor to HPCS failure in the base PRA model, the CPS CL06A base PRA does not credit the time delay in the accident sequence progression associated with failure of the RCIC Storage Tank low level transmitters (i.e., failure of these transmitters is assumed in the base PRA to result in HPCS failure at t=0, and not HPCS failure at the time the low tank level would be reached in various accident sequences).
In addition, the Clinton CL06A PRA does not consider the high suppression pool level signal, which also can transfer the HPCS suction source, occurring prior to reaching the RCIC Storage Tank low level as a means for mitigating failure of the RCIC Storage Tank 4
low level transmitters. This is a reasonable initial modeling decision in the base PRA because suppression pool high level is only an indirect indication that the RCIC Storage Tank level is decreasing and it may not be present for all initiators and sequences. This modeling assumption will be retained for the SDP analysis because, there are EOP allowed actions that can potentially prevent the success of the high suppression pool level instruments.
EOP-1, RPV control, provides guidance that it is acceptable to throttle ECCS flow.
Because this action will eliminate the vortexing concern, this action is relevant to the SDP analysis, whereas it is not part of the base PRA model because HPCS vortexing is not assumed to occur in the base model.
This SDP risk evaluation appropriately credits both the time delay provided by the RCIC Storage Tank volume and the impact of operators throttling ECCS flow.
Credit for Operators Throttling HPCS Flow If the operators are in a situation in which they would have to maintain reactor water level using HPCS, they would have met entry conditions into the Emergency Operating Procedures. The EOPs are symptom based approaches for dealing with challenges to nuclear safety because of Reactor Power, Reactor Pressure, Reactor Water Level and Containment Status. The actions directed by the EOPs along with operator priorities can have a bearing on the HPCS vortexing issue.
In a post scram condition for typical transients operators would tend to use systems in the following order for RPV level control:
- RPV depressurization followed by use of low pressure systems If the operators are required to use HPCS for reactor water level control, it is likely that problems were encountered using Feedwater and RCIC.
The operator's first priority when using HPCS is to recover reactor water level.
Managing reactor water level throughout the event remains the foremost operator consideration. The operator is directed to try to control reactor level between Reactor level 3 and level 8 by EOP-1.
Once RPV level is recovered to within acceptable bounds, the operator's next priority is to return cooling to a more normal method, especially one with decay heat removal capability. Preferred systems would be Feedwater with the Main Condenser in service or RHR in the Shutdown Cooling mode. The latter would require RPV depressurization.
To spend an extended period of time maintaining RPV level using HPCS implies that problems had been encountered recovering feedwater and/or commencing reactor depressurization and cooldown to place shutdown cooling in service. Transitioning to one of these other systems would remain a fairly high operator priority.
5
EOPs also provide guidance in several other areas that are germane to the HPCS vortexing issue. Most notably under the Level Control Leg of EOP-1 RPV Level Control, the operators are allowed to Throttle ECCS flow using CPS 4411.04. This involves clipping a wire locally at a HPCS Motor Control Center (MCC). Once the wire is clipped, the HPCS injection valve "seal-in" feature is defeated allowing the valve to be positioned in intermediate (throttled positions). Throttling of the injection valve is desirable because it allows for fine RPV level control instead of the normal mode of HPCS operation which is characterized by rapid RPV fill, followed by isolation of the injection valve and decreasing RPV levels due to decay heat boil-off. These large RPV level swings have negative consequences in that high RPV water level (at or above level 8) causes (in addition to the HPCS injection valve closure) trip of RCIC, trip of the Turbine Driven Reactor Feedpumps, and danger of flooding the Main Steam Lines. Low water level below RPV level 3 can cause trips and isolations as well, including additional scram signals and closure of certain containment isolation valves (including those on the shutdown cooling suction line). These condition can be preempted by manually opening or shutting the 1 E22F004 HPCS Injection Valve. Because it strokes full open or full closed before it is made throttleable, fine water level control can result in many valve strokes, which is not desirable either from the standpoint of continued valve operation or from the amount of attention the operators have to apply to control RPV level.
