ML20154D889
| ML20154D889 | |
| Person / Time | |
|---|---|
| Issue date: | 06/09/1988 |
| From: | Beckjord E NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | Jordan E NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| Shared Package | |
| ML20150F860 | List: |
| References | |
| REF-GTECI-A-45, REF-GTECI-DC, RTR-NUREG-1289, RTR-NUREG-1292, TASK-A-45, TASK-OR NUDOCS 8809160163 | |
| Download: ML20154D889 (791) | |
Text
{{#Wiki_filter:_ _ _ - - _ - - _ _ _ _ - _ _ - _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ - _ _ - ___ __ _________________________ --_ ___
/* g UNITED 8TAfts o NUCLEAR MEGULATORY COMMISSION '
{ wAsmworou, n. c. noses s -) =, ,,,, ; NEHORANDUM FOR: Edward L. Jordan, Director ' Office for Analysis and Evaluation - of Operational Data ; FRON: Eric S. Beckjord, Director Office of Nuclear Regulatory Research i (
SUBJECT:
CRGR REVIEW 0F PROPOSED RESOLUTION OF US! A-45 i
"$ HUT 00WNDECAYHEATREMOVA). REQUIREMENTS" }
9 ' h This memorandum requests CRGR review of the proposed resolution of US! A-45 i described in the attached memorandum to the Comissioners (with its several t enclosures). I The attached memorandum to the Comissioners describes the proposed resolution of this issue. The several plant-specific, detailed FRA-based analyses of ; l decay heat removal related risks are described, along with the results which ! are used to develop the Regulatory Analysis of the value/ impact ratios for the l several alternatives that were considered. Thest studies resulted in the staff reaching the following conclusions: I 1) The core damage frequency caused by decay heat removal failure for the six plants studied spanned a broad range with the average value either l 2E-04 or 4E-04 per reactor year, depending on whether or not credit is ( allowed for certain backup core cooling methods. This result includes ; consideration of all known significant, decay heat removal failure related sequences, including those related to station blackout. h a safety goal in terms of core dama I Althoukred,theCommission'ssafetygoalpolkefrequencyhasnotbeen fonnal ey states that severe ' Lj releases should remain below 1E-06 per reactor year. Assuring one severe ! release per hundred core damage events, the resulting core damage ! frequency goal including all causes of core damage is IE 04 core damage l events per reactor year. Realistic appitcation of this goal can be ! achieved by requiring that the contribution from any identified broad t class of events be less than ten percent of 1E-04 (i.e., less than 1E-05). ' This was done for US! A-44, "Station Blackout," where a core damage frequency goal of 1E-05 for events involving station blackout was implied (NUREG-1109, January.1986), r Decay heat removal failure related events constitute another broad class I t of core damage events, and so a goal of 1E-05 was adopted by the staff as ! also being appropriate for that class of events. It is likely that the cecay heat removal related core damage frequency (which averaged 2E-04 to 4E-04 for the six case studies) may be considerably above this goal at i certain plants, which results in the conclusions and recomendations made below. - neem at- mu
8 Edward L. Jordan ION [ Note that application of cne 1E-05 goal for the blackout events and a separate 1E-05 goal for the decay heat removal failure events will result in a combined risk from both types of events above 1E-05 but less than 2E-05 since there is some overlap (i.e., some of the decay heat removal failures are caused by station blackout). This small amount of "double counting" contributes to the margin that will be available for later inclusion of other quantitatively detemined core damage frequencies as ATWS) without exceeding the overall 1E 04 core damage frequency l.] goa(such 2) The value/ from impact plant to plant.ratio of the studied alternatises varied significantly Using conventional value/ impact methodology, some corrective actions do achieve a value/ impact ratio that would justify their implementation for certain plants ealthough none of the six alternatives analysed will simultaneously achieve such a value/ impact ratio and also reach the staff's core damage frequency goal (i.e., no cost effective Corrective actions were identified khich would make all plants reach an acceptable core damage frequency).
- 3) Since all of the significant US! A-45 results have been found to be highly plant specific, it is not apprupriate to propose a single generic action to be applied unifomly to all plants.
4) For any specific plant, to determine the core damage frequency caused by decay heat removal failure and the value and impact of proposed corrective design changes, detailed analyses of that specific plant are necessary. As you are aware, the Comission is currently planning to implement the Severe Accident Policy (50 FR 32138) and will issue a generic letter to require all plants currently operating or under construction to under examination temed the Individual Plant Examination (!PE)go a systematicto identify any plant-specific vulnerabilities to severe accidents. The IPE analysis, which is similar to those needed for item 4 above, is intended to examine and understand the plant emergency procedures, design, operations, maintenance, ano surveillance to identify vulnerabilities. The analysis will examine both the decay heat removal systems and those systems used for other functions. Therefore, we have decided to uomend (in the attached meno to the Comissioners) that A-45 be subsumed into the IPE program as the most effective way of achieving resolution of A-45. In sumary, in the attached memorandum to the Comissioners, we recomend: (1) Resolution of US! A-45 as an integral part of the IPE program. That is. DHR concerns (and USI A 45) will be subsumed within the IPE program, and USI A-45 will be considered resolved generically. Plant-specific implementation (including the effects of any corrective actions proposed by the licensee and/or required by the Comission) will also be subsumed within the planned IPE activitiest (2) Publication of the Public Notice shown in Enclosure C to the memoranoum to the Comissioners, infoming the puolic that US! A-45 has been subsumed into the IPE program; and
Edward L. Jordan 3 (3) Transmittal of the Congressional letters shown in Enclosure D to the memorandum to the Comissioners, informing Congress that US! A-45 has been subsumed into the IPE program. In the interest of maintaining the schedule for US! A 45 resolution defined for the EDO. we request that the CRGR review be completed by June 30, 1988. We would be pleased to provide any additional information you need for the CRGR review. The Task Manager for this issue is Dr. Roy Woods, who can be reached at ext. 23568 Q\b +b Eric S. Beckjord Ofr'ctor Office of tiuclear Reg latory Research
Attachment:
l Draf t Memorandum to the Comissioners i I
(- ( . umTe3sTAfts 00000* NUCLEAM WASHING TON, REGULATCMY D. C. 20044 10N COMMIS$ t t
'EMORANDUM FOR:
\
Chairman Zech OM: Corsnissioner CerrConraissioner Roberts Comissioner Rogers \
\
Victor Stallo Jr. t JECT: Executive Dire,ctore for Op ra tions 5
'OSE AND SUMARY:
5HUTDOWN DECAY HEAT REMOVAL REQ \ i UIREMENTS (US! A-45) '
\
memorandum 15 to inform you , an.
- gh fromplant-spectf Js tudies decay heat renoval tc analyses of staff plans for theunThe resoluti on of technical basis\
oer the Individuel Plant Eval risk assesst.<nts for sixe gplans incluces important i es, have, led to the cvtcgether with
- e operati IPE ts ) \
ng history of operating reactors. estons that: isk due to loss of Dhk decay hvet removal (OHR) \ i R failure vulnerabil.,d be unduly high for some ; plants i ose vulnerabilitiss,ities, and the optimum c j orrect
. ailed plant specific analysesare strongly plant specific; ive ac resolve this issue. (
3: under the IPE programeded will be ne i
.ston asstynate i
\
Sofety Issue US (d "Shutdown Decay Heat Removal \ to evaluate light tater the sa! A 45) in March 1981 Theand USIto A 45 prograuRequirements" as a\ reactor pwer plants b;nuf tt and cost) of afetywas adequacy of the DH \ s
< of th3 DHR function. alternative ssess the measures value and t iiapactction in thei 5 prograa employed probabili o taprove the overall ! )ofandthose cold-shutdown CHR systems and support yst=s analysts tecnniques sticinwer c9nditions risk assessrents both prsystems required and n sti. to achieve determi i (
to various internalernal and ext e events. used The toaccid assess they vulnerabilitessurized ar5 s, as aca small fires break loss of coolant of niquss were,used to assess thfloods, earthquakes, end s b k ents, and special o otage er:ergercyanalyses were li i easures to improve ethe net overall safety benwr.reliCost-benefit ( ability of it and cost of i
' cods (RES), 42 3568 the DHR function. i i
i i y
The Commissioners Six plants were onelysed af ter an initial selection process which considered vendor, product line, other issues in which each particular plant might be involved, operational status, and utility willingness to participate. The internal events analyses for these plants proceeded along the well-documented lines used for other PRAs. Additional emphasis was put supportingsystems. electrical systems including service water, component cooling water, are The performance of cortainment systems was examinea for each of the dominant core melt sequences, end the probability of containment failure for each containment failure mode was estimated. The analyses for fire, earthquake, wind, and external and internal flooo proceeded by identifying the significant hazards and their frequency of occurrence. An estinate nf the response of the plant to such hazards was then made, utilizing the results of an onsite inspection of the plant and equipuent. The appropriate event and fault trees were adjusted to account for cokinon-cause failures, the effects of fires and floods were quantified based on sn estimate of the probability of mitigative action, and estimates of the potential contribution of these events to core melt probability were derived, i The above results were combineo to calculate a total core damage frequency caused by decay heat removol f611ure for the six plants studied (see Enclosures A and B for further details). This frequency was found to be quite plant-specific in nature (i.e., there was considerable variation in the results among the six plants studied). In terms of expected core damage frequency Caused by decay heat removal failure per redCtor year, the range for the six plants was 7E-05 to 4E-04 with an average value of 2E-04 if credit is allowed ! for feed and bleed operation on the PWRs and containment venting on the bWRs. If one arbitrarily makes the unrealistic (but limiting) assumption that no such credit should he allowed, then the range becomes instead IE-04 to 1E-03 (average 4E-04). Heither the above ronges nor the averages were found to be significantly changed when several other existing, reliable PRA results were also included. On the other hand, the result of one recent industry-sponsored re-analysis (for the Point Beach plant, one of the si.x plants the staff analysed) was outside of , those ranges. The core damage frequency caused by decay heat removal tailure re-calculated in this study was 1E-05 per reactor year, o factor of seven below the bottom of the range quoted above, and a factor of thirty lowcr than the 3E-04 per reactor year'that the staff obtained for Point Beach. Reasons for the difference include different assumptions regarding the frequency of certain initiating events and the probability of the operator's taking appropriate mitigative actions (such as initiating the feed and bleed cooling option). The differences are detailed in Appendix 0 of Enclosure it, where it is concluded l that the "true" best estimate for Point Beach probably lies above 1E-05 and withi:. the range quoted above, but below 3E-04, 1 j Utilizing any of the above results, the six plants meet the health effects quantitative objectives in the Conraission's Sofety Goal (i.e., 0.1% of the expected accident or cancer risk from risks not related to nuclear plants). Guidance for an acceptable core damage frequency has not been explicitly ' 1 provided. However, in order to provide assurance that: (1) core damage cue to a decay heat renoval failure related event will not occur in the lifetime of i l
