B12143, Forwards Summary of Listed Projects Evaluated for Public Safety Impact Re Isap,Including Topics 1.16, ATWS, 1.19, Crdr & 2.08, Loss of DC Power

Forwards Summary of Listed Projects Evaluated for Public Safety Impact Re Isap,Including Topics 1.16, ATWS, 1.19, Crdr & 2.08, Loss of DC Power

ML20203J922
Person / Time
Site:	Haddam Neck File:Connecticut Yankee Atomic Power Co icon.png
Issue date:	07/24/1986
From:	Opeka J CONNECTICUT YANKEE ATOMIC POWER CO.
To:	Charemagne Grimes Office of Nuclear Reactor Regulation
References
B12143, NUDOCS 8608060078
Download: ML20203J922 (23)

Text

.f- .

[

e C O N N E C T IC U'T Y A N K E E ATOMIC POWER COMPANY B E R L I N, CONNECTICUT on any un marrnan_ enuwseTicor naut.nno I ELE PHONE 203-665-5000 July 24,1986 Docket No. 50-213 B12143 Office of Nuclear Reactor Regulation Attn: Mr. Christopher I. Grimes, Director Integrated Safety Assessment Project Directorate Division of PWR Licensing - B U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Gentlemen:

Haddam Neck Plant Integrated Safety Assessment Program Summaries of Public Safety Impact Mode) Project Analyses In a letter dated July 31, 1985,(1) the NRC outlined the scope of issues to be

) for the Haddam evaluated in the Integrated Neck Plant. Subsequently, Safety in a letter Assessment dated February 14,Program 1986, (ISAP(2) we identified a selected number of topics for which we would provide the Staff with public safety risk oriented analyses.

In order to facilitate the Staff review of our project analyses, we are providing the Staff, in Attachment 1, with a summary of the following projects we have evaluated for public safety impact:

1) ISAP Topic No.1.16 " Anticipated Transients Without Scram"

2) ISAP Topic No.1.19 " Control Room Design Review"

3) ISAP Topic No.1.20 " Safety Parameter Display System"

4) ISAP Topic No.1.23 " Post Accident Hydrogen Monitor (RG 1.97)"

5) ISAP Topic No. 2.08 " Loss of DC Power" It is noted that since we have not completed our analyses of the entire set of ISAP projects, the public safety impact scores are to be considered preliminary at this time. Upon completion of our analyses of the entire ISAP project set, including all five attributes, we will review our analyses and revise our public safety impact results, if necessary, to assure consistency in the ranking of the ISAP projects.

8608060078 860724 PDR ADOCK 05000213 P PDR (1) H. L. Thompson letter to 3. F. Opeka, " Integrated Safety Assessment Program," July 31,1985.

\

(2) 3. F. Opeka letter to C. I. Grimes, " Integrated Safety Assessment Program 00 Schedule for Implementation," dated February 14,1986.

s -

As further public safety impact analyses are completed, we will promptly forward summaries to the Staff for review.

If you have any questions on this material, please feel free to contact my Staff.

Very truly yours, CONNECTICUT YANKEE ATOMIC POWER COMPANY

- h-

3. F. Opekh U i

Senior Vice President 1 t

4 I

I i

- - - . . , ..,----,,,- n- , - -, , , -

---

,,a-- - - - . - - - - - - - , - - . . - - - - - , - - - - . , , - .-

-1_

ISAP # 1.16 Anticipated Transients Without Scram Safety Issue Anticipated transients without scram (ATWS) have been recognized as potentially significant risk contributors in the operation of nuclear power plants.

Certain transients such as loss of main feedwater followed by failure of the control rods to insert could result in rapid RCS pressurization. The primary safety relief valves would be challenged under some circumstances. If the relief capacity is not sufficient, the RCS could overpressurize threatening primary-integrity. Also, failure of the relief valve (s) to reseat could result in a consequential loss of coolant accident. Certain features in the design of r.uclear plants can help to mitigate the consequences of an ATWS. Among these are automatic initiation of Auxiliary Feedwater (AFW), automatic turbine trip, (unblocked) opening of the PORV's, and more negative moderator temperature coefficient of reactivity.