Once it becomes apparent that extended HPCS operation will be required (a necessary condition for depleting the RCIC tank), the need to throttle HPCS becomes compelling.
The time provided by the RCIC storage tank volume (several hours) should allow adequate time to complete this action.
A Human Reliability Assessment for actions required to make the HPCS injection valve throttleable is provided in Attachment 1. The estimated failure rate for plant operators to complete this action is 2.6E-2 from this analysis. Because the timing for the HRA analysis is based upon consumption of the RCIC storage tank for decay heat boil-off makeup (with intermittent HPCS minimum flow operation to the suppression pool), the HRA analysis is applicable to transient events in which there is no ATWS or LOCA in progress.
Once the HPCS injection valve is throttled for RPV level control, HPCS vortexing will not occur because HPCS flow will be too low. Using the Sanders correlations (ref.
JPGC2001/PWR-1 9010, Air Entrainment In A Partially Filled Horizontal Pump Suction Line) and the Clinton HPCS suction piping configuration (pre-modification), vortexing will not occur below a HPCS flow rate of about 1400 gpm, and vortexing with 2% air entrainment will not occur below about 1700 gpm. Per the pump vendor, the HPCS pump should remain functional through 5% air entrainment vortexing. Decay heat boil-off requirements range from about 700 gpm 100 seconds after a scram and continue to fall thereafter. Maintaining steady RPV water level requires that HPCS flow to the RPV roughly match that lost through decay heat boil-off, therefore Operators would adjust HPCS flow downward sufficiently that unacceptable vortexing would not occur.
Model Manipulation for Events Protected by Throttling of HPCS Flow Based upon the foregoing discussion, this risk evaluation appropriately models the following:
6
For all initiators involving decay heat boil-off (i.e., inventory not otherwise being lost through an RPV breach or due to an ATWS event), time is available for throttling of HPCS (consistent with the HRA analysis from attachment 1). By throttling HPCS flow, the operators will prevent vortexing failure of the HPCS system.
As such, credited protection against HPCS vortexingis provided by throttling HPCS for all events but Small, Medium and Large LOCA initiators, high energy line break initiators, interfacing system LOCA initiators and ATWS events. The applicable initiators/events are as follows:
- IEYSBLOCAI, "SMALL BREAK LOCA INITIATOR"
- IEYMEDLOCI, "MEDIUM LOCA INITIATOR"
- IEYLLOCAXI, "LARGE LOCA INITIATOR"
- IEYBOCMSXI, "BOC INITIATOR IN MAIN STEAM SYSTEM"
- ATWS, "ATWS SEQUENCE" To account for this in the model, the logic shown in Figure 1 was added to gate HGATE90C in the CL06A.CAF file of the 2006A Clinton PRA model. This logic adds an event HTHROTTSYH to represent failure of the operators to perform throttling of HPCS flow under extended HPCS operation. This event is "ANDed" to cutsets that contain event HRITKCCLSZ (already set to 1.0) with the condition that it not be applied to the events shown above.
HTHROTTSYH was assigned a value of 2.6E-2, which is the HRA value derived in the HRA analysis from Attachment 1.
Credit for Time Delay Provided by RCIC Storage Tank Volume The water volume in the RCIC Storage Tank provides a period of time for HPCS operation even if circumstances should allow HPCS failure due to suction vortexing on low tank level. For Medium LOCA cases, even though the time for RCIC Storage Tank depletion may be less, the natural reactor depressurization that occurs as a result of the breach may be sufficient to eliminate the need for use of depressurization systems.
