ML19350C875

Identification of New Unresolved Safety Issues Relating to Nuclear Power Plants.Special Report to Congress

ML19350C875
Person / Time
Issue date:	03/31/1981
From:	Office of Nuclear Reactor Regulation
To:
References
NUREG-0705, NUREG-705, NUDOCS 8104060946
Download: ML19350C875 (50)

Text

l NUREG-0705 Identification of New Unresolved Safety Issues Relating to Nuclear Power Plants

~

v Special Report to Congress ae u ished ac 198 Division of Safety Technology Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555

s. ~..

/

e

% l0 &Y0

ABSTRACT As a result of review by the Nuclear Regulatory Commission (NRC) staff and extended collegial consultations and investigations within the NRC, the Commission has designated four new Unresolved Safety Issues (USIs).

This report describes the process used to evaluate the large number of concerns and recommendations which resulted from the major investigations of the Three Mile Island-2 accident, as well as other events and investigations of the past year, and it identifies the four new USIs. They are:

(1) Shutdown decay heat removal requirements (Task A-45)

(2) ~ Seismic qualification of equipment in opetating plants (Task A-46)

(3) Safety implications of control systems (Task A-47)

(4) Hydrogen control measures and effects of hydrogen burns on safety equipment (Task A-48)

Appendix A of the report presents an expanded discussion of each new Unresolved Safety Issue including issue definition, a preliminary discussion-of the action plan, and a basis for continued plant operations and licensing.

Appendix B of the report provides a brief discussion of each of the candidate safety issues not designated as an Unresolved Safety Issue.

O.

a 4

L i

)

4

CONTENTS Page 1.

Introduction and Summarv......................................

1 2.

Background....................................................

3

.3.

Identification of New Unresol ved Safety Issues................

4 Bibliography.......................................................

13 n.

APPENDIX 'A - Description of New Unresolved Safety Issues APPENDIX B.

Summary Discussion of Candidate Issues Not Designated as Unresolved Safety Issues APPENDIX C - Resolution of the Comments from the NRC Office for Analysis and Evaluation of Operational Data (AE0D) l' APPENDIX D

' Resolution of the Comments from the NRC Committee on Reactor Safeguards (ACRS)

~

5 f

.4 3

.V

. f,

%p =

d S

)

t.

m, s

IDENTIFICATION OF NEW UNRESOLVED SAFETY ISSUES RELATING TO NUCLEAR POWER PLANTS 1.

INTRODUCTION AND

SUMMARY

Section 210 of the Energy Reorganization Act of 1974, as amended in Dececher 1977, requires the Nuclear Regulatory Coccission (NRC) to o

develop _ and submit to the Congress a plan for the specification and analysis of Unresolved Safety Issues and to include progress reports on the resolution of these issues in the NRC Annual Report. Chapter 3 of the 1979 Annual Report provided a progress report on the resolution of those Unresolved Safety Issues previously identified and reported to the Congress in the 1978 Annual Report.* A further progress report is provided in Chapter 4 of the 1980 Annual Report.

This special report is intended to supplement the information contained in Chapter 3 of the 1979 Annual Report in order to provide information on new Unresolved Safety Issues that was not available at the time of preparation of the 1979 Annual Report. A short sumary of this inforration is provided in the 1980 Annual Report. The 1979 Annual Report indicated that such a special report would be sutaitted to Congress in July 1980.

The report was' delayed to accomodate the extended collegial consultations and investigations that the Comissioners deemed necessary for their selection and approval of new Unresolved Safety Issues. This report

. describes the process used to evaluate the large number of concerns and recomendations which resulted from the rajor investigations of the accident'at Three Mile Island Unit 2 (THI-2), as well as other events

.and investigations of the past year, and the report identifies which of

-these new' issues are designated as Unresolved Safety Issues.

The issues considered in the staff's evalcation came from several sources, including the "NRC Task Action Plan Developed as a Result of the TMI-2 Accident" (NUREG-0660), Advisory:Comittee on Reactor Safeguards (ACRS) letters-and reports.during the period January 1979 to March 1980, Abnomal

' Occurrence Reports for 1979, and the NRC staff. Many of the issues are derived from operating' experience. The first step-in the selection process was a screening of issues-based on a set of initial screening p.

• The. process.used for selecting these issues was reported to the Congrcss E 'in NUREG-0510. " identification of Unresolved' Safety Issues Relating to Nuclear Power Plants," January-1979.

T

criteria that considered attributes of an Unresolved Safety Issue other than the level of safety significance; for example, an Unresolved Safety Issue must apply to a number of plants, it must relate to nuclear power plant safety, and so forth.

Forty-four candidate issues were identified as a result of the initial screening.

Each of the 44 candidate issues was then subjected to a systematic review to judge its safety importance on the basis of whether the issue involved equioment, operations, or emergency response and whether it was a potentially significant safety deficiency or a potentially significant safety improvement. The judgment as to which issues should be designated and reported as Unresolved Safety Issues was of necessity based principally on qualitative information provided as answers to these questions. The answers were developed through discussions with staff experts in the

=

areas being considered. More quantitative information would have been preferable as an aid in judging many of the issues; however, this was not possible because of the limited time available. The development of more quantitative information to aid in such decisions by the Office of fluclear Reactor Regulation (fiRR) in the future is intended as the new Reliability and Risk Assessment Branch in NRR develops its capabilities in these areas. The systematic review process that was used is described in further detail in Chapter III of this report.

As a result of this review process, the four issues listed below have been designated as new Unresolved Safety Issues. These issues, which are described in Appendix A of this report, are:

(1) Shutdown decay heat removal requirements (Task A-45) l (2)- Seismic qualification of equipment in operating plants (Task A-46)

(3) Safety implications of cont ol systems (Task A-47)

(4) Hydrogen control measures and effects of hydrogen burns on safety equipment (Task A-48)

An expanded discussion of each of these issues is provided in Appendix A of this report.

A Task Action Plan for each -issue will be developed and will present a detailed discussion of the work necessary (broken down into individual

. tasks) to achieve a technical resolution of the issue. The staff and contractor resources required and detailed schedules with intermediate milestones will be included in the plan.

Appendix B of this report provides a brief discussion of each of the candidate. Safety Issues that were considered but not recommended for designation as Unresolved Safety Issues.

Seven of these issues have been designated as requiring "further study" to determine whether or not they should be reported as Unresolved Safety Issues.

Further investigation of'these issues is. planned.

2

2.

BACKGROUND As noted in the NRC 1979 Annual Report, Section 210 of the Energy Reorganization Act of 1974, as amended, contains the following require-ment:

Unresolved Safety Issues Plan Section 210. The Comission shall develop a plan for providing for specification and analysis of unresolved safety issues relating to nuclear reactors and shall take such action as may be necessary to implement cor-O rective measures with respect to such issues. Such plan shall be submitted to the Congress on or before January 1,1978 and progress reports shall be included in the annual report of the Commission thereafter.

The following definition of an Unresolved Safety Issue was developed to satisfy the intent of Section 210; this definition was used in identifying the Unresolved Safety Issues previously reported to Congress in the 1978 Annml Report:

An Unresolved Safety Issue is a matter affecting a number of nuclear power plants that poses important questions concerning the adequacy of existing safety

-requirements for which a final resolution has not yet been developed and that involves conditions not likely to be acceptable over the lifetime of the plants affected.

In applying this definition, matters that pose "important questions concerning the adequacy of existing safety requirements" were judged to

.be'those for which resolution is necessary to (1) compensate for a possible major reduction in the degree of protection of the public health and safety, or (2) provide a potentially significant decrease in the risk to the public-health and safety. Those issues that satisfy (1) above are basically " backward" looking; that is, they bring the degree of protection back up to the assumed level. Those issues that satisfy (2) are " forward" looking; that is, they are improvements that decrease the risk significantly below the assumed level.

To satisfy the reporting requirement of Section 210, the NRC provided a report to the Congress, NUREG-0410,- in January 1978, describing the NRR

. generic issues program that had been implemented early in 1977.. The NRR o

program described in NUREG-0410 provides for the identification of

' generic issues, the assignment of priorities, the development of detailed task action plans to resolve the issues, the projections of _ dollar and manpower costs, continuing high' level management oversight of task

~

progress, and public dissemination of information related to the tasks as.they progress.

3

The 1978 Annual Report described NRC progress towards resolving those issues addressed in the NRR program that had been identified as Unresolved Safety Issues. Seventeen Unresolved Safety Issues were identified, to be addressed by 22 generic tasks. The 1979 and i980 NRC Annual Reports descrioe the progress made on the resolution of tnese 17 Unresolved Safety Issues.

As a result of the TMI-2 accident and other r. vents and the subsequent investigations, a large number of recommenditions related to nuclear power plant safety have been made. Most o" these have been incorporated into the NRC TMI-2 Action Plan (NUREG-0660, which establishes plans and priorities for resolution of the concerns ai./ issues which have been identified. To satisfy the requirements of Section 210, it was necessary to evaluate all of these recommendations (including those addressed in the NRC TMI Action Plan) in order to determine which of these should be designated as new Unresolved Safety Issues. The NRC 1979 Annual Report indicated that this evaluation, which would identify new Unresolved Safety Issues, would be completed and a special report submitted,to the Congress in July 1980, following a systematic review of all candidate issues from the Three Mile Island investigations and other sources. By a letter dated August 1,1980, the Comission informed Congress that the staff would not meet the July commitment because of the need to first receive coments from the NRC Office for Analysis and Evaluation of Operational Data (AE00) and from the NRC Advisory Comittee on Reactor Safeguards (ACRS). Appendix C and Appendix D describe the resolution of coments from these two groups. Coments and recommendations were also made by the NRC Office of Policy Evaluation. These coments and their resolution were a significant part of the Comission's deliberations in the selection of the new Unresolved Safety Issues. This report addresses the comitment made in the 1979 Annual Report for a Special Report to Congress.

3.

IDENTIFICATION OF NEW UNRESOLVED SAFETY ISSUES In order to evaluate safety concerns, recomendations, or general safety issues and determine if these should be designated Unresolved Safety

-Issues and' reported to Congress as such, the process described below was developed. This process was intended to provide a systematic and con-sistent approach to evaluating these issues and judging their impact on

. risk to public health and safety.

The sources of issues to be considered by this evaluation process were

-the NRC TMI-2 Action Plan (NUREG-0660); letters and reports from the

'ACRS from January 9,1979 through March 12, 1980;' Abnormal Occurrence Reports for 1979; and the NRC staff. From these sources, approximately 425 concerns and recommendations that' required consideration were identified.

The process;that was developed to. consider these various issues consisted -

of two steps, antinitial' screening based on specific criteria'and an Levaluation of safety importance based on~a specific procedure. The initial screening was done without addressing the safety'importance of

~

-an -issue. " An issue was eliminated from further consideration as an 4-O m

Unresolved Safety Issue if it met one or more of the first seven of the following criteria:

INITTAL SCREENING CRITERIA (1) The issue is not related to nuclear power plant safety, for example, transportation of radioactive materials.

(2) A staff position on the issue has been developed or is e/occted to be developed within 6 months. The purpose of this criterion is to eliminate those issues that are near resolution and, therefore, are not " unresolved" issues. Such issues do not warrant the attention and resources normally associated with an Unresolved Safety o

Issue.

(3) The issue is not generic.

(4) The issue is only indirectly related to nuclear power plant safety, for example, recommended changes in the licensing process, NRC organization, and so forth.

(5) Definition of the issue requires long-term confirmatory or exploratory research. The basis for this criterion is that investigative studies of matters.for which no clearly defined safety deficiency or improvement has been identified, although appropriate regulatory activities, do not warrant designation as Unresolved Safety Issues.

(6) The issue is related to one already being addressed as an Unresolved Safety Issue and can reasonably be or already is included in the current program.

(7) The issue requires a policy decision rather than a technical solution.

The purpose' of this criterion is to eliminate those issues that require a management decision only and do not represent potential deficiencies in existing safety requirements for which a resolution must be developed.

In some cases, the results of these policy decisions' may require designation of new Unresolved Safety Issues.

(8) The issue is related to safety improvements where existing protection is adequate.

(9) The issue. includes programatic matters involving implementation of

. issue resolutions already achieved.

(10) The issue includes collections of related issues in lieu of focused 4

critical issues.

(In this regard, an attempt should be made to define the issue so that matters extraneous to the issue are eliminated.)

' Criteria (8),'(9), and (10) were recommended.as-additions to this set by the Office of Policy Evaluation, and the Commission has directed that they be-used in future screenings.

5

4 i

1 The initial screening identified 44 candidate Unresolved Safety Issues to be evaluated for importance to safety. Table 1 provides the sumary list of these candidate issues.

1 TABLE 1.

List of Candidate Unresolved Safety Issues After Initial Screening t

TMI Action Plan Items Titles 1.

Section I.A.2.2 Training and qualification of operations personnel F

2..Section I.A.2.6 Long-term upgrading of training and aualification l

3. : Section I.A.4.2 Long-term training simu1Chr upgrade 4..

Section I.A.3.3 Requirements for operator fitness

.5. 'Section~I.B.1.1 Organization and management, long-term improvements 6.

Section I.C.9 Long-term plan for upgrading of operating procedures

~

-7 Section I.D.1 Contml room design reviews

8. 'Section I.D.2 Control room design, plant safety parameter display console

'9.

Section I.DM Control room design, control room design standard

10.Section I.D.5 Control room design, improved control room

~

instrumentation research ill. 'Section I.F.1.

. Expansion of Ouality Ass'urance (QA) list 12.t.Section I.F.2 Development of more detailed QA criteria

13. -Section I.G.I.

~ Training requirements for preoperational and low-power testing 14.- Section:. II.B.8 -

Consideration of degraded or melted cores in safety. review, rulemaking proceeding

~152 Section II.E.2.1:

Reliance on Emergency Core Coolant System.

'(ECCS)<

! 16.u. Section-II.E.2.3-ECCS, uncertainties-in performance predictions

-~

T 175 Section'.II.E.3.3 -

Decay heat removal, coordinated study of. shutdown-heat removal requirements

~

118. 1Section'II.E.4.3-Containment' design -integrity check :

J[

6.

~

9 l-m

i Table 1, continued TMI Action Plan Items Titles Continued

19.Section II.E.5.1 Design sensitivity of Babcock and Wilcox (B&W) reactors, design evaluation

20.Section II.E.6.1 In Titu testir.g of valves t

21.Section II.F.4 Study of control and protective action design requirements

22. - Section II.F.5 Classification of instrumentation, control, and electrical equipment

23.Section III.A.3.5 Improvement of NRC emergency preparedness -

training, drills, and tests

24.Section III.D.1.3 Radiation source control - ventilation system and radiciodine adsorber criteria 25.

Section III.D.3.3 Inplant radiation monitoring

26. -Section II.K.3.33 Evaluate elimination of Power Operated Relief Valve (PORV) function 4

ACRS Items-Titles 27.

Reliability of ventilation monitoring equipment 28.

Protective device reliability 29.

