ML20076M335

Operating Reactor PORV Repts (F-37),TMI Action Plan Requirements,C-E Owners Group (CEN-145), Technical Evaluation Rept

ML20076M335
Person / Time
Site:	Millstone
Issue date:	07/18/1983
From:	Delgaizo T, Jenkins S, Overbeck G FRANKLIN INSTITUTE
To:	Chow E NRC
Shared Package
ML20076M338	List: ML20076M335
References
CON-NRC-03-81-130, CON-NRC-3-81-130, RTR-NUREG-0737, RTR-NUREG-737, TASK-2.K.3.02, TASK-TM TAC-45264, TER-C5506-409, NUDOCS 8307200260
Download: ML20076M335 (52)

Text

.

N.i

' *.~ ' '

-TECHNICAL EVALUATION REPORT d

~

, OPERATING REACTOR .:

m j PORV REPORTS (F-37)

p 4__.1.~

_TMLACTION PLAN REQUIREMENTS COM30$ TION' ENGINEERD!G OWNERS GROUP (CEN-145)

NRC CCCXET NC. Various FRC PROJECT C5506

,j -

FRCASSIGNMENT7

] NRC CONTRACT NO. NRCG1-2 FRC TASK ~ 409

{ FrsCated D j G. J. Overbeck Frank!!n Researct: Canter Author: S. M. Jenkins i

Stri and Racis Streets T. J. DelGaico Philadelpt:fa, PA 19103 FRC Group Laader: G. J. Cvarbech Prepared for J NuclearRegulatory Commission i

Lead NRC Engineer: E. Chev i

Washington, D.C. 20555 t

I

~g July 13, 1983 l

This reocrtwas prepared as an account of work sconsored by an agency of ttte United States l g Government. Neither the Unitec States Government nor any agency therect, or any of their i *d ,

empicyees, makes any warranty, excressed cr implied, or assumes any legal !! ability or

responsibility for any third ; arty's use, or the results of such use, of any information, acca-g ratus, product or process disclosed in this recort, cr represents that its use by sucn third ch party would notinfringe privately owned rights.

N E

l

\

ES Rid XA Copy.Has_Been SenUoJ_p_R h

U M ah n 6.ypp(go1b )(A . . . .

Franklin Research Center gg. A m Division,cf e., , - Th,e Franklin,Insttute

.m usie aut oxc

.. e, l TECHNICAL EVALUATION REPORT l

OPERATING REACTOR PORV REPORTS (F-37)

TMI ACTION PLAN REQUIREMENTS l

C

'OMBU$ TION ENGTNEERING OWNERS GROUP (CEN"145)

.z.-

NRC DOCKETNO. Various FRC PRCJECT C5506 FRC ASSIGNMENT 7 NRC CONTRACT NO. NRC-C3-81 130 FRC TASK 409 Preparedby g, y, o,,,y,eg Franklin Research Center Author: S. M. Jenkins 20th.and Race Streets T. J. DelGai o Philadelphia, PA 19103 FRC Group Leader: G. J. Overbeck l

Preparedfor Nuc!eer Regulatory Commission Lead NRC Engineer: E. Chow Wasnington, D.C. 20c3 '

l July 18, 1983 -

This report was prepared as an account of work sponscred by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, maxes any warranty, expressed or implied, or assumes any legal liacility or resconsibility for any third party's use, or the results of such use. of any information, acca-ratus, product or crocess discsosed in tnis report, or racresents tnat its use ey such third party would not infringe pnvately owned ngnts.

Prepared by: Reviewed by: Approved by:

I . S. J.h G$ h k -

J' Pritic! jut! Auttfor Group ta'ader

~

' Department Dirgi: tory Date 7-' S3 Cate- 7 ~ 'I 83 Date: 7- / ~9 3 I

t _L Franklin Research Center A Division of The Franklin institute The Somerren Fe Pamwey, Ptuna Pa.19iC3 (213148.t 000

s

.. m.

TER-C550 6-40 9 -

9 CCNTENTS

-Snetion Title Page 1 INTRCDtI: TION . . . . . . . . . . . . . 1 1.1 Pur' pose of Review . . . . . . . . . . . 1 1.2 Generic Background. . . . . . . . . . . 1 1.3 Plant-Specific Background . . . . . . . . . 3 2 REVIEW CRITERIA. . . . . . . . . . . . . 4 3 TECHNICAL E7ALCATION . . . . . . . . . . . 5 3.1 Review of tne CE Report for Completeness . . . . . 5 3.1.1 CE's Tecanical Approach. . . . . . . . 6 3 .1.2 CE's Fault Tree Transient Initiator Event Frequencies . . . . . . . . . 7 3 .1.3 CE's Fault Tree Branches . . . . . . . 7 3 . 3, . 4 CE's Probability Data . . . . . . . . 9 3 .1.5 Method of Reducing PORV System Failure . . . . 10 3.1.6 Analysis and Result of Failure Reduction Program ,. 12 l 3 .1.7 Primary Safety Valves . . . . . . . . 13 t

3.1.8 Comparison With other PWRs . . . . . . . 13 .

3 .1.9 Conclusion . . . . . . . . . . . 14 3.2 maluation of the CE Report Submitted in Response to NUREG 0737, Item II.K.3.2 . . . . . . . . 15 3.2.1 Evaluation of CE's Fault Tree Transient Initiator Event Frequencies. . . . . . . 15

3.2.2 Evaluation of CE's Probability Data. . . . . 18 3.2.3 Evaluation of CE's Conclusions on POW Reliability. . . . . . . . . 18 3.2.4 Evaluation of Primary Safety valves. . . . . 19

.  %' 111 m.h Frankhn Research Center A Osname ed The Psessen suemme

.. a. * - .

. e TER-C550 6-40 9 CCNTENTS (Cont.) -

Section Title Page 3 .3 Additional Considerations Relevant to Small-Break LCCA from Stuck-Open PCW or Safety Valve . . . . . . 27 3.3.1 Events Which Require the operator Action to Open the POW . . . . . . . . . 27 3.3.2 Overcooling Events . . . . . . . . . 28 3.3.3 Considerations of Low-Temperature, Cverpressure Events. . . . . . . . . 29 4 APPLICABILITY . . . . . . . . . . . . . 30 4.1 Applicability of the CE Report to CE-Designed Plants . . 30 4.2 Su:mnary . . . . . . . . . . . . . 31 ,

5 COM:LUSIONS. . . . . . . . . . . . . . 32 6 REFERE2CES . . . . . . . . . . . . . . 33 APPENDIX A - Evaluation of the Contribution from Cvercooling Events to the Total Probability of a Small-Break Loss-of-Coolant Accident from a Stuck-Open Power-Operated Relief Valve or Safety valve l

l l

l l

l .

A iv E00 Franidin Research Center 4 m w N r i a m.au.

-6 I

l

• l TER-C550 6-40 9 i

• l l FORDiORD This Technical Evaluation h port was prepared by Franklin Research Center under a contract with the U.S. Nuclear Regulatory Commission (Office of Nuclear Reactor Regulation, Division of Operating Reactors) for technical as31 stance in support of NRC operating reactor licensing actions. The l

l technical evaluation was conducted in accordance with criteria-established by th3 NRC.

Mr. G. J. Overbeck, Mr. S. M. Jenkins, and Mr. T. J. DelGaizo contributed to the technical preparation of this report through a subcontract with WESTEC l Services, Inc.

l 1

i a

l 1

l l

h - v L!iu Franidin Research Center l A Dummen of The heuen inuumas

l l

l TER-C5506-40 9

1. INTRODtI: TION 1.1 PURPOSE OF REVIEW This technical evaluation report (TER) documents an independent review of the report of "PORV Failure Reduction Methods" prepared for the Combustion Engineering (CE) Owners Group in response to NUREG-0737 [1] , " Clarification of TMI Action Plan Requirements," Item II.K.3.2, " Report on Overall Safety Effect of Power Operated Relief Valve Isolation System," as it pertains to the CE-designed units. This evaluation was performed with the following cbjectives:

o to ensure that the CE response is complete and properly documents the information required by NUREG-073 7, Item II.K.3.2 o to ensure that the CE estimated probabilities satisfy the review criteria.

1.2 GENERIC BACKGROUND In NUREG-0635 [2] , " Generic Evaluation of Feedwater Transients and Small

, Brc2k Loss-of-Coolant Accidents 'in Combustion Engineering-Designed Operating l

l Plants," the Nuclear Regulatory Commission's (NBC) Bulletins and Orders Task i

l Force recommended the following:

" Licensees should provide a system which closes the block valve auto-matically whenever the reactor coolant system pressure decays to a preset l value subsequent to a POW opening. This system should include an

! override feature so that pressure relief can be accomplished at lower pressures, as necessary.

Combustion Engineering should' prepare a report documenting the actions which have been taken to decrease the probability of a small-break LCCA caused by a stuck-open PORV. The report should include an evaluation '

describing how the actions taken constitute a significant improvement in reactor safety.

j Any future failure of a PORV or safety valve to close should be reported  !

l to the NBC peceptly. All future challenges of the PORVs and safety '

i valves should be documented in the annual report."

L

These recommendations were later included in NUREG-0660 (3 ] , "NBC Action l l'

Plan Developed as a Result of the TMI-2 Accident." The first recommendation 1 t

l l

@d Frenidin Resear.ch Center a

A>===w m n . l

k. ._ _ _ _ , _ _ _ _ _

l l .* so *

. I

\ '

TER-C5506-409 1

l was incorporated into NUREG-0660 as Item II.K.3.1, "Instauation and Testing i I

of Automatic Power-Operated Relief Valve Isolation System," and the second ,two '

reconeendations were modified and combined to form Item II.K.3.2, " Report on C7eran Safety Effect of Power-Operated Relief Valve Isolation System." In l l Reference 1, the staff delayed implementation of Item II.K.3.1, until the pending PORV reliability analysis of Item II.K.3.2 confirmed the necessity of  !

an automatic isolation system. SpecificaMy, NUREG-0737, Item II.K.3.2 stated: i (1) 2 e licensee should submit a report for staff review documenting the j various actions taken to decrease the probability of a small-oreak loss-of-coolant accident (LOCA) caused by a stuck-open power-operated {

relief valve (PORV) and show how those actions constitute sufficient improvements in reactor safety.

(2) Safety-valve failure rates based on past history of the operating plant designed by the specific nuclear steam supply system (NSSS) I vendor should be included in the report sucaitted in response to (1) . I i

above."

In addition, Reference 1 further clarified that:

" Modifications to reduce the likelihood of a stuck-open PORV will be considered sufficient improvements in reactor safety if they reduce the probability of a sman-break LOCA caused by a stuck-open PORV such that it is not a significant contributor to the probability of a small-break LOCA due to au causes. (According to WASH-1400, the median probability '

of a small-break ICCA S2 with a break diameter between 0.5 in. and 2.0 in. is 10~3 per reactor-year with a variation ranging from 10-2 to 104 per reactor-year.)

The above-specified report should also include an analysis of safety-valve failures based on the operating experience of the pressurized-water-reactor (PWR) verndor designs. De licensee has the cption of preparing and submitting either a plant-specific or a generic report. l If a generic report is submitted, each licensee should document the I applicability of the generic report to his own plant.

Based on the above guidance and clarification, each licensee should perform an analysis of the probability of a sman-break LOCA caused by a stuck-open PORV or safety valve. B is analysis shculd consider modifica-tions which have been made since the TMI-2 accident to improve the probability. 21s analysis shall evaluate the effect of an automatic t-

' PORV isolation system specified in Task Action Plan Item II.K.3.1. In evaluating the automatic PORV isolation system, the potential of causing a subsequent stuck-open safety valve and the overan effect on safety (e.g. , effect on other accidents) should be examined.

I nkiin Research Center A Ohnmen af De Frannen kusame l .- . . . . .

s.-- y,,- - -

y- ,y,. , , - , - - - -

, e -e-,-i,* - , , - - + , ..,-y--- , ., , , -c- ,- --- _ v-,.mm ,,y- -w. -- , . - - .

.. so

• TER-C5506-409 Actual operational data may be used in this analysis where appropriate.

i. The bases for any assumptions used should be clearly stated and justf.fied.

"te results of the probability analysis should then be used to determine

, whether the modifications already implemented have reduced th'e probability of a small-break LOCA due to a stuck-open PORV or safety valve a sufficient amount to satisfy the criterion stated above, or whether the automatic PORV isolation system specified in Task Action Item II.K.3.1 is necessary.

In addition to the analysis described above, the licensee shouli compile operational data regarding pressurizer safety valves for PWR vendor de. signs. Base data should then be used to determine safety-valve failure rates.

The analysis should be documented in a report. If this requirement is l . implemented on a generic basis, each licensee should review the appropriate generic report and document its applicability to his own

plant (s) . The report and the documentation of applicability (where appropriate) should be submitted for NRC staff review by the specified date."

1.3 PLANT-SPECIFIC BACKGROUND In letters to the NBC dated in early 1981 (4), owners of CE-designed units endorsed a report prepared for the ,comoustion Engineering owners Group,

( '2H-14 5 (5] , "PORV Failure Reduction Methods" as the response to NUREG-0737, Items II.K.3.1 and II.K.3.2.

An independent preliminary review of the informatien presented in R2forence 5 resulted in a request for additional information (RAI) being sent to one CE licensee from the NBC on January 20, 1982 (6]. The licensee rasponded to the staff RAI in letters to the NBC dated April 26, 1982 (7] and Juna 7,19 82 (8] . This "'ER is an evaluation of the information presented in References 5, 7, and 8 along with other information pertinent to the topic of a small-break LOCA from a stuck-open PORV or safety valve.

l l ranklin Researen Center A Desumen of The Pauan ennunne

- - - - - - , , ~ . - . - . , - - . - - -, - - - - . - . , , - .--- -. -- . ..-...-- - ----.-,--- -- -

c- ,

.. .e e .

TER-C5506-409

2. REVIEW CRITERIA 9

The Licensee's response to NUREG-0737, Item II.K.3.2, was evaluated

. against the acceptance criteria provided by the NRC in a letter dated July 21, 1981 [9], which outlined Tentative Work Assignment F. Specifically, the Licensee's response to NUREG-0737, Item II.K.3.2 was supposed to contain the following information:

"1. The report shall list the actions taken by the licensee to decrease the probability of a small-break LOCA caused by a stuck-open PORV.

2. S e report shall include an analysis of safety-valve failure rate based on the past history of the operating plants designed by the licensee's NSSS vendor. Bis may be a plant-specific report or a j generic report showing the applicability to the specific plant.

i

! 3. The report sh~all have an analysis of the probability of a small-break ICCA caused by a stuck-open PORV or a stuck-open safety valve. 21s analysis shall evaluate the effect of an automatic PORV isolation system. In evaluating this system, the licensee shall evaluate the i

l potential of causing a subsequent stuck-cpen safety valve and the .

overall effect on safety.

4. Actual operational data may be used. me basis for any assumption should be clearly stated and justified.

5. The automatic PORV isolation system is not required if the licensee's ,

actions constitute sufficient improvements to reactor safety in reducing the probability of a small-break LOCA due to a stuck-open PORV or a stuck-open safety valve such that it is less than 10-3/ reactor-year, the median probability of a small-break LOCA S2 with a break size between 0.5 in, and 2.0 in. due to all causes."

$dd Frankun Research Center A Ogumen of The Feuien inmumme

_ _ _ _ . -._--, - ~ . - . --- ---- - - - - - - - -

" ' ~

~

~

.. .e*

TER-C5506-409

3. TECHNICAL EVALUATICN The following tasks were to be performed under contract to the NRC (9):

1. Review the licensee's report required by NUREG-0737, Item II.K.3.2 to determine (1) if a licensee proposes to provide an automatic PORV isolation system and (2) if all the data required in the report have been provided by the licensee. Review the licensee's analysis for '

completeness in identifying all transients that lead to PORV challenges. The analysis should include failure in the integrated control system (ICS) , applicable to Babcock & Wilcox (B&W) plants only, operator error, reliability of PORV block valve, and otner initiating events. Review the licensee's analysis of safety valve challenge rate and failure rate to reseat. The analysis should include consideration of the PORV being blocked as a result of leakage, operator action closing the PORV block valve and actuating hign pressure injection (SPI) during the recovery from depressuri-zation events.

2. Evaluate the licensee'r reports required by NUREG-0737, Item II.K.3.2 against the review criteria in Section 2. If generic reports are submitted, the applicability of the generic reports to the specific plants, should be evaluated. Priority should be given to determining if any of the PWR licensees is required to propose an automatic PORV isolation system. If necessary, a letter was to be provided requesting these PWR licensees to propose such systems and the plant-specific technical basis fbe this request.

3. Prepara a TER for each plant. The TER will discuss the evaluation of the licensee's reports and, if needed, the proposed automatic POKV isolation system. The TER shall include a discussion of the assumptions made by the licensee in his reports.

This report constitutes a TER in satisfaction of Task 3. Section 3.1 addresses the completeness of the Licensee's report, while Section 3.2 provides an evaluation of the Licensee's analysis. In Section 3.3, additional items relevant to the stoject of a small-breax LOCA from a stucx-open PORV cr safoty valve, but not specifically addressed by the Licensee, are considered.

3.1 REVIER OF TEE CE REPORT FOR COMPLETENESS I

The review and evaluation of the information presented in Reference 5, as cupplemented by the additional information presented in References 7 and 8, forms the basis of this report. Reference 5 was prepared for the combustion

) ranklin Research Center A Commun of The husman mesame

.. .c*

TER-C5506-409 Engineering owners Group by Combustion Engineering, Inc. (CE) for the purpose of generically addressing the requirements of NUREG-0737, Itam II.K.3.2. (See Section 1.2 of this report for more detailed information pertaining to the requirements of NUREG-0737, Item II.K.3.2.) In Reference 5, CZ describes the various modifications that have been incorporated into CZ-designed plants since the tree Mile Island (MI) accident,and presents a probabil'istic analysis of the likelihood of a small-break LCX:A from a stuck-open PORV. Included in tne probabilistic analysis is the evaluation of a pre-mI, CZ-designed baseline plant, the effect on the plant of the post-TMI modifications as implemented,

- and the effect of a conceptually designed automatic PORV isolation system as identified in NUREG-0737, Item II.K.3.1. In Paference 8, the Licensee presents a probabilistic analysis of a small-break LOCA from a stuck-open safety valve.

3.1.1 CE's Technical Ancroach Several methodologies presently exist for deter:sining the frequency of a small-break LOCA caused by a stuck-open PORV or safety valve. Inherent in all of these methodologies is the requirement to determine the frequency and number of PORV or safety valve c!gallenges (demands to open) and the proba-bility of the POR7 or safety valve failing to close once it has opened. De probabilistic analysis tool chosen in Reference 5 for determining the expected frequency of a small-break IDCA from a stuck-open PORV is the fault tree. Se probabilistic analysis method chosen in Reference 8 for deter:dning the expected frequency of a small-break ICCA from a stuck-open safety valve is the I event tree. As demonstrated in WASR-1400 [10], " Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Pcwer Plants," the use  ;

of event trees and fault trees as probablistic analysis tools is an acceptable technical approach for analyzing reactor incidents such as a stuck-open PORV or safety valve.

Since well-documented probablistic analysis techniques have been used, a detailed discussion of the technical approach is not required. Me following subsections, which describe the analyses as presented in References 5, 7, and 8, are provided for clarity.

p -s-Jdd4Frankiln om Research Center

.e n. r a- ..

- . 4_ ,.

...- . . . e-l l

TER-C5506-40 9 3 .1.2 CE's Fault Tree Transient Initiator Event Frecuencies l A surv?y was conducted in early 1980 to compile the operating experience and POW initiating transient history of CE-designed operating plants. The curvey results indicated that, during 29 reactor-years of operation, only three POW transient-related openings were reported. In addition, the survey indicated that 16 high pressurizer pressure reactor trips had occurred. Since

! th3 POW opening setpoint pressure of CE-<iesigned plants is the same as the high pressurizer pressure reactor trip setpoint, it can be concluded that an tdditional 16 POW transient-related opening events had occurred. Based on these historical data, the POW opening transient-related event frequency for CE-designed plants was 0.66 per reactor-year.

In addition, CE assigned a value of 2.8 x 10 -3 per reactor-year for the f expected frequency of a spurious POW opening, taken from " Post TMI Evaluation Task 3 Follow-up Report, Pressurizer Systems and Emergency Power Supplies"

[11} .

3.1.3 CE's Fault Tree Branches In Reference 5, CE developed a fault tree that was used with the tran-sient initiator frequencies identified in Section 3.1.2 of this report to evcluate the frequency of a small-break LOCA from a stuck-open POW. The fault tree is based on the premise that each initiator event results in a single POW challenge event (i.e. , the POW actuation setpoint is exceeded only once per initiator event) . A CE licensee justifies this assumption in F.nference 7 as follows:

l "Only one POW opening is expected during a pressurization event in which '

the - POW's are actuated. As described in Section 3.9 of CEN-145, the coincidence of the POW opening setpoint and the high pressure reactor l trip at approximately 2400 psia on the Calvert Clif fs Nuclear Power Plant insures that the reactor is shutting down as the POW's are opening, if not before. By the time the POW's blow down to the reset pressure, the typical post-reactor trip pressure reduction is noted in the licensing and analyses of FSAR pressurization events. It should be noted that a more realistic best estimate analysis of the pressurization event, described in CEN-128, ' Response of CE NSSS of Transients and Accidents, '

l uddh A >=Franidin a.t w r,m-se Research C. enter l

, , . , . - .m.- ,- , --

.. .a TE.'+-C5 50 6-40 9

. indicates that POW's are not challenged when the pressure reduction due to systems such as pressurizer spray and turbine bypass are considered."

Ele fault tree starts with the desired outcome of a "LOCA due to a POW path lef t open." The fault tree then branches into two identical sequences to accurately model the fact that CE-designed operating plants, with the

, exception of Arkansas Power and Light Company's Arkansas Nuclear One Unit 2, have two POWS which open simultaneously at the same pressure setpoint. The two sequences that model the POWS branch *into two paths. These paths are:

1. PO W opens and fails to reclose,.and

2. block valve fails to close.

The first path, " POW opens and fails to reclose ," branches into two patas. Stese are:

1. POW opens, and

2. POW fails to reclose.

The " POW opens" path uses the frequencies discussed in Section 3.1.1 of this report. The " POW fails to reclose" path uses the POW failure rate discussed in Section 3.1.4 of this report.

The other major patb discussed above, " block valve fails to close,"

branches into two paths. These paths are:

1. operator fails to close valve, and

2. equipment failure.

The " operator fails to close valve" path simulates the failure of the operator to recognize and take the appropriate action of shutting the manual

[ block valve in the case of a stuck-open POW. The " equipment failure" path accounts for the various failure modes of the POW block valve, including the failure of the automatic closure signal if the autcmatic closure system is postulated to be installed.

By modifying the basic fault tree described above and shown in Figure 1, CZ performed small-break LCCA from a stuck-open POW expected frequency calculations for five cases. The cases were for a CE-designed plant with:

A - a-

$dd4onFrankun .en.m Research C. enter

~- .-, ---% v- ,,---,,.,,gv,,

--%.,--e-.y. -

. .,. , , - .---,-v,-,.-,,.--,-.y-- - , , - . - , - .-,-,,-.e.,-,- - - , - - - - - - , , , , . - , - , - - , - - , - - . , . - . , , . - - - . , - , - - , - -

- . . _ _ _ __ ~ __ _ _

~..

y ,

V TER-C5506-409 9

.l. a turbine runback feature and no operator action s n.

lf

2. no turbine runback feature and no operator action

3. no turbine cunback !wature and operator action

4. no turbine runback feature and no operator action, but automatic closure of the block valve l 5. no turbine runback feature and no operator action, bu* automatic

[ closure of series-redundanti block valves.

l ,

h5 3 . l'. A CE's Probability Da ta r -

In order for CE to quantify the fault' tree that was developed, probtaility data had to be gathered for each path at each node.

As detailed in Section 3.1.2 of this report, CE used historical operating dtta collected from a survey of the CEdesigned operating plants to deter.nine

,tho expected frequency of,the transient initiator events.

y me probability data assigned to the other fault tree branches do not deal with the expected transient frequency of the plant. Instead, the remaining prooability data deal with operator and equip ant reliability.

[' 3pecifically, operator and components data are necessary for:

1. failure of the POR7 to teclose on demand once it has opened 2.. failure of an operator to block the stuck-open PORV after it should J have closed b[ 3. failure of the PORV block valve to close (both manually and

- automatically).

Fof the failure rate of the PORV to reclose on demand once it has opened,

,, CZusedavalue.of2x10[ failure per demand. " mis failure rate was based

[ 'on the operating.- history of Babccck & Wilcox (B&W) plants which use PORVs lkDimilartothose'ofCE-designedplants. 21s failure rate did not incorporate t

l ch3 CE operating history of no failures in 38 operational openings.

~

It used only the B&W history of three failures in 150 operational openings.

For the failure rate of an operator to block the stuck-open PORV after it l

9uld have closed, it was stated in Reference 7:

g bi ranklin,Research

~. .

C. enter e

y . ;

\

c TER-C5506-409 "The value is based on data in Wash 1400 Table III 6-1, " General Error Rate Estimates." 2e value used is the mean of the error rate at the operator's normal stress level and the error rate at severe stress levels.

The error rate at the operator's normal stress level was taken to be the sua of the estimated error rates where display is available in the control room and no arithmetic calculation is required. This result was rounded conservativity to 1.0 x 10-2, Severe stress level probability was taken as the upper value of the l general error rate given very high stress levels where dangerous

! activities are occurrin rapidly, or 3 x 10-1 De contputed (mean) error rate was (3 x 10~g + 1 x 10 2)/2 or 1.55 x 10~1 To calculate the failure rate of the PC.T. bicek vrive to close, CE

( postulated the failure modes of the block valve. These were:

1. mechanical malfunction of 6.59 x 10-6 per demand based on the CE interim data base l

2. block valve motor failure of 2.02 x 10-4 per demand based on the CE interim data base

, 3. block valve breaker failure of 1 x 10-6 per demand based on IEEE I

Std 500-1977

4. automatic signal not received of 1.2 x 10-2 based on WASE-1400.

1 l 3.1.5 Method of Reducing PORV System Failure In Reference 5, CE provided a discussion of possible methods for reducing PORV system failures by reducing the frequency of challenges to the PORVs. Of the six possible methods, only one (elimination of turbine runback) was considered not to adversely affect the plant. A review of the turbine runback feature indicated that its elimination would not adversely affect plant operation while reducing PORY challenges to a significant degree. The methods cejected as causing adverse impact, along with a very brief summary of the l impact, are provided below:

l Method Impact Raise PORY Setpoint High pressurizer pressure reactor tri'p would also be raised. mis would invalidate the safety analysis and l increase primary safety valve challenges.

_renidin Rese_eren

. Ce_nter

- _ . _ _ = - . - - _ - -

e e TER-C5506-409 Method _ Impact Lower High Pressurizer Pressure m is would also lower PORV setpoint, Trip Setpoint thereby increasing PORV challenges.

Raise PORV Setpoint and Add very small number of PORY openings Another Righ Pressuriser would be avoided by difficult and Pressure Reactor Trip at impractical circuitry changes and 2400 psig and bistable addition.

Block Out and/or Deactivate POR7c should be used to preclude PORV During Operation safety valve challenges. If a safety valve sticks open, there is no block valve to mitigate this failure.

Reduce Operating Pressure Operating DNB ratio would be decreased. Also, load rejection

, pressure overshoot would be increased due to delay in reaching high pressure reactor trip.

In addition to reducing PORV challenges, improved PORV system failure l ccuntermeasures were discussed. Bree of the proposed methods were judged to hava positive effects on mitigating the consequences of PORV system failures j improved PORV indication, PORV power .from emergency power supplies, and improved operator espability. 2e fourth' method, providing automatic closure of the block valve whenever a PORV failed to close on demand, was determined to be a complex alternative with its own failure modes and therefore required further evaluation of positive and negative effects.

In' summary, CE identified a failure reduction program to be implemented at c11 CE-designed operating plants. He failure reduction program described in Reference 5 is as follows:

1. The turbine runback feature to be eliminated.

2. Se motor operators for the PORV block valves and the pilot solenoids for the PORVs to be provided with emergency power supplies to permit them to function upon the loss of all non-emergency power.

3. Ultrasonic flowmeters to be installed on the PORV discharge piping to provide a direct measurement of steam flow and, therefore, of PORV position, with indication and alarm in the control room.

p 4. Operator training programs to be initiated to provide the operator

! with a more comprehensive understanding of plant operation under

[d!b4 on=.FrankEn m. e .- Rese.a.rch

. Center

TZR-C550 6-409 .

emergency conditions. Guidelines and detailed emergency operating procedures to be developed to aid the operator to cope with a 4

spectrum of emergency conditions. This includes the conditioning of the operator to recognize and respond promptly to PORV failure to prevent escalation of the-failure to r saall-break LOCA.

3.1.6 Analysis and Result of Failure Reduction Procram In Appendix A .to Reference 5, CE provided an analysis to estimate the reliability of the PORV system, as well as an estimate of reliability expected following implementation of the POW Failure Reduction Program. As noted earlier, C3 used the B&W plant PORV demand failure rate of 0.02 failures-to-close per cpening. The CE failure rate data base was not used as it represented a small statistical sample. A ccmcined C2 and B&W data base, which would reduce the failure rate by 20% to 0.016 failures-to-close per opening, was not used by CE. Westinghouse data were not used because of the different PORV vendor used by Westinghouse.

A value of 0.155 was used for the probability of failure of the operator to isolate the failed-open PORV. This value was based on the data in WASE-1400 and was taken as the mean between the operator's normal stress level and severe stress level failure probabilities.

The frequencies for a PORV loss-of-coolant accident for the various corditions analyzed are summarized below:

l Case No. Description Frequency oer Year 1 Turbine Runback Feature and 2.6 x 10-2

, No Operator Action 2 No Turbine Runback Feature and 1.1 x 10-2 No Operator Action 3 No Turbine Runback Feature and 1.3 x 10~3 l

Operator Action l

l

! 4 No Turbine Runback Feature and 1.4 x 10~4 Automatic Closure of the Block Valve l 5 No Turbine Runback Feature and 1.7 x 10~0 l

Automatic closure of Series Redundant Block valves t

_renidin Research ___ Ce_nter t

__ _ _ _ _ ___ _ - - ~ . - - --- -- - - -- - ~ ~ - ___

-_. .= - ._. . .- - _ . _ .. .-

4 TER-C550 6-409 3.1.7 Primarv Safety Valves ,

With regard to the primary safety valves, CE made the following t

statement in Reference 5: *

"No primary safety valve lifts have been reported for CE operating plants during approximately 30 reactor-years of operation. Westinghouse plants l also have not reported any primary safety valve lifts. One primary safety valve lift has been noted in a S&W plant, but no details were given. In view of the lack of challenges to -the primary safety valves, a direct quantitative estimate of their reliability based on experience cannot be made."

CE then proceeded to discuss the similarities between the primary safety velves and the main steam safety valves (MSSVs) . In concluding the discussion, CE stated:

" Based on the seven reported MSSV failures and the 5650 estimated MSSV demands, a failure rate of 1.24 x 10-3 per demand is estimated. This failure rate is lower than the value of 2 x 10-2 estimated for power operated relief valves in NUREG-0560. Assuming that the MSSV reliability data are to some degree applicable to the primary safety valves, the data suggests that the primary safety valves may be more reliable than the PORVs. More definite conclusions must await development of operational j and/or test data on primary safety valves."

l 3.1.8 Comparison With Other PWRs

In Reference 5, CE described a basic difference in the design function of ths PORVs in a CE-designed plant as opposed to those in B&W- and Westinghouse-

.hcigned plants. S e distinction is significant in that there is an inherent incremental margin to PORY coa 11enges of the CE design as compared to those of 34W and Westinghouse designs. CE's statement is provided below:

"On CE plants, the initial design function of the PORVs was solely to reduce the challenges to the primary safety valves during power l

! operation. Se PORVs on B&W and W plants had an additional function, _

l namely, to reduce the frequency of reactor trips due to high pressure.

2e PORV actuation set point on CE plants coincides with the high pressure reactor trip setpoint, whereas, the other PWR vendors required that the PORV actuation pressure be below the high presrure reactor trip setpoint in order to reduce the number of high pressure trips. The CE design allows the specification of a higher PORV actuation pressure, and i

l rankhn Rese

-_eren_ Center .

,- _. . . _ . , , . _ - . - . - - _ . . . - - - , _ , , _ - - _ _ . _ . . _ _ _ . . _ . . . - - . . , . . , - - . . _ . _ . _ . - - - . . ~ . , . , _ _ _

TER-C550 6-409

' therefore a greater margin above the normal plant operating prssure than do the other PWR designs. Typically, the margin between normal operating pressure and the PORV actuation setpoint was,about 150 psi for CE plants, 100 poi for W plants, and 70 psi for B&W plants. This difference provided an incremerttal margin to PORV challenges in CZ plants compared with those of the other PWR vendors."

3.1.9 Conclusion i

CE has submitted a report which shows that the frequency of a small-break LOCA due to PORV failure has been reduced to the range of recurrence frequencies for small pipe rupture estimated in NASE-1400. The report shows

] that incorporation of an automatic block valve feature would further improve Pohv system reliability; however, the Licensee states further evaluation of l

positive and negative impacts on overall plant safety require further study.

The report documents the various actions taken to decrease the l

probability of a small-break LOCA due to a stuck-open POR7 or safety valve.

The analysis considered operator error, reliability of the PORV bicck valve, and initiating events that result in an overpressurization. ne analysis did act consider depressurization events that actuate high pressure injection and require operator action to prevent challenges to the PORV during recovery. C3

. has provided data to support the quantification of the fault tree paths at each node. The CE report includes a discussion of the safety valve challenge rate. However, instead of compiling operational data regarding safety valves for use in determining safety-valve failure rates, C3 cited a lack of historical data to permit quantification. Where appropriate, CZ has used l operational data, including operational data from asW-designed plants.

In summary, CE has submitted a report which is complete with the following exceptions:

o Depressurization events were not considered as initiating events o operational historical data were not used to compile safety-valve failure rates.

, _ranklin Resear_en_

_ . Center g-- - , -- . --, y v w y. -y ,y-,-ww--ww g,--, - - . - - . , w

TER-C5506-409 3.2 EVALUATION OF THE CE REPORT SUBMITTED IN RESPONSE "O NUREG-0737, ITEM II.K.3.2 The evaluation of the information reviewed in Section 3.1 of this report, as well as other information pertinent to the stuck-open PORV or safety relief valve topic, is provided in this section.

3.2.1 Evaluation of CE's Pault Tree T ansient Initiator Event Frequencies i

In Reference 5, CE determined a PORV initiator event frequency based on a curvey taken in 1980 of 29 years of operating history. The frequency of 0.66 f Gvants per reactor-year for CE plants was based on a total of 19 events occurring in the 29-year period.

l i

CE noted that recording of all PORV actuations had not previously been a  !

requirement. Consequently, only three PORV actuations during power operations l htd been recorded. Sixteen additional actuation events, however, could be inferred from the recorded number of high pressuri=er pressure reactor trip cvsnts. The inference was possible because the high pressure trip signal is g:;n: rated by the same bistable which actuates the PORV. CE went on to note j that 11 cf the 16 high pressure reactor trips were caused by the turbine

! runback feature of the protection system. Since this feature has reportedly j b:cn eliminated from all CE plants, these actuation events were eliminated from the data base leaving a total of 8 (3 + 16 - 11) in 29 years for an initiator event frequency (with no turbine runback feature) of 0.276 per rocctor-year.

In evaluating this approach, three items require further discussion:

1. elimination of the 11 turbine-runback-initiated events from the data

2. the possibility that a significant number of unrecorded FORV actuation events were not included in the 1980 survey

3. the possiblity of multiple PORV cycles per initiator event.

Each of these items is discussed separately below.

Elimination of the turbine runback events from the data is problematic in that some plant transient initiated the turbine runback. From the data

n. .

U :fJ Franidin Researen Center 4 oimeen. w a==mma.

L

i 4

TF.R-C550 6-409 presented, it is not clear whether a PORV actuation wuld have occurred, had the turbine runback feature not been available during these transients. The turbine runback feature was instaned to anticipate load changes which otherwise could lead to a turbine trip. With the runback feature removed, it is likely that several of the recorded events would have initiated a turbine trip.

As documented in CZ-plant FSARs, a turbine trip results in a chauenge of the PORV when no credit is taken for the coincident reactor trip. Ecwever, a turbine trip does, by design, initiate a reactor trip on CZ-designed plants and, therefore, the primary pressure transient will be terminated before reaching the PORV setpoint. Consequently, even with the conservative assumption that all 11 turbine runback events would result in a turbine trip, less than 0.11 POR7 chauenges would result assuming the reactor trip feature to be at least 994 reliable.

In summary, C2's elimination of the 11 turbine runback initiator events from the data bases because of the removal of the runback feature from the plant is considered technically valid, because this action inserts a reactor tri"pcoincident with a potential turbine trip. C2's use of a 0.276 initiator

event frequency, with the turbine runback feature removed, is considered valid.

_R egarding the possibility that unrecorded initiator events have bypassed the data survey, it is believed that the survey provides an adequate reflection of initiator events for the fonowing reasons:

1. The requirements to record the high pressurizer pressure reactor trips ensures that the majority of potential PORV actuations, because of the design of CE plants is such that a pressure transient sufficient to cause a reactor trip must chauenge the PORVs.

l 2. Reactor trips other than overpressure events are unlikely to

! challenge the PORVs because of the prior insertion of control rods.

There are no PORV chauenges of this nature in the data base.

3. Independent data taken from EPRI Report NP-2230 of January 1982 (ATNS: A Reappraisal (12]) tend to confirm the survey data.

9 l

. , _ -c---* - - '~~~ ^

v W

TER-C550 6-40 9 In NUREG-0653 [21, the NBC stated:

"The vast majority of transients that actually occur in power plants are not as severe as those postulated in FSARs (e.g., the initial conditions are less limiting, system failures are not as extensive, the heat trans-for coefficients are not as biased) . CE indicates that of all the transients analyzed in FSAAs, only loss-of-load, uncontrolled rod withdrawal, or loss of all non-emergency ac power could actually result in lif ting a PORV. Based upon plant operating experience, the only event observed whien had caused POWS to open is the loss of load or turbine runback event."

Using the data from Reference 12 (ATWS) , the following event frequencies

or CE plants are derived:

Total No.

?vsnt No. Event Events Years Event / Year 2 Uncontrolled Rod Withdrawal 0 15 .4 2 0 33 Turbine Trip 30 15.42 1.94 34 Generator Trip 6 15.42 0.39

'35 Total Toss of Offsite Power _2_ 15.42 0 . 13

. 38 15.42 2.46 Applying the conservative assumption that 10% of tdese' events would activate a PORV, the initiator event frequency would be 0.246, whien is nearly id:ntical to CE's frequency of 0.276 for non-turbine-runback plants.

With regard to the possibility of multiple POW cycles per initiator cvcnt, it is stated in aeference 7 that only one POW challenge occurs per

. initiator event because a reactor trip occurs simultaneously with reaching the l

PORV setpoint; therefore, by the time the PORV blowdown is complete, a post-reactor shutdown pressure reduction is in progress. This assumption is '

considered to be technically _ valid, and the consideration of multiple cycles per initiator event does not appear to be warranted where PORV actuation is automatic and tot the result of operator action.

In summary, an initiator event frequency of 0.276 is considered a cctisfactory initiator event frequency. )

% ...ij Frenidin Researen Center A Ommen of the Fessen unumae

, . . - _ - . . - = . . _ _ - , - . . , - . . . - -- --

l TER-C5506-409 3.2.2 Evaluation of CE's Probability Data Review of the probability data submitted in Reference 5 indicates two areas which require further discussion. mese assas are:

1. the probability of a PORV to fail to close on demand once it has opened

2. the probability that the operator will fail to bicek the stuck-cpen PORV by manually shutting the block valve.

The probability of a POR7 failing to close on demand once it has opened

~

was determined by CE to be 2 x 10 failures per demand. Se operation history of PORVs at CE plants is that there have been no failures in 38 valve opening 3. At S&W-designed plants, in which the same Dresser electromatic solenoid pilot-operated valves are used, there have been three failures during power operations in 150 openings. Since the B&W information provided a larger data base, CE chose to use the S&W infor: nation to derive the 2 x 10 ~

failure rate. In determining the failure probability of a specific valve design, however, there is no reason why the data from CE and 3&W plants should not be combined. In this case, there have been three failures in 138 openings

~

for a 1.6 x 10 failures per demand rate.

With regard to the probability that the operator will terminate a poten-

, tial LCCA by shutting the block valvs, CE assigned an error rate of 0.155 per event, based upon W3SH-1400 data. Additional information on the probability l that an operator will take a certain action under emergency conditions can be found in the Handbook of Human Reliability Analysis With Baphasis on Nuclear Power Plant Applications, NUREG-CR/1278 (13] . An independent calculation of the expected operator error rate using the techniques of NUREG-CR/1278 yields a rate of 1.5 x 10-2 per demand, which is considerably below the error rate aw W a. .

3.2.3 Evaluation of CE's Conclusions on PORV Reliability In Reference 5, CE provided the following conclusions:

"2e C-E operating plants after approximately 29 reactor-years of operation h, ave experienced no PORV failures during power operation. De

_nkun Rese_ arch._ _ Center

TER-C5506-40 9 elimination of the turbine runback feature and the provision of a direct reliable means for indicating POW position to the operator provided significant. improvements._in_syster reliability. The recurrence frequency of a small break LOCA due to POW failure has been reduced by an estimated factor of about 15 to a value of about 1.8 x 10~3 per reactor-year. This recurrence frequency is well within the 90%

confidence range of the recurrence frequencies of 10-2 to 10~4 per reactor-year for a LOCA due to a small pipe rupture estimated in WASH-1400. Improved operater training programs and emergency procedures, as well as the provision of emergency power to the POWS and to their block valves, though not quantified, has reduced the small break LOCA recurrence frequency even further. The incorporation of the feature of automatic block valve closure upon PORV failure would further increase POW system reliability."

Figure 1 shows the calculation of CE's recurrence frequency of 1.8 x

~

10 per reactor-year for a small-break LCCA due to a stuck-open POW (turbine runcacx feature eliminated) . Figure 2 shows One same calculation

~

with the following exceptions: (1) a PORV failure of 1.6 x 10 has been uced (combines CE data and B&W data) , (2) an operator error rate of 1.5 x

-2 10 has been used (from NUREG-CR/1278) , and (3) accounts for the possi-bility that a PORV which spuriously opens will not reseat (i.e., failure probability of 1.0) . Thir calculation yields a recurrence frequency of 2.2 x 10 per year, which is below both the CE' determination and tne WASH-1400 median probability of 1 x 10 -3 per year.

With regard to installation of an automatically operated block valve fonture, CE's analysis indicates that this feature would reduce the frequency of a LOCA from a stuck-open PORV to 1.4 x 10 events per year, wnile an automatic closure feature employing series-redundant block valves would reduce

':ho frequency even further to 1.7 x 10 events per year.

The recurrence frequency of a small-break LOCA from a stuck-open POW, how;ver, is already well within the 90% confidence range of 10 ~2 to 10 '

~

~

iJiv:n in WASE-1400 (conservatively,1.8 x 10 and probably more realis-tically 1.4 x 10 ).

3.2.4 Evaluation of Primarv safety valves Section 14.5 (Loss of Load Event) of the FSAR for one CE-designed plant

- (Calvert Cliffs plant) discusses the situation in which a turbine trip f% . N Franklin Research Center A Queenen of The hessen innamme

.a 4 ,, _ _JE a _.. . _ _ _ _.

S 9 9 Oli s q TER-C5506-409 r

J)!I a i 5:, jiEN l!!ah li .l I

's.

s Ik

! , . s j

~ 'Is ~ j ij=i

=

,llsl m N x

" i !! u

'?

_ i e o 11, u 5

~ II I

,iv 5

_ o ggs '.? . -

3 Ji.g{"=lj!=?a i -:

is ; III=r

=

![ G -)"

3 ljs i i 3- ~

2

~

5}id{ l i gj O l. ih i -

1  : -

F

[l Q lg5 3 i

3 -. i. 5

=

l 1, ~

g i

s .

'?

I!i = .

3

- s .

s k Id 7\ i its s

l!bL9'kl,% 6

s 11 ,s -

s i

T lI N 5 l

i.,

. ,i i

s s~

~

j!!

, 's y

. N l- -

r i l

iliu-E

~

l*,

,1,. s.

s. I!! C~  ?

..a s

_  !! ~! ill!  ;

1; -

s i ~

! - ,!  : - 5 y, Ist ,

?- II.

)in: -

_ y si ^=

,?

i

- l Ji! ~?

lli 5 Mwin ~~.--

a re.s cem.,

.2

!IIsl TER-0550 6-409 I I

~

lI.

I!!

C " 'I

.s. ( : 4. {

t  ? 1 is8g a  : l-I

-a g ~-

lIIs lI i ~

If 5

'I

'8 lI5 F

? ,~1!!! u -

i

~

t

• lIls f 3 i

I c- - . , a, I!! (_-

- ~

'3!~ j' i ~

a

-  !. : C._. .-

s j 1

geIE "

i. _!!!U ll1 q,!!  : -

y

= -] it l

l

,9 ,

lig  :

a i II' . I ti c _

i

_J j,i C" r .

II E p88e a

,e p~

Ils  ? w 9 .ii

r. . ,

i.l -i; -

8

" E58 j,  !!I:  ?

_l5.g I.c ' U

!!!, O  ! 8 i

gg 8 A: i g: - - m s

9

. -3 ,

ligh

!ai a H _:ill

.. t i

's. -

a , e

?

=

It a;

' 5w i - If I- 0 l jjg u- I I ,i. !'.s!

F._] lgg'i .

. _ in i =

li!! Li !i

--j!u.

gI l il:

pI i i i eg;s-i-  !

,[ y jjs II: D. r'--"L. I ' I llii.

I 3li d

- ' jil ,s. li5 I*

4Is I8

_n_

l

$4 JUdd a oi Franidin

.# w r Resear.c.h Center

(

- TER-C5506-409 occurs (complete loss of load) and no credit is taken either for the reactor

~'

trip which occurs coincident with the turbine trip or fcr POR7 opening. The analysis of Section 14.5 shows that in this scenario, primary system pressure peaks at approximately 2540 psia (Figure 14.5-4 of the FSAR). Since the primary safety valves are set at 2530 and 2565 psia, at least one of the safety valves will be challenged. These data indicate that there is a substantial likelihood that any initiator event which challenges the FORV will challenge a safety valve, if neither PORV opens.

In Reference 4., CE states that the Palisades plant has operated with both PORV block valves shut since 1972. In addition, the ANO-2 plant does not have FORVs installed. Consequently, for these two plants, t.2ere is a quite high likelihood that an SRV will be challenged in an overpressure condition. With regard to the remaining CE-designed plants, CZ stated that licensees have operated from time to time with one or both PORV block valves shut due to PORV leaksge. Making the conservative assumption that POR7 leakage is sufficient to cause the block valve to be shut 50% of the time, there is a 251 proba-bility that both block valves will be shut at any given time at these units (0.5 x 0.5) . Therefore, it appears that an evaluation of SRV challenges should be performed for two cases one where there is no contribution whatscover from the PORVs (Palisades and ANO-2) and the other where the PORV block valves are shut 25% of the time (the remaining CZ units).

With regard to probable SRV failures, CE stated that because of the lack of challenges to the SRVs, a direct quantitative estimate of their reliability based on experience could not be made. CE further stated that, assuming main steam safety valve (MSSV) data are to some degree applicable to primary safety valves, a failure rate of 1.24 x 10' could be estimated. This rate was based on seven reported MSSV failures in 5650 estimated demands.

There are sufficient similarities between the SRVs and the MSSVs to justify using MSSV failure data to determine the SRV failure Pate. However, because of the nature and design of a nuclear plant, the MSSvs are exercised more, frequently than are the SRVs; also, the MSSVs relieve a high quality steam, while the SRV may occasionally serve as a water relief. In view of these two considerations, a conservative approach would entail the use of a A

b Fra=nidin Ao e n. e Resear.ch Center

TER-C5506-409 .

romewhat higher failure rate for the SRV. For the purpose of this analysis, cho SRVs have been assumed to fail at a rate 10' time larger than that*of MSSys (1.24 x 10" 'per demand). This failure rate is slightly lower than the PORY

~

failure rate (1.6 x 10 ), which is consistent with the fact that the PORV 10 a more complicated valve with more possible failure mechanism.

Incorporating the above data into the event trees of Figures 3 and 4, the

! probability of a small' break LOCA from a stuck-open SRV is estimated as follows:

i f All Plants Except Palisades q and ANO-2 (Figure 3) 8.6 x 10 per reactor-year Palisades and ANO-3 3.4 x 10-3 per reactor-year The parameters used in these event trees are as follows:

Node Value Reference / Rationale Trcusient Initiator Event 0.276 per year Section 3.2.1 of this report PORVs Not Blocked Yes: 0.75 Section 3.2.4 of this report (Figure 3) No: 0.25 PORY Opens on Demand Yes: 0.9999 4 Reference 8 No: 1.0 x 10 JORVs Not Blocked Yes: O Section 3.2.4 of this report (Figure 4) No: 1.0

~

POIU Recloses on Demand No: 1.6 x 10 Section 3.2.2 of this report PORV Blocked Closed After No: 1.53 x 10-2 Section 3.2.2 of this report PORV Failure SRV Opens on Demand No PORV Opening Yes: 1.0 Conservative assumption l

With.PORV Opening Yes: 1 x 10~3 If a PORV opens, no SRV set-point will be reached. A probability of 1 x 10-3 is assigned to conservatively account for a possible premature opening under elevated RPS pressure conditions.

~

SR7 Recloses on Demand No 1.24 x 10 Section 3.2.4 of this report Regarding the results of Figurt 3 and 4, the following observations thould be made:

Dh JUh .%nidin Research Center A Qasman af The mannan muunne

P

• TRANSIENT POftV POftV INITIATOR DLOCK SitV sitV fECUhHENCE BLOCKED OPENS RECLOSES OPENS CLOSED f1ECLOSES OUTCOME Ff1EQUENCY til fi- '

1 x 10-3 NOLOCA ah

' j.m 1.24 x 10*3 3 SRVLOCA 2.5 x 10

2 0.984 0.s --

Q NOLOCA a

it 0.9990 *I 1.24 x 10-3 SRVLOCA 4.0 x 10

O.9847 i 1.6 x 10-a NOLOCA g 0.75 1.53 x 10-3 i

PORVLOCA 5.1 x 10

i NOLOCA j

1 x 10.. 1.24 x 10~3

.: 0.276 por yr __- SRVLOCA 2.6 x 10-3 0

NOLOCA i

I g,o NOLOCA 0.25 1.24 x 10'3 N SRVLOCA 8.6 x 10'i O

NOLOCA os

. 1.

O l

• I Figure 3.

Small-Break LOCA from Stuck-Open SIN (All CE Plants Except Palisadc- aPd ANO 7'

( ..

. vilk PORV

• IRANSIEN T noy PORV PURV SRV SRV ftCCURRElJL.:

DLOCK

INITIAlOR BLOCKED OPENS RECLOSES OPEIIS RECLOSES OUTCOME FfEQUENCY CLOSED k

p .

SE NOLOCA E5' -

SRVLOCA g.h g

o NO LOCA 2 R 4 4

NO1OCA SRVLOCA NO LOCA l.

b sn 0

i i PORVLOCA

1. 10LOCA 0.276 per yr SRMOCA ilOLOCA e

1.0 NOLOCA e3

' 1.0 I.24 x 10'^ l's SRVLOCA 3.4 x 10 f sn 0 $

NO LOCA

• 1.

O so Figure 4. Small-Dreak LOCA from Stuck-Open SilV

! (Palisatles and ANO-2)

J l

r l

[

i I

!o . .

1 i

TER-C550 6-40 9

1. The results must be considered extremely conservative because:

a. No credit has been taken for the effect of the reactor trip which will occur before the SRV setpoint is reached. __

b. The SRV failure rate was conservatively set as 10 times the calculated MSSV failure rate.

c. The assumption that PORV leakage causes its block valve to be shut 50% of the time is a conservative assumption.

2. The calculations of Figures 3 and 4 yield a small-break LOCA probability on a per-valve basis. CE plants have two to three SRVs per unit (some set at identical setpoints and others set at different setpoints) . Nevertheless, in view of the fact that no credit has been taken from the pressure reduction associated with the reactor trip which would preceed the SRV opening, it is logical to assume that the first SRV to open would terminate the pressure increase and that only one SRV per initiator event opens. For the same reason, multiple SRV cycles per initiator event need not be considered.

3 .' The small-break LOCA from a stuck-open SRV probabilities of Figures 3 and 4 remain well within the 10-2 to 10-4 range of RSH-1400 for small-break LOCAs. Even in the extremely unlikely case of two SRVs opening in the same event, the probacility of a small-break LOCA remains within the iASH-1400 range for all CE units.

4. Figure 3 shows a small-break LO:'A probability from a stuck-open PORY to be 5.1 x 10-5 This 'value differs from that of Figure 2 because Figure 2 accounts for two PORVs. opening simultaneously and also because Figure 2 does not consider the block valves to be shut 25% of the time. By doubling the Figure 3 value and dividing by 0.75 (percentage of time the block valves are open) , the valve of Figure 2 is obtained (1.4 x 104).

In addition to the above analysis performed by the authors of this TER, Reference 7 presented another analysis of the pecbacility of a small-break LOCA from a stuck-open SRV, performed by one licensee of a CE-designed plant.

This analysis determined the recurrence frequency of a small-break LOCA from a stuck-open SRV to be 1.1 x 10 per reactor-year, with the predominant failure path being through inadvertent opening of the SRV. Using data from a

~

recently completed IREP report, values of 2 x 10 per event and 3 x 10 ~

per demand ware used for the probabilities of premature opening per valve and failure to close once open, respectively. This recurrence frequency is A -2s-du Franklin Research Center .

A Chuman of *he Premen wisease

Je . .

TER-C550 6-40 9 e

comparable to the value of Figure 3, which is the figure applicable to the lictnsee submitting Reference 7, although Figure 3 is somewhat higher due to its conservative approach.

In summary, it is concluded that the small-break LOCA frequency range of WASE-1400 satisfactorily bounds the probcbility of a stuck < pen SRV for all CE-designed units.'

(

3.3 ADDITIONAL CONSIDERATIONS RELEVANT TO SMALL-BREAK LOCA FROM STII:K-OPEN PORV OR SAFETY VALVE Although not addressed in the CE submittals, three other items should be considered relative to small-break LOCA from a stuck-open PORV or safety

-velvo. These items are (1) events which require the operator to open the PORV, (2) overcooling events which challenge the PORV or safety valves tnrough operation of the safety injection systems, and (3) low-temperature, over-

.prpccure events. These items are discussed in the following subsections.

3.3.1. Events Which Recuire the Ooerator Action to Coen the PORV i

Certain situations make administrative use of the PORV to depressurize

.:ho reactor coolant system. The more significant cases are:

1. use of the PORV in the plant recovery from a steam generater tube rupture event

2. use of the PORVs in " feed and bleed" operations in response to inadeqate core cooling (ICC) scenarios

3. use of the POW to vent the reactor coolant system to remove air or non-condensable gases.

In any situation in which the operator wishes to. depressurize the reacter coolant system, the operator can use the PORV to accomplish reactor coolant syntes depressurization. By cycling the PORV open and shut, the operator is Jcn: rally. able to control the reactor coolant system pressure. It is also asted that relatively rapid repetitive cycling of the PORV has the potential to increase the failure rate of the PORV to close when demanded.

%  ; . MU Franidin Ao==en em reme.n. Research C. enter

t i

TER-C550 6-40 9 f-i i

Although not specifically addressed by CE in Reference 5, it is concluded that this problem is not a significant contributor to the expected frequency of a small-break LOCA from a stuck-open PORV. De main reason for. this conclusion is that in any situation in which the operator is manually cycling the PORV open and shut, the operator would be particularly aware of the position of the PORV and the increase or decrease of primary system pressure.

If the PORV should fail to close on demand (as indicated by decreasing pressure) , the operator would immediately shut the PORV block valve, ter:sinating the small-break LOCA. Se limiting component of this scenario will most likely be the motor-operated block valve. The failure rate of a motor-operated valve to operate on demand from NUREG/CR-1363 (14), "cata Summaries of Licensee Event Reports of Valves at Commercial Nuclear Power

~

Plants," is 4 x 10 per demand. Therefore, even assuming that the failure rate of the PORV is conservatively estimated at 1.5 x 10 ~

per demand and that the frequency of these events is 0.1 per reactor-year (10 times the l

recorded frequency of a steam generator tube rupture), the contribution of l

these administrative 1y required operator-induced PORV cyclings and subsequent failures is only 6.0 x 10 per reactor-year, which is not a significant contributor to the overall expectied frequency of a small-break LCCA from a stuck-open PORV.

3.3.2 overcooling Events l

The contribution of overcooling events to the total expected frequency of a small-break LOCA from stuck-open PORV or safety valve is discussed and l quantitatively evaluated in Appendix A of this report. The generic plant evaluated in Appendix A is ' assumed to have a high-head safety injection system capable of developing sufficient pressure in the reactor coolant system to challenge (demand open) the PORV(s) and/or safety valves. A generic plant of this design with a.high-head safety injection would therefore be the limiting l or bounding case to be evaluated for its contribution to the expected frequency of a small-break LOCA from all sources. From the calculations shown '

in Appendix A, it can be concluded that overcooling events which initiate the A db Franidin Researen Center A Quem af The human humane

, - - , , . . , . , _ . . - . - .._,. --_. - , _ . _ _ . . - - . , , , , . . . ~ - - , . . , - . . . - . - . _ . - . - . . . . . . _ . . . .

TER-C5506-40 9 cafety injection system are not a significant contributor to the expected frcquency of a small-break LOCA from a stuck-open POW or safety valve.

3.3.3 Consideration of Iow-Temperature, Overpressure Events In August 1976, the matter of low-temperature, overpressure protection l

1 was raised, and licensees initiated procedures and proposed systems to mitigate postulated overpressure events while at reduced temperatures. The main concern was with the low-temperature modes of cooldown and heatup, during which overpres'surization could cause brittle fracture of the reactor vessel.

In most cases, licensees proposed a manually enabled low-pressure setpoint on tho ' existing POWS, supplemented by procedures and technical specifications, as the means of presenting overpressurization while at low temperatures.

With the reduced pressure setpoint in effect, transients or plant l conditions normally associated with the shutdown, cooldown plant can cause POW actuation (and hence possible small-break LOCA) , such as inadvertent

. operation of the pressurizer heaters or excessive charging. Although not addressed by CE in Reference 5, it is considered that the low-temperature, i

averpressure situation need not be considered with the other transients whien can result in a small-break LOCA from a stuck-open POW. The reasons for this conclusion ares o When reduced pressure setpoints are in effect, the plant will i generally be in a long-term cooling mode using the RER system. RER l can maintain system water inventory in spite of an open POW.

1 o When reduced pressure setpoints are in effect, the operator has less equipment running and can readily diagnose abnormal conditions. The operator is in a less stressful condition and can be expected to react in a positive manner.

o When reduced pressure setpoints are in effect, the plant has been shut down for some period of time, and therefore decay heat rates are lower, providing more reaction time before thermal limits are approached.

l o The temperature of the coolant released from the POW under these conditions will normally be such that flashing to steam will not occur. The water will merely be collected in the containment s' ump.

4, a Franklin Research Center -

A Ommen of the Frusuen simumme I

i _ _ _ _ , _ . _ _ _ _ _ _ _ _ _ _ . _- . . -. - ----- - - - - - - - - - - - - - - - - ~

.TER-C550 6-40 9.

4. APPLICABILITY 4.1 APPLICABILITY OF THE CE REPORF TO SPECIFIC CE-DESIGNED PLANTS 4.1.1 Initiator Event Frequencies As discussed in Section 3.2.1 of this report, CE determined a POW initiator event frequency of 0.276 per reactor-year based upon a total of eight POW opening events in the 29 years of CE plant operation. The eight opening events were distributed among the plant as follows:

Calvert Cliffs Unit 1 2 Fort Calhoun 1 Palisades

• 4 St. Lucie Unit 1 1 I

With an average lifetime of the CE-designed plants of 4 to 5 reactor-years, it is apparent that each CE plant has a plant-specific initiator event frequency equal to or less than 0.276 per reactor-year, with the exception of Calvert Cliffs Unit 1 and the Palisades plant. Imile it is not statistically valid to draw inferences from such a small data base, it can nevertheless be stated that it appears that Calvert Cliffs Unit i exceeds the average event I

eate by apptoximately a factor of 2, while the Palisades plant exceeds the i average rate by approximately a factor of 4.

I Even if a specific plant had an initiator event frequency four times the average rate, the probability of a small-break LOCA from a stuck-open POW (as calculated by CE) would be increased by a factor of 4 to 7.2 x 10" per

~

reactor-year, which remains within the WASE-1400 range of 1 x 10 to 1 x 10 per reactor-year for.a small-break LOCA. Furthermore, increasing the i

initiator frequency by a factor of 4 in the revised calculation of Figure 2, a more realistic result of 6.3 x 10 -4 per reactor-year is obtained, which is below the imSE-1400 median frequency of 1 x 10 ~3 per reactor-year.

• The Palisades plant reports it has operated with POW block valves shut since 1972.

i I

I Ag AS 4Franidin a== e n r Research C. enter

, , . .- -- - - . - -  ? A-^ - - - - ----A -- - -- - - - - - - * * * ~ ' ~ ~ ~ ~ ~ ~ ' *~~ ' ~ ' ' " ~ ~ ' ' ' ' ' " ~ ~ ~

L TER-C5506-40 9 4 .1.2 PORV Failure Rates All CE-designed plants, except for Arkansas Nuclear One Unit 2, (ANO Unit-" ~

2), which does not have PORVs installed, are equipped with Dresser electro-matic solenoid pilot-operated PORVs. For this reason, CE chose to use failure data from B&W-designed plants which have the samEr type of valve installed with a more substantial data base (150 B&W operational openings versus 38 CE valve cpenings*) . Since all CE plants have the Dresser valve, except ANO Unit 2, these failure data are applicable to all CE-designed plaats except ANO Unit 2, 4 .1.3 SRV Data As discussed in Section 3.2.4, estimates of small-break LOCAs from etuck-open SRVs were made by extrapolating information from MSSV failure data and by considering two different conditions (one where the PORV block valves -

cre normally open and the other where the block valves are always shut or PORVs are otherwise not available) . By determining small-break LOCA probabilities for these two different conditions, LOCA probabilities applicable to each of the CE-designed plants have been provided.

4.2

SUMMARY

In view of the foregoing information, portions of this report related to .

I PORV reliability are applicable to all CE-designed units except ANO Unit 2, which does not have PORVs, and the SRV portions of the report are applicable to all CE-designed units.

i l ,

"No te: The reason there have been 38 openings in CE units while the initiator event frequency considers only 8 operational openings is that a substantial number of POW openings were attributed to the turbine.-

runback feature which has been eliminated in order to improve PORV reliability. When the openings due to the turbine-runback feature are eliminated from the data base, the number of operational openings is reduced to 8.

4 'J'J' J U Franklin Research Center A OMESR SI The Fransen sumans

t O TER-C5506-409

5. CONCLUSICNS The conclusicas resulting from evaluation of the CE report against the review criteria of Section 2 are as follows: -

o CE's approach to developing an initiator event frequency is considered to be technically valid. An initiator event frequency of 0.276 events per year which challenge the PORV is considered valid, when the turbine runback feature is removed.

o By combining CE and B&W PORV failure data, a failure rate of 1.6 x 10-2 failures per demand can be used rather than the 2.0 x 10-2 failures per demand rate from the B&W data alone. .

o The Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Applications (NUREG-CP/1278) yields an expected operator I error rate of 1.5 x 10-2 errors per event, which is less than the 0.155 errors per event rate used by CE.

o CE calculated the recurrence frequency of a small-break LOCA frca a stuck-open PORV to be 1.8 x 10-3 events per year, which is well within the 2s3-1400 frequency of a small-break LOCA of 10-2 to 10-4 events per year. A revised calculation of this frequency in this report shows a more realistic frequency to be 2.2 ~x 10-4 events per year, which is below tr.a E SH-1400 median probability of 1 x 10 -3 a

o The probability of a small-break LOCA from a stuck-open safety relief valve is 8.6 x 10-4 per reactor-year for all CE plants except i Palisades and ANO-2 and 3.4 x 10-3 per reactor-year for Palisades and ANO-2. These frequencies are both within the 10-2 to 10-4 per reactor-year range of RSH-1400.

o Additional events which can challenge the PORV or safety valves, such as operator cycling of the PORV and overcooling events and low-temperature, overpressure event, have been considered and do not significantly influence the frequency of possible small-break LOCAs.

o CE's report sufficiently addressed actions taken to reduce the frequency of a small-break LOCA from a stuck-open PORV.

,1 -

o The CE report is applicable to all CE-designed plants except for the estimate of PORV reliability which is not applicable to ANO Unit 2 which does not have PORVs.

l I

nkiin Resear

-_ch_ Center .

m e

. TER-C5506-40 9

6. REFEFENCES

1. " Clarification of TMI Action Plan Requirements"

- NIC Office of Nuclear Reactor Regulation, November 1980 NUREG-0737

2. "Genocid Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in CE Designed Operating Plants" NRC Office of Nuclear Reactor Regulation, January 1980 NUREG-0635

3. "NRC Action Plan Developed as a Result of the TMI-2 Accident" NRC Office of the Executive Director for Operations, May 1580 NUREG-0660

4. Typical Letter Endorsing CEN-145 A. E. Lundvall (BG&E)

Letter to D. G. Eisenhut (NIC)

Subject:

Calvert Cliffs Nuclear Power Plant Units 1 and 2 Response to NUREG-0737 February 20, 1981

5. "PORV Failure Reduction Methods" CE, Inc. , Windsor, Connecticut, December 1980 3 -145

6. R. A. Clark (NRC)

Letter to A. E. Lundvall (BG&E)

Subject:

Request for Additional Information in Regard to NUREG-0737 Action Item II.K.3.2 for the Calvert Clif fs Nuclear Power Plant Units Nos. I and 2 January 20, 1982

7. A. E. Lundvall (BG&E)

Letter D. G. Eisenhut (NRC)

Subject:

Calvert Cliffs Nuclear Power Plant Units 1 and 2 Response to NUREG-0737 Items II.K.3.2 and II.K.3.17 April 26,1982

8. A. E. Lundvall (BG&E)

Letter R. A. Clark (NIC)

Subject:

Calvert Cliffs Nuclear Power Plant Units 1 and 2 Response to NUREG-0737 Items II.K,3.2 and II.K.3.17 June 7, 19 82

9. J. N. Donohew, Jr. (NRC)

Letter to S. P. Carfagno (FRC)

Subject:

Contract No. NRC-03-81-130, Tentative Work Assignment F l July 21,1981 h .m FrankHn Research Center A Ommmen elThe Feesuen huone

TER-C5506-40 9

10. " Reactor Safety Study, An Assessment of Accident Risks in U. S.

Comercial Nuclear Power Plants" United Stated Nuclear Regulatory Commission, October 1975 1&SH-14 00 (NUREG-75/014)

11. " Post-StI Evaluation Task 3 Follow-up Report, Pressurizer Systems and Emergency Power Supplies" CE, Inc., November 1980

12. "ATWS: A Reappraisal, Part III, Frequency of Anticipated Transients" Electric Power Research Institute, January 1982 NP-2230, Research Project 1233-1 13 . " Handbook of Human Reliability Analysis With Cuphasis on Nuclear Power Plant Applications" NBC Office of Nuclear Regulatory Research, October 1980 NUREG/CR-1278

14. " Data Sumaries of Licensee Event Reports on Valves at Commercial Nuclear Power Plants" NBC Office of Nuclear Regulatory Research, June 1980 NUREG/CR-1363 J

& J'J dd Franidin Research Cemer h of The Fw wumma, I

I i

APPENDIX A i

'D a.l. .

FrankJin Research Center A Division of Tne Franklin institute The Benperrun FrannAn Parmwey PMa Pa.19I03 (2:Sn 4481000

TER-C550 6-40 9 B I APPENDIX A EVALUATION OF THE CONTRIBUTION FRCM OVERCOOLING EVENTS TO THE TOTAL PROBABILITY OF A SMALL-BREAK LOSS-OF-COOLANT ACCIDENT FROM A STC0K-OPEN POWER OPERATED RELIEF VALVE OR SAFETY VALVE Purcose To review the available literature and operational historical data to Eccercain whether or not Comcustion Engineering and Westinghouse-designed nuclear steam supply system plants need to consider the contribution from s

ovc: cooling events to the total probability of a small-break LCCA from a et'ack-open POR7 or safety valve.

Backaround Overcooling events can cause a rapid depressurization of the prima.y system and subsequent initiation of the nigh pressure safety injection system.

To plant operators, a rapid depressurization appears to be very similar to a

, Emall-break LOCA. As a consequence of t.ge TMI-2 accident, operator guidelines l

l wtre instituted w require the PORV blocking valve (s) to be shut, thus

, tsrminating a depressuri=ation, if it was caused by a stuck-open PORV.

Ragardless of the cause of the depressurization, operator action is required to terminate high pressure safety injection upon sunsequent repressuri:ation to prevent cha11anges to safety valves (or PORV if unblocked) . The following l in a technical evaluation of whether such events can significantly contribute l to the number of challenges experienced by the PORV and/or safety valve.

l l Eveluation Secondary side overcooling transients usually occur because of overfeeding of a steam generator, demanding too much steam from the steam generators, or introducing excessive amounts of relatively cold auxiliary feedwater into the

etcan generators. NUREG-0667 (1], " Transient Response of Babcock & Wilcox-Dtcigned Reactors," describes the sensitivity of the once-through steam gennrator (OSTG) in B&W designs to suen overcooling transients. Specifically, it was concluded that

'

l l A-1 25 ac Franklin

.tn.r Research C. enter

- e TER-C5506-409 t

"Because the heat removed is proportional to the transfer area, the amount of heat removed by an CTSG is essentially directly proportional to I

the height of liquid on the secondary side. As such, any change in secondary coolant-level-directly-affects the amount of heat capable of being removed. This, coupled with -the relatively smaller secondary side liquid inventory, results in a fairly rapid primary system response to secondary coolant system perturbations."

4 Reference 1 also describes the sensitivity of a U-tube steam generator, such as the kind presently used in Westinghouse and Ccmoustion Engineering plants. It was concluded that:

"Since the heat removal rate is proportional to the product of the heat transfer coefficient, heat transfer area, and temperature difference, and because the product of the heat transfer area and heat transfer coefficient is usuali, hign, only small changes in primary to secondary temperature difference are needed to accommodate rather large changes in heat removal rate. Because of this and because the volu=e of water on the secondary side surrounding the U-tubes is large, perturbations on the secondary side of the inverted U-tube steam generator, such as feedwater from changes or system pressure changes, do not readily affect the behavior of the primary coolant system."

Based upon both of these descriptions, it can be concluded that Babcock &

Wilcox designed reactors are more susceptible to depressurizations caused by ,

overcooling transients than reactors designed by Westinghouse or combustion Engineering. This conclusion is supported by historical cperational' data. A Babcock & Wilcox generic report (2], " Report on Power-Operated Relief Valve Opening Probability and Justification for Present System and Setpoints,"

states that 8 overcooling transients have initiated high pressure safety injection system flow in 392 reactor trips, and that the current frequency of reactor trips is six trips per reactor-year per plant. Thus, for Babcock &

Wilcox-designed reactors, the frequenc= cc rierecoling events with subsequent high pressure safety injection sys.*< Aow aquals 0.122 events per reactor-year. For plants designec .sta.. .g Westinghouse or Combustion Engineering, very little pre-mI information is readily available concerning plant response to events that overcooled the primary system in excess of the normal cooling expected following a reactor trip. Reference 1 states, "Since TMI-2, three events that depressurized the primary system C.o the HPI actuation setpoint have occurred in plants with reactors designed by Westinghouse and Combustion Engineering." Two of these events involved stuck-open turbine

'< A-2 O

b) Franklin a c nor wResea'.ch . C. enter

. - - . - . . - . . - - , - - , . , , , _ , , . - . . - , . . , , , - , _ , - - , , -_-._- - - - ,~ . - - , - - .

TER-C5506-409 byptsi valves, and one was the result of a steam generator tube rupture.

Since the steam generator tube rupture is a separate initiating event, it can b3 cxcluded from this study. During the 2 years between the TMI-2 accident and the completion of Reference 1, 41.7 reactor cperating years were recorded by Westinghouse and Combustion Engineering plants. Therefore, the frequency of evercooling events with subsequent high pressure safety injection system

~

^

. flow equals 4.8 x 10 events per reactor-year for Westinghouse and .

Combustion Engineering plants.

To quantify the probability that an overcooling event will lead to a caall-break I4X:A from a stuck-open PORV cr safety valve, an event tree was ernStructed. This event tree is shown in Figure A-1. The following parcgraphs describe the branch nodes which are used in the construction of tne cvcnt tree. Paths branching upward at these nodes represent a "yes" response i

to the question, wnile those paths branching downward represent a "no" response. When quantifying the event tree, the probabilities shown in Table A-1 the probabilities represent the probability that the answer to the qu":stion is yes or no, rather than the availability and unavailability of a system. ,

Ned7 A Operator stops EPI prior Upward paths at this node indicate that the to PORV setpoint pressure operator has throttled or secured the high pressure safety injection system prior to the reactor coolant system pressure reaching the POKV opening setpoint pressure. The recommended PORV opening setpoint pressure is 2350 psia on Westinghouse-designed plants.

Downward paths at this node indicate that the operator has failed to throttle or secure the high pressure safety injection prior to the reactor coolant system pressure reacning the PORV opening setpcint pressure.

Nod 7 B PORV' block valve (s) open Upward paths at this node indicate that at least one PORV block valve is open when the challenge to the POR7 occurs. This applies both to the case A-3 l Rese a.r.ch. Center dhd 4o Fre,nidin,w

, . . , . , . . , . . _ , ~ . - . . ~ , . . . . . . , . . - _ .

TER-C5506-40 9 O

C,0 3 O O O O

C c: > c > > > O O O e c: > 5 C > >

ou - z e a e s e s - c m E E 5

- m 5 ese

$ k t2 ,

2 3 O f 1

f a

1:$s l w.

E

• , 3 ; CB 25'8 2 325%4 I i

a*

C-f W G 5 a

. 3A '

te ~ >

- l >

te 32s"!

5=-- c 35Ih-5 .

3 :s, -- 'E c

w a w

5 3 0 .

a if r

. c a

. 'J g

c E e sa or B

i a o u

I k- o

= Z Q O Z 1!" t y

Z  :

st !

EEE a C' -> w i O

3do W

m m -

o w O Z < c<,0 m w Q aw6 .J s

! > OC W D si EE

, c O EC>9R Mdtw I c ca<

w e

O w L Z Q >c.> W>.J

> - ggw>W<w[>C< 1>

~

- >cw>m JO4 e i 2 O w c. m O h;

C l lN -

26 w 5 ?.000 .?, c>.

~ nklin

~-.en.-.

Resear Cent er

TER-C5506-40 9 Nodn.B (Cont.)

• i where the PORV block valve is manually positioned, and the case of automatic open/ closure systems j where the block valve may be automatically moved.

Downward paths at this node represent those events where all the PORV block valves are closed wnen the PORV opening setpoint pressure is reached.

i This node is not considered to be relevant for those events where the PORV cpening setpoint pressure is not reached.

Nod,C -

PORV(s) open Upward paths at this node represent tne PORV(s) opening after the PORV opening setpoint pressure is reached.

Downward paths at this node represent the PORV(s) staying closed after the PORV opening setpoint pressure is reached.

Since this node is relevant only for those events where the POEV opening setpoint pressure is reache'd and the PORV block valves (s) are open, the probability of the PORV staying closed represents the failure of the PORV to cpen on demand. This prooability for the failure of the PORV to open on demand must therefore include such failures as pressure sensors, pressure transmitters,' and control channels, as well as those failures associated directly witn the PORV.

I !bd, D l

l Operator stops HPI after Upward paths at this node indicate that the PORV setpoint before operator has throttled or terminated HPI after sefsty valve setpoint the PORV opening setpoint pressure has been exceeded but before the safety valve opening setpoint pressure is reached. The recommended l opening setpoint for safety valves on Westinghouse-designed plants is 2500 psia.

l Downward paths at this node indicate that the operator has failed to throttle or terminate the HPI before the safety valve opening setpoint pressure was reached.

I A-5 UU$ Franidin Research Center A Opmeen of The Franseninsonne

.>& a E TER-C550 6-409 Node D (Cont.)

~

The probacility at this node must reflect whether the PORV and the PORY block valve are open, since the probability of reaching the safety valve opening setpoint pressure is significantly reduced if the POW and POW block ' valve are open.

(Note: This analysis assumes that the POR7 setpoint is exceeded one time per event, resulting in one PORV opening. Multiple PORV cycles are not considered for the following reasons:

1. The results of this analysis are to be compared to the results of the CE report.

The CE report considers one PORV opening per initiator event.

2. The operator who fails to secure HPI prior to the first PORV opening would be alerted to the need to secure HPI prior to the second opening.

Mode E

. Safety valve (s) open. Upward paths at this. node represent the opening of a safety valve at the safety valve opening setpoint pressure.

Cownward paths at this node represent the safety valve staying closed after the safety valve opening setpoint pressure is reached. -

This node is not considered to be relevant for those events where the safety valve opening

, setpoint pressure is not reached.

l Node F l

Safety valves (s) shut as Upward paths at this node represent the successful pressure decreases af ter reclosing of the safety valves (s) when the reactor l

'HPI is secured coolant system pressure decreases below the safety valve opening pressure 'setpoint after the HPI system is secured.

Downward paths at this node represent the failure of the safety valve (s) to reclose when the reactor coolant system pressure decreases below the safety valve opening pressure setpoint after the HPI system is secured.

l

& A-6 Edd Franklin Research Center 4 ommen.# ne n -en maman l

5 _ , . , . . . _ - , . _ _ , _ . _ - , - - , - , - - - . - - - - - - - -------~ - ~~ ' ~ - - - " - - ' - ~ ~ --~

TER-C550 6-40 9 Intuitively inherent in the probability assigned at this node is the fact that, at some point in .

the overcooling event, the HPI system will be secured allowing the reactor coolant system pressure to decrease below the safety valve opening setpoint pressure.

Nodn G PO W(s) shuts as pressure Upward paths at this node indicate the successful d: creases reclosing of the PORV(s) when the reactor coolant system pressure decreases below the PORV opening pressure setpoint after the HPI system is secured.

Downward paths at this node indicate the failure of the PORV(s) to reclose when the reacter coolant system pressure decreases below the POW e opening pressure setpoint after the HPI system is secured.

As with the probability assigned to Node F, the

! probability assigned to Node G assumes that at soce point in the overcooling event, the HPI i system will be secured allowing the reactor coolant system pressure to decrease below the PORV opening setpoint pressure.

Each endpoint path is categorized by 'a consequence description as defined oslow:

NR - No PORV or safety valve relief occurs RR - Relief occurs but the valve (s) recloses on demand l PVO - PO W(s) opens and fails to reclose L

SVO - Safety valve (s) opens and fails to reclose PVO/SVO - POW (s) and safety valve (s) opens and fails to reclose.

In order to quantify the event tree paths, probability data are needed for each path at each node of the event tree. The probability data represent ch3 answer to the question at that node. The probabilities and the reference l cource for the probability used for each node are given in Table A-1.

l "tte rasults of the various endpoint paths are shown on Taole A-2. The t

apected frequencies of a small-break LOCA from a stuck-open PORV or safety l

..h

• A_7 9J Franklin Research Center 4ommenern.n m

f) O

, TER-C5 50 6-40 9 valve from an overcooling initiated transient event are 6.1 x 10-6 p,,

reactor-year and 6.9 x 10 per reactor year', respectively. From this, it can be concluded that overcooling events are not a significant contributor to the expected frequency of a small-break LOCA from a stuck-open PORV or safety valve for Westinghouse and Combustion Engineering-designed NSSS plants.

a i

,& A-8

$J Frondn Researc.1 Center A Qanuen of The Frereen womano

TER-C550 6-40 9 Table A-1. Probabilities Assigned to Overcooling Event Tree Nodes Probability Node Node Description Assigned Discussion References Initating transient 0.048/

event frequency reactor-year Frequency was determined 1,3 ,4 ,5 from events reported in Reference 1 and total Westinghouse and Combustion Engineering plant operating time from 4/1/78-4/1/80 A Operator stops HPI 0.985 Probability was determined 6 prior to PORV set- from Reference 6 for an point pressure operator with a moderate to high stress level B 90RV block valves (s) 0.45 Probability was based 7 open on a summary of historical operating data for Westinghouse plants as reported in Reference 7 4

C PORV (s) open , 0.99 Conservative engineering 8 judgment coupled with information from Reference 8 for a single channel non-redundant control system l D Operator stops HPI 0.999 or 0.1 Note that two probabili- 8,9 af ter. POW set- ties are assigned to this point before safety node. The first proba-valve setpoint bility, 0.999, is for the case where the PORV (s) and block valve (s) are open, making it highly unlikely that the safety valve opening setpoint pressure would ever be reached. The cecond probability, 0.'1, is for i the case where the PORV (s) or block valve (s) do not or are noe open. Bo th A, a A-9 NJ Franidin Research Center

. amw

. w TER-C550 6-40 9 Table A-1 (Cont.) .

Probability Node Node Description Assigned Discussion References D' probabilities are based Cent. on plant and system characteristics from Reference 9 and general human error rate estimates from Refer-ence 8.

E Safety valve (s) 0.99997 Probability war. based on 8 opens information from Reference 8, Volume V, Page V-38.

F- EPI secured, safety 0.981 Probabilty is based en a 7,8 valve shuts as pres- conservative engineering sure descrease judgment using information from References 7 and 8 (see Section 3.2.6 6f this report for more detailed discussion. )

G PORV (J) shuts as 0.981 '

See discussion of Node F 7,8 pressure decreases above for information.

• he TER-C550 6-40 9 Table A-2. Endpoint Category Description and Frequencies Endpoint Frequency per CAtncorv Description Reactor-Year ER No PORV or safety valve relief occurs 4.7 x 10-2 RR Relief occurs cut tne valve (s) recloses on demand 6.6 x 10-4 PVO PORV(s) opens and fails to reclose 6.1 x 1.04 SVD Safery valve (s) opens and fails to reclose 6.9 x 10-6 ,

?VO/SVO PORV (s) and safety valve (s) open and fail to 1.2 x 10-10 reclose l

l I

l

-h A-ll

. % Frankiin Research Center l A w wn.r. .

. e TER-C550 6-40 9 REFERENCES

1. " Transient Response of Babcock & Wilcox-Designed Reactors" NBC' Office of Nuclear Reactor Regulation, May 1980 NUREG-0667

2. " Report on Power-Operated Relief Valve Opening Probability and Justification for Present System and Setpoints" .

Babcock & Wilcox, Nuclear Power Generation Division, April 1981 Document No. 12-11227792 3.. " Nuclear Power Plant Operating Experience-1978, Annual Report" NRC Office of Management and Program Analysis, December 1979 NUREG-0618

4. " Nuclear Power Plant Operating Experience-1979, Annual Report" NRC Office of Management and Program Analysis, May 1981 NUREG/CR-14 96

5. "Cperating Units Status Report, Data as of 4-30-80" NRC Office of Management and Program Analysis, June 19, 1980 NUREG-0020, volume 4, Number 5, May 1980

6. " Handbook of Human Reliability Analysic With Emphasis on Nuclear Pcwer Plant Applications" NRC Office of Nuclear Regulatory Research, October 1980 NUREG/CR-1278 4

7. "Probabilistic Analysis and Operational Data in Response to NUREG-0737, Itum II.K.3.2 for Westingnouse NSSS Plants" West.iaghouse Electric Corporation, February 1981 WCAP-9804 .

3. " Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants" G.S. Nuclear Ragulatory Connission, October 1975 WASE-1400 (NUREG-75/014)

9. " Generic Evaluation of Feedwater Transient.1 and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants" NRC Office of Nuclear Reactor Regulation, January 1980 NUREG-0 611 i

i

& A-12 3dU4 caFranidin e m r Research

. C. enter

.. . _ _ . _ - . . . . . _ .