Resolution of Generic Safety Issues: Issue 129: Valve Interlocks to Prevent Vessel Drainage During Shutdown Cooling ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
This issue was identified in a May 1986 DSI memorandum1164 in which 21 instances of BWR vessel draining through various paths in the RHR system piping were described. Later, in August 1986, AEOD/E6091165 was issued identifying six potential drain paths from the vessel to the suppression pool, liquid radioactive waste system, and voided RHR pipes. The events described involved inadvertent reactor vessel drainage through various paths in the RHR system of GE BWR-3,-4, -5 and -6 plants during the shutdown cooling (SDC) operating mode. There are approximately 30 plants of these designs in commercial operation.
Of the six potential drain paths identified in the AEOD report,1165 one "fast-drain" path connects the vessel to the suppression pool through a 20-inch diameter line when the SDC suction and suppression pool suction valves may be open at the same time. Other "slow-drain" paths can be established by misalignment of test return, minimum flow, radioactive waste, and automatic depressurization system valves.
There are several systems in place to prevent inadvertent draining. First, about half of the operating plants have valve interlocks to prevent establishment of the fast-drain path but not all have TS governing their use. Second, procedural controls are implemented at all plants to ensure that at least one valve in each potential drain path remains closed. Third, check valves are installed in the Low Pressure Coolant Injection line, the minimum flow line, and the RHR pump discharge line. Fourth, all plants have an automatic isolation system which is designed to close SDC suction isolation valves on either high flow rate in the SDC suction line or on low reactor vessel water level. Not all plant TS require that this system be active during SDC operation.
Safety Significance
Vessel draining incidents during SDC represent initiating events for sequences that can progress, by related equipment malfunctions and personnel errors, to core uncovery with the potential for subsequent core damage. Compared to accidents postulated for reactors at power, release from a plant in the SDC mode is reduced by the lower heat output and smaller radioactive inventory present in the core at shutdown. The release is increased by the possibility of open containment and the unavailability of some safety equipment due to maintenance, repair, and testing associated with the shutdown.
Possible Solution
The possible solution includes both preventive and mitigative measures. Preventive measures include installation of valve interlocks on the suppression pool suction and SDC suction valves to prevent fast-drain events. While some plants have interlocks installed, they lack TS governing their use; TS revisions would be required. The mitigative measure is a revision of all plant TS to equire that the RHR System Cooling/Head Spray Mode Isolation System be operable and active while in the SDC mode.
PRIORITY DETERMINATION
Frequency Estimate
The frequencies of event sequences leading to uncovery of the core were estimated first under a set of assumptions representing the base case, typifying the physical and logical arrangement of the current BWR (See Table 3.129-1). The frequencies of event sequences for the adjusted case were performed under a set of assumptions representing the current BWR with the proposed resolutions in place (See Table 3.129-2). The two applicable plant operating modes, Mode 4 (SDC) and Mode 5 (refueling), were considered separately.
Two types of potential draining events were evaluated. Either type of event may be terminated by operator intervention or by automatic RHR isolation.
(1) "Fast Drain" events involve valve alignments with the suppression pool suction valve and the SDC suction valve open at the same time. This alignment establishes a drain path directly from the reactor vessel to the suppression pool. It is this drain path that is addressed by the proposed valve interlocks.
(2) "Slow Drain" events involve valve misalignments in other RHR piping.
The assumptions that characterize the fast and slow event sequences for the base case and for the adjusted case are the same. Since interlocks were proposed only for valves in the fast drain path, interlock failure does not affect the slow paths.
The draining event was assumed to progress through five steps: (1) initiation; (2) valve interlock failure; (3) failure of the RHR auto-isolation to respond to high SDC flow rate or low reactor vessel water level; (4) failure of the operator to analyze the condition and take critical action; and (5) failure of the vessel makeup water systems. The frequencies of each of these steps were estimated in Tables 3.129-1 and 3.129-2. Notes pertaining to the events in both tables appear at the end of Table 3.129-2.
The change in core-melt frequency (
F) that would result from implementation of the SIR is the difference between the total base case frequency from Table 3.129-1 and the total adjusted case frequency from Table 3.129-2.
| F
| = [(1.8 x 10-8)-(2.9 x 10-10)+(2.6 x 10-8)-(1.4 x 10-10)]/RY |
| = 4.4 x 10-8/RY |
Consequence Estimate
Dose calculations were based on the BWR 4 release category which assumes enough containment leakage exists to prevent failure by overpressure. The reactor building was assumed to remain intact and concentrations of radioactive release to the atmosphere are reduced by condensation in the containment, standby gas treatment system, and release through an elevated stack. Because of the reduced thermal power level of a plant in the SDC mode and the decay of the short-lived fission products, the assumed release was estimated to be 0.1 of the BWR 4 model described in Appendix B of NUREG/CR-280064 or (0.1)(6.1 x 105) man-rem = 6.1 x 104 man-rem. Thus, the net change in whole body dose is (6.1 x 104 man-rem)(4.4 x 10-8 /RY) = 2.68 x 10-3 man-rem/RY. Assuming a remaining lifetime of 1,000 RY for operating and planned plants, the estimated public risk reduction is 2.68 man-rem.
