ML20137D737
| ML20137D737 | |
| Person / Time | |
|---|---|
| Site: | Saint Lucie, Palo Verde  |
| Issue date: | 09/07/1994 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20136C539 | List:
|
| References | |
| FOIA-96-485 GL-89-19, NUDOCS 9703260288 | |
| Download: ML20137D737 (10) | |
Text
...-
4 mg g
i UNITED STATES
,5 j
NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20066 4 001 t
+9*****f i
SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATING TO COMBUSTION ENGINEERING OWNERS GROUP STEAM GENERATOR OVERFILL PROTECTION (GL 89-19)
1.0 BACKGROUND
PWR steam generator (SG) overfill events have been identified by q
the NRC as potentially significant transients that could lead to unacceptable consequences.
Review of how control systems failures contribute to these events was, therefore, a major part of the Unresolved Safety Issue (USI) A-47 program.
This program evaluated control system failures that could be more severe than those previously analyzed in the Final Safety Analysis Report.
NRC studies identified four potentially safety-significant failure scenarios for Combustion Engineering (CE) plants, two of which lead to overfilling the SG via the main feedwater system.
In response to the above concern, a CE Owners Group (CEOG) study of the operating experience was conducted for their plants.
In idl cases, the overfilling events were terminated by the control system or operator action.
The study results were based on core-melt frequency and risk calculations performed for a generic plant.
Adjustments were then made to the calculated values as necessary to account for plant-specific design differences.
The specific core-melt scenario of concern is an overfeed event which leads to flooding of the steamline with relatively cold feedwater, a possible water hammer, an unisolable main steamline break (MSLB) outside containment, multiple steam generator tube ruptures (SGTRs), and failure of emergency core cooling due to exhaustion of the Refueling Water Storage Task (RWST) inventory.
These overfill scenarios for CE plants are analyzed in NUREG/CR-3958, " Effects of Control Systems Failures on Transients, Accidents and Core-Melt Frequencies at Combustion Engineering Pressurized Water Reactors," dated March 1986.
The estimated core-melt frequency due to overfill is approximately 4X10~'/yr.
A summary of the key aspects of this estimate is shown in Table 1.
To reduce the risk from SG overfill, Generic Letter (GL) 89-19 recommends that all CE plants provide an automatic SG overfill 9703260288 970301 PDR FOIA DINDER96-485 PDR
E.
U4..
2 l
a I
protection system to mitigate main feedwater (MrW) overfeed events.
Also, it recommends that procedures and technical l.
specifications for all CE plants include provisions to b
periodically verify the operability of overfill protection and j
ensure that automatic MFW overfill protection is operable during reactor power operation.
.a
}.
CE-designed' plants, except Palo Verde and St. Lucie, do not provide automatic SG overfill protection.
By letter dated 4
l' October 31, 1990, and during a subsequent meeting on November 20, i
1990, the CEOG questioned the assumptions and information used in i,
the cost / benefit analysis done to justify the recommended changes 1
to the design of CE plants.
The CEOG concerns on this issue are discussed below.
l' 2.0 DISCUSSION 4
The recommendations in GL 89-19 for CE plants are based on the probabilistic risk assessment and value/ impact analysis of control system failures performed by Pacific Northwest Laboratories (PNL) for the NRC in NUREG/CR-3958.
The dominant scenario for core-melt risk identified in this report is a result of a steam generator overfill caused by control system failures.
As the overfill occurs, water spills into the steamline I
eventually causing an MSLB at a non-isolable location, an SGTR or 4
multiple SGTRs, and failure of emergency core cooling.
The CEOG believes that PNL made.several inappropriate assumptions related to the likelihood of events in the above scenario.
If more realistic assumptions had been used in NUREG/CR-3958, the results would have been significantly different and would not have justified the recommended changes to CE plants.
The pertinent assumptions and information provided by the CEOG are discusced below.
J
]
(1)
Probability of SGTR j'
NUREG/CR-3958 used-the draft NUREG-0844, "NRC Integrated Program l
for the Resolution of Unresolved Safety Issues A-3, A-4, and A-5 j
Regarding Steam Generator Tube Integrity," report, dated April 1
1985, which established the probability of tube rupture due to an MSLB as 0.034.-
The total probability of tube rupture due to an MSLB was revised to 0.0505 in the final NUREG-0844 report, dated September 1988.
Although the overall SGTR probability was increased, the probability of rupturing greater than 10 SG tubes
- was decreased by nearly an order of magnitude, to 0.0005 from 0.003.
The core melt estimate is dominated by the sequence of rupturing greater than 10 SG tubes and the shorter time to exhaust the RWST inventory.
CE stated that replacing pertinent probabilities with revised information from the final NUREG-0844 report results in a reduction in exposure in NUREG/CR-3958 from 570 person-rem to 183 person-rem.
Based on $1000/ person-rem,
^f-a
\\
3 570 person-rem to 183 perso this benefit is below the app n-rem.
Based on $1000/ person-rem overfill prctection system of $200 roximate cost of installation of a appropriate.in NUREG-1218, USI A-47," dated July 1989
,000 that NRC concluded was
" Regulatory Analysis for Resoluti n
(2)
Probability on of of MsLa civen SG-overfill assumption that an MSLThe core damage estimates of N REG overfill event occurs.B will occur /CR-3958 depend on the PNL recognized the important r l50% of t is used to be consistent withassumption in Section 2 The CEOG states that "if an MSpreviou/CR-3958 and stated that ito e of overfill is used, s value/ impact analyses LB probability of 0.001 given.
the estimate of core melt and modifications difficult.several orders of magnitude
, making any cost-effectiverisk drops by light of this uncertainty in thscenarios and any need f The significance of the overfill e potential for MSLB." changes must b The SG tube integrity program (fi probability for MSLB from overfill nal NUREG-0844) uses a 0.001 should be noted that if the mai following a SGTR.
of an SGTR as opposed to an overf n steamline is flooded as a res, ult However it the steamline is saturated oeeding event, MSLB than an SG overfill eventlower probability of caused by subcooledn a water hamme the steamline due to a control indicates that 0.5 is conser system malfunction. water entering experience the best estimate ofvative and on the basis of actu (given overfill) is 0.13.
conditional-probability of MSLB the probability of an MSLB ev NUREG-1218 goes on to state th t i of magnitude, the proposed desig ent was further reduced by an order a
f n could not be justified.
As can be s wide range, een, the estimate for probability of an MSLB h 0.13 estima from 0.5 to 0.001, pointed-out above, may be unrealistiperson-with high uncertainty.
as a The 0.001 estimate of MSLB prob bi Using the out 120 considerably lower averted risk of cally low) lity (which, as a
wo (3)- MSLB Location about 1 personuld result in a rem.
reactor coolant sThe core-melt sequence of conc inventory through an unisolableern oc steamline break (ystem (RCS) in conjunction with SGTRs) exhausts the RWST inventory.
probability is based on the assumpti probability of occurring upstream or dThe steamline b isolation valve (MSIV).
on that an MSLB has an equal ownstream of the main steam 2
j i
- ~~
G j
4 In reality, the MSIV is located relatively close to the outside containment wall.
As a result, the majority of piping upstream of the MSIV is located inside containment.
If the MSLB occurred inside containment,. water lost through the break would be l
collected in the costainment sump and would be available for recirculation.
ThuW, core melt should not occur without l
additional failures.
i; NUREG/CR-3958 assumes that an MSLB occurs upstream of the MSIV with a probability of 0.5.
The CEOG estimates that the probability should more appropriately be the ratio of the main steamline piping length outside containment up to the MSIV, to
,i the total main steamline piping up to the MSIV.
Although this ratio is plant-specific, the CEOG revises the probability of 3
occurring upstream of the MSIV, but outside containment, to 0.16.
2 The estimated risk would be reduced by about a factor of 3.
\\
j (4)
Credit for Operator Action to Prevent Core Malt The CEOG' states that the analysis in NUREG/CR-3958 assumes that if an MSLB occurs.in an unisolable location.and steam generator tubes are ruptured, then core melt is inevitable.
No operator recovery actions are credited.
However, since it would;take many hours to exhaust the RWST inventory, operator actions are possible to prevent core melt.
Depressurization of the RCS would stop the inventory loss (or at least reduce it to a small amount) and prevent core melt.
Since the steamline break and tube ruptures would themselves cause a depressurization, the RCS would reach low pressures in a relatively short period of time.
In the NUREG-0844 report, Sequence 8C uses a value of 0.5 for operator failure based on an estimate for Westinghouse plants with 20 ruptured tubes where pressure drops to the point that low pressure safety injection pumps inject.
The CEOG believes that i
an unrealistically high flow rate is assumed which would not be applicable to CE plants.
Therefore, CE believes that crediting operator recovery action would reduce the likelihood of core melt by at.least a factor of 100.
In the core melt sequences for the I
events of a single SGTR, multiple SGTRs (2 to 10 tubes), and multiple SGTRs (more than 10 tubes), values of 1.0E-3, 1.0E-2 and 0.5 respectively, are used for an operator failing to depressurize the RCS before the RWST is exhausted.
This is based on having many hours to manually act before the RWST is emptied, as would be the case for all CE plants.
With an operator failure probability of 0.1, as estimated by the staff, the exposure reduction due to installation of an overfill protection system is j
decreased from 570 person-rem to 112 person-rem.
l 1
i
,,, - - ~
i i
9 5
(5)
Neaative Imoact of Sourious Operation The automatic feedwater pump trip function can itself cause a loss of feedwater accident due to spurious actuation or testing i
failures.
The CEOG believes that adverse consequences can also result from spurious actuation during other accidents.
To minimize a loss of feedwater accident due to spurious actuation or testing failures, GL 89-19 recommends that CE-designed plants provide water-level sensors with a coincident logic to isolate MFW flow on an SG high-water-level signal.
Also, it is recommended that the overfill protection system be separated from the feedwater control system.
Nevertheless, ther.e would be some increase in risk from spurious actuations caused by the addition of automatic overfill protection to a plant design.
A scoping analysis provided by the CEOG estimates an increase in core-damage probability of 1.4X10/yr due to testing of this feature at power.
4.0 CONCLUSION
The original cost / benefit analysis, as discussed in NUREG-1218, res'ulted in an estimated 570 person-rem risk reduction with a
$200K proposed design fix cost.
As stated above, this estimate depends on the probability of an MSLB, the MSLB location, the probability of an SGTR involving 10 or more tubes and the probability of the operator failing to properly respond.
Our review of the CEOG information and the above NUREG/CRs and NUREGs indicates that overly conservative estimates and steamline break location assumptions were made that unduly influenced the risk estimate.
We conclude that:
- 1) the MSLB probability is very likely lower than 0.5
- 3) based on the final NUREG-0844, the probability of an SGTR involving 10 or more tubes, given a MSLB, is less than 0.034.
We conclude that the core-melt frequency for the likelihood of this sequence is closer to, and very likely less than 1X10/yr, rather than the 4X10/yr taken from NUREG-3958.
Therefore, the recommended system modification to install an automatic fieedwater pump trip is not justified on a generic basis.
However, since this condition is based in part upon operator performance, each licensee should verify that a program of training and procedures, as the CEOG discussed in their
f i
\\
6 iustification, has been or will be implemented that will allow the operators to effectively deal with steam generator overfill events, and small-break loss-of-coolant accident (SBLOCA) scenarios discussed in GL 89-19 under Section (4) " Combustion Engineering-Designed PWR Plants," item "c".
Based on the above discussion, the staff concludes that if the licensee for each CE plant had: (1) implemented the appropriate operator training and procedures to address SG overfill events and the SBLOCA scenarios, and (2) performed an evaluation to confirm the applicability of the CEOG analyses to its plant, then j
the automatic SG overfill protection system is not necessary, and i
the plant meets the recommendations of GL 89-19.
I l
l l
I l
i l
l a
t TABLE 1 NUREG/CR-3958 Estimate of Core Melt Frecuency from Overfill Events Probability of overfill after reactor 9X10p2/yr trip / turbine trip due to feedwater failure Probability of failure of operator to terminate overfill 0.1 Probability of main steamline break (MSLB) 0.5 given overfill Probability of break being unisolable and 0.5 outside containment Conditional probability of core melt 1.7X10'3 probability given MSLB* resulting from steam generator tube rupture and loss of RWST inventory 2
3 Total CMF - (9X10f /yr) (0.1) (0.5) (0.5) (1.7X10I )= 4x10f'/yr Number of Probability Steam Generator Probability Probability of of Failure to Net Core Melt Tubes Ruotured of Ruoture loss of RWST Isolate SG Probability 1
0.017 IX10'3 1
1.7X10'5 2 to 10 0.014 1X10
1
- 1. 4 X 10
10 0.003 5X10
1 1.5X10'3 Total 0.034 Total 1.7X10'3
t (Addressee)
Dear Mr.
SUBJECT:
TRANSMITTAL OF THE NRC SAFETY EVALUATION REPORT FOR THE COMBUSTION ENGINEERING OWNERS GROUP RESPONSE TO GENERIC LETTER 89-19, " REQUEST FOR ACTION RELATED TO RESOLUTION OF UNRESOLVED SAFETY ISSUE A-47
' SAFETY IMPLICATION OF CONTROL SYSTEMS IN LWR NUCLEAR POWER PLANTS' PURSUANT TO 10 CFR 50.54(f)," AND THE CLOSE0VT OF THIS ISSUE -
[ PLANT NAME] (TAC N0(S). MXXXXX)
Enclosed is the NRC Safety Evaluation Report (SER) addressing the Combustion i
Engineering Owners Group (CEOG) response, dated October 31, 1990, to Generic Letter (GL) 89-19. Based on the staff's review of the response which included a cost / safety benefit analysis, the staff has concluded that if the licensee for each CE plant had: (1) implemented the appropriate operator training and procedures that address steam generator (SG) overfill events and small-break loss-of-coolant accident (SBLOCA) scenarios, and (2) performed an evaluation to confirm the applicability of the CE0G analyses to its plant, then the automatic overfill protection system is not necessary and the plant meets the recommendations of the GL. The staff's findings and conclusions are l
documented in the enclosed SER.
Your letter dated stated that you had reviewed the CEOG report 4
and verified that the generic aspects of the report are applicable to your plant.
Furthermore, your letter confirmed that your plant (s) had already implemented the appropriate operator training and procedures addressing SG overfill events and SBLOCA scenarios. Your letter provides an adequate basis to consider our review of your response complete.
Further NRC review, if any, will be performed by inspection or audit.
If you have any questions concerning this matter, please contact me at (301) 504-XXXX.
Sincerely, Project Manager Project Directorate Division of Reactor Projects Office of Nuclear Reactor Regulation Docket No(s).
Enclosure:
NRC Safety Evaluation Report cc w/ enclosure:
See ned page
i
[ Addressee)
Dear Mr.
SUBJECT:
TRANSMITTAL OF THE NRC SAFETY EVALUATION REPORT FOR THE COMBUSTION ENGINEERING OWNERS GROUP RESPONSE TO GENERIC LETTER 89-19, " REQUEST FOR ACTION RELATED TO RESOLUTION OF UNRESOLVED SAFETY ISSUE A-47
' SAFETY IMPLICATION OF CONTROL SYSTEMS IN LWR NUCLEAR POWER PLANTS' PURSUANT T0 10 CFR 50.54(f)," AND REQUEST FOR ADDITIONAL INFORMATION
[ PLANT NAME)
(TAC N0(S). MXXXXX)
Enclosed is the NRC Safety Evaluation Report (SER) addressing the Combustion Engineering Owners Group (CE0G) response, dated October 31, 1990, to Generic Letter (GL) 89-19. Based on the staff's review of the response which included a cost / safety benefit analysis, the staff has concluded that if the licensee for each CE plant had: (1) implemented the appropriate operator training and procedures to address steam generator (SG) overfill events and small-break loss-of-coolant accident (SBLOCA) scenarios, and (2) performed an evaluation to confirm the applicability of the CE0G analyses to its plant, then the automatic overfill protection system is not necessary and the plant meets the recommendations of the GL. The staff's findings and conclusions are documented in the enclosed SER.
Your letter dated did not address the above conditions. ((The PM should verify the accuracy of the previous sentenc )). Please provide your response to the above concerns within 30 days frob receipt of this letter.
If you have any questions concerning this matter, please contact me at (301) 504-XXXX.
The information requested by this letter is within the scope of the overall burden estimated in Generic Letter 89-19, which was a maximum of 240 person hours per licensee response. This request is covered by the Office of Management and Budget Clearance Number 3150-0011 which expires July 31, 1997.
l Sincerely, Project Manager Project Directorate Division of Reactor Projects Office of Nuclear Reactor Regulation Docket No(s).
Enclosure:
NRC Safety Evaluation Report cc w/ enclosure:
See next page l
)