4 l l l The Commissioners the present population of plants; (2) consistency is maintained with the 1E-05 per reactor year contribution to core damage frequency from station blackout expected after resolution of the station blac(out USI (A-44, NUREG-1109); and ! (3) the frequency of a severe release will be less than the Commission's safety I goal guidance of IE-C6 per reactor year, the staff selected a goal that core ! damage due to failure of decay heat removal function should be less than 1E-05 ! per reactor year. This staff-selected goal is intended only for current i opplication to the resolution of generic issue USI A-45. The results quotea obove indicate that the decay heat removal related frequency I of core damage at certain plants may be considerably above this goal. To address the question of whether corrective actions could be cost effective, six possible alternatives addressing potential decay heat removal vulnerabilities i were identified and then evaluated. The approximate costs and value/iupact j ratios of the alternatives were estimated, and are given in Enclosure A. i
- i
' Alternative 1 is to take no action for the resolution of US! A-45, i.e., the status quo described above would be maintained. This alternative was not selected because it appears likely that certain plants have a core damage ' frequency above the staff selected goal. 1 Alternative 2 is to have each licensee perform a risk assessment for its , olants. Thii assessment would be done in conjunction with the Individual Plant Examination program. At:ailable options for acceptable risk assessments include performing a Level-1 PRA (enhanced) or performing an analysis using the IDCOR IPEM. This is the proposed alternative (as discussed throughout the rernainder ; of this paper), since the plant risks, and the effects of individual corrective actions, are highly plant specific. ' ecified group of equipment and Alternative 3 is to perforu procedure mo3ffications a certain for each plant sp(as described for Alternative 3 in l i Enclosures A and B). These modifications generally correspond to several of l the current generic unresolved safety issues. This alternative would require t ' the same group of corrective actions for each plant, anu is not recommended I since many of the vulnerabilities are not the same for each plant. I Alternative 4 is to take whatever actions are necessary at each individual ! plant to provide and/or enhance the "feed and bleed" heat removal method for PWRs, and the "containment venting" method for BWRs. ! This alternative is not - recommended because the staff lacks sufficient confidence that operators would ; j initiate these cooling methods during an octual event when they might be r 7 needed. l l l j Alternatives removal syste5s 5 and capible 6 are to install of cooling thenew, plantsseparate and dedicated to a hot (Alternative decay) heat 5 or cold f (Alternative 6) shutdown condition. These alternatives show considerable ; l potential safety benefit, particularly when the advantages to other safety I issues, such as the possibility of insider sabotage, are considered. They may have a favorable value/ impact ratio only if conventional value-impact methods are modified, for example, to taxe into account the value of avoidin muratorium following a severe accident ("method #3" described below)g . a nuclear However, these alternatives u,,not be recommended at present due to their high cost (on j l v 1
, _ _ _ _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ __ ___O
The Commissioners - 4-the order of $100,000,000 per plant) and unfavorable value/ impact ratios, t Value/ impact ratios must be taken into account in cases such as this where the ' alternatives being considered maJ be considered as providing additional protection over that necessary for adequate protection. It was found that the value (saUty benefit) and the impact (cost) of Alternatives 2 through 6 varied significantly from plant to plant. To facilitate making a single recommendation that would be applicable to all plants, a set of generic results were derived to represent the overall family l of operating V. S. plants. In addition, the value/ impact analyses were performed using three separate methods:
- 1. The value term was limited to the reduction in dose to the po9ulation within a lies. The impact term was defined as the total cost of impleme ... ion with no reduction for the anticipated economic advantages in the form of averted costs.
- 2. The value term was defined as in method #1; however, the net impact used was reduced by the anticipated averted onsite costs.
1
- 3. The value term was based on the reduction in population dose as in method il, but was supplemented by the monetary value of other averted cost savings that would affect the public interest, such as consideration of a .
nuclear moratorium, insider sabotage, other outstanding generic issues, l environmental qualification, unquantifiable internal initiating events, and residual risk from special emergency events (assuming $1,000 per avertedperson-rem). The impact term was defined as in method #2. Using the more conventional approach of method #1, the value/ impact ratios for certain alternatives for the "generic" (i.e., the "average") plant did achieve a value/ impact ratio of about $1,000 per person-rem avertea. Specifically,
- l. Alternatives 3 and 4 achieved this ratio for the BWR, and were close to this ratio for the PWR. Alternative 2 was close to achieving this ratio for the j BWR. However, none of those alternatives (i.e., Alternatives 2, 3, or 4) t achieved a core damage frequency near or below the staff's goal of 1E-05 per '
reactor year DHR related core damage frequency. Therefore, the results show that, using method #1, none of the alternatives will simultaneously achieve a , value/ impact ratio of $1000 per person rem and also reach the staff's selected l core damage frequency goal. i Using method #2, value-impact ratios near $1000 per person rem are achieved for most alternatives, except for Alternatives 5 and 6 (which are the only two alternatives that reach the staff-selected core damage frequency goal). The results of method #3 show the cure damage frequency goal can be achieved by
- Alternatives 5 or 6 at a value/ impact ratio near $1000 per person rem. -
However, use of ruethod #3 goes beyond value/ impact analysis methods previously used for Unresolved Safety Issues. The high cost of Alternatives 5 or 6 cannot be justified on the basis of conventional value/fupact methods (i.e., methuds
#1 or #2),
i I t re- - - - - - - - - - - - - - -c-----e----+-+---mvmrn--vm=-=w-- ---w- - - - -re----*-e---m--- -* -e---
The Commissioners
SUMMARY
OF TECHNICAL FINDINGS:
- 1) The core damage frequency caused by decay heat removal failure for the six plants studied spanned a broad range with the average value either 2E-04 or 4E-04 per reactor year, depending on whether or not credit is allowed for certain backup core cooling methods. This re:..lt includes consideration of all known significant decay heat removal failure related sequences, including those related to station blackout.
Although a safety goal in terms of core danage frequency has not been formalized, the Commission's safety goal policy states that large releases should remain below 1E-06 per reactor year. Assuming one severe release per hundred core damage events, the resulting core damage frequency goal including all causes of core damage is 1E-04 core damage events per reactor year. Realistic application of this goal can be achieved by requiring that the contribution from any identified broad class of events be less than ten percent of IE-04 (i.e., less than IE-05). This was done for USI A-44, "Station Blackout," where a core damage frequency goal of 1E-05 for events involving station blackout was implied (NUREG-1109, January , 1986) . Decay heat removal failure related events constitute another broad class of core oamage events, and so a goal of IE-05 was adopted by the staff as also being appropriate for that class of events. It is likely that the decay heat removal related core camage frequency (which averaged 2E-04 to 4E-04 for the six case studies) may be considerably above this goal at certain plants, which results in the conclusions and recomendations made below. (llote that application of one 1E-05 goal for the blackout events ano a separate 1E-05 goal for the decay heat removal failure events will result in a combined risk from both types of events above 1E-05 but less than 2E-05sincethereissomeoverlap(i.e.}.someofthedecayheatremoval failures are caused by station blackout This small amount of "double counting" contributes to the margin that will be available for later inclusion of other quantitatively determined cure damage frequencies as A1WS) without exceeding the overall 1E-04 core damage frequency l.] goa(suc
- 2) The value/ impact ratio of the studied alternatives varied significantly from plant to plant. Even using only offsite benefits in the value/ impact methodology, some corrective actions do achieve a value/ impact ratio that would justify their implernentation for certain plants although none of the six alternatives analysed will simultar lusly achieve such a value/ impact ratio and 61so reach the staff's core camage frequency goal (i.e, no cost effective currective actions were identified which would make all plants reach an acceptable core damage frequency).
- 3) Since all of the significant USI A-45 results have been found to be highly plant specific, it is not appropriate tu propose a single generic action to be applied uniformly to all plants.
- 4) For as;y specific plant, to determine the core damage frequency caused by decay heat removal failure and the value and impact of proposed corrective design changes, detailed analyses of that specific plant are necessary.
b The Comraissioners PLAllS FOR RESOLUTION: As you are aware, the Commission is currently planning to implement the Severe Accident Policy (50 FR 32138) and will issue a generic letter to require all plants currently operating or unaer construction to under examination termed the Indiviaual Plant Examination (IPE)go toaidentify systematic any plant-specific vulnerabilities to severe accidents. The IPE analysis, which is sirailar to thosa needed for item 4 aoove, is intended to examine and understand the plant emergency procedures, design, operations, maintenance, and surveillance to identify vulnerabilities. The analysis will examine both the decay heat removal >ystems and those systems used for other functions. Therefore, we have decided tu subsume A-45 into the IPE prograr.i as the most effective way of achieving resolution of A-45. <
- We therefore plan to:
(1) Ad t Alternative #2 and subsume USI A-45 as an integral part of the 2o IPE program. That is, USI A-45 will be considered resolved generically. Plant-specific implementation (including the effects of any corrective actions proposed by the licensee and/or required by the Commission) will > dlso be subsumed within the planned IPE activities; (2) Publish the Public Notice shown in Enclosure C, informing the public of ; the resolution of USI A-45 by subsurhing it into the IPE program; (3) Transmit the Congressional letters shown in Enclosure D, informing Congress that USI A-45 has been subsumed into the IPE prograra. Victor Stello, Jr. Executive Director for Operations l
Enclosures:
1 ; A. "Regulatory and Backfit Analysis: Unresolved Safety Issue A-45, ' Shutdown Decay Heat Removal Requirements," NUREG-1289, April, 1988 < (DRAFT). i B. "Shutdown Vecey Heat Removal Analysis Plant Case Studies and Special Issues Summary Report," liUREG-1292, October,1987 (DRAFT). C. Proposed Federal Register Notice, "Shutoown Decay Heat Removal 1 Requirements" (to be published). 1 { D. Draft Congressional letter. i c i cc: SECY i OGC ' i, . i
ENCLOSURE C Nuclear Regulatory Comraission Staff 10 CFR Part 50 Shutdown Decay Heat Removal Requirements i AGENCY: Nuclear Regulatory Commission Staff ACTION: Final Generic Resolution of Unresolved Safety Issue l l AVAILABILITY: The materials describing the resolution of USI A-45 (discussed ' below)consistof: 1) Memorandum / rom Victor Stello to the Commissioners, '
"Shutdown Decay Heat Removal Requirements," dated (. . .); 2) NUREG-1289, "Regulatory and Backfit Analysis: Unresolved Safety Issue A-45, Shutdown Decay Heat Removal Requirements," April, 1988 (DRAFT); and 3) NUREG-1292, "Shutdown Decay Report,"Heat October, Removal 1987 Analy(DRAFT). sis Plantby All are available Case Studies request from and Special Issues Sum the huclear Regulatory Commission, Public Document Room, Washington, DC, 20555.
