ML20128F330

Trial Evaluations in Comparison with the 1983 Safety Goals

ML20128F330
Person / Time
Issue date:	06/30/1985
From:	Riggs R, Sege G Office of Nuclear Reactor Regulation
To:
References
NUREG-1128, NUDOCS 8507080209
Download: ML20128F330 (200)

Text

5 NUREG-1128 s

Trial Evaluations in l Comparison With i the 1983 Safety Goals E

E

, E 8-I a

2

, 8 O

a y U.S. Nuclear Regulatory 9 Commission Office of Nuclear Reactor Regulation 3 R. Riggs, G. Sege a

H pa atc%

5

$ (, ..c l\

's $

\l'. . . . . /

N l  :

6 850630

$ B507000209NUREG pp c Py R 1128

r NOTICE .

Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publl cations.will be available from one of the following sources:

1. The NRC Public Document Room,1717 H Street, N.W.

Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office, Post Office Box 37082, Washington, DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the rnajority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include NRC correspondence and internal NRC memorandp; NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices;

~ Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the NRC/GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, i such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Division of Technical Information and Document Control, U.S. Nuclear Regulatory Com-mission, Washington, DC 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 10018.

NUREG-1128 Trial Evaluations in Comparison With the 1983 Safety Goals I

Manuscript Completed: March 1985 Date Published: June 1985 R. Riggs, G. Sege Division of Safety Technology Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Comenission .,

Washington, D.C. 20555 .

p/ %>g l

l l

,a cw ABSTRACT This report provides retrospective comparisons of selected generic regulatory actions to the 1983 NRC safety goals, which had been issued for evaluation during a two year period. The issues covered are those analyzed by the Office of Nuclear Reactor Regulation (NRR) (assisted in some cases by the Battelle Pacific Northwest Laboratory). The issues include auxiliary feedwater reliability, pressurized thermal shock, power-operated relief valve isolation, asymmetric blowdown loads on PWR primary systems, pool dynamic loads for BWR containments, and steam generator tube rupture. Calculated core-melt frequencies, mortality risks, and cost-benefit ratios are compared with the corresponding safety goal quantitative design objectives.

Considerations that should influence interpretation of the comparisons are discussed. Comments are included on whether and how the safety goals may have helped in the regulatory decision process and on problems encountered.

l l

iii l

l l

L

.s 4.

TABLE OF CONTENTS P_ag ABSTRACT ...................................................... iii ACKNOWLEDGMENT................................................. ix ABBREVIATIONS.................................................. x EXECUTIVE

SUMMARY

............................................. 1 1 EVALUATION APPROACH ...................................... 5 1.1 General ............................................. 5

1. 2 Method of Comparsion................................. 5 1.3 Method of Analyses .................................. 6 1.3.1 Reduction of Risk to Public................... 6 1.3.2 Dose Equivalencies for Release Categories..... 7 1.3.3 Occupational Risk............................. 8 1.4 References........................................... 8 2 HIGHLIGHTS OF THE TRIAL EVALUATIONS....................... 10 2.1 Reliability Criteria for Auxiliary Feedwater System.. 10 2.1.1 Background.................................... 10 2.1.2 Requirement .................................. 10 2.1.3 Comparisons with Safety Goals............... . 10 2.2 Pressurized Thermal Shock (USI A-49)................. 13 2.2.1 Background.................................... 13 2.2.2 Requirement................................... 13 2.2.3 Comparisons with Safety Goals................. 13 2.3 Automatic Power-0perated Relief Valve Isolation System............................................... 17 2.3.1 Background.................................... 17 2.3.2 Requirement................................... 18 2.3.3 Comparisons with Safety Goals................. 18 2.4 Asymmetric Blowdown Loads on PWR Primary Systems...... 20 2.4.1 Background..................................... 20 2.4.2 Re gu l ato ry Ac ti o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.4.3 Comparisons with Safety Goals.................. 20 2.5 Safety / Relief Valve (SRV) Pool Dynamic Loads and Temperature Limits for BWR Containment /

22 (USI A-39)............................................

2.5.1 Background..................................... 23 2.5.2 Requirement.................................... 23 2.5.3 Comparisons with Safety Goals.................. 23 v

.w TABLE OF CONTENT (Cont.)

Pag 2.6 Steam Generator Tube Degradation and Rupture (USIs A-3, A-4, A-5): SWC/CISI Program.......................... 25 2.6.1 Background..................................... 25 2.6.2 Requirement.................................... 25 2.6.3 Comparisons with Safety Goals.................. 25 2.7 Steam Generator Tube Degradation and Rupture (USIs A-3, A-4, A-5): Other Program Elements.......... 30 2.7.1 Background...................................... 30 2.7.2 Requirement..................................... 30 2.7.3 Comparisons with Safety Goals................... 31 3 DETAILED NRR TRIAL EVALUATIONS............................ 35 3.1 Reliability Criteria for Auxiliary Feedwater Systems. 35 3.1.1 Background.................................... 35 3.1.2 Safety Significance........................... 37 3.1.3 Requirement................................... 38 3.1.4 Types of Evaluations.......................... 38 3.1.5 Conclusions................................... 43 3.1.6 References...............;i...................

45 3.2 Pressurized Thermal Shock............................ 48 3.2.1 Background.................................... 48 3.2.2 Safety Significance........................... 49 3.2.3 Requirement................................... 49 4

3.2.4 Types of Risk Evaluation used to Develop the Proposed PTS Ru1e............................. 49 3.2.5 Conclusion Regarding Proposed Rule............ 57 3.2.6 Speculation Regarding Future Methods that Could be Applied to Determine Risk Reduction in Terms of Early and Late Fatalities Averted and Dollars per Person-Rem Averted. . . . . . . . . . . . . 58 3.2.7 References.................................... 70 3.3 Installation and Testing of Automatic Power-Operated l Relief Valve Isolation System........................ 71 3.3.1 Background.................................... 71 3.3.2 Safety Significance........................... 72 3.3.3 Requirement................................... 73 l

vi l

l l

k

.% .'o TABLE OF CONTENT (Cont.)

Page 3.3.4 Types of Evaluations . . . . . . . . . . . . . 76 3.3.5 Conclusions. . . . . . . . . . . . . . . . . . 84 3.3.6 References . . . . . . . . . . . . . . . . . . 87 3.4 Asymmetric Blowdown Loads on PWR Primary Systems . . . . . . . . . . . . . . . . . . . . . . . 88 3.4.1 Background . . . . . . . . . . . . . . . . . . 88 3.4.2 Safety Significance. . . . . . . . . . . . . . 88 3.4.3 Requirement. ................. 89 3.4.4 Types of Evaluations . . . . . . . . . . . . . 91 3.4.5 Conclusions. . . . . . . . . . . . . . . . . . 103 3.4.6 References . . . . . . . . . . . . . . . . . . 104 3.5 Safety / Relief Valve (SRV) Pool Dynamic Loads and Temperature Limits for BWR Containment . . . . . . 106 3.5.1 Background . . . . . . . . . . . . . . . . . . 106 3.5.2 Safety Significance. . . . . . . . . . . . . . 107 3.5.3 Requirement. . . . . . . . . . . . . . . . . . 107 3.5.4 Risk Evaluation. . . . . . . . . . . . . . . . 108 '

3.5.5 Conclusions. . . . . . . . . . . . . . . . . . 116 3.5.6 References . . . . . . . . . . . . . . . . . . 118 3.6 Steam Generator Tube Degradation and Rupture:

Secondary Water Chemistry and Condenser Inservice Inspection Programs.................................. 122 3.6.1 Background.................................... 122 3.6.2 Safety Significance........................... 123 3.6.3 Requirement................................... 124 3.6.4 Evaluations................................... 124 3.6.5 Conclusions................................... 135 3.6.6 References.................................... 143

3. 7 Steam Generator Tube Degradation and Rupture: Other Program Elements..................................... 145 3.7.1 Secondary Side Visual Inspections and Improved QA/QC Procedures for Prevention and Detection of Loose Parts................................ 145 3.7.2 Full-length Tube Inspections and Maximum Steam Generator Inspection Intervals................ 158 vii

,% . .' a TABLE OF CONTENT (Cont.)

P_ age 3.7.3 Coolant Iodine Activity Limits. . . . . . . . . . . . . . . . 166 3.7.4 Primary-to-Secondary Leakage Rate Limits. . . . . . 176 3.7.5 Evaluation of Safety Injection Reset.......... 181 i

l l,

I I

l i

i i

l l

h i viii i

t

I

.h to ACKNOWLEDGEMENTS .

Many individuals made a variety of contributions to the total effort documented in this report. The report was prepared by R. Riggs (NRR) and G. Sege (NRR), R. Riggs coordinated and reviewed the technical aspects of-the trial evaluations and developed the NRR guidelines to compare them to the design objectives in the safety goals. G. Sege developed the scope and format of the report and provided critical review of the contents.

M. Harwell (ADM) provided editorial' assistance. The detailed trial evaluations contained in Section 3 were authored by members of NRR and PNL. The NRR contributing authors to Section 3 were J. N. Wilson, R. Woods, and D. Gupta.

The PNL contributing authors to Section 3 were W. Bickford, B. Fecht and S. Bian. Mr. Bickford also coordinated and reviewed the technical aspects of the evaluations performed by PNL for consistency with the NRR guidelines. D.

Strenge (PNL) performed the CRAC-2 calculations used in the fatality -

estimates. S. McKelvin (NRR) provided typing support.

W. Minners (NRR) and F. Rowsome (NRR) contributed supervisory guidance.

ix

.b 4s ABBREVIATIONS AC Alternating Current AFWS Auxiliary Feedwater System ATWS -Anticipated-Transient Without Scram BAST Boric Acid Storage Tank B&W Babcock & Wilcox BWR Boiling Water. Reactor C/B Cost / Benefit Ci Curies CI- Containment Isolation CISIP Condenser Inservice Inspection Program CRGR Committee to-Review Generic Requirements ' '

DEGB Double-ended Guillotine Break ECCS Emergency Core Cooling System-EFPH Effective Full Power Hour.

EFPY Effective Full Power Year EPRI Electric Power Research Institute FSAR Final Safety Analysis Report GDC General Design Criteria HHSIP Hi-Head Safety Injection Program LC0 Limiting Condition of Operation LOCA Loss-of-Coolant Accident .

LOOP Loss of Offsite Power LTOP. Low Temperature Overpressure Protection LWR Light Water-Reactor MFW Main Feedwater.

MWe Megawatts (electric)

MWt Megawatts (thermal)

NRC Nuclear Regulatory Commission NRR (Office of) Nuclear Reactor Regulation

.NSSS Nuclear Steam Supply System OBE Operating Basis Earthquake ORE Occupational Radiation Exposure ORNL Oak Ridge National Laboratory PORV Power-Operated Relief Valve PNL Pacific Northwest Laboratory PRA Probabilistic Risk Assessment PTS Pressurized Thermal Shock PWR Pressurized Water Reactor QA Quality Assurance QOO Quantitative Design Objectives RCIC Reactor Core Isolation Cooling RCP Reactor Coolant Pump RCS Reactor Coolant System RES (Office of) Nuclear Regulatory Research RPV Reactor Pressure Vessel X

t

.:. 2.

ABBREVIATIONS (CONT.)

RT Reference Temperature for Nil-Ductility Transition RW$kT Refueling Water Storage Tank RY Reactor Year SAI Science Applications, Inc.

SBLOCA' Small Break Loss-of-Coolant Accident SG Steam Generator SGEP Safety Goal Evaluation Program SGOG Steam Generator Owners Group SGTR Steam Generator Tube Rupture SI Safety Injection SRP Standard Review Plan '

SRV Safety Relief Valve SSE Safe Shutdown Earthquake -

SSI Secondary Side Inspection STS Standard Technical Specifications SWCP Secondary Water Chemistry Program TMI-2 Three Mile Island Unit 2 TS Technical Specifications USI Unresolved Safety Issue W Westinghouse i

Xi

, 1.

EXECUTIVE

SUMMARY

This report provides retrospective comparisons of a number of generic regulatory actions with the 1983 safety goals. The purpose of these comparisons was to assess (a) how the decisions taken might have been affected by the safety goals had they been effective (rather than issued, as they were, for evaluation only), (b) whether the quantitative design objectives in the 1983 safety goals might have been helpful as part of the regulatory decision processes, and (c) what problems might have been encountered in using them. The trial evaluations covered here are those done by the Office of Nuclear Reactor Regulation (NRR). Trial evaluations of some other issues (not included in this report) were performed by the Office of Nuclear Regulatory Research (RES) and the Office of Inspection and Enforcement (IE).

The results of these comparisons are not intended to alter or support previous regulatory decisions, but to determine whether and how the decision processes might have been changed by use of the safety goals as guidelines.

To conserve and eliminate duplication of staff efforts when comparing these trial evaluation issues to the safety goals, the trial evaluations started with existing regulatory analyses pertaining to the regulatory issues. The regulatory analyses were augmented by further detailed analyses included in Section 3 of this report. The detailed NRR trial evaluation analyses were structured to provide direct quantitative results for comparisons with the quantitative design objectives (QD0s) described in the 1983 safety goals (NUREG-0880, Rev. 1).

A tabulation of the comparisons between each of the NRR trial evaluation issues and the safety goal QD0s is given in the summary table included in this executive summary. The table identifies the ratio of the quantified best-estimate calculations to the QD0s in the 1983 safety goals. The table also includes a brief statement concerning the regulatory action taken for each of the trial evaluation issues, and whether or not the regulatory action taken is consistent with the action that would be suggested by application of the safety goals. In addition, the summary table identifies whether or not implementation of the issue would involve increases, or decreases, in occupational radiation exposure (ORE). The ORE impact is not a QD0 in the 1983 safety goals. However, the ORE impact of a regulatory issue is considered within the scope of the regulatory decision processes.

The summary table and clarifying notes indicate that the decisions taken are in general consistent with the decisions that would be suggested by the safety goals. This judgment, however, is contigent on how the safety goals are applied, how the quantitative uncertainties are viewed, and how relevant factors outside the safety goals are taken into account.

s b .?..

In the notation used on the summary table, ratios less than or equal to one meet the safety goal QD0s; ratios greater than one do not meet the safety goal QD0s. Ratios within an order of magnitude ( ) of one should usually be considered comparable to the safety goal QD0s, since the comparisons are subject to wide uncertainties.

When the individual trial evaluation issues are directly compared with the safety goal QD0s, the estimated changes in the probabilities of early fatalities and the core melt frequencies clearly dominate the estimated changes in the probabilities of latent cancer fatalities.

The safety goal QO0s concerning mortality risks and core melt frequency relate to overall plant performance design objectives. Guidelines to apportion a fractional part of the safety goal QD0s to particular systems, accident sequences, or generic issues are absent in the safety goals.

However, such apportionments are clearly needed.

As stated in the clarifying notes of the summary table, the cost-benefit ratios do not include averted costs. Averted costs might result from improved operational performance as a result of reductions in repairs and from reductions in plant downtime or operations at derated power levels and associated replacement power costs. Averted costs might also stem from cost savings associated with accident avoidance as a result of the regulatory action. The latter averted costs would be a function of a reduction in the core-melt accident frequency and the costs that would result from cleanup, repairs, refurbishment, and the replacement of electrical power generation.

If the averted costs were included in the cost term of the cost-benefit ratio, a number of the trial evaluation issues would become coat effective when compared with the safety goal cost-benefit QDO guideline.

In summary, comparisons of the NRR trial evaluation issues with the 1983 safety goals have provided a useful perspective concerning decisions where the safety goals might have been beneficial and on certain problems in the use of the 1983 safety goals. More detailed discussions related to comparisons of the NRR trial evaluations with the 1983 safety goals are provided in Section 2 of this report.

St# NARY TABLE - NRR TRIAL EVALUATIONS BEST ESTIMATE COMPARISONS WITH 1983 SAFETY G0ALS ,,-

Ratio Parameter [(b) (c) (d) (e)]

afe y G alValue QD0 ISSUE (a)

Action Core Early latent Supported Occupational Radiation Melt Fatality Fatality Cost-Benefit NRC by Exposure (person-res (ACM) (C/B) Action Safety Goals per reactor life (f)

(APEF) IO LP)

AFWS Reliability 3 8E-1 4E-4 7E-1 SRP revised Yes Negligible Criterion (II.E.1) 2E-1 4E-1 to 2E-4 to 2E-1 to PTS Rule Yes Not determined l Prcssurized Thermal Shock (USI A-49) to 9 2E+1 1E-2 2E+1 Auto PORV/ BLOCK SE-2 2E-2 2E-5 2E+1 Not required Yes Negligible Valve (II.K.3.1,2)

PWR Asymmetric Blow IE-3 1E-4 SE-8 . 3E+4 Not required Yes 700 l

down Load (USI A-2) i BWR SRV Pool Dynamic 6.8 4E+1 SE-2 3E-3 Compliance Yes N/A w Loads and Temperature with staff criteria, BWR

. Licits (USI A-39) Mark II, III Steam Generator Tube Degradation & Rupture (USI A-3, A-4, A-5)*: g h (1) SWC/CISI Program 7E-3 3E-2 3E-5 3E+1 g h -(1000 to 8000)

(2) SSI/QA Program 1E-2 4E-2 SE-5 2 g h 350 (3) Full-lengtn tune 3t-3 9E-3 IE-5 IE+1 g h 150 insp. & insp.

interval 0 0 0 g h Negligible (4) Coolant iodine g h 30 (5) Pria/sec. leak 2E-3 6E-3 SE-6 1E+2 rate (6) Safety injection 2E-4 SE-4 7E-7 SE-2 9 h Negligible reset

NOTES: a) T ra in parenthes2s indicctes USI designated number er TMI Actica Plan item number. I' b) Scientific Notation: (NE-2 = Nx10 2), (NE+2 = Nx102), A,-

c) Safety goal QOO values (see below) d) Whole numbers are above the safety goal QDO limits. ' Fractional (<1.0) numbers are below the safety goal Q00 limits.

e) Cost-benefit ($1000/ person-rem averted) does not include averted costs.

f) Negative sign indicates reduction in occupation radiation exposure (ORE) g) Recommended, but not required.

h) Staff action was in form of a recommendation rather than entered as a requirement.

• The NRC integrated program for the resolution of USI A-3, A-4,. A-5 involved multiple programs. Each program (issue) is evaluated as a separate issue in regard to mortality

• risk and the cost and benefits that are attributed to that issue.

u LEGEND, 000s: CM: Core-melt frequency = IE-4/RY

= SE-7/RY PEF: Probability of early fatality PLF: Probability of' latent fatality = 2E-6/RY C/B: Cost / benefit = $1000/ person-rem averted RY: Reactor Year A

. 3 1 EVALUATION APPROACH 1.1 General The principal results of the trial evaluations in comparison with the safety goals (Ref. 1) are presented as responses to nine questions that were specifically developed to help achieve reasonable consistency in the safety goal evaluation program (SGEP) (Ref. 2). The questions are given in Section

1. 2. Responses to the nine questions, following a brief description of the trial evaluation issue and its associated regulatory action, are provided in Section 2.

To the extent practical, the detailed NRR trial evaluations in this report started with the regulatory analyses, including value-impact analyses, that were developed for e 'ected issues documented in the respective review packages prepared the Committee to Review Generic Requirements (CRGR).

These analyses were augmented by the CRAC-2 computer code calculations for generic boiling water reactor (BWR) and pressurized water reactor (PWR) plants to arrive at the risk (fatality) estimates. The evaluations are as quantitative as they can reasonably be made, with further qualitative comments provided as necessary.

The methods of analysis used to augment the regulatory analyses are described in Section 1.3. The augmented regulatory analyses constitute the detailed NRR trial evaluation analyses provided in Section 3. The Section 3 analyses provide the bases for the comparisons (responses to the nine questions) made in Section 2.

1. 2 Method of Comoarison As stated in Section 1.1, a consistent comparison of the NRR trial evaluations and the safety goals was desired. This is accomplished by using a set of standard questions. The standard questions developed in Reference 2 for this purpose, are as follows:

(1) How do the estimated early and latent mortality effects compare with the corresponding safety goal design objectives?

(2) How does the estimated value/ impact ratio compare with the cost-benefit guidelines?

(3) How does the estimated core-melt frequency resulting from the issues at hand--and frequency reduction to be achieved-- compare with the core-melt likelihood guideline in the plant performance design objective?

sg

. .1 s

t s

4 g l 1 N, y~

.; a (4) Ho;.[does the hroposed requirement stand in' relation to the s defense _in-depth guidance in the last paragraph of the plant performance design cbjectiv'e?

(5) Are$there factors in the issue at hand that bear significantly on the' qualitative safety goals but are not involved in any of the

'a qulatitative designiobjectives? If so, what are the factors and effects, and how significant are they?

,(6) What are the uicertainties and uncertainty bounds in the C

results of items <(1) to (5)? What, if anything, is unusual in these

'4' ,

uncertainties? To what, factors are the results sensitive and how? The s Ifattes includes' consideration of such factors as the effect of ii occupational radiological. exposure (CRE), consequences and consequence i pathways that may not be adequately reflected (or reflected at all) in the calculation models used, the affect of averted plant damage on the cost-l.enefit guideline comparison, and so forth.

(7) W5at regulatcry decision does ';6e evaluation suggest? On wtiat basis? How clearly? How coes this compare with the decision

~

, actuallytake?{

(8) HowhelpfulwouldthesafetygSalshavebeenasadecision i

guide in this case? -

'(9) W at special problems or'difficultics, if any,s.ere ensountered in a; plying the safety:gcal in this case?

\ .. A ' w w

' Responses to the above- questions shouM provide consistent and complete summety: comparisons of each of the NRR trial evaluations to the 1983 safety goals Diaf.1).. ;By dssign, the questions and responses may also identify arise througn use of the 1983 safety goals.

potential In those situatidns ~problin.Narcas that m6y's the questh n direct a respor:se toward potential remedies to the problems. , ,

References for Sections 1 and 2 are identified in Section 1.4. In addition, each of the sunwary evaluations in Section 2 relies on the corresponding detailed trial evaluations in Section 3. References used in the detailed 4 trial evaluations contained ir,'Section 3 are identified at the end of each trial evaluation analysis.

1.3 ,M[thodofAnalyses. , ,

1.3.lg. Reduction of Risk'to Puolic The risk reduction resulting from a regulatory action is assumed to be represented by the difference between tne base case before the action is A

h /

e m

/

A

_a s

p g t

u - r S d g

b .

taken and the adjusted case that would result from implementation of the action. This calculation is performed for a generic plant. Because many of the regulatory actions evaluated involve different numbers of plants, types of plants, or general conditions for certain plant groupings, the results and comparisons are presented on a per plant basis for the affected plants. The overall risk reduction from the regulatory action can be approximated by the sum of the total contribution from all affected plants represented by the generic plant over the average remaining operating lives of the affected plants.

1.3.2 Dose Equivalencies for Release Categories Release frequencies, consequence factors, and uncertainty estimates are required for each radioactive material release category. Dose consequence factors were estimated for the light water reactor release categories defined Lin WASH-1400 (Ref. 3). The computer program CRAC-2 was used for the calculations applied to a typical Midwest site (Braidwood). Assumptions and parameters used for the calculations were as follows:

(1) Dose consequences are represented by the whole body population dose commitment (person-rem) received within 50 miles of the site.

(2) An exclusion area of 1/2 mile with a uniform population density of 340 persons per square mile beyond 1/2 mile was assumed. (This is the projected average 50-mile-radius population density around U.S. LWRs for the year 2000.)

(3) Evacuation of people was not considered.

(4) Meteorological data were taken from the U.S. Weather Service station at Moline, Illinois.

(5) The core inventory at the time of the accident was assumed to be represented by a 3412 MWt (1120 MWe) plant.

(6) For core-melt sequences, all exposure pathways except ingestion were included.

The calculated dose consequences to the public are nearly independent of the choice of reactor site. The only site-dependent parameters are reactor power level and the meteorogical data base. The power level determines the radionuclide inventory in the reactor at the time of the accident. The calculated dose sequences can be assumed to be approximately proportional to the power level. The meteorogical data base has very little influence on the calculated doses. Sample calculations for the first three release sequences (PWR 1A,1B and 2) yielded nearly identical results when New York City meteorological data were substituted for Moline, Illinois data. The

calculated dose consequences for a reactor power level other than the 1120 MWe Braidwood capacity used can be estimated by a ratio of the reactor power level to that of Braidwood. Because a uniform population distribution was used, the calculated dose consequences were not dependent on the Braidwood site demographic data.

For the reasons given above, the dose consequence factors may be considered generic. The use of generic dose calculations in this report was a convenience and was assumed to introduce errors that are acceptably small, considering the wide uncertainties that are involved in any event. Risk studies subsequent to WASH-1400 have tended to use the same release category definitions, so few problems related to models of radionuclide amounts / rates are introduced. Similarly, the environmental transport and human exposure functions used in each risk assessment are essentially similar to those for WASH-1400, with some updating required. .The demographic function is highly site dependent, varying from plant to plant, but the use of a constant population density simplifies the comparison of issues not related to siting and provides a reasonable means to compare a broad range of. issues with the safety goal QD0s and the relative importance of one issue to other issues.

With the exception of regions having zero population densities, the per-person probability of fatalities appears insensitive to population

' density. However, the person-rem dose to the total population within the 50 mile radius is proportional to the population density. Thus, the safety benefit (value) in the benefit / cost (value/ impact) analysis is sensitive to plant power rating and the site specific population density. Sites in high population density areas with similar plants will therefore derive higher benefit / cost (value/ impact) ratios than sites with low population densities for the same modification costs.

1.3.3 Occupational Risk: A General Discussion Occupational radiation exposure (ORE) doses are quantified in person-rem of whole body dose. These doses can arise from implementation and maintenance of the action taken to resolve an issue, as well as during cleanup, repair, and refurbishment of power plants following accidents. The total occupational risk is the algebraic sum of incremental changes resulting from implementation and maintenance of the regulatory action and the accident-related dose weighted by the reduction in accident frequency.

l 1. 4 References (1) NUREG-0880, Revision 1, " Safety Goals for Nuclear Power Plant Operation," U.S. Nuclear Regulatory Commission, May 1983.

(2) Memorandum from T. Speis to NRR Division Directors, "NRR Safety Goal Evaluation Work Plan," December 2, 1983.

l ,

1 l

(3) NUREG-75/014 (formerly WASH-1400), " Reactor Safety Study," U.S. Nuclear Regulatory Commission, October 1975.

(4)- NUREG/CR-2239, " Technical Guidance for Siting Criteria Development,"

U.S. Nuclear Regulatory Commission, December 1982.

(5) NUREG-0933, "A Prioritization of Generic Safety Issues," U.S. Nuclear Regulatory Commission, December 1983.

+

4:  :.

2 HIGHLIGHTS OF THE TRIAL EVALUATIONS 2.1 Reliability Criteria for Auxiliary Feedwater Systems 2.1.1 Background

~

As a result of the accident at Three Mile Island Unit 2 (TMI-2) in 1979, the staff required a reevaluation of the auxiliary feedwater systems (AFWS) for all PWR operating plants and applicants for PWR plant operating licenses. The staff reevaluations ~showed that eleven PWRs had AFWS unavailabilities greater than_the requirement described in Section 2.1.2, below. The comparisons reported below' pertain to these eleven plants and not to all PWRs.

~

Comparisons of results from detailed evaluations of the AFWS reliability to' plant performance design objectives contained in safety goals are provided in Section 2.1.3. The comparisons are in the form of responses to the nine questions stated in Section 1.

2.1. 2 Requirement ,

The reliability of the AFWS should comply with the requirements of General Design Criterion (GDC) 34 (10 CFR 50, Appendix A) as identified in Standard Review Plan (SRP) Section 10.4.9, Revision 2 (NUREG-0800). The current SRP Section 10.4.9 requires a demonstration of acceptable reliability and power diversity in the AFWS. Specifically, an acceptable AFWS should have an unreliability no greater than 1E-4 to 1E-5 per demand'for all expected events.

2.1.3 Comparisons with Safety Goal (1) Mortality Risks The calculations indicate that the probability of early fatalities for the AFWS criteria is 3.9E-7/RY. Comparison with the safety goal QD0 (SE-7/RY) shows that the improvement in reliability of the AFWS may account for 78% of the safety goal QD0 (i.e., approximately equal it) for those plants not l-meeting the current reliability criteria.

l The probability of latent cancer fatalities for this issue is 7.8E-10/RY.

Comparison with the safety goal QD0 (2E-6/RY) shows that the early fatality QDO dominates the latent fatality QD0 by approximately three orders of magnitude.

The' probabilities of fatalities for sites with plants operating at less than 1120 MWe are proportionately lower.

i (2) Cost-Benefit Ratio The value-impact assessment of the AFWS criteria was estimated at 1.45 person rem averted per $1,000 cost. Comparison with the safety goal QD0 (1 person-rem averted per $1,000 costs) suggest that implementation of the AFWS reliability criteria meets the safety goal benefit / cost QDO.

Those 1120 MWe plants with higher or lower population densities than the generic population density (340 persons / square mile) will derive higher or lower calculated value/ impact ratios, respectively.

(3) Core-melt Frequency A~ pre-implementation value of 1E-3/ demand was used for the AFWS

' unavailability. The evaluation showed that eleven reactors had an AFWS unavailability of 21E-3/ demand. The minimum AFWS reliability (IE-4/ demand) for the AFWS criteria reduced the core-melt frequency from 3E-4/RY to 3E-5/RY. The change (reduction) in core-melt frequency attributed to the AFWS reliability criteria is 2.7E-4/RY for the eleven plants. Thus, a 90%

reduction in core melt frequency, which is related to AFW unavailability in the eleven plants that do not meet the AFWS reliability criteria, seems likely.

The reduction in core-melt frequency of 2.7E-4/RY exceeds the safety goal QD0 of 1E-4/RY for the total allowable core-melt frequency.

(4) Defense in Depth The improvement in AFWS reliability has no direct bearing on the safety goals' continued emphasis on defense in depth.

(5) Qualitative Goals No applicable factors.

(6) Uncertainties In addition to the usual wide uncertainties associated with core-melt' and risk calculations, variable uncertainties exist related to plant-specific response capabilities to a loss of the AFWS. For some plants, feed and bleed operations, or use of the condensate pumps or firewater systems, may provide alternative sources of feedwater to mitigate or reduce the chance of core melts. Credit for such alternative methods can only be determined by a plant-specific analysis and review.

Little or no effect is anticipated for ORE. As discussed in responses (1),

(2), and (7), the plant-specific fatality estimates and cost / benefit ratios are sensitive to the plant power rating and site population density.

(7) Regulatory Decision The generic evaluation results when compared with the safety goal QD0s suggests implementation of an AFWS reliability criterion because of important improvement potentials in reduction of core-melt frequencies, reductions in potential- early fatalities, and cost-effective modifications.

The decision to implement the AFWS reliability criteria is consistent with the action that would have been suggested by the safety goal QD0s, had they been part of the regulatory process.

The AFWS could be a dominant contributor to core melt and early fatality probabilities for the eleven plants in this study. The total core-melt and fatality probabilities from all causes was not determined. Therefore, allocation of a fraction of the safety goal QD0s to specific systems, or issues, would further stress the importante of the AFWS reliability criteria.

Such a safety goal QDO might suggest a lower unavai, lability than the minimum of IE-4/ demand included in the current criteria.

Plant (site) specific power ratings and population densities will affect the fatality estimates and the benefit / cost (value/ impact) ratios.

(8) Helpfulness of Safety Goals The safety goals are helpful as an aid to the decision process. (See response (7), above.)

(9) Special Problems No special problems were identified.

l l

l W l.

2. 2 Pressurized Thermal' Shock 2.2.1 Background Pressurized thermal shock (PTS) transients involve rapid cooling of the reactor pressure vessel (RPV) internal surfaces. Such transients might induce thermal stresses of a magnitude sufficient to initiate, or propagate, through-wall cracks in the RPV. Because fracture resistance of the RPV material is dependent on the cumulative neutron radiation exposure (vessel irradiation), the PTS concern increases with each year of vessel irradiation.

The PTS concerns pertain to 16 PWRs that are projected to exceed the PTS screening criterion. These plants are divided into four groups of plants based on comparable core-melt frequencies. The 38 PWR plants not projected to exceed the screening criterion, for which fuel management techniques may provide adequate flux reduction, are not addressed.

2.2.2 Requirement NRC is proposing to amend its regulations for light water reactor nuclear power plants to (1) establish a screening criterion related to the fracture resistance of PWR vessels during PTS events, (2) require analyses and schedulestoimplementneutronfluxreductionprogramsthatarereasonably practicable to avoid exceeding the screening limit, and (3) to justify plant operation beyond the screening criterion. The proposed changes are intended to produce an improvement in the safety of PWR vessels by identifying those corrective actions that may be required to prevent or mitigate potential PTS events.

2.2.3 Comparisons with Safety Goals (1) Mortality Risks For the four groups of plants discussed above, the estimated probabilities of fatalities are as follows:

No. of Annual Probability of Fatalities Group Plants Early Latent 1 1 9.2E-6^ 1.9E-8*

2 4 1.8E-6 3.7E-9 3 3 6.5E-7 1.3E-9 4 8 1.8E-7 3.7E-10

a  :.

• The probabilities of fatalities for sites with plants operating at less than 1120 MWe are approximately-proportionately lower. As an example, the single group 1 plant is a 665 MWe plant. The generic fatality estimates for the group 1 plant should therefore be reduced by approximately 40%

(P 5 1.1E-8/RY). The approximation of the proportionate P EF a =ssum.5E-6/RY, Pestheearh=fatalitythreshold level is not penetrated. The rbaining15plantsareassumed to be represented by the generic analyses.

For the eight plants in groups 1 through 3 the estimated probability of early fatalities exceeds the safety goal QD0 of SE-7/RY. The group 4 plants (8 plants), with an average early fatality probability of 1.8E-7/RY, account for 36 percent of the safety goal QDO (SE-7/RY). All plants are two to four orders of magnitude below the safety goal QD0 (2E-6/RY) probability for latent fatalities.

(2) Cost-Benefit Ratio Comparison of the safety Goal QD0 cost / benefit guideline of $1,000/ person-rem averted with the four plant groups is provided below:

No. of Person-Rem Cost, Group Plants Averted / Plant $/ Plant $/ Person-rem 1 1 23,300^ 21.7E+6 930 2 4 3,900 21.7E+6 5,565 3 3 1,125 20E+6 to 3E+4 17,800 to 27 4 8 198 3E+4 152

• The group 1 plant is 665 MWe plant. The average population density within 50 miles of the group 1 plant was approximately 75 persons per square mile based on the 1970 census (see Table D.1.2 in NUREG/CR-2239). If the staff assumes that the population doubles from 1970 to some projected date within the remaining plant lifetime, the population adjustment for the group 1 plant is 150/340 = 0.44. Theggger{$0 person-remaverted(23,300)forthe665MWe plant can be reduced t 1120 340 (23,300) = 6100 person-rem averted. The adjusted cost / benefit ratio is therefore6lb (930) = $3,550/ person-rem averted. Therefore, the generic cost / benefit ratio shown above

($930/ person-rem averted), when adjusted to the specific group 1 plant value

($3,550/ person-rem averted) exceeds the safety goal QD0 by a factor of approximately 3.6. The remaining 15 plants are assumed to be represented by the generic analyses.

The five group 1 and 2 plants are assumed to undertake some redesign or large flux-reduction measures and to perform a probabilistic risk assessment (PRA) to justify continued operation above the screening limit. The three group 3 plants may or may not require large flux reduction measures or a PRA. The top values shown for the group 3 plants are large flux reduction costs, and the lower values are based on the assumption that large flux-reductions (or redesign) will not be required. The eight group 4 plants are assumed not to require extensive flux-reduction effort.

The above estimates indicate that the one group 1 and eight group 4 plants are within the safety goal QD0 cost-benefit guidelines. The cost-benefit for the three group 3 plants is strongly dependent on the to-be-determined need for extensive flux reduction. The four group 2 plants exceed the safety goal benefit / cost QD0 by a factor of 5.5.

(3) Core-Melt Frequency The average core-melt frequency per year for all years the plant would operate above the screening limit without flux reduction measures was compared with the core-melt frequency at the time the screening limit was reached. Assuming no significant increases in core-melt frequency beyond the screening limit (resulting from flux-reduction or equivalent risk-reduction modifications), the potential reductions in core-melt frequencies for the four groups of plants are:

No. of Group Plants ACM/RY l 1 9E-4 2 4 2E-4 3 3 7E-5 4 8 2E-5 The group 1 and group 2 plants exceed the safety goal QD0 (1E-4/RY). The group 3 and group 4 plants, account for 70 percent and 20 percent, respectively, of the safety goal QD0 for core-melt frequency.

(4) Defense in Depth

! A detailed containment failure modes analyses was not performed for the PTS l issue. The coatainment failure modes and probabilities were assumed to be analogous to large LOCA sequences. The PTS project is at present insufficiently complete to offer more meaningful insight into this subject.

l L

$* OO (5) Qualitative Goals The precautionary measures against a potential future PTS problem clearly support the first qualitative goal (of no significant additional risk to life and health) despite the unusually large uncertainties in the quantitative risk estimates.

(6) Uncertainties At the present time, the uncertainties in this issue are difficult, if not impossible, to quantify. Thus, possibly considerable (although unquantified) conservativeness was introduced into the selection of maximum allowable reference temperature for nil-dictility transition (RT since it is very unlikelythatallthrough-wallcrackswouldresultin$D[o)r,emelt. As much as two orders of magnitude, or more, conservativeness could be inherent in the core-melt estimates, depending on whether most, a small fraction, or almost none of potential through-wall cracks would lead to vessel rupture and core melt. Containment failure was assumed to result from missiles generated by the fractured vessel and overpressurization analogous to large LOCA sequences. This assumption may have introduced additional conservativeness -

(perhaps one to two orders of magnitude) into the calculated risks if large energetic missiles are not in fact formed.

The effect of this issue on ORE has not been determined because the actions to be taken have not yet been finalized.

As previously discussed, the cost-benefit ratio is sensitive to the plant power rating and site population density.

(7) Regulatory Decision The evaluations suggest that PTS might be a dominant contributor to risk for some plants. However, it must be recognized that the estimates are believed to be directed toward conservative values (overestimates) in the interest of maintaining minimum risk potential through the selected screening criteria.

The uncertainties in this issue are believed to be large, especially in terms of the lower bounds.

In view of the preceding, the results indicate that the issue is indeed rightly regarded as an Unresolved Safety Issue (USI), and that the NRC staff and. industry should focus on reducing the uncertainties centered around PTS.

The decision to implement the PTS requirement is comparable with the decision that would have resulted had the believed intent [see response to Question (9)].of the safety goals been applied to this issue.

i r

. t.4 1 (8) Helofulness of Safety Goals The QD0s would have been of very limited help in the decision process, because of the unusually large knowledge gaps and quantitative uncertainties in connection with crack propagation. (See items (7) and (9).)

(9) Special Problems There is' large uncertainty in the current state-of-the-art that addresses the PTS concerns. At the present time the staff can only assess the potential significance, but cannot accurately measure, or compare, the assessed results relative to a set standard like the safety goal QD0s. The staff position (requirement) to establish a conservative screening criterion pending final disposition of this issue appears to meets the intent but not the specific

-QD0s established in the safety goal.

The PTS is unique in that PTS risk increases with time. Thus, by setting conservative limits on the screening criteria, the time element is used to advantage; that is to allow time for better understanding of the multi-disciplined problems involved in PTS and development of better resolution (s), and decrease the uncertainties that currently exist in the PTS phenomena.

For some plants the PTS concern may be a dominant contributor to core melt and public risk. -An apportionment of a fraction of the safety goal QD0s to individual or dominant contributors would better stress the disproportionate importance of such concerns to overall plant performance QD0s. The large uncertainties for the PTS issue raise considerable concern about the importance of relying solely on current best estimate calculations to direct the decision making process [see response (6)].

Plant (site) specific power ratings and population densities will affect the fatality estimates and cost-benefit ratios. Examples of these effects are provided in responses (1) and (3) above.

2.3 Automatic Power Operated Relief Valve Isolation System (IMI Action Plan Items II.K.3.1, II.K.3.2) 2.3.1 Background As a result of the TMI-2 accident in 1979, the staff issued a number of actions (requirements) to plant licensees. This trial evaluation addresses one of the requirements established in response to a problem that was determined to be a leading contributor to the severity of the'TMI accident, namely, the undiagnosed small-break loss-of-coolant accident (SBLOCA) through a stuck-open power operated relief valve (PORV).

t

. . ~~ . _ _ . . . . _ . _ , - . . _ _ . . _ . . . _ . _ . _ . . . _ . _ . . . _ . _ . . _ . . ._

W b r-4 2.3.2 Requirement TMI Action Plan Item II.K.3.1, if required by results of the study performed in TMI Action Plan Item II.K.3.2, would require the licensees to implement i . automated PORV isolation systems. The isolation system would consist of automated block valves in the PORV piping runs to ensure against a SBLOCA should the PORV stick open. This system would automatically close the block-valve after the PORV opened and the reactor coolant system pressure decayed-

to a specific pressure.

2.3.3 Comparisons With Study Goals (1) Mortality Risks ~

The reduction in estimated probablities af early and latent fatalities are approximately 9E-9/RY and 3E-ll/RY respectively. The probability of early '

fatalities is approximately 2 percent of the safety goal QD0 of SE-7/RY. The L probability of latent fatalities is approximately 1E-3 percent of the safety goal QDO. ,

i.

i The reductions.in probabilities of fatalities for plants designed to less

!. than 1120 MWe are proportionately lower. ,

(2) Cost-Benefit Ratio e

! The cost-benefit assessment for automation of the block valves was estimated

at $2400/ person-rem averted. Comparison with the safety goal cost-benefit j QDO of $1000/ person-rem averted is well within the uncertainty range.

Those 1120 MWe plants with higher or~ lower population densities than the generic plant population density (340 persons per square mile) will derive higher, or lower, cost-benefit ratios.

Potential reductions in normal operating costs (reductions in forced outages and repairs) could significantly improve the cost-benefit ratio for this issues.

I (3) Core-Melt Freauency The core melt frequency for SBLOCAs attributed to the PORV/ block valve systems was estimated at 4.6E-6/RY. The reduction in core-melt frequency

. that might result from automating the block valves was estimated at -

o l 4.1E-6/RY. Therefore, approximately 90 percent of the PORV/ block-valve

[ SBLOCA frequency might be eliminated by automating the block valves. 1

l. '

i

u t.

~

Before implementation of the automated block valves the SBLOCA core-melt frequency (4.6E-6/RY) is approximately 5 percent of the safety goal QD0 for core-melt frequency (IE-4/RY). The SBLOCA core-melt frequency (5.9E-7/RY) after implementation of the automated block valves is approximately 1 percent of the safety goal QD0 for core-melt frequency (1E-4/RY).

