ML20125D495

Control Rod Drop Accident (Bwr)

ML20125D495
Person / Time
Issue date:	06/01/1976
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20125D471	List: ML20125D468 ML20125D476 ML20125D479 ML20125D493 ML20125D495
References
REF-GTECI-D-03, REF-GTECI-SY, TASK-D-03, TASK-D-3, TASK-OR NUDOCS 8001140331
Download: ML20125D495 (70)

Text

. - . - .

+ ,

..' t i.

CONTRO$R0DDROFACCIDENT(BWR)

Int'roduction The ACRS list of generic items relating to light-water reactors includes Item IIA-2 " Control Rod Drop Accident (BWRs)". In status report number 4,' dated April 16, 1976, the ACRS provided the following brief description of the scope and intent of this item.

"Some uncertainties have arisen in previous calculations of this postulated accident, including the choict of negative reactivity insertion rate due to scram and the potential differences between a two dimensional and a three dimensional calculation. Particularly for the latter point, more precise theoretical comparisons may be required to resolve the matter although probabilistic considerations may be relevant."

The staff considers this generic item to be resolved, although work will continue on three-dimensional ar.alyses as part of the on-going programs to improve methods of transient analysis. This report summarizes the history and status of the review of this topic. The discussion of the early phases related to reactivity insertion rates is brief since the documentation related to those reviews is extensive.

The consideration of three-dimensional calculations is discussed in somewhat more detail since it has not been previously documented.

ReactJvity Insertion Initial concern with the suitability of the GE analysis of the rod drop accident (RDA) arose during 1971 as a result of generic studies on transient analyses by our consultant, Brookhaven National Laboratory (BNL). These studies indicated no general problems or

- disagreement with the GE analyses or results except in the area of 90017021 y

1 2

8001140 _.

(

..'. s

, i control rod reactivity insertion rates. These reactivity insertion rates, and especially the scram renetivity, were substantially non-conservative because of the use of control rod scram movement rates faster than specified in the Technical Specifications and the use l of inappropriate spatial reactivity functions (i.e., reactivity inserted as a function of the fractional insertion of control rods).

The latter in particular,was the subject of extensive BUL studies that examined the validity of reactivity. representations in model geometries where spatial variables of importance were not ex-plicitly described. Since, as will be discussed further in con- r nection with the three-dimensional problen, the GE model is essentially a for of point kinetics (zero dimensional), the suitable representation of reactivity inputs is important. .

As a result of the concerns arising from these studies, and in conjunction with some improvements in the GE model, GE reanalyzed the RDA. The reanalyses incorporated the suggested changes in the i control rod reactivity functions, both rod movements in accord with Technical Specifications and spatial functions determined by methods comparable to BNL's. The calculations and results were reported in i 1972-73 in NEDO-10527 for beginning of first cycle (BOC) in BWR 2s and 3s, in Supplement 1 for BOC in BWR 4s and 5s, and in Supplement 2 for both types of cores later in the first cycle and in the second cycle.

BNL also did a series of calculations of the rod drop accident using one- and two-dimensional (R, Z) kinetics codes and their own developed version of the GE model. The more significant of these calculations and comparisons were reported on in many BNL reports  !

L 90017022 i

t which received external distributien. Tnese have all been distributed to the ACRS. Included were the following reports which discuss re-activity functions and methods, and transient analyses and check calculations.

'" Rod and Scram Bank Simulation," BNL RP-1018, August 1971.

" Application of Reactivity Weight Factors to Reactor Transients," BNL RP-1020, March 1972.

" Rod Drop and Scram in Boiling Water Reactors, Part I,"

BNL RP-1021, April 1972.

" Rod Drop and Scram in Boiling Water Reactors, Part II,"

BNL RP-1027, July 1973 "Gadolinia Shimmed BWR Rod Drop at Zero Power," and

" Curtain Shimmed BWR Rod Drop at 10% Power," Progress Report for Reactor Safety Analytical Support, May 1973 "Gadolinia Shimmed BWR Rod Drop at 10% Power," Progress Report, July 1973 The review and check calculations and comparisons of the GE reanalyeis were favorable. GE has switched to a suitable control rod reactivity representation and the comparisons with various BNL

. calculations were satisfactory. In our topical report review of NEDO-10527 several incomplete aspects of the review were noted, such as the 10% power and gadolinia core check calculations. These were subsequently completed (see the last three listed BNL reports) with 90017023

4

• o

-u-

' satisfactory comparisons. A final wrai: ap package involving a series of one-dimensional sensitivity calculations to relate the two-dimensional check calculations to a more approcriate range of dropped rod reactivity insertions was planned. This was not completed, however, and it has now been decided to await the co=pletion of future three-dimensional studies (see below) before completing a formal wrap-up. However, we have concluded that the initial problem has been resolved and that the GE calculations are suitable.

Need for Systems to Minimize RDA Meanwhile, the review of the reanalysis and the recognition that for a given control rod worth a higher fuel energy was predicted lead to an interest in an improved Rod Worth Minimizer (RWM) system to add assurance that a high reactivity worth, non-sequenced rod is not withdrawn to become a candidate for the accident. In response to this interest GE developed, in mid-1972, the Rod Sequence Control System (RSCS), essentially a hardwired version of the computer-controlled RWM.

This, in particular in its most recent form, the Group Notch RSCS, has - 4 been approved and is (or is being) installed in BWR 4s.

This posed the questaan whether to backfit RSCS on BWB-2s and 3s. To answer this, the staff carried out (in early 1975) an independent analysis of the probabilities, individual and combined, of the multiple events that must occur in order that a rod drop accident exceed the staff acceptance criterion of 280 cal /gm in the hottest fuel pellet.

This analysis was described in a June 1975 memo, "A Statistical Exam-ination of the RDA in Some BWRs," and was presented to the ACRS at the March 23, 1976 Subcommittee meeting on reactor safety in Chicago.

( ' A copy of the memo is provided as Appendix A to this report.

90017024 l

, - - -- , , ...,w.. -

r - n -, ---

- . . - . .. ~ _ _ -

s The study determined that a reasonable (and'quite possibly con-servative) estimate of the probability of having an RDA exceeding

-12 280 cal /gm is about 10 per reactor' year, without including any factor for the use of a RWM or RSCS. This indicated a large margin  ;

-7 to an acceptance criterion of.10 per reactor year, and allowed for considerable uncertainty in the input information or unforeseen in-

.teractions among. elements of the analysis. In addition, all BWR 2 and later reactors do have RSCS and/or RWH systems and Technical Specification requirements for their use. This result was the technical basis for the decision not to require backfit of an RSCS on BWR 2s and 3s. It also, of course, indicates in general the low probability of encountering a limiting RDA.

A further indication of margins existing in the RDA is the relation of the maximum expected sequenced rod reactivity worth to the rod worth for which the criterion of 280 cal /gm would be

~

exceeded. Typical maximum sequenced worths are less than 1% Ak.

(See, for example, the Shoreham FSAR where the peak maximum sequenced )

worth, at cold clean conditions, is about 0.9% Ak and usually much less than that for other conditions). From the results of Supple- l 1

ments 1 and 2 of NEDO-10527 we see that rod worths to reach 280 cal / )

gm range from somewhat over 1.4 to over 2.1% Ak depending on time in cycle (BOC is lowest) and cycle and assuming scram at Tech Spec velocities (1.6 to 2 3 at measured scram velocities). A 0.9% Ak rod results in only about 150 cal /sm (assuming 1.4% Ak gives 280 cal /gm). -

90017025 l

l

i j, e i

9 Importance of Dimensional Order Another possible RDA analysis problem was raised by an article by Birkhofer, Schmidt and.Werner (to be referred to in this memo as BSW) in the October 1976 issue of Nuclear Technology comparing the results of three-dimensional with lower-order analyses. The main theme of this article may best be summarized by the final paragraph which states "The conclusion to be drawn 18 that space- and time-dependent effects in large LWR cores with space-dependent feedback can only be predicted correctiv by performing ,

genuine three-dimensional calculations. All lower dimensional simulations of tne problem may produce non-conservative results." (underlines added)

The authors carried out some comparison calculations to come to this conclusion. .

We reviewed this paper and sent requests to each vendor to also review and comment on it. We subsequently reviewed these comments, in 1

particular those of GE, and evaluated the applicability of the BSW study l

I to vendor analyses. Also, our consultant discussed the paper with the authors during a European trip. Since it has not been previously reported, a brief discussion follows of the applicability of the study and its conclusions to the LWR vendor's and especially GE's analysis models.

Using their own developed three-dimensional kinetics code (apparently fast running) BSW did parallel XYZ, RZ, XY, and R calculations on what was approximately a small (about 7 ft. diameter by 9 ft. high core) BWR at ,

l' zero power. The calculations of primary interest were of the rapid removal 90017026

__. _ _ . . _ . . . . . . . .._ ~.

1

_7. .

(less than.1 second) of an off-center control rod, which was made ,

a center' rod for RZ and R calculations. Results may be generally l characterized by comparisons in two parts.

1. No Z component, i.e., XYZ vs XY and RZ vs R

2. Off-center to coater, i.e., XYZ vs RZ and XY vs R Both comparisons show a ratio of about 1.4 between the peak local energies of the higher and lower dimension results.

An important missing element in the study was the failure to consider sufficiently the role of auxiliary calculations when doing lower order calculations. (Perhaps if they had gone all the way and included a point-kinetics calculation in the study, this shortcoming might have become apparent since eupplemental parameters would have been required.) A prime exan.ple is found in the no-Z component l l

l calculations. No axial peaking factor was supplied or considered l (as any of the vendor calculations would have). For the geometry of the reactor analyzed, the appropriate peaking factor would have l been approximately 1.4, the calculated discrepancy.

An illustration of vendor use of auxiliary results to augment i

a lower order calculation is the collection of Westinghouse design l l

calculations described in the rod ejection report, WCAP-7588. The l calculational model is effectively a zero-order, point-kinetics approach (actually a 1D-Z kinetics) with auxiliary calculations to supply conservative peaking factors and reactivity feedbacks. For example, transient peaking factors are calculated, statically,

- without reactivity feedback to maximize peaking, and feedback is-90017027

I i

l estimated with a full feedback-reduced power distribution to 1

minimize feedback weighting. As expected, comparison with three- j dimensional calculations (described in the WCAP) indicate a high degree of conservatism. In reference to the previously underlined l

" correctly" and "may" in the BSW conclusion this Westinghouse ex-perience is an illustration that while lower order calculations will not directiv give " correct" resulta and if not altered they "may" be non-conservative, suitable modifications can be introduced into the lower order analyses to provide suitably conservative results.

The GE analyses do consider Z component peaking. The GE design method (described in NED0-10527 and Supplement 2) is a point-kinetics model with rod drop and scram reactivity functions from auxiliary three-dimensional, XYZ, calculations and power distribution functions and Doppler feedback weighting factors from concurrent static RZ multigroup calculations. (Moderator heating, particularly prompt heating from neutrons and prompt gammas, is not included in the model and this can be a significant conservatism.) The RZ power distribution calculation maintains the dropping control rod throughout the transient at one axial position, approximate 3y the position at the time of the first large rise and turn around in power. Since, for the control rod reactivity worths of interest, there is a significant axial movement of the peak throughout the transient (see, for example, the "three"-dimensional power distribution figures in the previously referenced BNL reports, e.g., RP-1021), this model produces a

~

conservatively large energy rise in the peak axial fuel pellet.

90017028

- - - - --..w-- 5 e-% e c %-e7._,s w p, m-t- vT-

)

s, e e it might appear that of perhaps more interest to the GE BWR analysis is the off-center to center comparison. However,-in this case.it is evident that the BSW ccmparisons were complicated, and.

we believe rendered of doubtful direct value, by the changes in the reactor center local rs geometry which were apparently introduced into the proble he B region in BSW) by the re-quirement to maintain a given ,aiue of control rod reactivity worth ,

for the two configurations. These modifications cause changes in power distributions in the vicinity of the dropped rod thus changing peaking factors for obtaining peak enthalpies, Doppler feedback weighting factors, and evidently reactivity insertion rates (see reactivity insertion figures in BSW). Indeed the problem of simul-taneously maintaining several important factors constant in one l calculation while shifting basic geometry is a difficult one.

However, in our view a suitable continuation of a BSW type study would have been to complete several more calculations examining consequences of. geometry changes in detail to develop suitable auxiliary multipliers, weighting factors,'etc., to apply to ap-proximate or lower order geometry calculations.

