ML20040C392
| ML20040C392 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 01/20/1982 |
| From: | Mills L TENNESSEE VALLEY AUTHORITY |
| To: | Harold Denton Office of Nuclear Reactor Regulation |
| References | |
| RTR-NUREG-0803, RTR-NUREG-803 GL-81-34, NUDOCS 8201270597 | |
| Download: ML20040C392 (26) | |
Text
_ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _.
~
TENNESSEE VALLEY AUTHORITY CH ATTANOOG A. TENNESSEE 37401 400 Chestnut Street Tower II January 20, 1982 e
RECEIVED D
9-Mr. Harold R. Denton, Director JM 2 619825 i Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission b"
3 828 823:tresr4::a Washington, DC 20555 f$:"* 88
/
4
Dear Mr. Denton:
g.
In the Matter of the
)
Docket Nos. 50-259 Tennessee Valley Authority
)
50-260 50-296 In response to D. G. Eisenhut's August 31, 1981 letter to All BWR Licensees, enclosed is a comprehensive evaluation for Browns Ferry of a scram discharge system pipe break scenario consistent with the guidance given in NUREG-0803 Based upon this analysis and our subsequent actions described in the enclosure, we believe that no additional actions are necessary for Browns Ferry Nuclear Plant. We also request that further generic regulatory actions on this issue be deferred pending completion of your severe accident sequence analysis (SASA) program investigating this scenario using Browns Ferry as a model.
Very truly yours, TENNESSEE VALLEY AUTHORITY Yb L. M. Mills, Manager Nuclear Regulation and Safety Subscribe a d sworn t before me this dayof!
xdA N f 1982.
1 e
Notary Public My Commission Expires b
i Enclosure g0\\
L sj 8201270597 820120 PDR ADOCK 05000259 p
PDR An Equal Opportunity Empicyer
~.
4 t
ENCLOSURE Response to Generic' Letter 81-34 Safety Concerns Associated with Pipe Breaks in the BWR Scram System Introduction j
(In regard to possible pipe breaks in the,BWR scram system as described
~
in references 1 and 2, TVA has been actively participating with General
' Electric Company (CE) and NRC to resolve tlue associated safety concerns.
We twice met with GE to review its generic evaluation, NED0-24342
+
l (reference 3), prior to presentation to NRC-on April 28, 1981. Additionally,-
we provided review comments to NRC staff on the preliminary draft NUREG-0803
-(reference 4) and, as manpower would permit, answered ~ direct NRC staff questions about mitigation equipment and operator actions to aid in their problem resolution.
As required by the April 10, 1981 letter (reference 2) to All BWR Licensees, we provided our 45-day response (reference 5) referencing the generic evcluation, NEDO-24342. We also committed to continue to review Browns Ferry Nuclear Plant in light of NEDO-24342 and analyze any plant-specific differences and their implications. Since that time, NUREG-0803.has been issued by Generic Letter 81-34 (reference 6) providing guidance for response to the 120-day requirement of the April 10, 1981 letter.
In a manner similar to the methodology of NUREG-0803, we have performed comprehensive analysis of the scram syste;n at Browns Ferry with an r.
emphasis on addressing the recommended ~ actions of the NUREG. In addition, we have performed a plant-specific probabilistic risk assessment (PRA)
I
~
of the scram system piping failures (appendix B).
Based upon our review, PRA, and subsequent actions, we believe that the probability of core d3 mane from the postulated scenario is very small and that the additional =
3:
measures described in this letter are sufficient to fully address this issue.
4 The following is the plant-specific detailed 120-day response to the-April 10, 1981 letter following the format and addressing the issues as presented in NUREG-0803.
Licensing Design Basis for Scram Discharge Volume Piping A.
Compliance with Reactor Coolant Pressure Boundary Requirement i
We have reviewed the' control rod drive (CRD) hydraulic system for conformance with the pressure boundary requirements of section 50.2(v) of 10 CFR 50.
We agree with the staf f that by strict interpretation of the regulation, the withdraw lines up to and f '
extensions of~the reactor coolant pressure boundary. We believe, including the scram discharge valves should be considered as however, that'due to the design of the CRDs with the redundant l
built-in seals and restricted flow area,.the intent of the regulation is met and the reactor coolant pressure boundary ends l
l
. at the CRD.
Even if the withdraw lines are considered a part of the pressure boundary, we fully agree with the staff that the departure from general design criteria (CDC) 55 is justified on the basis of the safety function they serve, the potential decrease in the reliability of the CRD system, and increase in probability of an anticipated transient without scram (ATWS) if additional isolation valves are installed.
B.
Emergency Core Cooling Capability We have reviewed Browns Ferry's conformance with GDC 35 and agree with the staff that the postulated leak rate from the SDV piping system could potentially cause adverse effects on the ECCS required for long-term cooling if the break is not isolated or the reactor is nor depressurizec. This operator action is a logical extrapolation from the present emergency operating instructions (E01s) and is not urgently required ard may be in a controlled cooldown manner due to the extended period of time needed for the low pressure ECCS systems to be jeopardized by either reactor building flooding or adverse environmental conditions.
In addition, Browns Ferry has the capa-bility for crossticing the RHR systems on the nonaccident units to the RHR system on the accident unit for more redundant long-term cooling. Therefore, we believe that we are in conformance with CDC 35 in regard to long-term cooling capability.
Regarding compliance with the ECCS requirements as described in 10 CFR 50, section 50.46, we agree with the staff and CE that this event is bounded by other loss-of-coolant analyses. As described later, the leak flow rate considered is based upon an average leakage flow rate of 3 gpm for each drive and the standard review plan (SRP) postulated equivalent crack size in the scram discharge volume (SDV) header.
Scram Discharge Volume Piping Integrity As recommended in NUREG-0803, we have taken various actions to ensure that the SDV piping system is designed, fabricated, installed, inspected, and maintained in a manner consistent with its service conditions and importance to safety.
A.
Design, Installation, Ouality Assurance, and Inspection The design of the Browns Ferry SDV system was subcontracted to Reactor Controls, Incorporated (RCI) through the GE NSSS contract.
Thus, the GE design specifications for this system were used, specifically the code requirements of USAS B31.1 as supplementeu by GE.
