ML20028B337

Technical Assessments of Selected Oyster Creek SEP Topics. One Aperture Card Available in PDR

ML20028B337
Person / Time
Site:	Oyster Creek
Issue date:	09/30/1982
From:	Bieniarz P, Buttemer D, Iden D ELGPLG, PLG, INC. (FORMERLY PICKARD, LOWE & GARRICK, INC.)
To:
Shared Package
ML20028B330	List: ML20028B329 ML20028B337
References
TASK-03-10.A, TASK-05-05, TASK-06-04, TASK-06-07.C1, TASK-07-01.A, TASK-08-02, TASK-08-04, TASK-3-10.A, TASK-5-5, TASK-6-4, TASK-6-7.C1, TASK-7-1.A, TASK-8-2, TASK-8-4, TASK-RR PLG-0247, PLG-247, NUDOCS 8211300298
Download: ML20028B337 (257)

Text

iO ATTAcmm.NT IV PLG-0247

O TECHNIC'AL~ ASSESSMENTS OF o

SELECTED OYSTER CREEK SEP TOPICS

o l

1

O l

i t

O i

i Prepared for l

GPU NUCLEAR CORPORATION i

O Parsippany, New Jersey l

j September 1982 I

I

!O

O 8211300298 821116

'O PDR ADOCK 05000219 P

PDR l

PICKARD, LOWE AND GARRICK,INC.

CONSULTANTS - ELECTRIC PCWER l

io IRVINE, CALIFORNIA WASHINGTON, D.C.

i

PLG-0247 TECHNICAL ASSESSMENTS OF SELECTED OYSTER CREEK SEP TOPICS by Douglas C. Iden David R. Buttemer Peter P. Bienlarz Prepared for GPU NUCLEAR CORPORATION Parsippany, New Jersey September 1982 1

PICKARD, LOWE AND GARRICK,INC.

CONSULTANTS - ELECTRIC POWER 1RVINE, CALIFORNIA WASHINGTON, D.C.

TABLE OF CONTENTS Topic Number Title Tab Number III - 10.A THERMAL OVERLOAD PROTECTION 1

FOR MOTORS OF MOTOR-0PERATED VALVES V-5 REACTOR C0OLANT PRESSURE 2

B0UNDRY (RCPB) LEAKAGE DETECTION VI - 4 CONTAINMENT ISOLATION SYSTEM 3

VI - 7.C.1 ELECTRICAL INSTRUMENTATION AND 4

CONTROL (El&C) RE-REVIEWS VII - 1.A ISOLATION OF REACTOR PROTECTION 5

SYSTEM FROM NON-SAFETY SYSTEMS VIII - 2 ONSITE EMERGENCY POWER SYSTEMS -

6 DIESEL GENERATORS VIII - 4 ELECTRICAL PENETRATIONS OF REACTOR 7

CONTAINMENT

1 f

t

'A 4

i i

I I

i i

I

/

TECHN; CAL ASSESSMENT 0YSTER CREEK SEP TOPIC III-10.A j

THERMAL OVERLOAD PROTECTION FOR MOTORS 0F MOTOR-0PERATED VALVES t

t I

i i

i 4'

s P

J i

i l

{

i i

d i

~

r u

1 i

.i I

t

.i l

0027G092982

/

4

/

(

k

i t

t TABLE OF CONTENTS Section Page 1

INTRODUCTION 1

2 EVALUATION 2

3 CONCLUSION 4

4 REFERENCES 5

i 00?7G0074R?

LIST OF TABLES Table Page l'

List of Oyster Creek MOVs Powered from Safety Related MCCs 6

2 Unbypassed Safety Related MOVs 10 l

s i

i i

i 1,

I i

1 i

J ii An97CAO*tn00

,.. - -. - - - - - - -, _. - - - -. - - _. -.. -. - - _,,,,,.. -.,. -. = - - _ _ _, - -... - - - - - -. - _., - -.

1.

INTRODUCTION On June 29, 1981, the Nuclear Regulatory Commission (NRC) issued a safety evaluation (Reference 1) on SEP Topic III-10.A, Thermal Overload Protection for Motors of Motor-0perated Valves for the Oyster Creek Nuclear Generating Station, which supplemented a previous technical evaluation by WP.C contractor (Reference 2). As a result of these evaluatioa. I.ne NRC proposes modifications to the valve control circuits of motor-operated valves (MOVs) that perform safety related functions which do not satisfy the current licensing criteria (because the adequacy of the setpoints for unbypassed thermal overloads has not yet been established). The review criteria which serve as the basis for these modifications are IEEE standard 279-1971 and Regulatory Guide 1.106.

This is the only unresolved issue for this topic.

The purpose of this assessment is to identify those M0Vs that perform a safety related function which do not have the bypass feature, and then evaluate each valve's safety significance in the context of the Oyster Creek Probabilistic Safety Analysis.

1 0027G092982

2.

EVALUATION The primary function of thermal overload relays is to protect motor windings of motor-operated valves against excessive heating. The thermal overload relays would be activated and interrupt power to the motor windings if either the valve itself had a mechanical or electrical failure which would cause high current flow through the motor windings or the relay setpoints were miscalibrated.

Before addressing these failure mechanisms it will be useful to determine which Oyster Creek MOVs, if failed, have the potential to impact the safety of the plant. To start with, a review of MOVs at Oyster Creek was conducted. Table 1 lists the identified MOVs powered from safety related motor control centers (MCCs) based on this review. Only the 12 core spray system MOVs were found to have thermal overload protection bypasses.

In addition, the Oyster Creek Probabilistic Safety Analysis was reviewed to identify the unbypassed MOVs which have an impact on the safety of the plant. Based on this review, 31 valves were identified to have a safety impact and are listed in Table 2.

Further system perform-ance review indicated that a great majority of these valves are normally open. The valves which are normally closed but which need to open in order to initiate a system's operation are identified by (*).

Except for MOVs V-17-19 and V-17-54 (shutdown cooling system inlet and outlet isolation valves), the failure of any single normally closed M0V to open on demand will not result in failure of the system.

Since MOVs V-17-19 and V-17-54 are manually operated and are not required to be open until many hours after a plant shutdown, sufficient time is avail-able to correct any valve failures that could occur due to thermal over-load trips or provide other means of long term decay heat removal. The only valve failures which could have an impact require two valve failures in the containment spray or the emergency condenser systems. For example, the failure of normally closed containment spray wetwell spray valve V-21-18 to open on demand is backed up by Y-21-15 in a redundant train. However, opening of the wetwell spray valves is not required for system success.

In addition, the failure of normally closed emergency condenser isolation valve V-14-34 to open on demand is backed up by V-14-35.

However, the emergency condenser system is backed up by core spray and ADS actuation. Therefore, even if the emergency condenser system fails due to thermal overload actuation in two valves, there are additional mitigating systems to prevent core melt given an initiating event.

As previously mentioned, the actuation of the thermal overload relays may occur as a result of mechanical or electrical valve failure or setpoint mi scalibration. The mechanical or electrical failure or setpoint miscalibration of an MOV to operate on demand (open or closed) due to thermal overload relay actuation is a small percentage of the overall failure rate of an MOV to operate on demand (less than 5%). This is based on an exhaustive and detailed review of Nuclear Power Experience (Reference 3) which includes the operating experience of both BWRs and PWRs and about 895 MOV failures from all causes. About 4% of these valve failures are common cause events (such as design errors, manufacturer's 2

0077G0474R7

errors, and common environmental conditions) which affect a second M0V.

Therefore, it is shown historically that thermal overload relay actua-tions have not been a significant contribution to M0Vs failing to carry out their safety related function.

3 on?7r,no?on?

3.

CONCLUSION Based on the above evaluation, it is seen that modifying the safety related MOVs to include thermal overload protection bypasses would not significantly improve MOV performance or system performance. As a result, it would not affect Oyster Creek core melt frequency or plant risk to any significant extent. This is because system redundancy provides backup valve trains that can actuate to provide the safety functions and the failure rate of MOVs due to thermal overload relay actuation is not a significant contributor to the total M0V failure to operate on demand from all causes. Consequently, it is concluded that neither design modifications to bypass the thermal overload protection relays for all safety related MOVs nor demonstrations of the adequacy of the setpoints of these relays should be undertaken.

4 nn?7cno?ono

4.

REFERENCES 1.

NRC letter from Mr. D.M. Crutchfield to Mr. I.R. Finfrock, Jr., of Jersey Central Power and Light Company, dated June 29, 1981, "SEP Topic II-10.A, Thermal Overload Protection for Motors of Motor-Operated Valves, Safety Evaluation for Oyster Creek."

2.

EG8G Report, "SEP Technical Evaluation, Topic III-10.A, Thermal Overload Protection for Motors of Motor-0perated Valves at Oyster Creek," Docket No. 50-219, April 1980, F.G. Farmer (4-7-80, 1653F).

3.

Nuclear Power Experience, Petroleum Information Corporation, April 1982.

i 5

0077G007047

TABLE 1.

LIST OF OYSTER CREEK MOVs POWERED FROM SAFETY RELATED MCCs AC M0Vs Description V-1-99 Flash Tank Vent Valve V-1-106 Main Steam Drain Valve V-1-107 Main Steam Drain Valve V-1-102 Flash Tank Vent Valve Y-1-103 Flash Tank Vent Valve V-1-11 SJAE Steam Supply Valve V-1-12 Steam Seal Regulator Feed Valve V-1-13 Steam Seal Regulator Bypass Valve V-1-14 Steam Seal Regulator Unloading Valve V-1-15 Reheater Vent Inlet Valve V-1-16 Reheater Vent Inlet Valve V-1-17 Reheater Vent Inlet Valve V-1-18 Reheater Vent Inlet Valve V-1-19 Reheater Stop-Check Valve V-1-20 Reheater Light Load Valve V-1-21 Reheater Stop-Check Second Stage Valve V-1-22 Reheater Vent Outlet Valve V-1-23 Reheater Vent Outlet Valve V-1-24 Reheater Vent Cross-Connection Valve V-1-25 Reheater Vent Cross-Connection Valve V-1-45 Third Stage Extraction Bypass Valve V-1-65 Main Steam Piping Drain Valve V-1-66 Main Steam Lead Drain Valve V-1-67 Control Valve Before Seat Drain Valve V-1-73 Reheater Shell Drain Second Stage Valve V-1-26 Reheater Vent Outlet Valve V-1-27 Reheater Vent Outlet Valve V-1-28 Reheater Stop-Check Valve V-1-30 Reheater Vent Cross-Connection Valve V-1-31 Reheater Vent Cross-Connection Valve V-1-32 Reheater Vent Inlet Valve V-1-33 Reheater Vent Inlet Valve V-1-34 Reheater Stop-Check Second Stage Valve V-1-35 Reheater Vent Inlet Valve V-1-36 Reheater Vent Inlet Valve V-1-46 Third Stage Extraction Bypass Valve V-1-68 Main Steam to Second Stage Reheater Drain Valve V-1-74 Reheater Shell Drain Second Stage Valve V-1-93 Steam Inlet to Heater Valve V-1-94 Steam Inlet to Heater Valve V-1-95 Steam Inlet to Heater Valve V-1-96 Steam Inlet to Heater Valve V-1-97 Steam Inlet to Heater Valve V-1-98 Steam Inlet to Heater Valve V-2-1 SJAE Condenser 1A Isolation Valve V-2-2 SJAE Condenser 1A Isolation Valve 6

no?7c,no?on?

TABLE 1 (continued)

AC MOVs Description V-2-3 SJAE Condenser 1B Isolation Valve V-2-4 SJAE Condenser 1B Isolation Valve V-2-5 SJAE Condenser 1C Isolation Valve V-2-6 SJAE Condenser 1C Isolation Valve V-2-7 Heater Bank IA Inlet Valve V-2-8 Heater Bank IB Inlet Valve V-2-9 Heater Bank IC Inlet Valve V-2-10 Heater Bank IA Outlet Valve V-2-11 Heater Bank IB Outlet Valve V-2-12 Heater Bank IC Outlet Valve V-2-82 Exhaust Hood Spray Water Bypass Valve V-2-30 Condenser Outlet South Side Valve V-2-31 Condenser Outlet North Side Valve V-2-32 Condenser Outlet South Side Valve V-3-12 Condensate Inlet Valve North Side V-3-13 Condensate Inlet Valve South Side V-3-14 Condensate Inlet Valve North Side V-3-15 Condensate Inlet Valve South Side V-3-16 Condensate Inlet Valve North Side V-3-17 Condensate Inlet Valve South Side V-3-18 Condensate Backwash North Side Valve V-3-19 Condensate Backwash South Side Valve V-3-20 Condensate Backwash North Side Valve V-3-21 Condensate Backwash South Side Valve V-3-22 Condensate Backwash North Side Valve V-3-23 Condensate Backwash South Side Valve V-3-24 Condensate 1A Backwash Crossover Yalve V-3-25 Condensate IB Backwash Crossover Valve V-3-26 Condensate IC Backwash Crossover Valve V-3-27 Condensate 1A Outlet North Side Valve V-3-28 Condensate 1A Outlet South Side Valve V-3-29 Condensate 1B Outlet North Side Valve V-3-88 Containment Spray Heat Exchanger Outlet Valve V-3-8 Circulating Water Pump 1-1 Discharge Valve V-3-9 Circulating Water Pump 1-2 Discharge Valve V-3-30 Condenser Outlet Valve South Side Y-3-31 Condenser Outlet Valve North Side V-3-32 Condenser Outlet Valve South Side V-3-87 Containment Spray Heat Exchanger Outlet Valve V-3-10 Circulating Water Pump 1-3 Discharge Valve V-3-11 Circulating Water Pump 1-4 Discharge Valve NG02-A Recirculation Pump NG01A Suction Valve NG02-C Recirculation Pump NG01C Suction Valve NG02-E Recirculation Pump NG01E Suction Valve NG03-A Recirculation Pump HG01A Discharge Valve NG03-C Recirculation Pump NG01C Discharge Valve NG03-E Recirculation Pump NG01E Discharge Valve 7

nn77r,no7097

TABLE 1 (continued)

AC MOVs Description NG08-A Recirculation Pump NG01A Bypass Valve NG08-C Recirculation Pump NG01C Bypass Valve NG08-E Recirculation Pump NG01E Bypass Valve NG02-B Recirculation Pump NG01B Suction Valve NG02-D Recirculation Pump NG01D Suction Valve NG03-B Recirculation Pump NG01B Discharge Valve NG03-D Recirculation Pump NG01D Discharge Valve NG08-B Recirculation Pump NG01B Bypass Valve NG08-D Recirculation Pump NG01D Bypass Valve NC-18 CRD Drive Water Pressure Valve NC-40 CRD Cooling Water Pressure Valve V-5-106 Closed Cooling Water Discharge Valve V-5-147 Closed Cooling Water Supply to Drywell Equipment Valve V-5-148 Closed Cooling Water Supply to Drywell Equipment Valve V-5-166 Drywell Containment Cooling Water Valve V-5-167 Drywell Containment Cooling Water Valve V-7-38 Gland Steam Exhauster Valve V-7-39 Gland Steam Exhauster Valve V-14-32 Emergency Condenser NE01-B Inlet Isolation Valve V-14-37 Emergency Condenser NE01-B Return Isolation Valve V-14-30 Emergency Condenser NE01-A Inlet Isolation Valve V-14-36 Emergency Condenser NE01-A Return Isolation Valve V-16-1 Cleanup System Inlet Isolation Yalve V-16-61 Cleanup System Return Isolation Valve V-16-13 Cleanup Auxiliary Pump Discharge Valve V-16-32 Cleanup Recirculation Pump Bypass Valve V-16-49 Cleanup Recirculation Pump Discharge Valve V-16-50 Cleanup Recirculation Pump Discharge Valve V-16-57 Discharge Valve to Radwaste V-16-59 Discharge Valve to Orifice Bypass V-16-60 Discharge Valve to Condenser V-17-19 Shutdown Cooling Inlet Isolation Valve V-17-54 Shutdown Cooling Outlet Isolation Valve V-20-41 Core Spray Isolation Valve V-20-3 Core Spray Suction Valve V-20-33 Core Spray Suction Yalve V-20-12 Core Spray Discharge Valve V-20-27 Core Spray Recirculation Valve V-20-4 Core Spray Suction Valve V-20-18 Core Spray Discharge Valve V-20-26 Core Spray Recirculation Valve 8

on?7nno?on?

