ML20029E169
| ML20029E169 | |
| Person / Time | |
|---|---|
| Issue date: | 11/26/1990 |
| From: | Jerome Murphy NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | Jordan E Committee To Review Generic Requirements |
| Shared Package | |
| ML20029E167 | List: |
| References | |
| REF-GTECI-023, REF-GTECI-NI, TASK-023, TASK-23, TASK-OR NUDOCS 9405170140 | |
| Download: ML20029E169 (6) | |
Text
. -... -
e gh-I
'?-
- .E.;;04
- *
- ! F.c :EEEM(---05R TEl. !C:!c' 432 !!ES
,pm ang
, :2*E 202 g'
3
[
S.,,a j
UNIT E D 3TA TES g
NUCLEAR REGULATORY COMMISSION g', en wAsmc7ov o. c. rosss
% h#
MEMORANDUM FOR:
Edward L. Jordan, Chairman Comittee to Review Generic Requirements FROM:
Joseph A. Murphy, Deputy Director Olvision of Systems Research Office of Nuclear Regulatory Research
SUBJECT:
THOUGHTS ON THE BACXFIT RULE 50.109 POLICY STATEMENT Detween the Backfit Rule (10CFR50The remaining discussions on G Because these interactions are com.109) and the Comission's Safety Goals.us on the CRGR is explicitly considering the Safety Goals, I offer someplex to the CRGR.
general thoughts 50.109(a)(3) requires that "... there is a substantial increase i protection of the public health and safety or the common defense a d n the overall to be derived from the backfit and that the direct and indi n security implementation for that facility are justified in view of the i costs of protection."
ncreased 50.109(c)(3) requires consideration of the "(p the publtc from the accidental off-stte release)otential change in the risk to of radioactive material."
We have traditionally implemented this using a criterion of $1000 and this approach has been approved by the Commission.
notning in 50.109 which reovires use of $1000/ person-rem factor.
there is a ve The Comission's Safety Goals may shed an interesting light on ou There are two Quantitative Health Objectives in the Comission's r approach.
Statement - one dealing with early fatality risk, and one dealing w o cy cancer fatality risk.
on the probability of a larger release for further studyThe Com atent i
Safety Goal imolementation also essentially establishes a subsidiThe Ju relative to the core damage frequency.
ary goal l
The standard oractice of performing cost-benefit analyses a criterion can be relatea almost dire using person rem as Health Objective (i.e., per, son-rem can,ctly, to the latent cancer Quantitative in general, be ecuated to latent cancer fatalities).
This means, however, that our cost-benefit procedure i essentially ignoring the other atract and subsidiary Safety Goals be sionificant because NUREG-ll50 clearly shows that the lat s
This could j
tne easiest of the Comission's Safety Goals to meet ent cancer QHO is
/4EZ7/fC /95 A7I 2 7'O ENC Z-MOD [tOb
% 0.' M 9 i
MEETING 195
M)V 2 6 LE This suggests that we may need to expano the criteria incluce sometning that can be related to the other OHO and thw goals.
These could be in the form of damage frequency reduction and (3) $/incre(ment ia 1
e subsiciary
, (2) 5/ increment of core of a large release.
The values used should be consistent with the gu n reduction in the frequency.
the June 15 SRM, i.e., at the Safety Goal values incentive for additional requirements, but they a,lso sho ldthere sh n
concept of rist aversion implicit in the Safety Goals which s u
reflect the core camage and large re calculated consequences. lease frequencies should be low, witho uggests that the on the order of $5,000/ person rem or largerThis, in turn, would sugges rem and pe frecuency,rhaps $1,000,000 or more per 1x10'ghen the dose received is over 200 ues with a similar value app early containment failure frequency.licable to a 1x10-6per year decrease (Numbers are illustrative only.)per year reduc With regard to the direct application of the Saf tis c SECY-89-102 dated June 15, 1990. Note the following from p.6 of the Sfet:a ement that is referred to as ' adequate protection'"These a of safety must be assured without regard to cost and, thusThis is the level that adequate protection, if the NRC decides to consid e.)
Beyond safety, costs must be considered, and the cost-benefit ana ncements to by the Backfit Rule must be performed.
! bow safe is safe enouch' that should be see equired n ion of go when oreoosino safety enhancements on how far to under the a (emonasis added)". includino those_to be considere ackfit Rule s I interpret the guidance as follows:
The oetermination of adecuate protection is a ca a plant and site combination considering the body of the adequate protection, if tne NRC decides to consider enhancse regulations. Beyonc costs must be considered, and the cost-benefit analysis requi Backfit Rule cust be performed.
ements to safety, i
cost-benefit space, i.e., if you meet the Safety GoalsThe Safety Goals red by the caveats relative to the robustness of the analysis), no(additiona and can satisfy other is acceptable, regardless of the value-impact analysis the ce mnvis line for value impact analyses on a requirement Thus, it appears that either directly at the Safety Goal given issue should be set 2), to satisfy the philosophy expre,ssed by the Comissior only slightly belo 1
on.
One possible interpretation is to apply the Quantitati (anc, presumaoly, the suosidiary core damage ve Health Objectives plants.
without the modified regulation, no change is requiUnless t objective e Safety Goals potential for exceeding the Safety Goals at an e i ti red.
If an issue has the benefit analysis would be required.
xs ng plant or plants, cost-Such an approach would not be greatly out i
l
s - s.
of Hne with how many of the existing regulations (e g A to Part 50) were established, albeit we approached th.., the G0Cs in Ao in the Sixties).
e problem qualitatively the oestreo level of safety - an indtcation of "how s an expression of new issues arise, examine the boundary conditions and assumptios s existing population of probabilistic studies to see if these issue ns of_ A adequately treated and the Safety Goals met.
s had been dropped after consideration of the potential impact of plant tIf so, t differences.
the leve) of safety envisioned by the Safety Goals wh
- o-plant design conditions were expanded and assumptions modified. oundary recomend we attempt to do this QUALITATIVELY, not quantitativ should be to identify regulatory gaps that could potentially " b The effort fill those gaps; not to engage in endless "numoers' exercises
, and to The reasons for de-emphasizing ' numbers' are obvious quantitatively are very low numbers.
The safety goals difference between calculated severe core damage frequencies IE-7 per year - they all mean that we believe the real frequenc
, 1E-6, or given the constraints of our analytical techniques.
y is very low, mde for low risk values (early or latent fatalities, or popu Further, the uncertainties are large.
(Theperson-remgerstationblackout core damage accident per NUREG 1150 is approximately 10. b least a two order of magnitude spread between the 5 and 95 distribution.
what our curre)nt knowledge base suggests might be im The numoers are important, but only as they help us id of the investigating the impacts of changes in that knowledge base in
, and guide us in Thus, qualitative judgements, supported by quantitative analyses a crude manner.
emphasized to the extent feasible and realistic.
, should be This approach would be difficult to codify and difficult for both C staff to implement, but has the advantage of being consisten of the art.
and the x
.h Joseph A. Murphy, Deo ty 01 rector Division of Systems Research Office of Nuclear Regulatory Research l
'O e4 4 MO
MQtto1RH i
j Safety Goal Analysis Core Damage Frequency 0.0003
- - -- - r - -
Grenter ihan 10f-dhhinh !nrin tv Enst-ben ac fit iIkely I
a~o g g, N'
, N\\\\ NNNNN'\\\\\\[(' 'ix' NNYbbh.
h a
/ / [
/ f;/
studyj eloser; riaay l'iave justified backfits 3E-05
/
I.
i ! l;!.! l /////,
medium to lop priority Isyues
- ffj,
\\j l
I 1 E-05
~
I / /
/
I j
"SafeZone" per 1150/ / N Li6e of constaInt risk
)
k
/ / /
urrdnt safety goals met C
3E-06 l tn 1 :
?
l l
's y
I j
with raargin.
/
/
j ! j' / /,! / /
/
g
'x k
f
/
// / j
A#old if possibib"'N 1 E-06 !
/
greMer man.1 ]
w N
q below 10(-6); hd,rd to justify, regardless of CCFP m
3 E - * ' 2 I- -
I-0.005 0.01 0.02 0.05 0.1 O_2 0.5 1
p)
Conditional Containment Failure Probability i
I
.a_L
..a t
/
~
- s-2/OA./ (GJ/O MOD. )
S ha\\
afety Goal Analysis i
Core e
o.0003 x
\\
L LL__
b(eb,(e t{iahlkk ghl priority; bost-ben efit backfit likely
{
o_non,..
/
1, olL~.w A s, ~.d n a-n I
i
/
m
/
</
/,-
i I
t i
,/ / j'
< /
I j
study,! closer; diay have justified backfits f !;/
3E-05 t
' /!
/;/,/
I l l/,
med um to low priority ispues j
l:
1 E-05 i[ { jl jl /ls
,~jj,,,/,
t i
l g,
l
/ " Safe 2one" per 1150/ /
/
Line of considnt risk
/ / jCurrent safety goals met f l'/ y,;,/ with raargin.
3E-06 x
j ///
ii
/
I 1
J l
t
/j
//
/r/
/ / / '/
Avoid if possible x
1 E-06 !
/./
CCFP greater than.1
(
below 10(-6); h rd to justify, regardless of CCFP 3E-07 b - - 2
' 2-0.005 0.01 0.02 0.05 0.1 0.2 0.5 1
Conditional Cor: tai ent Failure Probability e
aan e
s a a r - i n,n c EvewKS Safety Goa! Analysis Core Damage Frequency 0.0003 m
- - - p-N Gre$ter thanl10(-4);high l priority; host-ben efit backfit 1 kely i
o.0001 % [ N Y ^db ' M A W ~I- ~ ~ ~
l
\\NY j
i
~<1 i
s hoser; bay have justified backfits
?
/.'
t 3E-05 N
.j edjum to lovv priority is s
.,jf m
sues
/
i 1 E-05 l
i
/
k-N' i;'
. ' ',/
a
.o e".
O/. j (le of constElnt risk i
/ / il fCurre'nt safety goals met f
V
/ with triargin.
I///
/N!
i//
/
e
/
( ' / j/ y!i
/
/
j
/ /i/
/
Avoid if possible 1E46 CCFP greater than.1 3
belo s 10(-6); ha rd to justify, regardless of CCFP 3E-07 '
"W Iau i 1 I -
I O.005 0.01 0.02 0.05 0.1 0.2 0.5 1
J-
-a l 2
Conditional Containment Failure Probability i
i j
? % s.
Date l
ROUTING AND TRANSMITTAL SLIP
/ yg
.6 TO: (Name, ottice symbol. room number, initists Date -
s y
bulkling, Agency / Post)
,s qu'
- 1. cad # MtMJ/A S
- 2. MTLAAM7ES M ff76 #/9t/
A(SS } COAM S/_._ - - L I.. _
L 4.
5.
Actk>n File Note and Retum Approvat For Clearance Per Conversation Aa Requested For Correction Prepare Repy Circulate For Your information See Me Comment investigate Signature Coordination Jushty REMARKS enc ar.rtb /. s A A A A F 7 A l G.
ANAL)-S/.c t=*o K U /30 tes///ck JE u /13 ro cAC K Dis c ysSts#3 ef A'cf fdALL 00 NOT use this form as a RECORD of approvals, concurrences, disposals, clearances, and similar actions FROMt (Name, org. symbol, AgencyPost)
Room No.-Bldg.
ffff/S l
Po 5041 102 CPTl0N AL FORM 41 (Rev. 7 78) a u s GPo ises-o 461274r20022
$$UtYra)19111.200 1
/
4 DRAFT REVISION 2 ENCLOSURE 1 NUREG-1421 REGULATORY ANALYSIS FOR THE RESOLUTION OF GENERIC ISSUE 130:
ESSENTIAL SERVICE WATER SYSTEM FAILURES AT MULTI-UNIT SITES Draft Report for Comment Manuscript Completed:
October 1990
)
Date Published:
TBD j
V.
- Leung, D.
- Basdekas, G.
Mazetis Reactor and Plant Safety Issues Branch Division of Safety Issue Resolution 1
Office of Nuclear Regulatory Research U.S.