Proposed Project At the Haddam Neck Plant (Connecticut Yankee (CY)), the /EW start is initiated by low level in two out of four steam generators or tripping of both main feedwater pumps. Low steam generator level is one of the conditions that is indicative of an ATWS. This initiation circuity is diverse and independent from the Reactor Protection System (RPS) and therefore meets the ATWS rule requirement. The existing turbine trip does not meet the requirement of the ATWS rule since there is no turbine trip signal that is indicative of ATWS and independent from the RPS. In earlier analysis, the following modification was proposed to meet the turbine trip requirement.

The automatic AFW initiation circuitry is to be modified to include a trip circuit that will trip the turbine on steam generator low level with a 2 out 4 taken twice logic. This modification entails the installation of two additional trip relays in the AFW initiation circuitry as well as the addition of another steam generator level channel per steam generator. The modification would bring CY into conformance with regulations [ Reference 1].

CONNECTIClTr YANKEE {

t __ _ _ _ _ . _ _ _ _ _ _ _ _ _

I!EEGRATED SAFETY ASSESSMENT PROGRAM )

Analysis of Public Safety Impact In the CY PSS (Reference 2) the effect of turbine trip is only modeled through tne proDaoility of the lifting of the pressurizer safety valves. Witn successful turbine trip and adequate feedwater, the safety relief valves would not be challenged. If the valves lift and fail open, it is conservatively assumed that core melt results. On other event trees, this sequence is denoted by consequential small LOCA, and is transformed to a new event tree by the same name. The reason for this conservatism was to simplify the analysis for sequences with low frequencies. Other than the effect on safety valve lifting, turbine trip does not significantly impact accident progressions and the final plant damage states.

With failure of automatic scram, the failure probability of the turbine to trip is estimated as 0.15 currently. The operators will attempt to manually scram the reactor (with cach reactor trip the operators are instructed to push the manual scram button). Based on generic studies, it was postulated that there is a 50% chance that the control rods will still fail to insert. These are referred to as mechanical causes for the failure of control rods to insert and are assumed to be non-recoverable.

Two types of ATWS event trees are explicitly considered. One combines several transients that are followed by failure of automatic scram into one single ATWS event tree. Another considers loss of offsite power followed by failure of automatic scram. A brief description of potential scenarios follows.

i Since the failure of the operator to attempt to manually scram the reactor has a low probability (1.0E-3 per demand), only sequences with successful operator action are probablistically significant. If main feedwater (MFW) is available, the pressurizer safeties will not lift. Thus, the effect of an additional turbine trip feature on sequences with MFW available is minimal.

In the CY PSS, all ATWS sequences are assigned to two plant damage states designated as TE r.nd TEC. The letter C stands for "with Containment Heat Removal". TE designates transients followed by early core melt (less than two hours). The probability of failure of containment heat removal is small (less i CONNECTIClTT YAPEEE INTEGRATED SAFETY ASSESSMEfff PROGRAM

-3 than 1.0E-4). Thus, the frequencies of TE sequences are small and negligible.

The impact of turbine trip modifications is estimated below. It is noteworthy that the proposed turbine trip feature should be activated sooner than about 40 seconds after reactor trip in order to prevent the lifting of the pressurizer safety valves. The proposed modification to trip the turbine on low steam generator level may not meet this goal with sufficient time margin. The failure of turbine trip is only significant in ATWS events that entail loss of the main feedwater system. For this reason it may be more appropriate to tie the additional trip circuitry to the status of the main feedwater pumps. If the main feedwater pumps tripped, a turbine trip signal would be generated (perhaps with some short time delay).

There are only two sequences that will be significantly affected by this design modification. These are [ Reference 2]:

o Sequence 1 - path number 32 of event tree 22:

A transient followed by failure to scram (automatic and manual),

failure of MFW, failure of turbine to trip, and failure of the pressurizer safety valves to reseat. Auxiliary Feedwater is available.

o Sequence 2 - path number 32 of event tree 25:

This is identical to sequence 1 with the exception that it is initiated by loss of offsite power.

f I

l The decrease in the core melt frequency is estimated by assuming that the probability of safety valve opening decreases by a factor of 10 as a result of the modification. Note that this is the maximum impact since these are not l

actual core melt events unless they are combined with additional failures. The l decrease in the frequency of the TEC plant damage state for Sequence 1 is then given by:

AF 3 = (3.68 yr-l)(3.8E-5)(.506)(.11)(.15)(1 .18)(.2)(1 .1)

= 1.7E-7 yr-I where CONNECTICUT YANKEE I IEEGRATED SAFETY ASSESSMEE PROGRAM J

~ '

' total transient event frequency = 3.68 yr-l probability of failure of automatic scram = 3.8E-5 probability of failure of manual scram = 0.506 i

given failure of automatic scram unavailability of MFW = 0.11 probability of failure of turbine trip = 0.15 given failure of scram unavailability of AFW = 0.18 (both pumps to all steam generators) probability of stuck open safeties = 0.2 given two lift probability of safety valve lifting = 0.1 with automatic turbine trip upgrade For Sequence 2, the decrease is given by:

AF 2 = (0.17 yr-l)(1.9E-5)(1.0)(.15)(1 .18)(.2)(1 .1)

= 7.2E-8 yr-l where loss of offsite power frequency = 0.17 yr" probability of failure of control rods = 1.9E-5 to drop following LOSP unavailability of MFW = 1.0 probability of failure of turbine trip 0.15 given failure of scram unavailability of AFW = 0.18 (both pumps to all steam generators) probability of stuck open safeties = 0.2 given two lift probability of safety relief valve = 0.1 lifting with automatic turbine trip upgrade CONNECTICUT YANKEE INTEGRATED SAFETY ASSESSMENT PROGRAM

The total frequency reduction is therefore equal to:

AF = AF3 + AF2

= 1.7E-7 yr- + 7.2E-8 yr-

= 2.4E-7 yr-l .

The above quantification does not include the potential for increased public risk as a consequence of the increase in inadvertent turbine trip frequency.

It can be shown that for this contribution to be comparable to AF quantified above, the turbine trip frequency has to increase by about 2 yr . This is clearly several orders of magnitude larger than the actual potential increase in inadvertent turbine trips.

Results The TEC plant damage state which would be reduced by this modification is in Consequence Category 5. This equates to a public consequence of 2.8E+3 man-rem. The net decrease in public risk is given by:

R = 2.4E-7 yr- x 2.8E+3 man-rem x 20 yr = 1.3E-2 man-rem which is negligible. Note that this number was obtained despite the very conservative modeling assumption that all ATWS induced consequential LOCA's l lead directly to core melt. This project ?ceives a score of zero in its j public safety impact.

l I

i l

i l

l CONNECTICUT YANKEE

! IEEGRATED SAFETY ASSESSMEE PR0 GRAM

.. __ _ .~ . - . . -

Referetxes

1. 49 Federal Register 26044, June 26, 1984; 49 Federal Register 27736, July 6, 1984.

2. J.F. Opeka letter to C.I. Grimes, "Haddam Neck Plant Probabilistic Safety

, Study - Sunmary P.eport and Results," Decket No. 50-213, dated March 31, 1986.

t G

I l

l l

l l

l l

l i

CONNECTICUT YANKEE INTEGRATED SAFETY ASSESSMENT PROGRAM

ISAP #1.19 Control Room Design Review Safety Issue The safety issue which led to the desire to perform systematic control room design reviews (CRDRs) was the recognition that the control rooms in many nuclear power plants contain significant human engineering deficiencies. These deficiencies can compromise the ability of the control room to provide safe and effective facilities during emergency operations and can impair the emergency response capabilities of the control room operators. Such human engineering deficiencies have been identified as the root cause behind:

o unintentional plant shutdowns and transients caused by operation of the wrong device by a control room operator, o unintentional disabling of decay heat removal and engineered safeguards systems due to operator errors while manipulating controls, and o premature termination of engineered safeguards systems due to cognitive errors arising from incorrect interpretation of control board instruments.

P(vy&,ed Project The proposed project involves a systematic review of the Haddam Neck plant (Connecticut Yankee (CY)) control room design. The CRDR will encompass the criteria and guidelines of NUREGs 0737 (Supplement 1), 0700 and 0801 for existing design and all the contemplated (present and future) modifications.

The outcome of the review will be the identification of recommendations for possible control room design changes. The evaluation of this project is based on the implementation of these recommendations.

