Home > Electronic Reading Room > Document Collections > NUREG-Series Publications > Staff Reports > NUREG-0933 > ISSUE 87: FAILURE OF HPCI STEAM LINE WITHOUT ISOLATION (REV. 2)

ISSUE 87: FAILURE OF HPCI STEAM LINE WITHOUT ISOLATION (REV. 2)

DESCRIPTION

Historical Background

The HPCI steam supply line has two containment isolation valves in series: one inside and one outside of the containment. Both are normally open in most plants; however, two plants were found to operate with the HPCI outboard isolation valve normally closed. The HPCI supply valve, located adjacent to the turbine, and the turbine stop valve are normally closed. This issue addressed a postulated break in the HPCI steam supply line and the uncertainty regarding the operability of the HPCI steam supply line isolation valves under those conditions.⁸²⁴ A similar situation can occur in the RWCU system which has two normally open containment isolation valves that must remain open if the system is to function.⁸³⁰

The operation of the valves is tested periodically without steam. Due to flow limitations at the valve manufacturers' facilities, only the opening characteristics are tested under operating conditions. Therefore, the capability of the valves to close when exposed to the forces created by the flow resulting from a break downstream had not been demonstrated. However, there are reasons why the valves may operate under these accident conditions. The containment isolation valves are specified to open or close within 15 to 20 seconds. Calculations performed by Bechtel⁸²⁶ indicated that the mass flow through the HPCI steam line isolation valves reduces from 1470 lbm/sec. at the time of a break to 328 lbm/sec. after 0.135 seconds and remains constant until the valve closes.

Isolation valves are selected by the A/E for each plant. This results in a diversity of valves and valve types from plant to plant and increases the difficulty of demonstrating valve operating capability. Some plants have "Y-type" globe valves while others have gate valves. One plant using globe valves for HPCI steam supply isolation had the valve inside containment positioned such that the steam flow exerted a force on the valve skirt in the closed position. This force is expected to reduce the closing torque requirement of the valve motor-operator and increase the probability that the valve will close when a large amount of steam is flowing through the valve. Also, some valve experts believe that the force required to open gate valves under pressure is greater than the force required to close the valves under flow.

Safety Significance

In Mark I containments, the HPCI steam line exits the drywell and enters the torus compartment where it typically traverses approximately a 75 arc before exiting to the HPCI pump room. In the four corners of the reactor building along the torus compartment are four triangular-shaped rooms which house the RHR/LPCI system, the RCIC system, and the core spray system. In some reactor buildings, there is a ventilation opening or a door, usually open, between the rooms housing the emergency core cooling pumps and the torus compartment. Given an unisolated break of the HPCI steam supply line in the torus compartment, the environment in the emergency core cooling pump rooms may exceed design limits. This places in jeopardy the other systems required to cool the core.

In Mark II containments, the emergency core cooling components are typically housed in individual rooms which are contained in the large, annular-shaped area about the suppression pool. The HPCI steam supply line exits the containment and is then routed down through two floors to the room containing the HPCI turbine and pump. Again, given an unisolated break of the HPCI steam supply line, other systems which may be required to cool the core may be placed in jeopardy.

Possible Solutions

A proposed solution to the HPCI problem was to require that the outboard HPCI isolation valve be normally closed. However, a small bypass line on those plants not having this feature would be required to prevent thermal shock and water hammer and to provide assurance that leaks in the line would be detected before they become breaks. If the HPCI supply valve was kept normally open -- currently it is kept normally closed -- the probability of not getting steam to the HPCI turbine when needed might not be significantly changed.

Another possible solution that would apply to valves in any system was a demonstration by test or the verification of use in other service applications that certified the operability of the valve under line rupture flow conditions. If the normal HPCI steam flow rate approximates that estimated for a break in the steam line, the valves might be tested by individually closing them when the HPCI turbine is in operation.

PRIORITY DETERMINATION

Frequency Estimate

In the Browns Ferry 1 IREP study,³⁶⁷ the frequency of intermediate-size steam line breaks (in which size category the HPCI steam supply line is included) is 2 x 10^-4/RY. It was also assumed that a break is equally probable at any point in the steam lines of this size and category. The HPCI steam supply lines were estimated to constitute 23% of the steam lines in the intermediate-size category. Hence, the frequency of a HPCI steam supply line break was assumed to be 5 x 10^-5/RY.

The probability that both steam supply line isolation valves will fail to close was difficult to determine on a probabilistic basis because of the lack of engineering data. If one valve fails to perform its intended function because of conditions which exceed its design capability, it would be most probable that the second valve would also fail to function. As an upper bound calculation, it was assumed that the valve failure rate will be unity, given a line break, and that the dependency between valves was also unity. The lower bound was calculated by assuming that the valve design was adequate and that there were no failure dependencies between the valves. Thus, the frequency of both valves failing was obtained by taking the product of the independent failure frequency of both valves.