TABLE 1 (continued)

AC MOVs Description V-20-40 Core Spray Isolation Valve V-20-32 Core Spray Suction Valve V-20-21 Core Spray Isolation Valve V-20-15 Core Spray Isolation Valve V-21-7 Containment Spray Pump Suction Valve V-21-9 Containment Spray Pump Suction Valve V-21-11 Containment Spray Isolation Valve V-21-17 Containment Spray Isolation Valve V-21-18 Pressure Suppression Chamber Spray Valve V-21-1 Containment Spray Pump Suction Valve V-21-3 Containment Spray Pump Suction Valve V-21-5 Containment Spray Isolation Valve V-21-13 Containment Spray Isolation Valve V-21-15 Pressure Suppression Chamber Spray Valve DC MOVs V-1-110 Main Steam Drain Valve V-1-111 Main Steam Drain Valve V-14-31 Emergency Condenser Isolation Valve V-14-33 Emergency Condenser Isolation Valve V-14-34 Emergency Condenser Isolation Valve V-14-35 Emergency Condenser Isolation Valve V-16-2 Cleanup System Isolation Valve V-16-14 Cleanup System Isolation Valve V-17-1 Shutdown System Inlet Yalve V-17-2 Shutdown System Inlet Valve V-17-3 Shutdown System Inlet Valve V-17-55 Shutdown System Outlet Valve V-17-56 Shutdown System Outlet Valve V-17-57 Shutdown System Outlet Valve j

{

l l

I 9

nn?7r,no?on?

)

i TABLE 2. UNBYPASSED SAFETY RELATED MOVs AC H0Vs Description V-5-106 Closed Cooling Water Discharge Valve V-5-147 Closed Cooling Water Supply to Drywell Equipment Valve i

V-5-148 Closed Cooling Water Supply to Drywell Equipment Valve V-5-166 Drywell Containment Cooling Water Valve V-5-167 Drywell Containment Cooling Water Valve V-14-32 Emergency Condenser NE01-B Inlet Isolation Valve Y-14-37 Emergency Condenser NE01-B Return Isolation Valve V-14-30 Emergency Condenser NE01-A Inlet Isolation Valve V-14-36 Emergency Condenser NE01-A Return Isolation Valve i

l V-17-19 Shutdown Cooling Inlet Isolation Valve (*)

i V-17-54 Shutdown Cooling Outlet Isolation Valve (*)

V-21-7 Containment Spray Pump Suction Yalve V-21-9 Containment Spray Pump Suction Valve j

V-21-11 Containment Spray Isolation Valve i

V-21-17 Containment Spray Isolation Valve Y-21-18 Pressure Suppression Chamber Spray Valve (*)

V-21-1 Containment Spray Pump Suction Valve V-21-3 Containment Spray Pump Suction Valve V-21-5 Containment Spray Isolation Valve V-21-13 Containment Spray Isolation Valve V-21-15 Pressure Suppression Chamber Spray Valve (*)

l j

DC MOVs V-14-31 Emergency Condenser Isolation Valve V-14-33 Emergency Condenser Isolation Valve V-14-34 Emergency Condenser Isolation Valve (*)

V-14-35 Emergency Condenser Isolation Valve (*)

V-17-1 Shutdown System Inlet Valve (*)

Y-17-2 Shutdown System Inlet Valve (*)

V-17-3 Shutdown System Inlet Valve (*)

V-17-55 Shutdown System Outlet Valve (*)

i V-17-56 Shutdown System Outlet Valve (*)

V-17-57 Shutdown System Outlet Valve (*)

(*) Indicates M0V is normally closed.

i l

10 0027r,04?oR7

TECHNICAL ASSESSMENT OYSTER CREEK SEP TOPIC V-5 REACTOR COOLANT PRESSURE B0UNDARY (RCPB)

LEAKAGE DETECTION UNIDENTIFIED DRYWELL LEAKAGE l

l l

nn,nnno2099

f f

REACTOR COOLANT PRESSURE B0UNDARY LEAK DETECTION

}

WITHIN THE CONTAINMENT DRYWELL l

l Regulatory Guide 1.45 requires that unidentified primary coolant leakage within the containment drywell be monitored by the following three systems:

e Sump level and flow monitoring.

e Airborne particulate radioactivity monitoring.

e Airborne gaseous radioactivity monitoring, or air cooler condensate flow rate monitoring.

Identified leakage (from pump seals, valve packings, etc.,) should be collected and monitored separately from the unidentified leakage.

Regulatory Guide 1.45 states that the above leakage monitoring equipment sensitivity should be able to detect an unidentified leakage rate of 1 gpm in less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, that the airborne particulate monitoring system be operable when subjected to a safe shutdown earthquake (SSE),

that each leak detection system be provided with indicators and alarms in the main control room, and that the plant technical specifications should include limiting leakage conditions and system availabilities.

NUREG-0123, the Standard Technical Specifications for General Electric Boiling Water Reactors, issued by the U.S. Nuclear Regulatory Commission (NRC) on August 15, 1976, specifies identified and unidentified leakage limits of 25 gpm and 5 gpm averaged over a 24-hour period, respectively.

The Oyster Creek Nuclear Generating Station was licensed for full power operation before these leak detection requirements were instituted. The plant sump level and flow monitoring system is operational and its sensi-tivity is such that it can detect unidentified leakages on the mder of 4 gpm persisting over a period of about I hour. This system is indicated and alarmed in the control room and it is not qualified to operate during an SSE. The plant has a detection system to monitor both airborne particulate and gaseous radioactivity levels but this system has not been placed into operation due to condensation problems in the sample line which transmits gas samples from the containment drywell to the detector station located outside the drywell. Design modificaticas to this sample line which should rectify the condensation problem are currently being evaluated by GPUN.

The intent of the assessment that follows is to estimate what impact various levels of drywell leakage detection systems might have with regard to reducing the likelihood of an accident which could lead to core mel t.

By its very nature, this evaluation will be quite judgmental since little actual experiential data exists in the area of " leak before break" phenomena, as well as the progression rate of a postulated break in the primary coolant pressure boundary of a nuclear power plant.

1 onanc.no?on?

l

Lastly, we are not aware that any explicit credit has been taken in existing probabilistic risk assessments with regard to detecting small leaks and safely shutting the reactor down and reducing pressure before the leak manifests itself into a much larger leak causing a loss of coolant accident (LOCA). This is not to say that leakage detection is i

not worthwhile, but rather to say that it is not apparent that the risk reduction aspects of leak detection have as yet been evaluated.

Indeed, it is the intent of the following simplified evaluation to explore such benefits and to derive a relative measure of risk reduction in comparison with all risk contributors to a boiling water reactor (BWR).

I The Reactor Safety Study (RSS) (Reference 1) evaluated the BWR plant response to five accident initiator categories as noted in Table 5-3 of the RSS Main Report. The availability of plant equipment to mitigate the progression of the accident was evaluated for each of the initiating events so as to calculate the frequency of that sequence leading to a core melt condition. The results of that evaluation are summarized in Table 1.

From this table, it can be seen that for the general class of LOCAs, the collective contribution to core melt frequency is about 4% of the total.

As previously mentioned, no explicit credit has been taken with regard to leak detection and orderly plant shutdown for the LOCA accident categories.

In order to estimate how leak detection might help consider the following simplified evaluation, assume for the intermediate and large break LOCA categories (A and S, in Table 1) that the period of large leakage is preceded by a period of much smaller but easily detect-able leakage (approximately 5 gpm) 9 times out of 10. Assume for the small break LOCA category (S2 in Table 1) that the period of larger leakage is preceded by a period of smaller but detectable leakage 5 times out of 10.

In each of the low leakage periods considered, it will be assumed that the leakage progression is slow enough so that if the leakage is detected, there is sufficient time available for the operator to shut down the plant in an orderly manner so as to avoid the signifi-cant LOCA event altogether. Let us further conservatively assume that the frequency of successful leak detection and proper operator action is 1.0 for a system in total compliance with Regulatory Guide 1.48, whereas the same number is only 0.8 for the existing sump level / flow monitoring system and the containment pressure-temperature-humidity measurements currently available at the Oyster Creek Nuclear Generating Station (0CNGS).

In actuality, the OCNGS leak detection equipment would be expected to have a much higher availability, but this conservatively low value is used in this evaluation so as to illustrate the point.

}

Evaluating the percentage of risk reduction for the leak detection system in compliance with Regulatory Guide 1.45 results in a reduction in core melt frequency of:

(1.0% + $.1%) x 0.9 x 1.0 + 1.8% x 0.5 x 1.0 = 2.8%

1 2

nnannno?oR2

i Similarly, for the existing leak monitoring equipment and the conserva-tive assumption regarding its availability, the reduction in core melt frequency is estimated as:

(1.0% + 1.1%) x 0.9 x 0.8 + 1.8% x 0.5 x 0.8 = 2.2%

Thus, the simplified and conservative analysis suggests that the leak detection system improvements will at best reduce the frequency of core melt accidents by about 0.6%.

From the Reactor Safety Study, the median 3 x 10 gy of all events leading to core melt was calculated to be about frequen per year; thus, a 0.6% reduct a frequency reduction of about 2 x 10 jon in that number represents per year. Therefore, it is felt that there is little incremental risk in operating the plant in the interim until the containment atmosphere particulate and gaseous radioactivity monitoring system is made operational.

Reference 1.

U.S. Nuclear Regulatory Commission " Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants", October 1975.

3 nn,nennonon

TABLE 1.

RANKING OF INITIATING EVENT CATEGORIES AS CONTRIBUTORS TO CORE MELT FREQUENCY C

ibut n to e

Initiating Event Category Frequency (1/yr)

A Large LOCA 2.9 x 10-7 1.0 (greater than 6-inch diameter)

S1 Small LOCA 3.2 x 10-7 1.1 (2 to 6-inch diameter)

S2 Small LOCA 5.6 x 10-7 1.8 (1/2 to 2-inch diameter)

T Transients 2.9 x 10-5 95.7 R

Pressure Vessel ' Rupture 1.3 x 10-7 0.4 Tota?

3.0 x 10-5 100.0 i

Note: Median values from Table 5-3 of Reference 1.

4 0030G093082

4

}

4 1

TECHNICAL ASSESSMENT 4

0YSTER CREEK NUCLEAR POWER PLANT SEP TOPIC VI-4 CONTAINMENT ISOLATION SYSTEM EMERGENCY CONDENSER SYSTEM AND TORUS WATER LEVEL MONITORING SYSTEM LEAK DETECTION 1

k i

i i

4 l

i

TABLE OF CONTENTS Section Page 1

LEAK DETECTION IN THE EMERGENCY CONDENSER SYSTEM 1

1.1 Introduction 1

1.2 Evaluation 1

1.3 Conclusions 4

2 LEAK CETECTION IN THE TORUS WATER LEVEL MONITORING SYSTEM 6

3 REFERENCES 7

j LIST OF FIGURES Figure Page 3

1 Emergency Condenser System Schematic 8

(One of Two Loops Shown) 2 Schematic Diagram of the Torus Water Level 9

Monitoring System l

l i

ii 0030G093082

1.

LEAK DETECTION IN THE EMERGENCY CONDENSER SYSTEM

1.1 INTRODUCTION

Large diameter high pressure piping which penttrates the containment drywell and communicates directly with the reactor vessel in the Oyster Creek Nuclear Generating Station (0CNGS) consists of the main steam lines, the feedwater lines, and the emergency condenser steam and condensate return lines. Several diverse methods for main steam line leak detection are available which quickly close the main steam line isolation valves. The feedwater lines carry relatively low temperature water and each line is equipped wi'.S two series check valves (one inside and one outside the containment bywell) which should rapidly close in the event of a feedwater line break. The intent of this section is to describe the emergency condenser system, predict the frequency of failure of its piping system located outside the containment drywell, and assess the ability to detect leaks within the emergency condenser system pressure boundary.

1.2 EVALUATION Two emergency condensers are employed in the OCNGS; a schematic diagram of one of the loops is shown in Figure 1.

The other loop has essentially the same arrangement. The purpose of the emergency condenser system is to remove decay heat from the primary coolant by condensing steam supplied from the upper portion of the reactor vessel and to return the condensate to the reactor vessel recirculation lines. Each condenser consists of two tube bundles immersed in a large water storage tank.

Condensation takes place on the tube side of the condenser tubes, heat being removed by shell side boiling of atmospheric pressure water located in the storage tank; the steam produced in boiling the shell side water is vented off through an elevated stack. The emergency condenser system is a closed, high pressure and passive system, coolant circulation being promoted by natural circulation since the condenser heat sink is located some 45 feet above the reactor core heat source.

As noted Figure 1, the 10-inch steam pipes penetrate the containment drywell and two normally open motor operated isolation valves are located just outside the drywell wall. The containment pressure boundary extends to the housing of the innermost isolation valve. The 10-inch steam line expands to a 16-inch line which then splits into two 12-inch lines, each feeding steam to the two tube bundles located within the emergency condenser. The condensate leaves the emergency condenser through two 8-inch lines that are headered into a 10-inch line, which then penetrates the drywell wall and connects to a recirculation line. Two motor-operated isolation valves are located just inside and outside the drywell penetration, the inboard valve being normally open and the outboard valve being normally closed. Emergency condenser startup is made by opening the normally closed valve.

1 nn19c.no1nn9

Two forms of leak detection are utilized in the emergency condenser system:

e Flow rates are sensed in both the steam supply and condensate return lines by differential pressure sensors located at pipe elbows (see Figure 1).

If the sensed flow rate in any line exceeds approximately three times the design flow rate (which is about 500 gpm equivalent liquid flow, indicating a large break in the system outside the flow detectors) all isolation valves in the affected loop are automatically closed.

e Radiation detectors are located on the isolation condenser shell side vent pipes.

If a high radiation level is sensed (indicating a leak in the emergency condenser tube bundle), all isolation valves in the affected loop are automatically closed.

In addition to the excess flow and radiation leak detectors noted above, there are several other less direct means of detecting leakage of the emergency condenser piping within the reactor building. Before attempting to evaluate the ability of these detectors to sense leakage and to alert the operator to isolate the emergency condenser, an estimate will be made of the piping failure frequency.

The Reactor Safety Study (RSS) (Reference 1) examined nuclear and nonnuclear data sources to evaluate piping failure data, indicating that the data was quite rough and gave much freedom of interpretation. Al so, the intent of evaluating piping failures in the RSS was to determine large LOCA frequencies and, accordingly, interest focused on major severence type breaks, whereas minor leaks were not considered in the assessment. The assessment concluded that the frequency of rupture for high quality piping larger than 3 inches in diamter is 1 x 10-9/ hour for each section of pipe. Here, section is interpreted to be a run of piping between two rigid anchor points (not seismic snubbers or hangers),

or between a branch point and an anchor point. From Figure 1 there are 12 sections of emergency condenser piping located outside the containment drywell. Thus, the predicted frequency of failure for the emergency condenser piping located outside the containment is:

1 x 10-9/ hour-Section x 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br /> / year x 12 sections

= 1 x 10-4/ year Reference 2 cites a more recent assessment of piping failures done by Science Applications, Inc., (SAI) for nuclear power plants, stating that high cycle fatigue due to flow or mechanically induced vibration appears to be the highest contributor to pipe failures. When the reactor is operating and the emergency condenser is in the standby mode, the piping is subjected to full reactor pressure but it would be expected that the vibration levels within the piping are very small because there is no flow and no pumps are located in the piping system. Therefore, the above cited failure frequency for piping failures during emergency condenser standby operation is probably quite conservative. On the other hand, if a reactor isolation event occurs 2

nowr,none

(e.g., MSIV closure or turbine trip without bypass) and the emergency condenser is actuated (after reactor scram, of course) by opening the normally closed isolation valves in the condensate return lines (valves V-14-34 in Figure 1), one would expect somewhat high transient stresses in the emergency condenser itself due to the complex condensation phenomena taking place in the condenser tube bundles; the stress levels in the piping system should not be particularily high since reactor pressure decreases quite rapidly shortly after the isolation condenser is actuated. The isolation condenser is, of course, designed to accommodate these stressas. However, if a failure does occur, it would most likely be in the tube bundles themselves and would readily be detected by the shell sige steam vent radiation monitors. All in all, it is felt that the 1 x 10- per year failure frequency is a reasonable value for the OCNGS emergency condenser piping.