As specified in the CRDR Implementation Plan (Reference 1), the review will consist of the following:

1. Establishment of a qualified multidisciplinary review team.

CONNECTIClTT YANKEE INTEGRATED SAFETY ASSESSMENT PROGRAM

, 2. Performance of task analysis to identify control room operator tasks and information and control requirements during emergency operations.

3. A comparison of the information and control requirements with the control room inventory to identify discrepancies.

4. A control room survey to identify deviations from accepted human engineering guidelines.

5 Assessment of human engineering discrepancies (HEDs) to determine which HEDs are significant and should be corrected.

6. Selection of design improvements and establishment of i implementation schedules.

7. Verification that selected design improvements will provide the necessary correction.

8. Verification that improvements will not introduce new HEDs.

9. Coordination of control room improvements with other programs such as Safety Parameter Display System (SPDS), operator training, Regulatory Guide 1.97 instrumentation, and upgraded emergency operating procedures.

Analysis of Public Safety Impact The public safety impact of this proposed project was assessed using Method A of the Public Safety Impact Model to determine a theoretical maximum benefit i

from implementation of the recommendations of the CRDR. Engineering judgement was then utilized to determine a "best estimate" benefit from performance of l

the CRDR.

The severity of the human engineering discrepancies in the control room can be characterized by the corresponding quality of the man / machine interface. The l

l l

l CONNECTICUT YANKEE INTEGRATED SAFETY ASSESSMENT PROGRAM

[

CY Probabilistic Safety Study (PSS) (Reference 2) incorporated a number of

, cognitive operator actions (OA's) and manipulative operator actions (HI's).

The error probabilities associated with these operator actions were adjusted by l the quality of the man / machine interface in the control room. These adjustments were quantified using the Human Cognitive Reliability (HCR) Model i

(Reference 3). Information obtained from the CY PSS indicated that the man / machine interface in the control room is generally considered to be fair.

Assuming the recomendations from the CRDR would at best raise the quality of the control room interface from fair to good, the HCR model specifies that the affected operator action error probabilities would be decreased by a factor of 1.44. From Table 1.3.2-1 of the CY PSS, the risk reduction worth of all the operator actions is found to be 1.70. The following formula for calculating l

change in core melt frequency was used:

AF = (1-1/R)(P/Pg-1)F g where, AF is the change in core melt frequency, R is tM risk reduction worth, I P is the new availability of the quantity being evaluated, P

g is the present availability of the quantity being evaluated, and Fg is the present total core melt frequency.

For this evaluation, R is 1.70, as seen from above. When considering all operator action error probabilities, the quantity "P /P" g is 1.44, again from above. From Section 6.3 of Reference 2, F g is seen to be 5.48E-04 per year.

Therefore, the change in core melt frequency, AF, is determined as follows:

AF = (1-1/1.70)(1/1.44-1)(5.48E-04/yr) = -6.89E-05/yr.

Therefore, the maximum expected benefit from the implementation of the recommendations of the CRDR is a decrease in core melt frequency of 6.89E-05/yr. Sequences that belong to some of the most risk dominant plant damage states (i.e., V, V1, V2 and TE) are insignificant 1y affected by human errors. Assuming that the core melt sequences centaining the operator actions

! CONNECTICUT YANKEE I IEEGRATED SAFETY ASSESSMEE PROGRAM

are randomly distributed across the remaining spectrum of release categories, a weighted release value of 1.9E+04 man-rem is obtained. The expected benefit (R) from implementation of the CRDR can then be calculated using the Public Safety Impact Model as follows:

R = T x AF x C ave where, R is the total change in public risk (man-rem),

T is the remaining plant life (20 years),

e~ is the change in core melt frequency, and C

ave is the average consequences of all core melt accidents, except those in plant damage states V, V1, V2 and TE.

Therefore, R=(20 years) (-6.89E-05/ year) (1.9E44 man-rem) = -26 man-rem.

It should be noted that the reduction in public risk calculated above is a theoretical maximum. In reality there are additional factors which can affect the potential benefit from performing a CRDR. The most significant of these factors are discussed below.