Nuclear Regulatory Commission Washington, D.C.
20555 I
J l
({.p%)fELQ)3=?
b "\\k h
e i
I t
\\
O ABSTRACT The E:sontial Suteica Watc; System (ESiiO) la reqaired tc ptovice cooli.ng in nuclepr power-plants during norma! ope. ration and accident conditions.
Typical equipment supported by the ESWS are component cooling water heat exchangers, containment spray heat exchangers, high pressure injection pump oil coolers, emergency diesel generators, and auxiliary building ventilation coolers.
Failure of the ESWS function could lead to severe consequences.
This report presents the regulatory analysis for GI-130
" Essential Service Water System Failures at Multi-Unit Sites."
The risk reduction estimates, cost benefit analyses, and other insights gained during this effort have shown that implementation of the recommendations will significantly reduce risk and that these improvements are warranted in accordance with the Backfit Rule, 10 CFR Part 50.109 (a) (3).
iii
TABLE OF CONTENTS Page j
ABSTRACT iii LIST OF TABLES vii i
EXECUTIVE
SUMMARY
ix 1.
STATEMENT OF THE PROBLEM 1
2.
OBJECTIVE 4
3.
ALTERNATIVE RESOLUTIONS 5
3.1 Alternative 1 - No Action 5
3.2 Alternative 2 - Install Additional Crosstie 5
3.3 Alternative 3 - Provide Electrical Power Cross-Connection 5
3.4 Alternative 4 - Provide Separate Intake Structure 5
3.5 Alternative 5 Modity Tochnical Specifications 6
3.6 Alternative 6 - Provide Independent RCP Seal Cooling System 6
3.7 Alternative 7 - Combine Alternativ.es 5 and 6 7
4.
TECHNICAL FINDINGS 8
4.1 Core Damage Frequency Analysis 8
4.1.1 Initiating Events Frequency 8
4.1.2 ESW and RCP Seal LOCA Recovery 9
4.1.3 Relative Time Fractions 9
4.1.4 Core Damage Frequency 10 4.1.5 Effects of Potential Improvements on Core Damage Frequency 11 4.2 Dose Consequence Analysis 20 4.3 Cost Analysis 23 4.3.1 Direct Costs 23 4.3.2 Indirect costs 23 4.3.3 operating and Maintenance Costs 23 4.3.4 Technical Specifications Costs 24 4.3.5 NRC Costs 24 4.3.6 Averted Onsite Costs 24 4.3.7 Range of Cost Estimates 25 v
TABLE OF CONTENTS (continued)
Ekge-5.
VALUE/ IMPACT ANALYSIS 31 31 5.1 Alternative 1 - No Action 5.2 Alternative 2 - Install Additional Crosstie 31 5.3 Alternative 3 - Provide Electrical Power Cross-Connection 32 5.4 Alternative 4 - Provide Separate Intake Structure 32 5.5 Alternative 5 - Modify Technical Specifications 33 5.6 Alternative 6 - Provide Independent RCP Seal Cooling System 34 5.7 Alternative 7 - Combine Alternatives 5 and 6 36 5.8 Uncertainty Analysis 36 5.9 Life Extension Considerations 37 6.
DECISION RATIONALE 40 46 7.
IMPLEMENTATION 47 8.
REFERENCES vi
~.
LIST OF TABLES Page,.
s, TABLE ES.1 Best-Estimate Cost-Benefit Ratios xii 4.1.1 Operational Status of Multi-Unit Sites 13 4.1.2 State Dependent LOSW Initiating Event Frequencies 14 4.1.3 Sequence Conditional Core Damage Probabilities 15
.4 Core Damage Frequency due to Individual Sequences 16 4.1.5 Core Damage Frequency --- Summary 17 4.1.6 Failure Mode Classification 18 4.1.7 CDF Reduction For Alternatives 19
'.e.A senefits of Proposed Alternatives 22 4.3.1 Best Estimate Costs of Proposed Alternatives 26 4.3.2 Direct Cost Estimates 27 4.3.3 Cost Offsets for Proposed Alternatives 28 l
29 4.3.4 Onsite Consequences 4.3.5 Range of Estimates for the Total Cost and the Net Cost 30 l
5.1 Best-Estimate Cost-Benefit Ratios 38 5.2 Best-Estimate Cost-Benefit Ratios for 20-years License Renewal 39 vii
EXECUTIVE
SUMMARY
This report providec upporting information, including a valua-impact analysis, for the Nuclear Regulatory Commission's (NRC's) resolution of Generic Issue 130, " Essential Service Water System Failures at Multi-Unit Sites."
This issue addresses the concerns regarding the Essential Service Water (ESW) system at multi-unit PWR sites having two ESW trains par unit with a crosstie capability (fourteen reactor units at seven sites).
Typical components cooled by the ESW system under normal and accident conditions are the component cooling heat exchangers, containment spray beat exchangers, high pressure injection pump oil coolers, amargency diesel generators, and auxiliary building ventilation coolers.
The ESW system is also used for cooling the reactor coolant pump (RCP) seals, typically indirectly via the component cooling water system (CCWS) or the charging pumps.
This issue was initially identified as a result of the safety evaluation related to the limiting condition for operation (LCO) relaxation program for Byron Unit 1.
ESW system support from Byron Unit 2 via the crosstie between the two units was not available while Unit 2 was under construction.
To support the LCO relaxation pregram, Byron Unit 1 performed a probabilistic risk assessment (PRA) of the ESW system.
The insights derived from that study indicated that the core damage frequency due to the unavailability of a two train (one pump per train) ESW system could present a significant risk to the public health and safety, particularly if one ESW pump from the adjacent unit via an ESW system crosstie is not available.
At multi-unit sites, crossties are usually provided between the ESW systems of the adjacent unit to enhance operational flexibility; however, the Technical Specifications (TS) for these plants have typically not placed any operability requirements in the adjacent unit's ESW system, particularly during shutdown modes 5 and 6.
This regulatory analysis is partly based on a modified reliability analysis performed by Brookhaven National Laboratory (BNL) for the Byron plant.
The PRA model was modified to reflect the multi-unit configuration and the assumption of having an ESW system failure as an initiating event for the accident sequence.
Also, it was determined that a more recent value for RCP seal LOCA probability based on the data developed in NUREG-1150.should be established for the present analysis.
A model was developed to incorporate tha probability of an RCP ecal loc 4 as a function ix
of time and leakage rate of the reactor coolant pump seal.
In addition, both short and long term recovery actions which might
&ffect tha' final catccme1 wore examined.
~
~
The results of the analysis indicate that the core damage frequency (CDF) due to ESW system failure is estimated to be 1.52E-04 per reactor year.
The staff examined seven possible alternatives to lower the CDF, and estimated that the potential reductions in CDF range from 1.37E-05 to 9.13E-05-per reactor year.
A detailed description of modeling and assumptions used in the analysis are presented in NUREG/CR-5526.
P A cost-benefit evaluation of the possible alternatives indicate that cost-effective options are available.
One or more of these alternatives have the potential for significantly reducing the risk due to loss of ESW.
Table ES.1 provides a summary of the best estimate cost-benefit ratios for each of the alternatives exsmined.
Comparison of the best estimate cost-benefit ratios for all the alternatives against a guideline cost-benefit ratio of $1000/ person-rem shows that all the alternatives are cost-beneficial except Alternative 4 entailing a separate intake structure.
The regulatory analysis used these cost-benefit calculations as partial basis for considering a proposed resolution to GI-130.
The proposed rssolution is a combination of Alternative 6 (or 6a) plus Alternative 5 to provide a backup means of RCP seal cooling plus additional ESW technica:
specifications and amargency procedures.
i The cost-benefit ratios were also calculated for the case of licence renewal for an additional term of 20 years, or a remaining plant life of 50 years.
A comparison of the results-shows that the cost-benefit ratios for all analyzed backfit alternatives are considerably lower for extended plant life.
Even so, Alternative No.
4, Separate Intake Structure, still remains appreciably higher than the $1,000/ person-rem guideline at a cost-benefit ratio of $2,285/ person-rem.
Of interest to the decision process on this generic issue are the insights and views available in related PRA documentation in the open literature.
Although still not finalized, the preliminary PRA work available in NUREG-ll50, " Severe Accidents Risks: An Assessment for Five U.S.
Nuclear Power Plants" -(plus supporting documentation) is a source of extensive risk analyses information one might turn to for an understanding of ESW vulnerabilities.
An examination of the NUREG-ll50 documentation of the three PWRs that were studied indicates that the analyst considered that the ESW redundancy fcr tro of tha thrac PWRs vas large enough that a x
complete loss of ESW as an event-initiator was deemed not credible (eight pumps available in Sequoyah, Unit 1).
None of the tivw planrs in the NUREG-1150 study is. a GI-130 plant; however, it it wcethwhile to nots thrt one of the-PWRs -(Zica) e identified the service water contribution to risk to be substantial (approximately 1.5E-4/RY).
This contribution for Zion was approximately 42% of the total core damage frequency due to all causes.
Another PRA work available in the open literature is NSAC-148,
" Service Water Systems and Nuclear Plant Safety," dated May 1990.
Although it is only a compilation of earlier PRA results for six plants performed by the industry, it is useful to note that a greater appreciation of the service water system's contribution to plant risk has moved the industry to initiate a program to improve service water performance.
The limited guidance available in NSAC-148 is a step in the right direction..The wide range of core damage frequencies (due to LOSW) over the six plants studied suggests large variability in plant-specific ESW configurations.
The average CDF due to LOSW for the six plants was 6.55E-05/RY, with a range of 2.33E-04/RY-to " negligible" contribution.
Many details of these six PRAs are not included in NRAC-148 and, therefore, must be considered to be used only with a g: eat caution.
The overall message that the service water system provides an important safety function which could be a substantial contributor to overall plant risk tends to land added credence to the GI-130 conclusions.
i xi
Table ES.1 Best Estimate Cost-Benefit Ratios ($/ Person-Ram)
~
Total Cost /
T3tal Cost /
Altern,4tivo,
Benefit without Benefit /With Averted onsite Averted onsite Costs Costs 1.
No Action 2.
Additional Crosstie 433 238 3.
Electrical Cross-Connection 80 Note 1 4.
Separate Intake Structure 3847 3651 5.
Technical Specification Modifications + Procedures 25 Note 1 6.
High Pressure Pump for RCP Seal Cooling 862 684 6a.
Firewater for Thermal Barrier Cooling 37 Note 1 7.
Combination 6+5 756 574 7a.
Combination 6a + 5 39 Note 1 Note 1:
Including averted onsite costs resulted in a net cost savings.
xii
1.
STATEMENT OF THE PROBLEM Tnis issue was identified in~1966 (Refs.
1,
- 2) as a result of the Eyron Unit i vulnerability to core-damage sequancer in the absence of the availability of Byron Unit 2 (not operational at the time).
Because of the licensing considerations of Byron Units 1 and 2 and the immediate need to make a third ESW pump available to Byron Unit i via a crosstie with one of the two Byron Unit 2 ESW pumps, the Byron Unit 1 concern was treated as a plant-specific issue.
However, the Byron plant-specific issue raised questions relative to multi-unit sites that have only two ESW pumps / unit with a crosstie capability between them.
Fourteen units at seven sites having the basic Byron ESW configuration were evaluated as part of this issue.
These multi-unit sites have two ESW pumps per unit (one per train) with a sharing of one of the two pumps with the other unit via a crosstie between the two units.
Evaluation of other design configurations of ESW systems in LWRs, including those of single unit sites, will be performed under GI-153, " Loss of Essential Service Water in LWRs."
It should be noted that the success criteria for the ESW systems in providing adequate cooling capability during normal, accident, and post-accident conditions are design-specific, depending on the plant configuration, the capacities of the ESW pumps, and equipment dependencies on ESW cooling.
Although the success criteria may be as varied as the ESW systems, this evaluation assumed a generic set of success criteria as a representative model for purposes of quantifying the events leading to possible core-damage accidents.
These generic criteria are discussed below and apply only to multi-unit sites having two ESW pumps / plant with a crosstie capabil'ity between them.