Depressurization Due to Medium LOCA events Thermal hydraulic analyses performed to support PRA timing indicate that at the time the RCIC Storage Tank is reduced to the point where vortexing might occur, the RPV would have depressurized sufficiently such that depressurization of the RPV would not be required. This makes the cutset combinations involving the Medium LOCA initiator (IEYMEDLOCI), with event HRITKCCLSZ and events representing depressurization failures non-logical combinations. To account for this in the PRA model the leading combinations of these failures were added to the mutually exclusive file to delete cutsets 7
containing these combinations. The following are the combinations added to the mutually exclusive file CLMEX06A.TXT:
- 1. IEYMEDLOCI GADSMLOSYH HRITKCCLSZ
- 2. IEYMEDLOCI G1312CCMVO HRITKCCLSZ
- 3. IEYMEDLOCI GIA012AMVO GXDIV2MSYM HRITKCCLSZ
- 4. IEYMEDLOCI GIA013AMVO GXDIVlMSYM HRITKCCLSZ
- 5. IEYMEDLOCI GDIV1HESYH GXDIV2MSYM HRITKCCLSZ
- 6. IEYMEDLOCI GDIV2HESYH GXDIVIMSYM HRITKCCLSZ
- 7. IEYMEDLOCI GX042CCCVO HRITKCCLSZ
- 8. IEYMEDLOCI GIA026AFLP GXDIVIMSYM HRITKCCLSZ
- 9. IEYMEDLOCI GIA026BFLP GXDIV2MSYM HRITKCCLSZ
- 10. IEYMEDLOCI GIA012AMVO GIA013AMVO HRITKCCLSZ
- 11. IEYMEDLOCI GXSRVCCRVO HRITKCCLSZ The combinations shown above represent Medium LOCA with depressurization failures, including those associated with operator actions, depressurization system hardware failures, and depressurization system maintenance events.
The descriptions of the respective basic events are shown below.
- Event Event Prob Description 1 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GADSMLOSYH 1.20E-02OP FAILS TO MANUALLY INITIATE RAPID DEPRESS. (MEDIUM LOCA)
HRITKCCLSZ 1.OOE+OCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 2 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR G1312CCMVO 1.62E-04CC FAILURE OF ADS CONTAINMENT ISOL VLVS 013A/012ATO OPEN HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 3 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GIA012AMVO 3.96E-03 DIV 1 ADS CONTAINMENT OUTBOARD ISOL VLV FAILS TO OPEN GXDIV2MSYM 2.73E-02 DIV 2 ADS & LLS SRVs UNAVAILABLE DUE TO MAINTENANCE HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 4 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GIA013AMVO 3.96E-03 DIV 2 ADS CONTAINMENT OUTBOARD ISOL VLV FAILS TO OPEN GXDIV1MSYM 2.73E-02 DIV 1 ADS & LLS SRVs UNAVAILABLE DUE TO MAINTENANCE HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 5 IEYMEDLOCI 5.10E-04 MEDIUM LOCA INITIATOR GDIV1HESYH 3.OOE-03 DIV 1 ADS & LLS IA IMPROPERLY RESTORED FROM MAINTENANCE GXDIV2MSYM 2.73E-02 DIV 2 ADS & LLS SRVs UNAVAILABLE DUE TO MAINTENANCE HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 6 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GDIV2HESYH 3.OOE-03DIV 2 ADS & LLS IA IMPROPERLY RESTORED FROM MAINTENANCE GXDIV1 MSYM 2.73E-02 DIV 1 ADS & LLS SRVs UNAVAILABLE DUE TO MAINTENANCE HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 7 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GX042CCCVO 2.66E-05CC FAILURE OF ADS SUPPLY CHK VLVS 042A/B TO OPEN HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 8 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GIA026AFLP 7.20E-04DIV 2 ADS AIR BOTTLE LINE FILTER PLUGGED 8
GXDIV1 MSYM 2.73E-02 DIV 1 ADS & LLS SRVs UNAVAILABLE DUE TO MAINTENANCE HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 9 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GIA026BFLP 7.20E-04DIV 1 ADS AIR BOTTLE LINE FILTER PLUGGED GXDIV2MSYM 2.73E-02 DIV 2 ADS & LLS SRVs UNAVAILABLE DUE TO MAINTENANCE HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 10 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GIA012AMVO 3.96E-03 DIV 1 ADS CONTAINMENT OUTBOARD ISOL VLV FAILS TO OPEN GIA013AMVO 3.96E-03 DIV 2 ADS CONTAINMENT OUTBOARD ISOL VLV FAILS TO OPEN HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE 11 IEYMEDLOCI 5.10E-04MEDIUM LOCA INITIATOR GXSRVCCRVO 1.47E-05CC FAILURE OF 7 OF 9 SRVs TO OPEN HRITKCCLSZ 1.OOE+OOCC FAILURE OF RCIC TANK LEVEL TRANSMITTERS TO ACTUATE CDF and LERF Quantification of HPCS Vortexinq Confi-guration The CL06A PRA model with changes to the CL06A.CAF file and CLMEX06A.TXT as noted above was quantified at the original truncation levels.