The GE model, which as noted is essentially point-kinetics with several separate auxiliary calculations for reactivity and ,

peaking input, does not encounter these difficulties. The rod and scram reactivity-functions come from full XYZ calculations when ,

I

( required (see Supplement 2 to NEDO-10527), or from a suitable

• reduction to RZ when such a configuration is adequate (and in 1

i 90017029

"' z- " v~' ---

m.- . . e w.., . . , ,y.y..,

- . v. .

>+

- 10 ,

nearly all of the cases of interest _the maximum worth sequenced rods

- are central or central-like, i.e., not near boundaries and thus in sig-nificant regional flux-neutron importance gradients). The concurrent- -

power distribution-Doppler weighting calculations are RZ. However, the local geometry and cross section distribution around the dropping rod are appropriate 1y' preserved. It is this modeling in the region of -

the rod which is of primary importance in determining feedback reactiv.. y 1

ity and peak energy deposition.  !

1 Conclusion l l

Our review has indicated that the GE model ic not subject to the particular problems pointed out by and encountered in the BSW l

paper, and we continue to conclude 'that the GE analyses and results l l

are suitable even though the model does not consist of a full three-dimensional space-time-feedback kir.etics analysis.

• However, we recognize that such an analytical tool would serve a useful role in confirming this evaluation. Analyses have been 'l carried out with alternate methods only because the three-dimensional I

codes have been unavailable or too time consuming to operate. In I particular they have not been available to the staff or its consultant.

As part of the continuing generic review of transient analyses, the staff and BNL have recently acquired the new MIT-EPRI three-dimensional kinetics code, MEKIN, and'are working to get it operational. Depending on its operating characteristics and practicality, it will be used to study problems of the type covered by the BSW paper.

90017030 1 m- - - - . y =*.yte -.- ---.s--- ,s -. m, -w--rpp - - -w- *-,ee

-. ; q..

3 Thus,'with the perspective of the studies, reviews and eva'lu-ations regarding'the original reactivity' insertion-rate problem and the question of dimensional order, and the margins existing both in the probability of an RDA exceeding the 280 cal /gm criterion and between' generally expected: maximum sequenced rod worth and that required to reach 280 cal /gm, it is our conclusion that the uncertain-ties identified by the ACRS generic item about the RDA analysis have

.been resolved.

90017031 f

f L

i i

l l' , - , , _. , , _ . , . , - . - . - , . . , . - , . - . . . _ . , . . . . , . -

l APPf A: O r X 1:

9' .

A Statistical Examination Of The RDA In Some BWRs j

Summary This memo examines the probability arguments and related information analysis involved in decisions on requirements for additional elements (hardwarc or Tech Specs) to reduce the likelihood of having a BWR rod The memo drop accident which might exceed the 280 cal /gm criteria.

presents the purpose for this examination, the statistical approach to be (a rod drop exceeding 280 used, and develops a criterion f or judgement Previous cal /gm should be less probable than 10- per reactor year).

studies, comments on the statistical methods used in these studies, and information sources explored to provide probabilities for these and the present study are outlined. The events which are required in order to have a red drop which exceeds 280 cal /gm are examined and the conclusions reached from the information sources as to the probabilities for these events are given.

The results of the study indicate that a conservative estimate, based on the information examined, of the probability of exceeding

-12 per reactor year. The uncertainty 280 cal /gm is on the order of 10 ~

-) is of this result is discussed and a possible maximum probability (10 additio'nal developed. Based on'these results it is concluded that

~

hardware is not necessary, llowever, encouragement of RbH eperability (through Tech Specs) is desirabic.

s 90017032

- = ._ . -.

_2

! Purpose _

.The purpose of this memo is to develop a technical background on the events involved in the BWR rod drop accident (RDA). This is to assist in decisions.which need to'be made on requirements for additional hardware or Tech Spec changes relating to the RDA for some of the operating BWRs. The reactors 'to be considered are the BWR 2 and 3 classes (Oyster Creek through Pilgrim)'plus Vermont Yankee. These ten reactors do not have a Ro'd Sequence. Control System (RSCS). A primary decision needed.is -

1 whether these reactors should be required to install a RSCS or alternate equipment such as a template, which some applicants have claimed to be equivalent. (This memo will not address the merits of this equivalency

~

j argument .) A parallel question is the need for Tech Spr. chang'es to require more certainly the operability of the Rod Worth Minimi:cr (RWM).

The obvious intent of these requirements, if imposed, would be to reduce the probability of a RDA with excessive rod worth such that the 280 cal /gm criteria might be exceeded. Thus, the purpose of this memo is to ,

examine the need for such added probability reduction for these 10 reactors.

This memo will not directly address this question for the 3 or 4 older BWRs (D-1, Humboldt, Big Rcck, Lacrosse), where differing mechanisms, Itowever,  !

patterns and worth might produce different quantitative results.

the analyses would be similar for those reactors, and quantitative '

- results might well be expected to be of the same order.

i f

w- t t- w . ,e d-..a r .+- ,s- , , . = . . .

- ,er..s . + - -- w- - c ew .,

I

--3 It might be added that an additional purpose of this memo is to istical analyscs take another'small step down the path of quantitative stat least of reactor safety problems, and a. reminder that in some cases at the step is (apparently) not too difficult.

Approach '

Since the basic nature of the decisions to be made is primarily

) . i.e. , are ,

probabilistic(atleastbofarasthedecisionistechnical '

h to be used additional probability reducing elements needed, the approac d

is an examinatien of the statistics of the involved events, singly an Thus, we will exarine all the events required to produce in combination. b bility a P2A above 280 cal /gm, estimate (hopefully conservatively) the pro a f

of their occurrence, combine them to form an (conservative) estimate o i h a criteria the probability of the total event and compare the result w t A

for these 10 reactors.

which we will develop to judge such an event detailed fault tree analysis of the mechanical failures of individual l f l componets in the control rod - rod drive system will not be a part o J

)

this study.

Instead,.the analysis will be based on information on the failure (i.e., disconnect or sticking) of the rod system as a unit.

It is recognized that quantitative probabilistic analysis in this Regulatory approach, that form is not currently a generally prevalent for the RDA have been ,

previcus attempts by CE in this area (Ref. 1) disregarded, and that there have b'cen numerous manaccrial statements  !

Nevertheless, 1

about not rushing into WASit-1400 (Ref. 2) type reviews.

90017034 o""o "3 mr -

~ . AR a i

u..- -w-t* - - -sw .-

i

-4_.

. this appears to be a problem area amenable to this' type of analysis and one for which a decision is not otherwise obtainable (and has not been obtained) except by arbitrary flat based on subjective probability feelings.

The memo will not discuss the accuracy of CE calculations of the RDA, It will be assumed that it is sufficiently accurate (conservative) for this type of study. The present review of the 3-D vs 2-D analysis variati6n as applied to the GE analysis methods does not indicate the likelihood of an important inaccuracy, and the final results of this The study would not appear to be sensitive to potential variations.

amorphous nature of some of the information presently readily available to us on some.of the areas of the analysis and the effect of the results will be discussed later in the.neco.

Criteria A probabilistic study of this type requires a criterion in order to provide a basis for judgment. Just as probability studies are not I

y prevalent analytical tools in NRC, criteria for use in such studies are 3 The i

also not prevalent. Thus, one will be developed for this study. .

s too unrealistically 5 attempt will be to choose a criterion which, while not 9

harch, is appropriately conservative and casily defensible in the context of present NRC positienc and precedents.

~

90017035 s

-T 0

Y. 2 . _ -. . , _ , _ , . . - . . . _ . _ . . ,

e The criterion will take the following form: For the ten reactors

- under consideration,.the probability of a RDA exceeding 280 cal /gm shall

~7 0therwise, additional elements be icss than 10 per reactor (one) year.

must be provided to attain such an objective.

=There are three related Regulatory studies (known to me) ' offering pertinent information or viewpoints on this criterion.

The most directly 6'seful of the Regulatory staff studies is reported a

in WASH-1270 (AT'w'S) (Ref. 3). This report establishes, in effect, a safety objective level such that ArWS becomes a problem if it can occur

~

more probably than 10 per reactor year. The viewpoint cf RASH-1270 can best be indicated by quoting from pages 16 and 17:

"The staff believes this safety objective is met by requiring a design basis accident envelope that extends to very unlikely postulated accidents, and by establishing the further objective that accidents not included in the design basis envelveu should have an average recurrence interval of at least a thousand years for all nuclear plants combined.

For an anticipated population of about one thousand nuclear plants in the United States by the end'of the century, the saf ety obj ective will require that there be no greater than one chance in one millicn per year for an individual plant of an accident with potential consequences greater than the Part 100 guidelines." .

and from page 19:

"The safety objective is that the likelihood of all accidents with significant consegrences not included in the design basis envelope should not be greater than one chance in one million per year, i.e., should not occur with a failure rate 4

l

4 a

'6 '

~

greater than 10 per year. For the particular potential failure path of ATWS, the staff believes that a failure rate of the order of one tenth of the overall safety

. objective is an appropriate objective. 'Thus, (the prob _7 "

ability per year of an ATWS event should be 1 css than) 10 .

~

Note than that 10 .was based on a thousand reactors in operation.

If only. ten had been involved, presumably the criterion would have been 10

-5 ,

WASH-1400 (Reactor Safety Study) does not directly develop such a criterion, but does produce probabilities for the occurrence of accidents in several consequence (release) categories. For BWR Category 1 accident-

~

. sequences, the median probability of occurrent.e is 9 x 10 per reactor

~ -5 . lower and upper (5%) bounds) and Category 2 is 20 x year (10 and 10 l

10~ . 'Since it is doubtful that the (non-sequenced rod) RDA above 280 j cal /gm sequence would reach even Category 2 (less likely Category 1) ultimate release mechanisms, holding the probability of the accident to less than 10~7 per reactor year would seem not to affect the WASil-1400 I

results, and in particular, not even the release Category 1 results.

Note: For the BWR " Category 1 involves a steam explosion in the .

reactor vessel in which about half the core is involved. The steam j cxplosion ejects this half of the core from the containment. The j resulting exposure of the' finely dispersed molten fuel to an oxidizing atmosphere results in the largest release of radienctive material of all the accidents." The non-cequenced rod (maximum worth 2.5 - 3.0*: oh) 90017037

'w+

e s

9

- 7- ,

' ' RDA vould be expected to result in a maximum enthalpy of the order of

~

500 cal /gm in a small axial region of a few fuel pins, nnd a molten condition (the order of 300 cal /gm) in a limited axial region of several While

-(the order of 16 out of a total of the order of 500) assemblies.

the staff has not been convinced by the mechanical disruption calculations

. performed for this enthalpy range (thus the 280 cal /gm limit), neither is it persuaded that this enthalpy distribution would necessarily lead to vessel rupture.

The third study, WASH-1318 (Pressurc Vessel P.cliability) (Ref. 4)

However, it is even less directly related to the desired criterion.

does develop the position that present knowledge leads to the conclusion that "the upper limit (99% confidence) probability of a " disruptive

. failure" event occurring in any one nuclear vessel during any service

~6 ~

." By i= plication, this year f alls within the range of 10 to 10 leads to the tacit assumption that since vessel rupture is not presently an analyded accident that the 10

~

level might serve as a suitable criterion.

there is a We may, thus, conclude from these three studies that

~

reasonable basis to conclude that the 10 value can be used as a suit- .

ably conservative criterion (and note again that it is a factor of 100 ,

more conservative than the ATWS criteria).

Previous Studies Just about overy

- The probabilistic analysis of the RDA is not new.

vendor - applicant reference to the RDA begins with a qualitative J

-t, Ediscussion of the required events and a subjective statement about the total ~ unlikelihood of the sequence. There have been (at least) three attempts at a quantitative analysis. Two were by staff members and the third by GE'in the course of the RSCS development and review. The.two.

staf f reviews (Ref. 5 and 6) uere cu"rsory and intended only as initiating examinations. They contained little quantitative probability infor-mation (and most of that used was' inappropriate) and contained fun-damental drrors in the statistical analysis. Except for passing mention The GE analysis, Ref.

they 'will not be considered further in this memo.

