ML20031A282
| ML20031A282 | |
| Person / Time | |
|---|---|
| Issue date: | 08/31/1981 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| References | |
| NUREG-0803, NUREG-803, NUDOCS 8109220816 | |
| Download: ML20031A282 (67) | |
Text
_-
l Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping c
A i.
ba b
C 4 ? 1 Tit'981P se 7 ~ ws*g Qp l
~ - -
U.S. Nucioar Regulatory Commission Office of Nuclear Reactor Regulation
+m me ce,a
- ~
,A h-l
'e 1 C 064215 2 AN ALP C CCU M EN T CCATFUL CESK FER l
t bibGTLh CC 20555 l
i "sR15"s'"2**
0803 R PDR l-
Available frora GP0 Sales Progra:a Division of Technical Infomation and Document Control U.S. Nuclear Regulatory Cocraission Washington, DC 20555 Printed copy price:
S4.25 and National Technic:1 Infomation Service Springfield, VA 22161 l
Go g l
o i
[4
]3 0
UNITED STATES I
NUCLEAR REGULATORY COMM!SSION g
- E WASHINGTOrd, D. C. 20555
\\*****,o$
l l
August 31, 1 981 TO ALL GE BWR LICENSEES (EXCEPT HUMBOLDT BAY)
Gentlemen:
SUBJECT:
SAFETY CONCERNS ASSOCIATED WITH PIPE BREAKS IN THE BWR SCRAM SYSTEM (GENERIC LETTER 81-34)
On July 7,1981 the NRC staff sent a letter to all BWR licensees informing them that the generic review of this issue had been completed. We indicated that a NUREG report describing the results of this review would be issued.
This letter forwards NUREG-0803, " Generic Safety Euluation Report Regarding Integrity of BWR Scram System Piping," dated August '981.
Section 5 of NUREG-0803 presents the staff's generic conclusions or, this issue. Briefly, the staff hos concluded that the SDV piping system design is acceptable, provided certain conditions are satisfied on a plant specific basis. The staff further concluded that the safety concerns associattd with a postulated failure of the SDV piping system do not represent a dominant contribution to the risk of core melt, provided certain assumptions used in the risk assess-ment are validated on a plant specific basis.
NUREG-0803 provides the staff's guidance and schedule for implementation. As provided in our July 7,1981 letter, plant specific responses should be provided within 120 days of the date of this letter. Plant specific responses conforming to the guidance contained in NUREG-0803 uill satisfy the information requested in our April 10, 1981 letter.
As indicated in our April 10, 1981 letter, pursuant to 10 CFR 50.54(f), provide your plant specific response within 120 days of the date of this letter.
Sincerely, j[
)
b or D
fse u Div'sionofL' censing Office of Nuclear Reactor Regulation Enclosure "s Stated cc: Service Lists
NUREG-0803 Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping j
1 Manuscript Completed: June 1981 Date Published: August 1981 Division of Licensing Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555
- p....,
NYh-}
s.....
l l
l l
ABSTRACT 4
Safety concerns associated with postulated pipe breaks in the boiling water reactor (BWR) scram system were identified during the staff's continuing investigation of the Browns Ferry Unit 3 control rod partial insertion failure on June 28, 1980.
This report includes an evaluation of the licensing basis
~
for the BWR scram discharge volume (SDV) piping and an assessment of the potential for the SDV piping to fail while in service.
A discussion of the means available for mitigating an unlikely SDV system failure is provided, i
Generic recommendations are made to improve mitigation capability and ensure that system integrity is maintained in service.
N 1
i iii
CONTENTS Page ABSTRACT..........................................................
iii LIST OF FIGURES.....................................................
vi LIST OF TABLES......................................................
vii ACKNOWLEDGMENTS.....................................................
ix 1.
INTRODUCTION...................................................
1-1 2.
LICENSING DESIGN BASIS FOR SCRAM DISCHARGE VOLUME..............
2-1 2.1 Compliance With Reactor Coolant Pressure Boundary Requirements..............................................
2-1 2.2 Emergency Core Cooling Capability.........................
2-3 2.3 Conclusions...............................................
2-4 3.
SCRAM DISCHARGE VOLUME PIPING INTEGRITY........................
3-1 3.1 Scram Discharge Volume Piping System......................
3-1 3.2 Scram Discharge Volume Pipe Failure.......................
3-3 3.3 Conclusions...............................................
3-6 4.
MITIGATION ASSESSMENT..........................................
4-1 4.1 Initial Conditions........................................
4-1 4.2 Control Room Operator Actions.............................
4-8 4.3 Reactor Building Environment..............................
4-11 4.4 Equipment Environmental Qualification.....................
4-16 4.5 Manual Action To Terminate Leakage........................
4-17 4.6 Integrated Risk Assessment of Boiling Water Reactor Scram Discharge Volume Pipe Failure.......................
4-27 5.
GENERIC CONCLUSIONS............................................
5-1 5.1 Piping Integrity..........................................
5-1 5.2 Mitigation Capability.....................................
5-3 5.3 Environmental Qualifications.............................. 5 6.
References.....................................................
6-1 7-1 7.
Glossary.......................................................
V a
LIST OF I;GURES Page
)
4.1 Scram Discharge Volume Dose Rates in Reactor Building for Slow Depressurization Cases....................................
4-23 4.2 Scram Discharge Volume Dose Rates for Plant With Standard Technical Specifications-for Coolant Activity..................
4-25 4.3. Early-Stage Event Tree.........................................
4-29 4.4 Fault Tree for Failure to Reset................................
4-30 4.5 Decision Tree for Operator Error Probability Estimation in the Scram Resetting Phase...................................... 4-31 4.6 Fault Tree for Depressurization by Means of Safet Valves..........................................y Relief 4-33 4.7 Decision Tree for Operator Error Probability Estimation in the Safety Relief Valve Depressurization Phase.................
4-35 4.8 Fault Tree for Failure To Depressurize by Means of the Condenser......................................................
4-36 4.9 Decision Tree for Operator Error Probability Estimation-in the Condenser Depressurization Phase...........................
4-37 vi
l i
LIST OF TABLES PjLqe 4.1 Assumptions Used in Dose Calculations Common to all Scenarios and Those Specific for Each Case.....................
4-20 4.2 Whole-Body Gamma Dose Rates in Reactor Building and in Vicinity of Leak for Slow Depressurization Cases (Well-Mixed Reactor Building Atmosphere).......................
4-22 j
4.3 Whole-Body Gamma Dose Rates for Prompt Depressurization Cases..
4-22 5.1 Summary of Guidance for Individual Plants......................
5-2 4
J 1
Vii a
ACKNOWLEDGMENTS Many individuals contributed to this compilation through preparation of the initial draft and comments made during the review process.
The initial draft was prepared by the following members of the Office of Nuclear Reactor Regulation:
Ching-Yao Cheng John Hannon Philip DiBenedetto Wayne Hodges Patrick Easley William Kennedy Adel El-Bassioni Vincent Panciera Farouk Eltawila Ted Sullivan Michael Goodman Keith Wichman Charles Graves The comments of Charles Thayer and other BWR instructors at the Reactor Training Center in the Office of Inspection and Enforcement were particularly helpful in generically analyzing the available diagnostic information.
The comments and questions from Stuart Rubin and other members of the Office for Analysis and Evaluation of Operational Data contributed to the accuracy and depth of the final report.
ix
l GENERIC SAFETY EVALUATION REPORT REGARDING INTEGRITY OF BWR SCRAM SYSTEM PIPING 1.
INTRODUCTION On April 3, 1981, the Office for Analysis and Evaluation of Operational Data (AEOD) published draft NUREG-0785, " Safety Concerns Associated With Pipe l
Breaks in the BWR Scram System" (Ref. 1).
As a result of the development of these safety concerns and the findings presented in the report, Nuclear Regulatory Commission (NRC) staff met with representatives of the BWR Regulatory Response Group and General Electric Company on April 9, 1981. A letter was issued on April 10, 1981 (Ref. 2) to all boiling water reactor (BWR) licensees requiring a generic evaluation of the safety concerns within 45 days of receipt and a plant-specific evaluation within 120 days of receipt.
A meeting was held with General Electric on April 28, 1981 to discuss the status of its generic evaluation.
Subsequently NEDO-24342, "GE Evaluation in Response to NRC Request Regarding BWR Scram System Pipe Breaks" (Ref. 3), was submitted to NRC by letter dated April 30, 1981 (Ref. 4).
A multidisciplinary group from the Office of Nuclear Reactor Regulation was assembled to review the generic evaluation.
A three phase approach was developed to identify generic review objectives and describe review termina-tion points.
It was agreed that if the probability of core damage from the postulated scenario was shown to be sufficiently small, no further review, beyoid verification of plant-specific.esponse applicability, would be
(
necessary.
If the review could not be terminated on the basis of low probability, the scram discharge volume (SDV) piping would be assumed to fail.
If the consequences of the assumed failure were shown to be acceptable, no further review, beyond plant-specific verification, would be necessary.
If the review was not terminated on the basis of acceptable consequences, mitigation capability including operator action, the use of alternate cooling systems, and environmental qualification of mitigation equipment would be considered.
As the review progressed, it became evident that a sufficient data base did not exist to conservatively terminate the generic review on the basis of a quantitative risk assessment.
It was equally difficult to show acceptable consequences for all scram initiators, considering the potential for an unisolable leak from the reactor coolant system into the reactor building.
Thus, it was necessary to generically evaluate the mitigation capability for this scenario.
As the evaluation proceeded, several suggestions for improving and verifying piping integrity, mitigation capability, and environmental qualifications of 1-1 L
essential equipment were made.
These suggestions are discussed in the report, which begins with a review of the licensing design basis for the SDV piping system.
An evaluation of the SDV piping system integrity and an assessment of the mitigation capability follow.
Finally, each suggestion for improvement is evaluated in Section 5, " Generic Conclusions," where the final guidance is presented. Most answers to questions from the staff appear in a letter from General Electric dated June 30, 1981 (Ref. 5).
The remaining answers were provided verbally.
An acceptable plant-specific response for this issue will conform to the final, approved guidance provided in Section 5, ' Generic Conclusions."
This report is being issaed to provide guidance that should be followed by all BWR licensees when responding to the plant-specific information request., The original time allowed (120 days) for plant-specific responses was extended by letter dated July 7, 1981 (Ref. 6) to enable the guidance contained herein to be properly addressed.
This report, NUREG-0803, is not a substitute for the regulations, and complianca is not mandatory.
However, an approach or method different from the guidance contained herein will be accepted only if the substitute approach or method provides a basis.for determining that the regulations cited in NRC's letter of April 10, 1981 have been met.
1-2
p 1
2.
LICENSING DESIGN BASIS FOR SCRAM DISCHARGE VOLUME PIPING In NUREG-0785 (Ref.' 1), it was suggested that the staff consider the need to-j
_ include SDV system breaks in the licensing design basis for BWRs.
Compliance with reactor coolant pressure boundary requirements was reviewed to determine C
if the isolation provisions for the SDV system are adequate.
Compliance with the requirements to provide capability for long-term core cooling in case of j
an SDV system break was also reviewed.
2.1 Compliance With Reactor Coolant-Pressure Boundary Requirements The staff has reviewed the control-rod drive (CRD) hydraulic design for con-i formance with the reactor coolant pressure boundary requirements set forth in Section 50.2(v) of 10 CFR Part 50.*
The staff concludes that the CRD withdraw lines (which penetrate the containment) up to the scram discharge 4
l valve in each hydraulic control unit (HCU) may be considered as extensions of l
the reactor coolant pressure boundary.
General Design Criterion (GDC) 55,
" Reactor Coolant Pressure Boundary Penetrating Containment" (10 CFR Part 50, Apppendix A), provides the isolation requirements fo'r lines penetrating contain-4 ment that are connected to the reactor coolant. pressure boundary.
i General Electric, however, contends that the CRDs, which are provided with redundant built'in seals and restricted flow areas, isolate the withdraw lines i
from the reactor-coolant pressure boundary, and, therefore, the withdraw lines i
should not be considered as extensions of the reactor coolant pressure j
boundary penetrating containment.
1 General Electric also contends that, as in the case of instrument lines that l
are connected to the reactor pressure vessel, the CRD withdraw lines are 1
small-diameter (3/4-in.) lines and perform important safety functions, and, therefore, automatic isolation valves should not be used.
I The staff has reviewed the isolation boundary of the CR0 for compliance with i
the requirements set forth in GDC 55 and finds that the system design represents a departure from the explicit requirements of the GDC.
- However, 1
Appendix A to 10 CFR Part 50 states, in part, in its introduction, "There may be water-cooled nuclear power units for which fulfillment of some of the l
General Design Criteria may not be necessary or appropriate.
For plants such
).
as these,' departure from the GDC must ce identified and justified." Moreover,_
j GDC 55 permits departures from its explicit requirements provided the departure is justified on some other defined bases.
The staff finds that a departure from the explicit requirements of the GDC such as that represented.
i by the CRD hydraulic design is justified.
j
- Title 10,_ Code of Federa1 ' Regulations, Part 50, " Domestic Licensing of j
Production and Utilization Facilities."
i k
{
2-1 l
I
l The staff believes that requiring the use of an automatic isolation valve on the CRD system outside the BWR containment instead of the existing local manual valve, to satisfy GOC 55, would introduce a new potential failure mechanism for the CRD system.
The risk associated with having an automatic valve fail closed before a successful reactor scram in emergency situations would appear to exceed the risk associated with not isolating this line following an accident.
This assessment is based on the fact that the CRD withdraw lines penetrating the containment and routed to the HCus are small in diameter (3/4 in.) and are conservatively designed and of high quality.
Nevertheless, even if the staff postulated a break in one of these lines during reactor operation (including scram):
(1) The leakage through this break is within the reactor coolant makeup capabilities (feedwater and reactor mre isolation cooling) since, as required by GDC 14, " Reactor Coolant Pressure Boundary," the CRD system contains redundant CRD seals and a restricted flow area that limits the reactor coolant leakage to a very small value; (2) The reactor can be shut down and cooled down in an orderly manner; and (3) No leakage from the SDV, where flow from all other CRD withdraw lines is accumulated following scram, will occur through the areak because of the existence of a check valve between the SDV 6nd the withdraw line manual isolation valves.
For a break in a CR0 line downstream of the manual isolation valve, isolating the break by means of the existing local manual valve in each HCU would require sending an operator to the reactor building, which, depending on the accident, could be inaccessible. An improvement to the current design in this respect would appear to be achievable by replacing the existing local manual valves with remote manual isolation valves.
However, the impact of this change would be substantial--about 150 to 200 lines are involved and separate control lines would be needed--compared with the added benefit of precluding a nonisolable break that might cause a problem.
It is estimated that the dollar cost would be more than $2 million per plant.
Some unquantifiable cost in added risk is also involved because the additional valves might fail closed by a common mode problem.
In addition, this estimate does not include factors such as cost of replacing energy during the time the plant is shut down for this modification, impact on the emergency power load profile, and design requirements to protect these valves against pipe whip and missiles.
The staff Selieves that the addition of remote manual capability and the associated potential of a spurious signal that might render these valves inoperable could unacceptably r:' duce the reliability of the scram system.
This potential reduction of the scram system reliability is a significant safety concern.
The Probabilistic Aaalysis Staff ha; performed an analysis of the probability of scram system unavailability and core damage initiated by an anticipated transient without scram and has found that this probability likely exceeds the probability of core damage from a broken and unisolated pipe in the SDV system.