1. Over the life of a plant improvements are typically made based on actual discrepancies in the man / machine interface in the control room. Therefore, those discrepancies indicated by actual experience will already have been identified and corrected. However, no comprehensive evaluation of the CY control room man / machine interface j has been made. Therefore, discrepancies could exist which would only be evident during emergency situations that have not yet occurred at the plant.

2. Validation of the new Emergency Operating Procedures (EOP's), already being undertaken at the CY simulator, should find any obvious discrepancies that would exist under emergency or accident conditions. However, the charter for the E0P validation does not include provision for a systematic evaluation of the human factors t

l l CONNECTICUT YANKEE l IEEGRATED SAFETY ASSESSMEE PROGRAM

design of the control panel. As such, many less obvious discrepancies might go undetected.

Significant changes in the control room can lead to short or long term 3.

increases in risk due to operator unfamiliarity. However, implementation of CRDR recommendations would most likely involve one of the following: paint and tape used to highlight certain indicators or controls, installation of new indicators or controls, or physical relocation of existing indicators or controls, or changes made to existing indicators or controls for control board consistency (e.g.,

control closes a valve when operated in the clockwise direction versus the counter-clockwise direction). Our human factors review has concluded that the first two of these changes would have no negative impact on human reliability, and the third would have, at most, very minimal negative impact. The fourth is viewed to have some minimal negative, but unquantifiable impact.

The incorporation of these factors into the safety benefit analysis requires the use of engineering judgement. It is therefore assumed that current or prior identification of control room man / machine interface discrepancies reduces the theoretical maximum benefit from performing a CRDR by a factor of 2.

Results Considering that any control room improvements made as a result of actual experience or E0P step-through would not have been based on risk considerations, any discrepancies identified during the CRDR can be assumed to be randomly distributed across the spectrum of risk significance. Therefore, i using the maximum benefit results from Method A and using engineering judgement _

to incorporate the additional factors to be considered, this issue has an expected pubic safety benefit of 13 man-rem. This corresponds to an ISAP rating of 0.3 on a scale of -10 to 10.

CONNECTICUT YANKEE INTEGRATED SAFETY ASSESSMEhT PR'0 GRAM

I' s

References '

1. " Control Room Design Review Implementation Plan," Haddam Neck Plant, I

Connecticut Yankee Atomic Power Company, February 28, 1986.

2. J.F. Opeka letter to C.I. Grimes, ~ "Haddam Neck Plant. Probabilistic Safety Study - Summary Rep' ort and Results," Docket No. 50-213, dated March 31, 1986.

3. " Human Cognitive Reliability (HCR) Model for PRA Analysis," NUS-4531, Draft, December,1984 ,

l l

I

'1 4

CONNECTICUT YANKEE IEEGRATED SAFETY ASSESSMEE PROGRAM

ISAP #1,20 Safety Parameter Display System Safety Issue During abnormal and emergency conditions control room personnel may encounter difficulty in determining the safety status of a plant and in assessing whether abnormal conditions warrant corrective action to avoid a degraded core. This can be particularly important during anticipated transients and the initial phase of an accident. In the plant control room, under these conditions, there may be some difficulty in focusing on the indicators of critical safety function status due to the large number of indicators and alarms that are active in an emergency. The Safety Parameter Display System (SPDS) is intended to aid control room personnel under these conditions.

Proposed Project The proposed project involves the design and installation of an SPDS. The analysis of the SPDS is based on the assumption that the process computer at the Haddam Neck Plant (Connecticut Yankee (CY)) is replaced. The SPDS is not compatible with the current process computer at CY. This analysis also assumes that operations personnel will be trained to incorporate the SPDS into their various decision-making processes.

The principal objective of the SPDS for Connecticut Yankee is to aid the control room operating crew in monitoring the status of the Critical Safety Functions (CSF's) that constitute the basis of the plant-specific, symptom-oriented E0Ps. It is important to note that the SPDS is not the primary source of CSF status. Plant control boards are the primary source of plant information. However, an effectively implemented SPDS can be a useful aid in determining CSF status and executing related E0Ps.

The SPDS monitors the following six CSF's: Suberiticality, Core Cooling, Heat Sink, RCS Integrity, Containment, and RCS Inventory. The SPDS also continuously monitors the status of Radioactivity Release at the plant.

