B12024, :Response to Info Requested Re Station Blackout, Technical Review

:Response to Info Requested Re Station Blackout, Technical Review

ML20155B064
Person / Time
Site:	Millstone
Issue date:	03/31/1986
From:	NORTHEAST NUCLEAR ENERGY CO.
To:
Shared Package
ML20155B061	List: B12024, :Response to Info Requested Re Station Blackout, Technical Review ML20155B058
References
REF-GTECI-A-44, REF-GTECI-EL, TASK-A-44, TASK-OR B12024, NUDOCS 8604100197
Download: ML20155B064 (140)

Text

_ --

pocket No. 50-423 B1202{

Attachment Millstone Nuclear Power Station, Unit No 3 .

Response to Information Requested Regarding Station Blackout Technical Review

~

March,1936 8604100197 860318 PDR P ADOCK 05000423 PnR

. TAILE OF CONTERS

-Section Title Page Abstract i Table of Contents 11 1.0 IERODUCTION AND

SUMMARY

1 2.0 EVALUATION OF THE NUREG-1152 STATION AC BLACKOUT CORE MELT ASSESSME E 6 2.1 Modeling Assumptions and Physical Considerations 7 2.2 Core Melt Frequency Model 26 2.3 Reliability Data Assumptions 40 3.0 CORRECTED CALCULATION OF STATION AC BLACKOUT CORE MELT FREQUENCY 52 3.1 Revised Modeling Assumptions and Physical Considerations 53 3.2 Revised Core Melt Frequency Model 64

4.0 REFERENCES

82 MILLSTONE UNIT 3 QTATTART A f* DT A MrAl p a c creca#Pem

Appendix A H.R. Denton (NRC) letter to J.F. Opeka (with attached Regulatory Analysis)

Dated December 18, 1985.

Appendix B Millstone Unit 3 Risk Evaluation Report (Draft) NUREG-1152, Appendix B Appendix C R.J. Lutz (Westinghouse) letter to J.H. Bickel, Millstone Unit 3 Reactor Coolant Pump Seal Response to Loss of Seal Cooling, NS-RAT-SAA-86-005, dated January 10, 1986.

i Appendix D J.F. Opeka letter to H.R. Denten (NRC),

Haddam Neck Plant, Millstone Unit Nos.1,2, and 3, Effects of Hurricane Gloria, dated December 31, 1985.

Appendix E Reactor Coolant Pump Seal LOCA Leakage Rates and Probability Model (Westinghouse Proprietary Class 2), issued January 31, 1986.

This reference will be submitted under separate cover.

MILLSTONE UNrr 3 CT A TTAh! A t* Of APfrATM ACCCCCasenm

1

1.0 INTRODUCTION

A10 SUl9tARY

^

l In response to a September 21, 1981 letter from the U.S. Nuclear Regulatory Commission (NRC) Northeast Nuclear Energy Company (NNECO) submitted the Millstone Unit 3 Probabilistic Safety Study (PSS) on July 27, 1983. This study (Reference 1) contained detailed calculations of the probability and consequences of severe accident sequences including Station AC Blackout. The Station Blackout accident scenario involves a loss of Offsite Power, failure of the redundant Emergency Diesel Generators, successful operation of the steam driven Auxiliary Feedwater pump, and eventual degradation of the Reactor Coolant Pump (RCP) seals resulting in a long term loss of coolant. If AC power is not recovered (either onsite or offsite) it is not possible to provide makeup to the reactor to compensate for the loss of coolant through the RCP seals. This results in an eventual core melt, the potential for containment failure, and consequences to -

the public. The Millstone Unit 3 PSS assessed the core melt frequency of such scenarios as roughly 1.65 x 10-6/yr and as such contributed to '

only 3.6% of the total core melt frequency, less than .1% of the early fatality risk, and approximately 18.4% of the latent fatality risk.

Following submittal of the PSS, the NRC initiated an in-depth technical review and asked NNECO for further information related to Station AC Blackout, RCP seal performance, and Station Battery discharge times. The results of that review, along with NRC Staff assumptions, calculations, and results are documented in the Draft Hillstone Unit 3 Risk Evaluation Report (RER), NUREG-1152, which was provided to NNECO on October 17,1985 (Reference 2). One of the more important preliminary perceptions expressed in the Draft RER was the possibility that Station AC Blackout could be a significant contributor to risk at Millstone Unit 3.

On December 18, 1985, in order to determine whether or not the Millstone Unit 3 license should be modified, suspended, or revoked in order to reduce the apparent large contribution to risk due to Station AC Blackout, the NRC pursuant to 10CFR50.54(f) requested NNECO to l

l MILLSTONE UNIT 3 QTn TTnK1 nr Dt nrtin1W n oct'Ocut*SW

~

i fbrnish an evaluation of the NRC Staff's analysis and conclusions. '

This letter is included as Appendix A. The risk level perceived by the NRC due to Station AC Blackout at Millstone Unit 3 was in part due to assumptions made and calculations contained in the NRC Staff's Draft RER (NUREG-1152) issued in August 1985. The NUREG-1152 calculations of Station AC Blackout core melt frequency are included as Appendix B.

Because of this perceived high core melt frequency risk, the NRC Staff asked NNECO to provide an evaluation of the assumptions and new proposed calculations of Station AC Bisckout Core Melt Frequency in NUREG-1152 and suggest changes where appropriate. Additionally, NNECO j was asked to consider implementation of four potential design j backfits, which could possibly result in a significant reduction in the likelihood of core melt. The suggested options to reduce core melt likelihood were:

(1) Addition of a non-Seismic Category 1 Gas Turbine Generator (and enclosure structure) capable of powering a dedicated

• electric motor driven RCP Seal Cooling Pump.

(2) Addition of a non-Seismic Category 1 Diesel Generator (and enclosure structure) capable of powering a dedicated electric motor driven RCP Seal Cooling Pump.

(3) Increase the capability tc cope with Station AC Blackout to 8 ,

hrs by increasing the capacity of the Station Batteries, Instrument Air, and Auxiliary Feedwater supply.

, (4) Addition of a steam driven 'lurbine Generator for charging the Station Batteries, and capable of powering a dedicated electric motor driven RCP Seal Cooling Pump. .

Included along with these suggested improvements the NRC provided NNECO with their analysis of value and impact of alternatives.

MILLSTONE UNIT 3 RTSTTOh! A f' DT A/'FAf1T ACCCCCuCHP

summary .

P Upon performing the requested technical review of NUREG-1152 and considering pertinent new data, test results, and new analysis,'he t ,

following summarizes our findings:

o The analytical methods used to predict the frequency of core melt represent a more sophisticated technique in accounting for time dependent failure and restoration effects. The specific models, however, contain a number of errors related

to time-phasing in the convolution integrals.

o A significant portion of the core melt frequency predic'ted in .

NUREG-1152 is attributab.'.e to an apparent error in interpreting the frequency of loss of offsite power events of various time durations from NUREG-1032. Correction of this apparent error alone reduces the core melt frequency by almost 50%.

o The results noted in NUREG-1152 do not include a statement of the uncertainties involved, nor the fact that " conservative" point estimates were utilized in lieu of mean values and

~

uncertainties, o The NRC Staff estimate of Station AC Blackout core melt frequency (8.2 x 10-5/yr) documented in Appendix B of <

NUREG-1152 (Reference 2) was rounded upwards to 1 x 10~ /yr in Reference 3 resulting in an increase of 22%.  ;

o In terms of the current status of knowledge, the NUREG-1152 assumptions related to physical considerations are not currect " realistic" or "best estimate" values. Specific

, examples include: i i

l MILLSTONE cm.,rnu .c mUNIT o r, 3,n,- . ec ee e.,m.-

j

(1) Assuming 4 ECP seal LOCAs after thirty minutes

. without RCP seal cooling. Current experiments sponsored by the Westinghouse Owners Group and run for as long as 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> indicate this type of failure scenario is unrealistic.

(2) Assuming RCP seal leakages of 300 gpm/RCP over the long term given seal failure. This is significantly greater than current analysis and experimental data would indicato.

(3) Given a 300 gpm/RCP leak, assuming core uncovery in -

one hour. This is twice F3 fast as physically possible because it ignores the impacts of the RCP 1

seal leakage causing long term depressurization of ,

the RCS. Millstone Unit 3 plant specific best estimate analysis indicates a minimum of roughly two hours (essuming no secondary side '

depressurization).

(4) Ascuming the Station Batteries are depleted in three hourn. Use of recent Millstone Unit 3 startup test data considering actual loads and battery depletion rates indicates a minimum of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> ,

available 'oefore battery depletion.

In terms of currently available dste the assumptions in NUREG-1152 related to: RCP seal degradation rates, RCP seal leak rates, core uncovery times, Station Battery depletion tim'es, containment performance, and source terms should more correctly be identified as " highly conservative" and

" limiting worst case" values.

s o Consideration of new information derived from the wo.rk of the Westinghouse Owner's Group would have a very significant I impset on the results obtained in NUREG-1152. NNECO )

MILLSTONE UNrr 3 CTATTAnt AP Df Artroin A ccccetsenn

recenraends this improved knowledge be factored into the NRC ,

Staff's calculations.

o Because of the usage and prop 3Eatien of the " highly conservative" assumptions in the RER risk calculations, NNECO recoarrends that the results should not be coraronicated to decision makers and the public as if the values were

" realistic" or "best estimate" measures of risk parameters.

As shown in this report, if current]y available " realistic" or "best estimate" assumptions had been used in NUREG-1152, significantly different results would have been obtained, This would have lead to a conclusion that the Station AC Blackout risk at Millstone Unit 3 was significantly lower than predicted in JUREG-1152 and that no further plant specific actions are warranted p6nding full generic resolution of the Station AC Blackout Unresolved Safety Issue (USI A-44) and other related generic safety issues. '

MTIfMONE UNIT 3 CTATTAU AP Cf Af*VrTfft 8 9ercetytPr*

1 2,0 EVALUATION & MIRL1152 STATION AC BLACKWf ASSESSMart Thic section presents the results of Nortneast Utilities review of core melt frequency calculations .due to Station AC Blackout in NUE L 1152 including evaluations ef:

I o Modeling Assumptions and Physical Considerations o Core Melt Frequency Model - '

o Belisbility Data issumptions ,

In addition to this, sensitivity calculations are performed on the most sensitive parameters and revised calculations using current data and assumptions are provided.. Alternate calculations of the frequency of coro melt Guy to Station AC Bisckout which incorporate the i

technical points discussed in this section, are presented in Section 3.0. '

i 4

6 MILLSTONE UNIT 3

I l

2,1 Modeling Assu g tions and Physical CGesiderations In order to develop a model for calculating frequersy of core melt due to Station AC Blackout at M111stcne Unit 3, NUREE-1152 mckes a number -

l of simplified modeling assuroptions to take into account: ,

o the physical behavior of the Beactor Ocolant Pump (ECP) seals o the thermal hydraulic behavive of the Reactor Coolant System (RCS) in the presence of various leakage flowis o the dischar5e of the Station Batteries o the effects of different depressurization and core coolin6 strategies Table 2.1-1 suataarizes the key modeling assumptions made in NUREG-115?

and their assumed bases. Each of these key assumptions is further analyzed in the follcuing discussion.

As is noted in the table, a majority of thece essumptions a.*c " highly ,

censervative" in nature. Making cuch acsurnptichs is typical in PRa, calculations as a first cut, or vben insufficient information exists to make less bounding ossumptioris. If the conservative assumpticr.

proves to be unimportant in terms of its contribution to risk, it is probably not woPth devoting significcnt resources for ree'.cluatien.

(But the fact that it is concervative shoold be noted.) On the other '

hand, when the issue results in a perception of significant risk to the public and majcr p1' ant inodifications are thus being consid6 Ped, clcser scrutiny of each 6f these assumptions is clearly warranted.

• 4 7

MILLSTONE UNIT 3,,,.,.

, , , - , , . , , . . .~,~,.. ..

e It

Table 2.1-1 Physical Considera'tions Modeled in NUR m-1152 Model Assumption Technical Issue o 30 min. interruption in RCP seal Conservative approximation coolitig 'with RCS > 400 F results based on Parker Seal fiand-in 4 RCP seal LOCAs. book from Jan. 1977.

o RCP seal LOCAs result in 300 gpm Cor1servatively based on per RCP leak flow. maximtim leak flow assuming all seals are wide open to the full travel limits o Given 4 RCP seal LOCAs at 300 gpm Conservative calculation per RCP, core uncovers in 60 min, neglecting depressuriz-ation dye to l.0CA.

o 90 min. onsite AC power inter- 90 piin. is based on 30 min ruption within 240 min. of loss time to fail aCP seals and of offsite AC results in core 60 min core uncovery time.

melt. ,

o Operators delay cooldown for 120 No bases. 30 min. delay min after loss of offsite power. expected to be bounding with current procedures.

o RCS cooldown to less than 400 F Cooldown must be stopped requires 120 min. at 450 F to prevent N2 injection by Accumulators l

l l

8 MILLSTONE UNIT 3 l 1

i

't

} .

\\

l 'I o Station Batteries are depleted in Minimum of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 180 gin, without charging. available before battery

~

depletion o 180 min. onsite AC power inter-- Loss of Station DC results

.j ruption 240 min. efter loss of in total loss of instru-offsite power, results in core mentation. Cor6 melt is assumed.

1 melt.

I

_ _ ~-~.

- ,.,<:en -

. c O u -ap -  %

( k &

%> G

~ '

~ ~

- . , 1

'g' ) # #

f8  %

• I f

• , e j r- .,.', .

-' t N , .. *

," - es -

n' , ' s , . .

End g w *

• l

', P* *

-t,- ,a, E 9,,

O 4 4 l

%  % 9' .=

s, e

.

• t% '-[ . m#

e

~

-ps , ,

e 5

• W ,*f*' 6 t .. . . . . . ,

g - e -

e - o ,

6 o- . %w  % '~E. . f d l

l 1

l l

l 1

1 eW - i

~ - - . . .

RCP Seal Failure as a Function of Time NUREG-1152 makes a modeling assumption that given a 30 minute interruption in RCP Seal Cooling (with RCS temperatures greater than 400 F), a catestrophic type RCP seal blowout will occur. NUREG-1152 states:

"The behavior of the reactor coolant pump seals is uncertain.

The mechanism for the reactor coolant pump seal leak on loss of cooling of the seals is overheating and failing of the 0-rings (secondary seals). The basis for the estimate that the 0-rings will fail after 1/2 hour without cooling is a chart from the Parker 0-ring Handbook of January 1977. The chart is intended only as a rough guide.....

"The approximation made in the calculation of severe core damage frequency is even more rough - it is assumed that if the reactor coolant system temperature is above 400 F the '

seals will fail after 1/2 hour; below 400 F, they will not fail."

Comment:

These assumptions are equivalent to stating that, given a 30 minute interruption in RCP seal cooling with temperatures greater than 400 F, the probability of a catastrophic seal failure is: pf = 1.0. In reality the probability of catastrophic seal failure is considerably l less than one. l Reference 4 identifies 6 incidents in which operating nuclear power plant RCP seals were subjected to prolonged loss of cooling 30 minutes or longer at temperatures greater than 400 F. (This experience data base does not include the results of controlled experimental tests l which have been run for periods of as long as 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> without catastrophic failure.) Using only the limited industry experience, a crude Chi-squared approximation for the probability distribution was l

MILLSTONE UNIT 3 CTATTART A r* Of A/*FFATPf' A O Of'OOt af'am

1 l

constructed assuming zero failures in 6 prolonged loss of seal cooling i events. The results of this approximation and the NRC's point estimate are shown in Figure 2.1-1. The purpose of this figure is not to define what.is suggested as Millstone Unit 3's prompt failure distribution, but to point out how much the NRC's assumption differs from current experience. Clearly the NRC Staff's assumption that: pp = 1.0, amounts to a worst-case upper bound which is twice as large as the 95th percentile value of pp estimated from zero failures in 6 events.

As a result of the work of the Westinghouse Owner's Group, considerable new information exists regarding 0-ring performance that did not exist in January 1977. It has been recognized that there are really two issues affecting seal integrity under prolonged loss of cooling incidents:

o Early failure (possibly in the 30 minute time frame) due to improper seating of the #1 RCP seals. The probability of such a failure mode is very difficult to calculate and involves conditions in which the seal ring binds on the pump shaft and remains in a full open position despite a considerable force balance which would tend to maintain the seals in a proper orientation (Reference 5).

o Longer term leakage as a result of thermal and mechanical phenomena which may alter the leakage path profiles for RCS leakage.

Effect on Station AC Blackout Core Melt Frequency:

Elimination of the short term catestrophic RCP seal failure mechanism (or the dramatic reduction of it's probability) dramatically reduces the frequency of core melt due to Station AC Blackout.

MILLSTONE UNIT 3 R'T S T TR St An Dt A f9Fhf W A D O V O OS o f"'S FF'

1.0 - ~

9 - '

'O ~

NRC Point

• Estimate .-

1

.7 -

6 I-W

• i .6 -

Based on z Industry g Experience w

3 *5 -

E -

a: .

2

• 4 -

W A

.3 -

U 2 -

.1 -

O '

00 Q2 OA O.6 0.8 1.0 P:t PROBABILITY OF CATASTROPHIC SEAL FAILURE FIGURE 2.1-1 Probability of short term RC P seal f ailure.

12 --

RCPSealLea$: Rates A key assumption made by the NRC Staff in obtaining such short " grace times" is that the best-estinate nominal RCP seal leak rate is 300

! gpm/RCP. NUREG-1152 states:

"The magnitude of the RCP seal leak is assumed to be 300 gpm per pump..... The most recent position of the staff is that a leak of 500 gpm per pump would occur if a particular 0-ring were to fail, provided that no resistance to flow is given by the seals after failure of the 0-ring. Use of a 500 gpm leak rate would not significantly affect the results."

, Cnement:

With the current RCP seals in place at Millstone Unit 3 References 5 and 8 (Attached as Appendix C) would indicate that the nominal leakage is expected to be 21 gpm or less for the first two hours. This value and its technical bases have been discussed with the NRC Staff at a meeting held on December 17, 1985. Should subsequent failures of the secondary sealing 0-rings and channel seals occur well into the event, 4

the leakage rate could be as high as 76 gpm to 182 gpm per RCP.

A number of earlier probabilistic safety studies were performed making an ~ assumption of a 300 - 500 gpm/RCP leak flow following failure of the RCP seals. This assumption is based on simplified calculations with critical flow at full system pressure (2250 psia) and enthalpy (550 BTU /lbm) for the minimum, cold condition, nominal clearances of i

fully opened seals. As it turned out, the high temperature conditions result in mechanical loadings which change the tolerances involved for fully opened seals. In that case, calculations estimate the leakage to be 480 gpm/RCP.

Obviously this assumption is excessively conservative, but such an l assumption was made due to the lack of available test data on RCP seal i

, MILLSTONE UNIT 3 j

CT A TTAlf Ae Of A PfrAf fP A OOPOOnseem

. .. ___- _ _ , _ _ . . . . . . , . . . . . _ . . _ _ . . . , , . . . . _ - , _ _ , _ _ . . _ . . , _ . . . . _ _ . - .. . , , , . . . ~ , . _ _ _

~

performance under Station AC Blackout conditions. Because of the societal risk impact of this conservative assumption, the Westinghouse Owner's Group undertook an investigation of the response of the RCP seal system via a program of thermal hydraulic / analysis, component testing, and full scale RCP seal system testing.

Detailed thermal stress and thermal / hydraulic analyses were performed using mildly conservative assumptions for both the 8" standard and 8" cartridge seal assemblies subjected to the loss of all seal cooling.

The results of the analysis indicated that the expected RCP seal leakage during a Station AC Blackout would be ~21 gpm/RCP provided the 0-rings and channel seals do not fail. The analysis results were submitted to the NRC Staff in Reference 5. Following this submittal, the NRC Staff contracted with the Energy Technology Engineering Center (ETEC) to review the details of the analysis and perform audit type calculations. This review found that the results in Reference 3 were conservative and that a best estimate leakage rate of 19 gpm/RCP was actually expected over the long term.

• The Westinghouse Owner's Group also participated in the full scale testing of a 7" RCP seal system under the conditions representative of Station AC Blackout. This test was conducted at the Electricite de France (EdF) seal test facility in Montereau, France. The test results indicated a 20% lower flow rate than predicted by current analysis.

Design evaluations completed by Westinghouse have indicated that the 7" RCP seal system which was tested is similar in design to the 8" RCP seal system which was analyzed.

