Resolution of Generic Safety Issues: Issue 201: Small-Break LOCA and Loss of Offsite Power ( NUREG-0933, Main Report with Supplements 1–35 )

DESCRIPTION

Historical Background

This issue was identified¹⁸⁸⁰ by NRR following an allegation that was submitted to the NRC in March 2006 that described a scenario in which a SBLOCA event in a PWR has progressed to the sump recirculation mode of core cooling with the ECCS aligned for high-pressure recirculation. The allegation also described the safety concern relative to "the plant response starting with this ECCS alignment, should a LOOP occur," and stated that for "some PWR designs and operating procedures, the plant response to a LOOP will cause the emergency diesel generators to start and loads to be automatically sequenced onto the emergency buses." This may cause the high-pressure ECCS pumps to be sequenced onto the emergency bus before the low-pressure pumps come onto the emergency bus - resulting in the high-pressure ECCS pumps starting with insufficient suction head, likely causing pump damage.

Safety Significance

In the event of a LOCA in a PWR, approximately 300,000 gallons of water are available in the RWST for post LOCA injection. Eventually a switchover to the recirculation mode is necessary after a LOCA as the RWST inventory is depleted. The timing of the switchover to recirculation mode depends on the size of the break, due to the flow from the centrifugal HPI pumps - increasing as the pressure decreases. For large breaks, the maximum injection pressure of the LPI pumps will be reached relatively quickly, and the HPI pumps are not needed for recirculation. The HPI pumps are needed during recirculation for small breaks. The scenario of interest is an SBLOCA event where the RWST is depleted and the ECCS is aligned in the HPI recirculation mode, approximately 4 hours into the event. At this lineup, the LPI pumps provide suction head to intermediate/or high head pumps, depending on the design. The potential safety concern is (the possibility) that if a LOOP occurs in this situation, the HPI pumps may be sequenced onto the EDG prior to the sequencing of the low head pumps. This would result in the HPI pumps being restarted with inadequate suction head, with likelihood of pump damage. It should be noted that there are potentially other scenarios, such as a transient relying upon primary system feed-and-bleed that result in conditions similar to the SBLOCA-LOOP scenario of interest.

SCREENING ANALYSIS

On detection of an SBLOCA, steam generators are used to cool the RCS. Centrifugal charging pumps are used for inventory control. Typically, HPI pumps (1500 psig discharge pressure) run with mini-flow valves to the RWST open - ensuring no damage. After a period of 2 to 4 hours, the RWST level will necessitate swap over to recirculation sump suction and allow recirculation (and closure of the HPI mini-flow valves).

If a LOOP occurs at this point, a valid recirculation signal will be present. Therefore, when the safety injection sequencer initiates after EDG breaker closing, the equipment's recirculation configuration will not change. Also, procedurally, operators are required to validate that the configuration is in its correct alignment for the plant condition (recirculation).

For most accident sequences, this issue is not expected to be a concern after about 4 hours following an SBLOCA; nevertheless, a 24-hour exposure period to account for uncertainties was used in this analysis. At this condition, the RCS temperature and pressure will be low enough to begin to transfer to long-term RHR. At this pressure and temperature (350F, 350 psig), the HPI will inject enough water so that loss of mini-flow is not a problem. Similarly, since Westinghouse sometimes uses RHR to the SI pump piggy-back alignment to supply water from the sump to the RCS, and RHR spray is initiated to control the containment environment, RHR, mini-flow is not a concern in this situation.

Millstone 3 has a sub-atmospheric containment and relies on sump recirculation early in the event. As such, it is considered a bounding plant for this risk analysis. For most U.S. PWRs, following an SBLOCA, it is possible to use steam generator cooling to bring the plant pressure and temperature to a point at which RHR can be used for decay heat removal. In other words, most plants can use RHR without going to recirculation. Thus, the hypothetical frequency of going to recirculation at Millstone 3 is higher than for other plants. Also, based on our analysis of all SPAR PWR models, Millstone 3 has the same or a higher core damage frequency for the SBLOCA event than all others. Thus, it was used in the screening analysis.