We performed a review of the vendor work consistent. with our normal engineering design review program; however, to ensure the adequacy of the design and construction and to addr(se the concerns of the NRC staff as cited in appendix B of reference
- 1. we have taken the following actions.
. 1.
The SDV system was inspected in accordance with OIE Bulletin 79-14 (reference 7).
Although the bulletin does not require inspection of small-diameter piping, we have inspected a typical set of scram discharge risers from the hydraulic control units (HCUs) to the SDV header, the SDV vent lines, one of the SDV vent crosstie lines, a major portion of the drainage crosstie lines between the SDV headers and the scram discharge instrument volume (SDIV), and two of the SDIV drain lines. Under the guidelines of OIE Bulletin 79-14, the SDV piping system is qualified for temporary operation until completion of the long-term SDV modifications and associated seismic reanalysis.
The reanalysis and modifications will qualify the piping system to ASME section III class 2 allowable stress levels.
The tentative schedule for completion of the OIE Bulletin 79-14 seismic reanalysis, based upon our current outage schedule, is:
Unit 1 - August 1, 1982 Unit 2 - March 12, 1982 Unit 3 - February 1, 1983 The schedule for the long-term modifications is based upon our outage schedule and onsite manpower predictions as presented in references 8 and 9.
2.
We are incorporating the SDV piping into the Browns Ferry inservice inspection (ISI) program in accordance with the applicable requirements of ASME section XI class 2.
The inservice examinations of the SDV piping will begin during the second cycle of the first inspection interval.
B.
SDV Piping Failure Mechar isms We agree with the staff that, as presented in NUREG-0803, there appears to be no credible failure mechanisms for the piping in the SDV system besides the seismic loading concerns and possible operational errors.
As previously presented, we are committed to performing the seismic reanalysis and subsequent modifications to upgrade the system to ASME section III class 2 levels.
In addition, we have performed a review of our equipment maintenance, surveillance, and operations procedures to ensure that the integrity of the SDV system would not be jeopardized during times that its use may be required.
For the purposes of our plant-specific risk assessment presented in appendix B, we have taken credit for the above actions to reduce the extremely conservative estimate of the SDV niping system failure probability acknowledged in NUREG-0803. Our analysis la appendix A, while still con-servative, indicates that the probability of a piping failure in the SDV system is sufficiently small that the scenario is highly unlikely and would not warrant any further actions beyond those described herein for Browns Ferry. However, to be consistent with NUREG-0803, we continued to analyze the scenario given the SDV piping break and performed a plant-specific PRA to determine the probability of core damage of this event.
. Mitigation Assessment To allow continuation of the analysis, we assumed a piping failure in the SDV piping system following the methodology of NUREG-0803 but using Browns Ferry plant-specific information. We assumed that the reactor was the safety / relief valve (S/RV) pressure of 1105 psig af ter a scram at followed by a break in the SDV system before scram reset.
A.
Expected Leak Rate The expected leakage flow rate for this scenario depends on the average condition of the CRD seals, the break size, the reactor coolant temperature and pressure conditions, and the amount of CRD pump flow to the CRDs.
CRD Seal Condition We have reviewed and agree that the assumed 3-gpm seal leakage for each CRD as presented in NEDO-24342 and NUREG-0803 is reasonable. This leakage rate is based in part upon the analysis performed by GE as presented in NEDC-24276 (reference 10) concerning the incomplete rod insertion event on Browns Ferry unit 3.
Furthermore, CRDs with excessive seal leakage are replaced at each refueling outage since these leaking drives are an operational nuisance. Additionally, our normal surveillance on CRD withdraw stall. flow indicates leakage rates consistent with the assumed flow rate.
This would give a total leakage rate of approximately 550 gpm through the CRD seals.
Break Size For this evsluation and as discussed later, the break is assumed to be located in the SDV header. We reviewed the scram data for the past 140 scrams covering approximately 9.75 reactor years and have conservatively calculated that the SDV header is pressurized less tbgn 0.03 percent of the time.
Even if a scram is considered a nocmal plant condition, section 3.6.1 of the NRC SRP (ref erence 11) allows this piping system to be considered a moderate-energy fluid system since it is within the temperature / pressure conditions of a high-energy fluid system less than 2 percent of the time.
Addi-tionally, section 3.6.2 of the SRP (reference 12) provides that only a through-wall leakage crack need be postulated for moderate-energy fluid system piping. Using the conservative crack size formula prescribed by SRP section 3.6.2, the postu-latedcracksizeinthe6-inchdiameterscgedule80SDVheader iscalculatedtobeapproximatelyg.005ft as compared to the assumed break area of 0.010 ft used in NEDO-24342 and NUREG-0803.
Reactor Coolant Temperature and Pressure Coqi_it,lons l
As indicated by GE, the leakage rate past thg CRD seals is equivalent to a break area of about 0.007 ft using the Moody separated flow model. The critical flow rate will therefore i
. vary with the temperature and pressure of the leaking fluid, much of which will be reactor coolant.
CRD Pump Flow in addition to reactor coolant leakage, CRD charging and cooling water will be leaking past the CRD seals into the SDV.
This water being much cooler than the reactor coolant water will decrease the bulk enthalpy of the fluid leaking past the seals and thereby increase the critical flow rate calculated using the Moody model.
For evaluation of this event, we requeseed GE to perform a plant-specific leak rate calculation consiste.it with the methodology used in NEDO-24342. The following base conditions were prescribed for the analysis.
- Reactor pressure is at the S/RV setpoint plus the static head over the CRD system (1140 psia).
- The break size is 0.004969 ft
- The mean average CRD postscram leakage is 3 gpm.
- When considered, the CRD pump flow is 100 gpm at 80 F.
The analysis was performed assuming two conditions, one CRD pump operating and no CRD pumps operating. This was required due to the installed pump arrangement at Browns Ferry. There are three CRD pumps servicing units 1 and 2.
Of the three, the tvo normally in-service pumps are not fed from emergency power while the spare standby pump is fed by emergency power. Unit 3 has one normally inservice pump not fed by emergency power and one standby pump fed from emergency power. The results of the analysis and a comparison to NEDO-24342 are presented in table I.