The probability of core uncevery for -uch a break is believed to be less than 10 6 per plant year, in which case it would not be a dominant contribution to risk.
Therefore, the staff believes that the option of adding remote manual capability should not be adopted provided that the depressurization of the reactor could be achieved so that the leakage will be reduced to a small value and that an early detection of the break could also be achieved.
2-2
l l
2.1.1 Conclusion Based on the above justification, the staff concludes that for BWR plants, local manual isolation valves outside the containment to prevent outleakage in case of a pipe break outside the containment are preferable to automatic i
isolation valves outside the containment.
However, because of the potential problems associated with manually closing these valves from local stations in the event of degraded core accidents, the staff concludes that the licensees and applicants of those BWR plants that depend on local manual valves for primary containment isolation of the CRD lines should:
(1) Verify that the CRD lines and SDV piping meet applicable design, fabrication, installation, testing, and quality assurance requirements and specifications, and the applicable regulatory requirements; (2) Propose a program of inservice inspection and surveillance for the CR0 lines and SDV piping that will periodically verify their integrity; l
(3) Propose a leak-detection method that can provide prompt and unambiguous notification of a leak or break in one of the CRD lines or in the SDV piping; (4) Provide emergency operating procedures and training that will ensure appropriate, feasible, and timely operator actions in case of a leak or break; and (5) Verify that equipment qualification for the leak or break environment will ensure the needed functional iesponse and mitigation capability.
The staff also concludes that the CRD system with local manual isolation valves, when adequately supported by verified requirements, inservice inspection, surveillance, leak detection, and emergency isolation capability, complies with GDC 55 and is acceptable.
- 2. 2 Emergency Core Cooling Capability 2.2.1 General Design Criterion 35 Compliance with 10 CFR Part 50, Appendix A, GDC 35, " Emergency Core Cooling,"
was discussed in Appendix D, Section D.1.5 of NED0-24342 (Ref. 3).
For BWR 6 Mark III containment designs, the staff agrees that no threat to the long. arm cooling capability provided by the emergency core cooling systems (ECCSs) exists.
However, it cannot be concluded here that for Mark I and II contain-ment designs, compliance with GDC 35 is ensured by documented Final Safety Analysis Report analyses of instrument line breaks.
The f'ow rate from a postulated SDV header break exceeds that of the previously analyzed instrument line break.
This fact raises questions regarding potential adverse effects on ECCSs that would be relied upon to provide long-term cooling.
Section 15.6.5 of the Standard Review Plan (SRP) (Ref. 7) requires that the analysis address the complete sequence of events to the point where the plant is in the long-term cooling mode and removal of decay heat has been well established.
As discussed in other sections of this report, the maximum 2-3
postulated leak rate from the SDV piping system must be terminated by scram reset isolation or prompt reactor system depressurization and manual isolation.
Otherwise, potential adverse environmental conditions in the reactor building resulting from the postulated leakage would preclude a generic conclusion that long-term cooling can be established and maintained for Mark I and II containments.
2.2.2 10 CFR Part 50, Section 50.46 Compliance with 10 CFR Part 50, Section 50.46, was discussed in Section 7.6.1 of NED0-24343 for Mark I and II containment designs and Section 8.5.1 for Mark III containment designs.
The generic analysis was based on a flow cross-sectional area large enough to pass the assumed average leakage flow of all cont a rods.
The staff did not agree on the average leakage flow rate of 3 gpm per drive because other data suggested a larger value.
However, it judged the equivalent break size to be representative for the analysis of the SDV piping system failure because the current SRPs require that this system be analyzed for a crack and not a rupture because it is pressurized less than 2%
of the time.
The required postulated SRP crack size is consistent with the equivalent break size assumed by General Electric.
Even if the average flow per rod were 5 gpm rather than 3 gpm, the results would be bounded by other analyses of small-break loss-of-coolant accidents provided environmental conditions did not result in failure of multiple ECCSs.
The staff concludes that the analysis provided by General Electric to show compliance with 10 CFR Part 50, Section 50.46, for a postulated rupture of the SDV piping is acceptable provided environmental conditions do not result in multiple failures of ECCSs before shutdown cooling with the residual heat removal system is achieved.
- 2. 3 Conclusions The staff has concluded that the SDV piping system design deviates from the explicit requirements of GDC 55.
This deviation is acceptable proviacd that the CRD-HCU exhaust lines and SDV system piping meet the applicable require-ments for design, fabrication, installation, testing, and quality assurance and there are appropriate provisions for inservice inspection and surveillance.
Furthermore, adequate leak-detection methods and emergency procedures and training should be provided to ensure the earliest possible manual break isolation actions by the operator.
This assumes that tne prompt depres-surization function and other equipment requirements will be qualified to meet the expected HCU break environmental conditions.
The staff finds the SDV piping system design acceptable on this basis.
i 2-4
3 SCRAH DISCHARGE VOLUME PIPING INTEGRITY 3.1 Scram Discharge Volume Piping System 3.1.1 Design and Installation Table 6.3.1 in NED0-24342 (Ref. 3) lists the General Electric design require-ments and/or recommendations and industry standards applicable to BWR SDV piping systems.
The Power Piping portion of "U.S.A. Standard Code for Pressure Piping," USAS B31.1.0 (Ref. 8) (or its predecessor ASA B31.1) was specified for most of the 50V piping in operating BWRs.
The adequacy of this code was reviewed for the known SDV service conditions (Ref. 1).
The staff believes that the B31.1 Code as supplemented by the General Electric specifi-cations for materials, fabrication, and examination forms an acceptable basis for the construction of BWR SDV piping for its service conditions.
This code was also specified for reactor coolant pressure boundary piping and piping in other safety-related systems in those same operating BWRs.
The staff also agrees that the requirer. ants in Section III of the " Boiler and Pressure Vessel Code" of the American Society of Mechanical Engineers (ASME Code) (Ref. 9) for 4
Class 2 components form an acceptable basis for the construction of BWR SDV piping for its service conditions.
However, in one specific area, the General Electric specifications supplementing ASA B31.1 are suspect.
These specifi-cations allowed the use of threaded connections in the SDV system for pipe sizes which exceed those allowable by current codes.
General Electric identified those plants where the use of these connections was permitted.
The plants involved should verify the existence of threaded joints in their SDV systems piping and upon confirmation of their use, assess their structural and leaktight integrity under conditions where severe erosion, crevice corrosion, dynamic events, and vibration can occur.
Since Office of Inspection and Enforcement (IE)Bulletin 79-14 (Ref. 10) does not, at present, provide coverage of small-diameter pipe sizes in the BWR SDV piping system, actual system installation should be verified on a plant-specific basis.
The staff recommends that if not already performed, an as-built inspection of SDV piping and its supports be conducted at all BWRs.
Credit may be taken for SDV piping inspections already performed in response to IE Bulletins or othet sise.
The results of these inspections should be addressed in the plant-specific responses.
3.1.2 Quality Assurance and Inspection Reference 1 inferred that most operating BWR SDV systems were not constructed to the high quality assurance standards now considered to be appropriate for this system.
In response, the statement was made in NEDO-24342 that
"... experience has shown that the specifications in GE requirement documents have generally been carefully followed."
In reply to the staff's request for additional information, General Electric reiterated its statement with the caveat that because the utility retains responsibility for compliance with requirements specified by General Electric by means of an acceptable quality 3-1
assurance program, General Electric could not verify that the quality assurance provided by each utility was adequate.
In addition, General Electric has no control over quality assurance deficiencies such as those noted in Appendix B of Reference 1.
Therefore, the staff cannot support any generic conclusions regarding the adequacy of quality assurance programs l
applicable to SDV piping.
The staff recommends that the quality assurance of SDV piping be verified by as-built inspection, seismic analysis, and inservice inspection on a plant-specific basis.
Section 50.55a(g)(4) of 10 CFR Part 50 requires that all BWR components that are classified as ASME Code Class 1, 2, and 3 meet the inservice inspection (ISI) requirements of the applicable edition and addenda of the Section XI ASME Code throughout their service life.
Older plants where CRD hydraulic systems were designed to the specifications of the USAS B31.1.0 Code for nonnuclear pressure piping had to classify their components, during the first ISI program update, in accordance with the criteria of Regulatory Guide 1.26 (Ref. 11).
Therefore, the SDV header and its associated piping would have been classified as ASME Code Class 2 if the CRD hydraulic system had met the requirements of GDC 55 for primary contain-ment isolation.
If the SDV lines were classified as Class 2, they would have been included in the ISI program.
At present, most of the operating BWR ISI programs are based on the requirements specified in the 1974 Edition of the Section XI ASME Code up D 1975 Summer Addenda, although some of the most recently updated ISI programs may have been based on the 1977 Edition of Section XI Code up to 1978 Summer Addenda.
The 1977 Edition of Section XI Code requires that all pressure-retaining Class 2 pipe welds except those specified in IWC-1220 (Ref. 9) must be examined either by surface examination methods or by surface plus volumetric examination methods depending on their wall thickness.
Because most of the SDV headers in question are larger than 4 in. in diameter, they will have-to be examined either by surface techniques (for wall thickness 1/2 in. or smaller) or by surface plus volumetric techniques (for wall thickness over 1/2 in.).
In any event, all Class 2 pressure-retaining piping welds, irrespective of their nominal pipe size, will have to be pressure tested at 100% of nominal operating pressure and at 110% or 125% of system pressure every 3-1/3 and 10 yr, respectively.
For plants whose ISI programs are based on the 1974 Edition of the Section XI Code, the SDV header may have been excluded from the inspection requirements because of misinterpretation of IWC-1220(b).
Even in this case, the SDV header will have to be pressure tested at least once in 10 yr.
In summary, the staff finds that because SDV piping is designed and fabricated according to the requirements of ASME Section III Class 2 piping and because of its-importance in achieving the scram function, it should, at a minimum, be subjected to the ISI requirements for Class 2 piping of the Section XI Code.
3-2
3.2 Scram Discharge Volume Pipe Failure 3.2.1 Possible Failure Mechanisms NEDO-24342 states, "No scram discharge piping system at any reactor has had a rupture in over 20 years of reactor operation." General Electric further stated, in response to a request for additional information, t;at to its knowledge, no leakage cracks had ever occurred in SDV piping.
The staff also is not aware of any licensee event reports or other reports of cracking or rupture of this piping system.
Nevertheless, the staff has evaluated all credible failure mechanisms for the SDV piping as follows.
3.2.1.1 Fatigue Failures attributable to repeated (or cyclic) t % rmal or mechanical loads are referred to as " fatigue failures." General Electric, as reported in NED0-24342, has conducted an analysis of the Browns Ferry SDV header to determine if fatigue is a credible failure mechanism for that component.
Utilizing the rules of NB-3222.4(d) and the equivalent rules of NB-3630(2) of the ASME Code,Section III, General Electric has demonstrated that the SDV header piping is not sensitive to fatigue failure and would be exempted from fatigue analysis l
if it were Code Class 1 piping.
The staff, after independent verification, concurs with the General Electric assessment.
Furthermore, the rules of NB-3630 allow Code Class 1 piping of 1-in. nominal pipe size or less and l
piping of greater diameter--if the fatigue exemption rules are met--to be designed to Code Class 2 rules, which do not require fatigue analysis.
It should be noted that meeting the rules of Subsection NB of Section III of the ASME Code is a requirement of Section 50.55a of 10 CFR Part 50.
3.2.1.2 Seismic Loading According to NEDO-24342, it has been General Electric's practice to specify that the SDV piping be designed for Seismic Category 1 loadings in all BWR plants.
In response to the staff's request for confirmation of this state-ment, 3eneral Electric repliea that, while the actual seismic category specified by the utility for SDV piping design is not on file, in the majority of cases General Electric has verified (and is reasonably certain for the remainder) that the SDV piping in BWR 3's, 4's, and later product lines was specified to be seismically designed.
The staff performed a selective check of some BWRs and, as a result, believes that all SDV piping beginning with the BWR 2 product line (Nine Mile Point and Oyster Creek) has been designed for seismic loadings.
This fact should be confirmed in the plant-specific reviews.
Seismic design of safety related piping is plant specific and the adequacy of this design ultimately depends on the analytical techniques applied and installation of the system as designed.
Various events at operating BWRs involving the scram system and the ongoing effort under IE Bulletin 79-14 have led most BWR licensees to reevaluate their scram system piping for seismic events.
Specifically, reanalysis of the insert and withdraw lines at many BWRs is either in progress or has been completed.
Some support modifications of these lines have been completed or are being planned at a number of plants.
IE is currently pursuing this activity.
The results of all seismic 3-3
reevaluations and required modifications should be documented in the plant-specific submittals.
3.2.1.3 Intergranular Stress Corrosion Cracking Stress corrosion cracking results from a combined action of high stresses and corrosive environment that leads to brittle cracking of a metal.
Inter-granular stress corros' ion cracking (IGSCC) is a type of attack in which the grain boundaries of the metal corrode more rapidly than the grains themselves.
l IGSCC can occur only if the proper combination of stress, environment, and material conditions are present.
This combination exists for austenitic stainless steel in a BWR environment.
The only piping in the SDV piping system that is fabricated from Type 304 stainless steel is the Type 30455 3/4-in. piping of the individual scram discharge risers.
The most susceptible locations for IGSCC in this piping system are the weld joints, including the bimetallic joint at the SDV header.
However, General Electric test results indicate that IGSCC will not start under normal loading conditions (including residual stresses) in these weld joints after thousane of service hours even if the material is severely sensitized.
Because the SDV piping system is used cumulatively for only about 200 hr over its service life at high temperature, the staff does not expect IGSCC to be a potential failure mechanism for this piping system.
3.2.1.4 Waterhammer Loss-of pressure integrity in SDV piping has never occurred as a result of waterhammer loadings.
However, the staff is aware of one BWR where SDV piping supports and nonpressure-retaining components were damaged as a result of scrr induced hydrodynamic forces generated when the system encountered some vent and drain valve operational problems.
Corrective measures to prevent recurrence, which include vent and drain valve operability checks and piping modifications, have been identified so that waterhammer should be effectively precluded and thus not exist as a potential failure mechanisne for SDV piping.
3.2.1.5 Corrosion and/or Erosion Minor general corrosion of the SDV header piping material could be expected if it were continuously in contact with the reactor coolant at the normal reactor operating temperature.
Because the SDV header piping operates at temperatures considerably lower than 550 F and also because of extremely low-duty time, general corrosion is not expected to be a concern to the SDV piping system.
In addition, because the SDV piping system experiences high flow rates during the scram and/or reset cycle for short times, the potential for erosion caused by rapid flow is negligible.
The staff, therefore, concludes that corrosion and/or erosion cannot be a probable failure mechanism for the SDV piping system.
3.2.1.6 Fabrication Defects Because all base materials were examined according to the requirements of the material specifications, the full penetration welds were volumetrically 3-4
examined, and L e socket or fillet welds were exc.:..ined by surface methods, the staff finds no reason to expect the presence of fabrication defects.
Even if fabcication defects were missed during the preservice examination, the staff woul t'. not expect such defects to increase to a significant size so as to jecpardize piping integrity.
This ir. because of a lack of credible defect growth mechanisms described in Section 3.2.1 of this report. Therefor ~,
pending the quality assurance audit of the results of preservice inspc tion, the staff finds no basis for assuming that fabrication defects will h ed to the eventual failure of SDV piping.
3.2.1.7 Brittle Fracture Brittle fracture is characterized by sudden and complete failure of a structure under loading with little or no plastic deformation.
