Resolution of Generic Safety Issues: Issue 130: Essential Service Water Pump Failures at Multiplant Sites (Rev. 2) ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
This issue was identified958 when the staff found the Byron Unit 1 vulnerable to core-melt sequences in the absence of the availability of Byron Unit 2 which was not yet operational. Because of the licensing status of the multiplant configuration of Byron Units 1 and 2, and the more immediate need to make a third service water pump available to Byron Unit 1 via a crosstie with one of the two Byron Unit 2 essential service water (ESW) pumps, the Byron Unit 1 concern was classified as a plant-specific (not generic) issue. However, this plant-specific issue raised concerns for multiplant sites that have only two ESW pumps/plant with crosstie capabilities. The future operation of Byron Unit 2 would place both Byron units in this limited group of plants with multiplant configurations.
A limited survey958 of W plants was conducted to help identify the generic applicability of multiplant configuration vulnerabilities with only 2 ESW pumps/plant. In the multiplant configurations identified (approximately 16 plants), all plants could share ESW pumps via crosstie between plants. It was stated958 that B&W and CE plants would be surveyed to identify if similar multiplant configurations with 2 ESW pumps/plant and crosstie capabilities existed. Based on the staff's limited survey, this issue had the potential to affect at least 16 PWR plants. A survey was recommended for single-unit plants to identify if similar ESW vulnerabilities existed.
Safety Significance
All ESW systems are front-line (supporting) safety systems. The design of the ESW support systems is highly plant-specific with plant-specific equipment, crosstie capability, and ESW operability and functionability needs for successful (accident mitigation) operations. Because of the variability between ESW systems of different plant configurations, approximate generic modeling of the success criteria for the multiplant configurations with 2 ESW pumps/plant with crosstie capabilities was used to scope the safety significance of this issue. The assumed success criteria and systemic events leading to core-melt are discussed below. The core-melt and radiological risk (consequences) determined by this evaluation pertain only to the generic model multiplant configuration with 2 ESW pumps/plant. However, as discussed herein, other plant configurations may also contain similar ESW system vulnerabilities.
Should the front-line ESW systems fail to provide adequate cooling capability to shut down a plant when subject to a loss of ESW, a core-melt accident could result in significant risk to the public.
Possible Solutions
The possible solutions to reduce the public risk from a loss of the ESW system were: (1) provide a third ESW pump/plant; (2) provide an additional swing pump that is shared between units; and (3) modify TS governing the LCO for the ESW pumps.
PRIORITY DETERMINATION
The service water cooling system is used to remove heat from essential and non-essential equipment. Under accident conditions, the non-essential heat loads are isolated and the ESW system provides cooling only to essential equipment for plant cooldown and post-accident operations. At multiplant sites, the ESW systems for each plant are crosstied with double isolation valves that are normally closed.
ESW Success Criteria: The success criteria for the ESW systems in providing adequate cooling capability during normal, accident, and post-accident conditions are plant/design-specific. The ESW vulnerabilities would depend on the plant configurations, numbers and the capacities of the ESW pumps, and equipment ESW cooling dependencies. Because the success criteria may be as varied as the ESW systems, the following success criteria were assumed as a representative model for purposes of quantifying the systemic events leading to possible core-melt accidents. The generic criteria may apply only to multiplant sites having 2 ESW pumps/plant with crosstie capabilities.
During normal operations, one ESW pump/plant provides adequate cooling to systems such as CCW, RCP motor coolers, and air-conditioning and ventilation systems. The second ESW pump/plant is assumed to be normally in a standby mode. Because of load shedding (isolation of non-essential equipment), one ESW pump/plant was assumed to be capable of handling the accident and cooldown heat loads. Typical equipment cooled by the ESW under these conditions are the CCW heat exchangers, containment spray heat exchangers, diesel generators, and auxiliary building ventilation coolers. With one plant in normal operation and the second plant already in the shutdown or refueling modes of operation, the criteria assumed that one ESW pump can provide adequate cooling to shutdown the operating plant through the crosstie connections, should the need arise.
Initiating Transient Event: The initiating events leading to core-melt assume the following: one plant "A" ESW pump (P1) fails and the second ESW pump (P2) is out of service during a TS-allowed outage time (AOT) of 72 hours. The failure frequency of P1 was estimated at approximately 10-1/RY.959 The unavailability of P2 (normally in standby) from the AOT was approximately 10-2/RY. Therefore, the initiating event (Ta) that originates from plant A, due to the loss of service water in plant A, had a frequency of 10-3/RY.
