Resolution of Generic Safety Issues: Issue 71: Failure of Resin Demineralizer Systems and Their Effects on Nuclear Power Plant Safety (Rev. 3) ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
This issue was raised516 by DSI/NRR in August 1982516 following a search of LERs which suggested that additional licensing attention was needed for certain ancillary power plant equipment. The available information showed that failures of resin bed demineralizer sub-systems occurred within the process systems (both nuclear and non-nuclear) of nuclear power plants. These process systems, by definition, do not directly perform any reactor protection or engineered safeguard functions, yet their failure could seriously impair the capability of safety grade systems to perform by rendering their redundant trains inoperable (i.e., causing a common mode failure). The chief concern was the possibility that these types of events may not be bounded by the current licensing basis for nuclear power plants and could cause plants to be inadequately protected. The types of failures considered were: (1) introduction of resin into other areas of the system (either by breakthrough of the resin during normal operation or by improper recharging); (2) introduction of gas into other areas of the system by improper recharging; and (3) loss of water chemistry.
Safety Significance
Failures of resin demineralizers can be caused by operator error or by equipment failure and have produced the following: (1) clogging of pump strainers (due to resin introduction into the system) and the subsequent tripping of the pumps; and (2) introduction of gas into systems (subsequently causing pump trips) due to improper demineralizer back-flushing. Systems containing demineralizers are:
PWR
Two failure modes were considered: (1) introduction of resin or gas into a system which subsequently causes one or more additional failures; and (2) loss of water chemistry control which affects corrosion rates. The first failure mode can be caused by operator error or by equipment failure and has the potential of affecting the following systems:
Since some of these systems perform a safety function or support systems which perform a safety function, their failure could reduce the ability of a plant to maintain safe shutdown conditions. The following are a few examples of where demineralizer failures caused a loss of safety grade equipment.
(1) Following a review of a TMI-2 event that occurred in September 1977 during hot functional testing prior to fuel loading, it was concluded that, had the reactor been fueled and at power when the event occurred, there might have been core uncovery followed by fuel damage.516 TMI-2 has a full-flow, condensate polishing system in the condensate and feedwater system and, as a result of its malfunction, resin from the system was carried over into the plant's demineralized water system from which it migrated to all other parts of the plant, including the nuclear steam supply system and the turbine. The most significant result was that the resin clogged the strainers to all of the circulating pumps in the nuclear service closed cooling water system causing them to trip. This removed essential cooling water from all related reactor pressure and ESF systems and components and also all non-essential nuclear systems and components, i.e., RCPs, spent fuel coolers, instrument air compressors, and after-coolers. The loss of coolant to the RCPs caused the pumps to trip and the pressurizer heaters to shut off resulting in depressurization of the reactor coolant system. It was concluded that the net result of the polishing system malfunction was the potential loss of primary system heat removal capability, i.e., forced convection using RCPs, natural circulation cooling, and feed-and-bleed using HPSI pumps.
(2) During RHR operation at cold shutdown at San Onofre-2, there was a system malfunction or operator error while reprocessing of a demineralizer subsystem.1172 During this operating mode, the demineralizers of the related CVCS were lined up with the RHR to accomplish RCS cleanup and pressure control. Backflushing of one of the related filters was initiated and, during this process, by either system malfunction or operator error, nitrogen gas used during this procedure passed through the subsystem into the suction lines of all the RHR pumps with resultant loss of operability. The RHR pumps are also the LPSI pumps. In this case, redundant systems important to protection of the facility during an accident, as well as orderly cold shutdown of the plant from 350F, were rendered inoperable.
(3) At Pilgrim-1, there was a system malfunction which caused an improper recharging of a demineralizer in the RWCS.1173 This resulted in resin entering the RCS and caused the indicated flow rate input to the APRM flow bias trip settings to read high, thus providing a non-conservative input to two trip functions. In this case, a demineralizer problem affected the ability of a safety system to perform its function.
The loss of the ability to shut down or to maintain a safe shutdown condition for the reactor is considered of highest safety significance and the effect demineralizer failures could have on public risk associated with core-melt were evaluated below. The loss of spent fuel cooling and water cleanup capability was assumed to be of much less safety significance due to the long lead time available to restore cooling. Therefore, it was not considered a large contributor to risk and was not evaluated below.
The second failure mode (loss of water chemistry control) has the potential of changing the corrosion rate for the affected system. However, since a loss of water chemistry and the subsequent change in corrosion rate do not lead to immediate failures, do not affect all parts of the system at the same rate, and can be detected and corrected prior to having any significant impact, this failure mode was not considered a significant contributor to public risk and was not considered further below.
Therefore, based on the above, the rest of this evaluation addressed the failure mode of resin or gas introduction into a system which then leads to immediate failures of other safety systems.
Possible Solutions
Possible solutions included hardware and administrative changes. Specifically, a combination of the following could be done: (1) install filters on the outlet of all demineralizer units which would stop resin from entering the system through the demineralizer outlet nozzle; and (2) evaluate existing procedures, job aids, and training to discern where improvements can be made to enhance operator capability and further reduce the chances for human error which result in resin or gas intrusion into a system during demineralizer recharging.