1, (presented in Amendment 22 to the Peach Bottom FSAR and attached as The-probability Appendix A to this' memo) is considerably more satisf actory.

analysis is fully quantitative and the statistical approach appears to be suitabic. I't is incomplete, however, primarily because of a lack of quantitative bases for the event probabilities. They are simply stated and no backup data is offered. The remainder of the report will present extensive ccmparisons with the GE analysis.

It might be noted that the two staff reports produced a " result" or 1 css per reactor (based on my interpretation) of the order of 10-year of "too large" a RDA,.while the GE analysis results were of the

-19 While this indicates a large variat, ion in outlook, they order of 10 .

all meet the critorion (none of them developed its own criteria).

90017039 a

v-

/

-9, 4

Comments-on Statistical Methods The statistical models involved in this analysis are not complex, As an exampic.of however, they must be considered with some care.

potential pitfalls, consider the following probicm:

Given: .A years B actions / year, thus, AB actions

' C result is D* result 2s llave: C/AB result is/ action (probability of result ./ action).

D/AB result 2s/ action Probabilit'y is CD/A B that there will be combined result 1 and 2 per action and: .

CD/A B combination / action x B action / year 9

Gives: CD/A"B combinations /ycar But also have: C/A result 1s/ year D/A result 2s/ycar i

Giving: CD/A combinations / year Which is not the result above!

" .This may appear, either paradoxical or obvious.

The solution is that the second answer is for results occurring together (in the same

, 1 90017040

~

l-

o ,

p as is the year), but not necessarily . associated' with the same action, For the RDA, where the results are the (independent)

~

first answer.

disconnecting and sticking (and erroneous withdrawal) o'f a rod, the results must occur for the same rod being withdrawn (action), not just in the same reactor. The point is apparently sufficiently subtle that both staff reviews-chose the wrong path and thus, had no. chance of producing correct analyses. (Note that if there'are n results, the

. For n equals 3 and 10 rod withdrawals per answers wi,11 differ by B"~

6 The GE analysis is correct in year, the answers would differ by 10 .)

(It might also be this respect. Form one will be used in this memo. .

noted that one of the staff reviews also introduced " duty cycle" time' factors without recognizing correlations between failurcs within a " duty cycle".)

This memo will not delve into f ault tree analyses for the mechanical Attention failures leading to such phenomena as sticking and uncoupling.

will instead be confined to information on probabilities of the final event (s) , e.g. , uncoupling. The discussion will generally be in terms of events per rod withdrawals. The GE report made some limited display of fault tree development. It was not sufficient to catch the sub- .

sequently found strainer movement uncoupling mode of Dresden 2.

The basic assumption implicit in this (and the'GE) analysis, involving the multiplication of the probabilitics of the several in-dividual events, each of which must occur, is that each failure (event) e.

90017041 t

i rate is' constant in " time" (and, of course; the several cvents are not correlated). In this case " time" is the action space (i.e., per rod withdrawal) previously discussed (e.g., uncoupling per rod withdrawal).

Since we are dealing with the " rare" event, i.e.", many observations (of rod withdrawal) and few failures, the appropriate distributions to be used appear to be Poisson (and exponential intervals). A brief but useful discussion in this area is given in Appijdix A of WASH-1318 which is appended to this memo as Appendix B. Also given in this appendix is a discussion of the accuracy of estimating failure rate from limited observations based on these distributions (see also WASH-1270, pages 53-55), where it is shown that the chi-square distribution of the mean failure rate can be used to develop a confidence level for the failure rate estimate. Figure 2 of this appendix can be used to determine expected failure rates from observa ions and a desired confidence level.

For example, zero observations of a failure lead to an estimate of five

.' failures at a 99% confidence level and three failures at a 95% level (for the X number of withdrawals observed). The " desired" confidence level is, of course, debatable, WASH-1270 used 95, WASH-1318 used 99.

For this memo, the available information is sufficiently amorphous that .

the difference does not materially affect results. Where a choice is l'

~ ~

made, it will bc 95. D <* "" D D "D o o Ju o .2.1 o Information Sources The information base drawn on for this report is far 1 css complete and detailed than would be desired for a thorough, minimum uncertainty probability analysis. It consists primarily of (1) a computer printout 1

90017042 l

l

.~- - 12 '--

of ','all" apparently related A0 reports in its (OIE maintained) memory, (2) Semi-Annual Reports from utilities, (3) discussions with relevantly experienced project engineers in Operating Reactors, Operator Licensing,  ;

and Operation Evaluations (OIE) branches, and (4) previous years of experience dealing with the RDA. No attempt was made to extract detailed data from GE or utilities. As previously indicated the GE study contains little-explicit failure data as a basis for the probabilitics used.

An A0 reporting system in which all failures relevant to the RDA vere fully recorded into the computer system would, of course, constitute a suitable data source. There is ample indication that this is not the case, however. Discussions of insufficiencies in the data for individual failure areas will be presented later, but it might be noted as an example that known data on stuck rods and non-sequenced rod withdrawal appears to be missing from the data bank.

A more intensive and complete data retrieval was not attempted for

• this review because it does not appear necessary within the contexture of the results, criteria and cone'.usions, that a more pr ecise result be produced at this time. This too will be discussed latcr.

Withdrawal Data We will now examine the experience space we have.to work in, i.e.,

the number of rod withdrawals which have occurred in relevant BWRs to provide failure rate information, and the expected frequency of withdrawals in the reactors which this memo addresses so that probabilitics may bc converted to yearly rates for comparison with the criterion, o " lo 90017043 u

~ M 2*o m mLUL l l' .

L L . , . . .

c . . .. . .. - . --

I, .

We.will consider only.U.S. reactors since our information sources are limited to those.- The reactors of interest are listed in Table 1, i

.along with'the number of rods, tha year of startu'p and t eh approx mate years of operation.-

TABLE 1 Reactors Yr Start Yr Exp.

1. of Rods 69 5 OC 137 69 5 9M 129 .

70 4 Mont 121 70 4 Mill 145 .

70 4 D2 177 .

71 3 D3 177 71 3 QC1 177 ,

72 2 QC2 177 72 3 VY 89 72 2 Pil 145 73 1 BF1' 185 73 1 PB2 185 .

74 1 DA 89 74- 1 BF2 185 73 ' 1 PB2 185 r 74 1 Coop' 137 0

l37 74 Fitz 74 0 11 1 137 .

147 ave. 41 Total 90017044

+-.4 , y 9 gy.- - . - , --ww..

1 5 . ,

i , ...

=

Examination of a number of semi-annual reports from reactors of Ld ...'

-@j various vintages indicates new reactors average about 30 startups a year and older ones ten or less. -

f Combining this information indicates that there is data from in J f execss of 10 5 rod withdrawals, and that for the reactors of this memo

/ {

. s, (the first ten in Table 1) the appropriate order of magnitude for the 2 and 103 respective

1. L N number of rods withdrawn per startup and per year is 10

'd

]'

P f  ;

Events for RDA Above 280 cal /cri 1u We will begin the discussion of the events which must occur for the

.[5 RDA above 280 cal /gm with a brief reminder of the relationship between iP the withdrawal aspects of the RDA and B'<TR operations.

4 Beginning'from a fully shutdown reactor, startup proceeds by with-h ,

The first half of i

i

drawing rods one at a time but in proper patterns.

the rods are pulled all the way in a checkerboard pattern (e.g., red

..g;;" ,

squares) using 4 to 6 such groups each of which is withdrawn fully 3 ,. .

W y%, 4 before the next subgroup is started. The second half of the rods (i.e.,

. ..w

%% black squares) are withdrawn in smaller groups and are generally not l (* *;p: . It is fully withdrawn. See Figure 1 for 'a typical withdrawal pattern.

bef 1 C:h this pattern which devices such as the RWit and RSCS are intended to y ', , / s -,-

l,.; ? '

^' assist in maintaining. Ber. inning from its.most reactive state (i.e.,

J' of: ,,

i p,% w cold, no v.cnon, maximum cycle time reactivity), the reactor would be W .

j (%% - critical with about' half of the red rods withdrawn, about at hot standby 26 and reach the order of 10% power with 10 or

1. 'kk with all the red rods out, 20% of the black rod density withdrawn. At other titqcs in the cycic or restarts from hot and/or xenon conditions these milestones would require j (, - }r oeo e w 90017045 e= ~ ~

a A

,k\

m,

__ . .._m -. .- -.. ,

y t_

~

Mid$104f. *

< Mtt.LSTorJC

' ll , 3 l2 1 2l 61 5 -G l l5 l

47. . 3 '4 l 3 4' 3 47.' 13 14 l l !4 l - l 13 l

d. I 2 l1' _'2 1l 2 l: . 43 7 3l l-9 l _ l 5 l l 7 l ]'

39; 3 4

-l 3 l . '4l 3 '4 l3 39 13 15l l 1G l l 15 l - l 15 l - l 131' l, ,

35  : 1

.l 2 l _ .l. 2 l1 35 5 8 10 l l 11 l l10 l l5l l ' $ '> .

31 4 3 4 3l 4 3l l4 31' 14 l 16 f17l 17l- l 16 l l 14 .1 27 ' , 1 2l .ll l 2-l 1 l'2 l 27 6 9l l 11' l l 12 ' l 11 l 9'l )5) 23 3 4 I 'l 3 l l4l l3l 4l l3 23_ 14 IG l 17 ' l 17 l l 16 l 14 j ).

19' 2 1 l' l'2 l 1 l- l 2 l l1l .19 5 8l l 10 l 11l: l 10 l k5l l5 15 4 3L l4l l3l l '4 l- 3 l 15 13l. l 15 l l IG l l 15 l l 15 l l 13 l l 11 1 l2 l1l~ l 2 l -

2l 11 7 8l-l9l l3l I7 l l~

07 4 3 l4 l 'l 3 l l4l '07 13 . l 14 l l 14 i . l 13 l l 03

!l 2-l l1 l2 03 5 l6l l5l t i~

-02'06' 10 '14 18 22- 26. 30 31 39 d2 46 50 02 06 10 14 16 22 20 30 34 33 4: 4 G ' EC '

1

. 3. CC*.!PLETE Y,'ITCRA7tALS If OtCATCO IN EACM COLU!.l -

CT: CUP- " WITHORA?! TO PC$iTIOtt " $TEFS

. der 0RC CO: fig TO l' EXT COLU:/.N l 2 %1TilD8tA?/ Cr.OUp3 : ; 1 A!;D 4 ROCS IN0lVIDUALLY 1l2l3l4 l5l6 ' I7 i 5 i-9 10 l l FRC.*.10 TO 431:3 T!fE FOLLC7!!!:G OTIDCR 1  !  !

/.3 l l , , l 1 - (22-77). (30-35e .38-271 (30-19). 2 (22-11). '14 -l ?i 06 -27 <!4-351 46 l l'i' l '

l (22-43). 83?-51,. i32-43# 46-35). ,.

3* ' 48 l l l l l (40-19 ). t 35-ill. i30-031, 14-03), kf 0 '

(0~-11). 100 -43). 14-51 4 2 - (30-27 ). II:-19). (14- 27

{;- 43 l l l l l l ,  ; l .

(22-35). . .

(30-4 3), 135-13e 16271; 4

(33-10). r ^5 24 48 l (30-11). (22- 03)  !!4- 111. (06-1?).

DLACK l l i

l l

~

[! '

6 12 24

. (03-35). 3~ l 4l (14-J 31 (22-511 (35-51). l l ]

'. (46-43), (45-11i (33 -03) 7 I l  ! l 3 - (2G-31). 814-23> t:G-15). (16-23). 12 24 l 33 ' 3.t i 33 I' 40 l 431!

- '- e l l (10-31). (13-33i (26 47) (34-39), 6 6 10 8 4* l l (42-31). (!0-M' e40-151 (34-07). b14 l !!i' 24 ' 20 l 23 ' '

(16-01). 110-15: 302-211 (02-39), 9 6 10 l 14 l 13 l 24 30 g 33 s  ; l (10-47), (40 47). i50-30n 4 - (OG-23). f !3-31 s, :25-33). (34-31), 10 4 I

' (42-23), (34 155 S l 12 l IG l :: .' n I 33 4 l (2G-071.

(10-23). !02-311 i!0-33). (18-15)[

(18-471 II ' 8 II ) I0 l 22I II l 23 #8

• l l-(34-4 7). t42-29' e50 311 (10-15).