During normal operation, one ESW pump per unit provides adequate cooling to systems such as CCW, RCP seals and air conditioning and ventilation systems.
The second ESW pump per unit is assumed to be nornally in a standby mode.
Because of load shedding (isolation of non-essential equipment), one ESW pump per unit is assumed capable of handling accident and cooldown heat loads.
Typical equipment cooled by the ESW under these conditions are the CCW heat exchangers, containment spray heat exchangers, diesel generators, and auxiliary building ventilation coolers.
With one plant in power operation, and the second plant in the shutdown or refueling modes of operation, the criteria assume one ESW pump can provide adequate cooling to shut down the operating plant through the crosstia cer.ncetion, should the need aclau.
~
l
A survey of operational experience (Refs. 3 and 4) shows that a n=nhcr of different components in the ZSW system muy fail to perform. their i ntendad function in a variety. of. ways..Hevove*,
review of operating experience has indicated that there are specific dominant failure modes for the ESW system associated with failures of certain components.
Such failures have involved the traveling screens and/or other common cause problems at the intake structure leading to the partial or complete loss of the water supply.
The ESW pumps and their electrical power supply are other important contributors to the partial or total loss of the ESW system.
All ESW systems at the GI-130 multi-unit sites are safety systems, and their designs are plant-specific with plant-specific equipment, crosstie capability, and ESW operability needs for successful accident mitigation operations.
A comprehensive review and evaluation of the operating experience with ESWS has been performed and is reported in NUREG/CR-5526 (Ref. 3).
Excluding system fouling (sediment, biofouling, corrosion, erosion), the total number of plant events involving a possible complete loss of the ESW function was 12 (Ref. 3, Appendix B).
System fouling data were noted, but excluded from the current analysis due to the earlier resolution of Generic Issue 51, " Improving the Reliability of Open Cycle Ss rvice Water Systems" (see also the discussion in Chapter 6).
The total number of PWR years during this period of data retrieval was calculated to be 667 reactor-years.
In 1980. one event involved a complete loss of ESW at San Onofre, Unit 1.
At 100% power, a shaft on the operating salt water cooling (SWC) pump sheared due to vibration.
This event then involved the additional failure of the normal standby pump (discharge valve failed to open) as well as the failure of a second auxiliary standby pump (lost prime).
This led to a complete loss of ESW flow for about 15 minutes, at which time a fourth pump was manually crossconnected from the traveling screen wash system to establish cooling water flow.
A detailed examination of the loss of ESW events indicates that a number of events occurred in Modes 5 and 6 (shutdown) and some of them may not have been a complete loss of ESW in terms of total stoppage of ESW flow, even though the ESW system might have been declared inoperable.
The difference of the ESW system between power and shutdown operation is primarily the actual heat load and equipment affected by the loss of ESW.
In addition. the actual 2
e i
administrative requirements imposed by the technical specifications also differ, and make these two operational modes core distinct.
+-.
J To calculate the initiating event frequency for loss of ESW, the total operating ESW-system-years for all PWRs of 667 reactor-years was divided into two parts as follows:
487 reactor-years-at-power 180 reactor-years-at-shutdown Finally, the respective loss of all ESW frequencies were calculated to be 1.lE-03 per reactor-year-at-power, and 3.2E-02 per reactor-year-at-shutdown (with one pump running and one at standby), and 2.9E-01 per reactor-year-at-shutdown (with one pump running and the other in maintenance).
These numbers then were weighted for the various operational states of each unit and their respective time fractions, before calculating the CDF values, as discussed in Section 4.1.1.
Should a loss of the ESW system function fail to be recovered, the resulting core-damage accident could lead to significant risk to the public.
The most dominant sequence is the reactor coolant paap seal loss of coolant accident (RCP-LOCA).
This specific sequence is the subject of GI-23, " Reactor Coolant Pump Seal Failures" (Ref. 7).
This study estimated the total core damage frequency (CDF) attributable to the loss of ESW for seven two-unit sites (Chapter 4) and the cost-effectiveness of several alternative modifications (Chapter 5) which could lower this CDF.
3 k
2.
OBJECTIVE
.Tba purpose of the Generic. Insuc 130 prograr it ta.* valuate the safety adequacy of a two-pump ESW system in existing multi-unit FWR power plant sites, and to examine the cost-effectiveness of alternative measures for reducing the overall vulnerability to ESW system failures.
Probabilistic methods were used to assess the CDF, the potential reduction in risk of the modifications, and their cost-effectiveness.
The overall objective for resolution of GI-130 is that contribution from loss of the ESW system should be a small percentage of the total CDF due to all causes.
For USI A-45, the staff recommended in NUREG-1289 that the frequency of events related to DER failure leading to core damage should be reduced to a level (around 1.0E-5/RY) so that the probability of such an accident in the next 30 years would be about 0.03 based on a population of around 110 plants.
A similar core damage objective (1.0E-5/RY) was noted in USI'A-44 covering station blackout.
These objectives are also consistent with the recently issued guida nce to the staff (Ref. 6) setting a goal for CDF of less than 1.0E-04/RY from all contributors.
To meet such a goal the staff has aimed for the benchmark that a single contributor to the CDF contributes no more than 10% of the above suggested value, or no more than 1.0E-05/RY, The application of the safety goal guidance and the objectives of previously resolved USIs, as dir, cussed above, to GI-130 was limited to using them as general guidelines to the decision process described in Chapter 6.
Rigid application of such a quantitative objective to define an absolute requirement was not made.
Since the ESW vulnerability issue is only a fraction of the total contribution to risk due to all causes, the current safety goal guidance that the overall mean frequency of a large release should be less than 1 in 1,000,000 per year is not directly usable to this case.
This is partly because an overall PRA due to all causes was not in the scope of GI-130.
However, consistent with current policy guidance in References 5 and 6, a judgement was made that, in light of the safety goals and available knowledge, the recommendation to backfit selected design and operational improvements to reduce risk due to ESW failures is warranted (Chapter 6).
et 4
l 1
3.
ALTERNATIVE RESOLUTIONS Thers were ?cvaral alternatives considered for the r2Lcletion of Generic Issue 130.
These alternatives are described below.
3.1 Alternative 1 - No Action Under this alternative there would be no new regulatory re quirement s.
Consistent with existing regulations, this alternative does not preclude a licensee, or an applicant for an operating license, from proposing to tne NRC staff design changes intended to enhance the reliability / operability of the Essential Service Water System and its components on a plant-specific basis.
3.2 Alternative 2 - Install Additional Crosstie The ESW systems of the seven multi-unit sites analyzed under GI-130 are cross-connected through pipe connections and isolation valves.
This arrangement allows the operator of one unit to utilire the ESW cooling capacity of the other unit under most circumstances.
In most cases, the crosstie isolation valves can be remotely operated.
A hardware failure to open the isolation valves, should the need arise, could result in adverse conditions.
A parallel cross-connection could reduce the possibility of this kind of failure, and in. addition would allow for more flexible maintenance options.
3.3 Alternative 3 - Provide Electrical Power Cross-Connection In general, the electrical power supplies to the ESW trains are separated and have no cross-connection capability, i.e.,
the Train A ESW pump cannot be powered from electrical Train B (or Diesel B).
This alternative investigated the implamentation of crossties between the electrical trains of the unit with respect to the operation of the two ESW pumps (Trains A and B).
The cross-connection of electrical power supply of other electrical components, such as MOVs was not considered as part of this alternative because of their less significant potential contribution to risk as observed in the operational experience failure data.
3.4 Alternative 4 - Provide Separate Intake Structure The intake structure is usually a single structure divided into separate cays by concrets asile.
There re : nombcr of screens 5
installed to prevent the intake from passing large foreign objects.
The common mode failure of these screens may occur as a loss of the common inlet and/or common water source.
Tha whola intako structure or acreens could be affected by events a,uch as flooding or freezing.
The alternative considered here is a completely separate intake structure and swing pump serving as a redundant intake source of ESW water.
It may be located on the same water source, but in a physically separate location.
An alternate design, which would provide additional independence / diversity, would be to install the additional intake structure on a physically separate water source (e.g.,
pond or lake).
The separate intake structure alternative includes the structure, screens, associated motors, valves and piping.
A swing ESW pump would also be made available to either unit with redundant electrical power supplies.
Common mode failure considerations are assumed to play a primary role in the design and installation of the new structure (such as heated spaces in areas of the country subject to freezing conditions).
3.5 Alternative 5-Modify Technical Specifications (TS)
Requirements In operating modes 5 and 6 (shutdown and refueling, rewpectively), the status of ESW pumps is uncertain because TS typically do not require that the ESW pumps be operational in these shutdown modes.
This alternative partially involves imposing an explicit operability requirement on at least one of the ESW pumps of a unit while in modes 5 and 6 to provide backup for the other unit ESW system.
An additional improvement is the testing of the unit crosstie valves to provide greater assurance of operability, thereby reducing the hardware failure assumptions on the crosstie valves.
Also, this alternative includes additional credit for improvements in emergency procedures for recovering from a LOSW accident.
3.6 Alternative 6 -Provide Independent RCP Seal Coolinc System This alternative provides an independent water supply and distribution system for backup cooling of the RCP seals in case of ESW loss.
Preventing an RCP seal failure and, hence, a small break LOCA would remove a substantial risk contributor associated with this issue.
This alternative is also a consideration in Generic Issue 23, " Reactor Coolant Pump Seal Failures." A proposed resolution for GI-23 has recently been reported (Ref. 7).
An objective of the proposed resolution of GI-23 is to 6
l l
i reduce the probability of seal failure, thus making it a relatively small contributor to total core-damage frequency.
3.7 Alternativo 7 - Cembins Altarnativoa 5 end 6 FC Chaages and Independent RCP Seal Coolina)
Under this alternative, a combination of two or more alternatives discussed above could result in greater risk reduction.
The combination of Alternatives 5 and 6, namely technical specifications (TS) changes regarding limits on taking equipment out of service during shutdown operations, cross-tie testing requirements, and procedures improvement combined with an independent RCP seal cooling system, could be expected to result in a more substantial CDF reduction and still be cost-effective.
7
4.
TECHNICAL FINDINGS The BNL evaluation of failures of ESW system et multi-unit :3te:
included a determination of the initiating frequency of loss of ESW system, core damage frequency due to ESW failure, dose consequence analysis and cost benefit analysis.
The detailed evaluation is found in NUREG/CR-5526 (Ref. 3).
4.1 Core Damage Frequency Analysis The core damage vulnerability caused by the failure of the ESW system may be estimated by developing a full scale PRA model including initiating event frequency categories, event tree and fault tree analysis and incorporation of support system dependencies.
The PRA model was then appropriately modified to reflect various plant operating configurations to analyze the consequences of the loss of ESW function in each operating stato as shown in Table 4.1.1.
To facilitate the present analysis, BNL selected an existing Byron Unit 1 PRA model (Ref 2.) which was previously developed and which examined the ESW system of a single unit (Byron Unit 2 was not operational at the time)
The Byrcn model wan modified by BNL to include the effects of multi-unit configuration, and short term /long-term recovery actions.
Additionally, the probability of RC pump seal LOCA was established based on a more recent pump seal failure model as described in NUREG/CR-4550 (Ref. 8), and incorporated in the present analysis.
l 4.1.1 Initiating Event Frequency The initiating event frequency representing the loss of ESW for multi-unit site operations was derived initially from operational experience for single unit PWR operations.
This LOSW initiating event frequency was then modified, to reflect multi-unit PWR sites.
As the system configuration for various operating states may be different, the respective LOSW initiating event frequency for each of these operating states was determined separately.
An approximation method involving the combination of the experience data with an analytical technique was used.
A multi-unit ESW system fault tree was developed similar to the existing model of Byron Unit 1.
This modified model represents the unavailability of the second unit to supply ESW to the first Unit, given the complete LOSW in the first unit.
The fault tree is provided in Appendix D of Reference 3.
Table 4.1.2 lists the initiating event fraquency for o=ch oparating state.
This fraquency was 8
l 1
~~
calculated on the basis of the operational experience reflected by the base initiator, and then multiplied by a modifier corresponding to tne respective operating states of the two unit.'
durived fres c fault thrac analysis (r.e f. 3).
4.1.2 ESW System and RCP Seal LOCA Recovery The event tree established in Reference 2 indicated that the small LOCA due to RC pump seal failure and AFW system failure are the dominant accident sequences.
It was decided to use a more recent model for seal LOCA probability.
The RC pump seal failure probabilities are based on the model developed in Reference.8 which provides the probability of a seal leakage as a function of the leak rate and elapsed time after the loss of seal cooling.
A simplified recovery model was also developed by BNL in Reference 3 for the sequences relative to the failure of the ESW system.
The recovery model consists of a number of recovery factors which are established based on the particular failure mode and the time available.
Operating experience data bases regarding ESW systems consisting moatly of LER submittals were searched by BNL and, as also confirmed by NUREG-1275 (Ref. 4), the ESW system failure duratien has varied from less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to a few days before ESW system recovery.
The data suggest that there are approximately three characteristic time periods of system recovery.
The first time s
period involves ESW failures which may be recovered within one hour and consists of a large fraction of the ESW events (approximately 70% of the total).
The second time period involving more problematical hardware or other failures, extends up to 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
About 90-96% of all events may be recovered in this time.
The last group of events are such that recovery may take a relatively long time and generally involve the most serious hardware problems.
It is estimated that by the end of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> only about 1% of the events were not recovered.
4.1.3 Relative Time Fractions Since the average time of operation varies with different operating configurations, it is necessary to estimate the relative time fractions for each operating mode.
The relative time fractions essentially represent the average length of time period of the specific multi-unit operating state coupled with the arrangement of the ESW Systems.
Maintenance or test-related outage time of ESW equipment must also be accounted for in the systom's average tims fraction The ECW flow requirament mar be 9
(
i l
9 l
satisfied through the unit crossties utilizing the ESW pumps of i
the other unit.
Based on discussions with utilities, it was
)
assumnd that *be crossties are used about 10% of the Lim c: ring the shutdown period.
The most dominant time fraction is that of the power operating arrangement, i.e.,
both units at power and one ESW train of each unit running with the other in standby.
4.1.4 Core Damage Frequency For each of the operating states a conditional core damage probability (CDP) was calculated by renormalizing the original base case with the respective configuration-dependent initiating frequency and weighting the state-dependent initiating event f requency.
The total CDP may be expressed as:
CDP = l 1 (state)* P (Sequence)
- RT i
3 i
i Where l is the state-dependent initiating event frequency given i
that the unit is in this state for the full year, and RT, is the relative time fraction of the ith state while P is the ith i
sequence probability.
The dominant sequence conditional core damage probabilities are summarized in Table 4.1.1.
The sum of all the sequences during power operation results in P (power operation) = 1.03E-01 which reflects the conditional probability of core damage given a complete loss of ESW during power operations.
The corresponding value for shutdown is P (shutdown) = 2.82E-02.
The most dominant contributor for all sequences, including shutdown, is the RCP seal LOCA; P (Seal LOCA) = 6.8E-02, which is approximately 65% of P (power operation).
The core damage frequencies due to various accident sequences are summarized in Tables 4.1.2, and 4.1.3.
The most dominant sequence is the RCP seal LOCA: CDF (Seal LOCA) = 8.8E-05 per reactor year, which is about 60% of the total CDF due to ESW loss of 1.5E-04 per reactor-year.
The total CDF due to loss of ESW (1.5E-04 per reactor-year) is judged to be substantial compared to the total due to all causes (typically in a range of about 1.0E-4 to 2.0E-4 per reactor-year).
The next section presents the results of an examination of different alternatives which could lower this core damage frequency.
10
4.1.5 Effects of Potential Improvements on Core Damage Frequency The potential alternatives for improvements we're initially selected in NUREG/CR-5526 (Ref. 3) by considering (a) the dominant failure modes of the ESW system (listed in Table 4.1.4) and (b) the dominant accident sequences contributing to the relatively high CDF.
Since there is no single dominant failure mechanism represented in the initiating event frequency, a number of different options were considered including combinations of particular failure modes to reduce the initiating LOSW frequency.
The failure modes indicated in Table 4.1.4 r.ro based on actual operating experience.
The base case initiating event frequency was modified to take into account the effects of the particular alternative under consideration.
First, the fraction of the initiating event frequency that could be improved by each alternative under consideration was determined using the data listed in Table 4.1.8.
Second, the relative change in the ESW system reliability with and without the improvement provides an indication of the potential reduction in the core damage frequency.
Fault tree analyses which included tae logic modules and/or additional component failure rates that represent the proposed modification were employed to estimate the total system unavailability.
The reliability analyses of the improvements were performed for each state or plant configuration, resulting in a calculation of configuration-dependent initiating event frequencies.
As noted in Section 3, the following potential improvements were analyzed regarding their capability to provide a cost-effective reduction in risk due to a LOSW event:
o Additional Crosstie - Reducing the possibility of the malfunction of the cross-connection between units.
o Electrical Power Cross-Connection-Increasing the redundancy of the electrical power supplies to ESW
- pumps, 11
o Separate Intake Structure or Bay with an Additiou.1 Swing E3W Pump - 14.cze dug 1.he redundancy of the ultimate he9t sink or source of cooling and increasing the availability of the ESW pumps.
o Changing Technical Specification requirements and emergency procedures.
o Installation of an independent RCP seal cooling system.
o Combination of RCP seal cooling system and Technical Specifications / Procedures changes.
The first three alternatives were selected based on considerations regarding the ESW failure mechanisms observed in the PWR operating history data base.
A particular operating mode when both ESW pumps of the shut down plant are inoperable (State IId and h) is a concern since there are no_ explicit Technical Specifications requirements on the ESW system in this operating mode.
Therefore, the alternative of imposing additional TS requirements was also analyzed regarding their effect on CDF reduction potential.
This alternative also considers additional credit for unit crosstie testing and amergency procedures.
The most dominant contribution to the CDF arises from the failure of the RCP seal upon loss of seal cooling due to the unavailability of the ESW.
Therefore, the installation of an independent RCP seal cooling system which would cool the seals in the event of loss of ESW was also evaluated as a potential improvement.
The results are summarized in Table 4.1.5.
i l
12
Table 4.1.1 Operational Status of Multi-Unit Sites Unit 1 Unit 2 Site's ESW Pump ESW Pump Status Unit 1 1
2 Unit 2 1
2 Ia OP R
AOT OF R
AOT.
Ib OP R
AOT OP R
SB Ic OP R
SB OF R
ACT Id OP R
SB OP R
SB iia OP R
AOT DN R
AOT iib OP R
ACT DN R
SB IIc OP R
AOT DN M
M IIe OP R
SB DN R
AOT IIf OP R
SB DN R
SB IIg OP R
SB DN M
M IIIa DN R
AOT OP R
AOT IIIb DN R
ACT OP R
SB-IIIc DN R
SB OP R
ACT IIId DN R
SB OP R
SB IVa DN R
AOT DN R
ACT IVb DN R
ACT DN R
SB ivc DN R
ACT DN SB M IVd DN R
ACT DN M
M IVe DN R
SB DN R
SB IVf DN R
SB DN R
ACT IVg DN R
SB DN M
M OP = Operating.
DN = Shutdown.
R = Pump running.
SB = Pump in standby.
AOT = Pump in test (allowable outage time).
M = Maintenance.
13
4 Table 4.1.2 State Dupeudent. LOSW Initiating Event Frequenclos ESW Unit Initiating States Event Unit 1 Unit 2 Frequency /
Pumps Pumps Reactor-Year I - Unit 1-Up/2-Up R/AOT R/AOT 1.6E-01 R/SB 1.4E-02 R/SB R/AOT 1.2E-02 R/SB 1.1E-03 II - Unit 1-Up/2 Down R/AOT R/AOT 1.2E-02 R/SB 1.1E-02 SB/M 1.4E-02 M/M 1.6E-01 R/SB R/AOT 9.7E-04 R/SB 8.9E-04 SB/M 1.1E-03 M/M 1.2E-02 III - Unit 1-Down/2-Up R/AOT R/AOT 2.3E-02 R/SB 2.1E-02 R/SB R/AOT 2.6E-02 R/SB 2.3E-03 IV - Unit 1-Down/2-Down R/AOT R/AOT 2.3E-02 R/SB 2.1E-02 SB/M 2.6E-02 M/M 2.9E-01 R/SB R/AOT 2.6E-03 R/SB 2.3E-03 SB/M 2.9E-03 M/M 3.2E-01 14
-. _ = -.
Table 4.1.3 Sequence Conditional Core Damage Probabilities
'I Sequences Conditional Core Damage Probability Power Operations RCP Seal LOCA - P (Seal LOCA) 6.8E-02 i
Auxiliary Feedwater - P 2.3E-02 m
Long Term AFW - P.
9.1E-03 Other Sequences - P 3.2E-03 o,
Total - P(Operation) 1.03E-01 Shutdown - P(Shutdown) 2.82E-02 1
i l
l 1
1 l
i 15 i
1 l
1
Table 4.1.4 Core Damage Frequency Due to Individual Sequences
~
Initiating Event Core Damage Frequency Sequenca Frequency Sequences A*RT Probability-P CDF/R-YR Seal LOCA - P (SL) 1.3E-03 6.8E-02 8.8E-05 AFW - P,,
1.3E-03 2.3E-02 3.0E-05 Long Term - P 1.3E-03 9.1E-03 1.2E-05 m,
Other - P 1.3E-03 3.2E-03 4.2E-06
- m.,
Total Power Operation
- P (Power Operation) 1.3E-03 1.03E-01 1.3E-04 Shutdown - P (Shutdown) 7.1E-04 2.82E-02 2.0E-05 TOTAL 1.5E-04 i
i l
)
'}
16
4 Table 4.1.5 Core Dara.ge Frequency -- Sumt.1a ry Initiating Sequence Core Damage States Event Frequency Probability Frequency CDF/RYR A*RT P
I + II 1.30E-03 1.03E-01 1.3E-04 III + IV 7.1E-04 2.82E-02 2.0E-05 TOTAL 1.5E-04 17
4 Table 4.1.6 Failuro Mode Classification Relative Contribution Failure Mode to Initiating Frequency Intake structure unavailable 35%
Loss of electrical power supply 35%
Loss of ESW pumps 20%
other 10%
I 1
i j
i i
18
)
i n
Table 4.1.7 CLY Reduction For Alternativos Alternative ACDF 1.
No Action N/A 2.
Additional Crosstie 1.60E-05 3.
Electrical Power Cross Connection 1.4E-05 4.
Separate Intake Structure 9.13E-05 5.
Technical Specifications Modifications and Procedures 2.55E-05 6.
Independent RCP Seal Cooling 7.82E-05 7.
Combination of Alt. 6 + Alt. 5 9.10E-05 19 1
1 l
1 4.2 Dose Consequence Analysis For purposes of this. study, consequences are measured in person-ram and benefits la person-rom averted.
Once the core damage frequency (CDF) and changes in CDF due to a potential resolution alternative have been calculated (Section 4.1), the next step is j
to calculate the corresponding consequences in person-rem, and hence, benefits in person-rem averted.
The reactor safety study (WASH-1400) first attempted to evaluate containment performance for a number of accident sequences.
As part of that attempt a set of radioactive release parameters was developed corresponding to specific containment failure modes.
More recently, the NRC l
has documented in NUREG-1150 a detailed assessment of the risk associated with five nuclear power plants.
This study j
(NUREG-1150) represents the most updated analytical framework for the assessment of containment performance including source terms and off-site consequences.
It was decided to use NUREG-1150 as the basis for the evaluation of the seven two-unit sites of this issue.
A more detailed description of these calculations and their application to this study is given in Reference 3.
The consequence model specific to the Zion site was used as the starting point of the consequence assessment of the seven sites of this issue because of the availability of its detailed i
modeling and evaluation in the NUREG-1150 effort.
The multi-unit i
sites evaluated in the GI-130 study would be expected to prcduce average consequences smaller than those calculated for the Zion site because of their location and respective population densities within their evacuation zones.
For this reason, adjustments were made to the Zion consequences as discussed in
{
detail in Reference 3, and summarized in the following paragraph.
A comparisen of the Zion-based results was made with those of the Surry and Sequoyah plants, and it was concluded that the consequences of an ESW induced core-damage at a large, dry containment plant, typical of the GI-130 plants, to be 47% of the total consequences for Zion, or 8.0E+06 person-rem.
It should be noted that this is for power operation only and without taking containment systems recovery into consideration.
When recovery actions are taken into consideration this number is modified to 5.5E+06 person-rem.
A calculation of the consequences associated with shutdown operations was also performed.
While the use of power operation-release categories for consequence calculations at shutdown may appear to overestimate consequences, Reference 3 indicates that the person-rem consequences are relatively insensitiva to the 20
l 1
source term.
This is because of interdiction criteria and because of the relatively high contribution of long-lived isotopes lo the long' berm dose.
The total consequences for i
ehutdown oparaticn; wert calculated in NURE3/Cx-col 6 (Ref. 3) to be 3.1E+06 person-rem.
Hence, the overall benefit for each alternative considered in terms of averted consequences in person-rem may be estimated by multiplying the power consequences with the power ACDF and the shutdown consequences with the shutdown ACDF, adding the two products and multiplying by 30 years, the assumed lifetime of the average GI-130 plant.
Hence:
Total Benefit = 30 X ( ACDF,,,, X 5. 5E+0 6 + ACDF X
3.1. E+ 0 6 )
Table 4.2.1 shows the benefits (or consequences reduction) in person-rem that was calculated for each proposed alternative.
i i
l l
21
=
Table 4.2.1 Benefits of Proposed Alternatives (Pe rson-Rem)
Alternative Low Best High Estimate Estimate Estimate 1.
No Action 2.
Additional Crosstie 739 2,635 4,951 3.
Electrical Cross-Connection 645 2,349 4,467 4.
Separate Intake Structure 3,992 14,324 27,004 5.
Technical Specifications Modifications 1,150 4,141 7,825 6.
Independent RCP Seal Cooling 3,510 12,870 24,570 7.
Combination of Alternatives 6 and 5 4,063 14,821 28,211 22
4.3 Cost Analysis To csiculate-cost: foi the various alturnativ. L ;kfits, arteral-sources:were consulted (Ref. 3).
Some cost wetimates were derived from an NRC-sponsored research report (Ref. 9)
Another l
source was the computer printout for the Energy Economic Data Base (EEDB) and supporting documents (Ref. 10).
Still another source was various discussions with utilities.
An initial overall assumption was that the backfits can be accomplished outside of the critical path.
Consultation with utility personnel confirmed that this should be possible.
Otherwise, the direct costs will rise substantially, at the rate of $400K for each day that replacement power is needed.
For each resolution alternative, the costs noted in Subsections 4.3.1-4.3.7 were considered.
4.3.1 Direct Costs This cost category includes factory purchases, installation and onsite labor and materials, but excludes indirect costs (e.g.,
engineering, administrative, etc.).
It is given in the first column of Table 4.3.1 as a best estimate.
Table 4.3.2 shows the best estimate and the range of estimates in the direct cost.
Alternative 5 (technical specification modifications including proceduros and crosstie testing) shows a zero in the direct cost because this item was already included in Column 4 (technical specification costs) of Table 4.3.1.
4.3.2 Indirect Costs The indirect costs are usually a certain fraction of the direct cost.
As recommended in NUREG/CR-4627 (Ref. 9), 30% was used (the range is from 25% to 33% for engineering and quality assurance costs for in-place structures).
Column 2 of Table 4.3.1 includes this cost component.
4.3.3 Operatino and Maintenance Costs Usually, these costs annually equal 3% of total " overnight" costs.
Overnight costs represent the sum of total direct and indirect costs assuming that the modification was completed overnight (e. g., excluding the time costs of capital).
To arrive at the total operating and maintenance (O&M) cost, the annual value was integrated and discounted over the rconining plant.11t*
23
P (30 years).
Alternative 5 (modify Technical Specifications) was assumed not to involve any O&M costs.
Column 3 of Table 4.3.1 include: this coet component.
In calculating CJi! cocta, a ! por cent discount rate.was assuned,.consistant with the NRC recommended practice.
4.3.4 Technical Specifications Costs t
Each alternative involves modifying technical specifications to a certain extent. According to NUREG/CR-4627 (Ref. 9), these costs are $18K per reactor for a simple case and $35K per reactor for a complicated or controversial one.
It was assumed that each alternative will result in a simple technical specification change.
Neither choice includes the cost of a public hearing.
The fourth column of costs in Table 4.3.1' includes this component of cost.
4.3.5 NRC Costs NRC costs include the development and implamentation costs.
The development costs should be about $11K/ reactor for a simple case and $21K/ reactor for a complicated one.
Neither case includes the cost of a public hearing.
The former figure was chosen here.
Operating costs would be incurred after the resolution's implementation and they would cover ensuring compliance with the new requirements. The operating costs have to be integrated and discounted, since they are recurring.
The Emplementation and operating costs were estimated at $50K per reactor.
Total NRC costs would then be $11K + 50K = $61K per reactor.
Column 5 of Table 4.3.1 includes the NRC costs.
For a technical specification and procedures change, the total NRC costs would be
$21K per reactor (Ref. 9) 4.3.6 Averted onsite Costs Averted onsite costs are taken into account as cost offsets (Table 4.3.3) to the calculated cost of the proposed resolution alternatives, consistent with NRC policy.
Table 4.3.4 lists the averted consequences.
It can be seen that the onsite personnel exposure per accident will be low, compared to the offsite exposure, and other onsite consequences, so this component was not considered further.
The numbers are from NUREG/CR-3568 (Ref. 11) as best estimate numbers.
Averted onsite exposure would be added to the offsite person-rem exposure as part of the-benefits, but the effect is negligibly small.
For cleanup and replacement power, the integrated and discounted costs is then 24
l i
C multiplied by the ACDF to arrive at the offset cost of each alternative.
The cleanup and replacement power costs were calculated as follows:
u=
(C, + C,) l_ (1 -e'* ) (1 - o")
(nur. 11).
r' where: u = integrated and discounted cost C, = cost of cleanup ($100M/yr)
C, = cost of replacament power ($400K/ day) r = discount rate (0.05/yr)
At = remaining plant life (30 yr) m = duration of cleanup / power replacement (10 yr)
Table 4.3.1 shows components of the total cost and the net cost for the best estimate case (the costs are per reactor).
The net cost is the total cost minus the cost offset (from Table 4.3.3).
If the not cost is negative, the alternative is cost-beneficial regardless of the cost benefit ratio.
It should be noted that each column in Table 4.3.1 subsumes the cost item in the previous column and includes an additional indicated cost component.
For instance, column " include indirect cost" includes the direct cost and tha indirect costs of an alternative.
4.3 7 Range of cost Estimates Table 4.3.5 presents the range of estimates obtained for the total cost (corresponding to Column 5 of Table 4.3.1) and the not cost (corresponding to Column 6 of Table 4.3.1).
The low values were calculated by taking the lowest estimates in the data of various cost components (mainly direct costs)- and carrying the computation through to the final number.
The high values were calculated by taking the highest estimates in the data of the various cost components and carrying the computation though to the final number.
Table 4.3.1 B6st Estimate Costs of Proposed Alternatives, ($ Per Reactor)
Column Number 1
~
l' T'
5 6
~~
2 Include Include Onsite Include NRC Conseq.
Include Include Tech.
Cost-Offset Direct Indirect OEM Spec.
Total Net Alternatives Cost Cost Cost Cost Cost Cost 1.
No Action 2.
Additional Crosstie
$557K
$724K
$1.05M
$1.08M
$1.14M
$627K 3.
Electrical Cross-Connection
$50K
$65K
$94K
$128K
$189K -$246K 4
Separate Intake Structure
$29M
$38M
$55M
$55M
$55.1M $52.3M 5.
Technical Spec.
Modifications
$0
$0
$0
$83K
$104K
-$684K 6.
High Pressure Pump t'or RCP Seals
$5.9M
$7.7M
$11M
$11M
$11.1M
$8.8M 6a. Firewater for Thermal Barrier Cooling
$200K
$260K
$378K
$412K
$473K
-$1.9M 26
i Table 4.3.2 t
Direct Cost Estimates ($ Per Reactor) 3.ltarnat3"es I,o w tses t tetitnato liigh E st. int t e
?stimth '
1.
No Action 2.
Additional Crosstie 250K 557K IM 3.
Electrical Cross-Connection 50K 50K 50K 4.
Separate Intake Structure 7M 29M 38M 5.
Technical Specifications Modifications (see text) 0 0
0 6.
High Pressure Pump for RCP Seals IM 5.9M 15M 6a.
Firewater for Thermal Barrier Cooling 127K 200K 273K 27 m
Table 4.3.3 Cost Offsets for Proposed Alternatives ($ per Reactor)
.~
Alternatives Cost Offset ($)
1.
No Action 2.
Additional Crosstie 513K 3.
Electrical Cross-Connection 435K 4.
Separate Intake Structure 2.75M 5.
Technical Specifications Modifications 788K 6.
Independent RCP Seal Cooling 2.34M 7.
Combination of Alternatives 5 & 6 2.73M
?
28
4 Table 4.3.4 Onsite Consequences Type Amount Occupational Doses:
-Immediate:
1,000 Person-Rem
-Long Term:
20,000 Person-Rem Total 21,000 Person-Rem x 30 yr x $1,000/p-ram = $6.3E+08 yr Replacament Power
$1.8E+10 yr Cleanup
$1.2E+10 yr Total Onsite Consequences
$3.0E+10 yr*
- This number to be multiplied by A CDF for each alternative 29
e Table 4.3.5 Range of Retimate:S for the Total Cont.ind th(. hl Cost ($)
s Total Cost Net Cost Alternatives Low Best High Low Best High Estimate Estimate Estimate Estimate Estimate Estimate 1.
No Action 2.
Additional Crosstie 550K 1.14M 2M 37K 627K 1.5M 3.
Electrical Cross-Connection 173K 189K 205K
-262K
-246K
-230K 4.
Separate Intake Structure 14H 55.1M 72M
.11M 52.3M 69H 5.
Technical Specifications Modifications 4BK
.104K 171K
-740K
-684K
-617K 6.
High Pressure Pump for RCP Seal Cooling 2M 11.1M 29M 1.2M 8.8M 28.2M 6a. Firewater for Thermal Barrier Cooling 318K 473K 624K
-2M
-1.9M
-1.7M 30
l 5.
VALUE/ IMPACT ANALYSIS l
)
The value/ impact (V/I) methodology in analyzing the various alternatives examinad under this study 19 5=?ad on the requirements of the backfit rule (10 CFR Part Sq.109). and
{
related implementing guidance containad in Rcferences 11, 12, and i
13.
One of the primary considerations here is the derivation of cost / benefit ratios for each alternative evaluated in terms of cost in $ per person-rem averted, which may be compared to a guideline such as $1,000/ person-ram.
This quantitative guideline is one of the elaments considered in the decision-making process.
Deterministic considerations on the merits of a proposed alternative resolution are also a part of the decision with respect to a given alternative (Chapter 6).
In the following sections a description of each alternative and the results of a value/ impact assessment are presented.
Table 5.1 summarizes the results of this assessment for the various alternatives analyzed.
5.1 Alternative 1 - No Action Under this alternative there would be no new regulatory requiraments.
Consistent with existing regulations, this alternative does not preclude a licensee, or an applicant for an operating license, from proposing to the NRC staff design changes intended to enhance the reliability / operability of the Essential Service Water System and its components on a plant-specific basis.
Table 5.1 summarizes the results of this assessment for the various alternative analyzed.
5.2 Alternative 2 - Install Additional Crosstie The ESW systems of the seven multi-u.ait sites analyzed under GI-130 are cross-connected through pipe connections and isolation valves.
This arrangement allows the operator of one unit to utilize the ESW cooling capacity of the other unit.
In most cases, the crosstie isolation valves can be remotely operated.
A hardware failure to open the isolation valves, should the need arise, could result in adverse conditions.
A parallel cross-connection could reduce the possibility of this kind of failure, and in addition would allow for more flexible maintenance options.
The effects of the isolation valve failures on the CDF were not large due to the relatively low observed isolation valve failure rates indicating that other hardware components are more significant in reducing the overall system unavailability.
The core damage frequency reduction of this alternative was estimated to be 1.6 E-05/RY.
31
The cost-benefit ratio for this alternative was calculated to be
$433/ person-rem, or $238/ person-rem taking into account averted onsite costs.
5.3 Alternative 3 - Provida Electrical Pnwar Cross-connection One of the observed contributors to the unavailability of the ESW system is related to the reliability of the electrical power supply and control system.
Based on the data reported in Reference 3, the loss of the electrical power supply due to various causes was relatively high; however, the recovery times associated with these events indicate a relatively faster average recovery observed during losses of the ESW system.
In general, the electrical power supplies to the ESW trains are separated and have no cross-connection capability, i.e.,
Train A ESW pump cannot be powered from electrical Train B.
This alternative therefore investigated the implementation of a cross-connection between the electrical trains of the unit with respect to the operation of the two ESW pumps (Trains A and B).
The cross-connection of electrical power supply of other electrical components, such as MOVs was not considered as part of this alternative because of their less significant potential to rink contribution as observed in the operational data.
It is envisioned that the electrical power cross-connection would be an exclusively manual operation.
However, the possibility of adverse interactions between electrical trains A and B, such as the inadvertent transfer of f aults from one train to the other, and hence, the loss of both trains, make this alternative of questionable value.
Even if this contribution of possible adverse interactions between trains is set aside, the CDF reduction is not significant due to the relatively fast recovery observed during losses of electrical power.
The cost-benefit ratio without taking into account the potential adverse interactions for this alternative was calculated to be
$80/ person-rem, and, if the averted onsite costs are taken inro account, the net cost becomes negative, i.e.
resulting in a not savings.
5.4 Alternative 4 - Provide Separate Intake Structure A review of the failure modes of the intake structure indicates that one of the observed ESW failure mechanisms is the failure of certain intake components (such as travelling screens or strainers).
This type of failure within the intake structure l
produces a general stopping or restricting the flow of cooling water to the plant.
A separate intake structure, either located
?2 t
on the same body of water or using a different water source, would make a backup cooling capability available.
Thr. intake structure is usually a singla stractbr J1;1ded-into separate bays by concrete walls.
There are e nurber nF icranne installed to prevent the intake blockage by large foreign objects.
The collapse or plugging of these screens may occur as a common mode failure due to the common inlet and/or common water source.
The whole intake structure could also be affected by events such as flooding or freezing.
The alternative considered here is a completely separate intake structure serving as a redundant intake source of ESW.
It may be located on the same water source, but on a physically separate location.
An alternate design, which would provide additional independence / diversity, would be to install the additional intake structure on a physically separate water source.
Naturally, there are sites where this would not be feasible.
The separate intake structure alternative includes the structure, screens and the associated motors, valves and piping.
A swing ESW pump would be made available to either unit with redundant electrical power supplies.
This arrangement is intended to reduce the probability of two failure mechanisms; one involving electrical supply failures, and the other involving operating failures of the ESW pumps.
The additional ESW pump would be a swing pump serving either unit dependina on.the current needs of both units.
This combination of a separate intake structure and additional swing pump with redundant electrical power supplies would affect a large fraction of the initiating event frequency related to the failure mechanisms involving the intake, the ESW pumps, and their power supplies.
The calculated reduction in CDF associated with this alternative was 9.13E-05/RY, The respective cost-benefit ratio was calculated to be
$3,847/ person-rem, and $3,651/ person-rem taking 1
into account averted onsite costs.
5.5 Alternative 5 - Modify Technical Specifications Requirements There are certain operating modes, Modes 5 and 6 (shutdown and refueling modes respectively), that were examined with regard to specific requirements in the Technical Specifications (TS).
In these operating modes the reactor is in shutdown condition and the status of its ESW pumps is uncertain.
The TS do not require that any of the ESW pumps be operationa,1 in these modes.
An implicit requirement is imposed on the NSW trains through the 33 I
I
l explicit requirement to operate the RER system to remove decay i
heat.
In sesence, the eparator of the unit in shutdctn' may utilize the unit's own ESW' pumps-to provide the necessary host ramov ?
function, but may just as well decide to use the unit crosaties to supply ESW flow from the other unit.
In the absence of any requirements on the ESW pumps, both pumps could be maintained or made inoperable at the same time.
Although this is not a universal practice, certain modeling assumptions were made based on information gathered from plant sites representing a more conventional practice involving the administrative control of crosstie use, and the ESW pump maintenance schedule.
In the basic analytical model it was assumed that the simultaneous shutdown of both ESW pumps could occur only randomly.
The unavailability of the Unit 2 ESW pumps to provide backup for the Unit 1 ESW system may be reduced by imposing an explicit operability requirement on at least one of the ESW pumps of Unit 2 while the letter is in Modes 5 and 6.
An additional improvement is the testing of the unit-to-unit crosstie valves to provide greater assurance of operability.
Also, this alternative includes additional credit for improvements in emergency procedures for recovering from a LOSW accident.
The resulting CDF calculations indicated that the CDF would be reduced by 2.55E-05/2Y.
The respective cost-benofit ratio for tnis alternative was determined to be $25/ person-ram, and, if the averted onsite costs are taken into account, the net cost becomes negative, i.e. resulting in a not cost savings.
5.6 Alternative 6 - Provide Indeoendent RCP Seal Coolino System The technical findings reported in Chapter 4 and Reference 3 indicate that the major contributor to the ESW-related component of CDF comes from the failure of the RCP seals following a loss of ESW.
Specifically, the RCP seal LOCA sequence contributes about 60% of the total CDF attributable to ESW failures.
proportionately significant reduction in CDF may be achieved.
This alternative provides for a dedicated seal cooling system that would continue to provide heat removal capability after a loss-of-ESW event.
The cooling requirements of the RCP seals are relatively small, and a single small capacity high pressure pump capable of delivering about 50-100 gpm was judged to be sufficient.
The pump may be driven either by an electric motor or, for electrical independence from the point of view of other 34
i I
4 accident scenarios (such as station blackout), a diesel-driven pump option may also be considered.
The single high prasaure pump and diaael vcrid pemrido fler rin the cooling header to the four injection lines (one_to each RCP seal).
It was assumed that the pump and diesel woulo noc laquire auxiliary cooling for the lube oil, bearings, etc., as the suction flow or air cooling would be sufficient to provide all their heat removal requiraments.
It was also assumed that the return flow from the RCP seals would not be recycled.
In other words, a once-through cooling cycle would be used with a sufficient water supply to last about 8-10 hours.
It is assumed that a dedicated tank will be installed, with a capacity satisfying 8-10 hours of seal cooling.
After this time, added cooling could be provided by other available water supplies, such as the refueling water storage tank.
In modeling the system, the following assumptions were made:
1.
single high pressure pump, 50-100 gpm capacity, 2.
dedicated water storage tank with capacity to last at least 8-10 hours, 3.
ac-independent (non-seismic) diesel-driven pump, 4.
no support system cooling required, and 5.
once-through RCP seal heat removal.
Other design alternatives may also be considered utilizing arrangements different from that of the high pressure pump injection.
One less costly alternative would provide flow through the RCP thermal barrier heat exchangers by connecting the firewater system into the CCW lines.
Most firewater systams have one diesel-driven firewater pump which usually is independent of the ESW system.
The CDF reduction for this alternative involving a high pressure seal cooling system was calculated to be 7.82E-05.
The respective cost-benefit ratio for this alternative involving a high pressure seal cooling system was calculated to be
$862/ person-rem, or $684/ person-rem if the averted onsite costs are taken into account.
The cost-benefit ratio for this alternative involving a connection to the fire water systam for thermal barrier cooling was calculated to be $37/ person-ram, or, 05
if the averted onsite costs were taken into account, this alternative would result in a not cost savings.
57 Al terna*-ive 7-Enbino Alteracitives 5 eu tti G W5 Coan_ges ana Independent kco ca?' Coolino)
As shown in Table 5.1, most of the analyzed alternatives have favorable cost-benefic ratios (presented as $/ person-rem).
In these cost-benefit calculations, it was assumed that each of the alternatives (1 through 6a) was utilized individually and independently from the other alternatives.
For the combination case, the CDF reduction is calculated when two alternatives are combined and utilized together to reduce the risk due to the loss of ESW function.
The alternative with the highest ACDF and favorable cost / benefit ratio was ranked first and served as the starting basis point.
This was Alternative 6 (or 6a), the dedicated cooling system for the RCP seals.
When the next alternative was considered, the CDF reduction was calculated from the case where Alternative 6 (or 6a) was already incorpcrated.
The combined CDF reduction resulting from the implementation of alternatives 5 and 6 was calculated to be 9.12 X 10"/RY, and the respective cost-benefit ratio of
$756/ person-rem, or $574/ person-rem with the averted onsite costs taken into account with a RCP seal cooling system involving a high pressure cooling system.
The cost-bonefit ratio for this combination of alternatives with a RCP thermal barrier cooling system utilizing the fire water supply was calculated to be
$39/ person-rem, and if the averted onsite cost were taken into consideration a net gain would be achieved (i.e.,
a negative cost of implementation) 5.8 Unce rtainty Analysis j
This section discusses, the sources and treatment of uncertainty for the GI-130 study.
Uncertainty is expressed as a quantitative bounding of the mean value.
Uncertainty arises due to the I
selection of the data base used to determine parameter values, modeling assumptions, and completeness of the analysis.
{
Although a complete analysis of all data uncertainties was not conducted, uncertainty studies were performed on selected issues that were important to the results.
Uncertainty data were gathered, evaluated, and reported in the form of distributions for these selected issues.
This data-gathering and reduction was j
used to gauge the effects of the individual data uncertainty on the final core damage frequency results of the analysis.
3e
9 The primary areas of uncertainty exist in the determination of the initiating frequency values, modelling and data uncertaintics Each.of thase particular areas wer.e addressed ano the final result combines these issues to presen* the uncsrtainty of the core damage frequency.
All other parameters were treated as point-estimates.
The results of the uncertainty analysis show a mean value of CDF due to LOSW of 1.49E-4 per reactor-year, with a value of 5% and 95% of 3.99E-5/RY and 3.73E-04/RY, respectively.
5.9 Life Extension Considerations The regulatory process by which license renewal may be accomplished is currently under development by the NRC.
It is envisioned that a license renewal for an additional term of 20 years may be achievable based on satisfying specific requirements still to be established.
Hence, for considerations regarding the effect of license renewal on the results of the evaluation of GI-130, a reanalysis of the cost-benefit ratio parameters for each backfit alternative was performed.
The results of this reanalysis show that the benefits will increase by factor of 1.67, while the costs, both incurred and avarted will increase by a factor of about 1.2 for most of the backfit alternatives analyzed.
Table 5.2 summarizes the cost-benefit ratios based on a license renewal of 20 years or a remaining plant life of 50 years.
A comparison of these numbers with those listed in Table 5.1 shows that the cost-benefit ratios for all analyzed backfit alternatives are considerably lower for extended plant life of 50 years vis a vis a plant life of 30 years, corresponding to licenses in force currently.
Even though all alternatives listed in Tables 5.1 and 5.2 become more cost-effective with life extension, Alternative No.
4, Separate Intake Structure, still remains appreciably higher than the $1,000/ person-rem guideline at a cost-benefit ratio of
$2,285/ person-rem.
37
j j
i
.\\
Tabla 5.1 Best Esti. mate Cost-benefit Ratios (S/Pestson-Tem)
Alternatives Total Cost / Benefit Net Cost / Benefit 1.
No Action 2.
Adciitional Crosstie 433 238 3.
Electrical Cross-Connection 80 4.
Separate Intake Structure 3847 3651 5.
Technical Specifications Modifications 25 6.
High Pressure RCP Seal Cooling 862 684 6a. Firewater for Thermal fsarrier Cooling 37 7.
Combination of 6 and 5 756 574 7a. Combination of 6a and 5 39
- Including averted onsite costs results in a not cost savings.
39
Table 5.2 Best Estimate Cost-Benefit Ratios ($/ Person-Ram) for 20-yea r I,icans.c. Linc.tml Alternatives Total Cost /Bansfit Net Cost / Benefit 1.
No Action 2.
Additional Crosstie 271 133 3.
Electrical Cross-Connection 50 4.
Separate Intake Structure 2421 2285 5.
Technical Specifications Modifications 16 6.
High Prosauro RCP Seal Cooling 541 412 6a. Firewater for Thermal Barrier Cooling 23 7.
Combination of (;___and 5 474 343 7a. Combination of 6a and 5 24
- Including averted onsite costs results in a not cost savings.
1 1
1 l
l 39 l
6.
DECISION RATIONALE This generic issue was identified as a consequence of the Byron Unit 1 ova 1xLtion vith rospcet to its vulnerability uv evra-damage sequences in the absence.of a crosstie from the E8W of Unit 2.
This configuration existed because Unit 2 was under construction, and was eventually supplemented by the crosstie between units.
There are fourteen units at seven sites having two service water pumps per unit (one per train) with a sharing of one pump between units via a creasile between them, in a similar manner as currently in the two Byron units.
It was decided to focus the attention of this study on these seven two-unit sites because the design of their ESW system was expected to show the most vulnerable configuration to risk-significant sequences.
The remaining LWRs will be evaluated under GI-153,
" Loss of Essential Service Water in LWRs. "
As discussed in Chapter 5, most of the alternatives for reducing the risk associated with this issue would be cost-effective in meeting the $1,000/ person-rem guideline.
Fu rthe rmore, the objective of the GI-130 resolution is that the risk contributions from loss of the ESW system be reduced consistent with the backfit rule's two basic requirements that the improvement be both a substantial increase in protection, and be cost-effective.
A combination of potential improvements consisting of the installation of a dedicated RCP seal cooling system, and improvaments in Technical Specifications with respect to ESW system operation, including crosstie testing and improvements in procedures, was shown to be capable of reducing the total CDF by 60% (to 6.1E-05/RY) in a cost-effective manner.
Hence, this is deemed to meet the backfit rule.
The overall approach to arriving at the proposed resolution considered both the numerical results of the cost-benefit analysis and the spectrum and type of potential improvements available for potential risk reduction for loss of service water sequences.
From the prevention perspective of a LOSW, it would be desirable to choose those alternatives which could reduce the number of occurrences of the LOSW initiators.
From the mitigation perspective, it would be desirable to choose those alternatives which would help to reduce the consequences of a LOSW.
The proposed resolution (Alternative 7) was selected to achieve some balancing of both these views; that is, the improvements in technical specifications would assist on the prevention side, while the improved emergency procedures and 40
backup seal cooling would provide a blend of both prevention and mitigation capabilities.
Tbc BNL analyeia (Ref. 3) shows that efter irpl9mpntation of Alternative 7 there remains a residual component of CDF of 6.1E-05/RY cue to ESW loss which, on-the race Of it, would tend to indicate the need for additional risk reduction.
We have reviewed this aspect of our evaluation of GI-130 and have concluded that additional improvaments beyond Alternative 7 cannot be justified at this time based on the following considerations:
1.
When the possibility of additional corrective measures (beyond Alternative 7) was considered, the resulting reduction in CDF was either too small (i.e.,
approached diminishing returns), or the cost / benefit ratio too high to be consistent with the backfit rule.
The examination for added corrective measures focused on those systems which are dependent on ESW, and which performed a role in several of the more dominant event sequences.
For example, the alternative of including a recommendation for a design change to make the Auxiliary Feedwater System (AFWS) independent of ESW cooling did produce a modest CDF reduction (ODT was reduced from 6.lE-05/RY to 4.8E-05/RY).
Even further reduction is theoretically possible by removing dependence on ESW of each system and component, one-by-one until virtually complete independence is achieved; this is the ideal maximum reduction in vulnerability to LOSW; however it is judged that going further in this generic, representative plant calculation is pressing the limits of precision beyond what is warranted for plant-specific application to these 14 units.
In addition, such an alternative (AFWS upgrade), would be applicable only to some of the plant sites evaluated under this issue; three of the seven sites are known to have already AFW systems independent of ESW cooling.
In another case, Alternative 4, involving the installation of a separate intake structure and a swing pump to be shared by the two units, was determined to be capable of providing a substantial risk reduction, but was estimated to be not cost-effective.
Al
........ ~_
1 I
~,
2.
As part of-the implementation phase of resolving-this issue, we recommend that the licensees /
~
applicants of the fourteen plants evaluated under GI-100 per*orm a roview of their racpcetivo plar t-
,, specific designs vis-a-vis the' recommendations of Alternative 7, (combination of Alternatives 5 and
- 6 as discussed earlier in this chapter and in Chapter 5) and report, pursuant to 10 CFR 50.54 (f), whether and how these recommendations would be implamented.
'This licensee / applicant effort would take into consideration the existing plant-specific design features, which, in some cases, would be different from those assumed in the generic model used in the evaluation of this issue.
Hence, as a result of this effort, it is expected that individual licensees / applicants will submit a description of the measures taken as a result of the resolution of this generic issue, considering producing'at least a comparable CDF reduction as has been calculated for the Alternative 7 combination in the GI-130 generic calculations.
The results of some plant-specific PRA evaluations reported by EPRI in.leference 14 supports the view that plant-specific designs incorporating features recommended by the resolution of this generic-issue would result in significant reductions in CDF.
For some plants, the licensee or applicant may find it desirable or necessary to propose other design features, such as providing AFWS cooling independent of ESW, to improve on the assurance that the risk due to loss of ESW will result in a small fraction of the total risk for their individual plants.
3 3.
A number of generic safety issues related to GI-130 have been in various stages of resolution, including some that have already been resolved.
Their impact on GI-130 is as follows:
o GI-23, " Reactor Coolant Pump Seal
~
Failures" - This generic safety issue addresses the same possible improvaments as Alternative 6 and, in part, Alternative 7 of GI-130.
The evaluation of GI-23 has been completed and a 42 s.c y;-
e 9 ~.,
a proposed resolution has been reported (Ref. 7) an e5jective of the proposed rcec19 tic: Of GI-23 is to reduce the risk of severe assoc'ated with RCP seal failure by accicents i
reducing the probability of seal failure, thus making it a relatively small contributor to total core-damage frequency.
The proposed means of doing so entail the installation of a separate and independent cooling system for the RCP seals.
Hence, implamentation of the proposed GI-23 resolution could provide a substantial portion of the proposed GI-130 resolution.
As such, the proposed resolution of GI-130 will be coordinated with the resolution of GI-23.
o GI-51, " Improving the Reliability of Open-Cycle Service Water Systams" - The resolution of this generic safety issue has been reported in August 1989 (Ref.
- 15) and its implementation began with the issuance of Generic Letter 89-13 (Ref. 16), and Supplement 1 (Ref. 17)
The GI-51 implementation entails the implamentation of a series of su rveillance, control and test recommendations to ensure that the ESW systems of all nuclear power plants meet applicable licensing guidelines.
During the review of the operational experience data for GI-130, credit was taken for corrective measures as a result of the GI-51 resolution by excluding those events that involved fouling of the ESW (sediment, biofouling, corrosion, etc.).
Hence, there is no direct impact of GI-51 on GI-130.
o GI-153, " Loss of Essential Service Water in LWRs" is under prioritization review and expected to be assigned NRC staff resources (Ref. 18) for its resolution.
Its purpose is to assess this issue for all LWRs not already covered by GI-130.
Insights gained by the evaluation of 43
r l
generic safety issue 153 are expected to i
be useful in confirming and/or supplementing the technical findings of n7 1_?O.
On tne basis of tne considerations ciscussed in Itams 1-3 above and the technical findings of this study, including the value/ impact analysis of Chapter 5, it is concluded that the combination of Alternatives 5 and 6, namely, the augmentation of technical specifications and procedures along with the installation of an independent RCP seal cooling backup system are the appropriate risk reduction measures that are recommended.
These measures provide a substantial increase in overall protection of the public health and safety, and are cost-effective.
Of interest to the decision process on this generic issue are the insights and views available in related PRA documentation in the open literature.
Although still not finalized, the preliminary PRA work available in NUREG-ll50, " Severe Accidents Risks: An Assessment for Five U.S. Nuclear Power Plants" (plus supporting documentation) is a source of extensive risk analyses information one might turn to for an understanding of ESW vulnerabilities.
An examination of the NU1:EG-ll50 documentation of the three PWRs that were studied indicates that the analyst considered that the ESW redundancy for two of the three PWRs was large enough that a complete loss of ESW as an event-initiator was deemed not credible (eight pumps available in Sequoyah, Unit 1).
None of the five plants in the NUREG-1150 study is a GI-130 plant; however, it is worthwhile to note that one of the PWRs (Zion) identified the service water contribution to risk to be substantial (approximately 1.5E-4/RY).
This contribution for Zion was approximately 42% of the total core damage frequency due to all causes.
Another PRA work available in the open literature is NSAC--148,
" Service Water Systems and Nuclear Plant Safety," dated May 1990.
Although it is only a compilation of earlier PRA results for six plants performed by the industry, it is useful to note that a greater appreciation of the service water system's contribution to plant risk has moved the industry to initiate a program to improve service water performance.
The limited guidance available in NSAC-148 is a step in the right direction.
The wide range of core damage frequencies (due to LOSW) over the six plants studied suggests large variability in plant-specific ESW configurations.
The average CDF due to LOSW for the six plants was 6.55E-05/RY, with a range of 2.33E-04/RY-to " negligible" As
a e
contribution.
While many details of these six PRAs are not included in NSAC-148 and, therefore, must be considered to be used only with a great caution, the overall message that the service water syrtor. providas an i:npercunt sefaly - f aaction wnich could be a substantial contributor to overall p)*nt risk tends to lend added credence to the GI-130 conclusions.
1 4
)
i l
a
- e 7.
IMPLEMENTATION The staff proposom to impiscent the roselutien of Cer.;ric Iseue-130 by issuing a generic.. letter, under 10 CFR 50. 54 (f), to.tha..
'llcenses and applicants of the fourteen plants involved in this
~
evaluatica.
The content of the generic letter will address both the preventive and mitigative aspects of the proposed resolution as discussed in Chapter 6.
The implementation phase of Generic Issue 130 will be closely coordinated with that of Generic Issue 23, which deals with the RCP seal reliability for both normal operation and accident conditions.
i 46
f:-
A
's 8.
REFERENCES 1.
Memorandtim from T.
P.
Speis te H.
I..
Thotreon, "S=fety Evaluation Report Related to the LCO Re, laxation Program for the Dyreti Generating Statida., " January 15, 1986.
~
2.
- Cho, N.
Z.
et al.,
" Analysis of Allowed Outage Times at the Byron Generating Station," NUREG/CR-4404, June 1986.
3.
P.
Kohut, et al.,
" Analysis of Risk Reduction Measures Applied to Shared Essential Service Water Systems at Multi-unit Sites," NUREG/CR-5526, BNL, June 1990.
4.
- Lam, P.
et al.,
" Operating Experience Feedback Report -
Service Water System Failure and Degradation", NUREG-1275, Volume 3, November 1988.
5.
U.S. Nuclear Regulatory Commission Report, 10 CFR Part 50,
" Safety Goals for the Operations of Nuclear Power Plant,"
Policy Statement, dated August, 1986.
6.
Memorandum from Edward L. Jordan (CRGR) to Eric S.
Beckjord (RES) " Implementation of the Safety Goals,"
September 6, 1990.
7.
Memorandum from C.
J.
Heltamos, Jr. to.F.
P.
Gillespie, et al.,
" Proposed Resolution of GI-23, " Reactor Coolant Pump Seal Failures," June 20, 1990.
8.
" Analysis of Core Damage Frequency from Internal Events:
Expert Judgement Elicitation, " NUREG/CR-4550, Volume 2, April 1989.
9.
E.
Claiborno et al.,
" Generic Cost Estimates," NUREG/CR-4627, Rev.
1, Science Engineering Associates, February 1989.
10.
" Complete CONCISE Printout for Model 148-PWR-ME (A3-ME)
Energy Economic Date Base (EEDB) Phase IX Update," volume 2 of 9, Plant Set 2 of 3, 7697.900, DOE Report 871102, (Philadelphia, PA; Oak Ridge, TN; United Enginners and Constructors, Inc.), 1987.
11.
S.
W.
Heaberlin et al., "A Handbook for Value-Impact Assessment, NUREG/CR-3568, PNL, December 1983.
47
r~
A 1
12.
Memorandum from E.
S. Beckjord to D[stribution, RES Office Letter No.
2,
" Procedures for Obtaining Regulatory Impact Analysia m in
- .nd Support,
Ucmh. -10, - 1000 ;
- ~ - - -
13.
Memorandum from E.
S..
Beckjord to Distribution, RES Orfice Letter No.
3, " Procedure and Guidance for the Resolution of Generic Issues", May 10, 1988.
14.
" Service Water Systems and Nuclear' Plant Safety" NSAC/148, May 1990, prepared by Pickard, Lowe and Garrick, Inc. for Nuclear Safety Analysis Center and Electric Power Research Institute, 15.
Memorandum from E.
S.
Beckjord to J.
M.
Taylor, " Closeout of GI-51, " Improving the Reliability of Open-Cycle Service Water System'", August 10, 1989.
16.
Generic Letter 89-13, " Service water System Problems Af fecting Safety-Related Equipment", JulyE18, 1989.
17.
Generic Letter 89-13, Supplement 1,
" Service Water System problems Affecting Safety-Related Equipment", April 4, 1990.
18.
Mcmorandum from K.
Kniel to C.
E. Ader, " Request for Prioritization of New Generic Safety Issue. ' Loss of Essential Service Water in LWRs', " May 2, 1990.
m m
43 A :.
ocO-2 30 nE wca
- e ec-=Esi+:+m TEL e m 252 2 2
- 243 co2 f **%q t
["
j UNITED STATES
~,
l NUCLEAR REGULATORY COMMISSION f
wAmmorou o. c. 2osss
%..s/
u
= = =. -
MEHORANDUM FOR:
Edward L. Jordan, Chairman Committee to Review Generic Requirements FROM:
Joseph A. Hurphy, Deputy Director Division of Systems Research Office of Nuclear Regulatory Research
SUBJECT:
THOUGHTS ON THE BACKFIT RULE 50.1 POLICY STATEMENT The remaining discussions on GI-23 will of necessity f Because these interactions are complex and this is a ety Goals.
CRGR is explicitly considering the Safety Goals, I offer some to the CRGR.
rst instance that general thoughts 50.109(a)(3) requires that "... there is a substantial incre protection of the public health and safety or the comon defease in the ov to be derived from the backfit and that the direct nse and security rect costs of protection."
ncreased 50.109(c)(3) recuires consideration of the "(p)otential ch the public from the acc1 dental off-site release of radi ange in the risk to oactive material."
We have traditionally implemented this using a critorion of $1000 and this approach has been approved by the Commission.
nothing in 50.109 wnich recuires use of $1000/ person-rem a factor.
there is i
rminative The Comission's Safety Goals may shed an interesting light o
\\
There are two Quantitative Health Objectives in the Comission' n our approach.
Statement - one dealing with early fatality risk, and one dealin s Policy cancer fatality risk.
on the probability of a larger release for further studyThe Co with latent Safety Goal Implementation also essent The June 15 SRM on relative to the core damage frequency ially establishes a subsidiary goal The standard practice of performing cost-banafit aralysa a criterion can ba related alm using personirem as 1
Health Obiective (i.e., psr, son ost directly, to the latent cancer Quantitative i
rem can, i cancer fatalities).
This means, however,n general, be equated to latent be significant because NUREG-1150 clearly shows that oals.
This could the easiest of the Comission's Safety Goals to meet e latent cancer QHO is f4f4f/4/5 /ff
//7I~ 3 7D EHC Z-fg.wqneWe b W
r~'~~ ',
._..a
\\
xm NN t 6 LgW This suggests that we may need to expand the criteria include something that can be related to the other OHO and goals.
These could be in the form of damage fremiency reductM and (3) 5/incre(ment ia 1
e subsidiary
, (2) 3/ increment of cor,e of a large release.
The.v&a used shuuld be co. reductica. !m the frequency.
n the June 15 S#1, incentive for additional requirementsi.e., at the Safety Goal value core damage and large reconcept of risk aversion implicit in the e
calculated consequences. lease frequencies should be low, w suggests that the This on the order of $5,000/ person, rem or largerin turn, would suggest that we rem and perhaps $1,000,000 frequency, with a similar value appormoreper1x10~ghenthedoser early containment failure frequency.licable to a lx10-6per year decrea (Humbers are illustrative only.)per year re With regard to the direct application of the Saf tis SECY-89-102 dated June 15, 1990.
Note the following from p.6 of the SRM:a em that is referred to as ' adequate protection'"These of safety must be assured without regard to cost and, thusThis is the level that procedures required b
, without invoking the adeouate protection, y the Backfit Rule. (footnote safety, costs must be considered, and the cost-benefit a Beyond by the Backfit Rule must be performed nalysis required hand, are silent on the issue of cost but do orovideThe Safety G
!how safe is safe enouch' that should be seen a definition of go when oreo3sino saf_ety enhancements n how far to under the Backfit Rule (emphasis added)". includino thgIdLto be considered s
I interpret the guidance as follows:
The determination of adequate protection is a adequate protection, if the NRC decides to conside e regulations. Beyond costs must be considered, and the cost-benefit analysis ren anceme Backfit Rule must be performed.
quired by the cost benefit space, i.e., if you meet the Safety GoalsThe Safety Goals pro caveats relative to the robustness of the analysis), no(additio and can satisfy other is acceptable, regardless of the value-impact analysis the de mininil line for value impact analyses on a gi a requirement Thus, it appears that either directly at the Safety Goal ven issue should be set 2), to satisfy the philosophy expre,ssed by the Com ior only slightly belo m ssion.
One possible interpretation is to apply the Quantit t (and, presumably, the subsidiary core damage a ive Health Objectives plants.
without the modified 7egulation, no changPUnless it appear objective to the panoply of benefit analysis would be required. potential for exceeding the sa iS TCQuirGd.
e Safety Goals If an issue has the s
ng plant or plants, cost-Such an rpp mach would not be greatly out
(
~
of line' tith how 'many of the existing regulations (e g A to Part 50) were established, albeit we approached the.., the GDCs in in the Sixties).
problem qualitatively the desired level of safety - an inritettion cf % arTo an protestien-cf-new issues arise, ear.7ine the boundary conditiontard ass"cpti ns e is safe enough". As.
existing population of +, sabilistic' studies to' see if these issue a
o C_tM~.T
~~
doeauately treateti and the Safety Goals met.
s had been dropped after consideration of the potential impact of plant toIf s differences.
the level of safety envisioned by the Safety Goals wh
-plant design conditions were expanded and assumptions modified.
oundary recomend we attempt to do this QUALITATIVELY, not quantitativelT should be to identify regulatory gaps that could potentially "
y.
The effort fill those gaps; not to engage in endless "numoers" exercises
, and to The reasons for de-emphasizing " numbers" are obvious quantitatively are very low numbers.
The safety goals difference between calculated severe core damage frequencie IE.7 per year - they all mean that we believe the real frequen
-6, IE-6, or given the constraints of our analytical techniques.
s very low, made for low risk values (early or latent fatalities A similar argument can be Further, the uncertainties are large.
or population doses).
(Theperson-re,mgerstationblackout least a two order of magnitude spread between distribution.
what our curre)nt knowledge base suggests might be es of the investigating the impacts of changes in that knowledge base i
, and guide us in Thus, qualitative judgements, supported by quantitative analyse n a crude manner.
emphasized to the extent feasible and realistic.
, should be This approach would be difficult to codify and difficult for both staff to implement, but has the advantage of being consisten and the of the art.
e
/
Joseph A. Murphy, Den ty Director Division of Systems Research Office of Nuclear Regulatory Research
~
C...
9 MQuo1RH Safety Goal Analysis Core Damage Frequency 0.0003 I
Greater than 10f-dhhich!nriodtv Enst-ben ef Qfjk likely_
3
'N 0 0001
\\\\ \\ \\.N\\
l\\\\
/
!j',;'['// f,/
study. closer; diay l' eave justified ba'ckf}ts
/
! l', /' j' l-/ //,
med um to lop priority issues n l jl )'l
- / 7' g
r l
l i
I i
l:
I 1 E-05 i
i "S' afe2one" per 1150/ / k NLi6e of constant ridk j
)3
/,/,. ! j'/
urr(nt safety goals met
/
C
/
x '[
//
/
g 3E-06 with rriargin.
j
% g 't
! ' j.
j/ / / /, j'
/ /' / /
-Avoid if possible
~
/
GP greMer Wan.1
(
1E-os !
,/
s wD C below 10(-6); hdrd to justify, regardless of CCFP 3
- h. N J
-'i"'
- '-='8---
2-0.005 0.01 0.02 0.05 0.1 0.2 0.5 1
p Conditional Containment Failure Probability o
j
.I i
~
o v sv oju
<*-~ss.,
2/OAl (Lo/o MOD. )
Safety Goal Analysis 4
~
\\
NN X>
t Core agg M
eh 0.0003 *\\
I 4 &-...
e e
a
!1
- }%ghl priority; bost-ben efit backfit likely y'
0.0001 -
lt N
E ' ^ ~^^ A ' ' - ' ' - [ # '~ '
i/e p
I I
/
/
! / / / ['
l f ',.
study'! closer; diay have justified backfits
/
/ /j j,/ ;/ j/ /,,
med um to low priority is(sues i-
/
/
/
1 E-05 I!!
li ///
i fl l
I
=
I
/
/ " Safe 2one" per 1150/ j' h'j_irhe of const$nt risk r
Current safety goals met
,/
/
/
K.
l t
l t
3E-06 f
f'
/
' / y/ [,;,/ )with raargin.
f'/
l
,/
j
,i N
f i
/
/
j
/
/i/
N'N
/
l r
t 1 E-06 j
/
/
/
/
Avoid if possible
/
/
CCFP greateri han t
I l
below 10(-6); ha'rd to justify, regardless of CCFP b --> -
'.01 3E-07 0.005 2- -
-P 0
0.02 0.05 0.1 0.2 0.5 1
Conditional Cor:!a!
ent Failure Probability I
'M M
=
i 4
e
,,ar- /as--
E v=~^'"
Safety Goal Analysis
~I" g
1 i
Core Damage Frequency 0.0003 q Gredter thanl10(-4);highl priority; post-benefit b g.
N Y NNoL A A A LV,J m m
o oog,
'N xsix s
i y
em s,
l
, ')(
'r, s
's
\\
'N s
i
/,,
g f,'
Mu e os'N; may have justified backfits 2
3E-oS er
/
\\
3 N
medjurn to loyv priority is f
i t ",
l '/. '
,' /
/i sues
.xj \\/ '$a'fe; o ". ehh' f
~
j l
te.as i
N j j' Curre!nt safety goals met Liijie of constEnt risk
/ y f
f 3E./
il j with triargin.
i///
f!
n l
f :1 1 E-06
/ /j/ i j//{'
/
/
Avoid if poss,ibfe
/
/
j-j/
x CCFP greater than1
.. )
belo w 10(-6); ha rd to justify, regardless of CCFP 3 E-07 '---" > ' '
1- + 'l
+.J O.005 0.01 0.02 0.05 0.1 0.2
]
i 0.5 1
Conditional Containment Failure Probdbjlity
~
-