TABLE I Mass and Energy Leakage Rates Mass Flow Rate Enthalpy Energy Rate (1b /sec)
(Btu /lb )
(Btu /sec)
BFNP Without CRD System 37 563.4 2.1 x 10 Flow (278 gpm)
BFNP With CRD System Flow 70 461 3.2 x 10' (525 gpm)
NEDO-24342 70 557 3.9 x 10 (525 gpm) i
. It should be noted that GE calculations showed that the mass flow and energy rates are limited to that with the CRD system flow regardless of increase in SDV crack size. To remain' conservative for the continuation of the evaluation, we assumed that the leakage rate was 550 gpm; however, it should be remembered throughout the evaluation that the leakage rate would be approximately 50 percent less if the CRD pump.was lost for any reason. As the reactor is depressurized either through the automatic depressurization system (ADS) or through normal system cooldown, the break flow and energy rate would decrease accordingly.
B.
Diagnostic Information We generally agree with the staff's presentation on information available to the operator to diagnose the event in that there is not a single break-detection signal that would independently and unambiguously indicate to the operator that there is a break in the SDV system.
We are'certain, however, that taken together the many diverse signals provided to the operator will unambiguously indicate that there is a system break outside of primary containment.
As described later, the immediate operator, actions will be no different if~there is.a break in the SDV header or any other piping outside containment' connected to the primary system. After the immediate operator actions and upon finding that the break is not isolated, the operator will use all of the available instrumentation.
to determine the break location. The fact that two of these signals,.
excessive CRD high temperature alarms and the control rods rec.aining in overtravel, are not encountered on a normal scram may directly lead
' the operator to EuGject a break in the CRD system. If the break flow is so low that these signals do not occur, the time period for the operator to diagnose the event is lengthened considerably. Of in this case the event is also of proportionally less severity.
- course, We therefore agree with NUREG-0803 that no specific leakage detection instrumentation for the SDV system is necessary.
C.
System Response and Operator Actions Given the SDV header break following a scram, the system response will be very similar to that following a normal scram. Thus, the operator actions will also be very similar until the operator realizes that there is a break outside of containment.
Normal System Response and Operator Actions Following a normal scram in which the MSIVs remain open, the scram procedure requires the operator to immediately verify that all of the control rods have inserted, the reactor power has decreased, and the water level is above the top of the fuel.
He is subsequently required to trip the main turbine and all but one reactor feedpump, condensate pump, and condensate booster pump to allow the feedwater system to maintain water level. The system pressure is controlled by bypassing the steam to the condenser.
Next, he is required to place the
. mode selector switch (MSS) in " shutdown" to avoid inadvertent MSIV isolation and then reset the scram. Note that the feedwater system is the preferred means of regulating water level.
If the feedut;ter system was not available, RCIC (or HPCI if RCIC is inoperable) would be started manually or automatically and operated to maintain water level. All of the above actions typically occur within three minutes of the scram.
If the scram involved a transient in which the MSIVs closed, the operator action through scram reset is identical to the normal scram event with the exception that RCIC and CRD flow are used to restore and maintain water level. HPCI may also start automatically or be started manually to restore water level but is usually shut down before reaching the high water level HPCI and RCIC trip setpoint. The reactor pressure is required to be maintained at approximately 850-900 reig by manual operation of the S/RVs to prevent automatic operation and to equalize the heat loading in the suppression pool. The operator is next required to reopen the MSIVs and reestablish the condenser as the main heat sink if possible.
If, however, the MSIVs cannot be reopened, the operator begins a controlled depressurization and cooldown at a rate of <90 F/h using the S/RVs and the RHR system in the suppression pool coniing mode.
With a controlled cooldown, the reactor pressure would reach 350 psig within approximately one hour and the condensate booster pumps wculd hegin supplying condensate to the reactor.
Then, within approxjnately 2-4 hours, depending on the depressuri-zation rate, the rcactor would be at 100 psig and RHR shutdown cooling to the vessel could be established.
System Response and Operator Action with an SDV Header Break The system response to this event will be very similar to the normal scram event if the feedwater system is available. The feedwater pumps will easily make up the 550 gpm loss.
t For the event where the feedwater pumps are not available, the RCIC and CRD systems will not restore water Icvel as rapidly as normal. This time differential may or may not be realized by the operator depending on whether HPCI was used to assist in the water level restoration. If HPCI was used to restore the water level then tripped of f, RCIC and CRD flow would be adequate to maintain the level within the normal range.
Regardless of whether HPCI was used or not, RCIC and CRD flow with S/RV actuation could maintain the water level since the combined flow is essentially equivalent to the decay heat generation as indicated in figure 3.1.1.126.2 of NEDO-24708A (reference 13).
The only significant difference with this scenario versus a normal scram is the fact that the reactor building environment
i
. i is slowly deteriorating. Therefore, any difference in operator action would be based on attempts to identify and isolate the break or mitigate its effects.
As described earlier, there is no certainty that the operator will remotely identify the break location based upon available control room instrumentation. However, it will be recognized that there is a primary system break outside of containment. If the reactor building environment was not too harsh, the shift engineer would probably attempt to send an observer to physically inspect the area. Discounting accessibility, the control room operator could concurrently and rapidly determine that the
{
break is not a main steamline, HPCI steamline, RCIC steamline, l
or reactor water cleanup system (RWCU) break due to the redundancy of the presently installed break detection instrumentation and isolation logic. This would leave only three other break location possibilities, (1) SDV system, (2) instrument lines, or (3) RWCU blowdown line if it was in use before the scram.
Given this information, the operator would probably attempt only two actions to isolate the break; he could isolate the RWCU blowdown line or attempt to reset the scram valves had the scram not been reset earlier.
While the successful reset of the scram would terminate the break flow and make this event a normal scram situation, we cannot be certain that the operator would recognize the need to reset the scram. Additionally, there are certain scram signals that cannot be bypassed or reset without manually placing inhibits or jumpers. To establish a plant-specific data base for the probability to reset the scrau for use in the PRA in appendix B, we reviewed 140 scrams covering the past 9.75 reactor years. Of the 140 scrams, all were reset within 20 minutes, only 5 required more than 10 minutes, the mean reset I
time was approximately 3.5 minutes, and the median reset time was approximately 2.5 minutes. These scrams covered a variety of events including MSIV isolations and loss of condenser l
vacuum. Therefore, while we are not certain that the operator l
will reset the scram due to a break outside containment, experience has shown that a high probability exists for reset of the l
scram in a short time due to normal operator training and guidance from the scram procedure.