This information was made available to the NRC Staff at a meeting on December 17, 1985 (Reference 6).

l Effect on Station AC Blackout Core Melt Frequency: l Lower RCP seal leakage rates imply longer time intervals before reaching the point where the reactor core uncovers. This allows more time to recover either offsite or onsite AC power. The net effect ,

MILLSTONE UNIT 3,,,

c.m . m ., .e n, . ~ .ee-em,-.-

would be a decrease in Station AC Blackout frequency.

I 1

1 15 MILLSTONE UNIT 3 o, . , , , , ~ - . , , , , - - , , , , . .

d Secondary Depressurization Depressurizing the RCS using the steam generators will reduce the differential pressure across the seals thus reducing the RCP seal leak rates. This prolongs the time before onset of core uncovery.

NUREG-1152 makes the following assumptions regarding depressurizing the plant:

"..we assume that the react ~or operators will begin cooling down the reactor two hours after initiation of the loss of offsite power event."

Camusent:

A 30 minute assumption on operator action is more realistic. The NRC Staff assumption is not consistent with current plant Emergency Operating Procedures (EOPs) which require the operator to initiate steam generator depressurization down to 260 psig via manually dumping steam at the maximum rate. This procedure would be entered immediately after normal post trip actions and attempts to restart the diesels.

Effect on Station AC Blackout Core Melt Frequency:

Should significant RCP seal leakage occur, depressurization of the RCS using the steam generators will reduce the magnitude of the leak rates thus conserving RCS inventory. Conserving-RCS inventory prolongs the onset to core uncovery and allows more time for recovery. The net effect of this would be a large decrease in core melt frequency.

l l

16 MILLSTONE

- . . . . . . - .UNIT

. . . 3... .---- ....-

Core Uncovery Time In addition to highly conservative assumptions regarding: seal failure time, seal leakage rates, and lack of mitigating actions to conserve RCS inventory, the NRC makes additional highly conservative assumptions regarding how quickly the core uncovers. NUREG-1152 states:

"The magnitude of the RCP seal leak is assumed to be 300 gpm per pump, leading to a core uncovery time of about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the onset of the leak."

Coment:

This is two times faster than physically possible. Even assuming a 300 gpm/RCP seal leak, plant specific best-estimate analysis performed as

a part of the Millstone Unit 3 Probabilistic Safety Study indicates at least two hours being available before the onset of core uncovery.

Figure 2.1-2 shows the actual reactor vessel water level as a function of time assuming no cooldown. If the secondary plant is depressurized after one hour (References 5,6), the time until the onset of core uncovery is increased out to three hours as shown in Figure 2.1-3.

Figure 2.1-4 shows the predicted times to core uncovery at Millstone Unit 3 both with and without cooldown at 1000F/hr. Overlaid on this figure is the NRC Staff's assumed value.

Effect on Station AC Blackout Core Melt Frequency:

Increasing the time available before core uncovery provides more time to recover either onsite or offsite AC power. The net effect of increasing the time available before core uncovery is a dramatic decrease in Station AC Blackout core melt frequency.

MILLSTONE UNIT 3 emnernu ac m arvnne .cerecuen

_ 20.0

_ 17.5 -

s ___ ,

u W

_J 15.0 -

w m

3 12.5 -

s 5 ,

I a 10.0 -

us TOP OF CORE un

7. 5 -

m e .

O 5.0 -

O ~

6 a: 2. 5 -

I I I I O.O O 30 60 90 120 15 0 1

TIME (MINUTES)

I FIGURE 2.1-2. Reactor vessel mixture level- 300 gpm/RCP leakage without secondary depressurization.

t s

p 20.0 w

$ 17.5 -

• a w ._

I

$ 15.0 -

w m

3 12.5 -

~

5 d 10.0 -

TOP OF CORE

/

a

~

e $ 7.5 -

A m

o U

5.0 -

w m

2.5 -

O.O I O 60 12 0 180

, 240 TIME (MINUTES)

FIGURE 2.1 - 3 . Reactor vessel mixture level - 300 gpm/RCP I

leakage with secondary depressurization. .

20 -

16 -

\

\

12 -

t in a:

\

B \

i . \

y \ -

F

\

tr 8 -

k Millstone Unit 3 with plant g cooldown at 100*F/hr. starting cne

. W \ hourafter onset of station AC blackout

.o

\

N U

N N.

4 - N N

MillstoneUnit 3 N without plant cooldown \

, NRC staff assumed N value at 300 gpm/ pump O ' ' ' ' ' '

O 100 200 300 RCP SEAL LEAKAGE (GPM/ PUMP)

FIGURE 2.1-4. Best-estimate core uncovery time following station AC blackout with RCP seal degradation. '

l l

l l

l 20

RCS Cooldown Below 400 F 1

The NRC Staff makes an assumption that given sufficient time (even

, under Station AC Blackout conditions) the RCS can be cooled down to l below 400 F. Achieving this condition essentially defines a breakpoint between two different types of core melt scenarios. For scenarios where the cooldown below 400 F is not achieved, core melt due to RCP seal failure is postulated. In cases where the cooldown is achieved, core melt due to Station DC Blackout is considered.

Ch:

Under Station AC Blackout conditions and no capability to run the charging pumps, the cooldown is procedurally terminated at about 450 F to prevent pressurized nitrogen gas from the Accumulators being discharged into the RCS. Figure 2.1-5 shows the anticipated pressure response during a depressurization scenario following a Station AC ,

Blr.?kout. Figure 2.1-6 shows the anticipated temperature response during a depressurization scenario following a Station AC Blackout.

The NRC Staff assumption thus impacts the way in which the " grace times" were separated in the core melt frequency model, as well as the integration limits in the convolution integrals.

Effect on Station AC Blackout Core Melt Frequency:

The NRC Staff's assumption effects the way in which core melt frequency is calculated. It is difficult to project the net effect of correcting this assumption.

21 MILLSTONE UNIT 3

___ - - - . -. __. - -- . _ . - ._. - .. - = - - . ..-. . - .. .-. - . .- ..

1, j t . ,

I i

t 2500 2000 Upper head flashing begins

$ Hot leg flashing begins .I 4

w w

U W

1500 [ f

• e Cold le g flashing begins j 4

1

!'000 m

n.

1 - / . t. .

Accumulator injection l

500 -

i i

O l i I O 30 60 90 12 0 t

] TIME (MINU T ES) i i FIGURE 2.1-5. RCS pressure - 300 gpm/RCP leakage with

, secondary depressurization.

1 k

~

1 i

i I

' .k 7OO .

600 -.-

• cold leg

- tn '

Accumulator injection

- 500 - hot leg g a head a s n N 400 -

.)

w a id j

a. , i f

u, 300 1

i N 200 -

100 -

O f l l 0 30 60  % 120 TIME (MINUTES)

, FIGURE 2.1-6. RCS temperature-300 gom/RCP leakage with secondary depressurization.

• F 4

)

{*

s.

Battery Depletion Time NUREG-1152 states:

"The assumed battery depletion time of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> used in the calculations is somewhat larger than the present staff minimum estimate of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, but less than the applicant's estimate of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. (More precisely, the staff has no information to support a time greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, at present, since the applicant has not supplied this information.) Sensitivity studies are performed in which an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> battery depletion time is used. Severe core damage is assumed to occur after loss i of DC power because of loss of instrumentation and control."

Conument:

The NRC Staff's 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> battery depletion time is incorrect. It is noted in the Millstone Unit 3 FSAR (Reference 7) in the July 1984 response to Question No. Q430.44 that using conservative industry standards one will obtain a minimum 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> discharge time on each battery.

]

To obtain a realistic upper bound estimate of battery depletion time at Millstone Unit 3, special test measurements were made by NUSCO on behalf of NNECO on January 23, 1986. With the plant at hot standby conditions (DC electrical loads similar to what would exist during Station AC Blackout) measurements were made of the DC current drain to support all switchboard distribution loads. This load was increased by a 1.50 multiplier to conservatively account for momentary cyclic loads and possible future loads. The inverter load on the batteries was determined via measuring the AC load and converting this to the equivalent DC load with a 1.25 multiplier applied for conservatism.

The acceptance criterion for battery depletion time was based on supplying minimum voltages to operate equipment at the end of the MILLSTONE UNrr 3 CTATTAnt A f' Of A/'VAf fT A C CCC Cl8ClfP

.... - - . _, - _~ _ . , .

~

discharge period. The initial capacity of the batteries was additionally degraded to end of life conditions, wherein only 80% of rated capacity is available upon start of the discharge. Based on test measurements using these criteria the existing 1650 Amphour batteries, if subjected to a Station AC Blackout service profile, would have ample capacity to supply sufficient DC power for at least 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

This would be true over the life of the batteries. This data equates to an 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> worst case battery depletion time or 95% value. (No battery capacity conservation measures are assumed.)

To obtain a best estimate battery depletion time, the conservative multipliers on the switchboard and inverter DC loads were removed and battery conser.vation efforts (initiated at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> into the Station AC Blackout) were considered. The scope of battery conservation measures considered include: stripping of unnecessary DC loads, renoving the inverters from the train batteries and running the inverters on the two channel batteries. A number of possible scenarios were considered which lead to a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> best estimate value for battery depletion time.

Effect on Station AC Blackout Core Melt Frequency:

Using the NRC Staff's core melt frequency model, elimination of the NRC Staff's 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> Station Battery depletion time assumption results in a 13% reduction in the Station AC Blackout core melt frequency. If a corrected core melt frequency model were used an even larger reduction in predicted core melt frequency would be obtained.

l MILLSTONE UNIT 3 CTATTAnt AP Of A Ff/Af fP A cet

____'O esst*DPP_ _ _ _ _ _ _ _

A 2.2 Core Melt Frequency Model NUREG-1152 developed a core melt frequency model based on a number of physical considerations (some of which are felt to be unduly conservative) to describe the processes involved in a postulated core melt due to Station AC Blackout. The core melt frequency model is based on time dependent reliability calculations which in general are more sophisticated than those used in the Millstone Unit 3 PSS. The core melt frequency model is comprised of five terms which describe five particular scenarios or cases. These are:

Case (a) At time of loss of offsite power, each of the diesels is unavailable either because of random failures, common cause failures, or combinations of maintenance unavailabilities and random failures. Recovery of AC power (from either onsite or offsite sources) occurs after core melt.

Case (b) At the time of loss of offsite power, one diesel is unavailable due to maintenance and the redundant diesel starts but fails to run. Recovery of AC power occurs after core melt.

Case (c) At the time of loss of offsite power, one diesel fails to start, the other diesel starts but fails to run.

Recovery of AC power occurs after core melt.

Case (d) At the time of loss of offsite power, both diesels start but fail to run due to common cause failure. Recovery of AC power occurs after core melt.

Case (e) At the time of loss of offsite power, both diesels start but both fail to run as a result of random failures.

Recovery of AC power occurs after core melt.

This section provides comments on the way in which the core melt 26 MILLSTONE UNIT 3 nn . , ,, . . .....n. . - - - - . . - . -

o frequency model was constructed and what changes should be made to .

l yield a more realistic core melt frequency evaluation. l r

n 2 .'

27 MILLSTONE UNIT

. . . . . . . . . . . 3. . .--- ..-.

. i Case (c)

This case involves a loss of offsite power and unavailability of both diesels due to random failures to start, common cause failures to I start, and combinations of maintenance unavailability in one diesel and random failure in the other diesel. A time line diagram of the NRC Staff's postulated failure scenario is shown in Figure 2.2-1 along with all assumptions used in the model.

The sequence probability for this case was quantified by the NRC Staff using the following equation.

Pd*An (9f-Sc ) f(#1 + 9cc 0 (#1 }3 n(#1 4

+24Q(#)90(7)q,Q,(7) n 1 ff 3 3 Comments:

The point estimate calculation scheme employed in this equation treats the " grace time" ( T$ ) as a fixed system-related parameter which is estimated using unduly pessimistic assumptions. As noted in Section 2.1, the " grace time" is more Neurately characterized as a random variable which is dependent on:

o whether or not early RCP seal failure occurred, o the time at which secondary depressurization is initiated, o the initial leakage rate through the RCP seals.

The above noted model fails to account for this.

The second portion of the probability equation makes an implicit assumption that the maintenance unavailability of one of the diesels is initiated concurrent with the loss of offsite power and the failure to start event in the other diesel. This does not seem realistic. A more realistic scenario would involve the initiation of a maintenance 1

28 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMEfff

. ~_ - - - . .

b 0 0 0 0 0 0 i

8 I 8 8 ,

8 8 I 8

4 4 4 4 4 4 0 0 0 0 ,

0 I 0

I 2 I 2 2 y 2 2 2 4 4 4 4 4 4 0 0 0 0 0 0 e

6 I 6 6 ,

6 ,

6 I 6

3 3 3 3 3 3 )

(

a e

s w a

c 2

0 0 0 0 0 0 5 i

0 I 0 0 ,

0 ,

0 I 0 1 1

3 3 3 3 3 3 -

)

S G E E T R U U NI N M

(

r 0 0 0 0 0 0 o 4 4 ,

4 4 E f i I 4 4 , I M

2 2 2 2 2 2 e n IT i n

l w

o e d

/f f f lo i m

o '

o o T c

y 0 o['

y 0

y 0 0 o 0 0 se [4 r

v 8

1 r

e v

I 8

1

'vo r

e 8 1

8 1

t e

81 I 8

1 1

ore c o c[/ c n 2

ser w e

'r e i e

2 o/

p l r T E

l

'ai iaA lab R e/ 'it U t

nt dl e/

r n e l

G

/ i 0 e s 0 'e s 0 0 g, 0 0 I t

e s 1 2 t e I 2 t e 2 2i I 2 I 2 F f

/ oi[

'P d oi 1 1 1 1 1 1

/bfo' i P d I

[j . ' .

l l iI l  ! l i l I l 0 I 0 0 , 0 , 0 I 0 6 6 6 6 6 6

' ~-

t-O I l t O l g O'l l ,

Oi ,

Ol 4 hours) that the RCS is cooled down below 400 F. As discussed in Section 2.1, this asstaption is not credible.

There is again an unstated assumption in this equation that the maintenance unavailability of one of the diesels starts at the same time that the loss of offsite power event occurs. This does not appear ,

to be realistic. A more likely scenario would be one where the loss of offsite power event occurred somewhere in the middle of a diesel maintenance unavailability. If the maintenance outage of the diesel started before the loss of offsite power, such an outage would end earlier and therebye reduce the duration of the Station AC Blackout.

31 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

. - _ . - .-. _ . . - . _ - _ _ - . .. - . - ~. . - - - . . . .

4 I ,, , ,

O f f site ,

l Potential recovery of Power Availability l /offsite power [

l I [! [ l / I _ l 1 's I

f l ago

' O 60 120 180 240 000 360 420 Diesel A t- '- - - -

Availability Maintenance gunavailability I'otential, recovery of ,

I I / / I I O 60 l 120 180 240 300 360 420 480

, Diesel B N - - ' - -

Diese start Diesel fails

" "' O '

Availability ,

\ \ i \ l / / g l l y 0 60 120 180 240 300 360 420 480 l

! l l Operators ,

U I Initiate Cooldown  !, .

l ,0 60 120 180 240 300 3GO 420 480 I

d f '

I I l

RCS temp. l Time to cooldown ,

I  !

Below 400*F , , , , , , , ,

I 120 240 300 360 420 agO O 60 18 0 I l .

Core melt * '

l l t I l l t i I _ l l O 60 I 120 10 0 240 300 360 420 480 l TIME (MINU TES) i FIGURE 2.2-2. Time line for NUREG-1152 case (b)

(short terin scenario)

_ -y-

AE aln, as noted with Case (a), the " grace time" should be treated as a random variable 'rather than a conservatively estimated fixed parameter. The revised equation should , read as follows:

• • +=

Pd*Um A**P(-A*)0C#)S(*+7}A'*P(~bD)0(*-D+7)d*dD f f f n n o t Effect on Station AC Blackout Core Melt Frequercy:

Treating the " grace time" as a random variable and Vorrecting the time-phasing of the maintenance will both result in a reduction in core melt frequency.

i P

I B

t 9

L 33 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

~ -

Case (3)

This case involves a loss of offsite power in which one diesel fails to start, ar)d the other diesel fails to run. Restoration of any of the emergency power sources is delayed to beycnd the time of core celt onset. A time line diagram of this failure scenario is shown in Figure 2.2-3 along with key assumptions made by the NRC Staff.

W.

Pd

• b9f f( 7 ) Af " E(~Af "} f(* # } n( * # )dw 1 1 1 e

W.

+Q(7) p 2 A eXPC-A f W)Q p p(W+72 )0 n (* 72)dw]

We Ceauments:

The split integration limits on the convolution integrals are based on an incorrect assumption related to the ability to cool down below 400 F under Station AC Blackout conditions.

The " grace time" should be treated as a random variable rather than a conservatively estimated fixed parameter.

The revised equation should read as follows:

+ao Pd=2gqfp(7)Q A exp(-x f w)Q 7 (w+r)Q p n("+7)d" o

Effect on Station AC Blackout Core Melt Frequency:

Treating the " grace time" as a random variable results ,in a reduction in predicted core melt frequency.

s 34 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

' -  : i 0 'loAg c O o 0 5 e 1 E i g i 3 4 se 4 a 4 0 ,

0 0 , 0 0 e 2 2 2 2 I

2 4 1, 1 4 4 4- 4 i

0 0 0 O 0 0 6 9 6 g 6 ,

G i 6 i 6

3 3 3 3 3 3

[ _ )

(

c e

0 / 0 s 0 0 0 0 a 0 l 0 g 0 ,

0 f 0 i 0

C ,

3 f 3 , 3 3 3 3

[ o f

,o -

f o

)

S 2

5 y y E n!

1 r r T 1

-) ,

e e U Go v v ,e i

,o ,c o v N Er

,c -

s o R a ee 0 e c 0 0 IM U n 0 ,re 0 0 ( i -

rwo 4 2

., r f 4 4 ,

4 I 4 2

i 4 t e c

,lap l 2 l 2 2 n

2 E rs i

a / ,a M o e ,i t w I f m

,t nt

,e n ,en o T er

,t e s i t /

/ d l i net o

of o l P o P / o er t

c no 0 0 0 0 o 0 0 i r h 8

1 8

1 8

1 8

1 t

I 8

1

> 1 8 T (s e

m .

s i

3 <

l T -

la 2 f

• 2 C e 0 l

e 0 0 0 r 2 s 2 0 E 2 I l 2  ;} i 2 1 2 R I 1 lu 1 e 1 1 1 1 ,

i U -

i a D G f I F

ll g J t l I I I ' i' l 4 I l r

a -

t s \

0 I 0 i t O g 0 t 0 1 0 6 l e 6 r C 6 5 6 a \ 4 s t i

e s .

D \le s

i e -

QD O O O I , I ,

0I I i O1 1 O .

t y y y s p i t t t r n n w o ewo i i e

l i Ai i

l 5i i l

t

' n t rb l b l b at ad l " e is e a e a e a

• f f

OPA wia ov l

i sl e a i

V s

e a iv DA i

l rim et pi OiCn C

R S

C r

o DA d

i Ii t , l' ' l

1 1

j Case (d) I l

l This case involves a loss of offsite power followed by the failure of both diesels to run as a result of comon mode failure. The time line diagram for this scenario is shown in Figure 2.2-4. The sequence l probability for this case is quantified by the following equation:

W.

Pd

• Anc 0 (#1 } c'*P(~Ac w)eXP(-2 A 1 w)Q n (**1)d" e

w,

+ A 0 (# ) A eXPC-A w)exp(-2Ag w)Q I*# 2)dw nc 2 c e n W.

Comments:

The cplit integration limits on the convolution integrals are based on an incorrect assumption related to the ability to cool down below 400 F under Station AC Blackout conditions.

The " grace time" should be treated as a random variable rather than a ccnservatively estimated fixed parameter.

The term: exp(-2A w) 3 appears to be incorrect. The corrected equation should read as follows:

+ 00 Pd*An I c"*P(~A c"}E c(# E (w+7)dw n

a EfTect on F,tation AC Blackout Core Melt Frequency:

Treating the " grace time" as a random variable results in a reduction in pre:!icted core melt frequency.

36 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

I O f f site l ,, , , $

Power l Potential recovery of l Availability I ofIsile power [

l I [! [ l / I l l 3 l

0 60 120 180 240 300 360 420 480 l

Diesel A ' N N N Common cause "- ' - -

Olesel starts - f ailure to run P tential recovery of Availability p

, N N ,W ,

=

/r;'t , / , , ,

O 60 l 12 0 180 240 300 360 420 480 Diesel B \ N N N Common cause pagential recovery of Availability Diesel staris } (ailure to run f

\ \,\ l / f  ! l l -g ,

O 60 120 180 240 300 360 420 460 l l Operators ,

b initiate I 1 Cooldown , , l  ; y , , , ,

O 60  ! 120 180 360 240 300 4'20 430 I

RCS temp. l Time to cooldown

• I  !