Cost Estimate
Industry Cost: Industry costs include review and documentation of the design bases, development of interim operating procedures, system design modifications,
and TS revisions. No cost for replacement power was estimated for these modifications since it was assumed that the work can proceed during a normal outage. PNL estimated64 the total industry cost to be $1.06M.
NRC Cost: NRC costs attributable to the resolution include SIR development, inspections of the valve interlock installations, and review of the TS revisions. PNL estimated64 the total NRC cost to be $0.27M.
Total Cost: Thus, the total industry and NRC cost to implement the possible solution is $(1.06 + 0.27)M or $1.33M.
Value/Impact Assessment
Based on a potential risk reduction of 2.68 man-rem and a cost of $1.33M, the value/impact score is given by:
Other Considerations
(1) The occupational dose to install, inspect, and test the valve interlocks was estimated to be 57 man-rem. This dose is large compared to the estimated public dose averted by implementation of the SIR.
(2) INEL thermal-hydraulic analysis1166 of a postulated draining event that results in core uncovery* revealed the following findings.
* As a consequence of the BWR jet pump design, any draining event is naturally terminated with the water level in the reactor vessel at an elevation such that only the upper third of the core is uncovered.
(a) For a case where the operator fails to inject any coolant into the core, two-phase cooling of the fuel rods will maintain the cladding temperature of the hottest rods at about the boiling point of water for over an hour, with a relatively low fuel heat-up rate following dry out of the reactor vessel.
(b) For a case where a nominal flow of about 150 gpm is maintained through the CRD injection system, two-phase cooling of the fuel rods is sufficient to keep cladding temperatures at the boiling point of water for the duration of the analysis (i.e., an indefinite period of time).
The findings, therefore, suggested that the consequence value (6.1 x 104 man-rem/event) used above may be significantly overestimated and that the real potential public risk reduction for this issue may be significantly less than the low value determined above.
CONCLUSION
This issue was placed in the DROP category.
Table 3.129-1
ESTIMATED CORE-MELT FREQUENCY (BASE CASE)
| MODE 4 (SDC) FREQUENCY | MODE 5 (REFUELING) FREQUENCY | ||||
|---|---|---|---|---|---|
| EVENT | NOTE* | Fast Drain | Slow Drain | Fast Drain | Slow Drain |
| Initiator Event (event/RY) | 3 | 5.5 x 10-2 | 4.1 x 10-2 | 1.1 x 10-2 | 8.0 x 10-3 |
| Valve Interlock Failure (per demand) | 2 | 7.5 x 10-1 | 1.0 | 7.5 x 10-1 | 1.0 |
| Draining Events (per RY) | 1 | 4.1 x 10-2 | 4.1 x 10-2 | 8.0 x 10-3 | 8.0 x 10-3 |
| RHR Automatic Isolation Failure (per demand) | 4 | 3.0 x 10-2 | 3.0 x 10-2 | 3.0 x 10-2 | 3.0 x 10-2 |
| Emergency Core Cooling System Failure (per demand) | 5 | 1.0 x 10-2 | 1.0 x 10-2 | 1.0 | 1.0 |
| Operator Failure to Diagnose and Take Critical Action (per demand) | 6 | 1.0 x 10-3 | 5.0 x 10-4 | 1.0 x 10-4 | 1.0 x 10-5 |
| PRODUCT (core-melt/RY) | 7 | 1.2 x 10-8 | 6.2 x 10-9 | 2.4 x 10-8 | 2.4 x 10-9 |
| TOTAL Fast and Slow Drain FREQUENCY (core-melt/RY) | 8 | 1.8 x 10-8 | 2.6 x 10-8 | ||
* See bottom of Table 3.129-2 for explanation of Notes.