Three main conditions must be present for brittle fracture to occur:
(1) the stress must be sufficiently high, (2) the toughness of the material is relatively low, and (3) a sufficiently large flaw exists.
In the SDV piping system, all piping is made of high-toughness materials such as Type 304 stainless steel and SA-106 B carbon steel.
Furthermore, no mechanism is known to reduce the toughness of these materials during service.
In addition, these piping,ystems are subjected to service stresses con-siderably lower than those allowed by the ASME Code and the likelihood of the existence of a large flaw, either fabrication or service induced, in these pipes is remote.
Even if large cracks (circumferential cracks up to approximately 75% of the wall or through-wall cracks up to approximately 40% in circumference) are postulated in the SDV pipes, rupture is not expected to occur'under limiting stress conditions because of a significant safety margin to tolerate large cracks. The expected consequence of such a failure would be leakage out of a small through-wall crack.
The staff, therefore, concludes that brittle fracture is not a credible failure mechanism for the SDV piping under the service environment.
3.2.1.8 Operational Errors The SDV system design for pressure and reactor coolant containment during a scram condition relies on the use of contiguous interconnected piping in conjunction with both manual and automatic valves.
The SDV piping and connected valves are normally configured so that pressure boundary and scram discharge containment would be expected to be attained following a reactor However, it may be possible that a procedural error or operating error scram.
associated with an SDV component maintenance, surveillance, inspection, or modification could cause the integrity of the system to be temporarily defeated at a time when such integrity should be available or might be required (that is, a reactor scram while operating at power).
An example might be the removal of the internals from an SDV vent or drain valve for repair to reestablish valve operability while operating at power.
Another example might be the failure to fully close the isolation valve downstream of a scram outlet valve before the removal of scram outlet valve internals on a CRD-HCU module with a boundup check valve.
An operator or procedural error of 3-5
this type ce91d result in the loss of system integrity at a time when it might be required.
To preclude an inadvertent loss of system integrity, when required to be available, from these or other similar SDV operations, proper procedural controls must be exercised.
In response to the concerns raised in Reference 1 in this area, General Electric responded in NE00-24342, "It is expected that existing plant maintenance procedures adequately address... (these concerns)." However, the staff, from its review, has found et least one recent instance where an SDV drain valve was removed at a BWR without first taking appropriate precau-i tionary steps to ensure containment of reactor water discharged in the event of a reactor trip.
In view of the potential for defeating SDV integrity when required because of operational error sources, tne recent experience at an operating BWR, and General Electric's inability to generically and conclu-sively verify procedural adequacy on a plant-by plant basis, it is the staff's position that all surveillance, maintenance, inspection, or modification procedures which conceivably have the potential for defeating SDV integrity be reviewed (or modified, if necessary) by licensees on a plant-by plant basis.
These plant-specific reviews should verify that all such procedures contain sufficient guidance to ensure that the loss of SDV system integrity will not occur at times when such integrity should be available.
3.3 Conclusions A number of factors, including design, installation, quality assurance, inspection, and credible failure mechanisms, were evaluated in assessing the integrity of the SDV piping system.
The staff concludes that if (1) the SDV piping systems are verified by as-built inspection to have been installed according to design specifications, (2) the quality of installed SDV piping systcms is verified by quality assurance audit, including preservice inspections and tests, (3) periodic inservice inspections are performed on the applicable portions of the SDV piping in accordance with Section XI ASME Code requirements, and (4) SDV equipment maintenance, surveillance, modification, and other procedures that could result in an inadvertent loss of SDV pressure boundary integrity because of human error are verified to contain adequate guidance and precautions to prevent such occurrences, then the integrity of the SDV piping system would be adequately ensured for its service use.
For purposes of the generic risk assessment in Section 4.6 of this report, the staff used an estimated SDV pipe failure frequency of 10 4 per plant year.
While the staff considers this an extremely conservative estimate considering the lack of generically identifiable failure mechanisms, it acknowledges the uncertainty of this estimate because of the assumptions that were made and the scarcity of available data.
Thus, the staff finds it necessary to investigate this event further to verify that adequate mitigation exists.
3-6
4.
MITIGATION ASSESSMENT 4.1 Initial Conditions For purposes of this evaluation, the staff assumes that the plan' is operating at power and experiences a reactor scram from any one of the possible scram initiators.
A break then occurs in the SDV piping system before the scram is reset.
4.1.1 Expected Leak Rate If a break occurs in SDV piping following a normal scram and before scram reset occurs, the expected leak-flow rate from the break depends on the average condition of CRD seals, the nudiber of control rods, and the break size.
General Electric has run laboratory tests, conducted at full-operating vessel temperature and pressure, cn a single CRD to simulate seal leakage rate following rupture of a CRD withdraw line.
The tests also give expected leakage rates immediately after a normal scram before the SDV repressurizes to reactor vessel pressure following the normal closing of the SDV vent and drain valves.
General Electric stated that individual CRD leakage ander these conditions would be expected to range from less than 1 gpm for a CRD with new seals to about 5 gpm for a CRD with badly worn seals.
The laboratory tests were conducted with a CRD having worn seals that resulted in an initial leakage rate of about 2 gpm.
The initial test was made to determine if operation with continued leakage would cause seal degradation and, hence, an increase in seal leakage rate. The 90-min test showed no seal degradation.
Tests were also run following deliberate mechanical degradation of the seals (fer example, filing and cracking of seals).
These tests were used to correlate stall flow leakage with immediate post-scram leakage and indicated that even with badly damaged seals, the leakage flow rates would be less than about 6 gpm.
Tests with the seals completely removed resulted in leak flow rates of less than 10 gpm.
The above correlation between stall flow leakage and immediate post-scram leakage was used with stall flow test data from three operating reactors, including Browns Ferry Unit 3, to obtain a typical CRD immediate post-scram leakage rate of less than 3 gpm.
General Electric assumed an average CRD leakage rate of 3 gpm in evaluating the consequences of a rupture of an SDV header in which the resistance of the break to total leakage flow is negligible relative to the seal flow resistance.
For 185 CRDs, the total leakage rate at full-operating vessel temperature and pressure would be about 550 gpm.
For the assumed total leakage rate of 550 gpm at full-operating vessel pressure and temperature and a mass velocity from the Moody separated flow model for water subcooled by the 45-ft-elevation change between vessel water level and the CRD seals, General Electric obtained an equivalent break area of 4-1
\\
about 0.007 ft.
This 5reak area was then used with the Moody model to obtain 2
break flow rates for a range of vessel steam pressures.
For example, flow rates varied from 130 gpm at a pressure of 135 psia to 43 gpm at a pressure of 14.7 psia.
The average CRD leakage rate of 3 gpm is not necessarily representative of other plants because factors such as maintenance schedules to replace worn seals and plant operation schedules may vary.
For example, Bruiswick Unit I reported n estimated average CRD leakage rate of 4 gpm in a submittal dated i
August 15, 1980 (Ref. 12).
In view of this information, average CRD leakage rates following a postulated rupture of an SDV header could result in total leakage rates greater than the 550 gpm value used by General Electric.
However, considering the General Electric laboratory tests and the expected distribution of seal degradation for CRDs in a given plant, the average CRD leakage rate probably would not exaced 4-1/2 gpm.
For purposes of the generic evaluation of anticipated SDV system leakage, the staff has considered the applicable licensing guidelines.
Section 3.6.1 of the SRP (Ref. 13) suggests that the SDV header piping is a moderate energy fluid system because during normal plant conditions its maximum operating temperature is less than 200 F and the maximum operating pressure is less than 275 peig.
Ilnder these conditions', a reactor scram is interpreted to be an
" upset plant ccadition" or an anticipated operational system transient that occurs with moderate frequency during plant service life.
Even if a reactor scram is consider ed a normal plar.t condition, Section 3.6.2 of the SRP (Ref. 14) provides that through-wall leakage cracks instead of breaks may be postulated for fluid systems that qualify as high-energy fluid systems for only short operational periods but qualify as moderate-energy fluid systems for the major operational period.
An operational period is consiAred "short" if the fraction of time that the system operates within the pressure-temperature conditions specified for high-energy fluid systems is less than 2%
of the time that the system operates as a moderate-energy fluid system.
Conservitively assuming 15 scrams per reactor year with reset occurring in less than I hr each, BWR SDV piping systems are typically pressurized no more than 0.2% of the time.
Thus, it is considered acceptable to evaluate the consequences of a leakage crack rather than a full rupture of the SDV header, particularly when identifiable generic failure mechanis as are lacking.
If a crack instead of a rupture vere assumed, a decrease in total leak flow rate would be expected because of the flow resistance of the crack.
A formula giving a conservative estimate of crack size for moderate energy is provided in Section 3.6.2 of the SRP.
This formula gives a crack circular area of about 1.5 in.2 for a 10-in.-diameter schedule 80 SDV header.
General Electric calculations indicate that for crack sizes greater than about 1.5 in.2, there would be no increase in total leakage flow rate for the assumed average CRD leakage of 3 gpm.
For smaller crack sizes, the total leakage flow rate would decrease (for example, 260.gpm for a crack size of 0.5 in.2).
For small crack sizes, the flow resistance of the crack is limiting and the total ieakage flow rate approaches independence of CRD seal resistance.
It is also noted that the above reductions in total leakage flow with reduction in crack size would be more pronounced if an immediate post-scram average CRD leakage of greater than 3 gpm were assumed.
4-2
4.1.1.1 Conclusions The staff, therefore, concludes that the leak rate from a postulated failure in the SDV piping system that was assumed by General Electric in NEDO-24342 (Ref. 3) is reasonable.
Leak rates up to 50% greater than the assumed value might occur.
However, in view of the above discussion of crack sizes in moderate-energy piping, leak rates close to or below the assumed value would be expected.
4.1.2 Diagnostics Operator actions to bring the plant to a safe shutdown condition after a postulated post-scram break in the SDV system depend, in part, on information that could be used to diagnose the location and severity of the break.
In Table 7.5.1 of NE00-24342, General Electric listed 10 possible sources of break-detection signals that might be used by the control room operator.
These signal sources are listed below, along with an additional source (CRD position indication) which was provided by General Electric in response to a staff question.
Some limited supporting documentation, based on the Browns Ferry' Unit 1 plant, was also provided by General Electric.
The sources of SDV piping break-detection signals for Mark I and II containments are:
(1) Reactor building ventilation isolation alarm.
(2) Water-level alarms (a) Reactor building equipment sump level alarm (b) Reactor building floor drain sump level alarm (c) ECCS room level alarms.
(3) ECCS room ambient high-temperature alarms.
(4) Radiation monitor alarms (a) Area radiation monitor alarms (b) Reactor building ventilation high-radiation alarms.
(5) Reactor building low differential pressure alarm.
(6) Personnel observation of leakage.
(7) CRD alarms (a) CRD high-temperature alarms (b) CRD position indication.
The above information was reviewed by the staff to determine if, on a generic basis, any single-break-detection information source or combination of sources just listed might be sufficient, if available, to permit the operator to take necessary corrective actions.
The basis for staff judgment of adequacy involved the following considerations:
(1) estimated time lapse from 4-3
-u
postulated break to break-detection signal, (2) possible use of the break-detection signal in determining if break is in the SDV system, and (3) ambiguity of signal (for example, other nonbreak sources of same signal).
The effect of post-break environmental conditions in the reactor building and loss of offsite power on availability of these signals could not be determined on a generic basis at this time.
In the case of the assumed 550 gpm initial break flow rate and no operator action to depressurize the reactor coolant system (RCS), a total of about 16,500 gal of RCS water would be discharged to the reactor building in the first 1/2 hr.
Of this, roughly 30% would flash to steam and result in about 11,500 gal of water, supplemented by liquid water from steam condensation in the building, which would spread over the floor below the SDV system and possibly cascade down open floor drains and stairwells to lower levels of the reactor building as discussed in NUREG-0785 (Ref. 1).
The results of General Electric calculations described in NED0-24342 for this break size indicate that the 1/4-in. water negative differential pressure in the reactor building, which could be maintained by the ventilation or standby gas treatment (SEGT) systems, would be lost early in the transient and that blowout panels in the reactor building should give within 5 min.
These calculations, which did not include the ef fect of the blowout panels, also indicate that average reactor building temperature would reach about 100 F in 10 min and about 140 F in 30 min.
General Electric stated tnat the calculated average temperature would be less if the effect of the blowout panels had been included.
Since local temperature could be less than the average, ECCS ambient temperatures might not reach alarm setpoints of 120 F in 1/2 hr.
These results and consideration of the large uncertainties in the calculations of local conditions were used to make initial judgments on the merits of the signal sources, assuming that operator actions to isolate the break (scram reset) or depressurize the reactor must be initiated within 30 min after the break.
General comments concerning the listed break-detection signals are:
(1) The signal indicating isolation of reactor building ventilat#on is ambiguous.
Low vessel water levels that would be expected after some transients causing scram would automatically initiate the standby gas treatment system (SBGTS), which, in turn, would cause isolation of the ventilation system.
Therefore, the signal could not be used to verify that the break is in the SDV system.
(2) The sump signals involving measurement of water level would give a somewhat delayed response because of the time required for water to spread over the floor below the SDV system, drain to the basement, and raise sump and floor water levels to trip the alarm.
The ECCS room level alarm setpoints correspond to water quantities well above 20,000 gal.
Hence, they' probably would not be activated within the first 1/2 hr af ter the break.
In addition, these level alarms are not used in all plants.
None of these signals could be used to verify that the break is in the SDV system.
4-4 m
_j
(3) General Electric calculations inaicate that the ECCS room ambient high-temperature alarms would be delayed.
The signals could not be used to verify that the break is in the SDV system.
(4) Many radiation monitor alarms would be expected to give an early indication of a break in the reactor building.
However, the information could not be used to verify that the break is in the SDV system, primarily because recorder limitations would prevent the operator from detecting break location by relative time response of the detectors.
(5) General Electric calculations for the 550 gpm break indicate that the building low differential pressure alarm would come on very early in the transient and be followed within about 5 min by a rapture of the blowout panels.
The information from the signal could not be used to verify that the break is in the SDV system.
(6) Entry to the reactor building after the break could conceivably permit diagnosis of break sevtcity and location.
However, the staff cannot generically conclude thac, this information would be obtained within 1/2 hr after the break.
Any conclusions concerning personnel observatiois of leakage would be based on supporting information for individual plants.
(7) Of the automatic signals listed, the unly two that might give direct information concerning a break or valve leak in the SDV system are the CRD high-temperature alarms and CRD position indication.
Each CRD has a thermocouple to monitor internal temperature.
A recorder scans the CRD thermocouple outputs at a minimum rate of about two readings per minute and indicates a control room alarm when a given CRD temperature exceeds 250 F.
For 185 CRDs, a full scan takes about 1-1/2 hr.
General Electric stated that during normal plant operation, about three or four CRD high-temperature alarms per hour might be expected (1 to 5% of CRDs).
During the first 20 min after a normal scram, the rate might be 12 alarms per hour.
If there were a significant break in the SDV systems, the continued post-scram leakage before reset might cause most CRDs' temperatures to reach the alarm point and cause alarms at the rate of about one to two per minute.
General Electric states that this change in alarm frequency would be an unambiguous indication of the break.
The staff agrees that a significant break in the SDV system should lead tc, an increase in the number of CRDs having temperatures above the alarm point.
However, because of the recorder characteristics, enly about 15%
of the CRDs would be scanned in about a 15-min period after a postulated break.
As noted by General Electric, CRDs with good seals (*1 gpm leakage or less) may not reach the alarm point.
In addition, the number of alarms within this time period would depend on the number of times the operator actuated the reset.