Instrumentation set-point drift End-bf-life and maintenance criteria

30..

31.

Design' check and audit of balance-of-plant equipment 32.

. Boiling Water Reactor (BWR) control rod worth 33.

Flow-induced vibration 34.

Inadvertent actuation of safety injection 135.

Re-evaluation of reactor coolant pump trip criteria

.7-

Table 1, ccn.inued Other Items Titles 36.

Turbine disk cracking

.37.

DC power system reliability 38.

BWR jet pump integrity 39.

Seismic qual 71 cation of equipment at operating plants 40.

Smaii-break Loss of Coolant Accident (LOCA) from extended overheating of oressurizer heaters 41.

Pressurized Water Reactor (PWR) pipe cracks 42.

BWR main steam isolation valve leakage control systems 43.

. Radiation effects on reactor vessel supports 44.

Loss of offsite power subsequent to a LOCA To assess the importance to safety of each of these issues, a set of questions was developed to assist in evaluating the issue's general impact on various factors affecting safety. Figure 1 provides an overview of the process, including the questions used to assess safety impact.- After the initial screening, the issue is (1) identified as.

either a deficiency or an improvement; (2)' determined to be an issue related to either ooerations, ' equipment, or emergency response; and (3) evaluated in terms of potential for significantly affecting risk. 'To assess (3) above, the questions asked.are intended to evaluate the 1mpact of each candidate issue on probability of an accident or transient; probability of losing mitigating functions,' given the event; and consequences

given the event and loss of. mitigating functions. 'The overall conclusion is based on the answers to these questions regarding che potential for significantly affecting _ fission-product-barrier integrity, frequency of transients or accidents, safety functions, or emergency response capability.

~

For example,.if:the issue being evaluated passes the initial screening criteria,-is detemined to be'a deficiency (that is, a possible major reduction in the assumec' degree of protection), is' primarily en equipment concern, and impacts-the capability to perform safety functions, the following questions would be asked:

8 L

na s s

\\

e.....

e

<.s

.... o.e.

o.-.

I a<

1 o

I ma.ne ee. e eme

..e.

o I

I I

I l

[..e.-..-. ]

]

I I

__~.e..._

_ ~..

De e ape,*

a Des ate

• Os'ee= w *

~..

..e..<..-

_... ~.

.o.m

..e

- ~...

e o..

o.

I I

l l

I

'---'.. ;,' y w.* - -

..__ee,

=.e..

~,.

h-.--

Atees aseeu w

_se.,, _ e.,

i i

h== c h-* o-e--

8

-O

-O

_ ~, _...

- ~, _... ~.

e....

h Cre.h 084.e4f9 '

Der e Deegone,F

-==.nas tase, p.as eene

_.h.s I = enes4hr y, gee,gg 9 m

&esWe*Ge C uW Getuf 8'

- weg, agggyi

_ gem n t 4.eemse ye ammesme e

L ***d'.es s Laus as ba e, g,,,,

= WWhee e.P4 Seuse' e

s Isure

.' sesor

=.staa. L 6 -

. t

,,,,,,,,,o Co.4 eau.

Some O***

.e same.

e N Leene 4 4.L.e.8W IW se..~.

.Depeenag. easts g

7 gas e

.ee r-

. Fto b %S I8'4 es.tse f o 5=ev Deseemew' p,,g,,,,

gy,g,ga r

M E888 H

em A.ese e

. Lamp see D.e.

yg h D.e..e.se.s to 8'usu utag Os I

9 Seemd

.a A Sgadsemme "

we.er 4

~M EY =.

to Se samaav-owe ae v.

m ame-.

s T nefoessees va Dweear,7 p,

sme, a

a T

T.

e 9

era a

1. e *er taupW g,,,,,,, g egge Cess.C. w e8 e.me.e tasser e Geese s te Ame**

Se.ews an e R$o. mar Roese.en 88e **

h-Re sense he e f

wm Ammmed Devee.P

. Doom **e s'.a Dorse 9 **e88*e*

--e.

y s.o

(

P i

k f

L

f:-

! I s

b

~

i

_v

~

?.

-1 I

._,r..-.c

~~,-

I

[.-- % _

l 1.:

l

~ ~ = _

-. ~,.

- ~ _...

i I

I I

e.e'

.f

-,es c

.e e

-e m.

s.

.~r_

WF=

..e.

g-D*

'.s*

g)

~,

w i.-~..

.r_

..i 5.

c

- ~ _ =

.sg m.

,;:.,~ *

~,~

.~

.-. m.

g ;y,,.,,.,

• s. ;;-

v e

W

-m

~,,

w

~

c w-

~

w.

c. 'h

'w

.~

a FIGURE 1 L

IDENTIFICATION OF r-l-

NEW UNRESOLVED SAFETY ISSUES

f (1) What is the potential deficiency?

(This question is intended to obtain a clear and concise description b

of the deficiency, including identification of plants affected and the cause of the deficiency.)

(2) What is the likelihood that the potential deficiency exists?

(The answer should be " low," " low to medium," " medium," " medium to high," or "high."

If sufficient information is not available, the answer could be "Turther study" to assen the likelihood.

Quanti-tative information could be used if availdle.)

(3) What equipment / systems could be affected by the potential defi-ciency?

(Those safety and nonsafety systems that could be affected should be identified.)

(4) What is the likelihood that, given the above deficiency, the affected equipment will fail as a result?

Use likelihood estimates similar to those described for question 4

2) above.)

(5) What safety functions could be affected by failure of the equipment / systems?

(Identify safety functions that may be performed using any of the equipment / systems identified in response to question (3) above.)

(6) What is the likelihood of loss of the affected safety functions i

when needed, if the affected equipment / systems fail?

(Use likelihood estimates similar to those described for question (2) r above.)

(7) Based on the above, is it likely that a safety function will be

-lost as a result of this deficiency?

(On the basis of the answers to questions (1) through (5), a conclusion is made as to the potential for losing a safety function as a result of this deficiency.

If the potential is judged to be significant, the answer is "yes," and the deficiency is designated as'an Unresolved Safety Issue.

If sufficient information to answer any of these questions is not available, the answer is that "further study" is required to obtain the information necessary to deter line if the ' deficiency should be an Unresolved Safety Issue.)

- Where possible, quantitative information was used to answer the questions and arrive'at conclusions on potential impact. However, in most cases relevant quantitative information 'was not available, so that qualitative likelihood estimates were developed, and the conclusions were based on these. JThe qualitative' estimates were based on the engineering judgment of individuals knowledgeable of. the issue, with input and review by g

.-staff pe?sonnel from various: technical disciplines. These included an individual. from the NRC Division of System Reliability Research and an

' individual with plant operations experience.

4 1

10 I

--r

Through the implementation of this p"oce.s, the following six issues were. recommended to the Comission for consideration as new Unresolved Safety Issues:

(1) Long-term cograding of training and qualification of operating personnel (2) Operating procedures (3) Control room design (4) Consideration of degraJed or melted cores in safety reviews (5) Shutdown decay heat removal requirepr.cs (6) Seismic qualification of equipment in operating plants As 'a result of comments from the ACRS and AE0D and an evaluation by the staff, the following item was also recommended to the Comission for consideration as an Unresolved Safety Issue:

(7) Safety implications of control systems Following.several meetings with the staff, the acceptance of additional screening criteria (8), (9), and (10) presented above and further consideration and deliberation, the Comission approved issues (5), (6), and (7) as new

-Unresolved Safety Issues. Also, in light of the proposed rulemaking on degraded or melted cores and the activity underway on this subject in support of-that rulemaking, the Comission determined that proposed issue (5) was to be specifically focused on hydrogen control and the effects of hydrogen burns on safety equipment.

To summarize, the Comission approved only these new Unresolved Safety Issues:

(1) Shutdown decay heat removal requirements (Task A-45)

(2) Seismic qualification of equipment in operating plants (Task A-46)

(3)' Safety implications of control systems (Task A-47)

-(4) Hydrogen control measures and effects of hydrogen burns on -

safetyequipment:(TaskA-48)

These issues'are described'in Ap g. dix A to this report._ They will be

. evaluated and resolutions established in the same manner as the pre-

'viously identified Unresolved Safety Issues. - This will -include develop-ment of; Task Action. Plans, with a high staff priority placed on resolution of-the issues.. These Task Action' Plans will include-resource requirements and schedules for resolution of these issues.

Progress on these. issues twill-be provided quarterly in the NRC " Aqua" Book (NUREG-0606) and annually in the NRC Annual Report to the Congress.-

11 f

s

Additionally, as a result of the above review process, several issues were identified that required further evaluation in order to determine if they should be designated as Unresolved Safety Issues. This further study is planned for this year.

Issues requiring further evaluation, which are discussed in Appendix B, are:

(1) Reliance on ECCS (II.E.2.1)

(2)

In situ testing of valves (II.E.6.1)

(3) Protective device reliability (4)

PWR pipe cracks (5) BWR main steam isolation valve leakage control systems (6) Radiation effects on reactor vessel supports (7) Safety implications of steam generator trar.5ients and accidents (8) Piping and use of highly combustible gases in vital areas (9) Reliability of safe-shutdown instrumentation The resolution of items detennined not to be Unresolved Safety Issues may still have some benefits in terms of safety. Accordingly, the Safety Program Evaluation Branch will assign priorities to them, and their resolution will be monitored by the Generic Issues Branch. A discussion of each of these issues, including the bases for not desig-nating them as Unresolved Safety Issues, is included in Appendix B of this report.

Y 12

BIBLIOGRAPHY U. S. -Nuclear Regulatory Comission, " Identification of Unresolved

-Safety Issues Relating to Nuclear Power Plants," USNRC Report, NUREG-0510, January 1979.

U. S. Nuclear Regulatory Comission, "NRC Actica Plan Develooed as a Result of the TMI-2 Accident," USNRC Report, NUREG-0660, May 1980.

'C U. S. Nuclear Regulatory Comission, "NRC Program for the Resolution

.of Generic Issues Related to Nuclear Power Plants, Report to Congress,"

USNRC Report, NUREG-0410, December 1977.

1 I

'I e

^~

'w g.

~,,

13 3;

s

,'(

7 c

• 5 4 m

e APPEftDIX A

-U DESCRIPTION OF fiEW UtiRESOLVED SAFETY ISSUES i

8 9

1-I_

l.

a-

)

CONTENTS Pace 1.

Shutdown Decay Heat Removal Requirements (Task A-45)..

A-1 e

2.

Seismic Qualification of Equipment in Operating Plants (Task A-46)...........................................

A-7 3.

Safety Implications of Control Systems (Task A-47)....

A-9 4.

Hydrogen Control Measures and Effects of Hydrogen Burns on Safety Equipment (Task A-48).......................

A-11 Bibliography...............................................

A-20 C

e

. m A-iii L:

APPENDIX A DESCRIPTION OF NEW UNRESOLVED SAFETY ISSUES This appendix includes expanded descriptions of the four issues designated as new Unresolved Safety Issues. Two of the issues, Task A-45 and Task A-48, are derived from items included in the NRC TMI Action Plsa (NUREG-0660). A third, Task A-46, concerns the scismic qualification of equipment at older plants and is the result of a recomendation from the Systematic Evaluation Program (SEP). The fourth, Task A-47, concerns safety implications of control systems and is the result of operating experience and recommendations from the NRC Advisory Committee on React 3r Safeguards (ACRS) and the Office for Analysis and Evaluation of Operational Data (AE0D).

1.

Shutdown Decay Heat Removal Requirements (Task A-45)

Issue Definition Under normal operating conditions, power generated within a reactor is removed as steam to produce electricity via a turbine generator.

Following a reactor shutdown, a reactor produces insufficient power to operate the turbine; however, the radioactive decay of fission products continues to produce heat (so-called " decay heat"). Therefore, when

' reactor shutdown occurs, other measures must be available to remove decay heat from the reactor to ensure that high temperatures and pressures do not develop which could jeopardize the reactor and the reactor coolant system.

It is evident, therefore, that all light uter reactors (LWRs) share two common decay heat removal functional requirements: (1) to provide a means of transferring decay heat from the reactor coolant

- system to an ultimate heat sink and (2) maintain sufficient water inventory inside the reactor vessel to ensure adequate cooling of the reactor fuel. The rai1 ability of a particular power plant to perform these functions depends on the frequency of initiating events that require or jeopardize decay heat removal operations and the probability that required systems will respond to remove the decay heat.

There is an increasing realization that one of the most important factors in.the safety of nuclear reactors is the reliability of the systems used for decay heat removal following the shutdown of the reactor for any reason. The results of the Reactor Safety Study (WASH-1400) showed that the overall probability of core meltdown in the first generation of

~6-

. large comercial LWRs was higher than had been expected (about 5 x 10 s as compared to 1 x 10 6 per reactor yeat ).

insufficient reliability in the' decay heat rer. oval systems, particuiarly in response to small loss-of-coolant accidents (LOCAs), was show s to be responsible for a substantial

. portion of the overall probability of core meltdown.

A-1 o

i Tne principal means for removing the decay heat in a pressurized water reactor (PWR) under normal conditions immediately following reactor shutdown is through the steam generators using the auxiliary feedwater system.

In addition to the WASH-1400 study mentioned above, later reliability studies and related experience from the accident at Three Mile Island Unit 2 (THI-2) h w e reaffirmed that the loss of capability

- to remove heat through the steam generator is a significant centributor to the pmbability of a core-melt event.

It should be noted that following the TMI-2 accident, the NRC required reactor manufacturers to make many improvenents to the steam gonerator auxiliary feedwater system. However, the staff feels that providing an alternative means of decay heat removal could substantially increase the plants' capability to deal with a broader spectrum of transients and accidents and, therefore, could potentially significantly reduce the overall risk to the public. Consequently, this Unre:,olved Safety Issue will investigate alternative raans of decay heat remov.sl in PWR plants, including but not limited to using existing equipment where possible.

This study will consist of a generic systems evaluation and will result in recommendations regarding (1) the adequacy of existing shutdown decay heat removal requirements, and (2) the desirability of and possible design requirements for an alternative decay heat removal method, that is,

a. method other than that normally associated with the steam generator and secondary system.

This Unresolved Safety Issue will also investigate the need and possible design requirements for improving reliability of decay heat removal systems in boiling water reactors (BWRs).

Task Action Plan The NRC staff has initiated the preparation of a Task Action Plan on shutdown decay. heat removal requirements which will provide a description of the issue, a description of the NRC staff approach to resolving the issue,.a general discussion of the basis for continued operation and licensino pending resolution of.the issue, a discussion of the technical organizr.tfons involved in the task, and the requirements for manpower and prsgram support funding.

It is expected that preparation and approval of this plan will take about 3 months. The completion date for this program' depends'on obtaining the necessary program funding and implementation time for Technical Assistance contracts, probably on a competitive basis. A preliminary estimate for completion of this program is April 1984.

The primary goal of Task A-45 will be the development of a comprehensive and consistent set' of shutdown cooling requirements for existing and future LWRs, including the study of alternative means of decay heat removal. An integrated systems approach to the problem'will be employed.

