ML20127B005
Text
-.
- i^-
O o
OCT 2 7 N
-~
MEMORANDUM FOR:
Lester S. Rubenstein, Assistant Director for Core and Plant Systems Division of Systems Integration FROM:
Frank H. Rowsome, Assistant Director for Technology Division of Safety Technology
SUBJECT:
REVIEW OF BWR WATER LEVEL MEASUREMENT SYSTEMS
REFERENCES:
1.
SLI-8218, " Inadequate Core Cooling Detection in BWR's."
2.
SLI-8221, " Review of Shoreham Water Level Measurement System."
3.
SLI-8211, " Review of BWR Vessel Water Level Measurement Systems."
Attached please find the review of probabilistic risk assessment (PRA) provided in the BWR Owners Group reports SLI-8218, "ICC Detection in BWR's" and SLI-8221, " Review of Shoreham Water Level Measurement System". This review has been performed in response to the memorandum from L. S. Rubinstein to M. L. Ernst of December 23, 1982.
- The need for additional instrumentation for detecting inadequate core cooling was initially recommended by the BWR Owners Group in response to TMI Action Plan, Item II.F.2.
However, based on the PRA study, the BWR Owners Group contends that risk contribution assdciat'ed with failure of the water level measurement systems is acceptably small and that comparable risk reduction may be accomplished by implementing improvements as recommended in SLI-8211 " Review of BWR Reactor Vessel Water Level Measurement Systems,"
together with enhanced operator's responses.
Further, the BWR Owners Group contends that the PRA results are generically applicable to all BWR plants.
Results of this PRA review stiow that after implementation of improvements as recommended in SLI-8211, the core damage frequency due to water level measurement failures for Shoreham and Limerick is small when compared to the total core damage frequency for recent PRA results for BWR's.
Further, the risk of offsite consequences due to water level measurement failures is even smaller. This is because ecst of the accidents relating to water level measurement failures involve sequences where there is no gross failure of containment during core melt.
As a result, the risk of offsite consequences is also smaller.
131@T4%3) M
.~,o,
sumanie >
..........c3 care) ret 3maV NLJ M@RUC@M cm ca n d,cn
= * "
= " ~
~~
<e.e s
OCT 2 71993 Iris ~nuted that thdre are large uncertainties associated with the PRA-results provided in SLI-8218 and SLI-8221.
In addition, there are differences due to plant specific variations in water level measurement systems, drywell cooling systems, and human error probabilities associated therewith, therefore, the PRA results cannot be judged to be generically applicable to all BWR plants. However, this conclusion of generic inapplicability of PRA results should not be construed to imply that plant specific PRA be required to determine the need for additional diverse ICC instrumentation; that should be a separate issue to be determined by DSI.
A large fraction of uncertainties present in the PRA results is attributable to assumed reliabilities of the operator's action during an accident progression.
In addition to the implementation of SLI-8211 recommendations which have been reviewed by DSI, of equal if not even greater importance to the reduction of risk due to water level measurement failures are enhanced operator performance. The ability of an operator to perceive, diagnose and take timely action prior to a core damage state largely depends on operator training, effective emergency procedures and information display that provides integrated information on, makeup flows and is intelligible to the operator under high stress conditions. A full discussion on those recommendations is provided in the attachment.
Such enhanced operator performance is recommended to be considered by DSI/DHFS as an integral part of the BWR water level measurement program.
This completes the subject review of BWR water level measurement systems.
Please contact D. Yue (x28129) of RRAB if you have any questions on this evaluation.
l l
Original Signed by, Frank'li. Rowsome, Assistant Director Di n
M ty Techology Central Fife
Attachment:
As stated RRAB RDG DYue cc:
T. Speis RFrahm I
R. Mattson AThadani L. Phillips FRowsome u g R. Silver J. Shea D. Crutchfield W. Hodges R. Colmar W. Minners C. Berlinger h
'h"hhVIOUSCONCURRENCEy p
..R..R..A..B...:.D..S..T..*..D a vi sR. 4..d..!I...M...S..T..*....
....R..R..A..B..:..D..S..T..*....