Below 400 F , , , , g , , ,

I O 60 12 0 18 0 240 300 360 420 4go

(

i l 4 T' 6 Core rnelt g

] l l l _ s I I i _ l 0 60 l '120 18 0 240 30Ci 360 420 480 TIME (MIMU TES)

FIGURE 2.2-4. Time line for NUREG-1152 Case (d)

(!,!crt term scenario)

_ _ _ _ _ _ _ _ _ . _ _ _.___m _ _ _ _ _ _ _ _ _ . _ _ _ _ _ - _ _ -_--w _ .- m w -- _ t' M N e g _

l

, Case (c)

This case involves a loss of offsite power followed by the failure of both diesels to run as a result of random failures. The time line diagram for this scenario is shown in Figure 2.2-5. The sequence

' probability for this case is quantified by the. following equation:

We w -

Pd = 2A n (Of (71 ) A fexPC-Af W)Q n (*71 ) A exP(-A l x)Q f (w-x+r )dxdw g g

. o w, W

+ Qf (rp ) A exp(-A f

W)Qn (* #2 f AlexPC-Af x)Qi(W-k+T2)dxdw]

o o Commsents:

The split integration limits on the convolution integrals are based on an incorrect assumption related to the ability to cool down below 400 F under Station AC Blackout conditions.

The " grace time" should be treated as a random variable rather than a conservatively estimated fixed parameter.

The corrected equation should read as follows:

mm Pd = 2An Af exPC-A f x)Q f

(t-x+7)Qn (x+r)A p exp(-Af t)Qf (r)dtdx o x Effect on Station AC Blackout Core Melt Frequency:

Treating the " grace time" as a random variable results in a reduction in predicted core melt frequency.

38 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

O f f sit e -< - / '

Power l P tential recovery of Availa bility l f site power O 60 120 180 240 300

, 360 420 480

• ' ^ \

Availa bility Diesel starts ' Diesel f ails to Potential rec'overy of q l run

/// i /[

-+ diesel A l \i s i 1 I t i O 60 1 120 180 240 300 360 420 480 -

Diesel B N -- ' - '

Availability Diese start en al rec very of Diesel f ails to

\ s, s t a

1. • • 7' "/[ -/ , , , u O 60 120 180 240 300 360 420 480 I I Operators g

,, initiat e I

• I Cooldown , ,  ! , , , , ,

O 60 120 180 240 300 360 420 l I 480 l

I RCS ternp. l Time to cooldown I

Below 400*F , ,

, , g , ,

I O 60 120 18 0 240 300 360 420 4go

, i l Core melt l 4 '

I I l l l l l 1 i O 60 l 120 18 0 240 300 360 420 480 TIME (MINU TES)

FIGURE 2.2-5. Time line for NUREG-1152 Case (e)

(short term scenario) 1

2.3 Reliability Data Assu ptions .

This section provides comments on the relisbility data assumptions used in NUREG-1152 and which play a major part in the perceived high core melt frequency risk due to Station AC Blackout at Millstone Unit

3. In general, a majority of the point estimate values used for key parameters in the calculations found in NUROG-115? constitute upper bound estimates which exceed currently known 90th percentile confidence bounds. Specific examples include:

o Frequency of Loss of Offsite Power o Diesel Failure to Start Probabilities o Diesel Failure Rates to Run Given Start o Diesel Common Cause Failure to Start Probabilities o Diesel Maintenance Unavailabilities To understand the impact of these individual terms, simple sensitivity studies are performed using the existing NRC Staff models for core melt frequency.

l l

l 40 MILLSTONE UNIT 3 l STATION 3C BLACKOUT ASSESSMENT

Frequ mcy of Offgite Power Loss .

NUREG-1152 in Appendix B stat,es:

"The frequencies An n(t) of losses of offsite power exceeding t hours were taken from Figure 14 of the final draft of NUREG-1032. (This figure applies specifically to Millstone Unit 3.) This draft gives a range of values (called "Model Range"); the values of this appendix were chosen in .the midpoint of' this range. The table of values as used in this appendix are given in Table 1. Beyond 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> (the cutoff value for the table in NUREG-1032), a constant value of

.004/yr was assumed, fornn A O (t), until 24 hrs."

Cr==mt:

A detailed review of NUREG-1032 indicates that the actual values used by the NRC Staff in NUREG-1152 are not the midpoint values of the ,

"Model Range" as stated. To the contrary, the values used are ioughly factors of x2 greater than the midpoint values and are in fact greater than the upper confidence bound limits in the model. Figure 2.3-1 shows the values actually used in the NRC Staff's calculations overlayed on the "Model Range" which should have been used.

Effect on Station AC Blackout Core Melt Frequency:

i The AnnQ (t) term is coanon in all five equations used in NUREG-1152 to calculate the 8.2 x 10-5/yr core melt frequency estimate. Elimination of the factor of x2 overconservatism in the NRC Staff's calculations results in an overal reduction of the core melt frequency due to Station AC Blackout by 505 yielding roughly 4.1 x 10-5/yr.

l 41 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

Table 1 AnnualFrequenciesAfn(t)

Q f L sses f Offsite Power Exceeding t Hours at Millstone Unit 3 (Taken from NUREG-1152) t (hrs) Ann O (D} (Y# )

1.0 038 1.5 .029 2.0 .025 2.5 .021 3.0 .018 3.5 .015

, 4.0 .013 4.5 .012 5.0 .011 5.5 .010 6.0 .009 6.5 .008 7.0 .008 7.5 .007 8.0 .007 8.5 .006 9.0 .006 9.5 .005 11.5 .005 i 12.0 .004  !

24.0 .004

, l 42 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

~

~ .

a l

i o.os '

O.04 -

)

E NRC Staf f E Assumptions

( O.03 - in NUREG-1152 i

/

U z

g Millstone l 0 3 PRA N O.02 -

tL e o

m 4,

% Ag %

'N h o.o1 -

s w2.

Q% .

Model *"

Range '.-  ?

O.00 ' ' i 1.0 2.0 3.0 4.0 5.0 DURATION (Hrs.)

FIGURE 2.3 - 1 iIstimated frequency of losses of offsite power exceeding specified durations for Millstone 3 (Taken from NUREG- 1032 Figure A.12) 43

__ - _ _ _. . ___ . _ _ . . _ . . . . _ . . _ _ _ . . . - _ _ ~ _ - . .

6 Diesel Unavailability on Demand NUREG-1152 assumes a diesel unavailability on demand of 47 = 3 x 10-2/ demand based on NUREG/CR-2728.

Comment:

Based on Northeast Utilities operating experience, the value chosen by the fmC Staff is unrealistically conservative and is not a best estimate of diesel unavailability on demand. Detailed reliability analyses already performed for the diesels of two of our operating nuclear power plants are shown in Figure 2.3-2. (This data for the Millstone Unit 1 diesel has already been audited and reviewed by the NRC Staff and their consultants as a part of the ISAP.) Also shown on this figure is the NRC Staff's suggested value which is a point estimate without uncertainties. It is unlikely that the future diesel experience at Millstone Unit 3 will be significantly different from the Connecticut Yankee (Haddam Neck) and Millstone Unit 1 experience. '

Diesel generator reliability experience from the Millstone Unit 1 and Connecticut Yankee (Haddam Neck) diesels is summarized below and is compared to the NRC Staff's estimate.

Data Source Mean q p Var q p NUREG/CR-2728 3.0 x 10-2 _

Millstone Unit 1 PSS 6.7 x 10-3 9.6 x 10-6 Connecticut Yankee PSS 5.4 x 10-3 7.7 x 10-6 Our experience indicates that the q values used in NUREG-1152 are too r

large by a factor of x5 to x6. l Effect on Station AC Blackout Core Melt Frequency:

The qp term is common to probability calculations for cases (a) and (c). Case (a) involves failures of both diesels to start,due to random 1

MILLST0hE UNIT 3 QTATTAlf A t* Of ArmfrAt w n e e fac es sf* t m

0 2

0 g 1 x

_ t

_ 3 it ne oa Pm .

C .it Rs l

tE s

e

_ - Y i

it T l ib I

LI a

_ _ D b A o 2 D r p I 0 OR 1

_ - _ 2 x P dn D a Nm A ed

_ E M W n

D o N er

_ - O u l

E ia R f U

- _ LI A

l e

s F e i

L d E f e S o n1 2 E o t I t

s n i

R 0 D no 1

_ l iU l x i s

1 r

M

(

ap m

_ - C o _

2 4

3 _

2 t -

u E c

it ee R U

ck e

n n a I

G F

nY o

_ C 9 8 7 6 5 4 3 2 1 c t2sj3II3U u

z o I U z o u. z O s o @ c > 9 _

>sn

l l

failures, common cause failures, and failures of one diesel while the j second diesel is in maintenance. Case (c) involves failure of one diesel to start in conjunction with the other diesel failing to run. l Use of the more realistic best-estimate values in .the equations results in a dramatic reduction in predicted core melt frequency due to Station AC Blackout of roughly 50%. In conjunction with the effects of using the correct frequency for loss of offsite power, this change has the result of reducing Station AC Llackout core melt frequency down to roughly 1.7 x 10-5/yr.

I

)

l MILLSTONE UNrr 3 CT A TTAnf AF Dt A rt/Atw A ccreenst*Sim

Diesel Failure to Run Given Successfbl Start NUREG-1152 assumes a diesel failu' r e rate to continue running given successfbl start of f = 3.0 x 10-3/hr based on NUREG/CR-2815, Table C .1.

Coment:

The referenced Table C.1 of NUREG/CR-2815 under item C.3 " Shortcomings of' the Data Table" clearly states:

"In all likelihood, modifications of this table (C.1) will be necessary from time to time, .... because of new insights gained from operational experience.."

Based on Northeast Utilities operating experience, a value of p = 3.0 x 10-3/hr (as a best-estimate for the Millstone Unit 3 diesel) is excessively conservative. Detailed reliability analyses already '

performed for the diesels of two of our operating nuclear power plants are shown in Figure 2.3-3. (The data for the Millstone Unit 1 diesel has already been audited by the NRC Staff and their consultants as a part of the ISAP.) Also shown overlayed on this figure is the URC Staff's suggested value. It is highly unlikely that the future Millstone Unit 3 diesel experience will be significantly different from the Connecticut Yankee (Haddam Neck Plant) and Millstone Unit 1 experience.

Diesel generator reliability experience for the Millstone Unit 1 and Connecticut Yankee (Haddam Neck Plant) diesels is sumarized below.

Data Source Mean p Var p NUREG/CR-2815 3.0 x 10-3/hr --

Millstone Unit 1 PSS 1.1 x 10-3/hr 1.1 x 10 1.4 x 10 4

Connecticut Yankee PSS 1.3 x 10-3/hr MILLSTONE UNIT 3 CTftTTAhi A f* Df A /*PAf fP ACCCCensrt@

- - - - - _ - _ _ . ___ - _ _ _ . - - . = . ._-

1.0 -

.9 -

.8 -

Mills t one

,! z NRC Point Unit 1 O .7 -

%" Estimate %

W

• 2

• 6 - m Connecticut g Yankee P

S .5 - - - -

is b

k co O A -

td .

j .3 -

3 I

I a .2 -

U

.1

! I I 1x103 2x163 3x1d3

{

DIESEL FAILURE R ATE (PER HOUR) GIVEN STAR T i

j FIGUllE 2.3 -3. Comparison of . diesel failure rates given start 4

m

lcrga by a fcctor of roughly x2.5. .

Effect on Station'AC Blackout Core Melt Frequency:

The Af term is common to probability calculations for Cases (b), (c),

and (e). Case (b) involves one diesel being in maintenance and the redundant diesel failing to run given successful start. Case (c) involves one diesel failing to run after the other diesel failed to start. Case (e) involves failures of both diesels to run due to either random or cc knon cause failures.

In conjunction with the corrections previously noted, use of more realistic best-estimate values for A inf the equations results in a reduction of predicted core melt frequency down to roughly 1.2 x 10-5/yr.

i i

I l

l 1

' 49 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

Diesel Common Cause Failure to Start Probability NUREG-1152 assumes a diesel common cause failure to start probability of q = 1.1 x 10-3 on demand.

c Comment:

This is unrealistic 1y high. Even using common cause failure rates conservatively derived using LER data, data sources such as NUREG/CR-2099 would yield: q = 2.6 x 10 . The NUREG-1152 value is a c

factor of x4.2 larger than the NRC's published data would suggest.

Effect on Station AC Blackout Core Melt Frequency:

The qc term appears only in Case (a). Case (a), however is the largest of the five cases and qc related terms will tend to dominate over qp regardless of which values are used. Correcting this value will also reduce the predicted Station AC Blackout core melt frequency. '

MILLSTONE UNIT 3 CTATT/Ut A f' DT A t*f/Af fP Accrectarem

p

.n Diesel Maintenanca Unavillability NUREG-1152 assumes a diesel maintenance unavailability of q, = 6 x 10-3 on demand based on NUREG/CR-2989.

Comment:

Based on Northeast Utilities operating experience, a value of q, = 6 x I

10-3 (as a best-estimate for the Millstone Unit 3 diesel) appears conservative. A detailed analysis of the maintenance records for one of our operating nuclear plants over a fifteen year time period has shcwn m q = 1.07 x 10-3. (This data has already been audited by the NRC Staff and their consultants as a part of the ISAP.) The NRC assumed '

value is x5.6 larger. It is highly unlikely that the future Millstone Unit 3 diesel experience will be significantly different.

Effect on Station AC Blackout Core Melt Frequency:

The diesel maintenance term is comon to Cases (a) and (b). As noted in the previous section the NRC Staff's calculations make an assumption that a maintenance outage on one of the diesels is initiated concurrently with the loss of offsite power event.

Correction of this error and the use of a more realistic maintenance frequency will also reduce Station AC Blackout core melt frequency.

I i

+

0 51 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

3.0 CORRECTED CAIIULATION OF STATION AC BLACK 0UT CORE MELT FREQUENCY l .

Section 2.0 of this report NNECO provides technical comments on the NRC Staff's assumptions, models, and calculations of Station AC Blackout core melt frequency at Millstone Unit 3. The purpose of this i section is to provide a corrected Station AC Blackout core melt frequency calculation which reflects the previous comments. In doing this a time dependent framework similar to that developed in the NRC Staff's proposed model has been used. A key difference with the NRC Staff's approach and that inherent in this report relates to our use of a Monte Carlo numerical simulation of the actual best estimate values and uncertainties vs. the use of worst limiting case values. I In performing this revised analysis an attempt has been made to be responsive to other Station AC Blackout related issues which were not explicitly considered in the NRC Staff's calculations. These issues were identified as possible sources for modeling uncertainties in H.R.

Denton's letter (Reference 3) which could possibly increase the core '

melt frequency due to Station AC Blackout, and include:

o The effects of including Hurricane Gloria in the loss of offsite power initieting event data base.

o The effects of including the long restoration time from Hurricane Gloria in the loss of offsite power restoration time data base.

o The effects of concurrent loss of HVAC on critical equipment as a result of the Station AC Blackout scenario.

I MILLSTONE UNrr 3 CTATTAU A f' Df A r*VAf1P S COCOORTEPP

3.1 Revised Modaling Assumptions and Physical Considerations The revised Station AC Blackout core melt frequency model provided in this report is based on a number of improved and in some cases updated medeling assumptions. Section 3.1 discusses the technical bases for use of more realistic considerations in the following areas:

o frequency of loss of offsite power at the Millstone site o restoration times for offsite power o impacts of consequential loss of HVAC on critical equipment o recovery time limitations due to RCP scal leakage o recovery time limitations due to Station Battery voltages.

i The following section uses these assumptions to yield an updated ,

, Station AC Blackout core melt frequency.

a i

l l

1 53 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT i 1

l

_ e Frequency cf Iass of Offsite Power et the Millstone Sita The Millstone Unit 3 PSS (Reference 1, p.1.1-29), issued in August 1983, calculated a mean Millstone site loss of offsite power frequency of 1.1 x 10-I/yr using Bayesian statistics with a prior distribution obtained from industry loss of offsite power experience. This was updated with 13 years of Millstone site experience during which time there was one loss of offsite power event, during Hurricane Belle in 1976.

The Millstone Unit 1 PSS (Reference 9, p.1.2-8), issued in July 1985, calculated a mean Millstone site loss of offsite power event frequency of 1.24 x 10-l/yr. This revised Bayesian statistics calculation was based on exclusively northeastern regional experience obtained from Northeast Power Coordinating Council (NPCC) data. This prior data was updated with 14 years of Millstone site experience again with only the Hurricane Belle event. The slight increase in frequency is a result of using more regional statistics and a slightly larger plant experience ,

data base.

An updated estimate of the site specific loss of offsite power frequency can be obtained via performing a Bayesian statistical calculation using NPCC regional data updated with 15 years of Millstone site experience in which there were two events: Hurricane Belle in 1976 and Hurricane Gloria in 1985. The nature of the Gamma

< distributed prior distribution is discussed in Reference 9. The results of the Bayesian update are as follows: ,

A = 1.45 x 10-l/yr.

Var A = 3.92 x 10-3/yr.2 The results are similarly assumed to be Gamma distributed.

I 54 MILLSTONE UNIT 3 STATION AC BLt.CKOUT ASSESSMEhT

Offsite Power Restoration Times Et the Millstone Site The distributions of offsite power recovery times used in the Millstone Unit 3 PSS (Reference 1) were based on very limited data available at the time that the atudy was performed. Despite this, it compares reasonably well with analogous data contained in NUREG-1032 (Reference 10, p. A-39). The key differences are related to an assumption that some finite probability for non-restoration exists for very long time frames.

The issue of offsite power restoration times was reevaluated in the Millstone Unit 1 PSS (Reference 9, p.2A-5) which was issued in July 1985. The Millstone Unit i PSS developed a cumulative distribution for restoration times for nuclear plant sites in the NPCC region based on NSAC data contained in Reference 11. This cumulative distribution included only the effects of Hurricane Belle in 1976.

To evaluate the impacts of Hurricane Gloria on the assumed mean restoration time an evaluation was performed of what time period would be required to restore offsite power to Millstone Unit 3 had emergency conditions existed at the time. Reference 12 (attached as Appendix D) documented the fact that although offsite power was not promptly recovered at the Millstone site - it could have been had conditions warranted. Reference 12 did not address Millstone Unit 3 power recovery because the unit was not operational and had no fuel in the reactor. na evaluation has since been performed to determine what the 1

restoration time at Millstone Unit 3 could have been had it been necessary.

i Figure 3.1-1 shows a simplified One Line Diagram of the Millstone site switchyard. It is important to recognize that throughout the Hurricane Gloria power outage the 345kV grid was available. The same is true of Hurricane Belle in 1976. To reconnect Millstone Unit 3 to the offsite power grid it would be necessary to perform the following actions:

o Washdown all conducting surfaces between breakers 13T and 55 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMEVi i

MILLSTOflE 15G L4 L3 L2 L1 R Devices controlled by cot 4 VEX 348 310 371 383

• Devices contiolled by plant and CONVEX h h, hy hy A Devices cohtrolled by plant -

(except IOT & 18T-4) BUS A m FUTURE U R.R.

l 13 T 1[] A 10T-4 * []7T y{}4T $ {}1T

. 14 T

• ()  % ()BT $ []ST A []2T iST A 18 T-4

% {} $ {}9T  :(: []6T W []3T l _

BUS B 8:

7 7 1 4 E 7

Ah 5 AM 3N ^ o\ 5 AMis ^}ydi oh sI ab 15 AclN Y O M N . S u ta aJJ ut a.> LA u) ax aJJ aJu aas en em crm erm em n, e,c, r, r, erm rem A RSST *2 RSST*1 RSST ' 3 h3u h2u giu FIGURE 1 3.11. Millstone Switchyard I e

15T. (It is not necessary to washdown the main North-South bus ducts. The washdown of these bus ducts under non-emergency conditiens is one of the prime causes for the duration of the Millstone site switchyard outage.)

o Washdown conducting surfaces associated with the Millstone Unit 3 Main Generator Stepup Transformers and 345kV takeoff structures.

o Open breakers 13T and 15T. This isolates the potentially salt coated bus ducts and insulators which could result in ground faults.

o Close the main disconnect between the Millstone switchyard and 345kV line #348.

o Re-energize 345kV line #348 from the remote end of the line.

o Assure the Main Generator Breaker on the Millstona Unit 3 generator is open and the disconne'et switches en the Main Generator Stepup Transformers are closed. '

o Close breaker 14T thus powering the Millstone Unit 3 auxiliaries via backfeeding through the Generator Stepup '

Transformer.