Information from the SPDS is available to the shift supervisor or other operations personnel via any of 4 color / graphic terminals in the control room.

CONNECTICUT YANKEE IEEGRATED SAFETY ASSESSMEE PDOGRAM

A set of seven lights, one for each CSF and Radioactive Release, will appear on the bottom of the terminal screens if there is a change in CSF status. The light associated with the particular CSF that has changed status will blink to call attention to it. Pressing of the dedicated key associated with a particular CSF will display that CSF's mena, which contains a list of supplementary displays. The SPDS provides indication of data reliability through the use of quality labels, color coding and off-scale indicators.  ;

Analysis of Public Safety Impact  ;

l An effectively implemented SPDS can be a usefbl aid in helping an operator determine CSF status and execute related E0Ps. The CY Probabilistic Safety Study (PSS) (Reference 1) identified a number of risk significant cognitive operator actions (OAs). It is exactly this type of decision-making error that l can most benefit by a properly utilized SPDS. A list of the OAs used in the CY PSS can be found in Table 5.2.1-1 of Reference 1. It is difficult to quantify the effect that the SPDS will have on the individual OAs without a comprehensive analysis. However, given the nature of the OAs and the design of the SPDS, our human factors review has concluded that these human error probabilties can be reduced, on average, by at least a factor of 3. Reducing all OAs in the CY PSS by a factor of 3 results in a reduction in total core melt frequency of approximately 7.4E-05 per year. Sequences that belong to some of the most risk dominant plant damage states (i.e., V, V1, V2 and TE) are insignificantly affected by human errors. Assuming that the core melt sequences containing the OAs are randomly distributed across the remaining spectrum of release categories, a weighted release value of 1.9E44 man-rem is I

obtained. The expected benefit (R) from implementation of the SPDS can then be calculated using the Public Safety Impact Model as follows:

l R = T x AP x C ave 1

where, R = total change in public risk (man-rem) l T = remaining plant life (20 years)

AP = change in core melt frequency CONNECTICT YANKEE INTEGRATED SAFETY ASSESSMENT PROGRAM

C ave

= average consequences of all core melt accidents, except those from plant damage states V, V1, V2 and TE.

Therefore, R = (20 years)(-7.4E-05 per year) (1.9E4 4 man-rem)

= -28 man-rem.

Results The expected benefit to public safety from implementation and proper utilization of an SPDS is a reduction of 28 man-rem. This corresponds to a ranking of 0.6 on a scale of -10 to 10.

Refer 1mces

1. J.F. Opeka letter to C.I. Grimes, "Haddam Neck Plant Probabilistic Safety Study - Summary Report and Results," Docket No. 50-213, dated March 31, 1986.

i l

l l

l l

l CONNECTICUT YANKEE l

INTEGRATED SAFETY ASSESSMENT PROGRAM

[, ,

ISAP #1.23 Post-Accident Hydrogen Monitors Safety Issue During the course of an accident, monitoring of certain plant parameters is necessary for proper diagnosis and control of the accident. The specific parameter of concern here is the concentration of hydrogen in the containment.

Excessive levels of hydrogen in the containment can lead to a hydrogen burn end potential breach of containment and large scale radioactive release.

Therefore, this issue considers the installation of containment hydrogen monitors to follow the course of an accident.

Proposed Project The proposed project is to provide the supplemental design, procurement, and installation effort necessary to install redundant containment hydrogen monitors that will demonstrate conformance to the criteria of NUREG-0737 (Reference 1) and Regulatory Guide 1.97, Rev. 2 (Reference 2).

Analysis of Public Safety Impact Two situations in which hydrogen generation could be a problem were considered. The first situation is following a design basis loss of coolant accident (LOCA). Hydrogen generation following a design basis LOCA was evaluated in the Haddam Neck plant (Connecticut Yankee (CY)) Combustible Gas Control Evaluation (Reference 3). Based upon the very conservative evaluation included in this report, it was determined that the hydrogen concentration

, inside containment would not reach the flamable limit until thirteen (13) months after the time of the design basis LOCA. Even though this number may be