Plant B may be in operation or in the shutdown or refueling mode of operation. If a 0.7 capacity factor was assumed for both plants, the probability that both plants would be operating at the same time was 0.5 (product of capacity factors). Conversely, the probability that one plant is operating and the other plant is shutdown was also 0.5. Absent any TS requirements on the Plant B ESW pumps during
shutdown or refueling modes, the status of Plant B ESW pumps (P3,P4) was uncertain. Therefore, as shown in Table 3.130-1, the unavailability (Wi) to meet the success criteria (N) is the product of the status mode probability and the conditional failure probability, given the status mode of the ESW pumps.
| Ta | U | N | ESW PUMPS | Wi | |
|---|---|---|---|---|---|
| Initiating Events Frequency | Plant B Status | Number of Plant B Pumps Required | Status Mode | Unavailability | Unavailability of N |
| 10-3 | Operating | 2 | P3 =R | ||
| P4 =AOT | (10-2)(1.0) | W1=10-2 | |||
| Ubo =0.5 | 2 | P3 =R | |||
| P4 =SB | (0.98)(7x10-2) | W2=7x10-3 | |||
| 10-3 | Shutdown | 1 | P3=M | (0.25)(1.0) | W3=0.25 |
| P4=M | |||||
| Ubr=0.5 | 1 | P3=M | |||
| P4=SB | (0.25)(7x10-3) | W4=2x10-3 | |||
| P3=R | |||||
| P4=SB | |||||
| P3=R | |||||
| P4=M |
AOT - Allowed Outage Time M - Maintenance R - Running SB - Standby
Loss Of Service Water Transient Event Sequences: This section describes the loss of service water events for a two-unit multiplant configuration with 2 ESW pumps/plant, given the loss of service water initiating transient (Ta) in Plant A discussed earlier.
The control room operator is expected to trip the Plant A reactor and initiate local recovery actions to open the ESW crossties between Plant A and Plant B. After the Plant A reactor trip, the auxiliary feedwater system (L) would be demanded. If Plant B ESW pumps are available and the ESW is recovered by valve realignments (X, crosstie), it was assumed that the reactor (Plant A) can be cooled by steam generators using "L". If "L" is not successful (failure on demand), the operator would initiate HPI and cool the reactor by feed-and-bleed. Recovery of service water via "X" would also restore cooling to the CCW heat exchangers that cool the HPI pumps and other essential equipment.
If the Plant B ESW pumps are available and ESW recovery by "X" is not made, the Plant A RCP seals may fail (S) due to loss of seal injection (charging pumps) cooling and RCP thermal barrier cooling (CCW). The RCP seal failure results in a LOCA. The ECCS pumps were assumed to fail because of lack of CCW heat exchanger cooling by the service water, resulting in a core-melt event.
If "L" fails on demand, the operator would initiate the HPI pumps and attempt to cool the reactor by feed-and-bleed. However, the HPI pumps, as described earlier, indirectly require ESW cooling and are assumed to fail. If L is successful, the pressure relief valves (if required) could either fail to open (P) and relieve the reactor pressure (overpressure failure of reactor), or fail to close (Q), given that they opened (LOCA). Given a LOCA, the HPI pumps were assumed to fail because the service water to the CCW heat exchangers, which cools the HPI pumps, was not available.
If Plant B ESW pumps are not available (Wi) due to extended maintenance outage (M) or failure to start and run from a standby condition (SB), it was assumed that recovery of the ESW pumps cannot be obtained in sufficient time to preclude core-melt. In these cases, a successful crosstie (X) is not effective in reducing core-melt.
The cut sets (systemic event sequences) for the above loss of service water transient (Ta) in Plant A were:
| (1) | Plant B Operating | (Ubo) | ||
| X(L+P+Q) | 3.0 x 10-4 | 1.5 x 10-7 | ||
| TaUbo | XS | = (5 x 10-4) | 3.0 x 10-4 | = 1.5 x 10-7 |
| (W1+W2) | 2.0 x 10-2 | 1.0 x 10-5 | ||
| (2) | Plant B in Shutdown or Refueling | (Ubr) | ||
| X(L+P+Q) | 3.0 x 10-4 | 1.5 x 10-7 | ||
| TaUbr | XS | = (5 x 10-4) | 3.0 x 10-4 | = 1.5 x 10-7 |
| (W3+W4) | 2.5 x 10-1 | 1.3 x 10-4 |
The base case frequencies and probabilities for the cut sets shown above were:
| Ta = 1.0 x 10-3/RY | W3 = 2.5 x 10-1 |
| Ubo = 5.0 x 10-1 | W4 = 2.0 x 10-3 |
| Ubr = 5.0 x 10-1 | X = 3.0 x 10-2 |
| W1 = 1.0 x 10-2 | S = 1.0 x 10-2 |
| W2 = 7.0 x 10-3 |
L = 10-2 to 10-5, depending on plant-specific design and ESW cooling needs P = (10-3/demand)(10-1 demand/L) = 10-4 Q = (10-2/demand)(10-1 demand/L) = 10-3
Frequency Estimate
Based on the success criteria and examination of the above base case core-melt frequency estimates, a dominant core-melt frequency of approximately 10-4/RY for the multiplant units with 2 ESW pumps/plant can occur with one plant operating and the other plant shut down (refueling).