In the past,'the staff review of shutdown cooling was pursued in a fragmented manner because of the many technical disciplines involved,

.and each technical staff reviewer pursued his own interest in a particular, h

A-2' u

narrow aspect of the overall concern of maintaining adequate cooling

.while bringing a reactor to cold shutdown. The position of Task Manager for Task A-45 has recently been established within NRR to manage and coordinate the development of an integrated set of shutdown cooling requirements, including, but not limited to, consideration of the following technical disciplines:

o reactor systems e auxiliary systems e power systems e

e instrumentation and control systems e thermal / hydraulics e natural convection cooldown e fire protection e' seismic and other structural loadings conditions e environmental cualification o systems reliability e probabilistic risk analyses e overall plant response to accidents e systems interactions It is anticipated that the Task Action Plan for resolution of this USI will begin with the development of criteria for judging the adequacy of current shutdown decay heat removal requirements (including the extent to which current operating LWRs satisfy current requirements).

Before alternate decay heat removal system concepts are considered, it is important to understand how well current systems cope with dominant

-accident sequences which can jeopardize plant safety.

If the present criteria are found to be unacceptable, design criteria for both existing and alternate decay heat removal systems will be developed, as appropriate.

Design criteria will have to consider both frequent events (such as loss of offsite power, loss of feedwater, small LOCAs) and special emergencies s(such as seismic events, sahatage, airplane crash). Because of the broad spectrum of types M LWRs currently operating and the wide variation in the years they were put into service, a considerable number of existing plants will have to be analyzed; this fact contributes signi-ficantly to the rather extensive period (approximately 3 years) to complete this study. The results of the study are expected to show'

.three possible outcomes:

(1) that.are acceptable as is, (2) plants with decay heat removal systems plants whose existing decay heat removal systems need relatively minor upgrading, and (3) plants that are completely unacceptable ~ and must have a completely separate and independent shutdown

-cooling system installed.

In any event, this study will ensure the development of a comprehensive and consistent set of shutdown cooling system requirements.

Basis for Continued Plant Operation and Licensing The-auxiliary feedwater(AFW) system is a very important safety system in terms of providing a heat sink via the steam generators to remove core

-decay heat. The THI-2 accident and subsequent studies have further highlighted the importance of the AFW systems. As previously indicated,

'A-3

the NRC staff required certain upgrading of the AFW systems for all LWRs following the TMI-2 accident. Although this USI will investigate alternative means of decay heat removal, the NRC staff feels that the action taken following the TMI-2 accident justifies continued operation and licensing pending completion of this USI. Further discussion and the bases for this view are provided below for each type of LWR.

TMI-2 Accident The accident at TMI-2 on March 28, 1979 involved a main feedwater t v.sient, coupled with a stuck-open pressurizer power-operated relief valve and a temporary failure of the auxiliary feedwater system, and subsequent operator intervention to severely reduce flow from the safety injection system. The severity of the ensuing events and the potential generic aspects of the accident (as related to other operating reactors) led the NRC to initiate prompt action to:

(1) ensure that other reactor ifcensees, particularly those with plants similar in design to TMI-2, took the necessary action to substantially reduce the likelihood for TMI-2 type events, and (2) investigate the potential generic implications of this action.

The Bulletins and Orders Task Force (B&OTF) was established within the NRC Office of Nuclear Reactor Regulation (h J) in early May 1979, its work was completed on December 31, 1979. This task force was responsible for reviewing and directing TMI-2-related staff activities associated with NRC Office of Inspection and Enforcement (IE) bulletins, Commission Orders, and generic evaluations of loss-of-feedwater transients and small-break loss-of-coolant accidents for all operating plants to assure their continued safe operation. NUREG-0645, " Report of the Bulletins and Orders Task Force," sumarizes the results of the work performed.

Generic and Plant-Specific Studies For operating reactors designed by the Babcock and Wilcox Company (B&W) an initial NRC staff study was completed and published in NUREG-0560,

" Staff Report on the Generic Assessment of Feedwater Transients in Pressurized Water Reactors Designed by the Babcock & Wilcox Company."

This study considered the particular design features and operational history of B&W-designed operating plants in light of the TMI-2 accident and related current licensing requirements. As a result of this study, a number of findings and recommendations resulted which are now being pursued.

Generally, the activities involving the B&W-designed reactors are reflected in the actions specified in the Commission Orders. Consequently, a number of actions have been specified regarding transient and small-break analyses, upgrading of auxiliary feedwater reliability and performance, procedures for operator action, and operator training. The results of the NRC staff review of the B&W small-break analysis is published in NUREG-0565, " Generic Evaluation of Small-Break Less-of-Coolant Accident Behavior in Babcock & Wilcox-Designed Operating Plants."

A-4.

\\

Similar,tudies have been completed for the Westinghouse (W), Combustion Engineering (C-E), and General Electric (GE)-designed operating plants.

These studies, which also focus specifically on the predicted plant performance under different accident scenarios involving feedwater transients and small-break loss-of-coolant accidents (LOCAs), are published in NUREG-0611. " Generic Evaluation of Feedwater Transients and Small-Break Loss-of-Coolant Accidents in Westinghouie-Designed Operating Plants"; NUREG-0635, " Generic Evaluation of h edwater Transients and Small-Break Loss-of-Coolant Accidents in Combu:. tion Engineering-Designed Operating Plants;" and NUREG-0626, " Generic Eva.9ation of Feedwater Transients and Small-Break Loss-of-Coolant Accid a ts in GE-Designed Operating Plants and Near-Tem Operating License Applications."

Based on a review of the operating plants in light of te ~MI-2 accident, the NRC staff reached the following conclusions:

(1) The continued operation of the operating plants is acceptable provided that certain actions related tc the design and operation of the plants and the training of operators, as identified in NUREG-0645, are implemented in keeping with the recommended imple-mentation schedules.

(2)

The actions taken by(the licensees of operating plants in responseincluding the to the IE Bulletins

" Generic Assessment of Delayed Reactor Coolant Pump Trip During Small Break Loss-of-Coolant Accidents in Pressurized Water Reactors")

provide added assurance for the protection of the health and safety of the public.

In addition, the B&OTF independently confirmed the safety significance of those related actions recomended by other NRR task forces as discussed in NUREG-0645.

Pressurized Water Reactors (PWRs)

The primary method for removal of decay heat from pressurized water reactors is via the steam generators to the secondary system. This

. energy is transferred on the secondary side to either the main feedwater or auxiliary feedwater (AFW) systems, and it is rejected to either the turbine condenser or the atmosphere via the steamline safety / relief valves. As previously indicated, following the'TMI-2 accident, the importance of the AFW was highlighted and a number of steps were taken to improve the reliability of the AFW system (see NUREG-0645, " Report of the Bulletins and Orders Task Force").

It was also stipulated that operating' plants must be capable of providing the required AFW flow for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> from ow AFW pump train, independent of any AC power soure.e. (that is, 'if both off-site and on-site ac power sources are lost).

Pressurized water reactors also have alternate means of removing decay heat if an extended loss'of feedwater is postulated. This method is known as " feed and bleed" and uses the' high pressure injection (HPI) system to add water coolant (feed) at high pressure to the primary syste.n. - The-decay heat increases the system pressure and energy is

-A-5

removed through the power-operated relief valves (PORV) and/or the safety valves (bleed), if necessary.

It should be noted that some PWRs incorporate HPI pumps that cannot operate at full system pressure (cutoff head about 1500 psi). For those cases, the PORVs can be manually opened, thereby reducing the system pressure to within the operating range of the HPI. Vendor analyses have shown that the core can be adequately cooled by this means.

At low primary system pressure (below about 200 psi), the long-term decay heat is removed by the residual heat removal (RHR) system to achieve cold shutdown conditions.

Boiling Water Reactors (BWRs)

The principal means for removing decay heat in boiling water reactors while at high pressure is via the steam lines to the turbine condenser.

The condensate is normally returned to the reactor vessel by the main feedwater system; however, the steam turbine-driven reactor core, isolation cooling (RCIC) system is provided to control primary system inventory, if an abnormal event occurs where ac power is not available.

If the condenser is assumed to be unavailable, energy can be removed via the safety / relief valves to the suppression pool. Also, a high pressure coolant injection (HPCI) system or high pressure coolant spray (HPCS) system is provided on most BWRs as a backup to the RCIC system. These systems can recirculate fluid to the reactor vessel from either the condensate storage tank or the suppression pool.

When the primary system is at low pressure, the decay heat is removed by the RHR system.

If the RCIC. system and HPCI/HPCS systems are unavailable so that primary system pressure cannot be reduced, the pressure can be

' reduced by the automatic depressurization system (ADS), which opens the safety / relief valves and rejects energy to the suppression pool. At low pressure, long-term cooling in the RHR mode is initiated to achieve cold shutdown conditions.

In some earlier BWRs, an RCIC system was not provided.

For those cases, an isolation condenser was provided as a passive backup means for removing decay heat while at high system pressure.

Conclusion In summary, although mgrading of current decay heat removal systems was required following the TMI-2 accident, this USl will evaluate the benefit of providing alternate means of decay heat removal which could sub-stantially increase the plants' capability to handle a broader spectrum of transients and accidents. The study will consist of a generic systems

~

evaluation and will result in recommendations regarding the desirability

- of, and possible design requirements for, improvements in existing systems or an alternative decay heat removal method, if the improvements

.or alternative can significantly reduce the overall risk to the public.

Accordingly,. it is concluded that plants-may continue to-be licensed and operated prior to the ultimate resolution of this generic issue without endangering the health and safety of the public.

-A-6

2.

Seismic Qualification of Equipment in Operating Plants (A-46)

Issue Definition The design criteria and methods for the seismic qualification of mechanical and electrical equipment in nuclear power plants have undergone significant change during the course of the commercial nuclear power program.

Consequently, the margins of safety provided in existing equipment to resist seismically induced loads and perform the intended safety functions may vary considerably. The seismic qualification of the equipment in operating plants must, therefore, be reassessed to ensure the ability to bring the plant to a safe shutdown condition when it is subject to a seismic event. The objective of this Unresolved Safety Issue is to establish an explicit set of guidelines that could be used to judge the adequacy of the seismic qualification of mechanical and electrical equipment at all operating plants in lieu of attempting to backfit current design criteria for new plants. This guidance will concern equipment required to safely shut down the plant, as well as equipment whose function is not' required for safe shutdown, but whose failure could result in adverse conditions which might impair shutdown functions.

Current staff criteria for seismic design and qualification are documented in Standard Review Plan 3._2.2, 3.9.2, 3.9.3, and 3.10 and in Regulatory Guides 1.92 and 1.100. Mechanical and electrical equipment in older nuclear plants was designed before these criteria were developed. This does not mean, however, that adequate safety margins do not exist. The design rules and procedures in use at the time the older olants were designed incorporated inherent conservatisms.

Instead of using current licensing criteria to qualify equipment in operating reactors, more definitive criteria are needed to establish an acceptable safety margin.

Task Action Plan The NRC staff has initiated the preparation of a Task Action Plan on Seismic Qualification of Equipment in Operating Plants which will provide a description of the issue, a description of the NRC staff approach to resolving the issue, a general discussion of the basis for continued g

operation and licensing pending resolution of the issue, a discussion of the technical organizations involved in the task, and the requirements for manpower and program support tunding.

It is expected that preparation a

and-approval of this plan will taken about 3 months. The completion date for this program depends on obtaining the necessary program funding and on implementation time for technical assistance contracts, probably on a: competitive. basis. A preliminary estimate for completion of the program is May 1983.

The primary goal of Task A-46 will be the development of a comprehensive and consistent set of criteria ~and guidelines for use in assessing the capability of equipment important to safety to survive a seismic event and to perform its intended safety function.

i A-7

The staff approach to resolution of the USI will involve three major tasks:

(1) a survey of equipment design provisions and the qualification technology and programs used by(designers and vendors of equipment installed in operating plants, 2) definition of operability and functional requirements of classes and types of equipment, and (3) development of qualification procedures and acceptance criteria for classes of equip-ment.

Justification for Continued Operation Although many operating plants were designed before the develop-ent of current licensing criteria, the design rules and procedures incorporated inherent conservatisms. These include:

(1) the margins between allowable used for combining loads, (gth of engineering materials, (2) the methods stresses and ultimate stren

3) the inherent ductility of materials, and.(4) the seismic resistance of nonstructural elements which are not normally considered in design calculations.

An expanding data base of observations at large industrial facilities that have experienced strong ground motion suggests that these facilities have significant seismic resistance capabilities. From the data, it can be concluded that the inherent seismic resistance of engineered structures and equipment is usually much greater than is assumed in both past and current analysis and design procedures. Even facilities designed with very nominal seismic considerations, have been able to withstand severe seismic environments without loss of safety function. When even the

- most modest attention is paid in design to providing lateral load carrying paths, significant capability results. Nuclear power plants have been designed using more rigorous techniques; therefore, it is reasonable to expect even higher inherent margins than are implied from the data base of observations.

'Re-evaluation of the seismic design of the oldest operating reactors has been initiated in the SEP program. These evaluations have indicated that certain corrective measures are re margins (action on this is in progress) quired to improve seismic design However, when seismic design was considered on an integrated basis, it was concluded that equipment was adequate to resist the designated seismic hazard. This conclusion was predicated in part on (1) the consideration that there are degress of redundancy and diversity of' safety systems and components which avoid dependence on any one' component or system, and on (2) the premise that a comprehensive equipment maintenance program is carried out.

Because of the experience gained in'the review of the SEP facilities and the continued staff review of seismic issues, it is concluded that operating plants can continue to operate without endangering the' health and safety of the'public, pending resolution of this Unresolved Safety Issue.

a

-A-8 t

3.

Safety Implications of Contn>l Systems (Task A-47)

Issue Definitipn This issue concerns the potential for transients or accidents being made more severe as a result of the failure or malfunction of control systems.

These failures or malfunctions may occur independently, or as a result of the accident or transient under consideration. One concern is the potential for a single failure (such as loss of power supply, short circuit, open circuit, or sensor failure) to cause simultaneous malfunction of several control features. Another concern is for a postulated accident to cause control system failures which would make the accident more severe-than analyzed. Accidents could conceivably cause control system failures by creating a harsh environment in the area of the control equipment or by physically damaging the control equipment.

The effects of control system failures can be divided into the following categories:

(1) The effects of control system failures on " anticipated operational occurrences."

" Anticipated operational occurrences" are defined as those conditions of nonnal operation which are expected to occur one or more tines during the life of a nuclear power unit.

(2) The effects of control system failures on " accidents."

"Accidents" are defined as those conditions of abnormal operation that result in limiting faults. These are occurrences that are not expected.to occur but are postulated because their consequences would include the potential for the release of significant amounts

.of radioactive material.

(3) The effects of control system failures on operator actions.