Because of the lack of information on the CRD transient temperature behavior and the effect of operator actions on alarm frequency, this information source is considered ambiguous.
General Electric has also provided infbrmation concerning the possible use of CRD position indication to identit/ a break in the SDV system.
During a normal scram, a CRD is inserted to an overtravel position beyond 4-5
the " full-in" notch position "00".
When the SDV repressurizes (typically within about 1-1/2 min), the differential pressure needed to hold the CRD in the overtravel position is lost and the CRD settles back to the "00" position. With a scram plus a time-delayed postulated break in the SDV system, the CRD would begin to settle in the "00" position and then go back into the overtravel position until isolation of the break.
Indications of the overtravel position are given in the control room c,
the full core display and four-rod display because the overtravel-position indication typically is two horizontal dashes instead of a position number. With the CRDs not at acknowledged rod positions, rod drift alarms will sound and be indicated by lights on a full core display. The information that rod positon is not at an acknowledged number would also be indicatea on the process computer output.
The staff understands that all BWRs would have a control room display panel with at least (1) a light for each CRD indicating status of the rod drift alarm for that CRD and (2) a single panel annunicator and single reset.
Reset involves sources on the panel including CRD drift and vessel water level. This signal source (rod overtravel), in combination with other sources of a break in the reactor building (for example, radiation monitor), might be used, along with improved procedures and backup information from the CRD high-temperature alarms, to enable corrert event diagnosis to ensure timely control room operator actions in respoi e to a postulated large break in the SDV system.
However, for smaller breaks, the pressure in the SDV system could remain high enough to permit settling of the CR0s into the "00" position.
Insufficient information is available to permit a conclusion concerning the validity of this information source for a range of SDV break sizes of importance.
(8) For a normal scram, the folicwing conditions would be expected:
(a) As the result of the closure of vent and drain valves (typically within 30 sec), the SDV system would presurize to reactor pressure in less than 1-1/2 min. The pressurization time is a measure of average CRD leakage.
(b) The maximum SDV header temperature should be less than 280 F.
Deviations from these expected process conditions could be detected by pressure and temperature sensors in the SDV headers and used to identify that either a break in the SDV system has occurred or that vent or drain valves have not closed.
For example, a time-delayed alarm indicating failure to pressurize after about 2 min would indicate a significant leakage from the SDV system.
For a large break, the temperature indication in the SDV header could be lower than 280*F.
However, the break severity would be indicated by the low SDV pressure.
For small breaks or valve leaks, which do not result in a significant reduction in SDV header pressure, the eventual high SDV temperature resulting from CRD leakage would indicate leakage from the SDV system.
i 4-6 l
Automatic isolation of the SDV system is not considered feasible, as discussed in Section 2.1.
Hence, dedicated leak-detection instrumenta-tion for the SDV system can be used only to provide additional diagnostic information to the operator.
The alarm would indicate the need for scram reset to achieve break isolation or, alternatively, prompt depressuri-zation.
This is in contrast to dedicated break-detection instrumentation for some high-energy lines in the reactor building (for example, steam lines to high pressure coolant injection [HPCI] and reactor core isolation cooling [RCIC] turbines and main steam lines) that alarms and is also used to obtain automatic isolation of the break.
Scram reset would be the preferred way to isolate a break in the SDV system because it should result in lower reactor coolant inventory losses tnan depressurization.
Because of the increased iodine release with depressurization (" iodine spiking"), it should also result in lower.
reactor building radiation levels and offsite dose.
The availability of the diagnostic information from dedicated SDV leak-detection equipment to alert the operator to the need for scram reset should result in reduced risk.
However, scram reset can be preventeu if certain scram signals cannot be cleared, as discussed in Section 4.2.1.
4.1.2.1 Conclusions The limited information available to the staff at this time suggests that of the reactor building break-detection signals listed in Section 4.1.2, the high-radiation alanns in combination with information from CRD position indication are possible unambiguous sources of diagnost.ic information for identifying significant breaks in the SDV system in time for corrective operator actions. The CRD high-temperature alarms could be a possible backup source of information.
The use of sensors installed for the specific purposa of identifying leaks in the SDV system described under Item 8 of the general corrments should also be considered to cover a full spectrum of break sizes.
Present information does not permit the staff to conclude that there is a clearcut generic solution to the problem of specifically diagnosing a postt lated break in the SDV system in time to permit corrective operator actions.
The staff concludes that it would be appropriate to provide local process or ambient instruments if necessary to ensure prompt detection of the specific source of the leak and/or break so as to enable early and rapid isolation of the SDV header.
l 4.1.3 System Response Because the flow from a ruptured SD's is relatively small (approximately 550 gpm or the equivalent of a 0.007-ft break), system response during the 2
i first 1/2 hr will not deviate markedly from a normal scram except as it may.be modified by operator action.
The operator will start his normal scram procedure and will probably initiate the RCIC system manually.
Once the operator realizes that HPCI is required to maintain level, it will be initiated manually.
During a normal scram, the operator would typically take the reactor out of the run mode to prevent maia steam isolation valve (MSIV) closure and control 4-7
system pressure by typassing steam to the condenser.
The RCIC system would be manually initiated to provide makeup.
Analyses presented in Figure 3.1.1.1-26.2 of NEDO-24708A (Ref. 15) show that it takes about 50 min for the combined RCIC 2 break and through cycling and CRD flow to equal that lost through a 0.005-ft c relief valves to remove daay heat with the MSIV closed.
Therefore, the RCIC and CRD flow would not arrest the level decrease during the first 30 min after scram.
For a scram with no break, the RCIC and CRD flow would overcome inventory lost through decay heat within the first 5 min, thus the operator would expect to observe level recovery within the first 20 or 25 min.
If the transient that initiated the scram a;so resulted in MSIV closure, then pressure would be controlled with the relief valves by either manual or automatic action.
If the operator manually cycled the relief valves, the pressure woulo most l'kely be controlled at less than 940 psig and the operator would distP1bute the heat load to the suppression pool by selecting a different SRV each time he manually reduced pressure.
If the valves cycle automatically, the valve will open at about 1100 psig, which is above the high pressure trip setpoint.
Following the scram, the operator initially would be expected to try to restore water level to the normal control range.
Because the water level would be expected to continue to decrease with RCIC and CRD systems in operation if feedwater is not available (inventory lost to break and decay heat exceeds RCIC and CRD capacity), the operator would probably initiate HPCI to restore level.
Because HPCI would be required to maintain level and because of the presence of a high radiation alarm in the reactor building, the operator would probably suspect a leak in the primary system.
If the HPCI system were inoperable, then the level would continue to decrease during tne first 30 min and a controlled depressurization with the automatic depressuri-zation system (ADS) or safety relief valves (SRVs) would be indicated unless the RCIC system could correct the level decrease before reaching level one.
If the RCIC system was inoperable but the HPCI system was operable, the level would be quickly restorH tc the control range and the only significant indication of a leak v the high-radiation alarms.
If the operator recognized that an ongoing leak existed, he would be required
)
to depressurize the reactor coolant system (RCS) to reduce the leak rate.
However, unless the operator perceived a need to depressurize rapidly, which is not certain with present event-based emergency procedures, he would depres-surize at a rate that stays within the maximum allowable cooldown rate of less than 100 F per hour.
Depressurization would then take 3 to 4 hr.
If the operator elected to depressurize rapidly, the RCS could be depressurized to the low pressure injection range in about 3.3 min and to 100 psig in about 10 min.
Once the vessel pressure is below about 135 psig (100 psig for Browns Ferry), residual heat removal (RHR) cooling can be established.
Multiple sources of water, both inside and outside the reactor building, can supply water to the vessel.
4.2 Control Room Operator Actions Operator actions are necessary to mitigate the effects of an SDV break.
The analysis of an operator's timely and effective response to the postulated SDV l
event depends on many factors, including the following plant-specific items:
4-8
o Operator training o
Operator experience o
Specific indications and/or alarms available o
Emergenct operating procedures o
Administrative policies o
Control room and plant' layout This report evaluates the postulated event from a generic standpoint. To do this, relevant aspects of each of the items above were considered to be less than optimal in an attempt to generically bo od the problem.
Staff judgments regarding operator behavior were b4: sed on several sources of data.
As a result of the Three Mile Island (TMI) Action Plan, Item I.C.8, " Pilot Moni-toring of Selected Emergency Procedures for Near-Term Operating License Applicants" (Ref. 16), the staff has obtained firsthand experience in operator response to emergencies and the BWR Ownu's Group Emergency Pro-cedures Guidelines.
Additional input was based on discussions with General Electric and IE training staff and staff expertise in human factors.
4.2.1 Scram Reset c
The resetting of a scram is considered because its success would terminate the loss of coolant and release of radicactivity.
However, the failure of the operator to successfully reset a scram could lead to further problems. This discussion concerns the ability of the operator to successfully reset the scram.
The ability of the operator to reset a scraw depends en:
o Clearing of the scram signal' o
The operator attempting to reset o
The control system actually reclosing the scram valves f
The failure of the centrol system to reclose the scram vt.1ves is discussed in Section 4.2.2.
The General Electric submittal lists the scram signals in Table 7.5.3 on page 7-17 of NELM 24342. The clearing of the scram signals can be automatk, a result of the scram, or accomplished manually by the operator.
The General Electric submittal identified the scram signals that.would clear automatically or as the reivit of the scram.
The remaining five scram signals, which may not be reset by these actions, were:
o Reactor pressure vessel (RPV) high presst.re I
o RPV low level l
o Drywell high pressure o
Main steam line high radiation o
Manual Two of these signals, RPV high pressure ano RPV low level, are cleared by operator actions in accordance with the procedures (based on the BWR Owners' Group Emergency Procedures Guidelines).
If an RPV high pressure conditicn exists, an SRV wouM be cycling. The procedures direct the operator to reduce the pressure to 150 psig aelow the pressure s&tpoint for the SRV. The pressure is also below the scram reset pressure. An RPV low water level scram signal resulting from the combination of the scras and the SDV break would I
4-9 a
also be cleared by operator actions in accordance with the procedures.
A manual scram would be cleared by operator action even if not called for within the procedures.
Specifically, if the scram was initiated manually. the staff has determined that operator training alone would result in operator actions necessary to reset the scram.
The remaining two scram signals, drywell high prassure and main steam-line high radiation, would prevent the operator from resetting the scram.
Current plant-specific procedures may or may not also result in +.he same two or other s7 ram signals that cannot be reset.
However, the existence of any condition preventing the reset of the scram requires furtner consideration of the scenario.
Therefore, although the 8 min indicated in the scenario for the operator to attempt to reset the scram is a reasonable time estimate, the successful reset of the scram cannot be assured.
As a result, furtner actions, as discussed below, are necessary.
4.2.2 Depressurization General Electric in its report postulates that where scram reset is not possible, mitigation of the event will depend on the ability of the operating staff to promptly depressurize using the available blowdown capability.
Under the NRC postulated scenario, operator action must take place within a limited time frame to prevent the potential loss of blowdown caoability, minimize inventory loss, and minimize radioactivity release to the containment environment.
Staff evaluation of the depressurizatior, issue as discussed in this section was confined to the ability of the operating staff to recognize the need for prompt depressurizatica, given available alarms, indications, and emergency operating procedures.
Based on the information provided in Table 7.5.1 of the General E!ectric submittal, subsequent discussions with General Electric and the IE training, staff on the SDV piping break-detection signals, and a review of the current BWR Owners' Group Emergency Procedures Guidelines, the staff believes that these indications and alarms offe" little assurance that:
o The operating staff would recognize that there is an SDV pipe break unless it is by personal observation, o
The decision will be made in a timely manner to depressurize.
It should be noted that emergency procedures developed from the BWR Owners' Group Guidelines do not have to be in force until the first refueling outage occurring after January 1, 1982. While some plants may implement emergency procedures based on these guidelines at an earlier date, from a generic standpoint it must be assumed that the updated procedures will not be available at all BWRs for approximately 18 months.
Ex hting procedures do not adequately address the issue of an SDV leak, either from a diagnostic or an action standpoint (based on discussions with the IE BWR training staff).
However, because of the low overall risk associated with a leak in the SDV, existing procedures do not need to be modified in the interim.
Based on staff discussions with General Electric concerning its submittal, the BWR Owners' Group Emergency Procedures Guidelines can be used as a basis for 4-10
mitigating the consequences of the postulated SDV break.
The specific point that was made was that the operating staff would be directed to Caution #13 at Step CD-2.3 of the cooldown guideline.
General Electric's position was that this caution, as reproduced below, is sufficient to direct the operator to promptly initiate depressurization.
CAUTION #13 Cooldown rates above 100 F/hr (maximum RPV cooldown rate) may be required to conserve RPV water inventory, protect primary containment integrity, or limit radioactive release to the environment.
The staff contends that the lack of indication mentioned above along with the nature of the guidance provided by the caution is insufficient to ensure prompt initiation of depressurization under the General Electric postulated ccnditions.
Specifically, insufficient criteria are provided for promptly initiating depressurization or for exceeding the 100 F per-hour cooldown rate, and the decision is left entirely to the operating stcff based on available information and the staff's training and experience.
4.2.3 Conclusions and Recommendations The BWR Owners' Group Emergency Procedure Guidelines are intended to be symptom rather than event based, but these guidelines as curr;atly written do not adequately address reactor building problems for which an SDV break is only one example. The BWR Owners' Group should propose modifications to the guidelines to address reactor building problems (such as a loss of coolant) or environmental problems (from any source) that could threaten ECCS equipment in the reactor building.
Individual plants should implement procedures (based on the NRC-approved BWR Owners' Group Guidelines) to be apr*oved by NRC that include modificatiens addressing the secondary containment problems identified above.
4..
Reactor Buildira Environment 4.3.1 Initial Leakage and Resulting Environment Before Depressurilation In the event of a postulated rupture of a pipe in the SDV system, the ensuing leakage wauld cause a rapid deterioration of the reactor building environment.
Three concerns that are apparent as a result of this leakage are flooding of the building, high temperature and humidity conditions in the building, and the release of radioactive material to the building and the environment.
This section addresses the first two concerns, namely, flooding and temperatt e-humidity effects. A separate section in this report will address the radiological concerns.
4.3.1.1 Flording Considerations In the event of a break in the SDV after scram, the first available flow path for released water would be the HCU floor drains to the drain sumps in the 4-11
basement.
These drains typically are capable of carrying off between 300 and 100 gpm.
Stairwells to the lower elevations are located at HCU floor elevations.
These stairwells provide another flow path for the released water.
Floor drains at the bottom of the stairwells or in the basement floor would transfer water to the floor drain sumps.
If the SDV leakage exceeded the capacity of the floor drains, general flooding of the basement would begin shortly af ter the SDV ruptures.
However, t,acause of partial plugging of the floor drains by debris, some of the water probably would overflow the stairwells and fall directly on the equipment below.
Accordingly, each licensee should verify that any emergency equiptr,ent that could be sprayed with water from dripping or splattering of this overflow leakage is designed to operate with water impingement.
The reactor building sump pumps, which are typically 50 gpm to 100 gpm capacity, may be used to pump liquid reaching the reactor building basement to the radwaste system.
For the largest postulated break, it would be expected that the leakage rate into the sump would exceed the sump pump capacity 1 to 4 hr after the reactor is depressurized, depending on the capacity of the sump pumps.
Regardless of the capacity of the floor drains in the leakaoe flow path, general reictor building flooding would be expected to occur in this time period.
