ML20049A610

Summary of 810529 Meeting W/Ge & NUS in Bethesda,Md Re Proposed ECCS Approach for Bwrs.Agenda & Viewgraphs Encl

ML20049A610
Person / Time
Issue date:	07/02/1981
From:	Hodges W Office of Nuclear Reactor Regulation
To:	Mattson R Office of Nuclear Reactor Regulation
Shared Package
ML20049A611	List: ML20049A610 ML20052H503 ML20052H508 ML20052H515 ML20052H517
References
FOIA-82-172, FOIA-82-178 NUDOCS 8108030449
Download: ML20049A610 (58)

Text

N s.

t

1. • "0'*%

1. o

/

UNITED STATES

{ f

.f., y',j NUCLEAR REGULATORY COMMISSION

,C W ASHINGTON, D. C. 2CS!5

%E;[, /

',)Ut. 0 2 19 81 i

MEMORANDlM FOR:

Roger J. Mattson, Director, Division of Systems Integration THRU:

Paul S. Check, Assistant Director for Plant Systems, DSI

~

Themis P. Speis, Chief, Reactor Systems Branch, DSI %

Jerry Mazetis, Section Leader, Section C, Reactor Systems Branch, DSI y

i FROM:

Wayne Hodges, Reactor Systems Branch, DSI

SUMMARY

OF MAY 29, 1981, MEETING WITH GENERAL ELECTRIC ON

(

" PROPOSED ECCS APPROACH FOR BWRs" i

t On May 29, 1981, General Electric (GE) met with NRC management to discuss a proposed ECCS Approach for BWRs. GE proposed short-term actions which in-cluded:

i

1) Complete ECC testing in the GE/EPRI/NRC Cooperative program;

2) NRC complete review of model improvements which have been submitted;

)

3) NRC change rule for decay heat and metal water reaction;

4) GE to introduce new LOCA evaluation code for 1982; l

5) GE to use TRAC for benchmark calculations in 1983.

GE stated that there is mounting evidence that the conservatism in licensing model calculations is 1100 F t 400 F and that new issues raised over the last 10 years have affected the calculated peak cladding temperature by less than 100"F. GE further stated that the requirement to respond quickly to concerns which impact the limits of the rule has created a misdirected burden and cost.

to the industry and to the NRC.

As an incentive for NRC to consider the proposed approach, GE proposed com-mitting to the following design bcunds:

r l) 14.4 KW/ft. (peak pellet);

2) 54 KW/ liter (core average);

3) 28 KW/KGU (core average).

jet.

goy m

.. - _,m

i Roger J. Mattson JUL 0 2 19 81 These design bounds were presented as no escalation of design. Table 4.4.1 of the Grand Gulf FSAR shows the following values:

BWR/6 BWR/6 BWR/6 218-624 238-748 251-800 Linear Heat Generation Rat.

(KW/ft.)

13.4 13.4 13.4 Average Power Density)

(KW/ liter 52.41 54.07 54.14 Although the proposed design bounds provide some latitude beyond current de-sign, the difference is small.

i The NRC staff agreed to consider the GE proposal after it is submitted. No definitive comitments were made. contains the list of attendees and Enclosure 2 consists of a copy of the viewgraphs that were presented.

O.Ly f'

Wayne Hodges Reactor Systems Branch Division of Systems Integration

Enclosures:

As Stated i

cc: Meeting Attendees i

R. Capra Acting Chief, CPB o

i General Electric /NRC !!eeting May 29, 1981 Bethesda, MD Attendance List Rick Hill GE Barry Schneidman NUS Corp.

Brian Sheron NRC/NRR Themis Speis NRC/NRR 1ayne.:Hodges.

NRC/NRR Sumer B. Sun NRC/NRR H. Sullivan NRC/RES' R. B. Minogue NRC/RES D. F. Ross NRC/RES.

4 L. S. Tong NRC/RES Tom Murley NRC/NRR P. S. Check NRC/DSI Roger Mattson NRC/DSI L. S. Rubenstein NRC/DSI J. J. Watt NRC/ DST L. S. Gifford GE R. A. Becker GE M. R. Fleishman NRC/RES O

-e

-,c

-w

< GENERAL ELECTRIC /NRC NEETING PROPOSED ECCS APPROACH FOR BWRs MAY 29, 1981

.s GENERA,L ELECTRIC COMPANY NUCLEAR ENERGY BUSINESS GROUP SAN JOSE, CAllFORNIA e

e RAH:tn/SLP502(1) re m uss

i AGENDA o

INTRODUCTION G. G. SHERWOOD o

ECCS PROGRAM PERSPECTIVE H. H. KLEPFER o

PROPOSED ECCS APPROACH J. E. WOOD PROPOSED ECCS OBJECTIVES EVALUATION MODEL - EXPECTED BEHAVIOR COMPARISON BACKGROUND INFORMATION PROPOSEDLICENSINGPHILOSOPHY

SUMMARY

o PROPOSED ACTION PLAN R. A. HILL r

RAH:tn/SLP502(2) 5/27/81

GE OBJECTIVES FOR ECCS MEETING o

REVIEW ECCS STATUS WITH BWR'S MISDIRECTED BURDEN AND COST OF APPENDIX K LIMITS MARGIN BETWEEN LICENSING ANALYSIS AND TEST RESULTS s

o GE ECCS PROPOSAL TO BOUND ECCS ANALYSIS o

GET AGREEMENT ON REVISED PROGRAM FOR SWR'S','.. EXISTING PLANT DESIGNS t

GE/NRC/EPRI COMPLETE TECHNOLOGY

NRC COMPLETE MODEL IMPROVEMENTS NRC CHANGE RULE FOR DECAY HEAT AND METAL WATER GE TO INTRODUCE NEW LOCA EVALUATION CODE FOR 1982 TRAC FOR BENCHMARKS IN 1983 FOR BWR!S

~

t GGS 5/2 9/ 81 e

li s

EVALUATION MODEL STATUS e

CURRENTLY BEING USED BASE MODEL NEDE 20566P GEGAP GAP CONDUCTANCE AND FISSION GAS RELEASE LEAKAGE FLOW THROUGH LOWER CASTING HOLES ONLY CORE SPRAY (AMENDMENT 3) e CURRENT LOCA MODEL AMENDMENTS STATUS AMENDMENT SUBJECT SUBMITTED SER 1

POOL BOILING 1/76 2/81 4

CCFL CORRELATION 8/78 2/81 5

BYPASS FLOW 8/78 6

ENERGY / FISSION; 8/78 DECAY HEAT 1

I

,/

_BWR WATER DELIVERY SYSTEMS NO. OF PUMPS DESCRIPTION 2

CONTROL R0D DRIVES

.w/-

1 REACTOR CORE ISOLATION COOLING cs >:cic a

,n

/

3 CONDENSATE PUMRS ccc>

Amly:3 (2

FEEDWATER PUMPS

[,i]

{k LOW PRESSURE COOLANT INJECTION wen cas<

1 LOW PRESSURE COOLANT INJECTION 1

LOW PRESSURE CORE SPRAY l

HIGH PRESSURE CORE SPRAY I

C Ac ~ toib 66-

/ 1 0 & 't =.d 93 c 'E W a n,..,

x y

3~5 sh

^S* U N' d " -

VI:0U3 wn

n. g le c c{

Ne 5.S v :

e

- =.

g i

o GE COMMITS TO DESIGN BOUNDS FOR APPLICABILITY Ac M j OFTilISPROPOSEDAPPROACH,/,p. ylw V~

c 14.4 xw/FT (PEAK PELLET)

B #

"r" I "

a te -G.d 54 Kw/ LITER (CORE AVERAGE) i 28 Kw/xcu (CORE AVERAGE) i s

e n,..

s.-.

&, Lh J PROPOSED ECCS APPROACH i

e PROPOSED ECCS OBJECTIVES e

EVALUATION MODEL - EXPECTED BEHAVIOR COMPARISOf!S e

BACKGROUllD INFORMATION s

PROPOSED LICENSING PHILOSOPHY e

SUMMARY

6 O

_.-_m_.

PROPOSED ECCS OBJECTIVES ULTIMATE OBJECTIVES e

LICENSING ANALYSES BASED ON EXPECTED BWR BEHAVIOR T0:

ASSURE APPROPRIATE SAFETY f1ARGIN AVOID UNNECESSARY COSTS REGULATORY POWER GENERATION i

INTERIM OBJECTIVES e

MAINTAIN SUFFICIENT SAFETY MARGIN e

MINIMIZE UNNECESSARY PENALTIES ON POWER GENERATION COSTS e

MINIMlZE RESOURCES FOR MODEL REVISIONS AND LICENSING ANALYSES PROCESSES e

e e

PROPOSED ECCS APPROACH e

PROPOSED ECCS OBJECTIVES e

EVALUATION MODEL - EXPECTED BEHAVIOR COMPARISOf!S e

BACKGROUflD INFORMATION i

~

PROPOSED LICENSING PHILOSOPHY e

+

e

SUMMARY

i e

e

... ~, ~ ~

,. ~. -.

,.m, me--,.

.b '.

/

ce,s

i f' i

,s,

8^

.0 t!AIN STE AW FLOW

~~/-/--/

TO TURBINE 31EAM DRYER 5 %

x s

e

/

37EAW

.-/-~/--

SEPARATORS %Q-s, MAIM FEED FLOW 3fUUU FR0u TURBINE

~T l[:J=.,

3,,'

D RivlM C F LO * -+-

e k!/

~

f CORE JET PUWP N

g m

s f

+

m+ s

>c-5-ocM n

o RECIRCUL ATION ~

~~~~

PUWP (J (j

<l h

d

BWR LOCA RESP 0tlSE - DBA LIMITlflG BEHAVIOR Eh 8

E5@

5 e-

=

EI f

E I

=

si:

5 E

E E55 5

toct rien ttute Ptimia rt:0 setar Tunstta sept cm st;

, oc ut rias m :

l l l l

l I

I I

I I

o io

-x so

,, g3,,,,,3 roo i

l e

I l.O i

[ Cote M m

v b

LT

________.,_--__________b o

O

• lo

~ do

~ 50

" Zoo l

Liuiridc-Peak. CLAbbwe Tet4 PERATdCE 2o00

,l

.a "#f ggg SWR E ALUATiotJ e

ame n O

I w

/l y 1003 -

9 i

k{.

~ '

,/, sa s

EMEC.TED EC5PCNSE o s

t o_

o

• lo

-3 TlH E (SEcf e

s C OL7, COO

)

t i,

=

i qi l:

il I

t i ;. i di pd

$;. JJ. l

.Qk.,i0

' " ' " " S ^' 5 -

=.

=

3 j'

4 e

i

+

+

i

. CORE SPRAY On

+

o

=

c j

. CCFL AT UPPER IIE PLATE t

l

~

~

u@

- l-

[ -'M-_

-~

_J u

~

. CCFL AT SIDE ENTRY ORIFICE g________

q_-____

g

_t nti

!.ili i

?k h,.h,k m

i i

+p h g 'I $l'

[

3, n

l l

/

N\\

p j

s z

c s

jf u

y A

lll

]!

l l

O n

26*

e n

-e w

0 3 w

O k

<2 34 sO u$

eC xm

<u

<2

• 4 W W ww

a. >

2C JL J

l d

5 W

A w3a

~

w

'2 Ona C

O<o ZW2 4

• ,4

=

Jk JL d

JL d

JL dJL d ik JL 2

2 C

w a

u s

C Wh m

w J

w 4

e s

=

g g

2. e w

w O

w e

s u

o e m 3

3 m

e w

o E

E O

>W 2

u w

w w

o e

w a

m 2

w 0

'O f

w

.e 9

y O

3 m

w u

w W

a u

==

-=

D Ue

=

m o

e 4

E 2

m w

u o

F 4

2 y

p 3

C CU e

2 2

C O

w w

w w

W C

-U Q

m O

0

$=

u O

2 G

m C

0 O

26 C

O c

=

w i[

i, 5

8 E

a B

E Ei s

[

Ui 2

w I

Z C

2

<O

~

E 3

a e,

m e

e m

w w

w

• 9=

o

=

a a

w s

y 3

- :: e g

-j w

m e

Zw A

a wo

{Cd a

w 6 ii E

A E

e O

1_

w 3

4 7 Y

5

< w$ a u-c.

S :. 9 T S;oO s

m JL JI Jk dk N

Jk Jk J k Ji Jk N

JL h:

m

==

==

-=

2 2

2 L

9 9

9 0

2 2

z O

O a

z O

2 d

d Z

b "2 "4 b

p C

2 a

a W

w w

w O

O w

g, a

a e

e o

a es ec s

u*

e e

u w

w w

s g

i 5

8 5

8 a

8 CEg O w

2 t

e b

O O

O W

2 W

20 0 u - 0,3 z,

8 g

0 h

v u

a e

g g

O 7

"E E

2 O

O o

O e

d o

afga a

g h

O 9

U u

O m>>

w O

O E$6 moo

,-J M

J J

a E

who-m2 8ms

- 2 m

u w

w x

0 J

6e yaOwg3yO y

u W

W 4

w 3Cw

.a 4

u W

m-2 y

e u

e o

e E

e

~

w

_a w

kgh c

O Nw I

• c ue ta4 w.I qoo OE 3

m u

n.

u-2-w N

0 M

4 6

W OCdO C' u v

u m

m m

w c.

I 1 8

A 1 I I I I I e 3

m

" - J L

q

[%

Y

~

s

=

e e

O

BWRLOCAMODELEVALUATIONBASES e

INTEGRAL SYSTEM SIMULATION TESTS 7/7M SINGLE FULL SIZE BUNDLE CORE FULL POWER SIMULATION SMALL THRU LARGE BREAKS BLOWDOWN THRU REFLOOD i

e FULL SECTOR SIMULATION 30 DEGREE STEAM SIMULATION OF CORE POWER ACCURATE REFILL SIMULATION e

SINGLE HEATED BUNDLE FULL SIZE BUNDLE UPPER TIE PLATE CCFL STEAM COOLING EFFECTIVENESS CORE SPRAY HEAT TRANSFER l

e OTHER SYSTEM ANALYSIS IMPROVED GE MODEL BEST ESTIMATE MODEL WRAP-BWR-EM JAPANESE LICENSING MODELS

~

Pswer vs Tune

- Fission

- Decay l Power Peakang Factors l In.taal Gap Corkloctance l 1rif1f Ififif PLANTINPUTS RADIATION VIEW FACTORS

+

- CEOM E TilY Z

- COMPONENT RESPONSE FISSION GAS RELE ASE

+

CRITICAL FLOW CORilELATION PERFORMATION STRAIN VS TEMP

+

VOID FRACTION CORRELATION f+

YlELD STRESS VS TEMP Sj UTP CCF L CORRELATION A

ME TAL WATER RE ACTION COFIRELATION

-.)

UTP CCF L BRE AKDOWN CORRELATION CORE SPRAY HEAT TRANSFER COEFFICIENT PEAK CLADDING

~"g SEO CCFL CORRE LATION

+

TEMPERATURE LOCA PRESSURE VS TIME ODE SYSTEM HE AT UP SEO CCFL BREAKOOWN CORRELATION

• MODEL TIME OF NODE UNCOVERY MODEL TIME OF R ATED SPRAY FLOW Nl CORE EXIT DYPASS CCFL

=

A TION g

TIME OF NODE REFLO' D O

-N HYPASS LE AK AGE FLOW CORRELATION +

j HEAT TRANSFER COEF VS TIME PRESSURE LOSS COEFFICIENTS TO TIME OF R ATED CORE SPRAY r

VAPORIZATION CORHELATION

/

IIE AT TR ANSFER COEFFICIENT

- CRITICAL POWER CORRELATION

- REWET CORRELATION

- NUCLE ATE BOILING

- TR ANSITION DOILING

- FLOW FILM BOILING

- POOL FILM DOILING

- STEAM FLOW str

(, (

u

LIQUID STEAM l

l l l TOP OF CORE CCFL

,[

1 TCP OF CORE CCFL LIOulD OR AIN AGE l

STEAM LIQUID BOTTOM OF CORE CCFL BOTTOM OF CORE CCFL I

I I'

I l

STE AM CCFL ACROSS CORE 117 2 l

l

~

7 LIQUlO

)

P TE 0 4 LIQUID DE LIVE RED STEAM BEST FIT TO DATA BWR LICENSING MODEL i

I I

I STEAM nm2 UPPER TIE PLATE (TOP OF CORE) CCFL o

O

4 UPPER TIE PLATE CCFL CORRELATION i

S e

EFFECT INCREASED DELIVERY OF WATER TO CORE AND LOWER PLENUM.

1 il

~

EARLIER REFLOOD TIME.

e IMPACT ON PCT 50 - 100*F i

1 i

.i l

4 O'

.l

i i

I 225 200 LIQUlO l

175 -

PLATE i

150 1

STE AM w

C O

125 O

p-Ow 5

Ea W

100

\\

\\

\\

\\

DATA

\\

15

\\

\\

\\

\\

\\

~

\\

CCFL BREAKDOWN

\\

BWR LICENSING k

MODEL

\\" '.b

. =

,sv N____________

l

)

I l

I l

0 20 40 60 80 100 120 140 TIME AFTER ECCS INITI ATION UPPER TIE PLATE CCFL AND CCFL BREAKCOWN 1171 M

,,,,,4

,/

..7.,-

V E.

se f

s e

j

,[

^

/

~

r s

'/

ser...

, /

UPPER TlE PLATE CCFL AND BREAKDOWN 4

- 1 t

I 1

4

~

e 4^

a-4 s

'l A

e EFFECT:

' RAPID DELIVERY OF ECC WATER TO CORE-AflD i

j LOWED PLENUM;EARLY CORE QUENCHING AND REFLOOD.

g P*

e IMPACT ON PCT:

200 1400*F:

[

4

• i t

l^

- z.o '-- f,_

> so "

.y 1

i 9

x m

4 f

~,.

1. ~

/

.y

'/

t e

p-,

['

4 W

b f'

g, i

l

_s 4

1

~~

~~

i k'

l

?

4

? #?

s-u ar

?'

~

2 N

3

? ~

I p,

s t

O'

.J '

[

=

/

p f

=

~ e y

e w

..- e m.,

n+%.y y..

+wv

-v.-

w--

rog-ug.,

yrW'71'-wr-pi-r Tre-

'wytmy+y g-74yT--e77+<

r g

~

BWR LICENSING MODEL LIQUtu 100%/NO HOLD UP DRAINAGE 1

LIQUID x Nu STEAM i

DATA 1

l

{

STE AM CCFL AND CCFL BREAKDOWN AT BOTTOM OF CORE 117115 f

. = _ =

CCFL AT BOTTOM 0F CORE

)

4 r

e EFFECT:

DELAYED UNCOVERY OF CORE.

i-REFILLING OF CORE PRIOR TO EVENTUAL REFLOOD.

l u

I e

IMPACT ON PCT:

100 - 200*F J

t i

2 6

4 4

t l

t i

n

l N

BYP SS CORE SHROUD CORE l

l LIQUID DE LIVER E D l

l J

r FULL SECTOR BWR OATA LICENSING MODEL l

i STE AM UPDRAFT CCFL AT TOP OF BYPASS REGION 11713-7 4 l

~

CCFL AT TOP 0F BYPASS i

5 e

EFFECT:

EARLY BYPASS FILLING.

INCREASED LEAKAGE TO CORE AND LOWER PLENUM.

e IMPACT ON PCT:

SMALL (< 50*) FOR BWR 5/6 50 - 100*F FOR OTHER BWRs 9

)

s j.

I i

e

+

6 -

1 s

_ _-_ E_

n 8WH d

UCENSING MODEL 4 pii 3

sP BEST FIT TO DATA 2

LE A K AGE V

1 I

i 1

t I

i I

i l

l I

O 1

2 3

4 5

6 7

8 LE AKAGE FLOW TO CORE la 10 lbm/hr)

BYPASS TO CORE LEAKAGE si n 2-6 9

C

BYPASS TO CORE LEAKAGE e

EFFECT:

FASTER REFILLING OF CORE EARLIER REFLOOD e

IMPACT ON PCT:

50 - 100 F.

h

10.000 SWR LICENSING

\\

\\

r l

\\

s t

\\

3,

\\ ry g

{#

p

\\

\\

DATA

\\

j f, h

s c~ q

,wo s

.J*

3 l

,8 (f,

\\

f

/

t I

/

)

/

i=

g

/

/%

/

TLTA k

/

b DATA i

i

/

s i

l 9

t

>=

i i

E g

i

\\

\\

\\

l i

\\

l 5

s% //

E

+

PFB 10 MODEL PFB STEAM COOLING t

4 H=0 1

I 0

y 100

{

M TIME fint HE AT TRANSFER COEFFICIENTS in1H O

e

10,0007

,, s I

Fl i, i i

BWR FUEL HEAT TPANSFER i

li t

I I

i if L

lt g

1,000 l:

i li i

't 8

IMPROVED MODEL I

1 I,

1 EVALUATION MODEL i

'1 4

e i

t 8

i

,s 100 I

f I

I I

I I

t u',s o

~

\\

t s

I t

~

~,

10 -

. 't

/

a !

el I l el

• f I l l

IlI s

1 O

.100 200 TIME (SECONDS)

O

HEAT TRANSFER COEFFICIENTS e

EFFECT:

LOWER CORE HEATUP e

IMPACT ON PCT:

100 - 300=F

)

c.

l l

Power vs Time

- F ssion

- Decay Power Peaking Factors l Instaal Gap Conductance V Y II IfIfY PLANTINPUTS

- GEOME TRY RADIATION VIEW FACTORS

+

- COMPONENT RESPONSE FISSION GAS RELE ASE

+

CrilTICAL FLOW COf1 RELATION pef 1 FORMATION STRAIN VS TEMP VOID FRACTION CORHELATION YlELD STRESS VS TEMP

+

UTP CCFL CORRELATION METAL WATER REACTION CORRELATION f+

UTP CCFL BREAKDOWN COffilELATION A

CORE SPHAY HE AT TRANSFER COEFFICIENT +

l SEO CCF L CORRE LATION PE AK CLADDING PRESSURE VS TIME NOOE TEMPEllATURE LOCA SYSTEM e

HEAT UP SEO CCFL DREAKDOWN CORRELATION

• MODEL TIME OF NOOE UNCOVERY MODEL TIME OF RATED SPRAY FLOW CORE EXIT BYPASS CCFL y

RE ACTION i'

TIME OF NODE REFLOOD A

OYPASS LEAKAGE FLOW CORitELATION HEAT TilANSFER COEF VS TIME l

PRESSURE LOSS COE FFICIENTS TO TIME OF RATED CORE SPR AY w

VAPORIZATION CORRELATION HEAT TRANSFER COEFFICIENT

- Cf1ITICAL POWER COftRE LATION

- REWET CORRELATION

- NUCLEATE BOILING

- TRANSITION DOILING

- FLOW FILM BOILING

- POOL FILM BOILING w - STEAM FLOW 11713 3 h

e e

s j

EFFECTS OF INCLUDING IMPROVED MODELS l

e REALISTIC MODELS INCORPORATED FOR:

STEAM COOLING CCFL AT BOTTOM OF CORE SUBC00 LED CCFL BREAKDOWN, l

\\

l 4

l l

_.. _.. _ _ _... _. ~, -

PhELIMINARY RESULTS WITil IMPROVED INVENTORY CODE 4.0 Pt**2 Break

~i 2000

/s i

Current Licensing Model l

Reflood

\\

,'\\

1500

\\

'N E

\\.'.

o i

cs t

y U

43 d

e e

i

'l ~

c D*g '

1000 i

I.

I s

Improved Model t.y

'(

I' i

~x.

o "e(2 od

~N. _

4

.l cs e

s e.

e

.g l

u i

i 500 I

l i

I t

I i

i.

j I

I t

O i

i t

i i

~,

0 80 160 240 320 Time After LOCA (sec) o-.

RESULTS FROM IMPROVED MODELS e

ACCOUNTING FOR ESTABLISHED PHENOMENA REDUCES PCT SEVERAL HUNDRED DEGREES e

RESULTS SIMILAR TO INTEGRAL SYSTEM TEST DATA e

EXCESSIVE CONSERVATISM IN CURRENT BWR MODELS COULD BE RESOLVED BY INCORPOPATING ESTABLISHED PHENOMENA 9

e i

CALCULATIONS WITH DETAILED BEST ESTIMATE MODEL e

TRAC-BWR UTILIZED FOR BEST ESTIMATE CALCULATIONS e

FULL THREE-DIMENSIONAL VESSEL WITH MULTIPLE FUEL BUNDLES e

INCORPORATES ALL SIGNIFICANT PHENOMENA

\\

i

/

1

}

4 e

Ol

COMPARISON OF TYPICAL DE.4T ESTIMATE AND LICENSING CALCULATION t

-1500 2000 PEAK CLAD TEMPERATURE

,,1500 d*

mP 000 I

BWR Licensing u

flodel n.Eu H

'1000

.M N

t D

I H

TRAC BHR Best Fstimate !!odel Average Power Bundle w

n.

liigh Power Bundle ow Power Bundle 300 i

i i

i I

0 20 40 60 00 100 120 TIME (sec).

t DETAILED BEST ESTIMATE MODEL RESULTS i

~

PREDICTED PEAK ELADDING TEMPERATURES LESS IHAN 800*F e

FOR DBA.

BEST ESTIMATE ANALYSIS DEMONSTRATES LARGER PCT MARGINS.

i e

1 i

EXPERIMENTALLY OBSERVED BWR LOCA MARGINS ARE REAL.

o 1

CURRENT MODEL CONSERVATISMS ARE EXCESSIVE.

s

THERMALLY INSU[ TED i i CH AN NE L.

POOR S!MU uTION I

OF CHAN SEL HEAT TRANSFE4

- :-s w DURING tCCS OPERATION.

R LARGE DOWNCOMER FLOW AREA.

POOR SIMULATION OF SMALL

['a BREAK PHENOMENA TIMING.

L LOW WATER LEVEL. POOR C

' f_

d, SIMULATION OF RECIRCULATION g

"l; HEAD DURING SMALL BREAKS.

SHORT JET PUMPS.

POOR lj g

.' O SIMuuTION OF CORE REFLOOD.

j

...m.....

'O

q ese I

3gh-}y}

j\\

X

~'

'F

_M N

s j

c

g. w,-

DESIGNED FOR LARGE BREAK BLOhi)0WN STUDIES e

- FULL $CALE HEATED BUNDLE

- SCALED LOWER PLENLM VOLUME

- SCALED MASS INVENTORY

- GOOD SIMULATION OF LARGE BREAK BLOhDOWN PHENOMENA TIMING EXTENSION TO EMERGENCY CORE COOLING FOR LARGE BREAKS e

SOME SIMULATION COMPROMISES EXTENSION TO SMALL BREAK EVENTS RESULTS IN SERIOUS SIN e

COMPROMISES

?

e

I l

COMPARISotJ W(TH INTEGRAL sysTtsM Test (Two Lcce Test ApeAuws.)

DBA. StMkLATiord 6WR LOCA 2000 E # WAT'# M*]

21500 O

w-y j

DATA J1000 f

/

t e

s w

/

\\

C-t'

's s

1 500 C

\\

W x

F-N__-.

l I

5 i

g O

So 10 0 ISO Zoo 250 TIME (GEC)

O 1

M COMPARISON WITH INTEGRAL SYSTEM TEST (TWO LOOP TEST APPARATUS)

SMALL BREAK SIMULATION 1600 1400 1200 BWR LICENSING

{1000 MODEL ED 800 f5 n.

b 600 s

TLTA DATA N

200 I

I I

I I-I I

O-O 100 200 300 400 500 600 700 800 900 TIME (sec) 1 l

EVALUATION MODEL - EXPECTED BEHAVIOR COMPARISONS

=

EVALUATION OF INDIVIDUAL MODULES (DBA)

PCT CONSERVATISM F.

3 UPPER TIE PLATE CCFL 50 - 100 UPPER TIE PLATE CCFL BREAKDOWN 200 - 400 SIDE ENTRY ORIFICE CCFL 100 - 200 CCFL AT TOP 0F BYPASS 50 - 100 BYPASS LEAKAGE CORRELATION 50 - 200 HEAT TRANSFER COEFFICIENT 100 - 300 DECAY HEAT 200 - 400 FISSION GAS RELEASE

(

0 - 200)

COMBINED EFFECT NOT ADDITIVE ALTERNATE SYSTEM ANALYSES (DBA)

PCT CONSERVATISM F.

"lMPROVED MODEL" (SAFER 01)

~1000

~

BEST ESTIMATE MODEL (TRAC)

~1200 SYSTEM TEST DATA PCT CONSERVATISM F.

i LARGE BREAK

~1000 600 SMALL BREAK s

ALL EVIDENCE CONFIRMS EXCESSIVE MARGIN

GE EVALUATION MODEL -

OTHER LICENSING CALCULATIONS e

WRAP-BWR-EM LARGE BREAK LOCA SAVANNAH RIVER LABORATORY, JULY 1980 EVALUATION MODEL ASSUMPTIONS M0XY PCT ~1765 F.

(s400 F. BELOW GE EM)

DIFFERENCE ATTRIBUTED TO HIGHER HEAT TRANSFER DURING BLOWDOWN e

JAPANESE LICENSING ANALYSIS APPROVED LICENSING MODELS PCT '1700 F.

( $500 F. BELOW GE EM )

DIFFERENCE ATTRIBUTED TO TREATMENT OF DECAY HEAT COUNTER CURRENT FLOW LIMITATION l

EXCESSIVE CONSERVATISM COMPARED TO OTHER

" LICENSING" TYPE CALCULATIONS

L IMPACT OF EXCESSIVE CONSERVATISM e

CANNOT QUANTIFY KEY CONCERNS REAL SAFETY MARGIN SENSITIVITY OF SPECIFIC PHENOMENA URCERTAINTY e

POOR BASIS FOR PRODUCT EVALUATIONS PLANT OPERATION FUEL DESIGN SYSTEM DESIGN e

UNNECESSARY COSTS REGULATORY POWER GENERATION 1

PROPOSED ECCS APPROACH e

PROPOSED ECCS OBJECTIVES e

EVALUATION MODEL - EXPECTED BEHAVIOR COMPARIS0t!S e

BACKGROUND INFORMATION e

PROPOSED LICENSING PHILOSOPHY e

SUMMARY

l e

O

BACKGROUND INFORMATION BWR LOCA/ECCS EVALUATION MODEL EVOLUTION e

1970 SITUATION BWR DESIGNED FOR HIGH SAFETY MARGIN LOW SPECIFIC POWER NATURAL CIRCULATION DUAL CORE SPRAY SYSTEM REFLOODABLE CORE SIMPLE BOUNDING EVALUATION MODELS LARGE' CONSERVATISM CALCULATED PEAK CLADDING TEMPERATURES (PCT) <1500 F.

PCT LICENSING LIMIT s2700 F.

e 1975 SITUATION NEW REQUIREMENTS INTRODUCED PCT LICENSING LIMIT REDUCED TO 2200 F.

l 1971 ANS + 20% DECAY HEAT (+ s200-400 F. PCT)

COUNTER CURRENT FLOW LIMITATION (+ s200-400 F. PCT)

EVALUATION MODELS CALCULATE s2200 F. PCT c

SOME PLANTS DERATED i

l

BACKGROUND CORE POWER LIMITS CORE AVE.

CORE AVE.

FIRST POWER SPECIFIC ORDERED MLHGR DENSITY POWER (YEAR)

(KW/FT)

(KW/L)

(KW/KGU)

(3x8)

BWR/2 1963 17.5 35 13 BWR/3 1965 17.5 35 18 BWR/4 1966 18.5 51 26 BWR/5 1969 18.5 51 26 BWR/6 1972 13.4 54 28 f

e POWER DENSITY INCREASING DURING 60S e

POWER DENSITY STABLE DURING 70S e

CURRENT SITUATION KEEP TOTAL CORE POWER CONSTANT OPTIMIZE POWER DISTRIBUTION FOR LICENSING LIMITS FUEL CYCLE COSTS NO SIGNIFICANT IMPACT ON REAL SAFETY MARGIN 1

l

BACKGROUND INFORMATION 4

BWR LOCA/ECCS CURRENT STATUS e

CURRENT EVALUATION MODEL STATUS EXCESSIVE CONSERVAT!SM SOME DERATES MINIMUM MARGIN SENSITIVE TO NEW ISSUES e

MAJOR TECHNOLOGY PROGRAMS IN PLACE LARGE SCALE EXPERIMENTS BEST ESTIMATE MODEL DEVELOPMENT 4

e ARTIFICIALLY TIGHT MARGINS ARE EXPENSIVE EXTENSIVE REGULATORY RESOURCES NO FLEXIBILITY -+ HIGH FUEL COSTS i

1 j

'l l

PROPOSED ECCS APPROACH e

PROPOSED ECCS OBJECTIVES e

EVALUATION MODEL-EXPECTED BEHAVIOR COMPARIS0t!S e

BACKGROUND INFORMATION-l e

PROPOSED LICENSING PHILOSOPHY I

i e

SUMMARY

s b

{

.e

SUMMARY

e US BWR OPERATING LIMITS ARE TIGHT MINIMAL DERATES MINIMAL OPERATING MARGIN' e

TIGHT LIMITS ARE COSTLY REGULATORY ( VENDOR +.NRC ).

' POWER GENERATION ( UTILITY.+ RATE PAYER )

e CURRENT EVALUATION MODEL APPROACH UNREALISTIC BOUNDING PHILOSOPHY APPLIED TO MULTIPLE MODULES LEADS TO WRONG CONCLUSIONS ON REAL SAFETY MARGIN MODE OF PLANT OPERATION PRODUCT DESIGN EVALUATIC1S e

SUBSTANTIAL VARIANCE WITH OTHER CALCULATIONS WRAP-BWR-EM ANALYSIS f

JAPANESE BWR LICENSING ANALYSIS r

l BWR BEST ESTIMATE ANALYSIS l

NEED TO REVISE BWR EM DEVELOPMENT / APPROVAL APPROACH l

\\

l

~

EFFECT OF OPERATING LIMITS ON UTILITY POWER GENERATION COST i

6

$10 PER YEAR PER 1000 Mwe PLAtlT h

5 C4 A

M3

\\'k

\\

%g\\

S2 1

0-1 N N 82 N

s 5

N s E

N 3

s jl m

s M

84 5

'I

+ [$$gg

4 100% PLANT OUTPUT POWER 2

1 0

1 2

3 4

5 6

7 8

9 10 DERATE (%)

LOCAL MARGIN (%)

POWER GENERATION COST SAVING EXAMPLES e

OPERATING MODE S

ff SPECTRAL SHIFT PEAK TO BOTTOM 0F CORE EARLY IN CYCLE PEAK TO TOP 0F CORE LATE IN CYCLE REDUCED FLOW EARLY IN. CYCLE INCREASED FLOW LATE IN CYCLE o

CORE LOADIiiG PATTERN OPTIMlZE FOR EllERGY EXTRACTI 0ft

- RATHER THAN -

FLATTEST GROSS CORE POWER SHAPE e

BUNDLE DESIGN OPTIMlZE FOR ENERGY EXTRACTION

- RATHER THAN -

FLATTEST LOCAL PEAKING FACTORS O

e

PROPOSED ECCS APPROACH I

i e

PROPOSED ECCS OBJECTIVES e

EVALUATION MODEL - EXPECTED BEHAVIOR COMPARISOf!S e

BACKGROUllD INFORMATION q

[

e PROPOSED LICENSING PHILOSOPHY i

i J

t e

SUMMARY

.j

T.

~

PROPOSED LICENSING PHILOSOPHY e

PHYSICALLY C0NSISTENT CONSERVATION MODELS e

EXPECTED VALUE CORRELATIONS e

COMPARE CALCULATED MARGIN WITH REASONABLE UNCERTAINTIES 5

• 4 :.,,'t.,

4-j UNITED ST ATE!

-.- /

//

• * ' + /A

'\\

NUCL E AR REGUL ATORY CO*.* f.'.:SSIOh I"- Q '/

--I dh rE wAsssNcToN. c. c 20:51

'i W f/

/iA ' ~

.T.

I:F Q;%

aune 9, 393-C H l. l R P.'. A P.

..,[

MEMDTsAND' !'. FOR:

Commissioner Gilinsky J

Commissioner Bradford CommissionerAh'egrne jh\\

FROM:

Joseph M. Hendrie s

s

SUBJECT:

ATWS C#

Here, to the amazement of some, I am sure, is my cour.terpr;;;sa' or ATW5.

My difficulty with the earlier proposal from the staff is -.E; it seeme:

to be a menu of lists and pieces of ATW5 fixes, with cuestionatie safe:

gains from at least some parts.

There did no: seem to me tc De any clear overall direction to it.

And some parts I fount obje:-ionable--

fiddling with some of the better-designed scram breaker arrangements ir.

hopes of claiming a factor of 2 or so in some cbscure proba:iiity calculatior., for instance.

My aim in starting afresh was to try an approach with severa: eienerts:

(a)

Fix the obvious ATWS problems in BWR's that make A;:S one cf the dominant BWR risk sequences.

(b) Make people look carefully at their plants for ATr.'5-related vulnerabilities and then fix the outliers--and de it en a systems analysis or reliability engineerine basis. ratner than concutting a probability exercise te show ncthing is wrong.

(c) Accomplish the above without creating a brave nes. staf#

incustry of ATWS analysis review anc endless arg.; t : over design details.

As -he years have passed and ATWS has practically be:: e a e:..i:El disci:line in itself (I have been waiting for the firt: ar.n:.;.:ener.: cf an endowed chair in a prominant university--:ne Elmer.: Smi: e s C'.E'- cf ATW5 Engineering), there has actually been some usef '. irf -.1-it-develeped.

As I read the entrails of the beast these days Er.': ATW5 is ; ::E ;s C: i r.

needs fixing while FWR ATW5 may be a mini-pro:.ier.

n ne sense that W ATW5 is probably at the breacir e wee. N >

bE !/

v

(*O

l.

E: leave Eicne, if we had a safety goal o set that breakpoint.

CE a.c BM. are myr cuestionable, but the more direct fixas for them i vede heav'is i r. : cegraded core matters and with reasonable attentiori operatirg periots in which the moderator temperature coefficient is i

-favorable (a smali fraction of overall operating time), they should

ca C' u. . t,e degraced core matter is clearer.

(That was not the v'. e ye t -!

ag: wher wrote WASH-1270 anc BWR's and PWR's were treated a'ike.'

i ne at:a:ne: craft ATil5 rule sets out all of this in language both j

leare" ar c m:re elegar.1 than } Could have done it.

Frank Rowsome is j

the prin:ipai author:

I turned to him to try to put my hand-waving ir.:o coherent for.T and I am pleased with, and much admire the resultinc 4

rocu::.

Tne craf: rule takes a rather different tack from most of car past anc current rule ventures--it creates a self-propelled recime i

for osa'.ing w'tr. a problem area.

It is worth reading carefully for that re;.;ia :r a::rcacr., cuite apart from its merits as an ATWS-specific

.S E.

4 1

i En:les re:

As stated SED i

02:

i nr:

V e.

i I

0:A EC:

Ii23.

.c h*-

1

f.

\\( % (,'4 W ew.

t

'~

k-f.-ibt NUCLEAR REGULATORY COMMISSION 10 CFR PART 50 1

DOMESTIC LICENSING OF PRODUCTION AND UTILIZATION FACILITIES

~

\\

k Standards for the Reduction of Risk From Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants AGENCY:

U. S. Nuclear Regulatory Commission ACTION:

Proposed Rule

SUMMARY

The Nuclear Regulatory Commission is considering amending its regulations to require improvements in the design and operation of light-water-coole'd nuclear power plants to reduce the likelihood of failure of the automatic protection system to ec;id's-shut down the reactor (scram) in the event of operational occurrences expected to

_[...;,

cc, cur one or more t,imes during the operat ng life of a nuclear power i

unit (anticipated transients) and to mitigate the consequences of such

dn't'icipated transients without scram (ATWS) events.

l DATES:

The comment period expires (120 days after publication).

l ADDRESSEES:

Comments should be submitted in writing to the Secretary of the Commission, U.S. Nuclear Regulatory Commission, Washington, D. C.,

20555, Attention:

Docketing and Service Branch.

All comments received will be available for public inspection in the Commission's Public Document Room at 1717 H Street, N.W., Washington, D. C.

_ ~ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ - _. _ - _ - _ - _ _ _ _ _ _

A-2

[7590-01)

FOR FURTHER INFORMATION CONTACT:

David W. Pyatt, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Wash'ington, D.C.

20555, (301) 443-5921.

SUPPLEMENTARY INFORMATION: Concern regarding protection against anticipated transients without scram (ATWS) events has long been a subject of extensive and continuing study by the NRC staff. The significance of ATWS for reactor safety is that some ATWS events could result in melting of the reactor fuel and the release of a large amount of radioactive fission products.

The principal benchmark for deciding whether and to what extent nuclear power plants should be modified because of ATWS-related safety concerns is set forth in Section 161i(3) of the Atomic Energy Act.

That section grants

~

to the Commission the authority to " prescribe such regulations or orders as it may deem necessary...in order to protect health and to minimize danger to life or property." Throughout the history of regulating nuclear reactors, the dual concept of preventing accidents and mitigating their consequences should they occur, i.e., defense in depth, has been used to achieve this objective. Thus, conservative design, construction, testing, maintenance and operation of plants are required so that accidents will not happen (i.e., have a low probability of occurrence). Then, to provide defense in depth, the capability to mitigate their consequences is required for accidents that are postulated to occur even though the design is required to include measures to prevent them.

e*

O 9

t A-3 57590- 2 2 The judgment by the NRC as to whether the nuclear power plan s meet the standard of safety set forth in the Atomic Energy Act for ATWS events depends primarily on two factors:

(1) the reliability of current reactor scram systems (ATWS prevention) and (2) the capability of existinc reactor designs to mitigate the consequences of ATWS events ( ATWS mitigation).

It is within this framework that the NRC has concluded that the prob-ability of ATWS events occurring over the lifetime of light-water-nuclear power plants and the potential magnitude of consequences arising fron such events, should they occur, are sufficiently great to warrant the impo-sition of requirements designed to reduce the probability and mitigate rthe consequences'of ATWS events.

The essence of the proposed rule is that power reactor licensees shall implement a reliability assurance program to seek out and rectify reli-ability deficiences in those functions and systems that prevent or mitigate ATWS accidents. To cover the possibility that the reliability assurance programs might fail to correct an obscure reliability defect, some additional requirements for ATWS mitigation are selectively man-dated. These improvements in ATWS-tolerance of reactor plants have been chosen to afford an opportunity to learn from experience without incurring a substantial likelihood of an unacceptable radiological l

release.

The NRC is exploring the possibility that the regulation of reactor safety may evolve toward the regulation of the process by which licensees assure l

i

Ae

[7590-O:

oublic health ano safety and away from the licensing of the details of cl a r.

design and operation.

Programs like the reliability assurance program in this proposed ruit effer promise of growing into a formal, auditable way the NRC can determ'ine that licensees are doing a satis-factory job of assuring public health and safety.

A number of diverse regulatory initiatives are supportive of this trend.

Among them are the requirements on licensee staffing and organization, the proposal that licensees employ probabilistic risk assessment methods as design and operations management tools, and the pilot studies of independent design reviews.

The necessity for and content of the proposed rule is based on (1) operating experience to date with power reactor scram systems, (2) system

(

reliability analysi.s, (3) the qualitative findings of reactor risk assess-ment, and (4) ATWS accident analyses.

There has been one partial failure of the scram system in a commercial power reactor.

It occurred at Browns Ferry Unit 3 on June 28, 1980.

Although the particular scram system failure mode that caused the event is very unlikely to cause a severe radiological release accident,

• See, e.g., "NRC Action Plan Developed As A Result of The TMI-2 Action Plan" NUREG-0660, " Policy on Proceeding With Pending Construction Permit and Manu-facturing License Applications," SECY-Sl-20D, and "Use of Independent Design Reviews (IDRs) in the Regulatory Process," SECY-El-lEl.

Copies of these references are available for public inspection in the Commission's Publ'it Document Room,~ loc.* cit.

l l

I A-S

?E90-0i]

'd theeventandthereviews/, sit ti: <cd reveale: a nur.ber c' reliability de'iciencies in the BWF. scram systems.

Thess are nov. being rectified by the industry subject to the review and approval of thE W staff.

One objective of the proposed reliability assurance prograr is to 1

institutionalize within the licensed industry the th rcug* evaluation and implementation of the lessons of experience with fun:tions important to ATWS prevention or mitigation.

Reliability deficiencies in safety systems differ substantially in the kind and frequency of opportunities to detect and repair ther.

Some faults are self-announcing and thus elicit prompt repair.

Others show up in each surveillance test.

Some faults may,not be revealed by routine surveillance tests.

For instance, the reliability defect responsible for the partial scram failure at Browns Ferry could not have been detected in routine surveillance tests of the scram system.

System reliability calculations by the Electric Power Research Institute and others have shown that compo-L nent failures of reactor scram systemgthat are detected and corrected in each surveillance test are very unlikely to cause ATWS events.

Other system failure modes can only be detected in some but not all surveillance tests.

Still others show up only in some or all genuine demands upon the system.

Some reliability defects cannot be detected ever in genuine sys-tem demands, unless triggered by other failures.

Exam;ies cf the latter category are the hydraulic design deficiencies in the EWF. scrar discharge system revealed by the incident at Browns Ferry.

Such blind spots ir, the

e,.

..--. a.3 3

e);e ".er.:e DE!e fcr ca'ety systems can concesi serious flaws in relia-t " ' :;..

Tr..s, a second etje:tive of the reliability assurance prograr is :: cc d.:: E :Pc-sugh analysis of the startup test Orogram, the surve'l-

~

la"ce test prograr, and the record of system functional experience to where feasible - close loopholes through which design ider

e:

de.:'s :ies, constru: tion deficiencies, vulnerability to test or main-terian:e e""c", C" tC Component failures Fight escape detection and thus i

corre:-ic" fee cccsiderable periods of time.

t 5 :iss 4 i-iated in response to the Browns Ferry partial scram j

failu-e i-:icatec the two auxiliary systems that serve the scram sys er as well at c-te systems, could have caused partial or complete scrat failures.

~*is discove y is suggestive of a class of common cause

)

I failure: tha righ compromise the safety of a reactor.

Failures in a.xil ar., syste s tight cause the initiating transient as well as de-grace "i reliability of the scram system, or such failure might con-tritu e :c the scrar failure and also compromise the availability of one cf the systers required to mitigate an ATWS event, or all three, r

I T he Euy'.ii"y systems of note are the vent system, serving the scram d's:har;e v: lures, and the compressed air syster serving the air-operated s:ca viive s.

i

A-7

[7590-013 Tnus, a inird objective of the reliability assurance program is to search out and evaluate the potential common cause failures that might contribute to failure in two or more systems whose reliability is important to ATWS accident sequences.

This search shoulo embrace not only auxiliary systems but also human effects via test, maintenance, and operations; technical specifications dealing with equipment availability; and environmental conditions in the plant.

A fourth objective of the reliability assurance progrcm is to search out and evaluate the susceptibility of the redundant divisions of each safety system important to ATWS prevention or mitigation to common cause failure.

Concern with such common cause failure modes of the scram system has been central to the history of the ATWS controversy.

A common cause failure of an electrical nature has already occurred in a reactor scram system in a commercial nuclear power plant (Kahl reactor)

I that could have resulted in its failure to operate on demand.

That failure was detected during normal surveillance and rectified.

A similar common cause failure was detected and corrected in the startup testing of the Monticello reactor.

Estimates of the upper limits of the frequency of ATWS events for the commercial power reactor industry are of the order o 10- per reactor year.

The NRC staff has concluded that operating experience is not sufficient to determine conclusively on a statistical basis whether reactor scram systems are reliable enough to make the prob-ability of unacceptable consequences from ATWS events sufficiently small.

A-8

',7590-01)

The impmvements emanating from the proposed reliability assurance prograr.

will make ATWS accidents less likely and the systems that mitigate ATWS events more reliable, Nevertheless, it is necessary to assure that citigating systems will render the outcome of most ATWS events acceptable.

The principle of defense in depth calls for reactor plants to be designed and operated in such a way that a rare ATWS accident can be tolerated.

The requirements for ATWS-tolerance in light-water cooled commercial-power reactors are intended to afford an opportunity to learn from exper-

.ience without placing the public health and safety in jeopardy.

The first occurrance of an ATWS precursor due to any particular failure rode will result in studies like those now being made in response to the Browns Ferry incident.

These can be counted on to make a recurrence of the failure mode very much less likely in the future.

Calculations of the expected consequences of very severe reactor accidents have been made in the Reactor Safety Study, WASH-1400 and other studies.

The results indicate that the accidents which could realistically be expected to result in lethal radiation doses outside the plant site are those denoted as release category 1, 2 or 3 accidents in the notation of WASH-1400.

These are also the a'ccidents which are expected to cause substantial offsite property damage.

t

A-9

~7590-C1)

Studies of ATW5 accidents in pressurized water reactors (:WRs) sugges-that only a small percentage of reactor scrams are limitine transients.

That is, only a small fraction of the opportunities for ATW5 accidents occur under circumstances that r:ost severely challenge the ATWS-tolerance of the plant.

In addition, the qualita'tive findings of PWR risk assessment studies suggest that even the most limiting classes of ATWS accidents in PWRs are unlikely to produce a release category 1, 2 or 3 radiological outcome.

In boiling water reactors (BWRs) a substantial fraction of scrams take place under circumstances that can lead to a limiting transient.

BWRs are least forgiving of those ATW5 events in which the reactor is isolated.

Even if reactor isolation does not cause the transient in the first place, the effects of a failure to scram are likely to trigger reactor isolation.

Furthemore, BWR risk assessment studies suggest that ATWS accidents may give rise to release ca'tegory 1, 2 or 3 outcomes.

~

These arguments suggest that PWRs may already achieve the minimum ATWS tolerance necessary to supplement the reliability assurance program, whereas improvements should be mandated for BWRs to strengthen their provisions for ATWS mitigation.

However, a rore careful analysis of ATWS-tolerance is required in the proposed rule to provide the basis and fom of actions to be taken bf licensees.

~

In pressurized wator reactors, the liriting transier.t with respect tt ATW5 is a complete interruption in the delivery of feedwater to the stear generators during full power generation.

Snould the scrar fail to shut the reactor down, the continued power gene-ation and the declining heat removal, as the secondary coolant boils away, causes a surge in pressure of the reactor coolant. The.:everity of this pressure excursion is a sensitive function of the roderator temperature coefficient, the capacity of the relief valves attached to the reactor coolant system, and the speed with which the auxiliary feedwater system starts.

The pressure surge will subside as steam bubbles in the core shut down the reactor.

Subsequent reactor coolant replenishment and reactivity control is provided by the j

t high pressure injection system, which pumps cooling wate containing a reactivity poiso into the reactor coolant system.

The rest severe test of the ATWS-tolerance of a PWP lies in its survival of the pressure excursion, and in the successful start of the auxiliary feed-l water and high pressure injection systems. The possible outcomes of the pressure excursion are (1) the reactor coolant system remains undamaged and interfacing equipment undamaged, (2) the reactor coolant system remains in-tact but instruments on the pressure boundary fail or the valves for the HPI system are damaged, (3) the reactor coolant system is ruptured producing a-loss-of-coolant-accident (LOCA) in containment, (4) steam generator tubes rupture causing a primary-to-secondary LOCA, or other interfacing systems O

h

.m

A-11

-75 % - O _1 LOCA, c- (E) combinations of (2), (3) or (4).

The # irs outcome is c'ei-ly preferred.

The second outcome makes it clear that care mJst be take". :: assure that the operators have sufficient information about the status of tne -eactor to manage the recovery.

Should the HPI pressure boundary valves all seize in the closed alignment, the core will melt.

This is one o' several patns from ATVS to a contained core melt accident.

A LOCA in containment is likely ::

be mitigatable by the Emergency Core Cooling System (ECCS), even thougF. the initial pressure conditions are outside the design envelope for ECCS ana'.ysis.

Thus, no core nelt is expected, although a contained core melt is a remote possibility, and a core melt with missile damage to containment is a still more remote possibility.

Steam generator tube rupture car, provide a leakage path to the.outside atmosphere that bypasses containmer.t.

H3 wever, ECCS is likely to be successful, so the core would not melt.

All but one stear gen-erator can very probably be isolated, thus terminating a minor release.

The severe release category 1, 2, or 3 events occur only for a core melt and a gross above-ground failure of containment.

This is not among the no-e probable outcomes of even the most severe and damaging pressure excursions associated with ATWS in PWRs.

Analysis of ATWS transients by the NRC staff and the reactor supoliers suggest.that-Westinghouse reactors have sufficient relief capacity so tna; pressure excursions expected of limiting ATWS transients will not be ca ag-ing, provided that the auxiliary feedwater system starts promptly.

Combustion Engineering and Babcock and Wilcox reactors may be subject :

e ee

=

A-12

[ 7 590-01 ~'

seve-e pressure e>cursions even with prompt start of the auxiliary feed-system, shocid tne ATWS accident take place at a time in which the water moderator temperature coefficient is unfavorable. The NRC staff has ir. NUREG-046; that these plants should install additional relief arguet capacity to improve their ATWS-tolerance.

The industry has argued that such modificatior.s are very expensive, will produce substantial occupational exposures to radiction to those installing them, and are unnecessary because the plants already have sufficient tolerance of the pressure excursion, according to their analyses in proprietary reports.

The hRC, in reassessing its position, has concluded that the minimum ATWS tolerance necessary to complement the reliability assurance program, doe > not dictate additional pressure relief capacity in CE and B&W plants I

in light of the several mitigating factors noted above. However, there are a number of other safety-related incentives to alter the provisions for reactor coolant pressure reduction or relief in PWRs. These include deliberate depressurization to enable low pressure safety injection in smali LOCAs and feedwater transients with scram, to avoid the melt-through of reactor vessels while at elevated pressure, and enable the ECCS accumu-lators to extend the point of no return for the restoration of AC power in station blackout accidents. The NRC expects to take up the case for and acainst altered pressure relief provisions for PWR reactor coolant systems in the forthcomin; ru,lemakings on degraded core cooling and minimum engi-neered safety features.

\\

A-13

[7S90-01]

Tne required ATWS-tolerance of PWRs rests upon the prompt start of the auxiliary feedwater system, the availability of instruments necessary for the operators to diagnose the ATWS accident sequence and suc-

~

cessfully maneuver the plant to minimize the release of radiation, the training of operators to accomplish this, the availability of the high pressure injection system, and the integrity of reactor coolant pressure boundary valves through which a LOCA would bypass containment and could not be isolated.

In some F4Rs, the very rapid autostart of the auxiliary feedwater system following a feedwater transient can over-cool the reactor if the scram is successft).

In such plants, tne rapid start logic may be inter-locked to take place only if the scram fails.

The identification of the required instrumentation and the training of operators may be made a part of the reliability assurance program, and the verification that the instru-ments and the critical pressure boundary valves on the reactor coolant system have the required tolerance of the limiting pressure excursions are to be part of the ATWS-tolerance requirements.

The roderator temperature coefficient, which strongly influences the snerity of the reactor coolant pressure excursion for limiting ATWS trans-ients, is at its least favorable value during the early months of operation with the first fuel load.

The early months of plant operation j

l t

A-14

[7590-01]

are also characterized by a higher-than-average frequency of transients and of safety system failures as the plant is shaken down and the plant personnel gain experience with the equipment.

Therefore, much of the risk associated with ATWS accidents is expected to be concentrated in the first months of plant operation.

One mitigating factor is the less-than-equilibrium inventory of fission pmducts accumulated in the fuel at this time.

Nevertheless, PWR reactor licensees are to propose and implement particularly stringent limiting conditions of operation in the technical specifications to constrain operation when combinations.of the unavailability of mitigating or preventative equipment, the prevailing moderator temperature coefficient, and the power level encroach upon the tolerance of the plant for the pressure excursions to be expected of limiting ATWS transients.

In large, modern boiling water reactors, a transient with failure to scram from full power is very likely to cause, or may follow, the iso-lation of the reactor, notably a trip of the main steam isolation valves.

In the event that the reactor coolant recirculation pumps continue to run, the power level will remain high and a severe pressure excursion will take place.

Even if the reactor coolant system survives the pressure surge, the very high steam flow will rapidly heat the suppression pool and pres-surize the containment.

In addition, the high pressure coolant injection

A-15

[ 7 5 K - C', ';

~

(HPCI) may not suffice to cool the core; overheating and core damage may follow.

Ultimately the containment is expected to rupture due to overpressure while the core sustains damage.

Continued core coolant replenishment is questionable after containment rupture.

A large radiological release is a plausible outcome.

A necessary mitigatinc feature is thus a prompt, automatic trip of the recirculation pumps to avoid the pressure excursion and diminish the power and tne consequent steam flow to the suppression pool.

Given a trip of the recirculation pumps, the reactor power will stabilize at roughly 301 power until the reactor coolant boils down and steam bubbles (void fomation) in the core throttle the chain reaction. Thereafter, a static or oscillatory equilibrium will be maintained in which the reactor sustains the average power necessary to boil off however much reactor coolant is delivered, up to about 30%

powe r.

Analysis shows that HPCI or main feedwater can adequately cool the core to avoid extensive core damage.

However, the power delivered to the suppression pool will be greater than the pool cooling system can dissipate.

Therefore, containment overpressure failure remains a distinct possibility unless the reactor is shut down, either by control rod insertion or by liquid reactivity poison injection.

Well before the containment is significantly pressurized, the suppression pool will approach saturation temperatures and the steam condensation will become unstable.

Chugging steam condensation may threaten containment integrity

l or pressure suppressior, and thus shorter the M me avaiiatie to shut dowr.

l the reactor without unacceptable consequences.

In liniting transients, the failure of the main 'eedwater syster may be a concomitant of the initiating event. The HPCI is a single train syste..

System reliability analyses have indicated that it may fail or be unavailable in as many as 10* of the cases in wnich a demand is made of the system.

The tiRC finds this to be insufficient reliability 'or the mitigation of a potentially seriouc acci-dent having a frequency of occurance that might be as high as once in a thousand reactor-years.

A second, diverse syste., the Reactor Core Isolaticn Cooling syste- (RCIC) should be expected to autostart and run, delivering coolant to the reactor.

The flow rate delivered by the RCIC is lower than that of the HPCI.

In the event that the RCIC is the sole operative means of replenishing reactor coolant, the adequacy of core cooling, rather than the heat deposited 'in the suppression pool, is likely to be the factor limit-ing the time allowed to shut down the reactor without unacceptable consequences.

The RCIC can successfully cool the reatter once shut down, and it can slow the boil-off of reactor coolant in the reactor.

The fiRC has concluded that the liquid reactivity poison injection system in large, modern BWRs must have a start time and poison injection raie such thE' either of two redundant trains of high pressure reactor coolant replenishment systems, either of which may be expected to be available under ATWS conditions, can successfully citigate ATWS trans-ients. The two trains may be the HPCI and RCIC.

O

A 17 95?;-C'.:

The criteria of successful mitigation are:

(1) tne containment temp-erature and pressure must remain within the design envelope, (2) the core must retain coolable geometry, (3) neither acute fatalities nor serious i

off-site property damage are predicted, employing analyses whose conservatism is compatible with that employed in WASH-1400, and (4) stable hot shutdown is achieved.

Several factors complicate the analysis of the ATWS-tolerance of BWR plants.

The delivery of main feedwater, which viay be available in some ATWS accident sequences, may dilute liquid poison and increase the power level in ATVS events, thus threatening successful mitigation.

In some sequence variants, operators might be tempted t-depressurize the reactor to enable ' low pressure reactor coolant injection, but in so doing disable turbine-driven coolant injection systems or otherwise compromise possible avenues of successful ATWS mitigation.

The reliability assurance program must entail a thorough investigation of such ATWS accident sequences, of the instrument indications available, and of the passible range of operator actions.

Operator training should familiarize operators with the optimum strategifts and sensitize them to serious errors in dealing wTth ATWS' accidents.

~

BWR reactor operators may be subject to a strong disincentive to actuate the Standby Liquid Control (SLC) system because of the costly nature of

g..

lE

[7590-C' s:u ':a! SLC a::ut ier.s.

They may als; be in: ret te override er. au o-s a ; cf tne SL: ir.

ne event tha: they dout that ar. ATWS indicatier. is gen 4ne o-the fe'lu*e of the scra syster is irreparable. The NP.C re:cgr.izes the legitimacy of the concern with the cost of spurious SLC actuatien.

Tc deal with inese conflicting con: erns, the NRC proposes te require the automatic start of the SLC system under circumstances diagnosed to be ATW5 at:idents. Licensees are free to employ reliability engineering methods te rir.irize the 'ikelihood of spurious actuations under non-ATWS circu -

stan:es, provided that these provisions do not compro' ise the reliability of the essential SLC safety function in genuine ATWS accidents.

In light of the analysis and operator training associated with the reliability assurance program it is not deemed necessary to preclude provisions for manutily overriding the autostart of the SLC. As part c' the reliability assurance program, a thorough analysis is to be made of the circumstances in which an operator might be tempted to override a genuinely neeced SLC actuation.

Consideration should be given to improved ir.strumer.tation if the correct diagnosis of such secuences is ar.biguous. Doerators must be trained to give first priority to safety rather t r.a t tre availability of the plant for power generation.

The anticipatier. :nt: repeated manual scrams or quick fixes in the contrci cabinets may sa::eed in inserting the control rods would be an unacceo-table justification for overriding SLC actuatier..

A.l g

[7590-01)

The NRC does not deem it necessary that the SLC meet the single failure criterion as well as the indicated success criteria.

In the very unlikely event of an ATWS event and a failure of automatic and manual starts of the SLC system, a fallback strategy is available through manual rod insertion and intervention in the reactor protection system control cabinets.

Nevertheless, the SLC must not depend upon a single division of an auxiliary system, the failure of which would also compromise the reliability of the scram system or of the recirculation pur.p trip, or precipitate the initiating transient.

BWRs must also operate under specified Limiting Conditions of Operation I

that constrain power generation under circumstances in which equipment un-availability compromises the reliability of systems important to ATWS prevention or mitigation.

The older, lower power level reactors may differ significantly in the levels of ATWS-tolerance provided.

These plants are to submit analyses of their. ATWS-tolerance for review by the NRC staff.

The dual approach of ATWS-tolerance and the reliability assurance program provides defense-in-depth.

Each allows the other to be implemented s

Se

".O

l A-20

[7593-01]

without highly conservative margins. The margin provided by ATWS-tolerance allows realistic cost-benefit considerations to govern the selection and schedule of implementation for fixes suggested by the reliability assurance program.

The very costly accident at Three Mile Island has demonstrated that the protection of a license 9's investment in a reactor plant provides a powerful economic incentive to search out and correct reliability defects in the.

functions that protect a reactor core from damage.

These economic consid-erations, together with a realistic evaluation of offsite risks affecting public health and safety, are sufficient to determine the scope and schedule of the more expensive or intrusive alterations in plant operation or design emerging from the reliability assurance program.

The reliability assurance program is not to be a paper study to demonstrate to the NRC staff that the plant is already safe enough. The role of probabilistic evaluations is subsidiary to the qualitative search for and evaluation of specific types of reliability defects. The reliability assurance program is not intended primarily to serve NRC staff review, Rather, it is to be integrated into the conduct of plant management, per-sonnel training, and the conduct of operations.

It is intended to strengthen the responsibility for safe design and operation of the plant resting with the licensee, and to relieve the NRC staff of much of the ' detailed invol-vement in experience review and the selection of procedural or hardware

~7590-01)

A-21 backfits in the context of ATWS risks.

For this reason, the proposed rule emphasizes criteria for the sound implementation of the reliability assurance program and limits the staff review to these criteria, together with the conventional review and approval of the license amendments asso:-

iated with changes in design or operation.

Pursuant to the Atomic Energy Act of 1954, asLicended, the Energy Reorganization Act of 1974, as amended, and section 553 of title 5 of the United Stated Code, notice is hereby given that adoption of the following amendments to 10 CFR Part 50 is contemplated.

l l

4 ep e

e g

M e

i e

i.

~\\_

A-22

[7590-01) c.

5C.49 Standards for tne Reduction of Risk from Ar.ticicated Transier.ts Without Scram (ATWS) Events for Light-Water-Cocied Nuclear Power Pla nts Each commercial power reactor licensee shall establish and maintain a reliability assurance program for functions assoc 1;ated with the prevention and mitigation of Anticipated Transients Without Scram (ATWS).

State-of-the-art methods and procedures to identify vulnerabilities to failure shall be employed.

Each licensee is responsible for the implementation of cost-effective improvements to reduce ATWS risk. Defense-in-depth sha11 be maintained by operating

~

commercial power reactors only in mode,s which afford an opportunity to learn from,. experience with ATWS events without severe radiological releases.

Specific

(

acceptance criteria are delineated bel,ow.

(a) The initial reliability assurance analysis shall include an analysis and classification of the principal determinants of the radiological severity of eacF t tss of ATWS accident sequences in terms of the initial pl' w r3c*'. ions, the type of initiating transient, the failure mode of the reactor protection system, and the state of operability or inoperability of other active systems affecting the outcome. This analysis shall be employed in:,

s',

1 (1) The, training of licensed reattor operators in the diagnosis and

/

prognosis of the several ATWS accident sequen:es.

Operators shall be trained to make productive use of their time during c

S

'e 9 V

/

A-23

[7590-CE I

ATWS accidents c effect mitigation.

Consideratior. shall be given to improvin5 instrumentation, dis itys, emergency pro-j cedures, and operator training to minir.ize the likelihood that misdiagnosis or delayed diagnosis of ATW5 sequences may substan-tially increase the radiological severity cf tN outcome.

(2) An analysis shall be made of hypothetical erro"s in or erroneous departures from proper test and maintenance procedures for systems whose reliability is important to ATWS prevention or mitigation.

Consideration shall be given to improved designs, test equipment, procedures, and personnel training to minimize the likelihood that the reliability of these systems will be compromised by errors in test and maintenance.

(3) An analysis shall be made of the blindspots in the experience base with systems important to ATWS prevention or mitigation, through which reliability defects might escape detection for considerable periods of time. Hypothetical reliability deficiencies shall be classified by:

(i) kind (design deficiency, construction defi-ciency, vulnerability to test or maintain error, active or passive failure), (ii) affected components or subsystems, (iii) severity of the reliability deficiency, anc (iv' the frecuency and kind of opportunity to detect the deficier.c;..

A test prograr covering startup or one-time-only tests, tests associatec with periodic plant overhauls, and in-service surveiliance tests

A-2E

[7590-01) s.a :t ceveicoed and ir.piemented that rinimizes the nean time tc detect sucr deficiencies to the extent reasonably achievable.

(4)

A analysis shall be made of the susceptibility of the plant to cor.or :ause failures of two kinds:

those in which a single l

l rc:t cause degrades the reliability of redundant divisions of a safety system important to ATWS prevention or mitigation, and those in which a single root cause degrades the reliability of w: cr rore systems whose concurrent failure contributes to a sece e ATWS accident sequence.

The kinds of root causes to be censicered are those listed in (a)(3';(i) above.

Consideration w:'.1 be given to improved design or operation to reduce vulner-ability to common cause failures.

(b)

Centin;ing reliability assurance program Each commercial power reactor licensee shall maintain a continuing l

reliability assurance program for functions important to ATWS prevention and mitigation meeting tne following criteria:

'1 )

Configuration control will be instituted for designs, pro-cedures, and technical specifications to assure consistency

_ with the initial reliability assurance analyses.

9 9

E-25

[7590-C':

(2)

Affected portions of the initial reliability assurance analysis will be updated for, and prior t0, departures from the controlled design, procedures, or technical specifications.

Applications for license amendments to implement such changes shall include a brief analysis of the impact of the change on the reliability of systems important to ATWS risk.

(3)

An experience feedback system shall be maintained to review operational and test data on relevant systems in the licensed plant and the relevant experience at plants having a similar system design.

Each operational occurrence shall be reviewed for clues to oversight or errors in the reliability assurance analyses.

The initial reliability assurance analyses and cost-benefit analyses based thereon are to be updated when the experience feedback system reveals oversights or limitations in these studies.

(c)

Design and operation for ATWS tolerance (1)

Boiling water reactors receiving an Operating License after August 22,1969 shall:

(i) provide equipment to trip automatically the reactor coolant recirculation pumps under conditions indicative of an ATWS

event, G

G

A-2E

590-01]

~

~

(ii) provide equipment to deliver automatically liquid reactivity poison such that either of two independent reactor coolant replenishment system trains, expected to be available during ATWS events, can-successfully bring the reactor to stable, hot shutdown.

The poison injection system shall not depend for its function upon a single division of an auxiliary system whose failure could precipitate the transient or degrade the reliability of the scram system or defeat the recirculation pump trip.

(iii) provide a reliable scram discharge volume system.

(2)

Pressurized water reactors receiving an operating license after August 22,1969 shall:

(1) provide for the prompt, automatic start of the auxiliary feedwater system under circumstances indicative of a transient entailing loss of main feedwater and a failure to scram, and (ii) assure that the instruments necessary for the diagnosis of and recovery from ATWS accident sequences will not be disabled by the effects of such accidents, and (iii) assure that those reactor coolant system pressure boundary valves through which high pressure injection can reach the i

reactpr remain functional after limiting ATWS transients and j

m e

=ee e

A.27

[7593-01) those valves whose integrity is esser.tial to the avoidance of unisolatable, uncontained loss of coolant accidents retain their integrity throughout limiting ATWS transients.

1 (3) Commercial light-water-cooled power reactor licensees not covered in paragraphs (c)(1) or (c)(2) above shall submit an analysis of the ATWS-tolerance of the plant.

l (4) Each commercial power reactor shall prepare, submit for review

.and approval and implement Limiting Conditions of Operation that proscribe operation in, and mandate expeditious retreat from, operation under conditions which compromise the ATWS tol-erance of the plant.

Limiting Conditions of Operation should also minimize operation under conditions in which the ATWS-tolerance of the plant would be severely tested by a limiting ATWS event.

Consideration of the prevailing plant parameters as well as equipment operability is appropriate in the Limiting Conditions of Operation.

(5)

For the purposes of paragraph (c), the ATWS-tolerance of a plant is inadequate if any of the more limiting transients, followed by a total failure of the scram sy: tam, result in any one of the following:

(i) containment pressure or temperature above the design values, (ii) loss of coolable geometry in the core, or (iii) releases of radiation that may realistically cause any offsite acute fatalities or serious offsite

.... property damage.

r A.28

[7590-01) 1 (c)

Schedule of Im;:lementation and Reporting Recuirerents (1) Plans for the implementation of the reliability assurance program called for in paragraphs (a) and (b) cf this section shall be filed with the NRC for review and approval.

Holders of operating li-censes, applicants for operating licenses, and those expecting to file an application for an operating license within one year of

[the effective date of the rule] shall file the program plan at a time to be agreed upon by the NRC staff.

The time afforded for plan development will be not less thar, one year [from the effec-tive date of the rule]. Those holders cf construction permits who file an application for an operating license on or after [one year from the effective date of the rule] shall file the relia-bility assurance program plan at the time of operating license application. The plans shall identify (i) the ways the relia-bility assurance program will be integrated into the engineering and operations management of the plant, (ii) the reporting and approval requirements internal to the licensee's organization, (iii) the plans for information evaluation and exchange among licensees as part of the experience feedback function, (iv) the criteria for reporting to the NRC, (v) the criteria for the adop-tion and scheduling of alterations to plant design or operation emerging from the reliability assurance program, and (vi) the date at which the initial studies can be completed.

A brief summary of findings and plans for the resciution of reliability deficiencies should be filed with the NRC uoon ccTpletion of the initial reliability assurance studies.

Subsecuent discoverie's of

A-29

~759;-:':

I reliability deficiencies in the plar: 15culd as -ecorted in accord with prevailing practices for repcrtir.; ~.icensee even:s.

l The reliability assurance program will be sutject tc audit by the NRC.

It is not expected that the NRC wili engage in rou-ine review and approval of the program unless a ca-err suggestive of non-compliance is observed.

(

(2) Applicants for or holders of operating licenses subject to (c)(1) or (c)(2) of this section shall file with the NRC plans for the implementation of the requiremer.ts cf para-graph (c) [within one year of the effective ca:e cf the rule] or upon license application, whichever is later.

l The full implementation of the requirements of (c)(1) f and (c)(2) and (c)(4) shall be complete [within three years of'the effective date of the rule] or by the date of initial reactor criticality, whichever is later.

(3) Holders of operating licenses subject to (c)(3) of this secticr shall file with the NRC plans for the accomplishment of the ATWS-tolerance assessment called for in (c) [within one year of the effective date of the rule).

The results of these studies, together with proposed changes, if ar.y, in desigr.,

procedures, and technical specifications tc assure ATWS-tolerance, and a proposed implementation schedule, shall be filed with the NRC for review and approval ~within three years of the effective date of the rule).

- - _ _. -.. _ _ _. _ _ _ _ _ _ _.. _ _. _