ML20010H970

Testimony of Dr Buttemer Supporting Applicant Alternative Motion for Fuel Loading & Low Power License for Unit 2

ML20010H970
Person / Time
Site:	San Onofre
Issue date:	09/21/1981
From:	Buttemer D PLG, INC. (FORMERLY PICKARD, LOWE & GARRICK, INC.), SOUTHERN CALIFORNIA EDISON CO.
To:
Shared Package
ML20010H843	List: ML20010H842 ML20010H970 ML20010H972
References
ISSUANCES-OL, NUDOCS 8109290457
Download: ML20010H970 (13)

Text

- - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - . _ _ _ _ . _ _

7 UNITED STATES OF AMERICA 2 NUCLEAR REGULATORY COMMISSION 3 3 BEFORE THE ATOMIC SAFETY AND LICENSING BOARD 4

5 In the Matter of ) Docket Nos. 50-361 OL

) 50-362 OL

) 6

^ ^

EDISON COMPANY, ET. AL. )

7 )

(San Onofre Nuclear Generating )

O )

Station, Units 2 & 3) )

) 9 10 11

) 12 13 14 15 16 DIRECT TESTIMONY 17 OF MR. DAVID R. BUTTEMER

) 18 19 20

)

21 22 23

)

24 25 26 3

8109290457 810921 "'

) PDR T

ADOCK 05000361

_ PDR;

- _ _ _ _ _ _ _ _ _ _ I

1 TESTIMONY OF DAVID R. BUTTEMER 2

3 Q. Would you please state your name?

! 4 A. David R. Buttemer. 2 5 Q. By whc2 are you presently employed?

) 6 A. I am employed as Senior Consultant by Pickard, Lowe and 7 Garrick, Inc. (PLG), a consulting engineering firm 8 specializing in reactor siting, safety, and accident

) 9 analysis.

10 Q. For what purposes has PLG been retained by the Applicants in i

11 this proceeding?

12 A. PLG was retained by the Applicants to assess the response of 13 the San Onofre Nuclear Generating Station Unit 2 (SONGS 2) to 14 a range'of postulated accidents which might occur during low 15 Power testing.

16 Q. In what manner have you been involved in the work conducted 17 by PLG for the Applicants?

18 A. I have been involved in performing a variety of safety 19 analyses of potential low power accidents at the SONGS 2 20 Pl ant. During the course of these studies I have been in S

21 direct contact with the engineering staff of the nuclear 22 steam supply vendor for this plant, Combustion Engineering, 23 Inc., and obtained detailed information regarding the reactor 9

24 coolant system. The results of my anaylses are set forth in 25 ////

26 ////

9 9 _ _ _ _ - - _ - _ - - - - - _ _ _ - _ _ _ _ - _ - i

O 1 Exhibit 'RB-1, " Analysis of Postulated Accidents During Low 2

Power Testing at the San Onofre Nuclear Generating Station,

'O 3 Unit 2".

4 Q. What are your pertinent professional affiliations?

5 A. I am a registered Professional Engineer in the State of

.() 6 Cellfornia with certificates in both mechanical and nuclear 7 engineering.

8 Q. Please describe your academic qualifications pertinent to O 9 reactor accident analysis?

10 A. I graduated in 1960 from San Diego State Uni 7arsity with a 11 Bachelor of Science Degree in Mechanical Engineering. I

.O 12 received a Master of Science Degree in Mechanical Encineering 13 from UCLA in 1965. In the summer of 1976 and 1977, I was a 14 lecturer at the Fast Reactor Safety Course given at the O 15 Masschusetts Institute of Technology.

16 Q. What professional experience have you had in the field of

( 17 safety and accident analysis?

'O 18 A. During the period 1960 through 1977, I was employed by the 19 General Atomic Company. From 1950 to 1965, I was principally 20 involved in the mechanical design of the reactor core of an O

21 experimental reactor. From 1966 through 1968, I was 22 principally involved in the analysis and design of major Hich 23 Temperator Gas-Cooled Reactor components including the

,0 24 reactor core, steam generator and pre-stressed concrete l

25 reactor vessel. From 1969 to 1977, I was responsible for the 26 safety and systems analysis of the gas-cooled fast breeder O

lO .-

~

reactor (GCFR) in the capacity of Branch Manager. This work 1

entailed a wide range of accident analyses, including 2

analytical methods development and analysis of accidents well beyond the so-called design basis. In 1973, I spent six 4

months in Germany as a consultant to a German reactor 5

manufacturer, Kraftwerk Union, and to the German national

)

laboratory at Karlsruhe training their staffs on the use of 7

large accident analysis computer progrums I had developed 8

while at General Atomic. From 1977 to 1980, I was employed

-)

by Helium Breeder Associates ("HBA"), a firm responsible for 10 providing utility industry management and financial support

) to the GCFR program. 'While at HBA, I was the Technical 12 Director and was also the Manager af the Technical Division.

13 In this capacity I was responsible for the overall technical 14 3 direction of the program, working closely with the U.S.

15 Department of Energy in establishing priorities and 16 coordinating work being done by General Atomic, several U.S.

17 9 national laboratories and several architect / engineering 18 firms. The U.S. Department of Energy discontinued financial 19 support of the GCFR program in 1980 and I joined the S consulting firm of Pickard, Lowe and Garrick, Inc., ("PLG")

21 in December of 1980. At PLG, I have been primarily involved in the area of prcbabilistic risk assessment.

D Q. Have you previously submitted expert opinions in the area of safety analysis?

25

////

g 26 l

g _ - -_-_____-__

3 1

A. Yes. In the time period of 1971 to 1975, I made numerous 2

presentations on GCFR safety and licensing analyses to the '

1 3 Nuclear Regulatory Commission Staff and th Advisory Committee on Reactor Safety.

5 Q. What is the purpose of your testimony in this proceeding?

D 6 A. My testimony is in suppotc of Applicants' Alternative Motion 7

For a Fuel Loading and Low Power License For SONGS 2. My 8

testimony demonstrates that even extremely unlikely accidents 9

well beyond the design basis for SONGS 2, would progress very 10 slowly under the low power test program restraints. In 11 conjunction with the testimony of Rosenblum and Pilmer, my 3 12 testimony will show that such accident sequences progress 13 sufficiently, slowly to allow taking effective action to .

14 prevent serious accidents or to take offsite protective O 15 actions.

16 Would you describe how you have usei the concept of " risk" in Q.

17 performing your evaluation?

3 18 ~

l A. Yes. My studies were made to evaluate the risks associated 19 with fuel loading and low power operation relative to those 20 associated with full power operation. In this context risk O

l 21 is compr sed of two principal components. First, the 22 probability, or likelihood, that a given accident sequences 23 will occur, and, secondly, the public consequences associated 24 with that sequence.

25 Q. Pleasa describe the factors affecting potential public 26 consequences which you consider could conceivsbly occur l

l i

_..,_ _ ...._.,.-.__.,.... ,. ,_.,...__,._.,..,______.m____...__.,,.. . . . _

)

O during low power testing as compared to full power 1

operation?

2 3 A. A major factor affecting public consequences is the inventory, or amount. of radioactive nuclides available at 4

the plant. In a reactor facility which has been operating at 5

3 full power for an extended period of time, by far the largest radionuclide inventory is in the reactor core itself, 7

although significant inventories also exist in the spent fuel

) located in the spent fuel storage pool as well as in the 9

radioactive waste systems and activated corrosion products.

10 During the planned SONGS 2 low power test program there will 11 J be no spent fuel, ve'y little ralioactivity in the 12 radioactive waste systems and essentially no activated 13 corrosion products.

3 Because of the low reactor power levels and short 15 operating times planned in the low power test program, the 16 fission product inventory within the core itself is a small 3 fraction of that which would exist during normal operation.

18 Short-lived fission product inventories would be about 1/20th 19 of that which would occur during normal operation. The 20 longer-liced fission product inventories would be less than 21 1/20th of that during normal power operation.

22 The substantially lower core fission product

[] 23 inventories represent a much lower radionuclide source term 24 in the context of accident dose, more importantly, represent substantially lower fission product decay heat D 26 3 -s-

)

levels. In the event of an accident, the lower decay heat y

results in very slow heat up rates providing substantial timt 2

3 for mitigative action. At 5% power the core temperatures are 3

much lower than at full power, the stored thermal energy in 4

the core being about 5% of that at full power. These factors 5

J provide much greater " thermal margins to the design limits, which are established based upon full power operation.

Q. Have you identified any factors peculiar to low power 3 testing which would increase the potential accident consequences relative to full power operation?

A. No.

11 3 Q. How do the probabilities of severe accident sequences during low power testing compare to those at full power?

A. The probability that an accident will be initiated during

] low power operation should be about the same ac during full power operation. Bear in mind tnat probability expresses the likelihood that a given event will occur during a given 3 period of time. The SONGS 2 plant will be at. power greater 18

~

than 0.1 percent for only about two weeks during the low 19 power test phase. From the Reactor Safety Study, The Wash 3 1400 Report issued by the AEC in 1975, accident initiators 21 are grouped into two broad categories - loss of coolant 22 accidents (" LOCAs " ) and transients. Since the low power 3 23 tests are conducted at full pressure and at coolant 24 temperatures comparable to those at full power, the 25 probability of a LOCA would be about the same during low 3 26 3 -s-1 l

)

1 Power testing as at full power. Transient accident 2 initiators are caused by a wide range of eventa, many of 3 3 which are associated with operator error or failures in the 4 turbine generator portion of the plant. The low power test 5 will be conducted under strict procedural controls under the

) 6 direct scrutiny of engineering and technical supervisors.

7 Also, during low power physics and natural circulation tests, 8 the turbine generator system will not be operating, feedwater D will be supplied to the steam generators by the safety grade 9

10 auxiliary feedwater system and the steam produced in the 11 steam generators will be condensed in the main condenser.

' For these reasons, the likelihood of a transient accident 12 13 initiator would be lower than during full power operation.

14 Q. Have you identified any factors which would increase the S

15 likelihood of accident initiators?

16 A. Yes. Because of the newness of the plant, somewhat higher 17 equipment break in failures are possible, and some 9

18 uncertainties in integrated system performance exist.

19 However, the plant systems have been rigorously tested over a 20 peri d of several years as part of the system and hot g functional test programs. Although the maintenance, g operating, and emergency procedures have been utilized in the startup program, some further refinement may be required.

g 23 g Q. What is the net effect of the above factors on the likelihood of transient accident initiators?

////

2s O _7-

D -

1 A. All in all, I would expect that the likelihood of transient 2

accident initiators would be about the same for either low D 3 Power or full power operation.

4 Q. You have discussed the relative probabilities of initiation 5

f an accident. Assuming an initiator has occurred, would D 6 the accident progress differently at low power than at full 7

power?

8 A. Yes. All of the safety systems which are designed ,to accommodate accidents from full power operation would be 9

available for action, if needed, during the low power testing 10 phase. These safety grade systems would be expected to 3 automatically start and avert excessive core temperatures should an accident occur. If for some unforeseen reason these systems should malfunction, excessive core temperatures will not be reached for several tens of hours, thereby allowing ample time for diagnostic and corrective operator action.

D Q. What is the net effect of these factors on the likelihood of 18 severe accident sequences?

A. For the above reasons, I expect that during low power

, 20 testing, the probability of accident sequences leading to 21 core melt would be lower than at full power operation.

Q. Having examined both the probability and consequences of severe accidents during low power testing relative to full power operation, what is your assessment of the relative risk of low power testing?

9 O

1 A. Because both the probability and consequences of core melt 2 accidents are smaller during low power testing than at full O 3 power, I conclude that the risk is also much lower.

4 Q. Your Exhibit DRB-1 " Analysis of Postulated Accidents During 5 Low Power Testing at San Onofre Nuclear Generating Station, O 6 Unit 2" pr~sents a detailed analysis of various accident 7 scenarios. Can you summarize the significant conclusions of 8 that evaluation?

O g A. Yes. At the time these analyses were begun, the detailed low 10 power testing program was not available. Therefore, I 11 assumed continuous operation at 5% power for time periods of

'O two and a half, five and ten days. I considered three 12 13 classes of accident initiators: (1) a large LOCA, (2) an 14 instantaneous loss of the steam generator as a heat sink with O the safety valves remaining open, and (3) an instantaneous 15 16 loss of the steam generator as a heat sink with the safety 17 valves maintaining reactor coolant pressure at the 2500 psia O set point. In the loss of steam generator heat sink yg 19 accidents, no credit was taken for boiloff of the secondary 20 water in the steam generators themselves. The reactor was O

21 assumed to be shut down after the accident but it was assumed 22 that the active safety systems, mainly the auxiliary 23 feedwater and emergency core cooling systems, were not O

g operational. This is an extremely conservative assumption, in that these analyses apply to accident sequences which have 5

an ex eedingly small probability of g 26 O ___-______-

O 1 occurrence. The core decay heat and integral decay heat were 2 evaluated as functions of time after scram for the three O 3 operating periods assumed. Next, a therma]-hydraulic model 4 of the core in the steam cooling phase was developed. This 5 is the phase when the water level in the reactor vessel is in O 6 the active core region. For the large LOCA analysis it is 7 important to determine how much of the water initially in the 8 reactor coolant system and in the safety injection tanks O 9 (" SIT") is available for boiloff. The water' level cannot be 10 above the reactor vecsel nozzles since it would spill out the 11 severed pipe. For certain classes of LOCK's, it is possible O that residual nitrogen gas pree,sure in the safety injection 12 13 tanks can displace water out cf the vessel leak as it is g vented. This factor was taken into consideration. In the O 1 ss f steam generator cases, steam pockets can form in the 15 16 Upper extremities of the reactor coolant system and displace At water out of the safety valves located on the pressurizer.

O This factor was also accounted for.

g The residual water will g then be heated up and boiled off by the heat generated in the Core as well as by any stored heat remaining in the reactor O

vessel and its internals after the blowdown-SIT injection phase has ended. The core temperatures will gradually increase as the water level recedes and the time when O

excessive core temperatures are reached is of interest. This 24 temperature has been conservatively selected as 1,560 degrees Farenheit, the temperature at which significant metal water O _ lo _

)

1 reaction would begin. These times are indicated in Figure 2 DRB-A, " Summary of Accident Analyses--SONGS Unit 2, Low Power

) 3 Testing. Program" for the three accident initiators considered 4 as a function of the days of prior continuous operation at 5%

5 Power. As can be seen, these times are very long. The large

) 6 LOCA is the most limiting accident. With 10 days prior 7 Operation it can be seen that excessive core temperatures are 8 not reached for 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />. For the loss of steam generator J 9 heat sink events, excessive temperatures are not reached for 10 several days. Also shown in Figure DRB-A are the water make 11 up rates which would avert excessive core temperatures.

3 12 These make up rates are very small. The very long times before the onset of core damage and the snall water makeup 13 requirements allow for adequate corrective action to be taken 14

) 15 t arrest the accident sequence.

Q. Your analysis assumed no corrective action is taken up to the 16 Point that excessive core temperatures are reached. What 17

) 18 happens if no corrective actions are taken subsequent to reaching such excessive core temperatures?

19 A. As the temperature in the core heats up past 1560 degrees 20 Farenheit, an oxidation process begins to occur between the hot cladding and the steam. This chemical reaction, referred to as a metal-water reaction, produces hydrogen as one of the J reaction products. Since hydrogen is a combustible gas, one is Conce:ned with the rate at which it accumulates within the containuent building. A hydrogen / air mixture will burn J ,

)  !

l extensively (but will not explode) when the hydrogen reaches i 2 about 8 percent by volume. The hydrogen generation rate was l

) 3 conservatively evaluated for the large LOCA case assuming 10 4 days prior operation. This analysis shows that an additional 5 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> of oxidation is required to produce 8 volume percent

) 6 hydrogen within the containment. Therefore, this will occur 7 a total of about 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> after the accident is initiated, 8 assuming no containment sprays or hydrogen recombiners

) 9 operate. Addi*!onally, the resulting calculated peak 10 pressure after hydrogen burn is less than the pressure at yy which containment structural integrity is jeopardized and

) 12 therefore no release of radioactive material would be con ?.emplated .

13 14

)

l 15 l

16 17 18 i 19 20

)

l 21 22 .

)

24 25 3 26

) _ _ _ . _._ _ _ _ _ _ . _ - _ , _ _ - _ . _ - . _ _ _ . . _ _

O .

Reactor Powea History o 2.5 days continuo'as operation at 5". power O o 5 days continuous operation at 5% power o 10 days continuous operation at 5". power Postulated Accidents (all active systems assumed to fail)

O o Large Loss-of-Coolant-Accident (LOCA) o Loss of Steam Generator Heat Sink Accident -

Safety valves remain open )

O o Loss of Steam Generator Heat Sink Accident -

Safety valves maintain pressure at 2500 psia Times for Excessive Core Temperatures and Water Makeup O

Time When Water Makeup Significant Required To Accident Days Prior Clad Metal-Water Prevent Excessive O Initiator Operation Reaction Begins Core Temperatures (TCLAD > 1,5600F)

LOCA 2.5 47 hrs 0.8 gpm 5.0 28 hrs 1.5 gpm O 10.0 22 nrs 2.2 gpm LOSGHSA* - SVs 2.5 11.0 days 0.2 gpm remain open 5.0 5.6 days 0.6 gpm 10.0 3.7 days 1.0 gpm O __

LOSGHSA - SVs 2.5 12.2 days 0.4 gpm Maintain Pressure 5.0 5.8 days 0.8 gpm at 2,500 psia 10.0 3.9 days 1.5 gpm O

• LOSGHSA is loss of steam generator heat sink accident. SVs are safety valves.

.O Figure DRB-A: " Summary of Accident Analyses - SONGS Unit 2 Low Power Testing Program" -

O

. . . -- - -- . , - - . -. . . -