Assuming that the scram could not be reset, only two actions could be taken to isolate the break or mitigate its effects.
The first, manual isolation of the individual scram discharge risers at the hydraulic control units (HCUs), could be ruled out during this time period based upon the lack of knowledge that the break is in the SDV system as described earlier. The second action is to cooldown and depressurize the primary system to reduce the break fluid flow and enthalpy.
It is noted that the latter course of action would be prescribed regardless of whether the break was located.
NUREG-0803 suggests that BWR Owners' Group (BWROG) emergency procedures guidelines (EPGs) be modified to require rapid depressurization given this event or other similar events that
i
.ij could threaten ECCS equipment in the reactor building. By its charter, the BWROG cannot respond directly to NRC requests for utility action except at the discretion of its members. Neither can TVA commit the owners' group to a specific course of action except by its participation in owners' group decisions by vote.
Thus, we can only provide a response to the staff's guidance to the BWROC in NUREG-0803 as if it were addressed to us directly. However, the BWROG has discussed the guidance of NUREG-0803 regarding modification of the EPGs and acknowledges the benefits of treating the subject generically. The BWROG is in the process of completing an extension of the guidelines to include steps for reactivity control and certain other modifications to the guidelines which have been discussed with your staff.
It is our judgement that completion of the basic emergency procedures guidelines outweighs, in immediate importance, the NUREG-0803 concerns. After current activities on the guidelines are substantially complete, we will support a prelininary study by the BWROG to determine the best approach to fulfilling the intent of the guidance provided in NUREG-0803.
It is not clear that the best approach will involve modification of the guidelines. When that study is complete, currently expected to be near the end of the first quarter of 1982, the owners' group will determine whether to authorize specific actions to modify the EPGs.
Our plant-specific emergency procedures are being rewritten to reflect the EPGs and will replace our current emergency operating instructions (E0Is) when the EPGs have been approved by NRC and the operators retrained accordingly. We reviewed our current E01 concerning primary system breaks outside con-tainment and have found that it does not address unisolable breaks of this type. Our technical specifications regarding coolant leakage and primary containment do, however, mandate a prompt reactor cooldown. Furthermore, the prudent and likely operator actions would be to initiate a cooldown and depressuri-zation consistent with the break size or building environment.
Thus, the operator would initiate a cooldown and depressurization whether the break is in the SDV system, instrumentation line, or-unidentified. Hence, the operator need not necessarily reset the scram or identify the break location. ?ending further analysis and consideration by the BWROG, we are deferring the decision to make specific changes to the current E01.
i l
D.
Reactor Building Environment Given a break in the SDV system, NUREG-0803 describes three environ-mental concerns caused by the consequentiel leakage. We reviewed these concerns, reactor building flooding high temperature and humidity, and radioactivity release, and t ey will be discussed individually. Our approach was based upon the discussiors in reference 1, NEDO-24342, NUREG-0803, and our ongoing equipment quali-fication program in response to NRC OIE Bulletin 79-OlB (reference 14).
We have not and do not expect to perform an extensive and detailed reactor building response for this scenario given the extremely low probability of the event and presently available information from the 79-01B program.
. Flooding Concerns As discussed earlier, we assumed a leakage rate of 550 gpm.
To remain conservative, we also assumed that all of the steam condenses and all of the leakage flows to the reactor building basement. Finally, we assumed no sump pump operation throughout the event.
As typical with most BWRs, the RHR pumps, core spray (CS) pumps, and HPCI and RCIC pumps are all located within the basement in the four corners of the reactor building separated approximately 120 feet. The physical design of the basement is not necessarily typical in that there is no wall separation between the torus floor area, RHR and CS pump rooms, and the HPCI and RCIC pump rooms except for a one-foot curb. Therefore, above one foot there is flooding communication between all of these areas.
2 The approximate floor area of the basement is about 15,000 ft providing a large area for this leakage water to spread.
Assuming no depressurization and a constant 550-gpm leakage flow in the baserant, water would accumulate at a rate of 0.3 ft/h.
It would take the following times for flooding to jeopardize the pumps.
Top of RHR pumps 11.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> Top of CS pumps 13.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Centerline of RCIC suction 15.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and discharge Centerline of HPCI Booster 14.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> pump suction Note that these times are conservative since the RHR and CS pumps are water-cooled and water on top of the pumps below the motors should cause no damage. Therefore, from a flooding standpoint, there is no necessity to have depressurized the reactor or isolate the break before approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
This indicates that, in consideration of flooding, the reactor can be cooled down in a controlled manner if started within about 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of the break.
High Temperature and Hamidity Concerns As mentioned earlier, we have not performed a detailed reactor building temperature and humidity response but have reviewed the information presented in NUREG-0803 and NED0-24342. With information from our OIE Bulletin 79-01B program, we compared the qualification of the safety system components discussed below with the bounding values of 212 F and 100-percent humidity as prescribed in NUREG-0803.
Our environmental qualification program gives the following information about the mitigation equipment.
1.
Typical RHR and CS pugp motors have been successfully tested by GE in a 212 F and 100-percent humidity environ-ment for 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. Additionally, the motor housings are a " drip proof" type and any water cascading from the above elevations should not impinge on the pump motor.
-9 I-1 1 2.
Documentation does not exist to show that the HPCI and RCIC systems are qualified for this environment. However, the Terry turbine manual and Browns Ferry FSAR indicate that they would be operable in ambient conditions of 148 F and 100-percent humidity. For the PRA in appendix B, the HPCI and RCIC are conservatively assumed to fail if the reactor is not depressurized or the leak not isolated.
3.
The scram valves and backup scram valves have been type-tested and qualified for this environment for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
4.
On units 1 and 2, the motor control centers (MCCs) for all but 4 of the 13 5/RVs are located outside of the harsh environment. On unit 3, the MCCs for all but three of the S/RVs are located outside of the harsh environment. The MCCs are not presently qualified for the given environment but are to be qualified under a BWR Owners' Group generic qualification program. For this atudy, the remaining nine S/RVs on units 1 and.2 and the remaining ten S/RVs on unit 3 are sufficient for cooldown and depressurization and provide sufficient redundancy.