....A..D. 7..T..i..[.IS..Y.....
o,,,c i,
sua== >..Y.ue.:s1m............Er.atyn............A.Th.2@/83.n.i.....
....F.Rp,w to m,9,.,,.
a
....../.. 5 10flff83
.10../2. 4./8. 3..
......10/. 24/. 83 10
== 6 Inc ronu si_shuncu_o_no OIElCIAL R ECOR D_ COPY -
w-W a
- tuewem-m =.
9 O
PRA REVIEW 0F BWR' WATER LEVEL MEASUREMENT SYSTEM ~
I.
INTRODUCTION The purpose of this report is to review the probabilistic risk assessment (PRA) provided in the BWR Owners Group report, Sections 4, 6 and related appendicesofSLI-8218,"ICbDetectioninBWR's"(proprietary)andthe Shoreham report SLI-8221, " Review of Shoreham Water Level Measurement System" (proprietary). Other remaining sections of SLI-8218 have been reviewed by ORNL under separate contract with DSI. This report is partly based on staff assessment and partly on EG&G/ITI report EGG-REP-6396 (proprietary) on the review of BWR water level measurement systems.
The assessment of the BWR water level measurement system to determine the need for additional instrumentation for detecting inadequate core cooling (ICC) was made by the BWR Owners Group in response to TMI Action Plan, Item II.F.2.
Based on their assessment of the vulnerability of the present water level measurement system to specific line breaks, failures or malfunctions of the mechanical errors, the BWR Owners Group initially recommended several alternative measurement systems for detection of inadequate core cooling. However, based on the PRA study, the BWR Owners Group contends that risk contribution associated with failure of the water level measurement system is acceptably small and that comparable risk reduction may be accomplished without additional diverse ICC instrumentations by implementing improvements as recommended in SLI-8211, " Review of BWR Reactor 1
jna..,,
)
~
~
O o
Vessel Water Level Measurement Systems," together with enhanced operator performance.
Further, the BWR Owners Group contends that the PRA results are generically applicable to all the BWR plants.
It is noted that SLI-8211 has also been reviewed by ORNL under separate contract with DSI.
It is the purpose of this assessment to evaluate those claims relating to the PRA as contained in SLI-8218 and SLI-8221 on water level measurement systems for detecting ICC conditions.
Section II of this report provides a summary of the results of the EG&G/ITI report EGG-REP-6396.
Section III p,rovides discussions of the PRA in the areas of system reliability, operator performance and generic applicability of the results.
Conclusions and recommendations are provided in Section IV.
II.
SUMMARY
OF EGG-REP-6396 The report EG&G-REP-6396 was performed by EG&G Idaho under contract to DST. The review of SLI-8221 was performed by EG&G Idaho while the review of SLI-8218 was performed by Intermountain Technologies, Inc. under subcontract to EG&G Idaho.
In general, the PRA methodology employed in the BWR Owners Group reports SLI-8218 and SLI-8221 has been based on currently available PRA's of BWR's of similar designs. The fault / event tree logic and quantification appear to be valid with exceptions as noted below. The generic report SLI-8218 on inadequate core cooling has also been found, in general, consistent with the Shoreham report SLI-8221 with respect to event tree logic and system unavailability estimates.
Many questions and comments 2
W r
O.
O have been generated by the staff and. consultants.
Responses to the questions are considered to be, in general, positive and have added considerable perspective on most of the issues.
Those questions and responses are included as an appendix in the EGG /ITI Report EGG-REP-6396.
Three additional questions relating to operator's error probabilities and emergency procedure guidelines have been forwarded to the BWR Owners Group.
However, their responses are not expected until late November. While their responses will provide further clarification of the operator's role in the detection and mitigation of water level measurement system failures, it is believed that those responses are not essential for this evaluation and will
-therefore not be included in this report.
Those responses from the BWR Owners Group may be used as supplemental information by DSI in the evaluation of. enhancing the operator performance relating to water level measurement system failures.
The adequacy of existing water level measurement systems to indicate ICC under various accident conditions and to generate initiation signals for safety related systems has been based in part on the contribution those systems would have on the core damage frequency from:
(a) the failure of water level measurement systems as an accident initiator, and (b) the failure of water level measurement systems during an accident sequence.