RESULTS The CPS PRA model CLO6A, is used in this risk evaluation. The base risk results from the Clinton 2006a PRA model (using a 3E-1 1/yr accident sequence frequency quantification truncation limit for CDF and a 5E-1 1/yr truncation limit for LERF) are as follows:
o CDFo=1.16E-5/yr o LERFO= 5.25E-7/yr Results for Internal Event ACDF Based on the model manipulations discussed previously to reflect the HPCS vortexing configuration, CDF 1 = 1.616E-5/yr (at a quantification truncation limit of 3E-1 1/yr).
The change in core damage frequency (CDF) for this condition is then:
ACDF = CDF1 - CDFo = 4.59E-6/yr Results for Internal Event ALERF Based on the model manipulations discussed previously to reflect the HPCS vortexing configuration, LERF1 = 7.30E-7/yr (at a quantification truncation limit of 5E-1 1/yr).
The change in Large Early Release Frequency (LERF) is then:
ALERF = LERF1 - LERFo = 2.05E-7/yr 9
External Events Impact External events are expected to have the same event timings as the non-LOCA, non-ATWS internal events discussed above. That is, the time to deplete the RCIC storage tank is determined by the need to meet decay heat boil-off of the reactor. Breaches in the reactor coolant pressure boundary and ATWS scenarios do not represent significant contributors to external event risk profiles (including Internal Fires, Seismic Events, External Floods, Off site Facility Hazards, etc.). In other words, Fire or Seismic induced LOCA or ATWS events are extremely low probability events.
Fires and Seismic Events in particular are characterized by the initial casualty, which is fairly short in duration (e.g. seismic events end on their own, fires are extinguished by the fire brigade) followed by a recovery period. Their action may disable a particular set of equipment, but once they are done acting the plant must continue to provide core cooling with the equipment that remains available. If HPCS is used for an extended period of time, the same compelling motivations exist for throttling HPCS flow as existed with the internal events. Because the event timings are similar, with hours of operation of the HPCS system while being supplied by the RCIC storage tank, the odds of the operators throttling HPCS flow are approximately the same as for the internal events case.
Reliance of the HPCS system on throttling of the injection valve (rather than on low tank level instruments) to prevent unacceptable vortexing constitutes a moderate reduction in the overall reliability of the HPCS system for long-term operation. With a HRA value of 2.6E-2, the throttling failure mechanism is roughly equivalent to hardware and maintenance failure terms for the HPCS system. The overall impact for the internal events CDF was a factor risk increase of 1.62E-5/1.16E-5=1.39. The factor risk increase depends upon the particular initiators involved.
In general, the increase in risk for a particular transient initiator is greater if the initiator does not cause an impairment of the HPCS system. For example, if the initiator disables HPCS, there is no increase in risk for this initiator, because there was no benefit from HPCS in the first place. If the initiator caused a impairment in a HPCS support system (e.g. LOOP, Loss of RAT or loss of Plant Service Water), there is a smaller factor increase in the overall failure rate for HPCS (including support systems) than if there were no impairment, thus the overall factor increase in CDF is also smaller. If the initiator causes no impairment in support systems (e.g. manual shutdown initiator, transients without isolation) the overall failure rate for HPCS (including support systems) is at its lowest, thus introduction of a throttling failure mechanism causes the largest factor increase in HPCS failure rate and the largest factor increase in CDF. This is confirmed by a review of the factor increase in internal events CDF by initiator. For the dominant initiators (i.e., those contributing 1 E-7/yr or more to CDF) in which throttling was credited, the Manual Shutdown Initiator shows the greatest factor increase in risk for this application at 2.07.