However, if depressurization was promptly initiated (in about 30 min), flooding would only be 1 to 2 in, and would not threaten operation of the ECCS and RCIC pumps, located on the bottom floor of the reactor building.
Equipment hatches are located in the HCU floor areas of a typical BWR reactor building.
Some hatches above the ECCS compartments may be open; however, equipment hatches typically have shielded step plugs to prevent significant water leakage to lower floors.
Licensees should verify that any equipment needed for mitigation that could be wet dowr from leakage through these hatches is qualified for wetdown by 212 F water.
In summary, the leakage of water from the SDV would first be carried off in floor drains in the HCU area floor and in the stairwells.
Leakage into the sump that exceeds the capacity of the sump pumps will result in general building flooding, but the systems needed to mitigate this accident would not be expected to be threatened by the resulting level of flooding.
4.3.1.2 Building Almoenhere Considerations In addition to causing general flooding of the reactor building, the discharge from the SOV break would be expected to cause a deterioration of the building atmosphere.
The staff estimates that about 30% of the leakage flow would flash to steam and cause a rapid rise of the temperature, pressure, and humidity in the building.
Initially, temperatures could coms close to 212 F with a relative humidity of 100% in portions of the building especially those near the leak.
Therefore, emergency equipment, components, or systems required for mitigation of the event and for safe shutdown of the plant reactor should be qualified for such an environment.
However, the staff recognizes that several factors should lessen the effects of the leak on the reactor building environment.
Ihe structures with which the leakage comes in contact will remose some of the energy from the liquid.
Additionally, if the 4-12 l
1
CRD pumps are running, the discharged liquid will be diluted with cool drive water and the water temperature will be greatly reduced.
The CRD pumps would normally be left running after a scram.
However, neither of the CRD pumps at some plants receive vital power and, therefore, may not be available if offsite power is lost.
The SBGTS will be operating and will alleviate the environment by removing some of the moisture entrained in the air.
Tb? reactor building room air coolers will help reduce building temperatures.
General Electric estimates that the maximum bulk temperature in the building with operation of the SBGTS would reach about 140*F.
Figure 7.4.1 in the General Electric report shows that the reactor building would reach an internal pressure of slightly less than 1 psig a,suming 100%
reactor building leakage per day (SBGTS operation).
Because the release pressure of a typical blowout panel is about 1/2 to 1 psig, it is expected that one or more panels could rupture following the postulated SDV break.
The plants typically have several blowout panels spaced from the basement level up to the upper levels of the reactor building.
Rupturing of any of the blowout panels may occur.
If the ruptured panel is at the level of the HCUs or higher, this rupture may limit further deterioration of the building environ-ment on the lower floors.
If the ruptured panel is in the lower part of the building, the general building temperature and humidity would be expected to continue to increase until after the reactor is depressurized.
In summary, several factors work together to mitigate the reactor building environment.
However, depending on the location of the ruptured blowout panel, the environment may continue to deteriorate until after depressurization.
4.3.1.3 System Considerations Ultimately, systems are required to mitigate the event and to safely shut down the plant.
Some of these systems inur) operate in the reactor building environment.
Other systems may have controls and power supplies in the reactor building. Therefore, one must consider how the adverse environment of the building affects tne operation of these systems.
This section describes the concerns that arise from thiu adverse environme'it.
The preferred means of reactor water makeup and. decay heat removal is the feedwater and/or condensate system.
This system has the advantage of having its principal components located outside the reactor building and, therefore, removed from the effects of the SDV leakage.
At a plant such as Browns Ferry, three trains of this system may be accessible if offsite power is available.
In the event of a reactor isolation signal associated with the reactor scram.
the main condenser would not be of use.
The feedwater system may still be available for plants where the feedwater pun.p is motor driven rather than steam turbine driven.
Even though the feedwater and/or condensate systems are located outside the reactor building, the licensees should verify that operaticn of these systems is independent of any systems or components centained in the reactor building.
4-13 J
s Loss of the feedwater system would lead to a low reactor water level condition that, depending on the plant, would automatically initiate the RCIC or the isolation condenser system.
At a plant like Brown's Ferry Unit 3, the RCIC system is backed up by the HPCI system, which would automatically initiate on a low-low reactor water level condition.
The RCIC and HPCI systems each have one steam-turbine-driven pump, which isolates on the detection typically of temperatures of 180* to 200 F in their respective steam line spaces.
Clearing of the trip signals requires clearing of the high-temperature condition and operator action.
The licensees should determine the location of the tempera-ture trip monitors for the HPCI and RCIC turbines, their proximity to the SDV, and the path of the leakage from the SDV.
Licensees should conservatively determine whether these monitors would cause the turbines to trip because of temperature buildup in the areas where the sensors are located.
In summary, three high pressure systems could provide water to the reactor.
The feedwater system is preferred, but it will not be available if offsite power is lost.
Alternatively, if the feedwater pump is turbine driven, the high pressure feedwater system will not provide water under a containment isolation and cannot be relied on to provide water to the reactor.
The remaining high pressure systems are the RCIC and HPCI systems.
A licensee evaluation will be required to determine if these pumps will be available because turbine trip signals from high-temperature conditions may eccur.
Safety-related equipment in the reactor building has been or is bcir,g quali-fied for service at 212 F and 100% humidity.
The LPCI and core spray systems are also in the reactor building and most probably would be available because the reactor building environment is expected to be less severe than the con-ditions for which the equipment is qualified.
The feedwater and/or condensate system is located in the turbine building and should be unaffected by the SDV break environment provided verification is obtained that operation and control of these systems are independent of any equipment in the reactor building.
4.3.2 Leakage and Resulting Environment After Depressurization 4.3.2.1 Flooding Considerations As stated previously, the HCU floor drains, stairwell, and equipment hatches would be expected to carry break leakage to the casement sump pump.
- Hewever, the basement sump pump capacities are typically 50 to 100 gpm.
According to General Electric calculations, the SDV rupture flow would be reduced to less than 50 gpm about 4 hr after the break it depressurization of the reactor at 100 F per hour commences about 30 min af ter the event.
By the time the leakage flow is reduced to within the capacity of the sump pumps, the general basement i
flooding would be less than 1 ft deep.
However, shutdown equipment would not f
be affected by this level of flooding because the equipment is elevated above,
the floor.
4.3.2.2 Building Atmosphere Considerations After depressurization, the quantity and temperature of the water discharged from the break will be significantly reduced.
The SBGTS and the reactor building room air coolers will continue to be available to remove energy from i
4-14
the reactor building environment.
The ruptured blowout panel will also provide a path for leakage of hot, humid air to the outside environment.
It is expected that the general building environment would begin to improve shortly af ter the depressurization is initiated, leading to a building environment safe for operator entry.
If the ruptured blowout panel is high in the reactor building, the general building environment may not experience any further deterioration.
4.3.2.3 System Considerations Af ter Jepressurization, the reactor water could be provided by any one of the follt ing lov pressure systems:
LPCI, low pressure core spray (LPCS), and RHR/ Service Water.
The LPCI system utilizes the four RHR pumps, and the LPCS system has two more pumps.
These systems are located in the basement of the reactor building and should be qualified for service at 212 F and 100%
humidity.
Therefore, these systems would be expected to be available.
The RHR/ Service Water system components are located outside the reactor building, except for isolation valves between the RHR system and the service water system.
Thus, the only components exposed to the reactor building environment are the isolation valves, motors, and electrical circuits which should be qualified for service at 212*F and 100% humidity.
Each licensee should verify that all the components of systems required for safe shutdown of the plant are qualified for service at 212 F and 100% humidity.
In summary, general reactor building flooding after depressurization is not a concern.
The combination of the building mass as a heat sink, the SBGTS, the room air ;oolers, and the rupture of the blowout panel should restore the building environment to a condition safe for entry.
Three* low pressure systems, which should be qualified for the reactor building environment, are capable of supplying the reactor with the water needed for long-term decay heat remcval.
4.3.3 Conclusions and Recommendations The staff has reviewed the reactor building leakage flow path and has concluded that general basement flooding will occur but not to the extent to which emergency equipment operation would be adversely affected.
If depres-surization is initiated in 30 min, flooding to a depth of 1 to 2 in. could occur.
After depressurization, flooding to a depth of less than 1 ft could occur before the leakage from the SDV break decreases to less than the sump pump capacity, Because of the elevation of ECCS equipment above the basement floor, the staff has concluded that failure of this equipment as a result of flooding is not a concern, provided that break isolation is manually achieved within the time discussed in Section 4.5.2 of this report.
Licensees should verify that any equipment needed for mitigation that could be wet down from leakage through equipment hatches or from stairwell overflow is qualified for wetdown by 212 F water.
ANo credit is given for the electrically powered low pressure pumps in the feedwater train, which is also located outside the reactor building environment.
4-15
The staff has reviewed ?b? systems and design features available to mitigate the effects of the SDV leakage on the environment.
It has concluded that the reactor building environment would begin to improve shortly after depressurization is initiated and gradually become safe for operator entry.
The staff has reviewed the high pressure systems and equipment that could rupply water to the reacter vessel for decay heat removal before depressuri-zation.
It has concluded that only the RCIC and HPCI systems are reliable and that these systems would be available, provided that the steam line area temperature monitors do not initiate turbine trip signals.
The licensees should determine whether these monitors would cause the turbines to trip because of temperature buildup.n the areas where these monitors are located.
As a low pressure backup, the condensate portion of the feedwater system may be available to supply makeup water.
Each licensee should verify that operation of this system is unaffected by the adverse environment that would develop within the reactor building as a result of the postulated SDV break.
The staff has reviewed the low pressure systems and equipment that could supply water to the reactor vessel.
It has concluded thai, subject to verification of equipment qualification for service at 212 F and 100% humidity and possible wetdown with 212 F water, adequate systen.s would be available and, therefore, continued shutdown heat removal would be ensured.
4.4 Equipment Environmental Qualification The bulk average reactor building environment predicted to result from a postulated rupture in the SDV system, as analyzed by General Electric, is a temperature of approximately 140 F at 100% humidity.
General Electric has presented no evidence in its submittal to the staff that confiras the qualification of individual components to the postulated environment. General Electric, instead, alluded to the fact that an enveloping analysis was performed, considering a spectrum of breaks, which bounded the environmental conditions for the reactor building.
On this basis, General Electric stated that all equipment (safety related) supplied by General Electric is specified to meet or exceed an environment of 212 F and 100% humidity.
General Elactric could not address equipment provided for the balance of the plant, but again stated that the bounding conditions were provided to the vendors arm architect-engineers (AEs) for consideration.
The SDV break scenario as now postulated involves manual actions to mitigate the consequences of the accident.
Assuming the staff has concurred on the time rec irements and manual actions, the event should be terminated before the lost primary coolant accumulates in the sump to a level that could sub-merge equipment necessary to perform a safety function.
Equipment dousing by water spillage is also discussed in Section 4.3.1.
Therefore, this section only discusses the staff's review of the effects of temperature, humidity, and radiation on the equipment's performance.
If, however, in subsequent evalua-tions, the manual actions and dose rates to the operators become unacceptable, then the sequence of events necessary to mitigate the consequences of the postulated event must be provided considering failure of essential equipment due to submergence or dousing.
4-16
Secause the staff was not provided with a specific list of. equipment exposed to the environment or used during the mitigation of the event, the staff performed an independent evaluation. The staff selected two typical BWR Mark I containments and reviewed all of the equipment in tM reactor building to determine the status of equipment qualification.
In most cases where the equipment was specified to meet.or exceed 212*F and 100% humidity, the actual qualification, vCues specified by the licensee exceed the 212*F value.
- However, verification by the staff of the supporting documentation has not been completed.
Furthermore, unless equipment is found to be unacceptable from a safety standpoint, resolution of open items, such as additional testing to confirm qualification, is not required before June 30, 1982 (Commission Memorandum and Order CLI-80-21
[Ref. 17]). Although most equipment items satisfied the staff's concerns, several items, both nuclear steam supply system.(NSSS) and balance-of plant (BOP) supplied, lacked any specification.
In one particular instance, a motor control center, referenced as NSSS supplied had no specified values.
In telecons with General Electric, the vendor stated that this was supplied not by the NSSS but by the AE.
These inconsistencies must be clarified and corrected in order to ascertain qualification and the potential impact of nonqualified equipment.
The radiation environment postulated for this event is specified, by analysis and confirmed by the staff, to be of the order.of an integrated dose to equip-ment of.approximately 102 rad.
Because the threshold for degradation of equipment resulting from radiation effects is of the order of 103 to 104 rad for the most susceptible equipment and several orders of magnitude greater for l ese, susceptible equipment, the effects of radiation on equipment during this postulated event are considered negligible.
4.4.1 Conclusions and Recommendations The staff cannot make a definite ct.nclusion regarding equipment qualification becsuse safe-shutdown equipment in the SDV area has not been shown to be generically qualified for the local conditions that would exist under the postulated SDV rupture.
However, if licensees can verify that essential
]
components are qualified for service at 212*F and 100% humidity, as specified by General Electric, the staff would have reasonable assurance that the equip-ment qualification is adequate for mitigation.
Essential equipment would include that necessary for the pronpt de9ressurization function, as well as equipment required for long-term core cooling.
4.5 Manual Action To Terminate Leakage j
Manual action to terminate leakage from the SDV rupture would require personnel access to the reactor building.
Factors influencing the feasibility of manual valve closure include the acce*sibility of the valves, the temperature-humidity conditions near the valves and_its access routes, the radiation levels in the reactor building and in the immediate vicinity of the valves, and the time required to complete valve closure. The latter two factors are discussed in the following sections.
4-17 m
4.5.1 Dose Rate Calculations Follwing the postulated reactor scram and SDV rupture, the area of the reactor building where the leak occurs will become contaminated by the release of the radionuclides normally carried in the reactor coolant water.
Because no additional fuel failures are predicted for this event, the activity normally present in the primary coolant includes the radiologically important elements of iodine and cesium, and, to a lesser extent, activated corrosion products.
In addition, radioactive corrosion products or sediments might collect in the SDV or connected piping and be blown out in a rupture.
The dose from this source, however, is expected to be small in comparison to that from iodine.
Based on the expectation that the source term will be dominated by iodine, other radioisotopes were neglected in this calculation.
It was also assumed that the contribution to the personnel dose is dominated by airborne contami-nants, implying that the coolant leakage remaining in the liquid phase would drain away from the HCU area and be largely confined to sumps or lower floors where direct-shine contributions to the personnel dose can be avoided.
The most important variables in the assessment of the radiation environment in the reactor building are the concentration of iodine in the reactor water and the degree of mixing assumed near the leak.
The iodine concentration in the primary coolant is expected to urdergo a temporary increase above its equilibrium level following a scram and prompt depressuri;:ation (" iodine spiking"). The model used to account for this phenomenon is the one identified in Section 15.6.2 of the SRP (Ref.18)--a temporary increase of 500 times the equilibrium release rate from the fuel, which in turn is determined from the equilibrium coolant concentration.
This equilibrium concentration may vary substantially during the lifetime of the plant.
In all cases, however, it is limited by the technical specifications for coolant activity.
The Standarc' Technical Specifications (STS) for BWR plants, therefore, were used as the base case for this analysis.
Because the technical specifications for coolant activity substantially deviate from the STS for some BWRs, the calculations also were performed for a plant with typical nonstandard technical specifications, that is, those for the Browns Ferry plant.
General Electric stated that the use of the STS iodine concentrations is overly conservative and supplied plant data to show that normal iodine concentrations in the coolant are roughly 10 times lower than the STS liinit.