An evaluation performed of these steps by NUSCO, on behalf of NNECO, has lead to a conclusion that the entire restoration could have been accomplished in roughly a two hour time period from the time started.

Based on weather conditions experienced at the time, it is estimated that such restoration could have been initiated (had conditions warranted) in 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the initial loss of offsite power. This 1

results in an overall estimate of 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to restore offsite power to the Millstone Unit 3 auxiliaries.

, This additional data point was used to update the cumulative k

MILLSTONE m .,. m . , ,, UNIT 3, e, . -,- . ~ ~>-.

distribution of recovery times used in Reference 9. As would be expected, inclusion of the 3.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> data point for Hurricane Gloria causes an increase in the predicted mean restoration time. Using this cumulative distribution for recovery, a cumulative distribution for failure to recover offsite power Q n(t) was then developed.

To facilitate closed form evaluation of the convolution integrals in the Station AC Blackcut core melt frequency model, this cumulative distribution function was fitted to a linear sum of two exponential terms:

Qg(t) = A exp(-at) + B exp(-bt)

-where: A = 0.4 a = 0.297 B s 0.6 b = 4,6 The first term of this expression is asymptotic to the long term restoration trend, where25 the second term (which drops off quickly)

• describes the short term restoration effects. Our review of this distribution function shows that it is conservative for short restoration tires (higher non-recovery probabilities are predicted),

provides a reasonably accurate best-estimate result for recovery times in the 1.0 to 5,0 range, and becomes conservative for restoration times greater than 5.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />.

1 l

i I

.)

I al MILLST0fE UNIT 3 l j

Ishacts of Consequential Ioss of HVAC on Critical Components A physical consideration not explicitly considered in the NRC Staff's Station AC Blackout core melt frequency model is the potential impact of consequential loss of HVAC to systems used to assure decay heat removal and control of the resetor when the AC power is restored. In Reference 3 the NRC noted:

"Some areas with associated uncertainty appear to lead to higher core damage frequency and risk estimates:

Loss of room cooling (which itself can cause st' ation blackout) is not included in the station blackout core damage frequency or risk results. We performed a scoping analysis which estimated the potential mean core damage frequency contribution from room cooling to be greater than 1 x 10-N per year. The analysis did not consider operator recovery and assumed that switchgear failed if room cooling was lost for two hours. These may be very conservative assumptions."

This issue has been given additional consideration in NUSCO's, on behalf of NNECO, reevaluation. In the context of Station AC Blackout, loss of HVAC (and associated room cooling) would potentially impact two areas of the plant:

o Loss of room cooling in the steam driven auxiliary feedwater pump compartment might impact the long term operability of i the auxiliary feedwater system.

o Loss of room cooling in the switchgear room might impact the i

availability of the Vital AC buses used to control and monitor plant conditions, i

Both of these consequential failures have been evaluated. 1 1

1 MILLSTONE UNIT 3

. .~

~ -

Loss of HVAC Tmpact on Auriliary Feedwater Availability f

Following a Station AC Blackout, the availability of the steam driven auxiliary feedwater is critical in preventing severe core damage. If the steam driven auxiliary feedwater pump should fail, the loss of decay heat removal from the RCS would cause repressurization of the ,

RCS to the point that the pressurizer PORVs would open. This would result in a long term loss of coolant inventory without the capability to provide makeup.

Upon careful review of the design basis of the steam driven auxiliary feedwater pump, it was determined that the existing equipment is actually designed to operate under conditions of a long term sustained Staticn AC Blackout. Amendment 13 to the Millstone Unit 3 FSAR (Reference 7) notes that a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> sustained 1620 F room temperature environment was used to bound the Maximum Abnormal Excursion (MAE) and ,

states:

i "The transient Maximum Abnormal Excursion is based on the '

requirement to have the turbine-driven auxiliary feedwater pump operative through a complete loss of all AC power."

Based on this it may be concluded that the loss of room cooling which is a direct consequence of a Station AC Blackout, will not result in loss of the steam driven auxiliary feedwater pump. The impact of this on the Station AC Blackout core melt frequency models is that auxiliary feedwater flow availability does not have to enter into considerations of the " grace time" available before the onset of severe core damage.

Loss of HVAC Tmpact on Critical Components in the Switchgear Room 60 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMEllT

^

Following a complete loss of Station AC, all' AC pcwer related heat

~

loads in the switchgear rooms at Millstone Unit 3 are e1iminated and the flow of cool air drops off as the blower units c' cast down. The only remaining heat loads would be the heat rejected by the inverter units which convert DC power from the Station batteries to 120V AC for use in the Vital AC dependent systems. If the inverters (which will continue to run as long as DC power remains available from the batteries) reject sufficient heat to the switchgear rooms, the internal air temperature could increase to levels where the inverters could fail. Failure of an inverter will result in the loss of all associated 120V Vital AC loads. The key loads powered by the 120V Vital AC buses are the control board instruments which will be necessary to control the plant until Station AC is restored. Examples include: steam generator water level and pressure, RCS temperature and pressure, RCS subcooling, and the RVLMS.

T To evaluate room heatup a multinode computer model was develcped which considered the heat loss from the inverters as a heat source, and a considered the massive concrete walls and ceilings as passive heat sinks. Best estic: ate calculations were performed along with a number of sensitivity calculations using worst li"11 ting case values.

l The inverter units at Millstone Unit 3 are 25kVA units manufactured by Elgar Controls of San Diego and are 80% efficient. The heat load from such an inverter under Station AC Blackout conditions would be 13,658 STU/hr. Internal cooling for the inverter units is provided by 5 self-powered fans each rated at 560 cfm. Accounting for backpressure I

due to the tortuous air flow path and the intake air filters, the net cooling air flow would be roughly 800 cfm. The exhaust air from the inverter cabinet is directed toward the switchgear (on the 4'- 6" l level) via a drip hood. Current test data indicate that the units can run for at least 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> in a 122 F0environment which corresponds to a 134 F internal temperature.

The results of the switchgear room heatup calculations are shown in Figure 3.1-2. As noted, it takes 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> just to heat the room up to MILLSTONE UNIT 3 CTPTTAli AF DT A Ft/Af PP A ccC'cesst*te

- h 5

11 0 -

t 100 -

9 .

BULK ggy 90 -

CELLING suppg(

1 80 w

• n-3 m

" k \ ., INSfDE e COnCREgg e

70 z

w i n 60 -

SO ' ' ' - ' '

o 2 4 6

' ' =

8 10 12

~

14 16 TIME (HOURS)

FIGURE 3.1 - 2 . Switchgear room heatup during station AC blackout 4

. J

100 F. In view of this it is cppar:;nt t. hat the NRC Staff's calculations indicating 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to fail switchgear room components are based on unrealisticly conservative assumptions. The length of time required to fail the inverters due to lors of room cooling is thus evaluated a6 being so long that it does .not represent any real consideration in the Station AC Ela:kout issue (i.e., other issues would tend to dominate).

P h

t

+

\

l i

i l

63 l MILLSTONE UNIT 3 STATION AC BLACK 0iTf ASSES"> MENT

_m .

_- - J

l 3.2 Revised Core Melt Frequency Model Section 2.2 of this report identified a number of shortcomings in the NRC Staff's proposed model of Station AC Blackout core melt frequency.

The purpose of this section is to document the corrected model developed by NUSCO which addresses all of our previous findings, includingt o Elimination of the time-phasing error related to the starting of a maintenance action simultaneous with a loss of offsite power. This is done via replacing q, with A m eXp(-\t).

o Treatment of the " grace time" as a' random variable rather than a worst limiting case upper bound point estimate.

o Elimination of the split integration limits in the convolution integralc.

o Incorporation of an updated offsite power non-recovery distribution fbnetion (updated to reflect Hurricane Gloria).

To develcp the corrected core melt frequency model the convolutien integrals were all evaluated ir4 tlosed fcrm. The clo::ed form solutions were then evaluated with specific parataeters usin6 Monte Carlo rand a sau:pling techniques. The closed form expressions for the five cases '

are discussed as follows. .

d

- 64 KIU. STONE UNIT 3 i

STATION AC BLACK 0tif ASSESSMENT .

1

-l

.l Case (c) l l

The equation is evaluated as follows:

l l

P d* O(

n 9f f +90(

cc O(

n n

+ eo .

+ 2A,qp A n **E(~A n nt)Q (# f( y+ dt i o

= [q7exp(-2ar) + g gexp(-pr)][A exp(-ar) + B exp(-b7)]

+2 qf[An/(An+ a)]exp(-2ar)[A exp(-ar) + B exp(-b7)]  ;

t

/ t

} 65

~~

MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT i .. -. .. .

Case (b) j The equation is evaluated as follows:

==

A P

d* mj AeXPC-Ax)Q(7)((x+7)AexP(-At)Q(x-t+7)dxdt f p p n n n I

i

= 2[A,An f (^f + An + )]{A[exp(-(2a + a)T)]/[ Ap+a+a]

, B[exp(-(20'+ b)T)]/[Ap + a + b)])

A

~t  %

ct 66

, MILLSTONE UNIT 3 q STATION AC BLACKOUT ASSESSMENT

Case (c)

The equation is evaluated as follows:

4

+ oe Pd = 2Anff 9 9 (7) A exp(-A w)Q f f (w+T)Q f (w+T)dw o l 1

l l

I

= 2gAp qfexp(-2ar) {A[exp(-ar)]/[Ap+a+a]

+ B[exp(-b7)]/[Ap + a + b]}

i 2

4

-67 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMBTT

a l

Case (d) , l The equation is evaluated as follows:

too Pd*A n AcexP(-Ac " c(7 O (w+7)dw n

i 4

= ggexp(-gr){A[exp(-ar)]/[Ac + a] + B[exp(-br)]/[Ac + b]}

i i

?

9

' 68

^

l '

MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT'

1 1

Case (e) i The equation is evaluated as follows*

cm w Pd = 2An exP(-Ap x)Qp (t-x+7)Qn (*+ f exPC-A r t)Qp (T)dtdx ox 2

= 24[ Ap exp(-2ar)/(a + Af )]{A[exp(-a7)]/[2Ap + a]

i 1

6 4

+ B[exp(-b7)]/[2Ap + b]}

t s

1 i

I 69 i

MILLSTONE UNIT 3 STATION AC BLACK 0UT ASSESSMENT l _ _.

. . _ _ . ~ . . _ . . _ _ .  : . . - _ . . . . . -. _

Detemination cf Realistic Station AC Blackout " Grace Time?

There are two competing effects which determine the " grace time" during a Station AC Blackout event:

o Rate of degradation of the RCP sealing system o Rate of depletion of the Station Batteries.

Appendix E (Proprietary) developed based on the results of the Westinghouse Owner's Group work on RCP seal integrity defines the best estimate distribution of core uncovery times for the existing

, Millstone Unit 3 RCP seals. This distribution flanction is shown in Figure 3.2-1.

The distribution times for battery depletion were constructed based on available test data that indicates 95% confidence of providing sufficient DC power for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, and a 50% confidence of providing ,

sufficient DC power for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. For very short time intervals the random failure probability of 3.3 x 10-5 was used. The resultant distribution function for DC power availability is shown in Figure 3.2-2.

A composite discrete probability distribution (DPD), representing both DC power and RCP seal integrity related " grace time", was then generated using the following formula:

P(71 ) = PRCP(#)1 + PDC(#)1 - PRCP(#) iPDC ( #1 )

70 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

~ .

1.0 - e

_ l 8 -

. 1 l

6 _

g

_ _ _ - - __1 1

4 -

1 I

I

---l l

2 -

1 I

I

.1 .

l e .

l e _ l

_ i 4 _

I I

i l

l FIGURE 121.

PROBABILITY DISTRIBUTION FOR - -

2 _

l MILLSTONE UNIT 3 CORE UNCOVERY TIME DURING STATION AC BLACKOUT l

l 1

.01 .

_ l e .

l 6 .

I l I l l

d _ i l

i I

l l Without S/G 2 . cepressucitation 1

- - - - With S/G cepressurization I i i

l

.001 ' I ' ' ' ' '

O 4 8 12 16 20 24 CORE UNCOVERY TIME (HOURS) 71

l

1.0 .

8 .

6 4 -

2 .

3 8 _

6 .

4 ,

2 FIGURE 32-2 .

PROBABILITY DISTRIBUTION FOR

.01 -

MILLSTONE UNIT 3 BATTERY DEPLETION DURING STATION AC 8 -

BLACKOUT 6 .

- 4 1

2 \

4 01 ' ' ' ' '

O 4 8 12  % 20 - 24 EATTERY DEPLETION TNE (HOURS) -

72

The resultant discrete probability distribution of " grace times" (in hours) is as follows:

i f P(r,)

1.5 4.3 x 10-5 4.0 5.0 x 10-2 5.5 2.9 x 10~1 8.0 6.2 x 10~1 12.0 9.7 x 10~1 15.0 1.0 x 10-0 Using this distribution a mean " grace time" of 8.78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> was obtained using DPD arithmetic. Final calculations of Station AC Blackout core melt frequency use Monte Carlo sampling from the above DPD.

4 i

i i

s s

l 73 MILLSTONE UNIT 3 STATION AC BLACK 0lTr ASSESSMENT

Data Used in the Core Melt Frequency Model The reevaluation of the Station AC Blackout core melt frequency uses the following values:

I2rm Mean Value Variance Distribution Data Source 1.45x10-l/yr 3.92x10-3 Gamma MP-1 PSS n

Updated for Hurricane Gloria qp 6.7x10-3 9.6x10 " Beta MP-1 PSS q

c 2.59x10-4 9.0x10-9 Gamma NUREG/CR-2099 7

1.1xiO-3/hr 1.1x10-6 g,,,, gp_3 p33 i

c 9.0x10-5/hr 8.1x10-9 Gamma NUREG-1152 m

5.25x10-5/hr 2.76x10-9 Gamma MP-1 PSS The non-restoration distributions are given by the following expressions:

Offsite Power: Qn (t) = A exp(-at) + B exp(-bt)

A = 0.4 a = 0.25Tl B = 0.6 b = 4.6 I

Emergency Diesel: Q f (t) = exp(-t/15) (based on NUREG-1152)

Diesel Maintenance:Q,(t) = exp(-t/15) (based on NUREG-1152)

Common Cause: Q (t) = exp(-t/10) (based on NUREG-1152) l MILLSTONE UNIT 3

Results The overall Station AC Blackout core melt frequency was calculated using Monte Carlo simulation techniques with a sample size of 30,000 via the SPASM Code. The results of the Monte Carlo calculations are shown in Figures 3.2-3 through 3.2-8 and are suninarized below.

Case:

( A) 50

. . (A) 93 Case (a) 5.64x10-7 8.94x10-7 2.79x10-6 Case (b) 4.63x10-9 1.19x10-8 4.79x10-8 Case (c) 6.07x10-0 1.05x10-7 3.46x10-7

! Case (d) 5.83x10-7 9.49x10-7 3.08x10-6 i

Case (e) 1.52x10-7 5.63x10-7 2.44x10-6 TOTAL 1.91x10 2.52x10-6 6.65x10-6 i

75 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMENT

. -. , - , , - ,-, , -- - , ,,a.-, - . . . - -

2 -

FIGURE 3.2 -3 MILLSTONE UNIT 3 STATION K BLACKOUT e CASE (A) CORE MELT FREQUENCY MONTE 9 CARLO SIMULATION (3OOOO SAMPLES) x 5 U 1 a

b 1 O

>- 1 t -

e - -.-

4 b

m - . RESULTS: ~

"- = 5.64 x 10 /yr

%,gg = 2.n x to*/yr Y

t o ' ' MUUUM""" " '- '

O 1 2 3 4 5 l'

-6

% X 10. (PER YEAR) ,

i l

f 4 -

4 i'

i 3 FIGURE 3.2-4  ;

ao MILLSTONE UNIT 3 STATION AC BLACKOUT CASE (B) g CORE MELT FREQUENCY MONTE CARLO SIMULATION x

w (30000 SAMPLES U b 2

8

>- 2 s

E -

O a

Q.

RESULTS:

g _ K,g = 4.63x15 /yr A,95 : 4. 9x1 yr I

' ' ^""""** " " ' ~ "' " " ' '

O O 1 2 3 4 5 6 7 8 9 10 .

A X 10-8 (PER YEAR)

P 2 - -

4 FIGURE 3.2 - 5 MILLSTONE UNIT 3 STATION AC BLACKOU T CASE (C) CORE MELT FREQUENCY MONTE ,

CARLO SIMULATION (30000 SAMPLES) o 9

X

$ $Z d 1

. C

_J _

i5 m 1 8

J

• RESULTS:

~L A.50 : 6.07x 168 /yr 7

K.95 = 34 6x 16 /yr i

I " " " " "

O A X10-7 (PER YE AR)

_ _ _ _ _ -+ - - - - - - - - - - - - -

l

' )j)

1. 1

)

(

D E ,

S A

C

. 5 T

U O

KO CL AR ,

L A ,

BC C ET) -

A NS N OEL OI M P .

4 T M A

TCY A ,

SN S E0 m 3U0 Q0 n TEO I

N R3 n

)

R 6- U F( n A TN E 2 EL O n Y 3 NEI T n 3 .

OMAL R E T n E R SE U L R U r y r n P

(

G IL O y i FI MCSIM 51

/

6 /

0 i b1 1

x x X 2 8 8

5 0

3 h

=

S

0 .

2 5 p T -

L h U'

t S

E R I 1

. 1 r

U L

O 2 1 O

$ x > r!8 > bJ m<)d Sa.

U l l llIi l

i

)

. EN EI O

(

ST AA C UL '5 TI M

. U S O

KO CL AR LA BC K. TE N NO '

4 OI T

M "

AY T

S CN E "

3 U)

T QS I EE "

7 NR L

- UF P )

M "

R 2 ETA 3 N LS A

E O E 3 Y E

R S TM00 R .

E U L RE00 r " P G IL O3 y (

I F MC( /b 51 O i 6

0 1

x x " x 2 4 "

5 4 1 2 A

: = '

2 S

T g s, U

L A, g " -

S E

R 1

k O 0

1 9 8 7 6 5 4 3 2 i O OE bo " x D@ o :U o

c

1 4.8 -

t 4 -

. - }

~

FIGURE 3.2 -8 1

~ MILLSTONE UNIT 3 STATION AC BLACKOUT

)

l CORE MELT FREQUENCY MONTE CARLO SIMULATION (30000 SAMPLES) 3 -

nn a

9 I

= x il h h

{;; 2 -

z -

i td O

a >- r

' >- LJ 3 RE SULT S

• ai lf 6 /yr l < 150 : 1.91x1 m }

j g  : -

_r h9s = 6 65

• dvr i

g . . . . . . n.n -

0 1 2 3 4 5 6 7 8 9 10 h X10 (PER YEAR) i_- _

l REFEREEES

1. Millstone Unit 3 Probabilistic Safety Study, W. G. Counsil letter 4 l

to H. R. Denton, July 27, 1983.  ;

2. Millstone Unit 3 Risk Evaluation Report (Draft), NUREG-1152, U. S.

Nuclear Regulatory Commission, October 17, 1985.

3. H.R. Denton (NRC) letter to J.F. Opeka, December 18, 1985.

, 4. Reactor Coolant Pump Seal Performance, Westinghouse Electric Corporation, April 1983

5. Reactor Coolant Pump Seal Performance Following a Loss of All AC Power, WCAP-10541, Westinghouse Owner's Group Report, April 1984.

6. Handouts from the Westinghouse Owner's Group RCP Seal Integrity Meeting with the Nuclear Regulatory Commission Staff, December 17, 1985.

7. Millstone Unit 3 Final Safety Analysis Report.

8. R.J. Lutz (Westinghouse) letter to J.H. Bickel, January 10, 1986.

9. Millstone Unit 1 Probabilistic Safety Study, NUSCO-147, Northeast Utilities, July 1985, J. F. Opeka letter to J. A. Zwolinski, July 21, 1985.

10. Evaluation of Station Blackout Accidents at Nuclear Power Plants, NUREG-1032, U.S. Nuclear Regulatory Comission, May 1985.

11. Losses of Off-Site Power at U.S. Nuclear Power Plants - All Years Through 1984, NSAC-85, April 1985.

12. J.F. Opeka letter to H.R. Denton, Haddam Neck Plant, Millstone Nuclear Power Station, Unit Nos.1,2, and 3 - Effects of Hurricane MILLSTONE UNrr 3,~-

c.- , - m . , .-n,.~ -----,,-.-

e

Gloria, December 31, 1985.