The major contribution to the accident scenario considered was the dependency between the unisolated steam line breaks and the low-pressure injection systems. For both the upper and lower bound calculations, it was assumed that the dependence is unity, i.e., that the low-pressure injection systems will fail, given an unisolated line break.

If, during the accident condition described, the core is maintained covered by the feedwater system, the steam mass flow generated by decay heat should lower to a point that would permit the closing of an isolation valve. One means available would be electrically closing the isolation valve inside the containment; the other means available would be manually closing one of the isolation valves. If the steam flow forces prevent the initial closure of the isolation valve, the motor control breakers will likely trip from the overcurrent condition before motor damage can occur. Furthermore, the isolation valve inside containment will not have been exposed to the steam environment from the broken line. Resetting the motor control breaker would then permit energizing the valve motor and closing the isolation valve from the control room.

The second method available was to close one of the isolation valves by manual actuation of the hand crank. This would require suiting the operator in special garments and possibly using an airpack. Due to the expected high temperature in the torus compartment, the isolation valve inside the containment would be the valve most likely closed.

NEDO-24708A⁸²⁷ analyzed an unisolatable 0.5 square-foot steam line break inside containment, which approximated a break of the 10 in.(0.55 ft²) HPCI steam line from the time of the break up to the time that the low pressure systems would begin injection (225 seconds). The analysis also included the water injected by the RCIC, but this should be minimal. The 0.5 square-foot line break model predicted that the system pressure will fall below 300 psia at approximately 210 seconds after the break occurs. The water level will still be above the core and the condensate and the condensate booster pumps can be used (for those systems having a turbine-driven feed pump) to supply feedwater to the reactor. For those feedwater systems having motor-driven feed pumps, the feedwater system can supply feedwater continuously following the reactor trip. With the feedwater system providing cooling water, the fuel will remain covered until a HPCI isolation valve is closed and the RHR system is restored to operation.

It was calculated that 12,500 gallons/hour of water at 94F will be converted to steam at 212F in absorbing the decay heat from the fuel. At this rate of consumption, a 500,000 gallon condensate tank could be emptied in 40 hours. In order to maintain adequate coolant for the extended time period, the vacuum must be restored in the condenser and the decay heat dissipated using the condenser. This will also necessitate using the auxiliary boiler to provide steam for the gland seals. Having the condensers available will reduce the steam pressure in the reactor, thus reducing the amount of steam that will be discharged through the broken HPCI steam supply line and decreasing the consumption of water from the condensate storage tank. This action will also lower the amount of heat and humidity being dumped into the torus compartment.

The probability of the loss of the feedwater during a 168-hour interval, the time assumed necessary to restore the RHR system following a HPCI steam supply line break, was calculated to be 0.03. This was based on the Browns Ferry IREP³⁶⁷ frequency of transients that result in loss of feedwater (~1.4/RY). This equated to a mean time between failure of 5,570 hours. Assuming an exponential distribution, a failure rate of 1.8 x 10^-4/hour results.

Of concern were the operator actions needed to maintain the operation of the main feedwater system. Although this is an activity with which the operator should be very familiar, detecting that the HPCI is not providing make-up inventory may not be immediate. Further, the inventory in the hotwell must be maintained by flow from the condensate storage tank. To obtain an adequate flow, it may be necessary to re-establish the vacuum in the condensers. As reported in NUREG/CR-3933,⁸²⁸ PRAs assign a probability of 0.1 for failure to recover the power conversion system in a short interval. In this accident, the time needed to make the necessary operating adjustments will not be as short as required for transients or small breaks in liquid coolant lines. In addition, approximately ¼ or ½ of the make-up water requirements will be provided by one- or two-pump operation of the CRD hydraulic system. Thus, a human error probability of 0.05 was assigned. The total probability of failing to maintain coolant inventory with the feedwater systems for 168 hours was estimated to be (0.05 + 0.03) = 0.08. Thus, the frequency estimates were:

Closing the outboard isolation valve and opening the supply valve was assumed to result in no net change in the unavailability of the HPCI and, therefore, the frequency of other accident sequences was unchanged. Closing the outboard isolation valve until the HPCI is commanded does not reduce the accident rate from breaks that occur when the HPCI is energized or go undetected prior to the HPCI being energized. With the inclusion of a bypass line to prevent thermal shock, this contribution was believed to be much smaller than the long-term exposure with the line pressurized. Hence, the remaining contribution was not considered to be significant.

The BNL estimate⁸²⁹ of the frequency of a core-melt accident due to an unisolated break outside the containment in a six-inch RWCU line was 1.4 x 10^-5/RY. The study also conservatively assumed that the conditional probability for the isolation valves failing to close, given a line break, was 1.