The emergency condenser leak detection sensors described above (excess flow and radiation monitors) should provide accurate and prompt detection and isolation for large leaks in the steam or condensate lines (for equivalent liquid leaks greater than about 1,500 gpm, corresponding to steam and liquid line break areas of about 8 and 3 square inches, respectively) and for relatively small leaks in the condenser tube bundles. Detection of line leaks smaller then 1,500 gpm are less direct and, for fairly small leaks, will most likely require some degree of inference of other sensed parameters by the operator or notification by operating personnel who happen to be in the area. Four temperature sensors are located in the reactor building in the vicinity of the isolation condenser system as well as several area radiation monitors.

Alarms are annunciated within the control room if the temperature or radiation monitors exceed preset values. Steam line temperatures are measured near the isolation condensers as are shell side water temperatures. These measurements are recorded and alarmed; this perhaps would provide some indication of condensate return line leakage, although the same therma? response would occur if the closed condensate return line valves were leaking. The operator would most likely attribute high shell side water temperatures to leakage past the closed valve.

Operating personnel are frequently in the area where the isolation condenser lines penetrate the drywell (at the 87 and 90 foot elevations, respectively, above the 75 feet 3 inches floor elevation) and in the area of the isolation condensers themselves (above the 95 feet 3 inches floor elevation area).

It would be expected that fairly small leaks, most notably in the steam lines, would be heard by the operating personnel in the area. Also, small seepage type leaks would most likely be noticed, although both the steam and condensate return lines are insulated.

Reference 3 describes the results of a fracture mechanics analysis of the OCNGS emergency condenser steam and condensate return piping systems.

The purpose of the analysis was to evaluate the stability of postulated cracks within certain high stressed regions of the piping system during both normal and extreme loading conditions. For the normal loading condition, crack sizes which would result in readily detectable leakages (taken as 0.1 and 1 gpm equivalent liquid leakage) were characterized and then analyzed with regard to crack stability.

In all cases the cracks 3

003?r,no10R?

were stable, providing a basis for the leak-before-break hypothesis. The analyst concluded that rapid leak detection was unnecessary and suggested that visual observation of the piping system on a once-per-shift basis (i.e., once every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) was adequate. GPUN is currently evaluating different types of leakage monitoring equipment for possible installation during the planned 1984-1985 outage and will institute a once-per-shift visual observation procedure in the interim.

The preceding discussion of leaks in the condensate return line considers leaks developing between the emergency condenser and the closed isolation valve (valve V-14-34 in Figure 1). Since this valve is at the outer boundary of the containment drywell, it is extremely unlikely that a leak could develop in the short section of pipe between the valve and the drywell itself.

The last aspect of emergency condenser line leakage has to do with its potential impact with regard to pressurizing the reactor building. Based on a simplified analysis which neglects heat transfer to structures in the reactor building, steam line leaks of about 30 gpm (corresponding to a leak area of about 0.2 square inches) will, if not isolated, eventually cause the reactor building pressure to exceed its +1/4-psig design value (assuming that the normal ventilation syscem is isolated and the standby gas treatment system is actuated by detected high radiation levels in either the reactor building or in the normal ventilation system), causing blowout panels to open in the refueling floor area of the reactor building. A steam line leak of about 75 gpm (corresponding to a leak area of about 0.4 square inches) will cause the reactor building pressure to exceed its design value about 2 minutes after the normal ventilation system is isolated. However, the above mentioned fracture mechanics analysis indicates stable cracks with a readily detectable 1 gmp flow rate. Therefore, one would not anticipate leakages as large as 30 gpm.

1.3 CONCLUSION

S The predicted frequency of failures in the emergency condenser piping while the reactor is operating and the emergency condenser is in standby i s 1 x 10-4 per year. The existing excess flow leak detcctors in both the steam and condensate return lines automatically isolate the emergency condenser lines when the flow exceeds about 1,500 gpm, which is three times the flow rate during emergency condenser operation. Radiation detectors on the shell side vent lines will automatically isolate if leaks develop within the emergency condenser tube bundles. Steam line leakage less than 1,500 gpm can be detected by local temperature or radiation monitors, by radiation monitors in the normal ventilation i

system, by high reactor building pressure, or by visual and/or acoustic observation by operating personnel in the reactor building. Condensate line leaks can be detected by local temperature / radiation monitors, by operating personnel within the building, or by an increase in the emergency condenser shell side water temperature. A fracture mechanics analysis of the emergency condenser piping indicates that cracks large enough to leak 1 gpm are stable, suggesting that crack propagation is slow and that leak detection by visual observation once per shift is i

4 nn12r.noana?

adequate. GPUN will institute such an observation procedure. Steam line leak rates greater than an equivalent liquid leak rate of about 30 gpm can, if not isolated, cause excessive pressure in the reactor bulding (causing rupture of the blow out panels) if the building is isolated and the standby gas treatment system is operated. For a 75 gpm steam line leak, these excessive reactor building pressures will develop within about 2 minutes after building isolation.

i 5

003?nno1087

2.

LEAK DETECTION IN THE TORUS WATER LEVEL MONITORING SYSTEM Tha torus water level monitoring system is shown schematically in Figure 2.

The monitoring systw connects to the torus through two 2-inch lines, each having a local manually actuated isolation valve which is normally open. One of these lines connects below the water level at the bottom of the torus and the other connects into the suppression pool lacuum breaker line above water level. Two separate level transmitters are provided to measure the level.

No direct means of leak detection or remote manual isolation are provided for the level monitoring system because it is felt that the likelihood of failure is extremely remote. The piping used in the system is schedule 40 carbon steel. Using ASME Section III allowable stresses and design equations for pressure stresses in cylindrical pipes, the piping in this system is adequate to contain a pressure well in excess of 1,000 psig.

The value is much greater than the 35 psig design pressure of the pressure suppression chamber.

In addition, the level monitoring system is a static system which should not be affected by flow or mechanical vibrations, or by any of the oscillation or relief valve air clearing dynamic loads.

In conclusion then, it is felt that the design margins of the existing system are sufficiently large so as to render leak detection or remote manual isolation unnecessary.

6 0037Gnq1092

3.

REFERENCES i

1.

" Reactor Safety Study: An Assessment of Accident Risks in U.S.

Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, WASH-1400, (NUREG-75/014), October 1975.

2.

"Probabilistic Risk Assessment, Limerick Generating Station, Philadelphia Electric Company," conducted for the USNRC by the Philadelphia Electric Company, the General Electric Company and Science Applications, Inc., March 1981.

3.

" Fracture Mechanics Analysis of the Oyster Creek Nuclear Generating Station Emergency System," Fracture Proof Design Corportion, Rev.1, June 30, 1982.

}

l f

4 4

7 0032G093082

^

TO ROOF

^

i VENTS 4

R R

'N EMERGENCY CONDENSER MON ORS

/

r 3

SHELL-SIDE WATER MAKEUP 12" 12" 12" STEAM LINE 108'-3" f

)

U Y

)

h

'8" 8-8" DASHED LINE d

REPRESENTS DRYWELL u

PRESSURE BOUUDARY 10"

.;;p j FLOW METERS, l

/-

SEE DETAIL A l

?,,Q w

N.'

V STATIC PRESSUR E 10" 90*

~

TAPS

.c$-I V e g

- 'M t3:

'l i

V.14 31

-30

..:a '

187,,b

,g

_,7_

k fe' 7 -I

&2 s

REACTOR

['*,.

VESSEL dP dP MO

- e

,il. ?

Mo b

-c><}ee/

s!. g DETAll A-STEAM AND CONDENSATE LINE FLOW

';4 METERS

/

DRYWELL

.o

,E. :(*

r,.,

s t

l l

FIGURE 1.

EMERGENCY CONDENSER SYSTEM SCHEMATIC (0NE OF TWO LOOPS SHOWN)

ste.btTAit A e.

'g mN

/.

~. ' <

.hr.

j

\\.:i T

s

/'

)

J

\\

i i

• ' = ' "

• i tM-u-U r,.y, m*

von e.um

:.g:g.

,=,

i

=

,W "9(-

-9(-

]k]9"?'

I [j iQ-. 3.--.p-y m>~

.e.

l

+

0 I

I l'

t I I FQcu f.

to CLE ec rwy To i

UAL00M n s%

• T c Top _dg WATEP 6flEAf(Gr.Qg _ _

LE V E. L MCASiTON MA sY STEN l

rec.o s

=$N DETALL A

I FIGURE 2.

SCHEMATIC DIAGRAM 0F THE TORUS WATER LEVEL MONITORING SYSTEM 9

1 6

1 1

4 i

1 I

j i.

TECHNICAL ASSESSMENT OYSTER CREEK SEP TOPIC VI-7.C.1 l

ELECTRICAL INSTRUMENTATION AND CONTROL RE-REVIEWS

~

4 J

i 1

s i

4 4

1 rw" f'Tw-(t=r Y-7

• r--=J'--'?y*W^-'y7^e&1ey" M g g q ve -w MWl' e ht wq

-wW-+-

ur.y-gw+--w+ww-%ee--gw++ne,-

em-=->-.eee.-

w?-'*'

- - - *%"D7~---3 w-

-NWm--m--we78"TT-T

1 i

l TABLE OF CONTENTS 1

J l

Section Page 1

INTRODUCTION 1

i j~

2 EVALUATION 2

2.1 Loss of Transfer Switch Loads 2

2.2 Loss of Vital Buses -1A2 and 182 3

a 3

CONCLUSIONS 6

4 REFERENCES 7

i a

i l

4 i

5 i

r 1

i i

l i

0024G101482

LIST OF TABLES AND FIGURES Table Page 1

Normal and Backup Power Source for Automatic Transfer Switches 8

Figure 1

Vital One Line Diagram 9

2 Typical Transfer Switch Arrangement 10 11 nn?arno?on?

1.

INTRODUCTION On June 29, 1981, the Nuclear Regulatory Commission (NRC) issued a safety evaluation (Reference 1) which documented their findings and recommendations with respect to Oyster Creek SEP Topic VI-7.C.1, Electrical Instrumentation and Control Re-reviews. The NRC's safety evaluation was based on a contractor's technical evaluation (Reference 2) to determine Oyster Creek compliance with current licensing criteria for electrical independence between redundant onsite power sources and their distribution systems. The results of these evaluations stated that because of the presence of seven AC automatic bus transfer (ABT) switches or contact transfer panels, Dyster Creek does not comply with either General Design Criterion 17 or with the acceptable basis for its implementation, Regulatory Guide 1.6 and IEEE 308-1974. Five ABT switches are used to supply power to MCC 1AB2, vital lighting distribution panel 1, vital AC power panel 1 (VACP-1), continuous instrument panel 3, and instrument panel 4.

Two contact transfer panels provide power to protection system panels 1 and 2.

These switches and panels are shown in Figure 1.

During normal operation, the power source to the transfer switches is obtained from vital motor control center (VMCC) buses 1A2 and 182. Table 1 shows the specific power source for each switch in its normal and backup positions. The NRC recommends modifications to the onsite power distribution systems which would either remove these switches or redesign them to satisfy the current design requirements.

The purpose of this assessment is to determine the impact on plant safety of not implementing the proposed modifications.

l l

l l

1 l

l i

l 1

nn?ar,no?oA?

2.

EVALUATION The evaluation of the effect of maintaining the current ABT and contact transfer panel arrangement at Oyster Creek can be looked at from two general viewpoints:

(1) a failure in the ABTs or contact transfer panels which results in a loss of all the loads supplied from the transfer switch (downstream loads), and (2) a failure (short to ground) in the ABT (or contact transfer panel) or the bus it supplies which results in a loss of both vital (safety-related) unit substation buses,1A2 and 1B2.

The first case will be evaluated by determining the impact of losing individual loads from each ABT or contact transfer panel. The second case can only happen if specific circuit breakers fail to open on demand (overcurrent) and then the fault (short to ground) is transferred to the other redundant power sources whose circuit breakers also fail to open on demand. This second case will be evaluated following the first case.

2.1 LOSS OF TRANSFER SWITCH LOADS Upon examination of the specific loads on the buses and panels fed from the automatic transfer switches, the following observations can be made:

The transfer of switch IT-3 for continuous instrument panel 3 to its e

backup position would result if either the AC generator feeding the ABT failed or if both VMCC 182 and the 125V DC distribution center B failed. The ABT would then have to fail in the open position, or if it successfully transferred, VMCC 1A2 would have to fail in order to result in a loss of power to continuous instrument panel 3.

In order to fail the emergency core cooling system (ECCS) functions, e

both VMCC 1A2 and VMCC 182 would have to fail. This is because the core spray isolation valves, V-20-21 and V-20-41, if failed as a result of failure of VMCC 1B2 and the failure of transfer switch to transfer to its backup position, would be backed up by valves V-20-15 and V-20-40.

e The failure of the emergency condenser isolation valves which obtain their power from MCC 1AB2 is inconsequential because these valves are normally open.

l Complete loss of protection system panels would require the loss of e

both VMCC 1A2 and VMCC 182 (similar to the second observation) and would result in a scram since the reactor protection system " fails safe" upon loss of power.

l The remainder of the equipment relying on transfer switch operation e

given loss of its normal power source is not essential to the mitigation of any given initiating event. Consequently, sufficient time would exist to manually manipulate the switch in case of its failure or manually align circuit breakers in order to supply power to their associated equipment.

2

In the first observation, at least two failures would have to occur in order to impact the initiating event mitigation capabilities of the plant. The mean frequency of these two failures is on the order of magnitude from 10-6 to 10-7 In addition, an initiating event must be taking place at that time and its mitigation has to rely on that specific load. The frequency of any scenario that leads to a loss of continuous instrument panel 3 is small and insignificant as a contribution to core melt.

In the second and fourth observations, the failure of both VMCC 1A2 and VMCg 182 can occur randomly with a very small frequency, from 10-7 to 10, or if both diesel generators do not start given the loss of offsite power.

In the latter case, the operability of the transfer switches is totally irrelevant since both buses which supply p.ower to the automatic transfer switches would be deenergized.

In all the other cases, the operability of the transfer switches has an insignificant contribution to the successful mitigation of any initiating event.

2.2 LOSS OF VITAL BUSES 1A2 AND 182 Loss of both vital unit substation (USS) buses 1A2 and 182 which supply safety related loads requires at least five component failures and three successes. A typical transfer switch arrangement is shown in Figure 2.

The postulated scenario is as follows:

e A short to ground fault occurs in either the transfer switch or on the bus it supplies.

(Note: A fault downstream of this bus would require two failures, a short to ground fault on a load from this bus and its circuit breaker failing to open on overcurrent. The frequency of this two event failures is clearly dominated by the single short to ground faults.)

e The circuit breaker feeding the transfer switch from VMCC IB2 fails to open on demand (overcurrent). This is a molded case type circuit breaker with no remote operation capability.

e The circuit breaker feeding VMCC 1B2 from USS bus IB2 fails to open on demand (overcurrent). This is a metal enclosed type circuit breaker with automatic trip control.

o The circuit breaker feeding USS bus 1B2 successfully opens on demand (overcurrent). This results in a loss of power to USS 1B2 and VMCC 182.

e Sensing a loss of voltage from its normal power supply, the transfer switch successfully transfers to its alternate power supply.

In addition, the short to ground fault is also transferred.

3 nn7ar,noin99

e The circuit breaker feeding the transfer switch from VMCC 1A2 fails to open on demand (overcurrent.)

e The circuit breaker feeding VMCC 1A2 from USS bus 1A2 fails to open on demand (overcurrent.)

e The current breaker feeding USS bus 1A2 successfully opens on demand (overcurrent). This results in a loss of power to USS bus 1A2 and VMCC 1A2.