SUMMARY
- The Nuclear Regulatory Connission Staff has com resolution of Unresolved Safety Issue (UST) number A-45 (pleted Decay "Shutdown its generic, Heat RemovalRequirements"). The Cecay Heat Removal failure concerns identified ,
within USI A-45 have been subsumed within the Individual Plant Evaluation (IDE) . program. Plant specific implementation (including the effects of any corrective actions proposed by the licensee and/or required by the Commission) are ciso subsumed within the planned IPE activities. FOR FURTHER INFORMATION CONTACT: Dr. R. Woods, Division of Reactor and Plant Systems, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555, Telephone (301) 492-3568. SUPPLEMENTAL INFORMATION: Core damage resulted at THI-2 in March 1979 because ; of a failure to remove deciy heat. The accident involved a main feedwater ; transient coupled with a stuck-open pressurizer power-operated relief valve and - a teniporary failure of the auxiliary feedwater system. After the reactor was shut down, decay heat removal was hampered by operator intervention which severely reduced flow from the safety injection system. The severity of the ensuing events (and the potential generic aspects of the accident) led the t Commission to initiate action to: (1) ensure that other reactor licensees took the nccessary action to substantially reduce the likelihood of a similar event; ' and (2) Investigate the potential generic implications of this accident. I I
, . _-= - .
4 FEDERAL REGISTER NOTICE In addition to the accident at tne Tril-2 reactor, several studies have shown that the lack of high reliability in decay heat rernoval systems, particularly in response to SBIOCAs and transients, is responsible for a substantial part of the overall prob 6bility of a core-melt accident. These studies include: the Reactor Safety Study, U.S. Nuclear Regulatory Commission, WASH-1400 (NUREG-75-014), October 1975; the Interim Reliability Evaluation Program (IRREP) Study's Analysis of the Arkansds huclear One - Unit 1 Nuclear Power - Plant, NUREG/CR-2787 (SAI R W 78), Sondia National Laboratories, June IT87, and the Analysis of the Co1 vert Cliffs !! nit 1 Huclear Power Piant, NUREG/CR-3511
~
(SAND 83-2086), Saiioia National Labordtories, March 1984; and the Redctor Safety Study Methodology Applications Program (RSSMAP) study 's Sequoyah #1 PWR Power Plant, NUREG/CR-1659/1 of 4, (SAND 80-1897), Sandia National LaborH ories, February 1981, Calvert Cliffs #2 PWR Power Plant, NUREG/CR-1659/3 of 4 (SAND 80-1897), Sor.dia National Uboratories, May 1982, and Grand Gulf #1 BWR Power Plant, NUREG/CR-1659/4 of 4 (SAND 80-1897), Sandia National LaborH ories, October 1981. Although upgrading of the decay heat removal (and related) systems was required by the Conunission following the THI-2 accident, the Consnission decided that the staff should investigate additional alternative means of improving the decay heat removal function to increase the capability of nuclear power plants to cope with a broader spectrum of transients and accidents, including special emergency events (e.g., fire, flood, earthquake, sabotage). Accordingly, the Nuclear Regulatory Commission designated "Shutdown Decay He6t Removal Requirements" as en Unresolved Safety Issue (USI A-45) in March 1981. The USI A-45 program was i ltiated to evaluate the safety adequacy of the DHR function in light water reactor power plants and to assess the value and impact (i.e., the benefit and cost) of alternative measures to improve the overall reliability of the DHR function. The USI A-45 program employed probabilistic risk assessments and deterministic evaluations of those DHR systems and support systems required to achieve hot-shutdown and cold-shutdown conditions in both pressurized and boiling water reactors. Systems analysis techniques were used to assess the vulnerability of DHR systems to various internal and external events. The analyses were limited to transients, small-break loss-of-coolant accidents, and special emergency challenges such as fires, floods, earthquakes, and sabotage. Cost-benefit analysis techniques were used to assess the net safety benefit and cost of alternative measures to improve the overall reliability of the DHR function. l Six plants were dnalysed af ter an init'-l selection process which constdcred vendor, product line, other issues in which each particular plant might be involved, operational status, and utility willfngness to participate. i The internal events anolyses for these plants proceeded along the well-documented lines used for other PRAs. Rdditional emphasis was put on supporting systems including service watar, component cooling water, and electrical systeus. The performance of containment systems was examined for each of the dominant core melt sequences, and the probability of containment failure for each containment failure mode was estimated.
FEDERAL REGISTER NOTICE The analyses for fire, earthquake, wina, and external and internal flood proceeded by identifying the significant hazards area their frequency of occurrence. An estimate of the response of the plant to such hazards was then ' made, utilizing the results of an onsite inspection of the plant and equipment. The appropriate event and fault trees were adjusted to account for connon-cause failures, the effects of fires and floods were quantified based on an estimate of the probability of mitigative action, and estimates of the potential contribution of these events to core melt frequency were derived, i The above results were corr.bined to calculate the total expected core damage frequency caused by oecay heat removal failure for the six plants studied. NUREG-1289 and NUREG-1292 (previously referenced) discuss the results in ' detail. This frequency was found to be quite plant-specific in nature (i.e. there was considerable variation in the results among the 31x plants studied}. i The frequency range for the six plants was 7E-05 to 4E-04 per reactor year with f an average value of 2E-04 if credit is 611 owed for feed and bleed operation on the PWRs and containment venting on the BWRs. If one arbitrarily makes the j unrealistic (but limiting) assumption that no such credit should be allowed, then the range becomes instead 1E-04 to IE-03 (average 4E-04). Neither the
' above ranges nor the averages were found to be significantly changed when several other existing, reliable PRA results were also includad. ) On the other hand, the results of one recent industry-sponsored analysis (for the Point Beach plant, one of the six plants the staff analysed) were cucide
- of those ranges. The core darnage frequency predicted by this study fer failure of the decay heat removal function was 1E-05 per reactor year, a factor of !
seven (7) below the bottom of the lowest range quoted above, and a factor of ( thirty (30) lower than the 3E-04 per reactor year that the staff obtaini;d for ' Point Beach. Reascns for the difference include different assumptions regarding the frequency of certain initiating events and the probability of the operator's taking appropriate mitigative actions (such as initiating the feed j arid bleed cooling option). The differences are cetatled in Appendix 0 of i NUREG-1289. It is likely that the "true" best estimate fyr' Point Btach lies t aoove 1E-05, within the ranges quoted abvve, but below 3E-04. ( Utilizing any of the above results, the six plants meet the health effects i ' quantitative objectives in the Conoission's Safety Goal (e.g., 0.1% of the expected accident or cancer risk from non-nuclear plant related risk). L i Guidance for an acceptable core damage frequency has not been explicitly provided. However, in order to provide assurance that: (1) core damage due to a decay heat removal failure related event will not occur in the lifetime of ; the present population of plants; (2) consistency is maintained with the 1E-05 i from station blackout ' per reactor expected afteryear contribution resolution of the station to core damage blackout USI frequency (A-44, NUREG-110 ! (3) the frequency of a severe release will be less than the Comission's safety l j goal guidance of 1E-06 per reactor year, the staff selected a goal that core damage due to failure of decay heat removal events should be less than 1E-05 i per reactor year. This staff-selected goal is intended only for current [ l 4 opplication to the resolution of generic issue USI A-45. E f I I t
FEDERAL REGISTER NOTICE The results quoted above indicate that the decay heat removal related frequency of core damage ut certain plants may be considerably above this goal. To address the question of whether corrective actions could be cost effective, six possible alternatives addressing potential decay heat removal vulnerabilities were identified ano then evaluated. The approximate costs and value/ impact ratios of the alternatives were estimated, and are given in huREG-1289. Alternative 1 is to take no action for the resolution of USI A-45, i.e., the status quo described above would be maintained. This alternative was not selected because it appears likely that certain plants have a core damage frequency above the staff selected goal. Alternative 2 is to have each licensee perform <a risk assessment for its plants. This assessment would be done in conjunction with the Individual Plant Examination program. Available options for acceptable risk assessments include perforating a Level-1 PRA (enhanced) or performing an analysis using the IDCOR IPEM. This is the chosen alternative (as discussed throughout the remainder of this Notice), since the plant risks, and the effects of individual i corrective actior.s, are highly plant specific. Alternative 3 is to perform procedure modifications for each a certain plant those sp(ecified describled group forofAlternative equipment3 inand NUREG-1289 and NUREG=1292). These modifications generally correspond to several of the current generic unresolved safety issues. This alternative would require the saice group of corrective actions for each plant, and is not recucmended since many of the vulnerabilities are not the same for each plant. Alternative 4 is to take whatever actions are necessary at each indivioual plant to provide and/or enhance the "feed and bleed" heat removal method for PWRs, and the "containment venting" method for BWRs. This alternative is not recounended because the staff lacks Jufficient confidence that operators would initiate these cooling methods during an actual event when they might be needed. Alternatives 5 and 6 are to install new, separate and dedicated decay heat removal systems capable of cooling the plants to a hot (Alternative 5) or cold (Alternative 6)shutdowncondition. These alternatives show considerable potential safety benefit, particularly when the advantages to other safety issues, such 6s the possibility of insider sabotage, are considered. They may , have a favorable value/ impact ratio only if conventional value-impact methods are modified, for example, to take into account the value of avoidin moratorium following a severe accident ("method #3" described belcw)g . a nuclear However, : these alternatives cannct be recomended at present due to their high cost (on ' the order of $100,000,000 per plant) and unfavorable value/ impact ratios. Value/ impact ratios must be taken into account in cases such as this where the alternatives m.av be considered as providing additional protection over that necessary for adequate protection. I It was found that the value (safety benefit) and the impact (cost) of Alternatives 2 through 6 varied significantly from plant to plant. To facilitate making a single recommendation that would be applicable to all i plants, a set of "generic" results were derived to represent the overall , 1 "family" of opera +1ng U. S. plants. In addition, the value/ impact analyses : were performed using three separate methods: , i n
FEDERAL REGISTER HOTICE 1. ! The value term was limited to the reduction in dose to the population ' within 50 miles. The impact term was defined as the total cost of implementation with no reduction for the anticipated economic advantages in the form of averted costs to the licensee.
- 2. The value term was defined as in method #1; however, the net impact used was reduced by the ariticipated averted onsite costs.
