ML20128Q388
| ML20128Q388 | |
| Person / Time | |
|---|---|
| Site: | Shoreham File:Long Island Lighting Company icon.png |
| Issue date: | 05/31/1984 |
| From: | DELIAN CORP., SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY |
| To: | |
| Shared Package | |
| ML20127A367 | List:
|
| References | |
| FOIA-85-199 2-T-63-21, NUDOCS 8507130423 | |
| Download: ML20128Q388 (173) | |
Text
r-O
.c3-._..-._.~._,_..
,Y
.t f
1
. [
Mu /
/
\\
,g ?'
t
}
g yi 2-T-63-21 hw&~
[yQa PROBABILISTIC RISK ASSESSMENT SHOREHAM NUCLEAR POWER STATION LOW POWER OPERATION L'F TO 5?, OF FULL POWEP s
Prepared Ey:
[
Delian Corporation
/
Science Applications, Incorporated
[A h /}
Vfl 4
j+
For f
}q
'f,1
+
LONG ISLAND LIGHT!NG COMPANY
/I j
NUCLEAR ENGINEERING DEPARTMENT
.d N
0
'j [9 MAY, 1984 fW / g0 e
[' 40 4 [.
~
B507130423 850426 g
~
BE AIRS -199 PDR DRAFT I
. - ' ' ~-
A t_ -
.4
- 1 6
1 Table of Contents Abstract Pace Abbreviations and Acronyms 1.0 Introduction..........................
.7 1.1 Scope Limitations........................
7 1.' 2
.9 1.3 Description of Low Power Operation at Shorehan 9
1.4 Success Criteria.......................
12 1.5 Report Organization......................
13 2.0 FRA Sunr.ary.............................
12 2.1 Accident Classes........................
18 3.0 Low Power Risk Evaluation......................23 3.1 Loss of Offsite Power Initiator................ 24 3.2 Loss of Coolart Accidents (LOCAs)............... 43 3.3 Other Transients
....................... 52
'TWS Sequences 3.4 A
6C 4.0 Results S u nra ry.....................
7 0 4.1 74 4.2 Dorinant Contributors to Core Vulnerable Frequency 75 4.3 Comparison of Calculated Core Vulnerable Frequency Uncertainties.........................
76 4.4 80 4.5 Consecuences of Low Power Operation.............. 84 5.0 Conclusion............................. 90 Appendix A - Documentation of Input Data for Probabilistic Evaluation.
.A-1 L
Append 1x B - Plant Response Deterministic Calculations
..........B-1 Appendix C - SNPS/LILCO Grid Electric Power System Description
.C-1 Appendix 0 - Assessment of LOSP Event Data and Application of Dominant s
.0-1 Accident Sequences Appendix E - Sensitivity Studies
.....................E-1 JRH1 -
s
_J
~
~
ABSTRACT This report assesses the postulated accident sequences which could Shoreham plant operation at low power.
The bases for the evaluation plant analysis and logic models developed in the Shoreham Probabilistic R are the Assessment.
As a measure of public safety, the core vulnerable frequency associated with start-up testing at Shoreham when the power level is restrictec to a naximum of 5' of full power is calculated.
For this calculatier, several charges are made to the plant configuration to reflect the plart as it is, or perceived to be, during the start-up test phase.
These changes include:
1)
An assumption of no credit for the installed diesel generators; 2)
The incorporation of increased AC power system reliability due to the availability of a 20 MW on-site gas turbine with black start
~
cacability and the addition of nobile diesel generators to be connected direct y to the norral station busses; l
3)
The incorpo-ation of a detailed procedure for implementing a backue energency core cooling mode not dependent on AC pnwer in the 1.org term.
One principal focus of the evaluation is on the loss of offsite power (LOSF initiated accident sequences, based on the judgement that these sequences c be the most important given the assumed start-up configuration.. However, all the identified accident sequences from the Shoreham PRA are reexamined to as the total impact of low power operation.
In addition, the requantification is compared with the original Shorehan PRA so that the " risk" associated with start-up testing can be compared on a relative basis with that for normal plant operation.
The co'nclusion of the analysis is that the core vulnerable frequency 'or low power operation is much less than that quantified for full power operation, ever when quantified conservatively (i.e., taking no credit for installed diesel generator reliability and assuming extended steady state operation at Si pcwer).
JRH1 --.
r
- - - - -~
~
~ LIST OF ABBREVIATIONS AND ACRONYMS AC Alternating Current ADS Automatic Depressurization System APRM Average Power Range Monitor ASLB Atomic Safety and Licensing Board ATWS Anticipated Transient (s) Without Scrar BWR Boiling Water Reactor CET Contairnent Event Tree CCDF Complementary Cumulative Distributier. Functier.
CHF Critical Heat Flux CRD Control Rod Drive CS Core Spray CST Condensate Storage Tank D
Deman,d DEA Design Basis Accident DC Direct Current DF Decontamination Factor DG Diesel Generator ECCS Emergency Core Cooling Systems EFC Ele ~ctro Hydraulic Control EPRI Electric Power Research Institute EPS Electric Power Safeouard ESF Engineered Safety Feature ESW Emergency Service Water ET/FTA Event Tree / Fault Tree Analysis FSAR Final Safety Analysis Report FTA Fault Tree Analysis FT/ ETA Fault Tree / Event Tree Analysis FW Feedwater GE General Electric Company HCU Hydraulic Control Unit HPCI High Pressure Coolant injection HVAC Heating Ventilating and Air Conditioning HX Heat Exchanger IBV Inboard Isolation Valve JRH1 4
g.
'c LIST OF ABBREVIATIONS AND ACRONYMS (Cont.)
IaC Instrumentation and Control IEEE Institute of Electrical and Electronic Engineers
-IORV Inadvertent Open Relief Valve IREP Interim Reliability Evaluation Porgrar.
IRM Intermediate Range Monitor LCO Limiting Condition For Operation LER Licensee Event Report LILCO Long Island Lighting Company LIS Level Indicating Switch LOCA Less of Coolant Accident LOSP Loss of Offsite Power LP Low. Pressure LPCI Low Pressure Coolant Injectior. (a Mode cf RFFT LPCS Low Pressure Core Spray (or Core Spray)
LPRM Local Power Range Monitor MARCH Meltdown Accident Response Characteristics MCC Motor Control Center MCPR Minimum Critical Power Ratio MOV Motor Operated Valve MSIV Main Steam Isolation Valves MTTR Mean Time To Repair NRC Nuclear Regulatory Conrission N55 Normal Station Service N555 Nuclear Steam Supply System OBV Outboard Isolation Yalve PCS Power Conversion System P&ID
~ Piping and Instrumentation Drawing PRA Probabilistic Risk Assessment PRM Power Range Monitor PRS Pressure Relief System RCIC Reactor Core Isolation Cooling RCPB Reactor Coolant Pressure Boundary RHR Residual Heat Removal-RPS Reactor Pressure Vessel JRH1 *
. - - ---* - + r
'7~'
_ LIST OF ABBREVIATIONS AND ACRONYMS (Cont.)
RPT Recirculation Pump Trip RSS Reactor Safety Study RWCU Reactor Water Clean-up SAR Safety Analysis Report SDV Scran Discharge Volume SF Shielding Factor SFSP i
Spent Fuel Storage Pool SGTS Standby Gas Treatment System S!A Service and Instrument Air Syster SJAE Steam Jet Air Injector SLC Standby Liquid Control SNPS Shoreham Nuclear Power Statfor 50RV Stuck Open Relief Valve SP Suppression Pool SP:
Suppression Pool Cocling SRM Source Rarge Monitor sri Safety Relief Valve SSE Safe Shutdown Earthquake SVERM Station Ventilation Exhaust Radiatier. Monitorirg SW Service Water SWS Service Water System
-TBCLCW Turbine Building Closed Loop Cocling Water Syster TCV Turbine Control Valve TG Turbine Generator TIP Traversing In-Core Probe UHS Ultimate Heat Sink UPS Uninterruptiable Power Supply JRH1
~0"
o
1.0 INTRODUCTION
The Shorehar Nuclear Power Station may pose a small incremental risk to the public..The Shorehar Probabilistic Risk Assessnent [1-1] perfonned for LILCO calculated this risk (i.e.,
the product of probability and pctentia.1 consequences) in a manner consistent with the current state of the technology.
The results indicate that the core melt frequency and the risk measures of the proposed safety goals are met.
The PRA was performed assuming plant operation in the normal power mode, i.e., approximately 100% full power.
The purpose o' E this report is to quantify one of the key parameters derived in the PRA-tne frequency of core vulnerable conditions-associated with plant operation at or below 5'
of full power.
Other risk pa rameters,
e.g.,
source ter-characteristics, will also be discussed to provide additional qualitative informatier and scaling factors to assess the relative risk of the low power operation.
The' principal impact of this evaluation should be in the form of a reasonableness test on the relative plant risk associated with operation of the plant during start-up testing versus norral mature plant operation.
The're are both positive and negative effects which may influence the relative risk associatec with low power operation.
These effects are factored inte this The results of the probabilistic logic model quantification are one assessnent.
input into the decision-making process.
However, the principal test which the results are intended to provide the decision maker is the reasonableness of low power operatier.
Specifically, an evaluation of the relative risk contribution can provice insights as to whether low power start-up testing represents a disproportionate contribution to risk.
1.1 SCOPE As stated above, the objective of this report is to quantify the probabilistic models'-of the Shoreham plant in order to assess the frequency of core vulnerable conditions when-operating at 5% of full. power.
This quantification is based upon the PRA logic models and uses many of the ground rules established there.
The analysis given here is directly consistent with the PRA quantification and therefore affords a reasonable relative " risk" compar'ison between full power
- 1 JRH1 l
o operation and the restricted power level case. This power level restriction has a number of positive benefits which tend to reduce risk compared to operation of a mature plant at 100t power:
o The lower initial power level and lower decay heat levels reduce the rate of coolant inventory loss and the heatup of containment, thereby increasing the time available for operator action, o
The reduced requirements for coolant makeup and containrent heat removal allow greater flexibility in mitigating accidents, changing the plant system success criteria (e.g., the viability of CR0 flow as a successful coolant injection path for non-ATWS non-LOCA scenarios).
In the unlikely possibility of a core vulnerable condition there is an o
increased time available' for emergency response, in addition, the following positive considerations have been factored into the evaluatior of low power operation at Shoreham:
o Respense capability of on-site portable generators with special connections to the normal power buses.
Response capabilsty of on-site blackstart gas turbine,
-o Potential administrative controls which require shutdown o
in the face of severe weather, e.g., high winds, hurricane, tornado watch, etc.
increased time available 'or preservation of containment integrity.
o o
Reduction in radionuclide core inventory due to the early in life conditions of the fuel.
Negative effects associated with the start-up operations and the 54 power limitation include:
JRH1 8-
6 6 - *
'd
' - ' " - " * " ^ * ~ '
The initial period of plant operation tends to exhibit a substantially o
higher transient challence frequency and a higher system unreliability than a mature plant.
The testing phase of the plant power ascension may introduce even o
higher transient frequencies.
o With more control rod motion there may be a possibility for unusual power shapes, and control rod withdrawal incidents.
This has been explicitly addressed in the modeling of transient phenorena presented in Appendix 2.
1.2 LIM: TAT!0NS A key point to consider is that the Shoreham PRA does not include analysis of external e v er.t s.
One reason for not yet considering external events is the large uncertainty associated with the external event evaluation ccrpared to other accident scenarios associated with full power operation.
Nevertheless, exterrel everts may contribute to the potential risk associated with low power operation *,
By recognizing this limitation, the quantified Shorehar PRA car be effectively used in a risk based discussion or low power operation. The pRA is a valuable tool to be used in setting priorities and as one input to the decision-making process.
1.3 DESCRIp'!Ot. OF LOW p0WER OPERATION The overall objective of low power operation at Shoreham is to gain opera experience.
This applies to both LILCO personnel and plant systems.
As such, plant safety systems, and alternate plant systems that may play a significant safety role for accident mitigation during sequences initiated at low power, many aspects of low power operation are significantly different from operation of a mhture plant at 100% power. The purpose of this discussion is te outline
- Effects of external events are anticipated to 'be small based upon conri made by LILCO regarding limiting conditions of operation [1-2].
JRH1
.g.
~
these operational differences and to define the plant configuration that is assumed in this analysis.
This includes the operation of normal-plant systems, 1.3.1 General Plant Confiouration Plan't operation at a maximum of 5t power is assumed to involve one leg of the feedwater/ condensate system for RPV level control, steam flow through all four
' main steam lines, and bypass steam flow directly to the main condenser Reactor recirculation flow will be controlled by having both recirculation pumps i r.
operation.
All safety systems used for scran, RPV pressure control, RPV coolant injectior and containmer.
control are assumed to be available within the technical specification limits that apply to full power operation.
Safety systems that perform support functions are also assumed to be available accordirg to technical specifications, with special consideration in one case:
on-site
, erergency electric power systems.
This analysis provides estimates of syster availability assuming the installed emergency diesel generators are unavailable, which. means that essentially no credit is taken for the installed diesel generators.
Emergency power supply restoration capability following loss of off-site power will be augmented by the presence of an on-site 20 MW cas turbine with auto-start (blackstart) capability, and the presence of mobile generator units which can be connected to the plant side of the RSS transformer, both of which are included explicitly in this assessment.
Low power operation offers the safety advantage of reduced decay heat levels following a scram.
Figure 1,3-1 provides simplified schematic of the range of operation under consideration, i.e.,
fror approximately it to Si of full power. Deterministic calculations forn the basis for assuming that several additional plant contingencies (many of which were
~
considered for completeness, but given very little credit in the containment event ' trees of the PRA) may be available in emergencies.
Two methods for RPV injection which are judged viable alternatives for some accidents associated with low power operation include:
(1) the CRD hydraulic system pumps (one of which is in continuous operation), is found adequate due to the reduced coolant makeup requirements; and, (2) fire water injection through a spoolpiece JRH1 connection to the ultimate core cooling connection has increased probability cf success due to the extended times available for implementation.
Both alternatives are results of the lower decay heat levels associated with power operation at less than 51 power.
1.3.2 Specific Ascects of Low Power Operation There are many additional factors involved in the safety evaluation of operation at or below 5'.
power.
The following considerations have been included in the analysis: [1-2]
LILCC will inplement administrative controls which recuire shutdcwe o
ir the face of severe weather (e.g., high winds, hu rri c a ne, tcerte:
watch. etc.)
This will have a favorable inpact on the evaluation cf offsite pcwer l reliability, allowing failures due to severe werther to be elinineted from the data base.
g The time available for effective operator action to restore or repair o
equioner,t (e.g., restoration of offsite power) is increased due to the lower reactor power.
This is primarily found to have a favorable impact on the evalu?ticr of AC power system reliability since the additional time available tc the operator increases the probability of successful actions.
o The time available for preservation of containment integrity is increased.
I This has a dramatic impact on accident sequences involving challenges to containment or containment-related systems interactions phenomena (e.g., HPCI/RCIC failure due to high lube oil temperature).
For the most part, this impact is reflected in the revised success criteria. JRH1
~,_.
o Ea rly in life (referred to as
" wear-in")
failures (including initiating events and/or equipment failures) have been shown by operating experience to be more likely than for operation of a mature plant.
This is reflected in the analysis through increases in estinates of system unavailabilities and initiating event frequencies.
[
1.4 _S_UCCESS CRITERIA In this report, best estimate calculations of core vulnerable frequency are made assumirg that.the equilibrium power level is approximately 5t.
An estinate of the sensitivity of core vulnerable frecuency to this assumption is also derived based on an ecuilibrium power leve,1 value of 2.5' as discussed in Appendix E.
The syster success criteria for low power operation are derived from the Shoreham PRA with the exception that there are additional success paths which de not exist for cases in which the plant operates at high power.
Tables 1-1 anc 1-2 provide the system success criteria for low power operation in a format similar to the Shoreham PRA.
The principal examples of the additional system success states for low pcwer operation are as follows:
For transients with no SORVs, flow from the CRD purps, the diesel fire o
purp or any of the service water pumps would provide adequate coelant injection.
For 50RV or medium LOCA cases, no additional depressurization systers o
are required to allow low pressure systems to inject.
o'.
For ATWS conditions, RCIC plus CRD flow would provide adecuate coolant injection for powers in the range of 2.51 JRH1.
1.5 REPORT ORGANIZATION Section 2.0 of this report provides a sumary discussion of the Shoreham PRA accident sequence analysis.
This includes a review of the dominant contributors to the frequency of core vulnerable conditions.
The sequences defined i r.
Section 2.0'are reviewed in Section 3.0 to assess their impact for operatior a 5* power.
For convenience, four categories of sequences are discussed:Loss cf offsite power induced transients, LOCAs, other transients, and ATWS seque Sections 4.0 and 5.0 provide a sumary of the low power operation sequer.ce cuartificatior results and conclusions of the analysis, respectively.
e e
JRH1
.~
l 4
J FIGURE 1.3-1 RANGES OF NEUTRON MONITORING SYSTEM SRM IRM I.PRM APRM OPERATION 1014'.
!)(
m
.-t 100
==
2 1013 E
3a 10 E
t
- 1012, 3
3 A
8 e
ye
=
1011 S
j
}
=E C
E 0.1 h
E 1010 U
g 1
.01 E
e 109 Y
10'3 t
&I 108 c.g
.5 20-4 us J
I 107 It*
.c.
10'5
=
8 10 m 2
10-6 105 l
SOURCE JRH1.
~-
--m
.-~
.-m-
---w--,,-,
---e--,w---
y TABLE 1.1
SUMMARY
OF SUCCESS CRITERIA FOR THE MITIGATING SYSTEMS TABULATED AS A FUNCTION OF ACCIDENT INITIATORS ACCIDENT INITIATOR SUCCESS CRITERIA COOLANT INJECTION CONTAINMENT HEAT REM 0'.'AL Large LOCA:
Stear Break 0.08 ft Or 2
Liquid Break 0.1 ft 1 of 2 Core Spray Pumps Or Diesel Fire Pump Or 1 of 4 Service Water Pumps Medfur LOCA:
1 Same as Large 1 RHR Steam Break O.016 to 0.08 ft2 LOCA Liquid Break:
0.004 to 0.1 ft-Small LOCA:
2 CRD Normal Heat Removal Steam Break 0.016 ft Or 2
Or Liquid Break C.004 ft HPCI 1 RHR Or Or RCIC RCIC in Or St. Cond.
1 Condensate Pump Or Diesel Fire Pump or 1 of 4 Service Water Pumos Transient Same as Small LOCA Same as Small LOCA 10RV Same as Large LOCA Same as Large LOCA Transient + SORV Same as Large LOCA Sane as large LOCA ADS refers to any mode of successfu1 reactor depressurization.
~
t
4
' 8 t
TABLE 1-?
4
~
/
SUCCESS CRITERIA FOR ATWS' SEQUENCES BASED ON MODIFICATIONS IMPLEMENTED AT Sil0REHAM EFFECT OF POTENTIAL ADDITIONAL FAILURES (in Addition to ARI Failure)Id)
REDUCED COOL ANT REDUCED SilPPRESSION OTHER ATWS IN.)fCT ION POOL C001.ING TRANSIENT REDUCED OR FEATURES
~ ~ - - " ~ ~
~
~ ~ ~ ~ "
INITIATING LATE POISON FW &
BOTil RELIEF ADS PRESSURE EVENT PROJECTION FW llPCI 1 RilR RilRs RPT INITIATED-MSIV CLOSURE A
A A
N N
N A
A TURBINE (b) Trip A
A A
A N
N A
A a
10RV A
A A
N N
N A
A LOS OF OFFSITE POWER A
A N
N N
N A
A LOSS OF FEEDWATER A
A A
A N
N A
A LOST OF CONDENSER A
A A
N N
N A
A 1
i l
A Acceptable (Successful):
=
less than 240"F acceptable implies no significant fuel damage and suppression pool temperatures i
i N
Not Acceptable (Not Successful)
=
(a) l Combinations of failures not shown on the above table as acceptable should b
=
less 25% power. Note that RPT is not required for sequences from PST power or less.
(h)
All changes in recirculation flow outside of acceptable limits are treated as leading to a turbine tr? p
=
as are all increasing feertwater flow transients f
I 4
I I
s
9.
REFERENCES 1-1
_Probabilistic Risk Assessment, Shoreham Nuclear Power Station, Long Islan Lighting Company, Docket 50-322, June 1983 1-2 Supplemental Motion for Low Power Operating License, submitted in the matter of Long Island Lighting Company, Docket No. 50-322, to the Atomic Safety and Licensing Board, affidavit of W. J. Museler, dated March 20, i
1984 s
O JRH1 -
m 2.0 PRA
SUMMARY
The purpose of this section is to briefly summarize the quantitative results c' the PRA which can then be used for reference throughout the receinder of this report.
Many of the technical appendices of the Shoreham PRA provice information used for the cuantification of the probabilistic models.
Except for the differences explicitly described in this analysis, essentially all of the input data are the same; thus forming the basis of this comparative analysis.
2.1 ACCIDENT CLASSES Because the PPA is intended to provide a quantitative measurement of risk tc the public, several factors which influence the risk calculations other tha r, the frequency of releases are considered.
For this reason, five accident classes are chosen which are intended to represent the spectrum of accidents fror (relatively) high frecuency/ low consequence events to low frecuency/high consequence events. These accident classes are defined as follows:
Cw v P " CLASS DESCRIPTION les I
Inadequate Coolant Inventory Makeup I!
Inadequate Decay Heat Removal III LOCA With Inadequate Coolant Inventory Makeue IV ATWS with Inadequate Containrert Heat Rencsal
(
V Interfacing LOCA A second aspect of the analysis is the evaluation of various initiating events The PRA attempts to quantify the different impacts on plant response under a variety of initial conditions, ranging from the more common types of anticipated transients to very low frequency initiators. Together, these two aspects of the probabilistic analysis-initiating events and accident classes-are sunmarized ir Table 1-1.
JRH1.
3 TABLE 2-1
SUMMARY
OF THE DOMINANT ACCIDENT SEQUENCE FREQUENCIES WHICH LEAD TO CORE VULNERABLE STATES (PER REACTOR Y CLASS CLASS CLASS CLASS CLASS SEQUENCE E'/ENT INITIATOR CLASS I
II III IV V
TOTALS Tra nsients :
Turbine Trip 2.5E-6 1.0E-6 3.5E-6 Manual Shutdown 1.4E-6 1.2E-6 2.5E-6 MSIV Closure 7.4E-7 3.5E-7 1.1E-6 Loss of Feedwater
- 2. 0E-7 4.2E-8 Less of Conderser 2.4E-7 Vacuur 3.2E-6 2.1E-6 Loss of O'fsite Power 9.9E-6 5.7t-7 5.2E-6 10DV 1.0E-5 6.8E-7 8.9E-8 7.7E 7 1.7E-5 5.9E-6 2.4E-5 LO~A:
Large LOCA 6.9E-7 1.8E-7 Pediun LOC
Containment 7.2E-9 3.6E-8 4.3E-8 Reactor Pressure Vessel LOCA 3.1E-7 3.1E-7 2.lE-7 9.9E-7 1.0E-6 3.7E-8 3.6E-8 2.3E-6 ATWS:
Turbine Trip 1.2E-6 8.5E-10 2.3E-6 3.5E-6 MSIV Closure / Loss of Condenser Vacuue
- 8. 0E-7 7.5E-10 7.4E-6 Loss of Offsite Power 7.1E-8 8.2E-6 6.9E-7 7.6E-7 10RV 1.7E-7 1.6E-7 3.3E-7 Loss of FW 1.8E-6 2.1E-9 3.0E-6 4.8E-6 4.0E-6 3.7E-9 1.4E-5 1.8E-5 JRH1
.i-WHICH SUPNARY LEAD CORE OF THE TO i
00M VULNERABL ST EVENT 1
INITIATOR j
CLASS l CLASS
.lOther Transients:
I C
il j ~ Cases 'Involvi I
I l Release ng the l;
.l i
of
.I Water Excessiv e
l Cases Ini 3.1E-6 Loss tiated 7.8E-by the cf DC Power Sus
{
i2 j
Cases In l. 7E-6 Condi vciving an Upse:
i 7.4E-8 tion with l. MeasuremReactor Wa i
j the l
j i
evel ent l
4 Syster
.{
i j Manual Shutdown'Oue to
!2.4E-6
.}
High Dryw ll f
l.
ture Tempera-l1.2E-7 e
i IL of 1.4E-7
! oss Initiated EventService W 2.5E-6 l
1 1.2E-7 s
3 j
I.1E-7 l
TOTAL i 6.9E-7 I
- Note:
3.2E-5 Totals
- 8. 0E may not m tch 1.0E-6 a
due to round off i
I errors.
4 i
l I'
JRHg e
?p9 e-s-
,mm,e
-wgen
- 9 y pv, gr
%yepwyg-,g.,
--mum.
9 m
-.-w
,y%
v-giw
,g
.---.-,e%+-e-pe-
+e-.w
The plant configuration and the unique mitigation features available at the restricted St power level are judged to impact many of the dominant accident sequences in a similar manner.
Many of the initiators described in the PRt. can be combined in this analysis for the purposes of subsequent discussion.
Specifically, the initiator types are discussed in the following categories since the power restriction of St has a similar impact on the resulting postulated accident sequences; 1.
Loss-of Offsite Power 2.
Loss of Coolant Accidents 3.
Other Transients 4
ATKS Table 2-2 is a reduced version of Table 2-1 presanted in terms of these four generalized types of postulated s'cenario initiators.
The quantification and discussion in Section 3 is divided according to these generalized "initiater types".
The essence of this slight charge in focus results from the followirg consicerations:
Long term containment heat removal (Class II) accident secuences whic*
o are calculated to be of low frecuency in the Shoreham PRA are founc tc be significantly smaller in frequency for the start-up testinc mcde o#
operation at Shorehan.
o The interfacing LOCA sequences (Class V) are very low freque.cy sequences and not a dominant contributor to the core vulnerable frequency.
o The character. of the LOSP sequences and the interest in the L
sensitivity of the results to installed diesel generator reliability has elevated their potential importance during the low power startup phase.
JRH1.
m
- w""
l l
TABLE 2-2 00MINAt;T ACCIDENT SEQUENCE FREQUENCIES AT 100* POWER (PER. REACTOR YEAR) BY INITIATOR TYPE CLASS CLASS CLASS CLASS CLASS SEQUENCE' Event Initiator Type I
II III IV V
TOTALS I
Loss of Of' site Power 9.9E-6 5.7E-7
- 1.0E-5 k
LOCAS 2.1E-7 9.9E-7 1.0E-6 3.7E-8 3.6E-8
?.3E-6 Other Transients 1.8E-5 6.4E-6 2.8E-8 l2.4E-5
,!ATWS 4.0E-6 3.7E-9 1.4E-5 1.8E-5 i
i l
- TOTAL 3.2E-5 8.QE-6 1 1.0E-6 1.4E-5 l, 3.6E-8 5.4E-5 l t
t l
i l
l JRH1 22-i l
3.0 LOW POWER RISK EVALUATION The focus of this section is to quantify the probabilistic models of the t
Shoreham plant [3-1] in order to assess the frequency of core vulnerable conditions when operating at the 5'. power level.
This quantification is based upon the PRA logic models and uses mary of the groundrules established there.
The analysis given here is directly consistent with the PRA ouantification and therefore affords a relative " risk" (i.e.,
frequency of core vulnerable) comparison between full power operation and the restricted power level cases.
The evaluetion of core vulnerable conditions is based or a point estimate equilibrium operating value of approximately 5% of full power.
Since the intended use of the low power testing is to restrict the power level to below 5t, the anticipated equilibrium power level for characterizing the potentiel decay heat levels may be closer to,an effective 2.5% power due to power cyclin; for training and testing.
However, there may also be some uncertainty in the calibration of the ocwer level.
Therefore, it is judged prudent te perform the
' base calculations assuniing a power level of St and report the sensitivity cf the power level chances to approximately 2.5t power in Appendix E.
Previous NRC investigations (3-2, 3-3) have indicated that, in general, the risk to the public and the frequency of potential core vulnerable conditions are considerably lower for low power operation than the estimates calculated in the Shorehar-PRA and other PRAs for normal full power operation.
The Shoreh ar-specific analysis perfomed here documents evaluations similar to these perfomed by the NRC (3-2, 3-3) on a plant specific basis for Shor,ehan.
Tne Shoreham PRA is used as the baseline analysis to establish the relative " risk" and core vulnerable frequency for nomal power operation.
In addition to the '
conditions which may exist during nomal operation, this analysis' considers several variations in assessed initial plant configuration.
The prircipal '
change in the initial plant configuration which is examined is the availability of the installed diesel generators and alternative backup methods for obtaining AC pour restoration.
Because this change has the strongest effect on the postulated Loss of Offsite Power (LOSP) initiators and since the resultirg sequences are among the largest contributors to the frequency of core vulnerable '
conditions, these sequences are examined separately. JRH1
.n
Section 3 addresses the quantification of the four generalized types of initiators:
LOSP (Class 1) - Section 3.1 o
LOCA (Class I & III) - Section 3.2 o
Transients (Class I & II) - Section 3.3 o
ATWS (Class I & IV) Section - 3.4 o
3.1 LOSS OF OFF-SITE POWER INITIATOR The LOSP initiator represents a unique accident challenge since it causes the unavailability of the normal system used to supply coolant makeup and containrent heat removal.
This section is structured to discuss several possible variations in the scenario and in the plant configuration.
As such, it is important to estimate the timing of LOSP sequences with respect to key plant pa rameters.
The following discussion is based on the deterministic results obtained in Appendix B which are also sunnarized in Section 3.1.2.
The containment conditions during LOSP initiated scenarios from below 5' power will be substantially less severe than the containment conditions calculated for sequences originating from 1005 power.
As an example, one of the previcusly idertified plant conditiens which may contribute to the RCIC ano HPCI failure probability is the potentially high suppression pool temperature and cortainment pressure (RCIC)** which may occur within 7 to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> followir; a station blackout from full power.
The analysis reported in Appendix B shows that such adverse conditions are not expected to occur for many hours beyced these estimates.
ThusJhe limiting _ sequence involvirg plant recovery actiers )
involves a loss of coqlant injection following LOSP, unrelated to containment conditions.