PRIORITY DETERMINATION
Assumptions
No provision was made in the safety analysis of the operating LWRs to account for the effects or consequences of demineralizer problems or failures. Therefore, by considering the possibility of demineralizer failures, the additional risk these present to the public must be determined. The system failure probabilities used were those summarized in NUREG/CR-280064 and were based on the Oconee-3 PRA for PWRs and the Grand Gulf-1 PRA for BWRs. The number of plants affected by this issue was conservatively assumed to be all operating and planned plants (78 PWRs and 39 BWRs) and their average remaining life was assumed to be 30 years.
Frequency Estimate
The frequency of demineralizer failures was estimated using data from an LER search for the period June 1982 through June 1984. LERs prior to 1982 were not searched since old data did not reflect existing operating practice and improvements in procedures, training, etc., subsequent to TMI-2 and, therefore, may not have been an accurate estimate of failure rate.
From the LER search, it was determined that there were 15 events involving abnormalities caused by demineralizer-related problems. Of these 15 events, 2 led to degradation of a safety system. (See References 516, 1172, 1173.) An additional LER search covering the years from 1984 through 1987 was performed to identify LERs that involved demineralizer systems; no additional LERs were identified involving demineralizers that caused a degradation of a safety system. The span from 1982 through 1987 comprised 277 PWR-years of operating experience. Hence, for PWRs, the frequency of safety system failure due to demineralizer problems was 2 failures in 277 PWR-years or 7.2 x 10-3 failure/ RY. For BWRs, there were no recorded LERs involving the loss of safety systems resulting from demineralizer problems. However, the event described1172 at San Onofre-2 could have occurred in a BWR. Hence, for BWRs, it was assumed that one failure occurred over the span of 166 BWR-years or 6.2 x 10-3 failure/RY.
In the 1984 through 1987 LER assessment, 3 events involving BWRs were found to have occurred which resulted in either an automatic or manual scram. These scrams were the result of high main steam line radiation readings which were believed to be due to either resin or corrosion particles. It was conceivable that all 3 could have resulted from resin particles. Assuming 3 transient events in the 116 BWR-years resulted in 0.026 transient per BWR-year due to demineralizer failures. PWRs were not susceptible to these same occurrences. However, a PWR scram was found which resulted from a demineralizer fault. In the TMI-2 accident,516 the loss of feedwater resulted in a scram. With one transient trip in 227 PWR-years, a transient frequency of 3.6 x 10-3 event/RY resulted from demineralizer-related events.
Consequence Estimate
Demineralizer system failures and their resulting impact on other plant systems cannot, by themselves, lead to a core-melt or containment failure. They can, however, remove some of the systems which provide lines of defense against such core-melt and containment failure events, or result in transient-induced scrams. In the case of PWRs, the systems which provide a line of defense and which could be rendered inoperable due to a demineralizer failure are: High Head Safety Injection System (for reactor shutdown); Condensate and Feedwater System (for normal decay heat removal); RHR System (for shutdown decay heat removal); and Containment Spray System (for containment pressure and temperature control). For BWRs, the systems are: Reactor Protection System (for reactor shutdown); Condensate and Feedwater System (for normal decay heat removal); and RHR System (for shutdown decay heat removal and containment cooling).
The consequences associated with these events were estimated by considering the following scenario. While at full power, a malfunction in the plant required the plant protection system to automatically shut down the plant. However, a demineralizer problem caused the loss of function of one of the safety systems which could be affected by demineralizers. Other safety systems were assumed to fail with probabilities as defined in the Oconee-3 and Grand Gulf-1 PRAs leading to a core-melt with containment failure. Since this event could result in a loss of core cooling, containment cooling, or containment spray, it was considered to be bounded by the PWR-2 and BWR-2 release categories which have estimated dose consequences of 4.8 x 106 and 7.1 x 106 man-rem/event, respectively. The transient-related accidents T23 for BWRs and T3 for PWRs were expected to result in BWR release categories 1, 2, 3, and 4, and in PWR release categories 3, 5 and 7, respectively.64
To estimate the reduction in risk associated with the elimination of demineralizer failures, two calculations were involved: (1) the additional probability of reaching a core-melt due to demineralizer failure which rendered a safety injection system inoperable; and (2) the reduction in core-melt frequency resulting from a reduction in transient-induced scrams. The first was done by assuming that the effect of demineralizer failure contributed directly to the probability of core-melt by adding directly to the failure probability of those systems that can be affected by demineralizer failures. This contribution was calculated by examining the dominant accident sequences for PWRs and BWRs (using the Oconee-3 and Grand Gulf-1 PRAs as representative of these plants) and, for those sequences that involve systems whose performance could by affected by demineralizer problems, adding to that system an annual unavailability of (2 x 10-5) for PWRs and (1.4 x 10-6) for BWRs. This would then represent the incremental increase in the frequency of a core-melt accident for a plant. The values calculated for these increases in frequency were 6.4 x 10-8/RY and 8.8 x 10-8/RY for PWRs and BWRs, respectively. The transient reductions were based upon the frequency reduction values given previously. The transient reductions resulted in a reduction in core-melt accident frequency of 1 x 10-9/RY for PWRs and 8 x 10-8/RY for BWRs. The risk reduction associated with resolution of this issue was calculated below.
