Resolution of Generic Safety Issues: Issue 96: RHR Suction Valve Testing ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
This issue was identified during the staff review of the Indian Point 2 and Zion PRAs1150; in both of these studies, the dominant interfacing systems LOCA events were estimated to be through the RHR suction valves.
The significance of interfacing systems LOCA was recognized for some time, as evidenced by Item B-63, "Isolation of Low Pressure Systems Connected to the Reactor Coolant Pressure Boundary," which was resolved763 and implemented under MPA B-45. However, Issue 96 could not be integrated into Item B-63 because the resolution of Item B-63 exclusively addressed piping that leads into the primary system.
Safety Significance
The RHR system typically consists of two pumps and two heat exchangers, with associated controls and piping, and is used to bring a plant to, and maintain it in, a condition of cold shutdown. When used in this mode, the RHR suction is lined up to a primary loop hot leg and the RHR discharge to the cold legs. However, the RHR system is not a high pressure system. When the primary system pressure is high, the RHR must be isolated from the primary system. Both Zion and Indian Point 2 have a single suction path connecting the hot leg of one primary loop to a common header (also connected to the RWST and the containment sump) which feeds both RHR pumps. This path is equipped with two gate valves in series that isolate the high pressure piping from the low pressure RHR piping. Both valves are located within containment and function simultaneously as containment isolation valves and as part of the reactor coolant pressure boundary. Because there are two valves in series, this arrangement meets the single failure criterion. However, there remains a small probability of failure of both valves. This could happen either by means of a double (cascading) rupture or by the inadvertent opening of one valve and the subsequent rupture of the other. (If both valves are inadvertently left open, the primary system cannot be pressurized; in addition, interlocks will prevent inadvertent opening of either valve after the primary system is pressurized.) However, the desirability of these interlocks is the subject of Issue 99 and, in some plants, the interlocks have been removed.
If both valves fail, high pressure primary fluid will enter the low pressure RHR piping and can rupture it. Since this piping is 14 inches in diameter, the resulting LOCA can be quite large. Moreover, this same RHR system also serves as the low pressure ECCS. Ingress of high pressure fluid into the low pressure RHR suction piping will, in all likelihood, damage both pumps. Also, the coolant escaping from ruptured suction piping will create a very hostile mixed steam and water environment for which the RHR motors and electrical equipment are not qualified. In addition, even if the RHR pumps were fully operable, there would be insufficient NPSH with an opening in the suction piping common to both pumps. Finally, after completion of the primary system blowdown, it is likely that the RWST would then drain by gravity through the same suction line break and flood the entire area, unless the operator diagnoses the problem and closes a valve in the RWST line. With the primary coolant lost and both trains of the low pressure ECCS inoperable, core-melt is likely. In addition, because both RHR suction valves are postulated to be open, there is a direct open pathway from the core to an area outside of containment. The presence of the structure within which the RHR is housed and probable flooding in this area will tend to remove some escaping radioactive material, but will also cool the escaping gases and cause the plume to travel closer to the ground. In summary, failure of both RHR suction valves is not very likely, but the consequences of such a failure could be severe.
Possible Solution
The solution that was proposed for this item was to independently leak-test the two RHR suction valves after every refueling outage.1150 Pressurization of the primary system prior to heatup automatically demonstrates that at least one of the two valves is capable of holding pressure, since there is a small relief valve (of sufficient capacity to pass charging pump flow) located downstream of both suction valves. If neither valve holds pressure, the charging pumps will not be able to pressurize the system.
However, in the memorandum1150 identifying this issue, it was asserted that at least one plant did no testing beyond this automatic check. Independent valve testing would require an instrumentation tap in the piping between the valves, but would verify that both valves are capable of retaining pressure.
It should be noted that this proposed fix did not address the cascading rupture scenario. More elaborate fixes such as valve upgrading or addition of a third valve would be necessary to reduce the probability of this failure mode.
PRIORITY DETERMINATION
Frequency Estimate
Because this issue arose out of PRA studies, an unusually extensive probabilistic background is available in NUREG/CR-29341151 and NUREG/CR-3300.1152 The basic mathematical formulation is straightforward. Using the nomenclature and numerical values in Chapter 3.2.15 of NUREG/CR-2934,1151 the following parameters are defined:
| P | = the probability of a failure of a valve to close in an undetected manner |
| = 5.8 x 10-5 | |
| t | = the time between refueling outages |
| = 18 months | |
| = 13,140 hours | |
| = the valve rupture failure rate |
| = 1.2 x 10-8/hr | |
| P(v) | = the probability of an Event V sequence |
|
The first term on the right hand side of the above equation is the probability of a double rupture; the second term is the probability of a valve rupture with the other valve already failed open. A mean value of 3.4 x 10-7 for P(v) was calculated for Indian Point 2 in NUREG/CR-2934.1151 This figure was not obtained by substituting for P and in the equation; instead, the log normal distributions for P and
were used to calculate a distribution for P(v) and a mean for P(v) was then calculated. If the mean values of P and
are used, the resulting estimate of P(v) is 3.3 x 10, a full order of magnitude less than the estimated mean. This effect should be noted because first estimates are used below, but the limitations of these estimates must be borne in mind. A more complete discussion of this effect can be found in Chapter 3.2.15 of NUREG/CR-3300.