Failures of HPCI and RCIC lubrication cooling are postulated if suppression pool temperatures are high and pump suction is from the suppresion pool.
- Very high containment pressures in the range of containment design pr could result in protective trip actuation on RCIC.
JRH1 24
To provide a perspective on the LOSP evaluation, LOSP from high initial reactor l power coupled with failures of coolant injection systems are found to present {
potential core vulnerable conditions within 30 minutes to I hour.
However,{
similar case _s of LOSP at 5t_ power are found to present potentiaLcoQable conditions only at times greater than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, and, for many cases, at times i gtetter_.than 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
From this perspective, it can be seen that the 5' power restriction sharply increases the time available for operating staff actions to establish successful coolant injection and AC power restoration.
A detailed event tree analysis is perforned to identify the principal contributors to potential core vulnerable situations, given the following initial conditions:
o LCSP initiator.
Initial power 5.0' for over 30 days.
o Installed diesel generators assumed unavailable; sensitivity studies o
9 have also been performed to provide a more realistic estimate C #
on-site AC power reliability, o
On-site, black start gas turbine is available with a reliability s
developed free machine specific data.
Accitional temporary on-site AC power enhancenerts including:
o portable diesel generators which can be rarually switched inte the 4160V AC power system in the event of a station blackout.
i restrictions on reactor power operation in the event of severe weather warnings, e.g., hurricanes or tornado.
Figure 3.1 (a,b,c d.e,f) is the LOSP event tree used in the evaluation o' potential core vulnerable conditions from low power.
The event tree d i constrained to the delineation of a relatively small number of sequences in order to simplify the presentation.
The evaluation of LOSP sequences is or JRH1
iterative process because of the time dependence of recovery events.
In othe words, the probability of a specific sequence depends strongly on the associated sequence timing, while, at the same time sequence timing is calculated for the most probable secuence variations.
As a
- result, Figure 3.1 and the 1
corresponding calculations in Appendix B are developed in parallel.
Figure 3.1 consists of a screening event tree (Figure 3.la) that is used to define 5 groups of sequences each with its own similar timing.
Each grouping c' sequences is then modeleo on a subsecuent event tree (Figure 3.lb c,d e f) using the results of Appendix B as a basis for estinating event probabilities.
- Thus, tire ~ dependent effects are not sequentially mapped out on the initial event tree, but are judgenentally included in estimating of failure probabilities.
The functional events in the LOSP event tree snown in Figure 3.la are discussed below.
Initiatine Event (T):
The quantification of the LOSP initiating frecuercy is based upon LILCO grid specific data and is consistent with the original Shcrehar PRA (see also Appendix A).
Scrar (Ch The scran systen reliability is taken from the Shorehar PRA which in turn used a point estimate value from the NRC (NUREG-0460).
The value showr in Figure 3.1 is the mechanical comon mode failure probability of the conteci rods to insert.
Note that, consistent with the higher failure rates assumed for the wear-in period of plant operation, this failure probability has beer, increased by 100'..
The electrical comon mode failure probability is sinilar te that in the Shoreham PRA and has been shown to lead to a 'significantly lower frequency of core vulnerable since LILCO has incorporated a backup electrical scram systen (ARI) in the Shoreham design.
Primary Systen Integrity (P): One of the important pa rameters in the plan response to a transient from low power is the ability to maintain the primary system, integrity, if integrity is maintained, coolant is lost only by intemittant SRV actuation and the calculated time to a core vulnerable condition is extremely long, i.e., greater than 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
However, if the i
reactor is depressurized through an 50RV or LOCA condition,,then the time to ;
core uncovery and reactor fuel heatup is substantially less, i.e., approximately JRH1
d 6,
O I
LOSP KACTOR KACTOR COOLANT CDOLANT NO MMMAL SEQUDCC SEQUDCC SEEDCE INITIATI)$ SS-INTEGRITT MCIION MCIIOf EtOCDCY DEPESSIRI CLASS DESIGNATGt FEEDCT EvCNT atITICAL 009ES$ta! ZATION F4 Nts.
4-10 R ZATION
_ _fe C
P 0'
U Z'_[,_1,'_,_ _ _, _,,,,
i Te 0.5825E 01
'IE-1 IE-3 I
tex' 0.825aE-82 1
Tel' O.6256E-84 1.9E-1
' IE-1 2
Teu s.13tgE-gi lE-3 2
7.ut' s, t 4eg.g2 1
TeUZ' O.146E-44 5
74' s.m-g2 2.9E-2 l 1E-1 lE-3 2
TeU'I' O.2M-83 3
TeU'Z' e.7]eg-a5 4
TJ 8.20l?E-82 3E-2
'E IW 8 88880'88
~~
1.8E-1 3
140' e.442st-t3 4
T.C 4.127sE4
' 1E-2 IE-3 i
T.Cx*
e.12 tee 87 1
T.CZ' O.1290E 88 5
4.2982C 86 1.9E-1
'1E-2_._
2E-5 tr-3 4
T.CUI'
- e. m es 1
T.CUZ' O.3826E-99 5
T@'
6.479 0 07 2.9E-2 LJES-- 6 T.CU'X' e 475lE-09 1E-3 3
f a 'Z' O.4756EIt FIGURE 3.la LOSS OF OFFSITE POWER INITIATED EVENT TREE:
5% INITIAL POWER (EQUILIBRIUM) s JRH1 _. _ _
(Q1P
!aW*M '8f::lv0?
,.: s O M5 IGF WT.
DoeAm%TJ
'n5DE isshi b1[5E11 FIK
'5(2Oct '5f 20. !]
-1Tfl O
SVIf0#45 est G$
PRO AVAft.A&E haTO CLA13 N2A:t M UI3s 177! NWG 4 TAT.AAf Avalual i
i Turt X mat Dw[Clas ava?ual (avah alavai m f ava!LJett a
l u
e t
4 i
b i
b I
b I
b O
I F
i 3
0 3Re( t M
e la f ar.,
-2 4 32.!i.I?
I i
5 0 W.R T
E 8 m*.a
--O 9 IIHl.4' m'
e serJ 4;'
L i.
E 8 E*.W.
L
-3 4 3r 3( se
,n g guer..g '
~
-j3 e it'2f E '
i ja e K'i 5, i
R 8 ETJ.:I 1._
j 8 MA*'.W l 18 r
i 1
~
-js e gestf.m; e
D
-O
$ 273af.:# '
I
(
-E 1Ctf E 1
f i
-3
,8 anJi.e I
-2 r
.8 2:tif.4*
l'
-O l,8 734af.It
-3 0 2ettf.#
12 3
,8 70f tf.E l
I
,2
. n.f.,
r j
8 kreef.m t
-;3 8 mAJf ar O
4,%f.e' js 8 12: 'f. 4
- 1
~
't 8hrei.ed 13 l0.w..
i t
p w,
3 3
g
- 3 eitili.de I
y 1
4 4 #M M a
l l
j 0 $def.'s '
1
-2 e endt.s '
i 3
I l
-ja e mann!.m F
10 4 18 4.' t '
i 3
0 SE.4 E '
I_
3 1J G MAf #
i 1
43
.e f eet(.E in ism..q
' Entry Conditions Sequence Type 1 : LOSP; Isolation; Reactor Scrarred; Primary System Intact; Coolant injection Available through 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> via HPCl/RCIC; reactor may be depressurized to 150 psi.
(This sensitivity performed assuming the installed diesel generators are unavailable).
FIGURE 3.lb LOSS OF 0FFSITE POWER INITIATED EVENT TREE:
5% INIT!AL POWER (E0'JILIB"'?)
JRHj -
..s e
' MP CD=11asc at=vGt mDi
'esCtf Off 1JIl D.-1 ff legitt DR$C15 GE E3EM:I st2f <!
L 100i Pet $. Or 37 3 T70vtas Midem 6 ant E5 PMI avutaALI Wa1D Q.A55 Ftilt M Cila.
$J1t P M t avaAAkt avdtaEf Pa0 7188 M W1 MC7!m i:t i
avat: Am.t avut ant ava' iar_r aval.agt l
7 1
0 i
8 as en i
en i
b en I
e i
r t 8 Ban R 4 886;*.&,
W 4 E..&
I e
e aski?.3 1
3 8 M.*.e 5
i M*.m S
8 mai!.m I
r E
C M.* *N I
S 4 mw.'.e 3
0 Mi.5 E
6 Mf
- E 3
8 East.5 3
8 h.'.5 1
8 M.".4 I
e 0 hi.W 3
4 miif.N 2
0 tiFi.".E I
2 t 4EJ!.N I
3 8 Cami:*k 3
e B&t..R f
E G Isi:i t' 8
4 fl34:.t*
l 3
8 ed!!i.It i
1 r
3 i Ei".k i
3 0 ases:.M s
3 0 7::i.*.M i
3 0 211
- 4 1
3 8 We**W d
3 0 s 4J.k l
3 0 115e' le r
4 X**(.te T
(
l 3
8 USII' #
l I
2 0 IE*! s '
1 2
e ana.m I
2 e akt.m 3
3 55.:f.'s 2
8 15:41 04 I
r 3
0 GSMf *S n
a e vu:.n
,3 e essa:.cj
- Entry Conditions Sequence Type 2 : LOSP; Isolation; Reactor Scraered; Reactor Integrity Intact; Coolant Makeup Available 0-4 Hours; Reactor may be depressurized to ISO Dsia.
(This sensitivity performed assuming the installed diesel generators are unavailable).
FIGURE 3.lc LOSS OF 0FFSITE POWER INITIATED EVENT TREE:
51 INITIAL POWER (EQUIL!BRIUM)
JRH1
-29
=
MDe Ley Gbit:4D at:::vGv w>vaa(8407swaramlWT1IT(
m.5IT(
MSILE SIC 5ELS r;E
'M24,4 g u q I
3 nge. Pets a Wr-sov sas Powca avduatt water cuss ng321 Dh(;'Im
$JTC Pow (t svalaalt avdadLt ecW1 T'J0;g NT NCT!h I
l' avut aaf ava!Lastf avduatf avaLaalf 3
1 U
i t
4 b
I b
i b
i b
8 F
a e ashride E
G h!.dr W
G WWi 4 i
r E
8 MEM.N a
3
- 0. mi.m,
CV 0 m(.4 '
3 0 M.E,'
i r
E 8 M.m, n
E 9 M*N CV 0 M N[
a e mue.a 2
4 medi.m W
G mf.5, I
r E
8 Mf*N a
3 4 Mf.M,
CV 0 BMi*n '
2 f amai m I
r 2
8 mf.4 1
2 0 El.& '
O 4 m!.m 2
0 Esit.C 3
03:0*(.4e 3
0 l'te(* E.
t i
2 4 Adif. A I
,3 8 thed!.M 0
0 Mo'f M 4
,2 4 370f.m i
jQt 4 M{.W I
3 4 L&l.df M 3
0 14.Jf m 3
0 Ctal.de '
~-
3 0 li *!f ee '
1 r
-3 0.Wl E '
KJi.'m I
i 3
0 i
3 0 augt.a CV 0 E2 0 3
0.1*4!.0*
I
,2 0 ang.m i
2 0 emfi.g '
3 0 nWZ.E,
- Entry Conditions Sequence Type 3 : LOSP; Isolation; Reactor Scramed; SORV LOCA or ADS; no Coolant Makeus Available; Reactor Depressurized to Less than 65 psta.
(This sensitivit performed assuming the installed diesel generators are unavailable.
FIGURE 3.1d LOSS OF 0FFSITE POWER INITIATED EVENT TREE:
$1 INIT!AL POWER (EQUIL!BD!t,M)
-30 JRH1
LCP (2W1*C 4(:rv0f suDe 94 3's WT 1DC m 1DI m it DJf 5C'1 FlK E204 FRE:Lt,g. } '
ST2J C sCDi NES & WT*
5eDOa@ SVU002 681 EAS PUWG av4LAs.I wafG Q,A35 DdCtjs.
SD C Pow 3 av d & C avcaa(
PWJ m?(
Land M :*!as l
avd at aw:udtf avaltstf arcat g
4 0
8 4
8.
As lb.
A e
r I
l a
e timit.afr' 5
4 awai'.&
a e A:.4 8 8h27 6 I
r a
3 0 med!.m '
3 e anne:.ar a
e ann *.3 3
4 Ame!.&
1 1
1 m
6 mmi.'.e O
4 me' ar '
N 4 h.5 3
i hard.G l
3 4 h.'.3 g
i r
3 4 M *.ar I
2 0 &#:.E O
4 Ed!.ar 3
0 h4!.#
1 r
3 i' 8Ei* * &
I 3
4 herF T I
3 0 abid".#
3 4 illt.** C I
W 434.':f4*
3 0rel.k g
I r
! N il 444.'.44 i
- 3 8 he
- .as l
W G W o.* k I
- 3 0 34).*. N 3
1 Aste" de I
r i
t
- 3 8 N#.' sa j3 0 r*J!.at
,3 4 is ei.d* '
I r
23 8 f *4 *'
- i' '
-3
't M at f. 5 i3 0 M:*N i
i 3
0 mhe*.E 13 e ar*lf. ' 8 i
3 0 2648 44 i
r 2
e amJf.5 1
3 4W!.El' a
e =u:.n
- Entry Conditions Sequence Type 4 : LosP; Isolation; 50AV; Coolant Injection Available Initially.
(Thissensitiv1t performed assuming the installed diesel generators are unavailable.
FIGURE 3.le LO55"0F 0FFSITE POWER INITIATED EVENT TREE: $1 INIT!AL POWER (EOUIL!BR!W)
JRHL 31
u na 5
et sett ava. >ve at o.itatv n de a
a en Is g:{
$v[dt C
c-l
[
I t
5 t____ g ia
,a
-sao 2
l6 Ja e
- Entry Conditions f a
a a
es a
a:
or Sequence Type 5
,a et a
e m (This n
s it
- LOSP a ses are sens itivi Depressuriza tionC
!solatio unavailable. perform d a t
e Procedural al ssuming the install ed LO55 diesel gen 0F era tors 0FF5ITE POWER FIGURE 3.lf INITIATED JRH1 EVENT TREtt 51 INITIAL POWER (
UILIBRIUM) 32-1 t
o 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
The quantification of the conditional probability of an 50RV or LOCA is based upon the following:
5 o
50RV A single challenge to the first bank of SRVs.
l t
The failure probability of the SRVs from the Shorehar PRA [311 increased by 100t to account for the wear-in period of operatier.,
)
The operator action to prevent SRV cycling through running of the turbine driven systems (HPCI or RCIC) or opening a single SPV ranually.
The use of the turbine driven systers is judged tne
{
preferred course of action and is an integral part of theJ operator training.
t o
LOCA: the conditional probability of a ses11 LOCA induced during the less of offsite power, including rectreulation purp seal failures is included in the estimate of failure of primary system integrity.
The result of this evaluation is an estimate of the ccnditional pecbability cf a failure of prinary system integrity of.03/ event.
l High Pressure Coolart Injection (U):
5 The Shorehar plart has the caoability te i
provide coolant injection without AC power through the H31 and RUC turbine,
driven systems.
If one of the turbine driven systems is available to' provide the initial coolant injection following a scram, then the time to a core vulnerable condition is substantially increased.
The calculations sumarized in Appendix 8 indicate that the time available prior to core uncovery following one cycle of HPC!/RCIC operation can be on the order of 3 days deperding upen the operator response regarding reactor depressurization (See below).
Adequate coolant inventory makeup using the turbine driven systems ray be l
required under a variety of conditions if a station blackout were to occur, Figure 3.la separates out the principal types of challenges as follows:
j i
4 33 JRH1
o w
e' I
t Type 1:
The primary system integrity intact; coolant injection available through at least 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
Type 2:
The primary system integrity intact; coolant makeup available initially.
l Type 3:
A breach of primary systen integrity, no coolant makeup i
available.
Type c!
A breach of primery system integrity; coolant makeup initially available, i
Type 5 No initial coolant makeup and procedural depressurization.
In a manner analogous to the Shoreham PRA > full power analysis, coolant injec availability has been treated in a time dependent fashion.
This time decendency arises fror the potential for time dependent failure modes induced by such occurrences as battery drainage or high room temperatures.
Therefore, Figure 3.la prcvides two coolant injection phases U' (0 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) and 0-(410 hours0.00475 days <br />0.114 hours <br />6.779101e-4 weeks <br />1.56005e-4 months <br />).
The quantification of the success probability at each of these sites is similar to that of the full power PRA with the exception that the sys_ tem availabilities have been decreased due to the wear.in effects discussed in Section It should be pointed out that LILCO analysis has been performed to show that HpCl/pCIC Qceration can orovide adequate coolant injection for core thaf 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> with proper DC load stripping from the batteries J3 4].
Therefore, this possibility has been included in the analysis in a probabilistic fashion.
Situatient requiting the higttpressure coolant injection function early in tire involve cases with a 50RV or LOCA.
If HPCl* is initially availab_le to p[rovice coolant injection. but fails durina suhigggent demands,~then the reactor coolart inventory will be adequate for at least 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
'RCIC is marginal for this task because depressurization occurs suffici rapidly to preclude adequate coolant injection, however more detailed calculations could show its capability is adequate also.
JRH1 34 i
unavailable to_ provide this 1.11tial injection, then the time to potential co're vulnerable _ conditions __is_g_al_culate_dtobe_as_lowaQhours.
Another postulated condition is that associated with a f a l. lure to scrar following LOSP. For such situations the MS!Vs will close and the SRVs will opac to remove the power being generated.
There is no substantial effect of an 50PV on HPCI/RCIC availability; ra ther, it is postulated to result in a stable reduced reactor pressure (i.e., 350-400 psia).
Under such conditions, the high pressure coolant injection system (HPCI and RCIC) would be required to provice coolant makeup in a relatively short period of time.
It is found that RCIC alene is probably acceptable for maintaining adequate coolant injecticr.
however, it is not given credit in this analysis.
Therefore, if HP"'
is unavailable it is judged that core vulnerable conditions would occur wit!.f r 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
If HPCI is successful then coolant injection can be maintained for er extended period of time, which is limited by the interaction betweer the containment response and the HPCI system capability.
The time to reach an
~
elevated suppression pool temperature, i.e., approximately 240'F is more thar 3-4 hours.
In additier., there is a feedback mechanism which must be accounted for: by procedure the operator is directed to depressurize the reactor (less thaa 100'F/hr). A result of this depressurization process may be to defeat the HPC' and RCIC systers.
This is modeled in the event tree as function Z discussed below.
Reactor Depressurization (2,X):
The status of reactor pressure is important to the scenario development because:
1.
9epressurization of the reactor will result in a loss of coolant inventory.
3, Depressurization may also occur to such an extent as to disable HPCI and RCIC.
3.
Accident sequerce timing during a station blackout is strongly dependent on the rate at which RPV coolant is discharged. JRH1 2
.A
Because of these important considerations, the event tree (Figure 3.la) inclu' de's' two functional events for depressurization:
Z:
This event represents a rapid emergency depressurization eouivalent to ADS actuation.
While the operator is warned to avoid this, it has such an important influence on the course of the postulated sequence as to require separate consideration.
The impact of rapid depressurization (ADS) is to uncover the core and defeat HPCI and RCIC. This has the effect of reducing the time' available to recover AC power.
(It appears that it might even be prudent to disable A?S during start-up testing.)
X:
This event reflects the required procedural step of controllec depressurization following a station blackout (less than 100'F/nr).
The character of the c5ntrolled blowdown is such that HPCI and RCIC can be maintained as viable coolant injection sources. Therefore,the reason for considering this functional event is only to assess the cases where the HPC!/RCIC may fail.
In such cases, the coolart inventory could be discharged during depressurization at a faster rate than decay heat boil-off.
Under such circumstances (no HPCI/RC!C; slow depressurization) the time
- to recover AC power before a core vulnerable condition would be decreased.
The remaining functional events appearing in Figures 3.1 b,c.d.e. and f are as follows:
Recovery of Offsite Power (R):
Depending on the accident secuence there may te varying amounts of time available to the operator to restore offsite power.
Specifically, the recovery times and conditional probabilities from Table 3.1-1 apply. The probabilities from Table 3.1-1 are consistent with those used in the Shoreham PRA and are also quoted in Appendix A.
)
- Reduction in time available translates directly into decreased probabilities of recovery of AC power. JRH1
Main Switchyard Available (Ms):
As shown in Appendix 0, main switchyard faults are a large contributor to the extended LOSP sequences.
Based upon gereric nuclear plant operating experience, a point estimate conditional failure probability of 0.7/ event is used for the LOSP failure mode which involves the riain switchyard.
I Backup Switchyard (Bs): As shown in Appendix 0, there may be comon mode failures which would adversely impact both the main and 69KV backup switchyard.
For the initial start-up testing at Shoreham the conditional probability cf the 1
backup switchyard failure of 0.3/ event is judged to be corservative because:
The Shorehar' backup switchyard is physically separated frer the raf r o
I i
switchyarc, i
\\
The backu; switchyard will be required to be available during power i
e operation.
o Power operatten will not be performed during pericds of severe j
weather, which have characteristically been the cause of the observed l
I common cause switchyard related failures.
)-
Offsite 69r.' pewer Available (Os1:
Because of the high level of redundarcy o' the offsite power grid and its restoration ability, it is found that for tecte LOSS initiators which are generated by failure modes at the plart, i.e.,
switchyards, that the offsite power sources will remain viable with a high reliability.
Therefore, the ability to restore offsite power to the plart electrical busses is principally a function of the availability of an or site /
switchyard, ie., main or 69KV backup.
On Site Gas Turbine Available (On):
LILCO has perforned a detailed reliability evaluation of data from the on site blackstart gas turbine.
The results of the analys,is indicate that the unit reliability is 0.96/ event.
The unit can be used in those accident sequences in which the backup switchyard remains available.
j JRH1 37-
TABLE 3.1-1 CONDITIONAL PROBABILITY OF RECOVERY OF 0FFSITE POWER AS A TIME DEPENDENT FUNCTION l
l CONDITIONAL ACCIDENT INITIATOR FREQUENCY TIME AVAILABLE PROBAE!LITY OF SEQUENEES (PER RX YEAR)
FOR LOSP FAILURE TO RECOVERY (HRS)
REC 0VEP CFFSITE PO',.ER i
l TYPES 1) 6.2E-2 60 1.E 4**
1)'
6.2E-2 48 1.E 3**
2) 1.5E-2 30 5.E 3 3) 5.2E-4 3
.25 4) 2.0E-3 10'
.06 l5) 2.1E-3 7.5 0.13 Based on containment conditions.
Estinates of recovery pectability at times greater than 24 hcurs are spe:ulative since insufficient data exists to characterize such recovery l
probabilities even on a generic basis, MW" g fp (L
< " 4 y. J
" fp, s -;g,.ftf b,'
,e
, off M p A,,td)^*1 A f " pfi G i
l r W x 2 >A jYn e dls.
i I
A*-
L, T
pn'r*
e'A-
/
-38 l
JRH1 l
\\
i i
I I
I
9 l
Mobile Power Units Available (Om):
As temporary measures to further impro've on-site power source reliability, LILCO has installed four mobile diesel generator units.
These_udts_pypjjJdtLswitchyards and can be manually switched into the plant when required. A detailed reliability analysis of these units by LILCO indicates a reliability of.93 per diesel generator.
- Hewever, because of the need for operator interaction to start and connect the units, a conditional failure probability of.03 is used in the analysis to characterizel the commer cause failure of 3 out of 4 of the mobile units (any 2 diesel pS-generator units a re assumed recuired for _ ntiaimumdad).
These may be very conservative assumptions.
f Diesel Generators Avrilable (D):
For this analysis, the installed diesel generators are assured as a groundrule to have an unavailability of 1.0.
fire Water Available (N:
LILCO ha's performed an analysis of additional backuo reactor core cooling modes which de not recuire AC power. These methods require extensive manual operation and unusual plant lineups and therefore are heavily time dependent.
These alignments have been practiced by the operating staf' at
$horehar to verify their workability.
In addition, since they are heavily I
operator dependent, there may be a common mode coupling between these acticas f and those associated with the manual switching of the mobile diesel generato*s and the black start gas turbine.
The conditional failure pretability of I utilizing the fire water sources as a coolant injection back up are taken to be time dependert as follows:
Time Available
_ Conditional Failure Probability 2 days 0.1 30 hrs.
0.2 10 hrs.
0.3 7.5 hrs.
0.4 3 hrt.,
0.5 l
i i
39-JRH1
l l
3.1.2 Timing The LOSP event tree evaluation is based upon the accident sequence tining fror a number of deterministic calculations, including:
a.
General Electric LOCA calculations t
b.
LILCO calculations c.
Appendix B calculations with MARCH Since operator action and restoration of power are strong tire depercent furetions, the calculated timing of events sets the boundary conditiers fer the accident secuence quantification.
Table 3.1-2 summarizes some of the imccriart timing for the LOSP initiated accident sequences.
i i
3.1.3 Surney of DeMeant Sequences Based upon the calculated timing and the quantified accident sequences it is found that the following secuences dominate the core vulnerable frequency:
l 1
t Station blackout scenarios in which high pressure coolant l
0 irjectice (HPCIkRCIC) is unavailable and the operator slowly depressurizes according to procedure, and no AC power can be restored within 7!
hours.
i Station blackout plus a $0RV causes loss of both coolant o
HPC! iniection.
W 3.1.4 L0$P - Sensitivity Study 3.1.4.1 Two 50RVs The case of two $0RVs has not been explicitly calculated in the 6' pewer i
restricted case since the conditional probability of two 50RVs is calculated to i
be quite low, i.e.,
approximately it 5 per transient challenge for LO58
[
initiators from 5% initial power.
The consequences of the two 50RV case would 40 i
l be similar to a large LOCA and therefore the addition to the core vulnerable frequency for LOSP initiation would be approximately:
a)
Initiator frequency (LOSP 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) = 4E-2/RxYr b)
Two 50RVs = IE-5/ event c)
Auxiliary on-site power sources = 1E-1/ event This yields a total addition to the core vulnerabic frequency cf less ther 4E-8/ reactor year.
3.1.4.2 Diesel Generator Reliability The probabilistic quantification has been carried out assuming that the installed diesel generators are not included in the plant design.
However, a sersitivity study performed on the diesel generator reliability has shown that even if the joint reliabilities are arbitrarily reduced by two orders c' magritude below that derived from generic data, the installed diesel generators still previde significant reduction in the calculated core vulnerable frecueacy for the loss of offsite power initiated accident sequences.
The calculatec reduction is on the order of a factor of 3 to 10 (see Appendix E).
3.1.5 Results of LOSP Initiater The Shoreham PRA calculated the frequency of core vulnerable everts resu from loss of offsite power initiators and determined the total frequency to be approximately 1E-5 reactor year.
This frequency is judged to be sufficiertly low as to be acceptable both in relationship to other accident sea.,ence frequencies and relative to the proposed NRC safety goal.
S The calculated core vulnerable frequency due to accident secuences initiated a LOSP for Shoreham during the start up test phase with the installed diesel generators assumed unavailable is approximately 3E-6/ reactor year (see Table 3.1.3).
This frequency is less than the comparable sequence frequercies for Shorenan when operating at full power with installed diesel capacity evaluated JRH1
TABLE 3.1-2 CONSTRUCTION OF TIMING SCENARIOS l
FOR THE EORE VUL ERA 8tE STATES (51 POE R RESTRICTION)
TIMING TIE DELAY B0ll 0FF PLANT ACCIDENT PRIOR TO INVENTORY TIME AVAILABLE TOTAL TIME CONDITISIS SE0tKMCE BOIL OFF (TIME TO 10 CORE PRIOR TO CORE DE51GNA10R INITIATION UNCOVER)
HEAT UP VULNERA8tE 1)
Station hiackout, with
- 1) Te, Tex 10 hrs.
>33 hrs.
15 hrs.
Approximately 1)* initial coolant make-up through 10 or 30 hrs. as noted 2 days 1)' Te, Tex 30 hrs.
>:35 hrs.
16 hrs.
Approximately 3 days 2)
Station blackout.
- 2) TeU 4 hrs.
30 hrs.
13 hrs.
45 hrs.
with makeup available (Co8NS11ed through 4 hrs Depressuri-
~
zation)
?)* Less of makeup 2)* TeUK 0
18 hrs.
12 hrs.
30 hrs.
Initially but no (High depressurization Reactor Pressure) 3)
Station blackout A05 Tel no coolant injection 0
30 min.
24 hrs.
3 hrs, 4)
Station blackout TeP 50RV One HPCI in-O 25 hrs.
12 hrs.
>35 hrs jection to Level 8 5)
Station blackout Teu' depressuriza tion.
30 min.
45-60 min.
6-7 hrs.
7.5 hrs.
No make-up available JRH1
.17 -
l
1
~
.r y.
I
-i f'
with generic 'faiiure rates, and is far below the proposed safety goals. ' Iri addition, if even modest allowance is provided for the installed diesel generator this low frequency is further reduced by an additional factor of 3 tc 10.
~
TABLE 3.1.3
SUMMARY
OF LOSP
[ ACCIDENT SEQUENCE QUANTIFICATION -
1 LOSP
' TIME TO FREQUINCY FREQUENCY SEQUENCE CORE (PER Px YR)
(PER Rx YR)
~
TYPE
~
VULNERAELE
. DIESELS PROB-l DIESELS ABILISTICALLY UNtXA!LABLE j
a AVAILABLE TYPE 1 2 days 1.E-8 1E-7 TYPE 2 30 heurs 3.2E-8
- 3. 2 E - 7..
I
- )PE 3 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 8E-8 8E,
e TYPE 4 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> 5.9E-8 5.9E-7
'~"
TYPE 5 7.5h'gues 1.5E-7 '
1.5E 6 TOTAL 3.3E-7 3.3E-6 3.2 LOSS OF COOLANT ACCIDENTS (LOCAs)
This section provides an assessment of plant risk associated wit ( postulated LOCAs initiated from plant operation at St power.
A variety of LOCAs ~ are analyzed in the PRA because each represents a unique, potentially sesere, challenge to several plant safety systems.
In general, LOCAs have their largest impact on the availability of coolant injection systems, but there is alio the l
l potential for induced failures in containment systems.
These challenges to containment, which are shown in the She,reham PRA not to have a significant irrpact on the frequency of core vulnerable conditions, nevertheless may have a o
- 43=
JRH1
significant impact on overall risk estimates because of the potential for direN radionuclide releases outside of containment.
