ML20125D495

Control Rod Drop Accident (Bwr)

ML20125D495
Person / Time
Issue date:	06/01/1976
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20125D471	List: ML20125D468 ML20125D476 ML20125D479 ML20125D493 ML20125D495
References
REF-GTECI-D-03, REF-GTECI-SY, TASK-D-03, TASK-D-3, TASK-OR NUDOCS 8001140331
Download: ML20125D495 (70)

Text

.

+

t i.

CONTRO$R0DDROFACCIDENT(BWR)

Int'roduction The ACRS list of generic items relating to light-water reactors includes Item IIA-2 " Control Rod Drop Accident (BWRs)". In status report number 4,' dated April 16, 1976, the ACRS provided the following brief description of the scope and intent of this item.

"Some uncertainties have arisen in previous calculations of this postulated accident, including the choict of negative reactivity insertion rate due to scram and the potential differences between a two dimensional and a three dimensional calculation. Particularly for the latter point, more precise theoretical comparisons may be required to resolve the matter although probabilistic considerations may be relevant."

The staff considers this generic item to be resolved, although work will continue on three-dimensional ar.alyses as part of the on-going programs to improve methods of transient analysis. This report summarizes the history and status of the review of this topic.

The discussion of the early phases related to reactivity insertion rates is brief since the documentation related to those reviews is extensive.

The consideration of three-dimensional calculations is discussed in somewhat more detail since it has not been previously documented.

ReactJvity Insertion Initial concern with the suitability of the GE analysis of the rod drop accident (RDA) arose during 1971 as a result of generic studies on transient analyses by our consultant, Brookhaven National Laboratory (BNL). These studies indicated no general problems or disagreement with the GE analyses or results except in the area of 90017021 y

1 8001140 2

(

s i control rod reactivity insertion rates.

These reactivity insertion rates, and especially the scram renetivity, were substantially non-conservative because of the use of control rod scram movement rates faster than specified in the Technical Specifications and the use l

of inappropriate spatial reactivity functions (i.e., reactivity inserted as a function of the fractional insertion of control rods).

The latter in particular,was the subject of extensive BUL studies that examined the validity of reactivity. representations in model geometries where spatial variables of importance were not ex-plicitly described. Since, as will be discussed further in con-r nection with the three-dimensional problen, the GE model is essentially a for of point kinetics (zero dimensional), the suitable representation of reactivity inputs is important.

As a result of the concerns arising from these studies, and in conjunction with some improvements in the GE model, GE reanalyzed the RDA. The reanalyses incorporated the suggested changes in the i

control rod reactivity functions, both rod movements in accord with Technical Specifications and spatial functions determined by methods comparable to BNL's.

The calculations and results were reported in i

1972-73 in NEDO-10527 for beginning of first cycle (BOC) in BWR 2s and 3s, in Supplement 1 for BOC in BWR 4s and 5s, and in Supplement 2 for both types of cores later in the first cycle and in the second cycle.

BNL also did a series of calculations of the rod drop accident using one-and two-dimensional (R, Z) kinetics codes and their own developed version of the GE model. The more significant of these calculations and comparisons were reported on in many BNL reports L

90017022 i

t which received external distributien.

Tnese have all been distributed to the ACRS. Included were the following reports which discuss re-activity functions and methods, and transient analyses and check calculations.

'" Rod and Scram Bank Simulation," BNL RP-1018, August 1971.

" Application of Reactivity Weight Factors to Reactor Transients," BNL RP-1020, March 1972.

" Rod Drop and Scram in Boiling Water Reactors, Part I,"

BNL RP-1021, April 1972.

" Rod Drop and Scram in Boiling Water Reactors, Part II,"

BNL RP-1027, July 1973 "Gadolinia Shimmed BWR Rod Drop at Zero Power," and

" Curtain Shimmed BWR Rod Drop at 10% Power," Progress Report for Reactor Safety Analytical Support, May 1973 "Gadolinia Shimmed BWR Rod Drop at 10% Power," Progress Report, July 1973 The review and check calculations and comparisons of the GE reanalyeis were favorable. GE has switched to a suitable control rod reactivity representation and the comparisons with various BNL

. calculations were satisfactory.

In our topical report review of NEDO-10527 several incomplete aspects of the review were noted, such as the 10% power and gadolinia core check calculations.

These were subsequently completed (see the last three listed BNL reports) with 90017023

4 o

-u-satisfactory comparisons. A final wrai: ap package involving a series of one-dimensional sensitivity calculations to relate the two-dimensional check calculations to a more approcriate range of dropped rod reactivity insertions was planned. This was not completed, however, and it has now been decided to await the co=pletion of future three-dimensional studies (see below) before completing a formal wrap-up.

However, we have concluded that the initial problem has been resolved and that the GE calculations are suitable.

Need for Systems to Minimize RDA Meanwhile, the review of the reanalysis and the recognition that for a given control rod worth a higher fuel energy was predicted lead to an interest in an improved Rod Worth Minimizer (RWM) system to add assurance that a high reactivity worth, non-sequenced rod is not withdrawn to become a candidate for the accident.

In response to this interest GE developed, in mid-1972, the Rod Sequence Control System (RSCS), essentially a hardwired version of the computer-controlled RWM.

This, in particular in its most recent form, the Group Notch RSCS, has 4

been approved and is (or is being) installed in BWR 4s.

This posed the questaan whether to backfit RSCS on BWB-2s and 3s.

To answer this, the staff carried out (in early 1975) an independent analysis of the probabilities, individual and combined, of the multiple events that must occur in order that a rod drop accident exceed the staff acceptance criterion of 280 cal /gm in the hottest fuel pellet.

This analysis was described in a June 1975 memo, "A Statistical Exam-ination of the RDA in Some BWRs," and was presented to the ACRS at the March 23, 1976 Subcommittee meeting on reactor safety in Chicago.

(

' A copy of the memo is provided as Appendix A to this report.

90017024

...,w..

r n

~ _ _ -

s The study determined that a reasonable (and'quite possibly con-servative) estimate of the probability of having an RDA exceeding

-12 280 cal /gm is about 10 per reactor' year, without including any factor for the use of a RWM or RSCS. This indicated a large margin

-7 to an acceptance criterion of.10 per reactor year, and allowed for considerable uncertainty in the input information or unforeseen in-

.teractions among. elements of the analysis.

In addition, all BWR 2 and later reactors do have RSCS and/or RWH systems and Technical Specification requirements for their use. This result was the technical basis for the decision not to require backfit of an RSCS on BWR 2s and 3s.

It also, of course, indicates in general the low probability of encountering a limiting RDA.

A further indication of margins existing in the RDA is the relation of the maximum expected sequenced rod reactivity worth to the rod worth for which the criterion of 280 cal /gm would be

~

exceeded.

Typical maximum sequenced worths are less than 1% Ak.

(See, for example, the Shoreham FSAR where the peak maximum sequenced worth, at cold clean conditions, is about 0.9% Ak and usually much less than that for other conditions). From the results of Supple-ments 1 and 2 of NEDO-10527 we see that rod worths to reach 280 cal /

gm range from somewhat over 1.4 to over 2.1% Ak depending on time in cycle (BOC is lowest) and cycle and assuming scram at Tech Spec velocities (1.6 to 2 3 at measured scram velocities). A 0.9% Ak rod results in only about 150 cal /sm (assuming 1.4% Ak gives 280 cal /gm).

90017025

i j,

i e

9 Importance of Dimensional Order Another possible RDA analysis problem was raised by an article by Birkhofer, Schmidt and.Werner (to be referred to in this memo as BSW) in the October 1976 issue of Nuclear Technology comparing the results of three-dimensional with lower-order analyses. The main theme of this article may best be summarized by the final paragraph which states "The conclusion to be drawn 18 that space-and time-dependent effects in large LWR cores with space-dependent feedback can only be predicted correctiv by performing genuine three-dimensional calculations. All lower dimensional simulations of tne problem may produce non-conservative results." (underlines added)

The authors carried out some comparison calculations to come to this conclusion.

We reviewed this paper and sent requests to each vendor to also review and comment on it.

We subsequently reviewed these comments, in particular those of GE, and evaluated the applicability of the BSW study l

I to vendor analyses.

Also, our consultant discussed the paper with the authors during a European trip. Since it has not been previously reported, a brief discussion follows of the applicability of the study and its conclusions to the LWR vendor's and especially GE's analysis models.

Using their own developed three-dimensional kinetics code (apparently fast running) BSW did parallel XYZ, RZ, XY, and R calculations on what was approximately a small (about 7 ft. diameter by 9 ft. high core) BWR at l

zero power. The calculations of primary interest were of the rapid removal 90017026

~.

1

_7.

(less than.1 second) of an off-center control rod, which was made a center' rod for RZ and R calculations.

Results may be generally characterized by comparisons in two parts.

1.

No Z component, i.e., XYZ vs XY and RZ vs R 2.

Off-center to coater, i.e., XYZ vs RZ and XY vs R Both comparisons show a ratio of about 1.4 between the peak local energies of the higher and lower dimension results.

An important missing element in the study was the failure to consider sufficiently the role of auxiliary calculations when doing lower order calculations.

(Perhaps if they had gone all the way and included a point-kinetics calculation in the study, this shortcoming might have become apparent since eupplemental parameters would have been required.) A prime exan.ple is found in the no-Z component l

l calculations. No axial peaking factor was supplied or considered l

(as any of the vendor calculations would have).

For the geometry of the reactor analyzed, the appropriate peaking factor would have been approximately 1.4, the calculated discrepancy.

An illustration of vendor use of auxiliary results to augment a lower order calculation is the collection of Westinghouse design calculations described in the rod ejection report, WCAP-7588. The calculational model is effectively a zero-order, point-kinetics approach (actually a 1D-Z kinetics) with auxiliary calculations to supply conservative peaking factors and reactivity feedbacks. For example, transient peaking factors are calculated, statically, without reactivity feedback to maximize peaking, and feedback is-90017027 ei

i.

estimated with a full feedback-reduced power distribution to minimize feedback weighting. As expected, comparison with three-j dimensional calculations (described in the WCAP) indicate a high degree of conservatism.

In reference to the previously underlined

" correctly" and "may" in the BSW conclusion this Westinghouse ex-perience is an illustration that while lower order calculations will not directiv give " correct" resulta and if not altered they "may" be non-conservative, suitable modifications can be introduced into the lower order analyses to provide suitably conservative results.

The GE analyses do consider Z component peaking. The GE design method (described in NED0-10527 and Supplement 2) is a point-kinetics model with rod drop and scram reactivity functions from auxiliary three-dimensional, XYZ, calculations and power distribution functions and Doppler feedback weighting factors from concurrent static RZ multigroup calculations.

(Moderator heating, particularly prompt heating from neutrons and prompt gammas, is not included in the model and this can be a significant conservatism.) The RZ power distribution calculation maintains the dropping control rod throughout the transient at one axial position, approximate 3y the position at the time of the first large rise and turn around in power. Since, for the control rod reactivity worths of interest, there is a significant axial movement of the peak throughout the transient (see, for example, the "three"-dimensional power distribution figures in the previously referenced BNL reports, e.g.,

RP-1021), this model produces a

~

conservatively large energy rise in the peak axial fuel pellet.

90017028

--..w--

5 e-%

e c

%-e7._,s w

p, m-t-vT-

)

s, e e it might appear that of perhaps more interest to the GE BWR analysis is the off-center to center comparison.

However,-in this case.it is evident that the BSW ccmparisons were complicated, and.

we believe rendered of doubtful direct value, by the changes in the reactor center local rs geometry which were apparently introduced into the proble he B region in BSW) by the re-quirement to maintain a given,aiue of control rod reactivity worth for the two configurations. These modifications cause changes in power distributions in the vicinity of the dropped rod thus changing peaking factors for obtaining peak enthalpies, Doppler feedback weighting factors, and evidently reactivity insertion rates (see reactivity insertion figures in BSW). Indeed the problem of simul-taneously maintaining several important factors constant in one calculation while shifting basic geometry is a difficult one.