3
Q Q
i Contribution of water-level measurement failures to core damage frequency may be viewed from two different perspectives, i.e., (a) the relative contribution of water level measurement failures to the overall plant specific core damage frequency and (b) the absolute contribution of water level measurement failures to core damage frequency as compared to recent PRA results for BWR's.
(a) Relative Contribution The major thrust of the BWR Owners Group Report SLI-8218 was to demonstrate that the contribution of water level measurement failures was insignificant on a relative basis as compared with the plant overall core damage frequency.
The Limerick PRA was used to show that this contribution constituted only a few percent of the overall plant specific core damage frequency.
Results of_ this review indicate that, on a relative basis, the effect of water level measurement failures on the core damage frequency is not insignificant prior to the implementation of improvements as recommended in SLI-8211 and the best estimate calculations indicate some' limited reduction in contribution of water level measurement failures on overall core damage frequency. These calculations are believed to have large uncertainties and this issue is discussed in the following sections.
Table 1, which is based on SLI-8218 and SLI-8221, provides a comparison of water level measurement failure contribution before and after the implementation of SLI-8211 recommendations based on the Limerick and Shoreham core damage frequencies.
These recommendations were to:
4
1
\\
V b,
a.
Reduce the errors in reactor water level measurement caused.by high drywell temperature if significant.
b.
Modify ECCS initiation logic if the loss of a reference leg and a single level instrument failure result in the need for early operator action.
c.
Install analog level' measurement and trip units if plant experience warrants.
TABLE 1.
' Comparison of Limerick and Shoreham Core Damage Frequency Water Level Measurement Failure Contribution Plant Total CDF Before (1)
After (1)
Limerick 1.4 x 10 5 1.2 x 10 8 4.8 x 10 7 (SLI-8218)
(9% of total)
(3.4% of total)
Shoreham 4.4 x 10 5 5.5 x 10 8 4.1 x 10 8 (SLI-8221)
(12.5% of total)
(9.6% of total)
(1) Refers to before and after the implementation of SLI-8211 recommendations.
(b) Absolute Contribution The contribution from water level measurement system failure is generally small on an absolute basis especially after the implementation of SLI-8211 recommendations as compared to the overall core damage frequencies shown in recent PRA results for BWR's.
5 fbbs.. <
r3 rx L/
V
...From. Table 1, contributions from Shoraham and Limerick-after implementation-of SLI-8211 recommendations are on the order of 4% and 0.5%, respectively, of the core damage frequencies of recent PRA results for BWR's.
l III. STAFF DISCUSSIONS The basic issue of this study is to determine whether existing water level measurement systems for BWR's are adequate to indicate the approach to inadequate core cooling.
This issue, in turn, involves the following review areas:
1.
System Reliability - The performance of water level measurement systems under various accident conditions.
2.
Operator Performance - The reliance of the operator on existing water level measurement systems for the recognition of ICC under various accident conditions.
3.
Generic Applicability - The generic applicability of the results to BWR's.
1.
Systems Reliability A brief description of the water level measurement systems is given here for a frame of discussions.
Further descriptions may be found in the BWR Owners Group reports (Refs. I to 3).
The BWR reactor vessel water level measurement system typically consists of a differential pressure system based on:
(a) An unheated / cooled reference leg, 6
(isw.4!
e e
(b) A variable leg (reactor vessel water level),
(c) Condensate pot on the reference leg, and (d) A differential pressure transducer.
This system generally uses five different instrument ranges to accomplish its assigned control and indication tasks.
If there are reactor protection system set points within a range, redundant systems are provided.
The ICC point is generally located below the lowest level of the " fuel zone" range, which is generally out of the scale for the operator to see. The lowest significant level that the operator has available on the indicator is the "2/3 core covered" point which general'ly corresponds to the top of the jet pumps and is located approximately 7.5 ft. above the defined ICC point.
This particular level is a key level identifiable to the operator to assure no potential approach to ICC conditions.
The iinportance of this distinction is that in the BWR, after the vessel water level drops below the visible indicator range, there is still time available for the operator action before reaching the ICC point.