The staff believes, however, that the STS limits for coolant activity concentration are reasonable and will encompass normal fluctuations in coolant activity.
The fact that coolant activity is normally much lower than the STS limits indicates that implementation of STS for coolant activity for those plants not already having them should not present a burden to the licensees.
The expected degree of mixing of airborne contaminants with the reactor I
building atmosphere is a function of many parameters including the exact i
location of the postulated break.
In this analysis, the degree of mixing is l
treated parametrically. An upper bound on the degree of mixing is modeled by the assumption of instantaneous mixing with, and uniform dilution by, one-half l
of the entire free volume of the reactor building, followed by SBGTS-induced 4-18
3 mixing with the remainder of the building atmosphere.
The actual local radiation environment in the vicinity of the leak may be more closely approximated by the case assuniing instantaneous mixing in 20% of the reactor building's free volume, with SBGTS-induced mixing with the remainder of the building air.
An additional variable entering into the consideration of mixing in the reactor building is the failure of the reactor building blowout panels.
Failure of these panels may substantially reduce the degree of mixing induced by the SBGTS.
Under high-wind conoitions, however, the presence of large openings in the building may provide significant mixing in the reactor building.
This consideration also raises the question of the potential higher offsite doses resulting from a bypass of the SBGTS filter train, which is discussed below.
Other assumptions are s,pecified in Table 4.1.
Unless otherwise indicated, the plant parameters are those for Browns Ferry Unit 3.
Doses were calculated with the aid of a computer code, which includes the effects of time-variant iodine concentrations in the primary coolant; activity transport from the reactor to the coolant; buildup, mixing, and dilution in the reactor building; and radioactive decay.
The calculated doses are shown in Tables 4.2 and 4.3.
Only whole-body doses resulting from gamma radiation are presented because it is assumed that they are the limiting doses for operators wearing apparatus and appropriate protective clothing. Doses to the thyroid are predicted to be 5900 times.
higher than whole-body gamma doses for an unprotected person.
If self-contained breathing apparatuses are used, as would certainly seem prudent, the protection factor for inhaled iodine dose is assumed to be 10,000, making the whole-body gamma dose limiting.
The results presented in Table 4.2 snow that for the cases with Browns Ferry coolant activity technical specifications, entry into the reactor building would clearly be precluded during the critical time period.
If the entry and manual shutdown of all the valves take between 1 and 3 hr, the acceptable dose rate, to meet 10 CFR Part 20,* Section 20.101 limits, is between 1 and 3 rem per hour (whole-body gamma).
These rates could be exceeded from about 1/2 hr to about 48 hr after the scram for a plant with coolant activity concentra-tions as high as those permitted by the Browns Ferry Unit 3 technical specifications.
In contrast, for the corresponding case with realistic STS coolant activity limits (Case 5), this dose rate will be approached only for a short time (between 2 and 3 hr).
The dose rates in the reactor building for the case of a slow depressurization 1
are shown in Figure 4.1.
This figure clearly illustrates the benefit of limiting coolant activity levels to the STS.
- Title 10, Code of Federal Regulations, Part 20, " Standards for Protection Against Radiation."
4-19
Table 4.1 Assumptions Used in Dose Calculations Common to All Scenarios and Those Specific for Each Case Parameter Assumption COMMON TO ALL SCENARIOS Radioisotopes considered Iodine, as dose-equivalent I-131 (DE I-131).
Fraction of airborne iodine 10%, as an average of what is flashed, atomized, or desorbed from liquids or surfaces.
One-half of this is assumed to plate out quickly.
3 Volume of building to which leak occurs 1.32 x 106 ft.
3 Exhaust rate (unless blowout panels 14,000 ft / min.
rupture)
Initial coolant activity (equilibrium technical specification limits)
Standard Technical Specifications 0.2 pCi/gm.
Browns Ferry Unit 3 3.2 pCi/gm.
Iodine-spiking assumpticas Release rate of iodine (as DE I-131) from core to coolant increases by a factor of 500 over equilibrium value.
SPECIFIC TO EACH CASE Case 1 Leak rate 555 gpm, constant for 4 hr, then 43 gpts (consistent with a somewhat delayed depressurization).
Duration of iodine spike and 1.57 hr, assumed to stop when 0.1%
initial concentration of equilibrium inventory is released to coolant; Browns Ferry Unit 3 technical specifications.
Mixing inside reactor building Instantaneous mixing with one-half of free volume of reactor building.
Continuous mixing with entire free volume at 14,000 cfm.
(
\\
{
l I
l 4-20 j
i
Table 4.1 (Continued)
Parameter Assumption Case 2 Leak rate 400 gpm, decreasing to 130 gpm at 40 min, 73 gpm at 70 min, 65 gpm at 180 min, and 43 gpm at 240 min, and remaining constant thereafter (con-sistent with a less conservative initial leak rate and a depressuri-zation beginning 1/2 hr after scram).
Duration of iodine spike and Same as for Case 1.
initial concentration Mixing inside reactor building Same as for Case 1.
Case 3 Leak rate Same as for Case 1.
Duration of iodine spike and Same as for Case 1.
initial concentration Mixing inside reactor building Instantaneous mixing is assumed to occur only in area where SDV is locat3d, which represents 20% of reactor building volume. Contin-uous mixing--same as for Case 1.
Case 4 Leak rate Same as for Case 1.
Duration of iodine spike and 4 hr; Standard Technical initial concentration Specifications.
Mixing inside reactor building Same as for Case 1.
Case 5 Leak rate Same as for Case 2.
Duration of iodine spike and 2 hr; Standard Technical initial concentration Specifications.
Mixing inside reactor building Same as for Case 1.
Case 6 Leak rate Same as for Case 1.
Duration of iodine spike and 4 hr; Standard Technical initial concentrations Specifications.
Mixing inside reactor building Same as for Case 3.
4-21
l Table 4.2 Whole-Body Gamma Dose Rates in Reactor Building and in Vicinity of Leak for Slow Depressurization Cases (Well-Mixed Reactor Building Atmopshere)
In Reactor Building In Vicinity of Leak Case 1, Case 4, Case 3, Case 6, Time Browns Ferry Standard Browns Ferry Standard in Unit 3 Technical Technical Unit 3 Technical Technical hours)
Specifications Specifications Specifications Specifications Whole-Body Gamma Dose Rate (re'm/hr) 0.1 0.22 0.013 0.55 0.035 0.5 3.7 0.23 11 0.70 0.667 6.0 0.37 18 1.1 1.17 13.9 0.87 48 3.0 2
25 1.75 92 6.2 3
25 2.7 09 10 4
20 3.4 81 13 10 1.1 0.32 4.4
- 1. 3 20 0.52 0.18 2.1 0.70 48 0.16 0.053 0.62 0.21 120 0.007 0.0024 0.029 0.0096 4
720 0
0 0
0 o
Table 4.3 Whole-Body Gamma Dose Rates for Prompt Depressurization Cases Case 2, Case 5, Browns Ferry Unit 3 Standard Time (in Technical Technical hours)
Specifications Specifications Whole-Body Gamma Dose Rate (rem /hr) 0.1 0.16 0.0099 0.5 2.8 0.18 0.667' 45 0.28 1.17 5.3 0.33 2
5.9 0.39 3
6.3 0.48 4
6.0 0.47 10 3.1 0.25 20 2.0 0.16 48 0.60 0.049 120 0.027 0.0022 720 0
0 4-22
l
'M 3.
it la Us ic n
n n
h s
yo c
e ri e
s r t ea T a
Fc c
i d
n sfi r
nc a
o ds we n
i t
p n o a
o ai s
z Bl Sa ir r
t t
.a c
u c
.i 1i 4f s
n i
s e
ec e
h s
se r
c ap p
a e Ct CS e
d w
lso r
o 0
f 3
gn i
s d
r l
u i
o u
h b
r n
i to e
c m
i ae T
r n
i 0
2 se t
~
a r
eso d
e m
luov 0
e 1
g ra N
hcs N
i d
A I
ma r
/
c S
/
1 4
O e
0 7
4 1
8 5
2 9
6 3
O r
3 2
2 2
1 1
1 ug iF tEEE 2 8Om @Eb >En n$
4 W l
ll lI llllil
- l
(
1i
The potential increase in local radiation levels is demonstrated by the results for Cases 3 and 6 (see Table 4.2) for which the release was assumed to be instantaneously diluted by 20% of the reactor building air, followed by SBGTS-induced mixing of the entire reactor building.
The dose rates ce)cu-lated for the drowns Ferry Unit 3 technical specifications would be clearly prohibitive.
Even for the STS case, extreme caution before entering the vicinity of the leak would be indicated.
This calculation, however, is
- onsidered an upper bound, and would not be expected to occur unless stagnant air pockets develop in the reactor building.
Tha results for the case of prompt depressurization by means of the ADS are shown in Table 4.3.
A comparison of these cases with the results calculated for slow depressurization (Table 4.2, Cases 1 and 4) shows the substantial benefit of early and prompt depressurizaion.
These results indicate that access to the reactor building is attainable at all times provided that:
(1) Coolant activities are limited to the STS.
(2) The reactor coolant system is rapidly depressurized.
)
(3) Protective clothing and breathing apparatus are used.
(4) Stagnant air pockets are avoided.
The dose rates calculated for a plant with STS for coolant activity are plotted in Figure 4.2.
These curves define the limits for reactor building access for various assumptions cor:cerning depressurization and mixing rates in the reactor building.
In addition to the calculations described above, the potential offsite doses resulting from releases by means of the blowout panels were investigated.
The examination of this issue shows that offsite doses calculated for Browns ferry would exceed the 10 CFR Part 100* guidclines if a direct pathway to the environment is created by blowing out the reactor building blowout panels.
Calculations for the same plant and site with the STS coolant activity limits demonstrate tha* of fsite doses would be well within the Part 100 guidelines.
4.5.1.1 Conclusions Because of the considerations describeo above, the staff believes that:
(1) Reactor building access cannot be ensured during critical times following an SDV leak for Browns Ferry and other BWR plants with technical specifi-cations similar to those of Browns Ferry for coolant activity unless the coolant activity limits are changed.
(2) Radiation levels in the reactor building permit operator access following an SDV leak prov'ded that prudent but routine precautions for entering the high-radiation area are followed and reactor water iodine concentrations are limited to STS.
- Title 10, Code of Federal Regulations, Part 100, " Reactor Site Criteria."
4-24
8,_
'3 2
5
'e 5
3 f
~
- p#p m
,C D
.C M
'E, 3
a c
/
F
'5 E
'E 0
c a
c
/
/
O
/
o g
/
a m
1
/
3 E
g 5
/
'E 5
,/
6 8,
6,
/
8
?
/
i l
g
@V
/
e m
e 8
s D
D 0
,/
~
/
g l
s e
'3
/s
/
a lsI g
g
/
l k
E I
/
I j
T:
C o
3 3
g
?
g m
\\
\\
s 3
\\
e g
r
\\
E 1
3
\\
k
_8 s
u
%N g
s s
s
\\
g
\\
o 3
,_c
\\
o s
s o
3c m
s T
S s
s
\\
\\
- e g
i...3.
s i.....
i.......
i.....
i S
W 8,
s o
O N
ne
)rh/mer( etar esod ammag ydob-elohW le
- 2 v-is
(3)
Implementation of the STS coolant activity limits also will ensure that offsite doses will remain withia regulatory limits at Browns Ferry and other sites with similar meteorology.
The above analysis applies only to Mark I and II containments.
For Mark III containments, a likely source of additional radioactivity in the HCU area would be noble gases from operation of the ADS system.
This additional dose source, plus the fact that removal of airborne contaminants is slower or is delayed in a Mark III containment as compared with SBGTS, indicates that operator entry would be delayed more than for a Mark I or II design.
4.5.2 Manual Isolation of Scram Discharge Volume Break Manual isolation of all CRD-HCUs would stop the loss of coolant for the postulated scenario, ihe following criteria were used to evaluate this miti-gation method.
To be successful, an entry team must be able to perform the required actions at each CRD-HCU.
The skill required and the environmental effects of high temperature, humidity, and radiation on the entry team's ability to perform the necessary actions and on the time necessary to complete these actions must be considered.
It is expected that auxiliary operators would have the skills necessary to operate the valves; however, the precau-tions taken as a result of the hazardous environment would significantly increase the time needed to isolate the break.
The General Electric report allowed 30 min for isolation of the HCUs.
This value assumes 20 sec per valve with two team members working in a nonhazardous environment.
The staff considers this time per valve closure and the number h
of operators employed to be acceptable for a nonhazardous environment.
However, for an environment where high temperature a:1d humidity, surface contamination, or area radiation are significant. more time must be allowed.
The conservative estimate of the staff is that the evolution would take approximately four times as long--a total of 2 hr--to isolate the SDV break under conditions of an elevated temperature or a surface contamination problem.
This increased time interval is due to the actions necessary to compensate for the hazardous and degraded environment.
An elevated tempera-ture, a steam environment, or surface contamination would require donning of protective clothing and breathing apparatus, which would significantly reduce the entry team's ability to isolate the SDV break in a timely manner.
General body movement, visibility, and coordination necessary to shut the required valves would be degraded.
In addition, if the tempe ature or radiation levels are high enough to limit the stay of the entry team, the time to isolate could be increased by as much as 2 hr.
This additional time would be necessary to recover from high-temperature affects or fatigue and to obtain replacement team members in case of rudiation dose limitations.
4.5.2.1 Conclusion For the above reasons, the staff believes that the time necessary to isolate the SDV break is between the 30 min indicated by General Electric for a nonhazardous environment and 4 hr if the environmental conditions require replacement of the entry team.
4-26
4.6 Integrated Risk Assessment of Boiling Water Reactor Scram Discharge Volume Pipe Failure l
l l
Following a review of Reference 1 on the SDV break issue and General Electric's response, the staff has conducted a conservative evaluation to assess the likelihood of core damage associated with the incident.
The analysis conducted is generic in nature and based on a number of assumptions judged to be adequate for the purpose of this investigation.
These assump-tions are highlighted in this report and they require confirmation either by evaluations provided by the cognizant technical branches or by more compre-hensive considerations of additional plant-specific information that can potentially challenge the content of these assumptions.
One of the major assumptions is that the scram was successfully accomplished and is accompanied by an SDV pipe failure resulting in a leak of up to 550 gpm downstream from the isolation valves.
Breaks upstream from the isolation valves in the 3/4-in. piping were judged to be minor in size and with no potential short-term effects or the core cooling capability.
General Electric's analysis of the pipe failure probability data (Ref. 3) estimated the frequency of SDV rupture to be less than 3 x 10 5 per plant year.
As an alternative, if it is assumed that the rate of pipe defects is approximately three in 10 ft of piping per year (Ref. 19) and that the SDV 7
system includes 800 ft of large-bore piping and 1700 ft of small-bore piping, then the frequency of an SDV pipe failure can be estimated to be in the range of 10 8 to 10 4 per plant year.
The use of 10 4 per plant year as the frequency of SDV pipe failure is believed to be conservative beccuse the SDV system is pressurized less than 1% of the time.
However, the quality of SCV field construction may vary from one plant to another and undetected cracks may exist.
Reference 20 estimated the probability of an undetected crack 1 to 8 in. long and with a depth of up to about 1/10 of the wall thickness to De about 5 x 10 2 per joint for the worst case.
General Electric stressed the absence of mechanisms promoting such crack growth in the $DV.
- However, seismic events were not addressed as scram initiators in the General Electric report and are likewise not considered in this evaluation.