3.- The value term was cased on the reduction in population dose 45 in method #1, but was supplemented by the monetary value of other averted cost savings that would affect the aublic interest, such as consideration of a nuclear moratorium, insider sa)otage, other outstanding generic issues, environmental qualification, unquantifiable internal initiating events, and residual risk from special emergency events (assuming $1,000 j per averted person-rem). The impact term was defined as in method #2. Using the more conventional approach of method #1, the value/ impact ratios for certain alternatives for the "generic" (i.e., the "average") plant did achieve ' a value/ impact ratio of about $1,000 per person-rem averted. Specifically, alternatives 3 and 4 achieved this ratio for the BWR, and were close to this ratio for the PWR. Alternative 2 was close to achieving this ratio for the BWR. However, none of those alternatives (i.e., alternatives 2, 3, or 4) achieved a core damage frequency near or below the staff's goal of IE-05 per reactor year DHR related core damage frequency. Therefore, the results show that, using method #1, none of the alternatives will simultaneously achieve a value/ impact ratio of $1000 per person rem and alsc reach the staff's selected core damage frequency goal. Using method #2, value-impact ratios near $1000 per person rem are achieved for most alternatives, except for alternatives 5 and 6 (which are the only two alternatives that reach the staff-selected core damage frequency goal). The results of method #3 show the core damage frequency goal can be achieved by alternatives 5 or 6 at a value/ impact ratio near $1000 oer person rem. Howavar, use of method #3 goes beyond value/ impact analysis methods previously used for Unresolved Safety Issues. The high cost of Alternatives 5 or 6 cannot br justified on the basis of conventional value/ impact methods (i.e., methods
#1 or #2).
Based upon the results given in the Regulatory Analysis and the Summary Report, the Nuclear Regulatory Commission Staff has reached the following conclusions:
- 1) The core damage frequency caused by decay heat removal failure for the six plants studied spanned a broad range with the average value either 2E-04 or 4E-04 per reactor year, depending on whether or not credit is allowed for certain backup core cooling methods. This result includes consioeration of all known significant decay heat removal failure related sequences, including those related to station blackout.
FEDERAL REGISTER NOTICE , Although a safety goal in terms of core damage frequency has not been l formalized, the Comrrission's safety goal policy states that large releases should remain below 1E-06 per reactor year. Assuming one large release per hundred core damage events, the resulting core damage frequency goal including all causes of core damage is 1E-04 core damage events per reactor year. Realistic application of this goal can be achieved by requiring that the contribution from any identified broad class of events be less than ten parcent of 1E-04 (i.e., less that IE-05). This was done for USI A-44, "Station Blackout," where a core damage frequency goal of IE-05 for events involving station blackout was implied (NUREG-1109, Janua ry, 1986) . Decay heat removal failure related everits constitute another broad class of core damage events, and so a goal of IE-05 was adopted by the staff as also being appropriate for thr.t class of events. It is likely that the decay heat removal related core damage frequency (which averaged 2E-04 to 4E-04 for the six case studies) may be considerably above this goal at certain plants, which results in the conclusions and recommendations made below. [ Note that application of one 1E-05 goal for the blackout events and a separate 1E-05 goal for the decay heat removal failure events will result in a combined risk from both types of events above 1E-05 but less than 2E-05sincethereissomeoverlap(i.e.).someofthedecayheatremoval failures are caused by station blackout This small amount of "double counting" contributes to the margin that will be available for later inclusion of other quantitatively determined core damage frequencies (such as ATWS) without exceeding the overall 1E-04 core damage frequency goal.]
- 2) The value/ impact ratio of the studied alternatives varied significantly from plant to plant. Even using only offsite benefits in the value/ impact methodology, some corrective actions 00 achieve a value/ impact ratio that would justify their implementation for certain plants, although none of the six alternatives analysed will sin;ultaneously achieve such a value/ impact ratio and also reach the staff's core damage frequency goal (i.e., no cost offective corrective actions were identified which would make all plants reach an acceptable core damage frequency).
- 3) Since all of the significant USI A-45 results have been found to be highly plant specific, it is not appropriate to propose a single generic action to be applied uniformly to all plants.
- 4) For any specific plant, to determine the core damage frequency caused by decay heat removal failure and the value and impact of proposed corrective design changes, detailed analyses of that specific plant are necessary.
The Coranission is currently planning to implement the Severe Accident Policy (50 FR 32138) and will issued a generic letter to require all plants currently operating or under construction to undergo a systematic examination termed the Individual Plant Examination (IPE) to identify any plant-specific
FEDERAL REGISTER NOTICE vulnerabilities to severe accidents. The IPE analysis, which is similar to those needed for item 4 above, is intended to examine and understand the plant emergency procedures, aesign, operutions, maintenance, and surveillance to identify vulnerabilities. removal systems and those systems used for other functions.The analysis w The Commission Staff therefore believes that the most appropriate mechanism for requiring the plant specific analyses needed to resolve USI A-45 is through the IPE program. The Commission Staff therefore has genericall by subsuming it into an integral part of the IPE program. y resolved USI A-45 Plant specific implementation (including the effects of any corrective actions proposed by the licensee IPE planned and/or required by the Commissiot.), is also subsumed within the activities. < Dated at Rockville, Maryland, this day of ,1986. For the Nuclear Regulatory Cormiission Staff ( ) Executive Director for Operations
Enclosure D. Draft Congressional Letter The Honorable . . . , Chairman (Sub)Committeeon... (Committee on . . . ) United States (House of Represeritatives or Senate) Washington, DC 20515
Dear Mr. Chairman:
Enclosed for the information of the (Sub)Conmittee on . . .is a copy of a Federal Register Notice stating the resolution that has been adupted for Unresolved Safety Issue (US!) A-45, "Decay heat Rernoval Requirements." The issue has been studied extensively since its designation by the Commission ds dn Unresolved Safety Issue in March,1981. Bdsed upon the results of those studies, the Nuclear Regulatory Commission Staff has reached the following conclusions:
- 1) The expected frequency of core aamage related to failure of the decay heat renoval function varies significantly from plant to plant, and at certoiri plants may exceed the staf f's goal of IE-05 per reactor year.
- 2) The value/inipact ratio for the various corrective actions that could reduce the core damage frequency diso varies significantly from plant to plant. Although some corrective actions achieve a value/impdct ratio that would justify their iraplementation for certain plants, none of the corrective actions that wa identified and ariulysed will simultaneously dChieve suCh a value/ impact ratio and also redCh the staff's Core damdge frequency goal (i.e., no cost effective corrective actions were idencified which would make al,1 plants reach the staff's core damage frequency goal).
- 3) Since all of the significant USI A-45 results have been found to be highly plant specific, it is not appropriate to propose a single generic dction to be applied uniformly to all plants.
- 4) for any specific plant, to determine the core damage frequency caused by decay heat rernoval failure and the value and irrpact of proposed corrective actions, detailed analyses of that specific plant are necessary.
The Commission Staff determined that the appropriate mechanism for requiring the plant specific analyses needed to resolve US! A-45 is through the Individual Plant Evaluation (IPE) program. That (IPE) program will require each plant to be individually evaluated for its vulnerabilities to severe dCCidents, inCludi99 but not limited to those reldted to loss of the Decay heat Removal function. The Cormission Staff therefore has generically resolved USl t
A-45 by subsuming it into an integral part of the IPE program. Plant specific implementation (including the effects of an licensee a.1d/or required by the Conmiission)y , iscorrective actionswithin also subsumed proposed the by the planned IPE activities. Sincerely, Eric S. Beckjord, Director Office of Nuclear Regularory Research
/
Enclosure:
Federal Register Notice cc: (other chairmen) I
NUREG-1289 (DRAFT) .~* REGULATORY AND BACKFIT ANALYSIS: UNRESOLVED SAFETY ISSUE A-45, SHUTDOWN DECAY HEAT REMOVAL REQUIREMENTS DRAFT APRIL 1988 . e
ABSTRACT i . All light water reactors require decay heat to be removed subsequent to reactor shutdown. Interruption of the decay heat removal function could lead to severe consequences. Concerns about the reliability of the systems and components that assist in the decay heat removal process and the potentially r,evere conse-quences of a complete loss of decay heat removal resulted in establishing the requirements for decay heat removal as an unresolved safety issue (USI) desig-nated USI A-45, "Shutdown Decay Heat Removal Requirements." This report presents the regulatory analysis for USI A-45. It includes (1) a
~*
summary of the issue, (2) the proposed technical resolution, (3) alternative resolutions considered by the Nuclear Regulatory Commission, (4) an assessment of the benefits an'd costs of all alternatives considered, and (5) the decision rationale. , C ll PW W' 04/26/88 2 NU1289 COV/TC DRAFT 4/88
TABLE OF CONTENTS . A8STRACT LIST OF TA8LES ........................................................ # LIST OF FIGURES ....................................................... sr
+++t/4*'? f7 '
EXECUTIVE
SUMMARY
..................................................... Ja o66++
1 STATEMENT OF THE PROBLEM ......................................... 1-1 , 1.1 Background .................................................. 1-1
- 1. 2 Problem Definition ..........................................' 1-4 References ....................................................... 1-5 2 OBJECTIVES, PROGRAM APPROACH, AND FINDINGS ....................... 2-1
. 2.1 Objectives .................................................. 2-1 2.2 Program Approach ............................................ .
2-2 2.3 S umma ry o f Techn i cal F i nd i ng s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6 References ....................................................... 2-13 3 ALTERNATIVE RESOLUTIONS .......................................... 3-1 3.1 Alternative 1 - No Action ................................... 3-1 3.2 Alternative 2 - Limited-Scope PRA As a Basis for Modifications ............................................... 3-1 3.3 Alternative 3 - Application of Specified System Modifications to All Plants ................................. 3-2 3.4 Alternative 4 - Depressurization and Cooling Capability ..... 3-2 3.5 Alternative 5 - Dedicated Hot-Shutdown Capability ........... 3-3 3.6 Alternative 6 - Dedicated Cold-Shutdown Capability .......... 3-4 4 VALUE-IMPACT ASSESSMENT .......................................... 4-1 4.1 Summary of Value-Impact Analysis Methodology and Treatment of Uncertainties ............................................ 4-1 4.1.1 Objectives of the Value-Impact Analysis .............. 4-1 4.1.2 The Approach to Value-Impact Analysis in USI A-45 .... 4-2 References ....................................................... 4-10 4.2 Plant-Specific Value-Impact Analysis for Each Alternative ... 4-11 4.2.1 Alternative 1 - No Action ............................ 4-11 4.2.2 Alternative 2 - Limited-Scope PRA as a Basis for Modifications ........................................ 4-18 4.2.2.1 Definition of a Limited-Scope PRA ........... 4-18 4.2.2.2 Rationale for Conducting the PRA ............ 4-19 4.2.2.3 Objectives of the Assessment ................ 4-20 i-Mre 04/26/88 NU1289 COV/TC ORAFT 4/88
TABLE OF CONTENTS (Continued) . Page 4.2.2.4 Incorporation of PRAs into the .............. 4-20 Individual Plant Evaluation Program 4.2.2.5 Value-Impact Considerations for Limited-Scope PRA ................................... 4-21 4.2.3 Alternative 3 - Application of Specified System Modifications to All Plants .......................... '-27 4.2.3.1 Rationale for Modifications ................. 4-28 4.2.3.2 Modifications To Be Installed ............... 4-29 4.2.3.3 Value-Impact Considerations for System Modifications ............................... 4-32 . 4.2.4 Alternative 4 - Depressurization and Cooling Capability ............ .............................. 4-33 4.2.4.1 Bleed and Feed Capability for PWRs .......... 4-33 4.2.4.2 Secondary-Side Blowdown Capability for PWRs . 4-41 4.2.4.3 Containment Vienting for BWRs ................ 4-48 4.2.5 Alternative 5 - Dedicated Hot-Shutdowr Capability .... 4-60 4.2.5.1 Introduction ................................ 4-60 ( 4.2.5.2 System Oescriptions ......................... 4.2.5.3 Value-Impact Analysis ....................... 4-61 4-70 4.2.5.4 Other Design Considerations and Variations .. 4-71 4.2.6 Alternative 6 - Dedicated Cold-Shutdown Capability ... 4-74 4.2.6.1 Control of Existing RHR from ADHR Building .. 4-74 4.2.6.2 Dedicated RHR Train Option .................. 4-75 4.2.6.3 High-Pressure RHR System for PWRs ........... 4-76 . 4.2.6.4 Dedicated Residual Heat Removal Capability for BWRs .................................... 4-78 4.2.6.5 Impacts of Adding Cold-Shutdown RHR Capability to PWRs and BWRs Plus Other Options ......... 4-78 4.2.6.6 Values of Adding Cold-Shutdown Capability ... 4 t2 References ....................................................... 4-91 4.3 Generic Value-Impact Analysis ............................... 4-95 4.3.1 Methodology for the Generic Treatment of Value-Impact Analysis ............................................. 4-95 4.3.1.1 Generic Treatment Based on Averted Offsite Costs ............................... 4-96 4.3.1.2 Generic Treatment Based on Averted Offsite and Onsite Costs .................... 4-105 4/26/88 i'i NUREG 1289 COV/TC ORAFT 4/88
TABLE OF CONTENTS (Continued) i
.P_as[3 4.3.2 Estimates of the Generic Value Terms ................. 4-114 4.3.2.1 General Discussion .......................... 4-114 4.3.2.2 Alternative 1 - No Action ................... 4-115 .