At CE plants, LPI pumps are turned off with a recirculation signal, and the HPI pumps take suction directly from the sump. At Westinghouse plants, the low pressure pumps take suction from the sump and piggy-back the flow to the RCS through a combination of high pressure and low pressure pumps. For B&W plants following a LOCA, flow is initiated in the HPI and LPI systems from the borated water storage tank (BWST) to the reactor vessel. Flow is also initiated by the reactor building spray (RBS) system to the building spray headers. When the BWST inventory is depleted, recirculation from the reactor building sump is initiated by the operator for both the LPI flow and the reactor building sprays. If elevated RCS pressure requires piggyback operation, recirculation will also occur through the HPI System.

Long-term core cooling occurs by recirculation of injection water from the reactor building sump to the core through the LPI system for large breaks, or through the LPI system and the HPI system - in series - for small breaks where primary pressure remains above the shutoff head of the LPI pumps.

Although the HPI and the LPI systems operate to provide full protection across the entire range of break sizes, each system may operate individually and is initiated independently. The HPI system prevents uncovering of the core for small coolant piping leaks where high RCS pressure is maintained and delays uncovering of the core for intermediate sized breaks. The core flooding and LPI systems are designed to recover the core at intermediate to low RCS pressures and to insure adequate core cooling for break sizes ranging from intermediate breaks to the double-ended rupture of the largest pipe. The LPI system is also designed to permit long-term core cooling in the recirculation mode after a LOCA. The LPI system and the HPI system are designed to permit the recirculation mode at various system pressures following a LOCA. This is accomplished using LPI directly to the core for the low RCS pressures that exist following a large-break LOCA. The LPI discharge provides suction to the HPI in the "piggyback" mode of operation for higher RCS pressures which may occur following a small break. Pumped injection includes both HPI and LPI, each with separate and independent flow paths. One flow path from HPI system and one flow path from LPI system and the core flooding tanks are capable of providing 100% of necessary core injection.

During an SBLOCA, if system pressure remains above the LPI shutoff head upon depletion of the BWST, the LPI suction is manually realigned to the containment sump and the discharge is aligned to the suction of the HPI pumps (piggyback operation). Operation of the HPI system continues until the system operation is manually terminated.

To assure adequate makeup capability for the full range of SBLOCAs, each HPI pump is piped to all four injection lines. Redundant flow instrumentation and throttling globe valves were added to prevent pump run-out and to allow flow balancing among these four paths. Operation of this system does not normally depend on the operation of any other engineered safeguard; however, the system can be operated in series with the LPI system, in recirculation mode.

Frequency Estimate

A screening analysis was performed for sequences that require high pressure recirculation for continued core cooling during an SBLOCA event. The LOOP occurs during or after switchover to recirculation mode. The LPI system and the HPI system are designed to permit the recirculation mode at various system pressures following a LOCA. If the LPI pump loads before the HPI pump, the LPI discharge provides suction to the HPI in "piggyback" mode for higher RCS pressures which may exist following a small break. Therefore, there will be no pump runout and the HPI will have adequate suction flow. This concern is also applicable in sequences involving "feed and bleed" and stuck-open PORVs since plant behavior is equivalent to SBLOCA-initiated sequences.

Probability of a LOOP: We are concerned if a LOOP happens during the swapover to recirculation or during the recirculation. The LOOP could happen at random and could occur several times during recirculation. This random process can be represented by a Poisson process.

The probability of having failures (LOOPs) is:

where u = (_LOOP + _Weather + _Seismic )t = _totalt = t.

The LOOP frequency was 3.59E-02/year¹⁸⁸¹ and exposure time was conservatively assumed to be 24 hours. Therefore:

Since u is much smaller than 1 and expanding the above equation using Taylor series, we get

If we ignore the small terms, we get:

Therefore, the t approximation for the occurrence probability of multiple LOOPs is equal to the exact expression.