Before the vessel level drops below the "2/3 core covered" point, there are typically five low level set points which will either set off an alarm, produce a power runback, a reactor scram, or initiate the Engineered Safeguard Features (ESF's). As noted in SLI-8218, the probability of all those channels failing to produce a reactor shutdown, either through the l
automatic system or through operator action, is admittedly low. On the 7
E Whw&..
L
O O
a
}
other hand, the situation postulated here for water level measurement failures is an indication of a higher than the true level of water in the core region such as that caused by reference leg flashing. While a full discussion of the level measurement failures is beyond the scope of this report and may be found in References 1 through 3, suffices it to say that this could be caused by a reduction in the reference column height, density change, or shifts in the instrument zero offset. With respect to the last problem of shifts in the zero offset, it is noted that differential pressure transducers are generally very vulnerable to long term drift as between a typical refueling cycle of 18 months.
In the event of a spurious high level signal caused by reference leg flashing on loss of reference leg column, it is essential that the low pressure coolant injection systems not be turned off under any circumstances either by misdiagnosis or improper prioritization of operating procedures.
Those aspects of operator's error probabilities and measures for enhanced operator performance will be treated further in Section 2.
i Two general improvement approaches have been proposed in SLI-8218, which would yield comparable reduction in risk without additional diverse ICC detection devices.
Those improvements consist of improved reliability of existing water level measurement systems and enhanced operator performance. The improved reliability of existing water level measurement systems is primarily based on recommendations as given in SLI-8211.
8 je t...
-~
l
'J v
Sriefly...it consists of either reducing reference leg vertical drop in the drywell or cooling the reference legs to prevent failures due to high drywell temperatures.
In addition, the' instrument line failure contribution could be ameliorated by a thorough validation of level measurements to ensure that the operator is aware that portions o' the level measurement system have failed.
Further, the level instrument failure contribution could be reduced by a validation procedure to ensure that each individual level indication is within its range and is responsive to changes in other process parameters, such as changes in flows to and from the primary system.
It is noted that those proposed improvements will also enhance the operator performance, which will be dealt with in Section 2.
2.
Operator Performance It is well noted that there are large uncertainties associated with the probabilistic risk evaluation because the results are predicated on assumed reliabilities of operator's action and that there are plant specific variations in reactor water level measurement systems and drywell c'ooling systems.
In addition to the improved reliability of existing water level measurement systems as discussed previously, enhanced operator performance has also been recommended in SLI-8218.
As noted in SLI-8218, improvements relating to enhanced operator performance have been well recognized and have already been made independent of those discussed in the PRA study. Those improvements consist of human factor engineering review of control room 9
l--
O O
~
~~
~~
design, improved operator training and establishment of a common level reference for instrument zero.
Although the importance of the operator has been re' cognized, in SLI-2818 and SLI-8221, the procedural aspects of human errors have been emphasized, i.e.,
errors of omission (e.g., failing to start a manual system) and commission (e.g., overriding an operating system).
It must be recognized that cognitive behavior can potentially affect the water level measurement failure contribution to risk. A single wrong decision attributed to misdiagnosis based on faulty water level measurement or improper prioritization of tasks can lead to a series of incorrect actions.
As noted in SLI-8218, the PRA study shows that the key to recovering from measurement failures is operator's recognition of the approach to ICC upset conditions. Once the operator has recognized the measurement failure, he has operating guidelines which permit him to adequately cool the core even if the level measurements are unavailable.
Those operating guidelines typically instruct him to flood the vessel by all available means.
As pointed out in SLI-8218, timely detection of the level indication failure by the operator can be accomplished by examining the level indicators individually to determine if they are within range, are active, and have physically realizable trends; those individual readings could also be compared with each other to assure that they are consistent in absolute sense and that their trends are consistent.
It is also well noted that 10 hhh
- ^I
O O
there are a number of other existing measurements which are indicative of-the adequacy of core cooling. These consist of emergency core cooling flow rates, flows to and from the vessel, activity in the containment air space, hydrogen concentration in the containment, and activity in the primary water and suppression pool.
However, because of their physical separation, those various level measurement indicators as discussed above may not be properly relied upon by the operator for corrective measures under a high stress accident condition.