The next step in this evaluation is to quantify this scenario. The failure rate of short to ground faults taken from WASH-1400 is 3.0 x 10-7 per hour. Assuming 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br /> in a reactor year, the frequency of short to ground faults is 3.0 x 10-7/ hour x 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br /> / reactor-year = 2.6 x 10-3/ reactor-yea r The successful events will be conservatively assumed to have a frequency of 1.0.

The frequency of circuit breakers failing to open on demand taken from WASH-1400 is 1.0 x 10-3 per demand. A detailed data search of available data sources on circuit breaker failures such as IEEE 500 and actual plant experience revealed the following results for the frequency of failure to open on demand:

e Metal enclosed, with automatic trip control:

7.9 x 10-4/ demand e

Molded case:

8.4 x 10-4/ demand These results are very close to the WASH-1400 number of 1.0 x 10-3/ demand. Given that the short to ground fault has occurred, four circuit breakers must fail to open on demand to lose power to both USS buses 1A2 and 1B2. The fcur circuit breakers include two metal enclosed type circuit breakers and two molded case type circuit breakers.

It will be conservatively assumed that if any two of the four circuit breakers fail to open, the third and fourth circuit breakers fail to open with a frequency of 1.0.

This will account for any common cause failures which may exist with the third and fourth circuit breakers.

In addition, the result will apply not only to a loss of power to USS buses 1A2 and 182, but also to a loss of power to VMCC 1A2 and 182. The failure of two circuit breakers can occur either randomly or from common cause failures. Five percent of the randomly occurring failures are a result of common cause events (such as design errors, manufacturer errors, and common environmental conditions) based on actual plant experience. Therefore, the failure of the two circuit breakers is (random failure - 5% random failure)2 + (random failure x 5%)

= (8.4 x 10 0.05 x 8.4 x 10-4)2 + (8.4 x 10-4 x 0.05)

= (6.4 x 10-7) + (4.2 x 10-5) = 4.3 x 10-5 When this result is multipled times the frequency of the short to ground (2.6 x 10-J/ reactor year), the result is 1.1 x 10-7 reactor year.

/

4 nn7ar,noing?

This contribution to core melt frequency is very small and insignificant compared to the overall core melt frequency and therefore plant risk.

In addition, it is a conservative calculation and does not account for recoverability of the buses or VMCCs by manually aligning the circuit breakers.

d 1

4 i

5

.w....,-.,3-----

.,-.,- - -. -,- r s.--

m s-,__,,

- -. -. -,. - -.. -,, - - -,., +

3.

CONCLUSIONS The evaluation in Section 2 presented reasons why the automatic transfer switches in the vital AC distribution system of Qyster Creek do not contribute in any significant way to the failure probability of any key mitigation system and, consequently, to the core melt frequency. As a 2

result of this evaluation, it is clear that the modifications proposed by the NRC do not contribute positively to the safety of the Qyster Creek 1

plant and therefore should not be implemented.

i 6

nn94r,noson?

i 1

4.

REFERENCES 1.

NRC letter from Mr. D.M. Crutchfield to Mr. I.R. Finfrock, Jr., of Jersey Central Power and Light Company, "SEP Topic VI-7.C.1, Appendix K - Electrical Instrumentation and Control (EI&C)

Re-reviews," Safety Evaluation for Qyster Creek, June 29, 1981.

2.

EG&G Report, "SEP Technical Evaluation, Independence of Redundant j

Onsite Power Systems, Qyster Creek Nuclear Station Unit 1,"

S.E. Meyers, (11-16-79,1200F), November 1979.

P l

i

)

1 7

nn? anno 9an?

TABLE 1.

NORMAL AND BACKUP POWER SOURCE FOR AUTOMATIC TRANSFER SWITCHES Switch Normal Power Source Backup Power Source SW IT-3 Continuous Power Unit Transformer from (from VMCC 182 or VMCC 1A2 125V DC)

VACD 1 VMCC 182 VMCC 1A2 VLDP VMCC 1A2 VMCC 182 IT 4 VMCC 182 VMCC 1A2 MCC 1AB2 VMCC IB2 VMCC 1A2 Contractor Transfer Protection System Transformer from Panel GT-1 MG Set (from VMCC 1A2)

VMCC 182 or VMCC 1A2 Contractor Transfer Protection System Transformer from Panel GT-2 MG Set (from VMCC 1B2)

VMCC 182 or VMCC 1A2 8

0024G0930R2

f f

w.......o...,

j L).

.s.

4, i

f ;i f

• 6 a

i j i i

~"f " f d.f f),) -) -) -) "I)

.,. 1).1 x)f)g.

.." w

-) 4) ml) j) -)

r.v s. v. < *

• j t

)-

- -1 f

) -).-)

=

I I

. u.i L.,

I h

r5

-f-.-.

'rq I

qe

$.I I <., l l

C-E g ('..e l

q

(

m l.]E. p~,..<1 k. l-I I

I E h.3 6' i l',5.

i- [D iq

..I i+

+

i li.

I.

e.

e i

~

i l

e.

5. :

{,1

r.e..

. a.

I

c.

k T'.:p [.....,,

J.

4 b' IE. a)IT'd)!

y/

i.

l_ fE'-T pi I,j

• i t

A -

b:

f**

l 1

I IIg-I lII

• [ Pj k~h h;

if'

(

E '

s,Jla *;'

c dl, E*EP

• ff i

,i o.y.

{.

t__.__

?,.

s e.l.' /

[

i l.. I O*

L..

w..v

.I.*.

g

.e.. r..

---.3-.

(

4...

j!**

.p"*.~.~

. s.o...w.,r %= f t.P

s..

F -...

... e........1. !...a., ~/. %.... _ __ _ _ q

~

T.

.. ~e:e.tn.-

_j.

i

-.~.. ---

.....v.,,.;_,

i m

i1 l -

k A,,. A i A

. 1 1

L l i 1 3 l l

I.

I t) s.

+J 1)

.u-

"..) -..t)..t)..t) t t) i[

t t t).t#

.t). p) 5.. - s

v. : 6-.. -.s--

.-. s -. s.w - -

y -

hc.,w..

t,.

,.t,

%y W.. pr l l

4

.i.

s -

a 2-. is s - -

s '.

h.

. %.2, r.v. m.-

-.e R

- n.rw.- -

7

.,3 2

.s. F.t.' n L.._._ d _.I_ I.f.;_.s )

2 L -_;_ C.c. s.:-s L. I 1..

_u o

~..m n.-

r

: c.:

-.~u.~..e=--=---

.:,i q

.e. 6,!.

- ~ ~. -. --

~

6e s. r.za._

1:.'

..?: si z. -

e e

. -- m ~. -.m 9. e,, e,.,

ee G G. e. g e.:

g

.,..-e-t--

= r.m

m. r,c..,, u. a,

n.

n g a e:.. v.

u.~..n u e:.

.... n

c. ~.

,.w.=.

- ~_

r..,.:. -.s y,

c

..... _- u_~......

o.... y.h.. <;.

a..

e....... p.

. w te...%.:m w.,.u-

= e.e 6 s

e. 3 l

Ez a,.

a..

.: e i,,

p j, p.

ri e-p g

':".7.,"..<.7.;..~..-.

j 3

...~ s.w.ts

...A.,

mA, -..e r -. o r.

...e-n;-:.w

~c.--....~-.

.. w:

~

1.........

l g' 5, g/.O'J:'N wp

&.i....

6 W *r.:.";;:-:r.'l- *

., c... scr.... u c..

../r.9.<;. //

5.,

f-..

'.*.'-r~-

a.=

.w

, e... w..

.;.,;.gy _..W-n,

,~

,3.

r..

t' 'p.^_

a *-.

^_.f.?'*

(

g. 3 Lt. ;:~.

7.

4lg;......_T ' E 'lll-1l*?,.;';....

g.ggy.f r,.g..

^ ' * ^--...

2.so,r,,; ;;.._ ^. p* ^.. ; = a, ;.l.

N.

.._T.J 7_.m m.

-- ^ k* ^-

w.=

II.h.P.T.".1

^ _. - -.w

.._?.a.t ?--

.::.;;-E.: ?...a -_': #~ A'l'*-..

.i i.... e n... 7/.'. LC-

'..'.*..*..',*.*..'.'.5..".'**-'"'^*6#*H

._?.t ?_

w

.._...e.

s

...... =...

.c..

. a 18...

.v.

. x.* *..e.

e. W

)

w...

?.? *.?- ~. Mal.N.,..w.

W:* -

-y. ~. -*.2

.a.. '4* ;:

?.,.u?.

'T.*

- w r.

t

. - -,s

(

6.

. e.g

~ l

..m..

p.s.t;_

.= a

.wi.

-i. - -.._?.:n?-.s.t.

a.rwr. ; J'.2c

. % m,..

w -.

?.2*.?-...u.

._?.Ls'i;?-- - s

...(

L.. --

.4.-:..J

?__~~.m....

_e_,_n_?.

T dm7.

^

^

.=..

.. _ __ _..;,.: se.;

s. v.;;;fy;.r..,p'

.=I. V. la.OtC-

^

^

,,,-. am...i. =

...............,, -_-.m...

s.

- -. w.=

O

?

.:. ;.,.:;;,.f e..

._^-_^

J.Ag;;.;*

..e

. ~.

.=

.m.

_^_ ;-lg,,, gy

,.p a.n.a.

^

^

.i

.e e-n n

--.. m.i..

^

~.u. u., --_ ~.-

f

J

"'.;,

l"=yg';,rl:l,

,,b.

f...

s v.m. c. %r m.. rt n er r t 3

.emi.r-

~t t e 4. a..)

n.s.v t...~c t we... o.r.. e,.o I s auw

.....i...L..~~.....,

6

.... n...

.... M>

~. 4...

..In

.7....,...e..

n.

i-L.

m-..

.w a

r. :.g.1.=. =. ;=.. ;.y.s.

.e

. =..y;. c.; i..f.r. o.-3.., %..a _.m.

w,.m 9.g.v r<

me u. v ~ 1... T

'" T.f.5 R. -- =,hTfM r M.,.....

- --- rw n s ':::~.: c.--. r. t..E3 L' 1 "). W '; L.

},

'1 %

1

(

.f i

I t

• . * * =

9.

.. *...i8 S.....

)

..s e. e....e......s. s-o no.: ).sr...s I

) =) -)

i i

I l

2 r ?

3 i

I t g

l3 s.8

!.t

,[

.,)

r*.

.e g.

4

! *e

{

...e si.

i eg,7...- rgg- -----:

' 3y g,,..

v*

...p,........

.p...,....y....y....

l AMc t v.s.. iew s :

I e

e.e o. - e va..s.c o ev o, c.s.

_sdc_

_v-jt.;

... TJi'.7-.

.. 74.'_

..~

.. Tx_?-.

_O_'4_?_.

,,,--.g.,,3

-.?.;.r.T_

7

_?_.

.... ~.g.

s.. y.,... f..

~

- ~.

y

, y-

. g u..n..=.,

-....c..=,

p.et t ( v.cs p g. e.....ee. #5.4 3.g 9. )

C 'f f * += ge%1 t a...wt g.so i fC. I e.g) 3... e. =. e m.

. g t.s

e. s 3 3..... a.. es...

4s. s * *.... 4.p.,

4

. we...

3....

a T

M:

h

,,,.,,.. af.% 300 4.5004s t

....t. w:

M E Co.er.

]

L FO. C.f.4,..sae08t% M E f

Oma G G 2.

4'..

A'

\\

. ',... i

,TA.am.

~,F****.,641 6 9

. 6..e r.I s

w.ew awme -rs,,,

.+

.-u::...

-........i i..'.

n _.

-oam ue-- _........,, -...,

~~

'. v.-

a

., ~

,~,.f... -. e i s... >

sim o um om.7 r

u

- y

%"<. %1g).' FIGURE 1.

VITAL ONE LINE 4

1.,-

. g-m.uhm DIAGRAM d

.. s a :t. g*

en*

u m.,

7g. y c.,. pL r,y.

m.m..gw.,, n..,v.,

.y v-.r

,m,....,viv... -mc 1.

s.

..o

-, e +"

- ' n;

./ p e -

- - -\\n.7iR,.1lllillL9 W- -

s..

3

..g.

9

)

USS BUS 1A2 USS BUS 182 o

Cu VMCC1A2 VMCC 182 0

C,v r---

AUTOMATIC TRANSFER b__

_ _ d SWITCH BUS BEING SUPPLIED FIGURE 2.

TYPICAL TRANSFER SWITCH ARRANGEMENT 10

e

.am.._

.mm.

A>..

. -.. m v-t._,,_

=

_~.

a m

c

_. aw ta.a m..,%.

-~.e

.m.,._ms.

.m_..,,

1 I

i e

i j

TECHNICAL ASSESSMENT OYSTER CREEK SEP TOPIC VIII-2 ONSITE EMERGENCY POWER SYSTEMS - DIESEL GENERATORS

)

l 1

3 4

i r

TABLE OF CONTENTS i

i i

Section Page i

1 INTRODUCTION 1

2 EVALUATION 2

i 3

CONCLUSION 4

i 4

REFERENCES 5

a f

t

)

)

)

6 i

0028G09?oRP

_ _.-_.__.____._____ ___ _.-_.~_ _ _.-- _._ _...._.-._ _ _,... -.._.__ _ _-.._.- _,...._ _._ _, _ -

LIST OF TABLES

(

Table Page 1

Summary of Diesel Generator Events by Failure Mode 6

and Year 2

Summary of the Unavailable /Nonfailure Diesel Generator 7

Events by Failure Mechanism and Year 3

Summary of Diesel-Generator Failures by Failure 8

Mechanism, Failure Mode, and Year 4

Diesel Generator Failure Causes from NUREG/CR-0660 9

)

11 0028092982

1.

INTRODUCTION On June 29, 1981, the Nuclear Regulatory Commission (NRC) issued a safety evaluation (Reference 1) on Oyster Creek SEP Topic VIII-2, Onsite Emergency Power Systems - Diesel Generators, based on a contractor's technical evaluation (Reference 2). As a result of these evaluations, the NRC recommended modifications to the diesel generator protective interlocks. The unresolved recommendations include the bypassing of the Oyster Creek diesel generators' leading VAR and reverse power relays during emergency operation, which comprise part of the protective interlocks. As a basis for these recommended modifications, the NRC references Branch Technical Position ICSB-17 (PSB), " Diesel Generator Protective Trip Circuit Bypasses," which has subsequently been superceded by position 7 of Regulatory Guide 1.9 (Revision 2), December 1979. The Branch Technical Position and Regulatory Guide were developed in order to assure improved diesel generator availability and reliability during emergency conditions.

The NRC has sponsored a considerable number of r n m h projects to pinpoint the causes of diesel generator failures, i...

• the most recent and complete studies have been reviewed. These are:

" Data Summaries of Licensee Event Reports of Diesel Generators at U.S. Commercial Nuclear Power Plants," NRC Report NUREG/CR-1362, March 1980, EG&G Idaho, Inc.,

and " Enhancement of On-Site Emergency Diesel Generator Reliability," NRC Report NUREG/CR-0660, February 1979, University of Dayton Research Institute. The conclusion from the review of the above research is that diesel generator failures due to lockout by the protective interlocks are of no significance when compared with the other failure mechanisms.

The purpose of this assessment is to determine the impact of not imple-menting the recommended modifications on the safety of the plant in the context of the Oyster Creek Probabilistic Safety Analysis.

3 Y

u

)

I 1

on9peno9en?

i 2.

EVALUATION Two recent studies of diesel generator failures were reviewed to determine the contribution of the protective interlocks to the overall failure rate. The first study, " Data Summaries of Licensee Event Reports of Diesel Generators at U.S. Commercial Nuclear Power Plants,"

NUREG/CR-1362, presented data summaries from January 1,1976, to i

December 31, 1978. This data was categorized according to failure mode, failure mechanism, common cause, and various other classifications.

Table 1 presents a summary of diesel generator failures by failure mode.