5.
The CRD pumps have not been shown to be qualified for this environment.
6.
The valves necessary for RHR crosstie with the other units are qualified for this environment.
7.
The valves necessary for RHR service water (RHRSW) crosstic for alternate low-pressure makeup are qualified for this environment.
Note: While the information for items 3, 6, and 7 was determined for use in our 79-01B program, this equipment is not being qualified for the scenarios analyzed in that program.
In addition to the above information, our review of the feedwater and condensate systems indicates that there are no controls within the harsh environment that would jeopardize their operation in this event. Finally, the RHR systems in the other units can be crosstied to the accident unit and should not be affected by the environmental conditions proposed.
In summary, although all of the mitigating equipment has not been documented to be qualified for the 212 F and 100-percent humidity environment, we believe that a sufficient amount is qualified and adequate makeup sources exist outside of the harsh environ-ment to provide backup supply. We also believe, based upon the GE calculations, that the general reactor building will not attain these conditions for an extended period of time due to standby gas treatment system (SBGT) operation and possible rupture of the blowout panels. Therefore, we do not intend to address the high temperature and humidity concerns any further for this postulated event.
Radiological Concerns As stated previously, our analysis of the environmental concerns did not include a detailed plant-specific building response for Thus, it is temperature, humidity, or radioactivity release.
based upon the NUREG-0803 and NEDO-24342 discussions.
Upon reviewing the scenario and given the modified operator actions earlier noted, we would not expect to require manual isolation of the HCUs within the first 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of the event.
For the conditions given in table 4.2 of NUREG-0803, the expected dose rates in the vicinity of the leak would not preclude iso-lation of the HCUs assuming Browns Ferry or standard technical iodine (DEI) coolant specifications (STS) on dose equivalent The only case in which this action would be required activity.
is when the scram could not be reset and the reactor could not be depressurized. As indicated in the PRA in appendix B, this is a highly unlikely event.
A second radiological concern is that of offsite doses given that the reactor building and refuel zone blowout panels rupture due to increased pressure. As stated in NUREG-0803, the release remains below 10 CFR part 100 limits if the coolant activity is below STS limits, but that the 10 CFR 100 limits would be exceeded assuming Browns Ferry technical specification activity and the " iodine spiking" phenomenon identified in SRP section 15.6.2 (reference 15). Based upon the above, section 5.2.2 of NUREG-0803 suggests that the Browns Ferry technical specifications for coolant activity should be changed to be consistent with'STS.
We have performed a thorough investigation of the bases for the original coolant activity specifications and have found the We have also determined specified concentration to be adequate.
that the Browns Ferry technical specifications are actually in one sense more restrictive than those in the STS.
The value for initiation of our sampling and analysis program is 0.032 pCi/g, 1 percent of the Browns Ferry technical specification limit of 3.2 pCi/g. This is 6.25 times lower than the 0.2 pCi/g STS limit.
Section 5.2.2 of NUREG-0803 indicates that there is no need to revise the Browns Ferry coolant activity technical specifications if they can be shown, based on analysis of operating history and past and projected fuel performance, that the probability of 3
L exceeding the STS limits is less than 10 per reactor year.
In review of our operational history cf more than 105,000 cumulative hours, we found that we have had only one instance of calculating a DEI concentration above the 0.032 pCi/g surveillance limit. This event occurred on unit 1 in 1975 when we had a calcu-lated DEI of 0.0334 uCi/g, still well below the STS limit. This maximum DEI occurred on the initial operating cycle of unit I which contained all GE 7x7-type fuel assemblies. Unit 1 cycle I was also operated before the application of fuel preconditioning recommendations.
1
.p
- i. Our fuel performance experience as shown in table II, as well as that of other BWRs (figure 1), indicates that the improved 8x8-type fuel assemblies are less likely to experience cladding
~
defects.than the 7x7 assemblies when operated in accordance with GE preconditioning recommendations. All of our 7x7 assemblies are being replaced with the 8x8, 8x8R, and P8x8R assemblies, and the only remaining 7x7 assemblies will be
-replaced during the next unit 2 refueling outage presently scheduled for August 1982. In addition, it has been our general policy to sip our fuel to locate and remove leaking-assemblies whenever the pretreatment offges activity exceeds 100,000 uCi/sec.
3 TABLE II C
' Fuel Sipping Results for Browns Ferry Nuclear Plant EOC(
Leakers No. 7x7 No. 8x8 Unit
.1 1
6
-6 0
1 2
16 14 2
1 3
14 10 4
1 4
11 7
4 2
1 3
3 0
2) 2 2
2 2
0 Did not sip (3) 2 3
3 1
1 0
1 Did not sip ((3) 3 2
3) 3 3
Did not sip Totals-53 42 11 Notes:
(1) End of cycle
- )-
(2)- Sipped discharged bundles -- no sipping during EOC (3) Coolant activity so low that sipping not required
~
i In summary, based upon our operating experience and past and
.expectedfuelperformance,we_gelievetheprobabilityof l
exceeding STS is less than 10 per reactor year'..Therefore, we do not intend to change our technical specification limits on coolant activity and believe that, given the SDV-break, the radiation lireits e.111 be far.below those estimated in NUREG-0803.
l
-~
. Figure 1 General Electric Fuel Performance Improvement (As provided by GE)
- 1. 0.
0.8 5
.2 L
8 0.6-
=
J N
i 6
- 0. 4 -
wZWve W
R.
0.2 74 75 76 77 78 79 80 81 YEAR Summary i
We have performed a comprehensive evaluation of this scenario from pipe break initiation through mitigation activities.
In addition, we have performed a conservative plant-specific PRA given the break and have deter-mined that this sequence of events is not a significant contributor to core damage and overall plant risk. We therefore believe that no further j
actions based upon this postulated s.enario need to be taken for Browns
(
j Ferry Nuclear Plant.
I f
We also wish to note in cocclusion that Oak Ridge National I.aboratory (ORN1.) is performing for ti e NRG nevere accident sequence analysia (SASA) analysis niven the break program a detailed systems and hiilidinn response
)
in the SDV.