I l

l MILLSTONE m"nu ar n, . UfET

,,, 3,n,- , , , , , , , , , , , ,

APPENDIX A

(

MILLST0!E UIET 3 STATION AC BLACV,0VI ASSESSMENT

DEC.18 '85 11 35 P.001

[ g UNITED STATES y, I NUCLEAR REGULATORY COMMIS$10N me.emoron, p. c.sesas s

% ,,, , .; DEC 181985 Docket No.: 50-42 RECElVED Mr. John Opeka Senior Vice President NE r e t lities SENIOR VCE PREUDEM Nuclear Engirteering & Opersse,n Hartford, Connecticut 05141

Dear Mr. Opeka:

In September 1981 the Director of the Office of Nuclear Reactor Regulttion, U.S. Nuclear Regulatory Commission (NRC}-requested that Northe.sst Utilities (NU) perfom density site. aIndesign-specific risk study for Millstone 3, a high population August 1983 NU submitted the Millstone 3 Probahtlistic Safety Study (PSS) which estimated the core damage frequency and risk from internal and external events. The NRC staff has recently completed its review of the PSS in the fom of a draft risk evaluation report (RER) sub.

mitted to NU for coment on October 17, 1985. The staff's review of your '

report considered current understanding of pump behavior and diesel generator availability and led to identification of station blackout (loss of all off-site and onsite frequency fromAC power) internal as the most dominant contributor to core damage events.

Concern for station blackout has been further hich11ghted by the recent loss of offsite power event caused by Hurricane Gloria. The staff review considered four measures, two of which would result in significant wduction in the likelihood of core melt. A discussion of these measures and the supporting cost benefit analyses are proviced in the enclosure.

Accordingly, in order to detemine whether or not the Millstone 3 license shculd be modified, suspended, or revoked in order to reduce the apparant large cencribution tc risk due to station black out, pursuant to 10 CFR .

50.54(f), you are recuested to furnish under oath or affimation, in writing no later than 30 days from the date of this letter, your evaluction re-garding the staff's analysis and conclusions.

Sincerely..

/ k Harold R. Denton, Director Offf ce cf Nuclear Reactor Regulation

Enclosure:

Regulatory Analysis for Redu: tion of Station Blackout Core Damage Frequency at Millstono 3 '

cc. See next page

--, . .,,- .--- ,.--, ,n,-., ,-n, .-,- - - -

r-.. -

DEC.18 '25 11:3c P.002'  :

ENCLOSURE 1 Reguln ory Analysis; Reduction of Station Blackout Core Damage Frguency At Millstone 3 Statement of Problem The tem station blackout" refers to the complete loss of alternating current (AC) electric power to 'he essential and nonessential buses in a nu: lear power plant. Station blackout therefore involves the loss of '

offtite power concurrent with the failure of the onsite emergency At power system. Because many safety systems required for reactor core decay heat ret. oval e.nd containment heat removal are dependent on AC power, the consequences of station blackout could be severe.

The staff in its review of the Millstone 3 Probabilistic Safety Study (PSS) finds that the Millstone 3 emergen:y power system, while meeting all our regulatory requirements, has a near minimum design. There are two emergency

diesel generators at Millstone 3 with no diversity, electrical cross-ties, or additional emergency power sources as are found at plants such as Indian

Point and Zion, other high population density sites.

I- ,

Station blackout leeding to a reactor coolant pump (RCP) seal LOCA is the largest contributor in the Draft Millstone 3 Risk Evaluation Report (RER) to mean core damage frequency (staff estimates about 1x10-4 per year). The staff estimates that station blackout contributes 50% of the core damage .

frequency due to internal events. ,

'. Station blackout is estimated by the staff in the RER to contribute about 30%

i of the so:ietal dose due to internal events. Depending on the assumptions made J (e.g., conditional probability of H burn, offsite power recovery rate.

de-inertingduetocondensation),t$eestimatedmeandoseperreactor-year 1 s from station blackout out to 50 miles from the plant can range from rbut 2

{ to 60 person-rem. I s 7 person-rem per rea(The ctor-year). staff's Outcentral estimate to 150 miles fromout thetoplant, 50 miles the mean is about

} annual dose can range from about B to 200 person-rem. (The staffs central l I

estimateoutto150milesisabout26personomperreacteryear.) While i

ordinarily CRAC calculations out to only 50 miles would be used in a be:kfit l

.' analysis value-impa:t assessment, New York City, its suburbs, and ether '

- densely populated areas lie beyond 50 miles but within 150 miles. This is significant be:ause staff CRAC calculations estimate that downwind whole-body doses of 5 rem er more 'are quite possible for individuals living more than 50 miles from th~e site (based on long-term overpressure failure of containment).

The staff is pursuing generic resolution of the issues related to station -

blackout (USI A-44) and reactor coolant- pump seal failure (GI-23).

e G

,, , . _ . , _ .-n , ne--- - - - - - - --wr - ~ - ~ - ~ ~ - " '"~ "

DEC.18 '85 11:37 P.003 2

Uncertainties There are uncertainties related to the assumptions, equipment failure rates, omissions, modeling, human error, and other areas involved in estimating core damage frequency and risk due to station blackout. Some of these areas appear to be biased towards increasing or decreasing core damage frequency and risk.

This section discusses both biases and uncertainties. ..

Some areas with associated uncertainty appear to be biased such that we believe the results given by their mean values may result in a conservative -

estimate:

' One of the most important uncertainties in the estimation of station blackout core damage frequency and risk is the RCP seal leak rate, j The assumed average leak rate per pump for RCP seal LOCAs once seal

- cooling is lost for some time follbwing station blackout, will determine the time to core uncovery and core melt. Our analysis assumed a 300 gom

,I perpumpleakrate(sameasusedintheIndianPointProbabilisticSafety Study) starting 30 minutes after loss of cooling. Increasing the assumed

} leak rate would not change our core damage or risk results. A 50 gpm per pump leak rate would uncover the core about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the leak began.

If the leak rate could be dropped to 10 ppm per pump or or less, it would ,

'r take over 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> to un:over the core assuming no inventory makeup is l possible. Generic Issue 23 is seeking resolution of RCP seal failure.

The Westinghouse owners group on RCP seal failure has comitted (no date l determined) to repla:e the current 0-ring seals with seals of a composition more suited to withstand the conditions they would experien:e during a i s station bla:kout (i.e., high temperature and pressure). Reactor coolant l pump 0-ring failure is believed to be a significant contributor to catastrephic RCP seal fai. lure during a station blackout.

The staff's analysis does not take full credit for fission produ:t

~

t agglomeration that can accelerate the gravitational settling that will f

c::ur in containment and will continue to remove fission produdts from the centainment atmosphere. This difference is a "new source tem perception" based on NAUA which has been ben:hmarked against experiments. This is an "

j imp rtant bias be:ause it may reduce by an order of magnitude the estimated

.; , releases on containment failure due to long tem overpressure. j The staff analysis assumes that depletion of the DC safety related batteries under station bla:ko'ut conditions leads to rapid cere melt .

l sin:e the operator will be without any instrumentation and control power  !

i ,' for valves, relays, etc. Tne estimated core damage frequen:y is net sensitive to the time at which core damage c: curs following battery i l

j depletion.

l Some areas with asso:irced. uncertainty appear to lead to higher core damage i frequency and risk e.stimates:

4 .

, Frequency of loss of offsite power events of long duration is likely i underestimated. .

i -

DEC.18 '85 11:37 P.004 t

i: ,, . ,.

Loss of room cooling (which itself can cause station blackout) is not l included in the station blackout core damage frequency or risk results.

We perfonned a scoping analysis which estimated the potential mean core '

damage frequency contribution from room cooling to be greater than 1x10-4  ;

per year. The analysis did not consider operator recovery and assumed

[ that switchgear failed if room cooling was lost for two hours. These may be very conservative assumptions. -

I!

• The following areas would tend to increase core damage frequency and 7 risk for station blackout and could turn out to be the most important

,,- uncertainties. They are not readily quantifiable: design and

construction errors, omissions in the analysis, and sabotage.

1 i The staff has estimated that early containment failure modes such as  !

!! direct heating will have . negligible effect on risk. If a 10% ccnditional '

'I probability of early failu,r,e.were assumed, the risk estimates would be .

-l ,

increased by about an order of magnitude.  ;

j Sensitivity Analysis l t

i

, for station blackout events not caused by an earthquake, the staff in the r

RER first evaluated a base case where, if de-inerting of the containment occurred due to natural condensation, the containment was estimated to fail ,

i 10% of the time; if deinerting was due to spray recovery s1x or more hours  :

after vessel failure, the containment was estimated to fail 50% of the time; and if AC power was unavailable for as long as 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, power was always *

. assumed to be restored at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Battery depletion time was assumed to i

') ~ be 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. This case resulted in an estimated mean annual risk of two ,

!I person-rem within 50 miles of the plant and eight person-rem within 150

' miles of the plant. ,

1 In the first variation, the battery depletion time following station blackou' l l was assumed to be three hours; containment failure due to H., burns following I natural condensation was neglected; if deinerting was due tb spray recovery

six or more hours after vessel failure, the containment was estimated to fail

i. 50% of the time; and if effsite/onsite power was unavailable for as long as I 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, power was always assumed restored at 48 hcurs. For the first i,( variation, the estimated mean annual risk was seven person-tem within 50 miles of the plant'and 26 person-rem within 150 miles of the plant. The staff i: considers this their central estimate of mean annual risk from non-earthquake '

i induced station black ~ outs.

}'

• The second variation was the same as the base case, but all H burns (natural

', condensation or spray de-inerting) were assumed to fail conta$nment. For the second variation and more conservative case, the estimated mean annual risk -

was 15 person-rem, within 50 miles of the plant and 70 person-rem within 150

miles of the plant. , ,

J 1 l , .

I i

l l  ;

i

, _ . _ . . . _ . . , _ . -_..,.._____.m .___._____.._...___________...____.__._.._.__~_.m.______.___,-.

er.v.to o i s ,., c P.005 l I

1 i

For the third variation (the most conservative case), a station blackout  !

lasting six hours after vessel failure was assumed to always cause a hydrogen i burn which failed containment. This resulted in an estimated mean annual risk of 59 person-ree within 50 miles of the plant and 200 persen-rem within 150 miles of the plant.

Objectives The' general objective of proposing the following possible fixes is to reduce

, the impact of severe accidents associated with station blackout by reducing the station blackout contribution to total core melt frequency and, risk.

Al ternatives '

The following approaches were considered as alternatives to meet the I objective of reducing station blackout induced (non-earthquake events)

~

4

, core damage frequency and risk.

~

(1) Add a diverse gas turbine generator (which can charge an emergency ,

i battery) and an enclosure capable of withstanding winds of 150 mph.

' AJd a self-cooling, high head, low volume electric. pump (powered by the gas turbine generator) to supply coolant to the RCP seals.

(ii) Add a redundant emergency diesel generator (which can charge an

• emergency battery) and an enclosure cacable of withstanding very high ,

winds (e.g., 150 moh). Add a self-cooling, high head, low volume electric pump (powered by the added diesel generator) to suoply coolant to the RCP seals.

(iii) Upgrade emergency battery instrument air, and auxiliary feedwater f supply capacity to last at least eight hours following station blackout. '

f (iv) Add a steam-driven turbine generator to charge emerger.;y batteries and -

power an added electric pump .(self cooled) to supply crolant to tha RCP

}

seals. -

(v) Take ne action and await resolution of l!SI A-44 and Generic Issue 23.

Table 1 displays the value-impact analysis for each cf the octentiel fixes .

out to 150 miles. We have used 150 miles rather than 50 miles in the vt.lue-impact analysis for several reasons: . .

Dense population areas lie beycnd 50 miles but within 150 miles of the P.111stene site.

l CRAC calculations for evehts which result in late failure of containment estimate that a significant fraction of the time whole-body doses will i exceed 5 person-rem to individuals living mere than 53 miles from the  !

site. -

i 1

-l  !

I

l 1

d J

• The vast majority of the total estimated menn annual dose to individuals (even calculated out to 2000 miles) occurs to individuals living between 1 50 to 150 miles from the site. l Table 3 provides a sumary of benefits and costs. These include (1) public -

risk reduction due to avoided offsite releases associated with recuted acet-dent frequencies; (2) increased occupational dose from is.plementation and from operation a~nd maintenan:e activitie,s, as well at teduced cecupational '

exposure from cleanup and repair because of lower accident frequency; (3) costs to Northeast Utilities for implementation of modifications and operation  :

and maintenance; (t,) cost savings to hortheast Utilities from accident avoid-ance(onsitedamageand(5)NRCcostsfor' review. Table 4 provides a conpariton 6f Donitized value and costs (including avoided onsite property damage).

                                                                 ~

Value and Imoact of Alternatives - Alternative (1):

 ,         This alternative fix would require installation of a non, Seismic Category 1
 '~

gas turoine generator in an enclosure designed to withstand very high winds , (e.g.,150 mph). The turbine generator Wuld be capable of previding - sufficient AC power to run an electric pump to cool RCP seals and charge an emergency battery. This alternative would also require installation of a non.-Seismic Category 1, self-cooled, electric pump with high shutoff head and low volumetric capacity. The value from implementing this pptential fix is a

• j reduction in the estimated frequency of core melt due to station blackcut and ,

the asso:iated risk cf offsite radioactive releases. The impact is primarily

 !         on hortheast Utilities which would have to make the modifications. The major advantage; of this fix are that it reduces the probability of RCP seal LOCA, cf battery depletion, and of comen cause failure of the emergen:y AC power system.                                                                                             .           .

Value

) Based on the staff estimates for Millstone 3 of expected core damage -

frequan:y and risk due to station blackcut (details are given in the Draft ,i Millstone 3 Risk Evaluation Report), we can estimate the range ef incremental ' risk and core damage frequen:y reduction associated with this alternative.

         ~ Core damage frequen:y redu:tien for Alternative (1) is based on the
    ~

assumption that tne gas turbine generator (a diverse emergency power supply) . will have a reliability of at least 0.95 and therefore will redu:e core ,

          . damage frequen:y by about an order of magnitude.                                         -

In calculating "value", we have taken into account that not every core melt [ sequence leads to containment failure, and not every containment failure has the same estimated offsite consequences. The risk estimates used for this

      . value-impact analysis are unicue to the staff evaluation of Millstone 3. They differ from other plant specific and generic risk analyses in part because of plant and site features and in part be:ause of assumptiens used in the Millstone 3 review and this value-impact analysis.
                                                                              ~

b

                                                  .-     ,~.      .__e -
                                                                                .,   - . ~ . - , -     -           , , . .  - , . . - - - - - - , _ , - -

c-Table 1 Yalue-Impact Assessment for Station Bladout-Related Plant Modtf tcations (130 n:lles) [ 6 Range **or Incremental Estimated. Average *** $ Incremental Reduction

• Reduction in Exposure Cost .Per Persor.-reat Pctentlat Estimated
• In Frequency of Core (person-rem per Averted Over 40 Year 11fe Modifications Costs ($Million) Melt per Reactor Year _ reactor year) ($ per persen-reml y c:

1. Add a non-Scismic .7 to 1.2 8x10-5 7 to 190 630 Category I diverse (25) f

.                                    gas turbine genera-

• tor and enclosure. ,

Add an electric pump for RCP seal ccoling.

2. Add a non-Selsmic -

                                                                                           .6 to .8            .                 1.5x10-5                                1 to 36            .                            .2900                                           ;

Category 1. emergency (5) 3 diesel and enclosure. . Add an electric pump ' for RCP seal cooling. ,

3. Increas.e capablitty .3 to .5 1.1x10-5 1 to 27 1960 to cope with station (3) -

blackout to 8 hours . by increasing capacity of batterles. . Instrument air, and

• AfW supply d

a

                                           -                                                                                                                                                                                                                            }

t a_ _ . _ _ __ _ . _ _ _ _ - _ _ _ - _ - - - ---.---'-----------------e--"-- - - - - -- - - - " - - - - - ' - - - - - - '

                                                                                                                                                                          ' -"- '         ^
                                                                                                                                                                                                       ~
                                                                                                                                                                                              ^ " - ^ ^ ^ ^ ' - ^           " -   -~ - ^ ^ ^ ' - - ^ "-- -' -   '

F Ik ' Table 1 Value-Impact Assessment for Station Blackout-Related Plant Mcd!fications (150 alles) c h Range **of incremental Estimated Average *** - [ Incremental Redirction P. eduction in Exposure test Per Person-rem Pctential Estimated

• In Trcquency of Core (person-rem per Modifications Melt per Reactor Year Averted over 40 Year life Costs ($Million) reactor year) ($ per person-rew). I e

4. Add a steam-drfven 1.2 to 1.7 7x10-5 7 to 180 1005 turbine generator (23) to charge batterfes and power an added electric rump to ecol RCP seals.

                                                ~
    .                                                                                      1 a

Costs developed from R. A. Clark, et al. Science and Engineerin sociates, Inc., " Cost Analysts for Potential M9diffcations to Enhance the Ability of a Nuclear r Endure Station 31ackout." ' .,, USNHC Report NUREG/CR-3840, July 1984.

   *o  The range varies with the particular case assumed.

estimate out to 150 miles. The number .

• enthesis is our central oco Dased cr. geunetric mean or the cost and the person-rem averted.

e

                         -                                                                                                          D
                                                  ,                                                                                o>
                                /

l 9

                                                                                                                 -     e   *

                 ' DEC.18 '85 11:41                                                                     P.009 i

l Impact > The estimated cost to Northeast Utilities to implement this potential fix ranges from 30.7 million to $1.2 million based on costs given in R. A. Clark, et al, Science and Engineering Associates, Inc., " Cost Analysis for Potential Modifications to Enhance the Ability of a Nuclear Power Plant to Endure , Station Blackout," p. A-19 USNRC NUREG/CR-3840, July 1984. The cost estimate includes hardware for a non-Seismic Category'1 gas turbine, a non-Seismic , Category 1 electric pump (low flow, high head), and construction of an enclosure to house the gas turbine. The enclosure should be capable of withstanding very high winds (e.g., 150. mph). If insts11ation of tne turbine can be ende inside an existing qualified structure, cost estimates would be lower. Table 1 lists the estimated range in costs for each potential fix. Including averted plant damage costs can significantly affect the overa'.1 cost-benefit evaluation. The effect of the 3roposed action on averting plant . damage and cleanup costs has been estimated .)y multiplying the reduction in accident frequency by the discounted onsite property costs. The following equations from "A Handbook for Value-Impact Assessment " USNRC Report NUREG/CR-3568', December 1983 were used to make this calculation: Y = FU op and U =(Ce-rt)[1-e-r(t i f-t))(7 j ,-m) whe n (mrt) V = value of avoided onsite property damag!5 0  :%NN00al0e"ENMit{"$f$Ey*d%e C = cleanup, repair,- and replacement costs = $4.3 billion (S2.5 billion for f cleanup and repairs based on the assumed core melt being significantly worse than TMI-2 and $1.8 billion for replacement power based on.

                             ~NUREG/CR-3568) t f
                            = years remaining until end of plant life = 40

.! t g = years before reactor begins operation = 0

 .                   r      = discount rate = .10 (10t)                                                                      !

1 m = period of time over which damage costs are paid out (recovery . m period in years) = 10 l The discounted present values are shown in Table 2. Table 4 compares costs and benefits including avoided onsite property damage. , l Table 2 Discounted present value of avoided'onsite property damage I 10% disecunt rate 5% discount rate Cleanup, repair, and $2.1 million $4.7'million replacement power - -

                                                                                        .                                     l l

i

un.16 ' Ob 11:41 P.010 l - 9-

 !                                                    Value-!mpact Ratio i

Table 3 provides a sumary of the benefits and costs associated with the

 !                    Alternative (1). These include: (1)publicriskreductionduetoavoided offsitereleasesassociatedwithreducedaccidentfrequencies;(2) increased
 .                    occupational dose from implementation, and operation and maintenance I                    activities, as well as reduced occupational exposure from cleanup and repair because of lower accident frequency; (3) costs to NU for implementation, and maintenance activities, as well as reduced occupational exposure from cleanup and repair because of lower accident frequency; (4) costs to NU j                    for implementation of modifications, operation and maintenance, and increased reporting requirements; and (5) NRC costs for review of reports.                .

L

   '                  The estimated range of costs for NU to comply with Alternative (i) is $0.7 to 31.2 million based on NUREG/CR-3840. At a 10% discount rate, the present value of avoided cleanup, repair and replacement power is approximately                                                .