The Initiators used for the Fire PRA include a wide variety of different assumed internal events initiators and impairments, from simple transients with isolation through more demanding LOOP events. The total CDF frequency from fires is estimated to be 3.26E-6/yr from the IPEEE Fire PRA. A simple and conservative factor increase to apply to the Fire PRA result to estimate the impact of the vortexing failure mechanism is to use 2.07, which is at the high end for internal event initiators.
10
The Delta CDF for fires then can be simply estimated as follows.
ACDFfire = (2.07-1)
- 3.26E-6 = 3.49E-6/yr Clinton did not perform a seismic PRA, but did perform a seismic margins assessment.
While it is not readily possible to calculate changes in Seismic Core Damage frequency, it is generally recognized that for earthquakes up through the review level earthquake (0.3 g for Clinton), seismic risks are low and will be discounted for purposes of this analysis.
CONCLUSION Assessment Criteria In accordance with Refs.1, 2, and 3, the condition is assessed based on the ACDF and ALERF as summarized in the following tables:
ACDF Range SDP Color Significance from PSA Applications Guide [Ref. 1]
> 1 E-4/yr RED "Potentially risk significant"
< 1 E-4/yr - 1 E-5/yr YELLOW "Potentially risk significant"
< 1 E-5/yr - 1 E-6/yr WHITE "Assess Non-quantifiable Factors"
< 1 E-6/yr GREEN "Non-Risk-Significant" ALERF Range SDP Color Significance from PSA Applications Guide [Ref. 1]
> 1 E-5/yr RED "Potentially risk significant"
< 1 E-5/yr - 1 E-6/yr YELLOW "Potentially risk significant"
< 1 E-6/yr - 1 E-7/yr WHITE "Assess Non-quantifiable Factors"
< 1 E-7/yr GREEN "Non-Risk-Significant" The overall SDP color is the more significant of the two colors determined from ACDF and ALERF.
Based upon the risk analysis, it is concluded that the appropriate Phase 3 Significance Determination Risk color is WHITE because from the internal event initiators including flooding ACDF = 4.59E-6 /yr and ALERF = 2.07E-7 /yr. These are both in the WHITE range. Even when the estimated External Events contribution (ACDFfire = 3.49E-6 /yr) is added to the Internal events ACDF the conclusion remains that the color is WHITE.
REFERENCES
2, March 2006.
11
- 3. 1R 429583 12
Figure 1 Fault Tree Logic Added to Logic Gate HGATE90C 1.II[:41 4.21r.13 3.21E.13 13
HPCS Throttling HEP Calculation ATTACHMENT 1
- HUMAN ERROR PROBABILITY (HEP) CALCULATION -
Operator Fails to Throttle HPCS (Transient)
The purpose of this attachment is to calculate a Human Error Probability (HEP) for operator failure to throttle HPCS during Transient (i.e., non-ATWS, non-LOCA) type scenarios with loss of all high pressure coolant injection other than HPCS.
ACTION DESCRIPTION: This action is to manually throttle HPCS when HPCS is to be used for long-term RPV level control.
PROCEDURES GOVERNING ACTION: EOP-1 (provides the authorization) and 4411.04 (provides the proceduralized steps)
SUBTASKS:
- 2) Throttle HPCS injection valve by turning control in main Control Room (5 manipulations assumed)
RELEVANT CUES: No availability of other high pressure systems This HEP calculation assumes that all other high pressure systems are unavailable, and that the operators will proceed with the use of HPCS to the exclusion of low pressure systems.
TIMING OF INITIAL CUE: t = 1 hr The operators' first priority when using HPCS is to recover reactor water level. Managing reactor water level throughout the event remains the foremost operator consideration. The operators are directed to control RPV water level between Level 3 and Level 8 per EOP- 1.
Once RPV level is recovered to within acceptable bounds, the operators' next priority is to return cooling to a more standard cooling method, especially one with decay heat removal capability; the preferred systems would be Feedwater with the Main Condenser, or RHR Shutdown Cooling mode. To use HPCS for an extended period of time to maintain level implies that problems have been encountered recovering feedwater and/or commencing reactor depressurization and cooldown to place shutdown cooling in service.