12 4 JS I

• l (42-07), 10 -07' (02 151 SlUl16l"I H l 3G I l i

- ). WITiec:t AW GCOS 19 OT:!E R C'ICur's rY DANK. I;EE PtNG i OF A Cl:C'tr %tittiN A F t t! t:CTCitCS CF LACli 14 6 10 l 14 l 13 I 24 t?'34!33 I l 15 6 13 l 14 ' IS i 12 26 ; 3') l

4. TCft it001;litRTICNS. REVER$C Tite ORDER.  !

16 l4i 6 I 10 !4 , 18 D '" '"

I '

' l ' i i '8 I

_ A~QU'L

figt'reA3-I~ Control nod I','iths!:os.ut S: quar:e A i

& un r r 90017046

- .21c.

.: .=. - ~ w, . -, - . - . _ . - - . . -

'h,,',

-. e

's

, ,~ .

- 16 Above approximately 10% power,.the-RDA can not

-'  ; greater rod withdrawal..

exceed,280 cal /gm because of both~the more prompt Doppler feedback in this power range and'the impossibility of achieving high rod reactivity worth with the relatively low-rod density, even with erroneous rod potterns. Based on the observations from the semi-annual reports, as a general rule, having gone above the 10% power icvel, the reactor will.be back in the RDAf range' again only fellowing shutdown (usually by scram),

i.e., itTr,ill operate in the power' range for a period of. time then shutdown and start over again.

'(This is not an inevitable course, but s

Variations, where the full complement.of appears to be predominate.  ;

rods is not fully inserted in order to stand by in the ":cro power" range, would not appear to result in conditions cuf ficiently dif f erent to invalidate the atalyses.) ,

r The events which must all occur (emphasize all) to exceed 280 These cal /gm are outlined in Tabic 2 and described briefly here.

required events are (essentially). described in many GE presentations, They are crranged (or rearranged) including the attached Appendix A.

The assumption is that a rod is here for convenience of presentation.

(subsequently) occur (being) withdrawn and the events in the table must .

on that rod. -

I. Di.<connect _

' .l .A. The rod must be or beconc disconnected from the drive either b

by never being coupled, by becoming unlatched or by <7 reak in -

the syste'm such as a broken index tube.' l o 13 e 1 90017047 7

0 7~

. w a- -

.A

=>

g # -. 4 =

• This disconnect must occur with.the rod in the upper quarter B.

or icss of theccore (or it must subsequently be moved there)

(see II B) since most of the reactivity worth of the rod occurs during the initial part of the withdrawal.

. C. The disconnect must not be discovered -(c.g. , by over-travel coupling tests) and remedi'ed (see also III. D).

II. Stuck .

A. The rod must stick as the driveLis moved away.

3. 'The rod must stick in the upper quarter or less if the core, as discussed IB.

C.

The drive must be lowered at least a third of.the core length away from the stuck rod.

III. Errors _

A. The operator must select and withdraw a wrong (ncn-sequence) rod. Sequenced rods do not have sufficient worth to exceed

- 280. It might be noted that in some cases ro ds are withdrawn in several steps (i.e., not fully withdrawn bank positions for some rod groups). For sc=e of these rods, the error, sufficient to exceed 1.5% ok, might be withdrawing the rod too far rather ,

than an incorrect seicetion.

B. The RRM or, C.

The second operator (which has been allowed as an alternate for the RWM) must allow the wrong selection to go uncorrected.

- D. The rod m,stu be withdrawn.in spite of potential warmings of being unc'oupled,_ which are sometimes available, such as no response on the nucicar instrumentation to rod motion.

- ee e 90017048 o g 7 Ako a JN. 4

~m -- ---- .

m .n n a e ,.m, ,,4.- - ,.,-nw--- ,mr mm - ,,rr o

4

'e , ,

- 1P l

l 9

1 IV, pinh Worth Potential _

i 4

A. The erroneously pulled rod must have a high potential worth.

While it varies soccwhat with the reactor and time in cycle, wee as well as the drop valocity and scram time, a RDA must have a i ,

reactivity worth greater than about 1.5% ak to exceed 280.

Many of the possible erroneously pulled rods would not have i that worth, e.g., many core edge rods (see also V.C).

IP

j V. Drop-Timin g d A. The stuck rod must drop.

I B. The rod must drop when the reactor is nearly critical (if it U is far suberitical, the reactivity worth potential of the rod would not be suf ficient) and less than the order of 10!! power.

lP Above this power, 280 cal /gm can not be attained, i

C. The rod must drop (within that critical to 10!! pcwer time M frame) when the withdrawn red pattern enhances the rod worth s_

.. Generally, only so that it approaches its maximum worth.

V N error rods near (next to) the first rods pulled in a group, or

y. ;j some of the first of the black (beyond 50% red density) rods

.f, :1 have sufficiently high worth, and they lose that hi;h worth as 4

80 the pattern withdrawal progresses.

st ,

l.ha d, Probabilitien for Eventn

% Q )) We will now proceed throvgh the events of the RDA and assign prob-l M

mE!5 and compare these probabilities with those assigned abilitics to them, sj!

These probabilic'es are given in Tabic 2. The probabilitics by GE.

L 90017049 E

> oOO9 L

0 Q@R!'[gj mimi m__ _

.. - -- .~ .. . . . . . . .

. 4 N. 7 ,

5 4 g

9

'~ will be' discussed (and listed in Table 2) individually and in groups The gro'up probabilities under the group event headings previously given.

in particular are an attempt'at a conservative interpretation of the apparent information and.do not necessarily represent a direct use of the individual components. Note that the units.for the first 3 groups are per withdrawal, and for the foarth group per erroneous. withdrawal (this'is a conditional probability, given a non-sequence withdrawal has occurred). The.fifth group has a time fractional probability based.on .

Y .

. operation from the time the rod is withdrawn until it is eventually.

inserted.

90017050 '

[

ca. .

^s i

e 9

0 0

e P 5

,a L

h, ,

...,,e www, ow . a m m ene ammina 6 e

.4

' .' J , ,

• Table 2 .

Probabili1 ties For Events This Report Maximum

.CE

~

Group Individual _ Group _ Individual

~

-6 -5 2x10 10 2x10 I. Disconnect (/w) -4

-6 10 10 A. ' disconnect ~1 3x10 B. upper 1/4~

-2

- 10 C. not discover

~

-3 -2 10 10 II. Stuck (/w) 10 10

~

10" A. stuck -1 3x10 B. upper 1/4 ,

C. lower drive 1/J _

-2

~9 -4 10 8x10 10 III. Errors (/w) 2x10

~

2x10" A. operator select ,

-3 -1 2x10 10 B. 2nd operator

-3 -3 or 2x10 10 or C. RWM

-1

-3 10 1

2x10 D. withdran -1

~4 10

-1 4x10 High Worth Potential 7x10 IV.

(/cv) ~ ~1 7.10 10 .

A. high worth ~3

~

2x10

~

,6x10 Drop-Timing (/dscw) 7x10 V.- ~

1 10

'A. ~ drop ~  !

~1 '10 10 B crit to <20%P

-2 10-2 pattern enhance 7x10 C. .

3 2x10 3 2x10 VI. Rods /ycar (w/yr) 10 -10'? ,

~

-19 ~1 N 10 N'10 N 10 Total (above 280/ r).

90017051 _

^

~- . w

, - e- - ec e-

N 7

- 21 ~

l'. Disconnect. The information sources iiviicate that there have been no disconnects which have not been detected immediately'(before operations '

could lead to a RDA). The 95% confidence icvel, zero occurrence rate 5

estimate (see Figure 2 of' Appendix B) is thus 3 occurrences out of 2x10 withdrawals or a rate of.1.5x10 per withdrawal.

There have been 7 uncouplinge in Dresden-2. These all occurred at the fully withdrawn position (unlatching from a moved strainer) and were immediately detected by the over-travel coupling check. One uncoupled rod was found in U111 stone following a rod change. It was discovered in coupling  ;

l checks before startup. Using these 6 uncouplings (14 at a 95% confidence

~

1evel) would result in an uncoupling probability of about 10 '. However,

-this should be combined with a probability of not detecting the uncoupling.

Since procedures call for coupling checks under conditions when such events might occur, it seems reasonable to assign a probability of'the order of

-6 10

~

for such a failure to detect, giving a total of 10 for undetected uncouplings. )

No attempt has been made to analyze breaks in the system leading to

. disconnects. GE has assigned a 10~0 probability to this event based on its i

not having occurred to date (incidentally, this -indicates that GE considers 0

the number of withdrawals to total over 10 ). .

Thus, based on the availabic record, it would appear that a probability of 2x10

-5 per withdrawal, based primarily on the observation of no non-detected disconnects, is a suitably censervative value for this review.

This gives no credit for'having to occur in the upper quarter of the core.

' Note that the ascumption is made that the events of sticking and disconnect are independent. The availabic information does not contradict o**B 90017052

_. . M *D M mf@L Lun

-. *-- -++,,,--e,,

- ' 22 -

4 .

this assumption since no. occurrence in which one.has caused the other .

Th'is subject-will be mentioned later under uncer-

.has been observed.  !

tain tics.

II.

Stuck. The computer A0 report systems give almost no information on stuck rods. They are apparently not generally considered as AOs since

. ~

d d when'they occur, they can be'trearcd "normally" as inoperable ro s, an The semi-annual reports cr.amined also thus do not appear on A0 lists.

indicate little evidence for stuck rods. ~

The other information sourcen (verbal), houever, indicate that stuck rods appear not to be uncomnon (although the dif ferentiation ~

GE uses 10 ' per between stuck rod and inoperative drive is unclear).

if at all at

. withdrawal for this probability, stating it would ' result,

• 1

?

this level, from varped channel boxes.

Because of the lack of precise data, a satisfactory statistical However, what would appear to be a analysis can not be carried out. ~

per withdrawal.

suitably conscrvative estimate will be made of 10

~

Once Note that.this implies more than one stuck rod per reactor year.

l again the factors for occurrence in the upper quarter of the core wil .

not be used.

The computer A0 reporta also provide no information on f Ill. ' _ Err o r q.

Although at least one case (in VY) is known operator error histories. 1 in which a ncn-sequenced rod was pulled without being halted by the nor is in operation), this case is not, second operntor (the RWM was not '

Thus we have no re11abic record of any other, listed.by the' computer. -

i As an obvions corollary to thir.

actually withdrawn non-sequenced rods.

• o Y P 90017053 o90

- a e

~-

J..UAL .

~~

.4--, - ~ - >r = + s, ,=m., -~ i,,-r-.,-- - - , - 3,,, -r  % e e y-.w----,- yrv

i.  :

e' *-

22 -

we also have no: record of single operator errors which were caught by.

the second ' operator or RWlf. -Thus, we will have to consider more. general-ized: reviews of operators actions.

' Appendix III of UASH-1400 delves into the question of human error.

Whilc~a directly comparable case is not discussed, my review of that  :

material indicates that it is not incompatibic with a value of 10-3'( per f

withdrawal) for the operator error rate for the type of compicnity and stress icvol of the withdrawal operation. The material would also a

• appear to assign a lesser degree of' reliability'to the checking oper-ation -(second operator) . '

The infor=ation from experianced staff personnel (OLB, OEB) in- l dicates that numerous startups have been observed without an operator

- error. (For example, 50 startups without crror observed, which by the statistical analysis at a 95% ' confidence level would estimate an error i rate of 3 in over 5000 uithdrawals or less than 10- per withdrawal.) ,

The informatien appears generally compatible with a value of 10- .

These sources do not indicate a very high degree of confidence in the second. operator (as it has generrily been implemented) . The values assigned by GE in Appendix A are 2x10-3 per withdrawal for the operator .

i error and the same value~for the second operator.

i Based on this type of judgment information, this memo has assir,ned 4

~

per withdrawal operation to the operator and 10-

~

an error'.ratc of 10 to the second operator. Since rod' withdrawal for some rods requirce l morcit han one operadion.(rods moved to not fully out bank positiono), ,

thinestimateisincrescedbyafactorof2,to2x10}3 , to account for 90017054

, , , __ ,, . , , --. .-- d- - * * * * * * *

• 34 r- g-r .,y y --e=+ -, -- w-'-qw.m..

.c I' i

- 2 4 ,,

9 this increase in operations. A value of 10~ 'has also been. assigned'to

- other potential withdrawal errors such as not observing the non-reaction of the nucicar instrumentation to the non-movement of ~3the control ~ rod a

~

GE apparently assigns a value of 2x10 to such the drive is actuated.

an error, although the assignment is very unc1carly s'tated.