However, in our view a suitable continuation of a BSW type study would have been to complete several more calculations examining consequences of. geometry changes in detail to develop suitable auxiliary multipliers, weighting factors,'etc., to apply to ap-proximate or lower order geometry calculations.

The GE model, which as noted is essentially point-kinetics with several separate auxiliary calculations for reactivity and peaking input, does not encounter these difficulties. The rod and scram reactivity-functions come from full XYZ calculations when I

(

required (see Supplement 2 to NEDO-10527), or from a suitable reduction to RZ when such a configuration is adequate (and in 1

i 90017029 z-v~'

m.-

e w..,

,y.y..,

-. v.

>+

10 nearly all of the cases of interest _the maximum worth sequenced rods

- are central or central-like, i.e.,

not near boundaries and thus in sig-nificant regional flux-neutron importance gradients). The concurrent-power distribution-Doppler weighting calculations are RZ.

However, the local geometry and cross section distribution around the dropping rod are appropriate 1y' preserved. It is this modeling in the region of the rod which is of primary importance in determining feedback reactiv..

y ity and peak energy deposition.

Conclusion l

Our review has indicated that the GE model ic not subject to the particular problems pointed out by and encountered in the BSW l

paper, and we continue to conclude 'that the GE analyses and results l

are suitable even though the model does not consist of a full three-dimensional space-time-feedback kir.etics analysis.

• However, we recognize that such an analytical tool would serve a useful role in confirming this evaluation.

Analyses have been

' l carried out with alternate methods only because the three-dimensional codes have been unavailable or too time consuming to operate.

In particular they have not been available to the staff or its consultant.

As part of the continuing generic review of transient analyses, the staff and BNL have recently acquired the new MIT-EPRI three-dimensional kinetics code, MEKIN, and'are working to get it operational. Depending on its operating characteristics and practicality, it will be used to study problems of the type covered by the BSW paper.

90017030 1

m- - - -.

y

=*.yte

---.s---

,s m,

,3

-w--rpp

-w-

, e er.

g g-p.-

S

+

e

• -,ee w

up w

TN, e,

q..

3 Thus,'with the perspective of the studies, reviews and eva'lu-ations regarding'the original reactivity' insertion-rate problem and the question of dimensional order, and the margins existing both in the probability of an RDA exceeding the 280 cal /gm criterion and between' generally expected: maximum sequenced rod worth and that required to reach 280 cal /gm, it is our conclusion that the uncertain-ties identified by the ACRS generic item about the RDA analysis have

.been resolved.

90017031 f

f L

i i

l l'

9' APPf A: O r X 1:

A Statistical Examination Of The RDA In Some BWRs j

Summary This memo examines the probability arguments and related information analysis involved in decisions on requirements for additional elements (hardwarc or Tech Specs) to reduce the likelihood of having a BWR rod The memo drop accident which might exceed the 280 cal /gm criteria.

presents the purpose for this examination, the statistical approach to be (a rod drop exceeding 280 used, and develops a criterion f or judgement cal /gm should be less probable than 10- per reactor year).

Previous studies, comments on the statistical methods used in these studies, and information sources explored to provide probabilities for these and the present study are outlined. The events which are required in order to have a red drop which exceeds 280 cal /gm are examined and the conclusions reached from the information sources as to the probabilities for these The results of the study indicate that a conservative events are given.

estimate, based on the information examined, of the probability of exceeding

-12 The uncertainty 280 cal /gm is on the order of 10 per reactor year.

-) is

~

of this result is discussed and a possible maximum probability (10 additio'nal Based on'these results it is concluded that developed.

llowever, encouragement of RbH eperability

~

hardware is not necessary, (through Tech Specs) is desirabic.

s 90017032

=

_2

! Purpose _

.The purpose of this memo is to develop a technical background on the events involved in the BWR rod drop accident (RDA).

This is to assist in decisions.which need to'be made on requirements for additional hardware or Tech Spec changes relating to the RDA for some of the operating BWRs. The reactors 'to be considered are the BWR 2 and 3 classes (Oyster Creek through Pilgrim)'plus Vermont Yankee. These ten reactors do not have a Ro'd Sequence. Control System (RSCS).

A primary decision needed.is 1

whether these reactors should be required to install a RSCS or alternate equipment such as a template, which some applicants have claimed to be equivalent.

(This memo will not address the merits of this equivalency argument.)

A parallel question is the need for Tech Spr. chang'es to j

~

require more certainly the operability of the Rod Worth Minimi:cr (RWM).

The obvious intent of these requirements, if imposed, would be to reduce the probability of a RDA with excessive rod worth such that the 280 cal /gm criteria might be exceeded.

Thus, the purpose of this memo is to examine the need for such added probability reduction for these 10 reactors.

This memo will not directly address this question for the 3 or 4 older BWRs (D-1, Humboldt, Big Rcck, Lacrosse), where differing mechanisms, patterns and worth might produce different quantitative results.

Itowever, the analyses would be similar for those reactors, and quantitative results might well be expected to be of the same order.

i f

w-t t-w

,e d-..a r

.+-

,s-

. =...

,er..s

. + - --

w- -

c ew

I

--3 It might be added that an additional purpose of this memo is to istical analyscs take another'small step down the path of quantitative stat least of reactor safety problems, and a. reminder that in some cases at the step is (apparently) not too difficult.

Approach Since the basic nature of the decisions to be made is primarily

). i.e., are probabilistic(atleastbofarasthedecisionistechnical h to be used additional probability reducing elements needed, the approac d

is an examinatien of the statistics of the involved events, singly an Thus, we will exarine all the events required to produce in combination.

b bility a P2A above 280 cal /gm, estimate (hopefully conservatively) the pro a f

of their occurrence, combine them to form an (conservative) estimate o i h a criteria the probability of the total event and compare the result w t A

for these 10 reactors.

which we will develop to judge such an event detailed fault tree analysis of the mechanical failures of individual f

componets in the control rod - rod drive system will not be a part o J

)

Instead,.the analysis will be based on information on the this study.

failure (i.e., disconnect or sticking) of the rod system as a unit.

It is recognized that quantitative probabilistic analysis in this Regulatory approach, that form is not currently a generally prevalent for the RDA have been previcus attempts by CE in this area (Ref. 1) disregarded, and that there have b'cen numerous manaccrial statements Nevertheless, about not rushing into WASit-1400 (Ref. 2) type reviews.

1 90017034 o""o "3 mr AR a

~

i u..-

-w-t* - -

-sw

i

-4_.

this appears to be a problem area amenable to this' type of analysis and one for which a decision is not otherwise obtainable (and has not been obtained) except by arbitrary flat based on subjective probability feelings.

The memo will not discuss the accuracy of CE calculations of the It will be assumed that it is sufficiently accurate (conservative)

RDA, for this type of study. The present review of the 3-D vs 2-D analysis variati6n as applied to the GE analysis methods does not indicate the likelihood of an important inaccuracy, and the final results of this The study would not appear to be sensitive to potential variations.

amorphous nature of some of the information presently readily available to us on some.of the areas of the analysis and the effect of the results will be discussed later in the.neco.

Criteria A probabilistic study of this type requires a criterion in order to provide a basis for judgment.

Just as probability studies are not I

prevalent analytical tools in NRC, criteria for use in such studies are y

i also not prevalent. Thus, one will be developed for this study.

The 3

s too unrealistically attempt will be to choose a criterion which, while not 5

harch, is appropriately conservative and casily defensible in the context 9

of present NRC positienc and precedents.

90017035

~

s

-T 0

Y. 2

e The criterion will take the following form:

For the ten reactors

- under consideration,.the probability of a RDA exceeding 280 cal /gm shall

~7 be icss than 10 per reactor (one) year.

0therwise, additional elements must be provided to attain such an objective.

=There are three related Regulatory studies (known to me) ' offering pertinent information or viewpoints on this criterion.

The most directly 6'seful of the Regulatory staff studies is reported a

in WASH-1270 (AT'w'S) (Ref. 3).

This report establishes, in effect, a

safety objective level such that ArWS becomes a problem if it can occur more probably than 10 per reactor year. The viewpoint cf RASH-1270

~

can best be indicated by quoting from pages 16 and 17:

"The staff believes this safety objective is met by requiring a design basis accident envelope that extends to very unlikely postulated accidents, and by establishing the further objective that accidents not included in the design basis envelveu should have an average recurrence interval of at least a thousand years for all nuclear plants combined.

For an anticipated population of about one thousand nuclear plants in the United States by the end'of the century, the saf ety obj ective will require that there be no greater than one chance in one millicn per year for an individual plant of an accident with potential consequences greater than the Part 100 guidelines."

and from page 19:

"The safety objective is that the likelihood of all accidents with significant consegrences not included in the design basis envelope should not be greater than one chance in one million per year, i.e., should not occur with a failure rate 4

4 a

'6

~

greater than 10 per year.

For the particular potential failure path of ATWS, the staff believes that a failure rate of the order of one tenth of the overall safety

. objective is an appropriate objective. 'Thus, (the prob

_7 "

ability per year of an ATWS event should be 1 css than) 10 Note than that 10

.was based on a thousand reactors in operation.

~

If only. ten had been involved, presumably the criterion would have been

-5 10 WASH-1400 (Reactor Safety Study) does not directly develop such a criterion, but does produce probabilities for the occurrence of accidents in several consequence (release) categories.

For BWR Category 1 accident-

~

sequences, the median probability of occurrent.e is 9 x 10 per reactor

-5 year (10 and 10

. lower and upper (5%) bounds) and Category 2 is 20 x

~

10~. 'Since it is doubtful that the (non-sequenced rod) RDA above 280 j

cal /gm sequence would reach even Category 2 (less likely Category 1) ultimate release mechanisms, holding the probability of the accident to

~7 less than 10 per reactor year would seem not to affect the WASil-1400 results, and in particular, not even the release Category 1 results.

Note:

For the BWR

" Category 1 involves a steam explosion in the reactor vessel in which about half the core is involved.

The steam j

cxplosion ejects this half of the core from the containment.

The j

resulting exposure of the' finely dispersed molten fuel to an oxidizing atmosphere results in the largest release of radienctive material of all the accidents." The non-cequenced rod (maximum worth 2.5 - 3.0*: oh) 90017037

'w+

e s

9 7-

' RDA vould be expected to result in a maximum enthalpy of the order of 500 cal /gm in a small axial region of a few fuel pins, nnd a molten

~

condition (the order of 300 cal /gm) in a limited axial region of several While

-(the order of 16 out of a total of the order of 500) assemblies.

the staff has not been convinced by the mechanical disruption calculations

. performed for this enthalpy range (thus the 280 cal /gm limit), neither is it persuaded that this enthalpy distribution would necessarily lead to vessel rupture.

The third study, WASH-1318 (Pressurc Vessel P.cliability) (Ref. 4) is even less directly related to the desired criterion.

However, it does develop the position that present knowledge leads to the conclusion that "the upper limit (99% confidence) probability of a " disruptive

. failure" event occurring in any one nuclear vessel during any service

~6 year f alls within the range of 10 to 10

." By i= plication, this

~

leads to the tacit assumption that since vessel rupture is not presently an analyded accident that the 10 level might serve as a suitable

~

criterion.

there is a We may, thus, conclude from these three studies that reasonable basis to conclude that the 10 value can be used as a suit-

~

ably conservative criterion (and note again that it is a factor of 100 more conservative than the ATWS criteria).

Previous Studies The probabilistic analysis of the RDA is not new.

Just about overy vendor - applicant reference to the RDA begins with a qualitative J

-t, the Ediscussion of the required events and a subjective statement about total ~ unlikelihood of the sequence. There have been (at least) three attempts at a quantitative analysis.

Two were by staff members and the The.two.

third by GE'in the course of the RSCS development and review.

staf f reviews (Ref. 5 and 6) uere cu"rsory and intended only as initiating examinations. They contained little quantitative probability infor-mation (and most of that used was' inappropriate) and contained fun-damental drrors in the statistical analysis.

Except for passing mention The GE analysis, Ref.

they 'will not be considered further in this memo.

1, (presented in Amendment 22 to the Peach Bottom FSAR and attached as Appendix A to this' memo) is considerably more satisf actory.