Thus, a reduction (4.1E-6/RY) in the SBLOCA core-melt frequency may result from automation of the block valves. This reduction in core-melt frequency is approximately 4 percent of the safety goal QD0 (1E-4/RY), which pertains to an overall plant core-melt frequency.

(4) Defense in Depth The safety goals do not provide quantitative design objectives for defense in depth considerations, nor do they address qualitative design objectives for the various types of defense in depth that exist in reactor designs and operations. Many plants operate with the PORVs blocked because of PORV leakage problems, and there are no Technical Specification requirements that these components be operational when the plant is at power. Operational

- PORVs (unblocked) could lessen the potential for a SBLOCA through failure of a safety-relief valve (SRV) to reseat during a transient. Thus automated and operational PORV/ block valve systems could provide an additional layer of defense in depth to reduce the potential for a SBLOCA through the SRVs.

However, the SBLOCA frequency for the SRVs is approximately an order of

-magnitude lower than the SBLOCA frequency for the PORV/ block valve!s.

Therefore, automation of the PORV/ block valve system to preclude a SRV SBLOCA has little significant bearing on the concern for loss of defense in depth.

(5) Qualitative Goals No applicable factors.

(6) Uncertainties The main uncertainty centers around the prob 5Dility of core melt given a SBLOCA. No credit has been given for potential aggressive cooldown by the secondary side. Such c edit can only be determined through plant-specific evaluations. Additional uncertainty is thought to reside in the operator error rate and the failure probability expected with automation of the block valves. For the latter uncertainties, the operator error rate may be higher and the automatic block valve actuation failure probability lower. The effect of these increasing differences might be a greater reduction in PORV/ block valve induced SBLOCAs if the block valves were automated.

The estimated potential reduction in SBLOCAs resulting from automating the block valves, could reduce plant outage costs by approximately $600,000 per f~

• o

. %i plant. The potential reduction in plant outage costs was approximately a factor of 10 greater than the implementation and maintenance costs for automating the block valves. Thus, automation of the block valves might be economically attractive in terms of long-term plant operations.

(7) Regulatory Decision Based on a strict, narrow interpretation of the QD0s and direct comparison of the risk and core-melt frequency reduction estimates with them, the decision taken not to require this action is consistent with the safety goal guidelines. The estimated cost / benefit ratio is marginal; however, because of the low estimated risk reduction potential, the cost / benefit calculation might not have been made.

(8) Helpfulness of Safety Goals The safety goals would have been helpful to the decision process (but see also (3), (6), and (7).)

(9) Special Problems An allocation of a fraction of the safety goal QD0s to single or generic

issues would stress the importance potential of this issue relative to the j overall plant performance objectives provided in the current safety goals.

2.4 Asymmetric Blowdown Loads on PWR Primary Systems (USI A-2) 2.4.1 Background .

Asymmetric blowdown loads in a PWR primary system could result from rapid decompression of the primary system through a double-ended guillotine break (DEGB) of one or more of the reactor coolant pipe loops.

2.4.2. Requirement To reduce the consequences of asymmetric blowdown loads, as described above, would require plant modifications in the form of additional piping restraints to prevent large pipe ruptures, and modifications to equipment supports to withstand the imposed asymmetric loads. The regulatory decision was not to establish such a requirement.

2.4.3. Comparisons With Safety Goals (1) Mortality Risks The estimated probability reductions for early and latent fatalities are approximately 6.6E-11/RY and 1.lE-13/RY respectively. Compared to the safety goals QD0s of SE-7/RY for early fatalities, and 2E-6/RY for latent P

'a

, 3c fatalities, the fatality estimates are four to seven orders of magnitude below the safety goal risk QD0s.

(2) Cost-Benefit Ratio For the 16 plants evaluated in Section 3 the cost-benefit ratios varied from

$5E+6/ person-rem averted to $106E+6/ person-rem averted. The average cost-benefit ratio was approximately $33E+6/ person-rem averted. In all l cases, the cost-benefit ratios are several orders of magnitude above the safety goal cost-benefit QD0 of $1000 per person-rem averted.

(3) Core-Melt Frequency The change in core-melt frequency that might result from from implementa'tion of piping restraints was estimated at 1.4E-7/RY. This estimate is

approximately three orders of maynitude less than the QDO of IE-4/RY for core-melt frequency as contained in the 1983 safety goals.

(4) Defense in Depth No qualitative'or quantitative evaluation was performed to compare with the defense-in-depth guidelines.

-(5) , Qualitative Goals No applicable factors.

(6) Uncertainties The probabilities of double-ended guillotine breaks (DEGB) used in the analysis ranged from 7E-12/RY to 1E-5/RY. The nominal (best-estimate) probability'of a DEGB was 4E-7/RY. The nominal (best-estimate) probability of a DEGB is therefore approximately three orders of magnitude less than the WASH-1400 medium frequency of a large LOCA (IE-4/RY). However, the proposed action related to asymmetric blowdown loads considered only piping sizes in the range of approximately 30 inches in diameter, whereas the WASH-1400 large breaks. spectrum was based on piping sizes greater than 6 inches in diameter.

Because of the small potential. reduction in core-melt frequency (1.4E-7/RY),

the probable' averted onsite damage costs, attributed to the plant modifications, was.approximately $1900/per plant. Therefore, the averted onsite damage costs have little effect on the cost-benefit relationship.

(7) . Regulatory Decision Comparison of the evaluation results with the safety goal plant performance design objectives indicates that the plant modifications would neither provide a significant improvement in plant performance, nor a significant e *.

reduction in public risks. However, the modifications would result in a significant occupational radiation exposure and extend plant outages to affect the modifications.

The ORE that would result from implementation and maintenance of plant modifications was estimated at approximately 700 person-rem per reactor.

'Thus, the estimated ORE for implementation and maintenance of the plant modifications is approximately 3500 times greater than the estimated public dose reduction (0.2 person-rem per reactor).

The above results combine into cost-benefit relationships that are far in excess of the cost-benefit guidelines proposed in the safety goals [see response (2)].

The decision made not to require the plant modifications proposed for asymmetric blowdown loads is consistent with a decision that would be suggested by the safety goals.

(8) Helpfulness of Safety Goals The safety goals would have been helpful in reinforcing the regulatory decision taken by application of a coherent decision standard. [see response (7)].

(9) Special Problems No special problems were identified.

2.5 Safety Relief Valve (SRV) Pool Dynamic Loads and Temperature Limits for BWR Containment (USI A-39) 2.5.1 Background During the period from 1972 through 1974, two major areas of concern were identified for the BWR Mark II and Mark III containment designs. One concern

.was the hydrodynamic loads created during the initial transient of SRV line clearing. Experimental and operational evidence indicated that these loads were significant and should be included in the design of containment structures, piping, and equipment.

The second concern involved the suppression pool terrperature limits.

Experiments indicated that, for sufficiently high steam fluxes, the steam-jet / water interface existing at the discharge line was relatively stationary as long as the local pool temperature was low. However, continued-steam blowdown into the pool would increase the local pool temperature and the condensation process would become unstable, possibly leading to severe vibrations in the pool. To preclude unstable condensation, limits are required for the allowable suppression pool temperature.

o 5.

2.5.2 Requirement NUREG-0802 provides the acceptance criteria for hydrodynamic loads on piping, equipment, and containment stuctures for the BWR Mark II and III plants during SRV operation. These acceptance criteria are not intended as a substitute for the regulations, and compliance with them is not required.

However, an approach or method different from these criteria would be acceptable to the NRC only if it provided a basis for determining that the regulatory requirements contained in 10 CFR 50 were met.

2.5.3 Comparisons with Safety Goals (1) Mortality Risks The estimated probability reductions for early and latent fatalities are approximately 2E-5/RY and 1E-7/RY, respectively. The probability of early fatalities exceed the safety goal QDO (SE-7/RY) by nearly a factor of 43.

The probability of latent fatalities is approximately 7 percent of the safety goal QD0 (2E-6/RY).

~

(2) Cost-Benefit Ratio The cost-benefit assessment was estimated at 400 person-rem averted per $1000 costs. The assessed cost-benefit ratio when compared to the safety goal cost-benefit guideline of 1 person-rem averted per $1000 cost is very favorable.

(3) Core-Melt Frequency The core melt frequency for the SRV dynamic loads was estimated at 7.5E-4/RY.

The reduction in core-melt frequency resulting from the USI A-39 requirements was estimated at approximately 7E-4/ fly. The 90 percent reduction in core melt frequency (7E-4/RY) estimated'tt, result from the USI A-39 requirements exceed the safety goal QD0 (1E-4/RY) by a factor of about seven.

(4) Defense in Depth The potential loss of defense in depth from the SRV dynamic loads issue involves potential loss of emergency core cooling systems (ECCS) resulting from suppression pool failure, and the loss of containment integrity resulting from overpressurization. These potential effects are included in the risks analysis results.

(5) Qualitative Goals No applicable factors.

[

w i.

(6) Uncertainties The risk analysis results are believed to be biased on the high side. The maximum reduction in core melt frequency is estimated at 7.5E-4/RY. The smallest reduction in core-melt frequency is estimated at 4E-6/RY. The bounds of the estimated cost-benefit ratio range from 440 person-rem averted per $1000 cost to 1.7 person-rem averted per $1000 cost.

No increase in ORE is predicted to result from this issue because only new plants that have had the modifications implemented during construction are involved. However, based on the reduction in core melt frequency resulting from this issue, the reduction in ORE resulting from accident avoidance is estimated at approximately 400 person-rem / plant.

The averted plant damage cost, based on the reduction in core-melt frequency, was estimated at $33 million per plant. Thus, the averted plant damage cost is approximately two orders of magnitude greater than the implementation cost. The economic incentive indicated by the averted plant damage cost was not factored into the cost-benefit evaluations.

(7) Regulatory Decision The evaluation suggests implementation of the requirements to effect (a) reduction of core melt frequencies, (b) reductions in early fatalities, (c) favorable cost-benefit relation, and (d) reductions in averted ORE and plant damage costs.

The decision to implement the SRV dynamic load requirements is consisten.t with the action that would have been suggested by the safety goal QD0s, had '

they been part of the regulatory decision process.

(8) Helpfulness of Safety Goals The safety goals would have been helpful in the decision process; see response (7).

(9) Special Problems No special problems were identified.

a io

2. 6 Steam Generator Tube Degradation and Rupture (USI A-3, A-4 A-5):

Secondary Water Chemistry and Condenser In-service Inspection Programs 2.6.1 Background This trial evaluation compares the design objectives in the safety goals with reductions of risks from steam generator tube rupture accidents. The estimated risk reductions result from implementation of the secondary water chemistry program (SWCP, SRP Section 5.4.2.1, Rev. 2) and condenser in-service inspection program (CISIP). The staff has recommended that industry follow the revised SRP in their plant-specific procedures, but that the procedures need not be specifically included in the license. The intent of the recommendation is to provide guidelines on improved measures to reduce degradation and rupture of the steam generator tubes. The SWCP and CISIP are part of an overall integrated program designated to resolve USIs A-3, A-4, and A-5.

The potential public risk reductions from steam generator tube rupture (SGTR) accidents resulting from these changes are based on an average PWR plant.

The assumed average PWR plant is weighted by 23 plants that have experienced medium degradations of the steam generator tubes, and 8 plants that have experienced severe degradations of the tubes. The 16 operating plants with little or no significant degradations of the steam generator tubes essentially already comply with the revised SRP.

2.6.2 Requirement The SWCP and the CISIP are not regulatory requirements, but are recommended by the staff as programs that may provide improved measures to reduce steam generator tube degradations and ruptures by mechanisms related to the secondary water chemistry.

2.6.3 Comparisons with Safety Goals (1) Mortality Risks For the average plant discussed above, the estimated probability reductions for fatalities are as follows:

No. of Annual Probability of Fatalities Plants Early Latent 31 1.3E-8 6E-11 s,

Based on the above fatality estimates, the probability of early fatalities is approximately 3 percent of the safety goal Q00 of SE-7/RY. The probability of latent fatalities is approximately five orders of magnitude below the safety goal QD0 of 2E-6/RY.

(2) Cost-Benefit Ratio Comparison of the safety goal QD0 cost-benefit guideline of $1000/ person-rem averted is provided below:

No. of Person-Rem Cost, Plants Averted / Plant ($)/ Plant $/ Person-Rem 31 67 2E+6 31,000 The above estimates are based on an average remaining plant life of 28 years.

The above cost estimates are based on implementation costs, operational costs, and maintenance costs over the remaining plant life. These costs do not reflect potential cost savings derived by implementation of the recommendation. The estimated cost savings from reductions in tube repairs, forced outages, and replacement of steam generators exceed the implementation, operation, and maintenance costs. The estimated cost savings range from approximately $10 to $352 million per plant, with an average of approximately $90 million per plant. The safety goal QDO does not explicitly consider potential cost reductions (averted costs) resulting from improved plant performances that may result from implementation of a regulatory requirement, or in this case, recommended plant procedures.

(3) Core-Melt Frequency The core-melt frequency from SGTRs is approximately 4E-6/RY. This issue affects only a fraction of the overall core-melt frequency from SGTRs. In this regard, approximately one-half of the SGTRs are attributed to tube degradation from the secondary water chemistry (SWC). Also, it was considered prudent not to credit potential reductions in SGTRs that may follow an anticipated transient without scram ATWS event. This latter consideration has no significant impact on the comparisons with the safety goal Q00s.

The estimated reductions in core melt frecuency attributed to an improved SWCP and CISIP is 7E-7/RY. Compared with the safety goal QD0 of 1E-4/RY for core-melt frequency, the reductions in core-melt frequency is more than two orders of magnitude below the safety goal QDO.

s, (4) Defense in Depth Two of the major staff concerns related to steam generator tube degradation and rupture are centered around loss of defense in depth provisions.

The first concern is the direct release of radioactive fission products. The primary system contains a certain amount of radioactive material entrained in the coolant even during normal operation. The steam generator tubes constitute a particularly important part of the reactor coolant system (RCS) boundary, because their failure allows contaminated primary coolant to pass into the secondary side of the steam generators where its isolation from the environment is not fully ensured. Thus the SGTR event involves a containment bypass that is a loss of defense in depth.

The second concern is that a loss of primary coolant water through the secondary side without the capability to recirculate the water (as would be the case for LOCAs inside containment) might result in loss of the defense in depth provided by the emergency core cooling system (ECCS).

(5) Qualitative Goals ,

The defense in depth aspects discussed in items (4) and (7) may be viewed as having a bearing on the qualitative safety goals though not subject to direct quantitative evaluations in comparison with the QD0s.

(6) Uncertainties The core-melt frequency predictions are a major source of uncertainty. The analysis was completed using a best-estimate value. However, potential risk reduction estimates based on the estimated reduction in core melt frequency are not significant when directly compared to the safety goal QD0s for risks and core melt frequency. Additional uncertainties are present in the cost estimates. The analyses do not reflect all costs that may be incurred by plants needing extensive equipment replacement. However, these costs would likely be small compared with steam generator replacement costs, and would also be balanced by later averted costs resulting from the economic benefits derived from decreases in tube rupture and associated downtime.

The estimated core melt frequency resulting from SGTRs may therefore lead to an overestimate of the person-rem saved per dollar spent in the benefit-cost ratio given. However, utility costs are also developed from the same estimates of SGTR and repair. Thus, no significant net changes in the estimated ratio would be expected.

The estimated public risk reduction for the average plant was not significantly different from separate estimates based on plants with medium and severe degradations of the steam generator tubes. However, there was a significant difference in the estimated ORE between plants with medium and severe degradations of the steam generator tubes. For SWCP, the incremental

'o n.

changes in ORE were negligible in both cases. But for the CISIP, the increase in ORE was estimated at 6 to 30 person-rem annually for plants with medium and severe degradations of the steam generator tubes respectively.

Avoided ORE doses resulting from the reduced need for tube repairs in the medium group plants was estimated at 1230 person-rem per reactor. Avoided ORE doses due to reduced need for tube repairs and steam generator replacement was estimated at 8400 person-rem /R for the plants in the severe group.

The potential reductions in ORE as reported under (7) below, and discussed above, may be overestimates because of recent significant improvements in steam generator decontamination procedures and repairs. However, if averted plant damages estimated at approximately $10 million per plant for plants in the medium group and $325 million per plant for plants in the severe group were considered, the cost / benefit ratios for public risk reductions, and ORE risk reductions would be significantly lowered. In the latter case, the recommended SWCP and CISIP provide small but positive reductions in public risk, medium to large reductions in ORE, and significant cost savings for the industry.

(7) Regulatory Decision A regulatory decision to establish the SWCP and CISIP as a regulatory requirement is not supported by direct comparisons with the safety goals.

The decision to propose the SWCP and CISIS as recommendations to improve steam generator performance was taken in a context in which occupational exposure and certain other considerations not covered by QD0s had a role, as briefly discussed immediately below.

The net effect resulting from implemencation of the SWCP and CISP is a reduction in ORE of approximately 1000 person-rem /R for plants in the medium group, and an ORE reduction of approximately 8000 person-rem /R for plants in the severe group. Cost-benefit ratios, based on the above net reductions in ORE, and implementation costs are $350 per ORE person-rem averted for plants in the severe group and $1200 per ORE person-rem averted for plants in the medium group.

An allocation of a fraction of the safety goal risk QD0s to single issues, or concerns, such as SGTR events would place more importance on SGTRs.

The currently proposed safety goals do not provide quantitative design objectives for loss of defense-in-depth considerations similar to those described in response (4), above. The severity of the event is sensitive to the frequency, and potential release magnitude of containment bypass type events.

s. $. '

l l

For SGTR events, the modelings used to represent single and multiple SGTRs were based on PWR 4, and PWR 2 type of releases, with WASH-1400 source terms  ;

updated to a 1120 MWe plant. The PWR 4 release was assumed analogous to a failure to isolate the containment, or an opening in containment of approximately 3 to 4 inches in diameter. Single SGTRs provide a containment bypass opening of less than inch in diameter for double-ended type ruptures.

The water seal provided by the coolant in the steam generators (secondary side) will tend to further scrub the released fission products. SGTR events that involved overfill of the steam generators may carry and release the contaminated coolant directly to the atmosphere via the atmosphereic dump valves, or release the contaminated coolant to the turbine condenser. The i etaff is examining, in further detail, steam generator overfill concerns  !

(NUREG-0933, Generic Issue No. 67). In the interim, the estimated risk, ,

based on PWR 4 ' releases, is expected to bound the risks associated with  !

single SGTRs.  !

PWR 2 releases were used to model multiple SGTRs. The releases, and risks, [

attributed to multiple SGTRs are expected to be bounded by the results of the -

analyses. , i The potential for the loss of ECCS associated with SGTRs was modeled into the analyses. Therefore, the significance of loss in defense in depth was included in the analyses.

Based on the above discussion, the staff analyses have inherently considered loss of defense in depth related to SGTRs. However, quantitative design ,

objectives to compare with these types of events are not currently provided in-the safety goal QD0s.  ;

(8) Helpfulness of Safety Goals  :

The safety goals would have been of some, though limited, value as an aid to the decision process. However, decision weighting factors beyond the current i safety goal QD0s were used to reach the decision taken. These weighting factors involved ORE considerations and averted costs. These factors are not in the current safety goal Q00s.

(9) Special Problems  !

See responses (7) and (8). j r

l '

i i

i i

'o

. t.

2.7 Steam Generator Tube Degradation and Rupture (USI A-3, A-4, A-5:

Other Program Elements 2.7.1 Background The regulatory response to the steam generator tube rupture (SGTR) issue contained several additional recommended programs beside the water chemistry and condenser inspection programs dealt with in subsection 2.6, above. The present subsection (2.7) presents the highlights of trial evaluations with respect to those additional programs.

2.7.2 Requirements The additional recommended SGTR programs are as follows:

(a) Secondary Side Inspection (SSI) and Quality Assurance (QA) Programs.

SSI is intended to detect loose parts on the secondary side of steam generators. Operating experience suggests that half the SGTRs encountered can be traced to such loose parts. The QA program would provide detailed accountability procedures for all tools, equipment, and parts used during the steam generator inspection, modification, or repair.

(b) Full-Length Tube Inspection and Maximum Steam Generator Inspection Interval.

The staff recommendation for full-length steam generator tube inspections would revise the definition of the U-tube inspection to include inspections of the hot leg and cold leg of the U-tube. The revised definition would not require that the hot-leg and cold-leg inspection samples be from the same tube. The maximum inspection interval for any steam generator would be 72 months.

(c) Coolant Iodine Activity Limits.

All PWRs should meet the coolant activity limits of the Standard Technical Specifications (STS) even where the plant-specific Technical Specifications are less restrictive.

(d) Primary-to-Secondary Leakage Rate Limits.

All PWRs should meet the STS limits regardless of any less restrictive specific plant Technical Specifications.

_-_ ____ _ - _ _-_a.__-

+ s.

(e) Safety Injection Reset.

Automatic switchover of safety injection (SI) pump suction from the boric acid storage tank (BAST) to the refueling water storage tank should be evaluated to determine whether the switchover should be made on the basis of low BAST level alone regardless of SI signal status.

2.7.3 Comparisons with Safety Goals (1) Mortality Risks The estimated reductions in the probability of early and latent fatalities for the other program elements that comprise the resolution of USI A-3, A-4, and A-5 are:

Annual Probability of Fatalities Proaram Element Early Latent (a) SSI/QA 2E-8 10E-11

~

(b) Full-length Tube Inspection and Inspection Interval 4.5E-9 2E-11 (c) Coolant Iodine *

• Limits (d) Primary / Secondary Leakage Limits 3E-9 IE-11 (e) Safety Injection Reset 2.7E-10 1.3E-12 "The USI A-3, A-4 A-5 program element that recommends coolant iodine limits does not impact core melt directly. Therefore the coolant iodine limit is not comparable to the safety goals.

Comparisons of the individual program elements with the safety goal mortality risk QD0s indicate that the SSI/QA program element accounts for approximately 4 percent of the safety goal early fatality QDO (SE-7/RY), and the remaining program elements are even less. The combined sum of the reduction in early fatalities would be less than the arithmetic sum of the individual elements.

The estimated reductions in the probabilities of latent fatalities are five to six orders of magnitude less than the safety goal Q00 (2E-6/RY), and therefore negligible.

~

p t.

(2) Cost-Benefit Ratio The estimated cost / benefit ratio of the program elements are:

Cost / Benefit Program Element ($/ person-rem averted)

(a) SSI/QA 2,000 l

(b) Full-length tube Inspection and Inspection Interval 12,500 (c) Coolant Iodine Limits N/A (d) Primary / Secondary Leakage Limits 100,000 (e) Safety Injection Reset 500,000 i The cost-benefit ratio for the SSI/QA program element is comparable to the l safety goal cost-benefit QDO ($1000/ person-rem averted). The estimated averted costs from reduced steam generator tube ruptures and forced outages range from $3E+6 to $12E+6 per plant with an average of approximately $7.5E+6 per plant. The cost-benefit ratios listed above include only the implementation and maintenance costs. Thus, if the averted added plant operation costs are considered, the SSI/QA is economically attractive to the industry.

The cost-benefit estimates for the remaining program elements are not attractive when compared to the safety goal cost-benefit QDO

($1000/ person-rem averted). For program elements (b) and (d) the averted costs essentially balance the implementation and maintenance costs used in the above cost-benefit estimates. Therefore, if averted operational costs are considered, the program elements (b) and (d) would provide small risk reduction potentials with implementation and maintenance costs that are balanced by averted operational costs. The SI reset program element (e) has negligible averted costs, but the implementation costs is only approximately

$27,000/ plant and only approximately 10 plants would need the SI reset modification.

(3) Core-Melt Frequency The overall core-melt frequency from SGTRs is approximately 4E-6/RY. The program elements that are combined in this section are part of the proposed resolution of USI A-3, A-4, and A-5. The estimated potential reduction in core-melt frequency for the individual program elements addressed in this section are:

. s.

Program Element aCM/RY (a) SSI/QA 1E-6 (b) Full-Length Tube Inspection and Inspection Interval 2.5E-7 (c) Coolant Iodine Limits N/A (d) Primary / Secondary Leakage Limits 2E-7 (e) Safety Injection Reset 2E-8 The reduction in core-melt frequency for program element (a), SSI/QA, is approximately 1 percent of the safety goal QD0 of 1E-4/RY. The remaining program elements are approximately three to four orders of magnitude below the safety core-melt QDO.

(4) Defense in Depth

• Two of the major staff concerns related to steam generator tube degradation and rupture are centered around loss of defense in depth provisions.

The first concern is the direct release of radioactive fission products. The primary system contains a certain amount of radioactive material entrained in the coolant even during normal operation. The steam generator tubes constitute a particularly important part of the RCS boundary because their failure allows passage of contaminated primary coolant into the secondary side of the steam generators, where its isolation from the environment is not fully ensured. Thus, the SGTR event involves a containment bypass that is a loss of defense in depth.

The second concern is that a loss of primary coolant water through the secondary side without the capability to recirculate the water (as would be the case for LOCAs inside containment) might result in loss of the defense in depth provided by the ECCS.

(5) Qualitative Goals The defense in depth aspects discussed in items (4) and (7) may be viewed as having a bearing on the qualitative safety goals though not subject to direct quantitative evaluation in comparison with the QD0s.

g~ .

- ,c.

i i

d (6) Qncrirtainties The core-melt frequency predictions are a major source of uncertainty. The analysis was completed using a conservative best-estimate value. However, potential risk reduction estimates based on the estimated reduction in core-melt frequency are not significant when directly compared with the safety goal:000s for public risks and core-melt frequency.

Additional uncertainties are present in the cost estimates. The analyses do not refYact all costs that may be incurred by plants needing extensive equipment replacement. However these costs are likely to be small compared wi.th. steam generator replacement cost, and would be essentially balanced by caverted costs resulting from economic benefits derived from decreases in

'SGirs and associated downtime.

, (7) Rppulatory Decision

~

A regulatory decision to establish the program elements in this section as regulatory requirements is not supported by direct compariscos with the D safety goals.

h i A 1

, The decision taken to propose the USI A-3,' A-4, A-5 program elements of this b s section for recommended implementations was based on reducing the frequency i! of SGTRs (which are difficult operational transients) with minimum ORE impact and minimum cost impact to the industry. The SSI/QA program is estimated to provide the largest potential reduction in SGTR frequency and public risks when compared with the other program elements. Collectively the remaining program elements provide little additional reduction in SGTR frequency and public risks.

The incremental ORE estimated to result from implementation of the SSI/QA programs ranges from 200 to 600 person-rem / plant over the life of a plant.

The avoided ORE resulting from reductions in SGTRs was estimated at 44 person-rem / plant. Thus, the SSI/QA programs are estimated to result in an ,

additional ORE of approximately 350 person-rem per plant. The estimated l isc5cental increase in ORE for program element (b) is approximately 150 p'ersin-i'em per plant over the remaining life of the plant (28 years). The ectin.ateo incremental ORE from program element (d) is approximately 30 person-rem per plant for the remaining life of the plant (28 years).

As discussed in response (2), some of the program elements provide potential long-term economic benefits (cost savings) if averted operational costs and/or averted core-melt damage costs are considered. The SSI/QA programs were estimated to result in a net cost saving of approximately $7E+6/ plant

3 'because of reductions in SGTRs. The SSI/QA programs would appear to provide

,,'# - potential long-term economic benefits to those plants implementing the

recommendation. The full-length tube inspection and inspection interval

, (program element (b)) and the primary / secondary leakage rate limits (program p s f p *

.s se element (d)) implementation costs are essentially balanced by the potential averted costs.

An allocation of a fraction of the safety goal risk QD0s to single issues or concerns such as SGTR events would place more importance on SGTRs.

(8) Helpfulness of Safety Goals The safety goals would have been of some, though limited, value as an aid to the decision process.

(9) Special Problems This evaluation has illustrated the significance of taking into account (a) occupational radiation exposure as well as public risk and (b) favorable as well as adverse economic impacts in assessing the net cost impact.

3. DETAILED NRR TRIAL EVALUATION ANALYSES This section includes the detailed NRR trial evaluation analyses of issues selected for comparisons with the 1983 safety goals. The detailed analyses provide the calculated values used as the bases in Section 2 for comparing the issues to the quantitative design objectives (QD0s) stated in the safety goals.

As discussed in Section 1, the detailed analyses presented in this section augment existing regulatory analyses and value-impact analyses, and existing staff analyses for these issues. The principal augmentation are the additional risk assessment calculations that were needed for more direct comparisons to the' safety goal quantitative design objectives.

3.1 Reliability Criteria for Auxiliary Feedwater Systems by: J. N. Wilson, (NRR) 3.1.1 Background The Three Mile Island Unit 2 (TMI-2) accident and subsequent investi-gations and studies highlighted the importance of the auxiliary feedwater systems (AFWS) in the mitigation of transients and accidents.

As part of its assessment of the TMI-2 accident and related implications for operating plants, the staff evaluated the AFWS for all operating plants having nuclear steam supply systems (NSSS) designed by Westinghouse (W) (25 units) or Combustion Engineering (CE) (8 units),

(Ref. 1, 2). Studies of the AFWS at Babcock and Wilcox (B&W) designed-operating plants were the subject of separate Commission orders and other work performed by the NRC staff.

. s, I

The objectives of this study were to: (1) identify necessary changes in AFWS design or related procedures at these plants in order to assure the continued safe operation of these plants, and (2) to identify other system characteristics in the design of the AFWS for these plants which, on a long term basis, may require system modifications. To accomplish these objectives, the staff:

(1) Reviewed plant-specific AFWS designs in light of current regulatory requirements, and (2) Assessed the relative reliability of the various AFWS under three feedwater transients (one of which was the initiating event at TMI-2) and other postulated potential failure conditions by d'etermining the potential for AFWS failure due to common causes, single point vulnerabilities and human error.

As part of the evaluation, the staff performed a standard deterministic type of safety review, using as principal guidance the acceptance criteria specified in Section 10.4.9 of the Standard Review Plan (SRP)

(Ref. 3). In conjunction with this deterministic review, the staff used event tree and fault tree logic techniques, as part of a reliability analysis to determine dominant failure modes and assess AFWS comparative reliability levels under the following types of transients:

(1) Loss of Main Feedwater (2) Loss of Main Feedwater with Loss of Offsite Power (3) Loss of Main Feedwater with Loss of all AC The reliability assessment approach used and the principal insights and results are summarized in NUREG-0611 and NUREG-0635. The comparative reliabilities of the AFWS for the W and CE-designed operating reactors were evaluated for the three different initiating events. The results indicated that the reliabilities of the existing AFWS designs varied by at least an order of magnitude. The dominant contributors to this variability in reliability were, in general, human errors and single point vulnerabilities as described in NUREG-0611 and NUREG-0635. These reliability assessments resulted in the development of generic and plant-specific recommendations t (Ref. 1, 2) to improve AFWS reliability.

f-Item II.E.1 of NUREG-0737 (Ref. 4) required a re-evaluation of the AFWS for all PWR operating plant licensees and operating license applications, including a simplified AFWS reliability analysis. During the revision of the SRP to incorporate the TMI recommendations, a requirement for a simplified AFWS reliability analysis was proposed for SRP Section 10.4.9. During the internal review of this proposed SRP

u ,.

revision', a success criterion was suggested (Ref. 5). This criterion was based on the experience obtained-from previous AFWS reviews.

The Reactor Safety-Study, WASH-1400, estimated the frequency of total oss of main and auxiliary feedwater for extended periods of time to be approximately 7E-6/RY for the PWR plant analyzed. .The unreliability.of the~ auxiliary feedwater system was estimated to be in the 1E-4 to 1E-5 -

range. Because of lack of guidance for operator action following a total loss of feedwater, no credit was given for the potential capability of I the feed and bleed operation to prevent core melt. Further, WASH-1400 also concluded that the contribution to core melt of.the extended loss of main-and auxiliary feedwater event was approximately equal to the contribution from LOCAs. Since the challenge frequency for the auxiliary feedwater system is significantly higher than that for the l ECCS, the reliability of the AFWS should be higher than that for the ECCS. Therefore, we require an AFWS failure rate of 1E-4 to lE-5 per demand, which is the range of AFWS unreliability expected for three pump systems (Ref. 5).

An alternate approach to meeting the AFWS unreliability requirement would be to rely on feed and bleed in order to justify a. larger unreliability for the AFWS. However,-the staff does not presently give credit for: feed and bleed to mitigate the consequences of a design basis accident (Ref. 6).

3.1.2 Safety Significance The AFWS functions as an emergency system for the removal of heat from the primary system When the main feedwater system is not available. The AFWS is designed to hold the plant at hot standby, or to cool down the primary system to temperature and pressure levels at which the low pressure decay heat removal system can operate. The AFWS can also be used during normal plant startup and shutdown conditions for some

. plants. AFWS usually consists of a combination of steam turbine-driven and electric motor-driven pumps. The AFWS can provide enough water to

-the steam generators for decay heat removal following loss of main feedwater flow and assuming the most limiting single active failure.

Currently, a variety of AFWS designs are being used in the operating plants using W, B&W and CE-designed reactors. This factor gives rise to a variety of hardware dependencies and possible vulnerabilities brought

- about by human interaction with the design, or possibly some other common influences that could affect AFWS operation.

Past studies (Ref.'7, 8) have provided useful engineering insights into

.those areas of. system design where human interactions could significantly affect the availab'lity of standby safety systems. The aforementioned past studies have also provided additional insights for s .,

the more probable transient events that tend to dominate the demand for successful operation of the AFWS.

The AFWS is required for all situations in which the main feedwater system is not available, which include normal startups and shutdowns where the function is not provided for by the main feedwater system, anticipated operational occurrences and postulated design basis accidents such as small break LOCAs, steam line breaks, and steam generator tube ruptures. Therefore, its failure can be a dominant contributor to core melt accidents.

3.1. 3 Requirement The reliability requirement for AFWS is a demonstration of adequate reliability necessary to comply with the requirements of General Design Criteria 34 as identified in SRP Section 10.4.9, Revision 2. The current Standard Review Plan, Section 10.4.9 requires a demonstration of acceptable reliability and power diversity in the AFWS. The specific reliability criteria for AFWS is stated as follows:

An acceptable AFWS should have an unreliability in the range of 1E-4 to 1E-5 per demand based on an analysis using methods and data presented in NUREG-0611 and NUREG-0635.

3.1.4 Types of Evaluation 3.1.4.1 Core Melt Frequency Estimates We stated in Section 3.1.2 that there are several accident sequences in which the AFWS is challenged. However, the majority of the demand on the AFWS stems from the Loss of Main Feedwater (LMF) event.

Therefore, in order to determine the change in core melt frequency, we quantified the LMF event for pre- and post-implementation of the requirement in Section 3.1.3. We used a frequency of three events per year for the LMF event (Ref. 9 - 12).

The probability of recovery of the main feedwater system following its interruption depends on the initiating fault and the time window avail-able to restore the system to operation. The time available to restore the main'feedwater delivery depends on whether or not other systems such as the AFWS operates or whether or not the reactor protection system (RPS) operates. If, for example, the RPS fails to operate following interruption of MFW delivery, high reactor coolant system (RCS) pressure levels could be reached in a few minutes, and the likelihood of recovery of main feedwater in this period is very small. On the other hand, if RPS operates following this event but the AFWS fails to operate, the time period available for recovery of MFW would be about 1/2 to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> prior to boiling off the water inventory of the steam generators and

. n, loss of core heat removal capability. For B&W plants, the available time would be less than 1/2 hour. A conditional probability of failure of 0.1 (point estimate) was used for operator recovery of the LMF event, given offsite power available (Ref. 13). The failure probability of operator recovery includes hardware failures of MFW which preclude recovery of MFW. To account for the uncertainties, an error factor of 3 was assumed (18 - 20).

We used a pre-implementation value of IE-3 for AFWS unavailability per demand. Eleven reactors had an unavailability less than or equal to 1E-3. We used a value of 1E-4 for the post-implementation AFWS unavailability per demand. This value is the minimum acceptable unreliability setforth in Section 3.1.3. These values do not account for failure of AFWS after it starts on demand.

As stated in Section 3.1.1, the staff does not give credit for feed and bleed. Therefore, the probability of failure of feed and bleed for this event was set at 1.0. Using these values, we calculated the following estimates of core melt frequency (CMF) due to the LMF event.

CMF/LMF = LMF (Operator) AFWS (events /yr.) Recovery (Unavail/ demand)Bleed ( Feed and )

Pre-implementation = 3 x 0.1 x 0.001 x 1.0 = 0.00030 Post-implementation = 3 x 0.1 x 0.0001 x 1.0 = 0.00003 Change CMF/LMF = 0.00027

= 2.7E-4/yr.

Ratio of Change in CMF/LMF = 2.7 E-4 = 0.9 pre-implementation 3.0 E 4 This calculation shows that the failure of the AFWS is a dominant contributor to core melt accidents as stated in Section 3.1.2.

3.1.4.2 Risk Evaluation 3.1.4.2.1 Individual Risk Estimates The individual risk was estimated for a one-mile wide annular area located one-half mile from a hypothetical midwestern plant. In order to determine the probability-of prompt facilities in the annular area, conversion factors for each release category were used (Ref. 17). The conversion factors were based upon a typical midwest site meteorology (Byron /Braidwood), no evacuation, and a population density of 340 people / square mile. We used 3 release categories that relate to the sequences in which AFWS failure is involved in the expected release calculation and they are PWR-3, PWR-4 and PWR-6. The definition of

these acronyms are PWR-3...early containment failure with partial success of the fission product removal systems; PWR-4 -- containment fails to isolate, fission product release mitigating systems fail to operate; PWR-6 -- containment fails by basemat melt-through and fission product removal systems fail.

In our calculation, we did not perform a containment analysis to determine the containment failure probability for loss of all feedwater sequences. Instead, we used previous work (Ref. 13) that relates to the situation in this AFWS study. The probability that containment failure would lead to a conditional release was assumed to be 0.03 for PWR-3, 0.01 for PWR-4 and 0.96 for PWR-6. By combining the containment failure probabilities (PCF) with the change in core melt frequency from Section 3.1.4.1, we can determine the probability of prompt fatalities for each release category as follows:

P(release category = (CMF/LMF) x (PCF) x (Conversion Factor)

P(PWR-3) = (0.00027) x (0.03) x (0.0473) = 3.8 E-7 P(PWR-4) = (0.00027) x (0.01) x (0.00188) = 5.1 E-9 P(PWR-6) = (0.00027) x (0.96) x (0) =0 Total prompt fatality probability estimate

• 4E-7/yr.

Therefore, the estimate for the probability of prompt fatility from the loss of main feedwater event is 4E-7 per reactor year.

This estimate is compared to the. safety goal for individual mortality risks which is SE-7 per reactor year. The resulting comparison shows that improvement in the reliability of the AFWS accounts for approximately 80% of the safety goal for individual mortality risks.

3.1.4.2.2 Societal Risk Estimates ,

The societal risk to the public is based upon the probability of latent cancer fatalities. The calculation for the probability of latent cancer fatalities is similar to the calculation in Section 3.1.4.2.1, except that different conversion factors were used (Ref.

17).

P(PWR-3) = (0.00027) x (0.03) x (0.000079) = 6.4 E-10 P(PWR-4) = (0.00027) x (0.01) x (0.000014) = 3.8 E-11 P(PWR-6) = (0.00027) x (0.96) x (0.00000039) = 1.0 E-10 Total latent fatality probability estimate s 8E-10/yr.

t. t, Therefore, the estimate for the probability of latent cancer fatalities from the loss of main feedwater event is 8E-10 per reactor year. This estimate is compared to the safety goal for societal mortality risks which is 2E-6 per reactor year. The resulting comparison shows that improvement in the reliability of the AFWS accounts for only 4E-4% of the safety goal for societal mortality risks.

3.1.4.2.3 Occupational Radiological Exposure Nosignificantoccupationalexposurewouldresultfrommodifications,

'. maintenance, surveillance, or testing of the AFWS, since the system is located outside of containment and any necessary modifications would be performed during' refueling outages. However,. improvements in the reliability of the AFWS do result in a significant reduction in core melt frequency as shown in Section 3.1.4.1. Therefore, there would be a significant reduction in occupational exposures resulting from the cleanup of core melt accidents (Ref. 35).

(2.7E-4 core melt) (2.0E+4 person rem) (30 years) = 162 person rem year core melt 3.1.4.3 Defense In Depth The requirement for improving the reliability of the AFWS only contributes to the prevention of core melt accidents. The AFWS does not contribute to the mitigation of the consequences of core melt accidents, such as containment, siting in less populated areas, and emergency planning.

3.1.4.4 Value Impact 3.1.4.4.1 Benefit Estimates The benefit is based upon the averted person-rem within a 50 mile plant radius of resulting from the risk reduction attributed to imposition of the requirement in Section 3.1.3. In order to estimate the benefit, we assumed the plant was required to change from a two train AFWS to a three train AFWS. There are several plants with two trains of AFWS whose average system unavailability is about 1E-3 per demand. In order to estimate the improvement in AFWS reliability associated with the . addition of a third train, we extracted AFWS unavailabilities from 10 reliability studies of nuclear power plants that have 3 AFWS trains as shown in Table 3.1.1 (Ref. 20). These unavailabilities were calculated to obtain the average (mean) AFWS unavailability for each transient event and they are as follows:

ba  :-

Average (mean) AFWS Unavailability LMF event 1.8E-5/ demand LOOP event 5.1E-5/ demand LOCA event 1.8E-2/ demand By using the AFWS unavailability for the LMF event, we can determine the change in core melt frequency associated with the addition of a third train.

LMF AFWS CMF =(events /yr.) (Operator)

Recovery (Unavail/ demand..l ( Feed and )

Bleed 2 train = 3 x 0.1 x 0.001 x 1.0 = 0.0003000 3 train = 3 x 0.1 x 0.000018 x.1.0 = 0.0000054 Change in core melt for third train = 0.0002946 Change in core melt for third train

• 3E-4/yr.

We can now determine the averted person-rem by using the SPEB/NRR Dose Conversion Factors (Ref. 34) and assuming that there is 30 years of plant life remaining at the plant.

i Release = CMF x PCF x Dose Conversion Factor x Plant Life PWR-3 = (2.9 E-4) x (3E-2) x (5.4E+6) x (3E+1) = 1.4E+3 PWR-4 = (2.9E-4) x (IE-2) x (2.7E+6) x (3E+1) = 2.3E+2 PWR-6 = (2.9E-4) x (.96) x (1.5E+5) x (3E+1) = 1.3E+3 Total person-rem averted = 2.9E+3/yr.