It is evident that failures to start are more prominent than the failures to continue to run or unavailable /nonfailure. The last failure mode, unavailable /nonfailure, is one encompassing diesel generator unavailabil-ities discovered during nondemand periods which would have resulted in a failure to start or run had there been a demand. Tables 2 and 3 present the data further broken down by failure mechanisms. From these tabula-tions, it appears that mechanical / electrical control is the highest contributor to failure of diesel generators (approximately 27%). Further examination of the data revealed that diesel generator failures attribut-able to the protective interlocks actuation accounted for only 1 out of the 81 failures listed in Table 3 for this category.

The second study, " Enhancement of On-site Emergency Diesel Generator Reliability," NUREG/CR-0660, reviewed Licensee Event Reports from 1969 to September 28, 1977.

In addition, a review of available data from NPRDS and a review of literature pertinent to the operation and maintenance of diesel generator systems is also presented in this report. Table 4 shows a breakdown of the causes for the diesel generator failures. Although it appears that " engine and related" failures are predominant, it is important to note that a large portion of the monitoring and safety functions are performed electrically. Therefore, a further examination i

with specific emphasis on the protective interlocks was deemed neces-sary. From this review, it became apparent that protective interlocks per se did not contribute significantly to the overall failure rate of diesel generators.

Instead, environmental conditions, notably dirt in the relay contacts, produced a significant portion of the starting problems.

It should be pointed out that only 1 out of the 43 nuclear

)

plants reviewed bypasses all its protective interlocks during emergency operation and only two plants use coincident logic for each interlock that is not bypassed. Moreover, in many instances, trips other than the overspeed and generator differential were not bypassed. Consequently, the data base would reflect specific protective interlock related failures if they had occurred. As it turned out, no specific failures I

were readily apparent from the data base. Rather, the data shows that the prevailing cause for any trouble from the electrical and control areas stemmed from the environmental conditions existing in the diesel generator room. The root cause identified from the data points to dust, dirt, and grit between the electrical contact surfaces and it affects all the exposed electrical components including the protective

)

2 nn?nr.no?on?

l l

interlocks. NUREG/CR-0660 makes a set of recommendations in this respect. These are reproduced below.

e All contractors and relays should be dust-tight enclosed electrical contacts of the bifurcated type as manufactured by Struthers-Dunn or equal.

e All contactors and relays for the diesel generator equipment are to be enclosed in dust-tight steel cabinets having fully gasketed doors and other o?enings. Other equipment which may have louvers for ventilation, etc., such as the static exciter cabinets, should also have dust-tight gasketed doors and filter equipped louvers of sufficient number for proper cooling and protection of the field flasher contacts.

e Ventilating air for the diesel generator room should be taken about 20 feet above the adjacent ground surface because of dust blown about by wind and/or passing vehicles.

e Where construction work is being done adjacent to an operating power plant, the practice of wetting down the ground periodically to minimize the blowing about of dust and dirt should be adopted.

In addition, a separate review of 1,018 events from Nuclear Power Experience (Reference 3), which resulted in diesel generator failure to start, failure to run, or unavailability was conducted. This detailed review for both PWRs and BWRs revealed that only 9 out of the 1,018 events (less than 1%) could have been prevented had the protective interlocks under question been bypassed.

In four out of these nine events, the diesel generators were immediately restarted and operated properly. These results provide supportive evidence that protective interlock actuations are not a significant contributor to diesel generator failures.

4 I

~

)

)

3 nnoncnoono?

3.

CONCLUSION Based on the evaluation in Section 2, it is evident that the proposed bypassing of the protective interlocks during emergency operation at Oyster Creek might improve the availability and reliability of the diesel generators in a very small way. However, the historical performance of diesel generator failures does not support the need to implement any modifications since the failures are overwhelmingly dominated by failures other than protective interlock acteations. Consequently, when using diesel generator failure rates in the Oyster Creek Probabilistic Safety Analysis currently being performed, an insignificant effect on the core melt frequency and risk of the plant is expected if the recommended modification is implemented.

Certainly the improvement in availability and reliability would be so small that its effect in reducing the frequency of core melt or plant risk would be unnoticeable.

)

)

4 nn?nnno?on?

4.

REFERENCES 1.

NRC letter from Mr. Dennis M. Crutchfield to Mr. I.R. Finfrock, Jr.,

of Jersey Central Power and Light Company, "SEP Topic VIII-2, Onsite Emergency Power Systems - Diesel Generators, Safety Evaluation for Oyster Creek," June 29, 1981.

2.

EG8G report, "SEP Technical Evaluation, Topic VIII-2, Diesel Generators, Oyster Creek," Docket No. 50-219, June 1980, (draft June 24,1980 - 0713F).

1 3.

Nuclear Power Experience, Petroleum Information Corporation, April 1982.

?

t 5

on9ncnosono

l l

TABLE 1.

SUMMARY

OF DIESEL GENERATOR EVENTS BY FAILURE MODE AND YEAR Failure Percent Percent Percent 1976 Percent of 1976 of 1977 of 1978 of to 1976 to Mode Total Total Total 1978 1978 Total Does Not 56 44 71 45 59 42 186 44 Start Does Not 39 30 39 25 34 24 112 26 Continue to Run Unavailable /

33 26 47 30 47 34 127 30 Nonfailure Total 128 157 140 425

)

)

I

)

0029G091082

TABLE 2.

SUMMARY

OF THE UNAVAILABLE /NONFAILURE DIESEL GENERATOR EVENTS BY FAILURE MECHAN, ISM AND YEAR Percent Failure Mechanism 1976 1977 1978 Total of Total Personnel Operation 3

7 5

15 12 Personnel Maintenance 6

1 5

12 9

Personnel Testing 3

4 7

14 11 Design Errors 1

3 8

12 9

Fabrication / Construction /

1 2

3 2

Quality Control Procedural Discrepancy 5

1 3

9 7

Corrosion / Erosion 1

1 2

2 Foreign Material Contamination 1

3 1

5 4

Mechanical / Electrical Control 4

7 8

19 15 High/ Low Ambient Temperature 3

3 3

9 7

Lube / Fuel / Water / Air Leakage 5

9 5

19 15 Vibration 5

5 4

)

Out of Adjustment / Calibration 1

2 3

2 Total 33 47 47 127

)

)

)

7 0029G091082

v v

v v

TABLE 3.

SUMMARY

OF DIESEL GENERATOR FAILURES BY FAILURE f1ECHANISil, FAILURE MODE, AND YEAR Failure Modes Percent Failure flechanism Does Not Start Do Not Continue to Run Total of Total 1976 1977 1978 1976 to 1978 1976 1977 1978 1976 to 1978 Unknnwa 14 17 12 43 3

2 4

9 52 17 2

2 9

3 Personnel Coeratton 2

4 L

7 Personnel Hafntenance 5

1 5

11 5

5 1

11 22 7

2 1

2 Personnel Testtag 2

7 18 6

Design Error 2

8 1

11 4

3 2

1 3

5 2

FahriCa tion / Cons truC tf on 1

1 2

Quality Cnntrol 4

12 4

Procedural Discrepancy 3

2 3

8 1

3 1

1 3

5 5

2 Defective Fuel Injector (s) m 1

3 1

Corros ton / Erosion i

1 2

1 Forelen Material 6

9 7

22 10 4

4 18 40 13 Contamination Mechanical / Electrical 15 18 23 56 6

7 12 25 81 27 Control 1

1 3

1 2

2 High/ Low Ambient Temperature 5

5 2

3 to 15 5

Lube / Fuel / Water /A f r 1

4 Leakage Vibretton 2

4 2-8 3

6 1

10 18 6

4 2

6 13 4

Out of Adjustent/

2 3

2 7

Calibration Total 56 71

.59 186 39 39 34 112 298 0029G091082

m TABLE 4.

DIESEL GENERATOR FAILURE CAUSES FROM NUREG/CR-0660 Engine and Related Electrical General 5

E E

E E

E 3

8 5

8 8

zw 8

L o

m t

8 A

8" th 8

3 E

w m

u 8

5 5

E 8

3 t2 8%

e E

F t

b 8

8 e

8

.% s 8

3 8

8 8 ].

e 3

8 9

8 8

MF 8

E h

a m

u.

a o

e r

x or wm z

a o.

a.

No.

122 32 25 41 43 76 80 22 15 45 13 37 59 20.0 5.3 4.1 6.7 7.1 12.5 13.1 3.6 2.5 7.9 2.1 6.1 9.7 e

Grand Total all LERs = 610 (October 1977)

Engine and Sub Divisions Related Electrical General Total LER 339 162 109

% Total LER 55.7 26.6 17.9 0029G091082

i h

,s

,1 l

/

l l

l i

I I

i l

l t

i i

TECHNICAL ASSESSMENT l

OYSTER CREEK SEP TOPIC VII-1.A ISOLATION OF REACTOR PROTECTION SYSTEM FROM NONSAFETY SYSTEMS f

• e

)

{

t i

F 1

?

l l

1 1

l.

l l

I l

i i-r

TABLE OF CONTENTS Section Page 1

INTRODUCTION 1

2 EVALUATION 2

3 CONCLUSIONS 4

a 4

REFERENCES 5

l l

d i

nn99cno9aa9

l I

LIST OF TABLES AND FIGURES Table Page 1

Oyster Creek Nuclear Generating Station Initiating Event 6

Categories 2

OPSA Initiating Event Categories 8

3 ltatrix of Initiating Events versus Scram Signals -

9 Transients and LOCAs

(

Fi gu re 1

Oyster Creek Nuclear Station flaster Fault Tree 10 ii on99cnooooo

l l

1.

INTRODUCTION On July 30, 1981, the Nuclear Regulatory Commission (NRC) issued a safety evaluation (Reference 1) on SEP Topic VII-1.A, Isolation of Reactor Protection System From Nonsafety Systems Including Qualification of Isolation Devices for the Oyster Creek Nuclear Generating Station. The NRC's safety evaluation was based on a contractor's technical evaluation (Reference 2) which was endorsed by the NRC on June 17, 1981 (Reference 3). As a result of this safety evaluation, the NRC recom-mended modifications to the reactor protection system (RPS). As a basis for this recommendation, the NRC cites General Design Criterion 24 (GDC24), entitled " Separation of Protection and Control System" and IEEE-Standard 279-1971 (Section 4.7.2), entitled " Criteria for Protection Systems for Nuclear Power Generating Stations." The only unresolved iten is the lack of isolation devices between the nuclear flux monitoring systems (IRMs and APRMs) and the process recorders for these systems.

The purpose of this assessment is to determine the impact of not imple-menting the NRC recommendation to install suitably qualified isolators on the safety of the plant in the context of the Oyster Creek Probabilistic Safety Analysis.

If it does not significantly impair the safety of the plant, then the modification should not be made.

~

1 nn99cno?no9

l 2.

EVALUATION The safety of the Oyster Creek Nuclear Generating Station can be charac-terized by the risk which that plant poses to the general public. A probabilistic safety analysis is currently being performed for Oyster Creek which considers random in-plant or internal failures. The frequency of core melt or damage is being evaluated by a thorough and careful examination of all initiating events which, when in conjunction with failures of micigating systems, result in core melt or damage.

During the performance of this study, initiating event categories have been determined utilizing a " top-down" deductive thought process in the form of a master logic diagram shown in Figure 1.

The initiating event categories along with specific examples of initiating events which fall into that category are shown in Table 1.

A reduced set of these cate-gories is shown in Table 2.

The initiating events which require the scram function of the reactor protection system to be successful in order that the initiating event be mitigable are indicated by an asterisk in bble 2.

The reactor protection system initiates reactor shutdown (scram) through deenergization of two electrical solenoid pilot valves on individual control rod drive modules. Particular plant parameters are monitored by the RPS to initiate a scram when a sufficient number exceed their prede-termined protective setpoint. These parameters are listed in Table 3 along with an indication of which scram parameters would be exceeded during each initiating event. The order is approximate and the exact number of parameters involved depends on the failures of other mitigating systems. Event sequences have been developed for each identified initiating event category as part of the Oyster Creek Probabilistic Safety Analysis study currently being performed. Protection sequence diagrams have been developed as part of the Oyster Creek Nuclear Gener-ating Station Unit 1 Reactor Protection System Common Mode Failure Analysis (Reference 4).

These two studies show that for every initiating event category, several parameters monitored by the RPS exceed their predetermined setpoints. Of specific interest are the initiating events which result in an immediate trip of the high flux setpoint. These initiating events are ones which cause a collapse in the voids or moder-ator temperature decrease.

Upon careful examination, it is seen that in no instance is the high neutron flux the only variable tripped. There-fore, the failure of the high neutron flux signal in no way guarantees a failure to scram since at least one and usually two or more scram signals are present.

As part of the Oyster Creek Probabilistic Safety Analysis, a thorough evaluation of the failure probability of the scram system was performed.

The results of this evaluation show that at least two (and, most of the time, three or more) sets of detectors that sense different plant para-meters must fail to result in system failure. However, even if there was only one plant parameter being sensed to give a scram signal, the frequency of this mode of failure is small, being dominated by dependent 2

nn??cnooon9

1 I

failures in the logic circuits and mechanical failures in the control rod discharge lines. Therefore, the number of scram signals sensed does not significantly impact the frequency of failure to scram, core melt, or plant risk.

3 nn99c.no9ao9

I 3.

CONCLUSIONS The stated lack of isolation between the neutron flux monitoring systems and the process recorders for these systems does not pose a significant impairment to safety. This is based on the fact that several other isolated monitoring systems in the reactor protection system provide ample assurance of successful scram when so required. The calculated risk posed by the operation of Oyster Creek Nuclear Generating Station will not be changed by not providing the recommended isolation between the neutron monitoring system and the process recorders. Because of the above shown insignificant impact on safety, GPUN does not plan to take steps to implement the NRC recommendation.

4 nn??r.no9on?

4.

REFERENCES 1.

NRC letter from Mr. D.M. Crutchfield to Mr. I.R. Finfrock, Jr., of Jersey Central Power and Light Company, "SEP Topic VII - 1.A, Isola-tion of Reactor Protection System From Non-Safety Systems, Including Qualification of Isolation Devices, Safety Evaluation For Oyster Creek," July 30, 1981.

2.

EG&G Report, "SEP Technical Evaluation, Topic VII-1.A, Isolation of Reactor Protection System From Non-Safety Systems, Oyster Creek,"

Docket No. 50-219, March 1981 (Draf t 4-8-81, 0375J).

3.

NRC letter from Mr. D.M. Crutchfield to Mr. I.R. Finfrock, Jr., of Jersey Central Power and Light Company, "SEP Topic VII-1. A, Isolation of Reactor Protection System From Non-Safety Systems (0yster Creek),"

June 17,1981.

4.

" Reactor Protection System Common Mode Failure Analysis, Oyster Creek Nuclear Generating Station, Unit 1," General Electric Company Nuclear Energy Division, NE00-20636-01, March 1975.

5 nn99cno9oo9

1 TABLE 1.

0YSTER CREEK NUCLEAR GENERATING STATION INITIATING CATEGORIES (Initiating Events Involving The Reactor Core)

LOCAs (1)* Reactor Vessel Rupture (2)

Large LOCA (3)

Intermediate LOCA (4)

Small LOCA (5)

Spectrum of Piping Breaks Outside of Containment PLANT TRANSIENTS REACTOR PRESSURIZATION (6)

Closure of All Main Steam Line Isolation Valves (7)

Closure of One Main Steam Line Isolation Valve (8)

Turbine Bypass or Control Valves Closure (9)

Turbine Trip with Bypass (10) Turbine Trip without Bypass (11) Turbine-Generator Load Rejection (12) Loss of Condenser Vacuum (13) Pressure Regulator Failure, Increasing Pressure (14) Loss of Auxiliary Power (15) Turbine-Generator Load Rejection without Bypass (16) Partial Main Steam Isolation Valve Closure MODERATOR TEMPERATURE DECREASE (17) Loss of Feedwater Heating (18) Feedwater Controller Failure, Maximum Demand (19) Startup of Idle Recirculation Pump REACTIVITY AN0MALIES (20) Continuous Control Rod Withdrawal During Reactor Startup (21) Control Rod Withdrawal Error - Startup Power Range (22) Control Rod Ejection, Hot Standby (23) Control Rod Withdrawal Error - Head Of f (24) Control Curtain Removal Error - Head Off (25) Control Rod Drop (26) Fuel Assembly Insertion Error During Refueling (27) Failure to Achieve Shutdown with Operable Control Rods (28) Control Rod Withdrawal at Power (29) Operations Above Normal Power - Flow Line or Flow Biased Control Rod Block

• Numbers in parentheses (1) through (43) are used in Figure 1.