This aspect of the PRA is one of the considerations for the analysis of LOCAs initiated during operation at 5'.
The discussion to follow includes -estimates of LOCA sequence timing, a requantification of LOCA initiated core vulnerable sequences, and a sumary cf the overall risk associated with LOCAs at low power.
3.2.1 Sequence Timing for LOCAs Initiated From 5t Power The five types of LOCAs analyzed in the PRA include large, mediur, and small breaks inside of containment, RPV ruptures, and large LOCAs outside cf centaineert.
Because of the low decay heat energy levels following a scrar fecr low power, the timing of postulated accident sequences associated with these initiators takes on a different character from that described in the PRA Appendix B).
The reference scenario for the evaluation of sequence timing involves the double ended rupture of main steam line piping with subsecuent failure of all injection.
The initial blowdown phase as the RPV depressurizes to containment pressure is judged to be essentially equivalent to the blowdewn described for LOCAs initiated from full power operation.
However, for low power operation, the core heatup phase following a large LOCA is expected to te significartly longer, i.e., the onset of high fuel clad terperature car be delayed for up to three hours.
This reference value of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> is ene of the key parameters used to requantify secuence frequencies for large LOCAs in the following section.
In addition, this sequence timing is applied to medium LOCAr as well.
Small LOCAs are assumed to be characterized by sequence timing sieilar to that described for transients in which the reactor is isolated (Section 3.3 While this may not be conservative, it does not appear to play a sigrificant role in the calculations. Given that containment survives the initial LOCA blowdown and RPV makeup is established, the time available prior to centainment overpressure is greatly extended (on the order of 20-30 days) because of the lower decay heat levels.
As described in Section 3.3, sequences of this nature are judged to be small contributors to core and containment vulnerable conditions.
Therefore, a detailed quantitative analysis of these sequences is not presented in this section.
. JRH1
3.2.2 Quantification of LOCA Sequences Initiated From St Power In this section, accident sequences for each of the five LOCA initiators are reviewed and, where possible, requantified to reflect the frequency of core vulnerable conditions due to operation at low ~ power.
Each of the initiator frequency estimates is derived from very limited dita. Therefore, factors which may contribute to the initiator frequency estimates, such as the low number of stress cycles placed on the reactor coolant system, are not quantifiable.
For this reason, the LOCA initiator frequency estinates are judged to be the same as used in the Shoreham PRA.
3.2.2.1 Large LOCA and RPV Rupture Sequence Quartification There are three significant events to consider in the large LOCA sequence quantification:
reactor scran (Event C), vapor suppression system. availability (Event D), and low pressure injection (Events V', V", and V).
Failure of any one of these three events is assumed to lead to core vulnerable r onditions in the PRA.
The first two of these events involve a challenge similar to that expected for LOCAs initiated from full power opera tiers.
Therefore, no recuantificatien of events C and D', is considered.
Failures of low pressure injection, however, may be backed up by various operator initiated contingeccy actiers.
Injection of service water directly into the RPV is one such contingency. The use of the fire water system, which can be connected through a spoolDiece tc the ultimate core cooling connection, is another such certingency which car be implemented within a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> time frame.
Because of the potertial for significant delays in perfonning these complex contingency actiers, a relatively high conditional failure probability is estimated for operator backup actions:
0.5/ demand.
Based on this reduction in conditional failure probability coupled with the~ assumed decrease in reliability due to a wear-in-period, the total failure probability of Event V remains similar to the original PRA.
The accident sequence requantification is sumarized in Table 3.2-1.,
in addition to the large LOCA accident sequences another set of sequences involves breaches of the RPV.
For break sizes beyond a DBA successful mitigation may still be possible from initial powers of 54 if the core spray JRH1
1 system is functioning.
Therefore, sequences involving RPV breach and 1
unavailability of adequate coolant injection are found to make a negligible contribution to the frequency of core vulnerable states due to loss of coolant makeup.
3.2.2.2 Mediun LOCA Sequ'ence Quantification The medium LOCA initiated accident sequences quantified in the PRA involve a delayed RPV depressurization in which the use of HPCI for short term injectier, eventually requires initiation of low pressure injection systems.
In this regard, short term HPCI operation is considered a viable method of reacter depressurization, but necessitates low pressure system operation.
Because of the very low decay heat levels following scrams from low power, a LOCA in this size range is assured capable of depressurizing the reactor without HPCI or A05 prior to core heatup.
In other words, it is assumed that the RPV depressurizes below the shutoff head of low pressure systems prior to tne onset of core ove rh' eat.
This assumption makes failures of Event X, timely depressurization, no longer relevant.
Therefore, virtually all medium LOCA events depressurize sufficiently rapidly and to such a degree that they require mitigation by Icw pressure injection systens.
Additional credit for backup low pressure injectice system capability similar to the large LOCA case accounts for a reduction factor of 2.0 in the core vulnerable frequency for cases involving failures of low pressure injection.
However, the potential increase in system unreliability during the plant start-up (wear-in period) offsets this improvement.
The impact of these assumptions on frequency estinates for medium LOCA accident secuences appears in Table 3.2-2.
3.2.2.3 Small LOCAs Small LOCAs, as stated in Section 3.2.1, are judged to be characterizec by depressurization rates substantially less than 50RV sequences discussed in Section 3.3.
One of the implications of this is that the rate of coolant loss is much lower, extending the time available for recovery actions and reducing the RPV makeup flow requirements.
In recognition of these sequence characteristics, the success criteria for RPV inventory makeup is modified to incorporate the viability of the CRD pumps as an adequate coolant injection JRH1 '
source. In addition, the fire water and service water systems contingench actions previously described are also considered successful options.
In the first case, a positive point is that CRD pump ficw is available at any reactor pressure.
A second consideration, however, is that the break location fce a small LOCA may be in the lower region of the RPV which may divert a significant fraction of CR0 flow.
Therefore, an estimated reliability of 0.9/ challenge is applied to small LOCA sequences to account for CRD flow.
Third, RPV depressurization is judged inevitable in the long term due to the low decay heat levels.
Therefore, HPCI, RCIC, and feedwater are not given credit for long terr operation.
This impacts a significant fraction of sequences which were previously considered successful recovery states; increasing the challenge te low pressure systens.
Additional reliability of O'.5/challence is used tc account for operater backup contingencies in sequences involving failures of low pressure injection systems, which 0,ffsets the factor of 2 increase in equiprert unr.eliability due to the start-up (wear-in phase).
Table 3.2-3 summarizes the accident sequence cuantification for the high and low power cases.
3.2.2.4 Larce LOCAs Outside of Containment Large LOCAs outside of containment from 100'. power are extrenely rare everts, which by their nature may cause failures of RPV ccolant injection systers.
The situation for cases of low initial power may be substant ally di'ferent. There i
are anticipated to be more success paths due to additional time available; however, no requantification has been performed because of the very low care vulnerable frequency.
3.2.3 Imcact of LOCA Recuantification on PRA Table 3.2-4 summarizes the quantification results for the LOCA sequences providing a comparison between operation at high and low power.
As showr, the total estimated frequency of core vulnerable sequences due to LOCAs decreases by approwbnately a factor of 4
~ JRH1
TABLE 3.2-1 LARGE LOCA SE00ENCE FREQUENCY ESTIMATES FOR HIGH AND LOW POWER OPERATION ACCIDENT ESTIMATED FREQUENCY-FULL ESTIMATED FREQUENCY LOW SEQUENCE CLASS POWER (EVENTS / REACTOR YR) POWER (EVENTS / REACT 0D YP)
AV III 9.8E-8 9.8E-8 AD III 7.0E-8 7.0E-8 AC III 7.0E-9 1.4E-8 AW 11 3.4E-7 AV'V"W II 3.5E-7 R012
~
TOTAL, CLASS II 6.9E-7 TOTAL, CLASS III I 8E-7 1.8E-7
.O Tx..
l 8.7E-7
=
1.8E '.
- Estir.ated frequency less than 10'9/ reactor year
% JRH1
4 -
,8 i
TABLE 3.2-2 MEDIUM LOCA SEQUENCE FREQUENCY ESTIMATES FOR HIGH AND LOW POWER OPERATION ACCIDENT ESTIMATED FREQUENCY-FULL ESTIMATED FREQUENCY-L0k SEQUENCE CLASS POWER (EVENTS / REACTOR YR)
POWER (EVENTS /REACTOP YR) 5 0UX III 2.4E-7 N/A 1
5 0UV III 2.5E-7 2.5E-7 1
S GOL III 5.0E-9 5.0E-9^
g 5 0VW II 7.5E-8 1
5 0VV'W II 2.1E-10 3
5 0VV'V"W II 1.9E-7 3
5;C IV 3.0E-8 3.0E-8
TOTAL, CLASS II 2.7E-7 TOTAL, CLASS III
'5.1E-7 2.6E-7 T0TAL, CLASS IV 3.0E-8 3.0E-2 TOTAL 8.0E-7 2.9E-7 Estimated frequency less than 10~9/ Reactor Year Additional time to core vulnerable could result in a reduction in the
+
calculated frequency.
++ The RHR heat removal capability of approximately 3'. of full power could result in a significant change in the perception that a LOCA coupled with a failure to scrar could not be effectively mitigated from low power.
O i
e JRH1
TABLE 3.2-3 SMALL LOCA SEQUENCE FREQUENCY ESTIMATES F00.
HIGH AND LOW POWER OPERATION ACCIDENT l ESTIMATED FREQUENCY-FULL ESTIMATED FREQUENCY-LOW SEQUENCE CLASS POWER (EVENTS / REACTOR YR)POWER (EVENTS / REACTOR YR) 5 0LX III 1.5E-8 2
2.9E-9 S 00V.
I i
1.1E-10 5.0E-9 2
5 GOL I
j 2.1E-7 2
2.1E-8 l5 W II 1.3E-8 2
.'S 0W l
II 1.1E-10 p
- S0UW II 2.6E-7 2
S 0VVW i
II 1.1E-8 2
l i
- TOTAL, CLASS I
2.1E-7 2.6E-8
, TOTAL, CLASS II 2.1E-8 TOTAL, CLASS III 1.5E-8 2.9E-9 TOTAL 2.6E-7 2.9E-8
- Estimated frequency less than 104/ Reactor Year TABLE 3.2-4 FP.E0UENCY ESTIMATES FOR LOCAs IN PRA ACCIDENT CLASSES ACCIDENT ESTIMATED FREQUENCY 1005 ESTIMATED FRE0VENCY 5' CLASS POWER (EVENTS / REACTOR YR)
. POWER (EVEt.TS/REACTCE YR)
I 2.1E-7 2.6E-8 II 9.9E-7 7.2E-9 l
III 1.0E-6 4.4E-7 IV 3.7E-8 3.0E-8 V
3.6E-8 3.6E-8 TOTAL 2.3E-6 5.4E-7 JRH1
- ~ ~ ~ ~ ~ ~ -
3.3 OTHER TRANSIENTS Loss of offsite power initiated transients are evaluated in Section 3.1.
The category of "other transients" includes all of the remaining events described in the Shorehar PRA in which the reactor is challenged and successfully scrammed
- Thus, this category includes both relatively high frequency "anticipeted" transients such as spurious trips, MSIV closure, etc. and low frequercy initiating events as shown in Table 3.3-1.
TABLE 3.3-1 SEQUENCE INITIATORS IN WHICH THE REACTOR IS SCRAMMED AND THE PRIMARY SYSTEM IS INTACT I
t
.Af. :CIPATED TRANSIENTS
- LOW FREQUENCY INITIATING EVENTS l
i
125V DC Bus Failure Marual Shutdown Reactor Building Internal Floods
' MSIV Closure Reactor Water Level Instrument Failures 10RV Loss of Reactor Building Service Water Loss of Feedwater Loss o' Condenser Vacuur LOSP treated in Section 3.1 This section of the report consists of a reassessment of the dorinant core vulner.able sequences (as defined in the PRA) which are associated with these transients for start-up operation when power is restricted to a maximum of 5' of full power.
By definition, these initiators are contributors to the frequency of accident Classes I and II which involve loss of adequate coolant inventory and unavailability of containment heat removal, respectively (see Section 2).
JRH1 --_.
'~
o Before beginning the detailed quantification, it is useful to provide s'omi perspective on the effects of low power operation on the postulated accident sequence Classes I and II.
The evaluation of core or containment vulnerable conditions associated with the unavailability of adeouate containment heat' removal (Class II) includes the following considerations:
o The capacity of the suppression pool is very large (approximately 600,000 gallons).
For those events resulting in the trans fer of primary system stored energy into the suppression pool, the initial increase in suppression pool temperature would be on the order cf 50*F, raising the temperature to approximately 150~F.
The decay heat load for the next day would add about another 10*F.
Additional tire without cortainment heat removal would result in progressively slower tercerature rises.
This yields an extensive tine available tc the operatirg staff to respond with extraordinary means if deenec y
necessa ry.
Since the Shoreham LPCI pumps can effectively pur suppressier pool water even when saturated, these sequerces are found to be well below frequencies which can be credibly quartified.
[
The time required for initiation of containment heat removal fe?lowir; o
a. shutdown from Si, power is conservatively calculated to be on the order of 10 to 30-days.
o In addition, there is significant evidence that even at these tires the passive heat losses from the containment through the containreet walls will exceed the decay heat produced in the fuel.
Given the extended amount of time to reach a positive equilibriurr, it is found that the containment and core vulnerable frequency derived from these sequences (i.e., TW) are below 10 / reactor year.
Based upon this assessment, the focus of the evaluation of the transient initiators is on the ability to maintain adequa.te coolant inventory in the reactor vessel.
(The evaluation of transierts coupled"with a failure to scram is addressed in Section 3.4).
JRH1.
4 E
O e
e APPENDIX A DOCUMENTATION OF INPUT DATA FOR PROBABILISTIC EVALUATION l
A-1 JRH1
A.1 SUP9tARY OF LOSS OF OFFSITE POWER RECOVERY MODEL The conditional failure probability to restore offsite power given that it has become unavailable is an important parameter in the evaluation of loss of offsite power accident sequences..The change in the probability as a functior, of time can be characteriPd with reasonable accuracy over the initf a'l 2 to 4 i
hours time period.
Past this time the recoverability function becomes uncreasingly difficult to quantify due to the lack of adequate data.
Virtually all of the data points used to characterize extremely long duration loss.of offsite power situations are suspect.
Based on this the EPRI data can be characterized as conservative.
In order to establish a point estimate for -
recovery beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (f.e. the only data point), use is made of a model developed in the Zion PRA for offsite power recovery.
The Zion PRA sumarizes the recovery of offsite power as follows:
"Very few events are expected to result in physical damage to all six of the transmission lines at Zion, such that none can be reenergized through remote switching operations".
Some events (such as tornadoes, major ice storms, severe lightning, etc.) could, however, produce extensive damage, requiring several hours to repair.
We express the' following histogram as a representative distribution for the time to restore power to at least one 345 KV transmission line, given the fact that the cause of the fault has been identified and all required manual operations have been perfonned at the Zion switchyard.
Available power line data (Reference 1.3-5) is consistent with this histogram.
}
Time Following Local Operations Probability 0-1 minute
.70 1 - 10 minutes
.20 10 - 30 minutes
.05 30 - 60 minutes
.035
~~ 1-2 hours
.01 l
2-4 hours
.0045 4-8 hours
.0004 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />
.0001 i
A-2 JRH1
The implementation of this model at Shoreham is done by coupling the data from' EPRI NP 2301 with the Zion Model.
While this model does present a discontinuous function it is judged that the integrated effect of the model is reasonable.
Specifically, the failures to recover probability at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is judged to be overly conservative and the recovery probability beyond 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> is unknown due to lack of data.
Since extraordinary measures could be taken in the time frame greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the integrated model assessment is assumed reasonable.
The integrated model is shown in Table A.I.
o 4
A-3 JRH1
Tante A.1 SHOREHAM PRA VALUES FOR LOSS OF OFF-SITE POWER DATA SOURCE LOSS OF OFF-SITE POWEA INITIATING 0.04 PEA Rx Yr LILCO GRID FREQUENCY (PER RX YR)
CON 0!TIONAL PROSASILITY OF FAILURE TO RECOVER CFF-SITI POWER T*ME PHASE OURAT*CN OF TIME CUMULATIVE CON 0!TIONAL PHASE (HRS.)
FAILU RE FAILURE PROSA8ILITY PROBASILITY,,
I O-2 0.52' O.52 EPR!-2301 3/S2 II 2-4 0.28
O.54 4 - 10 0.23+
0.82 ty 10 - 24 0.06**
0.26 V
30 hrs.
0.005++++
Engineering VI 48 hrs.
0.001 0.2 Judgement (Cata VII 96 hrs.
0.0001 0.1 Extrapolation) l Based unen recovery within 30 minutes.
Based upon recovery within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
Sased upon recovery within 4 hcurs.
Based upon estimated recovery within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
- Conditional failure probablif ties are constructed such that the condition f ailure probability of restoring off-site power in time omase N is contingent upon the probability of power not being restored in time phase M-1.
++++ Conservatively derived from the zion PRA model which calculate values 10~4 to 10-3 for such events.
JRH1 A-4
s
.3 C
C
~
~
m l l 8
N 1
0 00 C
6=
Cw' 1
O L
C O
I./*
w m
t::
C ~,.
O
< ~
- g E
L O
~
~
O C:
O C
u V 6 3
4 C.
C o
34 C.
CCC. 4 LJ G
'~
O 6
O.=
_.C w S e c
V ed
@===
e w
-wC w
C Ow E C,h e
c5 i
c 6 g,.-
U o-m 3:-. -
5 e
c
.=
e b
~C tki C
st* =
n
=
~
- 6, e
w L
2:
- = 0 C.
\\
=
ew 3
w C
C w *i O z ">
J
=
ed 1 f C
ww m i
w C
3 u
- 4 m
$ U T. '.'"..E
~
>=
- e- -
O e
.O b
C
& C me t-N OL e0 a
23 *s E
m
~
U
-e OL c O
T m..o.
k.
cg EUN s
.C-6
[
l l
l f
C C
C C
C C
C C
C C
C C.
e.
cc.
4 e.
N.
h.
A m
in
~
C C
C C
C C
C C
C e
All'lI8V80Bd 9
~.
0, e'
e 5
9 J
APPENDIX B PLANT RESPONSE DETERMINISTIC CALCULATIONS 8"I SA!/01-667-05/84
PLANT RESPONSE DETERMINISTIC CALCULATIONS B.1 B a c k c rount' In the Shoreham PRA, il3, the risk methodology identi fied the important accident secuences which can lead to a core vulnerable condition and/or lo of cont ai nr'ent i nt egri t y.
The potentially ri sk domi n ant sequences were e.aluatec or the basis of an overal' assessment of the risk tc the ;ubit; f * '. -
these accidents initiated f rom full power and mature plant operation.
Tne ri s k analysts considered bot h the estimated frequency and poten*ial consecuences of severely degraded core accident events.
Tne ri sk do :i nar.:
sequences evaluated in the Shoreham PRA, as in other PRAs, were found to be those leading to core meltdown and containment failure.
The quanti fication of the point estimate f requencies of these accicents centered on the i ni ti ati ng event f requenci es and the assessed c onci ti on al f ailure probability of the required miti gating systems, gi ven the initi ating evert.
Tne results of the accident sequence evaluation in the PRA led to a quanti fication of fi ve generalized accident sequence classes which representec a spectrum of degraded core accident events.
Tnese accident sequence classes were furtner assessed to lead to a range of of f-site 'radionuclide releese events.
Tne radionuclide releases were found to yiele potentially severe of f-site consequences for those sequences where loss of cont ai nment i nt egat ty and core meltdown occurred early.
Because of the relatively short time scales of the characteristic plaet response of the accident sequences i ni ti ated at full power operati on, the evaluation of the Consequences of potentially severe reactor accidents were boun~ded by the five generalized accident classes, for whi ch the short terP plant response (i.e.,
prior to core vulnerability) cf speci fi c acci dee.
sequences were not examined in detail.
During low power operation, the short B-2 SA!/01-667-05/84
o.
term plant response of speci fic accident sequences become an i mport ant consideration in the overall probabilistic quantification process.
Therefore, deterministic calculations of the plant response were performed for specific acci dent sequences which may be mitigated or recovered if initiated at Iow power.
This appendix documents the deterministic calculations performed to investigate the plant response of several catego' ries of accident sequences initiated at low power.
B.2 Low Dower Ooeration Risk Anal ysi s The probabilistic risk analysi'. conducted here for the low power operation at Shoreham is basically a Comoarati ve evaluation.
That is, the risk at low power is ultimately comoared with the risk measure of full power operation as determined in the Shoretam PRA f,1].
As such, it i s important that the analysis of plant response, i.e.,
D1 ant model5 and physi cal process model5, are directly comparable between the PRA and this deterministic evaluation.
n In evaluating the risk domi nant sequences identified in the Shoreham PRA, as they apply to low power operation restricted.to five percent power or below, the important consideration relates to: (1) the definition of the recuirec plant systems which could successfully mitigate the accident, and (2) the time available for operator action wi thi n whi ch recovery of failed systems o*
alternati ve systems may be used before core vulnerability occurs.
These factors impact the assessment of the point estimate frequencies for those events leading to a core vulnerable condition.
In as much as the time constants of the accident progression during low power operati on are critical in the probabilistic quanti fication of recovery and mi ti gati ve measures, a more recent physi Cal process Comput ati onal model, MARCH-2 I23 was used in these calculations.
The Shoreham PRA used an earlier version of the same code, MARCH 1.1 f 3], in the analysis of severe accident progression for radionuclide releases.
It should be noted, however, that the use of MARCH-2 in thi s study does not conflict with the ground rules 0~3 SA!/01-667-05/84
=.
Q 4
established in the Shoreham PRA, since the present analysis is focused on the evaluation of the accident sequence timing, prior to core vulnerability for which the physical process models in the MARCH-2 code are judged to be more adecuate and realistic.
Assumotions and Physical Process Models in performing the analysis, the same plant models used in the Shoreham PRA for full power (as discussed in Appendix C of Reference [1]) were adopted in this 5+..*..
Tne accident procressinn det e rmi nati ons are timila-han a the assumpti ons and plant model s are analogous.
However, there are majoe differences which contribute to a substantial reduction in the risk associated with low power operation compared to the full power operation.
In order to adequately address these di f ferences, the f ollowi ng basic assumoti ons were made in this evaluation:
o There is a linear rel ati onshi p between radi cacti vi ty or d ec'ay heat and power, whereby the fi ssi on product i nvent ory at 100t power is i
nearly 20 times that at Si power f 4).
Tne decay energy release rate following shutdown follows the standard o
curve for uranium fueled thermal reactors, assuming an equi li b ri ur core.
In addition, the spatial distribution at shutdown CorresDonds to that of the spatial di st ri buti on in the operating conditions at low power.
o The ef fect of neutron capture in fi ssi on products and decay heat power from U 239 and Np 239 are included in the decay heat curve [5).
The decay heat power is related to the operating power history of the o
reactor core.
The short operation time (30 days) and anticipated fluctuations of the power level during this time are not considered in this analysis, it is assumed that the reactor core is exposed to a constant power level of five percent for a period of two years for consistent treatment with the Shoreham pRA.
B-4 SA1/01-667-05/St.
u.,<
It is expected that the assumptions with regard to the decay heat rate will conservatively overestimate the reactor power after shutdown f rom l ow power operati on.
The i mpact of these assumpti ons will be exami ned in the sensitivity analysis of Iow power operation.
Because of the substantial reduction in the decay heat energy release rate, there is a reduction in the required coolant recovery rate for mi ti gati ng accidents at low power.
Therefore the success cri teri on for the various accident types at full power analyzed in the Shoreham PRA could change.
Thi s analysis also investigates tha possi ble success paths for other types of accident events which are potentially risk dominant, Boundatv Conditions The evaluation of accident sequence ti mi ng requi res i nformati on regardin core design, plant sytems, containment or other engineered safeguard systems, etc. and the definition of the initial reactor conditions.
In this analysis, tne reactor i ni ti al condi ti ons are as defined by L!LCO [6] for low power operation. Those conditions at low power operation whi ch are si gni fi c antly di f ferent f rom that at full power mature plant operation described in Appendix C of the PRA [1] were considered in the plant models.
In p a rti cul a r, the following changes were made in the Shoreham plant models for this evaluation:
Tne reactor core power profile reflects the low power operation o
fuel and control rod configuration with corresponding power peaki ng factors.
The axial power peaking f actors are summarized in Table 1 and the radial distribution is shown in Figure 1.
o Due to the lower power level, the average core temperature is initially lower at five percent than at the full 100 percent rated The initial core temperature used is 640*F for this analysis, power.
which is approximately 400'F lower than the full power condition.
l I
B-5 SA!/01-667-05/S4
9 9
Table 1 AXIAL RELATIVE POWER PEAK!NG FACTOR PROFILE Axial Node' Peaking Factor 1
2 0.0388 0.162 3
0.239 4
5 0.305 6
0.3517 0.4208 7
0.5143 8
0.6376 9
0.7975 10 1.004 11 1.2802 12 13 1.4862 1.6252 14 15 1.7011 1.7233 16 17 1.7030 1.6517 18 1.5796 19 1.4959 20 21 1.4082 1.3225 22 1.2468 23 1.1667 24 0.8816 25 0.2597
- -The asial noce is identified incrementally relative from the bo**or of the acti ve fuel.
representing the 12.5 foot high core active fuel region.Each nod B-6 SA!/01-667 05/84
REIAllVE POWER DISTRIBUil0N SV ASSEM8LY, ARRAY P(1,J) 1 2
3 4
5 6
7 8
9 10 11 12 13 1
0.686 0.951 0.969 0.721 0.735. 1.024 1.068 0.8 38 0.967-1.347 1.359 1.144 0.333 2
0.951 0.760 0.828 1.014 1.086 0.779 0.873 1.173 1.316 1.039 0.982 1.0 4 0.315 3
0.969 0.828 0.799 1.105 1.062 0.868 0.857 1.289 1.357 1.070 0.997 1.043 0.310 4
0.721 1.014 1.105 0.789 0.871 1.157 1.279 0.939 1.065 1.474 1.424
'I.114 0.306 5
0.735 1.006 1.062 0.871 0.859 1.289 1.274 1.067 1.148 1.606 1.471 1.008 0.256 -
6 1.024 0.779 0.868 1.157 1.289 0.984 1.103 1 500 1.622 1.622 1.253 0.407 7
1.068 0.873 0.857 1.279 1.214 1.103 1.131 1.469 1.507 1.367 0.502 8
0.838 1.173 1.289 0.939 1.067 1.500 1.469 1.013 0.901 0.988 0.315 -
9 0.%7 1.316 1.357 1.065 1.148 1.622 1.507 0.901 0.684 0.673 0.195 10 1.347 1.039 1.070 1.474 1.606 1.622 1.367 0.968 0.673 0.236 11 1.359 0.982 0.99f 1.424 1.471 1.253 0.502 0.315 0.195 12 1.144 1.046 1.043 1.114 1.000 0.407 13 0.333 0.315 0.310 0.306 0.2%
FIGURE 1 RADIAt. RELAllVE POWER DISTRl8Uil04 AT LOW POWER OPERAil0N (1/4 CORE) e*
e H-7
s.,
At low power operation, the reactor coolant system (RCS) pressure and temperature would be slightly lower.
The reactor pressure of 950 psia versus 1020 psia is not expected to present a significant change in the RCS behavior particularly for the assessed domi nant sequences i nvol vi ng reactor depressurization.
Therefore, the basic PRA plant models were conservati vely adopted with regard to the reactor pressure vessel (RPV) pressure and coolant temperature.
The most i mport ant parameter change,is related to the reactor core thermal energy.
The stored energy of the core at low power is significantly lower than that at full power due to the lower initial average core wide temperature.
Thi s major di f ference is expected to af fect the sequence timing determinations significantly, particularly where core dryout occurs shortly following the initiating event.
B.3 Assessment of Dominant Accident Seouences Initiated at Low Power The analysis documented in this appendix focuses on those accident seque9ces whi ch have been identified in the low power PRA as potentially dominant and for whiCn operator action would be Critical i n mi ti gati ng such accident secuences.
Three generalized categories of acticent events with pot enti al ly similar impact on reactor response were evaluated. These include the following:
1)
T ransi ent event s with the RCS i solated. Two cases of these isolation events were considerec: a) no coolant i nj ect i on and b) coelant injection occurs via the high pressure injection systems.
2)
Transient induced loss of coolant acci dent s.
The cases considered include a large LOCA, a stuck open relief valve and a cont rolled bl owdown.
The effect of coolant makeup was also examined for the case with a stuck open relief valve.
3)
Transi ent events with f ailure to bring the reactor subt ri ti c al. The accident analysis pri mari ly considered ATWS sequences where the coolant injection f ails in the long term.
This could be due to pump B-B SA!/01-667-05/84
_m 1
i f ailure from either of two causes: the containment i ntegri ty being lost resulting in adverse or harsh envi ronment, or the lube oil degradation due to high suppression pool temperatures.
In addition, the reactor response for an ATWS coupled with a 50RV was also ex ami ned.
The categories of accident events described above were evaluated for the case where loss of of f-site power occurs, hence the plant systems requi ri ng i
of f-site power were not included in the accident analysis.
The evaluation consi sted of MARCH-2 calculations supplemented by hand calculations of sequence timing perturbations.
B.3.1 Catecorv I - Transient Events with the RCS !solated This category of accident events generally follow the Class I type of accident I
secuences addressed in the Shoreham PRA in which the reactor remains at hi gh In this evaluation it is assumed that following a transient initia-pressure.
ting event, the reactor is shutdown and isolated from the main condenser.
The coolant inventory is boiled off and discharged to the suppression pool through the safety relief valves.
Without suf fi ci ent coolant makeup, the core uncovers, the fuel would heat up and finally core vulnerability occurs.
Following full power operation, the accident progression to core vulnerability 1
is predicted to occur within 30 minutes.
For this accident sequence initiated at low power, there is a considerable time available between the initiating event and core vulnerability because of the low decay heat power level following shutdown at low pcaer operation.
The l
{
l B-9 SA!/01 -667-05/84 I
m-m
accident analysis performed predicts several hours (approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />) to initial core uncovering, and several more hours (approximately 11-12 hours) to heat up the core to core vulnerability.
An assessment of this accident event category with coolant injection was made to determine the demands for the HPCI and RCIC operation and their potenti al impact on battery depletion for LOSP cases.
The HPCl/RCIC pumps are steam turbine driven and start coolant injection when the RPV water level drops to the Level 2 set poi nt.
Coolant boil off to Level 2 was predicted to occur after approximately 12-13 hours.
Following coolant injection and recovery of the water level to Level 8 the HPCI would terminate injection flow.
It is assumed that these pumps would not be required to provide coolant makeup again until the coolant boils off to Level 2 (i.e., no operator intervention to throttle the flow is considered)
Based on a calculation of mass and energy balance, heat up of the coolant inventory to the SRV set point and boil off to level 2 was estimated to occur af ter approximately 1-1/2 days for this s cenari o, followi ng the i niti al recovery of coolant i nventory vi a the HPC1/RCIC pumps flow.
Core uncovery would subsequently occur af ter an additional day.
Therefore, the total estimated time to core uncovery given that the coolant inventory is recovered to Level 8 bi a single HPC1/RCIC cycle is approximately 2-1/2 days.
It is apparent f rom these estimates that the time sequence of an i sol ati on accicent event can be dramatically changed by delaying initiation of RCS and* fuel rod heat
- In tnese analyses, core vulnerability is defined in the context of cladd (assumed as a lumped parameter) to a maximum nodal up temperature of 1800*F to 2000'F where clad Incipient core melting could occur at 4130'F. rupture could potentially occur.
In the Shoreham PRA, because of l
the relati vely short time constants for core uncovery and overheat, core l
vulnerability was assumed to occur shortly af ter the core is uncovered to 2/3 l
of cwe height.
Core recovery with subsequent core cooling is by no means precluded beyond this point.
B-10 sal /01 667 05/84
coolant boil-o f f.
In the accident sequence described above, it is assumed that there is no operator intervention to provide coolant injection prior to the automatic initiation of the HPCI/RCIC systems at Level 2.
If coolant makeup is manually provided i niti ally, but is ultimately lost, the time to uncover the core and core heat up would be delayed accordingly.
Three such cases were evaluated.
In these isolation sequence variations, it is assumed that coolant is provided with the water level in the reactor seeking Normal Water Level (NWL) to Level 8 and that the reactor pressure is maintained at 1130 psia, the lowest SRV setpoint.
The time delays prior to boil-of f initiation were assumed to be 4, 10, and 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
The results of thi s i
evaluation are summarized in Table 2 below.
(
Table 2 - Summary of Impact on Isolation Sequence Timing l
for Various Time Delays Isol ati on Time Delay Time To Time To Seouence Prior to Core Core V ari ati on Boil Of f Uncovery Heatup 1
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />
> 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />
> 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> 2
10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />
> 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />
> 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> l
3 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />
> 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br />
> 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> An examination of the results shown in Table 2 indicates that the time to core heat up is not as significantly affected as the tirne to uncover the core for similar time delays prior to initiation of boil off.
In isolation sequences, where the coolant is not lost rapidly, the core is still partially covered when the uncovered core regions begin to heat up.
The uncovered fuel rods I
will experience cladding oxidation which could contribute to a si gni fi cant porti,on of the energy requi red to overheat the core.
The steaming rate is predicted not to be sufficient enough to cool the uncovered portions of the B-11 sal /01 667-05/84
l Core once elevated temperatures are reached which accelerate steam-cladding reaction.
The radiative heat transfer models in MARCH-2, however, indicate that the radiative heat transfer losses may compete with the clad-water reaction energy release rate.
For the sequence variation 3 involving a time delay of greater than 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> before core overheat occurs, the use of the radiative heat transfer models could extend the heat up time period of the fuel rods with the highest peaking factors by as much as 3-4 hours.
In this analysis, a range of times is indicated to account for the uncertainty associated with the heat transfer models in MARCH-2.
These analyses did not consider the passive heat losses through the reacto' vessel wall to the drywell and the cont ai nment walls.
It is judged that af ter two to three days, the decay heat rate would be very low compared to the passive heat losses through the vessel.
This would tend to stop boil off and si gni fi cantly reduce coolant loss from steam discharge through the safety relief valves.
Therefore, it is possible that vessel i nventory would be maintained with substantial reduction in the requi red injection capacity compared to full power operation.
Such minimal injection requirenents can be afforded by the CRD pump flow.
Therefore, it was determined that an alternative long term injection success path for this category of accident events would be via CR0 pumo flow.
B.3.2 Cateoory 2 - Transient Induced Loss of Coolant Accideat Thi s accident event category encompasses the class of accident sequences involving loss of coolant inventory f rom the vessel due to RCS breach.
- An assessment of the heat transfer between fuel rods and from the fuel assemblies to the core shroud using the radiative heat transfer models in the MARCH-2 code indicates that core overheat after dryout would be entended si gnj fi cantly.
Core vulnerability may not occur for isolation sequences where initta' tion of coolant boil-off is delayed substantially.
B-12 sal /01-667-05/84
The methodology applied in this evaluation includes a requantification of each of the functions that appear in the transient event trees.
However, it is not the intent of this analysis to reproduce the rationale used in the PRA, rather, it is intended only to emphasize the differences between high and low power operation which significantly influence quantitative estimates.
Therefore, the i
approach involves applying scaling factors to initiator frequency estimates and failure probabilities which are then applied.to the dominant event accident sequences te estimate the impact on the core vulnerable frequency.
3.3.1 Impact of Low Power Operation on Transient Initiated Accident Secuences At the outset of this discussion, it is noteworthy to outline some of the sequence differences between high and low power operation.
Specifically, the timirg of the everts is a key perspective for subsequent discussion.
The t
secuerce chronologies described in Table 3.3-2 are for the low probability scenarios described in Appendix B and as follows:
o Successful scran, reactor isolated, loss of all coolant injection (TOUV)
Successful scrar, one 50RV, loss of all coelant injection (TPOUV) o The decay heat level and the time available for operator action are critical to the analysis of event failure probabilities.
Two aspects of the quantificatior of event failure probabilities which may be enhanced during recovery at low power operation; but for which only a minimal level of credit is t'aken ir challenges from full power operation, are as follows:
l l
l JRH1
~ _.
e s
r 1.
Operator action:,
For low power operation, there may be a signific'arit' amount of time available for the initiation of ' contingency actions f
including connections of the. fire water system to the ultimate core cooling connection, or using an ensite fire pumper truck as a backup to the pur ;s used for injection to ultimate core cosling connection (i.e., the diesel fire purp and/or the service water pumps).
2.
Hieb cressure, low capacity systen availability:
An additionel plart system may be used for accident mitigation.from an initial power level o' 5'.
The CRD ' pumps are considered a successful means of. restoring and maintaining water level followin'g shutdown.
The high pressure capability of the CR0 purps makes them a valuable asset in accident mitigation.
TABLE 3.3-2 EVEr.T TIM!NG FOR CORE VULNERABLE SEQUENCES (5' INITIAL POWER)
TOUV TPQUt
.Ei'Et.T FULL P0.TR LOW POWER FULL POWER LOW POWER
' Scram l
0 min 0 rrin 0 min 0 mir I
/
Core Uncovery 30 min 38 hrs 30 min
,0 min 3
- Core
'Hea tup 30 min 11-13 hrs 30 min 4 hrs 1
i l
i I
l i '
JRH1
~ _ _ _ _
3.3.1.1 Initiator Frequency Ouantification This subsection provides the rationale used to requantify the dominant accident involving any of the transient initiating events listed in Table sequences 3.3-1.
The quantitative input for this discussion is sumarized in Table 3.3-3 which lists the estinated scaling factors for initiator frequt.ncies.
For additional perspective, refer to Section 3.5 of the Shoreham pRA for discussion of quantitative estimates that apply to challenges from full power operation.
The wear-in period for plant equipment (i.e., the initial 1 to 2 years o' operation) has been shown by operating experience to result in a higher thar.
average nunber of plant challenges. In this analysis, it is assumed that the number of challenges for most anticipated transients will be twice as high as the average for a mature plant.
The one exception involves turbine trip
^
initiators.
As stated in Section'1, the main turbine will much of this phase of operation.
remain idle curing This reduces one of the causes of turbire trips, that of failures related to the turbine itself.
Appendix A of the PP.A also assigns recirculation pump failures and spurious instrumentation trips te the more general categcry of turbine trips, which are still applicable events for the plant conffguratier at low power operaticr.
Therefore, while the first contributor is reduced, the others may occur with a higher than average frecuency for the reason stated above.
In the absence of data, it is judged that these effects are judged to offset each other, leaving no net change in the estimated frequency of turbine trips.
However, to provide the Shorehar operating staff the flexibility to " spin" the turbine with protective trips ir place, the evaluation includes a turbine trip challenge frequency of twice thet of a mature plant.
For the category of low frequency initiating events, no significant impact on the point estimate frequencies can be found.
If a trend does develop, it may be that. mature plants will have significantly fewer initiating events of.this type.
These. initiator frequencies are derived from relatively sparse experience data, for which there is no specific correlation to plant age.
Therefore, they are considered as likely for a nature plant as they are during the initial stages of low power operation.
JRH1.
,_,..n~
3.3.1.2 Mitigating System Conditional Failure Probability l
The conditional failure probability of mitigating systems is subject to many of the same argurents used above for the initiator frequency.
The exceptior.
however,.is that the generic data from industry used to characterize these system failures already includes a large fraction of " wear-in" data.
Therefore, the component failure probabilities are already judged to incorporate a substantial fraction of the potential for increased system unreliability.
Nevertheless, in order to ensure that the " wear-in" period is adequately treated, an additional factor of two is included in the system reliabilities.
This factor of two is aisc applied to common cause failures that may impact multiple systems.
The following discussion sumarizes the rationale used to develop scaling # actors for various events.
Evert C - Successful Scram, or, Criticality Control: A change of a factor of twc ir failure probability is assumed here for start-up operation at low powe-i consistent with the above discussion.
Event M - SRVs Open as Recuired:
A scram challenge at full power also causes (or is caused by) a turbine trip.
The subsequent reduction in steam flow car sometimes lead to a brief pressure challenge in the, reactor coolant system (RCS), forcing several relief valves to open.
Such a pressure transient is not applicable for the assumed plant configuration in this report.
As long as the MSIVs and turbine bypass valves remain open, no significant pressure rise in the RCS is expected following a scram.
In cases where the reactor becer,es isolated from the main condenser (e.g., MSIV closure) the pressure transient for low
~
power operation may be less severe, and in this analysis, it is assumed that only one group of SRVs (3 of 4) is initially challenged.
This is expectec to substantially reduce the failure probability for this event.
Due to the sparseness of available data, the signif.icant redundancy in this function, and the -minimal impact of failure of this event on subsequent calculations, no change..in the failure probability is considered in this analysis.
_ Event P - SRVs Reclose, RPV Integrity Maintained and LOCAs not Induced:The key point to consider for this event is that a different failure criterion from that described in the PRA is used for this analysis.
Because of the very low JRH1 decay heat levels following a scram from low power, this stady assumes that one L
SORV is sufficient to rapidly depressurize the reactor.
The significance __of I
this event is that it accelerates the rate of inventory loss 'from the RPV
~
,similar to a LOCA, thereby reducing the time available for operator action.
A significant uncertainty in the accident sequence quantification is the number of challenges to the SRVs, which is roughly proportional to the calculated failure probability of this event using the constant failure rate model.
For cases in which there is no vessel injection, the RPV heats up, pressurizes, and causes SRVs to lift; a process which is repeated a number of times until RPV inventory is depleted.
Since the boiloff process is slow, it is expected to be many hours between subsequent SRV challenges.
Therefore, in keeping with shutdowr. procedures, the most likely scenario involves the opera tor who is instructed tc manually open SRVs to prevent cycling. A second point to consider is the initiation of the steam driven pumping systems, HPCI and RCIC.
Because of the long response time available, it is most likely that these systems will be manually initiated to control RPV level as necessary, and also, because of the low decay heat levels, serve to depressurize the reactor without causing subsequent challenges to. the SRVs.
Therefore, only one demand on the first group of SRVs (3 of 4) is assumed.
Despite the substantial reduction in the number of SRV demands, the failure probability of this event is governed by the revised failure criterion.
Based on the failure rate data supplied in Apoendix A of the PRA increased by a factor of two (to account for equipment wear-in),
the failure probability of this event is calculated to be.02/ challenge, which is an order of magnitude greater than that calculated in the PRA.
This conditional failure probability is found to adequately quantify induced LOCA events following a transient initiator.
Event 0 - Feedwater Availability: This event can be viewed more generally as "High Pressure RPV Injection from Non-Safety Systems".
Within the Shoreham PRA following shutdown from high power, feedwater is the only system given credit for thj) function.
For shutdowns from low reactor power and success at event P, however, the flow from the CRD pump becomes sufficient to maintain coolant inventory.
This flow, which is normally available after a reactor scram, represents a significant improvement in the reliability of RPV injection.
The potential link to the feedwater system is through the normal AC power system. JRH1
As shown in the transient event trees of the PRA, relatively high estimates of feedwater unavailability are dominated by operator errors and hardware problers which would be relatively independent of the CR0 system.
Therefore, the combined reliability of these two systems is estimated to be improved by the factor of 0.99/ challenge to account for the CRD systen flow.
Events U' and U" - RCYC and HPCI Availability:
These turbine driven punping systems are capable of operating at relatively low steam supply pressures but do have 2200 rpm minimum throttling speed limitations.
Therefore, operation at very low decay heat levels may become erratic because continued operation of the pump may significantly reduce reactor pressure.
It is.iudged that the more
- ~ _ _ _ _ _
likely use of these systems will be for intermit _ tent _RPV level contro1I p-
^
to increase the potential for hardware, valve and for y/ g.
conditions are assumed h
control failures and therefore, the combined unavailability of these systems is increased by a factor of 2 for this analysis.
Coupled with the increase due to component " wear-in" this results in a factor of four increase in corrbined system f
unreliability.
Event X-Timely Reactor Depressurization: As stated for Event P, one open SRV is considered adequate for reducing reactor pressure.
Although this would appear to reduce the demand on the ADS, it is noteworthy to recall that the PRA evaluated the significant redundancy within the SRV depressurization syster and identified common cause failures as the dominant contributors. The common cause ccnditional failure probability is increased by a factor of twc to reflect the
" wear-in" period.
However, since the low initial power cases afford the opera tor a substantial amount of time to implement corrective action it is judged that the following three options would provide the operator the capability to depressurize over the extended time available for the low power initiators:
HPCI steam line with discharge to the suppression pool o
RCIC steam line with discharge to the suppression pool o..
MSIV or MSIV drain line to the main condenser o
Using these options the conditional failure probability is reduced by a factor (five).
The combination of the above factors "is a net reduction in the
- JRH1 J
.-s
- ~ ^ -
conditional failure probability of depressurization of a factor of 2.5.
For cases with an -SORV there would not be a requirement for the depressurization function because of the relatively rapid pressure reduction.
Events V', V",
and V - Core Spray, LPCI, and Condensate System Availability:
For-shutdowns from low initial power levels, the extended period of time j
available prior to core uncovery aIong with the reduced makeup flow recuirer'ert allow for possible contingency actions to be initiated.
Among these contingencies is the use 'of service water pumps and the diesel fire pump injection flow path via the ultimate core cooling connection.
Given.that the sequence does not involve an early loss of core inventory (e.g., an 50RV) the failure probability of the combined event (low pressure injection availability) is estinated to be a factor of 5 lower.
This quantitative assessment is based on the likelihood that at long times, i.e., greater than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> the technical support center (TSC) would be manned and creative decisions such as the use of service water could be implemented.
However, since the diesel fire pump procedure for injectior has not yet been implemented, this contribution to improved system reliability is not assessed at a high success rate. If the sequence timing is accelerated by an 50RV, then the combined failure probability is estinated to be only a factor of 2 lower due to the time constraints on operator action.
(The, estimate of
.5 in unreliability is iudged' to' be conservative).
Events W', 2, and W" - Containment Heat Removal: As discussed in the introduction of Section 3.3, the time frame for core vulnerable sequences following loss of containment heat removal is on the order of several days.
Plant failures under these conditions are not considered to be credible contributors to risk, therefore, a detailed quantification of dominant accident sequence frequency was not carried out.
3.3.1.3 Dominant Accident Sequence Quantification f
Using the scaling factors derived in this subsection, a subset of the Class I dominant acciden't sequences is requantified in Table 3.3-4 to estimate the frequencies of equivalent sequences initiated from low power operation.
All ' JRH1
~.. - - -.
Transient induced LOCAs are significant in that they tend to be more dominant probabilistically than small or medi um LOCAs.
From a plant response perspecti ve, these sequences are important since the rate of coolant lost through the safety relief val ve could lead to rapid core uncovering.
If cool ant i nvent ory is not reestablished, the core could heat up and core damage could occur early.
Following full power operation, the decay heat rate is sufficiently high that the reactor pressure could stabilize above the minimum HPCI and/or RCIC operational range, therefore, continued coolant injection by the HPCI and/or RCIC pumps is possible.
For low power operation, while the decay heat rate is low, the reactor operating pressure is nominally the same as for full power operation.
Since steam discharge through the 50RV is dependent upon the pressure, the rate of coolant loss for a given RPV pressure in both cases are equivalent.
A negative effect of the low decay heat rate for low power operation is that the reactor pressure -'y not be maintained above the minimum operating range of the steam driven HPCI and RCIC pumps given a 50RV.
Therefore, these pumps may become unavailable much sooner for LOSP SORV cases initiated at low power than for full power operation.
T.he positi ve impact of the low decay heat rate, however, outweighs the negative effect in that a substantial reducti on in the coolant makeup capacity is required to maintain sufficient core cooling.
In thi s
- analysis, several cases of Category 2 transient events were i nvesti gat ed:
(1) Stuck open reli ef valve (50RV) where the RPV coolant inventory lost through the 50RV is not recovered (2)
SORY where coolant makeup through the high pressure injection systems
~~
is available initially.
B-13 sal /01-667-05/84
(3) Transient events with intnedi ate blowdown through the ADS val ves without coolant makeup.
sequences in the steam lines.This case is judged to encompass large LOCA (4)
Transient events with controlled blowdown through the SRV, at of less than 100*F/ hour.
a rate accordance to a procedural limit on drywell conditions.The blowdow; For those sequences where inventory lost through the 50RV is assumed to be repl eni shed, the plant models considered t hat the coolant i njection is i ni ti ally provided by the HPCI and/or RCIC pumps duri ng depres suri zati on (while the reactor pressure is above the required set poi nt s ).
These sequences were further examined with minimal coolant make-up.
It was assumed that RPV inventory was subsequently maintained by the CR0 pumps in the long term following reactor depressurization and the single cycle of HPCI injection For this category of transient ' events, the reactor depres suri zati on would leave the core uncovered.
Without coolant makeup, the core would t he'n heat up.
Due to some steam cooling during the depressurization stage, radi ati ve heat transfe" and low decay heat levels, core vulnerability is estimated not to occur until after 2 to 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> following the transient event at fi ve percent power operation.
This would be extended further if the steam dri ven pumps are gi ven credit and coolant i njecti on occurs pri or to reactor depressurization below the HPCI pump operational range.
Case 1: 50RV Without Coolant Makeue The particular acci dent sequence evaluated here assumed the reactor is shutdown and i solat ed following the initiating event.
The RCS coolant temperature increases and the reactor pressure approaches the SRV setpoint of 1130 psi a.
The SRVs open to relieve reactor pressure and one SRV f ails to close.
Due to the low power levels of the core, the initially lower RPV pressure, and the initially lower t'
core average temperature, the RCS
" ool ant heatup to the SRV setpoint does not occur almost inrnedi at would be expected during the same transient event initiated at full power In this analysis, it is estimated that the SRV setpoint would be reached B-14 SAI/01-667-05/84
after approximately 20 minutes following the initiating event.
The MARCH analysis predicts core uncovery occurring 'at 25 to 30 minutes, and core heatup is initiated with the core fully uncovered.
Core overheat occurs in a steam starved envi ronment.
The reactor is depressurized and the coolant level is below the bottom active fuel height.
These factors lead to minimal steam generation rates, thus cladding oxidation does not contribute significantly to core overheating. The estimated time to reach core vulnerability is approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following the initiating event for this case of Category 2 accident sequences.
Case 2: 50RV With Coolant Makeup This case of transient induced LOCA sequences involves a similar transient event as Case 1 described above.
In Case 2, following the 50RV, duri ng the reactor depressuri zati on, the HPCI pump is assumed to be activated aut omati cally. Because of the coolant loss due to the canbined effect of flashing and boil off, it is assumed that water level in the reactor does not exceed level 8 thus the HPCI pumps are not tripped prematurely.
It is further assumed that the HPCI pumps would continue to operate as long as the reactor pressure is above 150 psig.
Therefore, the boundary conditions for coolant boil-off would be a reactor at 150 psig, the water level at approximately NWL, and a stuck open relief val ve.
Reactor depres suri zati on continues until the reactor pressure drops to approxi-mately 20 psi a.
Boil-off of the remaining coolant inventory at 20 psia involves a longer time than would occur at an elevated pressure due to the higher heat of vaporization at the lower pressure compared to 1130 psia.
In this scenario, following the initial core recovery, without subsequent coolant makeup from other modes of coolant i nj ecti on, it was determined that coolant boil off to the top of active fuel would occur within 20-25 hours. Subsequent core vulnerability is not expected to occur until after 12 to 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />.
Therefore, with a more realistic assessment of 50RV sequences for LOSP cases, there is a potential for extending the ti me B-15 sal /01-667-05/84 s
y s.,
before core vulnerability occurs.
Since there exists a driving force for the HPC1/RCIC pumps (i.e., sufficient steam pressure and flow rate from the RPV during reactor depressurization), it is judged that there is sufficient time to recover the other modes of coolant injection.
The CRD pumps providi ng subsequent cool ant flow into the vessel was found to mitigate this. accident event.
Case 3: Transient Events with Immediate Blowdown Case 3 is the limiting scenario of the Category 2 accident events.
invol vi ng t ransi ent induced LOCA accident sequences.
This scenario is intended to encompass large LOCA accident sequences as well, in which the reactor is depressurized to containment conditions almost immediately.
As in the 50RV cases, the core is completely uncovered after blowdown.
B ut since blowdown occurs very rapidly, the stored thermal energy in the core i s not sufficiently dissipated prior to initiation of core overheat.
In this sequence, the core becomes vulnerable within 2-1/2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, following the initiating event.
Case 4: Transient Event with Controlled Blowdown This scenario consi'ders a controlled depressurization of the reactor ini ti at ed by the operator to meet procedural limi t s of drywell temperature.
During loss of all AC power sequences, the drywell coolers become unavailable, and the drywell atmosphere could heat up beyond 296*F whi ch would requi re reactor depressurization.
The drywell temperature climbs rapidly during the first 5 to 10 minutes before heat transfer to the drywell liner is established.
In thi s analysi s,
the drywell temperature limit is assumed to be reached wi thi n 30 minutes at whi ch point the reactor is depressurized at a rate not to exceed 100'F per hour.
,This scenario effectively extends initiation of core heatup due to the concocrni t ant steam cooling during the depressurization stage.
Although core uncovery occurs within a few minutes, the blowdown to a pressure of B-16 SA!/01-667-05/84
o, u..,
150 psig is reached at approximately 150 minutes following the initiating Core event.
heatup subsequently follows and core vulnerability could occur after approximately 6-7 hours.
B.3.3 Category 3 - Anticipated Transients Without Scram Thi s category of accident sequences include those low frequency event sequences in which an anticipated transient coupled with failure to insert the cont rol rods may occur.
In the Shoreham PRA, the evaluation of postul ated ATWS accident events indicated that these sequences cou?d potentially lead to a more severe containment challenge compared with the other types of accident sequences investigated thus f ar.
Following operation at 100t power, pool heat-up and containment overpressure occurs rapidly.
The estimated time of core vulnerability determined in the PRA was approximately 30-40 minutes.
For ATWS events for which the condenser is isolated, the initial low power-level of 5 percent results in.a slower rate of suppression pool heat up which then provides more time for the operator to take action in mitigating the accident. In this evaluation, it is estimated that several hours would be required to heat up the suppression pool to saturation and several more hours for the containment to reach its ultimate pressure capacity.
This assumes that-the reactor power drops to approximately three percent of rated power or 60 percent of the initial low power level of five percent.
RCS coolant i nventory makeup is derived from the turbine driven HPCI pumps, and both trains of the resi dual heat removal heat exchangers are postulated to be unavail abl e.
The significance of high suppression pool temperature relates to the operability of the HPCI pumps under adverse conditions, e.g.,
lube oil The emergency procedure guidelines call for the operator maintaining the reactor pressure at 100-150 psig.
It is assumed in this evaluation that operator would tend to keep the reactor pressure from dropping well belowthe psig.
This would allow sufficient driving force for the steam turbine HPCI' 150 pump driver thereby ensuring availability of the HpCI system.
B-17 SA!/01-667-05/84
i
.s degradati on.
For some ATWS sequences evaluated in the PRA, continued coolant injection may jeopardize containment integrity which in turn could result in the degradati on of the ECC systems and inabili ty to mai nt ai n coolant i nventory.
Therefore, two cases of ATWS isolation events were considered in this evaluation:
(1) Coolant i njecti on is terminated at the point when the suppression pool temperature reaches 240'F.
In this scenario, coolant boil of f would occur in an intact containment.
(2) Continued coolant i njecti on is assumed, leading to cont ai nment f ailure and ECC f ailure.
This is subsequently followed by boil off of RCS coolant inventory in a failed containment.
In both cases described above, core vulnerability would follow shortly after core uncovery and dryout at decay heat energy levels.
The calculations performed predi ct an estimated ti me of' approximately 3-4 hours to heat up the suppression pool to 240'F.
For Case 1, subsequent to coolant injection being terminated a.t this point, the RPV inventory to the TAF is boiled off with the reactor at 3 percent of rated pw.er. The core is uncovered within 30 minutes after termination of coolant injection and heats up at the fission product decay heat power.
It is estimated that core vulnerability would occur at greater than ' 5-6 hours following core uncovery.
For Case 2, assuming that coolant injection is maintained, the containment is estimated to f ail by overpressure after approximately 6-7 hours.
F oll owi ng c ont ai nment f ailure, ECCS injection is terminated.
Coolant boil of f is estimated to uncover the core af ter 30 minutes and core overheat would subsequently occur after approximately 5-6 hours.
In thi s analysi s, the energy released via the steam flow to the Terry turbine HPCl/RCIC pump driver was not considered.
It is estimated that pool heatup and containment failure could be delayed by approximately 5-10 percent if this additional heat sink is considered in the analysis.
Transient events with failure to shutdown the reactor is potentially a more severe accident category because of the higher thermal energy release rate compared to shutdown conditions.
This category of accident events result in B-18 SA!/01-667-05/84
v o.-
w.,
the SRVs being open more often than would be if the reactor were shutdown.
The cycling of the SRVs present a challenge that could lead to one of the SRVs f ailing to close.
An ATWS event coupled with a SORV was i nvesti gated to determine the impact of the stuck open relief valve on plant response during the ATWS event, it was, determined that the reactor pressure could stabilize at approximately 350 to 400 psia for this sequence.
The impact on sequence timing would not be noticeably different.
However, a signi ficant perturbation would be the reactor cool ant loss following termination of i njection flow.
Blowdown could occur from 350 psi to containment conditions due to the stuck relief valve following decay in the core power which could result open in a more rapid core uncovering.
If the core becomes fully uncovered, a steam starved core condition would be expected during the core heat up phase delaying the core heat up period to some extent due to reduced clad oxidation B.4 Secuence perturbations The three ca*egories of accident sequences described above were also examined to determine the sensitivity of the accident event ti mi ng for power levels less than the reference value of five percent.
In this sensitivity evalua-tion, the reactor was assumed to be operated at a constant level of 2.5 percent of rated power; not the more likely scenario involving impulse power fluctuations below the reference five percent level.
The accident progression determinations were conducted consistent with the five percent power accident analysi s.
Because of the decaying nature of fission product energy release rate, the time scales of the accident sequences following shutdown are not always inversely related to the initial power level, i.e.,
at 2.5 percent power, the time to core vulnerability is not exactly twice that of the 5 percent power level case.
In general, the required time to boil off the same amount of wated inventory or heat up of the fuel would vary depending upon the time from shutdown at which boil off or core heat up is initiated.
This is apparent f rom the results of the assessment of the sequence perturbations of the B-19 SA!/01-667-05/84 i
I
r w...
category I transient events (i solation without makeup) i ni ti at ed at fi ve percent power level described in Section B.3.1.
The results of this sensitivity evaluati on indicate that for the transient events and isolatici cases without coolant makeup, (event category 1 described abovel the time to initial core uncovering estimated for the 2.5 percent power level case is approximately 45 to 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br />, and the subsequent core vulnerability is estimated to occur after another 26 to 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
If the reactor inventory is assumed recovered after boil off to Level 2, the time to core vulnerability would be found extended accordingly.
This assumes only a single cycle of HPCI and that subsequent coolant i njection does not occur.
Event category 2 evaluation (transient induced LOCAs) shows the same trent, and core overneat is predicted to occur at greater than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
For the ATWS scenarios, for whi ch no containment heat removal capability is assumed, cont ai nment integrity is jeopardized and coolant injection is lost at 6-7 hours.
This is followed by boil off and core overheat occurring afte-another 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after containment failure.
f ailure to bring the reactor For this sequence involving suberitical, the initial phase of the accicent assumes that tne reactor is at 60 percent of initial power level.
Therefore, tne rate of suppression pool heatup and containment pressurization is exoectec to be directly related to the assumed power level.
B.5 Summary and Conclusions The accidant analysis performed for the potentially ri sk domi nant sequences described above indicates that a significant ri s k reduction (in terms of esti-mated f requenci es ) during low power operation is possible.
The substantial time required to reach core vulnerability for each event category discussed in Section B.3, range from 2-3 hours to several days. This range of times would most.,likely provide suf ficient time for operator action to mitigate the B-20 sal /01-667-05/ea
u, acci dent.
in addition, the required Mtigative capacity of coolant injection sources is significantly reduced such that other coolant i njection success paths are possible.
The results of this evaluation as summarized in Table 3 provides an indication
^
of the time windows available for the operators to implement mitigative.
actions.
This table also shows the range of times prior to core vulnerability for the accident sequences studied in this appendix given some perturbations in the time delay prior to initiation of coolant boil off.
It appears that at low power levels, the time scales of the accident sequence progression to the point where the core or containment integrity may be lost are quite long that substantial times are available for operator action to mitigate the accident.
From an overall ri sk perspective (i.e.,
frequency and consequence considera-ti ons ),
the potential of f-si t e publi c health impact of these accident sequences initiated at low power would be reduced significantly.
Because of the low decay heat energy release rate, the containment integrity will likely be maintained for several days given that the accident does proceed unchecked to a core meltdown.
This will undoubtedly remove significant portions of the airborne radionuclide materials from containment, thus substantially reducing the amounts of fission products that could be released to the environment.
On the basis of thi s assessment, and considering the general aspects of radionuclide behavior, it is concluded that si gni ficant reduction in the source terms is possible at low power operation.
It is estimated that for the extended times prior to contair, ment failure and radionuclide release, a source term reduction factor rangi ng from 10 to 100 may be possible for si mi l ar accident sequences involving early containment failures studied in the PRA.
Furthermore, the fission product inventory of the reactor core operated at low power restricted to five percent is a factor of 20 less than that at full power.
e I
t B-21 SA!/01-667-05/84
+
Table 3 SU9 MARY OF EVENT T! MING FOR SELECTED ACCIDENT SEQUENCES AT LOW POWER OPERATION TIME DELAY TIME TO CORE TIME TO TOTAL ACCIDENT PRIOR TO UNC0VERY FROM C0RE OVERHEAT TIME TO CATEG04v 80lt OFF 80ll 0FF INITIATION FROM CORE UN"0VERY CORE VULNERAi!.:TY CATEh04V 1 Isola: ton 0
18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> 11-13 hours 30 nouas Transients 4 nours 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> 12-14 hours 2 cays 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> 33 hou s 13-15 nours' 2-1i2 cays 30 nours 35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> 14-18 hours 3-1/2 days CATEGJJT 2 50s. * 'o mese;:
0 25-30 minutes 3-1/2 nours 4 nea-s 5 34,'. ':91-tin' maiesp 3a 9+nutes 2u-2o nos s 12-14 nouas 1-1/2 days A25 (L)* l 0
0 2-3 hou s 3 houas a
Co : o'tec 5 '. o ::.4-0 45 5; minates 6-7 hos s 7.5 naa-s a
1 CA~Edss' 3 ATd5 with Co"tt19me9t inta::
3-4 nou s 30 minutes 5-6 nours 8 10 nsa s ATd5 wt:n Co9*ainne9%
fatleo 6-7 noa s 30 minutes 5-6 hours 11-13, no. s Time frpm initiating event given continued coolant injection from the supp ession pool, i.e., tne impact of nign pool water temperature (greate-tna9 24d'f) on HPCl/RCIC opera 0111ty is not considered in the analysis.
l JRH1-A B-22 L
i l
o g
a #
This analysis focused on LOSp cases for which the plant systems considered for coolant injection did not include those requiring of f-site power.
Extrapo-lating the results of this analysis to other accident initiators, could like-wise lead to extended times available for operator action for similar accident sequence progression.
In summary, a significant reduction of ri sk to the public (conservatively estimated as at least a factor of 20 to possibly 200 due to the reduced potential off-site consequences alone) is judged likely for the spectrum of accident events analyzed in the PRA for low power operation at Shoreham.
l l
SA!/01-667-05/84 B-23
s.,,
REFERENCES 1.
Shoreham Nuclear Power St ati on, Probabili stic Risk Assessment.
sal-372 83-PA-01, June 1983 2.
Draft Report on Status of Validation of the MARCH-2 Computer Code.
Battelle Columbus Laboratories, Columbus, Ohio, July 11, 1983 3.
Division of Systems and Reliability Research, Of fice of Nuclear Regulatory Research, Battelle Columbus Laboratories, MARCH (Meltdown Accident Response Characteristics)
Code Description and User's Manual, R.O. Wooten. H.l. Avci, NUREG/CR-1711 BMI-2064, Columbus, Ohio, October 1980 4
LILCO Interof fice Memo, NFD-83-016, January 24, 1983 5.
American National Standard for Decay Heat Power in Light Water Reactors, ANS!/ANS-5.1-1979, August 29, 1979 6.
Personal Communication R.J. Paccione (LILCO) and Z.T. Mendoza (SA!)
dated March 22, 1984 e
B.24 SA!/01-667-05/84
E 5
.k E
il APPEN0!X C 2
i SNPS/LILCO GRIO ELECTRIC POWER SYSTEM DESCRIPTION g
f
- t I
tre are two of f-site power sources at SNPS which are physically aa 3
sj
'a-a
- trically independent (1).
The primary source of of f site power to t"e
'j int is via the Normal Station Service (NSS) transformer which is conne:tes jj
_!'j
- ween the SNPS generator circuit breaker and the 138KV swi tchy a rd.
The
- ondary source is through the Reserve Station Service (RSS) transfoame-ich is connected to the 69KV transmission system.
A schematic diagaam of e 138KV transmission system in the area surrounding SNPS is shown in Fig.ae 1.
A one line diagram of the main portion of the SNPS electric power syste
.shown in Figure C 2.
The 138KV and 69KV transmission lines from the plant te-: out to various substations at nearby locations on the LILCO g-it. C e the getd connections, the Holbrook Substation, currently has a conne:tt:e a gas turbine generator with black start capability.
e on-site gas turbine generator considered for the bla:k sta rt modi fi c a*.':-
I
$NPS ts con-e:ted to the 69tv system on the site neaa tne RSS taansfo e.
e com' iga sti:n of the 69KV system witn respe:t to t=e on-site gas tsa:' e j
in Figu e C - 3.
a
. s n c.v a I
i JRHI c.1
9 f'
lsl'3
!_.1 i
8 3
I
{
b
.. ~..
s.
I 3 g,l
,I:; i' )
g J,f-y.}
_u p
g, t g; l}
s l*.,;!
n.!! '
I l'
e 8'
li 3.r t. '
)*
'L.~r.
1.I,.,
~
i,
,1.4 !a !A !; i,,y.l*,i' !
!) d d L.g -
3 3 3
- 'i l
i i
r l
l 8
-G I,i j
l
'L,b L;,
i l
,ll W. 4, 5, y j
i i
i -d'. 4 ~
_.5,_.
- i..,.
4..v..e
.[,
~
i.1..l. 1. l _..!'
- Ll/
L.,,
i i
f ie.
.,i i
p 8 e,
- - 3.. '
7 2r..i=;?!=f ri?
_2r sil.i l, rl si 8
-yl
, r t
i_
-, :: e -=.
. z..
s i
t l'
(
o ::
I
's s
3 g I,J
-~2n-1--
l,,
j.
(
P-W-is l--!
i JRH1 C.3
l e.,
g
/
\\
696V l
640
\\
i
/
~
623
%V
$witchyard VL W Mm l
?
1%V l
/%
/N 82-110
%/
%/
f On-site I
Gas Turbine Generator
+
figure t-3 kin autic Diagram of %oreham 69KV Switchyard
6 e
9
=
[
gl l8 A
t 3fn il Nn b
~
5o l lllll l"i:
p i.s
/
g i
1
/
f.
W.$,
I'
/ s,
/
(1 j
j I
\\.,
l 1 11:
l E,. %...
....... /
g, 1
,L-..,'
ll[m...
7 f
y r
[l[
I j 5 hn m
r--n 7.:';*
[. 7 l
f>
e:~. a>
}"....w. 2._'?
l =l1.i lr ~......(J
^q
~....
i]IJl ffI.
e.,,
I 1
,)J
......_.............m.
I; it $ l f
i ni JRH1 C-5
-.-...,--..__--,y
-.-_,---.---.-----v
R(FER(NC($
1.
Shoreham Nuclear Power Station. Final Safety Analysis Report. Oo:ket No. 50-322.
2.
Letter from R.J. Paccione/R.S. Zambratto (LILCO) to E.T. gu as (WLA), April 9,1983 O
e e
O e
4 JRH1 C-6
e, APPENDIK 0 ASSESSMENT OF LOSP EVENT DATA AND APPLICATION OF 00MI Two of the key parameters used in the Shoreham PRA for estimating the frequency of core vulnerable conditions following LOSP are: (1) the frequee:y of LO5P events, and (2) the time required for recovery of of f-site pcwer.
These parameters are derived from the LILCO grid reliability data base and EPRI NP-2301, respectively.
In the latter, data from a nationwide survey aae examined and conditional probabilities of recovery events are estimate for Shoreham.
The proposed black start modi fica tion provides a rede da-t 49:
diverse tethod for restoration of off-site power.
The time required for recovery 'of of f site power depends heavily on tne particular failure mode leading to the LOSP event.
A review of tne causes of the LO57 events in EPR!' NP-2301 leses to the definition of three ge e al categories of LOSP events: 1) grid failures or transmission line fa'i. es, 2:
ma'e swf tchyard failures, and 3) failures of both switenyaads.
These fai b e eveet categories allow the effectiveetss of the black start gas turti e syste-at Shoreham to be modeled and a sensitivity of its ef fe:tiveaess deve'::e:.
The LOSS categories are described as follows:
Grid or Transmission Line Failurest Based upon a review of histori:a' dait throughout the U.S. (1,2), grid failures range from a total system s%:::
to relatively minor switching errors that de-energize substations.
Witm pro:e-switching, either the black start system feeding the Holbroot Substattoa (22 miles from Shoreham) or the Shoreham on site gas turbine w$th bla:e sta t could restore power to Shoreham.
Transmission line failures are generally weather induced by causes su:N as wind stdrms or ice storms resulting in failures of several transmissics lines.
While the transmission lines at Shoreham are ge9 era 11y widely separated, tPe JRH1 D-1
l I
l 1
69EVcircuitdoessharethesameright-of-wayasoneofthetwo138KVcircuNs for a distance of approntmately one mile.
Tnerefore in cases in which the transmission lines become unavailable, the Holbrook black start system may be ineffective while the Shoreham on-site gas turbine could still provide power to the Shoreham on site electrical distribution system.
In this evaluation it is judged that the likelihood of recovery from getc failures is similar for LILC0 and for other grids in the U.S.
In other words, the black start gas turbine capability at Holbrook is judged to be adequately included in the ope ating emperience data base wnich reflects the strong possibility of recovery from such events.
Tnerefore, in the assessment of tne on site black start gas turbine ca ability, both grid fattures aac tra smission line failures can be lum;ed togetner for the pu pests or quaatification.
Ma*9 S='t:*y s d Failures:
These events as:1y to the range of f a'luaes. t ch coul d occur to tne vicinity of the main switchyaad.
These fattures a e corside e: to be inde;endeat of the availability of the 69KV syste.
In t*ese cases, the 6iKV syste9 is esse:ted to remain ent 112et, so tae'e is as su'staat'a' advartage to the addition of tne on site black sta** gas tu'3'ae.
failures of Both $witenyards:
These events involve cowca moce fa*1. es betnee the two switchyards.
In tnese cases, the black start cacabiltt/ =:.'t not be ef fective since the 69KV switchyard is required to at ect the ::.e-from the on site gas turbine into the normal 4160V buses.
Tne allocation of the fatture modes in EPRI NP-2301 into these enree cate;3 les is crucial in the assessment of the relative wortn of tag on stte gas turbire and its potential public safety improve?ent.
Thts allocation turns out to be one of the principal contributors to the uncertainty associated with the calculated reduction in core vulnerable frequeacy associat*ed with the Shoreham design modt fication.
Therefore, the follo=*ng quantification is structured to provide a sensitivity on the best estimate values to indicate the potential variation based upon data uncertainty.
JRH1 0-2 i
Table D-1 shows the categorization of the LOSP initiated events in EPRI NP-2301. Table 0-1 has been constructed with sorte subjective judgement used to characterize the failure modes.
In particular, the f ailure modes with potential impact on redundant switchyards have been inferred from the data; that is, those failure modes which are judged possible to cause a sim l anecas ut failure of both Shoreham switchyards are identified.
The conditional probability for failure to recover off-site power for each time phase is obtained from the sum of failures for each of the LOSP event categories.
EPRI NP-2301 contains a large amount of useful data to provide an overview of = Mat an " average" plant might look Itke.
However, one must be prudent in the application of these data on a plant specific basis.
In particular.
associating the Shoreham specific LOSP frequency with the geae-t e, f ai'. e moces from EPRI NP-2301 may unde estimate the benefit of the black staat capability.
Information presented in each Column of Table D 1 is described below:
(1) Nuclear plant at which the LO58 is recorded.
(2)
Incicents of LOSP which are caused by eit9ea total gric blackouts or transmission line failures (0 = less than 33 miNte duratton; a = is greater than 30 minute duration).
(3)
Incidents of LOSP in which a main switemy ard failure is involved.
(4)
Incidents of LOSP recorded in column (3) wnich also invol.*
multiple switchyard failures or the potential for suto aae identifted in column (4).
The probabilistic analysis of shoreham results in the calculatton of two cases: sensitivity A)
Main switchyard failure considered to have a higa itkelihood of impacting the reduncant switenyarc.
8)
Main switchyard failure consideaed to have a htgh o-uncertain likelihood of impacting tne reda9dJnt switchyard.
(5) The duration of each LOSP event.
(6) The number of grid connections at each plant.
4 JRH1 0-3 i
l l
l i
Table 0-1 CLASSIFICATION OF LO5P EVENTS APPEAAING IN EPRI NP-2301 1
l l
POTENTIAL NUM8ER OF OFF-5!TE:
IMPACT ON OFF-5!TE GA!D AND MAIN RE0uh0 ANT RECOVERY TRANS-NUCLEAR TRANSMIS$!0N SWITCH-SWITCHYARDS TIME M!$5!0N PLANT LINES YARD (1)
(2)
(3)
(A)(4)
(Hrs: Min)
LINES (3 )
(5)
(6)
- Bea vea Valley 0
- 17 2
,Ca!ve t C11ffs X
X 5:29 2
l Davis Besse l'
X*
3 0
- 26 3
,0resden 1 X
25:40 9
,Farley X
X A:$9 2
,Fitz:strick 0
<:01 2
f 0
- 03 2
, Fort Catho #
I 11:05 7
X X
- 54 7
0
<:01 7
G'-aa 0
- 30 2
i G*a X
- 40 2
Hat:n9 0
- 29 2
0
- 09 2
0
<:01 2
i 0
- 20 2
0
- 16 2
!NWottBay X'
I!ndtan Potnt X
2
'La Crosse 0
6:25 2
- 14 2
X 1:01 2
I 0
- 20 2
0
- 02 2
I A
X 1:50 2
0
- 10 2
A X
5:35 2
,Mt11 stone 1 X
X X
24: 37 2
,Nine Nile Point 0
<:01 2
i
,0coner.
I 1:00 2
,0yster Creek X*
X*
X*
3 L
See notes on ro11o.ing page.
JRH1 O'
T g
Table 0-1 (Continued)
CLAS5!FICATION OF LOSP EVENTS APPEARING IN EPRI NP-2301 POTENTIAL NUMBER OF OFF-5!TE:
IMPACT ON OFF-5 TE GRID AND MAIN REDUNDANT RECOVERY TRAN5-NUCLEAR TRANSMIS$!ON SWITCH-SWITCHYARDS TIME MI55!0N PLANT LINE S YARD (4
(1)
(2)
(3)
(A) )(B)
(Hrs: Min)
LINES (5)
(6)
Palisades A
- 56 3
X X
4:45 5
X X
3:30 5
X X
1:30 5
Pfigrim X
2: 40 3
X 8:54 3
point Beach 0
- 08 2
i X
- 55 2
Quad Cities X
1:11 4
San Onofre X
X X
4: 59 7
0*
- 04 7
i 0
<:01 7
!5t.Lucie 0
- 08 2
Waakee Acwe X
I
- 37 2
I i
l
.ine total n ncer of LOSP events is 45 u
x - Incteates an event lasting >30 miautes.
0 - Incicates an event lasting <30 minutes.
- - Ass."ed, based on the specific failure mode.
Included in the calculations as a failure lasting >4 hours.
The recoveay factors determined for LOSP events in tnis analysis inco ::-ne some subtle but potentially important distinctions regarding tne sour:e of t e
- data, i.e., the data set, is composed of a spectrum of failuael from rat e-minor single failure events through seveae weather conditions affe:: tag multiple transmission if nes.
Based upon the data in Ep8! NP 2301 (ca;ses a-:
durations), it is clear that there is a strong coupling between the du a*f on a
of the loss of of f-site power outage and the particular f ailure mode.
However, in the assessment of the on-site gas turbine capability the use of the dati to allocate enact failure modes entends the statistical significaa:e of the data to its limits. For this reason, this analysis attempts to esa-ine the general trend of the coupling of the failure modes (e.g. weat%ea) and JRH1 0-5
duration of LOSP and to provide both optimistic (CASE A) and pessismistic (CASE 8) assumptions in interpretation of the data to account for uncertainties in classification 0:
event.
From this perspective.
loa-duration transmission line failures take on an increasing importance.
Tme analysis incorporates these data directly into the probabilistic evaluation including the strong coupling between failure mode and duration of LOSP.
Table D-2 sumanarizes the data and classifies the failure modes by time phase consistent with the PRA.
The information in the table may be used to de ive estimates for recovery values used in the recovery logic model.
The time phases which have the highest contribution to core vuJneaab te fre:;en:y following LOSP initiators, f.e., time phases !!! and tv, na <e a subs:antial fraction of events for which off-site power has not bee 9 recove ec ba se:: upon historical nuclear plant cpe ating experience.
Table 0-2 SU* MARY OF LO57 EVENTS BY T!"E PHASE i
p l
GRID AND OFF-POTENTIAL IwpACT ON l
jf !*!
SITE TRANS-MAIN RESUNDAN? s c cwvac2s PHASE
- !55!0N SWITCHYARD CASE A
,1 CASE B I
(optimis:1c) '(pessimistic) i
' PHASE !
> 30 MIN 6
19 3
12
' PHASE !!
> 2 HR 4
11 3
9
, j. '
s' PHA$E I.]j
> 4 HR 3
10 3
8 PHASE IV
> 10 HR 1
2 1
1 I
JRH1 0~0
REFERENCES 1.
Loss of bff-Site Power at Nuclear Power Plants: Data and Analysis, EPRI MP-2301, March, 1982.
2.
- Scholl, R.F., " Loss of Off-Site Power Survey Status Repor", Revision 3 Report of the Systematic Evaluation of Program Brench, Division of Licensing, U.S. NRC.
e 4
s e
JRH1 0~7 e
APPENDIX E SENSITIVITY STUDY OF THE CORE VULNERABLE FREQUENCY ASSOCIATED WITH LOW TESTING The Main Report provides an indication of the assumed plant configuration for low power testing.
For simplification, steady state operation at Si power is in reality, however, the plant will be in a state of flux as numerous l
- assumed, system tests, inspections, and measurements take place.
The assumption of a 1
steady state power level of 55 is judged to be a conservative approach to the assessment of ris.k for low power operation.
The purpose of this Appendix is te l
provide additional bases for Concluding that this approach is conservative.
Specifically, a sunmary discussion of the detailed operational aspects of low power testing [1] is provided along with a best estinate, ra ther thar conservative ucper bound, evaluatian of the core vulnerable frequency.
E.1 DETAILED O'PERA*!0NAL ASPECTS OF LOW POWER TESTIt:G The initial plant testing at Shoreham invcives a series of four phases defined as follows:
Phase I:
Fuel loading and precriticality testing Phase II:
Cold criticality testing Phase Ill:
Heatup and low Dower testing to rated pressure / temperature l
conditions (approximately 1% rated power)
Phase IV:
Low power testirg (1-Si rated power) l The structure of the testing program is such that the plant must fulfill specific testing and operational objectives in each phase before continuing to the next.
Component " wear-in" failures will be repaired as they arise, which implies that the plant will have a full complement of safety systens available for ea,ch new power level.
j in this evaluation, it is judged that essentially no measurable risk car be f
associated with the first two phases of operation.
This conclusion is based on I
two observations:
E-1 JRH1
1.
WASH-1400 (2) identified spent fuel handling acciderts as a potential radionuclide release mechanism. Damage to unirradiated fuel would not fall into this category, however.
Fresh fuel bundles can be handled in open air and would not be subject to melting or significant radionuclide release.
2.
Cold criticality testing produces a negligible amount of heat (0.00018-to 0.001't of rated thermal power, or a maximum of 24kw).
Under these conditions, there is essentially no need for RPV inventory makeup systens.
If the RPV is inadvertantly drained, the core will beccre subtritical.
Therefore, postulated precursors to core damage (e.g.,
LOCA or failure to scrar) would have a negligible impact or core integrity.
Thus, Phases III and IV, in which the RPV is pressurized, stear is generated, and coolant makeup systens are required is judged to be the region of operation in which the first measurable risk due to radionuclide release appears The testir; prograr fer these phases censists of repeated gradual heatups to a marinur of Si full power followed by controlled cooldowns.
Only a small fraction of the total operating period is spent near Si power.
Because of these power cycles, it is judged that decay heat levels, which are dependent upon the power history, can best be modeled using an intermediate valve between 0% and 5' and assuming steady state operation.
For this reason, the core vulnerable frecuency associated with operation at 2.5'4 power is estimated in the followirg sec ti er..
E.2 CORE VULNERABLE FREOUENCY DUE TO STEADY STATE OPERA *:
As with the analysis presented in the Main Report, phenomenological calculations of postulated accident progressions are an essential starting point for assessing success criteria and quantifying event probabilities.
The analysis presented in this section is intended to (1) review the results of MARCH calculations for accidents initfWd for 2.5% power (2) identify and reassess events which are significantly Sfferent in timing or magnitude from the Si power case; and (3) quantify these differences to estimate the core vulcerable frequency. This approach is judged to be the most effective method of JRH1
_.s
evaluating the sensitivity of the assumed power level.
The results will be directly comparable to accident frequency estimates derived in the Main Report (5t power) and in the PRA (100t power).
E.2.1 ACCIDENT PROCESS CALCULATIONS Appendix B presents the results of proces.s calculations from MARCH for accidents postulated during low power operation.
The emphasis is primarily on the evaluation of parameters assumed for steady state operation at 5',
power.
In particular, the differences between 5% and full power include an upwardly skewed axial power profile, an average core tenperature of 640 F (representing a reduction of 400*F), and a reduced reactor pressure of 950 psia.
Given these differences, the key modeling difference between the 5!. and 2.5!: power level calculations is the reduction in initial and decay heat power levels. With this in mind, Table 1 presents a surra ry of the estimated timing of postulated accident secuences in which the cord becomes vulnerable to mel ting.
TABLE E-1 ACCIDENT SEQUENCE TIMING
SUMMARY
SEC'JENCE TOTAL TIME TO CORE VULNERABILITY (HRS )
5% POWER 2.5* POWER Scran, Isolation, Failure of Coolant Injection 30 71 - 80 Scran Large LOCA, Failure of Coolant Injection 3
10
~
ATWS,. Containment Initially Intact 8 - 10 14 - 15 JRH1
l These timing estimates are judged to-have a significant impact on the pla'nt
^
system success criteria beyond that already included in the Main Report.
Three principal effects are as follows:
1.
CRD purp flow is considered a viable alternative coolant injection source in accidents accelerated by a loss of coolant inventory.
This applies to SORV cases, medium LOCAs, and large LOCAs, but not RFV ruptures.
2.
RCIC alone is a viable alternative for coolant injection during ar ATWS (at 50 power, a combination of RCIC and CR0 flow is judgee necessary).
3.
The reactor power level following ATWS with RPT is estimated to be dw. thin the capacity of l' RHR heat exchanger.
This is based on the assumption that the power level will decrease by approximately 40' following RPT..Even if a single loop of RHR failed to match the ATES power level, the challenge to containment is expected to be substantially extended.
In these instances, a rationale similar to that described in the Main Report for dismissal of Class II challenges is judged applicable, i.e., the very long period of time available prior to containment failure represents a risk below that which can be credibly cuantified.
Therefore, such cases are judged to have a negligible frequency.
These success criteria are incorporated into the quantification of core vulnerable accident sequ'ence frequencies in the remainder of this section.
Additionally, revised event success criteria due to the timing estimates will be discussed as they arise.
E.2.2 OUANTIFICATION OF ACCIDENT SE0VENCE FREQUENCIES This section corresponds to-Section 3 of the Main Report. As such, a discussion and quantification of each of the four initiator types is presented; based on the revised success criteria for operation at 2.5% power.
E-4 JRH1
E.2.1.1 LOSS OF OFFSITE POWER INITIATOR The LOSP tree shown in Figure 3.1 of the Main Report consists of an initial subtree used to define groups of sequences with similar timing, followed by subsequent subtrees used for modeling time dependent events.
For the reassessment at 2.50 power, the only event requantified is Event R:
Recovery of l
Offsite Power.
Table 3-1 presents a comparison of the estimated recovery i
probabilities for the 5' and 2.5% power cases. This requantification results in a reduced core vulnerable frequency estimate of 7.7E-7 events / reactor-year for LOSP initiators.
TABLE 3-1 CONDITIONAL PROBABILITY OF RECOVERY OF 0FFSITE POWER AS A TIME DEPENDENT FUNCTION i
CONDITIONAL PROBABILITY CONDITIONAL PROBABILITY ACCIDENT OF FAILURE TO REC 0VER OF FAILURE TO RECOVER SEQUEEES OFFSITE POWER (5% POWEF.)
0FFSITE POWER (2.5% POWER) i TYPES I
1) 1.E 4
- 1.E-4 ^
^
^
1)'
1.E-3'*
- 1. E-4..*
^
2) 5.E-3 1.E-4 3)
.25
.06 4)
.06
.02 5) 0.13
.03 Based on containment conditions Estimates of recovery probability at times greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are based upon engineering judgement since insufficient data exists to characterize such recovery probabilities even on a generic basis.
E.2.2.2 LOSS OF COOLANT ACCIDENTS (LOCAs)
At 2.5% power, the viability of CRD pump flow tas its principal impact on mitigation of large and medium LOCAs sequences involving failures of low pressure systems.
Using an estimated CRD injection reliability of 0.9/derand (similar to the small LOCA case in the Main Report), the estinated frequency of core vulnerable conditions is reduced to 9.4E-8 events / reactor year and 6.0E-8 JRH1
~.
l 1
events / reactor-year for large and medium LOCAs, respectively.
Neither the additional time available nor the reduced challenge to plant systems frcr that described for 5; power is judged to have a quantifiable impact on other LOCA initiated core vulnerable sequences.
Therefore, the total estimated frecuency of core. vulnerable conditions due to LOCAs initiated from 2.5% power is redu:ed to 2.2E-7 events / reactor-year.
E.2.2.3 OTHER TRANSIEf.TS A significant contributor to the frequency of accidents initiated by "other" transients at 5'. power is the failure to maintain primary systen integrity.
Trarsient induced LOCAs or 50RVs tend to accelerate core heatup timing because coolant is lost early in the sequence. At 2.5% power, CRD flow is considered a viable alternative for coolant injection in these cases.
Assuming credit for CRC flow similar to other accident sequences in this category at 54 power (i.e.,
a reliability of 0.99/ demand), then the frequency estimates for induced LOCA er 50RV accident sequences are reduced by two orders of magnitude.
Other dominant. contributcrs to the frequercy of core vulnerable conditions are postulated to ' involve failures of depressurization systers which prevents injection by low pressure systens.
Intuitively, the extended core heatup tiring provides a basis for arguing that failures of depressurization systems may be recoverec' prior to reaching unacceptably high fuel temperatures.
However, the data and modeling required to support this assertion is a level of effort beyene
~
the scope of this analysis.
Therefore, it is judged that the already high combined reliability of depressurization systems at 5'. power is adequate for the estimated reliability at 2.5t power.
Thus, the total core vulnerable frecuercy due to other transients at 2.5%
power is estimated to be 3.5E-7 events / reactor-year.
E.2.2.4 ATWS The quantification of ATWS event trees at 5% power in the Main Report includes several changes in success criteria based on sequence timing.
The differences between 5% and 2.5% power are judged to be negligible with regard to the O
JRHl.
y
.,,m
,,m.ee._~m sw.
,,e e
a+=*--
---wir--*
e7m-
+rs% w a w M-yy
,w
,-cv y
wwr.4 a
~
~~
~
y requantification of events appearing in ATWS sequences.
The re fo re, the estimated frequency of core vulnerable conditions is the same for both ones.
E.2.3 COMPARISON AND
SUMMARY
Table 3-2 surnarizes the quantification of accident sequences frequenciei at 2.51 power.
As shown, the total frequency of core vulnerable conditions is reduced by approximately a factor of 3, primarily due to the extended timine c' LOSP sequences.
An additional contributor is the assumed viability of CR0 injection as a means of core cooling, which is also attributed to the extended sequence tiring.
While not explicitly calculated, it is judged that tne extended sequence tining would have a significant favorable impact er cther pararcters important to risk calculations including:
evacuation warrirg tires, in-cortainment residence times, etc.
TABLE 3-2 DOMINANT ACCIDENT SEQUENCE FREQUENCIES ASSUMING STEADY STATE OPERATION AT 2.5' POWER I
lh!TIATOR TYPE TOTAL SEQUENCE FREQUENCY Loss of Offsite Power 7.7E-7 LOCAs 2.2E-7 Other Transients 3.5E-7 ATWS 2.7E-7 TOTAL 1.6E-6 JRH1 E-7
. ~ ~ ~ - - '
.....a-REFERENCES 1.
Supplemental Motion for Low Power Operating License, submitted i r.
the matter of Long Island Lighting Company, Occket No. 50-322, to the Atomic Safety and Licensing Board, affadavit of J. A. Notaro and W.
E. Gur.ther, Jr., dated March 20, 1984 2.
- Reactor Safety Study, WASH-1400, NUREG75/014, dated October 1975.
e JRH1 E-8 1
,_.2_..,...-.----,7-
' ~ ' ' ~ ^ '
' ~ ~
~^
w.,
Transient induced LOCAs are significant in that they tend to be more dominant probabilistically than small or medium 1.0CAs.
From a
plant response perspecti ve, these sequences are important since the rate of coolant lost through the safety reli ef valve could lead to rapid core uncoveri ng.
If coolant i nvent ory is not reestablished, the core could heat up and core damage could occur early.
Following full power operation, the decay heat rate is sufficiently high that the reactor pressure could stabilize above the minimum HPCI and/or RCIC operational range, therefore, continued coolant injection by the HPCI and/or RCIC pumps is possible.
For low power operati on, while the decay heat rate is low, the reactor operating pressure is nominally the same as for full power operation.
Since steam discharge through the SORV is dependent upon the pressure, the rate of coolant loss for a given RPV pressure in both cases are equivalent.
A negative effect of the low decay heat rate for low power operation is that the reactor pressure may not be maintained above the minimum operating range of the steam dri ven HPCI and RCIC pumps gi ven a SORV.
Therefore, these pur ps may become unavailable much sooner for LOSP SORV cases initiated at low power than for full power operation.
T,he positi ve impact of the low decay heat rate, however, outweighs the negative effect in that a substantial reduction in the coolant makeup capacity is required to maintain sufficient core cooling.
In thi s
- analysis, several Cases of Category 2 t ransi ent events we 's i nvesti gated:
(1) Stuck open relief valve (50RV) where the RPV coolant inventory lost through the 50RV is not recovered
(,2) 50RV where coolant makeup through the high pressure injection systems is available initially.
B-13 SA!/0!-667-05/8:
(3) Transient events with i medi ate blowdown through the ADS valves, without coolant makeup.
sequences in the steam lines.This case is judged to encompass large LOCA (4) Transi ent of less than 100*F/ hour. events with controlled blowdown through the SRV, at a rate The blowdown is initiated at 30 minutes in accordance to a procedural limit on drywell conditions.
For those sequences where inventory lost through the 50RV is assumed to be repl eni shed, the pl ant models considered that the coolant i njection is initially provided by the HPCI and/or RCIC pumps duri ng dep res suri z ati on (while the reactor pressure i s above the required set poi nt s ).
These sequences were further examined with minimal coolant make-up.
It was assumed that RPV i.nventory was subsequently maintained by the CRD pumps in the long term following reactor depressurization and the single cycle of HPCI injection For thi s category of transient " events, the reactor depres suri zati on would leave the core uncove ed.
Without coolant makeup, the core would the'n heat Due to some steam cooling during the depressurization up.
stage, radi ati ve heat transfer and low decay heat levels, core vulnerability is estimated
~
not to occur until after 2 to 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> following the transient event at fi ve percent power operation.
This would be extended further if the steam dri ven pumps arp gi ven c redi t and coolant i nj ecti on occurs p ri or to reactor depressurization below the HPCI pump operational range.
Case 1: 50RV Without Coolant Makeue The particular acci dent secuence evaluated here assumed the reactor is shutdown and i sol ated following the initiating event.
The RCS coolant temperature increases and the reactor pressure approaches the SRV setpoint of 1130 psi a.
The SRVs open to relieve reactor pressure and one SRV fails to close.
Due to the low power levels of the core, the initially lower RPV pressure, and the initially lower core average temperature, the RCS
'c~ool ant heatup to the SRV setpoint does not occur almost imedi at e w1uld be expected during the same transient event initiated at full power In this analysis, it is estimated that the SRV setpoint would be reached l
B-14 SAI/01-667-05/84
.n
,~.
^
after approximately 20 minutes following the initiating event.
The MARCH analysis predicts core uncovery occurring at 25 to 30 minutes, and core heatup is initiated with the core fully uncovered.
Core overheat occurs in a steam starved envi ronment.
The reactor is depressurized and the coolant level is below the bottom active fuel height.
These factors lead to mi ni mal steam generation rates, thus cladding oxidation does not
- contribute significantly to core overheating. The estimated time to reach core vulnerability is approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following the initiating event for this case of Category 2 accident sequences.
Case 2: 50RV With Coolant Makeuo This case of transient induced LOCA sequences involves a similar transient event as Case 1 described above.
In Case 2, following the SORV,. during the reactor depres suri zati on, the HPCI pump i s ~ assumed to be activated aut omati cally. Because of the coolant loss due to the canbined effect of flashing and boil off, it is assumed that water level in the reactor does not exceed Level 8 thus the HPCI pumps are not tripped prematurely.
It i s further assumed that the HPCI pumps would continue to operate as long as the react or pressure is above 150 psi g.
Therefore, the boundary conditions for coolant boil-off would be a reactor at 150 psig, the water level at approximately NWL, and a stuck open reli e f val ve.
Reactor depressurization continues until the reactor pressure drops to approxi-mately 20 psia.
Boil-off of the, remaining coolant i nventory at 20 psia involves a longer time than would occur at an elevated pressure due to the higher heat of ' vaporization at the lower pressure compared to 1130 psi a.
' In this scenario, following the initial core recovery, without subsequent cool ant makeup from other modes of coolant i nj ecti on, it was determined that coolant boil off to the top of active fuel would occur within 20-25 hours. Subsequent core vulnerability is not expected to occur until after 12 to 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />.
Therefore, with a more realistic assessment of 50RV sequences for LOSP cases, there is a pot enti al for extending the time B-15 SA!/01-667-05/84 1
.-.ee e
e#
4
......------,-..---,.,w+
r..-
,.--.-g-.
r--g
J s.,
before core vulnerability occurs.
Since there exists a driving force for the HPC1/RCIC pumps (i.e.,
suf ficient steam pressure and flow rate - f rom the RPV during reactor depressurization), it is judged that there is sufficient time to recover the other modes of coolant injection.
The CRD pumps providi ng subsequent coolant flow into the vessel was found to mitigate this. accident event.
Case 3: Transient Events with Immediate Blowdown Case 3 is the limiting scenario of the Category 2 accident events.
involvi ng t ransi ent induced LOCA accident sequences.
This scenario is i
intended to encompass large LOCA accident sequences as well, in which the reactor is depressurized to containment conditions almost immediately.
As in the 50RV cases, the core is completely uncovered after blowdown.
B ut since blowdown occurs very rapidly, the stored thermal energy in the core is not sufficiently dissipated prior to initiation of core overheat.
In thi s sequence, the core becomes vulnerable withi n 2-1/2 to 3 ' hours, following the initiating event.
Case 4: Transient Event with Controlled Blowdown This scenario consi~ders a controlled depressurization of the reactor i ni ti at ed by the operator to meet procedural limi t s of drywell temperature.
During loss of all AC power sequences, the drywell coolers become unavailable, and the drywell atmosphere could heat up beyond 29' 6*F whi ch-would requi re reactor depressuri zati on.
The drywell temperature climbs rapidly during the first 5 to 10 minutes before heat transfer to the drywell liner is established.
In this analysi s, the drywell i
temperature limit is assumed to be reached wi thi n 30 minutes at whi ch point the reactor is depressurized at a rate not to exceed 100*F per hour.
This scenario effectively extends initiation of core heatup due to the
~
concocrni t ant steam cooling during the depressurization stage.
Although core uncovery occurs within a few minutes, the blowdown to a pressure of B-16 SA!/01-667-05/84
150 psig is reached at approximately 150 minutes following the initiating Core event.
heatup subsequently follows and core vulnerabi lity could occur after approximately 6-7 hours.
B.3.3 Category 3 - Anticioated Transients Without Scram Thi s category of accident sequences include those low frequency event sequences in which an anticipated transient coupled with failure to insert the control rods may occur.
In the Shoreham PRA, the evaluation of postul at ed ATWS accident events indicated that these sequences could potentially lead to a more severe containment challenge compared with the other types of accident sequences investigated thus far. Following operation at 100t power, pool heat-up and contai nment overpressure occurs rapidly.
The estimated time of core vulnerability determined in the f!RA was approximately 30-40 minutes.
For ATWS events for whi ch the condenser is is01ated, the initial Iow power-level of 5 percent results in a slower rate of suppression pool heat up which then provides more time for the operator to take action in mitigating the accident. In this evaluation, it is estimated that several hours would be required to heat uD the suppression pool to saturation and several more hours for the containment to reach its ultimate pressure capacity.
This assumes that the reactor power drops to approximately three percent of rated power or 60 percent of the initial low power level of five percent.
RCS coolant i nvent ory makeup i s deri ved from t5e turbine driven HPCI pumps, and both trains of the residual heat removal heat exchangers are postulated to be unavailable.
The significance of high suppression pool temperature relates to the operability of the HPCI pumps under adverse conditi ons, e.g.,
lube oil The emergency procedure guidelines call for the operator maintaining the reactor pressure at 100-150 psi g.
It is assumeo in this evaluation operator would tend to keep the reactor pressure.from dropping well below that the psi g.
This would allow sufficient driving force for the steam turbine HPCI 150 pump driver thereby ensuring availability of the HPCI system.
B-17 SA!/01-667-05/84
i degradation.
For isome ATWS sequences evaluated in the PRA, continued coolant injection may jeopardize containment integrity which in turn could result in the degradation of the ECC systems and i nabili ty to mai nt ai n coolant i nvent ory.
Therefore, two cases of ATWS isolation events were considered in this evaluation:
(1) Cool ant i njecti on is terminated at the poi nt when the suppression pool temperature reaches 240*F.
In this scenario, coolant boil off would occur in an intact containment.
(2). Continued cool ant injection is assumed, l eadi ng to cont ai nment f ailure and ECC f ailure.
This is subsequently followed by boil of f of RCS coolant inventory in a f ailed containment.
In both cases described above, core vulnerability would follow shortly after core uncovery and dryout at decay heat energy levels.
The calculations performed predi ct an esti mated ti me of' aporoximately 3-4 hours to heat up the suppression pool to 240'F.
For Case 1, subsequent to coolant injection being terminated at this point, the RPV inventory to the TAF is boiled of f with the reactor at 3 percent of rated power. The core is uncovered within 30 minutes after termination of coolant injection and heats
+
up at the fi ssion product decay heat power.
It i s estimated that core vulnerability would occur at greater than 5-6 hours following core uncovt ry.
For Case 2, assuming that coolant injection is maintained, the containment is estimated to f ail by overpressure after approximately 6-7 hours.
Fol l owi ng cont ai nment f ailure, ECCS injection i s terminated.
Coolant boil of f is estimated to uncover the core after 30 minutes and core overheat would subsequently occur after approximately 5-6 hours.
In thi s analysi s, the energy released via the steam flow to the Terry turbine HPCI/RCIC pump driver was not considered.
It is estimated that pool heatup and containment failure could be delayed by approximately 5-10 percent if this additional heat sink is considered in the analysis.
Transient events with failure to shutdown the reactor is potentially a more severe accident category because of the hi gher thermal energy release rate compared to shutdown conditions.
This category of accident events result in B-18 sal /01-667-05/84
4 s
'the SRVs being open more often than would be if the reactor were shutdown, i-The cycling of the SRys present a challenge that could lead to one of the SRVs failing to close.
An ATWS event coupled with a 50RV was investigated to determine the impact of the stuck open relief valve on plant response during the ATWS event.
It was, determined that the reactor pressure could stabilize at approximately 350 to 400 psia for this sequence.
The impact on sequence timing would not be noticeably different.
However, a si gni ficant perturbation would be the reactor coolant loss following termination of injecti on fl ow.
Blowdown could occur from 350 psi to containment conditions due to the stuck relief valve following decay in the core power which could result open in a more rapi d core uncovering.
If the core becomes fully uncovered, a steam starvec core condition would be expected during the core heat up phase delaying the core heat up period to some extent due to reduced clad oxidation.
B.4 Secuence Perturbations 1
The three categories of accident sequences described above were also examined to determine the sensitivity of the accident event timing for power levels less than the reference value of five percent.
In this sensiti vity evalua-tion, the reactor was assumed to be operated at a constant level of 2.5 percent of rated power; not the more likely scenario involvin'g impulse power fluctuations below the reference five percent level.
The accident progression determinations were conducted consistent with the five percent power accident analysi s.
4 Because of the decaying nature of fi ssion product energy release rate, the time scales of the accident sequences following shutdown are not always inversely related to the initial power level, i.e.,
at 2.5 percent power, the time to core vulnerability is not exactly twice that of the 5 percent power level case, in general, the required time to boil off the same amount of watee inventory or heat up of the fuel would vary depending upon the time from shutdown at which boil off or core heat up is initiated.
This is apparent f rom the results of the assessment of the sequence perturbations of the i
B-19 i
SA!/01-667-05/84 4
9
~., -
--...r.
,e n.,
r,, -,, -,, _. -,
.-----------e
category 1 transient events (i sol ati on without makeup) i ni ti ated at fi ve percent power ievel described in Section B.3.1.
The results of this sensitivity evaluati on indicate that for the transient events and isolation cases without coolant makeup. (event category 1 described abovel the time to initial core uncovering estimated for the 2.5 percent power level case is approximately 45 to 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br />, and the subsequent core vulnerability is estimated to occur after another 26 to 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
If tne reactor inventory is assumed recovered after boil of f to' Level 2, the time to core vulnerability would be found extended accordingly.
This assumes only a single cycle of HPCI and that subsequent coolant i njecti on does not occur.
Event category 2 evaluation (t ransi ent induced LOCAs) shows the same Dent, and core overneat is predicted to occur at greater than 10 h'ours.
l For the ATWS scenarios, for which no containment heat removal capability is assumec. containment integrity i5 jeopardized and coolant injection is Iost at 6-7 hours.
This is followed by boil off and core overheat occurring af te-another 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after c ont ai nment failure.
For thi s sequence involvi ng f ailure to bring the reactor subtritical, the initial phase of the acticent assumes that tne reactor is at 60 percent of initi al power level.
Therefore, tne rate of suppression pool heatup and containment pressurization is exoectec to be directly related to tne assumed power level.
B.5 Su-nary and Conclusiers The acciaant analysis performed for the potentially ri sk domi nant sequences described above indicates that a significant risk reduction (in terms of esti-mated f requenci es ) during low power operation is possible.
The substantial time required to reach core vulnerability for each event category discussed in Section B.3, range from 2-3 hours to several days. This range of times would most.,li k ely provi de suf fi ci ent time for operator action to mitigate the l
B-20 SA!/01-667-05/N
- - - - ~ ~
~"
~
accident.
In addition, the required ndtigative capacity of coolant injecti on sources is significantly reduced such that other cool ant injecti on success paths are possible.
The results of this evaluation as summarized in Table 3 provides an indication
~
of the time windows available for the operators to implement mitigative actions.
This table also shows the range of times prior to core vulnerability for the accident sequences studied in this appendix given some perturbations in the time delay prior to initiation of coolant boil off.
It appears that at low power levels, the time scales of the accident sequence progression to the point wnere the core or containment integrity may be lost are quite long that substantial times are available for operator action to mitigate the accident.
From an overall ri sk perspecti ve (i.e.,
frequency and consequence considera-ti ons ),
the potential off-site publi c health impact of these accident sequences initiated at low power would be reduced significantly.
Because of the low decay heat energy release rate, the containment integrity will likely be maintained for several days given that the accident does proceed unchecked to a core meltdown.
This will undoubtedly remove significant portions of the airDorne radionuclide materials from containment, thus substantially reduci ng the amounts of fission products that could be released to the environment.
On the basi s of thi s assessment, and consideri ng the general aspects of radi onucli de behavior, it is concluded that si gni fi cant reduction in the source terms is possible at Icw power operation.
It is estimated that for the extended times prior to containment failure and radionuclide release, a source term reduction factor rangi ng from 10 to 100 may be possible for si mi l ar accident sequences involving early cont ai nment failures studied in the PRA.
Furthermore, the fission product inventory of the reactor core operated at low power restricted to five percent is a f actor of 20 less than that at full power.
B-21 sal /01-667-05/84
~
Table 3
SUMMARY
OF EVENT TIMING FOR SELECTED ACCIDENT SEQUENCES AT LOW POWER OPERATION TIME DELAY TIME TO CORE TIME TO TOTAL ACCIDENT PRIOR TO UNC0VERY FROM C0RE OVERHEAT TIME TO CATEGO<t B0lt OFF 8 OIL OFF INITIATION FROM CORE UN 0VERY CORE VULNERAi!. TY CATEbORY 1 Isolation 0
18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> 11-13 hours 30 nou-s Transtents 4 nours 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> 12-14 hours 2 days 10 nours 33 nou s 13-15 hours 2-1/2 cays 33 hours3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br /> 35 hours 14-18 hours 3-1/2 days CATEGJJ) 2 503 w 'o mese;-
0 25-30 minutes 3-1/2 nours nou-s 5 34.' w ': 91,-
tie' maieap 33 - nu:et 2u-23 noa s 12-14 nou s 1-1/2 days A?5 (LJ -;
o 0
2-3 hours 3 nou s 0: : o'lec B l o-::..-
0 45-50 minutes 6-7 hou s 7.5 hoa s CA Eas"* 3 AT=S witn Co* 519de9%
inta::
3-4 nou-s 30 minutes 5-6 nours 8-10 nou s AT45 wt:n Co9*ainne9 failec 6-7 noa s 30 minutes 5-6 hours 11-13' no. 5
- Time fr.om initiating event given continued coolant injection from tne supp ession pool, i.e., tne impa:t of high pool water temperature (greate-than 240*F) on HPCI/RCIC operao111ty is not considered in tne analysis.
JRH1-A B-22
I
.,a This analysis focused on 1.0SP cases for which the plant systems considered for coolant i njection did not include those requiring off-site power.
Extrapo-lating the results of this analysis to other accident initiators, could like-wise lead to extended times available for operator action for similar accident sequence progression.
In summary, a si gni ficant reduction of ri sk to the public (conservatively estimated as at least a factor of 20 to possibly 200 due to the reduced potential off-site consequences alone) is judged likely for the spectrum of accident events analyzed in the PRA for low power operation at Shorenam.
]
e O
SAI/01-667-05/84 B-23
0 REFERENCES 1.
Shoreham Nuclear Power Station, Probabili sti c Risk Assessment, sal-372-83-PA-01, June 1983 2.
Draft Report on Status of Validation of the MARCH-2 Computer Code.
Battelle Columbus Laboratories, Columbus, Ohio, July 11, 1983 3.
Di vi sion of Systems and Reli ability Research, Of fice of Nuclear Regulatory Research, Battelle Columbus Laboratories, MARCH (Meltdown Accident Response Characteri sti cs )
Code Descripti on and User's
- Manual, R.O. Wooten, H.I.
Avci, NUREG/CR-1711 BMI-2064, Col umb.us,
Ohio, October 1980 4
LILCO Interoffice Memo, NFD-83-016 January 24, 1983 5.
Ame ri c a n National Standard for Decay Heat Power in Light Water Reactors, ANSI /ANS-5.1-1979, August 29, 1979 6.
Personal Communication, R..J. Paccione (LILCO) and Z.T. Mendoza (SA!)
dated March 22, 1984 B-24 SAI/01-667-05/84 l
E
?
I
,5,.
[
APPENDIX C i
il SNPS/LILCO GRID ELECTRIC POWER SYSTEM DESCRIPTION I.i,
' t
}
ere are two off-site power sources at SNPS which are physically ar:
'13
- q
=,'j
!:trically independent [1].
The primary source of of f-site power to tae I !
is via the Normal Station Service (NSS) transformer which is connecte ff int
- ceen the SNPS generator circuit breaker and the 138KV switchyard.
The
- endary source is through the Reserve Station Service (RSS) transforme-ich is connected to the 69KV transmission system.
A schematic diagasm of e 138KV transmission system in the area surrounding SNPS is shown in Fig. e 1.
A one line diagram of the main portion of the SNPS electric power system
.shown in Figure C-2.
The 138KV and 69KV transmission lines from the pla9t te-: out to various substations at nearby locations on the LILCO g-ic. C e the grid connections, the Holbrook Substation, currently has a conne:ti:n
.a gas turbine generator with black start capability.
I e on-site gas turbine generator considered for the black start modift a I
SNPS is connected to the 69KV system on the site nean the RSS traasfo-e.
e con'igs at :n of the 69KV system witn respe:t to t~e on-site gas ta :' e i
showe in F1gu e C-3.
a I
i b
JRH1 c.1
e
.i r"
i.
f It'l g
i i 1i, I
.i j
lJ-y.
t
,,I:i n!)
=
g
,2*3 lp1.s
_. u e, y -
e,
,sl I
- i..lil
,l!!.
5
.e. u n t II w a,,
I
- ~,../
ii ir oi i
e,,
,E.
s Is.g:*
y i,
2 at 2
,1,.
s:, ;, :
s,.
t
~..
- 1. 1.,. 5 e
- si ski,,=7..'enk
-c '],i i,i, i
: :
=,I e?
2?
a n
'A s
a, n
e i
-c -
8 i
d
--d '
3L(,
2 ar.
le l
l l
e1 E3 g.s.<, s i
p i
i
!l -d:j'E-d
.t
.1,' !,
. Q,v:
I
- a. =. ; =. : =.
lig g
ig e
s :..
3
- < ** *< w i
i i
.,1. l. l,l.-.d eL',i 4.;;1 5
i ii
,i ir3 8
i lle 3
.l
)
A
. 1 1 1
T T 1 *i et r
,e m
sn
_ i
~
. %I.,e
(
l' l',
i O ::
I)
.l.l b
I s
3 g
'l!r
-~2.11-j i:
I,,
p' sM-W-4 3:
.'ia.:
f e
i i
JRH1 C-3
u E
/
\\
69kV 4
640
~
\\
/
t r
i 623 4
9kV l
WW 4
t M
I n
a 13kV i
.l
/\\
/N I
1 r
i 1
.j 01-110 1
N/
)
N/
4 4
l On-site Gas Turbine l
Genera tor i
figure f.-3 Schenutic Diagram of Shoreham 69KV Switchyard
-a.
8 e
e A
- 1, c,=!
a s y.
g pn,p 5
it
.l g
e u.s{..,gi_ jkn Ea l' 1,I v
$ 5; II: Sj 3 ls}~?tst $sg; P
f g ylg I
u8 f.-.,,
- Tf 7
i E-Q 7
I 1
I'"\\,
II
<~
...):,
i
,,ni
/
-....m... m..... ;
~
- r-w o.r
,x I,,:g
)
j
~
clj
- ~.
r
-3.
7,'
l j.
fp~
e M (,'
le3 p
l El f
l
', '~~~,...
l a
k..',
J',, T ~;
' s l.
q.,,.~~ ~ ~
.., e I-rr j i1 9.e.
!! g g
. a.
1 El s s e
II n
/
1 N, :*1 i
C*
N JRHI C-5
- +.
m-
___-----__y_m+
..,,7
-._,.y.
REFERENCES 1.
Shoreham Nuclear Power Station, Final Safety Analysis Report, Do:ket No. 50-322.
2.
Letter from R.w'. Paccione/R.S. Zambratto (LILCO) to E.T. Bu ns (WL A), April 9,1983.
i JRH1 C-6 t
i
APPENDIX 0 ASSESSMENT OF LOSP EVENT DATA AND APPLICATION OF DOMINANT Two of the key parameters used in the Shoreham PRA for estimating the frequency of core vulnerable conditions following LOSP are: (1) the frequem:y of LOSP events, and (2) the time required for recovery of off-site pcwer.
These parameters are derived from the LILCO grid reliability data base and EPRI NP-2301, respectively.
In the latter, data from a nationwide survey are examined and conditional probabilities of recovery events are estima:e: for Shoreham.
The proposed black start modi fication provides a redarca-: and di verse method for restoration of off-site pc.er.
The time required for recovery 'of of f-site power depends heavily on the particular failure mode leading to the LOSP event.
A review of the causes of the LOSP events in EPR T NP-2301 leads to the definition of three ge e al categories of LOSP events: 1) grid failures or transmission line f a 'i.res, 2:
mate switchyard failures, and 3) failures of both switenyaads.
These f a' O e eve 9: categories allow tne effectiveness of the black start gas turti e sys:e-at Shoreham to be modeled and a sensitivity of its ef fective ess deve'::e:.
The LOSP categories are described as follows:
Grid or Transmission Line Failures:
Based upon a review of histoai:a' da:a throughout the U.S. (1,2], grid failures range from a total system 5%:d:
- o relatively minor switching errors that de-energize substations.
With pro:e-switching, either the black start system feeding the Holbrook Substatica (22 miles from Shoreham) or the Shoreham on-site gas turbine with bla:< sta :
could restore power to Shoreham.
Transmission line failures are generally weather induced by causes su:h as wind storms or ice storms resulting in failures of several transmission lines.
While the transmission lines at Shoreham are ge9 era 11y widely separa*ed, the JRH1 0-1
a
{
69KV circuit does share the same right-of-way as one of the two 138KV circuits for a distance of approximately one mile.
Tnerefore in cases in which the transmission lines become unavailable, the Holbrook black start system may ce ineffective while the Shoreham on-site gas turbine could still provide poder to the Shoreham on-s.ite electrical dist.-ibution system.
In this evaluation it is judged that the likelihood of recovery ( from grid failures is similar for LILC0 and for other grids in the U.S.
In other words, the black start gas turbine capability at Holbrook is judged to be adequately included in the operating experience data base which reflects the strong possibility of recovery from such events.
Therefore, in the assessment of tne on-site black start gas turM ne capability, both grid failures a' d a
traasmission line failures can be lumped toge:ner for the gu geses or a
qua at i fi ca t i on.
Main S=' t:*y s-d Fai lures :
These events apply to the range of f ailures wai tn could occur in thei vicinity of the main switchyard.
[Mse f ailures aae corside et to be inde:ende*t of tMe availability of the 69KV syste. IIn these '
cases, the 63XV systet is ex;etted to remain eneagized, so taeae is no suos*aatial advartage to the addition of the on-site black start gas tu-o'ae.
i Failures of Both Switchyards:
These events involve commea mode fai!.aes bet.een the two swi,tchyards.
In these cases, the black start cacarility wt.':
i not be effective since the 69KV switchyard is required to di ect the ::-e-from the on-site gas turbine into the normal 4160V buses.
The allocation of the failure modes in EpR I NP-2301 into these tnree catego-f es is crucial in the assessment of the relative wortn of the on-site l
gas turbine and its potential public sa fety improvement.
This a l l oc'a': f on turns out to be one of the principal contributors to the uncertainty associated with the calculated reduction in core vulnerable frequeacy associated with the Shoreham design modi fi ca t i on.
Therefore; the follow'ng quantification is structured to provide a sensitivity on the best estimate values to indicate the potential variation based upon data unc htatety.
(
b
\\
JRH1
,D.2 i
_w
_y,-
y
-m-m
4 Table D-1 shows the categorization of the LOSP initiated events in EPRI NP-2301. Table D-1 has been constructed with some subjective judgement used to characterize the failure modes.
In particular, the failure modes wi th potential impact on redundant switchyards have been in ferred from the data; that is, those failure modes which are judged possible to cause a simul aneous t
failure of both Shoreham switchyards are identi fied.
The conditional probability for failure to recover off-site power for each time phase is obtained from the sum of failures for each of the LOSP event categories.
EPRI NP-2301 contains a large amount of useful data to provide an overview of what an " average" plant might look like.
However, one must be prudent in tne application of these data on a plant specific basis.
In particular, associating the Shoreham-specific LOSP frequency with the ge e-ic.fai!. e modes f rom EPRI NP-2301 may underestimate the benef t: of the black s:a-:
Capability.
Information presented in each column of Table D-1 is described below:
(1) Nuclear plant at which the LOSP is recorded.
(2)
Incioents of LOSP which are caused by eithe-total grid blackouts or transmission line failures (0 = less than 30 minne duration; x = is greater than 30 minute duration].
(3)
Incidents of LOSP in which a main swi tchy ard failure is involved.
(4)
Incidents of LOSP recorded in column (3) which also invo!.e multiple switchyard failures or the potential for su:M ae identified in column (4).
The probabilistic analysis of Shoreham results in the calculation of two cases:sen si ti vi ty A)
Main switchyard failure considered to have a hig*
likelihood of impacting the redundant switcnyard.
B)
Main switchyard failure conside ed to have a high o-uncertain likelihood of impacting the redandant switchyard.
(5) The duration of each LOSP event.
(6) The number of grid connections at each plant.
JRH1 D-3
-_y
Table D-1 CLASSIFICATION OF LOSP EVENTS APPEARING IN EPRI NP-2301 POTENTIAL NUMBER OF OFF-SITE:
IMPACT ON OFF-SITE GRID AND MAIN REDUNDANT RECOVERY TRANS-NUCLEAR TRANSMISSION SWITCH-SWITCHYARDS TIME MISSION PLAhi LINES YARO (4)
(Hrs: Min)
LINES (1)
(2)
(3)
(A)
(B)
(5)
(6)
B! eavea Va!!ey 0
- 17 2
, Calve-: Cli f fs I
X 5:29 2
- avis Besse X'
X*
3 0
- 26 3
, resden 1 X
25:40 9
'Farley I
,'F i t:c a t ri ck X
4: 59 2
0
<:01 2
0
- 03 2
For: Catho;r I
11:05 7
X X
- 54 7
0
<:01 7
G'-aa 0
i
- 30 2
i Giaaa X
- 40 2
l Mattam 0
- 29 2
0 i
- 09 2
0 c:01 2
O
- 20 2
0
- 16 2
H obolt Bay I'
!!ndianPoint 2
X 6:29 2
la Crosse 0
- 14 2
X 1:01 2
1 0
- 20 2
0
- 02 2
X X
1:50 2
0
- 10 2
X X
5:35 2
Millstone 1 X
X X
24: 37 2
I 1,Mine Mile Point 0
0conee.
<:01 2
X
,0yster Creek 1:00 2
X*
X*
X*
l3 t
L See notes on following page.
JRH1 D-4
Table 0-1 (Continued)
CLASS!FICATION OF LOSP EVENTS APPEARING IN EPRI NP-2301 POTENTIAL NUMBER OF OFF-SITE:
IMPACT ON OFF-S!TE GRID AND MAIN REDUNDANT RECOVERY TRANS-NUCLEAR TRANSMISSION SWITCH-SWITCHYARDS TIME MISSION PLANT LINES YARD (4)
(Hrs: Min)
LINES (1)
(2)
(3)
(A)
(B)
(5)
(6)
Palisades K
- 56 3
X X
4:45 5
X X
3:30 5
X X
1:30 5
Pilgrim X
2:40 3
X 8:54 3
Point Beach 0
- 08 2
i 8
X
- 55 2
Quad Cities I
1:11 4
San Onofre X
X X
4:59 7
0*
- 04 7
I 0
<:01 7
'St. Lucie 0
- 08 2
- Yaakee Re e X
- 37 2
I l
i 7me total n meer of LOSP events is 45 u
X - Incicates an eveat lasting >30 minutes.
0 - Incica:es an event lasting <30 minutes.
- - Assu ed, based on the specific failure mode.
Included in the calculations as a failure lasting >4 hours.
The recovery factors determined for LOSP events in tnis ana *ysis inc:. :: ate some subtle but potentially important distinctions regarding the source of t e data, i.e., the data set is composed of a spectrum of failu es from ra:9e-minor single failure events through severe weather conditions affe:tirg multiple transmission lines.
Based upon the data in EP3.1 NP-2301 (ca;ses a :-
durations), it is clear that there is a strong coupling between the du a:icn r
of the loss of off-site power outage and the particular f ailure m:de.
However, in the assessment of the on-site gas turbine capability the use of
~
the dati to allocate exact failure modes extends the statistical significaace of the data to its limits.
For this reason, this analysis attempts to exa-ine the general trend of the coupling of the failure modes (e.g. weathee) and
(
JRH1 D-5
l duration of LOSP and to provide both optimistic (CASE A) and pessismis:ic (CASE 8) assumptions in interpretation of the data to account for uncertainties in classification of event.
From this perspective.
Ica; duration transmission line failures take on an increasing importance.
Tne analysis incorporates these data directly into the probabilistic evalua: ion including the strong coupling between failure mode and duration of LOSP.
Table D-2 summarizes the data and classifies the failure modes by time phase consistent with the PRA.
The information in the table may be used to ce-ive estima:es for recovery values used in the recovery logic model.
The time phases which have the highest contribution to core vulne ab'e fre ;ency follo-ing LOSP initiators, i.e., time phases !!I and IV, naDe a subs:antial fraction of events for which off-site power has not been recove ec based upon historical nuclear plant operating experience.
Table 0-2 SU" MARY OF LOSP EVENTS BY TIME PHA: 7 l
GRID AND OFF-POTENTIAL IMPACT ON jTIME SITE TRANS-MAIN REDUNDANT sw:TcsvioJs PHASE MISSION SWITCHYARD CASE A CASE S (optimistic)
(pessimis:ic)
' PHASE I l
> 30 MIN 6
19 3
12 j
' PHASE II i
> 2 HR 4
11 3
9 PHASE IJJ
> 4 HR 3
10 3
8 PHASE IV
> 10 HR I
2 1
1 JRH1 0-0
b e J REFERENCES 1.
Loss of Of f-Site Power at Nuclear Power Plants: Data and Anal ys4g, EPRI MP-2301, March, 1982.
I 2.
- Scholl, R.F., " Loss of Off-Site Power Survey Status Repor". Revision
- 3. Report of the Systematic Evaluation of Program Brench, Division of Licensing, U.S. NRC.
e e
d 4
e JRH1 D-7 e
I
APPENDIX E SENSITIVITY STUDY OF THE CORE VULNERABLE FREQUENCY ASSOCIATED WITH LOW POWEC TESTING The Main Report provides an indication of the assumed plant configuration for low power testing.
For-simplification, steady state operation at 5% power is assumed.
In reality, however, the plant will be in a state of flux as numerous systen tests, inspections, and measurements take place.
The assumption o# a steady state power level of 5*. is judged to be a conservative approach to the assessment of risk for low power operation.
The purpose of this Appendix is tc provide additional bases for concluding that this approach is conservative.
Specifically, a surmary discussion of the detailed operational aspects of low power testing [1] is provided along with a best estinate, rather thar conservative ucper bound, evaluation of the core vu.inerable frequency.
~
E.1 DETAILED O' PED.A'IONAL ASPECTS OF LOW POWER TESTING The initial plant testing at Shoreham involves a series of four phases defined as follows:
Phase I:
Fuel loading and precriticality testing Phase II:
Cold criticality testing Phase III:
Heatup and low power testing to rated pressure / temperature conditions (approximately 1% rated power)
Phase IV:
Low power testirg (1-5'J rated power)
The structure of the testing progran is such that the plant must fulfill specific testing and operational objectives in each phase before continuing to the next.
Component " wear-in" failures will be repaired as they arise, which implies that the plant will have a full complement of safety systens available for each new power level.
In this evaluation, it is judged that essentially no measurable risk car be associated with the first two phases of operation.
This conclusion is based on two observations:
E-1 JRH1
i 8
\\
1.
WASH-1400 [2] identified spent fuel handling acciderts as a potential
\\
radionuclide release mechanism.
Damage to unirradiated fuel would not fall into this category, however.
Fresh fuel bundles can be handled in open air and would not be subject to melting or significant radionuclide release.
2.
Cold criticality testing produces a negligible amount of heat (0.0001' to 0.001', of rated thermal power, or a maximum of 24kw).
Under these conditions, there is essentially no need for RPV inventory makeu; systens.
If the RPV is inadvertantly drained, the core will becnre subtritical.
Therefore, postulated precursors to core damage (e.g.,
LOCA or failure to scrar) would have a negligible impact or core integrity.
Thus, Phases III and IV, in which the RPV is pressurized, stear is generated, and coolant makeup systens are required is judged to be the region of operation in which the first measurable risk due to radionuclide release appears.
The testirg prograr fer these phases consists.of repeated gradual heatues to a marinum of Si full power followed by controlled cooldowns.
Only a small fraction of the total. operating period is spent near 54 power.
Because cf these power cycles, it is judged that decay heat levels, which are dependent upon the power history, car best be modeled using an intermediate valve between 0% and 5' and assuming steady state operation.
For this reason, the core vulnerable frecuency associated with operation at 2.5'; power is estimated in the follewir; section.
E.2 CORE VULNERABLE FREOUENCY DUE TO STEADY STATE OPERA :
0N AT 2.5'. POWER As with the analysis presented in the Main Report, phenomenological calculations of postulated accident -progressions are an essential starting point for assessing success criteria and quantifying event probabilities.
The analysis presented in this section is intended to (1) review the results of MARCH calculations for accidents initiated for 2.5% power (2) identify and reassess events which are significantly different in timing or magnitude from the 54 power case; and (3) quantify these differences to estimate the core vulnerable frequency.
This approach is judged to be the most effective method of JRH1
evaluating the sensitivity of the assumed power level.
The result will be directly comparable to accident frequency estimates derived in the Main Report (St power) and in the PRA (100% power).
E.2.1 ACCIDENT PROCESS CALCULATIONS Appendix B presents the results of proces.s calculations from MARCH for accidents postulated during low power operation.
The emphasis is primarily on the evaluation of parameters assumed for steady state operation at 5'-
power.
In particular, the differences between 5% and full power include an upwardly skewed axial power profile, an average core tenperature of 640*F (representing a reduction of 400*F), and a reduced reactor pressure of 950 psia.
Given these differences, the key modeling difference between the Sie and 2.Si, power level calculations is the reduction in initial and decay heat power levels. With tMs in mind, Table 1 presents a surra ry of the estimated timing of postulated a:cident secuences in which the core becomes vulnerable to melting.
TABLE E-1 ACCIDENT SEQUENCE TIMING
SUMMARY
SE7'ENCE TOTAL TIME TO CORE VULNERABILITY (HRS.)
5% POWER 2.5'- POWEF.
Scram, Isolation, Failure of Coolant Injection 30 71 - 80 Scram Large LOCA, Failure of Coolant Injection 3
10 ATWS,"-Containment Initially Intact 8 - 10 14 - 15
~
JRH1
These timing estimates are judged to have a significant impact on the pla'nt system success criteria beyond that already included in the Main Report. Three principal effects are as follows:
1.
CRD pump flow is considered a viable alternative coolant injection source in accidents accelerated by a loss of coolant inventory.
This applies to SORV cases, medium LOCAs, and large LOCAs, but not RPV ruptures.
2.
RCIC alone is a viable alternative for coolant injection during ar ATWS (at - Si power, a combination of RCIC and CRD flow is judget necessary).
3.
The reactor power level following ATWS with RPT is estimated to be within the capacity of I PHR heat exchanger.
This is based on the assumption that the power level will decrease by approximately 40' following RPT.
Even if a single loop of RHR failed to match the ATWS power level, the challenge to containment is expected to be substantially extended.
In these instances, a rationale similar to that described in the Main Repcrt for dismissal of Class II challenges is judged applicable, i.e., the very long period of time available prior to containment failure represents a risk below that which can be credibly cuantified.
Therefore, such cases are judged to have a negligible frequency.
These success criteria are incorporated into the quantification of core vulnerable accident sequence frequencies in the remainder of this section.
Additionally, revised event success criteria due to the timing estimates.will be discussed as they arise.
E.2.2 OUANTIFICATION OF ACCIDENT SE0VENCE FRE0VENCIES This section corresponds to Section 3 of the Main Report. As such, a discussion and quantification of each of the four initiator types is presented; based on the revised success criteria for operation at 2.St power.
E-4 JRH1
E.2.1.1 LOSS OF OFFSITE POWER INITIATOR The _ LOSP tree shown in Figure 3.1 of the Main Report consists of an initial subtree used to define groups of sequences with similar timing, followed by subsequent subtrees used for modeling time dependent events.
For the reassessment at 2.5% power, the only event requantified is Event R: Recovery of Offsite Power.
Table 3-1 presents a comparison of the estimated recovery probabilities for the 5' and 2.5% power cases. This requantification results in a reduced core vulnerable frequency estimate of 7.7E-7 events / reactor-year for LOSP initiators.
TABLE 3-1 CONDITIONAL PROBABILITY OF RECOVERY OF 0FFSITE POWER AS A TIME DEPENDENT FUNCTION i
COND;TIONAL PROBABILITY CONDITIONAL PROBABILITY ACCIDENT OF FAILURE TO RECOVER OF FAILURE TO RECOVER
, SEQUENCES OFFSITE POWER (5% POWER) 0FFSITE POWER (2.5% POWER)
TYPES l
1) 1.E 4
- 1.E-4
^
^^
1)'
1.E-3**
1.E 4**
2) 5.E-3 1.E-4^^
3)
.25
.06 4)
.06
.02 5) 0.13
.03 Based on containment conditions Estimates of recovery probability at times greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are based upon engineering judgement since insufficient data exists to characterize such recovery probabilities even on a generic basis.
E.2.2.2 LOSS OF COOLANT ACCIDENTS (LOCAs)
At 2.5% power.. the viability of CRD pump flow has its principal impact on mitigation of large and medium LOCAs sequences involving failures of low pressure systems.
Using an estimated CRD injection reliability of 0.9/ demand (similar to the small LOCA case in the Main Report), the estinated frequency of core vulnerable conditions is reduced to 9.4E-8 events / reactor year and 6.0E-8
~
JRH1
.p--e
,-m,
.,,,w
,,e_.
,-,-----n
events / reactor-year for large and medium LOCAs, respectively.
Neither the additional time available nor the ' reduced challenge to plant systems fror that described for Si power is judged to have a quantifiable impact on other LOCA initiated core vulnerable sequences.
Therefore, the total estimated frecuency of core vulnerable conditions due to LOCAs initiated from 2.55 power is recu ed to 2.2E-7 events / reactor-year.
E.2.2.3 OTHER TRANSIENTS A significant contributor to the frequency of accidents initiated by "other" transients at 5'. power is the failure to maintain primary system integrity.
Transient induced LOCAs or SORVs tend to accelerate core heatup timing because coolant is lost early in the sequence. At 2.5% power, CRD flow is considerec a viable alternative for coolant injection in these cases.
Assuming credit for CRC flow similar to other accident sequences in this category at 54 power (i.e.,
a reliability of 0.99/ demand), then the frequency estimates for induced LOCA er SORV accident sequences are reduced by two orders of magnitude.
Other dominant contributers to the frequercy of core vulnerable conditions are postulated to involve failures of depressurization systers which prevents injection by low pressure systems.
Intuitively, the extended core heatu; tiring provides a basis for arguing that failures of depressurization systems may be recoverec' prior to reaching unacceptably high fuel tenperatures.
However, the data and modeling required to support this assertion is a level of effort beycnd the scope of this analysis.
Therefore, it is judged that the already higr combined reliability of depressurization systems at 5'. power is adequate for the estimated reliability at 2.51 pcwer.
Thus, the total core vulnerable frecuercy due to other transients at 2.5%
power is estinated to be 3.5E-7 events / reactor-year.
E.2.2.4 ATWS The quantification of ATWS event trees at 5'; power in the Main Report includes several changes in success criteria based on sequence timing.
The differences between. 5% and 2.5% power are judged to be negligible with regard to the JRH1
requantification of events appearing in ATWS sequences.
Therefore, the estimated frequency of core vulnerable conditions is the same for both ones.
E.2.3 COMPARISON AND
SUMMARY
Table 3-2 summarizes the quantification of accident sequences frequenci s et e
2.5% power.
As shown, the total frequency of core vulnerable conditions is reduced by approximately a factor of 3, primarily due to the extended timing c' LOSP sequences.
An additional contributor is the assumed viability of CRD injection as a meaes of core cooling, which is also attributed to the exterdec sequence tiring.
While not explicitly calculated, it is judged that tre extended sequence tining would have a significant favorable impact or other parameters important to risk calculations including:
evacuation warnire times, in-cortainment residence times, etc.
i TABLE 3-2 00MINANT ACCIDENT SEQUENCE FREQUENCIES ASSUMING STEADY STATE OPERAT!ON AT 2.5' POWER I
INIT!ATOR TYPE TOTAL SEQUENCE FREQUENCY Loss of Offsite Power 7.7E-7 LOCAs 2.2E-7 Other Transients 3.5E-7 ATWS 2.7E-7 TOTAL 1.6E-6 JRH1 E-7 L
i REFERENCES 1.
Sueclemental Motion for Low Power Operating License, submitted ir. the matter of Long Island Lighting Company, Docket No. 50-322, to the Atomic Safety -and Licensing Board, affadavit of J. A. Notaro and W. E. Gur.ther, Jr., dated March 20, 1984 2.
Reactor Safety Study, WASH-1400, NUREG75/014, dated October 1975.
e 4
E-8 JRH1 P
4-
.~q
+
---Y t
"-+--ew ve-
- n*-&------*-t---r----
--<--~-*m---
F, F
i r,,
jf,.i BROOKHAVEN NATIONAL LABORATORY ASSOCIATED UNIVERSITIES, INC.
] (([
Upton, Long Island. New York 11973 (516)282s Deportrnent of Nuctect Energy FTS 666' 7
May 7,1984
]
b A. ThadanD 8
Rellaoisity ahd Risk Assessment Branch l
Division of Safety Technology I
Office of Nuclear Reactor Regulation i
U.S. Nuclear Regulatory Commission Washington, DC 20555
Dear Ashok:
Owing to unanticipated delays caused by the extra time devoted to the review of the " flood-initiator", the diversion of a key reviewer's time (K.
Shiu) to other -higher priority-project (FIN A-3366), and the lack of response to our Q-1 questions from LILCO, the completion date for Task 1 must be redefined.
The participation of Dr. Shiu to the review of the Shoreham PRA is
~
i i
absolutely necessary for the successful completion of the program. Dr. Shiu is, however, a key contributor to the remaining tasks of the review of the GESSAR-II PRA (FIN A-3366) and to the project " Guidance and Probabilistic Analyses,and lvaluations" (FIN A-3758), to both of whirch you have assigned
,high priority. Given the present priorities of the various programs, we propose to stop work on the review of the Shoreham PRA and resume it at a
, later date (on or about June 15, 1984) with a revised milestone for Task 1, 5 September 30, 1984. No cos,t increase is associated with this milestone
, t.
change.
L If you have any questions, please do not hesitate to contact me.
3
[
Wann regards, y
h3 Ioannis A. Papazoglou, Group Leader Risk Evaluation Group IAP/dm g
R. B
--[ [(, v e d M )
ungblood
^
E. Chow (NRC) j, @ ? g /, fgg.g/t.M
/
A. Busiik (NRC) d
~4
w 4
Transient induced LOCAs are significant in that they tend to be more dominsnt probabili sti cally than small or medi um LOCAs.
From a plant response perspecti ve, these sequences are import ant since the rate of coolant lost through the safety reli ef valve could lead to rapid core uncoveri ng.
If coolant i nventory is not reestablished. the core could heat up and core damage could occur early.
Following full power operation, the decay heat rate is sufficiently high that
.the reactor pressure could stabilize above the minimum HPCI and/or RCIC operational range, therefore, continued coolant i njecti on by the HPCI and/or RCIC pumps is possible.
For low power operation, while the decay heat rate is low, the reactor operating pressure is nominally the same as for full power operation.
Si nce steam discharge through the 50RV is deoendent upon the pressure, the rate of coolant loss for a given RPV pressure in both cases are equivalent.
A negative effect of the low decay heat rate for low power operation is that the reactor pressure may not be maintained above the minimum operating range of the steam driven HPCI and RCIC pumps given a SORV.
Therefore, these puc::s may become unavailable much sooner for LOSP SORV cases initiated at low power than for full power operation.
T,he positi ve impact of the low decay heat rate, however, outweighs the negative effect in that a substantial reduct'i on in the coolant makeup capacity is required to maintain sufficient core cooling.
In thi s analysis, several cases of Category 2 transient events were i nvesti gated:
(1) Stuck open relief valve (50RV) where the RPV coolant inventory lost through the 50RV is not recovered (2)
SORY where coolant makeup throagh the high pressure injection systems is available initially.
B-13 SA!/01-667-05/84
(3) Transient events with imedi ate blowdown through the ADS val ves,
without coolant makeup.
This case is judged to encompass large LOCA sequences in the steam lines.
(#)
Transient events with controlled blowdown through the SRV, of less than 100'F/ hour.
at a rate The blowdown is initiated at 30 minutes in accordance to a procedural limit on drywell conditions.
For those sequences where inventory lost through the 50RV is assumed to be repl eni shed, the plant models considered that the cool ant i njecti on is i ni ti ally provi ded by the HPCI and/or RCIC pumps duri ng depressuri z ati on (while the reactor pressure is above the required set poi nt s ).
These seawences were further examined with minimal coolant make-up.
It was assumed RPV inventory was subsequently maintained by the CRD pumps in the long that term following reactor depressurization and the single cycle of HPCI injection.
For this category of transient
- events, the reactor depressuri zati on would leave the core uncovered.
Without coolant makeup, the core would t he'n heat Due to some steam cooling during the depressuriration up.
stage, radi att ve heat transfer and low decay heat levels, core vulnerability is estimated not to occur until after 2 to 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> following the transient event at fi ve percent power ope rati on.
This would be extended further if the steam driven pumps are gi ven credi t and coolant i nj ecti on occurs pri or to reactor depressurization below the HPCI pump operational range.
Case 1: 50RV Without Coolant Makeue The particular accident sequence evaluated here assumed the reactor is shutdown and i sol ated following the initiating event.
The RCS coolant-temperature increases and the reactor pressure approaches the SRV setpoint of 1130 psia.
The SRVs open to relieve reactor pressure and one SRV fails to close.
Due to the low power levels of the core, the initially lower RPV pressure, and the initially lower core average temperature, the RCS
'c'oolant heatup to the SRV setpoint does not occur almost imedi at ely as would be expected during the same transient event iritiated at full power.
In this analysis, it is estimated that the SRV setpoint would be reached B-14 SAI/01-667-05/84
after approximately 20 minutes following the initiating event.
The MARCH analysis predicts core uncovery occurring at 25 to 30 minutes, and core heatup is initiated with the core fully uncovered.
Core overheat occurs in a steam starved envi ronment.
The reactor is depressurized and the coolant level is below the bottom active fuel height.
These factors lead t o mi ni mal steam generation rates, thus cladding oxidation does not contribute significantly to core overheating. The estimated time to reach core vulnerability is approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following the initiating event for this case of Category 2 accident sequences.
Case 2: 50RV With Coolant Makeue This case of transient induced LOCA sequences involves a similar transient event as Case 1 described above.
In Case 2, following the 50RV, duri ng the reactor depressurization, the HPCI pump is assumed to be activated automati cally. Because of the coolant loss due to the ccynbined effect of flashing and boil off, it is assumed that water level in the reactor does not exceed level 8 thus the HPC1 pumps are not tripped prematurely.
It i s further assumed that the HPCI pumps would continue to operate as long as the reactor pressure is above 150 psi g.
Tnerefore, the boundary conditions for coolant boil-off would be a reactor at 150 psig, the water l evel at approximately NWL, and a stuck open relief valve.
Reactor depressurization continues until the reactor pressure drops to approxi-mately 20 psia.
Boil-off of the remaining coolant inventory at 20 psia involves a longer time than would occur at an elevated pressure due to the higher heat of vaoorization at the lower pressure compared to 1130 psia, in this scenario, following the initial core recovery, without subsequent coolant makeup from other modes of coolant i nj ecti on, it was determined that coolant boil off to the top of active fuel would occur within 20-25 hours. Subsequent core vulnerability is not expected to occur until after 12 to 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. Therefore, with a more realistic assessment of 50RV sequences for LOSP cases, there is a potential for extending the time B-15 sal /01-667-05/84 O
before core vulnerability occurs.
Since there exists a driving force for the HPCl/RCIC pumps (i.e., sufficient steam pressure and flow rate from the RPV during reactor depressurization), it is judged that there is sufficient time to recover the other modes of coolant i njecti on.
The CRD pumps providing subsequent coolant flow into the vessel was found to mitigate this. accident event.
Case 3: Transient Events with immediate 91owdow Case 3 is the limiting scenario of the Category 2 a c ci de nt events involving transient induced LOCA accident sequences.
This scenario is intended to encompass large LOCA accident sequences as well, in which the reactor is depressurized to containment conditions almost immediately.
As in the SORV cases, the core is completely uncovered after blowdown.
But since blowdown occurs very rapidly, the stored thermal energy in the core i s not sufficiently dissipated prior to initiation of core overheat.
In this sequence, the core becomes vulnerable within 2-1/2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, following the initiating event.
Case 4: Transient Event with Controlled Blowdown This scenario consi'ders a controlled depressurization of the reactor i ni ti ated by the operator to meet procedural limi t s of drywell temperature.
During loss of all AC power sequences, the drywell coolers become unavailable, and the drywell atmosphere could heat up beyond 296*F whi ch would requi re reactor depressuri zati on.
The drywell temperature climbs rapidly during the first 5 to 10 minutes before heat transfer to the drywell liner is established.
In thi s analysi s, the drywell temperature limit is assumed to be reached wi thi n 30 minutes at whi ch point the reactor is depressurized at a rate not to exceed 100*F per hour.
,This scenario effectively extends initiation of core heatup due to the concomitant steam cooling during the depressurization stage.
Although core uncovery occurs within a few minutes, the blowdown to a pressure of B-16 SA!/01-667-05/84
s u.,,
150 psig is reached at approximately 150 minutes following the initiating Core heatup subsequently follows and core vulnerability could event.
occur after approximately 6-7 hours.
8.3.3 Category 3 - Anticipated Transients Without Scram Thi s category of accident sequences include those low frequency event sequences in which an anticipated transient coupled with failure to insert the cont rol rods may occur.
In the Shoreham PRA, the evaluation of postul at ed ATWS accident events indicated that these sequences could potentially lead to a more severe containment challenge compared with the other types of accident sequences investigated thus f ar.
Following operation at 100% power, pool heat-up and cont ai nment overpressure occurs rapidly.
The estimated time of core vulnerability determined in the PRA was approximately 30-40 minutes.
For ATWS events for which the condenser is isolated, the initial low powe r-level of 5 percent results in.a slower. rate of suppression pool heat up which then provides more time for the operator to take action in mitigating the accident. In this evaluation, it is estimated that several hours would be required to heat up the suppression pool to saturation and several more hours for the containment to reach its ultimate pressure capacity.
This assumes that the reactor power drops to approximately three percent of rated power or 60 percent of the initial low power level of five percent.
RCS coolant i nventory makeup is derived from the turbine driven HPCI pumps, and both trains of the residual heat removal heat exchangers are postulated to be unavailable.
The significance of high suppression pool temocrature relates to the operability of the HPCI pumps under adverse conditions, e.g.,
lube oil The emergency procedure guidelines call for the operator maintaining the reactor pressure at 100-150 psig, it is assumed in this evaluation that operator would tend to keep the reactor pressure from drop the psig.
150 pump deiver thereby ensuring availability of the HPCI system.
}'
B-17 SA!/01-667-05/84
1 I
s.,
degradati on.
For some ATWS sequences evaluated in the PRA, continued coolant injection may jeopardize containment integrity which in turn could result in the degradati on of the ECC systems and inability to mai ntai n coolant i nventory.
Therefore, two cases of ATWS isolation events were considered in this evaluation:
(1) Cool ant injection is terminated at the point when the suppression pool temperature reaches 240*F.
In this scenario, coolant boil off would occur in an intact containment.
(2) Continued cool ant injection is assumed, leadi ng to cont ai nment f ailure and ECC f ailure.
This is subsequently followed by boil of f of RCS coolant inventory in a failed containment.
In both cases described above, core vulnerability would follow shortly after core uncovery and dryout at decay heat energy levels.
The calculations performed predi ct an estimated ti me of' approximately 3-4 hours to heat up the suppression pool to 240'F.
For Case 1, subsequent to coolant injection being terminated at this point, the RPV inventory to the TAF is boiled off with the reactor at 3 percent of rated power. The core is uncovered within 30 minutes after termination of coolant injection and heats up at the fi ssion product decay heat power.
It i s estimated that core vulnerability would occur at greater than 5-6 hours following core uncovery.
For Case 2, assuming that coolant injection is maintained, the containment is estimated to f ail by overpressure after approximately 6-7 hours.
Followi ng cont ai nment f ailure, ECCS injection is terminated.
Coolant boil of f is i
estimated to uncover the core after 30 minutes and core overheat would subsequently occur after approximately 5-6 hours.
In thi s analysi s, the energy released via the steam flow to the Terry turbine HPCl/RCIC pump driver was not considered.
It is estimated that pool heatup and containment failure could be delayed by approximately 5-10 percent if this additional heat sink is cons,idered in the analysi.s.
Transient events with failure to shutdown the reactor is potentially a more 1
severe accident category because of the higher thermal energy release rate compared to shutdown conditions.
This category of accident events result in B-18 SA!/01-667-05/84 1
a
--.--.--,,--...,,-.--.-n-
,v..
b the SRVs being open more often than would be if the reactor were shutdown.
The cycling of the SRVs present a challenge that could lead to one of the SRVs failing to close.
An ATWS event coupled with a 50RV was investigated to determine the impact of the stuck open relief valve on plant response during the ATWS event.
It was. determined that the reactor pressure could stabili ze at approximately 350 to 400 psia for this sequence.
The impact on sequence timing would not be noticeably different. However, a si gni ficant perturbation would be the reactor cool ant loss following termination of i njection fl ow.
Blowdown could occur from 350 psi to containment conditions due to the stuck open relief valve following decay in the core power which could result in a more rapid core uncovering.
If the core becomes fully uncovered, a steam starved core condition would be expected during the core heat up phase delaying the core heat up period to some extent due to reduced clad oxidation.
B.4 Secuence Perturbatiens The three categories of accident -sequences described above were also examined to determine the sensitivity of the accident event timing for power levels less than the reference value of five percent.
In this sensitivity evalua-tion, the reactor was assumed to be operated at a constant level of 2.5 percent of rated power; not the more likely scenario involving impulse power fluctuations below the reference five percent level.
The accident progression determinations were conducted consistent with the five percent power accident analysis.
Because of the decaying nature of fission product energy release rate, the time scales of the accident sequences following shutdown are not always inversely related to the initial power level, i.e., at 2.5 percent power, the time to core vulnerability is not exactly twice that of the 5 percent power level case.
In general, the required time to boil off the same amount of wate inventory or heat up of the fuel would vary depending upon the time from shutdown at which bol1 off or core heat up is initiated.
This is apparent f rom the results of the assessment of the sequence perturbations of the B-19 SA!/01-667-05/84
--..,..,,----__r n-~.,,,
category 1 transient events (i sol ation without makeup) i ni ti ated at fi ve percent power level described in Section B.3.1.
The. results of this sensiti vity evaluation indicate that for the transient events and isolation cases without coolant makeup, (event category I described abovel the time to initial core uncovering estimated for the 2.5 percent power level case is approximately 45 to 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br />, and the subsequent core vulnerability is estimated to occur after another 26 to 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.
If tne reactor inventory is assumed recovered after boil off to level 2. the time te core vulnerability would be found extended accordingly.
This assumes only a single cycle of HPCI and that subs eq';ent coolant injection does not occur.
Event category 2 evaluation (t ransi er.t induced LOCAs) shows the same teenc.
and core overneat is predicted to occur at greater than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
For the ATWS scenarios, for which no containment heat removal capability is assumec containment integrity is jeopardized and coolant injection is lost at 6-7 hours.
Thi s is followed by boi l off and core overheat occurring af te-another 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> af ter containment failure.
For thi s sequence invol ving f ailure to bring tne reactor suberitical, the initial phase of the accicent assumes tnat tne reactor is at 60 percent of initial power level.
Therefore, tne rate of suppression pool heatup and contaimnent pressurization is exoectec to be directly related to tne assumed power level.
B.S Su-nary and Conclusions The accidant analysis performed for the potentially ri sk domi nant sequences described above indicates that a significant risk reduction (in terms of esti-mated f requenci es) during low power operation is possible.
The substantial time required to reach core vulnerability for each event category discussed in Section B.3. range from 2-3 hours to several days. This range of times woule most.,li k ely provide suf fi ci ent time f or operator acti on t o miti gate t he i
B-20 SA!/01-667-05/84
acci dent.
In addition, the required mitigative capacity of coolant injection sources is significantly reduced such that other coolant injection success paths are possible.
The results of this evaluation as summarized in Table 3 provides an indication of the time windows available for the operators to implement mitigative actions.
This table also shows the range of times prior to core vulnerability for the accident sequences studied in this appendix given some perturbations in the time delay prior to ' initiation of coolant boil off.
It appears that at low power levels, the time scales of the accident sequence progression to the point where the core or containment integrity may be lost are quite long that substantial times are available for operator action to mitigate the accident.
From an overall ri sk perspecti ve (i.e.,
frequency and consequence considera-ti ons ),
the potential of f-si t e publi c health impact of these accident sequences initiated at low power would be reduced significantly.
Because of the low decay heat energy release rate, the containment integrity will likely be maintained for several days given that the accident does proceed unchecked to a core meltdown.
This will undoubtedly remove significant portions of the airborne radionuclide materials from containment, thus substantially reducing the amounts of fission products that could be released to the environment.
On the basis of thi s assessment, and considering the general aspects of radi onuclide behavi or, it is concluded that si gni ficant reducti on in the source terms is possible at low power operation.
It is estimated that for the extended times prior to containment failure and radionuclide release, a source term reduction factor ranging from 10 to 100 may be possible for simil ar accident sequences involving early containment failures studied i n the PRA.
Furthermore, the fission product inventory of the reactor core operated at low power restricted to five percent is a f actor of 20 less than that at full power.
B-21 sal /01-667-05/84 9
4
Table 3
SUMMARY
OF EVENT TIMING FOR SELECTED ACCIDENT SEQUENCES AT LOW POWER OPERATION TIME DELAY. TIME TO CORE TIME TO TOTAL ACCIDENT PRIOR TO UNC0VERY FROM CORE OVERHEAT TIME TO CATEG041 80lt OFF BOIL OFF INITIATION FROM CORE UN*0VERY CORE VULNERAi!.:Ty CATEbORY 1 Isolation 0
18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> 11-13 hours 30 nou s Transients 4 nours 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> 12-14 hours 2 days 10 nours 33 nou s 13-15 hours 2-1/2 cays 30 nours 35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> 14-18 hours 3-1/2 days CATEGJs* 2 S:'.
- o mase;:
0 25-30 minutes 3-1/2 nours 4 moa s 5 3J.'
't,1-ste' manes: 33 m'nu:ec 2u-23 hea s 12-14 hou s 1-1/2 days A25 (L3 :'
u 0
2-3 hours 3 nou s Co-o'tes 5 : o-::..-
0 45-50 mina:es 6-7 hou s 7.5 nsa s CA~Eas ' 3 e
ATwS w1:n Co :319ne9 ints::
3-4 nou s 30 minutes 5-6 nours 8-10 no. s I
Aids wt:n Co9;ainne9 faileo 6-7 nou s 30 minutes 5-6 hours 11-13' no. s
- Time fr.om toitiating event given continued coolant injection from the supp ession pool, i.e.. the imoa:t of high pool water temperature (greate-240*F) on HPC1/RCIC operability is not considered in tne analysis.
tha9 JRH1-A B-22 e
-, - - ~ - -
~,.
e r
r---
s o
This analysis focused on LOSP cases for which the plant systems considered for cool ant i njection did not include those requiring off-site power.
Extrapo-lating the results of this analysis to other accident initiators, could like-wise lead to extended times available for operator action for similar accident sequence progression.
In summary, a significant reduction of ri sk to the public (conservatively estimated as at least a factor of 20 to possibly 200 due to the reduced potential off-site consequences alone) is judged likely for the spectrum of accident events analyzed in the PRA for low power operation at Shoreham.
O A!/01-667-05 m B-23
REFERENCES 1.
Shoreham Nuclear Power Station, Probabili sti c Risk Assessment, sal-372-83-PA-01, June 1983 2.
Draft Report - on Status of Validation of the MARCH-2 Computer Code.
Battelle Columbus Laboratories, Columbus, Ohio, July 11, 1983 1
3.
Division of Systems ard Reliability Research, Of fice, of Nuclear Regulatory Research, Battelle Columbus Laboratories, MARCH (Meltdown Accident Response Cha racteri sti cs) Code Description and User's Manual, R.O. Wooten, H.I. Avci, NUREG/CR-1711 BMI-2064, Col umb.us,
Ohio, October 1980 4
LILCO Interoffice Memo, NFD-83-016 January 24, 1983 5.
Ame ri c a n National Standard for Decay Heat Power in Light Water Reactors, ANSI /ANS-5.1-1979, August 29, 1979 6.
Personal Communication, R..J. Paccione (LILCO) and Z.T. Mendoza (SA1) dated March 22, 1984 B-24 SA!/01-667-05/84
E 5
I f
APPENDIX C f f i
SNPS/LILCO GRID ELECTRIC POWER SYSTEM DESCRIPTION
, s
-l
' 2 li
'2 tre are two off-site power sources at SNPS which are physically ar:
' =.3 q
-l l retrically independent [1].
The primary source of of f-site power to tre jj is via the Normal Station Service (NSS) transformer which is connected int
- ceen the SNPS generator circuit breaker and the 138KV switchyard.
The j
- endary source is through the Reserve Station Service (RSS) transformer ich is connected to the 69KV transmission system.
A schematic diagram of e 138KV transmission system in the area surrounding SNPS is shown in Fig. e 1.
A one line diagram of the main portion of the SNPS electric po-er sys:em
.shown in Figure C-2.
The 138KV and 69KV transmission lines from the plan:
te-: out to various substa: ions at nearby locations on the LILCO g-f 3. Ce the grid connections, the Holbrook Substation, currently has a conce::i:a a gas turbine generator with black start capability, e on-site gas turbine generator considered for the black start modi fica;*:-
I SNPS is con e::ed to the 69KV system on the site near the RSS transfo-e.
f e com'ig. a:i:n of tne 69KV system witn res:e:t to t"e on-si:e gas taa:' e snc a in Ftguae C-3.
I 1
JRH1 C.1
_,y
'q ;
i t
.i se g
y It' i,il r
8
....g I
.. q;l
_. t-M.
<.,,(,,,/d, t y
.e
's i
s,
,.2.e / )
- 1 J;_si i
__ u e., r. I +
i i..lp.,,l!!(.
f'""
5" t It 4
E' b 3 Jj
, 's
- ,,r.,i
- +,
. li
.. - i s,'
- 4*,
sig8; s.
t 6'-
L u i, J 2.
.in,r.
i, s
-a.
, 3_.
s,-
"1
~
l.i
, 3.
- 1. 1.,.1 i
L I
I a
r i
f
.p
- =. =. '-).I 4; a.r ski,,=T"]
a
/a
..e, c:
i 4
3 s
g f,,
.l'.
- , l 3
- t t ik i
a, i i ij-t i
1 S
i i
t
[
f 'Ll 6-.2--=.
l l
a
.I.,,
s,'
i,i
' I, a
3 M
- ev w
. i},e:
i i
.1.1,.1.1 _.!
6_:,/
ir
- 4qli, i
i i-l\\.: s..:.,,e
.i
_ %l
.v.:.,..,
,,7 ir.
m.,
., r i r yl. =
- :-- --: 2 -=.
ir_
,,1..
t 1
1
\\
}
g'
[
\\
's a c:
i' i
t f) l' E
f)\\ \\
'sg
,s!r
~*f l,,
j
(
l s P,-
s
-W.
. /
l.
.'li:
i o
fi
.I
/
/.
,1 JRH1 c.3
(
/
t-b
qis.
e 9
e 2
.c 2
wi e-E S
t C
SJ k
L AO L
G b ad C
e ed 2 84
= >= 6 G
C e ec 3f N
E
\\\\
3E
\\\\
_s
//
3 m
6
.h 6
>si m
/\\
"q A
i
/%
Ow
%/
Y Y
JRH1 C-4
1 0
e I
8 4,r 3I er
, pil a 1
g:-ti[
l s
ria!gh1 il s
-1 n! u s
I 5.-
..r.
g?
=qu=s:.:
' *E; I
r I
l'.d
/
e II-A.h,.
I e
s-I e
l (N l
1
{
s, /
1.;!!!
3%,
'""\\tku----_!
.w../
.g. -
- - -= - - - - - -
i y
w k ~,, e f p,!
i.ii 2
p
=
iL
,,~~~.. s
!5rg)
~ 3.'
y 5
!O !,'
,' El lT~~l
- E a
f
. t ~ ~~~. j L.
..f' 'as
/ 1 l T' ~~.
h t _
,1 h;. Q
'~-
\\
ll hh k..!
l Y
l
-- 3 g II I El s:
I s
N i
,I
/
S El I
N JRH2 C-5
l' j
l I
REFERENCES 1.
Shoreham NUCtear Power Station. Final Safety Analysis Report, Oo:ke:
No. 50-322.
E*
Letter from R*4*
4CCione/R.S. 28mbratto (LILCO) to E.T. gu.ns (WLA), Apej ) 9, g9g,
1 l
6 L
e JRH1 C-6
APPEN0!I D ASSESSMENT OF LOSP EVENT DATA AND APPLICATION OF DOMINANT A Two of the key parameters used in the Shoreham PRA for estimating the frequency of core vulnerable conditions following LOSP are: (1) the frequen:y of LOSP events, and (2) the time required for recovery of off-site pcwer.
These parameters are derived from the LILCO grid reliability data base and EPRI NP-2301, respectively.
In the latter, data from a nationwide survey are examined and conditional probabilities of recovery events are estima:ed for Shoreham.
The proposed black start modi fica:f on provides a redc ea : ame diverse method for res* oration of of f-site power.
The time required for recovery 'of of f-site power depends heavily on the particular failure mode leading to the LOSP event.
A review of the causes of the LOSP events in EPRI' NP-2301 leads to the definition of three ge e al estegories of LOSP events: 1) grid failures or transmission line f a 'iges, 2' mata swf:chyard failures, and 3) failures of botn switcnya-ds.
These fa.
e eve 9: categoetes allow the effectiveness of tse black start gas turti e sys:e-at Shoreham to be modeled and a sensitivity of its ef fe::ive9ess deve'::!:.
Tne LOSP categories are described as follows:
Grid or Transmission Line Failures:
Based upon a review of his:ori:a' ca:a throughout the U.S. (1,23, grid failures range from a total system s%:d: - to relatively minor switching errors that de-energize substations.
With pro:e-switching, either the black start system feeding the Holbroot Substa:io- (22 miles from Shoreham) or the Shoreham on-site gas turbine with bla:< s:3-:
could restore power to Shoreham, Transmission line failures are generally weather induced by causes su:h as i
wind sfirms or ice storms resulting in failures of several transmissiO9 Itnes.
While the transmission lines at Shoreham are generally widely separated, the JRH1 D-1
69KV circuit does share the same right-of-way as one of the two 138KV circuits for a distance of approximately one mile.
Therefore in cases in which the transmission If nes become unavailable, the Holbrook black start system may be inef fective while the Shoreham on-site gas turbine could still provide power to the Shoreham on-s.ite electrical distribution system.
In this evaluation it is judged that the likelihood of recovery from grid failures is similar for LILC0 and for other grids in the U.S.
In other words, the black start gas turbine capability at Holbrook is judged to be adequately included in the operating experience data base which reflects the strong possibility of recovery from such events.
Therefore, in the assessment of tne on-site black start gas turbine capability, both Tid failures a*:
traasmission Ifne failures can be lurped toge:Ner for the pu scses O'
quaat t fication.
"ain Sw' :ay a-3 Failures:
These events ap:1y to the range of f ailures
-i: 5 could occur in tne vicinity of the main switchyard.
These failures a e corside ed to be independeat of :ne availability of the 69KV syste,
in :rese cases, the 63KV system is expected to remain ene*gized, so Ne e is no su:staa-ia? advantage to the addi fon of the on-site black star: gas tu
'ie.
a Failures of Both Switchyards:
These events involve commoa moce fait aes betwee the two switchyards.
In these cases, the black start cacatility w:.':
no: De effective since the 69KV switchy ard is required to di e:t the ::-e-from the on-site gas turbine into the normal 4160V buses.
The allocation of the failure modes in EPRI NP-2301 in:o tnese three catego-les is crucial in the assessme it of the relati ve worin of :ne on-site gas turbine and its potential public safety improve *ent.
This allocation turns out to be one of the principal contributors to the uncertainty
{
associated with the calculated reduction in core vulnerable freque cy associa:~ed with the Shoreham design modi fi c a t i on.
Therefore, the follow'ng
)
quantification is structured to provide a sensitivity on the best estimate values to indica:e the potential variation based upon data uncertainty.
l JRH1 0-2 1
i
Table 0-1 shows the categorization of the LOSP initiated events in EPRI MP-2301. Table 0-1 has been constructed with some subjective judgement used to characterize the failure modes.
In particular, the failure modes wi th potential impact on redundant switchyards have been inferred from the data; that 15. those failure modes which are judged possible to cause a simul tanecas failure of both Shoreham switchyards are identified.
The conditional probability for failure to recover off-site power for each time phase is obtained from the sum of failures for each of the LOSP event categories.
EPRI NP-2301 contains a large amount of useful data to provide an overview of =nat an " average" plant might look like.
However, one must be prudent in tne application of these data on a plant specific basis.
In particular, associating the Shoreham-specific LOSP frequency with the ge e-ic. fai b e modes from EPRI NP-2301 may unde estimate the benefit of the black sta-:
capability.
Information presented in each column of Table 0-1 is described below:
(1) Nuclear plant at which the LOSP is recorded.
(2) Incioents of LOSP which are caused by either total grid blackouts or transmission line failures (0 = less than 30 min;te duration; x = is greater than 30 minute duration].
(3) Incidents of LOSP in which a main switchy ard failure is involved.
(4)
Incidents of LOSP recorded in column (3) which also invo!.=
multiple switchyard failures or the potential for suth ae identified in column (4).
The probabilistic sensitivity analysis of Shoreham results in the calculation of two cases:
A)
Main switchyard failure considered to have a higa itkelihood of impacting the redundant swit nyard.
8)
Main switchyard failure considered to have a high o~
uncertain likelihood of impacting the redundant switchyard.
(5) The duration of each LOSP event.
(6) The number of grid connections at each plant.
JRH1 D-3
Table 0-1 CLASSIFICATION OF LOSP EVENTS APPEARING IN EPRI NP-2301 POTENTIAL NUMBER OF 0FF-SITE:
IMPACT ON OFF-SITE GRID AND MAIN REDUNDANT RECOVERY TRANS-NUCLEAR TRANSMISSION SWITCM-SWITCHYARDS TIME MIS 5!0N PLANT LINES YARD (4)
(Hrs: Min)
LINES (1)
(2)
(3)
(A)
(8)
(5)
(6)
- Besve-Valley 0
- 17 2
- Calve-: Cli f fs X
I 5:29 2
l Davis Besse I'
X*
3 0
- 26 3
,0resden 1 X
25:40 9
'Farley I
X 4: 59 2
,'Fi:::st r i ck 0
<:01 2
0
- 03 2
,For: Catho;r X
11:05 7
X X
- 54 7
0
<:01 7
t' Gi,a 0
- 30 2
5 Gioaa X
- 40 2
Hattam 0
- 29 2
0 l
- 09 2
0
<:01 2
0
- 20 2
0
- 15 2
!He:oltBay X*
lIndianPoint 2
X 6:2B 2
La Crosse 0
- 14 2
X 1:01 2
0
- 20 2
0
.:02 2
X X
1:50 2
0
- 10 2
X X
5:35 2
Millstone 1 X
X X
24: 37 2
1 1,Nine Mile Point 0
<:01 2
0conee.
I 1:00 2
pys:ercreek X*
X-X*
3 L
See notes on folio.ing page.
JRH1
Table D-1 (Continued)
CLASSIFICATION OF LOSP EVENTS APPEARING IN EPRI NP-2301 POTENTIAL
' NUMBER OF OFF-SITE:
IMPACT ON OFF-SITE GRID AND MAIN-REDUNDANT RECOVERY TRAN5-NUCLEAR TRANSMISSION SWITCH-SWITCHYARDS TIME MISSION PLANT LINES YARD (4)
(Hrs: Min)
LINES (1)
(2)
(3)
(A) (B )
(5)
(6)
Falisades K
- 56 3
I X
4:45 5
X X
3:30 5
X X
1:30 5
Pilgrim X
2:40 3
X 8:54 3
Point Beach 0
- 08 2
I X
- 55 2
Ouad Cities X
1:11 4
San Onofre X
X X
4:59 7
0*
- 04 7
0
<:01 7
lSt. Lucie 0
- 08 2
Yaakee Rowe X
I
- 37 2
I i
l
.Ine total n ncer of LOSP events is 45 u
K - Inctcates an eve.at lasting >30 minutes.
0 - Inc+ca:es an event lasting <30 minutes.
- - Assu*ed,-based on the sDecific failure mode.
Included in the calculations as a failure lasting >4 hours.
The recovery factors determined for LOSP events in tnis analysis incer:: a +
some subtle but potentially important distinctions regarding the source of tae
- data, i.e., the data set, is composed of a spectrum of failu es from rat e-minor single failure events through severe weather conditions affe: tics multiple transmission lines.
Based upon the data in EP:!! NP-2301 (ca;ses a-c durations), it is clear that there is a strong coupling between the du a: ion of the loss of off-site power outage and the particular f ailure mode.
However, in the assessment of the on-site gas turbine capability the use of the data to allocate exact failure modes extends the statistical significa*ce of the data to its limits. For this reason, this analysis attempts to exa-ine the general trend of the coupling of the failure modes (e.g. weat5e-) and JRH1 D-5
.e,,--,-
-,m n----
y g
-nc w
I duration of LOSP and to provide both optimistic (CASE A) and pessismistic (CASE 8) assumptions in interpretation of the data to account for uncertainties in cla s si fication of event.
From this perspective.
Ioa;
~
duration transmission line failures take on an increasing importance.
Tne analysis incorporates these data directly into the probabilistic evaluati:n including the strong coupling between failure mode and duration of LOSP.
Table D-2 summarizes the data and classifies the failure modes by time p%ase consistent with the PRA.
The information in the table may be used to de-ive estimates for recovery values used in the recovery logic model.
The time phases which have the highest contribution to core vulne atle frec;en:y follo-ing LOSP initiators, i.e., time phases III and IV, ma<e a substantial fraction of events for which off-site power has not bee 9 recove ec baset upon historical nuclear plant operating experience.
Table 0-2 SU" MARY OF LOSP EVENT 5 BY T!.w! PHASE l
GR:D AND OFF-POTENTIAL IMPACT ON jTIME SITE TRANS-MAIN REDUNDAC S C CHva225
.PMASE M!55!0N SWITCHYARD CASE A CASE S (optimistic)
(pessimistic)
I
' PHASE I
> 30 MIN 6
19 3
12
' PHASE II I
> 2 HR 4
11 3
9 PHASE IJJ
> 4 HR 3
10 3
8 PHASE IV I
> 10 MR 1
2 1
1 JRH1 0-6
REFERENCES 1.
Loss of Off-Site Power at Nuclear Power Plants: Data and Aretysis, EPRI NP-2301, March, 1982.
2.
- Scholl, R.F., " Loss of Off-Site Power Survey Status Repor". Revision 3 Report of the Systematic Evaluation of Program Brench, Division of Licensing, U.S. NRC, o
S e
e e
e D-7 JRH1 e
. - -. ~.,,,
APPENDIX E SENSITIVITY STUDY OF THE CORE VULNERABLE FREQUENCY ASSOCIATED WITH LOW POWER TESTING The Main Report provides an indication of the assumed plant configuration for low power testing.
For simplification, steady state operation at Si power is assumed.
In reality, however, the plant will be in a state of flux as numerous system tests, inspections, and measurements take place.
The assumption of a steady state power level of 5'. is judged to be a conservative approach to the assessment of risk for low power operation.
The purpose of this Appendix is te provide additional bases for concluding that this approach is conservative.
Specifically, a sunmary discussion of the detailed operational aspects of low power testing [1] is provided along with a best estinate, rather ther conservative ucper bound, evaluatian of the core vulnerable frequency.
E.1 OETAILEO O'oERA'!ONAL ASPECTS OF LOW DOWER TEST!!:G The initial plant testing at Shoreham involves a series of four phases defined as follows:
Phase I:
Fuel loading and precriticality testing Phase II:
Cold criticality testing Phase III:
Heatup and low power testing to rated pressure / temperature conditions (approximately 1% rated power)
Phase IV:
Low power testing (1-5'! rated power)
The structure of the testing program is such that the plant must fulfill specific testing and operational objectives in each phase before continuing to the next.
Component " wear-in" failures will be repaired as they arise, which implies that the plant will have a full complement of safety systens available for each new power level.
In this evaluation, it ' is judged that essentially no measurable risk can be associated with the first two phases of operation.
This conclusion is based on two observations:
^
E-1 JRH1
1.
WASH-1400 [2] identified spent fuel handling acciderts as a potential radionuclide release mechanism. Damage to unirradiated fuel would not fall' into this category, however.
Fresh fuel bundles can be hardled in open air and would not be subject to melting or sigrificar.:
radionuclide release.
2.
Cold criticality testing produces a negligible amount of heat (0.0001' to 0.001', of rated thermal power, or a maximum of 24kw).
Under these conditions, there is essentially no need for RPV inventory makeup systens.
If the RPV is inadvertantly drained, the core will becera suberitical.
Therefore, postulated precursors to core damage (e.g.,
LOCA or failure to scrar) would have a negligib'e impact or core integrity.
Thus, Phases III and IV, in which the RPV is pressurized, stear is generate ('
and coolant makeup systens are required is judged to be the region of operation
.in which the first measurable risk due to radionuclide release appears.
The testing prograr fer these phases consists of repeated gradual heatuDs to a ma sinurr of 5' full power followed by controlled cooldowns.
Only a small fraction of the total.cperating period is spent near 54 power.
Because cf these power cycles, it is judged that decay heat levels, which are dependent upon the power history, can best be modeled using an intermediate valve between 0% ar.d 5' and assuming steady state operation.
For this reason, the core vulnerab}e frecuency associated with operation at 2.5% power is estimated in the folloWg sectier..
E.2
_ CORE VULNERA8:.E FREOUENCY DUE TO STEADY STATE OPERA As with the analysis presented in the Main Report, phenomenological calculations of postulated accident progressions are an essential s ta rting point for assessing success criteria and quantifying event probabilities.
The analysis
~
presented in this section is intended to (1) review the results of MARCH calculations for accidents initiated -for 2.5% power (2) identify and reassess events which are significantly different in timing or magnitude from the 50 power case; and (3) quantify these differences to estimate the core vulrerable frequency.
This approach is judged to be the most effective method of JRH1 n
evaluating the sensitivity of the assumed power level.
The result will be directly comparable to accident frequency estimates derived in the Main Report (St power) and in the PRA (100% power).
E.2.1 ACCIDENT PROCESS CALCULATIONS Appendix B presents the results of process calculations from MARCH for accidents postulated during low power operation.
The emphasis is primarily on the evaluation of parameters assumed for steady state operation at 5',
power.
In particular, the differences between St and full power include an upwardly skewed axial power profile, an average core temperature of 640*F (representing a
reduction of 400*F), and a reduced reactor pressure of 950 psia.
Given these differences, the key modeling difference between the St and 2.50 power level calculations is the reduction in initial and decay heat power levels. Witr tr.is in mind, Table 1 presents a sun ary of the estimated timing of postulated accident secuences in which the core becomes vulnerable to melting.
TABLE E-1 ACCIDENT SEQUENCE TIMING
SUMMARY
S E.' ENC E TOTAL TIME TO CORE VULNERABILITY (HRS.)
5% POWER 2.58 POWER Scram, Isolation, Failure of Coolant Injection 30 71 - 80 Scran, Large LOCA, Failure of Coolant Injection 3
10 ATWS,'-Containment Initially Intact 8 - 10 14 - 15 JRH1
These tining estimates are judged to have a significant impact on the pla'ni' system success criteria beyond that already included in the Main Report. Three principal effects are as follows:
1.
CRD puro flow is considered a viable alternative coolant injection source in accidents accelerated by a loss of coolant inventory.
This applies to 50RV cases, medium 'LOCAs, and large LOCAs, but not RPV ruptures.
2.
RCIC alone is a viable alternative for coolant injection during ar ATWS (at 55 power, a combination of RCIC and CRD flow is judgec necessary).
3.
The reactor power level following ATWS with RPT is estimated to be dw. thin the capacity of l' PHR heat exchanger.
This is based on the assumption that the power level will decrease by approximately 40 following RPT.
Even if a single loop of RHR failed to match the ATWS power level, the challenge to containment is expected to be substantially extended.
In these instances, a rationale similar to that described in the Main Report for dismissal of Class II challenges is judged applicable, i.e., the very long period of time available prior to containment failure represents a risk below that which can be credibly cuantified.
Therefore, such cases are judged to have a negligible frecuency.
These success criteria are incorpora ted into the quantification of core vulnerable accident sequence frequencies in the remainder of this section.
Additionally, revised event success criteria due to the timing estimates will be discussed as they arise.
E.2.2 OUANTIFICATION OF ACCIDENT SE0VENCE FREQUENCIES This section corresponds to Section 3 of the Main Report. As such, a discussion and quantification of each of the four initiator types is presented; based on the revised success criteria for operation at 2.5" power.
E-4 JRH1
E.2.1.1 LOSS OF OFFSITE POWER INITIATOR The LOSP tree shown in Figure 3.1 of the Main Report consists of an initial subtree used to define groups of sequences with similar timing, followed by subsequent subtrees used for modeling time dependent events.
For the reassessment at 2.5% power, the only event requantified is Event R: Recovery of Offsite Power.
Table 3-1 presents a comparison of the estimated recovery probabilities for the 5'. and 2.51 power cases. This requantification results in a reduced core vulnerable frequency estimate of 7.7E-7 events / reactor-year for LOSP initiators.
TABLE 3-1 CONDITIONAL PROBABILITY OF RECOVERY OF 0FFSITE POWER AS A TIME DEPENDENT FUNCTION i
CONDITIONAL PROBABILITY CONDITIONAL PROBABILITY ACCIDENT OF FAILURE TO RECOVER OF FAILURE TO RECOVER SEQUENCES OFFSITE POWER (5% POWEF.)
0FFSITE POWER (2.5% POWER) i TYPES l
1) 1.E-4'*
1.E-4
^^
1)'
1.E-3'*
1.E-4
2) 5.E-3 1.E-4
31 l
.25
.06 4)
.06
.02 5) 0.13
.03 Based on containment conditions Estimates of recovery probability at times greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are based upon engineering judgement since insufficient data exists to characterize such recovery probabilities even on a generic basis.
E.2.2.2 LOSS OF COOLANT ACCIDENTS (LOCAs)
At 2.5% power, the viability of CRD pump flow has its principal impact on mitigation of large and medium LOCAs sequences involving failures of low pressure systems.
Using an estimated CRD injection reliability of 0.9/derand (similar to the small LOCA case in the Main Report), the estinated frequency of core vulnerable conditions is reduced to 9.4E-8 events / reactor year and 6.0E-8 JRH1
~
\\
events / reactor-yea r for large and medium LOCAs, respectively.
Neither the additional time available nor the reduced challenge to plant systers fror that described for Si power is judged to have a quantifiable impact on other LOCA initiated core vulnerable sequences.
Therefore, the total estimated frecuency of core vulnerable conditions due to LOCAs initiated from 2.5? power is redu se to 2.2E-7 events / reactor-year.
E.2.2.3 OTHER TRANSIENTS A significant contributor to the frequency of accidents initiated by "other" transients at 5'. power is the failure to maintain primary systen integrity.
Transient induced LOCAs or 50RVs tend to accelerate core heatup timing because coolant is lost early in the secuence. At 2.5% power, CRD flow is considerec a viable alternative for coolant injection in these cases.
Assuming credit for CRC flow similar to other accident sequences in this category at 54 power (i.e.,
a reliability of 0.99/ demand), then the frequency estimates for induced LOCA er 50RV accident sequences are reduced by two orders of magnitude.
Other dcminant contributcrs to the frequercy of core vulnerable conditions are postulated to involve failures of depressurization systers which prevents injection by low pressure systems.
Intuitively, the extended core heatup tiring provides a basis for arguing that failures of depressurization systers r.ay be recoverec' prior to reaching unacceptably high fuel temperatures.
However, the data and rodeling required to support this assertion is a level of effort beycnc the scope of this analysis.
Therefore, it is judged that the already higr combined reliability of depressurization systems at 5'.
power is adequate for the estimated reliability at 2.St power.
Thus, the total core vulnerable frecuercy due to other transients at 2.5%
power is estinated to be 3.5E-7 events / reactor-year.
E.2.2.4 ATWS The quantification of ATWS event trees at 5% power in the Main Report includes several changes in success criteria based on sequence timing.
The differences between 5% and 2.5% power are judged to be negligible with regard to the E-6 JRH1
~
requantification of events appearing in ATWS sequences.
Therefore, the estimated frequency of core vulnerable conditions is the same for both ones.
E.2.3 COMPARISON AND
SUMMARY
Table 3-2 summarizes the quantification of accident sequences frecuen-%s at 2.5* power.
As shown, the total frequency of core vulnerable conditions is reduced by approximately a factor of 3, primarily due to the extended timing c' LOSP sequences.
An additional contributor is the assurned viability of CR0 injection as a mears of core cooling, which is also attributed to the exterdec sequence t ir-i n g.
While not explicitly calculated, it is judged that tre extenced sequence tining would have a significant favorable impact or other carareters important to risk calculations including:
evacuation warrirg tires, in-certainment residence times, etc.
I TABLE 3-2 DOMINANT ACCIDENT SEQUENCE FREQUENCIES ASSUMING STEADY l
STATE OPERATION AT 2.5' POWER I
IMTIATOR TYPE -
TOTAL SEQUENCE FREQUENCY Loss df Offsite Power 7.7E-7 i
LOCA(-
2.2E-7 Other Transients 3.5E-7 ATWS 2.7E-7 TOTAL 1.6E-6 JRH1 E-7 m
w+
t REFERENCES 1.
Supplemental Motion for Low Power Operating License, submitted i r.
the matter of Long Island Lighting -Company, Occket No. 50-322, to the Atomic Safety and Licensing Board, affadavit of J. A. Notaro and W. E. Gur.ther, Jr., dated March 20, 1984 2.
Reactor Safety Study, WASH-IdOO, NUREG75/014, dated October 1975, i
S i
l i
I 1
1 8
JRH1 M
g t
---it
--w-+
m
--,e we 1
P K
m
'rr---
r
---