3.1.4.4.2 Cost Estimates The cost for the addition of a third train of AFWS (motor driven pump, manual start, non-safety-related but powered by a reliable onsite source and located in an existing structure) is estimated to be $1 - $3 million. This estimate is based upon the cost of modifications made at Trojan and Calvert Cliffs and the projected cost at Midland. The work would be done during a refueling outage so there is no cost associated with replacement power. The incre-

. mental. costs for operating procedures, maintenance and testing are negligible since these items are already being performed for the existing AFWS.

[

> i o-3.1.4.4.3 Value Impact Assessment The value impact (VI) assessment is stated in person-rem averted per $1,000 cost. For the addition of a third train the VI is:

VI = 2,900 person-rem = 1.45 person-rem averted

$2,000,000 $1000 By comparing this value impact ratio to the reciprocal of the Benefit-Cost guideline, which is one person-rem averted /$1000 cost, we see that the addition of a third train of AFWS is cost beneficial.

Other modifications to the AFWS that would improve reliability (Ref. 1,

2) would be significantly less costly than the addition of a third train and th.erefore they should also be cost beneficial.

3.1.4.5 Uncertainty The major uncertainties in these calculations are due to plant specific variations in meteorology, population density, AFWS reliability and the number of challenges to the AFWS. The calculations are also affected by the assumptions of no evacuation and no feed and bleed.

3.1.5. Conclusions The evaluations performed in Section 3.1.4.1 showed that failure of the AFWS is a dominant contributor to core melt frequency. Section 3.1.4.2.1 indicated that increasing the AFWS reliability accounted for 80% of the safety goal for individual mortality risk. Section 3.1.4.4 showed that the. addition of a third AFWS train is cost beneficial. Based upon these evaluations, we believe that a safety goal comparison supports the reliability requirement for the AFWS. Since the unavailability of the AFWS is such a dominant contributor to core melt, we may be able to justify a lower unavailability than the minimum acceptable unreliability of 1E-4 setforth in Section 3.1.3.

L

~

~s e.

-TABLE 3.1.1 (Ref. 20)

SYSTEM UNAVAILABILITY FOR THREE-TRAIN AFWS LMFW Event LOOP Event LOAC Event Reference

1. Summer 1.2E-5 1.2E-5 1E-2 [21]

2. McGuire- 2E-5 7E-5 1.2E-2 [23]

3. Comanche Peak 2E-5 2.7E-5 1E-2 [25]

4. Diablo Canyon 3.'7E-5 6.1E-5 1.2E-2 '[29]

5. San Onofre-2 & 3 2.2E-5 3.8E-5 2.0E-2 [30]

6. SNUPPS 2.0E-5 5.3E-5 1.4E-2 [26]

'7. -Waterford 1.4E-5 3.9E-5 2.6E-2 [22]

8. Midland. 1.0E-5 7.0E-5 2.4E-2 [24]

9. Seabrook 2E-5 8.6E-5 2.3E-2 [28]

10. Cataba 0.7E-5 5.0E-5 2.8E-2 [31]

Total 18.2E-5 50.6E-5 17.9E-2 Average 1.8E-5 5.1E-5 1.8E-2 3.1.6 References

1. Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants (NUREG-0611), January, 1980.

2. Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Combustion Engi.ieering Designed Operating Plants (NUREG-0635), January, 1980.

3. Standard Review Plan (NUREG-0800), Section 10.4.9, Revision 1, and Branch Technical Position ASB 10-1.

4. Clarification of TMI Action Plan Requirements (NUREG-0737),

November, 1980.

5. Memorandum from Thomas E. Murley to Harold R. Denton dated June 29, 1981,

Subject:

Use of a Reliability Criterion in the SRP for the AFWS.

6. Memorandum from Roger Mattson to Harold R. Denton dated July 1, 1982,

Subject:

NRC Staff Reliance on Feed and Bleed.

7. Reactor Safety Study, (WASH-1400), October, 1975.

8. Memorandum, S. Levine to H. Lewis, dated June 27, 1978.

l

9. U. S. Nuclear Regulatory Commission, " Staff Report on the Generic Assessment of Feedwater Transients in Pressurized Water Reactors Designed by the Babcock and Wilcox Company," NUREG-0560, Page 3-1, May 1979,

10. U. S. Nuclear Regulatory Commission, " Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in WestinghouseDesigned Operating Plants," NUREG-0611, Page III-9, Jan.1980.

11. U. S. Nuclear Regulatory Commission, " Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Combustion Engineering Designed Operating Plants," NUREG-0635, Page III-9 , January 1980.

12. Electric Power Research Institute, "Value Impact Methodology for Decision Makers," EPRI NP-2529, Page 4-19.

13. U. S. Nuclear Regulatory Commission, Memorandum from T. Speis and R. Mattson to D. Eisenhut et al, " Staff Evaluation of the CE PORV Issue," September 9, 1983.

i l

14. U. S. Nuclear Regulatory Commission, " Regulatory Impact of Nuclear Reactor Source Term Assumptions," NUREG-0771, June 1981.

15. Testimony in Response to Commission Question No. 1, for Indian Point Hearing Before Atomic Safety and Licensing Board,Section III.8, Testimony of J. Meyer and W. Pratt, April 5, 1983.

16. U. S. Nuclear Regulatory Commission, "RSSMAP: Oconee Unit 3 -PWR Nuclear Power Plant," NUREG/CR-1659, V. 2, page 5-15, February 1981.

17. Memorandum from F. Rowsome dated September 18, 1984,

Subject:

Safety Goal Evaluation Plan - Subtask B Trial Evaluations.

18. U. S. Nuclear Regulatory Commission, " Reactor Safety Study,"

WASH-1400, Page V-39.

19. Electric Power Research Institute, " Loss of Offsite Power at Nuclear Power Plants: Data and Analysis," NP-2031, Pages 3-3 to 3-5.

20. Memorandum from A. Thadani to 0. Parr dated November 9, 1984

Subject:

Auxiliary Feedwater System - CRGR Package.

21. Bradley, G.H., "V.C. Summer Nuclear Station Unit 1 Emergency Feedwater System Reliability Study Evaluation," USNRC, NUREG/CR-1870, Page 53, June 1981.

22. Bradley, G.H. , "Waterford Steam Electric Station Unit 3 Auxiliary Feedwater System Reliability Study Evaluation," USNRC, NUREG/CR-2219, Page 36, September 1981.

23. Bradley, G.H., "McGuire Nuclear Station Unit 1 Auxiliary Feedwater System Reliability Study Evaluation," USNRC, NUREG/CR-2096, Page 42, July 1981.

24. USNRC, Memorandum from A. Thadani to 0. Parr, " Midland Auxiliary l Feedwater System Reliability," dated June 17, 1983.

25. Roscoe, B.J., " Comanche Peak Steam Electric Station, Units 1 & 2 Auxiliary Feedwater System Reliability Study Evaluation," USNRC, NUREG/CR-2248, Page 40, September 1981.

26. Roscoe, B.J. , "SNUPPS Auxiliary Feedwater System Reliability Study Evaluation," USNRC, NUREG/CR-2458, Page 23, January 1982.

- 27. Roscoe, B.J., "Palo Verde Nuclear Generating Station Units 1, 2 and 3 Auxiliary Feedwater System Reliability Study Evaluation," USNRC, NUREG/CR-2322, Page 30, December 1981.

l L

. :. ea

28. Fresco, A. et al, " Review of the Seabrook Units 1 & 2 Auxiliary Feedwater System Reliability Analysis," USNRC, NUREG/CR-3532, Page 6, February 1984.

29. Bradley, G.H., "Diablo Canyon Nuclear Power Station Unit 1

-Auxiliary Feedwater System Reliability Study Evaluation," USNRC, NUREG/CR-1925, Page 46, July 1981.

30. Bradley, G.H., " San Onofre Nuclear Generating Station, Units 2 and 3, Auxiliary Feedwater System Reliability Study Evaluation," USNRC, NUREG/CR-2153, Page 35, October 1961.

31. Fresco, A., et al, " Review of the Catawba Units 1 & 2 Auxiliary Feedwater System Reliability Analysis," USNRC, NUREG/CR-3299, Page IX, October 1983.

32. NUREG-0800, Revision 1, " Safety Goals for Nuclear Power Plant Operation," U.S. Nuclear Regulatory Commission, May 1983.

33. NUREG/BR-0058, " Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory Commission," U.S. Nuclear Regulatory Commission, January 1983.

34. NUREG/CR-3568, "A Handbook for Value-Impact Assessment," Pacific Northwest Laboratory, December 1983.

35. NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development, Pacific Northwest Laboratory, May 1982.

i

ag . -

's - se 3.2 Pressurized Thermal Shock by: R. Woods (NRR) 3.2.1. BACKGROUND-As a result of operating experience, it is now recognized that transients can occur in pressurized water reactors (PWRs) characterized by severe l overcooling causing thermal shock to the vessel, concurrent with or followed by repressurization (that is, pressurized thermal shock, PTS). In these PTS i transients, rapid cooling of the reactor vessel internal surface causes a temperature distribution across the reactor vessel wall. This temperature distribution ~results in thermal stress with a maximum tensile stress at the inside surface of the vessel. The magnitude of the thermal stress depends on l ;the temperature differences across the reactor vessel wall. Effects of this-thermal stress are compounded by pressure stresses if the vessel is

.repressurized.

l . Severe reactor system overcooling events which could be followed by i repressurization of the reactor vessel (PTS events) can result from a variety 4 'of'causes. These include instrumentation and control system malfunctions,

! and postulated accidents such as small break loss-of-coolant accidents (LOCAs), main steamline breaks (MSLBs), feedwater pipe breaks, or stuck open 4

valves -in either the primary or secondary system.

I As l'ong as the fracture resistance of the reactor vessel material remains relatively high,.such events are not expected to cause failure. After the 1

fracture toughness of the vessel is reduced by neutron irradiation (and this occurs at a faster rate in vessels fabricated of materials which are relatively sensitive to neutron irradiation damage), severe PTS events could 1 cause crack propagation of fairly small flaws that are conservatively postulated to exist near the inner surface. The assumed initial flaw might initiate and propagate into a crack through the vessel wall of sufficient extent to threaten vessel integrity and therefore core cooling capability.

The purpose of the proposed regulation is to assemble the data and analyses

needed to identify the most _ effective corrective actions from among the many

alternatives. This will be done in a timely manner that will allow

. implementation of necessary corrective actions before the fracture resistance decreases below a. level where safety of continued operation has been found to be acceptable. Future plant-specific regulatory action may be necessary for implementation of the necessary corrective actions, and the alternatives and their consequences will be fully considered and documented at that time.

There are multiple possible variations of the proposed rule, such as higher i

~

or lower values of the screening RT Discussion of such variations is provided in Ref. 1 (SECY-82-465) wh b . the particular choices made are justified. They are not true "different approaches" of the type defined for i

y i<

required discussion in this section; rather they are variations of the same approach.

We do not believe that there are any acceptable alternatives to the timely and orderly assembly of the data and analyses needed to identify the most effective corrective actions, which is the objective of this proposed rule.

4 Unacceptable alternatives are to allow plants to continue to operate at an unevaluated risk once the screening RT is exceeded, to arbitrarily require specificcorrectiveactionswithnofikTbases for those requirements, or to order plant shutdowns.

3.2.2 Safety Significance The basic safety concern is to maintain the extremely high reliability (i.e.,

structural integrity) required of the reactor pressure vessel (RPV). There are no backup systems provided for the RPV, and its failure, to an extent that would make it unable to contain sufficient water to cover the core, would result in a core melt. RPV integrity requirements with respect to fracture toughness are contained in GDC 31. In addition, depending upon the RPV failure mode, containment integrity would conceivably be called into question.

3.2.3 Requirement The Nuclear Regulatory Commission (NRC) is proposing to amend its regulations for light water nuclear power plants to: (1) establish a screening criterion related to the fracture resistance of pressurized water reactor (PWR) vessels during pressurized thermal shock (PTS) events; (2) require analyses and schedule for implementation of flux reduction programs that are reasonably practicable to avoid exceeding the screening criterion; and (3) require detailed safety evaluations to be performed before plant operation beyond the screening criterion will be considered. The proposed changes are intended, if adopted, to produce an improvement in the safety of PWR vessels by identifying those corrective actions that may be required to prevent or mitigate potential PTS events.

A complete discussion of the proposed rule can be found in Ref. 2.

3.2.4 Types of Risk Evaluations Used to Develop the Proposed PTS Rule Development of the currently proposed PTS rule has not involved determination of definitive risk in terms of core melts and offsite man-rem exposures, the method envisioned when the draft safety goal was created.

The draft safety goal envisions the process of first determining the risk due to a particular situation in terms of core melts and offsite doses, then identifying what corrective actions are possible, then identifying how much

9 i, each of the possible corrective actions will cost per unit decrement of risk, then finally identifying the required corrective actions as the ones that achieve an acceptable risk level with the lowest cost.

Any determination of total risk due to PTS involves multiple technical disciplines including plant control and safety systems, human factors, transient and accident analysis methods, thermal hydraulic analysis (experimental and analytical), materials properties, fracture mechanics analysis (experimental and analytical), and probabilistic risk assessment (PRA) methodology. Any effort to determine total PTS risk thus is a lengthy, interactive project and the cumulative uncertainty present in any final risk estimates is substantial. PTS risk becomes greater per year for every year of operation, due to the embrittlement of the vessel steel. Therefore, judgments regarding PTS risk were made on the basis of the frequency of thorough wall crack of the pressure vessel and this quantitative result was only qualitatively linked to the probability of core melt and offsite radiation exposure.

The decision to proceed with the proposed PTS rule was dictated by the increasing PTS risk with each year of vessel irradiation, and the lead time nee.ded for effective corrective action. It was determined during our work on the issue that the potentially most cost-effective means of reducing PTS risk was to reduce the fast neutron flux at the critical (most embrittled) areas of the pressure vessel wall, for example, by fuel rearrangement. However, this action must be taken early for maximum benefit (flux reduction action does no good once the embrittlement has already occurred) and development of a requirement as envisioned by the draft safety goal, given the multi-discipline nature of the problem, would have taken too long to take most effective advantage of flux reduction options for the limited number of operating plants where the issue is of greatest significance.

3.2.4.1 Risk Evaluation Used to Develop the Proposed PTS Rule At NRC's request, the NSSS vendors undertook studies to determine the expected frequency of vessel through-wall cracking due to a broad spectrum of potential PTS events, as a function of vessel material properties (the

, was used as ReferenceTemperaturefortheNilDuctilityTransition,RT,blexposureto the representative material property; it increases with ve fast neutrons). These studies involved identification of equipment and procedural features of generic plants that would contribute to the occurrence of all types of PTS events. This allowed categories of PTS events to be defined that were intended to include all potentially significant PTS events (with considerable uncertainty, because of the difficulty with completeness

-inherent in probabilistic risk analyses). Next, thermal-hydraulic calculations were made of representative PTS events in each category to determine the pressure-temperature history in the downcomer of the pressure vessel from each class of events. Due to the lack of detailed knowledge

s e, regarding ' flows and the degree of thermal mixing.of the cold HPI flow with warmer fluid in the RPV in the critical locations under PTS conditions, considerable additional uncertainty was added to the final result at this step. Finally, using the best applicable fracture-mechanics methods available, the effects on flawed welds were calculated for the various representative PTS transients.

i-

, 3.2.4.2 Core Melt Frequency Estimates Used to Develop the Proposed PTS Rule The above-described analyses resulted in an estimate of the expected through-wall crack penetration frequercy.due to.all PTS events as a function of RT Due to the considerable uncertainty present at each step, and consi b .in methods us'g that the ed could notstate-of-the-art fracture predict final crack mechanics

~ length calculational or shape, it was believed-that additional efforts to predict hole size in the pressure vessel resulting from the through-wall crack would have such large uncertainties as to be of no practical use in developing the proposed generic PTS rule. Thus, it was not possible to predict the expected frequency of core melt except by the use

-of grossly conservative assumptions, and given lack of that information it was not meaningful to try to predict offsite exposures. Predicting offsite exposures would require not~only knowledge of expected core melt but also

. prediction of_the vessel failure' mode and its effect on containment integrity. It was believed that results (beyond through-wall crack' frequency predictions) would be subject to so much cumulative uncertainty as to not be useful.

Thus, the NSSS results (which NRC modified upon review for use in rulemaking) conservatively bound the PTS risk expressed in draft safety goal units of core melts, but do not provide the risk in those units.

In selecting the " acceptable" RT level, f r purposes of proposing the draftPTSrulethatwasrecentlykblishedforpubliccomment,theNRC-N ~

modified NSSS results were used to establish a relationship between expected through-wall crack' penetration frequency and RT Due to the large-uncertainties inherent in that relationship it N I. desired to be conservative in the selection of the screening criterion, or. maximum acceptable, RT It was necessary to select a maximum acceptable frequency of through-wb.

crack penetration, which would- thus define the maximum allowable RTNDT using

~

the described relationship.

The selected maximum acceptable PTS-related through-wall crack frequency was

<within an order of magnitude of, but below, the draft safety goal core melt frequency. Thus, considerable (though unquantified) conservatism was introduced into the maximum allowable RT selection, since it is certain that not all through-wall cracks result k a core melt. For values of RT belowtheselectedlevel,theNRCstaffconcludedthatPTSrisk(although$I yet not quantified in draft safety goal terms) is acceptably low.

2.

For all PWR plants that are projected to exceed the selected RT level, the-PTS rule requires that licensees of such plants "shall submit..NS[ analysis and schedule for implementation of such flux reduction programs as are reasonably practicable to avoid exceeding the screening criterion." This requires such plants to take. early action to stay in the RT region where the risk is acceptably low. Byproceedingwithoutfirstdebminingall information needed for comparison with the safety goal, this important requirement will be'in force much earlier, and as explained, therefore the requirement will be more effective in reducing risk.

The PTS rule also places the burden of addressing the draft safety goal risk

upon any licensee who is unsuccessful in his efforts to stay below the selected RT level where the NRC staff has concluded that the risk is acceptable.NDJhedraftPTSruleoutlinesanalysesthatmustbeprovidedwell before exceeding that RT level. Those analyses must evaluate PTS risk withandwithoutproposegD{orrectiveactions. Results of those licensee analyses will go beyond through-wall crack frequency and will address the risk in draft safety goal terms.

As explained above, the NRC staff has not now completed a study of PTS risk that will address the draft safety goal in terms of core melts and mortalities. Therefore, if a safety goal had been adopted before the above described PTS studies were performed, it would not have had any appreciable effect since no results were determined that could have been compared to the safety go'al, and the same information used in developing the safety goal was used anyway, as described, in selecting the acceptable RT level. However, ifthesafetygoalhadbeenwrittensoastorequireaddr$SIingtheproposed core melt and mortality risk criteria before any rules could.be proposed or before any requirements could be made of the licensee, then this would have delayed the already accomplished work to a significant degree. This is a strong argument for writing the final safety goal so as to allow flexibility in handling situations that must be responded to without the delay that would be needed to provide a certain pre-determined set of information (such as addressing the core melt and mortality risks).

The NRC is now proceeding with a longer-term PTS effort that will provide guidance to the licensees regarding how the PTS risk analyses to be required should be performed, and also what level of risk due to PTS will be acceptable. These studies are going beyond through-wall crack penetration frequency and will consider how likely such crack penetration is to cause core melt, and to estimate resulting prompt and delayed mortalities. Since future results of these studies now underway will be in terms comparable to safety goal units, the safety goal may be useful in completing this longer range work.

s 5.

3.2.4.3 Defense in Depth Regarding Proposed Rule As previously explained, the work accomplished to date in developing the proposed rule has not attempted to quantify man-rem exposure to the public, which would require containment failure and meteorological analyses, etc. It was felt that the PTS project is at present insufficiently complete to offer meaningful insight into this subject, for purpose of the present rule development.

3.2.4.4 Costs Applicable to Proposed Rule Enclosure B of Ref. 2 contains the Regulatory Analysis performed for the proposed PTS rule. It estimates the costs, as shown below.

3.2.4.4.1 Costs to Licensee of Proposed Rule (a) To assess RTNDT (applies to all PWR licensees).

The basic materials property information is already available to each licensee. To meet this requirement would take about 25 licensee man-days and cost $10,000 based on a cost estimate of $100,000 per man year.

(b) To prepare and submit analysis of flux reduction programs (these costs apply to PWR licensees for which the projected RT is expected to exceed the proposed PTS screening criterion befor$DIxpiration of the operating license).

Enclosure B to SECY-82-465 (Ref. 1) indicates that about 16 plants are estimated to reach the screening criteria before end-of-life. Estimated costs per plant are about $20,000 based on 50 licensee staff man-days (at $100,000 per man year). There are a few plants discussed in item (c) below where costs may be much higher.

(c) To implement flux-reduction operation (see item (b) above for applicability).

For several plants, action within the next few years to reduce the flux at critical welds by. a factor of two or less will ensure that they do not exceed the screening criterion throughout their service life. It appears that such a reduction can be achieved through installation of a low leakage core (installation of partially burned fuel assemblies in the periphery of the core in place of fresh fuel assemblies). This fuel management option is already being implemented by some licensees at reportedly little or no additional cost. For plants in this category, the staff belieses that the rulemaking proposed above will provide a mechanism for ensuring prompt consideration of appropriate flux reduction measures, but no significant costs due to implementation will be incurred.

.u s.

There is a group of about eight plants for which near-term action to reduce the flux at critical welds by factors of two to five would ensure that they do not exceed the screening criterion throughout their service life. It appears to the sta.*f that these flux reduction factors could be attained through the installation of a low leakage core and the replacement of a few (8-12) peripheral fuel assemblies by dummy assemblies or part-length assemblies. These measures seem practical and cost effective to the staff, based on present knowledge, with some loss in margin to core overheating limits in certain postulated transients.

We estimate that there would be an engineering cost (redesign and safety analyses) of about $20 million per plant, and some small increase in fuel cycle or operating costs.

(d) To perform the plant specific PTS analyses due 3 years before exceeding the screening RT is not adequate)NDT (applies to only a few plants where flux reduction An estimate of the cost for performing the plant-specific analyses was made for the staff. The items considered in the cost estimates are identified below. The items were reviewed and collectively discussed with reactor specialists in each of the engineering areas. A judgment of cost per plant was then made upon an estimate of the time and facility requirement.

(1) Identification and quantification of PTS events $ 500K (2) Thermal hydraulic analysis S 400K (3) Better identification of vessel material properties $ 70K (4) Deterministic and probabilistic fracture mechanics $ 100K analyses (5) Flux reduction program analyses $ 100K (6) Inservice inspections and nondestructive evaluation S 75K study (7) Plant modification study $ 200K (8) Operating procedures and training study $ 150K (9) In-situ annealing study $ 50K TOTAL $164SK (e) To perform corrective actions, identified or needed by the analyses.

For purposes of this analysis, it is implicitly assumed that all such analyses will result in justification of continued operation to end of license without expensive corrective actions (other than flux reduction). This is the likely result for some (not necessarily all) such plants. Nevertheless, it is not possible to predict costs of corrective actions that have not yet been identified bs the analyses that have not yet been performed.

. s.

3.2.4.4.2 Costs to Government of Enforcing Proposed Rule The submittals by the licensee will be evaluated by the staff for each facility.

(1) RT NDT assessment (2) Flux reduction The evaluation in these areas will be performed by the Materials Engineering Branch and the Core Performance Branch, respectively. Four man-weeks time is estimated at a cost of $10,000 for each evaluation.

(3) PTS Analysis The evaluation of the plant-specific analysis will be performed by the staff and a technical assistance contractor. The staff time is estimated at 180 man-days at a cost of $70,000. The contractor cost is estimated at 0.5 man year for $50,000 plus $40,000 computer time.

3.2.4.4.3 Summary of Costs of Proposed Rule Based on the NRC study of the eight PWRs with highest RTN (Reference 3, especially the tables on the last page), for purposes of Nis cost estimate it will be assumed that: 1) all 8 plants perform the $20 million redesign for lower flux; 2) that such efforts result in not exceeding the screening criterion before end of license for 3 of the 8; 3) but the other 5 must also later perform the PTS-PRA to justify continued operation above the screening criterion. The costs shown are rounded upward, which can be justified by uncertainty and/or inclusion of the above quoted government costs to review the analysis.

Cost = 8 X $20 X 108 = $160 X 108

+ 5 X $1.7 X 108 = ~9 X 108

~$170 X 108 For the 16 licensees projected to exceed the screening criteria, 8 are discussed above. The other 8 will probably not require extensive flux-reduction engineering work and their cost for the present purpose will be $20,000 as estimated above (+$10,000 for government review).

Cost = 8 X $30,000 = $0.24 X 108 Finally, there are 38 operating PWRs listed in Enclosure A to Ref. 1 that will be required to submit RT NDT analyses. Per the above estimates (licensee

+ government) costs will be:

o t.

Cost = 38 X ($10,000 + $10,000) = $0.76 X 108 Therefore the total costs of the proposed rule are estimated at

($170 + $0.24 + $0.76) X 108 = Total Cost = $171 X 108 3.2.4.5 Benefit / Cost of Proposed Rule in Terms of Dollars Spent per Averted Core Melt The analysis that follows was not used in development of the proposed PTS rule. It was recently performed for purposes of the safety goal comparison, as stated below.

In order to provide a best estimate of the benefit / cost ratio prior to completion of the longer range work described above, the following assumptions were made. This study can serve as a guide for anyone wishing to use different assumptions.

Assumptions:

1) All plants that perform PTS-PRA analyses will be able to continue operation to end-of-license without expensive corrective actions.

2) No plant will request a license extension beyond 32 EFPY. (Some undoubtedly will, but quantitatively justifying any other assumption is not possible now).

3) All through-wall cracks result in core melt (this assumption is clearly wrong, but we do not now have results to further refine consequence calculations).

4) All plants have a through-wall crack frequency as shown in Figure 8-3 of Ref.1, i.e. , all plants behave like the Westinghouse generic plant used in that study (Preliminary B&W Owners group results support this, as shown in Encl. C to Ref. 1, and preliminary ORNL results (Ref. 4) for a B&W plant also support this).

5) a) The rule will result in no plant operating above the screening RT before end of license or alternatively, b) Some plants will operate NDT above that limit, but they will have implemented inexpensive corrective actions that will result in PTS risk equal to that incurred by an uncorrected plant operating at the screening limit.

6) All plants will have an end of license equal to end of life equal to 32 effective power years (EFPY).

o ie With the above assu'mptions, it is possible to calculate the incremental risk that will be avoided, due to the rule, by each plant that would have otherwise operated above the screening limit for some period of time before end of license. The sum for all such plants will then be taken as the incremental risk reduction due to the rule.

Table 3.2.1 gives detail of the calculation performed, with sources of data used.

The result is that 0.045 core melts would have occurred among the plants that would have operated above the screening criterion, during the time when those plants would have been above the screening limit. If one further assumes that, with the rule in place, all of those plants will reach the screening limit at the same time as they would have without the rule (no pre-screening-limit corrective actions are assumed) and then they take corrective actions which effectively keep the risk at the same level as would accrue from operation at the screening limit without corrective action, then the remaining risk, even with the rule in place, is a total of 0.006 core melts (see notes explaining table, following last note).

Thus, the safety improvement benefit of the rule is (0.045-0.006) or ~0.04 core melts prevented.

The cost / benefit ratio in terms of core melts averted of the rule is thus:

$171 X 108/0.04 core melts or

$4.3 billion dollars per core melt averted.

3.2.4.6 Uncertainty in Proposed Rule The uncertainty in the risk numbers used in developing the proposed rule is taken to be two" orders of magnitude, plus or minus (Ref. 4, uncertainty analyses for prototype calculations made for Oconee by ORNL). The costs are certainly not precisely known, but is is felt that their uncertainty is overshadowed by the risk uncertainty. Therefore, cost uncertainties will not be separately estimated.

Thus, the cost of the rule is estimated to be as high as $430 billion dollars per averted core melt, or as low as $43 million per averted core melt.

3.2.5 Conclusion Regarding Proposed Rule The preceeding section shows the present lack of the information needed to perform meaningful cost / benefit calculations. If, however, the median or lower cost estimate is correct, then the rule is certainly cost effective

e ,o 1

when one considers that cost of the onsite cleanup of a core melt is itself several billion dollars without considering any offsite consequences.

More definitive cost / benefit values are not available now. Therefore, if a safety goal had been adopted before the above described PTS studies were  !

performed, it would not have had any appreciable effect since no results were l determined that could have been compared to the safety goal. However, if the safety goal had been written so as to require addressing the proposed core melt and mortality risk criteria before any rules could be proposed or before any requirements could be made of the licensee, then this would have delayed the implementation of flux reduction on severely impacted plants and forfeited to a significant extent the ability to reduce PTS risk for these plants. This is a strong argument for writing the final safety goal so as to l allow flexibility in handling unique situations. Such situations must be responded to properly, without the delay necessary to provide a certain pre-determined set of information (such as addressing the core melt and ,

mortality risk). l 3.2.6 Speculation Regarding Future Methods that Could be Applied to Determine Risk Reduction in Terms of Early and Late Fatalities Averted and Dollars Per Man-Rem Averted As previously explained, the work accomplished in developing the proposed rule has not attempted to quantify early or late fatalities or man-rem exposure to the public, which would require containment failure and meteorological analyses, etc. The PTS project is at present insufficiently l complete to offer meaningful insight into the subject. l l

However, the folicwing discussion is provided as an example of how one could l calculate risk reduction in those units (other than core melts averted) if one had the necessary information.

The values used in the example are used only for purposes of illustration and j no bases have been developed for their applicability to PTS events. The risk '

reduction " estimates" should therefore be treated as fictitious.

To arrive at estimates of potential risk reductions resulting from the j proposed PTS rule, in terms of early and late fatalities averted and dollars l per man-rem averted, the 16 plants projected to exceed the PTS screening criterion (Table 3.2.1) were divided into 4 groups of plants. The average core melt frequency per year, for all years the plant would operate above the screening limit without flux reduction measures, was compared to the core melt frequency at the time the screening limit was reached. Continuing to use assumption #5 as stated above, that is assuming no significant increase in the core melt frequency beyond the screening limit (due to flux reduction measures or other equivalent risk-reducing modifications), the potential l

o i.

reduction in core melt frequency is developed in Table 3.2.2 and summarized here:

Reduction in Core Melt Oue to Category No. Plants Assumed Corrective Actions 1 1 9E-4/yr 2 4 2E-4/yr 3 3 7E-5/yr 4 8 2E-5/yr Forthepurposeofestablishingroughestimates,thecontagentfailure probabilities conditional on release category were assumed as:

PWR Release Category (WASH-1400) CF/RC l

1 .01 3 .2 5 .01 7 .78 (1)As noted above these assumptions are not based on any analysis of PTS events and are used only for illustrative purposes.

3.2.6.1 Early Fatalities Example calculations for Category 1, using the above values for ACMF and CF/RC, and the fatality probabilities from Revision 1 of the Evaluation Plan yields:

Early Fatalities (9.2E-4)(1) (E-2)(2) (5.66E-2)(3) = 5.2E-7 (9.2E-4)(2E-1)(4.73E-2) = 8.7E-6 (9.2E-4)(E-2)(7.5E-4) = 6.0E-9 (9.2E-4)(.78)(0) =0 IP = 9.23E-6 EF l (1) From Table 3.2.2, as summarized above (2) From CF/RC values above l (3) From Revision 1 of the Evaluation Plan

o s.

The above probability for early fatalities within 1.5 miles of the reactor site (9.2E-6/RY) for the Category 1 plants exceeds the draft Safety Goal Criterion of SE-7/RY. For the other category plants, utilizing the ACMF in l column 18 Table 3.2.1 for the other categories in place of 9.2E-4 as above, the results are: Category II, 1.8E-6, Category III, 6.5E-7, Category IV, 1.8E-7. Only Category IV plants do not exceed the draft safety goal criterion.

3.2.6.2 Latent Fatalities Utilizing the same core melt frequencies averted as above for the four categories of' plants from Table 2, the same containment failure probabilities conditional on release category as above, and the Latent Cancer Fatality Probability per Release Category from Section 4.2.'2 of the Revision 1 Evaluation Plan, for the Category 1 plant one obtains:

(9.2E-4)(E-2)(4.68E-4) = 4.3E-9 (9. 2E-4)(2E-1)(7.9E-5) = 1. 5E-8 (9.2E-4)(E-2)(3.8E-6) = 3.5E-11 (9.2E-4)(0.78)(7.5E-9) = 5.4E-12 Category I IP LF = 1.9E-8/RY As before, calculations for the other groups yield: 3.7E-9(Category II);

l 1.3E-9 (Category III); 3.7E-10(Category IV).

The safegy goal Q.D.0. is 2E-6/RY, for comparison.

3.2.6.3 Dose Assessment Si:nilar calculations for all groups of plants are made below to determine the dose reduction potential for the public within 50 miles of the plant over the remaining plant life.

For Category I (9.2E-4)(E-2)(4.9E+6)(1) = 45.1 (9. 2E-4)(2E-1)(5. 4E+6) = 993.6 (9.2E-4)(E-2)(1.0E+6) = 9.2 (9.2E-4)(0.78)(2.3E+3) = 1.7 Category I IP mrem

= 1049.6/ man-rem /RY As before, calculations for the other groups yield: 205 (Category II); 74 (Category III); 21 (Category IV)

(1) Provided by R. Riggs. (this value is also calculated) and nearly negligible for those that do not need the large flux reduction (not shown).

g -

o se i

l 3.2.6.4 Summary of Section 3.2.6 Table 3.2.3 first summarizes all of the above results and then converts the l man-rem /RY results immediately above to total man-rem averted for the remaining life of each group of plants, for comparison to the draft safety goal values. For Group 1 through 4 respectively, the total man-rem averted per (average) plant life are: (23,300), (3,900), (1,125), and (198).

I Examining the costs given in Section 3.2.4.4.3, it is noted that a total cost of $171E+6 is given, almost all of.which is attributable to the 8 plants assumed to spend $20E+6 each for re-design for large flux reduction.

Therefore, costs are approximately $171E+6/16 or $10.7E+6 per average plant, but this really represents $170E+6/8.= $21.3E+6 per plant for those that must perform the large flux reduction. and a comparatively negligible cost for the other 8.

Below, we show calculations for plants assumed to perform the large flux reduction. The cost would be 1/2 the values given for the average plant

. Cost / Man-rem Averted Cost / Man-ren Category for large flux red. plant (1) for "ava" Plant I

l 1 $ 914 $ 457 l 2 $ 5,460 $ 2,730 3 $ 18,900 $ 9,460 4 $107,500 $53,800 The V/I ratios for one of the four plant groups is less than the safety goal value of $1000/ man-rem averted. The other three plant groups are more costly l

than $1000/ man-rem averted.

i (1)Above discussed costs per plant were divided by column 6, Table 3.2.3 to obtain this left column, and 1/2 the left column values are given in the i right column.

% kA

h

. ig,q" ,i <

ug ,t , -

g gTABLE3.N.1 DETAILSOFBENEhlTANALYSIS l 21_ . . ,. .,

1 '2 3 4 5 6

, , 't ,

Fiuince'at U'pper 2-Sigma Initial Applic. Mean Value Plant ~ l Screening RT NOT Screening Crit. RT 2-Sigma Screening Crit.  !

ND.T

, e' HBR 1.95 x 1019 7'l 300*F -56 F 34 F 266 F r ; .

Ft. C.

1.18 , 270 -56 34 236

.TP3 1.85 300 0 59 241

-TP4 1.85 300 0 59 241 MY 1.18 270 -56 34 236 IP-3 1.04 270 74 48 222 RS 0.77 270 0 59 211 TMI-1 v0.75 270 , 0 59 211 0-2 ' ' 0. 99 300.'

0 59 241

. Z-1

,/ 1.25 300' 0 59 241

~0-1. 1.33 273 0 59 211 l

IPG T 1.18 270 -56 34 236

" "dN0k . 1.23 270 0 34 236 ANO-1 1.23 270 0 60 210 Dil . '2.33 270 -56 59 211 rh CR-3 1.18 270 0- 59 211 DCC - 1.94. 300 -56 34 266.

Yb

'v.

1 4, ) . .

I

- ~Y u

o .. 1

-TABLE 3.2.1 DETAILS OF BENEFIT ANALYSIS (Cont.) .

I 1 7 8 9 10 11 ART NDT at Fluence EFPY Below EFPY Above Fluence Plant Screening Lim. Per EPFY Screening RT Screening RT at EOL NDT NOT HBR 356 F 0.199 x 1019 9.8 yrs 22.2 EFPY 6.4 x 1019 Ft. C 326 0.100 11.8 20.2 3.2 TP3 300 . 0.160 11.6 20.4 5.1 TP4 300 0.,160 11.6 20.4 5.1 MY 326 0.069 17.1 14.9 2.2 IP-3 196 0.056 18.6 13.4 1.8 RS 270 0.058 13.3' 18.7 1.9

-TMI-1 270 0.053 14.2 17.8 1. 7 0-2 300 0.061 16.2 1.58 2.0 l 'A-1 300 0.063 19.9 12.1 2.0 0-1 270 0.054 24.6 7.4 1.7

i. IP-2 326 0.050 23.6 8.4 1.6 t

ANO-1 270 0.045 27.3 4.7 1.4 Pal. 326 0.116 20.1 11.9 3.7 CR-3 270 0.055 21.5 10.5 1.8 DDC 356 0.063 30.8 1. 2 2. 0 i

i d ..

l TABLE 3.2.1 DETAILS OF BENEFIT ANALYSIS (Cont.)

1 12 13 14 15 16 17 Core Melt Core Melt Average Core Melt ART NDT Mean RT NDT Frequency ~ Frequency Frequency While Total Core Melt Plant at E0L at EOL at EOL at RT Above RT While Above RT sc sc sc i

- - ~ -

HBR 450 F 360 F 4x10 3/ry 8x10 a/ry 1.0x10 3/yr 22.20x10 3 core melts !

Ft. C 390 300 3.8x10 4 2.3x10 s 1.9x10'4 3.84 i

- - ~

TP3 370 311 5.5x10 4 3.0x10 s 2.5x10 4 5.10

- ~ ~

TP4 370 311 5.5x10 4 3.1x10 5 2.5x10 4 5.10

~ - -

MY 365 275 1.5x10 4 2.3x10 s 1.0x10 4 1.49

- - ~

IP-3 220 246 4.4x10 s 1.4x10 s 3.5x10 5 0.47

~ ~ -

RS 325 266 1.0x10 4 6.0x10 6 5.0x10 s 0.93-

~ ~ -

TMI-1 315 256 6.0x10 5 6.0x10 6 3.5x10 5 0.62 0-2 345 286 2.0x10 4 3.0x10 5 1.5x10 4 2.37

~ ~ ~

Z-1 330 271 1.2x10 4 3.0x10 5 1.0x10 4 1.27 0-1 285 226 1.5x10 s 6.0x10 6 1.2x10 s 0.09 IP-2 350 260 7.0x10 5 2.3x10 s 6.0x10 s 0.50 ANO-1 275 215 7.0x10 6 6.0x10 6 6.5x10 6 0.03

~ ~ ~

Pal. 360 245 4.3x10 5 6.0x10 6 3.5x10 5 0.42

~ - -

CR-3 290 231 1.7x10 5 6.0x10 8 1.0x10 5 0.11

- - ~

-DCC- 358 268 1.2x10 4 8.0x10 s 1.0x10 4 44.60x10 3 = 0.045

'N ;sa Explanation of Columns in Table 3.2.1 Column #- Description and Reference of Source 1 All= plants needing flux reduction to stay below the screening criterion for 32 EFPY (effective full power years, the assumed life and license of a plant). From Table at end of. Appendix I of Enclosure A to Reference 1, should have been numbered Table I-4.

2 Totalfluencetolimitingmaterialwhenmaterialreaches screening ~ criterion (300 F for circumferential weld and

!' 270*F for plate or axial welds, as listed in column 3)

, from some source as column 1.

3- Applicable screening criterion, the " upper two-sigma" (or conservative) valve used to compare to actual vessel RT Value shown is 300*F if limiting material is a cikum.ferential weld, and is 270*F if the limiting material is an axial weld or a plate mate, rial. From some source as column 1.

4 ' Initial RT f limiting material, i.e., value before irradiatiokT From Table P-1, Appendix P of Enclosure A to Reference 1.

5 Twice the standard deviation of the " irradiated" RT I values. (Added to mean RT togettheconservatigT l- value used to compare to a$ual RT values of vessel).

NOT From same source as column 4.

i 6 Mean or "best estimate" of RT when the i " upper-two-sigma"valuereachgTthe. screening limit.

l Obtained by subtracting column 5 from column 3.'

7 Total change from initial value of " upper-2-sigma" RT NDT when the " upper-2-sigma" RT reaches the screening l limit. Obtainedby.subtracb[gcolumn4fromcolumn3.

i Irradiation rate of limiting material.

8 From some source as column 1.

9_ Effective full power years when limiting material reaches I screening limit. Obtained by dividing column 2 by column 8.

u.

s . ..

10 Number of years plant will operate above screening limit.

Obtained by assuming 32.EFPY as total license and life, and subtracting column 9 from 32.

11 Fluence in the limiting material at 32 EFPY. Obtained by multiplying column 10 by column 8 and adding result to column 2.

12 Total change from initial value of the " upper to-sigma" RT when the vessel reaches 32 EFPY. Obtained by the fobwingprocedure. Enter Ref. 5 at the A RT defined bycolumn7andthefluencedefinedbycolumn5DT This .

will determine a point. Through that point, draw a line parallel to the nearest line on the figure. On that newly drawn'line, read the A RTNDT corresponding to the fluence from column 11.

13 Mean value ov RT ObtainedasfollbI.oflimitingmaterialat32EFPY.

From column 12, subtract column 7.

This intermediate result (not shown) is the amount that RT has increased at EOL above the screening limit. To thbTintermediate value, add column 6 to obtain the result shown in this column.

14 Core melt frequency (assumed equal to crack penetration frequency) at E0L. Obtained by reading Figure 8.3 in Enclosure A to Ref. 1. Enter at column 13 (mean RTNDT) value, and read vertical axis.

15 Core melt frequency at screening limit. Obtained as in column 14 but enter at column 6 mean RT NDT*

16 Average core melt frequency for the time period when limiting material is above RT screening limit. It is obtainedasanaverageofcol$d14andcolumn15,butit is not merely (column 14 plus column 15)/2, since the relationship is logarithmic and this would underestimate the failure rate. It was obtained by approximate integration under the Figure 8.3 curve from the column 6 RT to the column 13 RT beNenthosetwoRT NOTs. # , divided by the difference 17 Total core melts for years when limiting material was above screening RT Obtained by multiplying column 16 NDT.

by column 10.

v . s.

- Some of-column 17 value is then total core melts expected for all plants considered while those plants are above the screening limit.

In addition, the " base risk" was calculated, which is the risk due to the same operation but with each plant held at the screening limit. This is obtained by multiplying column 15 by column 10 and summing. The result is 0.006

core melts.

{

6 4

4 E:

I

+

f f

67 -

+, e-+.- .,,,_-.y. p , -,. _m_._. - ,p,-.y,,, w -%,,, _ . . , - _ _w-- .,7., p. ,_.g e -w99._,- 9.,..e_ . , - - 9 , -p .--- g ..---gpa-y, 7 9

TABLE 3.2.2 Reduction In Core Melt Frequency Per Year Per Plant Column # (1) (2) (3) (4) (5)-

Average EFPY Above Core Melt Average Core Melt Reduction in Core Melt of Screening Freq. at Freq. While Above Due to Assumed Corrective Category . Criteria RT, _ RT,_ Actions

, em ,

-5 -3 -4 1 22.2 8.Ox10 /yr 1.Ox10 /yr 9.2x10 /yr 2.8x10

-5 2.1x10 -4

-4 2 19.2 1.8x10 /yr

-5 -5 6.5x10-5fy7 3 15.2 2.Ox10 8.3x10

' 1.8x10

-5 3.7x10

-5 -5 1.8x10 /yr 4 - 9. 4 8

Columns 2, 3, 4 are taken from columns of same name in Table 3.2.1 and represent the average for a selected group of plants in that Table.

Column 5 is column 4 minus column 3.

I

/.

.l TABLE 3.2.3

SUMMARY

OF AVERTED ~ RISK RESULTS Column # (1) (2) (3) (4) (5) (6)

Avg. Years Above Plant Reduction in Core Reduction in Reduction in Reduction in Screening RT Total Reduction Goup Melt Freq. Earley Fatalities Latent Fatalities Man Rem Plantsthis$T Man-Rem /(avg.) plant life 1 9.2x10-4/RY 9.2.x10-6/RY -8 1.9x10 /RY 1050/RY 22.2 23,300 man-rem 1.8x10

-4 1.8x10

-6 3.7x10

-9 205 19.2 3,900 2

3 6.5x20

-5 6.5x10'7 1.3x10

-9 74 15.2 1,125 4 1.8x10

-5 1.8x10

-7 3.7x10

-10 21 9.4 198

' Column 1: From Column 5, Table 3.2.2

$ Column 2: See development in Section 3.2.6.1

, , Column 3: See development in Section 3.2.6.2

Column 4: See development in Section 3.2.6.3 l'

Column 5: From Column 10, Table 3.2.1 Column 6: Column 5 times Column 5

s. . .o l

References

1. SECY-82-465, Pressurized Thermal Shock, November 23, 1982. Includes Enclosure A (PTS Report and Appendices), Errata Sheet for Enclosure A, Enclosure B (Value Impact Assessment), Enclosures C, 0, and E (ACRS Reports), and Enclosures F & G (CRGR meeting minutes).

2. SECY-83-288, Proposed Pressurized Thermal Shock (PTS) Rule, July 15, 1983. Includes Enclosure A, (Proposed Federal Register Notice),

Enclosure B (Regulatory Analysis), Enclosure C (Potential PTS Events in B&W Plants), and Enclosure D (Example of Congressional letters).

3. SECY-83-443, Flux Reduction Programs Related to Pressurized Thermal Shock at Selected (Lead) Plants, October 28, 1983.

4. _ Draft ORNL Report NUREG/CR-3770, ORNL/TM-9176, Pressurized Thermal Shock Evaluation of the Oconee-1 Nuclear Power Plant, April 13, 1984.

5. Pressurized Thermal Shock Presentation to NRC December 1,1982 by Dr. Stephen H. Hanauer. Slide #15 of Dr. Hanauer's presentation.

(available from handouts at meeting or in transcript).

I l _ . . - . . . _ , . :- - _ - - _ - , - . . - . - , _ . - ,

s s.

3.3 INSTALLATION AND TESTING OF AUTOMATIC POWER-0PERATED RELIEF VALVE ISOLATION SYSTEM by: W. Bickford (PNL) 3.

3.1 BACKGROUND

All current generation PWRs include a power operated relief valve (PORV) in the primary system in addition to safety relief valves. The safety relief valves are part of an automatic safety system to control reactor pressure in the event of a transient. These are thus subject to stringent requirements for operation and reliability. The PORV however is an additional control element placed into the system which is thought to allow greater system flexibility in responding to pressure transients, thus reducing the larger stresses that may be generated on the primary vessel and piping by demanding the safety valves or the possibility of safety valves failing to reseat. The PORV can also be operated manually by the operator for this purpose, or to release gases from the system. It thus can play a significant role in the .

reactor response to transients. It was originally thought that PORVs wou'd not play a vital role for design basis accident response, thus block valias were installed downstream of the PORVs to handle expected leakage.

In n.ut plants the low temperature overpressure protection (LTOP) system is designed to use the PORVs. For this mode of operation, the valves are typically set to open at 500 psig rather than the high pressure ( 2300 psig) setpoint used at power. Some Westinghouse plants use redundant PORVs for LTOP concerns. These plants are brought to a water solid condition during shutdown. In contrast, B&W owners use a single PORV and the gas (steam or riitrogen) space in the pressurizer function as the primary LTOP system. The PORV and associated actuation circuitry functions as a backup should the operator fail to terminate a low temperature everpressure challenge prior to compression of the gas space.

However, the accident at Three Mile Island Unit 2 (TMI-2) in 1979 demonstrated that a certain complacency had developed concerning PORV leakage. The TMI-2 suffered a severe fuel damage accident as a result of a combination of operator and maintenance errors, mechanical failures, and plant design characteristics. One of the leading contributors to the severity of the accident was an undiagnosed small break loss-of-coolant (SBLOCA) through a stuck-open PORV. The LOCA eventually resulted in severe undercooling of the fuel, with subsequent damage and release of fission products.

Since that time, other events have occurred involving PORV malfunctions which have led to significant plant transients. Most notable include Crystal River-3 in 1980, and H.B. Robinson in 1981 where the failure of the PORV block valve to completely close aggravated recovery from a reactor coolant

y 9 i

i

. system leak. Most recently, a malfunction of the PORV at Ginna aggravated L recovery from a steam generator tube rupture event in January 1982.

!=

l As a result of these incidents, a number of action items were developed to understand and resolve safety questions concerning PORV and block valves.

This evaluation deals with one particular TMI-2 action item developed to resolve questions concerning the undiagnosed leaking PORV (Reference 1, l NUREG-0737, Clarification of TMI Action Plan Requirements, November 1980).

l As per Task Action item II.K.3.1, Installation and Testing of Automatic l Power-Ope ~ rated Relief Valve Isolation System, all pressurized water reactors were required to access the need to install an automatic system to prevent PORV leakage.

!: The' significance of this issue and its interrelationship with other issues

> will be delineated below.

3.3.2 SAFETY SIGNIFICANCE As demonstrated above, the PORV and block valves are used in various modes of plant operation. As originally designed, they are to play a role in plant operation and transient control. Specifically, during startup and shutdown operations many of.the plants use the PORVs as part of the Low Temperature Overpressure Protection (LTOP) system. The LTOP systems that rely on lifting the PORV's to reduce reactor pressure, in accordance with established pressure / temperature limits, have experienced several events where the LTOP i systems have been inoperable. As a result of the. inoperable LTOP systems, the potential for brittle fracture of the reactor pressure vessel is increased. Some accident sequences and transients can be mitigated by using the PORV's and High Pressure Injection (HPI) pumps for pressure and-coolant inventory control. This mode of operation is known as feed and bleed, or bleed and feed, depending on the HPI capability of the injection pumps and

, system design. In these situations the PORV's could experience multiple

( openings and closures. Reliance on the PORV and block valves rather than the l SRVs is thought to lessen the potential for a small break LOCA (SBLOCA) as a result of failure of a SRV to reseat during a transient.

However, TMI-2 demonstrated that the PORVs themselves are subject to potential SBLOCAs if they stick open. If the PORVs are simply blocked due to i

continual leakage, the SRVs may again be challenged during transients, introducing the potential for an unisolated SBLOCA. Blockage of the PORVs would reduce operator flexibility to respond to transients,-but TMI-2 also demonstrated that confusion as to PORV status could also aggravate a scenario.

The safety s*gnificance of this particular issue focuses on auto isolation to evaluate leakage and the potential'for an unisolatable SBLOCA. However, 4

positive valve condition would also impact the operator knowledge of system configuration in a transient.

3.3.3 REQUIREMENT A number of requirements have been placed on the PORV/ block valve system.

Those directly related to II.K.3.1 will be presented first. '

Task action item II.K.3.1, Isolation and Testing of Automatic Power Operated I Relief Valve Isolation System, states that all PWR licensees should provide a system that uses a PORV block valve to protect against a small-break LOCA. J This system will automatically cause the block valve to close when the reactor coolant system pressure decays after the PORV has opened.

Justification should be provided to assure that failure of this system would not decrease overall safety by aggravating plant transients and accidents.

However, implementation of this requirement would depend on the outcome of ,

studies as mandated by Task Action item II.K.3.2, Report on Overall Safety i Effect of Power-0perated Relief Valve Isolation System. The criteria stated '

is that modifications to reduce the likelihood of a stuck-open PORV should be considered sufficient if the PORV represents a small contributor to the probability of a SBLOCA due to all causes. The median probability of a small-break SBLOCA with break diameter between 0.5 and 2.0 inches is put at l 1E-3 per reactor year in WASH-1400 (Reference 5), with the range of 1E-2 to l 1E-4 per reactor year.

The analysis for II.K.3.2 could consider modifications which have been made since TMI-2 to improve the reliability of the system in preventing SBLOCAs.

The results of the probability analysis would then be used to determine whether the modifications already implemented have reduced the probability of a SBLOCA due to a stuck-open PORV a sufficient amount to satisfy the criteria above, or whether the automatic PORV isolation system specified in Task Action item II.K.3.1 is necessary.

The Nuclear Steam Supply System (NSSS) vendors, Babcock and Wilcox, Festinghouse, and Combustion Engineering, responded with a generic evaluation of PORV leakage in their respective designs. The results indicated that for plants which incorporated these changes, the probability of SBLOCA due to stuck open PORV is within the range specified by II.K.3.2, and that the automatic PORV isolation system is not required (References 5, 7, 8). All licensees asserted that the generic report was applicable to their plants, although they did not provide any supporting documentation.

The NRC review of the analyses, and a review of their application to specific plants (References 9, 10, 11) resulted in the NRC concurrence with the NSSS vendor's position that the automatic PORV isolation system is not necessary.

s-  %

i l

1 l

L Related Is' sues:

As discussed above, the.II.K.3.2 analysis of PORV leakage could consider other modifications impacting valve reliability. The overall safety significance and requirements for this issue ~ impact other aspects of

.PORV/ block valve ~ performance. This could involve specification of the-PORV/ block valve combination to some or.all of the requirements associated

.with safety grade systems, better initial qualifications for'the valves,'and specified maintenance and testing requirements.

Related PORV problems thus depend on actions taken to correct associated problems as well as PORV leakage. A number of operator and system interactions played a role in a number of related changes which impacted the

. progression of the TMI accident, including:

o operator upgrading, training, and accident review (I.A.2.1, I.A.3.1, I . C .' 1 ) ,

o . performance testing of relief and safety valves (II.D.1),

o. requirements for positive valve. position indication (II.D.3), and o Technical Specification changes putting the high pressure reactor trip ,

before PORV demand.

As-stated previously, both the PORVs and block valves were originally designed as non-safety components in the reactor pressure control system.

However, RSB/DSI has recently determined that PORV's are, in fact, relied upon to mitigate a design-basis steam generator tube rupture (SGTR). The

. acceptability of relying on non-safety grade PORV's to mitigate a design-basis accident (SGTR) was' raised in Reference 12.

-NUREG-0737, Item II.D.1, set forth functional requirements for both PORVs and ,

2 block valves. .All plants were required to demonstrate the function of these

,. valves for all expected flow conditions during operating and accident

, conditions. It was further required that the block valves be capable of l closing to ensure that a stuck open relief valve can be isolated, thereby

~

terminating a small loss of coolant accident. In response to the II.D.1' requirements, PORVs were-tested extensively by EPRI (Reference 13) and the results reported to the staff. Only limited block valve testing has been

performed by the EPRI program. Reports describing the test program results i' have been submitted to the NRC staff for review as well as some plant-specific evaluations. Most plants have requested exemptions to the specified completion date for Task II.D.1 to obtain additional time for required evaluation of piping associated with safety valves, PORVs, and block valves.

1 1

4

}

4 ,

i

_.;..__2_._. ..u.-. , . - . . , a ~_ _ , _ c _ . _ . _ _ , _ . . _ _ . ,,....-_ - . _ - 4 __,__,m._.. ,.

p

[  %- 'y i

I t

i When PORVs are used for high point vents in some plants, under II.B.1 of NUREG-0737, both PORVs and block valves are required to meet seismic and environmental requirements for safety related equipment.

There was, and still is, no Technical Specification requirements that these components be operational when the plant is at power. Continued operation at power with inoperable PORVs and block valves is permitted by the Technical Specifications if the block valve is closed and power to the block valve (s) is removed. Many of the plants now o;:erate with the PORVs blocked.

LTOP systems, as specified in the Standard Review Plan 5.2.2 (Reference 14),

are to be single failure proof, testable, designed to quality standards and operable from emergency power. Full implementation of IEEE Standard-279 to withstand a Safe Shutdcwn Earthquake (SSE) is not specified, but the Operating Basis Earthquake (0BE) is. At the present time, the LTOP system requirements are being implemented as Multi-Plant ' Action Item B-04 (Reference 15).

Even though the LTOP system, as discussed above, is a separate MPA issue, the common cause failures are: inoperable PORVs due to PORV leakage, maintenance errors disabling the LTOP systems, procedural deficiencies, and inadequate inspection or surveillance of the gas (nitrogen / air) supply that provides the PORV opening force in certain plants.

It is noted that the conclusion of Item II.K.3.1,2 NUREG-0737 (Reference 6, 7 and 8) determined that an automatic PORV isolation system is not necessary.

However, the possible need to improve PORV reliability was recognized. The II.K.3.2 conclusion was predicated on the absence of need to reduce the PORV-SBLOCA frequency by this single modification. Therefore, the scope of the II.K.3.2 evaluation was limited in that it did not consider, or combine,

.the automatic PORV isolation system as a subset with other measures that could be taken to improve overall PORV/ Block valve system reliability.

NRC analysis (Reference 16) of the safety benefit associated with an automated PORV isolation system included this as a possible part of an overall PORV/ Black valve system reliability improvement. This analysis expanded on the II.K.3.2 evaluation by including additional means to improve the PORV/ Block valve system reliability and assessing all of the modes of risk reduction (and costs) that would likely result from these improvements.

That analysis, however, also indicated that a singular m ication, like that reviewed in II.K.3.2, or a reliability program to improve PORV/ Block valve system reliability without considering improvements to the control element (automation vs. manual) may yield at most small benefits.

i J L__ ____

.4 %s 3.3.4 TYPES OF EVALUATIONS This section evaluates the potential reduction in core-melt frequencies and in public and occupational radiation exposure due to implementation of the above requirements for II.K.3.1. Information available from the NRC analysis of related PORV Issue 70 (NUREG-0933) will be utilized in the development of these values.

3.3.4.1 CORE MELT FREQUENCY ESTIMATES PORV Challenge Frequency An NRC review of applicable data or PORV challenge frequency (Issue 70, NUREG-0933) puts this value at 1.0 PORV lifts /py for Westinghouse plants.

This value will be used here.

Base-Case PORV/ Block Valve Failure Frequency As per Issue 70, the failure of the PORV to close, given that it has opened is put at 0.02/ demand. The failure probability of the block valve is put at 0.005/ demand.

Base-Case Block Valve Failure Frequency Operator error for manual actuation of the block valve is put at 0.05. This assumes an 83% improvement in operator performance as a result of TMI associated operator training programs.

Base-Case PORV-SBLOCA Frequency For the purpose of this analysis, the PORVs and safety valves are assumed to be normally closed, with block valves open. The base case PORV induced SBLOCA is then (1.0/py)(0.02)(0.05 + 0.005) = 1.1E-03/py.

Adjusted-Case Block Valve Failure Frequency Implementation of the automatic actuation circuit is assumed to take the place of operator action. The failure rate of an automated block valve is taken at 0.002/ demand, as per Issue 70.

Note that no credit for improved PORV performance will be considered in this analysis as was done for the more comprehensive considerations in Issue 70.

Adjusted-Case PORV-SBLOCA Frequency The adjusted-case frequency for PORV induced SBLOCAs is then assumed to be:

(1.0/py)(0.02)(0.002 + 0.005) = 1.4E-04.

w - y Change in PORV-SBLOCA Frequency 1.1E-03/py - 1.4E-04/py = 9.6E-04/py.

Related Issues:

Improvements in PORV/ block valve reliability may influence reactor recovery from high pressure transients, LTOP and low power actuations, and during feed-and-bleed operations. The occurrence of most high pressure transients is assumed to be covered in the 1.0/py valve lift frequency used previously.

LTOP events are covered under the multi plant action item MPA B-04.

Feed-and-bleed is covered under USI A-45.

As per Issue 70, improvements in PORV/ block valve reliability should be developed as part of the resolution to MPA B-04 and USI A-45, but credit for improved performance in these areas will not be taken here.

For ATWS events, failure centers primarily on failure of the PORV or SRVs to open. However, once demanded, they again have a potential for sticking open.

Assuming an ATWS frequency as per Issue 70 of 1E-05/py and probability that the PORV opens of 0.99, and a change in block valve performance from 0.05 to 0.002 failures / demand gives a change in ATWS induced SBLOCAs of:

(1E-05/py)(0.99)(0.05 - 0.002) = 4.75E-07/py.

Note however that the performance of the block valve would likely be irrelevant in an ATWS unless recovery from the pressure transient occurs, leaving the SBLOCA to be corrected. This, however, would still be a non-dominant contribution to the change in PORV-SBLOCA calculated previously.

The total predicted change in PORV induced SBLOCA is then 9.6E-04/py.

Core-Melt Frequency Given SBLOCA The WASH-1400 median core-melt frequency (1.5E-05/py) given SBLOCA (1E-03/py)

-was considered in the NRC analysis of Issue 70, and updated to 4.0E-06/py using what is considered to be more representative values for the dominant sequence failures.

For this analysis, the probability of core-melt given SBLOCA will then be the core-melt frequency divided by the SBLOCA frequency. For category 7 for example, this would be assumed to be on the order of:

(4.0E-06/py)/(1E-03/py) = 4.0E-03.

The modified core-melt probabilities associated with the other remaining release categories are given below as developed in Issue 70, along with the resulting probability of core-melt given SBLOCA.

\- .s Modified WASH-1400 Assumed Probability Release Core-Melt Frequency of Core-Melt Category .(SBLOCA = 1E-03/py) Given SBLOCA

-2 2E-09 2E-06 3 2E-07 2E-04 4 -- --

5 1E-08 1E-05 6 1E-08 1E-05 7 4E-06 4E-03 Change in Core-Melt Frequency The estimated changes in core-melt frequency based on a reduction in PORV induced SBLOCA of 9.6E-04/py is then-given below for the release categories.

Release Base-Case Adjusted Case Change in Category Core-Melt /py Core-Melt /py Core-Melt /py

'2 2.20E-09 2.80E-10 1.92E-09 3 2.20E-07 2.80E-08 1.92E-07 4 -- --

5 1.1E-08 1.4E-09 9.60E-09 6 1.1E-08 1.4E-09 9.60E-09

, 7 4.40E-06 5.60E-07 3.84E-06 TOTAL 4.64E-06 5.91E-07 4.05E-06 3.3.4.2 RISK EVALUATIONS The dose and fatalities associated with the release categories for the reference site are combined here to estimate reductions in dose and fatalities as a result of the reduced probability of core-melt.

3.3.4.2.1 Individual Risk Estimates Individual risk estimates to the average individual within one mile of the site boundary and beyond a one-half mile exclusion zone are tabulated below.

The risk is expressed in terms of the probability of early fatality due to exposure from an accidental release. The population within this distance from the plant is put at 2.14E+03 people.

1 Release Change in man-rem Prob. of Early Reduction in Category Core-Melt /py per Event Fatality per Event Man-Rem /py Early Fatal /py 2 1.92E-09 3.09E+04 1.67E-02 5.93E-05 3.20E-11 3 1.92E-07 4.06E+04 4.72E-02 7.80E-03 9.07E-09 4 0 3.78E+04 1.88E-02 0.0 0.0 5 9.60E-09 2.71E+04 7.38E-04 2.60E-04 7.10E-12 6 9.60E-09 1.02E+04 0.0 9.79E-05 0.0 ,

7 3.84E-06 4.00E+02 0.0 1.54E-03 0.0 TOTAL 4.05E-06 9.76E-03 9.11E-09 Assuming a 27.7 year remaining life for the affected PWRs gives a total man-re.n reduction in individual exposure of (9.76E-03 man-rem /py)(27.7 yrs) =

0.27 man-rem / reactor.

Likewise, the -total reduction in early fatalities is (9.11E-09 fatalities /py)(27.7 yrs) = 2.5E-07 fatalities / reactor.

3.3.4.2.2 Societal Risk Estimates Societal risk estimates to the public within 50 miles of the site boundary are tabulated below. The risk is expressed in terms of the probability of total latent fatality. This included initial latent fatalities due to exposure from the original accidental release as well as fatalities that occur due to exposure from remaining contamination over the period of years.

The population within this radius from the plant is put at 2.67E+06 people.

Release Change in man-rem Prob. of Latent Reduction in Category Core-Melt /py per Event Fatality per Event Man-Rem /py latent Fatal /py 2 1.92E-09 4.8E+06 1.4E-04 9.22E-03 2.69E-13 l 3 1.92E-07 5.4E+06 1.6E-04 1.04E40 3.07E-11 4 0- 2.7E+06 5. 6 E-05 0.0 0.0 5- 9.60E-09 1.0E+06 2.0E-05 9.60E-03 1.92E-13 ,

6 9.60E-09 1.5E+05 2.7E-06 1.44E-03 2.59E-14 i 7 3.84E-06 2.3E+03 4.5E-08 8.83E-03 1.73E-13 l

)

TOTAL 4.05E-06 1.07E+0 3.14E-11 Assuming a 27.7 year remaining life for the affected PWRs gives a total man-rem reduction in societal exposure of (1.07E+0 man-rem /py)(27.7 yrs) =

29.6 man-rem / reactor.

s ..

Likewise, the reduction in total latent fatalities is (3.14E-11 fatalities /py)(27.7 yrs) = 8.70E-10 fatalities / reactor.

3.3.4.2.3 Occupatoinal Radiological Exposure Per-Plant Occupational Risk Reduction due to Accident Avoidance Given the estimated reduction in core-melt frequency of 4.05E-06/py and estimated occupational dose of 19,900 man-rem / core-melt (NUREG/CR-3568), the estimate of reduction in occupational radiation exposure (ORE) due to accident avoidance is then 8.1E-02 man-rem /py, or 2.2 man-rem per plant over 27.7 years.

Power-Plant Utility Dose Increase for Implementation Issue 70 estimated the time required to replace 2 upgraded SRVs and 2 automated block valves at 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> / plant in a 0.2 rem /hr field for a dose of 19.2 man rem / plant. It is unlikely that Issue II.K.3.1 would require actual replacement of the block valve as would be required if the valve were to be safety qualified and automated as in Issue 70. Modifications to the logic circuitry away from the actual valve would be sufficient. As a result, no ORE is expected for implementation of Issue II.K.3.1 alone.

Per-Plant Occupational Dose Increase for Operation and Maintenance Issue 70 assumed that doses associated with additional annual testing would be offset by improved valve maintenance and associated reductions in repair frequency and dose. Secondary effects include PORV/ block valve induced outages which lead to required maintenance in radiation zones. However, reductions in forced outage frequency would also be expected to have some associated reduction in maintenance and ORE. This was not quantified for Issue 70, and would be equally minimal here. Therefore, no increase is predicted for ORE due to maintenance and operation.

Total Per-Plant Occupational Dose Increase The net result is that no increase is predicted for ORE due to Issue II.K.3.2.

3.3.4.3 DEFENSE IN DEPTH As developed previously, the PORV/ block valves in PWRs were originally considered only as control systems. As such, their actions were not thought to be necessary for the recovery from design basis accidents. The introduction and use of the PORVs was then precisely thought to provide an additional layer of defense in responding to pressure transients before the dedicated safety systems were challenged. The SRVs, which are not allowed to r: ..

be blocked, could introduce the potential for an unisolatable SBLOCA if challenged and one failed to reseat. This was thus thought to be a classic application of defense-in-depth.

Past events demonstrated that the existing configuration, reliability, technical specifications, and operator training of PORV/ block valves had allowed the PORVs to actually play a role in aggravating transients. The question then arose a to whether the confusion in transients introduced by the uncertain reliability or operator control of the PORV outweighed the positive aspects for pressure control. The resulting programs to resolve this many-sided problem, if properly integrated, should eliminate the confusion surrounding the use of the PORV as a control system.

'However, the NRC staff determination that the PORVs are 'in fact relied upon to mitigate a design basis steam generator tube rupture indicate that the previous assumptions concerning the role of the PORV must be modified.

Instead of providing a discretionary control system for added defense, the PORV may take on mandatory safety duties. Modifications up to the requirements for safety grade equipment may also be required. credit associated with its function thus must be modified appropriately.

3.3.4.4 COSTS Per-Plant Industry Costs for Implementation Issue 70 estimated the effort for installation of 2 safety grade PORVs and 2 safety grade block valves instrumented for automatic actuation at 12 man-wks/ reactor at $2270/ man-wk, or $27,240/ reactor. Valve costs were put at

$25,000 each for $100,000. Incremental material costs were put at $50,000, with an additional $50,000 for safety analysis and $4,000 for a Class III License Amendment. The grand total was then $231,240/ reactor.

This issue. deals only with automation of the block valves, and would not require the safety upgrade and replacement of the existing valves. Labor is estimated here at 6 man-wks for engineering design and installation of new control logic for the existing block valves, or $13,620 at $2270/wk.

Material costs are put at $25,000 for the miscellaneous electronics, logic relays, panels, wiring, etc. An additional $25,000 is included for safety analysis, but no license amendment is required. This totals to

$63,620/ reactor.

Note that this is approximately 1/4 the total for Issue 70 which included installation of the automated block valve feature.

Per-Plant Industry Costs for Operation and Maintenance In Issue 70, additional costs were associated with additional testing and maintenance requirements on the valves because of the safety upgrade. This was put at 0.5 man-wk/py. It will be assumed that 1/4 of this effort would be directed at testing the automated block valve feature, which at $2270/wk becomes $284/yr. The present worth of this cost (as per NUREG/CR-3568, p.

C.4) in constant dollars with a 5% discount rate over 27.7 years is

$4210/ reactor.

Total Per-Plant Industry Costs The total estimated industry costs for this issue are then ($63,620 + $4210)

= $67,830, or approximately $68,000 per reactor.

NRC Costs NRC Costs for Development and Implementation A 3 man year effort was estimated in Issue 70 for development of generic studies, reliability studies, and performance goa's for the PORV/ block valves, resulting in the preparation of a Regulatory Guide. For the automated block valve feature alone, this effort is put at (1/4)(3 man yrs)($100,000/ man yr), or $75,000. Divided over 47 operating and 48 planned PWRs, the cost is then $790/ reactor.

The plant-specific reviews are also estimated at 1/4 the Issue 70 estimate, or (1/4)(1.5 man-months / reactor)($100,000/12 man-months) = $3125/ reactor.

NRC Costs for Operation and Maintenance Annual NRC costs associated with inspection and testing of the automated block valve feature are assumed to be included in the existing requirements.

No additional or incremental costs are estimated for this issue.

Total NRC Costs The total NRC cost for this issue is then estimated at $3,915/ reactor, or approximately $4,000/ reactor.

Outage Avoidance Cost Issue 70 noted that 0.11 outage events /py can be attributed to the PORV/ block valves, resulting in a loss of an average 115 Effective Full Power Hours (EFPH) per outage. It was further assumed that 30% of the effective reduction in SBLOCA frequency (1.05E-03/py)/(1,1E-03/py) due to issue implementation could be assigned to a reduction in the PORV/ block valve outage frequency, t

s m.

For Issue II.K.3.1, the ratio of change in 50LOCA frequency to the base case was estimated at (9.6E-04/py)/(1.1E-03/py). Attributing 30% of this reduction to a reduction in the 0.11 events /py frequency for PORV/ block valve induced outages then gives (0.30)(0.96/1.1)(0.11 events /py)(115 EFPH/ event)(EFPH/24 EFPD)

= 0.14 EFPD/py.

Using a replacement power cost of $0.3M/ Effective Full Power Day (EFPD) as per NUREG/CR-2800, this becomes $41,400/py of cost savings. Assuming a 5%

discount rate over 27.7 years yields a present worth cost savings of

$0.61M/ reactor.

Per-Plant Industry Savings due to Accident Avoidance As per NUREG/CR-3568, the costs associated with core-melt are estimated at

$1.65E+09. With a reduction in core-melt frequency predicted of 4.05E-06/py, the cost savings due to accident avoidance becomes $6.7E+03/py, or

$1.9E+05/ reactor over 27.7 years.

3.3.4.5 BENEFIT / COST (VALUE/ IMPACT)

Based on a per plant public risk reduction of 29.6 man-rem / reactor at an industry cost of $68,000 reactor and an NRC cost of $4,000/ reactor,, the value/ impact ratio is then:

S = (29.6 man rem)/($68,000 + $4,000) which includes NRC costs, or

= 0.41 man-rem /$1000.

3.3.4.6 UNCERTAINTY The analysis of Issue II.K.3.1 focused on the frequency of PORV induced SBLOCAs and the subsequent probability of core-melt. The difference between the base case and adjusted case values then came down to the SBLOCA initiating frequency times the difference between the probability of operator and automatic actuation of the block valve.

The information available on PORV/ block valve induced SBLOCAs is based to a large extent on observed data for failure rates. The data is reviewed in Issue 70 and is thought to have a higher confidence of the initiating frequency than SBLOCAs in general with this data base.

The expected performance of the automatic actuation of the block valve is also fairly certain. The failure probability of 0.002 used is based on a

s ..,

I worst case estimate of failure probability on demand, with actually no failures observed in 486 tests (Ref. 17).

The failure rate for automated block valve actuation is then compared to the assumed 0.05 failure probability for actuation by the operator. This latter human failure probability compares to the value of 0.29 assumed in WASH-1400.

As can be seen, a significant reduction in the operator failure probability has already been assumed (i.e. a 83% improvement, or (1 .83)(.29) = 0.05).

This reduction is credited to other post-TMI related operator training and procedural upgrades. This is considered to be a significant reduction of human error under stress and a higher value for human error is very likely.

More uncertainty is thought to reside in the operator error term than the failure probability expected with automation. However, the operator error rate is expected to actually be higher, and the automatic block valve actuation failure probability lower than the values used here. These both lend themselves to increasing the difference between the two and hence an even larger reduction in PORV-induced SBLOCAs would be predicted.

The remaining uncertainty deals with the probability of core-melt'given SBLOCA. The values used here are consistent with the values derived in the analysis of Issue 70, and are thus thought to be appropriate. Note however that the WASH-1400 numbers have been modified in the Issue 70 analysis, effectively reducing the assumed probability of core-melt for SBLOCA sequences compared to a WASH-1400 derived value. From WASH-1400, an average value would be:

(core-melt /SBLOCA) = (1.5E-05/py)/(1E-03/py) = 1.5E-02.

Values derived for this issue ranged from 4E-03 for release category 7 to 2E-06 for release category 2. Use of this average value would again result in an even higher estimate of the change in core-melt attributable to this issue resolution.

3.

3.5 CONCLUSION

S This analysis dealt only with the automation of the block valve, the primary purpose in being to reduce PORV leakage and induced SBLOCAs. All uncertainties associated with the analysis tend towards even larger predicted reductions in core-melt frequency and public risk associated with issue resolution.

Issue 70, PORV and Block Valve Reliability, also dealt with PORV leakage, but included a number of issues related to PORV performance in transient control.

The approach taken for analysis of Issue 70 also focused on reducing PORV leakage through automation of the block valve, and in fact this was

s ...

I l

c demonstrated to dominate the risk reduction compared to the PORV role in transient control. However, a number of costs are associated with transients (i.e. safety grade valves) that are not required for simple block valve automation. Thus, the net result is that Issue II.K.3.1 demonstrates a significant fraction of the safety benefit (90 percent) associated with Issue 70, but at only a fraction (1/4) of the cost of Issue 70.

If the above analysis were taken to an extreme, full time blockage of the PORVs would indicate an even higher safety return. This approach taken in the evaluation of Issue 70 then tends to downplay the positive benefits associated with PORV control in transients.

It is suggested that an approach is required that separates the actions ,

directed primarily at reducing PORV leakage from those actions directed at t improving performance in transient response. In this fashion, the original purpose for introducing the PORVs into the primary system (transient response) will not be lost in the consideration of corrective measures required to restore leakage control.

Note that Issue 70 included automatic block valve actuation in its analysis primarily because of the uncertain implementation of this requirement under Issue II.K.3.1. If judged by the criteria defined in II.K.3.2 alone for reduction in SBLOCAs, the feature will not be installed. However, the ability to rely of the PORV for transient response including SGTR is predicated on the reliability of the PORV/ block valve set achieved primarily through the use of the automated block valve feature.

The problem is believed to arise in the simple criteria of II.K.3.2 comparing SBLOCA frequencies in PORVs versus all other sources. The effects of these SBLOCAs are not however the same, in that leakage through the PORV/ block valve creates a SBLOCA\andkreduces the effectiveness of a control / safety <

system.

In the extreme case of pre-TMI, the problems introduced by valve reliability led to confusion which actually aggravated transients. It thus becomes apparent that additional criteria must be added to the consideration for automated block valves outside of the narrow confines of II.K.3.2.

The results are summarized in the following tables.

3.3.5.1 Statement on Primary Design Objective As can be seen, the reduction in probability of individual early fatality (2 percent of design objectives) is higher than the societal reduction in latent fatalities (2E-03 percent of design objectives), but the man-rem reduction in societal exposure dominates the individual exposure within one mile of the plant.

TABLE 3.3.1. Primary Design Objectives ChanJe in Risk Per Plant Individual Risk Societal Risk Item man-rem Fatalities man-rem Fatalities Safety Goal -

SE-07/py -

2E-06/py Requirement 9.76E-03/py 9.11E-09/py 1.07E+0/py 3.14E-11/py 3.3.5.2 Statement on Sub-ordinate Design Objective The benefit / cost result is summarized in Table 3.3.2. As can be seen, it is 42 percent of design objectives. .

TABLE 3.3.2. Sub-ordinate Design Objective Item Benefit / Cost Safety Goal 1. 0 man-rem (public) averted /$1000 per plant Requirement 0.41 man-rem (public) averted /$1000 per plant 3.3.5.3 StatementonPlantPerformanceDesignObjectives From data given in Section 3.3.4, the plant performance design objectives are summarized below. The reduction in core-melt is 4 percent of the design objective.

TABLE 3.3.3. Plant Performance Desian Objectives Item Core-Melt Frequency Defense-in-Deptn Safety Goal 1E-04/py Requirement (Issue II.K.3.2)

Base-Case Issue Core-Melt 4.64E-06/py --

Adjusted Case Issue Core-Melt 5.91E-07/py --

Change in Core-Melt 4.05E-06/py --

1

e. ..

l l

3.

3.6 REFERENCES

1. NUREG-0737, Clarification of TMI Action Plan Requirements, November 1980.

l

2. IE Information Notice 82-17, Overpressurization of Reactor Coolant System, June 10, 1982.

3. IE Information Notice 82-45, PWR Low Temperature Overpressure Protection, November 19, 1982.

4. Memorandum, Heltemes, C. to Denton, H., AE00 Report - Low Temperature Overpressure Events at Turkey Point, Unit 4, September 26, 1983.

5. NUREG-75/014, " WASH 1400 Reactor Safety Study," United States Nuclear Regulatory Commission, October 1975.

6. Memo for LG. Lainas from F. Rowsome, " Safety Evaluation of the B&W Licensees' Response to TMI Action Item II.K.3.3," 8/24/83.

7. Memo for G. Lainas from F. Rowsome, " Safety Evaluation of the CE Licensees' Response to TMI Action II.K.3.3," 8/26/83.

8. Memo for G. Lainas from F. Rowsome, " Safety Evaluation of the Westinghouse Licensees' Response to TMI Action Item II.K.3.3," 7/22/84.

9. Memo for G. Lainas from F. Rowsome, " Safety Evaluation of the Catawba Response to TMI Action Item II.K 3.3," 2/29/84.

10. Memo for G. Lainas from F. Rowsome, " Safety Evaluation of the McGuire Unit 1 Response to TMI Action Item II.K.3.3," 2/28/84.

11. Memo for G. Lainas from F. Rowsome, " Safety Evaluation of the Byron Units 1 & 2 Response to TMI Action Item II.K.3.3," 2/28/84.

12. Memorandum, Sheron, 8. To Minners, W., dated June 27, 1983,

13. EPRI-NP-2292, "PWR Safety and Relief Valve Test Program," December 1982.

14. NUREG-0800, Standard Review Plan.

15. NUREG-0748, Volume 3, No. 10, " Operating Reactors Licensing Action Summary," December 1983.

16. NUREG-0933, Evaluation of PORV/ Block Valve Reliability (Issue 70).

17. Kolb, G. et al. 1982. Interim reliability Evaluation Program: Analysis of the Arkansas Nuclear One - Unit 1 Nuclear Power Plant.

NUREG/CR-2787, Sandia National Laboratories, Albuquerque, New Mexico).

% c.,

Section 3.4 Asymmetric Blowdown loads on PWR Primary Systems by: D. Gupta (NRR) 3.4.1 Background In 1975, the NRC staff was informed of some newly defined asymmetric loads on PWR primary systems that result from postulated rapid-opening, double-ended guillotine breaks (DEGB) at specific locations of reactor coolant piping.

The locations include the reactor pressure vessel (RPV) nozzle pipe interface in the annulus (reactor cavity) between the RPV and the shield wall plus other selected break locations external to the reactor cavity. The postulated rupture could cause pressure imbalance loads both internal and external to the primary system which could damage primary system equipment supports, core cooling equipment or core internals and thus possibly contribute to core melt frequency. The internal asymmetric loads result from a rapid decompression that causes large transient pressure differentials across the core barrel and fuel assembly. The external asymmetric loads result from the rapid pressurization of annulus regions and cause large transient pressure differentials to act on the vessel.

The staff requested, in June 1976, that the owners of operating"PWRs evaluate their primary systems for these asymmetric loads. Most owners formed owners groups under their respective NSSS (Nuclear Steam Supply System) vendors to respond to the staff request. The Babcock and Wilcox (B&W) and Combustion Engineering (CE) owners groups each submitted a probability study, prepared by Science Applications Inc., and the Westinghouse owners submitted a proposal for augmented inservice inspection. The staff reviewed these submittals and concluded at that time that neither approach was acceptable for resolving this problem. In general, the staff concluded that the existing data base was not adequate to support the conclusions of the probability study and that the state-of-the-art for inservice inspection alone was not acceptable for this purpose.

The staff formalized these conclusions in a letter to the owners of all operating PWRs in January 1978. This letter also reiterated the staff desire

{ to have the PWR owners evaluate their plants for the postulated asymmetric i blowdown loads.

This generic PWR issue was designated Unresolved Safety Issue (USI) A-2 and is described in detail in NUREG-0609 (Ref. 4).

3.4.2 Safety Significance

}

The USI A-2 safety concerns resulted from the previously unanalyzed asymmetric blowcown loads caused by a postulated major double-ended pipe

} break in the primary system. For postulated pipe breaks in the cold leg, asymmetric pressure changes could take place in the annulus between the c. ore l i. - - -

O . .. ,

barrel and the RPV. Decompression could take place on the side of the reactor pressure vessel (RPV) annulus nearest the pipe break before the pressure on the opposite side of the RPV changed. This momentary differential pressure across the core barrel induces lateral loads both on the core barrel itself and on the reactor vessel. Vertical loads would also be applied to the core internals and to the vessel because of the vertical flow resistance through the core and asymmetric axial decompression of the vessel. For breaks in RPV nozzles, the annulus between the reactor and biological shield wall could become asymmetrically pressurized, resulting in additional horizontal and vertical external loads on the reactor vessel. In addition, the reactor vessel would be loaded simultaneously by the effects of-strain-energy release and blowdown thrust at the pipe break. For breaks at reactor vessel outlets, the same type of loadings could occur, but the internal loads would be predominantly vertical because of the more rapid decompression of the upper plenum. Similar asymmetric forces could also be generated by postulated pipe breaks located at the steam generator and reactor coolant pump.

These previously unanalyzed, asymmetric blowdown loads on the primary system components would have the potential to alter primary system configurations, damage core cooling equipment or core internals and thus contribute to core melt accidents.

3.4.3 Requirement Plant analyses for asymmetric loads were submitted to the staff for review in March and July 1980. The results of these plant analyses indicated that some plants would require extensive modifications if the rapid-opening double-ended guillotine break (DEGB) is required as a design basis postulation. The modifications could have been in the form of additions of piping restraints to prevent postulated large pipe ruptures from resulting in full double-ended pipe break area, thus reducing the blowdown asymmetric pressure loads and the need to modify equipment supports to withstand those loads.

In parallel with the performance of plant analyses for asymmetric loads, some owners, anticipating potential modifications resulting from the double-ended guillotine break (DEGB) as a possible credible design basis event for PWR primary piping. Upon completion of this investigation, Westinghouse, on behalf of the Owner's Group, suonitted three reports to the staff on its evaluation of the issue (Refs. 5, 6 and 7). The reports had used Mechanistic Fracture Evaluation to demonstrate that DEGB is not a credible design basis event and concluded that no plant modifications are needed to account for the asymmetric blowdown loads resulting from DEGB.

The staff reviewed the Westinghouse topical reports to evaluate whether the deterministic fracture mechanics analysis is an acceptable alternative to

s .. -

I' (a) postulating a double-ended guillotine break (DEGB), (b) analyzing the structural loads, and (c) installing plant modifications (e.g., adding piping restraints and primary system components supports) to mitigate the consequences, in order to resolve issue A-2. Based on this review, the staff notified all PWR licensees and applicants in a letter dated February 1,1984 that the Westinghouse reports provide an acceptable technical basis for the staff to concur that the asymmetric blowdown loads resulting from double-ended pipe breaks in main coolant loop piping need not be considered as a design bases for the Westinghouse Owner's Group plants * (Ref.8). This

. staff conclusion is subject to the condition that leak detection systems should be sufficient to detect leakage from the postulated circumferential through wall flow in accordance with guidance of Regulatory Guide 1.45.

The staff letter included a Regulatory Analysis of Mechanistic Fracture Evaluation of Reactor Coolant Piping along with a Value-Impact assessment for the alternate method of resolving issue A-2. This assessment formed an important part of the basis of staff evaluation of the unresolved safety issue (USI) A-2 for the Westinghouse Owner's Group plants. The analyses methods developed by Babcock and Wilcox and Combustion Engineering will be evaluated by the staff when their plant analyses are submitted to the NRC.

The object of the Safety Goal Evaluation presented in this report is'as follows:

If the Safety Goals (NUREG-0880, Rev. 1, dated May 1983) were applied in reaching a resolution of the Asymmetric Blowdown Loads issue for Westinghouse Owner's Group plants, how would the decision have compared with the staff conclusion given in February 1, 1984 letter to all operating PWR licensees?

To meet this objective, the available plant-specific and generic data given in the staff Regulatory Analysis of the Basis of Resolution (Mechanistic Fracture Evaluation, Ref. 8) are reviewed. The public risk reduction, occupational dose and cost impacts of using the alternate method (using plant modifications) of resolving the issue A-2 are evaluated. The evaluation results are then compared with the NRC Safety Goals.

^1. D. C. Cook 1 9. R. E. Ginna

2. D. C. Cook 2 10. San Onofre 1

3. H. B. Robinson 2 11. Surry 1

4. Zion 1 12. Surry 2

5. Zion 2 13. Point Beach 1

6. Haddam Neck 14. Point Beach 2

7. Turkey Point 3 15. Yankee

8. Turkey Point 4 16. Fort Calhoun (CE NSSS)

I

. u 3.4.4 Types of Evaluations This section discusses the assessment and evaluation of the proposed alternate resolution of issue A-2 for the 16 Westinghouse Owner's Group plants. The alternate resolution would have required these operating PWRs to add piping restraints and primary system component supports to withstand the asymmetric blowdown loads resulting from postulated DEGB. In the following sections, the negative numbers for radiation exposure indicate a reduction in the estimated exposure if plant modifications were made. Positive numbers indicate an increase in estimated radiation exposure due to plant modifications. Similarly, negative cost figures indicate estimated savings if plant modifications are not made. Positive cost figures indicate est,imated increased cost due to potential loss of property because of increased risk from not modifying the plant.

3.4.4.1 Core Melt Frequency Estimates An important aspect of the Safety Goals Evaluation Plan is the plant performance design objective. This objective involves the change in core melt frequency that results from the requirement.

A nominal estimate for the total increase in core melt frequency for the proposed action was determined by summing the contributions from breaks inside the reactor cavity and 20% of the out-of-cavity

• pipe break initiated core melt accidents and then adjusting for the average number of loops.

Nominal core melt increase = [9E-8 + 0.2 x 1E-8] = 1.4E-7/PY Similar calculations were made-to derive an upper estimate of core-melt fre-quency increase. The lower estimate for the core-melt frequency increase was not specifically calculated in the Regulatory Analysis. Based on lower estimate of DEGB probability of 7E-12 over a plant lifetime, the increase in core-melt frequency was considered to be essentially zero.

Total core-melt frequency increase estimates as a result of the proposed action were found to be as follows:

• The Westinghouse owner's group has provided analyses for ex-cavity breaks that indicate disruption of core geometry is unlikely to occur due to these breaks for 13 out of 16 plants. However, to account for this possibility, a 20% systems interaction contribution-is assumed applicable to estimate the risk from dependent failures resulting from outside-of-cavity asymmetric blowdown. Only this fraction would be incurred for this action since DEG breaks were previously considered in the plant design.

s. .s Increase in Core-Melt Frequency Item (Events /py)

Nominal Estimate 1.4E-7 Upper Estimate 2.0E-6 Lower Estimate 0 The estimated changes in core-melt probability due to not requiring plant modifications is compared to the Safety Goals. The Safety Goals design objective states that the likelihood of a nuclear reactor accident that results in a large-scale core melt should normally be less than one in 10,000 per year of reactor operation. Based on a comparison of the Safety Goals with the total core-melt frequency increase estimates due to the proposed action, it may be concluded that the estimated core-melt frequency increase would have met the plant performance design objective stated in the Safety Goals.

3.4.4.2 Risk Evaluations The types of evaluations for comparison to the Safety Goals include (i) risks to individual members of the public, (ii) risks to the general public (societal), and (iii) occupational radiologic exposures of plant workers.

The comparative risk parameters are more explicitly defined in NUREG-0880, Revision 1 (Ref. 1).

The individual risk estimates involve risk to an average individual in the vicinity (within a one mile radius) of the nuclear power plant boundary, whereas the general (societal) risk is within a 50 mile radius of the site boundary. These risk estimates are defined in terms of man-rem doses, prompt fatalities, and delayed cancer fatalities, and are compared to the primary quantitative design objectives in the Safety Goals.

The occupational radiological exposure to plant workers resulting from imple-mentation of a requirement is not specifically addressed in the Safety Goal design objectives. However, the Plan to Evaluate the Safety Goal, i

(Appendix VII, NUREG-0880) requires that the changes in occupational radiological exposure resulting from implementation of the requirement (s) l- also be considered.

3.4.4.2.1 Individual Risk Estimates In order to determine the probability of prompt fatalities for a one-mile wide annular area, conversion factors (fatality prob /RC) for each release category were used (Ref. 16). The conversion factors were based upon a typical midwest site meteorology (Byron - Braidwood), no evacuation, and a

. _ . _ __ _ _ _ _ l

a population density of 340 people / square mile. We used two release categories (RC) that relate to the sequences in which asymmetric blowdown loads are involved. These release categories were chosen based upon the data included in the leak before break value-impact analysis included in the staff's February 1,1984 letter to PWR licensees (Ref. 8). The two release categories are PWR-3 (.01) and PWR-7 (.99), with the conditional probability of failure (PCF) leading to each release category identified in parenthesis.

Consistent with the core melt frequency estimate (Section 3.4.4.1), these release categories are applicable for both breaks inside the reactor cavity and out-of-cavity pipe break initiated core melt accidents. The probability of-prompt fatalities for each release category are determined below for the nominal core melt increase case. Uncertainty in this estimate is discussed in Section 3.4.4.1.

ACM/ EVENT = 1.4E-7/PY (Nominal Core Melt Increase)

P (release category) = (ACM/ EVENT) x (PCF) x (fatality prob /RC)

P (PWR-3) = 1.4E-7 x .01 x 4.73 E-2 = 6.6E-11 P (PWR-7) = 1.4E-7 x .99 x 0.0 = 0.0 Total = 6.6E-11 The estimate for the probability of prompt fatality of 6.6E-11 per reactor year is compared to the safety goal for individual mortality risks which is SE-7 per reactor year. Based upon this comparison it may be concluded that the estimated prompt fatalities would be significantly lower than those included in the Safety Goals and thus would have met the objective stated in the Safety Goals.

3.4.4.2.2 Societal Risk Estimates The societal risk to the public is based upon the probability of latent cancer fatalities. This calculation is similar to the calculation in section 3.4.4.2.1 except that latent cancer fatality probabilities for each release category are used (Ref. 16). Again the nominal core melt increase case is shown. Uncertainty in this estimate is discussed in Section 3.4.4.1. I P (PWR-3) = 1.4E-7 x .01 x 7.9E-5 = 1.11E-13 P (PWR-7) = 1.4E-7 x .99 x 7.5E-9 = 1E-15 Total = 1.12E-13 l

l 1

The estimate for the probability of latent cancers of 1.12E-13 per reactor year is compared to the safety goal for societal mortality risks which is 2E-6 per reactor year. Based upon this comparison it may be concluded that the estimated. latent fatalities would be significantly lower than those included in the Safety Goals and thus would have met the objective stated in the Safety Goals.

3.4.4.2.3 Occupational Radiological Exposure In' the Regulatory Analysis of the USI-2 resolution, the staff concluded that

-Operational Occupational radiological exposure due to installation and main-tenance of plant modifications will be avoided by the proposed exemption of the . requirement to modify plants. The occupational exposure would have resulted during the implementation of plant modifications and future plant maintenance and operation. In estimating the avoided dose, no modifications to the core or core barrel were assumed. The estimated avoided occupational dose are shown below.

Item Dose Avoided (man-rem)

Nominal Estimate 1.1E+4 (Implementation 9700 + Maintenance 840) .

Upper Estimate 3.2E+4 Lower Estimate 3.5E+3 As indicated in the staff Regulatory Analysis, the dose avoided for this action is primarily occupational dose during equipment installation. The increased occupational exposure from accidents is comparatively small viz.,

nominal estimate of 0.8 man rem (Increase in core melt frequency 1E-7 events /ry x occupational dose 2.1E+4 man rem / event x reactor years 16 x 23.6).

It is interesting to note here that the increased radiological exposure risk to public due to a postulated LOCA, as derived by the Regulatory Analysis, is relatively small when compared with the avoided occupational radiological exposure to plant workers during plant modifications. If plant modifications were required, the nominal public risk exposure would have been reduced by an estimated 3.4 man-rem (see Section 4.5) while it would have caused a nominal

-increase of 1.1E+4 man-rem in the occupational radiological exposure.

3.4.4.3 Defense-in-Depth The philosophy of safety design used by nuclear power plant designers is called " defense-in-depth." It consists of providing multiple, redundant barriers against the release of radioactivity and includes redundant systems s .

to prevent or mitigate the consequences of an accident. For example, there are three barriers preventing the release of radioactive fission products from the fuel rods: (1) the cladding, (2) the reactor coolant pressure boundary which is the combination of reactor vessel, pipes, etc. , containing the primary coolant, and (3) the containment. Accompanying this defense-in-depth philosophy is an approach to safety design that may be unique in industrial applications. After a nuclear plant is designed to operate properly, its designers assume the failure of various safety-related equipment. Then, they design additional systems to keep the plant safe despite such failures. Then, some of these additional systems themselves are assumed to fail. More backup systems are provided which still keep the plant safe. The result is layers of redundant safeguards, or a " defense-in-depth" design.

The Safety Goals recognize this " defense-in-depth" design philosophy and the importance of mitigating the consequences of a core melt accident. Thus, the features such as containment, siting in less populated areas, and emergency planning are considered to be significant contributors to overall safety of the plant.

For the 16 Westinghouse plants, which are the subject of this study, the staff has not investigated qualitative and/or quantitative benefits to be derived from existing " defense-in-depth" design features of the plants.

However, it is recognized that if these features were considered in formulating the requirements for the resolution of the USI A-2, it would have resulted in overall reduction of the estimate of adverse consequences of DEGB, and lower probabilities of risk for the individual and societal fatalities and core melt.

3.4.4.4 Costs l

In evaluating the Safety Goals, cost estimates related to the proposed action are generally needed to check if the benefit cost of $1000 per averted man rem proposed in the Safety Goals is achieved. In accordance with the proposed Safety Goals, the need for a cost estimate is predicated only on situations where one of the quantified safety goals is not met. In cases where it is observed that all the design objectives have been met, no benefit-cost analysis is considered necessary.

Based on the comparisons made in Sections 3.4.4.1 and 3.4.4.2, it may be judged that in the oresent case, all the design objectives are met and a ,

benefit-cost analysis is not needed. However, all the cost and benefit data are readily available in the staff Regulatory Analysis; therefore, to get better insight into the proposed Safety Goals objectives, the cost data are summarized here and the benefit-cost comparison is included in Section 3.4.4.5 of this report.

s ...

Typical examples of effects that could result in costs or benefits are tabulated in Appendix 0 to NUREG/CR-0058 (Regulatory Analysis Guidelines),

Ref. 13. In the staff regulatory analysis of the proposed action in USI A-2, all these costs or benefits are not included; however, it is judged that all the major contributors to costs and benefits are included.

The staff Regulatory Analysis included the estimated off-site costs in its final benefit-cost analysis. However, in accordance with the Evaluation Ground Rules, these off-site costs are not to be included in ths estimates given in this section (Ref. 3). Therefore, the benefit-cost summary presented in the following section does not consider the off-site cost data.

3.4.4.4.1 Risk to Onsite Property In the Regulatory Analysis, the staff estimated the nominal effect of the proposed action on the risk to Onsite property by taking the product of (i) the change in accident frequency (1E-7), (ii) a generic onsite property cost (1.7E+9), (iii) the number of plants (16), and (iv) a discount factor (equal to 5.7 for 10% discount rate and equal to 11 for 5% discount rate).

The generic Onsite property cost was taken from NUREG/CR-2800 (Ref. 14).

Costs included are for interdicting or decontaminating onsite property, replacement power (3E+5 $/ day) and capital cost of damaged plant equipment.

A 50% spread of uncertainty bounds was used to account for the. level of uncertainty. The results of the cost estimates are given below. The cost figures represent the value of estimated damage to onsite property by not modifying the plants to accommodate asymmetric blowdown loads.

Discounted Value of Avoided Onside Property Damage Item Discount Rate 10% $

Nominal Estimate $1.5E+4 $2.9E+4 (1E-7 x 1.7E+9 x 16 x 5.7) (IE-7x1.7E+9x16x11)

Upper Estimate $4.6E+5 $8.8E+5 Lower Estimate 0 0

3.4.4.4.2 Industry Implementation Cost In the Regulatory Analysis, the staff has reported on several levels of cost benefits to the industry that would result from the proposed action. The staff would avoid potential design modifications ranging from major component support upgrades to the addition of major new equipment, e.g. pipe restraints. For calculating the industry implementation cost, the 16 plants were divided into two categories: three plants requiring extensive modifications and thirteen plants requiring some modifications. The staff considered the cost of design and construction of the plant modifications, and cost of replacement power with selective upgrading to leak detection systems. For the three plants requiring extensive modifications, implementation cost = Design and Construction cost ($3.1E+7)

+3 [ Replacement Power Cost (3E+5 $/ day x 40 outage days) - Leak Detection Cost ($2.5E4)]

= $6.7 E7 Out of the remaining thirteen plants requiring some modifications, it was estimated that only four of these plants would need replacement power

(@300K/ day) for 20 days. Thus, the implementation cost for the thirteen plants requiring some modification was estimated to be Design and Construction Cost ($1.4E+7) + Replacement power (4 plants x 3E +5 $/ day x 20 outage days = $2.4E+7) - Leak Detection Cost ($2.8E+5)

= $3.8 E+ 7 The net sum of the nominal implementation costs for all 16 plants was estimated to be -$1.1E+8 ($6.7E+7+$3.8E+7). To generate upper and lower estimates for costs, it was assumed that estimates are within 50% of the nominal estimate, yielding an upper bound estimate of -$1.6E+8 and a lower bound estimate of -$5.3E+7 for the net avoided implementation costs. The negative sign before the cost figures indicates estimated savings from not providing the plant modifications.

3.4.4.4.3 Industry Operation and Maintenance Costs In developing the avoided cost to the industry for operation and maintenance, the staff assumed that additional restraints will result in additional inspections and in restricting access to steam generators, reactor coolant pumps and reactor nozzles. This labor is assumed to total 80 man hours / plant year. At $100K/ man year and 44 man-wk/ man yr, the annual cost is

$4540/ plant. The estimated present value for increased industry costs for 16 plants are as follows.

, ..o Costs (5)

Item Discount Rate 10% g_

Nominal Estimate -$6.5E+5 -$1.0E+6 Upper Estimate -$9.8E+5 -$1.5E+6 Lower Estimate -$3.3E+5 -55.0E+5 3.4.4.4.4~ NRC Implementation Support Costs The staff estimated the avoided NRC implementation support costs to be as follows:

Item Costs ($)

Nominal Estimate 16 plants (0.25 man yr/ plant @ $100,000/ man yr) -$4.0E+5 Upper Estimate -$6.0E+5 Lower Estimate -$2.0E+5 3.4.4.5 Benefit / Cost (Value/ Impact)

As stated in the previous _section, although a benefit / cost analysis is not needed in this case to evaluate tne Safety Goals because all the design objectives are met, it is provided here to gain some insight into the proposed Safety Goals objectives.

.The benefit (value) is based on the averted societal risk within a 50 mile radius of the various site boundaries. The averted risk is estimated in terms of averted man-rem resulting from the risk reduction attributed to the i proposed action. The averted public risk estimate accounts for the reduction j in public risk over the entire remaining lifetime of the 16 nuclear power plants (average of 23 6 years). The averted man-rem is the product of the ,

-number of plants, the averted public risk reduction per plant year, and the number of years of remaining plant lifetimes. Therefore, the averted risk l

. reduction represents a constant value and not a discounted value. )

3.4.4.5.1 Benefits Estimates Dose estimates for the 16 plants were derived for the release categories using the CRAC code. Quantities of radioactive isotopes and guidelines used in WASH-1400 were assumed in this analysis. Additional assumptions included l

p .

-s .,

meteorology at a typical midwestern site (Byron-Braidwood), a uniform population density of 340 people per square-mile and no evacuation of population. The release model was based on a 50 mile-radius. The staff analysis accounted for both ex-cavity and in-cavity DEGB induced LOCA.

Results for the 16 plants were obtained using an average of 3.1 loops ,

configuration per plant. The average remaining. life of these plants was '

taken as 23.6 years.

Three sources of data were used to provide nominal, upper and lower bound DEGB frequency estimates for large primary system piping. The upper estimate used a value of 1E-5 failures per reactor year for DEG' break probability (Ref. 9). For the nominal estimate, DEG break frequency of 4E-7 per year for the primary System (outside-of-cavity DEG large LOCAs) and 9E-8 per year in the reactor cavity were used (Ref. 10). Lower estimate derivations used a break probability of 7E-12 over a plant lifetime (Ref. 11). This value is essentially zero for risk calculation purposes.

The nominal value of:the dose risk contribution from DEG breaks in the reactor cavity was estimated as follows:

' Nominal estimated frequency of in-cavity asymmetric blowdown automatically causing core melt = 9E-8/ reactor year Core melt frequency per event = 1.0 WASH 1400~ containment rupture frequency (dominant) due to reactor vessel steam explosion R-a (PWR-3) based on WASH 1400 reactor vessel rupture frequency of IE-7 per vessel per year = 1E-9 Release (from CRAC code) corresponding to R a (PWR-3) per containment rupture = 5.4E+6 man rem Reactor years = Number of Plants x, Average remaining life =

16 x 23.6

~

Adjustment factor to account for the fact that the average number of loops in the 16 plants is different than 2 = 3.1/2 Using tihe above values, the calculations yield:

Core Melt x Containment Rupture x Release Dose = Events RY x

Events Core Melt Cont. Rupture x R.Y.x3.1/2 Dose 3' D se

= 9E-8 (1.0) hxf93 1E x 5.4E+6x(16x23.6) x 2

=3.4 man rem

e. ..

The nominal risk contribution from outside-of-cavity DEG large LOCAs was estimated to be negligible.

Similar computations were made in the Regulatory Analysis to derive upper estimate of risk.

The total estimated dose risk increase to public resulting from no plant modification for the 16 sites was found to be as follows:

Total Added Risk to Public Item (man-rem)

Nominal Estimate 3.4 Upper Estimate 37 Lower Estimate 0 3.4.4.5.2 Cost Estimates The nominal cost figures are as follows:

Onsite Property ($1.5 E+4 and 2.9E+4) + Industry Implementation

($1.1E+8) + Industry operation and Maintenance ($6.5E+5 and 1.0E+6) + NRC Implementation cost ($4.0E+5) = $1.1E+8 The two numbers for cost figures shown above for onsite property and Industry operation and maintenance correspond to 10% and 5% discount rates,

_respectively. The industry implementation costs dominate the other cost estimates.

3.4.4.5.3 Value/ Impact Assessments The summary results for the value-impact assessment are shown below.

Value (man-rem) Impact ($)

Nominal Upper Lower Est. Est. Est. Nominal Est. Upper Est. Lower Est.

-3.4 -37 0 -1.1E+8 -1.6E+8 -5.3E+7 l

Note that since the industry implementation costs ($1.1E+8) dominate the  !

total cost ($1.1E+8) these figures are not affected by the assumed discount i rate used in the analysis. )

- 100 -

. l

1 e, .. i For comparing the benefit / cost figure of the proposed action with the Safety Goal guidelines, the value/ impact relationship is expressed in terms of public man-rem averted per $1,000 costs. This ratio is then compared to the reciprocal of the Safety Goal guideline of $1000/ man-rem averted, namely, one man-rem averted /$1000 costs. The comparison is shown below.

Basis of Evaluation Man-rem averted /$1000 costs Nominal Upper Lower Item Estimate Estimate Estimate Value Impact Assessment 3.0E-5 2.3E-4 0 Safety Goal Guideline 1 1 1 Based on the above comparison, it may be concluded that if the Safety Goals were used ,in the Staff Regulatory Analysis, the proposed Safety Goals guidelines with respect to man-rem averted per $1000 cost would have been met and the action no plant modifications would have been recommended.

3.4.4.6 Uncertainty This section identifies the major sources of uncertainty in the value/ impact analyses.

3.4.4.6.1 Impact (Cost)

The nominal economic costs identified in the staff regulatory analysis are offsite property damage ($2.4E+4 and 3.8E+4), onsite property damage ($1.5E+4 and 2.9E+4), industry design modification costs ($1.1E+8), industry operation and maintenance costs ($6.5E+5 and 1.0E+6) and NRC staff implementation support costs ($4.0E+5). The two numbers for offsite and cosite property damage and industry operation and maintenance correspond to 10% and 5%

discount rates, respectively. The main source of uncertainty in cost estimation is to ensure that realistic figures are used for the various elements of these costs.

3.4.4.6.2 Value (Benefit)

Many uncertainties are associated with the predictions of severe-accident progression, containment response, and source terms.

- 101 -

e. o The staff has used three sources of data to develop estimates of DEGB probabilities. The upper estimate is based on a study of nuclear and non-nuclear pipe reliability data presented by Bush, 1977 (Ref. 9). The staff used a value of IE-5 DEGB failures per reactor year in the analysis as an upper estimate. The data presented by Bush indicates that this value may be 100 times too high for the pipe sizes (30 inches diameter) being considered in the proposed action. An intermediate or nominal estimate (4E-7/py for the primary system and 9E-8/py DEGB in the reactor cavity) is based on a study by SAI (Ref. 10). The approach and data used in this study are not plant specific. The lower estimate of a LOCA (7E-12/py) was developed by Lawrence Livermore Laboratories (LLL). In this LLL study, indirect effects such as external mechanical damage were not included (Ref. 11).

The nominal cost estimates are based on field data from utility plant modifications of 2 to 3 plants. In deriving the upper and lower bound cost estimates, the regulatory analysis used the assumption that these estimates are within 50% of the nominal estimate. The staff considered that this range provides a reasonable bound on the potential cost estimate variations.

No data sensitivity study exists. Thus, the quantitative uncertainty estimates associated with the predictions of DEGB and severe accident progression are not available. It should be noted that both the upper and nominal estimate DEGB frequencies used in the analysis are less than the WASH-1400 large LOCA median frequency of IE-4/ reactor year. The following table identifies several factors associated with issue A-2 compared to the data base used for WASH-1400 that support use of a lower pipe break frequency:

Factor Westinghouse A-2 Plants WASH-1400 Large LOCA Pipe size >30" diameter >6" diameter Pipe material Austenitic stainless steel Carbon steel and System and Class Only Class I primary system Miscellaneous primary of pipe pipe with nuclear grade QA and secondary system and ISI piping of various classifications Type of failure Double-ended guillotine (DEG) Circumferential and break only longitudinal breaks, large cracks Failure location Selected primary system Random system break break locations locations Leak detection LDS capability to detect leak No requirement or system (LDS) in a timely manner to maintain provision for leak large margin against unstable detection crack extension

- 102 -

e, ..

Uncertainties also exist in the modeling of containment response. The staff regulatory analysis conservatively assumes that asymmetric blowdown from a DEGB large LOCA automatically causes core melt when the DEGB occurs within the reactor cavity. Accident sequences analogous to those for reactor vessel rupture in WASH-1400 are also assumed. Again, quantitative estimates of uncertainties for LOCA within or outside of reactor cavity are not available.

. Uncertainties in offsite-consequence predictions have not yet been assessed comprehensively. The staff has used CRAC code in its regulatory analysis assuming the quantities of radioactive isotopes and guidelines used in WASH-1400. A uniform population density of 340 people per square-mile and no evacuation of population are assumed. The meteorology used in the analysis is that for a typical midwestern site. These assumptions are only approximate representations of the 16 plant sites considered in this study.

A range of uncertainty in the consequence analysis results is not available.

Other uncertainties which are generic to many of the similar studies are discussed in detail in section 4 and Appendix B of NUREG-1050 Draft. Report, dated February 1984 (Ref. 15).

3.4.5 Conclusions Based on a comparison of the results given in the staff Regulatory Analysis of the Asymmetric Blowdown Loads on PWR Primary Systems with the guidelines given in the Safety Goals (NUREG-0880, Revision 1), the following findings are made.

1. A comparison of Primary Design Objective in the Safety Goals guidelines (related to prompt and latent fatalities) with the Regulatory Analysis demonstrates that both prompt and latent fatalities would be significantly lower than the objectives stated in the Safety Goals.

2. The sub-ordinate Design Objective of the Safety Goals ($1000/ man-rem averted) would have been met for the action recommended for the resolution of the issue USI A-2, as seen from the following comparison of the nominal Benefit / Cost estimate.

Table 3.4.1 - Sub-ordinate Design Objective Item Benefit / Cost Safety Goal 1 man-rem averted /$1000 Requirement 3E-5 man-rem averted /$1000 i

I

- 103 -

c..  :.o 4

s

3. A comparison of Plant Performance Design Objective given in Safety Goals

! guidelines (related to core-melt frequency) with that derived in the Regulatory Analysis indicates that estimated increase in nominal core-melt frequency as a. result of not providing the plant modifications is substantially less than that given in Safety Goals guidelines. The comparison is shown below:

-Table 3.4.2 - Plant Performance Design Objectives Item Core Melt Frequency Defense-in-depth Safety Goal 10 */ry * -

Requirement 10 7/ry- **

• No quantitative design objective is given in the Safety Goals.

• • Regulatory Analysis did not account for " Defense-in-depth" design philosophy. i

4. As indicated in Section 3.4.4.6 of this report, it needs to be emphasized that the staff Regulatory Analysis has not systematically studied the effect of uncertainties and unquantified factors on the results of this study. Also no sensitivity studies were made. Since the risk and cost estimate results are subject to uncertainties, the conclusions of the Safety Goal Evaluation summarized above need to be viewed in this light.

3.4.6 References

1. NUREG-0880, Revision 1, " Safety Goals for Nuclear Power Plant -

Operation," U.S. Nuclear Regulatory Commission, May 1983. "

2. Memorandum, T. Speis to NRC Division Directors, "NRR Safety. Goal Evaluation Work Plan," December 2, 1983.

3. R. Riggs, " Safety Goal Evaluation Plan - Evaluation Ground Rules,"

Interim Report, March 1984, U.S. Nuclear Regulatory Commission.

4. NUREG-0609, " Asymmetric Blowdown Loads on PWR Primary Systems -

Resolution of Generic Task Action Plan A-2," U.S. Nuclear Regulatory-Commission, January 1981.

5. WCAP 9558, Revision 2 (May 1981) " Mechanistic Fracture Evaluation of Reactor Coolant Pipe Containing a Postulated Circumferential Throughwall Crack."

i t

- 104 - L

- . . ~ . - - , - , - - ~ , - - - .

o. ...

6. WCAP 9787 (May 1981) " Tensile and Toughness Properties of Primary Piping Weld Metal for Use in Mechanistic Fracture Evaluation."

7. Letter Report NS-EPR-2519, E. P. Rahe to D. G. Eisenhut (November 10, 1981) Westinghouse Response to Questions and Comments Raised by Members of ACRS Subcommittee on Metal Components During the Westinghouse Presentation on September 25, 1981.

8. Letter from D. G. Eisenhut, NRC, to All Operating PWR Licenses, Construction Permit Holders and Applicants for Construction Permits,

Subject:

Safety Evaluation of Westinghouse Topical Reports Dealing with Elimination of Postulated Pipe Breaks in PWR Primary Main Loops (Generic Letter 84-04), dated February 1, 1984.

9. Bush, S. H. 1977. " Reliability of Piping in Light Water Reactors,"

IAEA-SM-218/11. International Symposium on Application of Reliability Technolcgy to Nuclear Power Plants. International Atomic Energy Agency, Vienna, Austria.

10. Harris, D.0. and Fullwood, R.R. 1976, "An Analysis of the Relative Probability of Pipe Rupture at Various Locations'in the Primary Cooling Loop of a Pressurized Water Reactor including the Effects of Periodic Inspection, "SAI-001-PA, Science Applications Inc. , Palo Alto, California.

11. Stevenson, J.D. 1980, " Cost and Safety Margin Assessment of the Effects of Design for Combination of Large LOCA and SSE Loads," UCRL-15340, Lawrence Livermore Laboratory, Livermore, California.

12. NUREG/CR-3568, "A Handbook for Value-Impact Assessment," Pacific Northwest Laboratory, December 1983.

13. NUREG/BR-0058, " Regulatory Analysis Guidelines of the U. S. Nuclear Regulatory Commission," U. S. Nuclear Regulatory Commission, January 1983.

14. NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," Pacific Northwest Laboratory, Richland, Washington, 1983.

15. NUREG-1050, "Probabilistic Risk Assessment (PRA): Status Report and Guidance for Regulatory Application," Draft Report for Comment, U. S.

Nuclear Regulatory Commission, February 1984.

16. Memorandum'from F. Rowsome dated September 18, 1984,

Subject:

Safety Goal Evaluation Plan - Subtask B Trial Evaluations.

- 105 -

3.5 DETERMINATION OF SAFETY / RELIEF VALVE (SRV) POOL DYNAMIC LOADS AND TEMPERATURE LIMITS FOR BWR CONTAINMENT (USI A-39) by: S. Bian (PNL) 3.

5.1 BACKGROUND

All boiling-water reactor (BWR) plants are equipped with a number of safety / relief valves w.;Vs) to control large primary system pressure transients. There are two major areas of concern related to actuation of these valves. One is the hydrodynamic loads created during the initial transient of SRV line clearing. When a SRV is actuated, the steam released from the primary system is discharged into the suppression pool and condensed. The air column within the partially submerged discharge line is compressed by the high pressure steam and, in turn, accelerates the water leg into the suppression pool. The water jets and compressed air create pressure and velocity transients which are manifested as drag or jet impingement loads on submerged structures. Experimental and operational evidence indicate that these loads are significant and should be included in the design of containment structures, piping and equipment.

The suppression pool temperature limit is another concern. Following the air-clearing phase, high quality steam is injected into the pool.

Experiments indicate that, for sufficiently high steam fluxes, the steam-jet / water interface which exists at the discharge line exit is relatively stationary so long as the local pool temperature is low. Thus, the condensation proceeds in a stable manner and no significant loads are experienced. However, continued steam blowdown into the pool will increase the local pool temperature. The condensation rates at the turbulent steam / water interface are eventually reduced to levels below that needed to readily condense the discharged steam. At this " threshold" level the condensation process becomes unstable, possibly leading to severe vibrations in the pool. To preclude unstable condensation, limits are required for the allowable suppression pool temperature.

This unresolved safety issue was initiated as the result of plant operational experience and tests on Mark III containments. During the large-scale testing of the Mark III containment system design in the period 1972 through 1974, new suppression pool hydrodynamic loads were identified for postulated LOCAs. GE tested the Mark III containment concept in its Pressure Suppression Test Facility (PSTF). It was from the PSTF testing that the short-term dynamic effects of drywell air being forced into the pool in the initial stage of the postulated LOCA were first identified. In addition to the information obtained from the PSTF data, other LOCA-related dynamic load information was obtained from foreign testing programs for similar pressure-suppression containments. It was from these foreign tests that oscillatory condensation loads during the later stages of a postulated LOCA were identified (Ref. 5).

- 106 -

• . a Also, experience at operating plants indicated that severe vibration in the primary containment could occur if the pool reached a " threshold" temperature. In April 1972, an incident related to relief valve operation occurred at the Wurgassen Power Plant (KKW) in Germany. KKW is a BWR plart with eight relief valves. During the startup test relief valves were actuated with the reactor at about 60 percent of power with one of the relief valves failing to close. During the subsequent power reduction and depressurization, the suppression pool was gradually heated by the steam released through the relief valve. When the pool temperature exceeded 160'F, condensation became unstable and the containment structure vibrated severely causing some damage to the pool metal liner.

A relief valve test at a Switzerland plant in July 1972 indicated that pool vibration may be expected when steam condensation occurs with a. pool temperature in excess of 140'F and high SRV discharge rate.

The BWR applicants / licensees, GE, and Kraftwork Union (KWU) in Germany initiated various programs to deal with these issues, and the staff established USI-A-39 to review and evaluate the technical activities from these programs. -

Plants Affected are BWRs with Mark II and Mark III Containments. Mark I Containment is addressed in a separate safety issue (A-7).

3.5.2 SAFETY SIGNIFICANCE As indicated above, SRV actuations generate substantial dynamic loads on piping, equipment and containment structures. Because of the significance of these loads, the quencher devices have been developed to mitigate them. The piping, equipment and structure are then designed on the basis of these reduced loads. The integrity of piping, equipment, structure, including primary systems and ECCS, depends on the adequacy of these design loads.

Therefore, this requirement should be consistent with other changes that assume.the integrity of the containment. The proposed requirements are within existing regulations GDC 16, " Containment Design" and GDC 50

" Containment Design Basis". Failure of the suppression pool or associated piping would constitute a major breach of containment, with likely loss of pool water supplies used for emergency cooling. Such a failure would thus represent a significant precursor to accident sequences leading to core damage.

3.5.3 REQUIREMENT Reference 6, NUREG-0802 (Safety / Relief Valve Quencher Loads: Evaluation for BWR Mark II and III Containments) provides the results of the evaluation performed by the NRC staff and its consultants on the methodologies for determining SRV quencher load specifications. These methodologies include

- 107 -

3. . ..

the T quencher loads proposed by the Mark II Owners Group and the cross quencher-loads proposed by the General Electric Company to be used-generically for all Mark III plants. As a result of.the evaluation, the staff has established the acceptance criteria for quencher loads as stated in NUREG-0802 and recommends its application for all BWR Mark II and III plants

.with the exception of the WPPSS II plant. WPPSS II is a Mark II plant but utilizes the. Mark III/GE cross quencher. Therefore, a plant unique method was necessary.

It should b'e noted that the staff has already issued SRV load acceptance criteria for both Mark II (NUREG-0487, Supplement No. 1, September 1980) and

-Mark III (SER for GESSAR, July 1976). However, the staff, the Mark II Owners Group and GE recognized that these criteria were very conservative because they were established at the early. stage of quenchor development. Since then, extensive quencher test programs were performed resulting in a.

sufficient data base to justify re-evaluating the SRV load criteria. In response to the request by the Mark II Owners Group and GE, the staff re-evaluated the SRV loads and established the new acceptance criteria recommended in NUREG-0802 on the basis of the relevant data base.

3.5.4 RISK EVALUATION This section evaluates the potential reduction in core melt frequencies and in public and occupational radiation exposure due to implemeatation of the above requirements for USI A-39. Information available from NRC analysis will be utilized in the development of these values.

3.5.4.1 CORE-MELT FREQUENCY ESTIMATE The estimate of the impact of this issue resolution on core-melt frequency and public risk is based on a review of the NRC analysis (Appendix A).

Relief Valve Discharge Frequency (PURDD)

A NRC review on USI A-39 (see Appendix A) provides a value of 5/py for relief valve discharge frequency.

Relief Valve Sticking Open Frequency (PURDSOD)

As per Issue USI A-39, the frequency for relief valve sticking open is put at 0.1/ event.

Base-Case Quencher Tie-Down Failure Frequency (PUQfGED)

The value for the base-case quencher tie-down failure frequency is based on the GE criteria. It is given as 1E-2/ challenge.

- 108 -

E

i. .

f Adjusted-Case Quencher Tie-Down Failure Frequency (PUQfNRCD)

The value for the adjusted-case quencher tie-down failure frequency is based on the NRC criteria. It is given as 1E-3/ challenge.

Frequency of Loss of All Core Cooling Except RCIC (PULCCERD)

As derived in Appendix A, the frequency of loss of all core cooling except RCIC is 0.3/ event.

Frequency of Core-Melt due to Inability to Sustain Cooling Through RCIC (PUCMCRD)

The core-melt frequency due to inability to sustain cooling through RCIC is 0.5/ event.

Reduction in Core-Melt Frequency (AF):

The reduction in core-melt frequency is the difference of the above two values:

AF = (7.5E 7.5E-5)/py = 6.75E-4/py 3.5.4.2 RISK EVALUATIONS The individual and societal risks are presented below. The NRC analysis of this issue assumed a BWR Category 3 type release. However, this release category takes credit for fission product retention in the suppression pool.

This issue however deals with containment failure via rupture of the suppression pool. As a result, it is proposed that a BWR-2 release category is more conservative for analysis of the risks associated with this issue.

this assumption will be used in the following estimates.

3.5.4.2.1 Individual Risk Estimates The early fatality probability for individuals within one mile of the plant are given here. The probability of early fatality associated with BWR-2 releases is put at:

l (6.76E+01 fatalities / event)/(2136 people) = 3.16E-02/ event.

l L The man-rem exposure for individuals within one mile of the plant associated with BWR-2 releases is 7.75E+04 man-rem / event.

The containment failure probability is then assumed to be:

(CF/BWR-2) = 1.0

- 109 -

The reduction in the estimate of the early fatality probability due to a reduction in the core-melt frequency is then:

P(EF/BWR-2) = (6.75E-04 events /py)(1.0)(3.16E-02 fatalities / event)

= 2.13E-05 individual early fatalities /py.

The reduction in man-rem exposure due to a reduction in the core-melt frequency is then:

P(E/BWR-2) = (6.75E-04 events /py)(1.0)(7.75E+04 man-rem / event)

= 5.23E+01 man-rem /py.

3.5.4.2.2 Societal Risk Estimates The probability of latent fatality in the general population within 50 miles of the plant is considered here. The probability of latent fatality associated with a BWR-2 type release is put at:

(5.4E+02 total latent fatalities / event)/(2.67E+06 people) = 2.0E-04/ event.

The man-rem exposure for the general public within 50 miles of the plant associated with BWR-2 releases is 7.1E+06 man-rem / event.

'The containment failure probability is then assumed to be:

(CF/BWR-2) = 1.0 The reduction in the estimate of the total latent fatality probability due to a reduction in the core-melt frequency is then:

P(EF/BWR-2) = (6.75E-04 events /py)(1.0)(2.0E-04 fatalities / event)

= 1.35E-07 total latent fatalities /py.

The reduction in man-rem exposure due to a reduction in the core-melt frequency is then:

P(E/BWR-2) = 6.75E-04 events /py)(1.0)(7.1E+06 man-rem / event)

= 4.79E+03 man-rem /py.

3.5.4.2.3 Occupational Radiological Exposure The estimate of occupational radiation exposure due to implementation of this issue is given below.

- 110 -

o. .o Per Plant Occupational Dose Reduction Due to Accident Avoidance Given the estimated reduction in core-melt frequency of 6.75E-04/py and estimated occupational dose of 19,900 man rem / core-melt (Ref. 3) the estimate of reduction in occupational radiation exposure (ORE) due to accident avoidance is then 13.4 man-rem /py, or 403 man-rem per plant over 30 years.

Per Plant Occupational Dose Increase for Implementation This issue impacts new plants which have had the modifications implemented during construction. There are no additional design and equipment changes to operational plants due to the SIR from the FSAR requirement, therefore, the occupational dose increase for SIR implementation is zero.

Per Plant Occupational Dose Increase for Operation and Maintenance No changes in plant maintenance,_ inspection, and operation are foreseen.

Thus, the occupational dose increase for operation and maintenance is zero.

Total Per Plant Occupational Dose Increase The net result is that no increase is predicted for ORE due to Issue USI A-39.

3.5.4.3 DEFENSE IN DEPTH The primary functions of the suppression pool are to allow depressurization of the reactor vessel while maintaining containment, and to provide a heat .

sink and a make-up water supply for emergency cooling systems. This issue deals with SRV lift and blow-down through the quenchers, possibly resulting in load-induced failures of the pool. (Issue 61 in Ref. 7, deals with failure of the SRV downcomer before it reaches the suppression pool). The reactor vessel would then depressurize even in the event of pool failure, but the question of re-flooding the vessel and providing longer term cooling remtins.

The water injection systems involved in vessel re-flooding include the HPCI and RCICS. Both these systems initially draw water from the condensate storage tank, using the suppression pool only when this supply is exhausted.

The condensate storage tank is sufficient for this task, provided the primary system is intact. However in this case a stuck-open SVR is postulated, presenting a SBLOCA. As a result, in this scenario the suppression pool water supply would ultimately be drawn on.

Again, failures of the suppression pool necessary for the loss of ECCS or RCIC would involve loss of all water above the pump inlet points for these systems, or loss of sufficient water to make the suppression pool ineffective as a heat sink. Hydrodynamic loading (i.e. water slugs) would predict failures below the normal water line which could result in draining of the

- 111 -

% .a i

pool. However the vacuum breaker for the SRV downcomers is designed to prevent such slugs (as per Issue 61), as are the quenchers which distribute the steam injected into the pool. It is uncertain if temperature induced vibrations of the pool would preferentially cause failure below the water line.

As will be discussed in Section 3.5.4.5 under uncertainty, the question of suppression pool failure under dynamic loads is one of frequency of failure as well as one of severity. In all likelihood, the re-design of equipment would reduce the severity of pressure surges to the suppression pool, and hence reduce the frequency of pipe ruptures or structural failures.

Load-induced failures that do occur in the suppression pool would most likely be of a less severe nature, more on the order of a gradual leakage and loss of inventory over a period of several days versus a rupture and immediate loss of all water.

The potential for loss of core cooling except RCIC would then most likely be reduced by design, with the values suggested in Section 3.5.4.5 likely being reduced from the originally assumed values of 0.3 to a more reasonable value of 0.1. Likewise, the probability of loosing RCIC could be reduced from the 0.5 value used by Ref. 4 to the suggested 0.1. A lower failure probability of quencher tie-down failure (SE-03 versus the Ref. 4 value of 1E-02) also gives better credit for previous consideration of this issue. This is then reduced to 1E-03 after re-design. The estimate of base-case minus adjusted case and change in core-melt would then be:

(5/py)(0.1)(5E-03)(0.3)(0.5) - (5/py)(0.1)(1E-03)(0.1)(0.1)

= 3.75E-04/py - 5.0E-06/py

= 3.70E-04/py.

Assumptions for better performance of containment systems can then reduce the estimated reduction in core-melt frequency by an order of magnitude.

Finally, defense in depth will also impact the release category assumed for the accident. Reference 4 originally assumed a category 3 release with hold-up of fission products in the suppression pool. Hold-up was ignored in this analysis, due to the assumed failure of the the suppression pool to hold adequate water for the RCIC function. A significant reduction in the severity of the failure in the suppression pool would certainly reduce this to a category 3 release (5.1E+06 man-rem / event). Partial maintenance of the RCIC function would likely further reduce this to a non-core-melt sequence such as BWR category 5 (2.0E+01 man-rem / event). Estimates of the change in public risk would then be (3.75E-04/py)(7.1E+06 man-rem / event) - (5.0E-06/py)

(2.0E+01 man-rem / event) = 2.66E+03 man-rem /py, or 8.0E+04 man-rem per plant over 30 years.

- 112 -

c

F

c. .o 3.5.4.4 BENEFIT / COST (VALUE/ IMPACT)

The benefit / cost ratios are developed here for comparison to the design goals of $1000 per man-rem averted.

3.5.4.4.1 Benefits Estimates The benefits of issue implementation are based on the averted societal risk due to reduced probability of core-melt. The per reactor year reduction in exposure was calculated previously at 4.79E+03 man-rem /py. For an assumed life of 30 years, this is 1.44E+05 man-rem per reactor.

3.5.4.4.2 Cost Estimates The costs associated with issue implementations are estimated here.

Per Plant Costs for Implementation Using NRC estimated costs (Appendix A), modifications to the SRVs at $10,000 are estimated, giving ($10,000/SRV)(15 SRVs/ plant) = $150,000/ plant for SRVs.

In addition, plant redesign for bigger dynamic loads is estimated to require 2 man yrs / plant, or $200,000/ plant.

No additional labor costs are estimated, as the valves and redesigned suppression pool are integrated into the plant during normal construction.

This then gives a total utility cost for implementation of $350,000/ plant.

Per Plant Industry Cost for Operation and Maintenance No additional costs are estimated for operation and maintenance.

Total Plant Industry Costs Total per plant industry costs are then put at $350,000/ plant.

Per Plant Industry Cost Savings Due to Accident Avoidance As per Ref. 3, (NUREG/CR-3568) with the estimated change in core-melt frequency of 6.75E-04/py, this is:

(6.75E-04/py)($1.65E+09/ core-melt) = $1.1E+06/py Over 30 years, this becomes:

($1.1E+06/py)(30 years) = $3.3E+07/ reactor

- 113 -

i j

i

s. ...

NRC Costs NRC Costs for Development and Implementation Reference 4 estimated the staff time for review and implementation of design charges at 0.25 man years, or $25,000. Assuming 2 plants effected, this is

$12,500/ plant.

NRC Costs for Operational Maintenance No additional costs are foreseen for operation and maintenance.

Total Per Plant NRC Costs Total per plant NRC costs are then put at $12,500/ plant.

Total Costs The total costs of relevance to the benefit / cost ratio are then industry plus NRC costs, or ($350,000/ plant + $12,500/ plant), or $362,500/ plant.

3.5.4.4.3 Benefit / Cost (Value/ Impact)

For purposes of comparison with Benefit-Cost guidelin~es, the averted public risk given in Section 3.5.4.2 is assumed to cover the region of a 50 mile radius of the site boundary. Using the industry cost as calculated in 3.5.4.4.2, this ratio is then:

S = Benefit / cost = Averted public risk (man-rem / plant)

Cost to industry

= (1.44E+05 man-rem averted /$362,500)

= 400 man-rem averted /$1000 3.5.4.5 UNCERTAINTY Reference 4 performed a sensitivity analysis of a value/ impact score,

-concluding that several orders of magnitude in change for risk reduction or cost would be required to effect the resulting prioritization of the value/ impact ratio. However, no quantitative discussion of variations in predicted core-melt frequency or cost were made.

The observation was made, however, that there did not appear to be a strong disagreement from the owner's group concerning the conservatism sugge:ited by the NRC staff in calculating safety implications for the issue. The most likely ccnservatism is used in the calculation of change in core-melt

- 114 -

frequency (Appendix A). The values chosen for the failures are highly conservative in some cases. For example, probability of the SRVs sticking open after being challenged was assumed to be 0.1. Review of applicable data indicates this is more likely 0.02 (NUREG-0933, Issue 70, PORV/ Block Valve Reliability (Ref. 7).

The probability of quencher tie-down failure using the GE design was put at 0.01 given the discharge. This is also likely a high estimate of failure probability, being 10 times the assumed pipe break probability of 1E-03. A failure va'ue of SE-03 given surge would still be 5 times the normal pipe break probability. Finally, the probability of loss of all emergency core cooling except RCIC (assumed to be 0.3) and probability of core-melt given this failure (0.5) are also likely very high estimates. The uncertainty involves just what type of failure that would be induced in the suppression pool structure. To cause total loss of emergency cooling, the failure would -

have to be of such severity as to eliminate the pool as a heat sink and source of emergency cooling water. Such failures would then have to occur below the normal water line in a fashion that would drain the pool below normal ECCS sump points. Partial loss of water inventory may provide water to ECCS pumps, but impact the heat sink capability of the pool. It is thus thought here that values for loss of this function on the order of 0.1 rather then 0.3 would still be conservative especially after implementation of the design modification.

The same is true for loss of sufficient ECCS function to prevent core-melting. Only minimal performance of pool for a heat sink would be required.

Steaming through the turbine may also be possible, although turbine isolation would be one of the leading initiators for SRV lift which initiated the accident. The assumed value for core-melt due to insufficient ECCS cooling was put at 0.5. After implementation of the design modification, a value of 0.1 for RCIC failure and core-melt is considered more appropriate.

Using the nomenclature from Appendix A, the greatest predicted charge in core-melt frequency from this data would then assume the best reduction in tie- down failure and ECCS/RCIC failure. This would be:

(5/py)(0.1)(1E-02)(0.3)(0.5) - (5/py)(0.1)(1E-03)(0.1)(0.1)

= 7.50E-04/py - SE-06/py.

The greatest predicted reduction in averted public dose would then further assume that releases associated with events after implementation of design change would be associated with a less severe release category. Using a non-core-melt BWR 5 category, this would become:

(7.50E-04/py)(7.1E+06 man-rem / event) - (SE-06/py)(2.0E+01 man-rem / event)

= (5.32E+03 man-rem /py)(30 yrs)

= 1.6E+05 man-rem / reactor.

- 115 -

Using_the same approach, the smallest core-melt change and public risk change would assume the more likely failure probabilities discussed above for the SRVs (i.e. , 0.02) and pipes, and give credit for better ECCS and RCIC performance before the fix. This would be:

. (5/py)(0.02)(5E 1E-03)(0.1)(0.1)

= (5.0E-06/py) - (1.0E-06/py) = 4.0E-06/py.

Assuming the accidents are associated with BWR release category 3, then gives:

(4.0E-06/py)(5.1E+06 man-rem / event) = 20.4 man-rem /py.

Over 30 years this is then (30)(20.4) = 612 man-rem / reactor. Assuming the costs remain the same, a reasonable estimate of the upper and lower bounds for the benefit / cost radio then range from 440 man-rem /$1000 to 1.7 -

man-rem /$1000, with 400 man-rem /$1000 as the estimate given.

Note however, that the assumed based case core-melt frequency attributed to this issue alone ranged from a high of 7.5E-04/py to 5.0E-06/py, with the predicted adjusted core-melt frequency associated with issue resolution ranging from SE-06/py to 1E-06/py. With 1E-04/py being a plant requirement for all accident sequences considered, it can be seen that the NRC estimates are likely biased on the high side for its base-case estimate of core-melt frequency from this issue alone. However even the less conservative estimates still result in a benefit / cost rates exceeding the 1 man-rem /$1000 Safety Goal QDO.

3.

5.5 CONCLUSION

S The conclusions are summarized here in tabular form.

3.5.5.1 STATEMENT ON PRIMARY DESIGN OBJECTIVE There is considerable uncertainty in the estimate of the base-case and adjusted-case core-melt frequency attributable to this issue. The estimate presented here is considered to be highly conservative, as is the assumption that releases are associated with release category BWR-2. Less conservative but still reasonable assumptions as to the failure of the suppression pool and decay heat removal functions and credit for fission product retention in the pool can reduce the estimates of core-melt frequency and subsequent off-site dose by over a factor of 200.

l l

)

l i

- 116 - l l

-5, .*

From Section 3.5.4, the reduction in societal risk due to issue resolution is estimated at 4.79E+03 man-rem /py for the affected plants over 30 years.

TABLE 3.5.1. Primary Design Objectives Individual Risk per py Societal Risk per py Item man-rem Early Fatalities man-rem Latent Fatalities Safety Goal -

SE-07 -

2E-06 Requirement 5.23E+01 2.13E-05 4.79E+03 1.35E-07 As can be seen, the individual early fatality probability-is 42.6 times the design goal. The societal risk of latent cancer is approximately 7% of the design objective.

3.5.5.2 STATEMENT ON SUB-0RDINATE DESIGN OBJECTIVE The uncertainties expressed above also translated into a similar uncertainty for the benefit / cost ratio. The best estimates used here result in the 400 nan-rem /$1000 value given below in Table 3.5.2. A sensitivity analysis of reasonable core-melt and release category assumptions can lower this to 1.75

. man-rem /$1000.

TABLE 3.5.2. Sub-ordinate Design Objective Item Benefit / cost Safety Goal 1 man-rem averted /$1000 Requirement 400 man-rem averted /$1000 per plant 3.5.5.3 STATEMENT ON PLANT PERFORMANCE DESIGN OBJECTIVES The estimates as presented consider a relatively high potential for suppression pool failure and loss of adequate core cooling given SRV actuation, leading to a base-case core-melt frequency of 7.5E-04/py. The best estimate is that this can be reduced by an order of magnitude with design changes, giving an estimated reduction in core-melt frequency of 6.75E-04/py.

l

' This base-case core-melt frequency for the single SRV issue is very high, particularly in light of the over-all facility goal of 1E-04/py. Again, reasonable but less conservative assumptions as to the failure of the suppression pool and decay heat removal functions can lower the estimate of

- 117 -

o. - .o l -

the base-case core-melt frequency attributable to this issue. Less conservative (i.e. lower) failure probabilities for the suppression pool and decay heat removal function can easily give a base-case minus adjusted case value for core-melt of (7.5E 1E-06)/py = 7.4E-05/py. This is included below to the reflect the ' defense in depth' concept expected to mitigate the loss of function in the suppressien pool.*

TABLE 3.5.3. Plant Performance Design Objectives Item - Core-Melt Frequency Defense-in-Depth a Safety Goal 1E-04/py -

USI A-39 Base-Case Issue Core-Melt 7.5E-04/py' 7.5E-05/py

' Adjusted Case Issue Core-Melt 7.5E-05/py 1.0E-06/py

, Change in Core-Melt 6./SE-04/py 7.4E-05/py In spite of the uncertainties expressed in the calculation of the core-melt frequency and resulting risk, the subordinate design objective still remains at or above the goal of 1 man-rem /$1000 even for less conservative assumptions.

3.

5.6 REFERENCES

1. NUREG/CR-2800, " Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," Andrews, W. B. et al, Pacific Northwest Laboratory, Richland, Washington, 1983.

2. Memo for V. Stello from H. Denton, "CRGR Review of Proposed Requirements in NUREG-0763, NUREG-0783, and NUREG-0802 related to SRV Dynamic Loads (USI A-39)," U.S. Regulatory Commission, Washignton, D.C., July 6, 1982.

3. NUREG/CR-3568 (PNL-4646), "A Handbook for Value Impact Assessment,"

Heaberlin, S. W. , et al, Pacific Northwest Laboratory, Richland, Washington, December 1983.

4. Memo for K. Kniel from W. Mhr.n , 3afety/ Relief Valve - Quencher Loads Evaluation Reports - BWE br( + , and III Containments," U. S. Nuclear Regulatory Commission, tv d u -, 1981.

5. NUREG-0661, " Safety Evaluation Report: Mark I Containment Long-Term Program Resolution of Generic Technical Activity A-7," U.S. Nuclear Regulatory Commission, Washington, D.C., 1980.

l l

'.- .o :

6. NUREG-0802, " Safety / Relief Valve - Quencher Loads Evaluation Reports -

BWR Mark II and III Containments," U.S. Nuclear Regulatory Commission, Washington, D.C., 1982. .

7. NUREG-0933, "A Prioritization of Generic Safety Issues," U.S. Nuclear Regulatory Commission, December 1983.

- 119 -

t

t APPENDIX A To Section 3.5 The Reference 4 analysis of this issue contains a number of assumptions relevant to-this analysis. These are reproduced here.

If quencher tie-down fails, the following could happen:

1. pipe whip or impingement could cause structural failure under pool and loss of pocl

2. could cause tail pipe' failure above pool and in wet well with containment failure

3. could cause pool dynamic loads which would disable RHR and pool cooling, leaving only RCIS for core cooling.

The assumptions'nade to evaluate the accident sequence are as follows:

Probability of relief valve actuation = 5.0/ reactor /yr i

Probability of relief valve sticking open = 0.1/ event L -The probability of quencher tie-down-failure had two values given:

I a) NRC Criteria b) GE Criteria about same as large LOCA assume one order of

= 1E-3/ challenge magnitude greater (WASH-1400) = 1E-2/ challenge Given failure of quencher tie-down, the failure probability of the remaining systems was as follows:

1. Probabil.ity of containment structural failure due to pipe whip or jet impingement with loss of pool = 0.1/ event.

l

2. Probability of tail pipe failure (in wet well) given tie-down failure =

0.5.

3. _ Probability of loss of pool due to overpressure due to discharge to wet well = 0.2.

4. Probability of loss of LRHR and LPSIS due to pool dynamic loads if quencher fails = 0.1/ event.

- 120 -

f A. .a The probability of loss of all core cooling but RCIS (condensate system) given tie-down failure was put at.

=.PUID + PU2D + PU3D = (0.1) + (0.5)(0.2) + 0.1 = 0.3/ event Given only RCIS available for core cooling via steam to atmosphere over the

-full term of cooling would give a probability of core-melt per event of 0.5/ event.

-The probability of a core damage event due to relief valve discharge is then:

(PURDD)(PURDS00)(PUQfGED - PUQfNRCD)(PULCCERD)(PUCMCRD) =

(5.0)(0.1)(1E-02 -.1E-03)(0.3)(0.5) = 6.75E-04/py 9

where PURDD = probability of relief valve discharge PURDSOD = probability of relief valve sticking open

.PUQfGED- = probability of quencher tie-down failure using GE design PUQfNRCD = probability of quencher tie-down failure using NRC design PULCCERD = probability of loss of all core cooling except RCIC PUCMCRD = probability of core-melt due to inability to sustain cooling through RCIC.

Consequences of the event looked like a BWR Category 3 event (WASH-1400) -

.i.e., core-melt event with releases through reactor building.

Costs The following costs were estimated by the NRC:

Cost - future cost to NRC to require changes in GE proposed design criteria -

i 1/4 man yr = $20,000. PNL will use $25,000 for 1/4 man yr.

Cost to licensee = redesign to bigger loads = design time plus licensing review = 2 man yrs = $200,000.

Cost for additional materials for supports $10,000/SRV = 15 x 10,000 =

, $150,000/ plant.

- 121 -

_ _ . , . ,, _. .- u _ -._. .._ . _ -. _ _ _. . _ -

'. s 3.6 STEAM GENERATOR TUBE DEGRADATION AND RUPTURE: SECONDARY WATER CHEMISTRY AND CONDENSER INSERVICE INSPECTION PROGRAMS BY: B. Fecht (PNL) 3.

6.1 BACKGROUND

Since the first commercial PWR plant manufactured by Westinghouse (Yankee, Rowe, Massachusetts) began operations in 1961, the nuclear industry in the United States and abroad has had a series of problems with degradation of the steam generators (SGs)-from such mechanisms as vibration, " fretting" (rubbing of adjacent surfaces), high-cycle fatigue, water hammer, cracking, " wastage" (wall thinning), " denting" (distortion that occurs when a tube support plate made of carbon steel corrodes to the point where it squeezes down the steam

. generator tubing), and erosion corrosion (Ref. 1). Steam generator tube degradation was recognized as a potential generic problem when in 1973 the-Palisades Plant of the Consumers Power Company, which started commercial operation in 1971, plugged approximately 700 tubes in each of its 2 steam generators as a preventive measure due to the discovery of tube degradation.

In 1973, regulatory guidance for addressing steam generator tube degradation was developed, and in 1974, Regulatory Guide 1.83 " Inservice Inspection of PWR Steam Generator Tubes," was issued. This guide was revised in 1975, and in 1976 Regulatory Guide 1.121, " Bases for plugging Degraded Steam Generator Tubes," was also issued.

The development of an NRC program related to generic issues was initiated by the Commission in October 1976 and implementation began in April 1977. This program is cescribed in NUREG-0410, "NRC Program for the Resolution of Generic Issues Related to Nuclear Power Plants." The issue of steam generator tube integrity for Westinghouse (A-3), Combustion Engineering (A-4) and Babcock and Wilcox (A-5) plants is identified in this report. Following the steam generator tube rupture (SGTR) event at Ginna in January 1982, direction was given to develop generic steam generator requirements which would help mitigate or reduce steam generator tube degradations and ruptures.

The staff has proposed a number of recommendations to reduce steam generator degradation. This evaluation deals specifically with the Secondary Water Chemistry Program (SWCP) and the Condenser Inservice Inspection Program (CISIP). These two tasks are combined due to evidence that condenser tube integrity has accounted for, directly or indirectly, approximately 90 percent of the SWC problems which affect tube integrity. The SWCP requirement should be considered the primary requirement because SWC is responsible directly for SG degradation, whereas condenser inspection requirements provide a backup measure to assure condenser integrity and proper maintenance of SWC (NRC 1984). In support of the value-impact analyses completed by the NRC staff, Science Application, Inc. (SAI) has also conducted value-impact analyses (Ref. 2). The SAI analysis was based on single steam generator tube rupture (SGTR) events for a typical Westinghouse design. Independent analyses by the l

- 122 -

8 .,

NRC staff have broadened the scope of SGTRs to include multiple SGTRs, challenges to the reactor trip and decay heat removal functions, LOCAs, SGTR events in combination with loss of secondary system integrity, and ATWS events leading to multiple (>10) SGTRs (Ref. 3). Both the NRC and SAI findings will be incorporated in this value-impact analysis which will

, consider only operating PWRs as affected for this issue. New plants are not being considerad as affected since utilities appear to be considering the Steam Generator Owner's Group (SG0G) SWCP at most new plants. This analysis will identify potential reductions in core-melt frequencies, potential reductions in public and occupational radiation exposures and estimates of NRC and industry costs due to implementation of SWCP and CISIP.

3.6.2 SAFETY SIGNIFICANCE Concerns relative to steam generator tube degradation stem from the fact that the steam generator tubes are a part of the reactor coolant system (RCS) pressure boundary and that failures can result in a loss of primary coolant into the secondary (steam) side of the plant. This introduces two major safety considerations with respect to public risk.

The first is the direct release of radioactive fission products. The primary system contains a certain amount of radioactivity entrained in the coolant even during normal operation. The steam generator tubes constitute a particularly important part of the RCS boundary since their failure allows contaminated primary coolant into the secondary side of the steam generators

~

where its isolation from the environment is not fully ensured. Note that this would represent a containment bypass release mode, with the more likely path being through the condenser with significant holdup and entrainment. A steam line PORV or safety valve lift is required for a more direct release from containment.

Second is the potential for creating a more severe accident through the loss of primary water which is needed to cool the reactor core. An extended loss of coolant would eventually require the actuation of make-up water supplies or emergency core cooling systems to deliver water and prevent core damage.

Potential failures of such emergency systems when demanded could potentially lead to core damage or melting, resulting in significant releases of radioactive material. Accident sequences severe enough to breach containment barriers would then result in off-site releases.

In addition, tube degradation and failure require plant corrective maintenance which can involve tube plugging and repair, or entire steam generator replacement. Because of the entrained activity in the primary coolant, the generator surfaces have significant inventories of radioactive crud which produce high radiation fields around the generator. Any utility maintenance around or on the generator thus results in significant occupational radiation exposures.

- 123 -

e, . .a I~

3.6.3 REQUIREMENTS The following requirements are included in the SWCP (Ref. 3):

o A requirement for a secondary water chemistry program to minimize SG tube degradation shall be specified in license conditions.

o The program shall be defined in specific plant procedures but not specifically-included in the license.

o The program shall address measures to minimize SG corrosion (i.e.,

materials selection, chemistry limits and control measures, corrective actions for out of SPEC conditions).

o Revised SRP 5.4.2.1 provides staff review criteria and incorporates "PWR secondary water chemistry guidelines" of September 1981 prepared by the SG0G.

o Operating plants will be required to commit to the revised water chemistry guidelines. -

The following requirements are included in the CISIP (Ref. 3):

o _ Exceeding secondary water chemistry limits which should result in power reductions twice per quarter due to condenser leakage, requires a license condition that commits to perform condenser ISI.

o The condenser ISI program shall be included in the plant operating procedures.

3.6.4 EVALUATIONS This section evaluates the potential reduction in core-melt frequency, individual and societal risks, and occupational radiation exposure due to implementation of the above requirements for both the SWCP and the CISIP.

Cost estimates for the implementation and maintenance of these program are addressed, and finally, a value/ impact figure is developed based upon the results obtained from the above calculations. Information available from SAI and NRC analyses will be utilized in the development of these values.

3.6.4.1 CORE MELT FREQUENCY ESTIMATES The estimate of changes in core melt frequency due to implementation of this issue is based on a review of the SAI and the NRC analyses of this issue (Ref. 4). In both analyses, the affected plants were divided into three groups: severe, for those plants with significant SWC related tube degradation; clean, for plants with little or no SWC related tube

- 124 -

• .'- .4 _

degra'dation; and medium, for those plants which fall in between. For the purposes of this. examination, the assumptions used by SAI (further developed in Attachment 1) will be used here. For_47 PWRs, it will be assumed that 1/6 or 8 plants are severely impacted by SWC tube degradation; 1/2 or 23. plants will be medium impacted, with the the remaining 1/3 plants being clean.

Therefore only (8+23) or 31 plants will' be assumed to be affected by this-issue resolution.

Base Case SGTR Frequency

' It will be assumed that the initial SGRT frequency is 1E-02/py.

Reduction in-SGTR Frequency ItLis assumed that only 50% of steam generator tube ruptures (SGTR) are the

-result of SWC problems. Implementation of a SWC and CISIP is assumed by SAI to reduce SGTR due to SWC problems by 75% in the worst case plants, and by 50% for the medium plants. The average reduction in SGTR over.all PWRs is

'then

. [- -(8)(0.5)(0.75) + (23)(0.5)(0.5) ] [1E-02/py] = 2.8E-03/py.

8 +-23 The' new' SGTR frequency would then be (1 - 0.28)(1E-02/py) = 7.2E-03/py.

Core-Melt Frequency The best estimate for core-melt frequency selected for this analysis'was developed by the NRC and includes single and multiple SGTR as well as challenges to the reactor trip and decay heat removal functions. This is further developed in Attachment 1. Assuming an initiator frequency of 1E-2/py as given above, an effective probability of core-melt given SGTR is also calculated.

Core-Melt Assumed Core-Melt Release Category Frequency, 1/py Probability Given SGTR ,

PWR-2 9.0E-07 9.0E-05 PWR-4 1.6E-06 1.6E-04 TOTAL 2.5E-06

- 125 -

• . 4 Reduction in Core-Melt Frequency The net reduction in core-melt frequency is then the reduction in assumed

'SGTR challenges times the probability of core-melt given the challenge, or Release Category Reduction in Core-Melt Frequency PWR-2 (0.28)(lE-02/py)(9.0E-05) = 2.52E-07/py PWR-4 (0.28)(1E-02/py)(1.6E-04) = 4.48E-07/py TOTAL 7.0E-07/py 3.6.4.2 RISK EVALUATIONS Fatalities associated with release categories for the reference site are used here to estimate reductions in acute and latent fatalities as a result of the reduced frequency of core-melt.

3.6.4.2.1 Individual Risks The risks to the average individual within on~e mile of the site boundary and beyond a one-half mile exclusion zone are tabulated below. Note that the initial calculations made by SAI and the NRC were by release category and have been presented in that form. The probability of containment failure for each fission product release mode is back-calculated for completeness.

(CF/RC) Probability PWR-2 (9.0E-07/2.5E-06) = 0.36 PWR-4 (1.6E-06/2.5E-06) = 0.64 The following early fatality probabilities for individuals within 1 mile of the exclusion boundary are assumed:

Release Early Fatality Man-Rem Category Probability per Event per Event 2 1.67E-02 3.09E+04 4 1.88E-02 3.78E+04

- 126 -

• . ,A The reduction in early individual fatalities (EF) is then:

P(EF/2) = (2.52E-07/py)(1.67E-02) = 4.21E-09 fatalities /py P(EF/4) = (4.48E-07/py)(1.88E-02) = 8.42E-09 fatalities /py 1.26E-08 fatalities /py The reduction in individual man-rem exposure within the one mile radius (MR) is then:

P(MR/2) = (2.52E-07/py)(3.09E+04) = 7.79E-03 man-rem /py

'P(MR/4) = (4.48E-07/py)(3.78E+04) = 1.69E-02 man-rem /py 2.47E-02 man-rem /py 3.6.4.2.2 Societal Risk Estimates The societal risk to the public within 50 miles of the plant site is based on the probability of latent cancer fatality.

The following societal latent fatality (SLF) probabilities for the public within 50 miles of the exclusion boundary are assumed:

Release Total Latent Fatality Category Probability per Event 2 1.39E-04 4 5.62E-05 The reduction in total societal latent fatalities is then:

P(SLF/2) = (2.52E-07/py)(1.39E-04) = 3.50E-11/py P(SLF/4) = (4.48E-07/py)(5.62E-05) = 2.52E-11/py 6.02E-11/py 3.6.4.2.3 Occupational Radiological Exposure SAI has defined activities which are necessary in implementing the requirements for the SWC and CISI programs. The individual common activities of concern are SG ISI, tube plugging, SGTR repair and SG replacement. SAI describes occupational doses for these activities (Ref. 2):

SG ISI: The total radiation exposure due to SG ISI has been documented between 5 and 20 man-rem /SG (Ref. 5). However, this ISI is associated with the hot-leg side set-up only and this exposure is expected to be double on a cold-leg side set-up. Other estimates include 2E-03 man-rem per tube inspected (Ref. 5) and 4.95 man-rem for equipment set-up and removal.

- 127 -

C.; J Tub'e Plugging: Tube plugging is 95 percent explosive plug oriented. This takes from 20 seconds to 2 minutes (Ref. 5) in a 10-60 rem / hour environment,-

yielding a nominal 1 man-rem per plug value.

SGTR Repair: The dose for SGTR repair has been estimated to' range from 10 to i- 100 man-rems (Ref. 6) for moderate repairs. Experience has shown major leak repairs involving 150 man-rem exposures and SGTR repairs have caused total doses of approximately 350 man-res/ event when QA and testing exposure are included'as part of the event.

SG Replacement: The replacement of a SG has been estimated to have an occupational exposure of between 800 and 2150 man rems. Experience with three utilities has shown that the dose per SG is approximately 700 man-rems (Ref. 6, 7, 8).

Estimates of occupational dose due to implementation of the above requirements and due to maintenance and operation subsequent to implementation are included below.

Per Plant Occupational Risk Reduction Due to Accident Avoidance

• Given the estimated' reduction in core melt frequency of 7.0E-07/py and the estimated occupational dose of 19,900 man-rem / core-melt (Ref. 9), the '

estimated reduction in occupational radiation exposure due to accident avoidance is 1.4E-02 man-rem /py or .39 man-rem per plant over 27.7 years.

Per-Plant Utility Dose Increase for Issue Implementation No additional utility labor is anticipated to implement the new secondary water chemistry and condenser inservice inspection programs. The result is a minimal utility dose increase. Where upgrading is necessary the occupational' dose increase has been included-directly in the operation and maintenance dosage estimates below.

Per-Plant Occupational Dose Increase for Issue Operation and Maintenance

.The incremental increase of occupational exposure for the SWCP is considered by SAI (Ref. 2) to be negligible. The repair and inspection radiation ,

doses.for the CISIP are estimated-at 6 to 30 man-rem annually for medium and severe plants. Given 8 severe plants and 23 medium plants an average of '

[(30)(8) + (6)(23)]/31 = 12 man-rem /py or 332 man-rem / plant will be assumed for CISIP inspection.

Avoided doses due to reduced need for' tube plugging are, however, considered.

significant. This is estimated by SAI (Ref. 2) and given below. Note the steam generator replacement is estimated only once in the life of a severely degraded unit, thus the annual dose figure given is the total estimated dose y

averaged over 27.7 years. For the average plant, the dose contribution for replacement is (0.3)(2100), which gives 700 man-rem. This equates to ,

approximately 25.3 man-rem / unit year.

- 128 - l l

t'

4

.1 Avoided Dose 27.7 Year Avoided Dose Plant Condition (man-rem / unit yr) (man rem)

Severe Plant Plugging and Repairs 225.2 6238 Steam Generator Replacement 75.8 2100 301.0 8338 Medium Plant Plugging and Repairs 44.3 1227 Steam Generator Replacement 0 0 44.3 1727 Average PWR Plugging and Repairs 59.0 1634 Steam Generator Replacement 25.3 700 80 2334 Total Occupational Dose Increase for Ooeration and Maintenance For the average PWR, the implementation of the CISIP would result in 12 man-rem /py due to CISIP, minus the average avoided dose of 84.3 man rem /py with improved SWC, or a dose increase of (12 - 84) = -72.3 man-rem /py (i.e.,

a dose reduction). This is further decreased with the accident avoidance dose of 1.4E-02 man-rem /py.

3.6.4.3 DEFENSE IN DEPTH The release of radioactive materials from the primary system due to tube rupture in the previous analysis followed a loss-of-coolant accident (LOCA) which increased in severity sufficient to cause fuel damage, melting, and eventual containment failure with release to the environment. In this sequence of events, the probability of reaching core damage depends to a great extent on the severity of the LOCA and the response required of make-up water supplies. In general, plants are designed to provide a number of alternatives for dealing with relatively small breaks, however options become limited with increasing severity of the LOCA.

In the analysis above, consideration was given to multiple tube ruptures that can be assumed to represent more serious LOCAs. With implementation of the SWCP and CISIP, it can be assumed that the degradation of tubes in general would be brought under control and the probability of multiple tube ruptures reduced significantly. This in turn should reduce the severity of LOCA sequences initiated by tube rupture, which should be reflected in the core-melt sequences derived. This in turn could place more of the associated

- 129 -

p 5, of L

core-melt sequences into less severe release categories, which represent less severe containment failure modes. Note that no tube-rupture induced LOCAs leading to fuel damage have occurred to date.

Note also that for tube ruptures not leading to more severe accidents, any releases must be via the condenser or off gas treatment systems which provide barriers for hold-up which are typically given no credit in licensing considerations. However, the vast majority of tube ruptures to date have had leaks confined to these pathways. The exceptions have been where relief valves have lifted following tube rupture, resulting in releases directly to the atmosphere.

3.6.4.4 BENEFIT / COST (VALUE/ IMPACT)

The benefit-cost comparisons are presented here.

3.6.4.4.1 Benefits Estimate For purposes of comparison with the Safety Goal Benefit-Cost guidelines, the benefit (value) is based on the averted societal risk within a 50 mile radius of the site boundary. These are presented here, in terms of averted risk over the remaining lifetime of the power plant (assumed to be 27.7 years for PWRs).

From Section 3.6.4.2, the net reduction in core-melt frequency and associated man-rem per event is given by release category:

Release Reduction in Man-Rem Man-Rem Category Core-Melt Frequency per Event per py PWR-2 2.52E-07/py 4.8E+06 1.21 PWR-4 4.48E-07/py 2.7E+06 1.21 Total 2.42 Over a lifetime of 27.7 years, this is then an averted risk of 6.7E+01 man-rem / plant, or 2.1E+03 man-rem for 31 PWR plants.

3.6.4.4.2 Cost Estimates The economic benefits of the SWCP requirements are the avoidance of tube plugging, forced outages due to leaks, tube ruptures, SG replacement and derating. The general approach is to determine implementation costs and cost benefits in maintenance and operation programs due to the implementation.

(

- 130 -

. 4 INDUSTRY COSTS Per-Plant Industry Costs for Implementation For equipment (sensors, continuous recorders and analytical data machines),

it is estimated that utilities following the manufacturer's SWCP will need to spend approximately $1.0 million/ unit to upgrade to the SG0G SWCP. The upgraded equipment is expected to be needed in approximately 2/3 of the operating PWRs (Ref. 2). It.is estimated that an additional 50 percent of this will be required for labor costs, giving the total cost for upgrade of approximately $1.5 million.

These values do not assume any condenser upgrade or repair, a concern expressed by Westinghouse. The staff acknowledged this,.but pointed out that such plants would benefit the most from such required action in terms of later avoided economic costs associated with tube rupture and down time. The conclusion was that condenser repair costs would not have a significant effect on the overall costs, and no estimate of this repair was made (Ref.

4).

The NRC indicates that no modifications to the plant Technical Specifications will be required for implementation of the requirements (Ref. 4), so no estimates of costs associated with formal licensing changes were made.

However Reference 4 called for the utilities to develop a license amendment to include the description of the water chemistry and condenser ISI programs.

This cost is estimated directly at $25,000 (3 man-months) for utility staff time.

In addition, the CISIP will require helium leak detection equipment which is estimated at $25,000/ unit. However, surveys indicate that perhaps only 30 percent of the plants would need to implement this program in addition to their current inspection programs.

The average implementation cost is then assumed to be

[(31)($1.5E+06) + (31)($2.5E+04) + (0.3)(31)($2.5E+04)]/31 = $1.53E+06.

Per Plant Industry Costs for Operation and Maintenance SAI estimated that all PWRs would require a program for SWC, and put the requirements ~at 4 to 6 man-months per plant. Using an average of 5 man-months per plant, this represents $42,000/py.

For CISIP, only 30 percent of the plants will likely be required to implement a program. The costs were estimated (Ref. 2) at $10,000 to $25,000 (at

$48,000/ man yr) for eddy current and air inleakage tests. This indicates a

man power estimate of 0.2 to 0.5 man yrs effort. Helium leak detection costs I

- 131 -

', .I were put at $5,000 per inspection, which is assumed to represent 0.1 man yrs of effort. Using the accepted $100,000/ man yr, this translates into a coct of $20,000 to $50,000 per plant year for the CISIP, plus $10,000/yr for the helium leak detection. The maximum value of $60,000/py will be used here.

The average annual cost for operation and maintenance is then assumed to be

[(31)($42,000) + (0.3)(31)($60,000)]/31 = $60,000/py.

With a 10 percent discount rate over 27.7 years, this represents a present value of

($60,000)(9.29) = $5.6E+05.

With a 5 percent discount rate over 27.7 years, this represents a present value of

-($60,000)(14.82) = $8.9E+05.

The 10 percent discount rate will be used for value/ impact comparisons.

Total Per-Plant Industry Costs The total average industry per plant cost is then put at $1.53E+06 (implementation) + $5.6E+05 (present worth of operation and maintenance),

or $2.09E+06.

Avoided Costs Reference 2 estimated the avoided costs due to reduced SGTR and forced outages over a 24 year period for implementation of both SWCP and CISIP.

Correcting to a 27.7 year period for an average plant, this came to the following in constant dollars:

Cause of Downtime Median Plant $avings ($)

Tube Rupture & Forced Outage 9.2E+06 Tube Plugging & Low Performance $1.2E+06 SG Replacement None Total $10.4E+06/ plant This then comes to an average annual savings of $3.75E+05/py over the 27.7 year period.

- 132 -

R. .  ;.4 Per-Plant Industry Savinas Due to Accident Avoidance Given the estimate costs associated with core-melt at $1.65E+09 (Ref. 9), and the predicted reduction in core-melt frequency, the. cost savings due to

_ accident avoidance is

.(7.7E-07/py)($1.65E+09) = $1.16E+03/py.or $3.20E+04/ reactor over 27.7

. years.

NRC COSTS

.In determining the NRC Cests for issue development and implementation it is assumed that previously ' funded work is to be accounted for in estimating the NRC costs. The following figures were obtained for development of generic tasks A-3, A-4 and A-5 (Ref. 10). Since 1981 values were not available, averages were obtained from the previous 4 years.

4 FY77 FY78 FY79 FY80 FY81 Total (man-years)

- NRC Labor

.5 2.2. 2.1 .8 1.4 (7.0)

(dollars)

Technical $223K $325K $375K $300K $300K ($1.52E+06)

Assistance

' Contracts Fifty percent of these costs to date are assumed to be directly related to the SCWP and the CISIP. In addition, the final rulemaking and issuing of specifications will be approximately $250K. This will included condenser inspection requirements. In addition, it is anticipated that 1 man week / plant will be required to review implementation actions. 4 j Assuming $100,000/ man year for staff labor total NRC costs for development are:

= (.50)(7 man years)($100K/ man year) + (.50)($1.52E+06) + $250K

= $1.36E+06 5 Averaging over 31 PWRs and adding implementation costs yields $4.6E+04/ plant.

i

- 133 -

. c. c A i-

1 I l Per-Plant NRC Cost for Review of Issue Operation and Maintenance l None Total NRC Costs The total NRC costs for this issue are estimated at $4.6E+04/ plant.

The cost estimate used for comparison to the guidelines then includes '

quantified industry and NRC costs, this being ($2.09E + 06 + $4.6E+04), or

$2.14E+06 per plant. For 31 plants the total cost is $6.6E+07.

3.6.4.4.3 Value/ Impact Assessment-The benefit / cost ratio is based on the averted risk estimate accounting for the reduction in risk over the entire remaining lifetime of the affected plants and costs to the utilities and the NRC for implementation, operation and maintenance of the requirements. It should be noted that this estimate does not reflect avoided costs introduced in this particular issue. In addition, the cost portion of the ratio is based on the average cost estimates.

In establishing the benefit to cost ratio a total per plant public risk reduction of 2.1E+03 man rem is used. The cost figure of $6.6E+07 represents the summation of utility costs and NRC costs on a per plant basis over the '

27.7 year life expectancy of the 31 affected plants.

benefit = 2.1E+03 man-rem = 3.2E-02 man-rem cost $6.6E+07 $1000 If the deferred costs due to reduced down-time are considered, the costs become negative, reflecting a net savings.

3.6.4.5 UNCERTAINTIES The major source of uncertainty in this analysis falls within the core-melt frequency predictions and resulting doses. The analysis was completed assuming a best estimate derived by the NRC. However, Attachment I also carries through calculations based on the most conservative estimate. Even this ; ost conservative estimate does not produce core-melt frequencies that are significant with respect to a 1E-04/py criteria.

Another major uncertainty exists in the assumed release categories and resulting off-site doses. Any release via SGTRs actually represents a containment bypass rather than direct containment failure, with the potential for significant partitioning and dilution of any primary coolant released to the secondary side of the steam generator. In addition, entrainment and plateout of fission products and holdup'can significantly reduce the likely magnitude of any release. As a result, the use of PWR 2 and 4 release categories is expected to be highly conservative.

- 134 -

s. -a Additional uncertainties are present in the cost estimate section. The present analysis does not reflect all costs which may be incurred by plants which need extensive equipment replacement, this being possible condenser repair and replacement needs. However, these costs would likely be small compared to steam generator replacement costs, and would also be balanced by later averted costs due to the economic benefits derived from decreases in tube rupture and associated downtime. Uncertainties are present in NRC cost estimates as present technical assistance contract costs were established as an average of previous fiscal year contracts awarded.

The conservative treatment of core-melt frequency due to tube rupture may therefore lead to an overestimate of the man-rem saved per dollar spent in the benefit / cost ratio given. However utility costs are also developed from the same estimates.of tube rupture and repair. Thus no significant changes in the estimate of this ratio are expected in the near term with more detailed analysis of tube rupture data or core-melt scenarios.

3.

6.5 CONCLUSION

S The results of the analysis are summarized in the following tables. Results relative to the primary design objectives reveal the change in acute and latent fatalities due to implementation of the requirements. The information presented in the following tables is presented on a per plant basis over the 27.7 year life expectancy for the 31 affected PWRs.

3.6.5.1 STATEMENT ON PRIMARY DESIGN OBJECTIVE The primary design objective relates to the reduction in risk of early fatality for individuals located within one mile of the plant, and reduction in latent fatalities for the general society within 50 miles of the plant.

The resulting comparison below indicates that the early fatality estimate represents 2.5 percent of the design objective for individual risk. The latent fatality estimate over 50 miles represents 3E-03 percent of the design objective for societal risk.

TABLE 3.6.1 Primary Design Objectives Individual Societal Item Risk Risk (man-rem) (f atalities) (man-rem) (fatalities)

Safety Goal -

SE-07/py -

2E-06/py l Requirements 2.47E-02/py 1.26E-08/py 2.42E+0/py 6.02E-11/py i

- 135 -

l

• . .i l

There is considerable uncertainty in the estimate of frequency of steam generator tube rupture and subsequent probability of core-melt. This analysis uses the 'best estimate' for tube rupture frequency and subsequent core-melt, with the probability of core-melt thought to be quite conservative. The worst case being approximately 1.5 times the best estimate. This ratio would carry through for potential' reductions in man-rem and exposure, based on the assumed reduction in tube rupture due to implementation of a water chemistry and condenser inspection program. This would increase the ratio of individual and societal requirements to 3.75 percent and 4.5E-03 percent of the respective QD0s, which still represents a relatively small fraction of the QDO.

3.6.5.2 STATEMENT OF SUBORDINATE DESIGN OBJECTIVE The sub-ordinate design objective expresses man-rem of societal exposure averted to the industry and utility costs. This relates to the guideline of 1 man-rem averted per $1000 cost. As can be seen, the subordinate design objective is approximately 3 percent of the guideline.

TABLE 3.6.2 Sub-Ordinate Design Objective Item Benefit / Cost Safety Goal 1 man-rem averted /$1000 SWCP + CISIP 0.03 man-rem /$1000 per plant The low benefit / cost ratio is because the reduction in SGTR induced core-melt results in a dose reduction of only 2.1E+03 man-rem for 31 plants over 27.7 years, but at a cost of $2.1E+06 per plant. Considering a worst-case frequency of SGTR would increase this ratio to only approximately 5 percent of the guideline.