32.1 million. Also, the public risk reduction over the 40 year life of the plant ranges from 280 to 7600 person-rem. i Alternative (i) is estimated to reduce the station blackout mean core damage frequency by 8x10-5 per year. The estimated incremental risk reduction for this alternative ranges from 7 to 190 person-rem per year depending on the I scenario assumed. The estimated average cost per person-rem averted over the , plant's 40 year lifetime is $630 per person-rem (geometric mean). Our con-i tainment analysis conservatively treats fission product agglomeration and gravitational settling in containment. I If cost sayings to Northeast Utilities from accident avoidance (cleanup and repair of onsite damages and replacmert power) were included, the overall l value-impact ratio would improve significantly. If this benefit were taken i into account, the overall value-impact would show that estimated onsite savings are higher than estimated installation and operation costs. o l ,

f. -

y 1

              --   --                          -             - - _ , - - ,   ,.c --%.-     ..__-.r--- - ,e-- . - -   -++~,,,-,_,w-.,,-           . , . -- , , ..,

DEC.18 '85 11:42 P.011 l . Table 3 Value Impact Sumary.for Alternative (i) for Plant Lifetime DoseReductionRange(person-rem) Cost ($1,000) Public Health 280 to 7600 Occupational Ex osure 4 - (Accidental)II Occupational Exposure NA ,i (Routine)(2) NLf Implementation 700 to 1200 NUOperation(3) 35 to 60 NRCImplementation(4) , 7 t .-

 )          Total                               284 to 7600                        742 to 1267 (150 miles)

Value-ImonetRatio(5) $ per Person-rem averted The averaged sum of NRC and Northeast 655(6) . Utilities costs divided by public I dose reduction l I Based on an estimatedo ' ccupational radiation dose of 40,000 person-rem for post-accident. cleanup and repair activities, NRR Office Letter No.16,

 .             Revision 2. " Regulatory Analysis Guidelines,".0:tober 3, 1984 1         -

2 No significant increase .in c:cuoational exposure is expected from operation - and maintenan:e or implementing.the recomendations proposed in this resolution. Equipment additions and modifications contemplated do not require significant work in and around the. reactor coolant system and there-fore would not be expected to result in'significant radiation exposure. NA = not affected. . 3 Assume's 5% of installation costs for operation and maintenance. (From draftNUREG-1109). Based on an estimated 120 person-hours for NRC review. (From draft NUREG-1109). .

Ln . A o 'c[541N P.012 Table 3 Value Impact Sumary for Alternative (i) continued 5 This does not take into account the additional benefit associated with avoided plant damage costs or replacement power costs resulting from reduced frequency of core melt. The cost for plant cleanup following a core melt accident is estimated to be $2.5 billion, and replacement power is estimated to cost about $1.8 billion based on NUREG/CR-3568. The estimated discounted present value of these avoided onsite costs is given in Table 2. 6 The estimate of $665 per person-rem is based on the geometric mean of the value divided by the geometric mean of the impact. M e h ? O O 9 4 e O O 4

   .                                                                                                                                 l 1

t TABLE 4 p Comparison of Values and Costs h cs 41 ternative - Value ($Million) Estimated Costs ($Million)* La Monttized** litscounted - Averted Person-Rem Averted C ($1000/ person-rem) OnsIte Cost  :- IDI-

                                                                                                           ~5_%_

l. Add a non-Seismic 1.0 4.7 2.1 0.7 to 1.2 ~

Category 1 diverse gas turbine genera-ter and enclosutt. Add an electric pump for RCP seal cooling. ,

  ?.      Add a non-Seismic

• 0.2 0.9 0.4 0.6 to 0.8 ' -

Category 1, emergency l diesel and enclosure.. . 1 Add an electric pump i fer RCP seal, cooling. I 1 Increase capabI1Ity 0.1 0.6 0.3 0.3 to 0.5 to cope with station , blackout to 8 hours by increasing

capactty of batterf es, -

instrinnent air, and

! AfW supply.

• e il CD i -

c< r" Alternative Value($Mililon) Estimated Costs ($Million)*

                                                                                                                                                                     ~~

P Monit'Isigna Discounted Averted Person-Rem Averted 7, ($1000/ person-rem) Onsite Cost 7% IDI- . d

                                                                                                                                                                                                                                     ,_n o.-*

0.9 4.1 1.8 1.2 to 1.7  %

4. Add a steam-driven turbine generator j:.

to charge batteries and power an added electric pump to cool RCP seals. ,

• Costs develcped from R. A. Clark, et al, $clence and Engineering Associates. Inc., " Cost Analysis for Potential Modifications to Enhance the Ability of a Nuclear Plant to Endure Station Blackout." USMRC Report NUREG/CR-3840, July 1984. .

                          **                                      Central estimate'
                                                                                                                                                                                                                                     ?

c.

                                                                                                                                                                                                                                   . .gm l                                                                                                                                                                        -

u-L.10 OD ll:44 P.015 1 Alternative (ii) This alternative fix would require similar modifications to those in , Alternative (i) except that NU would install a non-Seismic Category I emergency diesel generator rather than a gas turbine generator. The major advantage is that the utility already is experienced in operating and maintaining diesel generators. The major disadvantage is that the extra diesel generator does little to reduce the chance of a comon cause failure of all diesel generators. TheestimatedcostofAlternative(ii) ranges from 0.6 to 0.8 million dollars based on cost estimates given on p. A-15 USNRC NUREG/CR-3840. Alternative (ii)isestimatedtoreducethestation blackout core damage frequency by.1.5x10-5 per year based on the limiting comon cause failure rate among 3 diesel generators. The estimated in:re-mental risk reduction for this alternative ranges from I to 36 person-rem per year. The estimated average cost per person-rem averted over the plant's 40 year life is $2900 per person-rem. . . Alternative (iii) l Another alternative considered by the staff would have NU upgrade the I capacity of emergency DC bus batteries, instrument air system, and the water supply to the suction of the auxiliary feedwater pumps such that they would last at least eight hours following a station blackout. Along with this, emergency procedures and operator testing would be upgraded. The major advantages to these improvements are (1) the relative low cost and (2) if the frequency or cagnitude of reactor coolant pump seal LOCAs is reduced, D0 battery depletion appears to be the next largest contributor to station blackout induced core damage frequency. The major disadvantage to this l alternative is that it does nothing to prevent or mitigate a reactor coolant pump seal LO;A. The estimated cost of Alternative (iii) ranges from 0.3 to 0.5 million dollars based on costs given in R. A. Clark et al, Scien:e and Engineering Asso:iates, Inc., " Cost Analysis for Fotential Modifications to Enhan:e the Ability cf a Nu: lear Power Plant to Endure Station Blackout," pp A-5, C-2, and D-2, USNRC NUREC/OR-3840, July 1984. Based on staff anal of the effect of extending battery capa:ity to 8 hours, Alternative (iii) ysis is estimated to reduce station blackout core damage frequency by 1.1x10-5 per year. The estimated incremental risk reduction for this alternative ranges from a to 27 person-rem per year. The estimated average cost per person-rem averted over the plant's 40 year life is $1850 per person-rem. , Alternative (iv) . An:ther alternative would be to install a non Seismic Category 1, AC-independent, steam-driven turbine generator to charge the emergen:y batteries and power an added, self-cooled, motor-driven pump capable of

 . delivering 50 to 100 gpm to reactor coolant pump seals. This potential fix                       .

is similar to that instituted in France to help prevent core melt due to

   . station blackout induced RCP seal failure and core melt due to emergency battery depletion. The major advantages to this alternative are that it helps redu:e b th frequen:y of station blackout and probability of emergen:y 9
                                                                                             - . ,      ----ew

                 . . . .     . ..   .   .. ~

DEC.18 '85 11:45 P.016-

                   ~

l l l I battery depletion. The estimated cost of Alternative (iv) ranges from i 1.2 million dollars to 1.7 million dollars based on costs given on p. B-6 of i

 }                          NUREG/CR-3840. Alternative (iv)isestimatedtoreducestationblackoutcore                      I

damage frequency by 7x10-5 per year based on an assumed reliability of 0.9 for L the system. The estimated incremental risk reduction for this alternative l

 ',                         ranges from 7 to 180 person-rem per year. The estimated average cost per                   l i

person-rem averted over the plant's 40 year life is $1005 per person-rem. Alternative (v) This alternative would be to take no actions beyond those resulting from the proposed resolution of Unresolved Safety Issue A-44 And Generic Issue 23. i

                                                                        -                                              l f

k, t l I. 7 l 1 1 O l - l

APPENDIX B . l l l l l l MTTL90NE UNIT 3 STATION AC BLACKOUT ASSESSMDR

B-2 Appendix B Rate of Occurrence of Severe Core Damage Events Due to' the Loss of Offsite Power Initiator, for Millstone Unit'3 A.1 Introduction and' Summary This appendix gives an evaluation of the frequency, or rates of occurrence of severe core damage events, from the loss of offsite oower initiators for the Millstone Unit 3. The frequen;y of severe core damat1e from the loss of offiite power initiator is estimated at 8.2x10 5/ year. A discussior,cf uncertainties is given. ,Theyarejudgedtobekarge,but have not been quantified. Sensitivity analyses to some of the assumptions . are given.

                                                   ~

The model used is based on the Marshall-Olkin model [Ref.1] for fatal shocks to take into account diesel generator failure-to-run, and common cause failure-to-run of the diesel generators. Failures-to-start of the diesel generators, and maintenance unavailability are also included. Recovery of diesel generators and of loss of offsite power is modeled. The ability of the plant to withstand' station blackout (loss of all AC power) of limited duration without severe core damage is modeled. The duration of the station blackout that can be withstood (the " grace time") without severe core damage depends' on the time of initiation i of the station blackout. For early times, the grace time depends on the time without seal cooling that the reactor coolant pump seals can withstand before failing; for later times, the grace time depends on the battery depletion time. 9 i 1

                                                                           ~_                  - _ _ _                                 _ _ , _ _ _     _ . _ , _ . _ _ .

B-3 For later times, the reactor coolant pump seals are' assumed not to fail be-cause a cooldown of the reactor is assumed to take place. We note ,that failure-to-run of diesel generators were not modeled in the' Millstone 3 PSS. The remaining sections of this appendix are: A.2 Physical Considerations A.3 Definitions . A.4 Data Values and Sources

                   ..A.5 Analysis and Humerical Results                                                     .

9~ .. A.6 Discussion of Uncertainties .. A..' References A.2 Physical Considerations We assume that if all AC electric-power is lost for a period If=1 hours, at any time within the first wf=4 hours after the loss of offsite power, that core melt occurs. If all AC electric power is lost for a period of 3 hours, at any time after the first 4 hours after loss of offsite power, then core melt occurs. The rationale for this is that we assume a reactor coolant pump seal LOCA will occur after h hour without electric power, if the reactor coolant temperature is above 400"F. The core will then uncover within another hour, unless power is restored. However, we assume that the reactor l operators will begin cooling down the reactor two hours after initiation of the loss of offsite power, and the reactor co'olant temperature will be below 400*F at 4h hours after the loss of offsite power event. Thus, if all AC electric power is lost after 4 hours into the event, the seal LOCA will not' occur before the reactor coolant system is cooled below 400 F, and hence will

B-4 not occur. The 3 hour grace time for the station blackouts which begin 4 hours after loss of offsite power comes from an assumed battery, depletion time of 3 hours. l The assumed battery depletion time of 3 hours used in the calculations is somewhat larger than the present staff minimum estimate of 2 hours, but less than the % plicant's estimate of'8 hours. (More precisely, the staff has no information to support a time greater than 2 hours, at present, since the .  ;

       . app,licant has not supplied this information). Sensitivity. studies are r,                                                                                                ~~

performed in which an 8 hour battery depletion time is used. Severe core damage is assumed to occur after loss of I)C power because of loss of instrumentation and control. , It is assumed that electric power will be restored with certainty 24 hours

  -       after initiation of the loss of offsite power. However, one of the sensitivity studies considers the case where electric power is not restored                              l f

with certainty until 48 hours after initiation of the event. Containment failure can occur by various mechanisms. First of all, a hydrogen burn sufficiently intense to cause containment failure may occur. For this to happen, the containment must first be de-inerted by the removal of water vapor from the containment atuosphere. De-inerting may occur from natural condensation or as a consequence of electric power being restored and the containment sprays being actuated. (If de-inerting is due to 4

B-5 containment spray actuation, the sprays will probably significantly reduce , l the source term; about 2 orders of magnitude.) Inaddition,asuf[ficiently i l large amount of hydrogen must have been produced so that t'he pressure rise produced by burning it is sufficiently large to fail containment. Although I the amount of hydrogen produced after core melt may continue to rise, the l amount of hydrogen that can burn is limited by the amount of oxygen in containment; this depends on the pre-accident containment pressure in the l l subatmospheric containment at Millstone 3. 7 .. Whether the containment fails on a hydrogen burn depends also on the efficiency of the burn in producing a pre'ssure rise in containment. Burns which are slow permit greater heat transfer from the containment atmosphere ' to the walls and other materials of the containment, reducing the pressure rise. The staff estimates that if de-inerting occurs by natural condensation, then the probability of containment failure from a hydrogen burn which consumes all the oxygen in containment is .1; the burn here is considered relatively slow and inefficient. On the other hand, if de-inerting occurs be'cause the containment sprays have been turned on, after a stoichiometric mixture of hydrogen and oxygen exists, the probability of containment failure is taken as .5, since the burn is considered more efficient. ) l l Containment failure can also occur by overpressure from steam and noncondensibles.  ! For this to occur, the staff estimates 24 hours after core melt without the o restoration of electric power is necessary.

                                                           '            ~

B-6 8 The staff estimates that the rate of hydrogen production is such that a The stoichiometric mixture of hydrogen and oxygen exists after 6 hours,. calculations of containment failure assume no probability of containment

  . failure if electric power is restored before 6 hours after core melt; the error here is small.

De-inerting by natural condensation (without sprays) is estimated to occur There is , with.pniform probability at any time from 6 hours to 20 hours. - ) l % some conservatism here, since it is possible that natural condensation will _. j not occur at all.  ! A.3 Definitions Time will be measured from the instant of loss of offsite power, or from time of failure, as appropriate. The formulas below will indicate the origin of the time axis. is the probability that the offsite power has been Rn(t)  ! recovered by time t after the onset of its loss (symbol n designates electrical network); nR (t) is the distribution of recovery time Qn (t) = 1-Rn(t) is the probability that the offsite power has not been restored by time t

      *                     .g B-7 is the probability of nonrecovery of a diesel generator Qf (t) by time t after its failure,-f'or either the,failing-to-start mode of failure or the failure-to-run mode of failure, if these failures were from independent causes.

In the case of failure-to-run, the symbol Qg(t) may also be used. , Q,(t) is the probability of nonrecovery by time t from being in maintenance or test .

  %   - Qc .(t)         -

is the probability of nonrecovery of.a diesel - generator by time t after its failure, if it has failed from common'cause q, is tile probability of a single diesel generator being . in maintenance at time of demand. . qf is the probability of a single diesel generator

  -                                  failing to start on demand.

q2 is the probability that both diesel generators fail to start on demand. q is the probability of common cause failure of both e diesels starting. is the failure rate for a running diesel generator. Af (t) = Af Ag (t) = A c is the failure rate from a common cause event (or shock) that will disable all running diesels. A=A -A g is the failure rate for a running diesel from j f independent causes. 4

                                                  - . - , _     , - - _ . . _ , .,,.m,, y.,.._ _,,,   .,e,     , -   - _ _ - - - . , ,- - ,

               -                                                                                               i l

B-8 w, subdivides the time interval after the loss of offsite power. Forstationblackoutsbeginningattifesbefore w,, the grace time the plants can withstand a total loss of AC power before severe core damage occurs is determined by the reactor coolant pump seal failure; for times after w, the grace time is determi,ned by, l battery depletion. r, - is the grace time (see definition w,) for station blackouts

       - ty ,                                                                                  ~~

initiated in the time interval Ost(w ,o where the reactor coolant pum'p seal failure is controlling. See section on physical considerations of this appendix. , < T is the gra e time for times t2w o, where the battery depletion 2

  -                    is controlling.

wy is the termination time used in the calculations; station blackouts initiated after time wy are assumed not to lead to core melt. For the base case, wy+ T By 24 hours after loss of offsite 2 = 24 hours. I power, recovery of electric power by one means or another is assumed. In sensitivity calculations, it was assumed that power was not recovered with certainty ) until 48 hours after the loss of offsite power cccurred. l A is rate of loss of offsite power. n _.m _. _ ,, _

                                                      ' " ' ' ' " ' ~ '          --w,

B-9 A.4 Parameter Values and Their Sources .. (1) The frequencies An On (t) of losses of offsite power exceeding t hours were taken from Figure 14 of the final draft of NUREG-1032. (This figure applies specifically to Millstone 3.) This draft gives a range of values (called "Model Range"); the values of this app'endix were

                          . chosen in the midpoint of this range.                                                                     The table of values as used in                 ,

this appendix are given in Table 1. Beyond 16 hours (the cutoff value _for the table in NUREG-1032), a constant value of .004/yr was assumed,

      %                   . for AnOn(t), until 24 hours.

The values for Q f (t), Q, (t), Q (t') g were derived from values given in NUREG/CR-3226 (Ref. 2), page 237. It was found that these values were , fitted reasonably well by exponential curves exp(-at). The values of a for Qf (t), Q, (t), and Qg(t) were: Non-recovery periods a Qf (t)' 1/15 l Qm (t) 1/15 l

                                                                                                                                                                                                                                                      )

Qg (t)' .1 l A s.omewhat better fit could have been obtained for Q, (t), non-recovery from maintenance, but the results are insensitive to this value. (2) q,was taken as 6 x 10 3/per demand from NUREG/CR-2989 (Ref. 3). was taken as 3 x 10 2/ demand from NUREG/CR-2728 (Ref. 4) p. 128. (3) qf t l

   ,-     - . , , , - _   _, -        _ - . . - _ - - - . -         , , . , . , _ , , , . , _ . . , . . , , . , _ _ - , , , . , ,       ,  , . . , . , - ,       ,_y,_e_,,.__..,,_-,     7~-,_n ,, , . , , ,     ,.y,.                ,, . , . ,, , ,

                                                                                                  .  /
                                   ~

B-10  ; l (4) q2 was taken 2 x 10 3/per demand rounded off from 1.9 x 10 3 ,as listed in NUREG/CR-2989, p.42. -[  ! (5) q wase computed from q2 and qf to be 1.1x10 3 l (6) A was taken as 3 x 10 3 per hour from NUREG/CR-2815 (Ref. 5) Table C.1 . f (7) A wasg taken as 9 x 10 s per hour as derived from the p factor of .03

         .   (rounded from .0325) of Midland Nuclear Plant Probabilistic Risk Assessment (Ref.6), Appendix E.1, p. 76 (8).. Aj = 3 x 10 3 - 9 x 10 5 ~ 2.9 x 10 3 per hour                                .

T.

                                                                   ~
      .(S) w o= 4 hours                                                                 },           l Tywas taken as 1.5 hours (see Section A.2)

I 2was taken as 3 hours (see Section' A.2), coming from battery depletion time; in sensitivity studie , T was 2 taken as 8 hours. O e G

                                                                                                     \

I l I

B-11 Table 1 ,.

                                                                                                       ~.

Annual FrequenciesnAnO (t) of Losses of Offsite Power Exceeding t hours, at Millstone 3 i t(hrs) An On (t) (1/yr) t An On (t)

1. 0 "

                                .038                                          8.0                .007                               .
   %   .        1.5 -           .029                                          8.5                .006                              --

2.0 .025 9.0 .006 2.5 .021 9.5 .005 3.0 .018 - 11.5 .005 3.5 .015 12.0 .004 4.0 .013 24.0 .004 . 4.5 .012 - 5.0 .011 5.5 .010 6.0 .009 6.5 .008 7.0 .008 7.5' .007 1 I

     .                                                                                                                                                        l 1

l

B-12 A.5 Analysis and Numerical Results

• A.5.1 Seouences Analyzed The rate of occurrence of severe core damage and rate of occurrence of core damage with containment failure under various conditions was evaluated for five

        " major" sequences.

9; .. (a) At- time of loss of offsite power, each.of the diesels is unavailable- _. either because of maintenance or failure to start. (b) One diesel is in maintenance; t'he other diesel starts but fails while running, leading ultimately to core melt.