Operator action would be considered with the plant at shutdown, during plant heatup or cooldown, following plant trips, or following actuation of engineering safeguards systems. The control systems failures include those which deprive the operator of required information for manually controlling plant conditions, those which

. provide confusing or incorrect information to the operator, or those which may initiate or compound transients.

'Although it is generally t,elieved that such control system failures -

- would not lead to serious events or result in conditions that '

safety' systems cannot' safely handle, rigorous indepth studies have not been performed to confirm this belief..

In the past, NRC staff reviews have been performed on currently. licensed

. plants with the goal ~ of ensuring that control. system failures will not prevent automatic or manual initiation and operation of any safety system equipment required to trip the plant.or maintain the plant A-9

~

m m

in a safe shutdown condition following any " anticipated operational occurrenca" or " accident." The approach has been either to provide physical independence between safety and nonsafety systems or to require isolating devices, such as isolation amplifiers between safety and non-safety systems, so that failures of nonsafety system equipment cannot propagate through the isolating devices to impair uperation of the safety system equipment.

In addition, a specific set of " anticipated operational occurrences" has been analyzed to demonstrate that plant trip and/or safety system equipment actuation occurs on a time scale such that no core damage results.

In these analyses, conservative initial plant conditions, core physics parameters, and instrumentation setpoints have been assumed. Where active control system operation would mitigate the consequences of the transient, no credit is taken for the control system operation. Where active control system operation would not mitigate the consequences of a transient, no penalties are taken in the analyses for incorrect control system actions that might be caused by control system equipment failures.

It should be emphasized that the issue is not whether reactor trip or safety system equipment action would be defeated, but whether trip or equipment action would occur in time to maintain the core design limits e

appropriate for " anticipated operational occurrences" and, more importantly, whether control system failures might confuse the ooerator in such a way that the operator takes improper actions which worsen the transient consequences.

Task Action Plan The NRC staff has initiated the preparation of a Task Action plan on Safety Implications of Control System requirements which will provide a description of the issue, a description of the NRC staff approach to resolving the issue, a general discussion of the basis for continued operation and licensing pending resolution of the issue, a discussion of the technical organizations involved in the task, and the requirements for manpower and program supporting funding.

Preparation and approval of the olan is expected to take about 3 months. The completion date for this program depends on obtaining the necessary program funding and on implementation time for technical assistance contracts, probably on a competitive basis. A preliminary estimate for completion of this program is April 1984.

~

The primary goal of Task A-47 will be the devt:lopment of a comprehensive and consistent set of requirements and desigr. criteria for existing and future LWRs. Specific subtasks will be defined. One such subtask will be to study the reactor and/or steam generator overfill transient in

-BWRs and PWRs to determine the need for preventative and/or mitigating design measures to preclude or minimize the consequences of this transient.

Other' subtasks, yet to be developed, will-(1) define other scenarios that should also be considered

'(2) develop a methodology for evaluating these scenrios A-10.

~.

(3) develop acceptance criteria for the results of these scenarios (4) develop guidelines for improvements that must be made where acceptance criteria are not met These subtasks will address (1) measures to improve the reliability of control systems (such as quality assurance criteria, environmental qualification, or increased redundancy)

(2) measures to reduce the effects of control system failures (3) measures to improve the capability of coping with effects of control system failures (such as procedural improvements, improvements in information display, human factors improvements, improvements in operator training, and/or changes in safety system setpoints)

Basis for Continued Operation As previously noted, NRC staff reviews have been performed on currently licensed plants with the goal of ensuring that control system failures (either single or multiple failures) will not prevent automatic or manual initiation and operation of any safety system equipment required to trip the plant or maintain the plant in a safe shutdown condition following any " anticipated operational occurrence" or " accident." In addition, a specific set of " accidents" has been analyzed to demonstrate that plant trip and/or safety system equipment actuation occurs with sufficient capability and on a time scale such that the potential consequences to the health and safety of the public are within acceptable limits.

In

- these analyses, conservative assumptions analogous to those for the

" anticipated operational occurrences" have been used. The conservative analyses perfomed and the " accidents" chosen for the analyses are intended to demonstrate that the potential consequences to the health and safety of. the public are within acceptable limits for a wide range of postulated events even though specific actual events might not follow the same assumptions made in the analyses.

Accordingly, it.is concluded that plants may continue to be licensed and operated prior to the ultimate resolution of this generic issue without endangering the health and safety of the public.

3afe_ ogen Control Measures and Effects of Hydrogen Burns on Hydr 4.-

ty Equipment (Task A-48)

Issue Definition

' Following a.LOCA in i LWR plant, combustible gases, principally! hydrogen, may accumulate inside the primary reactor containment as a result of:

(1), metal-water reaction 19volving.the fuel element cladding; (2) radiolytic decomposition of the water in the reactor core and the containment sump;

. (3) corrosion of certain construction materials by the spray solution;

~

- and (4) synergistic chemical, thermal, and radiolytic effects of post-accident' environmental conditions on containment protective coating systems and electric cable insulation.

A-11

~

4

In the event of degraded or melted core, a large additional amount of hydrogen would be generated as a result of a reaction between the molten fuel and the concrete containment base. Other combustible gases may also' be generated by this reaction.

Because of the potential for significant hydrogen generation as the result of an accident, Title 10 of the Code of Federal Regulations (10 CFR) Section 50.44, " Standards for combustible gas control systems in light water cooled power reactors," and General Design Criterion 41,

" Containment atmosphere cleanup," in Appendix A to 10 CFR Part 50 require that systems be provided to control hydrogen concentrations in the containment atmosphere following a postulated accident tc ensure that containment integrity is maintained. Conventional hydrogen control systems (for example, hydrogen recombiners) have historically been installed to provide the capability to control the hydrogen accumulation as _a result of radiolytic decomposition of water, corrosion of metals

,inside containment, and environmental effects on coatings and insulation.

The design capability or margin to control the contribution to hydrogen accumulation resulting from a metal-water reaction involving the fuel cladding. has historically been provided by the net free volume inside the containment structure. That is, the containment volume was large enough such that hydrogen generated and released from the cladding reaction would not reach a uniform concentration approaching the lower limit of flannability. The reason for this approach is that the rate of hydrogen release _as a result of'a cladding reaction is assumed to be rapi_d following a postulated accidcut (that is, on the order of minutes).

This corresponds to a release: rate well beyond the capability of conventional hydrogen control systems. However, the containment net free volume was

-found to be sufficient for providing the initiai protection, and hydrogen control systems would be actuated later to control eqdrogen accumulation from the other sources and gradually reduce the hydrogen concentration

.inside' containment.

L10 CFRlSection'50.44 requires that the combustible gas control system provided'be ~ capable of handling 'the hydrogen generated as a result of degradation of the emergency core cooling system (ECCS) in such a way. that the:hy~drogen release is five times the amount calculated in

. demonstrating' compliance with 10 CFR Section 50.46 or the amount corresponding

to reaction of; the

cladding 'to aidepth of '0.00023 inch, whichever amount is: greater.

The accident 'at TMI-2'on March 29,1979 resulted in a metal-water reaction ~ which -involved hydrogen generation well in excess of-the

' amounts specified in.10 CFR Section 50.44. - As a result, it became

apparent;to'NRC that additional hydrogen control and mitigation measures would have ~ to be-considered for all nuclear power plants. This topic-was first' address'ed in the Lessons Learnd Nport (NUREG-0578) and Lsubsequently-included in the TMI Actio-P' e, NUREG-0660 (item II.B.7).

. As_'part of;-- and asa result of L-- tec :onsiderations,' the Commission udete'rmined that _a rulemaking prors,tu euld be undertaken to deffne the~ manner 'and extent _to which hyagh. vlution-and _other effects of a

?-12!

p A

1 w

e-

i i

d degraded core must be taken into account in plant design. An advance notice of the rulemaking proceeding on degraded core issues was published in the Federal Register on October 2,1980.

Because completion of this rulemaking may require a number of years, a set of short-term or interim actions relative to hydrogen control requirements were developed 'and implemented. These interim measures were described in a second notice in the October 2,1980 Federal Register.

' Analyses conducted by the Commission and consultants indicated that the containment oesigns for all nuclear plants can generally be placed in three categories on the basis of their capability for accommodating large hydrogen releases and the subsequent burning of hydrogen without loss of containment integrity.

These three categories are defined in terms of the relative containment

' volume as small, intermediate, ano large. The number of reactor units in each of the three categories now operating and under construction is as follows:

4 INVENTORY 0F CONTAINMENT TYPES Number of Units Category'

-Size Type Operating Under Construction 1

Small Mark I/BWR.

22 3

Mark II/BWR 0

11

' 2 Intermediate Ice Condenser /

3 7

PWR Mark III/BWR 0

18 3

Large Large Dry /PWR 45 70 Total-70 109

- Small Containments The small containments include the Mark I and Mark II' containments for BWRs. Their design pressures range from about 45 psig to 62 psig.

3 Their: net-free volumes' are approximately '300,000.ft. Containment

- failure is likely to result from. combustion of the hydrogen in air produced by-a metal-water reaction involving more than 6 to 9% of the fuel l cladding. 7 The Commission determined 'that ~these units should be inerted,

. and a proposed interim rule implementing this finding was published in the Federal Register-onl0ctober 2,1980.

Inerting will be a licensing requirement-for all new Mark I and Mark II units.

A-13 c

4 m,

+

2-%

4 I

Intermediate Containments The intermediate size containments include the ice condenser and Mark III containments. Their desian nressures range from 12 to 15 psig, and 3

their volumes range from 1.2 to 1.5 million ft.

Some rather extensive structural response analyses have shown that the 12 psig Sequoyah (ice condenser) containment can withstand up to 45 psig without failure.

Containment failure is likely to result from combustion of the hydrogen produced by a metal-water reaction involving more than about 25% of the fuel cladding, if combustion initiation is assumed to occur at the least favorable time (that is, when all hydrogen has been released), thus releasing all.the potential._ reaction energy simultaneously. The Commission found Jit prudent to require interim resolutions to the hydrogen issue for these intermediate-size containments. The Tennessee Valley Authority

.(TVA) proposed an interim distributed ignition system (IDIS) for the Sequoyah clant and was reouired Sv a license condition to demonstrate the effectiveness of the system in preventing containment rupture before January 31, 1901.

For operation of the plant beyond January 31, 1982,

. the-NRC must confirm that adequate H control measures are installed and 7

will perform their intended functions in a manner that provides adequate safety marqins. The staff is pursuing similar interim resolutions with all the other ice condenser owners and with Mark III owners as well.

-Larne Containments The large dry containments for PNR plants have design pressures ranging 3

-from 45 to 60 psig and volumes from about 2.0 to 3.0 million ft.

Combustion of the hydrogen produced by metal _-water reaction involving

- all the Zirconium cladding will produce pressures that may exceed the design pressures but that are generally well below the estimated failure-pressures. Therefore, no near-term mitiqation measures are being required for hydrogen control in large dry containments.

With respect to hydrogen control measures, the proposed interim rule requires that all Mark I~and Mark-II containments be inerted.

It also

.reauires that the owners of all plants ~with other containments perform.

cert'ain' analyses of accident scenarios _ involving hydrogen releases and furnish the-. staff with a proposed approach for mitigating these hydrogen releases.

The final rule was initiated with the publication of an advance notice of rulemaking on October 2,1980. - Public commnts on this notice were due'no later than December 31, 1980. The staff has a number of technical 4

assistance and research programs that are designed to support this rulemaking_ effort.

The rulemaking proceeding will-address both degraded core and melted

. core issues.

In the area of hydrogen control, it will prescribe requirements

. that'are appropriate' for--operating plants as well as for plants that are at varir.us stages of construction.

In this regard, the considerations will' include: -(1) the sources,' rates, and amounts of hydrogen generation and release to the containment,-includin the~ postulated reaction _of a molten core with the concrete _ floor; (2)gthe distribution characteristics, i

'A >-

,l~

including stratification and pocketi ng potential; (3) the performance characteristics and adverse impacts of the various mitigation systems; (4) the characteristics and requirements for hydrogen monitoring systems; (5) the structural response of the containment to the various loadings associated with the hydrogen release assumptions and control systems, including local detonations and molten fuel concrete ineraction; and (6) the requirements dealing with survivability of equipment to assure continued plant safety. To assure continued core cooling following a degraded core accident, essential equipment required for safe shutdown of the reactor must be able to survive the adverse environment created

'< the degraded core accident.

If the mitigative measures for accommodating large releases of hydrogen involve the controlled combustion of the hydrogen, then the various pieces of equipment needed to assure continued functioning of the mitigative system and the core cooling system must be identified and shown to be capable of surviving the associated environment.

This includes the short Juration but high temperature condition and the brief. periods of high. heat fluxes produced by the flame front. The ability tc wrvive the effects of local hydrogen detonations also needs attention.

~

The continuing study of hydrogen control measures by the Commission staff is required to support the rulemaking proceeding as well as the reviey of operating licenses and construction permits. The designation of hydrogen control measures and equipment survivability as an unresolved

. safety issue provides a focal point for all Commission staff effort and will result _in an integrated program for resolution of Commission concerns.

Task Action Plan The NRC staff has initiated the preparation of a Task Action Plan on Hydrogen Control Measures which will provide a description of the issue, a description of the NRC staff approach to resolving the issue, a general discussion of the basis for continued operation and licensing pending resolution of the-issue, a discussion of the technical organi-zations involved in the task,-and the' requirements for manpower and

. program support funding.

It is expected that it will take about six months for preparation and approval of the above plan. The completion date for this-program depends on obtaining the necessary program funding

.and implementation time for Technical Assistance contracts, probably on

.x a competeti.ve basis. A ' preliminary-estimate for completion 'of this

. program is April-1984.

Staff effort on.this USI-is presently planned for the following tasks and subtasks:

Task 1 Definition of hydrogen sources, release rates, and amounts

. generated

' Task 1.1. Definition of worst case accident scenarios

.A-15

.,--n

Task 1.2 Development of analysis procedures and computer codes Task 2 Definition of hydrogen distribution characteristics in containment including stratification and pocketing Task 3 Investigation of H2 mitigation svstems Task 3.1 Deliberate ignition Task 3.2 Inerting of containments Task 3.3 Water fogging Task 3.4 H and 0 _ scavenging systems 2

2 Task 4 Development and evaluation of hydrogen monitoring systems Task 5 Capability of containment to withstand hydrogen burns and detonations Task 6 Survivability of safety equipment A detailed description of the work to be performed under each task will be prepared.

Basis for Continued Plant Operation and Licensing The only' interim action required by the staff with respect to the capability for hydrogen management is the inerting of the Mark I and Mark II containments for BWRs.

It is the view of the Commission staff that if~this_ action is taken, continued operation and licensing is justified pending completion of this USI and the rulemaking proceeding on degraded cores and hydrogen management. The bases for this view for each class of containments are summarized below.

-Mark I and Mark II Containments

' Metal-water reactions'in the range of 30 to 50% can produce hydrogen concentrations in Mark I and Mark II air-filled containments that are

-well_within the range for rapid combustion and detonation.

Inerting these containments as proposed by the interim rule will eliminate the concern relative to combustion-and detonation. - The peak containment 1pressuresiconsidering the effect of the noncondensible hydrogen gas and the associated exothermic reaction energy, will approach twice the design _ pressure-for the worst case assumption of an uncooled core immediately-following a reactor shutdown. The staff believes Mark I and Mark IIicontainments can withstand, without failure,.a slowly applied pressure:that is as much as two or three times-the design pressure.

- Accordingly, pending completion of this USI and the rulemaking proceeding 4

L on hydrogen'managemer.t,'the-staffJconcludes that continued operation and Llicensing of Mark I'and Mark IIc containment plants-is justified if

-the containments are inerced.

A-16 V

Ice Condenser Containments Metal-water reactions in the range of 30 to 50% in ice condenser contain-ment plants can produce hydrogen cc'centrations in the range of 9 to 15%. At these concentrations, detonation is not expected.

Moreover, combustion will be inhibited for steam concentrations above 70%, which is also expected in the event of a LOCA. However, operation of the containment spray system and/or the e Mcts of passive heat sinks will condense the steam and produce mixtures. hat are combustible.

Assuming that there is combustion of hydrogen gas and considering the effect of the noncondensible hydrogen gas and the energy associated with

-its formation, the estimated amount of metal-water reaction needed to achieve the containment design pressure and failure pressure are 15% and 25%, respectively. The design pressures for ice condenser plants are between 12 and 15 psig, and the corresponding failure pressures are estimated to be between 36 and 47 psig.

The "Short Tenn Lessons Learned" from the TMI-2 accident have been implemented at all operating plants and will be implemented at all the other plants before issuance of the operating licenses. This action will reduce the likelihood of accidents that could lead to substantial amounts of metal-water reaction.

Inerting was considered as a mitigative measure for ice condensers.

It was concluded that although it might improve the hydrogen management capability, certain important maintenance functions would be restricted.

The Conunission has' required that a distributed ignition system be installed in ice condensing containments as a licensing requirement. The igniter systems are required as an interim measure to provide further assurance t h t containment integrity would be maintained in the evert of a degraded core accident.

Therefore, because the likelihood of degraded LOCAs has been made more

. remote by implementation-of the "Short Term Lessons Learned" and because substantial amounts of metal-water reaction can be tolerated without jeopardizing containment integrity, the staff ~ concludes that, pending completion of this USI and the rulemaking proceeding, continued operation

~

and licensing of nuclear plants with ice condenser containments is justified.

Mark III Containment ~

If 30 to 50%'of the Zircaloy. cladding were to oxidize in a Mark III containment system, the resultant uniform concentration of hydrogen gas would be between about:13 and 21%. To~ avoid detonation and combustion

for.the noninerted containment, the steam concentrations would'have to be greater than ~about 55 and 70%, respectively.

A-17

If it is assumed that the hydrogen gas does not burn, the resulting containment pressure will be between 15 and 20 psig, respectively, for the assumed 30 and 50% metal-water fractions.

In arriving at these containment pressures, the noncondensible hydrogen gas and its associ-ated energy of formation are assumed to enter the containment along with the other LOCA mass and energy sources.

If it is assumed that the hydrogen gas does burn, the Mark III containment can acconinodate the burning of the hydrogen produced by about 17% metal-water reaction without exceeding its design pressure and about 23%

metal-water reaction without exceeding twice the design pressure. The design pressure for the Mark III containments is 15 psig. While analyses have not been performed to determine their failure pressures, the staff believes that it would be at least twice the design pressure (30 psig).

This. view is based on the analysis that was performed for the ice condenser plants discussed above.

It is, therefore, concluded that pending resolution of this USI and the rulemaking proceeding, additional mitigation systems are not needed for the Mark III containment.

Subatmospheric Containments TIf as much as 50 to 65% of the Zircaloy cladding were to react with steam or water in a subatmospheric containment plant, the resulting containment pressure would be less than its design pressure. Essentially all-of the cladding would have to be oxidized for the resulting containment pressure to exceed its' estimated failure pressure.

As indicated in the discussion for ice condenser plants, the "Short Term Lessons Learned". from the TMI-2 accident have been implemented at all operating plants.and will be implemented at all the other plants before issuance of the operating licenses. - This action will reduce the likelihood of accidents that could lead to substantial amounts of metal-water reaction.

Therefore, because the. likelihood of degraded LOCAs has been made mere remote by implementation of the "Short Term Lessons Learned" and because

. substantial amounts of metal-water' reaction-can be tolerated without jeopardizing containment integrity, it-is concluded that, pending resolution

~

~ f this USI and the rulemaking proceeding, continued operation and o

licensing of nuclear plants with subatmospheric containments is justified.

Dry Containments g

3 of net free tiost dry containments have about two mill _ ion or more ft

-volume.: -Assuming 30-to 50% metal-water reaction in the core, the resulting unifonnly mixed concentration of hydrogen in the containment will_ range from 6.to 10%.. ' Thisiis~well below the concentrations for detonation and

~

even below the limits-for combustion if there were more than 50% steam in the: containment atmosphere.

A.

A-18

The design pressures for these large containments range from about 45 to 60 psig. Analyses performed on inc Zion and Indian Point plants show that the failure pressures are greater than twice the design pressures.

If.the substantial amount of metal-water reaction were to occur following onset of the large LOCA and while the containment is still near its peak pressure, the pressure increase caused by the noncondensible hydrogen gas and its associated exothermic formation energy will be substantially

-less'than the failure pressure.

If the metal-water reaction were to occur well after onset of the large LOCA, when the containment heat

. removal systems have been able to condense most of the steam and reduce containment pressure, then a substantial margin will exist for accommodating the hydrogen generated by the metal-water reaction.

As : indicated in the above discussion for. ice condenser plants, the "Short Term Lessons Learned" from the TMI-2 accident were implemented

.before issuance of.the operatin; licenses. This action will reduce the likelihood of accidents that could lead to substantial amounts of metal-

-water reaction.

. Accordingly, pending resolution of this USI and the rulemaking proceeding on hydrogen generation, continued operation and licensing of nuclear plants.with dry containments-is found to be acceptable.

I A-19

BIBLIOGRAPHY U. S. Nuclear Regulatory Commission, " Generic Assessment of Delayed Reactor Coolant Pump Trip During Small-Break Loss-of-Coolant Accidents

'in Pressurized Water Reactors," USNRC Report, NUREG-0623, NovemNr 1979.

4 U. S. Nuclear Regulatory Comission, " Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents on Combustion Engineering-Designed Operating Plants," USNRC Report, NUREG-0635, February 1980.

-U. S. Nuclear' Regulatory Comission, " Generic Evaluation of Feedwater Transients and Small-Break Loss-of-Coolant Accidents in GE-Designed Operating Plants and Near-Term Operating License Applications," USNRC Report, NUREG-0626, January 1980.

U. S. Nuclear Regulatory Commission Report, " Generic Evaluation of Feed-

-water Transients and Small-Break Loss-of-Coolant Accidents in Westinghouse-

- Designed Operating Plants," USNRC Report, NUREG-0611, January 1980.

U. S. Nuclear Regulatory Commission Report, " Generic Evaluation of Small-Break Loss-of-Coolant Accident Behavior in Babcock and Wilcox-Designed Operating Plants," USNRC Report, NUREG-0565, January 1980.

.U. S. Nuclear Regulatory Commission, " Investigation and Evaluation of Cracking Incidents in Piping in Pressurized Water Reactors,"'USNRC Report, NUREG-0691, September 1980.

U. S.- Nuclear-Regulatory Comission, "NRC Task Action Plan Developed as a-Result of the TMI-2 Accident," USNRC Report, NUREG-0660, May 1980.

'U.- S. Nuclear Regulatory Commission, " Reactor Safety Study - An Assessment of Accident Risks in U. S. Comercial' Nuclear Power Plants,"

Executive Sumary, WASH-1400, NUREG-075/014, October 1975.

• U. S. Nuclear Regulatory Comission, " Report of the Bulletin and Orders Task Force," USNRC Report, NUREG-0645, January 1980.

U. S. Nuclear. Regulatory Comission, " Review of Licensee Event Reports (1976 - 1978)," USNRC Report, NUREG-0572, September 1979.

U. S. Nuclear Regulatory Commission, " Staff Report on the Generic

' Assessment of Feedwater Transients in Pressurized Water Rea-tors

,esigned by Babcock and Wilcox," USNRC Report, NUREG-0560, May 1979.

D U. S. Nuclear Regulatory Comission, "TMI-2 Lessons Learned Task Force:

Status Report and Short Term Recommendations," USNRC Report, NUREG-0578, July 1979.

A-20

All of the cited reports are available for purchase from the NRC/GP0 Sales Program, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555, and/or the National Technical Information Service, Springfield, VA 2,7161.

• WASH 1400 is available in microfiche only upon written request to the Division of Technical Information and Document Control, U.S. Nuclear Regulatory Commission, Washington, D. C. 20555.

m Y

A-21

i O

APPENDIX B

SUMMARY

DISCUSSION OF CANDIDATE ISSUES NOT DESIGNATED AS UNRESOLVED SAFETY ISSUES

I CONTENTS Page Issdes Requiring Further Study........................

B-1 Training and Oualification of Operating Personnel

.-(Item I.A.2.2)......................................

B-1 Long-Term Upgrading of Training and Qualification of Operating Personnel (Item I. A.2.6).................. B-2

' Long-Term Training Simulator tipgrade (Item I.A.4.2)...

B-3 Requirements for Operator Fitness (Item I.A.3.3)......

B-3

' Organization and' Management, Long-Term Improvements

.(Item-I.B;1.1)......................................

-B-4 Operating Procedures-(Item I.C.9).....................

B-4 LControl Room Design (Items I.D.1, I.D.2, I.D.3, and I.D.4)..............................................

B-5

-Expansion of GA-List-(Item I.F.1).....................

B-5

' Developmer:t 'of. More' Detailed QA Criteria. (Iten I.F.2).

B-6 Pre-Operational' and Loe-Power esting Training Require-

-ments'(Item.I.6.1)..................................

B-6 Consideration of-Degra'dsd or Melted Cores.in Safety

- Review (Item II.B.8)................................

B-6 Reliance on ECCS-(Item II.E.2.1)......................

B ECCS, Uncertainties'in Per:formance Predictions-(Item

-II'.E.2.3)...........................................

B-7 Containment Design Integrity Check.(Item II.E.4.3)....

B-8 C

Design: Sensitivity of B&W Reactors'(Item II.E.5.1)....

B-8 In Si tu Testing of Valves -(Item II.E.6.1);............

B-8

.; Study'6f Control and Protective Action Design Require-mentsl(ItenII.F.4)..................................B-9

- C1assification: ofJ Instrumentation,- Control, ~ and '

L El ectrical Equipment -(Item I I.F. 5)..........~......... - B-9 NRC. Emergency Preparedness -- Training, Drills, and

Tests-(Item-III.A.3.5)..............................

B-9

_~

-B-iii T--

Page Radittion Source Control - Ventilation System and

}

Radiciodine Adsorber Criteria (Item III.D.1.3)......

B-10 Inplant Radiation Moni toring (Item III.D.3.3)......... B-10

- Evaluate Elimination of PORV Function (Item II.K.3(33)) B-10 Reliability of Ventilation Monitoring Equipment....... B-10 Protective Device Reliability.........................

B-11 Instrument Set Point Drift............................

B-11

. End-of-Life and Maintenance Cri teria.................. B-11

' Design Check and Audit of Balance-of-Plant Eouipment.. B-12 BWR Control Rod Worth.................................

B-12 Fl ow-Induced Vi bra tion................................

B -Ina'dvertent Actuation ^ of Safety Injection............. B-12 Re-evaluation of Reactor Coolant Pump Trip Criteria

.(Item-II.K.3(5))....................................

B-13 Tu rbi ne Di s k C racki ng................................. B-13

. DC Power; System. Reliability...........................

B-13 BWR Jet Pump Integrity................................

B-14 1

Small Break LOCA from Extended.0verheating of~

~ Pressurizer Heaters.................................

B-14 PWR Pipe Cracks.......................................

B-14

- BWR Main Steam' Isolation Valve Leakage Control-Systems B-14 Radiation Effects on L Reactor Vessel Supports.......... B-15

Loss of-Offsi te. Pr wer. Subsequent: to a LOCA............ B-15 Safety; Implications of Steam Generator Transients and i

Accidents.....................

..................... B-15 i

' Piping and Use of. Highly Combustible Gases 1 n Vital Areas...............................................

B-15 y

Bibliography..........................................

B-17 i-

-B-iv-

.u l w

APPENDIX S

SUMMARY

DISCUSSION OF CANDIDATE ISSUES NOT DESIGNATED AS UNRESOLVED SAFETY ISSUES a

20f the issues that passed the initial screening criteria, most were not

'. designated as Unresolved Safety Issues. However, certa'n of inese issues were' identified as requiring further study to bet?.er define the

~-'

safety concern or to assess their safety significance in order to determine whether they should be designated as Unresolved Safety Issues.

The issues requiring _further study are listed below. Numbers in parentheses refer to the corresponding action item in the NRC TMI-2 Action Plan (NUREG-0660).

IssuesReofringFurtherStudy

.(1)

(2) fin situ: testing of valves (II.E.6.1)ystems (ECCS) (II.E.2.1)

Reliance on emergency core cooling s

-(3 Protective device reliability (4

-Pressurized water reactor-(PWR) pipe cracks (5,

Boiling water reactor (BWR) main steam isolation valve leakage control systems (6) Radiation effects on_ reactor vessel supports P) Safety. implications of' steam generator transients. ar.d accidentsl

.(8) _ Piping and 'use of highly combustible gases in vital areasl (9). Reliability of safe-shutdown instrumentation 2 The following sections provide a summary discus'sion of the candidate-

. issues-not designated a~ Wresolved Safety Issues, including those requiring-further study, i the bases for these conclusions.

The

' issues'are listed in the 4 ar in which they appear in Table 1-of this report.

Training and Qualification of Operating Personnel- (Item I.A.2.2)

This issue involves.a short-term potential improvement in the training-and qualification of operations personnel, other than plant operators, and. includes maintenance and technical personnel. Human error in the performance of plant operations'can.' dominate the unavailability of plant 1 equipment. ~ Such errors, however, appear to be more a ' result of poor

procedures,; administrative controls, and communications than of a 4From a = letter-from the Office for Analysis and Evaluationiof 0perational

. Data.to NRC Chairman John Ahearne dated August 1, 1980.

2From a-letter from the Advisory Committee on Reactor Safeguards to NRC Chairman John Ahearne dated August 12,.1980.

B-1 C

~

significant deficiency in the training and qualification of operaticos personnel. 10 CFR Part 55 currently specifies the requirements for reactor operator qualification and requalification. As a result of the short-term recommendations of the TMI-2 Lessons Learned Task Force, the stof' issued a letter to all power reactor licensees and applicants, dated March 29, 1980, which specified revised criteria for reactor operator qualifications that could be implemented under the existing i

regulation and provided guidance for operator training.

Related short-term actions have been taken to expand the scope of the licensee training programs, to emphasize the team aspect of the operations personnel and utility management, and to provide broader based training for mitigating core damage.

A related short-term activity involved a study performed by the Basic Energy Technology Associates (NUREG/CR 1280). This study compared the selection, training, and qualification practices of the nuclear industry to those used in the Naval Nuclear Propulsion Program. The results of this study included a number of recommendations which will be considered

'in developing training and qualification requirements for nuclear power plant operations personnel.

In any case, this issue involves a short-term tsorevement by licensees, with limited guidance from NRC. The development of firm guidelines in this area is included in "Long-Term Upgrading of Training and Qual-ification of Operating Personnel" (Item I.A.2.6).

Because a large reduction is not likely to result from these short-term improvements alone, this issue was not recommended for designa'.1on as an Unresolved

~

Safety Issue.

Long-Term Upgrading of Training and Oualification of Operating Personnel t

(Item I.A.2.6)

The ability of operators and technicians of nuclear power plants to respond correctly to abnormal conditions and to avoid errors which could lead to abnormal conditions is principally dependent upon the individual's training, experience,-and education. A number of varied incidents which have occurred throughout the history of commercial nuclear power, and in particular the TMI-2 accident, have involved errors of omission or commission by operations personnel. Consequently, the risks associated with human error could be significantly reduced by improving the rcope and content of the training programs for reactor operators, by specifying minimum training requirements.for other operations personnel, and by imposing stricter qualifications requirements for all operations personnel.

The' prin'.4 pal objective of this action plan item is longer-term development of new regulations and regulatory guides which will provide improved requirements for the training and qualification of reactor operators, senior operators,' shift sup'ervisors, auxiliary operators, technicians, J

B-2

and possibly other operations personnel. These requirements will be developed from studies of selection, training, and qualification programs

- by the staff ano contracted consultants in the field.

In a related progre that is not part of this item (NUREG-0660, Task I. A.4), the staff will review improvements in reactor simulators which could enhance the training of operations personnel.

This activity relates specifically to Task I.A.2.6 in the TMI-2 Action Plan (NUREG-0660). The revised requirements and the subsequent rule-making activities are expected to be completed in approximately two years.

Long-Term Training Simulator Upgrade (Item I.A.4.2)

This issue involves a potential improvement in operator performance by upgrading the capabilitit.s of training simulators to include programming of WASH-1400 accident sequences and adding capability to test operator diagnostic capability. The issue is not recommended for designation as an Unresolved Safety Issue because significant improvements in operator performance will be obtained through the resolution of the TMI Action

. Plan items on "Long-Term Upgrading of Training and Qualifications of Operating Personnel" and " Operating Procedures" and by improvements in areas where requirements have already been established and implementation is underway or planned, such as the short-term simulator improvement (Item I.A.4.1), use of a shift technical advisor (Item I.A.1.1), improvements in shift manning (Item I.A.1.3), and improvements in operating procedures (Item I.C). The short-term simulator upgrade includes establishing and sustaining a higher degree of realism in. training using simulators,

. including dealing with transients; modeling saturation conditions; programming multiple-failure accident sequences, incorrect instrument responses, and active and passive failures; and including training on natural circulation. operation under solid water conditions. These actions already:taken or underway will provide significant improvement in operator performance. The long-term simulator upgrade is expected to provide refinements of the actions previously taken and, although these will provide some improvement in operator performance and will be implemented as part of the TMI Action Plan (NUREG-0660), the improvement is not expected to be large enough to warrant designating this issue as an

-Unresolved Safety Issue.

Requirements for Operator Fitness (Item I.A.3.3)

.This issue involves a potential deficiency with respect to a lack of qualification criteria to screen out individuals with 'a poor ability to perform under stress or who have dependencies on alcohol or drugs. ~ The issue is not recommended for designation as an Unresolved Safety Issue because: (1) there is nojevidence of any significant problem'in this area; (2) additional operators and the use of a shift technical advisor will reduce the likelihood of operator errors'as a result of this deficiency;'(3) ' operator errors would generally ~ result only in. the

. interruption of some equipment and'not necessarily in a failure of the B-3

equipment;-(4) alarms and indicators would warn t% other operators of conditions resulting from an error tha' require correction; and (5) corrective action may be-taken by the operator or other operators to restore the safety function.

Resolution of this issue will provide some safety improvement and will be implemented as part of the TMI Action Plan (NUREG-0660), but it does not warrant designation as an Unresolved Safety Issue.

Organization and Management, Long-Tem Improvements (Item I.B.1.1)

This issue involves a potential improvement in plant organization and management regarding the capability to ensure safe plant operation and to respond to emergencies. This issue has not been recormended for designation as an Unresolved Safety Issue because it is judged that L

additional upgrading in this area beyond that already implemented is not likely to result in a large reduction in risk. The first line of defense in an accident situation consists of the operators, who are directly supported by a Shift Technical Advisor. Operator training,

. qualifications, procedures, and so forth, have already been upgraded,

and more upgrading is planned.

In addition, interim upgrading of plant J

emergency organization and management has been implemented.

Resolution of this issue will provide some improvement in licensee response to emergencies, but it does not warrant designation as an Unresolved Safety Issue.

Operating Procedures (Item I.C.9)

The actions performed by plant operators for both normal plant operation

- and off-normal plant conditions are described in a set of written pro-cedures. These instructions reduce the reliance on the operator's

. memory in order to ensure the proper sequence of manual actions. A number.of reported events have been directly related to deficiencies in the written procedures. This' experience has suggested that the procedures are not:sufficiently explicit and may not contain sufficient diagnostic

..information to assist the operator to quickly identify and readily cope with abnormal conditions.

In addition, the interrelationship between the administrative, operation, test, surveillmce, and maintenance procedures may contribute.to events when the required actions are not O

clearly defined. Consequently, the potential for procedural errors can

?

lbe significantly reduced.by providing cons stent. format and content to 1

the procedures and i_mproving the delineation of symptoms, events, and L plant: conditions that identify abnormal situations.

For the short term, the staff has required (through letters dated 2

September 13 and 27, October 10 and 30,: and November 9,1979) that licensees and applicants perform analyses _of several accidents and transients 'and, from the, results of these analyses, develop -improved

operational procedures for _off-normal plant conditions. The short-term actions include clarifying the. delineation of authority, shift change practices, and control room access.

~ Although the short-term actions are considered adequate. to ensure the i

health and safety of the public, further long-term actions involve l

18-4 a,

development of a detailed program plan for the upgrading of plant procedures.

This plan will include guidelines on procedures content and format review procedures, as well as auditing techniques that could provid2

-significant additional improvements in the operating procedures and further reduce the potential for procedure-related errors.

The plan development will include consideration of related criteria

-resulting from other activities, such as the system response analyses, reliability analyses, human factors engineering, crisis management, and operator training. Specific emphasis will be placed on guidelines to assure that procedures identify symptoms of accident and transient scenarios not presently being investigated, in addition to current accident and ' transient scenarios (such as, small break loss-of-coolant accidents, steam loss of feedwater, and uncovering

.the reactor core) generator tube rupture,The resulting plan will form the basis for rev w

operet'.g pracedures for off-normal plant conditions for their quality ar,J diagnostic capabilities. This issue relates specifically to Task

-I.C.9 in the TMI-2 Action Plan (NUREG-0660).

Control Room Design (Items I.D.1, I.D.2, I.D.3, and I.D.4)

The design and layout of a nuclear power plant control room can significantly affect the operators' ability to deal with abnormal plant conditions.

This conclusion was drawn by several of the studies of the TMI-2 accident.

The operators' effectiveness in periods of high stress following an accident or severe transient is dependent upon both the type of information provided and the manner in which it is displayed. By improving these aspects-of the. control room design, the potential for human error can be significantly reduced.

Consequently, the objective of this action plan item is to establish

-improved design requirements and standards for the control room instru-mentation and for the arrangement and identification of important controls. : As a first step, the staff will establish guidelines and requirements for control room design. reviews, including site visits to determine existing control room design capabilities.

In addition, the staff will establish requirements for a plant safety parameter display console. - These activities are expected to be completed in approximately

1. year.

As a second step, the staff will develop final control room design

.requ_irements, related standards and regulatory guides, and improved control room instrumentation research. The research activities will investigate audio-visual alarms,. plant surveillance instrumentation, and post-accident monitoring instrumentation. Revised regulatory require-ments' and implementation schedules are expected to be issued in mid-1982.~.

This issue relates to Tasks I.D.1, 2, 3, and 5 in the TMI-2 Acti k Plan (HUREG-0660)..

-Expansion of QA List (Item -I.F.1)

.This issue involves a: potential improvenent related to the application of 10 CFR 50l Appendix B quality assurance (OA) criteria to systems and B-5

.x

L

' components that in the past have not been considered safety related.

Such equipment would include balance-of-plant equipment that could perform a safety function or whose failure could place demands on safety-related equipment. The issue is not recommended for designation as.an Unresolved Safety Issue because:

(1) many of the criteria for the

-electrical. equipment are being established under Action Plan Item II.F.5, and the issue was found to not warrant designation as an Unresolved Safety. Issue; (2) application of QA criteria to this balance-of-plant equipment will not provide a large improvement in reliability of the equipment; and (3) licensees already place importance on the reliability of such equipment because of economic conside-ations. Note that implementation of this issue will rely on the results of other ongoing studies such as

-IREP and Systems Interaction.

. Development of More Detailed QA Criteria (Item I.F.2)

This issue involves a potential deficiency related to the lack of sufficient detail being specified

• certain QA criteria. Such lack of

. datail could ledd to incorrect interpretation of how to satisfy the intent of the QA criteria. The issue is not recommended for designation as an Unresolved Sa'fety Issue because:

(1) experience has shown that, ir general, licensees and applicants have been makin effort-to satisfy the intent of th:2 QA criteria; (2)g a conscientious even if the intent is not satisfied in a particular area, other CA measures such as technical specification surveillance will provide a means to prevent and detect faults in equipment; and (3) the potential deficiency involves developing further detail _.in only a limited number of areas. Although resolution

' of this. issue will' provide some improvement in application of OA criteria, it does not warrant = designation as an Unresolved Safety Issue.

.Preoperational and Low-Power Testing Training Requirements (Item I.G.1)

This' issue involves'a potential improvement in operator training by

. requiring " hands-on" training during low-power test programs. The issue

.has not been recommended for designation as an Unresolved Safety Issue because -it is not likely that such training can significantly improve

'the operator's' ability to respond to potentially serious accidents.

Classroom and simulator training are.better able to provide such training.

Although resolution of this issue may' provide some' improvement in safety, it does not warrant designation as an Unresolved Safety Issue.

' Consideration of Degraded or Melted Cores in Safety Review (Item II.B.8)

Historically, the design basis ~ for nuclear power plants has 'been predicated

on preventing core damage. Consequently, little investigation has been done :regarding provisions to deal with degraded or melted cores. As a result of the TMI-2: accident,'the staff is now considering the extent to which the plant design bash 3hould \\ include damaged core conditions.

'Providing equipment ~ and procedures'to deal with damaged core conditions can significantly reduce the risks to the public from events that go

~

~beyond the; original design' basis?

J B-6.

2 a

=

,j

For the short tenn, the staff has issued criteria (through letters dated September 13 and 27, October 10 and 30, and November 9, 1979) which require that licensees and applicants develop design provisions for reactor coolant system vents, access shielding, and post-accident sampling.

Requirements and guidelines are being developed to train operations personnel to deal with core damage events.

In addition, the staff is reviewing design changes and other measures that could reduce the consequences of a severe accident for plants located in areas of high population density (Zion Units 1 and 2 and Indian Point Units 2 and 3). These interim measures are intended to provide an immediate increase in the capability to deal with degraded core conditions.

The principal objective of this issue will be the longer term rulemaking that will formalize the design requirements for degraded core conditions.

a The rulemaking activity will specifically consider the use of filtered-

. vented containment systems; the use of additional hydrogen control measures; the use of core-retention devices; design criteria for decay heat removal, radwaste, and ventilation-filtration systems; provisions for post-accident recovery; criteria for locating highly radioactive systems; and the effects of multiple reactors on a given site. This activity relates specifically to Task II.B.8 in the TMI-2 Action Plan (NUREG-0660).

A number of related activities have bearing and may impact this rulemaking.

These include core melt research studies (NUREG-0660, Task II.B.5),

siting policy (NUREG-0660, Task II.A.1 and 2), emergency preparedness (NUREG-0660, Task II.A.2), and the licensing actions for Zion and Indian Point (NUREG-0660, Task II.B.6). This last activity will have to be closely coupled with this issue.

The-rulemaking is expected to occur in approximately 2 years, depending on the extent of public comment, the progress on research and design studies, and the need for a hearing. From the wide diversity of topics to be addressed in this rulemaking, the Conunission selected the specific issue of hydrogen control and equipment qualifi:ation as a consequence of hydrogen' burns as a USI.

Reliance on ECCS (Item II.E.2.1)

This issue involves a potential deficiency in' the reliability of emergency core cooling systems (ECCS). The concern results from a higher _ than

- anticipated frequency of ECCS challenges in operating reactors, in part because of the reliance on ECCS for other than loss-of-coolant accidents.

The rel ' bility of ECCS is believed to be high,_ but it is not clear that it is sufficiently high to accomplish its safety function with high g.

assurance, considering the increase in expected challenges.

Further study is recommended to detennine:if this issue should be repcrted as an Unresolved Safety Issue'. The further study _ would be in the form of scoping calculations related to ECCS challenges and system reliability.

ECCS, Uncertainties in Performance Predictions (Item II.E.2.3)

This issue involves potential. uncertainties in small-break ECCS performance cvaluations as a result of uncertainties that are the result of modeling-B.

assumptions or inaccura-ies. The issue has not been recommended as an Unresolved Safety Issue oeca"se small-break analyses are believed to be conservative. Resolution of this issue is needed to confirm the adequacy of the existing analyses.

Containment Design Integrity Check (Item II.E.4.3)

This issue involves a potential improvement related to developing a method to verify gross ir.tegrity of the containment structure.

Containment integrity is presently verified by monitoring the integrity of components

-(valves, penetratit.ns, and so forth) and by administrative controls on

, valve positions and seal integrity. The issue has not been recomended for designation as an Unresolved Safety Issue because monitoring or periodically verifying gross integrity is expected to provide only marginal improvement over current practic.e. Study of the feasibility,

.need, and possible methods for such testing will be carried out as part of the TMI-2 Action Plan (HUREG-0660); however, it does not warrant designation as an Unresolved Safety Issue.

Design Sensitivity of B&W Reactors (Item II.E.5.1)

This issue involves a potential improvement that might be achieved by modifications in systems or procedu as to reduce B&W reactor sensitivity to. transients. Under Item II.E.5.2 of the TMI Action Plan, recommendations were made,' based on a short-term study, on improvements that should be made to reduce B&W reactor sensitivity to transients. These recommendations

~ are contained in NUREG-0667; " Transient Response of Babcock & Wilcox-Designed Reactors." Because NUREG-0667 has been issued, Item II.E.5.2 was screened out as a candidate issue.

Item II.E.5.1 of the Action Plan

' involves.aslonger-term evaluation of B&W reactor sensitivity and identification of any further recommended improvements to those identified in NUREG-0667

-The' staff does not believe that this longer term study will result in significant improvements.beyond those resulting from NUREG-0667 (Item'II.E.5.2). The results of the long-term evaluation art expected to confirm the adequacy of the changes resulting from NURM-0667. Accordingly, this issue 'is not recommended for designation as an Unresolved Safety issue.

In Situ Te' sting of Valves (Item II.E.6.1).

This issue involves a potential improvement that might be achieved by L demonstrating the functional performance of valves in engineered safety

features systems.

Inservice testing and technical specification surveillance provides some measure of the operability of valves. However, these

' tests are. not performed under the same loadings and conditions that the

. valve may experience in'an accident or emergency situation. A valve Lreliability study, based on test and operational data, indicates valve reliability is'about the same as.was estimated-in WASH 1400. However, a

~

current study of valve test. frequency. and further consideration of.

.. testing valves under severe conditions may indicate a potential for risk

.feduction greater.than currently anticipat'ed. Accordingly, further

.' study. is recommended. to estimate if the test adequacy study to be performed un, der -Item II.E;6.1 is likely to ' result in:

(1) a significant. improvement B _

in valve reliability by changing the test f equency and (2) a significe.it reduction'u -isk if methods were developed for test'r.g of valves closr:r to the des!d6 conditions.

Study of Control and Protective Action Design Requirements (Item II.F.4)

This issue involves a potential deficiency related to:

(1) basing protective actions on derived variables rather than direct reading of process variables; (2) protective actions relying on coincidence of independent process variables rather than relying on either variable; and (3) lack of testing and control circuit components at expected degraded power supply conditions.

It is believed that existing requirements already preclude these deficiencies. This issue is not recommended for designation as an Unresolved Safety Issue because the recommended e

action involves adding further clarification to existing requirements in the Standard Review Plan, and only minor improvement in protection is expected to result.

Classification of Instrumentation, Control, and Electricial Equipment (Item II.F.5)

This issue '.nvolves a potential improvement through the development of a standard for establishing design criteria and performance requirements for instrumentation, control, and electrical equipment in accordance with the equipment's safety importance. This is likely to result in upgraded requirements for some equipment. The current classification scheme (Class' IE) is judged to provide reasonably good criteria for many systems and components.important to safety. Additionally, Revision 2 to Regulatory Guide 1.97, " Instrumentation to Follow the Course of an Accident," has been developed and issued in final. Although development of an improved classification scheme could improve the reliability and performance of.some equipment (and this will be done in accordance with the NRC Action Plan), the issue is not recommended for reporting as an Unresolved Safety Issue because the. reduction in risk from this improvement is not expected to be large.

NRC Emergency Preparedness.-- Training, Drills, and Tests (Item III.A.3.5)

,This issue involves a potential improvement in NRC emergency preparedness through NRC observation and evaluation 'of.joi, ext

~ses involving the licensees, State and. local agencies, and Federal response organizations (including the Federal Emergency Management Agency (FEMA)). The issue is not' recommended for designation as an Unresolved Safety Issue because:

~

(1) the significant reduction in risk resulting from improvements in the area of emergency preparedness at each NRC-licensed nuclear facility 4 -

will evolve from an intensive NRC program to. upgrade emergency preparedness and~the issuance of upgraded emergency preparedness regulations (the criteria and requirements have already. been established for these rules)

.and. (2) the NRC has developed a program for the improvement of NRC emergency preparedness that encompasses far more than just observation of joint exercises. The importance of observation of Dint exercises should not be down played, but it will provide only a small impact on the improvement of NRC emergency preparedness.

B-9.

Radiation Source Control-Ventilation System and Radiciodine Adsorber Criteria (Item III.D.1.3)

This issue involves a potential deficiency in means to control and Process airborne radioactivity in the atxiliary and radwaste buildings and in maintaining filter met efficiencj. Operating experience and resea9. have identified certain areas where charcoal filter efficiency and use may be improved; further research s planned. The issue is not recommended for reporting as an Unresolved Safety Issue because:

(1) existing criteria on charcoal filters are believed to be generally quite good, with perhaps only minor changes required, based on operating experience and research, and (2) the improvements that will be made are not expected to result in a significant reduction in risk.

It should be noted that the rule change under item II.B.8 of the TMI Action Plan may also require further changes to ventilation system filtration capability; the impact of these further changes is not considered under this issue.

Inplant Radiation Monitoring (Item III.D.3.3)

This issue involves a potential improvement that might be achieved by increased inplant radiation monitoring capability, including installation of radiation monitors with remote readout, high-dose-rate readout instruments, and additional portable radiation monitoring equipment.

This issue is not recommended for designation as an Unresolved Safety Issue because the increase in radiation monitoring equipment will provide only an incremental improvement in reducing dose to plant personnel for postulated accidents beyond the protection provided by present monitoring capability.

Evaluate Elimination of PORV Function (Item II.K.3(33))

This issue involves a potential improvement that might be achieved by either reducing denands on the power-operated relief valve (PORV) (revising set-points) or by providing an improved means to cope with a stuck-open PORV (automatic operation of the PORV block valve). The issue is not recommended for designation as an Unresolved Safety Issue because:

(1) a study by the Probabilistic Analysis Staff has indicated that these improvements would not significantly reduce the potential for core damage; (2) licensees have already been required to provide improved methods of indication to the operator of a stuck-open PORV; and (3) changes to operator training and emergency procedures are being made so that the operator is better able to cope with a stuck-open PORV.

Reliability of Ventilation Monitoring Equipment This issue involves a potential deficiency related to low reliability of air flow monitoring cquipment. The issue was identified in the ACRS report on Licensee Event Reports (NUREG-0572). The issue is not recommended for designation as an Unresolved Safety Issue because loss of the air monitoring equipment, in itself, will not cause loss of a safety function.

For a loss of a safety function to occur, the following would have to take place: a failure in the ventilation equipment, a failure in the plant operator shift tours, a failure in the system redundant to that affected B-10

G.

^

by the ventilation failure, and failures in any nonsafety systems that could perform the safety function.

-Protective Device Reliability This issue involves a potential deficiency in that high failure rates of protective devices (fuses, circuit breakers) could result in a lower reliability of safety equipment. The issue was identified in the ACRS report on Licensee Event Reports (LERs) (NUREG-0572). This report noted an apparent large number of LERs related to failures of protective devices. Such failures will result in unavailability of the related safety equipment. However, it was not known whether the failure rate of 4

safety equipment might be grew - :han previously assumed (in WASH 1400 or other reliability report s a result of protective device failures, A

or if the reliability of : rety equipment could be significantly improved by increasing protective device reliability. Accordingly, further study has been recommended to estimate the failure rate of protective devices and to determine:

(1) if this failure rate is excessive and leads to an increase in failure rate estimates for essential equipment, or (2) if the failure rate estimates for essential equipment could be significantly

-reduced by improving the reliability of protective devices. Such a study should be conducted before a decision is made on whether this issue should be designated as an Unresolved Safety Issue.

Instrumentation Set-Point Drift This. issue involves a potential deficiency related to an excessive drift in instrumentation set points beyond Technical Specification limits.

The issue was identified in the ACRS report on LERs (NUREG-0572). The issue is not recommended for designation as an Unresolved Safety Issue

'because:

(1) given the set point drift, the affected channel in most cases would be only slightly out of tolerance and therefore would trip at.close to the desired setting; (2) other channels would generally be available; and (3) in most cases, operators may take manual actions to

. accomplish the safety function.

End-of-Life and Maintenance Criteria This issue involves a potential deficiency related to a lack of. adequate criteria for establishing maintenance periods and end-of-life expectancy for. materials that may degrade significantly with time or use. The issue was identified in the ACRS report on LERs (NUREG-0572). The issue is not recommended for designation as an Unresolved Safety Issue because:

(1) it is'not =likely that failures as a result of this deficiency will occur. simultaneously in redundant systems; (2) periodic testing of equipment and inservice ' inspection will detect such degradation; and -

(3). requirements are being established.for.certain identified issues related to~ material degradation, and these have been previously. designated

-as Unresolved Safety Issues'(A-3, A-4,'A-5, Steam Generator Tube Integrity, and A-11,- Reactor Vessel Materials Toughness). Although establishment of:such criteria may provide 1some improvement i_n safety, this issue does not warrant. designation as an Unresol_ved Safety Issue.

.B-11.

a

Design Check and Audit of Balance-of-plant Equipment This issue involves a potential improvmnt that might be achieved by requirements for verification that the balance-of-plant "as built" configuration satisfies the design intent. Such action could improve the reliability of balance-of-plant equipment and reduce demands on safety equipment. The issue was identified in the ACRS report on LERs (NUREG-0572).

. he issue is not recommended for designation as an Unresolved Safety Issue because transients or safety system challenges result more frequently from operator errors and " random" component failures than from deviations from the intended plant design. Additionally other ongoing studies (IREP and Systems Interactions) will identify potential adverse impacts from balance-of-plant equipment.

BWR Control Rod Worth This issue involves a potential deficiency of accounting for xenon

following a reactor trip in assessing the effect of xenon on control rod worth. ' The issue was identified b the ACRS report on LERs (NUREG-0572). The issue is not recommended for designation as an Unresolved Safety Issue because an initial staff review has found that the rod worths are relatively_ insensitive to xenon distribution. The results of the final staff review will be documented when the review is completed.

Flow-Induced Vibration The issue involves a potential for single and multiple failures of piping, valves, snubbers, and nearby electrical and mechanical components

- as a ' result of flow-induced vibrations. The issue was identified in the

.ACRS report on LERs (NUREG-0572). The issue is not recommended for designation as an Unresolved Safety Issue because:

(1) failures in electrical equipment as a result of flow-induced vibration are likely to occur in only one safety division because redundant components are separated physically to satisfy (2) failures in mechanical components are other regulatory requirements such as flooding and fire protection;

. likely to be in piping restraints or supports rather than.in the piping and, as such, are not likely to result in loss of a safety funtion; and (3) many sources of flow-induced vibration failures' noted in LERs have been identified and corrected, such as pump high cycle fatigue and reactor : internal ' vibration.

Inadvertent Actuation of Safety -Injection

~

This-issue involves a potential tendency for operators to terminate safety injection when it is actually required, because their judgment has ~been influenced by the large _ number of _ inadvertent safety injections that have occurred in the past. The issue was identified in the ACRS reportonLERs1(NUREG-0572). The issue is not-recommended for designation

. as an' Unresolved Safety Issue because, after the accident at TMI,' improvements

- in training and procedures related to safety injection operation have stressed the 'need for operators-to obtain multiple indications to determine iff actuation 'was inadvertent. Further-evaluations of ECCS challenge frequency will-be performed under Action Plan Item II.E.2.1, which is~-

currently designatedifor further study.

B-12 E:

u r

Re-evaluation of Reactor Coolant Pump Trip Criteria (Item II.K.3(5))

This. issue involves a potential improvement that might be achieved by establishing better criteria on when to allow reactor coolant pump operation and when to trip the pumps. Better criteria might allow use of reactor coolant pumps to aid in recovering from certain transients, while still ensuring that these pumps are tripped for a small-break LOCA. The issue'was identified by the ACRS in its letter of March 11, 1980 concerning recommendations of the NRC Task Force on Bulletins and Orders. A study to resolve this issue is under way and is expected to be completed in mid-1981. The issue is not recommended for designation as an Unresolved Safety Issue because, although such use of reactor coolant pumps would provide a snall improvement in safety, the safety evaluations of transients used for licensing acceptability do not assume the availability of the reactor coolant pumps.

Turbine Disk Cracking This issue involves a potential deficiency related to turbine disk 4

integrity that could increase the_ likelihood of a severe accident from turbine missiles. This issue has recently been raised because of the discovery of stress corrosion cracking in high-pressure turbine disks (first-and second-stage-disks). The issue has not been recommended for reporting as an Unresolved Safety Issue because the probability of turbine missile generation assumed by the staff in accident calculations has been unaffected by the discovery of these cracks.

Requirements for periodicEinspection of the disks may actually decrease this probability.

In addition, a serious accident is not considered likely even if the affected disks fail because, to date, the cracking has been observed only 'in the smaller, lower kinetic energy disks. Missiles generated

-from these disks would not likely escape the turbine casing or penetrate other structural barriers.

DC Power' System' Reliability This issue -involves a potential improvement related to de power system reliability. -The issue was originally raised by an ACRS consultant.

'.The NRC staff has funded a contractor study of the probability of core

' damage following certain transients as a result of-loss of shutdown cooling from de power system failures. The de power system analyzed in the' study was.a dc system meeting the staff's current minimum requirements.

A

'The results. indicate that reductions in the probability of core damage from event sequences involving de power system failures could be realized

~

-by. making certain improvements in the de power system design. The staff report providing its. technical resolution of this i.ssue has been co.?pleted and discussed with the ACRS who'have generally-concurred with its content.

~ The staff is.now completing the final editing to address any ACRS comments and will-publish the. report as NUREG-0666; Therefore, this issue has not~been' recommended for reporting.~as an Unresolved Safety Issue.

B-13.

a.

=_

BWR Jet Pump Integrity This issue involves the potential for degraded core cooling as a result of jet pump failure that occurs because of a large LOCA and degraded structural jet pump members.

Failure could result if jet pump structural members were cracked during normal service by water hammer events before the LOCA, or failure could result from flow-induced vibration caused by ECCS flow following a LOCA. This issue was the subject of a memorandum from C. Michelson to H. Denton, dated May 23, 1980, and work has been underway in NRR on this subject since the first reports of degraded structural members were noted. The issue is not recommended for designation as an Unresolved Safety Issue because the occurrence of degraded core cooling would require the combination of:

(1) a large LOCA; (2) a degraded jet pump; and (3) jet pump failure that results in inadequate core cooling. The likelihood of this combination of events is judged to be very low.

Small-Break LOCA from Extended Overheating of Pressurizer Heaters This issue involves the potential for failure of the pressurizer pressure boundary in the event of extended overheating of the pressurizer heaters.

The issue has not been recommended for designation as an Unresolved Safety Issue because the possible scenarios involved multiple equipment failures and operator inaction for relatively long time periods. Such scenarios are not likely to occur.

PWR Pipe Cracks This. issue involves a potential deficiency in plant equipment related to cracking in various PWR piping systems. The principal causes of cracking have been thermal fatigue, vibration-induced fatigue, and intergranular stress corrosion cracking. This issue has been the subject of a recent

. investigation by the Pipe Crack Study Group (" Investigation and Evaluation of. Cracking Incidents in Piping in Pressurized Water Reactors," NUREG-0691). Although thermal fatigue cracking has been observed in a number

. of feedwater lines, analyses indicate that such cracking is not likely to result in complete severence of the line even when severely loaded.