They are using 15rowns Ferry as the model plant, and we are t
f providing technical informition as reqties t ed. We therefore recommend that I
any further generic regulatory action on this issue he deferreti pent!!nn completion of this analysis.
r-I L
REFERENCES 1.
U.S. Nuclear Regulatory Commission, " Safety Concerns Associated with Pipe Breaks in the BWR Scram System," USNRC Draft Report-NUREG-0784, April 1981.
2.
Letter from D. G. Eisenhut.NRC, to All BWR L'icensees dated
~
April 10, 1981.
3.
. General Electric Company, "GE Evaluation in Response to NRC Request j
Regarding BWR Scram-System Pipe Breaks," NEDO-24342, April 1981.
4.
U.S. Nuclear Regulatory Commission, " Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping," USNRC Draft Report
.NUREG-0803, June 1981.
5.
Letter from L. M.' Mills to H. R. Denton, NRC, dated May 29, 1981.
6.
Letter from D. G. Eisenhut, NRC, to All BWR Licensees (except Humboldt Bay) dated August 31, 1981 (Generic Letter 81-34).
7.
U.S. Nuclear Regulatory Commission, Office of Inspection and Enforce-ment Bulletin No. 79-14, " Seismic Analyses for As-Built Safety Related Piping Systems," July 2, 1979.
8.
Letter from L. M. Mills to H. R. Denton,.NRC, dated May 5, 1981.
9.
Letter f rom L. M. Mills to H. :R. Denton, NRC, dated October 28, 1981.
I 10.
General Electric Company, " Evaluation of Incomplete Control Rod Insertion Event at Browns Ferry-3," NEDC-24276, October 1980.
11.
NRC Standard Review Plan, USNRC Report NUREG-0800,.Section 3.6.1,
" Plant Design for Protection Against Postulated Piping Failures in Fluid Systems Outside Containment," Rev. 1, July 1981.
12.
NRC Standard Review Plan, USNRC Report NUREG-0800, Section 3.6.2,
" Determination of Break Locations and Dynamic Effects Associated i
with the Postulated Rupture of Piping," Rev. 1, July 1981.
i s
13.
General Electric Company, " Additional Information Requested for NRC Staff Generic Report on Boiling Water Reactors," NEDO-24708A, Rev. 1, December 1980.
14.
.U.S. Nuclear Regulatory Commission, Office of Inspection-and Enforce-ment Bulletin No. 79-OlB, " Environmental Qualification of Class IE Equipment," January 14, 1980.
15.
NRC Standard Review Plan, USNRC Report NUREG-0800, Section 15.6.2,
" Radiological Consequences of the Failure of Small Lines Carrying Primary Coolant Outside Containment," Rev. 2, July 1981.
- 16. - U.S. Nuclear Regulatory Comm!ssion, "heactor Safety Study: An l
Assessment of Risks in U.S. Commercial Nuclear Power Plants,"
WASH-1400 (NUREG-75/014), December 1975.
+
~.
-~
APPENDIX'A SDV System Piping Failure Probability We reviewed the piping failure probability discussions as presented both in NEDO-24342 and NUREG-0803. We realize that there are no universally accepted probabilities for various types of pipe' breaks. The many sources of data, depending upon the piping service conditions, qualification, testing and inspection, and failure modes, indicate probability ranges of several orders of magnitude. GE's probability data, extracted from WASH-1400(reference 16)andpresentedinNgDO-24342,estimatestheSDV piping system rupture rate to be <3.5 x 10 per reactor year. The estimate used in NUREG-0803, which is also extracted from WASH-1400, shows a failure rate of 10-4 per reactor year giving credit to the SDV system
'being pressurized less than 1 percent of the time. However, this is a generic estimate and the staf f considers it extremely conservative based upon the lack of generically identifiable failure mechanisms, differences in field construction at various plants, and differences in ISI require-ments. The staff, and likewise GE, did not, however, consider the seismic qualification of the system.
On a Browns Ferry plant-specific pipe length basis, we determined the probability of piping failures in the various portions of the SDV system using the 3 x 10 undetected defects per reactor year -ft referenced in NUREG-0803. These probabilities are. tabulated in table A-1.
- However, we believe that these probabilities are overly conservative by more.than an order of magnitude based upon the following.
1.
Review of the scram data for the three unita at Browns Ferry for tha past 9.75 reactor years indicates that the SDV system is pressurized less than 0.03 percent of the time.
2.
The QA audit of the design, fabrication, installation, and testing of the SDV system indicates that it met GE and TVA specifications.
3.
We are committing to including the SDV system in the ISI program in accordance with ASME section IX for class 2 piping.
4.
We have reviewed our equipment maintenance, surveillance, and operational procedures to ensure minimization of the probability of inadvertently-reducing the pressure boundary integrity of the SDV system when it may be required.
5.
The SDV system is qualified for temporary operation under the guide-lines of OIE Bulletin 79-14 and will in the future be seismically reanalyzed and modified to be qualified to the ASME section III class 2 allowable stress levels.
6.
We agr.u with the staff and GE and have not identified any failure mechanisms for the SDV system piping.
l
' As indicated in table A-1, we have conservatively assigned a failure probability one order of magnitude lower than indicated without the above information.
TABLE A-1 SDV System Piping Failure Probabilities Piping Approximate WASH-1400 BFNP Assigned Description Piping Length Probability Probabilities
-6 12" CS Sch. 80 12' 3.60 x 10 3.60 x 10~
-4
-5 6" CS Sch. 80 465' l.40 x 10 1.40 x 10
-5
-6 2" CS Sch. 160 150' 4.50 x 10 4.50 x 10
-5
-6 1" CS Sch. 160 180' 5.40 x 10 5.40 x 10
-5
-6 3/4" CS Sch. 160 65' 1.95 x 10 1.95 x 10
~
-5 3/4" SS Sch. 80 1785' 5.36 x 10 '
5.36 x 10 According to the SRP, section 3.6.2, cracks should be postulated in moderate-energy fluid systems for piping or branch runs exceeding a nomi-nal pipe size of 1 inch. As indicated in the table, a failure in the 12-inch SDIV is very unlikely when compared to the remainder of the system and will not therefore be considered. A failure in the 6-inch SDV header is a significant contributor to the remainder of the c2mulative probability and carries with it the bounding leakage rate. Piping failures, including circumferential breaks, in the piping upstream of the manual isolation valves and check valves were determined to be minor in -ize and with no short-tern effects on core cooling capability. The leakage flow in this piping is lleited to the seal leakage from one CRD and is therefore not considered in the failure probabilities.