Risk Calculation: A full train of ECCS is required for cooling during recirculation. It is conservatively assumed that at the occurrence of the LOOP the high pressure recirculation (HPR) is failed. The event trees for small LOCA and Transient are shown in figures below. We are only interested in sequences that involve recirculation, including those resulting from SBLOCA and consequential SBLOCA such as "feed and bleed" and stuck open PORVs. To determine the frequency of being in recirculation (i.e., being vulnerable to the GI-201 scenario), the probability of operator to initiate the HPR is set to one and the calculation was done using the SPAR (Standardized Plant Analysis Risk) model for Millstone 3 with a sequence cutoff frequency of 10^-12. The CDF in Table 3.210-1 is the CDF increase for failed HPR function, which is equivalent to the frequency of entering HPR.

Figures 3.201-1 and 3.201-2 show the transient and SBLOCA event trees. Other event trees referred to in Table 3.201-1 are similar to the transient (event) tree and are not included. The frequency of being in recirculation is the summation of being in recirculation during small LOCA, "feed and bleed" and stuck open PORVs modes (the scenarios are marked in the figures 1 and 2). Using the expression for the CDF - with frequency 4.1E-04 from Table 3.202-1, we get

CDF = (4.1E-04)/year * 9.8E-05 or, CDF = 4E-08/year.

This CDF is a bounding estimate of the risk associated with getting a LOOP during recirculation because:

(1) The analysis assumed all HPR pumps would start when the EDG started. This is not true if there is no SI signal present or if some HPR pumps are not designed to autostart.

(2) The EDG load sequencer may load differently for different operational modes. To ensure that we have bounded the issue, we assume that the most conservative loading pattern occurs, i.e., the loading sequence always causes all HPI pumps to fail.

(3) The analysis assumed that all HPR pumps will fail. They may survive until the LPI pumps are started and providing water.

(4) The analysis assumed that the plant was in HPR for 24 hours. The time in HPR varies for different sequences and, for the purpose of risk analysis, would always be less than 24 hours.

(5) The plant chosen for analysis has a simple AFW system and required HPR for successful mitigation of large and medium LOCAs.

(6) The plant chosen is one of the few plants that does not credit the ability to cool down and place the plant in RHR without going to recirculation.

Figure 3.201-1. SBLOCA Event Tree

Figure 3.201-2. Transient Event Tree

With a CDF this low, calculations of LERF and person-rem/RY were not warranted. If it is assumed that all CDF ended in LERF (probability that CDF causes LERF is one), the LERF value is 4E-08, which is less than the LERF threshhold value of 1E-07.

Table 3.201-1

Event Tree	Sequence	CDF with HPR function Failed	Baseline CDF	CDF
SLOCA	3	4.00E-04	2.40E-06	4.00E-04
TRANS	17	1.30E-06	7.50E-09	1.30E-06
SLOCA	5	1.10E-06	6.20E-09	1.10E-06
LOMFW	19	9.60E-07	2.00E-08	9.40E-07
LOCHS	19	8.60E-07	1.80E-08	8.40E-07
TRANS	5	5.10E-07	2.90E-09	5.00E-07
SLOCA	7	4.00E-07	2.20E-08	3.80E-07
LOMFW	18	1.90E-07	1.00E-09	1.90E-07
LOCHS	18	1.70E-07	9.10E-10	1.70E-07
LOCHS	5	6.50E-08	3.60E-10	6.50E-08
			Sum	4.05E-04

CONCLUSION

The negligible CDF increase associated with a SBLOCA and LOOP indicated that the issue did not require a technical assessment, in accordance with the guidelines of NRC Management Directive 6.4, "Generic Issues Program." Therefore, the issue was DROPPED from further pursuit.¹⁸⁸²

REFERENCES

1880. Memorandum for F. Eltawila from M. Mayfield, "Small-Break Loss-of-Coolant Accident and Loss of Offsite Power Scenario (Allegation No. NRR-2006-A-0003)," August 7, 2006. 1881. NUREG/CR-6890, "Reevaluation of Station Blackout Risk at Nuclear Power Plants," U.S. Nuclear Regulatory Commission, December 2005. 1882. Memorandum for B. Sheron from J. Monninger, "Results of Initial Screening of Generic Issue 201, 'Small-Break Loss-of-Coolant Accident with Loss of Offsite Power,'" March 28, 2007. [ML070820124]