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
In addition, since hardware fixes were assumed to be part of the solution of this issue, the occupational dose associated with the installation of these fixes were considered. The addition of 6 strainers per plant on the outlet of demineralizers was assumed as the hardware fix.
The occupational dose received from the installation of demineralizer strainers was estimated as follows: (1) it was assumed that the installation of each strainer involved 40 man-hours of labor in a radiation zone; and (2) from Chapter 12 of the Oconee-3 and Grand Gulf-1 FSARs, the dose rate in the areas where demineralizers are present was approximately 100 millirem/hr when the plant is shutdown. Therefore, the occupational dose received from the installation of 6 outlet strainers was (40 man-hrs)(6)(0.1 rem/hr)=24 man-rem/reactor.
Since this occupational dose was less than the risk reduction dose consequences, it appeared that there was some benefit to implementing such fixes. The impact of additional strainers on increased occupational dose due to maintenance was assumed to be negligible.
Cost Estimate
Industry Cost: The cost associated with resolution of this issue involve hardware additions (demineralizer outlet strainers) to mitigate the consequences of demineralizer failures, procedure changes, and additional operator training. Hardware fixes were estimated to cost $600,000 based on the addition of 6 outlet strainers/plant. Procedural changes were estimated to cost $12,000 assuming 1 man-month/plant. Based on 1 man-week/RY, additional operator training was estimated to cost ($3,000/RY)(30 years)or $90,000. Thus, the total industry cost was estimated to be $700,000. It was assumed that all of the fixes could be done during normally scheduled downtime; therefore, the cost of replacement power was not a factor.
Additional maintenance costs to monitor implementation were assumed to be negligible. However, it was also possible that a reduction in demineralizer problems would also reduce undesired plant shutdowns and thus save licensees the cost of replacement power. From the LER search, it was determined that, of the 15 events reported involving demineralizers, 2 caused plant shutdowns to correct the problem. It was assumed that half of these could be avoided by the better training procedures and mitigation effects of demineralizer outlet filters. Therefore, based on the LER data, a plant will avoid [(1)(30 years)/(75)(2.5 years)]=0.16 shutdown/plant due to demineralizer problems over its life. This resulted in a cost savings to each plant of (0.16 shutdown)($500,000/ shutdown) =$80,000/plant over its life. (Each shutdown was assumed to last 1 day at a cost of $500,000/day.) Therefore, the total cost/plant to resolve this issue was estimated to be $(700,000 - 80,000) or $620,000.
NRC Cost: NRC costs were negligible.
Total Cost: The total industry and NRC cost associated with a possible solution was estimated to be $0.62/reactor.
Value/Impact Assessment
Based on estimated public risk reductions of 9.3 man-rem/reactor and 32 man-rem/reactor for PWR and BWRs, respectively, and a cost of $0.62M/reactor for a possible solution, the value/impact scores were given by:
(1) PWRs: S = 9.3 man-rem/reactor $0.62M/reactor
< 15 man-rem/$M
(2) BWRs: S = 32 man-rem/reactor $0.62M/reactor
< 52 man-rem/$M
Other Considerations
(1) The assumptions used in this evaluation regarding frequency and consequence estimates were conservative because the estimates of frequencies of transients and failures in BWRs were high and the bounding of non-transient accidents by BWR-2 and PWR-2 releases resulted in high public dose estimates. Therefore, the value/impact scores were considered to be high estimates.
(2) Many demineralizer failures can and are detected (via water chemistry, etc.) prior to their affecting other equipment.
(3) Generally, a demineralizer failure affects only one system and this is not enough to prevent a plant from performing its safety functions. In the one case at TMI-2 where more than one system was affected,516 the plant was in the pre-operational testing phase, prior to certification that the plant condition (equipment and procedures) was suitable for power operation.
(4) At the time of this evaluation, fixes following the TMI-2 failure appeared to have reduced the frequency of occurrences.
CONCLUSION
Based on the above value/impact scores, the issue was given a low priority ranking (see Appendix C) in February 1990. Further prioritization, using the conversion factor of $2,000/man-rem approved1689 by the Commission in September 1995, resulted in impact/value ratios (R) of $66,666/man-rem and $19,375/man-rem for PWRs and BWRs, respectively, which placed the issue in the DROP category.
Following a periodic review of LOW-priority issues, new information was provided1773 by Region IV that required a reevaluation of the issue. However, consideration of this new information did not result in any change in the priority of the issue.1774
REFERENCES
|