In order for an operator to perceive, diagnose and take timely action prior to a core damage state, three elements are considered to be of paramo'unt importance, i.e., operator training, effective emergency operating procedures and information display that is intelligible to the operator under high stress conditions.
For the operator training, it is important that training information reflects actual operating conditions which are
' characteristic of the plant; training information taken from plant final safety analysis reports does not usually reflect realistic plant operating conditions.
In the emergency operating procedure, the contribution of those augmentative measurement indicators as discussed previously should be properly incorporated, taking into consideration the degree of severity and time available for the particular accident sequence.
For the information display, control room process-management aids such as the Safety Parameter Display System now available may be considered as an integral part of the BWR water level measurement program. With the range of information 11
O O
1
)
' ~ ~
"p?ovided, those systems can make 'a~ control room operator a problem-solver and decision maker so as to ameliorate potential cognitive errors caused by water level measurement' failures.
l 3.
Generic Applicability It is' interesting-to note from Table 1 that the Shoreham contribution from
. water level measurement failure is 5.5x10 8 before implementaion of the SLI-8211 recommendations, and only drops slightly (to 4.1x10 8) after implementation.
On the other hand, the Limerick contribution from water level measurement failure is 1.2x10 8 and 4.8x10 7 before and after implementing the SLI-8211 recommendations, respectively.
This difference is attributed to plant specific design variations in the water level 1
l measurement systems.
Further, the Shoreham water level measurement failure contribution is at least four times as great as Limerick, and there is no assurance that the contribution might not be higher on other plants.
Thus, while it may be argued 'that water level measurement failure contribution i
for Limerick is small, particularly after implementation of SLI-8211 recommendations, it is not clear whether the same conclusion is valid for
(
Shoreham on a relative basis.
l This comparison (factor of 10 difference between Limerick and Shoreham) shows that there may be significant variation in the estimates of PRA results which are attributable to plant unique features of water level measurement systems, drywell cooling systems, and human error probabilities and the use of the results of the PRA study as provided in SLI-8218 and SLI-8221 for all BWR plants may be questionable.
12 3 rO -...
?
, nA
a
.m O
O" However, with the implementation'of enhanced operator' performance as discussed above and improvements as recommended in SLI-8211, further implementation of diverse ICC instrumentation will probably yield little additional risk reduction especially on an absolute basis. This is because after implementing the SLI-8211 recommendations, total failure of the water level measurement system combined with operator's failure to take corrective action constitutes an acceptably small likelihood of occurrence.
It should also be noted that most automatic initiation features will have occurred prior to flashing in the reference leg, which occurs under the conditions of low reactor vessel pressure and high drywell temperature.
In this manner, the accident consequences will be further
. mitigated.
However, it must be reemphasized that properly trained operators with effective emergency procedures are paramount in recognizing failed level instrumentation and taking appropriate action.
IV.
CONCLUSIONS AND RECOMMENDATIONS Based on the above discussions, the following conclusions and recommendations may be made:
1.
After implementaiton of improvements as recommended in SLI-8211, the core damage frequency due to water level measurement failures for Shoreham and Limerick, is small when compared to the total core damage frequency for recent PRA results for BWR's.
Further, the risk of offsite consequences due to water level measurement failures is even smaller after implementing the SLI-8211 recommendations.
This is 13
' x i-c.
.- ? Q: b?
0 0
because most of the accidents relating to water level measurement failures involve sequences where there is no gross failure of containment during core melt. As a result, the risk of offsite consequences is also smaller.
2.
Since there are differences in the PRA results attributable to' plant specific variations in water level measurement systems, drywell cooling systems, and human error probabilities, results of the PRA study may not be generically applicable to all BWR plani.s.
However, with the implementation of enhanced operator performance and improvements as recommended in SLI-8211, further implementation of diverse ICC instrumentation will probably yield little additional risk reduction, especially on an absolute basis.
3.
A large fraction of the PRA uncertainties is attributable to assumed reliabilities of the operator's action.
Improvements in operator performance may be accomplished by developing effective emergency procedure guidelines, improved operator training, and implementing process-management aids such as the Safet'y Parameter Display System.
It is recommended that enhancing operator performance be considered by DSI/DHFS as an integral part of the BWR water level measurement program.
14 Lid