6 on21rno?7a?

l t

TABLE 1 (continued)

COOLANT INVENTORY DECREASE (30)* Pressure Regulator Failure, Decreasing Pressure (31)

Feedwater Controller Malfunction, Minimum Demand (32)

Loss of Feedwater Flow (full or partial)

(33)

Inadvertent Opening of One or More Safety or Relief Valves (34)

Inadvertent Initiation of ADS (35)

Inadvertent Opening of All Bypass Valves COOLANT FLOW INCREASE (36)

Recirculation Pump Overspeed COOLANT FLOW DELREASE (37)

Trip of One Recirculation Pump (38)

Trip of All Recirculation Pumps (39)

Seizure of One Recirculation Pump (40)

Seizure of All Recirculation Pumps (41)

Recirculation Flow Control Failure, Decreasing Flow (42)

Recirculation Flow Blockage HEAT TRANSFER DECREASE (43)

Changes in Fuel Geometry or Properties Causing Decreased Heat Transfer

• Numbers in parentheses (1) through (43) are used in Figure 1.

4 7

nn97c.no90a 9

TABLE 2.

OPSA INITIATING EVENT CATEGORIES Transients T1 Reactor Trip T2*

Partial Pressurization T3*

Full Pressurization T4*

Loss of Offsite Power T5*

Loss of Feedwater Flow T6*

Feedwater Flow Increase T7*

Moderater Temperature Decrease Loss of Coolant Accidents L1 Large/ Intermediate Break, Below Core, Inside Containment L2*

Small Break, Below Core, Inside Containment i

L3*

Large/ Intermediate Break, Above Core, Inside Containment L4*

Small Break, Above Core, Inside Containment L5 Large/ Intermediate Break, Below Core, Outside Containment L6*

Small Break, Below Core, Outside Containment L7*

Large/ Intermediate Break, Above Core, Outside Containment L8*

Small Break, Above Core, Outside Containment L9*

Inadvertent Opening of One Relief Valve L10*

Inadvertent ADS Initiation

• Requires scram function.

8 nn91cno9an?

TABLE 3a. MATRIX 0F INITIATING EVENTS VERSUS SCRAM SIGNALS - TRANSIENTS Scram Signal Initiating

• bent High High High Low High-High Stop High-High Water R

or g3gy 9

Reactor Drywell Main Stream Condenser Neutron Valve Level in Scram 05"'O Acceleration t,'),'

Pressure Line Radiation Vacuum Flux Closure Discharge Volume Pressure il NA(b)

NA NA NA NA NA NA NA NA NA T2 X

X X(C)

X X

NA l

T3 x

X(d) x(d) x x

x X

NA 14 X

X XIe)

X C)

X X

X NA I

l 15 X

X X(c)

X NA X C)

X X

NA I

l 16 17 XIC)

X X

NA l

TABLE 3b. MATRIX OF INITIATING EVENTS VERSUS SCRAM SIGNALS - LOCAS e

IdI Initiating 0"

High High High Low High-High Stop High-High Water eactor

"$I Turbine Reactor Drywell Main Stream Condenser Neutron Valve Level in Scram t

UIUSU

Acceleration Pressure Pressure Line Radiation Vacuum Flux Closure Discharge Volume L1 SNNIfI SNN SNN SNN SNN SNN SNN SNN SNN WA L2 X

X X

XIC)

X NA X c)

X NA I

L3 X

X X

L4 X

X X

X(c)

X NA LS SNN SNN SNN SNN SNN SNN SNN SNN SNN NA L6 X

X X

X(c)

X HA L7 X

X X(c)

X NA X c)

X NA f

L8 X

X L9 X

X X

XIc)

X NA L10 X

X X

XIc)

X NA a.

See Table 2 for legend.

b.

NA = not applicable.

c.

Possible fuel damage.

d.

These signals occur if scram is delayed and safety / relief valves open to provide pressure relief.

c.

MSIVs close due to loss of air.

f.

SNN = Scram not necessary.

0023G090282

l 4EbEL I

CORE MELT EEVEL CORE 2

COME WER COOLING 8NC HE ASE S DECRE ASE$

l l

l

=

I I

I I

I LEVEL A* ODE R A TON OTHER MODERATOR T(f *PE H A f uRE pos3f tyE TE MPE H A TURE REACTOR HE AT COOLANT COOLANT TR ANSF E R fLOA INVENTORY H

CECHE ASE - COLD HE AClivlTV DE ChE ASI: - COOL AN T PHE 55UHi2 Af TONS I

O n ATE R AcoiTIONs IN5t H ilONS F LOW INCHE ASES Ot CHE ASE E DE CRE ASES DE CHE ASES l

l LEVEL H il (203 1361 8 64 l43p gjpg g,;

4 UII till

( FI g 33, g 73 l

(191 gyyg g 9, i3H

( 3i l

I2 38 itC)

1. 4 03 g ei (241 OTHER*

lit!

OTHER *

(41)

{ St I42I I

OTHE R *

(27)

(3 4)

gjy, 1281 H 51 (3 33 E 291 gigga g343 e

(351 OTHtH

• OTHE R.

OTHf R

• p luf Nile st u tr sTI ATING E VE NIS - NUMisE RS IN PARENTHE$iS HEF E R TO TABLE 1 I

e

. uNiotNise st o Nafi ATsNG E vt his i

1 FIGURE 1.

0YSTER CREEK NUCLEAR STATION MASTER FAULT TREE

0 TECHNICAL ASSESSMENT OYSTER CREEK SEP TOPIC VIII-4 ELECTRICAL PENETRATIONS OF REACTOR CONTAINMENT l

l i

i I

l 0031G092982 L____

TABLE OF CONTENTS Section Page 1

INTRODUCTION 1

2 EVALUATION OF SPURIOUS SHORT CIRCUITS IN CONTAINMENT 3

DRYWELL DURING NORMAL POWER OPERATION 3

EVALUATION OF SHORT CIRCUITS IN CONTAINMENT DRYWELL 5

FOLLOWING A LOSS OF C0OLANT ACCIDENT a

4 EVALUATION OF CONTAINMENT DRYWELL LEAKAGE 8

RATES AND THEIR EFFECTS 5

CONCLUSIONS 10 6

REFERENCES 11 APPENDIX: ANALYSIS OF REACT;R BUILDING PRESSURE RESPONSE DUE TO A-1 L

LEAKAGE FROM THE CONTAINMENT FOLLOWING A LOSS OF

{

COOLANT ACCIDENT (LOCA) 1 I

)

l l

(

i L_

LIST OF FIGURES Figure Page 1

Electrical Penetration Design 12 2

Header Plate Hole Pattern 13 3

Maximum Reactor Building Pressure and Steam 14 Leakage through Reactor Building Walls versus Drywell Leak Area A-1 Diagram of Reactor Building Model and A-6 Listing of State Variable Names A-2 Primary Containment Pressure following A-7 Recirculation Line Break A-3 Drywell Temperature Response Following A-8 Recirculation Line Break A-4 Program OCRA - Calculated the OCNGS Reactor Building A-9 Pressure Charge Associated with Drywell Leakage l

l l

l 1

l

.s I

ii 0031G101982 L.. -

l 1.

INTRODUCTION SEP Topic VI!!-4 addresses the subject of overcurrent protection of electric circuits for conductors which pass through containment electric l

penetrations. The remaining outstanding aspect of this topic for the

}

Oyster Creek Nuclear Generating Station (OCNGS) technical review has to i

do with the response time of the secondary overcurrent protective devices

}

(0PD) for low voltage penetrations (those in the range of 150 to 1,000V

)

AC). Reference 1 identified a typical low voltage penetration circuit as l

the containment drywell recirculation fan (RF 1-1) which is a 460V, i

three-phase circuit fed through electrical penetration 11. This same i

reference also provided trip curves for both the primary and secondary OPDs (GE circuit breaker types TEF70 and AK-2A-50, respectively). Both l

the NRC staff (or their consultants) and the OCNGS technical staff have conducted analyses to determine the peak temperatures developed in representative low voltage conductors assuming that:

l i

e A LOCA has occurred within the containment drywell.

e A short circuit condition develops inside the drywell.

e The primary OPD fails to open (the traditional licensing single i

failure criterion).

The analyses are based on selecting:

e An initial conductor temperature when the short circuit occurs which is based on elevated temperatures associated with the LOCA.

A maximum current which can be developed during the overcurrent e

period, considering both phase to phase and phase to ground faults.

e A maximum temperature above which the leaktightness of the electrical penetration assembly cannot be assured.

2 The adiabatic heatup of the conductor due to the 1 R heating is then evaluated assuming the current is constant and the copper resistivity varies linearly with temperature; the analysis then provides the time required to reach the prescribed maximum temperature limit.

This time is then compared with the trip response time of the secondary OPD; if the trip time is less than the calculated time to reach the temperature limit, the secondary OPD is said to comply with the design requirements.

Reference 2 addresses several aspects of the above analyses for the Millstone Nuclear Power Station, referencing Amendment 62 of the OCNGS, and identifies several aspects of the NRC staff's evaluation which are felt to be in error (including the selection of initial and final conductor temperatures as well as the determination of the maximum current). However, further review of the OCNGS low voltage conductors using more realistic values, but retaining other conservative aspects of the problem, indicates that the response time of the secondary OPD is still too long. GPUN intends to reevaluate the secondary OPDs to see if 1

0031G093032

1

)

l setting adjustments can be made which will shorten their response time.

The intent of the analysis provided herein is to address certain probabi-listic and physical aspects of this subject so as to evaluate the risk associated with plant operation with the existing secondary 0PDs.

i I

I l

l l

l t

i 2

0031G093082 t..

2.

EVALUATION OF SPURIOUS SHORT CIRCUITS IN CONTAINMENT DRYWELL DURING NORMAL POWER OPERATION During normal power operation, electric power is supplied to much of the electrical equipment located within the containment drywell. The power conduits pass through a number of electrical penetration assemblies that are part of the primary containment pressure boundary. Should a spurious short circuit develop within any of this equipment or its power wiring during normal power operation, an overcurrent will temporarily exist 3

within the penetration conductor until either the primary or secondary OPDs open, or until the conductor itself melts. Depending on the severity of the electrical problem inside the containment, the reactor can still remain at power and remain in compliance with the plant technical specifications.

Assume for the moment that there are a total of NW wires within the containment drywell that are powered during plant operation and which, if shorted, could potentially cause excessive temperatures within the containment penetrations. From Table 111.2-1 of the Reactor Safety Study (Reference 3), the median failure rate for a wire shorting to ground is 3 x 10-7 per hour and the median failure rate for circuit breakers failing to open is 1 x 10-3 per demand. Thus, the frequency of short circuits occurring inside the containment drywell during reactor operation, defined as 4SC,0PER, is evaluated as:

SC,0PER = NW x 3 x 10-7 short circuits / hour x 8,760 hours0.0088 days <br />0.211 hours <br />0.00126 weeks <br />2.8918e-4 months <br /> / year 4

= 2.6 x 10- x NW short circuits / year Assume for the moment that the response times for both the primary and secondary 0PDs are sufficiently short so as to avert excessive electrical penetration temperatures.

Thus, the frequency of excessive penetretion j

temperatures associated with a single conductor short circuit, assuming that the primary and secondary 0PD failures (each having a failure f

frequency of 1 x 10-3 perdemand)areindependent,is 2.6 x 10-3 x NW short circuits / year x 10-3 failures / primary OPD demand x 10-3 failures / secondary OPD demand = 2.6 x 10'9 x NW/ year l

A rigorous analysis of the value of NW has not been made for the OCNGS, l

however, a value of 100 seems reasonable.

This results in a frequenc of j

a single conduit failure in the containment penetrations of 2.6 x 10-per year assuming that both overcurrent protective device response times L

are sufficiently short. However, if the secondary overcurrent protection device does not trip quickly enough to avert overheating, the corres-(

ponding frequency of containment penetration failure is 2.6 x 10-4 per year.

3 0031G093082

\\

The penetration failure in itself does not release activity to the environment, but if it goes undetected and an accident were to occur at some later time requiring containment leaktightness, then it would, of course, be of concern. Containment electrical penetration leak tests are performed at each refueling outage (that is, approximately once every 18 months), and any failures would be detected and corrected at that time.

Taking a mean time value at risk as half of the refueling interval (9 months, or 0.75 year) and assuming that the secondary 0PDs are ineffective, the likelihood that the containment nenetration leak-tightness cannot be guaranteed because of this class of electric penetration failures is 2.6 x 10-4 penetration failures / year x 0.75 year = 2.0 x 10-4 Taking LOCAs as the accident class of most concern, from Reference 3 the median frequency of all LOCAs is 1.4 x 10-3 per year. Thus, the combined likelihood of a penetration leak due to spurious shorting during normal power operation followed at some later time (but before the leak is detected during the subsequent refueling outage) by a LOCA is 2.0 x 10-4 x 1.4 x 10-3 LOCAs/ year x 0.75 year = 2.1 x 10-7 a very smalI number indeed. Furthermore, as will be discussed in Section A, the consequences of such an electrical penetration failure are expected to be minimal.

h l

l l

l

[

4 0031G093082 L__

3.

EVALUATION OF SHORT CIRCUITS IN CONTAINMENT DRYWELL FULLOWING A LOSS OF C00LANI ACCIDENT The previous section addressed the occurrence of spurious short to ground events in the containment drywell during normal power operation and concluded that the likelihood of an undetected penetration failure followed by a LOCA was very small. This section will address the poten-tial of short circuit events occurring within the containment due to the harsh environmental conditions which would exist following LOCAs of varying severity.

In Section 4 of this assessment, estimates will be developed for the potential consequences associated with electrical penetration failures following a LOCA.

Electrial equipment located within the containment drywell is generally categorized as safety grade or nonsafety grade. Safety grade electrical equipment and its associated power cabling is designed and qualified to operate in the harsh environment (temperature-humidity-pressure) which occurs following a LOCA. On the other hand, nonsafety grade equipment is not qualified to operate in a LOCA environment, so one would expect its failure rate to be quite high if it continued to operate following a LOCA. Nonsafety grade equipment in the drywell, which would normally continue to operate following a LOCA, consists of the five drywell recirculation fans. Power cabling for all the drywell recirculation fans enters the drywell through electrical penetration 11. A simplified diagram for this electrical penetration design is shown in Figure 1.

Electric conductors pass through two stainless steel header plates which have hole patterns as shown in Figure 2.

The electrical conductors within each penetration assembly are installed and sealed prior to welding to the drywell. The insulation is locally removed from each wire in regions just inside of the two header plates and about 1 inch of potting compound is applied at the inboard end of each header plate, forming a pressure resistant seal around each conductor, and in the area where the header plates mate with the cylindrical cover section (see detail A in Figure 1). After sealing the ends and performing leak tests, the penetration assembly is welded into the drywell penetration, and connectors are put on the wire ends and installed in junction boxes inside and outside the containment.

The junction boxes are not leaktight.

In order to estimate the frequency of a LOCA induced electrical penetra-tion failure, one needs to know the LOCA initiating event frequency, the number of conductors which are susceptible to short circuiting when subjected to a LOCA environment, and the failure rates of both the primary and secondary OPDs. From Table III.6-9 of Reference 3, the calculated median initiating event frequencies for the three LOCA categories considered are as follows:

4 Pipe Rupture Median Initiating Size (inches)

Event Frequency (yr,1J 1/2 - 2 1 x 10-3 2-6 3 x 10-4 more than 6 1 x 10-4 5

0031G093082

1 l

l Conservatively assuming that all LOCAs occur inside the containmen the combined median frequency of LOCAs inside' containment is 1.4 x 10 g,per I

year, over 707. of which is attributable to the small break category.

As previously mentioned, the five drywell recirculation fans normally continue operating if a LOCA occurs. Power is supplied to each fan motor by three No. 2 AWG power conductors which are assumed to enter through 1/2-inch diameter holes as in penetration 11 (see Figure 2).