CPS Operations personnel interviewed in support of this calculation stated they believed that all of the operating crews would pursue HPCS throttling per 4411.04 if it became apparent HPCS was the only injection system likely to be available for some time.
I C467060002-7407R I-12/12/2006
HPCS Throttling HEP Calculation This HEP calculation conservatively assumes that the operators allow HPCS to operate in automatic mode and cycle for the first hour while they pursue re-alignment of other more preferred cooling methods.
END OF TIME WINDOW: t = 2.5 hrs The end of the available action time window is defined by the time HPCS fails due to vortex-induced air ingestion after pumping approximately 123,000 gallons from the RCIC Storage Tank. For Transient cases, this time frame is approximately 2.5 hrs if HPCS is operating in automatic mode (i.e., filling the RPV from Level 2 to Level 8, then automatic transfer to 500 gpm min-flow to suppression pool during RPV boil-off, then automatic re-initiation of RPV injection on Level 2). This time estimate varies by tenths of hours depending upon assumptions such as the decay heat curve selected, the HPCS flow rate used, whether or not CRD flow into the RPV is credited, etc. The estimate of 2.5 hrs used here is a reasonable nominal estimate for this HEP calculation.
TIME REQUIRED FOR PERFORMANCE: 15 mins This HEP calculation assigns 15 minutes for manipulation time for the action. This manipulation time is estimated as:
- Travel time to HPCS Switchgear Room (5 min.)
" Execution time to identify and clip the appropriate wires in the HPCS MCC (5 min.)
" Travel/execution time for positioning HPCS injection valve at main Control Room panel (1 min per manipulation, 5 manipulations assumed = 5 min.)
The 10 minute estimate (5 min. + 5 min.) for the two ex-Control Room subtasks (i.e., the first two bullets above) is consistent with the associated Job Performance Measure (JPM) and simulated performance of the task. Clinton JPM 44110402NSN02, Rev. 4, "Throttling ECCS Injection Flow - HPCS", assigns 15 minutes for training purposes as the estimated time to travel to the HPCS Switchgear room, complete the necessary actions at the HPCS MCC and then notify the Control Room that the HPCS injection valve is available for throttling. Operators have shown that they can perform these ex-Control Room subtasks in less than the estimated 15 minutes of the JPM. In a V&V effort for the EOP steps in 1992, an operator completed the CPS 4411.04 Section 2.2 steps (including traveling from the main Control Room to the HPCS Switchgear room, acquiring the necessary tools, and simulating cutting the indicated wires) in under 4 minutes. As such, the average of the 15 minutes from the JPM and the 4 minutes from the simulated performance are used to here as the required manipulation time estimate for the ex-Control Room subtasks of this action.
The time estimate for the in-Control Room valve manipulations assumes 5 manipulations of the valve control switch over the course of the accident progression, at 1 min. per valve manipulation. One minute for manipulation of a valve control on a Control Room panel is reasonable and a typical HRA time estimate for such an action.
2 C467060002-7407R 1- 12/12/2006
HPCS Throttling HEP Calculation QUANTIFICATION BASIS: Consistent with the approach used in the CPS base PRA, this HEP is calculated using the NRC ASEP (Accident Sequence Evaluation Precursor) HRA Methodology, as described in NUREG/CR-4772. The nominal diagnosis error curve from NUREG/CR-4772 is used.
DIAGNOSIS HEP: Per NUREG/CR-4772, the available diagnosis time is defined as the total time window minus the time of the initial cue minus the required manipulation time. For this calculation, the diagnosis time is: 2.5 hrs - 1 hr - 15 mins = 75 mins.
As directed by guidance in NUREG/CR-4772, the Upper Bound of the ASEP nominal diagnosis error rate curve is used given the following characteristics of this action:
" Proceduralized action identified in EOPs
- Operators are not routinely trained on this action Per the ASEP upper bound nominal diagnosis curve from NUREG/CR-4772, the diagnosis error rate contribution for 75 mins for this action type is 2.5E-3.
EXECUTION HEP: Per NUREG/CR-4772 guidance, each of the 6 sub-tasks identified for this action are defined as "step-by-step tasks performed under moderately high stress". Per NUREG/CR-4772 nominal post-initiator HEP guidance, the base HEP for a step-by-step execution task performed under moderately high stress is 2E-2.