4.3.2.3 Alternative 2 - Limited-Scope PRA as a Basis for Modifications ..................... 4-115 4.3.2.4 Alternative 3 - Application of Specified System Modifications to All Plants .......... 4-116 4.3.2.5 Alternative 4 - Depressurization and Cooling Capability .....................,.... 4-117 4.3.2.6 Alternative 5 - Dedicated Hot-Shutdown Capability .................................. 4-119 4.3.2.7 Alternative 6 - Dedicated Cold-Shutdown Capability .................................. 4-121 4.3.3 Impact Estimates ..................................... 4-121 4.3.4 Value-Impact Indices ................................. 4-122 4.3.4.1 Basis of the Value-Impact Indices and Treatment of Uncertainties .................. 4-122 4.3.4.2 Interpretation of the Generic Value-Impact Indices for the Various Alternatives ........ 4-123 (' 4.3.5 An Overview of the Results of tha Generic Value-Impact Analysis .... ....................................... 4-123 References ...................................................... 4-125 4.4 Other Cutstanding Generic Issues............................. 4-127 4.4.1 0verview.............................................. 4-127 4.4.2 Safely Issue Summary.................................. 4-128 References ....................................................... 4-130 4.5 Effect on Valur Opact Analysis of Including Sabotage........ 4-130 4.5.1 Semiquantitative Benefits............................. 4-131 4.5.2 Conditional Value-Impact Analysis..................... 4-131 References ........................:.............................. 4-132 4.6 Effects of Unquantifiable Contributions, Source Term Variations, and Nuclear Moratoria............................. 4-133 4.6.1 Importance of Unquantifiable Contributions............. 4-133 4.6.1.1 Internal Initiating Events.................... 4-134
- 4. 6.1. 2 Special-Emergency Events...................... 4-134
- 4. 6.1. 3 Environmental Qualification................... 4-135 4.6.2 Effects of Source Term Variations...................... 4-135 4.6.3 Nuclear Power Plant Moratoria.......................... 4-136 4/26/88 til NUREG 1289 COV/TC ORAFT 4/88
, */
TABLE OF CONTENTS (Continued) Pa21 References ............................................................. 4-137 5
SUMMARY
OF ALTERNATIVES AND FACTORS FOR DECISION MAKING ......... 5-1 5.1 S umma ry o f A l t e rn a t i v e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1 5.1.1 Alternative 1 - No Action ........................... 5-1 5.1.2 Alternative 2 - Limited-Scope PRA As a Basis for Modifications ....................................... 5-2 5.1.3 Alternative 3 - Application of Specified System ' Modifications to All Plants ......................... 5-3 5.1.4 Alternative 4 - Depressurization and Cooling Capability .......................................... 5-3
. 5.1.5 Alternative 5 - Dedicated Hot-Shutdown Capability ... 5-5 5.1. 6 Alternative 6 - Dedicated Cold-Shutdown Capability .. 5-6 5.2 Factors for Decision Making ................................ 5-7
- 5. 2.1 Summary of Approaches to Value-Impact Analyses. . . . . . . 5-7 5.2.2 Industry-Sponsored Study of Point Beach ....... ..... 5-8 References ............................................................ 5*9
. (, Appendix @
A Go,1eric Issues Potentially Related to USI A-45 Corrective Actions..................................................... A-1 8 Further Discussion of Sabotage Issues....................... B-1 C Costs Due to Nuclear Moratoria.............................. C-1 ; j 0 Insights Gained From Industry-Sponsored Study of Point , Beach....................................................... 0-1 j i i I i i I 4/26/88 iv NUREG 1289 COV/TC DRAFT 4/88 !
1~ TA8LE OF CONTENTS (Continued) Pajgg Table 2.3.1 Summary of data relevant to frequency of core melt due to DHR failures available from "reliable PRAs" ........ 2-9 2.3.2 Summary of results of "reliable PPAs" for p(cm)DHR .... 2-10 4.1.1 Interpretatioa of probabilities of cost effectiveness . 4-6 4.1.2 . Interpretation table for estimated specific not benefit, average U.S. site, of fsite costs only. . . . . . . . . . . . . . . . . . 4-6 4.1.3 Interpretation table for estimated specific net benefit, average U.S. site, offsite plus onsite costs ................................................. 4-7 4.1.4 Interpretation table for estimated specific net benefit, high- and low population U.S. sites, offsite costs
'o only .................................................. 4-8 4.1.5 Interpretation table for estimated specific net benefit, high- and low population U.S. sites, offsite costs and onsite costs .......................................... 4-9 4.2.1 Probability of severe accident ........................ 4-13 4.2.2.1(A) Alternative 2, modifications based on limited-scope PRA, results of value-impact analyses for specific plants ................................................. 4-22 4.2.2.1(B) Alternative 2, modifications based on limited-scope PRA, results of value-impact analyses for specific plants in terms of "specific net benefit" using monetized radiation dose .............................. 4-23 4.2.'2.2 Contents of example modifications from the case studies ............................................... 4-24 4.2.3.1(A) Alternative 3, Application of Specified System Modifications, results of value-impact analyses for specific plants ....................................... 4-34 4.2.3.1(B) Alternative 3. Application of Specified System Modifications, results of value-impact analyses for specific plants in terms of "specific net benefit" using monetized radiation dose .............................. 4-35 4.2.4.1(A) Alternative 4/1, feed and bleed, results of value-impact analys e s fo r s peci fi c PWR s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-42 4.2.4.1(B) Alternative 4/1, feed and bleed, results of value-impact analyses for specific PWRs in terms of "specific nat benefit" using monetized radiation dose ................ 4-43 4.2.4.2(A) Alternative 4/2, secondary-side blowdown, results of value-impact analyscs, specific PWRs ................... 4-46 4.2.4.2(B) Alternative 4/2, secondary-side blowdown, results of value-impact analyses for specific PWRs in terms of "specific net benefit" using monetized radiation dose .. 4-47 4
4/26/88 v. NUREG 1289 COV/TC ORAFT 4/88
TABLE OF CONTENTS (Continued) Table a ag _P, 4.2.4.3 Typical containment vent paths ......................... 4-49 4.2.4.4(A) Alternative 4/3, containment venting, results of value-impact analyses for specific BWRs ................ 4-53 4.2.4.4(B) Alternative 4/3, containment venting, results of . value-impact analyses for specific BWRs in terms of "specific not benefit" using monetired radiation dose .. 4-54 4.2.4.5 Summary of values ...................................... 4-59 4.2.5.1(A) Alternative 5, Dedicated Hot-Shutdown Capability, results of value-impact analyses for specific plants ... 4-72 4.2.5.1(B) Alternative 5, Dedicated Hot-Shutdown Capability, results of value-impact analyses for specific plants in terms of "specific net benefit" using monetized radiation dose ......................................... 4-73
..* 4.2.6.1 Impacts of adding RHR capability to PWRs - direct cost comparison ............................................. 4-80 i 4.2.6.2 PWR add-on decay heat removal system option comparison ............................................. 4-83 4.2.6.3 BWR add-on decay heat removal system option comparison ............................................. 4-86 4.3.1 Derivation of generic factors for estimating popuistion dose ........................................ 4-98 4.3.2 Derivation of generic parameters for value-impact analysis ............................................... 4-99
' (' 4.3.3 Generic value terms for Alternative 3, Application of Specified System Modifications (average values for modifications or groups of modifications with gross impact $$108) .......................................... 4-101 4.3.4 Generic value terms for Alternative 4, Additional Depressurization and Cooling Capability ................ 4-102 4.3.5 Generic value terms for Alternative 5, Dedicated Hot-Shutdown Capability .................................... 4-103 4.3.6 Generic value terms for Alternative 6. Dedicated Cold-Shutdown Capability .................................... 4-104 4.3.7(A) Results of generic value-impact analysis for Alternative 3, Specified System Modifications (average values for modifications or groups of modifications with gross impact 55108)................................ 4-106 4.3.7(B) Results of generic value-impact analysis for Alternative 3. Specified System Modifications, in terms of "specific net benefit" (SNB) using monetized radiation dose (average values for modifications or groups of modifications with gross impact $$108) ................... 4-107 4.3.8(A) Results of generic value-impact analyses for Alternative 4, Additional Depressurization and Cooling Capability ..................................... 4-108 4/26/88 vi NUREG 1289 COV/TC DRAFT 4/88