Let P1 denote the probability of an Event V in one refueling cycle due to a single rupture coupled with an earlier failure of the other valve to have closed at the beginning of the cycle. Therefore,
P1 = 2P(1 - e-t)
The failure-to-close factor P is a per-demand value. The factor within parentheses is the probability of at least one rupture event in time t, assuming a Poisson distribution. The factor of 2 comes from the possibility that either valve can fail to close while the other ruptures.
With testing every refueling outage, the probability of an Event V in any fuel cycle is given by P1, i.e., although this probability is not constant during the 18-month fuel cycle, it is repeated in the same manner every cycle. Over a 40 calendar-year license lifetime, a plant will undergo about 25 fuel cycles. Therefore, with testing, the lifetime probability (PL) of an Event V due to the failed-open-plus-rupture scenario is:
PL(with testing) = 25 P1 = 50P(1 - e-t)
Without testing to discover a failed open valve, the probability of an open valve increases with every fuel cycle. In the first cycle, the probability is P. In the second cycle, the valve has had two opportunities to fail open. The probability becomes 1 - (1 - P)2 or approximately 2P, since P«1. Using this approximation, the probability from an arithmetic progression of the first order is given by:
P(N) = 2(NP)(1 - e 1t), where N is the number of cycles.
The lifetime probability is approximated by summing the arithmetic progression.
The change in lifetime probability brought about by testing is then:
Using the mean estimates of P = 5.8 x 10-5, t = 13,140 hours, and = 1.2 x
10-8/hr, the first estimate of 
PL is 5.6 x 10 per reactor lifetime.
Consequence Estimate
In the Indian Point study,1151 the Event V sequences are associated with Release Category B. To translate this Category B into the standard assumptions of 340 people per square mile, no ingestion pathways, no credit for evacuation, and a central midwest plain meteorology, a CRAC 2 computer calculation was done specifically for this issue using the radioactive release parameters for Indian Point 2 Category B. The result was 5.2 x 106 man-rem/event. Thus, the total consequence associated with this issue is (5.6 x 10-6)(5.2 x 106) man-rem = 29 man-rem.
Cost Estimate
Industry Cost: Testing the gate valves individually should not be an expensive procedure. We estimate the cost per reactor as follows:
| Equipment | = $10,000 |
| Installation (10 man-weeks) | = $20,000 |
| Actual testing (20 man-weeks) | = $ 1,000/fuelcycle |
Over a plant lifetime that includes 25 fuel cycles, the cost/plant is $42,000, based on a 5% annual discount rate.
NRC Cost: Because the fix is straightforward, NRC costs are not expected to exceed $10,000 (about one man-month) per plant.
Total Cost: Total cost (licensee plus NRC) are thus estimated to be on the order of $52,000.
Value/Impact Assessment
Based on an estimated risk reduction of 30 man-rem/reactor and a cost of $52,000/reactor for the proposed resolution, the value/impact score is given by:
Other Considerations
(1) The above calculations were based on per-plant estimates. The identifying memorandum1150 indicated that there was one plant that did no testing. Almost certainly there are more, but the number was unknown.
(2) The above calculations were point and first estimates. Arithmetic means for these parameters may well be a factor of 10 higher.
(3) There are PWRs that have two suction paths connected to two hot legs of the primary system. These plants (if they do no testing) may be twice as vulnerable to this issue.
(4) At the time of this evaluation, the STS had provisions for testing the valves individually. Thus, this issue was likely to primarily deal with backfit situations. Unlike most issues, the risk figures for this issue will become greater as the plants age. Thus, the risk in a backfit case will be greater than one would calculate by simply scaling according to remaining lifetime.
(5) The cost figures did not include credit for averted cleanup. However, such a credit would increase the priority score by only 30%.
(6) ORE associated with valve testing was also not included. Informal estimates of the radiation field around the RHR suction valves are on the order of 200 millirem/hr. If the valve testing involves more than about 6 man-hours of labor per outage in the vicinity of these valves, the ORE could exceed the estimated averted risk to the public. Therefore, any resolution of this issue would have to address the question of ORE.
(7) The consequence estimate was calculated in terms of total whole-body man-rem. However, it should be noted that the event sequence considered was the only internally-initiated event that results in early fatalities in the Zion PRA.1150
CONCLUSION
Based on the numerical estimates and other considerations, this issue would have received a medium priority ranking. In early 1985, the staff's requirements regarding individual leak testing of reactor coolant system pressure isolation valves (PIVs) were questioned by both CRGR and the EDO.1153 A limited analysis performed at that time indicated that a requirement to individually leak-test all reactor coolant pressure boundary PIVs during refueling outage intervals might well be cost-effective. As a result, this issue and the additional concerns with the staff's leak testing requirements for PIVs were integrated into the resolution of Issue 105, "Interfacing Systems LOCA at LWRs," which was broadened to encompass both BWRs and PWRs.
REFERENCES
|