Based on engineering judgment, at least one of the ESW pumps in the shutdown plant should be kept running. In addition, the RHR and diesel generator TS operability requirements for Modes 5 and 6 indicated (indirectly) that the ESW pumps should be operable in Modes 5 and 6. However, by possible valving alignments (plant-specific), the RHR system and diesel generators could be cooled by the adjoining operating plant's ESW pumps. Therefore, lacking specific operability requirements on the ESW pumps when the plant is in Modes 5 or 6, the operability of the shutdown plant's ESW pumps was not assured. If only one of the two ESW pumps is out for maintenance and the other pump is in standby, the core-melt frequency for the operating plant was approximately 10-6/RY from Ta. If at least one ESW pump is running (simultaneous multiple failures of running pumps in both plants was considered unlikely) in the shutdown plant, the core-melt frequency of the operating plant from Ta was negligible.
Based on the above, TS requirements on ESW pumps while plants are in Modes 5 and 6 may provide a reduction in core-melt frequency of approximately 10-4/RY for the operational plant at a two-unit multiplant site. When both plants are operating, the dominant core-melt frequency from an ESW transient (T) was estimated at 10-5 /RY. Improvements in valve realignments (crosstie) procedures were not believed to contribute significantly to core-melt frequency, but the resolution of this issue should reexamine the need for TS or procedures for these crosstie operations. It also appeared that changes to the ESW TS in Modes 1, 2, 3, and 4 would not provide significant reductions in core-melt frequency.
An additional ESW swing pump between plants or a third ESW pump/plant was estimated to provide at least an order of magnitude reduction in core-melt frequency. Therefore, the reduction in core-melt frequency from the addition of an ESW pump was estimated at approximately 10-5/RY.
Consequence Estimate
As shown above, the two-unit multiplant configurations with only 2 ESW pumps/unit may have a core-melt frequency reduction potential (CM) on the order of 10-5/RY when both units are running, or 10-4/RY when one unit is running and the other is shut down. Because the indicated remedies for each dominant core-melt frequency were significantly different in scope and costs to implement, the risks were calculated separately. In each case, however, the estimated core-melt frequency was predicated on the potential unavailability of the ESW pumps in the adjoining unit of the multiplant configuration. The crosstie configurations and capability of the plant operators to realign the valves in the crosstie configurations were not estimated to be as significant an impediment to success in reducing core-melt frequency.
It was also estimated that recovery of the ESW pumps out of service cannot be assured in time to preclude a core-melt. Equipment such as the screen wash pumps (non-safety grade) might provide alternate means of service water cooling. However, alternate equipment and its use in these situations will be highly plant-specific.
With the ESW system unavailable for direct or indirect cooling of all emergency core cooling systems and containment cooling systems, the containment was estimated to be as likely to fail by overpressurization (WASH-1400,16 Category 2) as by basemat melt-through (WASH-1400,16 Category 6), the timing of the release being dependent on progress and timing of the core-melt. Potential containment failures similar to the WASH-1400,16 Category 4 (failure to isolate containment) were estimated to be of lower probability and, therefore, of lesser significance.
Given the above, the risk (consequences) was calculated as a product of the core-melt frequency, the release (dose) per category type release, the probability of the category type release, and the number of remaining reactor years of plant life. The conditional public dose per category type release was based on the fission product inventory of a 1120 MWe PWR, meteorology typical of the Byron site, and a surrounding uniform population density of 340 persons per square mile over a 50-mile radius from the plant site, with an exclusion radius of one-half mile from the plant.
| Plant A Operating | Core-Melt Freq.(CM/RY) | Release Category (WASH-1400)16 | Prob. of Release Category | Dose per Release Category (man-rem) | Remaining Plant Life | PublicRisk (man-rem/reactor) |
|---|---|---|---|---|---|---|
| Plant B | 1.3 x 10-4 | 2 | 0.5 | 4.8 x 106 | 30 | 9,360 |
| Shutdown | 1.3 x 10-4 | 6 | 0.5 | 1.5 x 105 | 30 | 300 |
| TOTAL: | 9,700 | |||||
| Plant B | 1.0 x 10-5 | 2 | 0.5 | 4.8 x 106 | 30 | 720 |
| Operating | 1.0 x 10-5 | 6 | 0.5 | 1.5 x 105 | 30 | 35 |
| TOTAL: | 755 |
The estimated risk reduction that may result from installing a third ESW pump/plant, or an ESW swing pump per 2-unit multiplant configuration, was 755 man-rem/plant when both plants are in operation. When one plant is in operation and the other plant is shut down (refueling), the estimated risk reduction from improved TS LCOs in Modes 5 and 6 was 9,700 man-rem/plant for the operating plant.