TABLE OF CONTENTS (Continued) Table Pad 4.3.8(B) Results of generic value-impact analyses for Alternative 4, Additional Depressurization and Cooling Capability, in terms of "specific net benefit" (SNB) using monetized radiation dose .................... .... 4-109 4.3.9(A) Results of generic value-impact analysis for Alternative 5, Dedicated Hot-Shutdown Capability ....... 4-110 4.3.9(B) Results of generic value-impact analysis for Alternative 5, Dedicated Hot-Shutdown Capability, in terms of "specific net benefit" (SNB) using monetized radiation dose ......................................... 4-111 4.3.10(A) Results of generic value-impact analysis for Alternative 6, Dedicated Cold-Shutdown Capability ...... 4-112 4.3.10(B) Results of generic value-impact analysis for Alternative 6, Dedicated Cold-Shutdown Capability, in terms of "specific net benefit" (SNB) using monetized radiation dose ............................... 4-113 4.4.1 Total cost to implement unresolved and generic safety issues ................................................. 4-134 A.1.1 Comparison of reduction in core melt frequency for USI A-44 and USI A-45 ...................................... A-3 B.1 Comparison of probability o' core melt given sabotage has occurred (internal events only) ........................ 8-3 B.2 Probability of core melt given the combined sabotage event, diesel gererator disabled and loss of oi-fsite .......... B-3 B.3 Limited value-impact assessment for effects of add-on decay heat removal system given the combined sabotage event, diesel generators disabled and loss of offsite p.ower induced, as a function of the probability of the event and including random initiating events ........... B-5 B.4 Value-impact analysis for effects of add-on decay heat removal system in terms of specific net benefit (SNB) .. B-6 C.1 Summary of 1985 present worths of potential losses arising from different types of nuclear moratoria at specific times (all loses in 1985 U.S. Oo11ars, 5% p.a. discount rate, 2.5% p.a. fuel costs) ................... C-2 C.2 Summary of 1985 present worths of expectations of loss due to various types of nuclear moratoria (all values in 1985 dollars, 5% discount rate, 2.5% escalation rate in fuel costs) ............................................ C-3 C.3 Sensitivity of present worth of expectation of loss associated with replacement power costs to raie of esca-lation in fuel prices (nuclear and coal) due to two types of nuclear moratoria (5% discount rate) ................ C-4 C.4 Effects of including moratoria costs on the specific net benefit and cost effectiveness of Alternative 6 for the case study plants ...................................... C-6 0.1 Comparison of Point Beach studies ...................... 0-3 0.2 Dominant sequence definitions .......................... D-10 4/26/88 vii NUREG 1289 COV/TC DRAFT 4/88
TABLE OF CONTENTS (Continued) i . Fiaure Page 2.1 Shutdown decay heat removal analysis .................. 2-5 4.2.5.1 Flow diagram for PWR add-on system (auxiliary feedwater train + HPI) ................................* 4-63 4.2.5.2 BWR add-on decay heat removal system (with high-
. pressure injection capability) ........................ 4-66 4.2.5.3(A) Priwary blowdown system ............................... 4-68 4.2.5.3(B) Primary blowdown system ............................... 4-69 4.2.6.1 PWR add-on residual heat removal system (long-term) ... 4-77 4.2.6.2 High pressure RHR system .............................. 4-79 4.2.6.3 BWR add-on residual heat removal train (long-term) .... 4-81 4.2.6.4 BWR redundant active component ADHR system with high-pressure injection .................................... 4-85 I
J' t i i l e 1 4/26/88 v111 NUREG 1289 COV/TC ORAFT 4/88 l
EXECUTIVE
SUMMARY
The primary objectives of the USI A-45 program were to evaluate the adequacy of , decay heat removal (OHR) systems in existing light water reactor (LWR) power plants, determine the benefit of providing alternative means of decay heat removal that could substantially increase the capability of a plant to handle a broad spectrum of transients and accidents, and assess the benefit and cost of alternative measures for improving the overall reliability of the DHR function. The USI A-45 ' program included probabilistic risk assessments and deterministic evaluations of DHR systems and support systems required to achieve hot-shutdown
~
and cold-shutdown conditions in both pressurized and boiling water reactors. Integrated system analysis techniques were used to assess the vulnerability of DHR systems to various internal and external events, including transients, small-break loss-of-coolant accidents, and specisi emergency challenges such as fires, floods, earthquakes, and sabotage. Cost-benefit analysis techniques
- were used to assess the net benefit in terms of public health and economic effects of alternative measures to improve the overall reliability of the OHR function.
'l Cost-benefit analyses, probabilistic risk assessments (PRAs), and deterministic evaluations based on engineering judgment are all used in the decision-making process. In considering the role of initiating events that are difficult to quantify in a probabilistic sense such as fires, floods, earthquakes, and sabotage, deterministic evaluations are important. Comparison with ouantitative
- o measures and indicators of benefits and costs are also made and displayed as f aids to the decision-making process.
A common characteristic of the USI A-45 analyses, plus evaluations performed to date for other plants, has been the identification of support system failures as significant contributors to the probability of core melt. At the support system level, there is often insufficient redundancy, considerable sharing of 4 systems, inadequate separation and independence between trains, and poor ovor-all general arrangement of equipment from a safety viewpoint. From an integrated ( safety standpoint, this aspect of the layout of plant equipment is an important 4/26/88 h NUREG 1289 COV/TC ORAFT 4/88
i l 1 concern identified in the USI A-45 program. Many plants have redundant trains of safeguards equipment sitting side by side in a common area. Adequate - physical separation and protection of redundant safeguard trains is often lacking. This exists for both front line and support systems. This type of general arrangement of equipment creates vulnerabilities in that single events such as a fire, a flood, or insider sabotage can disable multiple trains of safeguards equipment resulting in an inability to cool the plant. Another weakness in the systems used to accomplish the DHR function is the lack of independence. There is considerable sharing and interconnection between -
' redundant safeguards trains. This lack of independence creates single point vulnerabilities, some of which have been analyzed.
Extensive use has been made of PRA methods, and this report provides a descrip-tion of the quantitative analyses that have led the NRC staff to recommend that plant-specific analyses be conducted for LWRs to determine the degree to khich improvements to the DHR function are needed at each specific plant. This is, recommended because the staff recognizes that there is considerable plant-to-plant variation in the DHR capability; consequently, a solution appropriate tr. ( many plants is not necessarily the best solution in all cases. Therefore, the most appropriate solutions for each plant will have to be developed by the plant-specific analyses. The recommendation stems primarily from the implications of the NRC's Policy Statement on Safety Goals of August 1986, in particular, the statement: "... the Commission intends to continue to pursue a regulatory program that has as I its objective providing reasonable assurance, giving appropriate consideration I to the uncertainties involved, that a severe core damage accident will not occur at a U.S. nuclear power plant." The scope of the six PRAs carried out as part of USI A-45 was limited to the DHR function but included all supporting ! systems for that function and the effects of a complete range of initiating events external to the systems. Other PRAs of comparable quality in the treat-ment of the DHR function carried out as part of other programs were also l considered. tgtheA-45PRAsandtheotherPRAsshowthat,intheexisting population of 4 plants, the chance of Lt least one accident leading to m ky core damage in the next 10 yearsmo4 % 1 in ng,gtpenext30 years (the average lifetime of the existing plants), i b " W t 1 in 2. These X 4/26/88 lxle NUREG 1289 COV/TC DRAFT 4/88
& ptl6 wa *)bu-e A-k
- L~+ %-
L
- "" ^^^'
y o tak n the unquantified contributions to the frequency org e^^u idading to sceaece core damagey . One way to reduce these probabilities is to perform the recommended plant-specific analyses to identify what type of improvements are needed at each plant (if any). y = : -M 7 (y
& "i = .
If the mean[s" # *; Of ; ci A ,M leading to semene core damage were reduced , to 3x10 5 per year, the chance of such an accident in the next 10 years would be reduced to about 1 in 30 and, in the next 30 years, this chance would be abo g i,n g g fore p tog vg eg eth"re g le assurance" referred to ve, tneY " ? " y or accidents'ieading to h core damage due to failure g- j$'hY *" ' " 0)* kN*) k?'h Y NN $ & 54$$h*k~j?.tL a ' ej-uantifiatiTe contriouti'on cibuld not be greater snaW~~ < e g. j . r [ ,
, j M- 8 f., a pr r g ab g ontributio g ruu . . - - . - - . - . - ~ . . - . . . .m k 0 M med< p: Cwww_Mm t Aw w. 2.Do
( The six case-study PRAs and the others of comparable quality referred to above showed a wide plant-to plant variation in the probability of core melt due to failure of the OHR function, as can be seen from Table 2.3.1. In view of this wide variation, it seems unlikely that a solution appropriate to the majority of plants would necessarily be applicable to all plants for resolving USI A-45. At one end of the spectrum, there may be plants in which the probability of W core damage, denoted here by p(cm), may already be low enough to be fully acceptable or could be made so by minor modifications of an acceptable nature. At the other end of the spectrum, there may be plants in which p(cm) is too high to be accepttble 3 for more than a few years. For these plants, an accelerated schedule to secure some early improvements should be considered on completion of the recommended analyses and determination of the needed changes. QAv-'~b S $c W A f&) The six Wrt a ,c;r PRA{carriedoutinUSIA-45providedabasisfordetailed y value-impact analyses for each of the alternatives for each plant. These plant-specific analyses together with the results from other PRAs of similar quality were then used as a basis for separate generic analyses for PWRs and for BWRs.
" V*
4/26/85 NUREG 1289 COV/TC DRAFT 4/88
Th. AII.":~ ny J4.-~~k m a>.6.4: c - AIk~ h 1. l fa ;w um x:
& J d .
; his.h- z., S pa>p-)M P2; y Lt - sp-h n,A ~J p
& S. e.. A'J
-S n. t.F.