The-probability analysis is fully quantitative and the statistical approach appears to I't is incomplete, however, primarily because of a lack of be suitabic.

quantitative bases for the event probabilities.

They are simply stated and no backup data is offered.

The remainder of the report will present extensive ccmparisons with the GE analysis.

It might be noted that the two staff reports produced a " result" (based on my interpretation) of the order of 10-or 1 css per reactor year of "too large" a RDA,.while the GE analysis results were of the

-19 While this indicates a large variat, ion in outlook, they order of 10 the critorion (none of them developed its own criteria).

all meet 90017039 a

v-

/

-9, 4

Comments-on Statistical Methods The statistical models involved in this analysis are not complex, As an exampic.of however, they must be considered with some care.

potential pitfalls, consider the following probicm:

Given:

.A years B actions / year, thus, AB actions C result is D* result 2s C/AB result is/ action (probability of result./ action).

llave:

D/AB result 2s/ action Probabilit'y is CD/A B that there will be combined result 1 and 2 per action and:

CD/A B combination / action x B action / year 9

Gives:

CD/A"B combinations /ycar But also have:

C/A result 1s/ year D/A result 2s/ycar i

Giving:

CD/A combinations / year Which is not the result above!

The solution is

.This may appear, either paradoxical or obvious.

that the second answer is for results occurring together (in the same 1

90017040

~

l-

o p

as is the year), but not necessarily. associated' with the same action, For the RDA, where the results are the (independent)

~

first answer.

disconnecting and sticking (and erroneous withdrawal) o'f a rod, the results must occur for the same rod being withdrawn (action), not just The point is apparently sufficiently subtle that in the same reactor.

both staff reviews-chose the wrong path and thus, had no. chance of producing correct analyses.

(Note that if there'are n results, the answers wi,11 differ by B"~. For n equals 3 and 10 rod withdrawals per 6

The GE analysis is correct in year, the answers would differ by 10.)

Form one will be used in this memo.

(It might also be this respect.

noted that one of the staff reviews also introduced " duty cycle" time' factors without recognizing correlations between failurcs within a " duty cycle".)

This memo will not delve into f ault tree analyses for the mechanical Attention failures leading to such phenomena as sticking and uncoupling.

will instead be confined to information on probabilities of the final event (s), e.g., uncoupling.

The discussion will generally be in terms of events per rod withdrawals. The GE report made some limited display of fault tree development.

It was not sufficient to catch the sub-sequently found strainer movement uncoupling mode of Dresden 2.

The basic assumption implicit in this (and the'GE) analysis, involving the multiplication of the probabilitics of the several in-dividual events, each of which must occur, is that each failure (event) e.

90017041 t

i rate is' constant in " time" (and, of course; the several cvents are not correlated).

In this case " time" is the action space (i.e., per rod withdrawal) previously discussed (e.g., uncoupling per rod withdrawal).

Since we are dealing with the " rare" event, i.e.", many observations (of rod withdrawal) and few failures, the appropriate distributions to be used appear to be Poisson (and exponential intervals).

A brief but useful discussion in this area is given in Appijdix A of WASH-1318 which is appended to this memo as Appendix B. Also given in this appendix is a discussion of the accuracy of estimating failure rate from limited observations based on these distributions (see also WASH-1270, pages 53-55), where it is shown that the chi-square distribution of the mean failure rate can be used to develop a confidence level for the failure rate estimate.

Figure 2 of this appendix can be used to determine expected failure rates from observa ions and a desired confidence level.

For example, zero observations of a failure lead to an estimate of five failures at a 99% confidence level and three failures at a 95% level (for the X number of withdrawals observed). The " desired" confidence level is, of course, debatable, WASH-1270 used 95, WASH-1318 used 99.

For this memo, the available information is sufficiently amorphous that the difference does not materially affect results. Where a choice is made, it will bc 95.

D <* "" D D

~

"D

~ l'

.2.1 o o Ju o o

Information Sources The information base drawn on for this report is far 1 css complete and detailed than would be desired for a thorough, minimum uncertainty probability analysis.

It consists primarily of (1) a computer printout 1

90017042 l

l

. ~ -

- 12 '--

of ','all" apparently related A0 reports in its (OIE maintained) memory, (2) Semi-Annual Reports from utilities, (3) discussions with relevantly experienced project engineers in Operating Reactors, Operator Licensing, and Operation Evaluations (OIE) branches, and (4) previous years of experience dealing with the RDA.

No attempt was made to extract detailed data from GE or utilities. As previously indicated the GE study contains little-explicit failure data as a basis for the probabilitics used.

An A0 reporting system in which all failures relevant to the RDA vere fully recorded into the computer system would, of course, constitute a suitable data source.

There is ample indication that this is not the case, however. Discussions of insufficiencies in the data for individual failure areas will be presented later, but it might be noted as an example that known data on stuck rods and non-sequenced rod withdrawal appears to be missing from the data bank.

A more intensive and complete data retrieval was not attempted for this review because it does not appear necessary within the contexture of the results, criteria and cone'.usions, that a more pr ecise result be produced at this time.

This too will be discussed latcr.

Withdrawal Data We will now examine the experience space we have.to work in, i.e.,

the number of rod withdrawals which have occurred in relevant BWRs to provide failure rate information, and the expected frequency of withdrawals in the reactors which this memo addresses so that probabilitics may bc converted to yearly rates for comparison with the criterion, 90017043 o " lo

~

M 2*o m mLUL ul' L

L c

I, We.will consider only.U.S. reactors since our information sources The reactors of interest are listed in Table 1, are limited to those.-

h i

.along with'the number of rods, tha year of startu'p and t e approx mate years of operation.-

TABLE 1 Reactors

1. of Rods Yr Start Yr Exp.

OC 137 69 5

9M 129 69 5

Mont 121 70 4

Mill 145 70 4

D2 177 70 4

D3 177 71 3

QC1 177 71 3

QC2 177 72 2

VY 89 72 3

Pil 145 72 2

BF1' 185 73 1

PB2 185 73 1

DA 89 74 1

BF2 185 74-1 PB2 185 73 '

1 r

Coop' 137 74 1

Fitz l37 74 0

11 1 137 74 0

41 Total 147 ave.

90017044

+-.4 y

9 gy.- -. -

--ww..

, 1 i

5

=

Ld Examination of a number of semi-annual reports from reactors of various vintages indicates new reactors average about 30 startups a year

-@j and older ones ten or less.

f Combining this information indicates that there is data from in J

f

/

{

5 rod withdrawals, and that for the reactors of this memo execss of 10 (the first ten in Table 1) the appropriate order of magnitude for the

. s, 2

3 L

and 10 respective

1. N number of rods withdrawn per startup and per year is 10

'd

]

P Events for RDA Above 280 cal /cri f ;

1 We will begin the discussion of the events which must occur for the u

.[5 RDA above 280 cal /gm with a brief reminder of the relationship between iP the withdrawal aspects of the RDA and B'<TR operations.

4 Beginning'from a fully shutdown reactor, startup proceeds by with-h The first half of i

i drawing rods one at a time but in proper patterns.

the rods are pulled all the way in a checkerboard pattern (e.g., red

..g;;"

squares) using 4 to 6 such groups each of which is withdrawn fully 3,..

W before the next subgroup is started. The second half of the rods (i.e.,

y%, 4

..w black squares) are withdrawn in smaller groups and are generally not l (* *;p:.

It is See Figure 1 for 'a typical withdrawal pattern.

bef fully withdrawn.

1 C:h this pattern which devices such as the RWit and RSCS are intended to y ',, / s -,-

l,.; ? '

Ber. inning from its.most reactive state (i.e.,

^'

assist in maintaining.

J' of:,,

cold, no v.cnon, maximum cycle time reactivity), the reactor would be p,% w i

W

(%% -

critical with about' half of the red rods withdrawn, about at hot standby j

26 and reach the order of 10% power with 10 or

1. 'kk with all the red rods out, 20% of the black rod density withdrawn.

At other titqcs in the cycic or restarts from hot and/or xenon conditions these milestones would require

(, - }r 90017045 j

oeo e

e=

a w

,k\\

A m,

~

~

.._m t_

y Mid$104f.

< Mtt.LSTorJC

~

' ll 3

l2 1

2l 61 5

-G l l5 l

47.

3

'4 l 3

4' 3

47.'

13 14 l l !4 l - l 13 l d.

I 2

l1'

_'2 1l 2 l:.

3l l-9 l _ l 5 l l 7 l ]'

43 7

-l 3 l.

'4l 3

'4 l3 39 13 15l l 1G l l 15 l - l 15 l - l 131' l,

39; 3

4 l1

.l 2 l _

.l.

2 35 5

8 10 l l 11 l l10 l l5l l ' $ '>

35 1

3l l4 31' 14 l 16 f17l 17l-l 16 l l 14.1 31 4

3 4

3l 4

l'2 l 27 6

9l l 11' l l 12

' l 11 l 9'l

)5) 27 ',

1 2l

.ll l 2-l 1

23 3

4 I 'l 3 l l4l l3l 4l l3 23_

14 IG l 17

' l 17 l l 16 l 14 j

).

19' 2

1 l' l'2 l 1 l-l 2 l l1l

.19 5

8l l 10 l 11l: l 10 l k5l l5 15 4

3 L l4l l3l l '4 l-3 l

15 13l.

l 15 l l IG l l 15 l l 15 l l 13 l l

11 1

l2 l1l~ l 2 l 2l 8l-l9l l3l I 7 l

l~

11 7

07 4

3 l4 l 'l 3 l l4l

'07 13

. l 14 l l 14 i. l 13 l l

!l 2-l l1 l2 03 l6l l5l 03 5

t i

-02'06' 10 '14 18 22-26. 30 31 39 d2 46 50 02 06 10 14 16 22 20 30 34 33 4: 4 G ' EC '

~

1

. 3. CC*.!PLETE Y,'ITCRA7tALS If OtCATCO IN EACM COLU!.l -

CT: CUP-

" WITHORA?! TO PC$iTIOtt " $TEFS l

. der 0RC CO: fig TO l' EXT COLU:/.N 1l2l3l4 l5l6 I7 i 5 i-9 10 l l

2 %1TilD8tA?/ Cr.OUp3 : ; 1 A!;D 4 ROCS IN0lVIDUALLY

/.3 l l

l FRC.*.10 TO 431:3 T!fE FOLLC7!!!:G OTIDCR 1

1 - (22-77).

(30-35e

.38-271 (30-19).

2 46 l l'i l

l (22-11).

'14 -l ?i 06 -27

<!4-351 l

l (22-43).

83?-51,.

i32-43#

3* '

48 l

l l

46-35).

(40-19 ).

t 35-ill.

i30-031, 14-03),

kf 0 43 l l

l l

l l

(0~-11).

100 -43).

14-51

{

4 l

2 - (30-27 ).

II:-19).

(14-27 (22-35).

l l

l l

l

[!

(30-4 3),

135-13e 4

r

^5 24 48 16271; (33-10).

(30-11).

(22- 03)

!!4-111.

(06-1?).

DLACK i

~

l

]

l 3~ l 4l 6

12 24

. (03-35).

(14-J 31 (22-511 (35-51).

(46-43),

(45-11i (33 -03) l 12 24 l 33 ' 3.t i 33 ' 40 l 431 l

I 7

3 - (2G-31).

814-23>

t:G-15).

(16-23).

I e

(10-31).

(13-33i (26 47)

(34-39),

6 6

10 8 (42-31).

(!0-M' e40-151 (34-07).

b14 l !!i 24 ' 20 l 234*

l l

10 l 14 l 13 l 24 ' 30 g 33 s

l (16-01).

110-15:

302-211 (02-39),

9 6

(10-47),

(40 47).

i50-30n S l 12 l IG l ::.' n I 33 4 l

4 - (OG-23).

f !3-31 s,

25-33).

(34-31),

10 4

I

' (42-23),

(34 155 (2G-071.

(18-15)[

II ) I0 l 22 II l 23 #8

• l l -

II 8

(10-23).

!02-311 i!0-33).

(18-471 I

(34-4 7).

t42-29' e50 311 (10-15).