However, the benefit / cost ratio again fails to consider cost saving due to reductions in down time and reduced performance as a result of improved steam generator and condenser tube condition. these savings in fact exceed implementation and annual operational costs.

3.6.5.3 STATEMENT ON PLANT PERFORMANCE DESIGN OBJECTIVE The plant performance design objective presents the reduction in core-melt frequency estimated as a result of issue implementation. This relates to the design goal of less than 1E-04/py for the plant as a whole. As can be seen, the implementation of this issue represents approximately 0.7 percent of the design goal.

- 136 -

o '. . s-Again uncertainties in the analys'is of core-melt frequency and potential reductions could increase this by a factor of 1.5 for the worst case NRC analysis, increasing the performance objective to approximately 1 percent of the design goal.

. TABLE 3.6.3 Plant Performance Design Objectives Item Change in Core-Melt Frequency Defense-in-Depth Safety Goal lE-04/py SWCP + CISIP 7. 0E-07/py -

- 137 -

S. .

Attachment to Section 3.6 The following information is provided in support of the Core-Melt and Risk Reduction estimates. The majority of this information discusses the derivation of values utilized in estimating base and adjusted-case values for core-melt frequencies and public risk. In addition, it carries through these calculations for worst possible cases as determined by NRC and SAI analyses (Ref. 2 and Ref. 3).

The estimate of the impact of this issue resolution on core-melt frequency is based on a review of the SAI and the NRC analyses. The review of the SAI and NRC Analyses reveals some differences in approach. In both evaluations affected plants were divided into three groups: (1) severe, for those plants with significant SWC related tube degradation, (2) clean, for those plants with little SWC related tube degradation, and (3) medium, for those plants between severe and clean. It has been estimated that those plants with severe and medium tube degradation would achieve reductions in SG tube degradation of approximately 75 percent and 50 percent, respectively. Both analyses use the following established estimates: 1/6 of the operating plants fall into the severe group, 1/2 of the operating plants fall into the medium group and the remaining 1/3 of the affected plants fall into the clean group.

It has been estimated that loose parts in the secondary side account for approximately 50 percent of the SGTRs and that the SWCP, in tandem with the condenser ISI program, is expected to reduce the other 50 percent of the SGTRs and tube degradation by up to 70 percent (Ref. 2). Discussions with Pacific Northwest Laboratory staff who are examining the Westinghouse steam generator taken from Surry indicate that secondary water chemistry and loose parts are an apparent cause of degradation in the generator. Galvanic corrosion due to the use of dissimilar metals (Inconel, stainless steel, and carbon steel) is also apparent. This aspect is inherent in the design, and likely not subject to full elimination without major design modifications for insulating dissimilar metals or providing passive or active electrical current control.

One of the more obvious conditions present in the Surry steam generator is the significant distortion of channel flow slots and tube support sheets.

Although this has not yet been investigated, the distortion is most likely the result of large thermal transients. These distortions can introduce stresses in the Inconel tubes to such an extent that cracking would occur regardless of water chemistry control. Inconel cracking in pure water has been observed under such conditions. Although likely thermally induced, it is currently uncertain if the observed distortions were the result of operational power changes outside the design envelope (ramps during startup or shutdown), or if they were indicative of faulty design incapable of handling normal operational thermal changes (considered unlikely). The other

- 138 -

l possibility is that the generator has been subjected to rapid cool-down following tube rupture causing the thermal distortion of internal generator

. structures. The induced stresses wculd then further accelerate tube failures

. degraded by secondary water chemistry problems or loose parts.

It should be recognized, therefore, that operationally induced thermal transients and galvanic corrosion of dissimilar metals may be playing a role in steam generator tube failure. However given the present uncertainty, the effect of these mechanisms could be assigned to the 50 percent of tube ruptures assumed aoove to not be amenable to correction as a result of this program.

For the purposes of this examination, the SAI assumptions will be used.

Implementation of this program will then address 50 percent of the underlying causes for steam tube rupture. It will further be assumed that the operating PWRs are impacted by steam tube degradation in the following manner:

1/6 of PWRs

severe impact, or 47/6 = 8 pli.nts, i 1/2 of PWRs: -medium impact, or 47/2 = 23 plaats, 1/3 of PWRs: clean, for,a total of 31 impacted plants Further, it will be assumed that tube ruptures due to secondary water chemistry problems can be reduced by 75 percent for the severely impacted

plants, and 50 percent for medium plants by implementing the SWCP-CISIP.

l This will give a net reduction of (.50)(.75) = 38 percent for severe plants, i

and 25 percent for medium plants, with no change for clean plants. The resulting estimate of changes in core-melt frequency are given below.

BASE-CASE VALUES In the SAI analysis of single SGTR, a model was developed based on thirteen plant response functions which are required or affected following a SGTR.

• Networks were developed for each function to define fault structures.

Seventy seven sequences were found to describe common groups and minimal i

. fault sets. Five sequences were'found to be dominant for high response l- plants (plants which can respond to anticipated transients without scrtt

l. (ATWS) and can feed and bleed) and seven sequences were found .o be dor..inant for low response plants (plants which cannot respond to ATWS ce feed and bleed). The estimated base-case range for core-melt probability was 7.2 E-05/py to 4.6 E-05/py. These values assume that questionaale core-melt sequences fall within the non core-melt categories. The qtastionable core-melt deals with the capacity of the plant's refueling dater storage tank or other borated water ~ sources to keep the core covered if the primary system 1

is not rapidly depressurized and the secondary side is at atmospheric pressure due to a secondary side LOCA. If the plant does not have sufficient borated water inventory to last until the primary system is depressurized,

- 139 -

7-S. .e the core will uncover and melt. Otherwise, the core is not uncovered and the result is a major plant release, but not a melt. The time frame for this questionable melt is on the order of 10 or more hours following the SGTR.

Thus, this variable is treated as a melt or as a non-melt due to the uncertainty associated with the sequence consequences and response (Ref. 2).

The worst case would assume that these sequences fall within the core-melt cases and thus, a worst case would predict a value of 1.0E-03 for the probability of core-melt given SGTR. Assuming the frequency of rupture is on the order of 1E-02 per year, the frequency of core-melt from SGTR alone would be on the order of 1E-05/py--a value that is larger than the estimated probability of core-melt from all events in Wash-1400. The SAI analysis (Ref. 2) concludes that a more accurate estimate is obtained if the questionable melts are included in the non-melt categories. Therefore, in

-this analysis the low to high range estimates for core melt frequency consider those cases where the questionable melts are included as non-core-melt cases.

The base-case range is determined below. The lower bound on the range assumes that questionable core-melt sequences fall into non-core-melt categories:

Release SGTR Core-Melt Category Probability Probability

(/py) (/py)

PWR-3 lE-02 2.8E-07 PWR-4 1E-02 4.5E-05 PWR-5 1E-02 2.9E-07 Totals 4.6E-05 Upper bound on range assuming questionable core-melt sequences fall into non-core-melt categories:

Release SGTR Core-Melt Category Probability Probability

(/py) (/py)

PWR-3 1E-02 2.7E-05 PWR-4 1E-02 4.5E-05 PWR-5 1E-02 2.7E-07 Totals 7.2E-05

- 140 -

S .,

o Note again that SGTR represents a containment bypass failure, with significant partitioning, dilution, and entrainment expected in the steam generator shell or a condenser release pathway. This would also be true given a value lift on the secondary side, although to a lesser extent. The release categories used here are thus considered conservative.

The NRC analysis selected two of the seventy seven sequences identified in the SAI analysis as dominating core-melt probability. The two dominant accident sequences were 1)' loss of offsite power and failure of both dies-1s to start (IE-07/py) and 2) failure of the auxiliary feedwater system (2E-07/py). The release category for the two sequences was assumed representative of a PWR Category 4 type release. The combined SAI sequences result in a core melt probability of 3 E-07/py. Independent NRC analyses also included multiple SGTRs, challenges to the reactor trip and decay heat removal functions, LOCAs, SGTR events in combination with loss of secondary system integrity, and ATWS events leading to multiple (710) SGTRs. Eight sequences were identified as dominant (frequencies greater than 1E-07/py) and were grouped in accordance with the representative release categories 2 and

4. The base-case core-melt frequency and the public dose /py are established belcw. Each analysis type was considered a separate category establishing a summation procedure (Ref.11). In addition, it should be noted that the probability of SGTR has been included.

Release Core-Melt Category Analysis Probability

(/py)

PWR-4 (SAI) 3.0E-07 PWR-4 (NRC) 1.3E-06 PWR-2* (NRC) 9.0E-07 PWR-2 ATWS Seq. 1.0E-06 Totals 3.5E-06

(*) Excludes ATWS Sequence The base-case core-melt frequency is believed conservative with respect to the overall risk associated with potential SGTRs. However, in estimating risk reductions resulting from implementation of the proposed generic requirement, the NRC considered it prudent not to credit the requirements with potential reductions to SGTRs following an ATWS (ATWS sequence assumed a l 1.0 probability of multiple SGTRs). Therefore, the above core-melt frequency will be considered an upper bound and a core-melt frequency of 2.5E-06/py l will be considered a best estimate, l

l - 141 -

oo ..

A0JUSTE0 CASE VALUES AND REDUCTION IN CORE-MELT FREQUENCY l Using the above values, assuming a reduction in SGTR of 38 percent for the

severe plant group (this assumes 50 percent of the plants can be impros.ed l with the SWCP-CISIP and assumes a 75 percent improvement), assuming a

' reduction in SGTR of 25 percent for the medium plant group and assuming essentially no improvement for the clean plants, the adjusted core-melt

frequency and change in core-melt frequency are calculated below (example l uses a base-case core-melt frequency of 3.5E-06/py):

Adjusted core-melt frequency:

(1 .38)(3.5E-06)/6 + (1 .25)(3.5E-06)/2 + (1-0)(3.5E-06)/3

= 2.8E-06 /py L Change in core-melt frequency:

(3.5E-06/py) - (2.8E-06/py) = 7.0E-07/py.

Using this procedure (Ref. 11) for SAI and NRC values of base-case core-melt frequencies, the following table of adjusted core-melt frequencies results:

Base-Case, Adjusted and Delta Core-Melt Frequencies (a)

Basa-Case Adjusted Case Delta Core Analysis Core-Melt Core-Melt Melt Freq.

SAI(low) 4.6E-07/py 3.7E-07/py 9.0E-08/py SAI(high) 7.2E-07/py 5.8E-07/py 1.4E-07/py NRC(best est) 2.5E-06/py 2.0E-06/py 5.0E-07/py NRC(worst) 3.5E-06/py 2.8E-06/py 7.0E-07/py (a) Values include the probability of an SGTR event (1E-02/py)

The best estimate for core-melt frequency selected for this analysis is then 2.5E-06/py. The SAI analysis further broke this down into the release categories shown below, which will be used in this analysis. Assuming an initiator frequency of 1E-02/py was given above, an effective probability of core-melt given SGTR is also calculated.

- 142 -

%s et Core-Melt Assumed Lore-Melt Release Category Frequency, 1/py Probability Given SGTR PWR-2 9.0E-07 9.0E-05 PWR-4 1.6E-06 1.6E-04 Total 2.5E-06 In the analysis of this issue, only the 31 affected plants of 47 total PWRs will be considered. PWRs with clean systems will not likely be required to implement extensive changes in their secondary water chemistry and condenser inspection programs. The estimated change in core-melt will then be

[(1-0.38)(8)(2.5E-06/py) + (1-0.25)(23)(2.5E-06/py)] /31 or 1.8E-06/py for a reduction in core-melt frequency of (2.5E 1.8E-06)/py = 7.0E-07/py. ,

3.

6.6 REFERENCES

1. UCRL-53032, " Worldwide Assessment of Steam Generator Problems in Pressurized Water Reactor Nuclear Power Plants," Woo, H. H. and S. C. Lu. , Lawrence Livermore Laboratory, Livermore, CA,1981.

2. Morehouse, J. H., et al., "Value-Impact Analysis of Recommendations Concerning Steam Generator Tube Degradations and Rupture Events,"

prepared for the U.S. Nuclear Regulatory Commission, Science Applications, Inc., McLean, VA, 1983.

3. "Prioritization of Steam Generator Generic Requirements Concerning Tube Degradation and Rupture Events," U.S. Nuclear Regulatory Commission, Washington, D.C., 1984.

4. NUREG-0844 (Original Oraft), " Resolution of Unresolved Safety Issues A-3, A-4, and A-5 Regarding Steam Generator Tube Integrity," Strosnider, J., U.S. Nuclear Regulatory Commission, Washington, D.C., 1981.

5. NUREG/CR-1490, "Some Aspects of Cost / Benefit Analysis for Inservice Inspection of PWR Steam Generators," Zina, G. E., et al., Pacific Northwest Laboratory, Richland, Washington, 1981.

6. NUREG-0886, " Steam Generator Tube Experience," Cheng, C. Y., U.S.

Nuclear Regulatory Commission, Washington, D.C., 1982.

- 143 -

'5 a

7. NUREG/CR-1595, " Radiological Assessment of Steam Generator Removal and Replacement: Update and Revision," Hoenes, G. R., et al., U.S. Nuclear Regulatory Commission, Washington, D.C., 1980.

8. NUREG-0692, " Steam Generator Repair at Surry Power Station, Unit No.1,"

U.S. Nuclear Regulatory Commission, Washington, D.C., 1980.

9. NUREG/CR-3568 (PNL-4646), "A Handbook for Value-Impact Assessment,"

Heaberline, S.W. , et al. , Pacific Northwest Laboratory, Richland, Washington, 1983.

10. NUREG-0371, " Task Action Plans for Generic Activities: Category A,"

U.S. Nuclear Regulatory Commission, Washington, D.C. ,1978,

11. NUREG/CR-2800 (PNL-4297), " Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," Pacific Northwest Laboratory, Richland, Washington, 1983.

l i

i

! - 144 -

,_1..__ __.______________._.-______._._:___._____.___________________.________.___..______________

f

' s P

3.7 Steam Generator Tube Degradation and Rupture: Other Program Elements by: W. Bickford and B. Fecht (PNL) 3.7.1 Secondary Side Visual Inspections and Improved QA/QC Procedures For Prevention and Detection of Loose Parts 3.7.

1.1 BACKGROUND

Operating experience has revealed objects which have been left in the primary and secondary sides of nuclear reactor steam generators. For example, loose parts and foreign objects were identified as the cause of tube ruptures at Prairie Island and Ginna. A secondary side peripheral visual inspection would assist in identifying loose parts, foreign objects on the tube sheet and  ;

degraded conditions caused by loose parts on the outer diameter of the j peripheral tubes. i Visual inspections conducted in accordance with the NRC staff position would result in initial inspections of all steam generators plus inspections each time the secondary side is opened for modification or repairs (NRC, 1983). ,

Inspection of the upper side of the tube sheet is to be performed in l conjunction with the eddy current testing. It is therefore assumed that the effort required to enter the armway access port will be small. No access effort is required if sludge removal is performed along with the eddy current testing. For steam generators without these access ports, inspections could be performed from other ports but with additional difficulty, at greater cost and probably with greater occupational exposure.

3.7.1.2 SAFETY SIGNIFICANCE The basis for the staff position on the secondary-side visual inspection and improved quality assurance (QA) procedures is that the existing inspection methods and practices and material accountability controls have not proven sufficiently effective to insure that loose parts and foreign objects are identified and removed before startup. These foreign objects and parts have contributed to tube damage and degradation on numerous occasions.

Concerns relative to steam generator tube degradation stem from the fact that the steam generator tubes are a part of the reactor coolant system (RCS) pressure boundary and that failures can result in a loss of primary coolant into the secondary (steam) side of the plant. This introduces two major safety considerations with respect to public risk. First is the direct release of radioactive fission products. This results when failure of the steam generator tubes allows contaminated primary coolant into the secondary side where its isolation from the environment is not ensured. The second consideration is that of creating a more severe accident through the loss of primary water needed to cool the reactor. This latter situation is possible in the event of an extended loss of coolant.

- 145 -

s, a In addition, tube degradation and failure require plant corrective maintenance which usually involves tube plugging and repair, or entire steam generator replacement. Any utility maintenance on or around the steam <

generator can result in significant occupational radiation exposures.

3.7.1.3 STAFF POSITION Loose parts and foreign objects in steam generators shall be detected by performing inspections and shall be prevented by revising, as necessary, quality assuraace procedures.

(1) Secondary Side Visual Inspections:

The Technical Spe'cifications should be revised to require visual inspections 4 of the steam generator. secondary side in the vicinity of the tube sheet, both

,along the entire periphery of the tube bundle and along the tube lane, for

' purposes of identifying loose parts or foreign objects on the tube sheet, and external damage to peripheral tubes just above the tube sheet. An l appropriate optical device should be used (e.g. mini-TV camera, fiber

. optics). Loose parts or foreign objects which are found should be removed l from the steam generators. Tubes observed to have visual damage should be eddy current inspected and plugged if found to be defective. These visual inspections should be performed (1) for all steam generators at each plant at the next planned outage for eddy current testing, (2) after secondary side modifications, or repairs to steam generator internals, and (3) when eddy current indications are found in the free span portion of peripheral tubes, unless it has been established that the indication did not result from damage

, by a loose part or foreign object.

e

^' >

For PWR OL applicants, such inspections should be part of the preservice

/ inspection.

+

For steam generator models where certain segments of the peripheral region J' ' can be shown not to be accessible to an appropriate optical device, licensees and applicants should propose alternative actions to address these inaccessible areas, as appropriate.

Licensees should take appropriate precautions to minimize the potential for corrosion while the tube bundle is exposed to air. The presence of chemical species such as sulfur may aggravate this potential, and may make exposure to the atmosphere inadvisable until appropriate remedial measures are taken.

Licensees may propose alternatives to visual inspections, including installation and operation of a loose parts monitoring system. Any such alternative should include criteria for determining when appropriate remedial actions should be taken to address any suspected presence of loose parts or foreign objects.

/

- 146 -

e

%. a (2) Improved Quality Assurance Procedures:

Quality assurance / quality control procedures for steam generators should be reviewed and revised as necessary to ensure that an effective system exists to preclude introduction of foreign objects into either the primary or secondary side of the steam generator whenever it is opened (e.g., for maintenance, sludge lancing, repairs, inspection operations, modifications).

As a minimum, such procedures should include (a) detailed accountability procedures for all tools and equipment used during an operation, (b) appropriate controls on foreign objects such as eye glasses and film badges, (c) cleanliness requirements, and (d) accountability procedures for components and parts removed from the internals of major components (e.g.,

reassembly of cut and removed components).

3.7.1.4 EVALUATIONS This section evaluates the potential reduction in core-melt frequency, individual and societal risks, and occupational radiation exposure due to implementation of the above staff position for secondary side visual inspections and improved QA/QC procedures for prevention and detection of loose parts. Cost estimates for the implementation and maintenance of this program are' addressed, and finally, a value/ impact figure is developed based upon the results obtained from the above calculations. Information available from SAI and NRC analyses will be utilized in the development of these values.

t 3.7.1.4.1 CORE-MELT FREQUENCY ESTIMATES The estimate of change in core melt frequency due to implementation of this issue is based on a review of the SAI and the NRC analyses.

Base-Case SGTR Frequency SAI assumes a tube rupture frequency of 0.011/py or 1.1E-2/py attributed

' entirely to loose parts. This is based on a limited data base of 2 occurrences. The tube rupture frequency of 1E-2/py will be used here for simplicity.

Reduction in SGTR Frequency I

It is estimated that the secondary side visual inspections plus the QA procedures will eliminate up to 90 percent of the SGTRs that can occur from loose parts in the secondary side. This is based on that assumption that

[

there is a 20 percent chance of mitigation through implementation of the QA procedures and a 70 percent chance of detection through implementation of the secondary side visual inspection program (NRC 1984). In addition, some l plants are assumed to be severly affected by this issue, and some are not.

e 147 -

i i

6

6 .s It will be assumed that the average reduction in SGTR over all PWRs is half the above, or (0.5)(0.9)(1E-02/py) = 4.5E-03/py.

The adjusted SGTR frequency due to loose parts is then:

(0.5-0.45)(1E-02/py) = 5.0E-04/py.

Core-Melt Frequency In this evaluation the best estimate for core-melt frequency is based on the original analysis of the SWC program. The estimate used in that situation was developed by the NRC and includes single and multiple SGTR as well as challenges to the reactor trip and decay heat removal functions. Based on the analysis in NUREG-0844, the probability of core-melt given SGTR is put at 2.5E-04. The reduction in core-melt associated with this issue is then (4.5E-03/py)(2.5E-04) = 1.13E-06/py.

As per the NUREG-0844 analysis, it will be assumed that the releases will be associated with the PWR 2 and 4 release categories with a 36% and 64%

probability, respectively. In fact, leakage via the ruptured steam tubes represents a small containment bypass. The subsequent entrainment and holdup in the steam generator shell makes the use of these release categories conservative. This will be discussed further in Section 3.7.1.4.5, Uncertainties. The resulting core-melt information based on these assumptions j is summarized below. '

Release Release Cat. Core-Melt Prob. Core-Melt Freq.

Category Probabilities Given SGTR Due to Loose Parts,/py PWR-2 0.36 9.0E-05 4.5 E-08 I PWR-4 0.64 1.6E-04 8.0 E-08 l TotiT 1.00 2.5E-04 1.25E-07 l

Reduction in Core-Melt Frequency f

The net reduction in core-melt frequency is the reduction in assumed SGTR challenges times the probability of core-melt given the challenge, or

- 148 -

%. A Release Category Reduction in Core-Melt Frequency PWR-2 (4.5E-03/py)(9.0E-05)= 4.05E-07/py PWR-4 (4.5E-03/py)(1.6E-04)= 7.20E-07/py Total 1.13E-06/py 3.7.1.4.2 RISK EVALUATIONS Fatalities associated with release categories for the reference site are used here to estimate reductions in acute and latent fatalities as a result of the

. reduced frequency of core-melt.

3.7.1.4.2.1 Individua'l Risks The risks to the average individual within a one mile radius of the site boundary and beyond a one-half mile exclusion zone are tabulated below. Note that the initial calculations made were by release category and have been presented in that form here. The probability of containment failure for each fisssion product release mode has been back-calculated and was given in the previous step.

The following early fatality probabilities for individuals within a one mile radius of the exclusion boundary are assumed:

Release .Early Fatality Man-Rem Category Probability per Event per Event PWR-2 1.67E-02 -3.09E+04 PWR-4 1.88E-02 3.78E+04 The reduction 'in early individual fatalities (EF) is:

P(EF/2) = (4.05E-07/py)(1.67E-02) = 6.76E-09 fatalities /py P(EF/4) = (7.20E-07/py)(1.88E-02) = 1.35E-08 fatalities /py 2.03E-08 fatalities /py The reduction in individual man-rem exposure within the one mile radius (MR) is:

P(MR/2) = (4.05E-07/py)(3.09E+04) = 1.25E-02 man-rem /py P(MR/4) = (7.20E-07/py)(3.78E+04) = 2.72E-02 man-rem /oy 3.97E-02 man rem /py

- 149 -

I

.. D 3.7.1.4.2.2 Societal Risk Estimates The societal risk to the public within 50 miles of the plant site is based on the probability of latent cancer fatality. The following societal latent fatality (SLF) probabilities for the public within 50 miles of the exclusion boundary are:

Release Total Latent Fatality Man-Rem Category Probability per Event per Event PWR-2 1.39E-04 4.8E+06

-PWR-4 5.62E-05 2.7E+06 The reduction in total societal latent fatalities is:

_ P(SLF/2) = (4.05E-07/py)(1.39E-04) = 5.63E-11/py P(SLF/4) = (7.20E-07/py)(5.62E-05) = 4.05E-11/py 9.68E-ll/py The reduction in total societal man-rem exposure within the fifty mile radius (50MR) is:

P(50MR/2) = (4.05E-07)(4.8E+06) = 1.94 man rem /py P(50MR/4) = (7.20E-07)(2.7E+06) = 1.94 man-rem /py 3.88 man-rem /py 3.7.1.4.2.3 Occupational Radiological Exposure Occupational dose estimates due to the implementation of the secondary side visual inspection and QA programs are taken directly from data presented by SAI. Where a 24 year remaining life is assumed in that report, a 27.7 year remaining life is assumed here.

Per-Plant Occuoational Risk Reduction Due to Accident Avoidance Given the estimated reduction in core-melt frequency of 1.13E-06/py and the estimated occupational dose of 19,900 man-rem / core-melt the estimated reduction in occupational radiation exposure due to accident avoidance is 2.24E-02 man-rem /py or .62 man-rem per plant over 27.7 years.

Per-Plant Utility Dose Increase for Issue Implementation Implementation dose increases are included with dose increases for issue operation and maintenance below.

- 150 -

%. .s Per-Plant Occupational Dose Increase for Issue Operation and Maintenance The occupational dose estimates for performing the ISI for loose parts and upgrading QA procedures are summarized below.

Activity Estimate of Occupational Dose Inspection 5-10 man-rem / inspection /SG QA/QC 5-15 man-rem / reactor year If it is assumed that there are an average of three steam generators per plant, that initial inspections of all~ steam generators will occur during the next eddy-current test outage,.the remaining lifetime frequency for opening the secondary side of all plant steam generators for maintenance or repairs is once per every five years, and an average occupational radiation exposure of 5 to 10 man-rems per inspection for one steam generator is expected, the estimated occupational exposure is 4 to 8 man-rem /py or 90 to 180 man-rems over the 27.7 year remaining life of the plant.

When the estimated 27.7 year lifetime occupational radiation exposure from the visual inspections is added to the estimated ORE from quality assurance work procedures (139 to 416 man-rems), the total ORE attributable to implementation of these actions is estimated to be 229 to 596 man-rems.

In addition to the occupational dose from implementation of the two staff positions, there is an avoided. dose due to the elimination of SG repair. The occupational dose for repairing the Ginna SG was approximately 350 man-rem.

The expected value of the avoided dose was estimated using the 350 man-rem value times the change in tube rupture frequency per year over the remaining 27.7 years of operation. The base-case frequency was estimated at 1E-02 with the potential 45 percent reduction in total SGTR frequency. Thus, the avoided dose frequency is (4.5E-03)(350)(27.7) or 44 man-rem.

Total Occupational Dose Increase for Operation and Maintenance The total ORE which incorporates the avoided ORE is approximately 185 to 552 over the remaining 27.7 years of plant life. It should be noted that the estimated avoided doses include only those attributed to repair of SG tube ruptures and does not include avoided doses that accrue from avoided repairs due to other types of damage from loose parts.

i

- 151 -

\. 4-3.7.1.4.3 DEFENSE IN DEPTH The role of the steam generator tube integrity and plant features to mitigate the effects of a SGTR are the same as that developed for the SWC and CISI programs.

3.7.1.4.4 BENEFIT / COST-(VALUE/ IMPACT)

The benefit-cost comparisons are presented in this section. Benefit and cost estimates were made based on SAI and NRC data.

3.7.1.4.4.1. Senefits Estimate.

For the purpose of comparison with the Safety Goal Benefit-Cost guidelines, the benefit-(value) is based on the_ averted societal risk within a 50 mile radius of the site boundary. Values presented here are in terms of averted risk over the remaining lifetime of the power plant (assumed to be 27.7 years for PWRs).

From Section 3.7.1.4.2, the net reduction in core-melt frequency and associated man-rem per event is given by release category:

Release Reduction in Man-Rem Category Core-Melt Frequency per Event per py PWR-2 4.05E-07/py 4.8E+06 1.94 PWR-4 7.20E-07/py 2.7E+06 1.94 Total T.T6 Over the lifetime of 27.7 years, this is then an averted risk of 107 man-rem / plant, or 3330 man-~ rem for 31 PWRs. By way of comparison, the SAI analysis approximates the public risk reduction due to secondary ISI and QA as 3 man-rem /py.

3.7.1.4.4.2 Cost Estimates The economic benefits of implementing the secondary side inspection and QA procedures are the avoidance of forced outages due to leaks, tube ruptures, SG replacement and derating. The general approach is to determine costs for implementation and maintenance of the program as well as cost benefits due to avoided maintenance and outages.

- 152 -

L

A. .t I

I INDUSTRY COSTS Per-Plant Industry Costs for Implementation, Operation and Maintenance The estimated costs for secondary side inspection of one steam generator is

$1600. This estimate assumes 0.2 SG inspections per year with one SG per year subjected to ECT and additional maintenance performed every 5 years.

The cost for a mini-TV camera system is approximately $29,000.

It is estimated that QA procedures will add 10 percent to the current

. inspection and maintenance costs. Using data from NUREG/CR-1490, approximately 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> / year or 0.1 man year / year is required. At a salary of

$100,000/ man year, the QA cost is $10,000/ year.

Total Per-Plant Industry Costs Discounted values for the ISI and QA program costs (labor) are

$2.37E+04/ plant and $1.48E+05/ plant, respectively. Including the camera

-system costs, the total per plant cost over the remaining 27.7 year plant life for the secondary side inspection and QA programs is approximately

$0.20E+06.

Avoided Costs The estimated avoided costs are due to reduced SGTR and forced outages over a 27.7 year period for implementation of the secondary side visual inspection and QA programs. The expected value of the benefits is $3.6E+06 to $12.2E+06 for assumed outages between 30 and 90 days.

Per-Plant Industry Savinas Due to Accident Avoidance Given the estimate costs asscciated with core-melt as $1.65E+09 and the predicted reduction in core-melt frequency, the cost savings due to accident avoidance is:

(1.13E-06/py)(S1.65E+09) = $1.86E+03 or SS.16E+04/ plant over 27.7 years.

NRC COSTS NRC Costs for Issue Development and Implementation It is assumed that previously funded work is to be accounted for in estimating NRC costs. The following figures were obtained for development of generic tasks A-3, A-4, A-5. It is assumed that the development phase was completed on 4-30-82. Since 1981 values were not available, averages were obtained from the previous 4 years.

- 153 -

4 .s Item FY77 FY78 FY79 FY80 FY81 Total (man years)

NRC . Labor: 0.5 2.2 2.1 0.8 1.4 7.0 (dollars)

Technical 223K 325K 375K 300K 300K 1.5E+06 Assistance Contracts Fif ty percent of these costs to date are assumed to be directly related to

,the SWCP and the CISIP. The remaining issues constitute the remainder of the costs. It is assumed that remaining costs are divided equally into six portions; one portion each for the 5 issues addressed in this evaluation and one portion for the remaining 5 potential requirements not addressed.

Assuming $100,000/ man year for staff labor, the total NRC costs for development are:

0.5[ 1/6(7 man yrs)($100K/ man year)+ 1/6($1.5E+06) ] = $1.8E+05 Averaging over 31 PWRs and adding implementation costs which are anticipated to be 1 man-week / plant yields $8.2E+03/ plant.

Per-Plant NRC Cost for Review of Issue Operation and Maintenance None Total NRC Costs The total NRC costs for this issue are estimated at $8.2E+0'3/ plant.

Total Costs The cost estimate used for comparison to.the guidelines then includes total industry and NRC costs. This estimate is $0.20E+06 + $8.2E+03 =

$0.21E+06/ plant.

3.7.1.4.4.3 Value/ Impact Assessment The benefit / cost ratio is based on the averted risk estimate accounting for the reduction in risk over the entire remaining lifetime of the affected plants as well as costs to the utilities and the NRC for implementation, operation and maintenance of the requirements. It should be noted that this estimate does not reflect avoided costs introduced in this particular issue.

- 154 -

u_

-A. .s In establishing the benefit to cost ratio a total per plant public risk reduction of 107 man-rem is used. The cost figure of $0.21E+06 represents the summation of utility and NRC costs on a per plant basis over the 27.7 year life expectancy of the 31 affected plants.

Benefit = 107 man-rem = 0.51 man-rem Cost $0.21E+06 $1000 If'the deferred costs due to reduced down-time are considered, the costs become negative and a net savings is reflected.

3.7.1.4.5 UNCERTAINTIES Uncertainties cited in the SWCP and CISIP evaluation concerning core-melt frequency predictions and cost estimates are applicable to this evaluation as well. As with previous SGTR issues, this analysis assumed that the release via the ruptured tubes is best associated with PWR-2 and PWR-4 category releases. The PWR-2 release however is typically characterized by a check valve rupture with release directly to the environment,-and PWR-4 is characterized by a containment leakage rate equivalent to a 3 to 4 inch diameter hole. Both of these likely require multiple. steam tube ruptures to be equivalent events, with the probability of multiple ruptures being progressively less likely. In addition, the release via the ruptured tubes is into the steam generator shell, with partitioning, entrainment, and general ~ holdup likely to reduce the release significantly compared to a direct atmospheric leakage pathway. These considerations would lower the estimated frequency of the events as well as the release magnitude. The latter alone would likely indicate a PWR-5 release category with a reduction in predicted doses of approximately a factor of 2 to 3.

3.7.

1.5 CONCLUSION

S The results of this evaluation are summarized in the following tables.

Results relative to the primary design objectives reveal the change in acute and latent fatalities due to implementation of the NRC staff position. The information in the following tables is presented on a per plant basis over the 27.7 year life expectancy for the affected 31 PWRs.

3.'7.1.5.1 Statement on Primary Design Objective The primary cesign objective relates to the reduction in risk of early' fatality for individuals located within one mile of the plant, and reduction in latent fatalities for the general society within 50 miles of the plant.

The comparisons below indicate that the early fatality estimate represents 4 percent of the design objective for individual risk. The latent fatality

- 155 -

4 .s estimate over 50 miles represents SE-03 percent of the design objective for societal risk.

TABLE 3.7.1.1 Primary Design Objective Item Individual Risk Societal Risk (man-rem) (fatalities) (man-rem) (fatalities)

Safety Goal SE-07/py 2E-06/py Staff '3.97E-02/py 2.03E-08/py 3.88/py 9.68E-11/py Position There is considerable uncertainty in the estimate of frequency of steam generator tube rupture and subsequent probability of core-melt. This analysis uses the best estimate and that which is consistent with previous analyses developed for the SWCP and CISIP. Based on historical data presented by SAI it can be assumed that the upper bound estimate of SGTR frequency due to loose parts may increase the reduction in core-melt frequency by as much as 50 percent. This would increase the ratios of individual and societal risk to 6 and~7E-03 percent of the respective PD0s, which still represents a relatively small fraction of the PDO.

3.7.1.5.2 Statement of Sub-Ordinate Design Objective The subordinate design objective expresses a ratio of man-rem of societal exposure averted to the industry and utility cost. The safety goal guideline is 1 man-rem averted per $1000 cost. The resulting subordinate design objective for this issue is approximately 50 percent of the guideline.

TABLE 3.7.1.2 Subordinate Design Objective Item Benefit / Cost Safety Goal 1 man-rem averted /$1000.

Staff Position .51 man-rem averted /$1000.

An increase to 75 percent of the subordinate design objective would result if the SGTR frequency of 0.011 is used. However, it should also be noted that the benefit / cost ratio fails to consider cost savings due to reductions in downtime and reduced performance as a result of improved steam generator and tube condition. These savings exceed the implementation and annual operation costs for the program.

- 156 -

9 .: .s 3.7.1.5.3 STATEMENT OF PLANT PERFORMANCE DESIGN OBJECTIVE The plant performance design objective presents the reduction in core-melt frequency est: mated as a result of issue implementation. Implementation of the issue represents approximately one percent of the plant performance design objective.

TABLE 3.7.1.3 Plant Performance Design Objective i

Item Change in Core-Melt Frequency Defense-in-Depth Safety Goal 1E-04/py --

Staff Position 1.13E-06/py --

- 157 -

ll

• 4 v ~ w-- e ~ e sn -

p.nn w-, y e .. . ..~, ,x - , - - m na ., ,

• . a 3.7.2 INSERVICE INSPECTION OF STEAM GENERATOR TUBES TO INCLUDE FULL LENGTH TUBE INSPECTIONS AND MAXIMUM STEAM GENERATOR INSPECTION INTERVALS 3.7.

2.1 BACKGROUND

Operating experience has shown that steam generator tubes on the cold-leg side have been susceptible to a variety of degradation problems (e.g.,

wastage, pitting, denting, and' fretting-induced wear.) Forced outages have occurred as a result of cold-leg side leakage at Indian Point 3 and Ringhals

3. In addition to evidence of pitting, denting etc., there has been evidence of accelerated wear on some Westinghouse Model D steam generators at baffle supports due to vibration problems.

The' Standard. Technical Specifications (STS) and Regulatory Guidelines define a U-tube inspection to mean an inspection of the steam generator tube from the point of entry on the hot-leg side around to the top support on the cold-leg side. A majority of the PWR licensees recognize the importance of inspecting the cold-leg side as evidenced by the fact that approximately 70 to 80 percent of those plants with U-tube type steam generators are currently including a cold-leg

• inspection during inservice inspections. This portion of the issue would require a change in the STS such that a U-tube inspection would include inspection from tube end to tube end.

The second portion of this issue addresses the need for a revision of the STS to_ limit the maximum allowable time between inspections of an individual steam generator using the eddy current method. The limit proposed is 72 months. Current regulations allow inspections to be limited to one steam generator on a rotating schedule if indications are that all steam generators are performing in similar manner. If two consecutive inspections show that any previously found degradation has not continued, then the inspection interval can be extended to 40 months. Under these conditions it is possible to have a 160 month inspection interval for a 4-loop plant.

3.7.2.2 SAFETY SIGNIFICANCE Safety concerns relative to steam generator tube degradation have been discussed in previous evaluations and these same concerns apply to this evaluation as well. This proposed inspection would provide an improved early detection scheme and provide an added assurance that degraded SG tubes are identified and removed from operation.

3.7.2.3 REQUIREMENTS This staff position calls for a revised definition of the U-tube inspection to include inspection from tube end to tube end (ie., the entire length cf the tube). The revised definition does not require that the hot-leg and cold-leg inspection sample be from the same tube. In other words, separate

- 158 -

5 .s entries may be made from the hot and cold sides to meet minimum sampling requirements. Supplemental sampling inspections may still be limited to partial length inspections provided the inspection includes those portions of the tube length where degradation was found during initial sampling.

Additional revisions are specified for-the maximum allowable time interval between inspections of an individual steam generator using the eddy current technique. .The staff position suggests a 72 month interval as maximum.

3.7.2.4 EVALUATIONS This section evaluates the potential reduction in core-melt frequency, individual and societal risks, and occupational radiation exposure due to implementation of the above staff position for full-length tube inspection and maximum steam generator inspection intervals. Cost estimates for the implementation and maintenance of this program are addressed, and finally, a value/ impact figure is developed based upon the results obtained from the above calculations. Information available from SAI and NRC analyses will be utilized in the development of these vr. lues.

3.7.2.4.1 CORE-MELT FREQUENCY ESTIMATES Based on the absence of historical data in this area, SAI has attempted to establish an upper bound for the reduction in core-melt frequency due to implementation of this inspection procedure. It is estimated that the reduction in tube rupture frequency resulting only from degraded tubes will be no greater than 20 percent of the total SGTR frequency. However, a NRC DST review of this issue recognized that only 50% of tube ruptures are currently being attributed to tube degradation with the remainder attributed to loose parts. The SAI upper bound would then effectively attribute 20 % of the total SGTRs, or 40% of tube ruptures from degradation to cold leg problems where historically no ruptures have actually occurred. This is considered a highly conservative measure of the magnitude of the cold leg problem.

As a more reasonable upper bound, the NRC proposed that the implementation of inspection to include the cold leg would result in at most a 20% reduction in SGTRs due to degradation. The NRC further assumed that the maximum inspection interval of 72 months for each steam generator would then have a negligible impact on the reduction of core-melt frequency. The above reduction in SGTR estimated by the NRC is however significant, being (0.2)(0.5)(1E-02/py) = (0.1)(1E-02/py).

The reduction in core-melt frequency predicted is then (assuming a base-case core-melt frequency given an SGTR of 2.5E -04/py as in previous issues):

(0.1)(1E-02)(2.5E-4) = 2.5E-07/py

- 159 -

S. a The relative contributions by release category are PWR-2 = 9.0E-8/py and PWR-4 = 1.6E-07/py, assuming a 36% and 64% split, respectively, between the two release categories as with other SGTR issues. The risks associated with this reduction will be presented below even though the inital NRC evaluation put the risk reduction as negligible.

3.7.2.4.2 RISK EVALUATIONS Fatalities associated with the release categories for the reference site are used here to estimate reductions in acute and latent fatalities as a result of the reduced frequency of core-melt.

3.7.2.4.2.1 Individual Risks The risks to the average individual within one mile of the site boundary and beyond a one-half mile exclusion zone are tabulated below.

The early fatality probabilities for individuals within one mile of the exclusion boundary are assumed:

Release Early Fatality Man-Rem Category Probability per Event per Event PWR-2 1.67E-02 3.09E+04 PWR-4 1.88E-02 3.78E+04 The reduction in early individual fatalities (EF) is:

P(EF/2) = (9.0E-08/py)(1.67E-02) = 1.50E-09 fatalities /py P(EF/4) = (1.6E-07/py)(1.88E-02) = 3.00E-09 fatalities /py 4.50E-09 fatalities /py The reduction in individual man-rem exposure within the one mile radius (MR) is:

P(MR/2) = (9.0E-08/py)(3.09E+04) = 2.78E-03 man-rem /py P(MR/4) = (1.6E-07/py)(3.78E+04) = 6.05E-03 man-rem /py 8.83E-03 man-rem /py 3.7.2.4.2.2 Societal Risk Estimates The societal risk to the public within 50 miles of the plant site is based on the probability of latent cancer fatality.

- 160 -

r * .- .s I

l The following. societal 11atent fatality (SLF) probabilities for the public within 50 miles of the exclusion boundary are:

l Release Total Latent Fatality Man-Rem Category Probability per Event per Event PWR-2 s 1.39E-04 4.8E+06 PWR-4 5.62E-05 2.7E+06 The reduction in total societal latent fatalities is:

P(SLF/2) = (9.0E-08/py)(1.39E-04) = 1.25E-11 fatalities /py P(SLF/4) = (1.6E-07/py)(5.62E-05) = 8.99E-12 fatalities /py 2.15E-11 fatalities /py The reduction in total societal man-rem exposure within the 50 mile radius

, (50MR) is:

P(50MR/2) = (9.0E-08/py)(4.8E+06) = 4.3E-01 man-rem /py

-P(50MR/4) = (1.6E-07/py)(2.7E+06) = 4.3E-01 man-rem /py 8.6E-01 man-rem /py 3.7.2.4.2.3 Occupational Raolological Exposure Estimates of occupational aose due to implementation of the above staff position and due to maintenance and operation have been combined and are included below.