This memo will not attempt to develope a well justified value to be assigned to the RWM. (That is a t'ask for the EISCSB.) Based on personnel

~

per withdrawal appears reasonable.

judgmenti a value of the order of'10  ;

Because of this amorphous ncture of the information in this area, an overall estimate for the withdrawal error has been taken at what

~

This ba ically  !

ap;;ais to be a cur.rervative level of 10 ' per withdrawal.

~

Note that.10 ' implies the order ignores any contribution from the RUM.

This appears of 1 withdrawal error per year for ten operati*ng reactors.

However, the compatible (but somewhat conservative) with known errors.

GE error rate, which is of the order of 10

~

is possibly less so.

It should be noted that any potential difference between a wrong rod seicetion error and an error of withdrawing a rod too far when in This is believed to be justified group. bank operation has been ignored, fundamentally different and ,

both because the basic probabilitics are not because the significant excessive withdrawal error operations are only a Similarly, for the small fraction of the total withdrawal. operation.

same reasons, the complications introduced by the occasional enterini.

into the RDA range from the higher power range by inserting rodo has '

been ignored. TThis will be mentioned later in the discussions of un~

certainty and' RUM. .

90017055 Q H . A w ,.+ . , ~ , e .r,,- - p , .gp- -- m w, ~

,,eg vv,. - ,y rg

2 i

1 ,. .

~ ,2 5 -

IV. liigh Worth Potential. It is evident clat a number of possibic'non-sequenced rods will not have sufficient reactivity worth to exceed the order of 1.5% ok required to execed 280 cal /gm. For example, while pulling red" rods, a wrong red rod ight be withdrawn. This might have a

- slightly larger worth than normal, but would not (to the best of our present understanding) execed 1.5% 6k. Other potential candidates.for non-excessive worth might be core edge rods or rods not near first rods pulledi$agroup. We do not have precise quantitative information in this area, however. Our normal revicu of rod uorths for the RDA focuses on the taaximum possible rod worths and not on those of somewhat_ lesser

- magnitude. Furthermore, we no longer even examine non-sequenced rods since the assumption is that only sequenced rods are involved in the RDA. _Thus, the estimate is largnly subjective, based on pact experiences and discussions and augmented by several BNL calculations. The estimate

-1 is that 10 of the erroneously withdrawn rod have sufficient reactivity worth. (Note'that this is a conditional probability, given an erroneously ,

withdrawn rod, and the units are per erroneous withdrawal.) It might be noted that the GE value of 7x10~0 (which is deduced from Figurc J.4.13,7 of Appendix A) is obviously for a BOL curtain core. The RDA is somcwhat more severe for a given rod worth in a reload core (which is of concern in this memo) and approaches that for a BOL shaped Gd core. Thus if GE had considered a reload core for the analyscs the rod worth to exceed l

- t 280 would bc lowered and clie potential for exceeding that worth inerenced' .

[

90017056 I t

L s

I

• ' * ' --%,m. . w,.

• *6 ,

l

4

- 26.-

The 1.5% ok'value for 280 cal /gm is only slightly sensitive to variations in the drop velocity and scram velocity parameters for reload i t

l cores. It is somewhat more sensitive in first cycle curtain cores and I i

the velocities included as parameters in the GE analysis (Figure J4.13.7 of Appendix A). For reload corce,'the possibic range of velocity for either drop or scram can result in only about a 10% change in enthalpy, The availabic which is equivalent to.about 0.1%'ok change in rod worth.

sufficiently precise to information on rod worth distribution is not consider this as a parameter of this analysis.

V. Drop-Timing. It is unlikely that every stuck rod would always drop.

However, there appears to be no clear basis for developing a probability

-1 on Table 2, but for the cccurrence. Thus, we list a probability of 10 basically assume a probability of 1 in developing a total probability for this group. GE also assumed 1. (Note that uc again have a conditienal probability with units of per disconnected, stuck, erroneous withdrawal.)

it In considering the timing of the occurrence of the red drop, will be assumed, for the moment, that the probability is constant over the time period from withdrawal to eventual insertion (after power operation). '

This is conservative if the stuck rod is more lickly to drop during the increased vibration time of power operations. It is not conservctive if the drop is more correlated to cccurring soon after the drive is withdrnwn from the stuck rod To exceed 280 cal /cm the red must drop after the reactor is nearly critical (usually after more than 1/4 of the rods have been withdrawn) and before reaching the order of 10~, power. Typically the reactor is in 90017057_

o "' "

~

o "oX q w1 3

< 1

. 1

+ * .

7, i

this regime 1 css than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> per startup.. With 10 startups per year' this gives a 10

~

'(8 x 10/8000) probability of dropping during this -

> )

critical time frame.. ,

The high r.eactivity worth rod.will.have that high wor:h only during a part(s) of the withdrawal sequance. There is a sawtooth maximum worth pattern as a function of time (number of rods withdrawn). ,

As was discussed under High Worth Potential, we have icss than fully detailed knowledge of the magnitudes of this function. However, we believe it can be ,

1

-2 for the fraction of the critical time estimated as the order of 10 ,

that high worth exists for a given rod.

Combining these factors (conservatively), we will estimate unit

~1 probability for the drop, 10 for the drop occurring in the critical 2

for the drop occurring in that time frame when time frame, and 2x10

-3 the pattern enhances the rod worth. This gives a total of 2x10 . The

-2 probability for the critical time frame has been increased from 10 t0 1

~1 in an attempt to account for a possibility of early drop correlation.

10 The pattern enhancement factot has been increased by a factor of-2 to account for uncertainties in our knowledge of the pattern worthc. .

is not exactly directly comparabic.* It is

~

-The GE value of 7x10 for the hot startup condition only. (The breakup in Tablo 2 is arbitrary.)

The final result is also for that condition only. ,

i l

'90017058 I E

• -*+*=**nsw,

+ - ow a . w . .*w...m+sm.. ,,, , , , , , , , . , , , , _ , , , , , , , , , , , ,

r

-  ! l 1

t

~, ., VI. Rods / Year. 'As previously discus.,cd, the estimated startups per year is 10, giving the order of 10 withdrawals per year. This has been increased to 2x10 to include some consMeration for the multipic steps

-per withdrawal for some rods. The value stated by CE in Appendix A is 0

103 . However, 10 appears to be used in their analysis.

l Resols The final probability resulting from the product of these .ssigned probabilitics is about'10~1 RDA events per reactor year exceeding the

~1 280 cal [gmcriteria. This can be compared with the GE value of about 10 ,

which, as previously mentioned, was for hot startup conditions in a BOL curtain core. Changing the GE results to bring these differences in j assumptions into agreement, would still leave several orders of magnitude difference in results. Principal differences are an order of magnitude each for disconnect and stuck probabilities and 4 orders of magnitude for errors. These differences are not surprising since we attempted to

. be conservative when the information available to us was less than complete. Our information and analyscs does not directly refute the CE results, however.

-12 is, of course, a factor of 10 less than the This result of 10 .

criteria of 10 . The conclusion from this is that an RSCS (or,its equivalent) system is not required for the 10 reactors under considcration.  !

lincertnJnty of Results and Posnihte Itaximum Probability As has been noted throughout this memo, the analyses is less precisc j than desired, or co'uld be achieved with further detailed exploration of other posnibic information sources. Even though the attempt has been 1

SS m '-

D 90017059 oc o f J1. .,a ge e4

g - -. . .. -

, ,- I n , t

- 29 ~ r s  !

made to be conservative where information is incomplete, the~ question  ;

. might be asked 'as to. whether the. information should be made more precise .

by pursuing a more complete data basc'with GE and the utilities. The.

r answer appears, to be that it is unnecessary.for the purposes of this.

. memo. _The question might also be asked as to whether there might be- 'l important hidden (or forgotten) characteristics'of one of the events which would completely invalidate the assumed modeling of the probabilitics

. of the e. vent, and thus, should details of the mechanisms involved be i

. more closely explored. This answer appears to be the same as for the first question. These answers arc the result of the magnitude of difference i between the. calculated probability and the criterion, and the lack u dominance of the resultant probability by any one of the required events.

Thus the sign of the comparison remains unchanged for large changes in the components. I in developing the event grcup probabilitics, each one was considered uncertain because of potentially incomplete information, but values In answering the question of expected to be conservative were " chosen".

it is useful to push the need for further information of improvement, If resulting probabilitics are extent of conservatism even further. '

greater than could reasonably be expected from nugmented data, such a scarch is unnecescary. An example of such a punh is given in Tabic 2 under Maximum, and discussed as follows:

I.

The " Disconnect" probability which had been based on' no known e occurrences of operation with a disconnected rod is increased by an

. order of magnitude to 2x10' . For a 95% confidence IcVel estimate, D 90017060 D}

unne+ w -e e

~n , ,,wrwu- , p.e- -e% -

w r .e3---.-t-+ w pr-~t , y y e-%n, r- g

6 l

1 this would indicate that the order of 30 uncorrected disconnections have occurred (in the upper 1/4 of the core),

11. The " Stuck" probability which had been based on only verbal information

-2 sources is increased by an order of magnitude. This rate of 10 per withdrawal is equivalent to hcving one stuck rod (not drive) per startup (in the upper 1/4 of the core), and data would have to indicate a history of about 400 stuck rods.

III. The " Error" probability which had been based on subjective evaluations is increased by 2 orders of mag 11tude. This rate of 10~ per withdrawal ir also equivalent to the order of one erroncously withdrawn rod (selcetion, backup, non-respensive withdrawal) per startup and a history of 400 occurrences.

IV, The "High Worth Potential" which had been estimated based on less than full inf on::ation on worth f requency distributions less than

~

maximum is increased by a f acter of 4. This rate of 4x10 high worth rod per erroneous withdraual would be equivalent to nearly all " black" ' rods having high worth.

V. The " Drop-Timing" . probability which had also been estimated with 1 css than full information on pattern worth distributions is increased

-3 by a factor of 3. The rate of 6x10 may be viewed as being composed of the sanc conservative assumption of a drop probability of 1, in

~1 a critical to 20% power range of 10 , along with a probability for dropping when the rod is enhanced at the appropriate " sawtooth"

-2 , an increase of 6 over (time-withdrawal) interval which is 6x10 the expected value.

90017061 D""D *D Nj '

ca edLR Y ,

i

- 31 The total in this exampic, of courac, is icss than 10' . The event probabilitics are beyond those to be expected.'from further exploration of data. Thus, further exploratien is~ unnecessary.

~The example istalso a view of possible accommodation of model deficiencies.- That is, if as yet hidden or possibly insufficiently explored

. aspects of the events (e.g., a new uncoupling mechanism or the previously mentioned entering of'the RDA region from the power region by rod _inscreion) were to lead to (future) increased probabilitics, these increases could apparent 19 be significant without exceeding'the criteria. A slightly  !

l alternate view of this is that any of the events could be at a probability

~

of one and the total probability vould still be less than 10 . Thus, if the constant occurrence rate assumption of the model were sufficiently invalid that one of the events were to increase to' unit probability, the i criteria would not be exceeded. Eote that this also includes the case for one event causing another evert, i.e., a stuck rod causing a decoupled rod, and thus the lack of independence resulting in unit probability for the second event. Thus it appears to be unnecessary to further explore l

details of mechansims involved.

Conclusions ,

The approach developed in this memo has shown that even when conscr-vatively accounting for imprecisicn in information and modeling, the probability of an RDA above 280 cal /gm, for the 10 reactors without an RSCS, is Icss than a suitably conrervative criteria. Thus no further information'is needed to conclude that an RSCS is not rc' quired for thesc 1

reactors, so far as this decision is based on a techn1 cal argument.

1 L

90017062

- i 32 l

, ' The RW f A parallel question exists as to requirements (Tech Spec) for RtR!

operability. The analysis in this memo has essentially ignored any contribution of the R W to the total probabilities. The 10 per withdrawal i;

-1 error rate assutsed a second operator error rate of 10 rather than a ,

(which, 'it may be recalled, was rather arbitrarily

~

RW crror race of 10 assigned). The history of withdrawal errors, if it were known, is somewhat i influenced by the Rkil, however. It is (also) imprecisely known, but estimated 'that the order of half of the startups which hava occurred r

have been with the Rh?! in operation. Early operability of the E11 was very poor and a-large percentage (approaching 100%) of the startups involved the second operator. Subsequent changes in Tech Specs for some reactors, requiring greater operability have evidently reculted in increased efforts to achieve operability, which have apparently met with success. For example, Pilgrim, for which R!Di operability is required (without exception), has apparently achicved nearly 100% operability.