SlUl16l"I H l 3G l

12 4

JS I (42-07),

10 -07' (02 151 I

i

- ). WITiec:t AW GCOS 19 OT:!E R C'ICur's rY DANK. I;EE PtNG i

OF A Cl:C'tr %tittiN A F t t! t:CTCitCS CF LACli 14 6

10 l 14 l 13 I 24 t?'34!33 I l

15 6

13 l 14 ' IS i 12 26 ; 3') l

4. TCft it001;litRTICNS. REVER$C Tite ORDER.

16 l4i 6 I 10 !4, 18 I

' l ' i i '8 I D '"

A~QU'L figt'reA3-I~

Control nod I','iths!:os.ut S: quar:e A i

& un r r

90017046

-.21c.

. =.

- ~

w,

'h,,',

e

's

,,~

- 16 Above approximately 10% power,.the-RDA can not

greater rod withdrawal..

exceed,280 cal /gm because of both~the more prompt Doppler feedback in this power range and'the impossibility of achieving high rod reactivity worth with the relatively low-rod density, even with erroneous rod potterns. Based on the observations from the semi-annual reports, as a general rule, having gone above the 10% power icvel, the reactor will.be back in the RDAf range' again only fellowing shutdown (usually by scram),

i.e., itTr,ill operate in the power' range for a period of. time then

'(This is not an inevitable course, but shutdown and start over again.

s Variations, where the full complement.of appears to be predominate.

fully inserted in order to stand by in the ":cro power" rods is not range, would not appear to result in conditions cuf ficiently dif f erent to invalidate the atalyses.)

r The events which must all occur (emphasize all) to exceed 280 These cal /gm are outlined in Tabic 2 and described briefly here.

required events are (essentially). described in many GE presentations, They are crranged (or rearranged) including the attached Appendix A.

The assumption is that a rod is here for convenience of presentation.

(subsequently) occur (being) withdrawn and the events in the table must on that rod.

Di. connect _

I.

be or beconc disconnected from the drive either

'.l

.A.

The rod must by never being coupled, by becoming unlatched or by <7 reak in b

the syste'm such as a broken index tube.'

l 90017047 0 7~

o 7 13e

. A 1

w a-

=>

4

=

g

This disconnect must occur with.the rod in the upper quarter B.

or icss of theccore (or it must subsequently be moved there)

(see II B) since most of the reactivity worth of the rod occurs during the initial part of the withdrawal.

The disconnect must not be discovered -(c.g., by over-travel C.

coupling tests) and remedi'ed (see also III. D).

II.

Stuck stick as the driveLis moved away.

A.

The rod must

'The rod must stick in the upper quarter or less if the core, 3.

as discussed IB.

The drive must be lowered at least a third of.the core length C.

away from the stuck rod.

III. Errors _

The operator must select and withdraw a wrong (ncn-sequence)

A.

Sequenced rods do not have sufficient worth to exceed rod.

280.

It might be noted that in some cases ro s are withdrawn d

in several steps (i.e., not fully withdrawn bank positions for For sc=e of these rods, the error, sufficient some rod groups).

to exceed 1.5% ok, might be withdrawing the rod too far rather than an incorrect seicetion.

B.

The RRM or, The second operator (which has been allowed as an alternate C.

for the RWM) must allow the wrong selection to go uncorrected.

The rod m,st be withdrawn.in spite of potential warmings of u

D.

being unc'oupled,_ which are sometimes available, such as no response on the nucicar instrumentation to rod motion.

90017048 ee e

Ako JN.

g 7

o 4

a

~m m

.n n a e

,.m,

,,4.-

,.,-nw---

,mr mm

,,rr o

4

'e,,

- 1P l

l 9

1 IV, pinh Worth Potential _

i 4

The erroneously pulled rod must have a high potential worth.

A.

While it varies soccwhat with the reactor and time in cycle, wee as well as the drop valocity and scram time, a RDA must have a i

reactivity worth greater than about 1.5% ak to exceed 280.

Many of the possible erroneously pulled rods would not have that worth, e.g., many core edge rods (see also V.C).

i IP V.

Drop-Timin g j

A.

The stuck rod must drop.

d I

The rod must drop when the reactor is nearly critical (if it B.

is far suberitical, the reactivity worth potential of the rod U

would not be suf ficient) and less than the order of 10!! power.

lP Above this power, 280 cal /gm can not be attained, i

The rod must drop (within that critical to 10!! pcwer time C.

M frame) when the withdrawn red pattern enhances the rod worth s_

so that it approaches its maximum worth.

Generally, only V

N error rods near (next to) the first rods pulled in a group, or

! y. ;j some of the first of the black (beyond 50% red density) rods

.f, :1 have sufficiently high worth, and they lose that hi;h worth as 4 80 the pattern withdrawal progresses.

st

' l.ha d, Probabilitien for Eventn

% ))

We will now proceed throvgh the events of the RDA and assign prob-Q M

l and compare these probabilities with those assigned mE!5 abilitics to them, sj!

by GE.

These probabilic'es are given in Tabic 2.

The probabilitics L

90017049 E

oOO9 0 Q@R!'[gj L

mimi m__

- --.~

4 N.

7 5

4 g.

will be' discussed (and listed in Table 2) individually and in groups 9

'~

under the group event headings previously given.

The gro'up probabilities in particular are an attempt'at a conservative interpretation of the apparent information and.do not necessarily represent a direct use of Note that the units.for the first 3 groups the individual components.

are per withdrawal, and for the foarth group per erroneous. withdrawal (this'is a conditional probability, given a non-sequence withdrawal has The.fifth group has a time fractional probability based.on occurred).

Y

. operation from the time the rod is withdrawn until it is eventually.

inserted.

90017050

[

ca.

^s i

e 9

0 0

e P

5

,a L

h,

...,,e

www, ow. a m m ene ammina 6

e

~,,.

.4

. '.' J Table 2 Probabili1 ties For Events This Report Maximum

.CE Group Individual _

Group _ Individual

~

~

-5 2x10

-6 2x10 I.

Disconnect (/w) 10

-4

-6 10 10 A. ' disconnect

~1 3x10 B.

upper 1/4~

-2 10 C.

not discover

-2

-3 10

~

II.

Stuck (/w) 10 10 10"

~

10 A.

stuck

-1 3x10 B.

upper 1/4 C.

lower drive 1/J

-2

-4 10

~9 III.

Errors (/w) 8x10 10 2x10"

~

2x10 A.

operator select

-3

-1 2x10 10 B.

2nd operator

-3

-3 or 2x10 10 or C.

RWM

-3

-1 2x10 10 1

D.

withdran

-1

~4

-1 4x10 IV.

High Worth Potential 7x10 10

(/cv)

~1 7.10 10

~

A.

high worth

~3 V.-

Drop-Timing (/dscw) 7x10 2x10

,6x10

~

~

~

1 10

'A.

~ drop

~1

'10

~

10 B

crit to <20%P

-2 10-2 7x10 C.

pattern enhance 3

3 2x10 10 -10'?

2x10 VI.

Rods /ycar (w/yr)

~

~1 N 10

-19 N 10 Total (above 280/ r).

N'10 90017051

~-

^

w e-ec e-

N 7

- 21 ~

l'.

Disconnect. The information sources iiviicate that there have been no disconnects which have not been detected immediately'(before operations could lead to a RDA). The 95% confidence icvel, zero occurrence rate 5

estimate (see Figure 2 of' Appendix B) is thus 3 occurrences out of 2x10 withdrawals or a rate of.1.5x10 per withdrawal.

There have been 7 uncouplinge in Dresden-2. These all occurred at the fully withdrawn position (unlatching from a moved strainer) and were immediately detected by the over-travel coupling check.

One uncoupled rod was found in U111 stone following a rod change. It was discovered in coupling checks before startup. Using these 6 uncouplings (14 at a 95% confidence 1evel) would result in an uncoupling probability of about 10 '.

~

However,

-this should be combined with a probability of not detecting the uncoupling.

Since procedures call for coupling checks under conditions when such events might occur, it seems reasonable to assign a probability of'the order of

-6 10 for such a failure to detect, giving a total of 10 for undetected

~

uncouplings.

)

No attempt has been made to analyze breaks in the system leading to

. disconnects.

GE has assigned a 10~0 probability to this event based on its i

not having occurred to date (incidentally, this -indicates that GE considers 0

the number of withdrawals to total over 10 ).

Thus, based on the availabic record, it would appear that a probability

-5 of 2x10 per withdrawal, based primarily on the observation of no non-detected disconnects, is a suitably censervative value for this review.

This gives no credit for'having to occur in the upper quarter of the core.

' Note that the ascumption is made that the events of sticking and disconnect are independent.

The availabic information does not contradict o**B *D mf@L 90017052

_.. M M Lun n

-++,,,--e,,

91

4 this assumption since no. occurrence in which one.has caused the other Th'is subject-will be mentioned later under uncer-

.has been observed.

tain tics.

Stuck. The computer A0 report systems give almost no information on II.

They are apparently not generally considered as AOs since stuck rods.

~

d d

when'they occur, they can be'trearcd "normally" as inoperable ro s, an The semi-annual reports cr.amined also thus do not appear on A0 lists.

indicate little evidence for stuck rods.

~

The other information sourcen (verbal), houever, indicate that stuck rods appear not to be uncomnon (although the dif ferentiation GE uses 10 ' per

~

between stuck rod and inoperative drive is unclear).

if at all at

. withdrawal for this probability, stating it would ' result, 1

?

this level, from varped channel boxes.

Because of the lack of precise data, a satisfactory statistical However, what would appear to be a analysis can not be carried out.

~

per withdrawal.

~

suitably conscrvative estimate will be made of 10 Once Note that.this implies more than one stuck rod per reactor year.

l again the factors for occurrence in the upper quarter of the core wil not be used.

The computer A0 reporta also provide no information on f

Ill. ' _ Err o r q.

is known Although at least one case (in VY) operator error histories.

1 in which a ncn-sequenced rod was pulled without being halted by the nor is in operation), this case is not, second operntor (the RWM was not Thus we have no re11abic record of any other, listed.by the' computer.

As an obvions corollary to thir.

actually withdrawn non-sequenced rods.

i 90017053 o90

• o Y P a

J..UAL e

~-

~~

.4--,

~

>r

= +

s,

,=m.,

-~

i,,-r-.,--

3,,,

-r e

e y-.w----,-

yrv

i.

e' 22 -

we also have no: record of single operator errors which were caught by.

the second ' operator or RWlf. -Thus, we will have to consider more. general-ized: reviews of operators actions.

' Appendix III of UASH-1400 delves into the question of human error.

Whilc~a directly comparable case is not discussed, my review of that material indicates that it is not incompatibic with a value of 10-3'(per f

withdrawal) for the operator error rate for the type of compicnity and stress icvol of the withdrawal operation. The material would also a

appear to assign a lesser degree of' reliability'to the checking oper-ation -(second operator).

The infor=ation from experianced staff personnel (OLB, OEB) in-l dicates that numerous startups have been observed without an operator (For example, 50 startups without crror observed, which by the

- error.

statistical analysis at a 95% ' confidence level would estimate an error i

rate of 3 in over 5000 uithdrawals or less than 10- per withdrawal.)

The informatien appears generally compatible with a value of 10-These sources do not indicate a very high degree of confidence in the second. operator (as it has generrily been implemented).

The values

-3 assigned by GE in Appendix A are 2x10 per withdrawal for the operator i

error and the same value~for the second operator.

i Based on this type of judgment information, this memo has assir,ned 4

~

~

an error'.ratc of 10 per withdrawal operation to the operator and 10-to the second operator.

Since rod' withdrawal for some rods requirce l

morci han one operadion.(rods moved to not fully out bank positiono),

t thinestimateisincrescedbyafactorof2,to2x10}3, to account for 90017054 d-34 r-g-r

.,y y

--e=+

sve

-s-i.

w tg.w.,-

e,

+

w-'-qw.m..

e-,<g

,-,e-,

w w

• ew i t.

.o

1. ing>.rw +e g

I' i

.c

- 2 4,,

9 this increase in operations.

A value of 10~ 'has also been. assigned'to

- other potential withdrawal errors such as not observing the non-reaction of the nucicar instrumentation to the non-movement of the control ~ rod a

~3

~

to such the drive is actuated.