Cost Estimate
Three cost estimates were provided for this issue. The first considered the costs associated with the addition of a third pump per plant in a multiplant configuration. The estimated cost of the third pump/plant was also considered applicable to the cost of a swing pump between the 2 plants. In this second option, the cost of the swing pump can be shared between the 2 plants. This significantly lowers the per plant costs in a multiplant configuration. The third option involved modified TS on the LCOs for the ESW pumps. This analysis addressed TS LCOs on the ESW pumps in Modes 5 and 6. However, the TS for all modes of operation should be reviewed for adequacy and updated accordingly. It was also expected that Options 1 and 2 stated above might require additional TS.
Industry Cost: Based on estimates provided,960 the cost of an additional service
water pump/plant was approximately $15M, assuming an additional pump-house is not needed and that the work can be performed during a 60-day scheduled outage (no replacement power cost). The $15M/ESW pump included the following: direct cost (pump, piping, valve, and labor) estimated at $6M; indirect cost (engineering, temporary construction, and construction management) estimated to be approximately equal to the direct cost ($6M); and an additional cost ($3M) equivalent to 25% of direct and indirect costs to cover contingencies and operations and maintenance.
The industry cost to prepare the TS was estimated to be $16,000/plant961 and included 8 man-weeks of licensee technical, legal, management, and committee input.
The total estimated industry cost/plant for each of the three options were:
(1) Additional ESW Pump Plus TS = $15M (2) Additional Swing Pump = $7.5M (3) TS Modifications = $0.016MF
or Options 1 and 2, the TS costs were negligible when compared to the associated pump costs.
NRC Cost: The NRC cost included the cost to review and develop a solution(s) for the issue and the cost of reviewing plant-specific TS. The review and development of the solution(s) were estimated to require one staff-year of NRC time and approximately one man-year of contractor assistance. At a cost of $100,000/man-year, this amounted to $200,000 for all plants or $12,500/plant when distributed over at least 16 plants.
The NRC cost per plant was based on cost estimates given in NUREG/CR-4627961 and included 6 staff-weeks of technical effort and three weeks for management and legal reviews and concurrences. Based on a rate of $50/staff-hour, the NRC costs were estimated at $18,000/plant per TS change. Considering that two Federal Register notices might be required ($800), the total NRC cost was estimated to be approximately $19,000/plant. The total NRC cost, including the generic review costs distributed over the affected plants and the plant-specific TS costs, amounted to $32,000/plant. The above NRC costs were applicable to each of the three options discussed in this analysis.
Total Cost: The estimated total industry and NRC cost/plant for the above three conditions and options were approximately $15M, $7.5M, and $0.05M, respectively.
Value/Impact Assessment
Three value/impact assessments were calculated for this issue.
| (1) Additional ESW Pump/Plant: | 
|
| (2) Additional Swing Pump: | 
|
| (3) Modified TS/Modes 5, 6: | 
|
Other Considerations
(1) This issue was evaluated based on approximate generic success criteria for 2-unit configurations with 2 ESW pumps/unit and crosstie capabilities between the units. In actual plant configurations, the success criteria and shared use of ESW and other equipment are highly plant-specific. Because of various ESW pump capacities, some plants with more than 2 ESW pumps/plant might also have vulnerable ESW systems. Single unit designs should be reviewed for potential ESW vulnerabilities.
(2) Because of the large variations in ESW designs and success criteria, there are large uncertainties in a limited generic analysis such as this one. Further, a more careful analysis that includes additional sequences (valve faults, etc.) may show greater (or lesser) ESW plant-specific vulnerabilities and public risk.
(3) The possible solutions may vary from plant to plant. However, this issue identified the need to evaluate possible ESW vulnerabilities in all modes of plant operations for single and multiplant configuations.
(4) The need for requirements on crosstie operations and ESW TS in Modes 5 and 6 was identified in this evaluation as potentially significant in reducing public risk and was determined to be potentially cost-effective. In this regard, it was recommended that resolution of this issue be coordinated with the Technical Specifications Branch, DOEA/NRR.
CONCLUSION
Based on the evaluation and other considerations described above, this issue was given a high priority ranking. In resolving the issue, the staff addressed the loss of essential service water at 7 multiplant sites. The affected units have similar ESW system designs with two trains per unit: one pump per train with a crosstie between units. The issue was resolved with TS and emergency procedures
improvements issued in Generic Letter No. 91-13.1368 The staff's technical findings and regulatory analysis were published in NUREG/CR-55261408 and NUREG-1421,1409 respectively. Thus, this issue was RESOLVED and requirements were issued.1410 In an RES evaluation,1564 it was concluded that consideration of a 20-year license renewal period did not change the resolution.
REFERENCES
|