Complete severence of small (s3/4 in.) vent or drain lines in certain locations in emergency core cooling systems as a result of vibration-

' induced fatigue could potentially result in degraded core cooling.

However,-it is not evident that the'particular scenarios envisicned are likely enough to involve a significant. contribution to risk. Accordingly, further study has been recommended to determine if this issue should' be designated as an Unresolved Safety Issue.

BWR Main Steam Isolation Valve Leakage Control Systems This' issue involves a-potential' deficien :y in the ' ability to control leakage'through the main steam isolation valves (MSIVs) in BWR plants.

~

As a result of excessive leakage experience for the MSIVs in operating

' plants, the: staff developed requirements for MSIV leakage control systems

(as described-in Regulatory' Guide 1.96). However, the initial operating experience with the leakage" control systems suggests that they are also-prone'to failures.

In addition, it appears from recent leakage test B-14

results that there are improved maintenance procedures that may significantly reduce excessive leakage from the MSIVs. Accordingly, further study has been recommended to estimate the MSIV and leakage control system failure rates and to determire if the leakage control system failure rate is excessive in order to determine whether the issue sould be desiqnated as an Unresolved Safety Issue.

Radiation Effects on Reactor Vessel Supports This issue involves a potential deficiency in reactor vessel supports related to a reduced fracture resistance as a result of irradiation damage from low energy neutrons. Although the consequences of reactor Q

vessel support failure under large loads such as LOCA or earthquake loads could be severe, there are a number of uncertainties regarding the likelihood for low support fracture resistance. Further study to better characterize the support materials, the neutron spectra, the potential radiation damage and the structural loading of supports is recommended before a judgment is made regarding whether this issue should be designated s

.as.an Unresolved Safety Issue.

Loss of Offsite Power Subsequent to a LOCA This issue l involved a potential improvement that might be achieved if plant design were required to consider loss of offsite power subsequent ito a LOCA.- This issue has not been recommended for designation as an Unresolved Safety Issue because the probability of the combined event is judged to be very low (on the order of 10 6/RY) and the consequences would be -insignificant, because adequate core cooling would be provided by vessel inventory during the time required (less than 1 minute) for

~ diesels to start and assume load.

Safety Implications of Steam Generator Transients and Accidents

.. This concern is related to the probability of various transients and accidents involving the steam generator and the ability of the plant

. operators to satisfactorily respond to the. event. Matters of concern are the potential for steam generator overfill, the ef fects af blowdown from overfilled conditions, and the potential for multiple tube failures as a' result of loose partsL(such as turning vanes in the feedwater

, system). Certain aspects of this concern are already being addressed by Unresolved Safety Issue A-47, Safety ~ Implications of Control Systems.

Additionally. item II.E.2 from,the TMI Action Plan (Research on Small-Break LOCAs and Anomalous Transients) will provide information related to this concern. Further-study has-been recor:inended -for this concern in e

-ordr to ~ determine the-extent to which it is already covered under other tasks and to evaluatelits' potential impact on risk.- This further study will~ determine.if thi's' issue should be desicnated as an Unresolvea Safety I,ssue.

Piping and Use of-Highly Combustible Gases in Vital Arcas This concern is rel.ated to the_ potential for a combustible gas explosion

that'would disable safety equipment.

In PWRs, hydrogen is used during 2

B-15

n

A l

plant operation to scavenge oxygen from the primary system as a means of corrosion control. The hydrocen is piped to the volume control tank located in the auxiliary building, which is a safety-related structure housing components of various safety systems.

In addition, other 1

combustible gases, such as propane, are routed to laboratories located in auxiliary or control buildings. Leaks in this piping could result in combustible or explosive conditions in areas housing safety-related equipment. The AE00 has also raised a concern that if some olants i

hydrogen detectors :ady be relied on to detect and alarm if leakage were i

to occur; however, these detectors are generally not qualificated or supplied by an emergency power source. Therefore, they may not b6 functional during, or following, an event that could cause a hydrogen leak or cause loss of ventilation systems that may have been diluting the gas resulting from an existing, but undetected, leak.

The fire protection reviews did consider the routing of such highly combustible gases, but they may not have considered all of the concerns identified above. Accordingly,-further study is being performed to determine the extent to which these concerns have been addressed before j

a decision is made whether to designate this issue as an Unresolved Safety Issue, i

f J

(

i t

e B-16 m

m-

-m-.

.-r-,

BIBLI0r,RAPHY i

2 U. S. ' Nuclear Regulatory Commission, "NRC Task Action Plan Developed as a Result of the TMI-2 Accident," USNRC Report, NUREG-0660, May 1980.

- U. S. Nuclear Regulatory Commission, " Power Plant Staffing," Basic Enerqv. Technology Associates, USNRC Reoort, NUREG/CR-1280, January 1980.

U. 5. Nuclear Regulatory Commission, " Reactor Safaty Study - An Assessment of Accident Risks in U. S. Commercial Nuclear Pcwer Plants," Executive Summary, WASH-1400, NUREG-75/014, October 1975.

40

- U. S. Nuclear Regulatory Commission, " Transient Response of Babcock and Wilcox-Designed Reactors," USNRC Report, NUREG-0667, May 1980.

7 4

L t

v f

r

^(

T t

h

-B -

1

?

e

a aa g

O APPENDIX C h

1 CONSIDERATION OF COMMENTS FROM THE OFFICE FOR ANALYSIS AND EVALUATION OF OPERATIONAL DATA (AE00)

(

C i

g.

APPENDIX C CONSIDERATION OF COMMENTS FROM THE OFFICE FOR ANALYSIS AND EVALVATION OF OPERATIONAL DATA (AE0D)

By letter of August 1,1980, the Office for Analysis and Evaluation of Operational Data (AE00) provided comments to the then-Chairman of the NRC John Ahearne concerning the information and recommendations in SECY 80-325. These comments may be summarized as:

W (1) Agreement with the issues recommended by NRR as Unresolved Safety Issues

-(2) Recommendation that two new issues by considered as candidate issues (3) Recommendation that two additional concerns be considered, possibly under the umbrella of existing Unresolved Safety Issues The staff has addressed the concerns expressed by Items (2) and (3) above as follows:

1 New Items for Consideration as Unresolved Safet1 ssues The staff agrees with the AEOD recommendation that two items, Safety Implications of Steam Generator Transients and Accidents, and Piping and Use of Highly Conbustible Gases in Vital Areas, warrant further consideration.

As a result of additional discussions with AE0D the NP.R staff decided that the AEOD concerns with steam generator overfill tmsient in particular warranted treatment as an Unresolved Safety Issue. This issue involves transients that could lead to gross overfilling of the secondary side of steam generators-in PWRs, and the equivalent event in BWRs (overfilling of the. pressure vessel).

Because this transient essentially results from a control system failure, this issue has been included as a specific part of the USI on Safety Implications of Control Systems.

Additional study of other portions of the issue on Steam Generator Transients and Accidents and the issue on Piping and Use of Highly Combustible Gases in vital areas is planned. These issues will be evaluated along with other newly identified issues to evaluate their

, impact on overall risk and to determine if they meet the Unresolved 4

Issue definition. With respect to the iten concerning combustible Safety'it.seems likely that this evaluation will show that it has already

gases, been addressed in the Fire Protection reviews, although some refinement to the criteria may be required.

Items that Might Be Included Under Existing Unresolved Safety Issues The staff, agrees that these two concerns identifed by AE0D probably fall under.the scope of existing or proposed Unresolved Safety Issues. To

~

C-1

ensure that the concern related to failure modes of nonqualifed equipment in a seismic event and effects of these failures is not overlooked in the proposed Unresolved Safety Issue on Seismic Qualification of Equipment at Operating Plants, the staff has clarified the description of this issue in Appendix A of this report.

It is the intent of this task to look at the seismic qualification of equipment required to safely shut down the plant, as well as the qualification of equipment fer which failure could produce unwanted actions.

With respect to the AE0D concern related to effects of a high-energy pipe break on small lines (for example, instrument lines) or in causing unwanted actions by control systems, the staff agrees that this concern is within the scope of the Systems Interaction (A-17) Unresolved Safety Issue. However, the portion of the concern related to development of unwanted actions in control systems is closely related to a concern L

raised in the ACRS letter of August 12, 1980 on the subject of New Unresolved Safety Issues. These concerns will be addressed in the proposed Unresolved Safety Issue, Safety Implications of Control Systems, as described'in Ap)endix A.

The balance of this AE00 concern will be addressed within tie scope of Task A-17 or follow-on program.

1 s

C-2 i_

o APPENDIX D g

CONSIDERATION OF COMMENTS FROM THE ADVISORY COMMITTEE ON REACTOR SAFEGUARDS (ACRS) a t

5 2

APPENDIX D CONSIDERATION OF COMMENTS FROM THE ADVISORY COMMITTEE ON REACTOR SAFEGUARDS (ACRS)

On August 7, 1.980, the NRC staff discussed with the ACRS the information contained in a CY 80-325 that would be included in the Special Report to Congress on New Unresolved Safety Issues. As a result of these discussions, the ACRS provided several recommendations to the then-Chairman of the NRC, John Ahearne by letter dated August 12, 1980 concerning Unresolved Safety Issues. This letter indicated agreement with the new issues designated by the staff as Unresolved Safety Issues, but also recommended addition of three issues:

a (1) Control system reliability (2) DC power suoply reliability (3) Single-failure criterion The staff has considered the ACRS recommendations and has the following comments:

Control System Reliability.

The staff agrees with the ACRS recommendation concerning control system reliability and recommends that a task, Safety Imolications of Control Systems, be added to the list of new USIs designated in the Special Report to Congress. Appendix A describes the issues that would be addressed in this task.

The staff believes that further study is required for the ACRS concern related to reliability of safe-shutdown instrumentation to assess the improvements already made by licensees, the extent of the deficiency, and the resultant impact on risk.

Following this further study, a decision will be made as to whether this issue should also be designated as a USI.

DC Power Reliability The definition of an Unresolved Safety Issue includes a statement that it is an issue "for which a final resolution has not yet been developed."

While the-staff agrees with the ACRS that dc power reliability is an w

important issue and one that may have a major impact on overall risk, the staff has-taken the position that it should not be designated as an Unresolved Safety Issue before.a report that proposes a resolution of this-issue.has been reviewed. This report has been discussed with the members of the ACRS, who have generally concurred with the content. The staff is now completing the final' editing to address any ACRS comments and will publish the report as NUREG-0666 Single-Failure Criterion-The staff believes that the single-failure criterion has served well in its use as a licensing review tool to ensure reliable systems as one D-1

element of the defense-in-depth approach to reactor safety.

The Reactor Safety Study (WASH-1400) and more recent reliability studies have indicated that the use of the single-failure criterion has led to a generally high level of reliability in most systems important to safety. However, for certain systems it may be necessary to postulate more than a single failure in order to provide a sufficient reliability c# performing a safety function. The Interim Reliability Evaluation Program (IREP)

. investigations that are under way will evaluate the current system reliability achieved by application of the single-failure criterion.

The results of IREP, when used in conjunction with quantitative safet.y s

goals, will identify deficiencies in systems where improvements beyond the single-failure criterion are required in order to achieve an acceptable level of risk. These quantitative safety goals will be developed as g

described in action items IV.E.1 and V.B.1 of the TMI Action Plan.

Where these deficiencies in system reliability are identified, they will be considered for designation as Unresolved Safety Issues. One such deficiency has already been designated as an Unresolved Safety Issue.

Because of the significant contribution to risk of loss of all feedwater in PWRs (that is, multiple failures in main and auxiliary feedwater systems), a separate issue concerning reqairements for an alternative decay heat removal method has been desianated as an Unresolved Safety Issue, Shutdown Decay Heat Removal Requirements (see Appendix A). The results of the IREP studies will be carefully reviewed for similar issues.

The staff believes that the IREP program is adequately structured to provide the information required to identify deficiencies in the single-failure criterion and that it is receiving priority and resources for expeditious. completion.

It is being monitored by the Reliability and Risk Assessment Branch with NRR. Additionally, the Generic Issues Branch'has the responsibility to monitor new concerns and issues to identify those that should be designated as Unresolved Safety Issues.

Accordingly, the staff does not recommend that such a broad concern as

" Single-Failure Criterion" be designated as a separate Unresolved Safety Issue, but rather that any specific generic defit.iencies identified by IREP be considered as candidate Unresolved Safety Issues as they are 3 identified.

I D-2

U.S. NUCLE AR REGUL ATOR) COMMISSION BIBLIOGRAPHIC DATA SHEET NUREG-0705 4 TITLE AND SUBTITLE LAdd Volume Na.o!epternew)

2. (Leave b!wk)

Identification of New Unresolved Safety Issues Relating to Nuclear Nwer Plants - Special Report to Congress

3. RECIPIENT'S ACCESSION NO.

7. AUTHOR (S)

5. DATE REPORT COMPLETED MONTH l YEAR Februarv 1981

9. PERFORMING ORGANIZATION N AME AND MAILING ADDRESS (tactue lip Coolel DATE REPORT ISSUED Generic Issues Branch MOura lvEaR March 1981 Division of Safety Technology Office of Nuclear Reactor Regulation s (te. e u aal U. S. Nuclear Regulatory Commission Washinaton, D. C.

20555 8-(Lea'e * * *>

12. SPONSORING ORGANIZATION NAME AND MAILING ADDRESS (lactue lsp Coel p

11. CONTRACT NO.

13. TYPE OF REPORT PE RIOD COVE RED (Inclusere dems/

Congressional Report

15. SUPPLEMENTARY NOTES

14. (Leave WmAl

16. ABSTRACT #00 words or Aess)

As a result of NRC staff review and extended collegial consultations and investiga-tions within the NRC, the Commission has designated four new Unresolved Safety Issues (USIs). This report describes the process used to evaluate the large number of con-cerns and recommendations which resulted from the major investigations of the Three Mile Island-2 accident as well as other events and investigations of the past year, and the report identifies the four new USIs selected as follows:

(1) Shutdown decay heat removal requirements (Task A-45); (2) Seismic oualification of equipment in operating plants (Task A-46); (3) Safety implications of control systems (Task A-47); and (4) Hydrogen control measures and effects of hydrogen burns on safety equip-ment (Task A-48). Appendix A of the report presents an expanded discussion of each new USI including issue definition, a preliminary discussion of the action plan and a basis for continued plant operations and licensing. Appendix B of the report pro-vides a brief discussion of each of the candidate safety issues not designated as an USI.

0 4

17. KEY WORDS AND DOCUMENT ANALYSIS 17a DESCRIPTORS 17th IDENTIFIE RS/OPEN-EN DE D TERMS

18. AVAILABILITY STATEMENT

19. SECURITY CLASS (This reporr)

21. NO. OF PAGES

20. SE CU RITY CLASS (This papel

22. PRICE S

CmCPCRM 335 (7 77)