                 '(c) One diesel fails to start, the other diesel starts but fails while running, leading ultin.ately to core melt.                                      )

1 (d) Both diesels start but fail while running through common mode. J (e) Both diesels start but the first failing diesel fails while running from an independent random f ailure, and the second diesel fails while running, from either an independent or common cause. A.5.2 Formulas The formulas below are developed to deal with the probability (per year) of severe core damage from the loss of offsite power initiator. The symbol Pd "III be used to denote the annual frequency of severe core damage, from the loss of offsite power initiator. The numerical evaluation is for the base case, with

      ~

a battery depletion time of 3 hours. i

B-13 The derivation of the formulas follows rather directly from the physical , model described above. Afewexplanationsmaymakeiteasierforkhereader to follow. Thecontributionfromtermsinvolvingthefaiiureofadiesel l generator, its repair, and subsequent failure are neglected. Except for  ! l case (a), all cases require integr& tion. Because two different grace periods (T!s) after loss of AC power are involved, two separate' integrals are necessary. These will be designated by Iy and I2. 5 me f the formulas involve a factor of 2; this factor of 2 arises because there are two symmetric cases; either

 ~;       -

diesel generator A fails first or diesel generator B fails first. .. Both cases (d) and (c) involve explicitly' the shock model for common cause failure, one that is equivalent to the Marshall Olkin model for fatal

       . shocks. Shocks which cause both-diesels to fail simultaneously arrive at a rate A and with density function for time of arrival A     g exp(-At).

c In c

 ~

addition, each diesel may fail from independent causes with the rate Aj and the density of failure times A$ exp(-A$ t). All arrivals of shocks and all I arrival times of independent failures are completely independent. It is presumed that repairs on failed diesels from independent causes would be concurrent and the respective repair times would be statistically independent. l This is also equivalent to repairing only the engine that would yield the i earliest repair. For common mode failures,the same common repair time for both diesels was postulated. e l I

B-14 ' The most compli ated formula pertains to case (e), in which the first diesel failere is an independent diesel failure while running. Consider,I for case (e) (this might be more profitably read after looking at the respective formula). The variable of integration, w, represents the time when the "second" diesel fails and thus creates the loss of all AC power. The second failure can come about either as an " independent" failure or as a common cause failure; thus its failure rate is Af. Initiation in an interval (x,x+dx) has probability exp(-A x)Aj dx. The factor exp(-A x) f comes from the fact that neither a common f

     . cause failure nor.an independent failure occurs before time x.          In order that .

z the AC power supply be failed for a time 11, restoration of the various components cannot occur respectively before times T{, w + ty, and w - x - Ty; hence the Q's in.the formula. In the computations, the exponential factors associated with the failure densi. ties were taken as unity, introducing a slight conservatism. l Case (a') Neither diesel generator is available at the time of loss of offsite power, either because both fail to start or because one fails to start and the other is in maintenance. l Pd

• Ar. I(4f ~ Ac )N0f(T1 )E+%9c (II)l0 n(T 1)+2Ann 0 (II)4f%9f(T1)0m(T1)

Pd = 4.7x10 5/ year N.B. - The term involving q, was neglected in the numerical evaluation. Case (b) One diesei generator in maintenance, the other fails while running. Pd*An 2 g {I 4y 1 ]2where

   ~

I y=Q(t)(o f y A f exp(4 fw) Q , (w + ty) Q n (*

• T 1) dw m

B-15 and 12

• Of (T1) I f **P(-A f *) O m (*
• T 2) O n (*
• T 2) dw -

o P = 3.0x10 s/ year

      ,       d Case (c) One diesel fails to start and the other starts, then fails while running.
          ,, d*A n2 qf {I 1 + I 2} where P                                                                             ,

exp(-Af w) Qf (w + T1) Q n (*

• T 1) dw 1

1=Q(TldoA f i f and I 2

• Of (T2) 1 **PC-Af *) O f (* * '2) O n (*
• T 2) dw 0, ,

Pd = 1.3x10 s/ year ... . Case (d) Both diesels start, then fail while running through common mode. Pd*An(I l

• 1 ]2 where Il=Q(T)(o g 1 Ag exp (-Agw) exp (-2 A $w) Q n (*
• T1 ) N and -

I2

• Oc (T2) 1A c **P (-Acw) exp (-2 A$ w) Q n (*
• T 2) dw 0

Pd = 1.0x10 5/ year l l t e l

m B-16 Case (e) Both diesels start, the first diesel generator fails while running from " independent causes", and the second diesel generator Ja[ils while  ! running, from either independent causes, or a common ' mode shock. P= nA 2{I 1+I}yhere2 Il

• Of (II )k A f**PC-A")O(**T)bA f n 1 i exp(-Afx) Q (w - x + T 1) dxdw Note Qj = Q f for all practical purposes I2
• O f (I2) 1A f **P(~Af*) O n (*
• T2) Ai exp(-Afx)Qj (w - x + T 2) dxdw 0

i

,. Pd

• 8'3x10 8/ year }, l The sum over the 5 cases yields Pd = 8.2x10 s/ year j A-5.3 Secuences With Containment Failure, and Sensitivity Calculations

- The above mathematical formulation can be used to determine the frequency of events in which electric power is not restored for a time t, after core melt. To do this, in the above formulae, (1) Replace yt by ty + t, (2) Replace2 t by t2+t, (3) Replace wyby infinity, but assume, for the base case (where power is restored with certainty 24 hours after loss of offsite power), that Qn (t) = 0 for t > 24 hours. Suppose nA Oep (t ,) deno,tes the probability no electric power is restored for a period of at least t mhours after core melt. Let g (t) represent the j

                                               -m                   ,   __              ,      ,-._% .

E-17 density function for natural condensation occurring. Then ,, Agg(t,)Q,p(t,)dt, , is the probability natural condensation occurs. According to the discussion in Section A.2, natural condensation occurs with eqval likelihood at any time between 6 and 20 hours, so that g (t) = 1/14; the lower limit on the integral is 6 hocrs and the upper limit 20 hours. The result obtained must be multiplied by .1, the conditional probability of containment failure after a hydrogen burn where de-inerting eccurred by natural condensation.

                                                                                                 ~
   -=       --

The. frequency of severe core damage events in which containment failure occurred with the sprays on was calculated by computing the frequency of events in which power was lost for at least 6 hours after core melt, sub-tracting the probability of a hydrogen burn caused by natural condensation, and multiplying by .5, the conditional probability of containment failure. A sensitivity calculation was performed in which electric power was act

                                                                      .                                 1 assumed to be restored within 24 hours of the loss of offsite pont, but rather, for the time interval between 24 hours and 48 hours gA nQ (t) was I

taken as .004/ year. Steam overpressure failure of containmett was assumed at 24 hours. de-inerting caused by natural condensatien was assumed not to l take place. l l Additional sensitivity calculations were run assuming the battery depletion l 1 time was 8 hours instead of 3 hours. l

                                   .                                                                     l I

i

                                                                                                  ~
                                                                                                         \

I I B-18 i Table II Summary of Results for Frequencies of Station-Blackout Induced Severe Core Damage, and Severe Core Damage With Containment

• Failure, as a Functicn of Battery Depletion Time .,

Battery Depletion Ti.me 12 3 hours 8 hours Used in Base h r Frequency cf severe core damage 4.4x10 7/yr 3.3x10 7/yr with :entainment failure from i hydfogen burn after da-inerting by.natdral condensation T. -

                                                                                               ~'

Frequency of severe core damage 4.3x10 8/yr 3.4x10 '/yr , with containment, failure froin . hydrogen burn after sprays are turr.ed on , , Used in Central Estimate Frequent.y of sev~ere core damage 1.6x10 8/yr 1,0x10 8/yr with containment failure by steam overpressure, given electric povr- not restored for certainty for 48 hours after ' loss of . offsite power Fresuonev of severs : ore damace 8.2x10'5/yr 7.1x10 5/yr e i I { e

l l B-19 A.6 Discussion of Uncertainties Some of the uncertainties in the estimate are caused by -

1. Uncertai' ties in the frequency of losses of offsite power, and in the distributi:1 of times to recover offsite power. .

i

2. Diesel generator reliability data.

3., Uncertainty concerning the behavior of reactor coolant pump' seals on loss of cooling.

4. .. Uncertainty concerning the battery depletion time.  ;

                  .5:. The assumptions concerning hydrogen burns after de-inerting by natural
                                                                                                 }

condensation of steam. Amongst the assumptions ccncerning hydrogen burns are the assumptions of ~ uniform probability of de-inerting by natural condensation between 6 and 20 hours after vessel failure, and the assumption of a 10% probability of con-I tainment failure, given a hydrogen burn. Note further that the frequency of core melts with containment failures occurring after the sprays are turned on is reasonably sensitive to the assumptions made concerning de-inerting by natural condensation of steam. The reason for this is the assumption that if a hydrogen burn occurs by natural condensation (and 90% of these are assumed not to fail containment) then a hydrogen burn after the sprays are turned ,

on will not fail containment. The subtraction of the probability of a hydrogen burn caused by natural condensation causes about a factor of two decrease in the frequen;y of severe core damage with containment failure -

1 occurring after the sprays are turned on. 9 0 b

B-20 The diesel generator reliablity data we used is generic. There are wide variations from plant to plant in diesel generator reliability, b$t since there is no plant-specific operating data i~t is not possible to reduce this uncertainty. The behavior of the reactor coolant pump seals on loss of cooling of the seals is uncertain. The mechanism for the reactor coolant pump seal leak on .lcss of cooling.of the seals is overheating and failing of the 0-rings -

         -(iecondary seals). The basis for the estimate that the 0 rings will fail     [.

after 1/2 hour without cooling is a chart from the Parker 0-ring handbook of January 1977. The chart is intended o'nly as a rough guide. For ethylene propylene 0-rings the time to failure of the 0-rings, as a function of temperature, is: " ~

 ~

Temerature Time 550* .4 hrs 500 .7 hrs 450* 1.8 hrs 400* 5 hrs The approximation made in the calculation of severe core damage frequancy is even more rough - it is assumed that if the reactor coolant system temperature is above 400*F the seals will fail after 1/2 hour; below 400*F, they will not fail. O e i

B-21 The magnitude of the RCP seal leak is assumed to be 300 gpm per pump,  ;

                                                                                    ~'

leading to a core uncovery time of about I hour after onset of the leak. The most recent position of the staff is that a leak of 500 gpm per pump . would occur if a particular 0-ring were to fail, provided that no resistance to flow is given by the seals after failure of the 0-ring. Use of a 500 gpm leak rate would not significantly affect the results. - g , , b e W $ e ee D F i .

              .                                                                                                i 1

l i l l 1 1 l

B-22 A.7 References ,f (1) A. W. Marshall and I. 01 kin "A Multivariate Exponential Distribution," l Journal of the American Statistical Association, Vol. 62, pp.30-44,  ! March 1967.  ! (2) A. M. Kolaczkowski and A. C. Payne, Jr. Sandia National Laboratories,

                " Station Blackout Analyses," NUREG/CR-3226, SAND 82-2450, May 1983.

(3) R. E. Battle and D. J. Campbell, Oak Ridge National Laboratory,

                " Reliability of Emergency AC Power Systems at Nuclear Power Plants,"                                                               l
             - NUREG/CR-2989, ORLN/TM 8545, July 1983.                                                                           -

• D. D. Carlson and cthers, Sandia National Laboratories, " Interim

      ~ (4-)                                                                                                    .             ..

Reliability Evaluation Guide," NUREG/CR-2728, SAND 82-1100, January 1983. , i i

    .    (5) . I. A. Papazoglou and others, Brookhaven National Laboratory,                                                                         l "Probabilistic Safety Analysis Procedures Guide," NUREG 2815, BNL                                                      .            ;

NUREG 51559, June 1984. l 1 (6) F. R. Hubbard, III and others, " Midland Nuclear Plant Probabilistic . 1 Risk Assessment," prepared by Pir.kard, Lowe and Garrick, Inc. for Consumers Power Company, May 1984.

                                                                                                                                                    \

l l e l

APPENDIX C . I 1 l MTi.! STONE UhTT 3 STATION AC BLACKOUT ASSESSMDTr

l Reactor Coolant Pump Seal LOCA Current Status SFJll DESIGN The Westinghouse reactor coolant pumps are of a vertical single stage centrifugal design with controlled seal leakage. The controlled seal leakage system is a three stage seal system design which restricts leakage flow and reduces the pressure from operating system pressure to atmospheric. Each seal contains a ring which is free to move axially and a runner which rotates with the reactor coolant pump shaft. - The #1 s2al is a two piece seal which consists of a ring attached to the pump housing and a runner attached to the pump shaft. The face-plates of the seal ring and runner are an aluminum oxide composition which utilizes a hydrostatic . film-riding, taper-face design. The majority of the pressure drop across the reactor coolant pump seal assembly occurs across the #1 seal. The leakage control is pressure activated and does not require shaft rotation. The # 2 seal is a rubbing face type seal consisting of a carbon-graphite insert which is shrunk into a stainless steel ring. The seal ring insert rubs on a hard faced stainless steel runner which rotates with the shaft. The seal is , primarily used to divert the #1 seal leakage to the leak-off line. The seal is of high pressure capability and can maintain pressure retention for up to 24 . hours with the coolant pump stopped. The #3 seal is also a rubbing face type seal similar to the #2 seal and is used to divert any #2 seal leakage to the leak-off line. The seal is of low pressure capability. The seal assembly also consists of secondary sealing materials between the seal assembly co=ponents. These secondary seals are Ethylene-Propylene 0-rings in static sealing locations and Polymer-filled Teflon channel seals backed by Ethylene-Propylene 0-rings in dynamic seal locations. Snt COOLTNG Cooling of the seal asse=bly during operation is provided by the seal injection system and the therm 1 barrier heat exchanger. Both syste=s are normally in operation and reactor coolant pu=p operation can continue for un to 24 hours with only one mode of cooling in operation. The seal injection system provides a flow of 1 gpm per pump of clean cooled water from the CVCS makeup system to an area of the pu=p between the reactor coolant and the #1 seal. Approximately 4 gpm of this flow goes through the #1 seal with the remainder entering the reactor coolant system. This arrangement prevents reactor coolant from entering the seal area and provides filtered cool water to the seals.

1 1 The thermal barrier heat exchanger is located between the areas of the pump in direct contact with reactor coolant and the seal area. The thermal barrier heat exchanger is cooled by a component cooling water supply and limits the  ! i heat transfer from the reactor coolant fluid to the pump lower internals, including the seal assembly. The thermal barrier heat exchanger also provides back-up cooling when seal injection is unavailable. l l LOSS OF SFAL COOLTNG l A loss of seal cooling is defined 'as the concurrent loss of the seal injection system and the loss of cocponent cooling water supply to the thermal barrier. If cooling is not restored in a short period of time (see later discussion), the seal assembly will be subjected to a severe thermal transient and operation of the reactor coolant pump is prohibited. Steady state analyses of the reactor coolant system leakage through the pump seals during periods of loss of seal cooling has several assumptions. The . first assumption is that the reactor coolant pump is not rotating at the time that significant temperature increases begin to occur in the seal area. The second assumption is that the seal injection return line is isolated downstream of the safety relief valve thereby providing a significant back-pressure in the area between the #1 and #2 seals. These assumptions are reasonable for the .nost likely sequences of events which could lead to a loss of pump seal cooling such as the loss of all station a.c. power. , SEAL RESPONSE TO LOSS OF COOLTNG Following the loss af all seal cooling, the reactor coolant pump lower internals water volume arm the thermal capacitance of the thermal barrier heat exchanger would provide limited cooling to the seals for several minutes. The lower internals water volume would begin to be purged within 5 minutes of the loss of all seal cooling, resulting in an increase in the seal inlet temperature. The temperature of the water at the seal inlet would increase rapidly and eventually reach a rate approaching 150 degrees per minute. Approxicately 13 minutes following the loss of all seal cooling, the lower pump internals volume will be completely purged and the fluid temperature at the seal inlet will stabilize at the reactor coolant cold leg temperature. This time period is based on an analysis of the component cooling water system for a typical plant and includes the effects of natural circulation in the component cooling water syste=. The increase in seal inlet te=perature initially results in increased seal leakage due to changes in the viscosity of the fluid passing through the seals and due to the transient thermal distortion of the seal assembly components. As the seal assembly compenents reach thermal equilibrium with the high temperature fluid from the reactor coolant system, the leakage flow' rate will ' stabilize at a rate which is higher than the normal leak-off flow rate through the #1 seal. l m

                 -                                                                                            l

A number of different themal considerations are acting on the seal assembly - resulting in the increased flow rate. A thermal gradient across the #1' seal causes changes in the taper of the face-plates. Changes in the face-plate angles cause a change in the hydrostatic force balance, resulting in an increased separation between the face-plates and therefore, a higher leakage rate. There is also a reduction in the viscosity of the fluid at the il seal which results in an increase in leakage. The increased flow in this area results in a turbulence increase which also further increase the leakage rate. Due to the initial pressure differential across the #1 seal, two-phase flow will occur between the face-plates which results in a decrease in the flow rate. Finally, the axial shaft thermal growth is greater than the film height in the #1 seal face-plate which results in increased flow. The transient thermal effects are no longer acting on the seal assembly and a constant long term leakage can be established. The leakage rate across the tapered #1 seal is self-limiting since the back-pressure in the area between the #1 and #2 seals will act to close the #1 seal face-plates while the reactor . coolant pressure will act to open the face-plates. Permanent distortion of the seal pieces may result from the relief of manufacturing stresses during the severe thermal transient following a loss of all seal cooling. Consequently, after exposure to high temperature conditions and return to normal seal cooling conditions, the seals are expected to experience distortion which may result in increased normal condition leakage rates. O-PlNG SrlL RESPONSE The 0-rings presently used in the reactor coolant pump seals are Parker E-515-80 material, which is an Ethylene-Propylene compound. Tests of the 0-ring material response to the temperatures which the 0-ring would experience during a loss of pump seal cooling incident at AECL ( Atomic Energy of Canada, Limited ) laboratories indicate that the 0-ring material would survive approximately 2 to 2.5 hours before significant extrusion of the 0-ring occurs. 0-rings manufactured in Europe to this same material specification were used in the French 24 hour test and no 0-ring extrusion occurred during the test interval. An alternate 0-ring material is presently being recommended for installation in Westinghouse reactor coolant pu=p seals. The alternate caterial has thermal properties which are better than the presently installed 0-ring material. Tests of an alternate ca.terial at the AECL laboratories showed acceptable high temperature extrusion performance for test durations greater than 18 hours. EXPECTED SEAL Let#AC PrrES The expected response of the reactor coolant pump seals following a loss of - seal cooling is based on experimental results supplemented by aralytical efforts. The leakage rate is expected to increase from the initial value of 3 gpm to approximately 60 gpm ( or less ) during the initial seal heatup and then quickly return to approximately 21 gpm. The leak se spike to 60 gpm has a half-width of less than 2 minutes. Thereafter, the leakage is expected to remain at approximately 21 gpm as long as reactor coolant system pressure is

maintained at the operating level. Reductions in reactor coolant system pressure due to natural depressurization or operator actions to provide a controlled cooldown of the system will result is lower leakage rates that correspond to the lower system pressures. At approximately 600 psia system pressure, the leakage rate is expected to be approximately 10 gpm. As previously noted the seal leakage rates expected following a loss of seal cooling are based cn experimental evidence. A full scale test was performed at the EDF Montereau Power Station in France using a 7 inch reactor coolant pump seal and 0-ring material manufactured in Europe to the Parker E-515-80 specification. The results of this test showed that the leakage rate through the seal assembly followed the transient flow spike response as described above, but the high temperature, high pressure leakage stabilized at 16 gpm. The seal assembly was subjected to high system pressures and temperatures for a 24 hour period. The experiment consisted of an initial period of approximately 3.5 hours at 540 degrees and 2250 psia. This was followed by a 3.5 hour cooldown period during which the system pressure was reduced to approximately - 600 psia and the system temperature was reduced to 470 degrees. This condition was then maintained for 18 hours after which the experiment was terminated and temperatures and pressures were reduced to atmospheric. The post-experiment tear-down of the seal assembly revealed no major degradation of either the seal surfaces or the 0-ring material. POTEhTIAL SEVrRe LEAVAGE RA rEs . The reactor coolant pump seal loss of cooling event has traditionally been analyzed as a condition which results in a severe pump seal LOCA. The event postulates a 300 gpm leakage rate from the pump beginning at 30 minutes after the loss of seal cooling. The 300 gpm leakage rate is based on a critical flow t & assu=ing that no 0-ring material is present, minimum seal component to.Lerances at nominal conditions, and that the #1, #2 and #3 seal are open to the maximum extent possible. This modelling of the loss of reactor coolant pu=p seal cooling is based on the assu=ption that the 0-ring material in the seal asse=bly cannot withstand the reactor coolant system te=peratures and are therefore conservatively assumed to disappear from the assembly. j 3 More recent analyses of the leakage rates of the complete seal asse=bly indicate that if the #1, #2 and #3 reactor coolant pu=p seals are open to the full extent of their travel at reactor coolant system te=peratures, a leakage rate of 480 gpm is possible. A mechanistic review of the reactor coolant pump seal performance following a loss of all seal cooling indicates that such large leakage rates are highly improbable. In order to postulate these very large leakage rates, the #1 seal must jam in the open position, and the #2 seal must enter the film riding mode of ( operation. Both of these occurrences are contrary to the analysis and experimental results. High temperature degradation of the 0-ring material may occur resultinE in the extrusion of these materials. Extrusion of the 0-ring material could cause the seal rings to become jemmed in a fixed position. t

                                                        . - _ , _ , . . . , , . - . , _ . _ . _ .      _ ., , . - _ . - -_ ,,._c-.   . _- ..,

4 i Thermal growth motions between the reactor coolant punp shaft and housing could then mehanistically change the separation between the seal face-plates resulting in an increase in the leakage rate. However, at this early stage of } the event, no significant degradation of the 0-rings and channel seals is expected. Furthermore, extrusion of the 0-ring material is not expected to result in binding of the #1 seal runner on the reactor coolant pump shaft. Additionally, thermal growth motion between the reactor coolant puup shaft and ! housing is in the direction of increasing the face-plate separation on during 1 the initial transient heatup of the seal system. Finally, the #2 seal is expected to rotate to a closed, rubbing surface mode of operation, even if the

                 #1 seal is janmed open. Thus the high leakage situation is predicted to have a low probability of occurrence.
,              ' Degradation of the 0-ring materials due to high temperatures is like5y to

^ result in a situation in which' the #1 seal performs as intended. Increased leakage through the #1 seal may occur as a result of the loss of back-pressure in the area between the #1 and #2 seals due to the degradation of the 0-rings.