Since the

[

motors are not qualified for operation in the LOCA environment, one must assume a fairly high likelihood of failure of these motors. Also, one must ascertain if the motor failure mode will produce a short to ground I

condition. The containment drywell is filled with saturated steam at 0

around 260 F (approximately 20 psig) for a period of about two minutes following the design basis LOCA; temperature and pressure reduce fairly rapidly thereaf ter due to containment spray actuation.

The density of r

steam in this initial period is not much different than that of air, so l

one would not expect much change in fan pumping power presuming the fans j

operate at constant speed.

Let us define the conditional frequency of l

motor failure given a LOCA as a value 4 (motor failure lLOCA). Let t.s further conservatively assume that motor failure results in a short to ground in each of the three power cables supplying that motor (most likely failure would initiate in a single phase to ground which would cause the primary OPD to open and remove power from the remaining two phases). Using a failure frequency of the primary 0PDs of 10-3 per demand as discussed in Section 1, and a failure frequency of timely operation of the secondary 0PDs as 1.0 per demand, then the frequency of excessive penetration temperature following a LOCA is evaluated as:

4(penetration failure due to a LOCA) 4(LOCA) x 5 motors x 4(motor failure lLOCA)

=

x 4(primary OPD failure / demand) x 4(secondary 0FP failure / demand)

Let us now differentiate the value of 4(motor failure ILOCA) according to leak size. For large and intermediate LOCAs (pipe rupture size greater than 2 inches), let us assume that the environment within the containment drywell is sufficiently severe such that 4(motor failurellarge or intermediate LOCA) is 1.0.

For these classes of LOCA

then, Q(penetration filure due to large and intermediate LOCAs)

= (1 x 10-4/ year + 3 x 10-4/ year) x 5 fan motors x 1.0 motor failure l1arge or intermediate LOCA x 1.0 x 10-3 primary OPD failure / demand x 1.0 secondary OPD failure / demand = 2 x 10-6/ year 6

no,,-,n,.o, y

J Let us now consider the case of a small LOCA. Peak containment pressures and temperatures will be signficantly lower, and let us assume that 4(motor failurejsmall LOCA) is 0.1.

Thu s ',

4(penetration failure due to small LOCA) = (1 x 10-3/ year) x5fanmotorsx0.1motorfailureslLOCA x 10-3 primary OPD failure / demand x 1.0/ secondary OPD failure / demand = 5 x 10-7/ year The frequency of electrical penetration failure caused by electrical shorts in a single motor power cabling associated with all inside containment LOCA categories is then 2.5 x 10-6 per year. The analysis in the following paragraph will estimate the leakage area associated with penetration failure due to excessive wire temperatures and evaluate the likelihood of multiple motor cable failures. Section 4 of this assess-ment will evaluate its impact with regard to leak rates and on the performance of the reactor building and its associated standby gas treatment systems.

Figure 2 shows the hole pattern for the No. 11 electrical penet.ation.

The No. 2 AWG power cabling is assumed to pass through the 1/2-inch diameter holes located in zone A2 of the header plate. Should a short circuit occur in the power cabling, the wire conductor will begin to heat 2

up due to the 1 R heating.

The highest potting compound temperature will develop locally where the insulation is stripped from the wire and the compound seals directly onto the wire itself. Also, any initial heatup due to the LOCA environment will affect only the inner header plate; the outer header plate will be unaffected by the LOCA.

The seal is critical with regard to the low leakage specification for the penetra-tions since leakage could occur within the wire insulation itself.

In the interest of conservatism, it will be assumed that excessive wire temperature results in a leak area equal to the affected hole area within the header plate. This implies that the copper conductor, insulation, dnd potting compound essentially disappear locally at both of the header I

plates, a very conservative assumption indeed. The leak area is thus 0.20 inches 2 per power cable. Conservatively assuming that motor l

f ailure results in a short to ground in each of its three power cables, 2

l then the leak area ragges from 0.6 inches for a single motor / primary OPD failure to 3-inch leak area for essentially simultaneous failure i

of all motors and their associated primary 0PDs.

The frequency l

associated with the 0.6 inches 2 leak area is 2.5 x 10-6 whereas the 2

frequency associated with the 3 inch leak area is extremely small.

l 1

7 0031G093082

S 4.

EVALUATION OF CONTAINMENT DRYWELL LEAKAGE RATES AND THEIR. EFFECTS In order to estimate the risk associated with this class of potential failures one must consider both the frequency and the potential conse-quences. Penetration leakage after a LOCA will result in leakage of the drywell atmosphere into the reactor building. When a LOCA occurs a high a

drywell pressure signal automatically isolates the reactor building normal ventilation system and starts the standby gas treatment system (SGTS) fans. This results in maintaining the reactor building at a slightly subatmospheric pressure (presuming the leak rate from the m

primary containment is at or below its design basis value of 0.5% per day), and passing any primary containment leakage through the SGTS filters before it is released through the elevated SGTS stack. Leakage from the primary containment in excess of its design basis value will, of course, result in a higher inventory release to the environment, but it can also potentially impact the performance of the reactor building /SGTS in the following ways:

e Primary containment leakage can be sufficiently large so as to cause reactor building pressure to be above atmospheric for a period of time following the LOCA. During the period of positive reactor building pressure, a portion of the leaking primary coolant inven-tory will leak through the reactor building walls directly to the atmosphere, bypassing the SGTS filters.

e For larger primary coolant leaks, the resulting reactor building pressurization can exceed the building + 0.25 psig design value, causing blowout panels to fail at the refueling floor elevation and causing any subsequent primary centainment leakage to bypass the SGTS altogether.

Z The Reactor Safety Study (Reference 3) addresses the second item above for the Peach Bottom 2 plant and states that primary containment leakage

=

with effective diameters greater than 6 inches causes reactor building failure. Since little background information is given for the basis of this number, a simplified transient analysis of the OCNGS reactor building response to post-LOCA primary containment leaks was made to address both asoects of the problem; the Appendix describes the assumptions and the computer program. The analysis used containment drywell pressure and temperature histories based on the design basis LOCA as given in Figures XIII-2-11 and XIII-2-12, of the OCNGS Facility Description and Safety Analysis Report.

The reactor building is at atmospheric pressure when the LOCA occurs, and the SGTS is assumed to immediately start discharging gas at a constant rate of 2,600 cfm.

The containment drywell leak is assumed to occur 1 minute after the LOCA initiatec.

The drywell is assumed to be filled with steaa at the pressure / temperature values given from the LOCA analysis. The user

. specifies a leak area and the associated drywell steam leakage is evaluated at either choked or unchoked flow conditions. Mass and energy balances are made on the reactor building atmosphere assuming perfect i

mixing and conservatively assuming no heat removal by condensation or 5

8 0031G101582

convection cooling by building internal-structures.

The reactor building pressure and outleakage are evaluated unt'il the reactor building becomes subatmospheric again. The results of this study are shown in Figure 3, which show peak reactor building pressure and the unfiltered steam released through the reactor building walls as a function of the contain-ment drywell leak area. The weight of steam released into the reactor building until its pressure is atmospheric is about 2,300 pounds per square inch of leak area. Figure 3 indicates that a leak area of 25 square inches or greater results in a reactor building pressure greater than its 0.25 psig design value. This agrees quite well with the 28 square inches value (associated with a 6-inch diameter leak) given in the RSS (Reference 3). The largest electrical penetration leak area due to nonsafety grade equipment shorts is 3 square inch with an extremely small probability of occurrence; thus, from Figure 3, it can be seen that this class of accident does not threaten reactor building integrity.

If a LOCA occurs, the main steam isolation valves would close. The primary 9001 ant inventory initially within the vessel is about 4.3 x 100 pounds. From Figure 3, no unfiltered primary coolant leakage through the reactor building walls will occur for leak areas as large as those associated with all five motors shorting (approximately 3 square inches). For this 3 square inch leak, about 7,000 pounds of steam are released into the reactor building over a period of about 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />; it would be expected that a large fraction of this steam leakage would be the uncontaminated water initially in the suppression pool which is injected into the drywell by the containment and core spray systems.

If it is conservatively assumed that all drywell leakage is primary coolant steam, then this represents about 1.6% of the initial vessel inventory.

As noted above, all of the activity released through the failed electrical penetration will be discharged through the SGTS filters.

The last aspect of penetration leakage concerns what effect it has on the operation of equipment needed to provide long term core decay heat removal following a LOCA.

If the LOCA occurred below the core, then the core would be cooled by core spray either from the core spray pumps or f

the fire water protection system. For leaks initiating above the core, one could use core spray or, for the longer time frame, use the shutdown l

cooling system for decay heat removal. Containment drywell spray and suppression pool cooling would be provided by the containment spray system. Electrical penetration leaks will not have a significant effect on the performance of these systems provided that suppression pool cooling is available in a reasonable period of time. Delayed suppression l

pool cooling could cause NPSH problems on pumps which take suction from the suppression pool because the benefit of cover gas pressure would not i

exist. However, the combined probability of LOCAs, electrical penetra-tion failures, and failures in timely suppression pool cooling is sufficiently low so that this should not be an accident sequence of cancern.

1 9

L

5.

CONCLUSIONS GPUN has evaluated the performance of the low voltage econdary OPDs and determined that their response time is too slow.

They are currently evaluating ways to improve their response time. The enclosed analysis investigates several aspects associated with excessive temperatures developing in containment electrical penetretion assemblies due to short circuits developing inside the containment and failure in the timely operation of either the primary or secondary overcurrent protection devices. The likelihood of such a failure due to spurious short circuits occurring during normal power operation which results in an undetected leak in the electrical penetration is estimated be 2.6 x 10-4 The likelihood of this event occurring and of a LOCA subsequently occyrring inside the containment is felt to be of a very low value (2 x 10-' per year).

The frequency of electrical penetration failures cccurring as a conse-quence of a LOCA is evaluated based on failures of nonsafety grade equipment located inside the containment which would continue operating after a LOCA. The frequency of LOCA induced penetration failure (with leakage of about 0.6 square inch) is estimated to be 2.5 x 10-6 per year. The largest potential leak area (associated with the simultaneous failure of all motors and their respective OPDs) would be about 3 square inches with an extremely small expected frequency.

Even so, such a leak area does not impose a threat to the reactor building pressure integrity and it should not degrade the performance of the standby gas treatment system or the cora decay heat removal systems.

(

10

\\

I 6.

REFERENCES 1.

Finfrock, I.R. Jr., letter to Director, USNRC-NRR, SEP Topic VIII-4, Docket Number 50-219, April 24, 1979.

2.

Counsil, W.G., letter to D.M. Crutchfield SEP Topic VIII-4, Docket Number 50-245, A01334, January 29, 1981.

3.

U.S. Nuclear Regulatory Commission, " Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400, (NUREG-75/014), October 1975.

11

.n.

l l

LA C

\\

C I

R T

1 CE" m

LE' X

LA" O

Y x

I dW C"

B 5

I p

N P"

O i

T x

T

/

C 1

x N

1 x

U C

x

, A J

/j L

/

L

%'=EI x

A A/l/

x T

x W

M D

x 1

x

/

._x

/

N

$t

/

/

/

L L

L

/

(

Md

/

n"

//

^"

/

v

/

i

/

L

/

1

/

3

=

/

/

L

/

i l

/

A 1

W

/

/

"C

/

/

L L

/

/

E

/

/

W

/

/

V R

/

/

S D

/

/

E

/

T

/

/

A

/

L G

/

P

/

R I

/

N

/

/

E T

A T

/

D L

/

A I

/

N O

P

/

E A

/

/

H T

E

/

/

D

/

/

E

/

NG

/

E

/

I e

/

.WS

/

s

/

/

Sl E a

/

/

D c N

/

/

Oo

/

I

/

I t

/

^~'

T

.v

/

At

.M

.u

/

/

R o

//

T n

/

L

s E

/

/

Ng

/

E n Pi

/

x

/

w

/

x

/

L a

, k Ar

/

A x

/

X CD

/

xY

//

O I

R x

B T

x N

R C e x

O O

Et L o x

TI T

x C

C EN k

r#

N A

x U

E J

R 1

g E

R 1

U

=

G t

I F

\\

g l

l

l r

g Os

• ge wm a

a,_

m 0 'O,)00l@+Q. l a -

(V Cr]g)+

+ e@ cM-r a

O Ge /.#:

i c3

,O <,

O O

S e *,> /

i m '

s~,/i

.I i

6-t, g

s:

=

,R E

2 25 pE i _

_m

~

m g

o i

c j

5 13 t

I

/

Ij j

3000 7

REACTOR BLDGINTERNAL DESIGN PRESSURE (0.25 PSIG = 6.9 INCHES WATER) j f

I 6

2500

)f E

h e DESIGN BASIS LOCA (ALEAK = 6.2 FT )

]

y 2

6 3

y e REACTOR BLDG VOLUME = 1.8 x 10 FT g

j e REACTOR BLDG LEAKAGE = 2600 CFM @-1/4" WATER GAGE

[

g Q

e SGTS FLOW = 2600 CFM 8

e h

e DRYWELL LEAKAGE BEGINS @ 1 MINUTE

/

2000 i

i c

m m

O

~

l h

b E

1500 5

s 5

"3 i

/

i U

d a

1000 k

1 w

a2 g

d u.

x-o

/

LEAKAGE y

2 PRESSURE r

a w

/

1

- 500

/

/

/

/

0 s

--Y I

I I

O 5

10 15 20 25 2

DRYWELL LEAK AREA (IN )

l FIGURE 3.

MAXIMUM REACTOR BUILDING PRESSURE AND STEAM LEAKAGE THROUGH REACTOR BUILDING WALLS VERSUS DRYWELL LEAK AREA 14

APPENDIX ANALYSIS OF REACTOR BUILDING PRESSURE RESPONSE DUE TO LEAKAGE FROM THE CONTAINMENT FOLLOWING A LOSS OF COOLANT ACCIDENT (LOCA) 1.

INTRODUCTION The configuration being analyzed and the symbols used are shown in Figure A-1.

Following a LOCA, the reactor building is kept at a 1/4-inch water negative pressure by the standby gas treatment system (SGTS) which takes suction from the building and exhausts through a filter bank and then through an elevated stack.

This system is automatically started due to high drywell pressure or high radiation levels in the reactor J

building.

The reactor building in-leakage is 2,600 cfm when it is maintained at a 1/4-inch water negative pressure. The analysis which follows will evaluate the reactor building pressure transient induced by leakage from the containment drywell following a LOCA.

The following three flow rates will be evaluated during the course of the accident:

O e

The flow of steam from the containment drywell into the reactor building.

e The flow of the air-steam mixture up the SGTS stack.

e The leakage flow through the reactor building walls; this will be U,

ambient air in if the building pressure is subatmospheric and will be an air-steam mixture out if a positive building pressure develops.

The analysis will be made by taking appropriately small time-steps over the duration of the transient. Each of the above three flow rates will s

be evaluated based on the beginning of time-step containment and reactor U

building pressures. These flow rates will be assumed to remain constant over the time-step.

Energy and mass balances will be made upon the gas within the reactor building so as to evaluate the change in pressure, temperature, and composition of the reactor building atmosphere over the time-step.

Perfect mixing will be assumed within the reactor building, and it will be conservatively assumed that no heat is removed by structures within the building (this implies that there is no water vapor removal due to condensation as well).

Two aspects are of particular concern for this class of accident:

e If the rer tor building pressure becomes positive, a portion of its O

inventory vill be released to the atmosphere by leakage through the building talls.

e If the reactor building positive pressure exceeds 1/4-psi gage, blowout panels located above the refueling floor are designed to fail, thus releasing all contents to the atmosphere and not deriving mU the filtered and elevated release benefits afforded by the SGTS.

A-1

,-o, 0021G101482

O II. LEAKAGE FROM CONTAINMENT DRYWELL Assuming that a LOCA is caused by a break in a recirculation line, the O

representative drywell pressure and temperature histories are as shown in Figures A-2 and A-3, respectively. Assume that an electrical penetration fails some t* seconds after the initiation of the LOCA and that the failure results in an effective leak area of Al square inches. Assume the containment drywell is filled with steam only and that the steam behaves as a perfect gas.