Per Plant Occupational Risk Reduction Due to Accident' Avoidance Given the estimated reduction in core-melt frequency of 2.5E-07/py and the estimated occupational dose of 19,900 man-rem / core-melt the estimated reduction in occupational-radiation exposure due to accident avoidance is 4.98E-03 man-rem /py or .14 man rem per plant over 27.7 years.

Per Plant Utility Dose Increase for Implementation. Operation and Maintenance The NRC indicated that the increase in ORE associated with a maximum 72-month inspection intarval would not be expected to be significant since the total number of inspections will increase by only a small percentage. Therefore, no increase in ORE has been identified. However, the SAI analysis did estimate that a single-entry full-length inspection of a 3 percent sample of tubes will increase ORE by 0.4 to 1.0 man-rem per plant year. In the case where a separate. entry in the opposite leg is necessary the inspection will j increase ORE by 1.6 to 12 man-rem per plant year. Although this separate 1

- 161 -

l

- _ _ - . , ._ , -_._.- ._ __,~. _ _ _ _ _ _ , _ _

O O entry should generally not be necessary these latter figures will be used as an upper bound.

The avoided annual ORE is estimated to be .3 to 3 man-rem for assumed reductions in forced outage frequencies of 1 and 10 percent, respectively.

Total Occupational Dose Increase for Operation and Maintenance The total ORE increase is then estimated at .4 to 1 man-rem /py or 11 to 28 man-rem over the 27.7 years of expected plant life. The upper bound on these figures is 44 to 332 man-rem. When including the avoided doses the total dose increase over the 27.7 years is 3 to -55 man-rem or the upper bound is 36 to

'249 man-rem. The negative value indicates a dose savings.

3.7.2.4.3 DEFENSE IN-DEPTH The role of the steam generator tube integrity and plant features to mitigate the effects of a SGTR are the same as that developed for the SWC and CISI programs.

3.7.2.4.4 BENEFIT / COST (VALUE/ IMPACT) ,

The benefit-cost comparisons are presented in this section. Benefit and cost estimates are also based on SAI and NRC input.

3.7.1.4.4.1 Benefits Estimate For the purpose of comparison with the Safety Goal Benefit-Cost guidelines, the benefit (value) is based on the averted societal risk within a 50 mile radius of the site boundary. Values presented here are in tern:s of averted risk over the remaining lifetime of the power plant (27.7 years for PWRs).

Release Reduction in Man-Rem Man-Rem Category Core-Melt Frequency per Event per py PWR-2 9.0E-08 4.8E+06 43 PWR-4 1.6E-07 2.7E+06 .43 Total .86 Over the remaining lifetime of 27.7 years, this is an averted risk of approximately 24 man-rem / plant.

- 162 -

0 o%

3.7.2.4.4.2 Cost Estimates The economic benefits of implementing the full length inspection and the maximum steam generator inspection interval programs are the avoidanct of forced outages due to leaks, tube ruptures, SG replacement and derating. The approach here is to determine costs for implementing these programs as well as the cost benefits due to avoided maintenance and outages.

INDUSTRY COSTS Per-Plant Plant Industry Costs for Implementation, Operation and Maintenance The incremental cost of the proposed full length inspection is $9E+03 to

$15E+03'per year. Since it is not anticipated that the total number of inspections will increase substantially for the maximum steam generator inspection interval no additional costs have been anticipated for this portion of the issue.

Total Per-Plant Industry Costs Discounted values for the full length inspection program are $1.33E+05 to

$2.22E+05/ plant over the 27.7 years at a 5% discount rate.

Avoided Costs The estimated avoided costs from 1 and 10 percent reductions in .requency of leak repairs, assuming a 14 day outage to repair the leaks, over a 27.7 year period, are $0.35E+06/ plant-to $3.0E+06/ plant respectively. The economic costs appear to be offset by the economic benefits for this portion of the issue.

Per-Plant Industry Savings Due to Accident Avoidance Given the estimate costs associated with core-melt as $1.65E+09 and the predicted reduction in core-melt frequency, the cost savings due to accident avoidance is:

(2.5E-07/py)($1.65E+09) = $4.13E+02/py or $1.14E+4/ plant over 27.7 years.

NRC COSTS The NRC cost involves plant-specific reviews and amendments to plant STS.

The estimated implementation cost is $11.5E+03/ plant. Recurring and potential annual problems are estimated to require an incremental cost of

$3800/py. The initial and annualized NRC cost is estimated at $0.1E+06/ plant The discounted value for annual costs plus the implementation cost results in a total NRC cost of $6.78E+04/ plant.

! - 163 -

L

1

%. cs 3.7.2.4.4.3 Value/ Impact Assessment The benefit / cost ratio is based on the averted risk estimate accounting for the reduction in risk over the entire remaining lifetime of the affected plants as well as the costs to the utilities and the NRC for implementation and maintenance of the staff position. An upper bound value is used for the utility costs and the discounted NRC costs are then ($2.22E+05 + $6.78E+04) =

$2.90E+5.

Benefit = 24 man-rem = .08 man-rem Cost $2.90E+05 $1000 3.7.2.4.5 UNCERTAINTIES Uncertainties have been cited in previous evaluations of portions of the SGTR issue. These apply to this portion of the issue as well. In addition, the number of affected plants for this portion of the issue remains uncertain.

Information is given which summarizes current industry practice (e.g. cold legs are always inspected at 32 Westinghouse (W) and 7 Combustion Engineering (CE) steam generators, cold legs are sometimes inspected at 27 (W) and 2 (CE)

SG, etc.). However, the number of affected plants and to what extent they are affected would need to be established to ascertain total industry benefit or cost.

3.7.

2.5 CONCLUSION

S The results of this evaluation are summarized in the following tables.

Results relative to the primary design objectives reveal the change in acute and latent fatalities due to implementation of the NRC staff position. The information in the following tables is presented on a per plant basis over the 27.7 year life expectancy for the affected plants.

3.7.2.5.1 STATEMENT ON PRIMARY DESIGN OBJECTIVE The compariscns below indicate that the early fatality estimate represents approximately 1 percent of the design objective for individual risk. The latent fatality estimate over 50 miles represents 1E-03 percent of the design objective for societal risk.

TABLE 3.7.2.1 Primary Design Objective Item Individual Risk Societal Risk (man-rem) (fatalities) (man-rem) (fatalities)

Safety Goal SE-07/py 2E-06/py Staff 8.83E-03/py 4.50E-9/py 8.6E-01/py 2.15E-11/py Position

- 164 -

g- .,,,

3.7.2.5.2 STATEMENT OF SUB-ORDINATE DESIGN OBJECTIVE The sub-ordinate design objective expresses a ratio of man-rem of societal exposure averted to the utility and NRC cost. The safety goal guideline is 1 man-rem averted per $1000 cost. The resulting sub-ordinate design objective for this issue is approximately 8 percent of the guideline.

TABLE 3.7.2.2 Sub-Ordinate Design Objective Item Benefit / Cost Safety Goal 1 man-rem averted /$1000.

Staff Position .08 man-rem averted /$1000.

Again, it should be noted that avoided costs are not included.

3.7.2.5.3 STATEMENT OF PLANT PERFORMANCE DESIGN OBJECTIVE The plant performance design objective presents the reduction in core-melt frequency estimated as a result of issue implementaticn. Implementation of the issue represents approximately 0.3 percent of the plant performance design objective.

TABLE 3.7.2.3 Plant Performance Design Objective Item Change in Core-Melt Frequency Defense-in-Depth Safety Goal 1E-04/py --

Staff Position 2.5E-07/py --

- 165 -

e-

% +

3.7.3 COOLANT IODINE ACTIVITY LIMITS 3.7.

3.1 BACKGROUND

Activity circulating in the primary coolant system of a PWR may be available for release from the secondary side in the event of a steam generator tube rupture (SGTR). This release pathway into the secondary side is considered the limiting accident for PWRs.

Some PWRs currently have Technical Specification limits and surveillance requirements that are less restrictive than the Standard Technical Specification requirements. Ten operating PWRs currently do not have limiting conditions for operation (LCO) covering coolant iodine activity and surveillance requirements, and one PWR has an inadequate LC0 as judged by the NRC.

The potential need for LCOs has been raised in the past. In light of SGTR incidents at Point Beach 1, Surry 2, Prairie Island 1, and Ginna this issue has been identified as part of the A-3, A-4, A-5 USI requirements. This issue is related to Generic Safety Issue #74, (" Proposed Technical Specifications for Primary and Secondary Coolant Activity Limits,"

NUREG-0933) which applies to BWR LCOs. This will be developed further below.

In addition, an evaluation of accident progression following several tube rupture incidents (i.e. Ginna) indicated that under certain accident scenerios, the operational procedures at some plants for dealing with SGTR appear to be capable of aggravating the potential for steam generator ,

overfill, secondary side PORV lift, and sustained release to the environment. '

Present SGTR emergency operating procedures proposed by many licensees require manual RCP trip if pressure drops sufficiently during the accident.

Plants that have low-head high pressure safety injection pumps are more likely to require RCP trip following a SGTR than plants with high-head pumps.

This in turn increases the potential for void formation, sustained leakage to the secondary side, and potential steam generator overfill following the SGTR. Significant release to the environment would then require a secondary side PORV to lift and stick open. Unfavorable meteorological conditions can then add-further to the possible radiation doses from the release.

The new specifications for coolant activity would then apply to all PWRs, with stricter provisions and operating procedures proposed for the low-head SI PWRs thought to be more susceptible to SG overfill following a SGTR.

3. 7. 3. ?, SAFETY SIGNIFICANCE As mentioned above, a transfer of primary water to the steam generator shell occurs during a SGTR accident. This primary water is contaminatea with fission products from the reactor core, with the primary health hazard being i

- 166 -

l

s, e the potential for exposure to the entrained iodine products. The potential then exists for an uncontrolled release of this contaminated secondary water and steam to the outside environment. This release requires some further breach of the secondary piping, or the lifting of relief valves on the secondary side. The Ginna incident was an example of the latter scenerio, with the PORV lift occuring due to steam genrator overfill, followed by sticking of the PORV and a sustained release.

Plants currently operate with coolant activities significantly below the proposed specifications. Operation at elevated levels is however possible for short periods of time. Implementation of this issue is thus not likely to reduce the frequency of tube ruptures or the magnitude of the release under normal conditions, but is directed primarily at reducing the potential for large. releases occuring during periods of higher than normal coolant activity levels.

3.7.3.3 REQUIREMENTS This issue proposes to:

All PWRs with Technical Specifications limits and surveillance requirements for coolant iodine activity limits that are less restrictive than the Standard Technical Specifications will conform with the STS.

Further, those plants identified above that also have low-head high pressure safety injection pumps will either:

1) limit the potential for releases by lowering the allowable operational limits for iodine in the primary coolant to 20% of the LC0 (IE-06 Ci/ gram of primary coolant), or

2) commit to implementation of the reactor coolant pump trip criteria which will ensure that if offsite power is retained, no loss of forced reactor coolant system flow will occur for SGTR events up to and including the design-basis double-ended break of a single tube, and implement iodine limits consistent with the LCO.

3.7.3.4 EVALUATIONS This section evaluates the potential reduction in core-melt frequency, individual and societal risks, and occupational radiation exposure due to implementation of the above staff position for coolant iodine activity limit.

Cost estimates for the implementation and maintenance of this program are addressed, and finally, a value/ impact figure is developed based upon the results obtained from the above calculations. Information available from SAI and NRC analyses will be utilized in the development of these values.

- 167 -

t. ,%

3.7.3.4.1 CORE-MELT FREQUENCY ESTIMATES Some plants with low-head high pressure safety injection pumps currently respond to a SGTR with RCP trip and safety injection. However, the NUREG-0844 analysis indicates that this response can lead to a higher hot-leg temperature in natural circulation compared to forced cooldown with the RCPs.

This higher pressure and continued safety injection can lead to prolonged leakage into the steam generator. The proposed issue then deals entirely with limiting leakage, or the activity in that leakage.

The SGTR event in itself is a precursor to possible core damage and additional release of fission products. However, the implementation of the STS with its LOC for iodine activity and procedures following a SGTR impact on19 the potential for release of iodine and noble gas inventories entrained in the primary coolant immediately following a SGTR. They would not impact any progression of sequences to core-melt.

The safety goal evaluation format as it is currently structured reflects only the public dose as a result of core-melt accident scenerios. The procedure expressed above has no impact on potential core-melt scequences for any PWR, as was recognized in the priority analysis of Generic Safety Issue #74 and Issue B-65 on Iodine Spiking. The change in affected core-melt frequency due to the implementation of this issue is therefore zero.

An estimate will be made here however of the possible public dose reduction associated with non core-melt releases.

3.7.3.4.2 RISK EVALUATIONS Fatalities associated with release categories for the reference site are used here to estimate reductions in acute and latent fatalities as a result of the reduced frequency of core-melt.

3.7.3.4.2.1 Individual Risks The reduction in individual risks from core-melt due to implementation of this issue are zero. An estimate is given below applicable to exposure from non core-melt releases.

3.7.3.4.2.2 Societal Risk Estimates For non core-melt doses, the public dose associated with releases has been estimated in NUREG-0844 as well as for Safety Issues A-47 and 8-65. The approach taken here will be to bound the possible dose reduction associated the above analyses. This approach will consist of the following:

1) Frequency of the initiating event

2) Magnitude of the iodine equivalent release

- 168 -

3) Conversion from thyroid dose to man-rem public dose

4) % effectiveness in reduction of this dose with issue implementation.

The steps are developed further below.

Initiating Event Frequency NUREG-0844 puts the frequency of non core-melt SGTR events at 1.3E-03/ry. A frequency of 2E-02/ry for SGTR with a 10% probability of PORV lift and sticking open is suggested here, for a frequency of 2E-03/ry. The probability of PORV failure to reseat given lift is typically put at 0.02.

Thus, even assuming a probability of 1 for PORV lift given SGTR, the

-frequency of this event would be (2E-02/py)(1)(0.02) = 4E-04/py. The above estimate is thus likely to be conservative by a factor of 5, but will be used here for simplicity, as developed below. This issue then deals primarily with the subsequent release of entrained iodine in the coolant during off-normal conditions with concentrations higher than normal. The LCOs allow operation for 5% of the time at elevated levels, so it will be assumed that the plant will be vulnerable to a SGTR while at elevated levels with a frequency of (0.05)(2E-03/ry) = 1E-04/ry.

Magnitude of Iodine Release NUREG-0844 estimated the release associated with a non core-melt SGTR scenerio at 53,600 Ci of iodine. The SGTR incident was estimated to have release from 106 to 5000 Ci, depending on the assumptions used in the analysis.

With the exception of several worst cases, the observed coolant activity levels in PWRs currently range from 0.01 to 0.1E-06 Ci/ gram of coolant, compared to the 1.0E-06 Ci/ gram level allowed by the LCO. Only at Ginna and Oconee 1 have' coolant concentrations been seen in the 0.5E-06 Ci/gr range.

Spiking of iodine coolant concentrations have then been observed ranging from a factor of approximately 10 to 1000, with the larger values typically associated with lower equilibrium levels. For plants at 0.5E-06 Ci/ gram, a spiking factor of 20 was proposed, giving a concentration of 10.0E-06 Ci/ gram. The NRC best estimate for an average coolant concentration was put at 0.1E-06 Ci/ gram with a 20% probability of a spiking factor reaching 500, again giving an estimated coolant concentration of 10.0E-06 Ci/ gram.

A conservative estimate of the magnitude of the release from an accident like the Ginna incident can then be made based on the calculated loss of primary

-coolant. This was put at 18,300 gallons, or 7E+07 grams of water. Note here that this represents leakage to the steam generator shell. The actual loss of water past the PORV was put at approximately half the above with partitioning and dilution, further reductions in radio-iodine activity per

- 169 -

L-p  :+ -

m W

W. J.

unit flow past the PORV would be expected. Using the primary leakage however then gives an estimated loss of (10.0E-06 Ci/ gram)(7E+07 grams) = 700 Ci.

The expected range for the release is then again 106 to 5000 Ci, with 700 Ci as the best estimate. The 53,600 Ci release is apparently associated with SGTR scenerios that lead to core damage, which would require further safety system failures. This would effectively reduce the expected frequency of such events by several orders of magnitude below that of a simple SGTR. The 5000 Ci per event release will, therefore, be used here as the upper bound.

Conversion to Public Dose Based on the information in NUREG/CR-0651 for a SGTR at Prairie Island 1, a release of 2.1E-04 Ci of I-131 was estimated to result in a public dose exposure of 4.3E-06 rem to the thyroid. Issue II.A.1.3,-Potassium Iodide Blocking Agents, developed a further reduction factor of 100 thyroid-rem.per man-rem based on the assumption that health effects due to thyroid dose are 95% curable, and that whole body doses are given 5 times the weighting of thyroid doses in protective action guides (NUREG-0654, 1980) (i.e. 0.05/5 =

0.01). The estimated conversion factor is then 2.0E-04 man-rem /Ci released.

Estimated Public Dose The estimated public dose per release then ranges from (106 to 5000 Ci)(2.0E-04 man-rem /Ci) = 0.02 to 1 man-rem per event. The 53,600 Ci release for non core-melt SGTR events would give an absolute upper bound of 11 man-rem where the accident progresses to fuel damage. The 1 man-rem / event upper bound due to entrained iodine activity will be used here. The annual dose committment associated with this issue then ranges from 2E-06 man-rem /ry to 1E-04 man-rem /ry.

Implementation of this issue would possibly result in some reduction of the public dose estimated above. This is bounded by simply assuming that the entire 1E-04 man-rem /ry is attributable to this issue. Over 27.7 years, this is then approximately 3E-03 man-rem per plant.

3.7.3.4.2.3 Occupational Radiological Exposure Per-Plant Occupational Risk Reduction Due to Accident Avoidance Dose reduction due to core-melt avoidance is again zero.

Per-Plant Utility Dose Increase for Issue Implementation Zero

- 170 -

% . - p.

Per-Plant Occupational Dose Increase for Issue Operation and Maintenance The NUREG-0844 analysis indicated that a small increase in ORE would be likely from increase primary coolant sampling, however this could all be attributed to Issue #74 (NUREG-0933).

It would not be likely that there would be an increase in shutdowns to meet the new iodine specifications, but some of the low-head plants restricted to 20% of the STS may require additional shutdowns. Shutdowns to replace leaking fuel elements were estimated in NUREG-0844 to result in 25 to 60 man-rem.

No estimate of dose reduction associated with this was given in the NUREG-0844 analysis. If any shutdowns are required, it is. believed that this would

.be restricted to one or two of the worst PWRs, which may not be low-head SI plants. It was also noted that changes in the RCP trip procedures would remove the 20% LC0 criteria for the affected plants. This easier approach would eliminate any likely dose increase attributed to this issue alone.

Total Occupational Dose Increase for Operation and Maintenance This is therefore estimated at zero.

3.7.3.4.3 DEFENSE IN DEPTH Again this issue does not impact progression to core-melt. However, the procedures for RCP trip certainly help to limit the potential for leakage to the secondary side in the case of a SGTR. The more frequent testing required for the restrictive LCOs also are of use in dectecting leakage to the secondary side. This may provide an early indication of deteriorating tube conditions and help prevent more serious tube ruptures that represent core-melt sequence precursors.

3.7.3.4.4 BENEFIT / COST (VALUE/ IMPACT)

The benefit-cost comparisons are presented in this section. Benefit and cost estimates were made based on information in NUREG-0844.

3.7.3.4.4.1 Benefits Estimate As per the evaluation guidelines, the public benefit associated with this issue is put at zero. The reduction of non-core melt dose is estimated at 3E-03 man-rem per plant.

- 171 -

! o. , e 3.7.3.4.4.2 Cost Estimates The costs associated with the implementation and maintenance of the program for uniform technical specifications on iodine activity in the coolant as well as cost benefits due to avoided maintenance and outages will be developed here.

INDUSTRY COSTS j

Per-Plant Industry Costs for Implementation, Operation and Maintenance The plant lifetime cost for expanded coolant surveillance programs is put at

$400,000. No costs were thought to be associated with the more restrictive LCOs for iodine. No cost was given for development of a better RCP trip criteria. Any costs for the trip criteria will likely be associated with NRR's Multi-Plant Action Item G-1.

Total Per-Plant Industry Costs Total utility costs are then estimated at $400,000 per affected plant.

Avoided Costs Implementation of this issue will not impact down time. The avoided costs are put at zero.

Per-Plant Industry Savings Due to Accident Avoidance l Zero NRC COSTS NRC Costs for Issue Develooment and Imolementation I None Per-Plant NRC Cost for Review of Issue Ooeration and Maintenance None Total NRC Costs None Total Costs The cost estimate used for comparison to the guidelines then includes total industry and NRC costs. This estimate is $400,000 per affected plant.

- 172 -

c. e l

l 3.7.3.4.4.3 Value/ Impact Assessment The benefit / cost ratio is based on the averted risk estimate accounting for the reduction in risk over the entire remaining lifetime of the affected plants as well as costs to the utilities and the NRC for implementation, operation and maintenance of the requirements. It should be noted that this isue in fact has no reduction in estimated pablic dose due to core-melt. The estimated reduction in off-site releases due to non-core melt accidents is j given for comparison.

In establishing the benefit to cost ratio a total per plant public risk reduction of 3E-03 man-rem is used. THe cost figure of $0.4E+06 represents the summation of utility and NRC costs en a per plant basis.

Benefit = 3E-0'3 man-rem = 7.5E-06 man-rem Cost $0.4E+06 $1000 (non core-melt public exposure) 3.7.3.4.5 UNCERTAINTIES This issue does not apply directly to core-melt scenerios. The estimates given above again apply to non core-melt releases which are very sensitive to the following factors:

- primary coolant iodine activity concentrations spiking of iodine concentrations above normal levels leakage rates of primary coolant tc the secondary side via the SGTR mixing or partitioning of the activity in the SG shell plate-out of activity in the SG shell release rates and duration past a valve site meteorology and transport.

Operational experience with the iodine concentrations alone indicate that most PWRs operate at several orders of magnitude below the LCOs. The other steps involved in the release path indicate that the iodine related doses would be significantly below those estimated here. In addition, the operator has the ability to block leaking PORVs or direct ;econdary side flow through the condenser. This could significantly reduce any release through entrainment, pate-out and holdup processes.

3.7.

3.5 CONCLUSION

S This issue does not impact core-melt directly and thus does not fit into the specified guidelines for this evaluation with respect to the safety goal. A deterministic calculation can show that significant iodine-thyroid doses can be reached at the exclusion area boundary given conservative assumptions for

- 173 -

• . . p I

coolant iodine activity, primary to secondary leakage, little partitioning of

- coolant in the SG shell, prolonged leakage past a relief valve, and conservative transport meteorology. However a probabilistic calculation I ', based on f:est estimates for the above variables will lower these postulated l iodine-thyroid doses significantly. A better estimate for non core-melt i

iodine exposures associated with this issue is thus likely an order of magnitude or more below the 1E-04 man-rem /py level estimated here.

, Careful monitoring of coolant actitivies is a prudent activity for fuel l j.-management, and changes in the secondary side-concentrations may provide an indication of tube failures that would help prevent more serious ruptures.

O The imposition of RCP operating procedures on the low-head SI plants would likely be prudent to reduce the potential for secondary side leakage, but only if this procedural change did not adversely. impact the response to other.

more serious accident precursors.

3.7.3.5.1 STATEMENT ON PRIMARY DESIGN OBJECTIVE The orimary design objective relates to the reduction in risk of early fatality for individuals located within one mile of the plant, and reduction l in latent fatalities for the general society within 50 miles of the plant.

l l TABLE 3.7.3.1 Primarr Desian Objective 1

l Item Individual Risk Societal Risk l (man-rem) (fataliti%>) .(man-rem) (fatalities)

Safety Goal SE-07/py f 2E-06/py Staff -

0/py 1E-04/py 0/py Position '

3.7.3.5.2 STATEMENT OF SUB-ORDINATE DESIGN OBJECTIVE 1

The subordinate design objective expresses a ratio of man-rem of societal I exposure averted to the industry and utility cost. The safety goal guideline l is 1 man-rem averted per $1000 cost.

l This issue again results only'in non core-melt exposure, but this is given below for comparison.

1 E ,

,a r

- 174 -

*. an l

TABLE 3.7.3.2 Sub-Ordinate Design Objective Item Benefit / Cost

' Safety Goal 1 man-rem averted /$1000 l

Staff Position 3E-05 man-rem averted /$1000.

3.7.3.5.3 STATEMENT OF PLANT PERFORMANCE DESIGN OBJECTIVE The plant performance design objective presents the reduction in core-melt frequency estimated as a result of issue implementation. Implementation of the issue again does not impact core-melt frequency.

TABLE 3.7.3.3 Plant Performance Design Objective Item Change in Core-Melt Frequency Defense-in-Depth Safety Goal 1E-04/py --

! Staff Position 0/py --

l

)

0

- 175 -

• • . o, 3.7.4 PRIMARY-TO-SECONDARY LEAKAGE RATE LIMITS 3.7.

4.1 BACKGROUND

Leakage rate limits have been shown to provide important information relative to steam generator tube degradation rates. Operating experience has shown that some forms of degradation can develop in time periods which are shorter than inspection intervals or that it may be difficult to detect degraded conditions using standard eddy current techniques. In this case the leakage rate is a potential indicator of problems which could suggest shutdown, inspect'or some corrective action.

Not all plants are currently required to comply with the latest revision of  !

the Standard Technical Specifications (STS) concerning leakage rates. In I some cases leakage rate limits may be higher than specified in the STS. The i proposed action would require that leakage rate limits at all plants be consistent with the specifications.

l 3.7.4.2 SAFETY SIGNIFICANCE Safety concerns relative to steam generator tube degradation or rupture have been discussed in previous evaluations. Similar concerns are applicable to this issue as well. In addition, consistency with the specifications will help to ensure that dose contributions from tube leakage will be limited to a small fraction of the specified limits during either a tube rupture or a steamline break, and that steam generator tube integrity will be maintained l in the event of a main steamline break or loss of coolant accident.

3.7.4.3 STAFF POSITION "All PWRs that have Technical Specifications (TS) limits for primary-to-1 secondary leakage rates which are less restrictive than the Standard Technical Specification (STS) limits should revise their TS to incorporate the STS limits.

3.7.4.4 EVALUATIONS This section evaluates potential reduction in core-melt frequency, individual and societal risks, and occupational radiation exposure due to issue implementation. In addition, cost estimates for implementation and .

maintenance are included along with value/ impact figures.

3.7.4.4.1 CORE-MELT FREQUENCY ESTIMATES The analysis in NUREG-0844 does not directly present an estimate of reduction in core-melt frequency associated with this issue. However, a public exposure reduction of 0.7 man-rem /py is given. Based on the SAI analysis of l'

- 176 -

u .

%. 3 iodine STSs, which associated a 0.5 man-rem /py dose reduction with a core-melt frequency of 1E-07/py, this issue indicates a core-melt frequency reduction of (0.7/0.5)(1E-07/py) = 1.4E-07/py.

Referring to the PNL analysis of Visual Inspection and QA, a 3.88 man-rem /py public exposure was based on a change in core-melt frequency of 1.13E-06/py.

This ratio predicts a core-melt frequency of 2E-07/py for a 0.7 man-rem /py dose. For simplicity, a 0.5 man-rem /py dose and 1.5E-07/py core-melt frequency will be assumed.

Additional, NRC evaluations showed no significant risk reduction identified with this issue. In support of this statement it should be recognized that the accuracy with which leaks due to tube degradation can be detected has not been identi.fied. It is also uncertain that detectable leakage necessarily preceeds a tube rupture. Increases in leakage may indicate a general deterioration in the integrity of the generator. However, detection based on the ' leak before break' philosophy is not accepted at this time.

However, as an upper bound, the change in core-melt frequency for the primary-to-secondary leakage rate limits of 1.5E-07/py will be used for this analysis.

• 3.7.4.4.2 RISK EVALUATIONS The individus) and societal risk estimates will simply be based on the results of the secondary side Visual Inspecticn and QA for Loose Parts issue.

The risk estimates from this issue will be ratioed to the estimated change in core-melt frequency between the two issues, or by a factor of (1.5E-07/1.13E-

06) = 0.133. -

3.7.4.4.2.1 Individual Risks The reduction in early fatalities is estimated at (0.133)(2.03E-08' fatalities /py) = 2.7E-09 fatalities /py.

The reduction in individual man-rem exposure within the one-mile radius is estimated at (0.133)(3.97E-02 man-rem /py) = 5.3E-03 man-rem /py.

3.7.4.4.2.2 Societal Risk Estimates The reduction in total latent fatalities is put at (0.133)(9.68E-11 fatalities /py) = 1.3E-11 fatalities /py.

I

- 177 -

J

% .. o.

The reduction in societal exposure is put at (9.133)(3.88 man-rem /py) = 0.5 man-rem /py.

This totals to 14 man-rem / plant over 27.7 years.

3.7.4.4.2.3 Occupational Radiation Exposure Implementation of STS for primary-to-secondary leakage will result in a negligible incremental occupational dose. The avoided occupational dose for plants currently without STS is approximately 1 man-rem / year or less than 27 over the 27.7 years of remaining life.

3.7.4.4.3 DEFENSE IN DEPTH The role of the steam generator tube integrity and plant features to mitigate the effects of a SGTR are the same as that developed for previous evaluations associated with the steam generator.

3.7.4.4.4 BENEFIT / COST (VALUE/ IMPACT)

The benefit-cost comparisons are presented in this section. Benefit and cost estimates were made based on SAI and NRC data.

3.7.4.4.4.1 Benefits Estimate The net reduction in core-melt frequency and the associated man-rem per event is considered negligible in this issue. An upper bound for those few plants which do not currently have technical specifications was estimated to be approximately 1.5E-07/py and 0.5 man-rem per plant year for core-melt and public exposure, respectively. This is an averted risk of less than 14 man-rem over 27.7 years.

3.7.4.4.4.2 Cost Estimates INDUSTRY COSTS Per-Plant Industry Costs for Implementation, Operation and Maintenance The one time labor cost to develop and document leakage assessment procedures is approximately 1 man-week / year or $2270/ year. Recurring costs to perform all sampling and analysis include approximately 1 man year or $100,000/ year and $1,000/ year in materials. These figures were obtained from the SAI evaluation and corrected to reflect the cost of man power estimates consistent with current cost assumptions.

- 178 -

l

ca. -,.

r Total Per-Plant Industry Costs The discounted value for recurring costs plus the one time labor cost over the remaining 27.7 years is approximately $1.2E+06/ plant.

Avoided Costs Using SAI. figures again as an upper bound and correcting for the remaining lifetime of affected PWRs, the avoided, costs assuming 60 days.are required to repair SGTR over 27.7 years, is $1.6E+06/ plant.

Per-Plant Savings Due to Accident Avoidance This.value is negligible since change in core-melt is not considered

.significant.

NRC COSTS It is assumed that NRC costs for this issue will not exceed those estimated for the full length tube inspection program. Therefore, those costs will be

~

used as an upper bound for this evaluation. Total NRC costs are then estimated at $6.78E+04/ plant for affected plants only. This will include any necessary plant-specific reviews and amendments to plant STS as well as recurring costs for associated problems.

3.7.4.4.4.3 Value/ Impact Assessment Based on a negligible averted risk this figure is also considered negligible.

'For the~ upper bound case (14 man-rem averted risk), the value/ impact assessment is (14)/($1.2E+06 + $6.78E+4) = 0.01 man-rem /$1000.

3.7.4.4.5 UNCERTAINTIES

-Uncertainties applicable to other SGTR issues are also applicable here. In addition, there is little evidence that would support any significant core-melt change for this issue. The question of leak-before-break has not been answered for steam tube ruptures, along with the ability to detect the leakage rates of interest in an accurate and timely fashion.

3.7.

4.5 CONCLUSION

S Based on the values and comparisons shown in the following Tables, this issue does not favorably compare with the Safety. Goal design objectives.

- 179 -

s. e 5 TABLE 3.7.4.1 Primary Design Objective Item Individual Risk Societal Risk (man-rem) (fatalities) (man-rem) (fatalities)

Safety Goal SE-07/py 2E-06/py Staff 5.3E-03/py 2.7E-09/py 0.5/py 1.3E-11/py Position

. TABLE 3.7.4.2 Statement of Sub-Ordinate Design Objective Item Benefit / Cost Safety Goal 1 man-rem averted /$1000 Staff Position worst case = .01 man-rem averted /$1000 TABLE ~3.7.4.3 Statement of Plant Performance Design Objective Item 1 Change in Core-Melt Freauency Defense-in-Depth Safety Goal 1E-04/py- --

Staff Position '1.5E-07/py --

- 180 -

L -

bh gS

• 3.7.5 EVALUATION OF SAFETY INJECTION RESET 3.7.

5.1 BACKGROUND

This evaluation addresses the need to review the control logic associated with the safety injection (SI) reset. A potential problem was recognized at the Ginna plant when it was necessary to switch the high-head SI pump (HHSIP) suction from the boric acid storage tank (BAST), which was near depletion, to the refueling water storage tank (RWST). The system will automatically switch over upon low BAST level should the SI signal not be reset. However, when it is reset there is a requirement of the operator to ensure that suction from the HHSIP is not lost. Failure to do so could cause damage to the SI pump. Improvement may be achieved if automatic transfer from the BAST to the RWST is provided upon low BAST level under all operating conditions.

3.7.5.2 SAFETY SIGNIFICANCE The major value of the proposed action is that it reduces the potential for loss of the SI function in an accident scenerio. Failure of the SI pumps is a common-mode effect that could cause the high pressure coolant inventory controls to fail and thus increase the adverse consequences of an SGTR. The risk associated with a SGTR would then increase as well. The safety concerns relative to SGTR are consistent with those presented in previous evaluations.

Improvement in the automatic transfer is desirable since the BAST level may not drop to the low switchover setpoint until 20 to 30 minutes after the SGTR, during which time the operators cannot reset SI. Howev,er, SI must be reset before containment isolation (CI) can be reset, and CI reset allows the operation of systems that mitigate the consequences of SGTR.

3.7.5.3 STAFF POSITION "The control logic associated with the safety injection pump suction flow path should be reviewed and modified as necessary, by licensees, to minimize the loss of safety function associated with safety injection reset.

Automatic switchover of safety injection pump suction from the BAST to the RWST should be evaluated with respect to whether the switchover should be made on the basis of low BAST level alone without consideration of the condition of the SI signal."

3.7.5.4 EVALUATIONS This section evaluates potential reduction in core-melt frequency, individual and societal risks, and occupational radiation exposure due to issue implementation. In addition, cost estimates for implementation and maintenance are included along with value/ impact figures.

- 181 -

t

)

r

%% y-3.7.5.4.1 CORE-MELT FREQUENCY ESTIMATES The WASH-1400 estimate for the probability of operator failure to establish SI pump alignment prior to reset (0.01) is used as a measure of the improvement expected with automation of the SI suction alignment. Where operator action is required, an upper bound for the reduction in frequency of core-melt resulting from the proposed change was determined. A public dose reduction of less than 0.05 man rem /py was estimated. Based on the analysis of the Secondary Side Visual Inspection and QA issue and the approach used for the Primary-to-Secondary Leakage Rate Limits issue, the 0.05 man-rem /py dose will be assumed to be associated with a core-melt frequency reduction of 1.5E-08/py.

3.7.5.4.2 RISK EVALUATIONS The individual and societal risk estimates will simply be based on the results of the Secondary Side Visual Inspection and QA for Loose Parts issue, along with the Primary-to-Secondary Leakage Rate Limits issue. In the absence of any detailed analysis of this issue in NUREG-0844, the estimate was made that a 0.5 man-rem reduction in public exposure correlated with a reduction in core-melt of 1.5E-07/py. In this issue, a 0.05 man-rem /py reduction will be assumed to result from a 1.5E-08/py reduction in core-melt frequency. The estimate of individual and societal risks will then be ratioed to the-Inspection and QA issue by the core-melt frequencies, or (1.5E-08/1.13E-06) = 0.0133 3.7.5.4.2.1 Individual Risk The reduction in early fatalities is estimated at (0.0133)(2.03E-08 fatalities /py) = 2.7E-10 fatalities /py The reduction in individual man-rem exposure within one mile of the side boundary is estimated at (0.0133)(3.97E-02 man-rem /py) = 5.3E-04 man-rem /py 3.7.5.4.2.2 Societal Risk Estimates The reduction in total latent fatalities is estimated at (0.0133)(9.68E-11 fatalities /py) = 1.3E-12 fatalities /py The reduction in societal exposure is estimated at (0.0133)(3.88 man-rem /py) = 0.05 man-rem /py 4 i

- 182 -

[ . _ . _ . _. __

N%' O c This totals to 1.4 man rem over 27.7 years.

3.7.5.4.2.3 Occupational Radiation Exposure No significant ORE changes are identified to implement the staff position.

3.7.5.4.3 DEFENSE-IN-DEPTH In addition to the role of steam generator tube integrity and plant features to mitigate the effects of SGTR discussed in previous evaluations, this staff position is important in maintaining defense-in-depth of the emergency core cooling system (ECCS).

3.7.5.4.4 BENEFIT / COST (VALUE/ IMPACT)

The benefit-cost comparisons are presented in this section. Benefit and cost estimates are made based upon SAI and NRC analyses.

3.7.5.4.4.1 Benefits Estimate The reduction in core-melt frequency is put at 1.5E-08/py, with reduction in societal exposure at 0.05 man rem /py for a total of 1.4 man-rem over 27.7 years.

3.7.5.4.4.2 Cost Estimates INDUSTRY COSTS

, The only industry costs associated with this issue involve costs for valve control modifications which are dependent on the design details of the existing valve control circuits and on the number of circuits to be modified.

For one type of SI system a cost estimate of approximately $100,000 has been estimated. The NRC estimates utility costs at $20,000 per plant to implement this staff position. In this evaluation it will be assumed that these figures are bounding. The industry estimated costs of $100,000 plant are thought to better reflect the true issue cost, and will be used he(re.

NRC COSTS It is assumed that the major NRC costs for this issue are based on plant-specific reviews which will require approximately 3 man-weeks per plant. The cost, based on $2270/ man-week is $6810/ plant.

3.7.5.4.4.3 Value/ Impact Assessment Based on a negligible averted risk this assessment is also considered negligible. For the upper bound (1.4/ plant man-rem averted risk), the i value/ impact assessment ranges from (0.05)/($100,000 + $6810) = 0.01 man- l rem /$1000. Using the lower NRC estimated costs for industry implementation i give (1.4)/($20,000 + $6810) = 0.05 man-rem /$1000. l

- 183 -

Q ' y ry.

3.7.5.4.5 UNCERTAINTIES This issue does not impact the frequency of SGTR directly, but deals instead with the probability of successful response of the safety injection systems given a SGTR.- As such, the uncertainty in the previous issues associated with SGTR frequency' addressed in NUREG-0844 do not apply here. The role of the operator in aligning the SI suction is defined in WASH-1400 for the core-melt scenerios involving SGTR. As such, the uncertainty for the estimate by SAI of the potential risk reduction associated with this issue is taken to be that of the WASH-1400 study itself. This is thus considered to be a good estimate of the upper bound represented by this issue.

The cost assumed for issue implementation varies by a factor of 5 from NRC

-and utility estimates. The lower costs could improve the value/ impact ratio accordingly.

3.7.

5.5 CONCLUSION

S Based on the values and comparisons shown in the following Tables, this issue does not favorably compare with the Safety Goal design objectives.

TABLE 3.7.E.1 Primary Design Objective Item Individuai Risk Societal Risk (man-rem) [ fatalities) (man-rem) (f atali ties)

Safety Goal BE-07/py 2E-06/py Staff 5.3E-04/py 2.76-10/py 0.05/py 1.3E-12/py Position TABLE 3.7.5.2 Statement of Sub-Ordinate Design Objective i

Item Benefit / Cost Safety Goal 1 man-rem averted /$1000 Staff Position upper bound = 0.01 to 0.05 man-rem averted /$1000 t 1

- 184 -

s .

P.

TABLE 3.7.5.3 Statement'of Plant Performance Design Objective Item Change in Core-Melt Frequency Defense-in-Depth Safety Goal. 1E-04/py --

Staff Position 1.SE-08/py --

- 185 -

e

r-O_ , P.

e

. .. o r o . . w ., noc. .., . ., ,

g,,o=== u o.ucu.. ..out.ro t co ii!" % BISUOGRAPHIC DATA SHEET u s .rauct.o . o. r.. . vi... , fiUREG-1128

3. rirk No SvererL4 3 LEAVE SLA%E Tria . valuations In Comparison With The 1983 '

[j Safety als . .r. ..,0 7 co.,ario lyj1985 oo r. ....

v.u. oms, March e oars aspear issuto Robert Riggs, George Sege oo r- f v.*a I

\

i pensonwi so onommaariom =4ep. amo wa.umo acomess es= t.c ms June / 1985 a emosact,tasa.vegna umi muwata Division of Safet Technology /

Office of fluclear R ctor Regulation * *ea cvar ww.a=

U.S. Nuclear Regulatory Commission Washington, D.C. 2055

.. - ..o....m..r,o,,.....o....g.,o.... - ..c ,.r...o....o.,

Division of Safety Technology 4 Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commi'ssion ' ' ' " ' ' " " ' " " " " * ' " "

Washington, D.C. 20555 ia sur.tausgram, morts

\ ,/

,u. r..cr u,

\ g f

/

This report provides retrospective com%pa_rison/s of selected generic regulatory actions to the 1983 NRC safety. goals, which had beeh issued for evaluation during a two-year period. The issues covered are those anafyzed by the Office of Nuclear Reactor

} Regulation (NRR) (assisted in some cases /by\the Battelle Pacific Northwest Laboratory).

l The issues include auxiliary feedwaterjieliability, pressurized thermal shock, power-operated relief valve isolation, asymmetric bibwdown loads on PWR primary systems, pool dynamic loads for BWR containmedts, and stdam generator tube rupture. Calculated core-melt frequencies, mortality rijks, and cost-benefit ratios are compared with the corresponding safety-goal quantitative design objectives. Considerations that should influence interpretation of the comparisons are disdussed. Comments are included on whether and how the safety godls may helpain the regulatory' decision process and on problems encountered.  %

/

\

to cocuwe%r 4%46vs.s -e savacaos casc#ietcas

\ , , , , ,, ,,,, u r v svarawa%r Safety Goals Unlimited

't SEcum.rv CLAS$18scArto%

. b =r.....to,im ~,.o ....

f'nc$ssified Auxiliary feed ter reliability, pressurized thermal shock, power- Unc sified operated-relief-valves, BWR pool dynamic loads, steam generator ,, w ....o,,. ..

tube rupture.

i . .. .a

_____:_______u