! reduced by several months due to additional evaluation, installation of containment hydrogen monitors would produce no significant safety benefit following a design basis LOCA. The second situation in which hydrogen generation can be a problem is following a core melt accident. Again from Reference 3, a 4 percent by volume concentration of hydrogen is necessary to support the upward propagation of a flame in an oxygen-rich environment (using CONNECTICUT YANKEE IEEGRATED SAFETY ASSESSMEE PROGRAM

the very conservative assumption that there is no water vapor present in the containment). Given CY's containment volume, a 4% volume concentration translates into the generation of 475 lbm of hydrogen. Following a design basis LOCA, Reference 3 calculates a short term generation of 62.7 lbm of hydrogen, assuming 5% of the fuel cladding is oxidized. Therefore, to generate 475 lbm of hydrogen in the short term would require the oxidation of 35 to 40 percent of the fuel cladding. Given the amount of cladding that was oxidized following the accident at Three Mile Island Unit 2, it is reasonable to assume that sufficient hydrogen could be generated following certain core melt

, accidents at CY to reach a flamable concentration.

The core melt accidents with the potential for hydrogen burn are those where containment heat removal (i.e., containment fan coolers and sprays) are unavailable. Given a core melt accident with the potential for hydrogen burn and the presence of hydrogen monitors, the operators are still very limited in how they can respond to reduce the likelihood of a hydrogen burn or the consequences of a containment overpressure. The containment heat removal systems are already assumed to be inoperable. It would not be feasible to inject air into the containment (to dilute the concentration) given the already high pressure that would exist there. Also, due to the potentially large amount of fission products in the containment, purging would not be prudent.

The only potential benefit to public safety from the operators knowing that a hydrogen burn may be imminent is that an evacuation may be ordered sooner than if there was no knowledge of the hydrogen concentration in the containment.

Considering this, the expected benefit to public safety from the installation of containment hydrogen monitors can be calculated using the following equation:

R = (fCM/H2)(PH2 BURN)(PEVAC)(CR)(T)

U) where, R is the risk reduction (man-ren),

f is the frequency of core melt accidents with the potential CM/H2 for hydrogen burn, CONNECTICUT YANKEE INTEGRATED SAFETY ASSESSMENT PROGRAM

P is the conditional probability of a hydrogen burn which H2 BURN causes an increase in pressure sufficient to breach containment, P is the conditional probability of an early evacuation given EVAC a high hydrogen reading from the monitors, CR is the potential decrease in consequences to the public due to an early evacuation, and T is the remaining life of the plant (i.e., 20 years).

Core melt accidents with the potential for a hydrogen burn can be separated into two categories. The first category consists of those core melts which occur early or which result in rapid pressurization of the containment. The second category consisto of those core melts that occur late and result in a slow pressurization of the containment. From the CY Probabilistic Safety Study (Reference 4) the cumulative frequency of the core melt accidents in Consequence Category 3 is 1.2E-05 per year. The cumulative frequency of the core melt accidents in Consequenca Category 4 is 1.0E-05 per year. The probability of a hydrogen burn leading to containment failure is assumed to be 0.10 for Consequence Category 3 core melt accidents and 0.01 for Consequence Category 4 core melts. These probabilities are based on work done for Millstone Unit 3 (Reference 5). Since it is uncertain if, and how soon, an i evacuation would be ordered, given a high hydrogen concentration reading in the containment, a highly judgmental number must be used. To obtain a maximum realistic benefit value from this modification, a probability of early l

evacuation of 0.5 is used. It is also assumed that the evacuation would be l ordered, at most, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> earlier than normal. The potential decrease in consequences to the pubito due to an early evacuation can be estimated for each l

Consequence Category using the following equations:

CR (Category 3) = f x public consequence for Consequence Category 3 CR (Category 4) = f x public consequence for Consequence Category 4 (2)

I 1

l CONNECTICUT YANKEE l

I!EEGRATED SAFETY ASSESSMENT PROGRAM

_19_

o where f is the fractional decrease in consequences to the public due to early evacuation. This factor was estimated using Table 2.5-6 of NUREG/CR-2239 (Reference 6). This table does not contain information on latent effects, which are the basis for evaluation of this modification. Therefore, the reduction in "early injuries" information was used instead as an upper bound for latent effects. Also, a two hour earlier warning time has the equivalent effect of assuming a two hour reduction in delay time. From the table, assuming a 10 mile response distance, a fractional decrease in consequence of 0.07 is obtained. From the Public Safety Impact Model, the public consequences associated with core melt accidents in Consequence Categories 3 and 4 are 2.2E+06 man-rem and 8.4E+04 man-rem, respectively. Quantifying Equation (1) once for Consequence Category 3 and once for Consequence Category 4 yields the following:

R = (1.2E-5 yr-l)(0.1)(0.5)(0.07 x 2.2E+6 man-rem)(20 yr)

+ (1.0E-5 yr-l)(0.01)(0.5)(0.07 x 8.4E+4 man-rem)(20 yr)

R = 1.9 man-rem.