If the ratio of drywell to reactor building pressure (defined as PC and PB, respectively) is sufficiently large, the leak flow rate (ML) will be choked and flow will be evaluated by isentropic, compressible flow sonic equations. Thus, if k

k-1 O

h>k+1 (A.1) then the leak is choked and the flow is evaluated as k+1 k-1 (A.2)

O ML = AL x PC x kg 2

RT k+1 j where PC = Containment drywell pressure (psia) (see Figure 2).

O PB = Reactor building pressure (psia).

K = Specific heat ratio = 1.32 for water vapor.

ML = Leak flow rate (1bm/sec).

2 AL = Leak flow area (in ),

g = Acceleration constant = 32.2 ft/sec2, R = Gas constant = 85.8 ft/'R for water vapor.

O T = Containment drywell atmosphere temperature ('R) (see Figure A-3).

If the pressure ratio is below the sonic value the flow rate through the leak is evaluated as I

O ML = AL x x

(A.3)

CD l

where CD = effective pressure loss coefficient of the leak (velocity heads), and other terms are as described above.

lO III. LEAKAGE THROUGH REACTOR BUILDING WALLS Based on discussions with GPUN personnel, the leakage into the reactor building is 2,600 cfm when the building is at a negative pressure of 1/4-inch water.

It will be assumed that this volumetric flow rate 0

l

' represents air at 70 F, and that the volumetric flow rate through the O

A-2 g

0021G101482

D l

SGTS filters and stack is also the same.

If the building is at a subatmospheric pressure, the in-leakage is evaluated as 3

g MD(in-leakage) = p ir *Yrated *

& rated

(^* )

a where D

p V

= Air density =.076 lbm/ft,

3 3

rated = Rated leakage flow = 2,600/60 ft /sec.

Prated = Rated pressure differential = 1/4-inch water.

O

= Actual pressure differential (inches water).

The above relationship treats the leakage as turbulent flow with Reynolds number independent loss coefficients. Without knowing the form of the reactor building leak (s), or having measurements of leak flow versus pressure differential, it is difficult to assess which is more correct.

O Some researchers treat the leakage as half turbulent / half laminar, and adjust the & exponent to 1/1.5, rather than one-half.

If the reactor building pressure is positive, the leakage is evaluated as O

MB(out-leakage) =.075 x 2,600/60 x x

(A.5) g where 3

MB = Density of air-water vapor in reactor building (1bm/ft ),

O IV. FLOW RATE OUT OF SGTS STACK As pressure in the reactor building increases from the 1/4-inch water gage design value, the head imposed upon the SGTS fans reduces. This should result in a larger volumetric flow rate. However, in the interest

'O of being conservative, it will be assumed that the volumetric flow rate through the SGTS stack is constant at 2,600 cfm. The flow rate through the stack is evaluated as MS = 2,600/60 x pRB (A.6)

O V.

REACTOR BUILDING MASS BALANCE Equations (A.2) through (A.6) evaluate the flow rates into and out of the reactor building as a function of pressures, temperatures, and leak path characteristics. As mentioned earlier, the analysis herein subdivides the problem duration into a number of time intervals.

The reactor O

building and containment drywell pressures, tamperatures, and gas A-3 nv 0021G101482

(

O composition are known at the beginning of the time interval. Flow rates ML, MB, and MS are calculated based on these beginning of time interval values, and are assumed to remain constant over the time interval At.

O Defining the weights of air and steam in the reactor building as WA and WS, respectively, and considering for the moment that the reactor building pressure is subatmospheric, the mass balance is:

WA(I+1) = WA(I) + MB(I) x At - MS(I) x h x At

(^*

}

WS(I+1) = WS(I) + ML(I) x At - MS(I) x h x at where O

NA = Number of moles of air in reactor building.

(A.8)

NS = Number of moles of steam in reactor building.

NM = Number of moles of mixture in reactor building.

and 3

NA = WA/AM NS = WS/SM NM = NA + NS where AM and SM are the molecular weights of air and steam, respectively.

O If the reactor building is at a positive pressure, then Equation (A.7) becomes:

WA(I+1)=WA(I)-(MB(I)+MS(I))x x at WS(I+1) = WS(I) + ML(I) x At - (MB(I) + MS(I)) x h x at (A.9)

VI. REACTOR BUILDING ENERGY BALANCE Defining U(I) as the energy content in the reactor building at the

_U beginning of the time step, then the end of time step energy is evaluated as follows for the case where the reactor building is subatmospheric:

U(I+1) = U(I) +

ML(I) x PS x TC(I) + MB(I) x PA x TA (A.10)

- MS(I) x TB(I) x x PA + h x PS x At where PS = Specific heat at constant pressure for steam (Btu /lbm 0F).

PA = Specific heat at constant pressure for air (Btu /lbm-F).

TC = Containment drywell temperature (8R).

m TA = Ambient air temperature (0R).

'~'

TB = Reactor building atmosphere temperature ( 8R).

A-4

-U 0021G101482

9 If the reactor building is at a positive pressure, the U(I+1) = U(I) +

ML(I) x PS x TC(I)

-(MB(I) + MS(I)) x TB(I)(A.11)

O x PA + h x PS x at x

Knowing the end-of-time-step internal energy in the reactor building, and the weights of both the air and steam constituents, the mixed temperature is evaluated as 7

~

TB(I+1) = U(I+1)/ [WA(I+1) x VA + WS(I+1) x VS]

(A.12) where VA = Specific heat at constant volume for air (Btu /lbm 'F).

')

VS = Specific heat at constant volume for steam (Btu /lbm 'F).

The end-of-time-step pressure is evaluated by knowing the end of time step temperatures and masses, by treating the two constituents as perfect gases, and by summing their partial pressures as

>O

+

+

0 "A( + ) + WSII+1)

I PB(I+1) =

xR x x

(A.13)

V8 u

AM SM 144 where 3

VB = Reactor building free volume (f t ),

O Ru = Universal gas constant = 1,545 ft-lbm/'R-mole.

VII. COMPUTER PROGRAM A computer program called OCRA has been developed to solve above equations. A listing of the BASIC instructions is given in Figure A-4.

O 0

0 O

O 0021GIO1982

)

MS n

O

,a SGTS + STACK y

u 3

REACTOR

1. BUILDING PB TB WA O

MB y

m CONTAINMENT ^

DRYWELL g ML

{ PC AL sa LC TC 0

///l

%,'/

M/

/

/

\\%

PC = CONTAINMENT DRYWELL PRESSURE O

TC = CONTAINMENT DRYWELL TEMPERATURE AL = AREA OF CONTAINMENT LEAK LC = PRESSURE DROP LOSS COEFFICIENT OF LEAK ML = MASS FLOW THROUGH CONTAINMENT LEAK PB = REACTOR BUILDING PRESSURE TB = REACTOR BUILDING TEMPERATURE n

WA = WElGHT OF AIR IN REACTOR BUILDING WS = WElGHT OF STEAM IN REACTOR BUILDING VB = VOLUME OF REACTOR BUILDING MB = MASS FLOW INTO (OR OUT OF) REACTOR BUILDING WALLS TA = AMBIENT AIR TEMPERATURE MS = MASS FLOW THROUGH SGTS STACK

'O l

'O FIGURE A-1.

DIAGRAM 0F REACTOR BUILDING MODEL AND LISTING 0F STATE VARIABLE NAMES A-6 lo

O O

O O

O O

O U

U U

40 DRYWELL 30 6

{

ONE CONTAINMENT SPRAY LOOP AT FULL FLOW G

g 20 M

E o.

3 WETWELL 3 10 E

P 8

O N

1 HOUR 1 DAY p

U

.io l

I I

I I

I 10'l 10 10 10 10 10 10 10 0

1 2

3 4

5 0

TIME FROM START OF ACCIDENT (SECONDS)

OYSTER CREEK NUCLEAR POWER PLANT UNIT NO.1 - FACILITY DESCRIPTION AND SAFETY ANALYSIS REPORT FIGllRE A-2.

PRIMARY CONTAINMENT PRESSURE FOLLOWING RECIRCULATION LINE BREAK

O O

O O

O O

O U

U W~

300

+

250 200 C

9_.

E b 150 2

>b 100

~

1 HOUR 1 DAY 50 u

i I

I I

I I

g 0

1 2

3 4

5 6

10'l 10 10 10 10 10 10 10 TIME FROM START OF ACCIDENT (SECONDS)

OYSTER CREEK NUCLEAR POWER PLANT UNIT NO.1 - FACILITY DESCRIPTION AND SAFETY ANALYSIS REPORT FIGURE A-3.

DRYWELL TEMPERATURE RESPONSE FOLLOWING RECIRCULATION LINE BREAK

/

CO J/r = 1. F".o *

• f CACTOt:: filILDIrfG (RM Fr.CE VOf.UNF. (Cf f.C T. n 02 TA=7o: *1 A *AMntritT AIR TEttPCr ATIIIW (l' )

00 VA.171 PA=. P4: ' AIR FFECIFIC HEAT AT CON 9 tat 4T UOI.tJME/F Rr'J3s arE

' )

40 VS =. "*4 : FC =. 45 ' GTM EFECIFIC HJAT AT CONSTANT VOLUNf/OF 5 ",UhE 50 Art = Ort.97: 5N, t O: " Art /Stta4 !R/STFAf1 MOLCClit (.R WCIGH I;

60 *NA/H9/NNrNeilI0ER OF NOLE7 OF (.IR/GTN/fil?: It! RD 70

• ttL /ttre/t1%MAGO Fl OU fcATES r.F Du LCf.1/RD Lt:Al/LGTO STACE (t r,M/EEC) 80 ' FC/F F F G =COrlT A!!1tIFNT ORYUZLL/RB F FECSUhEC (F CI A) /hD GAGF FRCc3' IRE tP UGn 100

• WA/UWuMICHTS Of' Alf;/S itt til RD (L 011)

)

110 AL= 5.OOs i: LF R IllT"! CAF AREA (CO. lit. ) =". AL LF R !?tT LF G irlT" TIME (CEC) ". "F B F REG ( I m

N-ti) "

. "LCAl' FLOW (F PS ) ". "R F5 FLOW (F F E ) ". "STAC FLCLI (FFS1" LF R Illi d

100 LC=T.OnnO: 'LCmF RE35URE LOSS COEFF IN CRYWELL LEAt: (VEL.H03.)

100 'T&/TC= TEM"ESATURE OF GAS.IN RD/CRYWELL (F) 140 DT=2.

s'OTuTIME GTEP (m) 142 TF W W: ' TF<ND T INE (SEC) 150 GR=(2/O.02)C(-1.02/.02)

• SR=50ti!C FL0tl FRE55.RATIrl FOR GTTAM 160 Als SOF:Cl30.0/(LC305.31) s'Al=EUF30 HIC FLG-1 TCRif FOR Dul.EAl 17ri A =

50R((2/2.;;) (2.;;/.

)al.;; c;.2/gs.en

• An=qnWIC fl.OW TCRit m

!?u D!lt T /SOO ). F C (COO). F F: ( SOO). TC (*.,3O n. T B (S.;O f. ML (500 ). !!9 (",001. :19 P.OO e. L.Hi (EOO..

WA COO ). t 1000) 132 131:T(1erOn:F A ( 1 ) = 14,7. ;*5 9. 03611 : TD ( 1 ) = 70. b5 (li ro.oOn dA(11 uF e (l i a 1 la sVD/

(5!. " !*(FD(1)+4'306 104 U ( ! ) %ih i l l t Va n ( 73 ( 1 ) *4601 190 'UFCATC TIMCS ft40 CALLULATE EDT3 RB CON 5TITUEllTS 219 flSWSils/SM:8!AaWA ( 11/AH 11N=Hi+flA: F 4=F B ( I l -14

'I 200

's** CALCULATE EOTS FLCW FATES FoiED UFON 00T3 CCtIDI TIO;14 4*a q

24n * *

• LEAI AGE FROM CCflT. Du IH TO FR 44 a

Oro THaT i l i + r.T.' ;: GGur.10no r

• rt.I.C i:OTS CCNT. 0ld F is E E 'i. AMs TEt F Odo IF IF C ( I.. F "a i i ) GRi TMCf1 "Mn

• ChF Ci; F6A Cxti ED FLct CrtwI ri,i 270 ' s Si lM Ol ll C F) 04 TH7 0l!Gil LCAl' *

'9n ML ( 1 ), A. sf.t s'irR f r C ( ! i.t

• F C t i i -FD' I ) ) / ' TC ( li +4 Ani n 2 0010 3'* A

24) ** Wil!C (CliO; ED e FLms TIGOU:l H LEA 6 L 000 Nt. ( I ) wil i A'.' t f C 4 ! ) MDR ( TC ( I ) + -Im1 010 *** LCAIAGE UP SAT 3 ST/.CI'--aS?UNE CONST VCL Fi cu FOR rnu *

• Cro its t I > = t:260 40.t015(!)+ua<lin/VR m

000 '68 LCAI ACC THROUGH F EACTO.'s ELDG ut. LLC a s 040 !!e (750n/ bon 190'R ( AZ S (FG) / (. 25 8.0 s11) 1 O!O IF (F U.0) TPEll 90 OSO

'2 IllLCA6 AGE OF AIR

• 070 ND ( I ) =. 075

• 2 0: COTO 110 OGO

• t DUTLEA6f.GE OF NIXTURC FROM REACTCG DLDG

• 09a it& (!) = Z O

• GOR ( ( (WA (1 ) +WS (I ) i /VD ) /. 075) 2. 073 g

460 ' a s s cal.CULA TE EOTS NASSES til RD ads wJ 410 WA ( ! + 1 ) ablA ( I ) -113 ( I a

• D T *Na / tit t 42G IF (F G 01 TMEli WA ( I + 1 ) suA I + 1 ) +1tD (1 ) L DT 42n NS ( I + t 1 =us i l ) +NL ( I '

• DT-t;9 ( I '

• DT 4NS /tlet 440 (F (F G '.611 Hell US ( I + 1 > =uG ( I + 1 ) -;1R ( I ).O T itis /f!M 45n I F ( F G o n THEti Ua t I + 1 ) =WA ( I + 1 *

'ff:' ! )

• D T ailA /NM 456 'at CALCULA1E EOTS TEl:FERATil6CS FF O ! $4CRCY DAl.i.t:CE sta 476 IF(T G 0) THEN Z1=N9(In tf A r (TA+4An): ' AIR INLEAlAGE CASE 490 U

IF (F G ' o n THEN Z I =-N9 4 I) * ( TD (I) +460) t irtA4 F A+1d *F E) /titt 'CUTLCA) AGE CA3E m

400 IF (F Cat e ) TIIEtt 2140 49G U( 1 + 11 =U( ! ) + (ML ( !) * ( TC (I l +.1601 J F 9-M3 ( I n e ( TD ( I). 4 66) e (tlA s F A *fl3 iF S) /t:

N+Z!1*DT 500 TD ( I

• t ).U ( I + t ) / (UA ( ! + 1 ) *Vn+W9 ( I

• t I tVG) - ;60 001 F O t I

• 1 l e iUA ( I + 1 ) / At t +W3 ( 1 + t ) /CM) t 1045 4 (T3 ( I + 11 +4 eon / (UT. :1441 502 (F(T(!) 50 t t1T ) THEtlD T ' t O t D T 504 LFFIfff T ( 11. F G /. OT511. t"L ( ! ). itD ( ! ) a crri t F G). MS ( I )

505 !=I + t : r (Il ui(I-11 *DT: IF (T(l) :TF) THEHO!O q

52 CNT13'CND T!!!G FYrFEDED J

W'

' SUT rot t t !!1E L:: s t Cli IrlTERFOLAiE7 CONT I;u F6EMUAF At10 Titt '

lonO (C(!)=.~4.77-lG.27:

RETURif 4 LOG (Tru/ LOG (19)+14.7 TC(Il=4**.5-41.14541.GG(TNi/LO3(1 0:

FIGURE A-4.

PROGRAM OCRA - CALCULATED THE OCNGS REACTOR BUILDING

,u PRESSURE CHARGE ASSOCIATED WITh DRYWELL LEAKAGE A-9 q

u