Because this study is generic in nature and because of the seismic discussian, the staff will use an estimated SDV pipe failure frequency of 10 4 per plant year.
The early phase of the accident following scram involves a number of important decisions that hava to be made in the control room.
These decisions will be made in the midst of numerous post-accident activities and include scram signal resetting and/or depressurization.
Successful Scram signal resetting will terminate flow from an SDV. pipe failure downstream from the isolation valves.
In case of failure to reset or in the case of leaks upstream from the isolation valves, depressurization will limit the leakage rate in the reactor building.
1he reduced leakage rate will lessen the deterioration of the post-accident enviconment near the leak and the risk of equipment flooding and allow the operator to use low pressure mitigating systems.
A period of about 3 to 4 hr is assumed fer this early stage of the accident.
This time span is assumed to be adequate for following the depressurization procedure with some allowance for decisionmaking.
The length of this period can either increase or decrease depending on the decisions made in the control 4-27
room, the impact of the accident ew ironw nt on mitigating equipment performance and control room infora tion, and the availability and adequacy of operational procedures used for resetting and depressurization.
An important assumption for this analysis is (1) that the adverse environment does not reduce equipment reliabilities from those values appropriate for normal (nonaccident) environments, and (2) that procedures are adequate for diag-nosing the event and performing the proper actions to mitigate it.
These key assumptions must be validated on a plant-specific basis.
The first 1/2 hr of the early accident stage is referred to as the " resetting phase" and is devoted to nor.nal control room activities following scram.
The remainder of this period (3 to 4 hr) is assumed to be used for depressurization in case it was operationally decided to depressurize.
The following sections include analysis details for the resetting and depressurization phases.
Confining the analysis to post-scram, short-term actions is rather limiting.
Some systems that might be used for depressuriza-tion and inventory control were not taken into consideration.
However, this limited scope of analysis is justified on the basis of conservatism, subject to the validation described above.
Moreover, long-term cooling and long-term effects of the accumulated leakage are considered out of the scope of this analysis.
4.6.1 Event Tree Figure 4.3 shows the event tree used to describe the chain of events that might occur in the early accident stage.
The 1:,wermost sequence is the dominant sequence and will be considered for quantification in the next two sections.
4.6.2 Failure To Reset The scram resetting phase is assumed to occupy up to about 30 min following scram initiation.
Routine actions in the control room typically occur in the first 15 min following scram.
The remaining 10 to 15 min are devoted to reset initiation or restoration of the capability to reset.
Figure 4.4 shows the fault tree used to analyze the failure to isolate the leak by resetting the scram signal from the control room.
The failure to reset can be related to failures in the hardware associated with the isolation, to the existence of a scram signsi associated with the scram in tiator and/or break that inhibits d
reset for the duration of the resetting phase (thus not allcwing isolation),
or to the failure of the human element in the control room.
Quantification of the fault tree was based mainly on data extracted from References 19 and 21.
Contributions to the top event probability are shown in Figure 4.4 for only two levels of the tree.
The hardware contribution (< 6 x 10 a) is estimated to be the least significant contributor to the top event.
Common-cause failures related to
'he leak-induced environment were judged to have minor impact in this initial phase of the accident; however, this judgment has to be confirmed in the plant-specific responses.
Conclusions t.oncerning inability to reset the scram 4-28
o,
.,i,sioon phe Screen toe. tang phees
E
'!EO.Y t
i MMMM I
Figure 4.3 Early-stage event tree are based on about 10 scrams experienced per plant year, with 30 to 50% of these scrams conservatively assumed to be associated with scram signals that cannot be reset for the duration of the resetting phase.
A fair degree of conservatism is implicit in this assumption and is justified by the uncer-tainty associated with post-leak environment that right contribute to the inability to reset.
Operator failure to reset was based on a manning level of three personnel in the control room--a shift supervisor, a main operator, and an auxiliary operator. As mentioned above, the first part of the resetting phase (10 to 15 min) was assumed to involve post-scram in:trumentation checks; the remainder of the resetting phase is then used for diagnostics, course-of-action recognition, and, finally, accomplishment of the scram signal resetting (provided existing conditions do not inhibit the scram reset action).
Methodology described in Reference 21 was used to construct and quantify the decision tree of Figure 4.5.
Operator failure probability is estimated to be less than 3 x 10 2, 4.6.3 Failure To Depressurize The depressurization phase is the second phase in the accident progression.
Failure to reset the scram signal (s) in the resetting phase complicates the existing conditions and consequently the analysis of this phase.
One of the 4-29
~ e... s.
+
f I
I
~,.,......,..
op,.,.=y-.
~ a. i. s..,. *
- d;;, O g **
s.. i.
U4*"."*'
..'::.-t T
l l
E3
'.-.pg,,.
.E3
~.. -
A l
T I
I I
1 l
":~.'. '.='
'. ':*.i::
'{fE-
' ~ ";'
A.
'4 em T.-.
cy::3, c.
c._,
agg;,'la
<-;' g i.e.
e e.e.
- "l0 ":'
, w 4..
m u 1,
m Figure 4.4 Fault tree for failure to reset complicating factors is the impact of the accident-induced environment.
However, it is assumed that instrumentation and controls are still capable of functioning.
This assumption should be confirmed on a plant-specific basis.
Recognition of the need to depressurize and making a decision to start depressurization by means of one of the two modes considered in this analysis (SRVs or condenser) contribute to the second complicating factor.
This factor is critical in defining the course of events that will follow in the accident progression.
This phase is assumed to extend from 30 min to about 3 hr following the scram.
It is assumed that the most likely depressurization mode i
f
{
4-30
(0.99 to 0.9) a A (10-2 to 10-9 t
(0.999 to 0.99) b B (10-3 to 10-2)
(0,99) b' B
Failure Failure (0.999 to 0.99)c C (10-3 to 104)
(0.9) c' C' I' Failure Failure A = Failure to 6 gnose scram causes B = Failure to decide on resetting C = Failure to initiate resetting (small letters denote success)
NOTE: Probability of failure 2 3 x 10-3 to 3 x 10-2 Figure 4.5 Decision tree for operator error probabliity estimation in the scram resetting phase 4-31
l will be by means of the SRVs because the condenser path may not be readily available at the beginning of the depressurization phase.
Figure 4.6 shows the fault tree describing failure depressurization by means of the SRVs.
References 19 and 21 were the main sources of data used for quantification.
Failures are either hardware related (<8 x 10 3) or operator related
(<5 x 10 2),
The operator failure probability was estimated by analyzing the operator's actions and decisions.
Figure 4.7 shows a decision tree (Ref. 21) for operator error probability estimation.
This tree is based on a recognition of the importance of the decision to depressurize in the resetting phase.
Should credit be given for an improved leak-detection capability, as recommended in Section 4.1.2.1, the staff estimates that the upper bound on operator error probability in Figure 4.7 would change from 5 x 10 2 to about 3 x 10 2 because of the enhanced ability to make a decision about the need for depressurization.
The second part of the depressurization phase is assumed to start about 90 min following the scram if depressurization by means of the SRVs was unsuccessful.
In the remaining period of the depressurization phase (90 min to $3 hr), an operational decision will be made to use the condenser for depressurization.
Figures 4.8 and 4.9 show the fault tree and human-error decision tree used in the analysis.
Failure to depressurize by means of the condenser was estimated to be less than 2 x 10 1 and dominated by operator error (*1.7 x 10 1).
This second segment of the depressurization phase is assumed to be associated with deteriorating environment in the reactor building and a higher stress level in the control room.
It is important to note that in the depressurization phase no credit was taken for the possible restoration of the ability to reset scram and thus isolate from the control room.
4.6.4 Conclusions Fault and decision trees shown in the last two sections indicate the importance of the human error factor, especially in making the decision to depressurize and in the correct interpretation of control room information.
- Moreover, the accident environment as a common-cause failure mechanism has a potential impact on equipment and instrumentation performance that can range from minor to very serious depending on plant-specific details about equipment and its locatioa and about systems layouts.
Co.'irmation at each individual plant regarding the availability and adequacy of existing procedures used for such accident as well as the impact of accident environment on the operability of equipment and instrumentation used in the accident mitigation is required to verify the validity of the assumptions made in this report.
Under the assumptions that the SDV pipe failure frequency is about 10 4 per plant year and that the operability of the required mitigation equipment is not degraded by the adverse SDV break environment, the frequency of core melt is estimated to be less than 10 6 per plant year.
Based on this value and pending confirmation of the assumptions noted in the report, the staff concludes that the analyzed sequence of events is not a dominant contributor to core melt.
4-32
Fedure to depressurlae
- 6=10-8 try means of SRve
+
1 SRV dep-essuria.tson
- 8*1F3 functiones fanure Ope.rator-2m10-8 to 5 = 10-8 rea ted f.Hure O
I 1
Fedure to depressurire Feiture of more then 2 by mea"'
s Ad.ou.ie tim.
...a.wi. io co.mpioi.
d.,r urin i.o.
- a. ave. of more than 4 on che 6 non AOS $RVs e
Figure 4.6 Fault tree for depressurization by means of safety relief valves l
l 1
4-33
F.m te.n.
..elu,. of S = to 8 3.
...ngt. SM V.n AD5 4
m I
I
.............m...
.w pe...u....e th.
$RV...t. at..e s., V.....,,, -,
O.
c
,,,p..
c o...
- na,
- '
....p, u...
.a-.
.a...
T l
c.m-...
e.nt..I Acc.m 4.t.,
N.,m.I Im g.,uy Com.p e...e Hom.n
..e
- suppt, p.,q,,.
b.tte s..ppf v h--...
e...
.a,.
..a Figure 4.6 (Continued) 4-34
(0.9a7 to 0.85),
(3=10-8 to 0.bl
)
(10-8 to 10-81 (0.995 to 0.86)
(5 =10-3 to 0.15)
(0.999 to 0.99) j Failure p,;ig,,
(0.99 to 0.9)
, (10-2 to 10-')
Failure 5=10-8 to 10-8) 10.99 to 0.9)
D'(10-2 to 10-1)
(0.996 to 0.99) d D
d' (0.95 to 0.9)
' e' E'
e E
Failure Failure (0.9),
p (0.1)
(0.8),.
p.10.2)
Failure Failure A = Failure to prepare for depressuriration during T, B = Failure to decide on depressurizatiun by means of ADS C = Failure to use written procedure in depressurlastion D = Failure to follow procedure correctly E = Fa. lure to decide on depressurization by means of non. ADS SRVs F = Failure to follow correct procedure in depressurization (smallletters denote success)
NOTE: Probability of failure = 2 x 10-8 to 5 m 10-2 Figure 4.7 Dec!sion tree for operator error probability estimation in the safety relief valve depressurization phase 4-35
Feeture to depressurtse
< 2 = 10 ' 8 by me6ns of condoneet
- 2=10 8 l
I Opeestor.
Feature to bypees f, *
..ted tu,b.no faduce
,e,,,,e e = 10 8 to 1 7=10 '
f +
+
l l
l Feduce os bypass walves 4,,g,,g,,,
Cercule'eng water fa*1ure Bypete control
+
fadute i
v.cuum pump fadute Power fa.eute Figure 4.8 Fault tree for failure to depressusize by means of the condenser i
4-36
1 1
(0.996 to 0.9) 5" a
g t
(0.81 8 (0 2 b
(0.99 to 0.9)
Failute
(
Failure (0.9)
C" 0.11 c
C.
Fai!ure (0. E IO II d
D d'
Failure Failure A = Failure to prepare for depressurization by r: eans of cendenser B = Failure to decide on depressurizaion by means of condenser following failure to depressurize by means of SRVs C = Failure to use written procedure D = Failure to fonow procedure correcity (smsilletters denote st ccess)
P.OTE: Probability of failure = 6 10-3 to 1.7 = 10 '
Figure 4.9 Decidon tree for operator error probability estimat on in the ccadenser i
depressurization phase 4-37
-a
I 5.
GENERIC CONCLUSIONS l
The staff has made an integrated assessment of the recommendations developed during the course of this review. Two of the recommendations were found not to be necessary in order to resolve the generic safety concerns.
First, the l
staff judged that an adequate basis did not exist at this time to require additional leak-detection systems specifically for the SDV piping system.
Second, provided a licensee can demonstrate a low probability of operating at coolant activity levels in excess of those allowed by Standard Technical Specifications, the need does not exist at this time to impose stricter technical specification limits on reactor coolant activity.
The remaining recommendations were adopted and are considered appropriate guidance for providing the information necessary to demonstrate an acceptable SDV system design and resolve the safety concerns associated with a postulated SDV system break.
The integrated risk assessment (Section 4.6) concluded that the analyzed sequence of events is not a dominant contributor to core melt.
Continued plant operation is acceptable pending verification of the assumptions in the risk assessment based on:
(1) Low probability of SDV leak actually occurring in a BWR before corrective action is taken; (2) No SDV piping leaks or breaks have been reported to date at any operating PWR; (3) Deficiency in equipment design, installation, or operation has not been fully determined to exist at any BWR; and (4) The staff's judgment that the urgency of taking regulatory action on this issue is no greater than that for an anticipated transient without scram.
Table 5.1 provides a summary of the staff's guidance and schedule for an acceptable plant specific resolution of the outstanding issues and concerns resulting from this evaluation.
Some of the guidance appears in more than one section in the report. Where a-recommendation was not adopted, it is so noted. The guidance had been grouped into three major areas of concern:
(1) Piping integrity (PI)
(2) Mitigation capability (M)
(3) Environmental qualifications (EQ) 5.1 Piping Integrity The staff has concluded that actions to ensure SDV piping ir,tegrity must be carried nut on a plalt-specific basis.
First, the quality assurance of SDV piping should be verified at each plant by providing the results of any as-built inspections and seismic reanalysis of the SDV piping and its supports conducted in accordance with IE Bulletins or otherwise.
If such an inspection has not been previously conducted, the responses should provide a sc.hedule for conducting an as-built inspection and seismic reanalysis of the SDV piping and its supports 5-1
Table 5.3 Summary of Guidance for Individual Plants Area of Section Concern 6,;idance in Report Schedule PI Periodic inservice inspection and 2.1 IS: program i
surveillance for the SDV system 3.1.2 PI Threaded joint integrity
- 3.1.1 120 days PI Seismic design verification 3.2.1.2 120 days PI HCU-SDV equipment protadures review 3.2.1.8 120 days EQ Environmental qualification of 2.3 EQ program prompt depressurization function PI As-built inspection of SDV piping 3.1.1 120 days and supports M
Improvement of procedures 4.2.3 NUREG-0737 EQ Verification of equipment designed 4.3.1.1 EQ program for water impingement EQ Verification of equipment qualified 4.3.1.1 EQ program for wetdown by 212 F water EQ Verification of feedwater and condensate 4.3.1.3 EQ program system operation independent of the reactor building environment EQ Evaluation of availability of HPCI-4.3.1.3 EQ program LPCI turbines due to high ambient temperature trips EQ Verification of essential components 4.3.2.3 EQ program qualified for service at 212 F and 4.4.1 100% humidity M
Limitation of coolant iodine concen-4.5.1 120 days tration to Standard Tect.nical Specification values **
- pplicable to Dresden Units 2 and 3, Monticello, Peach Bottom Units 2 and 3, Millstone Unit 1, and Vermont Yankee.
- Not required in final integrated assessment provided analyses outlined in Section 5.2.2 are acceptable.
5-2
and a program for correcting any rjeficiencies identified. A schedule and program for reviewing and revising, as appropriate, the HCU-SDV maintenance, surveillance, and modification procedures should also be included.