To be congervative, the cumulative ' probability of piping failure of l
8.0 x 10 per reactor year for use in the PRA in appendix B is assigned to the 6-inch SDV header.
In summary, the probability of a significant
{
piping failure in the SDV system at Browns Ferry is so small that this alone should indicate that no further actions based upon this scenario should be required.
l l
t l
l i
l
APPENDIX B Probabilistic Assessment of a Postulated SDV System Pipe Break at Browns Ferry Nuclear Plant The following is a quantitative assessment of the probability of core damage resulting from an SDV system pipe break given that a successful scram has occurred following a transient. This analysis uses as a base-line configuration event trees developed by GE in response to NUREG-0803 with modifications applicable to Browns Ferry.
It should be noted that TVA is performing a probabilistic risk assessment of the Browns Ferry unit I which will provide detailed calculations of the probability of core damage following plant transients and loss of coolant accidents.
The Browns Ferry PRA uses an approach that will enhance the calculations performed in this analysis and will place this particular sequence in proper perspective to other plant specific sequences.
1.
Approach A.
The GE event trees were restructured to more accurately portray the systems applicable to Browns Ferry.
B.
Browns Ferry plant specifi$c data, where available, was used in lieu of generic data.
2.
Probability of an SDV System Pipe Break The scram discharge piping failure probability following a scram is based on a strict failure for each pipe length per year as presented in appendix A.
Assuming 14 scrans per reactor year, tgeprobability of a pipe break per challenge is approximately 6 x 10 3.
Frequency of Occurrence of Scram Initiators The following is a summary of the Browns Ferry plant-specific frequency of occurrence for scram initiators.
Initiators Frequency (per reactor year)
Feedwater Retained
- 11.2 Feedwater Loss **
3.2 Loss of Offsite Power ***
0.02
- 109 events for units 1, 2, and 3 covering 9.75 reactor years from 1978-1981.
- 31 events for units 1, 2, and 3 covering 9.75 reactor years from 1978-1981.
- 0 events for Browns Ferry during 8 years of plant commercial operation. It is not expected that the plant will lose offsite power in its commercial existence. A value of 1 failure in 40 years was used for the calculations.
. 4.
Analysis Eoundary Conditions A.
Credit was taken for the use of the low pressure core injection (LPCI) and core spray (CS) systems for unisolable cases based on their environmental qualification for an environment of 212 F and 100-percent humidity as discussed in the earlier part of this report relating to OIE Bulletin 79-018.
I B.
No credit was taken for the capability to reset the scram valves j
by restarting the MG set feeding the reactor protection system l'
(RPS) buses following a loss of offsite power.
C.
No credit was assumed for reestablishment of the offsite power
-during the transient resulting in its loss.
D.
No credit was taken for the reestablishment of the condensate system by way of backfeeding capability from a 4-kV shutdown board during the transient resulting in loss of offsite power.
E.
The use of the residual heat removal service water (RHRSW) cross-i tie was included as an additional low pressure cooling system.
]
F.
The conditional probability of a break occurring in the SDV given a scram is assumed to be independent of the scram initiator.
G.
For the degree of accuracy necessary in the boundary analysis, only "best estimate" point values are employed to represent frequencies and probabilities. A more complete analysis would include consideration of uncertainty.
H.
This boundary analysis does not specifically consider, in all cases, depetjencies imposed by support systems.
I.
The event sequences depicted in the event trees are modeled until core inventory recovery is postulated or until a short-term stable configuration is achieved.
5.
Event Trees Three event trees were constructed for an SDV break, one where the tra sient does not result in the loss of feedwater (FW), another where the transient results in a FW loss, and the last for a transient resulting in the loss of offsite power (reference figures 1, 2, and 3).
Table B-1 lists the failure probabilitics used for the GE and TVA analysis. The following is the rationale used for the differences indicated (refer ta table B-1).
Table B-1 Reference Rationale for Differences in TVA Analysis 1-Browns Ferry plant-specific data supports a lower failure probability to reset a scram within ten minutes. For the loss of offsite power tree, no credit was assumed for restoration of reset capability by restarting the emergency power RPS MG sets.
. Table B-1 Reference Rationale for Differences in TVA Analysis 2a & 3a -
No credit was assumed for restoration of the condenser and FW during the sequence given its initial loss.
4a -
A failure probability of 0.5 was assigned to HPCI/RCIC taking into consideration both the environmental conditions and possible operator action to bypass the high area temperature isolation of HPCI and RCIC.
4b -
No credit was assumed for restoration of FW given its initial loss.
For the FW-retained event tree, its use as a high-pressure makeup source was included with a failure probability 2
of 1 x 10 assumed since it is outside of the harsh environment.
Sa -
The FW as a low-pressure makeup source is identified as the condensate system on TVA's event trees. No credit was taken for the reestablishment of the condensate or booster pumps by way of backfeeding capability from a 4-kV shutdown board given a loss of offsite power.
Sc -
Credit was taken for the LPCI and CS systems for the unisolated case based on the environmental qualification program. The higher failure probability for the unisolated case reflects the additional system stress due to the environment.
Se -
Credit was taken for the RHRSW crosstie as an alternate low-pressure coolant supply.
6.
Frequency of Failure tn Maintain Core Cooling On the following page is a table summarizing the failure probabilities calculated in this analysis for an SDV break, f
. Scram Freq of Scrams Prob of SDV Prob of Prob of Initiator-Scrams /yr Break /
Failure to Core (ref. par. 3)
Challenge Maintain Damage Core Cooling given SDV Break (ref.
fig. 1, 2, and 3)
-6
-11 FW retained
- 11.2 6 x 10 1.6 x 10-1.1 x 10
-6
-5
~9 FW loss **
3.2 6 x 10 7.5 x 10 1.4 x 10
-6
-11 Loss of Off-0.02 6 x 10 7.6 x 10~
9.1 x 10 site Power m
1.5 x 10 '
Events considered:
-
- Loss of condenser vacuum or main steam isolation valve (MS1V) closure 7.