Other non RSCS reactors, for which a less restrictive Tech Spec (rcquiring operability for the withdrawal of the first twelve rods) has been issued, have apparently achieved similar operability results. The latter Tech Spec requirement is not in itself a logical requirement, since it,is after the twelth rod that the RDA is of importance. However, it too seems to have resulted in an upgrading of the Riel availability sufficiently to make operability a "likely" condition. To approach the Rtal assigned probability of 10' rather than the 10-1 rate of the second operator

^

would require a reasonably high level of operability. To decrease the-e e

90017063

~ - - - - . .

i e t

- 33 .

10

-1 rate to about-10-2 , 2x10-3 er 10 -3 would require operability of 90, ,

!99 o'r 99.9% respectively. Something in this' range appears to be achiev-able.- ,

The results of the analyses in this memo do not seem to demand the

-1 extra factor of 10 to 10" which could be achieved from the RWM.

Nevertheless, it is a system which exists and which can be useful with relatively little effort. The e::tra f actor which it introduces serves as an additional buffer for the RDA and should not be ignored. It would seem to be particularly useful in assuring the correct rod patterns when entering the RDA region from the power region. Thus, it is recommended that Tech Spec requirements be maintained to assure a reasonable degree of operability.

90017064 e

e t

F

$ 8 l

.f' .

.34 -

• i , .  ;

References .

'1. Amendment 22 to the Peach Bottom 2,3 FSAR, October 1972.

2. -WASH-1400, Reactor Safety Study, Draft, August 1974.

3. WASH-1270, Anticipated Transient's Without Scram for Unter-Cooled Power Reactors, September 1973.

4. VASH-1318, Analysis of Pressure. Vessel Statistics from Fossil-Fueled Power Plant Service and Assessment of Reactor Vessel Reliability in Nuclear Power Plant Service, May 1974. _

5. Memo: Rod Drop Accident for BWRs, G.F. Owslay, May 1972.

6. Memo: Assessment of a.BWR Rod Drop Occurrence, A. Serkig, August 1972.

9'0017065' E

4 4

0 s

h*-P * -espe muses, = ,, , _

d

1. - .- . ,, , . - , , . . - ,__--,s _ _ , . _ - - = - . - - -

t e

s .

Appendix A Taken from Amendment 2

- Peach Bottom FSAR D #"D "

"D 't

~

4 U

o6 c. ,}._ a 90017066 9

~

A probabilistic cpproach to Design nacia Accidents enables designers not only to cec the conuequencen of an accident, but it also af fo):ds the opportunity of casily dotcrinining uhich cc:"ponents aid mect in reducing the probabilitics of such an accident. I'er this reason, the probabilistic approach has been used an an a3d in investigatinn " the decian basic,.wCC::Tn0L RCD Dn0P ACCIDZ:lT (C. Di.) and the m-t hr r toduce tne t3ro- l

.. - . 4 4 . - . . .. m 4 . s ne n n , , ,. * ,.. n e ,3 8001140

., bability ofLsignificant conscque:._au due to the event.. .

The analysis presented hero concentrates.primarily on the

. most' probable modes of failures leading to a CRDA. Where

' probabilities cannot be calculated .from historical data,

, i . ~ deliberately conservative values have been used to avoid contentions over particular numbers. The overall pro-ba'bility for the CRDA will be seen to be very small despite the compounding of conservative assumptions.

Figure J.4.13 5 is a f ault tree model of a control rod stuck in the core ready for a drop. Three primary branches combine to produce the stuck-rod " ready for a' drop" state.

'These are: (1) a CONTROL ROD IS STUCK IN THE "NEAR FULL" OR " FULL IN" POSITIOU; (2) a CONTROL ROD SEPAP.ATED FROM THE CONTROL ROD DRIVE (CRD) ; AND (3) a CONTROL ROD DRIVE -

MOVED ABNORMALLY. The heavy lines in Figure J.4.13.5 indicate the most probable path of f ailure which could lead to a CRDA. ,

The first of the three conditions which must necessarily exist for there te be a potential for a CRDA is that a control rod would be stuck in the "near full"or " full in" position. -This could happen in several ways, the most probable one would be where the fuel, channel is '

warped, which could be conservatively estimated to have a probcbility of 10-4 failures / insertion. Another way would be that a loose object could enter the channel and jam the rod in a fixed position. However, the fact that the control rod weighs nearly 200 pounds and the low pro-bability of loose objects lodging in channels in an oper-ating reactor seem to restrict this mode of f ailure; in fact, from the histerical evidence that no such failures have occurred, a conservative probability of 10 o failurcs/

insertion for this mode of f ailure can be assumed. Assuming the other modes of sticking have a much lcwer probability than the previcusly discussed ones , the total probability ,

for a control rod to stick would be essentially 1.0 x 10 "

failures / insertion.

The second condition contributing to the rod drop accident requires that the CRD be discennected from the control rod.

The most likely mode of failure in the separation of the control rod drive from the rod itself would be through the breaking of the index tube. Since this failure has never occurred with the present design, it is justifiabic to say that the probability of its happening would be no larger than 10-6 f ailurcs/ withdrawal. Assuming that the probability of failure of the control red would be much smaller than that of the index tube, it has not been incorporated into this analysis. Since there must be multiplo f ailurcs present for the rod actually to be uncoupled without the operator's knowledge, the probability for this mode of failure would be small in comparison to that of the index tube breakin'. g 7g y a.4-16 90017067 g _Ag XAY . .

-?.

• N.

Co.nsequently, the probability.of a control rod becoming separated from its drive is approximately 10-6 f ailure/

' withdrawal.

.The third and final condition necessary-in order for a control rod to drop, is that the control rod drive must have been moved abnormally. A purely mechanical failure could not cause this condition without several other accompanying failures. This product of failures leads to a probability which is much smaller than that of the other mode of failure, namely, the operator error. In order for an operator to withdraw a control rod drive which is disconnected from the control rod,'he would have to ignore or not receive the various signals indicating a malfunction in the drive. Even if the operator ignores an alarm and withdraws the uncoupled drive, the accident is of no consequence unless the rod is an out-of-sequence rod. There is a Rod Worth Minimi:or (RWM) which acts as an automatic check on the operator's drive selection.

Since this report is to look into the improvement in

~

reliability of the addition of a Rod Sequence Control System (RSCS), both cases of operator error (with and without the RSCS) will be invertigated. In order to be conservative in the calculation, a. probability of 2 x 10-3 errors / withdrawal has been used for both the operator's selection of an out-of-sequence red and for the checking ,

performed by the RWM (or second reacter operator), the

• joint probability being 4 x 10-6 errors / withdrawal. To arrive at the probability of a drive withdrawal for the

. Power level where only the RWM is in ef f ect, the pro-babilityof4x10-6

, errors /withdrawalismultipliedby 2 x 10- errors / operation (which is a conservative estimate i of the probability of an operator to ' ignore a signal or alarm which indicates a system malfunction) . This pro-duces a probability of 8 x 10-9 errors /withdrawa1 that the operator withdraws an out-of-sequence rod and icnorce anv indications of system problems. At the power level when' '

the RSCS is also in operation the probability of withdrawine an out of sequence rod is a factor of 10-3 smaller (assumini the hard' Wired RSCS is twice as reliable as the RWM) . .

The probability that all three required conditions are present during a particular period of time is the product of the probabilitics of each condition. Thus, the pro-bability of an cut-of-sequence control rod becoming stuck, disconnected, and its drive withdrawn would be 8 x 10-19 failures / withdrawal, with only the RUM being in ef f ect.

With both the RWM and the RSCS, the probability of a control rod being ready to drop is 8 x 10-22 failurcs/

~

withdrawal. Assuming 1000 withdrawals per, year per reactor, the probabilities become 8 x 10-15 f ailurcu/ycar and 8 x 10-18 failurcs/ year respectively. ,

90017068 h J 4-17 hD

.e For mechanical reasons, the prcbability of a rod becoming unstuck is not independent of the probability of its being stuck. In order to climinate t'he complexitics of this interdependency calculation of probability, the probability

['a of a stuck rod unsticking will be conservatively assumed This means that if a rod sticks it will drop.

to be unity.

From the above argument, the probabilityfailures of a control rod

/ year for i, sticking and then falling is 8 x 10-18(when both the RSCS An

lowpowerlegelsfailures/ year when the RWW only is in effect.

and 8 x 10-1 it is necessary to However, in the Design Basis Accident,It is casily'seen that p assume that there is a rod drop.

'y this overwhelming assumption has exaggcrated the importance of this accident.

a4 9"

Figure J.4.13.6 shows that there are throc reactor These are: (1) states cold-used in the an lysis of the CRDA. atmospheric pressure, startup (-reactor at 20 degrecs C, and 10-8 of rated power); (2) hot-startup (reactor of at 5

saturated temperature, operating pressure and 10-0 No higher power rated power); and (3) 10% cf rated power.

(

' levels are investigated since the effects are negligible (peak

in that no calculated fuel rod perforation occursThe probability fuel enthalpy is less than 170 cal /gm).

7 of a reactor being at cold stcrtup can be The calculated tine span usingfrcm

the nominal startup time (reference 7 ) . (pcwer) the initiation of rod withdrawal to the hot-standby e

l condition is 7.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> per startup. thaIntorder to be con-there may be con-7 servative ditions and to take recuiring into account the operator to slow the startup JE Thus, a reactor is inprocedure, the cold-a factor of 2 will bc used. Assuming four cold-startup condition 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />,'startup.

startups a year, the probability thatThea hot-startup reactor.is in the 6

con-cold-startup state, is 6.9 x 10-3 dition requires 2.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to pass through for each startup.

On the average, there are eleven hot startups/ year which

,j 0 gives a total of 61.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> / year in the hot-startup con-The third condition I/ dition, or a probability of 7 x 10-3 of any consequence is 100 power. The time that a reactor JA is in this state will be very conservatively assumed to be 1000 hours0.0116 days <br />0.278 hours <br />0.00165 weeks <br />3.805e-4 months <br /> / year. Thus, the probability of' a reactor

v

' 9

- being at 10% power will be 0.114.

' fl l

q 3

Figure J.4.13.5 shows tha t the decision tree spreads into hot-startup j three groups. Only the ef fects of the CRDA at Figure j

will be discussed because it is theculminating worst case.in the number

.El J.4.13.7 of failedshows fuelthe pins.decisien tree,The analyses of failed fuel and rod

• , j worths are for a curtain core; however, the results will not be significantly different for a gadolina core. The rod worths are broken down into four groups. , Assuming i

I o~o 90047069 o93 '

lN k ~** oI 1 . a J.4-10'

1 e

that there has been an operator crror, and that an out-of-sequence rod has been withdrawn, the probability of

. . an out-of-sequence rod having a rod worth. of 0 to it 4 k/K is 5.9 x 10-2 The probabili.ty tha t the out-of-sequence rod would have a worth of 11 to 21 Ak/X~is 0.893. Only a specific configuration of withdrawn rods will produce a rod worth in the 2t to 3% rango. The probability associated with this configuratier is 4.7 x 10-2 Considering the possibility of the operator and the inttrumentation making multiple errors, it is necessary to multiply the probability of attaining a mul-tiple error configuration by the probability of the oper-ator making a second error and by the probability of the instrumentation allowing a second error to be made. The

-probability of a configuration to produce rod worths in the range of 3t to 4.5% 6K/K is 1.7'x 10-3, whereas, the probability of an operator making a second error is 10-2 (the higher probability accounts for the possibility of interrelations-between errors). The probability associated with the RWM allowing the error is taken to be 10-2 (same reasoning as for the operator). and the RSCS is also taken to have a second-failure probability of 10-2 Thus, the probability for rod worths in the 3% to 4.5% ok/k range is 1.7 x 10-7 without the RSCS and 1. 7 x 10-9 with it.

The next paramotor of concern is the velocity at which the control rod drops. E::periments have been performed (the average rod drop velocity was 2.73 feet /second) and the probabilities are as shown in Figure J.4.13.7.

The scram time (903 insertion) is the next parameter of interest. The data for actual control red scrans in operating reactors was used to obtain the probabilities

. given in. Figure J.4.13 7. The scram time technical speci-fication is 4 seconds for 901 insertion.