GE apparently assigns a value of 2x10 an error, although the assignment is very unc1carly s'tated.

This memo will not attempt to develope a well justified value to be assigned to the RWM.

(That is a t'ask for the EISCSB.) Based on personnel judgmenti a value of the order of'10 per withdrawal appears reasonable.

~

Because of this amorphous ncture of the information in this area, an overall estimate for the withdrawal error has been taken at what to be a cur.rervative level of 10 ' per withdrawal.

This ba ically

~

ap;;ais Note that.10 ' implies the order

~

ignores any contribution from the RUM.

This appears of 1 withdrawal error per year for ten operati*ng reactors.

However, the compatible (but somewhat conservative) with known errors.

GE error rate, which is of the order of 10 is possibly less so.

~

It should be noted that any potential difference between a wrong rod seicetion error and an error of withdrawing a rod too far when in This is believed to be justified group. bank operation has been ignored, fundamentally different and both because the basic probabilitics are not because the significant excessive withdrawal error operations are only a Similarly, for the small fraction of the total withdrawal. operation.

same reasons, the complications introduced by the occasional enterini.

into the RDA range from the higher power range by inserting rodo has been ignored. TThis will be mentioned later in the discussions of un~

certainty and' RUM.

90017055 Q H A

w

,.+.,

~

e

.r,,-

- p,

.gp-m w,

~

,,eg vv,. -

,y rg

2 i

1,.

~,2 5 -

IV.

liigh Worth Potential.

It is evident clat a number of possibic'non-sequenced rods will not have sufficient reactivity worth to exceed the order of 1.5% ok required to execed 280 cal /gm.

For example, while pulling red" rods, a wrong red rod ight be withdrawn.

This might have a

- slightly larger worth than normal, but would not (to the best of our present understanding) execed 1.5% 6k.

Other potential candidates.for non-excessive worth might be core edge rods or rods not near first rods pulledi$agroup. We do not have precise quantitative information in this area, however. Our normal revicu of rod uorths for the RDA focuses on the taaximum possible rod worths and not on those of somewhat_ lesser

- magnitude. Furthermore, we no longer even examine non-sequenced rods since the assumption is that only sequenced rods are involved in the RDA.

_Thus, the estimate is largnly subjective, based on pact experiences and discussions and augmented by several BNL calculations.

The estimate is that 10 of the erroneously withdrawn rod have sufficient reactivity

-1 worth.

(Note'that this is a conditional probability, given an erroneously withdrawn rod, and the units are per erroneous withdrawal.)

It might be noted that the GE value of 7x10~0 (which is deduced from Figurc J.4.13,7 of Appendix A) is obviously for a BOL curtain core. The RDA is somcwhat more severe for a given rod worth in a reload core (which is of concern Thus if GE in this memo) and approaches that for a BOL shaped Gd core.

had considered a reload core for the analyscs the rod worth to exceed l

t 280 would bc lowered and clie potential for exceeding that worth inerenced'

[

90017056 I

L t

s I

--%,m.

w,.

• *6 l

4

- 26.-

The 1.5% ok'value for 280 cal /gm is only slightly sensitive to variations in the drop velocity and scram velocity parameters for reload i

t It is somewhat more sensitive in first cycle curtain cores and cores.

the velocities included as parameters in the GE analysis (Figure J4.13.7 i

For reload corce,'the possibic range of velocity for of Appendix A).

either drop or scram can result in only about a 10% change in enthalpy, The availabic which is equivalent to.about 0.1%'ok change in rod worth.

sufficiently precise to information on rod worth distribution is not consider this as a parameter of this analysis.

It is unlikely that every stuck rod would always drop.

V.

Drop-Timing.

However, there appears to be no clear basis for developing a probability

-1 Thus, we list a probability of 10 on Table 2, but for the cccurrence.

basically assume a probability of 1 in developing a total probability for this group. GE also assumed 1. (Note that uc again have a conditienal probability with units of per disconnected, stuck, erroneous withdrawal.)

it In considering the timing of the occurrence of the red drop, will be assumed, for the moment, that the probability is constant over the time period from withdrawal to eventual insertion (after power operation).

This is conservative if the stuck rod is more lickly to drop during the It is not conservctive if increased vibration time of power operations.

the drop is more correlated to cccurring soon after the drive is withdrnwn from the stuck rod To exceed 280 cal /cm the red must drop after the reactor is nearly critical (usually after more than 1/4 of the rods have been withdrawn) and before reaching the order of 10~, power. Typically the reactor is in "o q 3 90017057_

o "' "

o w1 X

~

1

+

7, i

this regime 1 css than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> per startup.. With 10 startups per year' this gives a 10

'(8 x 10/8000) probability of dropping during this

~

)

critical time frame..

The high r.eactivity worth rod.will.have that high wor:h only during a part(s) of the withdrawal sequance. There is a sawtooth maximum worth pattern as a function of time (number of rods withdrawn).

As was discussed under High Worth Potential, we have icss than fully detailed knowledge of the magnitudes of this function.

However, we believe it can be

-2 estimated as the order of 10 for the fraction of the critical time that high worth exists for a given rod.

Combining these factors (conservatively), we will estimate unit

~1 probability for the drop, 10 for the drop occurring in the critical 2

time frame, and 2x10 for the drop occurring in that time frame when

-3 the pattern enhances the rod worth.

This gives a total of 2x10 The

-2 probability for the critical time frame has been increased from 10 t0

~1 10 in an attempt to account for a possibility of early drop correlation.

The pattern enhancement factot has been increased by a factor of-2 to account for uncertainties in our knowledge of the pattern worthc.

-The GE value of 7x10 is not exactly directly comparabic.* It is

~

for the hot startup condition only.

(The breakup in Tablo 2 is arbitrary.)

The final result is also for that condition only.

'90017058 E

r

-*+*=**nsw,

+ -

ow a. w.

.*w...m+sm..

l 1

t '

~,

VI.

Rods / Year. 'As previously discus.,cd, the estimated startups per year is 10, giving the order of 10 withdrawals per year. This has been increased to 2x10 to include some consMeration for the multipic steps

-per withdrawal for some rods. The value stated by CE in Appendix A is 3

0 10.

However, 10 appears to be used in their analysis.

Resols The final probability resulting from the product of these.ssigned

~1 probabilitics is about'10 RDA events per reactor year exceeding the

~1 280 cal [gmcriteria.

This can be compared with the GE value of about 10 which, as previously mentioned, was for hot startup conditions in a BOL curtain core.

Changing the GE results to bring these differences in j

assumptions into agreement, would still leave several orders of magnitude difference in results.

Principal differences are an order of magnitude each for disconnect and stuck probabilities and 4 orders of magnitude for errors.

These differences are not surprising since we attempted to be conservative when the information available to us was less than complete. Our information and analyscs does not directly refute the CE results, however.

-12 This result of 10 is, of course, a factor of 10 less than the criteria of 10 The conclusion from this is that an RSCS (or,its equivalent) system is not required for the 10 reactors under considcration.

lincertnJnty of Results and Posnihte Itaximum Probability As has been noted throughout this memo, the analyses is less precisc j

than desired, or co'uld be achieved with further detailed exploration of other posnibic information sources.

Even though the attempt has been SS m

o f

. J1..,a 90017059 D

oc ge e4

g I

n t

29 ~

r made to be conservative where information is incomplete, the~ question s

. might be asked 'as to. whether the. information should be made more precise The.

by pursuing a more complete data basc'with GE and the utilities.

answer appears, to be that it is unnecessary.for the purposes of this.

r

_The question might also be asked as to whether there might be-

' l

. memo.

important hidden (or forgotten) characteristics'of one of the events which would completely invalidate the assumed modeling of the probabilitics and thus, should details of the mechanisms involved be

. of the e. vent, i

. more closely explored. This answer appears to be the same as for the These answers arc the result of the magnitude of difference i

first question.

between the. calculated probability and the criterion, and the lack u dominance of the resultant probability by any one of the required events.

Thus the sign of the comparison remains unchanged for large changes in the components.

I in developing the event grcup probabilitics, each one was considered uncertain because of potentially incomplete information, but values expected to be conservative were " chosen".

In answering the question of it is useful to push the need for further information of improvement, extent of conservatism even further.

If resulting probabilitics are greater than could reasonably be expected from nugmented data, such a An example of such a punh is given in Tabic 2 scarch is unnecescary.

under Maximum, and discussed as follows:

The " Disconnect" probability which had been based on' no known I.

e occurrences of operation with a disconnected rod is increased by an

. order of magnitude to 2x10'.

For a 95% confidence IcVel estimate, D

90017060 D}

unne+ w

-e e

~n

,,wrwu-p.e-

-e%

w r

.e3---.-t-+

w pr-~t

, y y

e-%n, r-g

6 this would indicate that the order of 30 uncorrected disconnections have occurred (in the upper 1/4 of the core),

The " Stuck" probability which had been based on only verbal information 11.

-2 sources is increased by an order of magnitude.

This rate of 10 per withdrawal is equivalent to hcving one stuck rod (not drive) per startup (in the upper 1/4 of the core), and data would have to indicate a history of about 400 stuck rods.

The " Error" probability which had been based on subjective evaluations III.

is increased by 2 orders of mag 11tude.

This rate of 10~

per withdrawal ir also equivalent to the order of one erroncously withdrawn rod (selcetion, backup, non-respensive withdrawal) per startup and a history of 400 occurrences.

The "High Worth Potential" which had been estimated based on less IV, than full inf on::ation on worth f requency distributions less than

~

maximum is increased by a f acter of 4.

This rate of 4x10 high worth rod per erroneous withdraual would be equivalent to nearly all " black" ' rods having high worth.

The " Drop-Timing". probability which had also been estimated with V.

1 css than full information on pattern worth distributions is increased

-3 by a factor of 3.

The rate of 6x10 may be viewed as being composed of the sanc conservative assumption of a drop probability of 1, in

~1 a critical to 20% power range of 10

, along with a probability for dropping when the rod is enhanced at the appropriate " sawtooth"

-2 (time-withdrawal) interval which is 6x10

, an increase of 6 over the expected value.

90017061 D""D

• D Nj edLRY ca

i

- 31 The total in this exampic, of courac, is icss than 10'.

The event probabilitics are beyond those to be expected.'from further exploration of data. Thus, further exploratien is~ unnecessary.

~The example istalso a view of possible accommodation of model deficiencies.- That is, if as yet hidden or possibly insufficiently explored

. aspects of the events (e.g., a new uncoupling mechanism or the previously mentioned entering of'the RDA region from the power region by rod _inscreion) were to lead to (future) increased probabilitics, these increases could apparent 19 be significant without exceeding'the criteria. A slightly alternate view of this is that any of the events could be at a probability

~

of one and the total probability vould still be less than 10

Thus, if the constant occurrence rate assumption of the model were sufficiently invalid that one of the events were to increase to' unit probability, the i

criteria would not be exceeded.

Eote that this also includes the case for one event causing another evert, i.e., a stuck rod causing a decoupled rod, and thus the lack of independence resulting in unit probability for the second event.

Thus it appears to be unnecessary to further explore l

details of mechansims involved.

Conclusions The approach developed in this memo has shown that even when conscr-vatively accounting for imprecisicn in information and modeling, the probability of an RDA above 280 cal /gm, for the 10 reactors without an RSCS, is Icss than a suitably conrervative criteria.

Thus no further information'is needed to conclude that an RSCS is not rc' quired for thesc 1

reactors, so far as this decision is based on a techn1 cal argument.

90017062 L

i 32 l

' The RW f

A parallel question exists as to requirements (Tech Spec) for RtR!

operability. The analysis in this memo has essentially ignored any contribution of the R W to the total probabilities.

The 10 per withdrawal i

-1 error rate assutsed a second operator error rate of 10 rather than a RW crror race of 10 (which, 'it may be recalled, was rather arbitrarily

~

assigned). The history of withdrawal errors, if it were known, is somewhat i

influenced by the Rkil, however.

It is (also) imprecisely known, but estimated 'that the order of half of the startups which hava occurred r

have been with the Rh?! in operation.

Early operability of the E11 was very poor and a-large percentage (approaching 100%) of the startups involved the second operator.

Subsequent changes in Tech Specs for some reactors, requiring greater operability have evidently reculted in increased efforts to achieve operability, which have apparently met with success.

For example, Pilgrim, for which R!Di operability is required (without exception), has apparently achicved nearly 100% operability.

Other non RSCS reactors, for which a less restrictive Tech Spec (rcquiring operability for the withdrawal of the first twelve rods) has been issued, have apparently achieved similar operability results.

The latter Tech Spec requirement is not in itself a logical requirement, since it,is after the twelth rod that the RDA is of importance.

However, it too seems to have resulted in an upgrading of the Riel availability sufficiently to make operability a "likely" condition.

To approach the Rtal assigned

-1 probability of 10' rather than the 10 rate of the second operator

^

would require a reasonably high level of operability.

To decrease the-e e

90017063 e

..e.-.-

wm

~

i e

t

- 33

-1

-2

-3

-3 10 rate to about-10

, 2x10 er 10 would require operability of 90,

!99 o'r 99.9% respectively.

Something in this' range appears to be achiev-able.-

The results of the analyses in this memo do not seem to demand the

-1 extra factor of 10 to 10" which could be achieved from the RWM.

Nevertheless, it is a system which exists and which can be useful with relatively little effort. The e::tra f actor which it introduces serves as an additional buffer for the RDA and should not be ignored.

It would seem to be particularly useful in assuring the correct rod patterns when entering the RDA region from the power region.

Thus, it is recommended that Tech Spec requirements be maintained to assure a reasonable degree of operability.

90017064 e

e t

F 8

l

.f'

.34 -

i References

'1.

Amendment 22 to the Peach Bottom 2,3 FSAR, October 1972.

2.

-WASH-1400, Reactor Safety Study, Draft, August 1974.

3.

WASH-1270, Anticipated Transient's Without Scram for Unter-Cooled Power Reactors, September 1973.

VASH-1318, Analysis of Pressure. Vessel Statistics from Fossil-Fueled 4.

Power Plant Service and Assessment of Reactor Vessel Reliability in Nuclear Power Plant Service, May 1974.

Rod Drop Accident for BWRs, G.F. Owslay, May 1972.

5.

Memo:

Assessment of a.BWR Rod Drop Occurrence, A. Serkig, August 6.

Memo:

1972.

9'0017065' E

4 4

0 s

d h*-P

• -espe muses, =

,__--,s

_ _,. _ - - = -. - - -

t e

s Appendix A Taken from Amendment 2 - Peach Bottom FSAR D #"D "D

't

~

4 U

,}._

o6 c.

a 90017066 9

~

A probabilistic cpproach to Design nacia Accidents enables designers not only to cec the conuequencen of an accident, but it also af fo):ds the opportunity of casily dotcrinining uhich cc:"ponents aid mect in reducing the probabilitics of such an accident.

I'er this reason, the probabilistic approach has been used an an a3d in investigatinn the decian basic CC::Tn0L RCD Dn0P ACCIDZ:lT (C. Di.) and the

.. -. 4 4. -....

,.w m 4. s ne n n,,,. *,.. n e,3 m-t hr r toduce tne t3ro-l 8001140

bability ofLsignificant conscque:._au due to the event..

The analysis presented hero concentrates.primarily on the most' probable modes of failures leading to a CRDA.

Where

' probabilities cannot be calculated.from historical data, i. ~ deliberately conservative values have been used to avoid contentions over particular numbers.

The overall pro-ba'bility for the CRDA will be seen to be very small despite the compounding of conservative assumptions.

Figure J.4.13 5 is a f ault tree model of a control rod stuck in the core ready for a drop.

Three primary branches combine to produce the stuck-rod " ready for a' drop" state.

'These are:

(1) a CONTROL ROD IS STUCK IN THE "NEAR FULL" OR " FULL IN" POSITIOU; (2) a CONTROL ROD SEPAP.ATED FROM THE CONTROL ROD DRIVE (CRD) ; AND (3) a CONTROL ROD DRIVE MOVED ABNORMALLY.

The heavy lines in Figure J.4.13.5 indicate the most probable path of f ailure which could lead to a CRDA.

The first of the three conditions which must necessarily exist for there te be a potential for a CRDA is that a control rod would be stuck in the "near full"or " full in" position. -This could happen in several ways, the most probable one would be where the fuel, channel is warped, which could be conservatively estimated to have a probcbility of 10-4 failures / insertion.

Another way would be that a loose object could enter the channel and jam the rod in a fixed position.

However, the fact that the control rod weighs nearly 200 pounds and the low pro-bability of loose objects lodging in channels in an oper-ating reactor seem to restrict this mode of f ailure; in fact, from the histerical evidence that no such failures have occurred, a conservative probability of 10 o failurcs/

insertion for this mode of f ailure can be assumed.

Assuming the other modes of sticking have a much lcwer probability than the previcusly discussed ones, the total probability,

for a control rod to stick would be essentially 1.0 x 10 "

failures / insertion.

The second condition contributing to the rod drop accident requires that the CRD be discennected from the control rod.

The most likely mode of failure in the separation of the control rod drive from the rod itself would be through the breaking of the index tube.

Since this failure has never occurred with the present design, it is justifiabic to say that the probability of its happening would be no larger than 10-6 f ailurcs/ withdrawal.

Assuming that the probability of failure of the control red would be much smaller than that of the index tube, it has not been incorporated into this analysis.

Since there must be multiplo f ailurcs present for the rod actually to be uncoupled without the operator's knowledge, the probability for this mode of failure would be small in comparison to that of the index tube breakin'.

g 90017067 a.4-16 g _Ag XAY 7g y

-?.

N.

Co.nsequently, the probability.of a control rod becoming separated from its drive is approximately 10-6 f ailure/

' withdrawal.

.The third and final condition necessary-in order for a control rod to drop, is that the control rod drive must have been moved abnormally.

A purely mechanical failure could not cause this condition without several other accompanying failures.

This product of failures leads to a probability which is much smaller than that of the other mode of failure, namely, the operator error.

In order for an operator to withdraw a control rod drive which is disconnected from the control rod,'he would have to ignore or not receive the various signals indicating a malfunction in the drive.

Even if the operator ignores an alarm and withdraws the uncoupled drive, the accident is of no consequence unless the rod is an out-of-sequence rod.

There is a Rod Worth Minimi:or (RWM) which acts as an automatic check on the operator's drive selection.

Since this report is to look into the improvement in reliability of the addition of a Rod Sequence Control

~

System (RSCS), both cases of operator error (with and without the RSCS) will be invertigated.

In order to be conservative in the calculation, a. probability of 2 x 10-3 errors / withdrawal has been used for both the operator's selection of an out-of-sequence red and for the checking performed by the RWM (or second reacter operator), the

• joint probability being 4 x 10-6 errors / withdrawal.

To arrive at the probability of a drive withdrawal for the

. Power level where only the RWM is in ef f ect, the pro-babilityof4x10-6 errors /withdrawalismultipliedby 2 x 10-errors / operation (which is a conservative estimate i

of the probability of an operator to ' ignore a signal or alarm which indicates a system malfunction).

This pro-duces a probability of 8 x 10-9 errors /withdrawa1 that the operator withdraws an out-of-sequence rod and icnorce anv indications of system problems.

At the power level when' the RSCS is also in operation the probability of withdrawine an out of sequence rod is a factor of 10-3 smaller (assumini the hard' Wired RSCS is twice as reliable as the RWM).

The probability that all three required conditions are present during a particular period of time is the product of the probabilitics of each condition.

Thus, the pro-bability of an cut-of-sequence control rod becoming stuck, disconnected, and its drive withdrawn would be 8 x 10-19 failures / withdrawal, with only the RUM being in ef f ect.

With both the RWM and the RSCS, the probability of a control rod being ready to drop is 8 x 10-22 failurcs/

~

withdrawal.

Assuming 1000 withdrawals per, year per reactor, the probabilities become 8 x 10-15 f ailurcu/ycar and 8 x 10-18 failurcs/ year respectively.

90017068 h

hD J 4-17

For mechanical reasons, the prcbability of a rod becoming

.e unstuck is not independent of the probability of its being stuck.

In order to climinate t'he complexitics of this interdependency calculation of probability, the probability of a stuck rod unsticking will be conservatively assumed

['

This means that if a rod sticks it will drop.

a to be unity.

the probability of a control rod From the above argument, failures / year for sticking and then falling is 8 x 10-18(when both the RSCS An i,

lowpowerlegelsfailures/ year when the RWW only is in effect.

and 8 x 10-1 it is necessary to However, in the Design Basis Accident,It is casily'seen that assume that there is a rod drop.

p

'y this overwhelming assumption has exaggcrated the importance of this accident.

Figure J.4.13.6 shows that there are throc reactor states a4 These are:

(1) cold-9 used in the an lysis of the CRDA.

startup (-reactor at 20 degrecs C, atmospheric pressure, and 10-8 of rated power); (2) hot-startup (reactor at 5

saturated temperature, operating pressure and 10-0 of rated power); and (3) 10% cf rated power.

No higher power

(

levels are investigated since the effects are negligible (peak in that no calculated fuel rod perforation occursThe probability fuel enthalpy is less than 170 cal /gm).

of a reactor being at cold stcrtup can be calculated using (reference 7 ).

The tine span frcm 7

the nominal startup time (pcwer) the initiation of rod withdrawal to the hot-standby In order to be con-l condition is 7.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> per startup. tha t there may be con-servative and to take into account e

ditions recuiring the operator to slow the startup procedure, 7

a factor of 2 will bc used.

Thus, a reactor is in the cold-JE Assuming four cold-6 startup condition 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />,'startup.

a reactor.is in the startups a year, the probability that is 6.9 x 10-3 The hot-startup con-cold-startup state, dition requires 2.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to pass through for each startup.

there are eleven hot startups/ year which On the average, gives a total of 61.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> / year in the hot-startup con-

,j I/

dition, or a probability of 7 x 10-3 The third condition 0

The time that a reactor of any consequence is 100 power.

JA is in this state will be very conservatively assumed to

' 9 be 1000 hours0.0116 days <br />0.278 hours <br />0.00165 weeks <br />3.805e-4 months <br /> / year.

Thus, the probability of' a reactor v

' fl being at 10% power will be 0.114.

l q Figure J.4.13.5 shows tha t the decision tree spreads into 3

hot-startup Only the ef fects of the CRDA at j

three groups.

will be discussed because it is the worst case.

Figure j

culminating in the number

.El J.4.13.7 shows the decisien tree,The analyses of failed fuel and rod of failed fuel pins.

• , j worths are for a curtain core; however, the results will The not be significantly different for a gadolina core.

rod worths are broken down into four groups., Assuming i

90047069 lNI o~o o93 J.4-10' oI 1 a

~**

k

1 e

that there has been an operator crror, and that an out-of-sequence rod has been withdrawn, the probability of

.. an out-of-sequence rod having a rod worth. of 0 to it 4 k/K is 5.9 x 10-2 The probabili.ty tha t the out-of-sequence rod would have a worth of 11 to 21 Ak/X~is 0.893.

Only a specific configuration of withdrawn rods will produce a rod worth in the 2t to 3% rango.

The probability associated with this configuratier is 4.7 x 10-2 Considering the possibility of the operator and the inttrumentation making multiple errors, it is necessary to multiply the probability of attaining a mul-tiple error configuration by the probability of the oper-ator making a second error and by the probability of the instrumentation allowing a second error to be made.

The

-probability of a configuration to produce rod worths in the range of 3t to 4.5% 6K/K is 1.7'x 10-3, whereas, the probability of an operator making a second error is 10-2 (the higher probability accounts for the possibility of interrelations-between errors).

The probability associated with the RWM allowing the error is taken to be 10-2 (same reasoning as for the operator). and the RSCS is also taken to have a second-failure probability of 10-2 Thus, the probability for rod worths in the 3% to 4.5% ok/k range is 1.7 x 10-7 without the RSCS and 1. 7 x 10-9 with it.

The next paramotor of concern is the velocity at which the control rod drops.

E::periments have been performed (the average rod drop velocity was 2.73 feet /second) and the probabilities are as shown in Figure J.4.13.7.

The scram time (903 insertion) is the next parameter of interest.

The data for actual control red scrans in operating reactors was used to obtain the probabilities given in. Figure J.4.13 7.

The scram time technical speci-fication is 4 seconds for 901 insertion.

By using the dif ferent combinatiens of parameters shown in Fig.J.4.13.7, the values of peak enthalpy (ref erence 5 )

can be obtained.

Also, these same parameters provide the needed inputs to computer codes which project the number of fuel pins perforated.

Both the enthalpy and fuel damage numbers appear in Figure J.4.13.7.

The offect of the modification on dose at the site boundary can now be assessed.

The actual magnitude of the release is affceted by many factors besides the mechanics of failure and nuclear excursion discussed here:

decontmnination factor, isolation valvo closure time, main steam and recirculation flow at the time of the accident, condenscr.outicakage, and matcorology are a few of those parameters which add uncertainty to the final result.

Ilowever, all of these factors which are not actually related to the magnitude of the excursion have been taken at the highly conservhtive 90017070 D

• D

• 3

~

1. D

~ J g J.4-19 och

. 2.1 ti _ >

o-

4 r

yg

, valuesLused.in the FSAR analysis.

This approach will demonstrate the specific ef fect ci the modification. quite clearly.

The offsite dose is calculated from the highest 24-hour whole-body gamma cose (essentially the same as the course-of-the-accident dose) tabulated in Tacle 14.4.3 of the

- Peach'Dottom-FSAR.

This value of 2.3 x 10-5 Rom is equivalent to 6.9 x 10-8 Rem per perforated rod.

In Figurc J.4.13.8.the ordinate of a point on the curve is-

'the probability per reactor-year that the dose to a hypo-the'tical individual at the site boundary, assuming the least favorable meteorological conditions, will exceed the.value of the abscissa due to the postulated control rod drop accidents.

The low probability that there will lbe any release at all is equal to the probability that there will be a rod drop times the probability that there will be 'aty fuel damaged, given the red drop occurs.

Figure J.4.13.8 does not include any of the cases resulting in peak fuel enthalpics in excess of 425 cal /gn:

under such con-ditions existing physics models cannot be used to predict the exact dynamics of fission product release.

From Figure J.4.13.7 the,grobability of such circumstances is no greater than 4 x 10- d per reactor-year with only the M.'M in coera-

~

tion and'no greater than 4 x 1029 with both the RWM and the RSCS.

i The expected value of fencepost dose due to postulated control-red drop accidents can be calculated frca the distributions shown in Figure J.4.13.8 by intacratine the respective curves.

The result is 3 x 10-E2 millirem per year before the modification and 3 v. 10-25 millirem per year after the modification.

The same hypothetical individual at the site boundary woula expect co receive approximately 140 nillire.n per year f rom natural "bac.:-

ground" and other manmada radiation sources, as reflected in the " natural radiaticn" curve of Figure.J.4.13.8.

It is concluded.that the addition of the Rod Sequence Control System acts further to reduce the impact of the CRDA, but from thc' effects of an accident whose impact.'

on public health and safety was already trivially small.

9no'7.071 g mg gy e

.w o n n

1 MIL l

. p '#

L J.4-20

CUSSIldidflull A11D Ui'LP/di:,, P L;P.Mi r LLTTLits -

REFERENCES 1.

Dray, A.

P.,

"The General Electiic Company Analytical and Experimental Programs for. Resolution of.ACRS Safety Concerns ", General Electric Co., APED-5608, April, 1968.

2.-

" Metal-Water Reaction.s - Ef fects on Core Cooling and Containment", General Electric Co., APED-5454, March, 1968.

3.

" Considerations Pertaining,to Containment Inerting",

General Electric Co., APED-5654, August, _1968.

4.

Stirn, R.

C.

et. al.,

" Rod Drop Accident Analysis for Large Boiling Water Reactors," NEDO-10527, March 1972.

5.

Stirn, R.

C, et al.,

" Rod Drop Accident Analysis for Large-BWR's -- Supplement 1," NEDO-19527, July 1972.

6.

Letter to Roger Boyd from Ivan F.

Stuart,-September 14, 1972.

7.

General Electric, "G.E.

Bi.'R Critical Path Startuo Requirements," APED-5772.

90017072 j

l J.4-21

= = muse = -in i +.

.. au.e

..m w w.

we,

. = * *

-=

e

i 1

L.UKilVL ROU 15 511)Ci; !.! NEAR FULL OP. FULL 1.:10SITf0

(

k r

i LCC5e Gi>-

WaliOL iMu FtJdL O'is nj.

FULL U D...;;.

4 Mi.\\R CJ.<TTai.

.E\\R C24'i!J:.

JJCT 1.sTL'15 BECGlHS I

ND t;'J.P5 n'0 Sl;!FT5 t'LMiii. MD DISTORI'ED U.;;Xif ECTED f.t X'.E10

~BlDCES IT F.\\ILtlPJi "ID LCUPLE CD:,TEOL LOD To ra fW O

U..C.L Pl.1;sG Tr.5T FAILS

_._ Leo:a:L P211 GT.R 0)UPLED lilTil CONTFOL CD mlW I

i P0511,0a 1.201-JPf.F.W.- i Ai 2 Ji t?.Jo JR C\\ TOR EP.'a.< -

iU TEST F M l'.CRE.5 E0JS 0\\Tr;rPX.IL C\\"dRTTR\\1L A! W.!

7 g

I I

i yr'e.t.,u v.s w :.-

Lf;C00FL L;G SF'JD E!.GERS 5:GriED INC; l'L'JJ F.A!!.;D 300 SnJCK L4 BE;T LOCKING l{

I Dr.C3UPLE Pl.lir.

AL L. uA.+ v.

p 3, g,';,;3 g

g iTSIT in.4

...,PtiR SlC.,

re.all

.w

.s St.T101E3

Ji Pf.Ci!!\\ED gg;. g.

1.4 liiu;G X Ib!T.D t.CC VI 10i

• ilTC:r S I

TT I

I

?dii;D Silici "L.D 5".'.1701 i;;i?.D SilTul I dt t' lei? li'SITIJ.;

I?R KliJ 1.ll'Jll' 1;0K C\\lR-9001 073 lat'lC\\l'lds Ol' A 1.'G\\llG4 fl'Wi!L FAILS l' "I ' >

1 % \\l104 18 i.s l \\lii Ol'!!4 r \\l! S t'i.m).0

(:I M '11 D**D

• D ~3~ Y Q

_ Jl.1/L

.oo o

~

~

e..

-n,-e-wm

+--nvr

CQiflCL TOD -

SIUCK I.4 COPL RIM 0Y FOR I1MP 1

IlI CGN1RCL l'DU SthUfED Fiuf CasTiOL 00 futW e

_(n'UCO M I F.CiRilG1 IC O J!S l

FAILUFI 1.i SUO8rG:

t

• t RimcI '

11[ DRIVE LINE Erli?.Ci l CF A; di ir Sh.':7 1

(MIICL

,.EC it's ICE l0.1VE Al b'.ruite ll \\L p,gjtgg3 gp EChIX FAl1.URl: OF D!U '.'11 T,ilt C.4TEL

,nn r mpwps7

[

bntl.,G O.s LCL: -

lt;G Fi.t:G Flt1LE3 j

L... l u.

r_' d f**0#'i.,.

,h ds.\\ de%u 4.t. c. w

'J.,

1..vLs ib e:

L% J 4'u..

Fl.;GERS C Ui'L t..G Eini/vus

$0CiJ.T

'J.LOCin

'N-

.iLC3 L!l.tlTER I;r24.4 5'tUD Disr!-

.h7 MC r \\ il <

a snra I

i T

I IO l11( A1,sd

( d'.il'l I.td e,

'111RL.\\lG L,,

r.,ts'!)

di'llo

- Z s b 0 oe o-7pv a ^ Op. to d i 6 0 e 4 C b @x dn>e a.df'* :7 i _O_ DJ s 0 "

e. o N Z 2

90017076 O n'd O O ~_ O (r +W O

1. ) b

% ^^ o ~J.E 9 e i dl_)O _O_ m 9 O DQ i ~

• itL1

".s a u. a nr r me r w e natt wtjatil g ri t< t ti tv mrt.914g twinatti ton per'r jne. Its ' (1.426:10*N) .);LO,,. 142? est/so IS90 (1.429:10* 34) (.015)> (7.8 f o*D)

f. b).6 9

)42S cal /re 1200 (7.8s10*II) 3,56 I4 7 (J D4) (1.5410f)) i425 cal /na 1810 1 1-L41-3 (1.38:10 9An Q ~ (.166) (4.9)stn-2 3 D U 1 55.S-9 1425 cel/pss 1460 (4.9) 10 y) @W c ./:2 t l0.01$) ,75-1.9 1.9-1.49 373 cal /a. 1875 0.24 10 243 (3.24a1029) . 30) i.9a)) . stia. es t 0 2,*g. . 392,gg,7,},-i) 1 26 (t'W n%Y) 425 cal /c2 1435 0 71r9)

LhLL, (9. 3 )s10"3 g))

(9.35:10 1.5 3.48 3$0 cal /ts 1035 (6.16:10* #') ?.a 7.14 /(.01)) (n,pt s g es) 16.14:10 ) 3 (.6)); " ( in) (.395sloN)) tats cal /rs 1185 M 5.0 3 (.39510 /(.015)

• I' t.5-1.49 350 cal /c, 230 (2.59,1<t ">

)t,,,,o a. 3 9 10- )

1. 4 n,-.,

.of o.ee (1.36,1(0,[> [ 400 cat / n n00 L.g4;7,33-2

1. 5-5. o,

(1.34:1 1 63 g,og3) 7.M-3 $ 1.5-) / 9 (.345) (.585) 265 cal /tn 440 (0.9 10*I') 3 (8.9:10" *) 3 ht.0.,,.9 110 e a L /r. 150 (2.$4a10 ) (2.58s40 ) (.01)) hl 2.4-?.?4 -MLQ 270 cal /tst 420 0.1:10*I ) U.7a10 l) (.655) (.955) 9 6 9,,o C 215 est/rn 3f5 (4. M e l o," ) (4.n.io ) (.,,4) 7.746 (.)45) (1,2 5,1 (I., ) Q 160 est/ o O n. 2 5. m ) ,,,,,) .01.n?1

• (.89))

.Q 190 est /am too g g,,,, g (4. 9 7 :10 ) ?.4-;.ta (.635)

• -17

'si:1 *.2o 135 ent/a= (0) (3,3a,gg 3 (2.34 sin *IU) (.726) 19 f' % t.o -22)3 to ent/ m (0) g,,g, g

1. 1. '8 (9,nSa t o

.,,. [/ ' a.at h=0.9sl0*I) n) ) 22 85 cells. n) g,ggn

- 1,. ) ' f,

[ h',j 0

1. ~

(f.es10 ) i 90017077 - 1 4,

Appendix B-

'I Taken1 from Appendix A of WAS!!-1318 i 1 STATISTICAL A.ALYSIS OF PRESSt*RE VESSEL " FAILURE" EVENTS Introduction i The objective of this discussion is te provide the basis for defining and inferring the values of probabilities of failure' events from service experience data available' on non-nuclear vessels in fossil-fueled power plant service.' Statements of probability derived from observation of the frequency of events must necessarily have associated trith them a statement of the confidence level. Also, the calculated probabilitias ~ should be considered to be the upper' limits at the stated confidence icvel that can.be supported by the mathematical procedures. Discussien When rare events arc distributed in cine, the assumption is usually made that (a) the number of events in a fixcd time interval has a Poisson distribution and.(b) the intervals betseen events have an expencatial i distribution. Two types of situations exist in which the exponential distribution ' holds on both a theoretical and cxperimental basis. If ~ components are " tun in" or subjected to preservice examinations to climinate these with manuf acturine, de fe:ts, and degraded components arc replaced or repaired, the failure rate may be assumed as constant and the intervals between failures an exponentially distributed. The t same distribution law holds for complex cystems where individual 913017078 1 c . -.,1 s . - l ~ ion) as soon components are replaced.(or restored to the original condit (1 ) as a failure occurs. A compicx system may fail from any one of a number of mechanisms be known or modes,% The details of_one or more-mechanisms or modes may ill assure with'some deg'ree of certainty, but no extent of analysis w dly all f ailure mechanisms and modes are included in a suppose that The probability of failure of the - complete description of the system. system during the time interval [0,T) is given by (1) h1 (t. - Tg) dt) F(T) = 1 - exp (-E / i o where: d g (t) = hasard function for the ich failure no e h = time at which ich mode uns kneun to be " good." t If "1" is suf ficiently large (i.e.. >5), then the term I h1 (t-t t) is j i say A. Consequently, approximately constant, E/ hg (t-T 1) dc = AT, and equation (1) becemos i o-(2) F(T) = 1 - exp (-TT) The dcncity function of time to f ailure, f(T) is then (3) dP(T) / dT = A exp' (- AT ) and the density function is exponential. 90017079 a T T T e T-49 -M t v m w E-(;1 47 - r i !I. This argument is 'the justification. for the general assumption that !i tit:es-to-f ailure for complex systems nay be ' assumed-to be exponentially

j distributed.without knowledge' of the details of the several failure 1

mechanisms or modes.' j i To demonstrat.c that the above argument holds in reality, a Monte Carlo t calculation was performed. A compicx system was assumed to fail by each of 10 dif f crent mechanisms all of which ucre.ascumed to have k'eibull distributions kinstead of exponential distributions) of times-to-f ailure. The constants for several 'Jcibull distributions were selected as shown in Tabic A.- The cumulative distribution for the lleibull function is F(t) = 1 - exp (-( At)') (4) 1 l TABLE A Failure Mann Ti.m.e-to-Failure Mechanism A n -3 1 3'.14 x 10 1.2 300 -3

1. 4 -

620 2-1.47 x 10 ~3 3 1.95 x 10 1.6 460 -3 4 1.53 x 10 1.8 560 5 1,64 x 10 2.0 540 -3 3 6 2.11 x 10! 2.2 400 7 2.61'x 10 2.4 340 ~ ~ -3 8 1.39.x 10 2.6 640 -3 9 1.78 x 30 2.8 500 -3 10 2.35.x 10 3.0 380 90017080 i-e .,_m.,,. ,.,.i...,,,- .e.- _,,.,,,.,....--.,._.d-.,,-,,_i..m,.w.w,wm-- ),. I. o ( 4 I. - A sampic of 200 intervals between f ailure was selected by the random lts were plot ted as shoun in Ficurc 1. h 'or.}ionte Carlo process and t e resu was made The selection of the abeissa, -In (1-F(t)),.and'the ordinate, t, ) because if the overall distribution was exponentially distributed then j line with a slope of-the result on such a plot-should be a straight y, since '(5) F(t) = 1,- exp (-yt) i (6) e i -in (1-F(t)) = yt. I h The relationship between y and the nean times-to-failure for the Weibu ll distribution is 1 I i - Q, 4, 9 h isn. where e =.mean time to f ailure for "ich" Weibull f ailure mec an g line in Figure 1 for the expenential distribution uith I The straight to the data generated by the Mente Carin y = 45.02 shows a good fit i Thus, although no individual failure mechanism was assumed calculat ion, ~ for the compicx to be exponentially distributed, the overall failure rate i e 9 I system is exponentially distributed. 4

follows, Reference,

, which provides the basis for the discussion that 14/ ( furnishes additional.confirmacion of the use of the exponential distri-a 4 bution ns a time-to-f ailure model, l 90017081 l i + v. ,~, ...--.-.._.-,,,c ,.y., y, -a t \\q t, ~. 41 - i t t t p 60 i' . g* t 0 50 i i i ( 40 0 i / t 30 ?/ / 20 &f 10 /. 0/ 0.2 0.4 0.0 0.8 1.0 1.2 '.n [1 - F(t)] t 90017082 i FIGURE 1 I I. ~ + e i l 1 u u L-h i. The exponential probability. density function f ~ Ae , t >,o and A>o I (7) J, f(t;1) = o, ciscwhere- .-( 'that is the most commonly u' sed. time-to-f ailure distribution, plays a central role in reliability, comparable to that of the normal distribution. The, hazard function for an exponenticily distributed variate is -At h(t) = =A (8) g-At Thus the probability of f ailure during a specified time interval is a constant depending only on the length of the interval and is the same irrespective of whether the component is in its early period of operation or has previously survived 10 years, 20 years, or 30 years. The parameter A is referred to as the failure rate. ~ 4 The time-to-failurc for a component is exponcatially distributed if the componcevent happens independently at a constant rate. Frequently, however the' ticc-to-failure distribution for a component is not exponent ially l . distributed over its entire life, but tht in-unato portion in exponen-tially distributed. The time-to-failure for the cocenonent in-uscce is then exponentially distributed, because the anplicable hnrard function is g 90017083 \\ 1 i l .l l . D constant. This is so, even if the time-to-f ailure distribution over the tctal life of the component is far from exponential. The exponential . distribution is considered more appropriate as a time-to-f ailure model Reference 15/, which for a complex system than for its ccmponent. parts. deals specifically with nuclear reactors, provides additional material on estimation of failure rates. This reference indicates that a mathe-matica11y acceptabic method of esticating failure rates is to use data The from the opnrating history of the reactor or similar type vessels. method can be used if the failures are assumed to be distributed as a Poisson process with gamma-distributed waiting times to failure and exponentially-distributed interarrival times. These asumptions are valid if it can.be assumed that maintenance and repair res' ult in no year-out effect. The degree of accuracy obtained in estimating a f ailure race is directly related to the amount of operating data available. As an example, if a .. component _ decs not. f ail in 15. years, estinating its f ailure rate presents some difficulty, llowever, its failure rate is Icss than for a compenent that f ailed once in 15 years. Using this concept and the above-stateJ distribution theory, an upper confidence limit may be placed on a ' component that has no observed failurcs in an observation time T. The lower 1-o confidence interval on the population f ailure r.uc v, given ' as a probability statement, is 2- (2nk). (9) X .P [0 1 v 8 1-n -/2T) = 1-n 90017084 ,-,r, l 'i a . l where: a = probability that an observation from the hypothesized population I will randomly occur outside the confidence interval, n = number of failures observed 'in time interval T, X _( * ) = 1-a percentile of a chi-square distribution with 2n+2 degrees of freedom, v = population alue of failure rate per year. bL!' 1b!' E provide more details on failure rate j References l i confidence intervals. The above formula from Otway, et al,15/, is a special case of a much more I / general formula developed in this discussion to compute the confidence The basic intervals for' the parameters in Poisson and binomial processes. are the limits that define j assumptien is that the quantitics of. interest j l an interval of the frequency corresponding to the stated confidence levci, A distribution function,20/. C (rlc, c) conditional on the observations. is defined as follows: r (10) G(rlc,c)=P(Acclc,o)=/ g (Al c,c) d A, A?,o J vhere P (Asrlc, a) = the probability that thc. fregt ency, A, is icss than or and a, equal to r, conditional upon e the obnerved count, the hypothesis of the prior dcocity of the frequency. 90017085 i l ~

e 53'-

4 The. density. function, g ( Alc, a) is assumed to be given by Dayes' theorem-1 2 - in the following form: f(A)- 'h(cl A) (11) g(Alc, a) =, f(A) h(clA)dA f o For a Poisson process-c -A (12) h(cl A) = for (C el A >o where: A = the true frequency or the ev.pected number'of events during the period of observation. c = the observed number of events. ' The density function f( A) is conveniently chosen to be a gaena density, i.e., s ....~s .s,.. ( f(A) = for A>0, S>0, K>0 (13) This density has two parameters'S and K so that appropriate choices for a their numerical values can repre.acnt a variety of assumptions concerning, the "a priori" distribution c'f A. In particular, the ch51cc 0 = 0 and K = 0 corresponds to the assumption that A is uniformly distributed between.:cro and infinity. This means that no particular value of A i in favored over another prior to obtaining, the statistical data. l 'l t 90017086 L i e g e-7 w rvw 4 .e-t&>-O TM, 9 9 y me w 7-gow 9-7 w V' Mn- ,w-'w w-y-W+- i g-t 4 m k By combining these considerations, the dencity function, g(Alc, B. K) is a gamma density. 1 + 6)"+K+1 A "+K ~A(1+G) g( A l c, S. K) = ((c+K+1) e The value of the integral of this density function is equal to the The relation-chi-square integral whenever K = 0 or a positive integer. ship 2/ 2-is P(Atrlc, S, K) = P '[ X s2r(1+3) l v = 2 (c+R+1)] (15) 2 al.15/ when S = 0 and K = 0. This formula becomes identical to Otuay, et Therefore, Otuay, et al. are presumed to have made the "a priori" assumption that X is distributed uniformly between zero and infinity. This "a priori" assunption is seeming,1y a safe and most reasonabic ene since it really amounts to an unprejudiced attitude with respect to what A tnight be p,rior to, co11ceting the da.ta. A short listing of values derived from the above formula for the case of the "a priori" assumptien that A is uniformly distributed between zero and infinity, as utilized in the determination of failure probabilities stated in thin report, is nhown in Tal lo 11 (For values other than thode listed refer to rigure 2.) 90017087 D "" 6" D 6" if 6B ~ j b o) oj u Al f 't i n ~ 55 - j l i, TABLE B i - I STATISTICALLY-Tt!FERRCD tRRIBER OF OCCURRE!!CES Confidence Level Observed flurber of Occurrences - n. 90% 95% 99% 0 0 2.3 3.0 4.6 1 '3.9 4.7 6.6 2 5.3 6.3 8.4 6 10.5 11.8 14.5 13 18.9 20.6 24.1 100 114.2 118.2 125.4 A Monte Carlo calculation was performed to verify the values frem the above table for :cro cbserved events. Monte Carlo "er.periment s" on digital computers utilize their capability to make random selection of numbers in order to produce results completely independent of analyticci ~- methods. llowever, the sampic sine selected must neenssarily be finite, and consequently the resulting values will not be equal exactly to those achieved by analytica[ methods using the infinite limit. Poisson processes were sciccted at randou with A's uniformly distributed between :cro and infinity and a count was obtained on cach process. If the count was :cro, then the corresponding A was added to the sample; D**D

• D ~T h

_2.A m se e-90017088 Y f e ,, _ _,.. A.gq _ 2 o 7 o 5 <= oG 1d i e G g - t $o O O z o e C C \\ o D c-0 \\ 0 g O g t

u. m 1

OO i b W C m m O O O o z 2 'D VJ D \\ EN \\ UW OO l -i \\ IO 'O O. O o O \\ wc in u G-W O XO W g E w QD cc UJ 2 5 g O. g k Q N >@ t I O E s O 2 w >n to C J o I \\ w J i tn O O O z, o O yC O' W W \\ \\ i-M \\.. \\ N o W I (N C'. DO E s_N = s \\sx\\ 1

s. 6, s.

\\ \\ o o l l 90017089 i ..e' Q w.,,,w.... a..d v - -- ~ ~ ~ -- w 3 I i. I. otherw!.se the process was discarded. This procedure was carried out The results are tabulated in until 20,000 frequencies had accumulated. Tabic C. TABLE C N. ilumber of Frequencies Percentage of Total- ~ Upper Limit-on Less than Uoner Limit Confidence Value t Frcoucncy, A 90.115 { 18023 2.3026 r 95.135 l 19027 2.9957 99.020 [ 19804 f 4.6052-f

figures, The upper limits listed are the values, to five significant 907;, 957;, and 997; ccnfidence and for zero observed f,

from Table B for Obviously, the results demonstrate that the Mente Carlo and { i events. analytical values are in excellent agreement. t, i the methods j These results are judged to be an adequate denonstration that discussed can be applied..to estimate the range cf f ailure probabilitics for the case of from statistical service histories of prassure ves:cis, either a finito number of observed f ailure events or the absence of any i. failure event. 90017090 l D"*0

• 9 T y gy

. 2 1.\\.[f%, 'od e. a 1 ..