Analysis of 0-ring failures indicates that most 0-ring failures would not impact seal integrity. Only the failure of a few critical 0-rings could lead to increased reactor coolant pump seal leakage. A mechanistic evaluation of the 0-ring degradation shows that the 0-rings would be expected to degrade in a , sequential fashion. Estimates of the leakage rate would be expected to increase if the critical 0-rings undergo degradation fron; approximately 21 gpm to 35 gpm the first critical 0-ring degrades at approximately two hours . following the loss of all seal cooling. As sequential critical 0-rings degrade, the leakage would increase to approximately 60 gpm. At this time, the

                #2 reactor coolant pump seal is expected to remain in the rubbing face mode and the leakage would stabilize at approximately 60 gpm. However, if the #2 seal goes into a film-riding mode and opens due to the pressure in the area between the #1 and #2 seal an increase in the leakage rate to approximately 175 spm would occur. Tne leakage rate would be expected to remain at this level for the duration of the event.

RECOVERY OF REACTOP C00LAhT PUMP SEAL COOLING ^ The specifications for restoration of seal injection cooling of the reactor coolant pump seals is 1 degree per cinute and is based on limiting the thermal ~

                                                                                                                  )

stresses in the #1 pump seal to acceptable values. Cooling at a rate greater than 1 degree per minute may result in significant degradation of the seal 1 integrity as a result of high thermal stresses. Since there is a 10 to 15 l minute thermal capacitance in the reactor coolant pump seal thermal barrier :I heat exchanger, restoration of seal injection during this time should not result in a significant degr,adation of the seal integrity. However, restoration of full seal flow injection at times after the #1 seal has i equilibrated at reactor coolant temperatures could result in cooling rates in i excess of the specified limits. For loss of seal cooling everts of duration , greater than 10 to 15 minutes, cooling of the seal area by restoration of

• i I

component cooling water flow to the thermal barrier heat exchanger or by ' cooldown of the reactor coolant system at the specified limit of 50 degrees per j hour will result in seal cooling within acceptable limits. . k d }  !! 1 N i

CONCLl]SIONS The following conclusions can be drawn based on the experimental and analytical evidence gathered with respect to reactor coolant pump seal integrity under loss of seal cooling conditions:

1) Loss of seal cooling for time periods less than 15 to 20 minutes is not expected to result in any significant degradation in the reactor coolant I punp seal integrity.  !

2) Loss of seal cooling for extended time periods is expected to result in a steady state leakage rate of approximately 21 gpm at reactor coolant system operating temperatures and pressures. Operator actions to depressurize the reactor coolant system will reduce the long term leakage to approximately 10 gpm at 600 psia.

3) Large pump seal leakages of approximately 480 gpm are only possible for -

the case in which it is postulated that the #1 seal jams in a wide open position with the subsequent full opening of the #2 and #3 reactor coolant ptanp seals. This is considered to be a very low probability event.

4) Degradation of the 0-ring material due tn exposure to reactor coolant system temperatures will only result in a change in seal integrity if the degradation occurs in a few critical 0-rings. Degradation of most 0-rings .

will not impact the overall seal integrity.

5) For the case of degradation of the critical 0-rings, the pump seal leakage is expected to increase progressively from approximately 21 gpm at 2 to 2.5 hours after the loss of seal cooling to approximately 60 gpm. At this time the #2 reactor coolant ptanp seal would be predicted to remain in the rubbing surface mode and the leakage rate would stabilize at this value. However, if the #2 seal enters the film-riding mode due to the increased pressure in the area between the #1 and #2 seals, the seal leak rate is prec'icted to be approximately 175 gpm. No further increase in pump seal leakage is predicted after this time.

6) Restoration of pump seal cooling via seal injection is only recommended if the cooling can be restored within 10 to 15 minutes. Pump seal cooling after this time should only be attempted via standard procedures.

Restoration of pu::p seal cooling via seal injection after 10 to 15 minutes may result in degradation of the #1 pump seal integrity with attendant high i leakage rates.

8) The best estimate reactor coolant pump seal response to a ccc .ete loss of cooling incident is the same for those pumps with the new alternate seal material and those with the old seal material (Parker Specification  ;

E-515-80). The new seal material provides a greater degree of confidence - that the seal assembly response will be as predicted, compared to the seal response using the older naterial. 1 i

                                                                                                                                                                      +

t ,I . n ,~ . - , , - - , , - - , - -. . . , ~ . - . . , , - . , n-,--, . . -- . . - -- - , - , - --,,--,.,a- - , , . - -- - . . - - - , -

APPENDIX D . L ,1 '0 MILLSTONE UNIT 3 STATION AC BLACKOUT ASSESSMD.T

NORTHEAST UTILITIES o.nere on c.. . s.io.n su t. sen.n. conn.ci cui

              )v$.7EbNaNc cUa~--                                        P.O. BOX 270
              =******o**N HARTFORD. CONNECTICUT 06141-0270 L    L   J  7 ,C 2.N, g                                               (2 @ 66 5 5000 December 31,1985 Docket No. 50-213

_50-245 30-336

                                                      ~'

50-423 '- B11930 - Mr. Harol. R. Denton Director of Nuclear Reactor Regulation U.S. Nu-lear Regulatory Commission Washington, D.C. 20555 Gentlemen: Haddam Neck Plant Millstone Nuclear Power Station, Unit Nos.1,2 and 3 Effects of Hurricane " Gloria" .' On September 27, 1985 Hurricane Gloria moved through Connecticut with sustained As reported winds of up in License to 58 Event mph(LER) Reports and gusts of vo to 85-018-00(1) and 7585-014-00,(2 mph at the Millstone site} Millstone Unit Nos. I and 2 experienced loss-of-off-site power (LOOP) events as a result of Hurricane Gloria. In order to maximize the extent to which the insights derived from assessing this event can be appropriately factored into the Staff's ongoing efforts to resolve Unresolved Safety Issue (USI) A-44, Station Blackout, Connecticut Yankee Atomic Power Company (CYAPCO) and Northeast Nuclear Energy Company (NNECO) are providing this informational letter to more fully explain the details associated with the effects of Hurricane Gloria. Precarations for the Storm . On September 26, 1985, the Millstone site hurricane action plan was

    -tmplemented. The hurricane action plan included a checkout of the Emergency Response Facilities (ERF), the selection of two Station Emergency Organization (SEO) shifts and successful testing of the emergency on-site AC power sources.

At 1500 hours on September 26, 1985 the National Weather Service declared a Hurricane watch for Connecticut and the on-call emergency organizations for the Millstone site, the Haddam Neck Plant and the Corporate Emergency Operations Center were notified to report to duty stations at 0700 hours on . l-September 27,1985. ' l (1) W. D. Romberg letter to U.S. NRC concerning LER 50-245/85-018-00, dated October 25,1985.  : l (2) W. D. Romberg letter to U.S. NRC concerning LER 50-336/85-014-00, dated October 25, .!985. [

1 l l The following points summarize the more important elements of our preparatory activities: o By 0700 hours on September 27, 1985, all Millstone ERFs were manned and ready. o At 0745 hours, based on predictions that the storm would reach the Millstone site between 1600 and 1700 hours, the decision was made to bring all units at Millstone and Haddam Neck to a shutdown condition. I i o At 0815 hours each corporate EOC Manager was requested to prepare contingency plans for dealing with a possible loss of communications and/or loss of off-site power sources for each unit. o At 0830 hours the Governor declared a " State of Emergency" in Connecticut. . o At Millstone, all power was secured to nonessential plant areas at 0843 hours. The hurricane was being tracked east of New Jersey at 0845 hours and was moving north at 30 mph. The winds at Millstone were determb-d to be 29 mph (lower level) and 40 mph (upper level of approximately 142 2e-t) at 0915 hours. o Twelve hour shift rotations were established for all Corporate EOC functions. o The National Weather Service issued a tornado watch for all of Connecticut for the hours between 1000 and 1800 hours. o In order to assure the availability of service water following the storm, preventative measures were taken to protect the integrity of the service water system during the storm o The power level at 1030 hcurs was 25% for Unit I and 43% for Unit 2. o At 1040 hours the Millstone meteorological conditions included 40 mph winds at the lower level and 50 mph at the upper level. The speed of the eye of the storm was estimated at 40 mph. o The Millstone Unit O. I gas turbine was successfully tested at 1045 hours. o Millstone Unit No. 2 was taken off-line at 1112 hours- -- o Millstone Unit No. I was aken off-line at 1140 hours. o The Millstone EOF shifted to emergency power at 1216 hours. o At 1220 hours the winds at Millstone were determined to be 49 mph at the lower level and 57 mph at the upper level. o Mllistone Unit No. 2 shutdown at 1227 hours. Both units were shutdown by 1255 hours.

                                                                                                                                       ~                            .      l l

l Details of LOOP Events At Millstone Unit Nos. I and 2, the first or " preferred" source of off-site power is supplied via each of the unit's reserve station service transformers (RSST). At Millstone Unit No.1, an alternate source of off-site power is via the Flanders line, a distribution line originating in the Flanders Substation, approximately 5 miles from the Millstone site, and terminating at Millstone Unit No.1. On September 27, 1985, at 1028 hours, the Flanders line to Unit No. I was intermittently lost. o At 1250 hours there was voltage fluctuation on the 345 kV line supplying the switchyard. o At 1300 hours the Milletone Unit No. 3 RSST was sparking. o At 1307 hours Millstone Unit No. 2 was proceeding to natural circulation, o At 1317 hours Millstone Unit No. 2 manually disconnected from the RSST. Both of the Unit No. 2 emergency diesel generators automatically started and loaded, o At 1334 hours Millstone Unit No.'1 lost normal power and both the emergency diesel generator and the gas turbine automatically started and loaded (additionally, both of the Unit No. 3 emergency diesel . generators automatically started). j o At 1300 hours the Millstone lower level winds were 49 mph and the upper

level winds were 59 mph.

Recoverv From LOOP Events The Station Emergency Organization had been activated and in place since j 0700 hours on the morning of the storm to ensure that all actions taken were performed under a coordinated and planned effort. Extra personnel were kept at the station to provide assistance and all non-essential personriel were sent home well before the peak of the storm hit the area. A relief schedule was prepared and put into effect which provided for adequate relief for those who remained at the station during the storm.

Mi!! stone Unit No.1

             .The Millstone Switchyard was reenergized at 2000 hours on September 27, 1985.

i The 23 kV Flanders line into Unit No. I was teenergized at 1705 hours on September 27,1985; however, operators elected to stay on emergency AC power.  ; This decision was based on the exce!!ent performance of all 3 units' emergency i AC power sources and the stable configuration of d.e plant. This allowed the  ;

unit to stay with the emergency power source until the RSST was energized via the switchyard. Unit No. I energized its RSST at 0910 hours on September 28, 1985, following a complete washdr - of switchyard and station insulators.

I While the unit relied on on-site power for approximately 20 hours, off-site power,if needed, could. have been restored via the Flanders line within 3M hours. i k i i 4 l

                        ,   _..._ ..        ._.- . . . . . ~ . _ _ . . ,     , _ . _,           ._.,m.                   . . _ . . _ -   _ _ . . . - , , , . ~ , , _ _ ~ .

Millstone Unit No. 2

                                                                                                 )

The Millstone Switchyard was reenergized at 2000 hours on September 27, 1985. The 23 kV Flanders line mto Unit No. I was reenergized at 1705 hours on September 27,1985. At 1330 hours on September 27 natural circulation had been verified in the Millstone Unit No. 2 Reactor Coolant System, with heat removal via both steam generators. The steam generators were being supplied with feedwater by the electrically driven auxiliary feedwater pumps. The auxiliary feedwater system functioned normally with an adequate supply of water being maintained in the condensate storage tank.

Normal off-site power via the RSST was restored to Millstone Unit No. 2 at 1527 hours (on September 28, 1985) following a complete washdown of the outside transformers, transmission lines, switchyard circuit breakers, and the replacement of several damaged lightning arresters.

At the Millstone units, there are no automatic features which will energize any . of the buses via the " alternate" off-site AC power sources since the decision to utilize an alternate off-site AC sources is based on an operator assessment of the situation. In the case of Hurricane Gloria, emergency on-site AC power source performance was excellent, thus operations personnel did not elect to utilize their alternate sources of off-site power, which in all cases were

  ,    available earlier than the " preferred" sources. It is possible to provide Flanders line ~ power to Unit No. 2 via the Unit No. I outdoor bus at its' connection to Unit   ',

i No. 2. This requires the defeat of several interlocks. However, it is an option that the EOC support team mentally exercises during each training drill, and in the event resulting from Gloria, also considered. Conservatively,2 hours would be required to complete this connection. Thus, Millstone Unit No. 2 could have had off-site power restored, if needed, within SM hours. While the unit relied on on-site power for approximately 26 hours, off-site power, if needed, was available within SM hours. As noted by the Staff during the November 14, 1985 Commission briefing on the resolution of USI A-44, this decision allowed for power to be restored in a prudent fashion:

            "...they did in anticipation of some of the salt spray shut down the plant and    .

'. they took some very prudent procedures in restoring power. Indicated here, actual loss of time to restore was about 20 hours. They might have been able to restore power sooner but they were cleaning the salt off the switchyard, off the insulators checking the breakers before they actually went in and restored power. The diesels were operating successfully during that event." Additionally, as indicated in Inspection Report No. 50-245/84-24, Inspection Findings,

               .the licensee's actions taken in preparction for the storm were timely anc' appropriate."                                                                        :

l As indicated by the Staff, the LERs report the amount of time the plant was without off-site power without respect to when power was available if needed. { In this case for Unit No. 2, off-site power could have been restored af ter 3M hours. l l

          .                                                   Millstone Unit No. 3 On September 27, 1985 Millstone Unit No. 3 had not yet loaded fuel and accordingly did not have core cooling requirements. However, upon loss of normal power, the emergency diesel generators automatically started and loaded. The circumstances of this event had no impact on Unit No. 3 which was undergoing final preparations for initial fuel load.                                               :

1 Haddam Neck Plant . While the Haddam Neck Plant did not experience a loss of off-site power event,

                                                                                                             )

it is worth noting that the Haddam Neck Facility took essentially the same  : precautions as the Millstone Units. The EOF was staffed at 0700 hours on i September 27, 1985, and the unit was at 0% power at 1106 hours on  ! September 27,1985. The emergency diesel generators were successfully tested, . j started and operated during the storm. The unit was back on-line later that i same day. November 14, 1985 Commission Briefing on Station Blackout, USI A-44 , At the November 14, 1985 Commission briefing on USI A-44, Station Blackout, the Staff portrayed the Millstone Unit No. 2 LOOP as having a duration of approximately 20 hours. Additionally, the Staff indicated that Hurricane Gloria illustrated a Staff concern with the rapid movement of some severe weather i events and the potential for inadequate time to take precautionary measures. ' 1 As discussed above, Hurricane Gloria, while being a rapidly moving storm, was tracked and there was ample time to take precautions such as orderly plant shutdowns, and preheating and starting the emergency on-site AC power sources. Due to the precautionary actions taken before Gloria arrived, the Millstone Units ' were in very stable conditions during the LOOP events and were able to proceed to restore off-site power in a deliberate and orderly Iashion, j While the units relied on on-site power for approximately 20 hours, off-site power, if needed, would have been restored within 35 hours for Millstone Unit , No. I and within 55 hours for Millstone Unit No. 2. The Staff also indicated tl$at NNECO had implemented corrective actions .. following a similar storm, Hu ricane Belle, in 1976. Following Hu ricane Belle, NNECO assessed the results of a lack cf effective rainfall during a storm which would cause a buildup of salt spray in the switchyard. As a result of the ' assessment, NNECO: o Installed salt monitors in the switchyard and o Installed new equipment in the switchyard to increase creep path, i.e.,

• increase resistance to ground. Specifically, NNECO a) installed the largest commercially available glass insulators in the switchyard; -

I b) replaced switchyard circuit breakers to provide better insulation  ! capability and c) replaced transformer bushings between the unit,and the  ! switchyard. These modifications and precautionary actions taken prior to the event enabled , NNECO to respond to the recent LOOP event at the Millstone Units in a prudent, l 1 I

i 1 i i deliberate and coordinated manner without jeopardizing the safety and health of either the public or company employees. I Summary , On September 27,1985 with the impending arrival of Hurricane Gloria, CYAPCO and NNECO commenced an orderly shutdown of the Haddam Neck Plant and 1 Millstone operating units. Prior to and during the reactor shutdown, i l precautionary steps were taken which included laying out supply hoses to bring , l i alternate cooling water to a diesel generator or the instrument air compressors  ! installing sand bags around doorways, closing floodgate doors, installing life lines i between outdoor buildings to ensure personnel could move safely between i i buildings when necessary, and other actions as described above. -

                                                                                                                                         ..      .        i j          As the storm reached its peak, it became evident that, because of a lack of any

, effective rainfall, a heavy buildup of salt spray was taking place as evidenced by l an increased frequency of arcing on outside transformers, switchyard . ! transmission lines and circuit breakers. Steps were taken to bring the units off-line. All the Millstone emergency on-site AC power sources successfully started and loaded and ran until prudent plant actions were completed to allow for restoration of normal off-site power. If necessary, Millstone Unit No. I could have had off-site power restored within 3M hours and Millstone Unit No. 2 cou!d have had off-site. power restored within 5M hours. Since more rapid restoration

                                      ~

i of off-site power was not vital, NNECO elected to pursue a more deliberate and ' thorough cleaning and checking restoration process. This approach was in the best interest of personnel safety of company employees. I The advance notification associated with severe weather events of this kind permits advance precautionary actions not usually credited by the Staff or in plant probabilistic safety studies. As noted by members of the Advisory Committee on Reactor Safeguards (ACRS) during the November 19, 1985 Subcommittee meeting in Waterford, Connecticut (reference pages 207 through 209 of the meeting transcript), the adva'nce warning and actions taken prior to a j severe storm arrival lead to conservatisms in a probabilistic risk assessment, and

;         perhaps, these events shou'Id be categorized in a fashion different from other i          than LOOP events.                                                                                                                   ,

l We are hopeful that the infor'mation provided above will put the September 27, 1985 events at Millstone in their proper perspective. As always, we are available i to answer any questions you may have on this matter. i Very truly yours, j CONNECTICUT YANKEE ATOMIC POWER COMPANY NORTHEAST NUCLEAR ENERGY COMPANY i I i h . b.M#

3. F. Opeka ) V l Senior Vice President i

1 .

                                                      .                               .        r--

I i [ __,__..____.,_._._.._.._._,__,,__.__.

APPENDIX E . k i l l l l MTTIST0!E UtaT 3 STATION AC BLACK 0tTT ASSESSP2ftr l l - . - _ - _ _}}