g 'h%da3 ffo;;&, laLfJ ~ h s -kAJn
!. i. 1. J
~
f Lf) p-l Qn y, E L .f4 -<~D Ll4 y1. lik ~
. Pu Rr J sil- Ab - B wR, I
A \ k 4 ' ' '. - -k.ai ~ ~ MAAJL-( , < Jn s72 L k ~ C /J J-4 ( t y J L.- C. At+. s) J e,u z,LJd.. 4
/ ( AI4 wlku%
l I i l
e s . X AW The value-impact analyses were carr cci out4 and t.he results Mre displayed , using three separate methods to assist the decision maker. Method 1. The value term was limited to the reduction in population dose to 50 miles as estimated by M urrent version of the CRAC-2 codt. The , [ impact term was' defined as the total cost of imolementation with no reduction for the anticipa.ed economic advantages in the form of averted costs. The criterion for cost effectivene ssumed to be a maximum expenditure of $1000 per person-rem averted, Method 2. The value term and the cost-effectiveness criterion were defined as in Item 1; however, the impact term was reduced by the averted onsite costs to the licensee. . Method 3. The value term was based on the reduction in population dose as in Item 1 but was monetized at $1000 per person-rem an'd supplemented by the monetary value of other averted cost savings that would affect the public interest, such as consideration of a nuclear moratorium, insider sabotage, other outstanding generic issues, unquantifiable internal initiating events, and residual risk fre.t special emergency events. L'lefk N 1, When judged in terms of lA fi .<. =c6 or con urainu aurinea w a:, few of tha numerous variations of tha alternatives that are based on modifications to the existing systems (i.e., Alternatives 2, 3, and 4) are shown to be cost effective. M ened 2, Judged in terms of-tt. % t f '
- tr ' ' 2 :d :t:c:, many variations of Alternatives 2, 3, and 4 are shown to be cost effective. In several cases,
/\
\
the averted onsite costs are greater than the total engineering costs; that is, there is economic incentive for the licensees to make the modifications irrespective of the safety aspect. The two alternatives (5 and 6) that embody an additional independent and dedi-cated DHR system are e ly solut.isns that are not st effective judged solely 3. on the basis of either e 'th o" ol- J' ' 97~n M .. . ef kda n; A ve. These alterna- / tives may be cost effective using tb.c tH ' Iitho i.e., including the full { ipi NUR;G 1289 COV/TC ORAFT 4/88 4/26/88 mQ
i range of the effects on public interest that would result from a nuclear mora-torium, the reduction in the vulnerability of DHR systems to insider sabotage, the resolution (without additional cost) of other related outstanding Generic Issens, and the averted costs estimated to arise from the unquantified con-tribution to the probability of severe accidents associated with failures of the DHR function. . Taking all of the above into account, the staff believes that a plant-specific analysis is needed (for each plant) to determine the degree to which its OHR-related risk is acceptable and, if necessary, to determine the most cost-effective way to bring that risk within acceptable limits. 4/26/88 xVi t NUREG 1289 COV/TC DRAFT 4/88
1 STATEMENT OF THE PROBLEM 1.1 Backaround .
,Under normal reactor operating conditions, the heat generated in the reactor core of a nuclear power plant is removed as steam that is used to produce electri-city in the turbine generator'and that is eventually condensed by the main cooling water system. When the reactor is shut down, radioactive decay of !
fission products continues to generate heat in the reactor core, Means must be available.to remove the decay heat from the core or the residual heat from the reactor structures to ensure that high temperaturas and pressures that might jeopardize the fuel or the reactor coolant pressure boundary do not develop. Therefore, all light water reactors (LWRs) share two common functional daicay heat removal requirements: (1) to maintain sufficient water inventory in the reactor coolant system to ensure adequate cooling of the fuel and (2) to provide the means for transferring decay heat from the reactor coolant system to an ( ultimate heat sink. Thus[oneofthecrucialfactorsinnuclearreactorsafety is the reliability of the decay heat removal (OHR) function, which depends on the frequency of initiating events demanding decay heat removal and the pro-bability that the required systems will respond to the demand. In the context of the Task Action Plan (TAP) for Unresolved Safety Issue (USI) A-45, the systems related to the decay heat removal function are defined as those components and systems required to maintain primary and secondary coolant inventory control and to transfer heat from the reactor coolant system to an ultimate heat sink following shutdown of the reactor for' normal events or abnormal transients such as loss of main feedwater, loss of offsite power, and small-break loss-of-coolant accidents (SBLOCAs). This program was not concerned with anticipated transients without scram, interfacing system loss-of-coolant accidents,(thoseemergencycorecoolingsystemsthatarerequiredonlyduring \' the reflood phase to maintain coolant inventory and dissipate heat for a short period following either a medium or large LOCA. However, the USI A-45 program 4 has considered $Ws supporting systems such as the component cooling water system, { s 04/25/88 1-1 NUREG 1289 SEC 1 DRAFT 4/88
essent'ial service water system, and emergency onsite AC and DC power systems that are required for various modes of decay heat removal. The reliability of the reacter protection system is not addressed. and successful shutdown of the reactor is assumed. The transition from reactor trip to hot shutdown (excluding she reflooding phase in a large LOCA), the transition from hot shutdown to cold shutdown, and maintaining cold shutdown conditions have been considered as part of this program. However, the latter two phases have not received the same degree of quantitative analysis as the first. In addition, the USI A-45 program was directed toward prevention of accidents that lead to core damage sameene 6 and not to mitigation of such accidents. The issue was also limited to ( K i nuclear power plants currently licensed or under construction and did not con-sider future plants. The principal means for removing decay heat in a pressurized water reactor (PWR) under transient conditions (e.g., loss of main feedwater, loss of offsite power) immediately following reactor shutdown is through the steam generators using the AFW system. In addition to the Reactor Safety Study (Reference 1), later reliability studies (References 2 through 6) and related experience from the accident at Three Mile Island Unit 2 (TMI-2) have reaffirmed that the loss of capabi g t remov heatjvagstjamgengtorsisasubstantialcontri-butor to p obabilitf4 Following ttfe THI-2 accident, a number of K steps were taken to improve the reliability of auxiliary feedwater (AFW) systems ; (Reference 7), i If an extended loss of both main and auxiliary feedwater from a PWR is postu-lated, an alternative method may be used for removing decay heat. The method, krmwn as "feed ano bleed," consists of using the high pressure injection (HPI) system to add water (feed) to the primary system while removing heated fluid through the power-operated relief valve (PORV) or safety valves (bleed). For ! i those plants where the maximum head of the HPI pumps is less than the safety j valve operating pressure, the PORVs s.ay be manually operated t'o reduce the system pressure to the operating range of HPI pumps. This mode of decay heat ! removal is sometimes described as "bleed and feed." Vendor and NRC contractor analyses have indicated that the decay heat can be removed by this method under certain conditions. 04/25/88 1-2 NUREG 1289 SEC 1 DRAFT 4/88
- -- -L.. _ _ _ _ _ _ _ . _ _ _ _ _
t At low primary coolant temperature (less than about 350'F), the long-term decay heat is removed by the residual heat removal (RHR) system to achieve and maintain cold shutdown conditions. The primary concerns in the RHR phase are l (1) to ensure adequate reliability in the electrical and mechanical equipment of the RHR system, particularly during prolonged exposure to a potentially degrading environment that would be encountered after even a small'LOCA (but , I not after an accident where extensive fuel damage N occurs), and (2) i to ensure adequate reliability of the RHR system after encountering severely disturbed conditions such as ea'rthquakes, sabotage, floods, or fires. As 1 indicated above, the USI A-45 program has considered both the short-term phase, , shutdown decay heat removal (SOHR), and the long-term phase, residual heat i
*emoval (RHR), in the analyses. " r: m , Me """ f r e m et = :i h io - l P: ;=c.1; ? u .n.', ::n N !
) The primary method for removing cecay heat in boiling water reactors (BWRs) ; while at high pressure is through the steam lines to the turbine condenser. i The condensate is normally returned to the reactor vessel by the main feedwater l
.. system. In some early BWRs, emergency cooling is provided by an isolation ,
j( condenser. However, for the majority of BWRs, the steam-turbine-driven f reactor core isolation cooling (RCIC) system is pro ided to control priwary l system inventory should an abnormal event occur or C power is not available. l If the condenser is unavailable, energy can be removed through the safety /- i relief valves to the suppression pool. Also, alternative emergency cooling in , y the form of either a high pressure coolant injection (HPCI) system or a high- { pressure core spray (HPCS) system is provided on most BWRs. These systems can 3 ] provide fluid to the reactor vessel from either the condensate storage tank or j l the suppression pool. l f When the primary system it at low pressure, the decay haat is removed by the i L
; RHR system. If the RCIC system and HPCI/HPCS systems are unavailable so that j primary system pressure cannot be reduced, the pressure can be reduced by the '
1 automatic depressurization system (ADS), which opens the safety / relief valves and rejects energy to the suppression pool. At low pressure, long-term cooling [ in the RHR mode is initiated to achieve and maintain cold shutdown conditions, j As is the case with PWRs, the main tecnnical issues in the RHR phase relate to [ l the reliability of the RHR system and continuity of operation of the RHR system ! during potentially adverse environmental conditions. 04/25/88 1-3 NUREG 1289 SEC 1 ObFT 4/68 . I
1.2 Problem Definition Core damage resulted at THI-2 because of a failure to remove decay heat. The accident involved a main feedwater transient coupled with a stuck-open pres-surizer power-operated relief valve and a temporary failure of the auxiliary ; feedwater system with subsequent operator intervention that severely reduced , flow from the safety injection system. The severity of the ensuing events and I the potential generic aspects of the accident led the Commission to initiate action to (1) ensure that other reactor licensees took the necessary action to , substantially reduce the likelihood of a similar event and (2) investigate the potential generic implications of this accident. The accident demonstrated how a relatively common fault could escalate into a ; hazardous situation, accompanied by severe financial losses to the utility (and ! indirectly to the U.S. public) because of diffict.ities arising in the decay heat removal function. Other circumstances of a more unusual nature (e.g., damage to systems by events external to the reactor systems such as floods or earthquakes or by sabotage) that could make removal of the decay heat difficult-t may also be possible. The question arises as to whether current designs are adequate to ensure that LWRs do not pose unacceptable risk due to failure to r remove shutdown decay heat and whether, at a cost commensurate with the increase in safety that could be achieved, improvements could be made in the effectiveness of the decay heat removal function. Although upgrading of decay heat removal I and related systems was required by the Commission following the THI-2 accident. the Commission decided that the staff should investigate alternative means of improving the decay heat removal function to increase the capability of nuclear power plants to cope with a broader spectrum of transients and accidents, I including special emergency events (e.g., fire, flood, earthqu'ake, sabotage). In addition to the THI-2 accident, the Reactor Safety Study (Reference 1) and the IREP (References 2 and 3) and RSSHAP studies (References 4, 5, and 6) have [ shown that the lack of high reliability in decay heat removal systems, particu-larly in response to SBLOCAs and transients is r sponsible for a substantial part of the overall probability of a core- accident. Given this background. [ a program was initiated to evaluate the safety adequacy of the OHR function in light water reactor power plants and to assess the value and impact (benefit-cost) 04/25/88 1-4 NUREG 1289 SEC 1 ORAFT 4/88
of alternative measures to improve the overall reliability of the DHR function. , In March 1981, the Nuclear Regulatory Commission designated this program as ; Unresolved Safety Issue (USI) A-45 "Shutdown Decay Heat Removal Requirements" (Reference 8). The reliability per demand that is needed from the decay heat removal systems depends on the frequency of initiating events that challenge thase systems. The loss of short-term decay heat removal is seen primari'.y as a function of equipment reliability, although the accident at THI-2 demonstrated that human error can thwart well' designed and -maintained equipment. This study has moval. Such everits have consideredgemainprecursorstolossofdecay <* . includedtfeATHI-2 accident discussep m ters above A and 44 the recent loss-o &-all. f feedwatereventattheDavis-Besseplantf hithough mea +-ceevnt events4were not factored into the component data base, such precursors were factored into the USI A-45 program studies to the extent practicable for the short-term decay heat removal phase. The systems of first concern are the AFW and HPI systems in PWRs and the RCIC, HPCI (or HPCS), and ADS systems in BWRs. However, the A-45 studies and other PRAs show that the support systems (component cooling water, essential service water, and electric power systems) are of equal or even greater concern. With respect to the loss of the long-term decay heat i removal function, such precursors have been extensively reported in Reference 9. i As reported in Reference 9, the underlying causes of most actual losses of the i long-term decay heat removal function have been human factor deficiencies in- , volving procedural inadequacies and personnel grror. Although these losses i m \ of DHR have not been treated quantitatively %n y; t-to the same degree as the losses ' 4 occurring during the short-term phase, they have been analyzed deterministically, ! and the alternative resolutions considered reflect their frequency of occurrence. ;
,3ferences(ForSection1) i f 1. "Reactor Safety Study," U.S. Nuclear Regulatory Commission, WASH-1400 l (NUREG-75-014), October 1975.
j 2. "Interim Reliability Evaluation Program: Analysis of the Arkansas Nuclear One - Unit 1 Nuclear Power Plant," NUREG/CR-2787 (SAND 82-0978), Sandia l 3 National Laboratories, June 1982. 04/25/88 1-5 NUREG 1289 SEC 1 DRAFT 4/88
i
- 3. "Interim Reliability Evaluation Prcgram: Analysis of the Calvert Cliffs Unit 1 Nuclear Power Plant," NUREG/CR-3511 (SAN 083-2086), Sandia National Laboratories, March 1984.