By using the dif ferent combinatiens of parameters shown in Fig.J.4.13.7, the values of peak enthalpy (ref erence 5 )

can be obtained. Also, these same parameters provide the needed inputs to computer codes which project the number of fuel pins perforated. Both the enthalpy and fuel damage numbers appear in Figure J.4.13.7.

The offect of the modification on dose at the site boundary can now be assessed. The actual magnitude of the release is affceted by many factors besides the mechanics of failure and nuclear excursion discussed here: decontmnination factor, isolation valvo closure time, main steam and recirculation flow at the time of the accident, condenscr.outicakage, and matcorology are a few of those parameters which add uncertainty to the final result. Ilowever, all of these factors which are not actually related to the magnitude  ;

of the excursion have been taken at the highly conservhtive 90017070 .

• D 1

~ ~ '

D 3 #D J g J.4-19 och o- . 2.1 ti _ >

4 yg

• r valuesLused.in the FSAR analysis. This approach will demonstrate the specific ef fect ci the modification. quite clearly. .

The offsite dose is calculated from the highest 24-hour whole-body gamma cose (essentially the same as the course-of-the-accident dose) tabulated This value ofin2.3Tacle x 10-514.4.3 Romofisthe equivalent

- Peach'Dottom-FSAR.

to 6.9 x 10-8 Rem per perforated rod.

In Figurc J.4.13.8.the ordinate of a point on the curve is-

'the probability per reactor-year that the dose to a hypo-the'tical individual at the site boundary, assuming the least favorable meteorological conditions, will exceed the .value of the abscissa due to the postulated control rod drop accidents. The low probability that there will lbe any release at all is equal to the probability that there will be a rod drop times the probability that there will be 'aty fuel damaged, given the red drop occurs. Figure J.4.13.8 does not include any of the cases resulting in peak fuel enthalpics in excess of 425 cal /gn: under such con-ditions existing physics models cannot be used to predict the exact dynamics of fission product release. From Figure J.4.13.7 the,grobability of such circumstances is no greater than 4 x 10- d per reactor-year with only the M.'M in coera- ~

tion and'no greater than 4 x 1029 with both the RWM and the RSCS.

i The expected value of fencepost dose due to postulated control-red drop accidents can be calculated frca the distributions shown in Figure J.4.13.8 by intacratine the respective curves. The result is 3 x 10-E2 millirem per year before the modification and 3 v. 10-25 millirem per year after the modification. The same hypothetical individual at the site boundary woula expect co receive approximately 140 nillire.n per year f rom natural "bac.:-

ground" and other manmada radiation sources, as reflected in the " natural radiaticn" curve of Figure.J.4.13.8.

It is concluded.that the addition of the Rod Sequence l

Control System acts further to reduce the impact of the CRDA, but from thc' effects of an accident whose impact.'

on public health and safety was already trivially small.

g mg e gy 9no'7.071 1 MIL on

.w n 1

l

. p '#

L J.4-20

CUSSIldidflull A11D Ui'LP/di: , , P L;P.Mi r LLTTLits -

REFERENCES -

1. Dray, A. P., "The General Electiic Company Analytical and Experimental Programs for. Resolution of.ACRS Safety Concerns ", General Electric Co. , APED-5608, April, 1968.

2.- " Metal-Water Reaction.s - Ef fects on Core Cooling and Containment", General Electric Co., APED-5454, March, 1968. .

3. " Considerations Pertaining ,to Containment Inerting",

General Electric Co., APED-5654, August, _1968.

4. Stirn, R. C. et. al., " Rod Drop Accident Analysis for Large Boiling Water Reactors," NEDO-10527, March 1972.

5. Stirn, R. C, et al., " Rod Drop Accident Analysis for Large- BWR's -- Supplement 1," NEDO-19527, July 1972. .

6. Letter to Roger Boyd from Ivan F. Stuart,-September 14, 1972.  ;

7. General Electric, "G.E. Bi.'R Critical Path Startuo '

Requirements," APED-5772.

90017072 j

l

. l l

J.4-21 .

we, .- . = * * -=

. . au.e ..m w w. ..

= = muse = -in i +.

e

. i 1

L.UKilVL ROU 15 511)Ci; !.! NEAR FULL OP. FULL 1.:10SITf0

( .

i k r FtJdL O'is nj. FULL U D. ..;;. 4 LCC5e Gi>- WaliOL iMu '

BECGlHS I Mi.\R CJ.<TTai. .E\R C24'i!J:. JJCT 1.sTL'15 U.;;Xif ECTED ND t;'J.P5 n'0 Sl;!FT5 t'LMiii. MD DISTORI'ED f .t X'.E10 F.\ILtlPJi "ID

~BlDCES IT LCUPLE CD:,TEOL LOD To ra fW O

U..C.L Pl.1;sG Tr.5T FAILS

_._ Leo:a:L P211 GT.R 0)UPLED lilTil CONTFOL I

i CD mlW P0511,0a 1.201- JPf.F.W .- i Ai 2 Ji t?.Jo JR C\ TOR EP.'a.< - iU TEST F M l'.CRE.5

• E0JS 0\Tr;rPX.IL C\"dRTTR\1L A! W .! 7 g I i yr'e.t.,u v.s w :.-

I 5:GriED INC; l'L'JJ F.A!!.;D Lf;C00FL L;G SF'JD E!.GERS 300 SnJCK L4 BE;T LOCKING I

• l{ -

Dr.C3UPLE Pl.lir.

g g AL L. uA .+ v.

iTSIT in.4 p 3, g,';,;3 re.all ..

.w. ,PtiR SlC ..s ,

Ji Pf.Ci!!\ED gg;. g.

.

St.T101E3 1.4 liiu;G X Ib!T.D t.CC VI 10i *ilTC:r S I

TT I I

?dii;D Silici "L.D 5".'.1701 i;;i?.D SilTul I dt t' lei? li'SITIJ.; I?R KliJ 1.ll'Jll' 1;0K C\lR- "

lat'lC\l'lds Ol' A 1.'G\llG4 fl'Wi!L FAILS Ol'!!4 9001 073 l' "I ' >

1 % \l104 18 i.s l \lii r \l! S t'i.m).0 (:I M '11 D**D *D ~3~ Y Q

.oo o _ Jl .1/L .

~ ~

• e.. . _ _ . - . ,

-n,-e- # wm +--nvr

CQiflCL TOD -

SIUCK I.4 COPL RIM 0Y FOR '

I1MP 1

IlI CGN1RCL l'DU ,

SthUfED Fiuf CasTiOL 00 futW ,

e (n'UCO M I l F.CiRilG1 IC O J!S SUO8rG: t FAILUFI 1.i 11[ DRIVE

• t RimcI '

LINE Erli?.Ci l

- CF A; di ir Sh.':7 1 (MIICL

,.EC it's ICE l0.1VE Al b'.ruite ll \L p,gjtgg3 gp FAl1.URl: OF '

EChIX D!U '.'11 T,ilt

,nn C.4TEL r mpwps7

[

bntl.,G O.s LCL: -

lt;G Fi.t:G Flt1LE3

. _ _ -- L. . . l u . r_' d j

, L% J 4'u. .

f**0#'i.,.

4.t . c. w 'J. , 1..vLs ib e: 'J.LOCin

,h ds.\ de%u Eini/vus $0CiJ.T 'N-Fl.;GERS C Ui'L t..G .iLC3

L!l.tlTER I;r24.4 5'tUD Disr!- .h7 MC r \ il < _,

a snra _, I i

I I

1 T

I IO e, l11( A1,sd ( d'.il'l I.td l di'llo

'111RL.\lG L,,

r.,ts'!) - Z s b $- o 0 e o- . 7pv a ^ O

p. to d i 6 0 e -

4 C b * @x d n>e a. d f'* :7 % i _O_ D J s 0 "

e. o N Z .

2 90017076 O n' . d O . O ~_ O (r * . + O W

1. ) b

% ^^ o . ~J .E 9 e i dl_)O _O_ 9 DQ O m i ".s a u.

• itL1 nr r me r w e a

~ natt wtjatil g ri t< t ti tv twinatti mrt.914g ton per'r jne. Its ' 142? est/so IS90 (1.426:10*N) .);LO,, . (1.429:10* 34) ,, (.015)> )42S cal /re 1200 (7.8 f o*D) 3,56 f. b).6 9 (7.8s10*II) (J D4) I4 7 1810 i425 cal /na (1.5410f)) 1 1-L41- 3 * (1.38:10 Q ~ 9An - (.166) D U , 1425 cel/pss 1460 (4.9)stn-2 3 1 55.S-9 (4.9) 10 y) c ./:2 . t @W ,. . . l0.01$) 1875 0 .24 10 243 ,75-1.9 1.9-1.49 # 373 cal /a. (3.24a1029) . 30) i.9a)) . stia . es t ' 1 0 2,*g . . 392,gg,7,},-i) , (t'W n%Y) 26 1435 (9.35:10 0 71r9) LhLL, 425 cal /c2 (9. 3 )s10"3 g)) (n,pt s g es) (6.16:10** #') 3$0 cal /ts 1035 ?.a 7.141.5/(.01)) 3.48 3 16.14:10 ) (.6)); " ( in) tats cal /rs 1185 (.395sloN)) M 5.0 3 (.39510 /(.015) *I' 350 cal /c, 230 (2.59,1<t ">

1. 4 n ,-., )t,,,,o t.5-1.49 a . 3 9 10- )

.of o .ee , n00 (1.36,1(0 [ ,[>

1. 5-5. o , 400 cat / n (1.34:1 1 L .g4;7,33-2 63 g,og3) 7.M-3 $ 1.5-) / 9 3 265 cal /tn 440 (0.9 10*I')

(.345) (.585) (8.9:10" *) . (2.$4a10 ) 110 e a L /r. 150 3 ht.0.,,.9 (2.58s40 ) (.01)) hl 270 cal /tst 420 0.1:10*I ) 2.4-?.?4 -MLQ U.7a10 l) (.655) (.955) (4. M e l o," ) 215 est/rn 3f5 9 6 9,,o C - (4.n.io ) (.,,4) 7.746 (.)45) (1,2 5,1 (I., ) 160 est/ o O Q n . 2 5. m ) - ,,,,,) .01 .n?1

• (.89))

190 est /am too g g ,,,, g .Q (4. 9 7 :10 ) '  ?.4-;.ta (.635) (3,3a,gg

• -17 3

'si:1 *.2o 135 ent/a= (0) (2.34 sin *IU) (.726) 19 to ent/ m (0) g, ,g , g f' % ##'8t.o (9,nSa t o -22)3 a .at  ; . ,, . [/ ' h=0.9sl0*I) n) ) 85 cells. n) g,ggn h',j 0 22 (f.es10

1. ~

- 1,. )'f,

[ * ) i 90017077 - 1 4 ,

Appendix B- . 'I Taken1 from Appendix A of WAS!!-1318 ,

i 1 STATISTICAL A.ALYSIS OF PRESSt*RE VESSEL " FAILURE" EVENTS l Introduction i The objective of this discussion is te provide the basis for defining > and inferring the values of probabilities of failure' events from service experience data available' on non-nuclear vessels in fossil-fueled power plant service.' Statements of probability derived from observation of the frequency of events must necessarily have associated trith them a statement of the confidence level. Also, the calculated probabilitias ~ should be considered to be the upper' limits at the stated confidence icvel that can.be supported by the mathematical procedures. Discussien When rare events arc distributed in cine, the assumption is usually made that (a) the number of events in a fixcd time interval has a Poisson distribution and .(b) the intervals betseen events have an expencatial i distribution. Two types of situations exist in which the exponential distribution ' holds on both a theoretical and cxperimental basis. If ~ components are " tun in" or subjected to preservice examinations to climinate these with manuf acturine, de fe:ts, and degraded components arc replaced or repaired, the failure rate may be assumed as constant and the intervals between failures an exponentially distributed. The t same distribution law holds for complex cystems where individual  ! 913017078 1