- Finally, the licensees and applicants for BWR plants should propose in their responses a program of periodic inservice inspection for the SDV system meeting the requirements for Class 2 piping in the Section XI ASME Code.
This revise-inservice inspection program should be implemented on a schedule consistent with the requirements of the licensee's inservice inspection program for ASME I
Section XI Class 2 piping.
5.2 Mitigation Capability 5.2.1 Emergency Operating Procedures Guidelines The staff has considered comments frota the General Electric Company and the BWR industry in judging the adequacy of the presently installed mitigation capability for a postulated pipe break failure in the BWR scram system following a reactor trip.
The staff has also considered the perspective provided by the results of its independent quantitative risk assessment, which concluded that the SDV break was not a dominant contributor to core melt risk.
However, this assessment das based on several important assumptions that will require validation on a plant-by plant basis.
Should the plant-specific reviews show that one or more key equipment qualification or operator performance assumptions were not correct (and nonconservative), then the conclusions stated in this section will be reexamined and may be revised on a plant-specific basis.
The mitigation sequence for the postulated SDV break accident could not, for all scram initiators, be based on reliable and early closure of the scram cutlet valves for break isolation, followed by an o-derly shutdown of the unit.
The mitigation sequences fer other potentially large brcaks in lines penetrating primary containment are based on closure of qualified and redundant isolation valves.
The potential for noncleared trip conditions, loss of control air, or other factors that could prevent successful closure of the scram valves requires that. acceptable mitigation be based on demonstrating adequate long-term core cooling capability, which involves RC5 depressuri-zation with the break unisolated, followed by entry into the reactor building to terminate the leak using the manual isolation valves associated with each CRD-HCU.
Reactor system depressurization with adequate core cooling involves cor. trol room operator recognition of the need to depressurize and the ability of the depressurization and core cooling systems to perform their required functions in the adverse environment created by the break.
For a plant adequately following the guidance summarized in Table 5.1, the staff would consider the presently available break-detection instrumentation to be adequate to detect an SDV break or other equipment-threatening leak outside primary containment so as to enable timely and correct operator action and equipment performance required for acceptable mitigation.
This would require that the BWR Owners' Group Emergency Procedure Guidelines be revised to lead the control room operator into a controlled blowdown when plant condi-tions indicate a reactor system leak outside the drywell.
Implementation of procedures based on such revised guidelines would allow the staff to conclude 5-3 1
]
with reasonable assurance that an operator using these revised emergency procedures would take the appropriate actions necessary to successfully mitigate a leak or break in the SDV or elsewhere in the secondary containment.
Specifically, the presently installed detection equipment, in conjunction with procedures that require a prompt blowdown (in excess of the 100 F per-hour cooldown rate) whenever a trip condition that cannot be reset occurs coincident with indication of a leak in the reactor building or a leak that cannot otherwise be promptly isolated, would be acceptable.
The rate of depressurization must be compatible wth the qualification of equipment in the reactor building to withstand an unisolable liquid break.
It is expected that the revised guidelines will direct a complete RCS depressurization within 1 hr of break indication in secondary containment.
An early blowdown with a minimum number of SRVs would be preferable to a full but delayed ADS blowdown.
Even so, final staff acceptance of the modified, improved procedures will eventually require the support of sufficient equipment qualification information documentation, as sursarized in Table 5.1, to allow the staff to conclude that the depressurization system and other required emergency core cooling system equipment are capable of performing che functions required for successfui mitigation.
Licensees who intend to show acceptable mitigation on this basis and to follow the specific guidance provided above for their plant-specific submittals should provide a commitment to implement the required revised emc.gency pro-cedures in their plant-specific responses by the first refueling outage occurring af ter January 1,1982.
This would ensure al acceptable mitigation basis for leaks and/or breaks outside the drywell on a schedule that is consistent with the TMI Action Plan, item I.C.9, "Short-Term Accident ar.d Procedure Review" (Ref. 22), for procedural modifications.
The guidance described above is not inter.ded to be the only basis for showing SDV break-mitigation arrangements acceptable to the staff The staff may alternatively accept orocedures that would permit a complete RCS depressuri-zation 1 hr or more after break detection.
However, these procedures would have to be supported by the documentation of acceptable ECCS equipment qualifica-tions, which bounds the conditions predicted by an adequately conservative plant-specific analysis (and model) of the reactor building for the maximum s
credible SDV leak rate.
5.2.2 Reactor Water Specific Activity Limits The calculations of Section 4 clearly demonstrate that reactor water iodine concentrations oresently contained in the technical specification of a number of operating BWRs are incompatible with ready access to the reactor building, and may actually exceed regulatory limits for offsite doses.
It should be noted, howewr, that the reactor water iodine limii,s for such plants (for example, Crowns Ferry) are highly unrealistic and are contradicted by the operating experience at all BWR plants.
This is verified by General Electric which provided data demonstrating that actual reactor water concentratior.., are consistently lower than those of the Brcens-Ferry-type technical specifications by several orders of magnitude, and are lower than the Standard Technical Specification (STS) values by about one order of magnitude.
From this fuel performance data, it is concluded that the STS would nrovide a reasonably conservative upper limit of reactor water iodine concentration.
i 5-4
The staff has concluded, therefore, that the STS for coolant activity should be !..:plemented for all operating BWRs unless it is demonstrated that the probability of requiring operator access to the reactor building is consistent with the staff's quantitative risk assessment (pipe break plus failure to reset scram).
New operating licenses will include STS.
The staff's analysis also showed that a potential for exceeding 10 CFR Part 100 guidelines exists if the plant operates above STS coolant activity limits.
In t
order to support continued operation without STS coolant activity limits in effect, a licensee should demonstrate, based on analysis of operating history and current and projected fuel performance, that the probability of operating at coolant activity levels in excess of those allowed by STS is less than 10 3 per reactor year. Otherwise, a licensee's response should include proposed revised technical 7,pecifications to conform to the STS coolant activity limits.
5.3 Environmental Oualifications Preliminary results from studies modeling a typical reactor building response to the postulated SDV failure indicate that the expected environmental con-ditions would be less severe than the environmental conditions postulated for a steam-line break in the reactor building.
However, the staff cannot make a definite generic conclusion because specific equipment in the SDV area has not necessarily been qualified for the local conditions that would exist. While the staff recognizes that the SDV piping system is excluded from the scope of the Commission's Order CLI-80-21 (Ref. 17), regarding environmental cualifica-tion reviews, the adequacy of the qualification of the required mitip tion equipment should be verified.
Therefore, licensees in their plant-specific responses should:
(1) Identify the equipment that would be used to detect a break and/or leak in the SDV system and include the qualification of this equipment in the NRC's ongoing EQ program to show that it would perform the identification function.
(2) Identify the equipment needed to mitigate an unisolable break in the SDV-system and include the qualification of this equipment in the NRC's ongoing EQ program to show that it would perform the mitigation function, paying particular attention to the guidance summarized in Table 5.1.
When providing the qualification of this equipment, qualification for service at a given temperature and humidity shall mean that the equipment is capable of remaining on standby and of being energized and operated in the presence of the actual SDV break environmental transient (including specified level of adverse environment as a maximum condition) without any immediate or subsequent loss of required SDV break-mitigating capa-bility.
The SDV break environmental profile assumed for qualification purposes shall be prescribed as to temperature and humidity levels and time duration at each level, and shall be a conservative replica of the postulated transient.
(3) For any equipment required for identification and/or mitigation that is not qualified for service at 212 F and 100% humidity, provide a schedule for defining the plant-specific SDV break environment and a commitment to qualify the equipment in accordance with the NRC's ongoing EQ program.
5-5
6.
REFERENCES NRC reports in the NUREG series and Regulatory Guides are available from the
(
NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission, Washington, DC 20555. Open-literature material is available in public technical libraries.
All other material is available for inspection and copying for a fee at the NRC Public Document Room, 1717 H Street, N.W., Washington, DC 20555.
1.
U.S. Nuclear Regulatory Commission, " Safety Concerns Associated With Pipe Breaks in the BWR Scram System," USNPC Draft Report NUREG-0785, April 1981.
2.
Letter from D. G. Eisenhut, NRC, to all BWR licensees,
Subject:
Safety Concerns Associated With Pipe Breaks in the BWR Scram System, dated April 10, 1981.
3.
General Electric Company, "GE Evaluation in Response to NRC Request Regarding BWR Scram System Pipe Breaks," NE00-24342, April 1981.
4.
Letter from G. Sherwood, General Electric Company, to D. G. Eisenhut, NRC,
Subject:
Safety Concerns Associated With Pipe Breaks in the BWR Scram System, dated April 30, 1981.
5.
Letter fro.n R. L. Gridley, General Electric Company, to J. N. Hannon, NRC,
Subject:
Safety Concerns Associated With Pipe Breaks in the bWR Scram System, dated June 30, 1981.
6.
Letter from D. G. Eisenhut, NRC, to all BWR licensees,
Subject:
Safety Concerns Associated With Pipe Breaks in the BWR Scram System, dated July 7, 1981.
7.
U.S. Nuclear Regulatory Commission, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants - LWR Edition,"
USNRC Report NUREG-0800 (formerly NUREG-75/087), Section 15.6.5,
" Loss-of-Coolant Accidents Resulting From Spectrum of Postulated Piping Breaks Within the Reactor Coolant Pressure Boundary," Rev. 1.
8.
American National Standards Institute, "U.S.A. Standard Code for Pressure Piping," USAS B31.1.0 - 1967, New York, NY.
9.
American Society of Mechanical Engineers, " Boiler and Pressure Vessel Code," New York, NY.
10.
U.S. Nuclear Regulatory Commission, Office of Inspection and Enforcement,Bulletin 79-14, " Seismic Analyses for As-Built Safety-Related Piping Systems," July 2, 1979.
11.
U.S. Nuclear Regulatory Commission, Regulatory Guide 1.26, " Quality Group
(
Classifications and Standards for Water, Steam, and Radioactive Waste-Containing Components of Nuclear Power Plants."
L 6-1 l
12.
Carolina Power & Light Company, " Response to Concerns on the Scram Discharge Volume Drain Line Failure," Docket No. 50-325, August 15, 1980.
13.
NRC Standard Review Plan, USNRC Report NUREG-0800, Section 3.6.1, " Plant Design for Protection Against Postulated Piping Failures in Fluid Systems Outside Containment," Rev. O.
14.
NRC Standard Review Plan, USNRC Report NUREG-0800, Section 3.6.2,
" Determination nf Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping, Rev. O.
15.
General Electric Company, " Additional Information Requested for NRC Staff Generic Report on BWRs," NED0-24708A, December 1980.
15.
U.S. Nuclear Regulatory Commission, "NRC Action Pian Developed as a Result of the TMI-2 Accident," NUREG-0660, Vol.1, May 1980.
17.
U.S. Nuclear Regulatory Commission,11 NRC No. 5, May 1980, p. 707 in the Matter of Petition for Emergency and Remedial Action for Modification of License Concerning the Environmental Qualification of Safety-Related Electrical Equipment.
i 18.
NRC Standard Review Plan, USNRC Report NUREG-0800, Section 15.6.2,
" Radiological Consequences of the Failure of Small Lines Carrying Primary Coolant Outside Containment," Rev. 1.
19.
U.S. Nuclear Regulatory Commission, '; Reactor Safety Study:
An Assessment of disks in U.S. Commercial Nuclear Power Plants," WASH-1400 (NUREG-75/014),
December 1975.
20.
D. Okrent and others, "Some Probabilistic Aspects of the Seismic Risk of Nuclear Reactors," UCLA-CN6-76113, University of California, Los Angeles, December 1976.
21.
A. D. Swain and H. E. Guttmann, Sandia Laboratories, " Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Application,"
USNRC Report NUREG/CR-1278, October 1980.
22.
U.S. Nuclear Regulatory Commission, " Clarification of TMI Action Plan Requirements," USNRC Report NUREG-0737, November 1980.
6-2
7 GLOSSARY AEOD Analysis and Evaluation of Operational Data ADS automatic depressurization system AE architect-engineer hl ASME
-American Society of Mechanical Engineers B0P balance of plant BWR boiling water reactor CFR Code of Federal Regulations CRD controi rod drive ECCS emergency core cooling system y.
EQ environmental qualifications FSAR Final Safety Analysis Report GDC General Design Criterion HCU hydraulic control unit HPCI high pressure coolant injection IE Inspection and Enforcement IGSCC intergranular stress corrosion cracking ISI inservice inspection LPCI low pressure coolant injection LPCS low pressure core spray system M
mitigation capability MSIV main steam isolation valve NRC U.S. Nuclear Regulatory Commission NSSS nuclear steam supply system PI piping integrity RCIC reactor core isolation cooling RCS reactor coolant system RHR residual heat removal RPV reactor pressure vessel SBGT standby gas treatment SBGTS standby gas treatment system SDV screm discharge volume SRP Standard Review Plan SRV safety relief valve STS Standard Technical Specifications TMI Three Mile Island I
l 1
U.S. NUCLEAR REGULATcRY COMMISSION 7
NUREG-0803 BIBLIOGRAPHIC DATA SHEET
- 4. TITLE AND SUBTITLE (Add Volume No.,if approprisol
- 3. RECIPIENT *$ ACCESSION NO.
- 7. AUTHOR (S)
- 5. D ATE REPORT COMPLETED M ON TH YEAR June 1 981
- 9. PERFORMING ORGANIZATION N AME AND M AILING ADDRESS (Include 2,p Codel DATE REPORT ISSUED MONTH VEAm j
Division of Licensing August 1981
\\
Office of Nuclear Reactor Regulation 6- (te*** o'ea */
U. S. Nuclear Regulatory Commission Washington. D. C.
20555 8d"* *'*" * #
- 12. SPONSORING ORGANIZATION NAME AND M AILING ADDRESS (Include Zip Codel p
- 11. CONTRACT NO.
- 13. TYPE OF REPORT PE RIOD COVE RE D (inclussre c' ass)
Regulatory
- 15. SUPPLEMENTARY NOTES 14.(Le*** o/ Mal
- 16. ACSTR ACT 000 words or less)
Safety concerns associated with postulated pipe breaks in the boiling water reactor (BWR) scram system were identified during the staff's continuing investigation of the Browns Ferry Unit 3 control rod partial insertion failure on June 26, 1980. This report includes an evaluation of the licensing basis for the BWR scram discharge volume (SDV) piping and an assessment of the potential for the SDV piping to fail while in service. A discussion of the means available for mitigating an unlikely SDV system failure is provided.
Generic recommendations are made to improve mitigation capability and ensure that s:(stem lintegrity is maintained in service.
17 KE Y WORDS AND DOCUMENT AN A LYSIS 17a DESCRIPTORS 17e iDENTIFiE RS OPEN-ENDED TERMS 1E AV AIL ABILITY ST ATEMENT
- 19. SE CURsTY CLASS (Tn,s reporrt 21 NO OF PAGES unclassified Unlimited so gCgig g S""'"'
d se s onu ass a ni
Uh$lTED STATES NUCLEAR REGULATORY COMMIS$10GO f
7 W A$HIN GTOG4, D. C. 20303 Post AG E AND F E ES P AID OFFICI AL BUSINESS u.s. N UCLE A R RE GU LA TOR Y PEN ALTY FOR PRIV ATE USE, $300 CoMussstoN L
L J
I
\\
r 2
6 O
E HmO 3
i H
O 71 03Ix
$w EIw HmE 2
3 2
O CO C
Nsi s
- _ _ _ _ _ _ _ _ _. _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - - - - - - - - - - - - - -. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -