ML19257B044
| ML19257B044 | |
| Person / Time | |
|---|---|
| Issue date: | 01/24/1979 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19257B042 | List: |
| References | |
| REF-GTECI-AS, REF-GTECI-B-60, TASK-B-60, TASK-OR NUDOCS 8001150147 | |
| Download: ML19257B044 (10) | |
Text
.
ENCLOSilRE 2 REPORT ON THE NEED TO BACKFIT LOOSE-PART DETECTION SYSTEMS ON OPERATING REACTORS 1.
Introduction Proposed Regulatory Guide 1.133,(1) " Loose-Part Detection Program for the Primary System of Light-Water-Cooled Reactors,"
provides guidance for the design of a system which is i.ow reouired for new plants by Section 4.4 of the Standard Review Plan.(2)
The pyrpose of the system, according to the Yalue Impact State-ment,L33 is to add to the " defense in depth" of the plant and also to reduce the potential for radiation exposure to station personnel. The reason for concern with loose parts is perhaps best illustrated by the history of loose-part events. These occur, on the average, about once every 9.8 reactor-years.14) events On the average, each reactor will experience about four loose-part events over its 40-year lifetime. However, relatively few of these past events were of direct safety significance. Indications of the loose object were of ten detected by other instrumentation, and in no case was there an actual radioactive release.
The following sections establish criteria to be used in backfit decisions on plants which are already licensed and in commercial operation. The specific safety concerns involvad in a loose-part event are discussed and evaluated against the backfit criteria.
Finally, the practicality and effectiveness of a backfitted system are examined before coming to a conclusion.
2.
Safety Concerns The safety significance of a loose part can be divided into the following areas:
(1) Direct mechanical damage to the pressure boundary (2) Direct mechanical damage to the reactor or steam generator internals (3) Mechanical interference with control rods, valves, planp impellers, and other moving parts (4) Coolant flow blockage 1750 082 8 001150 /V7
. (5) Coolant chemistry upset (6) Abrasive effects (7) Excessive coolant radioactivity (8) Missing part (The presence of a loose part of internal origin implies that some capoaent of the system has been degraded.)
3.
Criteria Used in Backfit Decisions Title 10 of the Code of Federal Regulations, Part 50.109, para-graph (a) pennits the NRC to require backfitting "if it finds that such action will provide substantial additional protection which is required for the public health and safety." In order to require backfitting, two criteria must be met:
(a) There must be a definite, substantial safety-related need (cf. " required for the public health and safety").
(b) The backfit must effectively meet the need (cf. " substantial addi tional protection").
Only if these two criteria are met may a backfit be required; it is not sufficient for the' proposal to make a plant "nore safe" or be " sound engineering practice," even though requirements on new plants may be imposed for these reasons.
Some recently-licensed plants have committed to installing a Loose-Part Detection System (LPDS) during their OL reviews.
Because of this pre-existing commitment, these plants do not fall under 10 CFR 50.109, and the reasons for imposing Proposed Regulatory Guide 1.133 on license applicants apply equally well-to them. These plants will be discussed separately in Section 6.
1750 083
. 4.
Need for Loose-Parts Detection 4.1 Alternative' Instrumentation Although a loose-parts detection system can contribute to safety in all of these areas, it is not the only contributing system.
Interference with moving control camponents (by one loose part) will be detected by exercising programs for this purpose already in every licensee's Technical Specifications. Bulk flow as well as local flow in certain places (e.g., jet pumps) are monitored di rectly. Coolant chemistry and coolant activity are sampled pe riodically. Abrasive effects can be observed by the surveillance of total suspended solids and primarily by seal leakage (monitored di rectly). Therefore, for all of these areas in Section 2 (3, 5, 6, 7, and part of 4) a loose-part detection system mur. be regarded as an additional system which only provides defense in depth by earlier warning.
4.2 Flow Blockage Flow blockage (Section z.4) in unmonitored areas is not covered in the above discussion. Examples of such blockage include small objects jammta within the fJel lattice, larger objects blocking flow at the lower surface of the core, and, in the case of BWRs, objects blocking flow in the orifice areas. Safety analysis of such situations, which take credit for decreased neutron moderation, crossflow, and void feedback, have in the past shown that margin to DNB still existed. One vendor has written a generic topical report on the subject,(5) and concluded that 79% blockage in one orifice could be tolerated without transition boiling. No DNB-related fuel failure in a canmercial LWR has ever been traced to flow blockage due to a loose part in 348 reactor-years.
It is not certain that a loose-part detection system would detect such objects, since they possibly would not impact against any surface with a direcs acoustic path to an LPDS sensor.
1750 084
4 4.3 Missing Parts Of the loose-part events on file,I4) roughly three-quarters of those which occurred in camercial operation were internal NSSS parts which had becme detached. The presence of such a loose part implies that an internal component has been degraded (Section 2.8).
However, the high redundancy of the various designs generally pemits the loss of one non-testable or exercisable cmponent without sig-nificant safety consequences. The only exception to this presently on file was the loss of a lock bolt on a reactor coolant pump, which led to seal failure. Most other events on file (capscrews, sur-veillance capsules, fuel pin parts, etc.) had no immediate safety consequences because they were missing. The remainder (e.g., burn-able poison pins, pieces of channel boxes) were detectable by means other than a loose-part detection system.
4.4 Mechanical Damage to the Pressure Boundary Direct mechanical damage (Section 2.1) by an impacting loose part to the reactor coolant pressure boundary is possible and has hap-pened.(4)
It must be emphasized, however, that such " damage" has never degraded the immediate safety integrity of the pressure boundary.
This damage involves either the reoval of a portion of the stainless steel inner liner, allowing the primary coolant to corrode the base metal of a vessel wall, or the rupture of a caponent which is connected to a lower pressure area (steam generator tubes or nuclear instrumentation tubes) resulting in a very small isolable leak.
It is doubtful that any loose part of credible size and velocity could cause significant leakage. The events observed, although resulting in a plant shutdown in some cases, were relatively slowly-acting and were readily detectable where leakage occurred.
4.5 Direct Mechanical Damage to the NSSS Internals Direct mechanical damage (Section 2.2) to the NSSS internals is probably the most obvious safety concern resulting fra a loose-part event. Generally, a relatively massive object is required to do significant damage. Even a relatively simple LPDS should detect such an object.
1750 085 m.
. Currently, impact damage due to a loose part is not considered in the structural design of the NSSS. However, it is most unlikely that the massive, seismically analyzed internal support structures will be damaged to the point of being unable to function as intended.
Fuel cladding damage is possible, but is unlikely to be extensive because of the modest coolant velocity (about 15 feet /second, equiva-lent to a fall of 3-1/2 feet), the longitudinal directipp of the flow, and the relatively easy detectability of such failures.WI Any such damage would, in all likelihood, require a period of time equivalent to the greater part of a fuel cycle to becue severe (e.g., the instrument tube vibration in BWRs and the guide tube wear in PWRs).
The potential for cladding failure due to loose part impacts can be assessed more quantitatively using existing impact data. Of the four NSSS vendors, GE has assessed the ammount of impact energy nec-essary to cause cladding failure.(6) GE uses this assessment in the radiological analysis of a fuel handling accident where a fuel assembly is dropped upon the reactor core at 40 f t/sec.
(Other vendors analyze the dropping of an assembly on a concrete floor and conservatively assume all the rods fail in one assembly. Although the other vendors do not use impact damage data, it is expected that their fuel behavior will not differ greatly.)
GE has concluded (and the staff has accepted) that one fuel rod can absorb abot.t one foot-pound of bending energy, or about 250 f t-lb.
of capression loading prior to cladding failure. Obviously, a small object striking a fuel rod fra the side can have as much potential for damage as a far larger object striking from above or below.
For an object traveling with the coolant at 15 ft/sec, one ft-lb.
of kinetic energy implies a weight of 4.6 ounces.
If it were made of stainless steel, this object would need a volume of approximately one cubic inch. It does not appear that there is a significant probability that such an object would have a shape which would pemit entry into the fuel lattice with sufficient transverse velocity to cause cladding failure.
-y-0-
A more realistic event would be a heavy object striking the core from above or below. Cladding failure would require 250 f t-lbs.
of kinetic energy, corresponding to a 72 pound object moving at 15 f t/sec with the coolant. In reality, the tie plates and other structural caponents would spread the impact energy over many fuel rods. Consequently, a very massive object would be needed to Such ob' e fail cladding by impacting the core inlet or outlet.are not anticipated based Damage to control rods (exclusive of the mechanical interference discussed in Section 4.1) is also possible, but is unlikely. Con-trol rods are protected by guide tubes when withdrawn, and have already perfomed their shutdown function when inserted. It is instructive to note that a Westinghouse plant can tolerate up to 1-3/4 inches deflection of the guide tubes with no loss of function.(7)
The remainder of the internal components are either expected to be less vulnerable to impact damage than the above, or are necessary only for simultaneous accident conditions (e.g., vent valves) or will, at most, lead to a small isolable leak as discussed in Sec-tion 4.5.
4.6 Synergistic Effects A relatively massive impacting loose part has significance in addition to the direct mechanical damage considered in Section 4.5.
This extra significance is dus to the fact that high impact energies can break up the loose object or otherwise generate many loose ob-jects. Thus, the hazard associated with all eight areas of safety significance is multiplied by the number of loose parts present.
The only area which becomes significantly more hazardous in the presence of a multitude of small loose objects is area 3, mechanical interference with moving parts. the control rods in particular. It is possible in such circumstances to jam more than one control rod (transient and accident analyses always assume one stuck rod) in a time period shorter than the control rod exercise surveillance pe riod.
Boiling water reactors are relatively immune to this problem. Coolant velocities in the lower plenum are low, generally allowing loose ob-jects to settle out. Should an object enter a control rod guide tube and not be carried into a fuel channel, it will drop to the velocity limiter, where exercise programs should detect it.
In the 1750 08T
. event of a scram, the shape of the velocity limiter plus the very large upward force exerted by the hydraulic control rod orive should enable the rod to scram, even though the velocity limiter may be damaged in the process.
Westinghouse pressurized water reactors are somewhat more vulnerable in that a loose object may be cast up and came t rest on top of an RCCA guide plate. Exercise programs would prob
- not detect such an object, but the object could still prevent cowlete insertion by preventing the spider from passing that guide plate. Although the loose object would have to be light enough to be carried up to the plate, yet heavy enough to renain in place in the presence of cross-flow, such an event is credible if many loose objects are present.
Thus, there is a possibility of a transient followed by an incomplete sc ram.
It should be remembered that much of the shutdown margin in PWRs is needed to support the asstsnptions used in the analysis of the steam line break accident. For each anticipated transient, much less negative reactivity is necessary.
For a four-loop Westinghouse reactor at end of equilibrium cycle (worst case), the plant will main-tain sufficient shutdown margin with five clustered RCCAs failing to insert, or as many as 18 or more RCCAs in a distributed pattern failing to insert.(8)
(These numbers take no credit for partial insertion.) Therefore, even multiple loose parts are unlikely to prevent the reactor from shutting down safely in the event of an anticipated transient.
Similar arguments could be made for B&W and CE plants. However, all of these plants (except Palisades) are already equipped with loose-part detection systems. Thus, the question is moot for these plants.
4.7 Conclusion At this point, all 8 items of safety significance associated with a loose-part event have been considered. None of them have been sufficient to meet the criteria of Section 2.
It is, therefore, concluded that back'itting should not be imposed. However, this conclusion rests partly upon probabilistic bases. Cases mdy arise where an existing loose part is known to be present, or a minor design defect is identified which leads to a higher than nonnal probability of loose-part events.
In such individual cases, it would be justified to require a loose-part detection program in conjunction with the appropriate safety analyses.
1T50 088
. 5.
Effectiveness of Backfitted Systes A backfitted LPDS is generally not as effective as a system which was included in the original design of the unit. The two major reasons for this are sensor placement and calibration.(4)
An ideal systen would have its sensors attached directly to the vessel wall (or on nozzles immediately adjacent to the vessel wall) and distributed to provide maximum coverage. A backfitted system will not, for example, have the benefit of threaded studs built into the vessel. Instead, a backfitted system must use either magnetic or adhesive mounting on the vessel wall (neither has met with complete success); or strap clamps on piping and/or structural members attached to the vessel. (This latter method is more common.)
Some sensors are attached at distances as much as 12 feet from the vessel wall. Because sensor locations are based upon accessibility considerations rather than unifomity of acoustic coverage, the re-sulting array may be far fra optimum.
The response of an LPDS sensor to an impact at a given location cannot be readily calculated. Such a calculation would have to consider waves (of three polarizations) propagating through a complex inhomo-geneous three-dimensional structure involving diffraction at each vessel penetration and considerable mutual interference and resonance ef fects. Also, the acoustic energy generated at the point of impact is not linearly related to the kinetic energy of the impacting object.
Therefore, it is necessary to empirically calibrate any LPDS by a series of impacts of various energies at each of many locations on the vessel (and steam generator) walls. Because of problems with both accessibility and personnel exposure, backfitted systems are generally not as thoroughly calibrated as are " original equipment" systems.
Moreover, it is necessary to measure the background noise of the unit as a function of coolant flow and core power. Background noise is more readily measured during the initial startup testing than after any camercial operations.
Installation of any LPDS does not guarantee knowledge of all loose objects. These systems are impact detectors and will not detect a loose object that is not sonically active. Moreover, the rather high false alam rate, especially in backfitted systems, mandates verification of h alam before any mitigating action by the operator is taken.
Thus, hours or days may pass before an alarm results in any change in the plant status.
1750 089
. 6.
Plants with Existing LPDS Canmitments Recent licensees have been required during their OL reviews to cammit to installing a loose-part detection system. No specifica-tions for these systems were imposed. Thus, there exists a class of licensees which do not fall under 10 CFR 50.109, but are also operating, and thus will find it extremely difficult to install a system or upgrade an existing system to meet the requirements of Proposed Regulatory Guide 1.133.
For this class of plants, it will be necessary to accept the lesser effectiveness of a backfitted system. However, it is recommended that the programmatic aspects of Proposed Regulatory Guide 1.133 be imposed. Experience has shown(4) that licensees of ten pay insufficient attention to their LPDS. Thus, a pro-grammatic (and possibly some hardware) backfit should be imposed on this class of plants. The extent of backfitting will be decided on a case-by-case basis.
7.
Summary and Conclusions Because a loose-part detection program can detect the presence of a loose part before significant damage (or additional damage) is done, the staff believes that a plant equipped with LPOS is generally safer (has more depth to its defense) than a similar plant not so equipped. Moreover, early detection should decrease the personnel radiation exposure associated with repair work. However, examination of the various consequences of a loose-part event and the rate of occurrence of these events has indicated that there is insufficient justification for across-the-board backfit. ting. Limited backfitting is justified in the case of reactors which have a pre-existing LPDS commitment and also in the (hypothetical) case of individual plants which have a known loose part or a known high probability of a loose-part event.
1750 090
References 1.
Regulatory Guide 1.133, " Loose-Part Detection Program for the Primary System of Light-Water-Cooled Reactors," Revision 1, Draf t 2, dated May 1978.
2.
" Standard Review Plan for the Retiew of Safety Analysis Reports for Nuclear Power Plants," NUREG-75/087, Septaber 1975.
3.
"Value-Impact Statement for Proposed Regulatory Guide 1.133,
' Loose-Part Detection Program for the Primary System of Light-Water-Cooled Reactors,'" dated March 1978.
4.
" Operational Experience with Commercially Marketed Loose-Part Monitoring Systems," dated 5.
" Consequences of a Postulated Flow Blockage Incident in a Boiling Water Reactor," NEDO-10174, October 1977.
6.
" Generic Reload Fuel Application," NEDE-24011 dated May 1977.
7.
"RESAR 35," Westinghouse Reference Safety Analysis Report, dated July 1975.
8.
" Anticipated Transients Without Reactor Trip in Westinghouse Pressurized Water Reactors," WCAP-8096, April 1973.
9.
B. Siegel and H. H. Hagen, " Fuel Failure Detection in Operating Reactors," NUREG-0401, March 1978.
1750 091