Consistent with NUREG/CR-4772 guidance, a recovery factor is applied to the base execution error rate to account for checks by additional personnel. Per NUREG/CR-4772 nominal post-initiator HEP guidance, the error recovery factor for verifying the correctness of a step-by-step task performed under moderately high stress is 2E- 1.
Therefore, the execution HEP contribution is calculated as: 2E-2 x 6 x 2E-1 = 2.4E-2 This calculation reasonably assumes that there is no concern about identifying the proper wires to cut as part of the ex-Control Room action. Procedure 4411.04 explicitly identifies the MCC ID and associated breaker cubicle and the terminal numbers inside the breaker cubicle. The JPM for this action used to train the operators also includes photographs of the interior of the breaker cubicle, showing the appropriate terminals. In addition, CPS Operations personnel interviewed in support of this calculation stated that sufficient personnel would be available during such scenarios to perform the 4411.04 tasks.
FINAL HUMAN ERROR PROBABILITY (HEP): 2.6E-2 The final HEP is the sum of the diagnosis error and manipulation error contributions. The final HEP for this action is therefore:
HEPfinal = 2.5E-3 + 2.4E-2 = 2.6E-2 3 C467060002-7407R 1- 12/12/2006
ý:.-- I'll I I U-603796 ATTACHMENT 2 Discussion of Conservatisms in SDP Analysis Throttling of the High Pressure Core Spray (HPCS) system is an action allowed under the "Level Control" leg of Clinton Emergency Operating Procedure (EOP), EOP-1, "RPV Control." Because HPCS is a high volume flow rate system, throttling of HPCS results in better reactor water level control, specifically when HPCS is used for an extended time period to provide reactor vessel makeup. Throttling to meet decay heat boil-off needs eliminates the possibility of HPCS vortexing because of reduced flow. Since throttling is a high priority action for the operators and eliminates the vortexing problem, it is the key feature credited in the Significance Determination Process (SDP) analysis documented in SA-1578, Revision 2, "Significance Determination Process (SDP) Evaluation for CPS HPCS RCIC Storage Tank Suction Vortexing."
If the operators took no action during an event where RPV level recovery is required, suppression pool level would rise specifically for those dominant transient initiators in the Probabilistic Risk Assessment to the point that the HPCS suction would transfer to the suppression pool. The high suppression pool level occurs due to steam transfer from the RPV during boiloff and/or due to HPCS minimum flow operation when isolated from the RPV. The Reactor Core Isolation Cooling (RCIC) water storage tank volume (above any level at which vortexing can occur) is much greater than the volume of water transferred to the suppression pool causing HPCS suction transfer. Although not credited in the SDP analysis, this design feature would further reduce the calculated result in the SDP.
Another consideration not addressed is the "Pool Level" leg of EOP-6, "Primary Containment Control." Per the guidance of the EOP, water can be removed from the suppression pool in order to manage suppression pool water level within bounds. While this action does not have the same priority as reactor water level control, or recovering reactor inventory makeup systems, a much more appropriate approach for dealing with rising suppression pool water level would be to simply let the high suppression pool level transfer automatically occur (or to manually initiate it). A manual suction transfer involves opening the suppression pool suction valve, 1 E22F01 5, after which the RCIC storage tank suction valve, 1 E22F001, closes. This is easily achievable using a control room hand switch and therefore forms a basis for high potential of operator success. A suction transfer would terminate any further suppression pool level rise due to HPCS operation and would eliminate any possibility of HPCS vortexing due to RCIC water storage tank water level decreases.
Because credit for manual transfer of the HPCS system suction and/or the transfer that would occur automatically upon high suppression pool level can be difficult to quantify, credit has not been numerically included in SDP evaluation SA-1 578, Revision 2. A general application of the likelihood of a suppression pool transfer on high suppression pool level would decrease the delta core damage frequency (CDF) value for the SDP analysis by a factor such that the overall change in CDF would be lower than that represented in the current analysis provided in Attachment 1.