Table 3.129-2
ESTIMATED CORE-MELT FREQUENCY (ADJUSTED CASE)
| MODE 4 (SDC)FREQUENCY | MODE 5 (REFUELING)FREQUENCY | ||||
|---|---|---|---|---|---|
| EVENT | NOTE* | Fast Drain | Slow Drain | Fast Drain | Slow Drain |
| Initiator Event (event/RY) | 9 | 5.5 x 10-2 | 4.1 x 10-2 | 1.1 x 10-2 | 8.0 x 10-3 |
| Valve Interlock Failure (per demand) | 10 | 2.5 x 10-2 | 1.0 | 2.5 x 10-2 | 1.0 |
| Draining Events (event/RY) | 11 | 1.4 x 10-3 | 4.1 x 10-2 | 2.8 x 10-4 | 8.0 x 10-3 |
| RHR Automatic Isolation Failure (per demand) | 12 | 1.3 x 10-3 | 1.3 x 10-3 | 1.3 x 10-3 | 1.3 x 10-3 |
| Emergency Core Cooling System Failure (per demand) | 5 | 1.0 x 10-2 | 1.0 x 10-2 | 1.0 | 1.0 |
| Operator Failure to Diagnose and Take Critical Action (per demand) | 6 | 1.0 x 10-3 | 5.0 x 10-4 | 1.0 x 10-4 | 1.0 x 10-5 |
| PRODUCT (core-melt/RY) | 7 | 1.8 x 10-11 | 2.7 x 10-10 | 3.6 x 10-11 | 1.0 x 10-10 |
| TOTAL Fast and Slow Drain FREQUENCY (core-melt/RY) | 8 | 2.9 x 10-10 | 1.4 x 10-10 | ||
NOTES:
1. The draining event frequency is estimated in the AEOD/E6091165 by noting 11 operational events in approximately 100 RY, yielding a frequency of about 0.1/RY for all types of draining events. If it is assumed that about half of the events are fast-draining, the frequencies for the fast and slow events should each sum to 0.05/RY. Accordingly to a PNL estimate,64 approximately 1/6 of the SDC transitions are for refueling. The draining event frequencies are assumed to be distributed between Mode 4 and Mode 5 in the ratio of five to one.
2. The base case probability of valve interlock failure/demand or unavailability is taken as 0.75. This value is based on the observation that only 1/2 of the plants have the interlocks installed and only 1/2 of those have T/S governing their use; slow-drain paths are not affected by valve interlocks.
3. The frequency of draining events and the frequency of valve interlock failure are used to estimate the frequency of the initiator, which is the attempted misalignment of RHR valves. These values are used in Table 3.129-2.
4. The probability of auto-isolation failure/demand for the base case is 0.03 since it is assumed that 1 out of 30 plants does not have T/S or procedures for auto-isolation during SDC.
5. The probability of failure/demand or unavailability of the water inventory makeup in Mode 4 for both the base and the adjusted cases is assumed to be due to equipment malfunction. The value of 0.01 is assumed. In Mode 5, the ECCS is not normally available and its failure/demand probability is assigned a value of 1.
6. The probability of operator failure to diagnose the problem and take appropriate action reflects the relatively long period of time available between the initiation and estimated onset of core damage. The staff reported results1166 of a calculation of core heat transfer following a postulated fast draining event in a BWR in SDC. In one calculated case, assumed to be completely unmitigated, the peak cladding temperature did not rise appreciably above the water saturation temperature for over 60 minutes after initiation. Citing Sandia operator performance data, PNL reported64 the probability of operator failure to diagnose a problem in 30 minutes at 0.001. In the time predicted for the evolution of even a fast drain event, the probability of failure to diagnose is insignificant. The probabilities entered in Tables 3.129-1 and 3.129-2 characterize operator failure to take critical action, 10-3 for the fast drain case. The probabilities for the slow drain events are smaller because of the much greater time available to respond. The operator failure probabilities entered for the Mode 5 sequences are significantly smaller due to the larger inventory of coolant assumed to be present over the reactor.
7. Because the events constituting a core-melt sequence are assumed to be independent, the core-melt probability is calculated as the product of the sequence constituent probabilities.
8. The fast-drain and the slow-drain events are independent but not mutually exclusive. The combined probability of one or the other occurring is approximated here by adding the small probabilities for each occurring independently.
9. The initiator event frequency for the adjusted case is assumed to be the same as that calculated from the base case. (See Note 3 above.)
10. Resolution assumes interlock installation at all plants and appropriate T/S revision. Interlock failure probability for the resolved case is the sum of probability of failure of the electrical portion plus the probability of failure of the limit switch. These probabilities are estimated in the PNL report64 as follows:
| Component | Failure Probability | Source |
| Electrical | 10-3 | NRC Accident Sequence Evaluation Program |
| Limit Switch | 2.4 x 10-2 | Indian Point Review Study |
The combined probability is 2.5 x 10-2.
11. The frequency of draining events for the adjusted case is calculated as the product of the initiator frequency and the valve interlock failure frequency.
12. Failure/demand probability of the RHR isolation system in the adjusted case is taken from the PNL citation64 of the Station Blackout Study in which the actuation and control value of 1.3 x 10-3 is given. Assuming that the probability of mechanical failure is negligible, the RHR isolation failure rate is estimated to be due only to actuation and control and the 1.3 x 10-3/demand value was used.
REFERENCES
|