It should also be noted that CY already has a post accident sampling capability which can be used to determine the hydrogen concentration in containment.

However, for accurate, continuous readings of containment hydrogen concentration, the hydrogen monitors would be much more reliable than post accident sampling. Therefore, in this analysis no credit is taken for the post accident sampling capability.

Results Summing the expected benefits from installation of containment hydrogen monitors for both groups of core melt accidents yields a total maximum expected benefit of 1.9 man-rem. This benefit corresponds to a ranking of 0.04 on a scale from -10 to 10.

Note: The most recent draft of the CY Emergency Operating Procedures (EOP's) does not include provision for operator consideration of l

l CONNECTICUT YANKEE IEEGRATED SAFETY ASSESSMEE PROGRAM

~

l l

containment hydrogen concentration. This analysis has been l performed assuming that the E0P's will be modified to include provision for operator monitoring of containment hydrogen concentration. "

References

1. NUREG-0737, " Clarification of TMI Action Plan Requirements," November, 1980.

1

2. Regulatory Guide 1.97 (Revision 2), " Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," December, 1980.

3. "Haddam Neck Plant Combustible Gas Control Evaluation," Connecticut Yankee Atomic Power Company, March, 1983.

4. J.F. Opeka letter to C.I. Grimes, "Haddam Neck Plant Probabilistic Safety Study - Summary Report and Results," Docket No. 50-213, dated March 31, 1986.

5. D. A. Dube and R. J. Lutz, Jr., " Containment Response During Severe Accidents at Millstone Unit-3," International Meeting on LWR Severe Accident Evaluation, August 28, 1983 to September 1, 1983, Cambridge, Mass.

6. NUREG/CR-2239, " Technical Guidance for Siting Criteria Development,"

November, 1982.

CONNECTICUT YANKEE IEEGRATED SAFETY ASSESSMEE PROGRAM

, _ . _ - _ _ . _ - _, ._ _ . , __ ~ , _ _ _ _ _ . , _ . _ _ . _ . .

I

, f x .

ISAP #2.08 loss of DC Power On Jsnuary 2, 1981, at Millstone Unit 2, an inadvertent trip of a 125V DC battery bus resulted in a reactor trip and some unpredictable plant behavior that has been the subject of much discussion and close scrutiny by the NRC and Northeast Utilities. The event has precipitated studies into the susceptibility to a similar event of Millstone Units 1 and 3 and the Haddam Neck plant and the possible harmful consequences of such an event; specific details and concerns pertaining to these studies have been defined in Northeast Utilities' Significant Operating Experience Report (NUSOER) 1-81. This NUSOER specifically requires an examination of the response of the turbine / generator, the " fast" auxiliary bus transfer scheme, and the diesel generators to the type of partia'. loss of DC that occurred at Millstone Unit No. 2.

In response to this issue the Haddam Neck plant (Connecticut Yankee (CY)) Ioss of DC Study Report was written. This report addresses the explicit concerns of the NUSOER as they relate to CY. It also addresses some additional DC-dependent equipment and control schemes that were deemed appropriate to be included in this type of study. This study resulted in a number of procedural recommendations regarding the DC Power35 stem at CY. Action has been taken on these recomendations by implementation of an emergency operating procedure to deal with the loss of a DC bus (Reference 1). This effectively closes out the issue.

References

1. Connecticut Yankee Emergency Operating Procedure No. E0P 3.1-49,

" Partial Loss of DC Power," Rev.1, September 12, 1985.

1 CONNECTICUT YANKEE INTEGRATED SAFETY ASSESSMENT PROGRAM

_ _ - . ._ _- _ _ ._.