- > c

. -. ,1 , s l ~ ion) as soon , components are replaced .(or restored to the original condit (1 ) as a failure occurs. A compicx system may fail from any one of a number of mechanisms be known or modes,% The details of_one or more-mechanisms or modes may ill assure with'some deg'ree of certainty, but no extent of analysis w dly that all f ailure mechanisms and modes are included in a suppose The probability of failure of the - complete description of the system. system during the time interval [0,T) is given by (1) F(T) = 1 - exp (-E / h1 (t. - Tg) dt) i o where: d hg (t) = hasard function for the ich failure no e t = time at which ich mode uns kneun to be " good." j If "1" is suf ficiently large (i.e. . >5), then the term i I h1 (t-t t) is say A. Consequently, approximately constant , E/ hg (t-T 1) dc = AT, and equation (1) becemos . i o-(2) F(T) = 1 - exp (-TT) The dcncity function of time to f ailure, f(T) is then (3) dP(T) / dT = A exp' (- AT ) . and the density function is exponential. 90017079 a T T T - e T-49 -M t v - E- _ (;1 , 47 - , , r ' i This argument is 'the justification. for the general assumption that !I . ' !i

j tit

es-to-f ailure for complex systems nay be ' assumed- to be exponentially '

distributed .without knowledge' of the details of the several failure 1 ' mechanisms or modes.' . j i To demonstrat.c that the above argument holds in reality, a Monte Carlo , t calculation was performed. A compicx system was assumed to fail by each , of 10 dif f crent mechanisms all of which ucre.ascumed to have k'eibull distributions kinstead of exponential distributions) of times-to-f ailure. . . The constants for several 'Jcibull distributions were selected as shown l in Tabic A.- The cumulative distribution for the lleibull function is F(t) = 1 - exp (-( At)') (4) l 1 l TABLE A l Failure Mechanism A n Mann Ti.m.e-to-Failure -3 1.2 300 1 3'.14 x 10 -3 1. 4 - 620 2- 1.47 x 10 - ~3 460 3 1.95 x 10 1.6 -3 1.8 560 4 1.53 x 10 ' 1,64 x 10 -3 2.0 540 5 2.11 x 10! 3 2.2 400 - 6 , ~ ~ 2.61'x 10 2.4 340 7 -3 2.6 640 8 1.39.x 10 , -3 2.8 500 9 1.78 x 30 -3 3.0 380 10 2.35.x 10 90017080 l i- e ,, .,_m.,,. ,.,.i...,,,- , - - , . . . . , _ . . , _,,.,,,.,....--.,._.d-.,,-,,_i..m,.w.w,wm-- ), . ...... . I. o ( ' ' 4 I. - A sampic of 200 intervals between f ailure was selected by the random ' lts were plot ted as shoun in Ficurc 1. 'or.}ionte Carlo process and the resu

t, was made

) The selection of the abeissa, -In (1-F(t)),.and'the ordinate, because if the overall distribution was exponentially distributed then j line with a slope of- ' the result on such a plot-should be a straight . y, since , '(5) F(t) = 1,- exp (-yt) i (6) e -in (1-F(t)) = yt. I i ll h . The relationship between y and the nean times-to-failure for the Weibu distribution is 1 I 9 i - Q, 4, h isn. where e g =.mean time to f ailure for "ich" Weibull f ailure mec an I The straight line in Figure 1 for the expenential distribution uith to the data generated by the Mente Carin i y = 45.02 shows a good fit , calculat ion , Thus, although no individual failure mechanism was assumed * ~ for the compicx i e to be exponentially distributed, the overall failure rate 9 I system is exponentially distributed.  : 4 , follows, 14/ , which provides the basis for the discussion that Reference, ( 4 a furnishes additional.confirmacion of the use of the exponential distri-bution ns a time-to-f ailure model, ' l - l . 90017081 i + v. ., , , . , , - . ,~, . ...--.-.._.-,,,c ,.y., y, -a t . .. \q ~. t, . 41 - - i - t t  ; t p , i 60 ' . g* t 0 50 i i i. ( 40 0 i / . t 30  ?/ / . 20 & f . 10 /. 0/ 0.2 0.4 0.0 0.8 1.0 1.2 '.n [1 - F(t)]  ! t FIGURE 1 90017082 i I I. ~ ,, -- --- + e i 1 l u u L-  : . i. h The exponential probability. density function f ~ ' Ae , t >,o and A>o I f(t;1) = J, (7) . o , ciscwhere- ' -( 'that is the most commonly u' sed . time-to-f ailure distribution , plays a central role in reliability, comparable to that of the normal distribution. The, hazard function for an exponenticily distributed variate is -At h(t) =g-At =A (8) Thus the probability of f ailure during a specified time interval is a constant depending only on the length of the interval and is the same irrespective of whether the component is in its early period of operation or has previously survived 10 years, 20 years, or 30 years. The parameter A is referred to as the failure rate. . ~ .. 4 , . . . . . . . . .. The time-to-failurc for a component is exponcatially distributed if the componcevent happens independently at a constant rate. Frequently, however , the' ticc-to-failure distribution for a component is not exponent ially l . distributed over its entire life, but tht in-unato portion in exponen-tially distributed. The time-to-failure for the cocenonent in-uscce is then exponentially distributed, because the anplicable hnrard function is g . 90017083 , \ l l 1 i l l .l .. ,. l D constant. This is so, even if the time-to-f ailure distribution over the tctal life of the component is far from exponential. The exponential . distribution is considered more appropriate as a time-to-f ailure model Reference 15/ , which , for a complex system than for its ccmponent . parts. deals specifically with nuclear reactors, provides additional material on estimation of failure rates. This reference indicates that a mathe-matica11y acceptabic method of esticating failure rates is to use data from the opnrating history of the reactor or similar type vessels. The method can be used if the failures are assumed to be distributed as a Poisson process with gamma-distributed waiting times to failure and exponentially-distributed interarrival times. These asumptions are valid if it can.be assumed that maintenance and repair res' ult in no year-out effect. The degree of accuracy obtained in estimating a f ailure race is directly related to the amount of operating data available. As an example , if a , .. . .. component _ decs not. f ail in 15. years, estinating its f ailure rate presents some difficulty, llowever, its failure rate is Icss than for a compenent that f ailed once in 15 years. Using this concept and the above-stateJ , distribution theory, an upper confidence limit may be placed on a ' component that has no observed failurcs in an observation time T. The lower 1-o confidence interval on the population f ailure r.uc v, given ' as a probability statement, is 2- (2nk) . X .P [0 1 v 8 1-n -/2T) = 1-n - (9) 90017084 ,-,r, - - -- , l 'i; . a l where: - a = probability that an observation from the hypothesized population I will randomly occur outside the confidence interval, n = number of failures observed 'in time interval T,

• ) = 1-a percentile of a chi-square distribution with 2n+2 X _( '

degrees of freedom, v = population alue of failure rate per year. ,

1. " E provide more details on failure rate References bL!' 1b!' j l

i confidence intervals. The above formula from Otway, et al,15/ , is a special case of a much more - I / general formula developed in this discussion to compute the confidence The basic  ; intervals for' the parameters in Poisson and binomial processes. j assumptien is that the quantitics of. interest are the limits that define j l an interval of the frequency corresponding to the stated confidence levci, A distribution function,20/. C (rlc, c) conditional on the observations. is defined as follows: . r g (Al c,c) d A , A?,o (10) G(rlc,c)=P(Acclc,o)=/ , J vhere P (Asrlc, a) = the probability that thc. fregt ency, A, is icss than or and a, equal to r, conditional upon e the obnerved count, the hypothesis of the prior dcocity of the frequency. 90017085 i l ~ -- - . _ _.

e - .

' - 53'- 4 ' 2-The . density . function, g ( Alc, a) is assumed to be given by Dayes' theorem-1 , in the following form: f(A)- 'h(cl A) (11) g(Alc, a) = , f(A) h(clA)dA , f , o For a Poisson process-c*-A " for (C A >o ' ' * ** (12) - h(cl A) = el where: , A = the true frequency or the ev.pected number'of events during the . period of observation. , c = the observed number of events. ' The density function f( A) is conveniently chosen to be a gaena density, i.e., .s , .. s ....~s .. . . . . . ( for A>0, S>0, K>0 (13) f(A) = ., _ This density has two parameters'S and K so that appropriate choices for , a their numerical values can repre.acnt a variety of assumptions concerning, the "a priori" distribution c'f A. In particular, the ch51cc 0 = 0 and  ; K = 0 corresponds to the assumption that A is uniformly distributed between .:cro and infinity. This means that no particular value of A , - l l i in favored over another prior to obtaining, the statistical data. l 'l t L 90017086 - i e g e-7 w rvw 4 .e- t&>-O TM, 9 9 y me w 7-gow 9-7 w V' Mn- ,w-'w w- y-W+- i g- t 4 m . k By combining these considerations, the dencity function, g(Alc, B. K) is a gamma density. "+Ke~A(1+G) 1 + 6)"+K+1 A g( A l c , S . K) = ((c+K+1) , The value of the integral of this density function is equal to the The relation-chi-square integral whenever K = 0 or a positive integer. ship2- 2/ is , P(Atrlc, S, K) = P '[ X2 s2r(1+3) l v = 2 (c+R+1)] (15) This formula becomes identical to Otuay, et al.15/ when S = 0 and K = 0. Therefore, Otuay, et al. are presumed to have made the "a priori" assumption that X is distributed uniformly between zero and infinity. This "a priori" assunption is seeming,1y a safe and most reasonabic ene since it really amounts to an unprejudiced attitude with respect to what A tnight be p,rior to, co11ceting the da.ta. A short listing of values derived from the above formula for the case of the "a priori" assumptien that A is uniformly distributed between zero and infinity, as utilized in the determination of failure probabilities stated in thin report, is nhown in Tal lo 11 (For values other than thode listed refer to rigure 2.) 90017087 6" 6" if ' ~ D "" D 6B j b o) oj u Al , f 't i l . n j ' ~ 55 - , l , i, TABLE B  ;, i - I STATISTICALLY-Tt!FERRCD tRRIBER OF OCCURRE!!CES Observed flurber Confidence Level of Occurrences - n 0. , 90% 95% 99% 0 2.3 3.0 4.6 1 '3.9 4.7 6.6  ; 2 5.3 6.3 8.4 6 10.5 11.8 14.5 , 13 18.9 20.6 24.1 100 114.2 118.2 125.4 A Monte Carlo calculation was performed to verify the values frem the above table for :cro cbserved events. Monte Carlo "er.periment s" on digital computers utilize their capability to make random selection of numbers in order to produce results completely independent of analyticci * ~- methods. llowever, the sampic sine selected must neenssarily be finite, and consequently the resulting values will not be equal exactly to those , achieved by analytica[ methods using the infinite limit. Poisson processes were sciccted at randou with A's uniformly distributed between :cro and infinity and a count was obtained on cach process. If the count was :cro, then the corresponding A was added to the sample; D**D *D ~T h . e- _2.A m se 90017088 Y f e , , _ _ , . . A .gq _ 7 2 o 5 o <= o G 1 d i

• e G

g $o t O O o z e C C \ g \ o c-D 0 0 O g

u. m t 1

OO i W C b m m O o Oz O VJ 2 D 'D \-i U W EN OO \ l \ o O O. IO O 'O wc i \ ' in u O G-XO W g W E , w QD cc UJ 2 5 g O. g Q t I k' O E s O w N 2 C >n J to o I \z, o w tn O O J OO yC i' ', O' WW \ , \ . i-M \.. \

• o (N

N W C'. D I O E  ! s_Ns = \s x\ 1

s. 6, s. .

\ \

• o @

l _ .- o - l 90017089 . . i ..e' a..d v - -- ~ ~ ~ -- Q w .,,,w . . .. w ': .  ; 3 I ' . i. I. otherw!.se the process was discarded. This procedure was carried out  !. until 20,000 frequencies had accumulated. The results are tabulated in - Tabic C. . TABLE C N. ilumber of Frequencies Percentage of Total- ~ Upper Limit-on Confidence Value . Frcoucncy, A Less than Uoner Limit t ' 18023 , 90.115 { 2.3026 r 19027 95.135 l 2.9957  : 99.020 [ 19804 f 4.6052-f figures, The upper limits listed are the values, to five significant f, from Table B for 907;, 957;, and 997; ccnfidence and for zero observed Obviously, the results demonstrate that the Mente Carlo and { events. i analytical values are in excellent agreement. t, i the methods j These results are judged to be an adequate denonstration that discussed can be applied..to estimate the range cf f ailure probabilitics from statistical service histories of prassure ves:cis, for the case of either a finito number of observed f ailure events or the absence of any i. failure event. 90017090 l D"*0 *9 T y gy - od e. . 2 1 .\.[f% , a 1 - . . -. ..- ..