The impact of FLEX on outage risk: Part 2 (practice)

Spent fuel pool: reducing outage risk

From NUMARC 93-03, the following safety functions must be addressed for shutdown conditions:

• Decay heat removal capability
• Inventory control
• Power availability
• Reactivity control
• Primary and secondary containment issues.

When the fuel is off-loaded from the core to the spent fuel pool during an outage, these functions are shifted from the coolant system to the pool. At Palo Verde, the RMAL requirements apply to the spent fuel pool in the following conditions: when the refuel pool and spent fuel pool are connected (the PCNV118 and SFP transfer gate are both open), such as during core off-load or reload; when the core is fully off-loaded to the spent fuel pool; or when the spent fuel pool's heat load is greater than 3.69 MW. In any of these conditions, Palo Verde requires at least N+2 success paths to be available for normal-risk activities, and N+3 success paths for high-risk activities, for the SFP RMAL to be green.

Since the spent fuel pool is one of the three focus areas of the mitigating strategies order, APS has put strategies in place to provide a redundant means of filling it if an event were to occur. Two pathways transfer water from the condensate storage tank through a portable FLEX pump. A review of this FLEX strategy found that pre- deploying the portable FLEX pump during an outage and making the connections adds redundancy to the spent fuel pool makeup system (a critical system during a refuelling outage).

The normal SFP inventory control safety function defence-in-depth is maintained by condensate transfer pumps that take suction from the condensate storage tank. Thus, if there is any work on the tank in an outage both success paths would be lost, and the plant would be in an orange RMAL. Alternatively, the core offloading would need to be delayed until the condensate storage tank work is complete, which adds outage time. Employing the FLEX pumps to draw from an alternate tank and crediting them as success paths allows Palo Verde to remain green while working on the tank without delaying core offload -- a significant benefit that is obtained at no additional cost.

In addition to the inventory function, FLEX also adds defence-in- depth to spent fuel pool cooling. At Palo Verde some classic shutdown risks -- and others related to design discrepancies -- require both spent fuel pool cooling pumps to be available during an outage. Over the past few outages Palo Verde provided temporary power to the cooling pumps to compensate for the loss of availability due to scheduled electrical bus work. Part of the planned FLEX effort will allow Palo Verde to use a portable FLEX 480V generator to "backfeed" either cooling pump, thereby maintaining the safety function. This allows electrical work to be performed during the outage, while maintaining the spent fuel pool RMALs as green, without bringing in additional temporary power.

Avoiding the use of safety-critical equipment in maintenance

The high-pressure safety injection pump at Palo Verde is a key safety component that is used to provide high-pressure coolant system makeup in the event of an accident. However, this pump is also used during an outage for normal maintenance activities such as refilling the accumulators, also known as safety injection tanks (SIT, see Figure 3, above), as well as providing high pressure for check-valve testing. The original plant design only allows the B-train safety injection pump to perform these activities, and the in-service testing data on the B pump in each unit showed greater wear than the A-train pump. Using the B pump for normal maintenance activities is something that has always been a concern of the plant operations department, so when the FLEX modifications were reviewed by operations and the outage team, several opportunities were identified.

One of the FLEX modifications is the coolant system primary makeup connection. This flow path uses the proposed connections from the existing refuelling water tank (RWT) drain valve through a portable pump connecting, via a Storz fitting, to permanently-installed piping. This ties into the safety injection piping downstream of HPSI injection valves to supply borated water to the RCS.

By adding a connection from the FLEX piping into the safety injection tank fill and drain header, and by pre-deploying the FLEX portable low-pressure/moderate-flow pump, this modification -- in conjunction with the pre-deployment of the pump -- can now be used to fill the four safety injection tanks during an outage, rather than using the HPSI B pump. The plan is depicted in Figure 4. APS is also considering using a high-pressure FLEX pump in hot standby (at the back end of the outage) as the hydro test pump (instead of the HPSI pump). Not only will these changes eliminate the need to use a safety component for normal maintenance activities, but they will also increase the outage maintenance scheduling window for the B-train HPSI pump.

Improving boration capabilities to reduce outage time

An improvement being considered is adding a portable boric acid storage tank (BAST) as a suction source for the FLEX RCS makeup pump using the primary RCS FLEX injection path. Palo Verde is designed with three positive displacement charging pumps, which are used to borate and maintain RCS inventory during the cooldown at the beginning of the outage. Because of limited flow from the pumps, the initial cooldown is limited to 70° F (21° C) per hour, although the plant technical specifications allow for 100° F per hour.

By deploying a FLEX pump at the beginning of the outage for RCS makeup, the full cooldown rate can be utilised, which will reduce the outage duration. Injecting the higher-concentration borated water from the BAST also reduces the time to reach the refuelling boron requirement of 3,000 ppm specified in core operating limits. Palo Verde has two reactor coolant pumps in service until the specified boron concentration is achieved.

With the current outage plan (charging pumps only) it takes about 19 hours to reach 3,000 ppm boron in the coolant system. In the current outage template, at 13 hours into the outage the station starts the coolant cleanup by injecting hydrogen peroxide into the system to induce a crud burst. Because the pumps are still in service, the crud from the fuel is transported throughout the coolant system and all the water in the system has to be cleaned. If the coolant could be borated to >3,000 ppm prior to the hydrogen peroxide injection, the utility could secure the pumps before injecting hydrogen peroxide and inducing an in-core crud burst, therefore limiting crud mobilisation and reducing the volume of water to be cleaned. Cleanup time is directly proportional to the volume of radioactive water and the purification flow rate, so an in-core crud burst would reduce the amount of time needed to reach the chemistry limit (0.05 microCuries/ml). That reduces dose and allows maintenance windows to open sooner. An earlier start for maintenance improves resource levelling and balancing and, in some cases, could shorten outage duration.

The BAST also provides margin to the back-end hot shutdown refuelling water tank minimum water level requirement. Currently, Palo Verde stores and transfers water from various canals and pits to meet this requirement. There have been outages where the plant was very close to having to batch the tank to achieve minimum level. This involves dissolving boric acid to make borated water in the Chemical Volume and Control System, a time-consuming task that challenges outage duration. The BAST, which is not yet designed but in theory will be about 35,000 gallons, will provide about 5% refuelling water tank margin. APS is working with Westinghouse to design a portable BAST that meets these functions.

About the authors

Mike Powell, director, Fukushima Initiatives, and Kevin Graham, manager, Work Management Outage, Palo Verde Nuclear Generating Station; Jeff Taylor, product manager, Post-Fukushima Safety Enhancements for Westinghouse Electric Company