Conclusions Based on the assumptions made in modeling this event and in estimating conservative "best estimate" bounds on the relevent frequencies and probabilities, the frequency of core uncovery at Browns Ferry due to scram discharge volume breaks is very small and believed to be a small contributor to the total probability of core damage.
o TABLE B-1 Failure Probabilities (Given Scram and SDV System Break)
Accident Sequence W Retained FW Lost Offsite Pwr Lost Ref.
Accident Sequence Functions (Fig. 1)
(Fig. 2)
(Fig. 3) 1 Reset scram from control 1 x 10~
1 x 10~
1.0 room (5 x 10~I.)
(5 x 10-1)
(9 x 10~I) 2 Depressurize the reactor
_y 1.0 1.0 _y)
(2 x 10~y) 2a Using the condenser 2 x 10 (2 x 10 2b Using S/RVs 1 x 10-3 1 x 10~
1 x 10~
3 Manual isolation of HCUs
_1 1.0 _
1.0 _1)
(1 x 10 ))
3a Given condenser 1 x 10 (1 x 10 depressurization 3b Given S/RV depressurization 1 x 10~
1 x 10~
1 x 10~
~I
~I
~I 3c' Given no depressurization 5 x 10 5 x 10 5 x 10 4
High pressure makeup
_7
_y
_7 4a HPCI and RCIC 5 x 10 5 x 10 5 x 10 (6 x 10~ )
(6 x 10~3)
(6 x 10-3) 4b Feedwater 1 x 10~
1.0 1.0 (1.0) 5 Low pressure makeup
-2
-2 1.0 _1)
Sa Condensate system 1 x 10 1 x 10 (2 x 10
~4
-3 Sb LPCI & core spray given 5 x 10~
5 x 10 1 x 10 break isolated
-2
-2
-2 Sc LPCI & core spray given 1 x 10 1
10 2 x 10 break is not isolated (1.0)
(1.0)
(1.0)
~I
~I Sd RHR erosstie with other 1 x 10~
1 x 10 1 x 10 units
~1
-1 5e RHRSW crosstie 1 x 10~
1 x 10 1 x 10 (NA)
(NA)
(NA)
Note: Parenthesis indicates the GE failure probabilities where different from that used in this analysis.
m O
O e.
e.
n.
o o
o e
O o
C x
N N
N N
n a
C O
O C
j
~
=
o.
n e
~
la4 b
b da.
A gn, b
-b MM
~
-'O
'C C
C c
N N
N n
C
~~
~~
~~
~,
u C
V wH H
Y v.
"W Ow uw
.=
f UZ f
G 4
g H
O O
EC O
C w
=
=s E
3 g
4 N
4 g
8 8
8 g
-M C
s O
Uy C
o h
W M
M g
s ed e
g Wq
- R W
t N
O e
~
~
~
~
o d
'C
'e
'o
'.o 4
c
~
Z M
M M
m c
g
-=
w C
w C
.a a
b U
8 GA s
- v. m
-O and v
% 6 n
c f
1 M
M b b
e oo U y) m
==
e hv.
O e
U u
3 C=
m w
C" w e.
&~
n m
0 W 8
e f.A H g
C C
~e w
uo g
E M
M C C W *
m sO g y
@ D bH z
Hv O
J p
7 Y
E M-i e
e e
o 28 w
r e
1 e
M C
C h
z f
-m j
u m
M 5
x u
end N
e.e a
w to tA
==
4Z 0
- W O
go e
>Q
==
A.
E 8
M
=
n me i
jb o
U x
mm e
M F
b e
w Ma
=
=
in b
l i!
,I i '
.l o
O 5 5 5
-0 0
0 0 -
0 1
1 1
1 1
x n
x n 9
0 5 0 n
1 2 %
5 4
F y
y y 7
E I
1 1
l T
S 0
0 a
S 1
t 1
O o
R x
x T
C l
t
'i l
S I T I
N F
U U
E R
l 1_
K E
^
A H
0 0
M T
1 1
O E
/
m R
W U
1 S
W O
I S 0
0 1
L C
1 x
=
)
s 1
e yI n
r
\\
i us ET g
o A
n l
2 S
i C
N E
0 0
t 1
D l
V 2
N O
x u
I s
S C
1 I
i esF l\\
Rs o,
sLm e
u F
cru S
nec K
esa A
C M
I unV C
qe E
R ed r RU S ne S
os S
I E
C rCn R
P 1
o e
P H
f rd 0
on H
1 C
e o
I erC H
re Ttf 1
ao t w nd s ees N
veo O
EFL gI
, T 2
l 1
A f.
0 W
L 0
O 1
a S
2 1
I 8
e f
5 5
I r
o I1 ug s
i s
F o
R L
O T
(
C AE S
R VR E
/
Z S
I R
A U
I S
V 3
S E
0 R
1 PE x
D 1
1 MT o
AE t
RS CF
=
SF i
n s
K s
u VA e.
DE th t
SR
_ a B
F lflll!l I
l ll l
l,>
I
i ll 1
I O
-0 1
6
~
~
0 0 o x
1 1
t x
x =
6 9
5 o.
9 2 s 7
F r
r E
I l
1 a
T I
"0 S
S t
O 1
o R
C u
T I
F i
U E
KA S
M T
I E
N R
U U
S R
r S
E I
E H
~
e R
T 0
w F
0 1
o
/
W W
x P
O L
1 e
l l1 t
is 3
f "0
f
~
IS 0
O C
1 1
=
x f
1 2
o ll sso F
L UEK r
I C
o M
IC f
E R
RU e
S e
S I
r E
C R
P T
F N
I o
t H
t n
C l
e l
r v
I s
E 3
er 1
u
~
I
~
g 0
0 i
1 1
F m
=
1 s
ROTCAE S
R f
R E
/
Z S
I R
A U
S v
3 SE
-0 R
P 1
=
1 e
r y
c u
D c
l i
S cu a
s F
f I
l lll