Consequence Estimate

A break in the HPCI steam supply line would be a LOCA outside containment. This would be closely equivalent to the PWR Event V sequence identified in WASH-1400.¹⁶

The consequences were obtained using the CRAC Code.⁶⁴ An average population of 340 persons per square mile (which is the average for U.S. domestic sites) was assumed from an exclusion area ½ mile about the reactor to a 50-mile radius about the reactor. Typical midwest site meteorology was assumed. Based on these assumptions, a release produces an exposure of 5 x 10⁶ man-rem. With upper and lower bound frequencies of 4 x 10^-6 and 4 x 10^-12 core-melt/RY, the upper and lower values of risk exposure were 20 man-rem/RY and 2 x 10^-5 man-rem/RY, respectively. Based upon an average remaining life of 24 years for 24 BWRs having a HPCI system with open isolation valves, the risk posed by this issue has an upper bound of 11,500 man-rem and a lower bound of 1.1 x 10^-2 man-rem. The consequences of the RWCU line break sequence would be 70 man-rem/RY and 40,000 man-rem total. Thus, the maximum risk reduction associated with this issue was estimated to be 51,500 man-rem.

Cost Estimate

Industry Cost: Implementation of the proposed change to leave the outboard isolation valve closed was estimated to be 2.5 man-years. This included: (1) an engineering review of the logic for HPCI initiation to assure that the valve will be commanded open and will properly isolate if required; (2) preparation of changes to procedures (normal and emergency); (3) revision to operator training covering the change; (4) revision to the FSAR; (5) license amendments; and (6) hardware changes. No added maintenance costs were anticipated. No hardware costs were included for the addition of a bypass line because it was believed that most reactors already had this feature. At an average cost of $1OO,000/man-year, the total industry cost was estimated to be $6.75M.

NRC Cost: It was estimated that 1 man-month/reactor would be required for a total cost of $210,000 for all reactors. However, there was at least one reported instance in which the isolation valve could not be opened under pressure; this occurrence was reported in AEOD/T420.⁸²⁵ If these valves would have to be modified to open under pressure, the costs would be much greater.

Performing qualification tests on a selected sample of RWCU isolation valves and actuators, and demonstrating, by analyses, that the other valves and actuator combinations will perform satisfactorily were estimated to cost $1M. If actuators have to be replaced, this would add to the costs.

Total Cost: The total industry and NRC cost associated with the possible solution was estimated to be $7.96M.

Value/Impact Assessment

Based on a potential risk reduction of 51,500 man-rem and a cost of $7.96M, the value/impact score was given by:

Other Considerations

(1) The occurrence of the analyzed event would result in the loss of one defense layer (containment). Other considerations, which in individual cases may reduce the risk associated with this issue, include the absence of ventilation openings or open doors between the torus compartment and the pump rooms. The absence of these openings reduces the common cause failure potential of the RHR/LPCI, RCIC, and core spray systems with the HPCI steam supply line break. Consideration should be given to reducing the risk if the isolation valves were selected based on the requirement to close under line break/steam mass flow conditions. This concern could be eliminated if it could be shown by test or from actual application that valve operation was verified under loads equivalent to line break conditions.

(2) A similar situation exists for the RCIC system. Since the RCIC steam line is smaller than the HPCI line, the risk may not be as great but would still add substantially to the values estimated previously.

CONCLUSION

Based on both the RWCU and HPCI event sequences and the Event V consequences, this issue was given a high priority ranking (See Appendix C). In resolving the issue, a study¹⁵⁹⁰ was made of valve assemblies in high energy BWR systems outside containment and the staff conducted a two-phase valve test program: Phase 1 was reported in NUREG/CR-5406¹⁴⁰³ and Phase 2 was reported in NUREG/CR-5558.¹⁴⁰⁴ In addition, laboratory tests of DC-powered MOVs were conducted and reported in NUREG/CR-5720.¹⁵⁸⁹

In general, it was found that many of the valves of concern in the issue did not have sufficient margin to close under the blowdown loads that would be encountered under the design basis conditions caused by a pipe break. The primary reasons for this were: (1) at the time the valves and operators were sized, the internal mechanisms and load paths of the MOVs were not well understood; and (2) the standard equation used by the industry to predict MOV stem loads did not adequately account for all of the force components resulting from the interaction of the blowdown flows on the valve internal parts.

The results of the Phase 1 test program were factored into the development of Generic Letter No. 89-10¹²¹⁷ thus providing licensees with the best guidance available at that time regarding how they should assure that their MOVs would perform their design basis function. The results of the Phase 2 test program were used in the development of Supplement 3 to Generic Letter No. 89-10¹²¹⁷ which provided licensees with further guidance. The staff also conducted training for inspectors and provided computer software to aid in identifying these problems on site. Thus, this issue was RESOLVED¹⁴⁰⁶ and requirements were issued to licensees in Generic Letter No. 89-10.¹²¹⁷ The related ACRS concern for the design basis for valves that might be subjected to significant blowdown loads was addressed in Issue 152. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not affect the resolution.