- 4. "Reactor Safety Study Methodology Applications Program: Sequoyah #1 PWR Power Plant," NUREG/CR-1659/1 of 4, (SAN 080-1897), Sandia National l Laboratories, February 1981. l
- 5. "Reactor Safety Study Methodology Applications Program: Calvert Cliffs ,
#2 PWR Power Plant," NUREG/CR-1659/3 of 4 (SAN 080-1897), Sandia National Laboratories, May 1982.
- 6. "Reactor Safety Study Methodology Applications Program: Grand Gulf #1 BWR Power Plant," NUREG/CR-1659/4 of 4 (SAN 080-1897), Sandia National Laboratories October 1981. ,
- 7. "Report of the Bulletins and Orders Task Force," U.S. Nuclear Regulatory Commission, NUREG-0645, January 1980.
- 8. "Identification of New Unresolved Safety Issues Relating to Nuclear Power Plants - Special Report to Congress," Generic Issues Branch, U.S. Nuclear Regulatory Commission, NUREG-0705, March 1981.
- 9. "Decay Heat Removal Problems at U.S. Pressurized Water Reactors." AE00 Case Study Report, AE00/C503, July 1985.
04/25/88 1-6 NUREG 1289 SEC 1 DRAFT 4/88
2 OBJECTIVES, PROGRAM APPROACH, AND FINDINGS _ 2.1 Objectives . The purpose of USI A-45 is to evaluate the adequacy of current designs to ensure that LWRs do not pose unacceptable risk as a result of DHR system failures. The primary objectives of the USI A-45 program are to evaluate the safety adequacy of DHR systems in ex{ sting LWR power plants and to assess the value and impact (or benefit-cost) of alternative measures for improving the overall . reliability o' the OHR function. At the time the USI A-45 program commenced, the NRC also started to develop a set of qualitative safety goals and quantitative design objectives (QDO). To aid progress in the USI A-45 program, some interim QD0s were defined with the knowledge that,these might have to be changed later in the program to conform with those finally decided on by the Commission. The principal quantitative design objective sele-ted for USI A-45 is the frequency of s+vece core damage y duetofailureoftheOHRfunction,designatedbyp(cm)[HR. An interim value of 1x10 5 per reactor year is proposed for this QDO. Following issuance of the Commission's Policy Statement on Safety Goals in August 1986, the staff's interpretation of the Commission's policy is now being formulated and will be stated in forthcoming guidance for implementing that policy af ter approval by
/t& e Commission.
h
% N M{ W $ '-HV .~d.l W MbKb& .
The USI A-45 program included probabilistic risk assessments and deterministic evaluations of those OHR systems and support systems required to achieve hot- i shutdown and cold-shutdown conditions in both pressurized and boiling water reactors. System analysis techniques were used to assess the vulnerability of OHR systems to various internal and external events, including' transients, ; small-break loss-of-coolant accidents, and special emergency challenges such as fires, floods, earthquakes, and sabotage. Cost-benefit analysis techniques f described in Section 4 were used to assess the net safety benefit of alterna-tive measures to improve the overall reliability of the DHR function. ; h_ rMine DI (cm) p used throughout thia document refers to
, core damage frequency,eggi core melt frequenc(r. The choice of acronym letters is a 'cseryover f rom earlier analyses where distinctions were not made between Gore gamage and gore celt.g
)~{ - _ _ - _ _ _ _ _ - -
2.2 Proaram Acoroach The scope of USI A-45 encompasses the entire population of existing LWR plants in the U.S. commercial nuclear power industry. Because it was considered im-practicable to examine every unit, even in the initial screening process,the % number of plants to be considered was reduced by elimina+1ng several categories. Excluded were special types (e.g., HTGR), units included in the Systematic Evaluation Program, units for which sufficiently similar ones remained in the data base, and units not far enough along in the construction process to have information available. As a result, over 90 units formed the base for the studies.
^
At the time the U$1 A-45 program was started, there were only six PRAs available, for U.S. LWRs, and even by mid-1986, the number was less than twenty. Moreover, the quality and degree of completeness varied widely. Thus, as described below, the program had to be based on the assumption that PRAs for only a small number of plants would exist. However, the situation has now been changed considerably by tha decision to accelerate the systematic examinations for severe accident vulnerabilities for all existing plants in accordance with the NRC Policy Statement on Severe Accidents and the staff's proposal to have these available at about the same time as that visualized for the resolution of USI A-45. The remainder of this section provides a description of the studies carried out as part of the original USI A-45 program. The initial steps in assessing the current state of decay heat removal (DHR) were to (1) characterize the units in terms of their physical parameters (e.g., number and location of safety pumps, number of redundant power trains) and (2) develop a set of qualitative screening questions against which the character-istics could be compared. The screening questions were based on a thorough review of available probabilistic risk assessments, regulatory guidance, and other topical studies. These questions provided a qualitative screen designed to reveal potential vulnerabilities in OHR capabilities both for design basis events and for beyond-design-basis situations. The screening was only a tool to highlight plants with potential OHR vulnerabilities for further study; it did not provide adequate information for a definitive assessment of industry-wide DMR capabilities. The initial qualitative screening identified i, group of 4/25/88 2-2 NUREG 1289 SEC 2 ORAFT 4/88
0
- 5
/
1 emergency (frequentlyreferredtoasexternaleventsinotherPRh alyses
- used the methods outlined in the USI A-45 documentation (References 2, 3, and' I 4). Insofar as possible, the assumptions regarding operator actions, recovery l
; actions, and component reliability have been held constant across the analyses. .l Where the data base indicated a strong reason to change values for a specific !
plant, those recommendations were accepted and documented in the ense studies. r The analyses of special emergencies (e.g., earthquake, wind, floods, fire) followed a similar though more qualitative path. Generally, the analyses for 4 earthquake, wind, and external flood proceedud by identifying the hazard and its frequency of occurrence. This was followed by an estimate of the response of the plant to such a hazard, a key aspect of which was an onsite inspection , of the plant and equipment. The individual equipment fragilities were then
- defined for critical equipment. Using the internal event and fault trees properly I adjusted to account for common-cause failures, the potential contribution of special-emergency-induced failures to core melt probability was estimated.
Again, the results are used to suggest equipment modifications to eliminate or i ) reduce vulnerabilities. i The special-emergency analyses for fire and internal flood proceeded in a ! l , j sightly different fashion. For fire, potentially significant fire areas were l l first identified using the transient event trees and system fault trees to [ j establish the critical front line and support systems. The physical arrange-i ments of equipment and potential fire sources were then verified by a site , t visit. The effects of the special emergency were then quantified based on l I l historical fire frequency data, analytical models of fire growth, and fire
- suppression probabilities. In addition, random failures and human factors were ;
I considered where applicable. Using these results, appropriate modifications designed to reduce core malt probability were proposed. Analyses for internal flood were similar with flood and flood spray replacing fire as the threat. L The various modifications were combined into groups (called variations in this report but labeled alternatives in the case studies) for engineering evaluation I of feasibility and impact based on initial estimates of the possible reductions in core melt probability that might be achieved. The alternatives were reviewed 4/25/88 2-4 NUREG 1289 SEC 2 DRAFT 4/88
) - - , , - - , _ - , . _ . , - - , _ - _ ~ , - . _ _ - _ . . - _ - - , - _ _ - - . _ _ - - - - . - - - , _ . . , , , - - - - - - - - - - - ,
_ _ _ . . . _ _ . _ = _ _ _ _ _ _ - _ _ _ _
.h
=
- 3 lettamal _ _
anraCr amaavsas AmatvsIs ESTAStB5H AtiteNA!!VES - setCIR
'"E "
EntesteCY - - Amatysts Amatysts 4 watw/ InrACT m Amatusis u. z 2
- unesc E Mcenntenaisens M -
E N n N O C A u D
=
Figure 2.1 i tdown decay heat removal analysis
by an architect engineer (AE) and the. plant staff for feasibility and reasonable-ness. Based on this initial review, the AE proceeded with conceptual design.' After an onsite inspection to ensure that the proposed designs could be imple-mented and to gather site-specific cost and related data, the AE developed an impact report. This included but was not limited to capital costs for engineering. and installation, radiation exposures incurred, and maintenance an'd operational costs. Once the conceptual designs for each alternative were reasonably well ; established, the internal and special emergency.models were updated and the analyses rerun for each alternative to establish its value in teres of reduced core melt probability and reduced public risk. This information was then used to generate value-impact assessments for each of the alternatives. The results were used as technical bases to develop the generic insights necessary for the i resolution of the issue. As p, art of the A-45 program, only six limited-scope PRAs could be carried out to assess the DHR function in existing plants. However, from the results of the A-45 studies together with those of PRAs performed as part of other programs, it has been possible to reach some generic conclusions concerning the DHR function in existing plants and develop recomendations for improving it. 2.3 Sumary of Technical Findinas Decay heat removal vulnerabilities have been identified in one or more of the following areas: response to transients; response to small-break loss-of- ! coolant accidents; and insufficient redundancy, separation, and physical l protection of existing safety trains for internal fires, floods, and sabotage. l l A comon characteristic of the USI A-45 analyses and other PRAs performed to date has been the identification of support system failures as significant } contributors to the probability of core melt. At the support system level, I there is often less redundancy, much sharing of systems, lack of separation and independence between trains, and poor overall general arrangement of equipment from a safety viewpoint, i 4/25/88 2-6 NUREG 1289 SEC 2 DRAFT 4/88
From an integrated safety standpoint, this aspect of 1ayout of plant equipment is one of the most important concerns identified in the USI A-45 program. Many plants have redundant trains of safeguards equipment located side by side in a common area. Adequate physical separation and protection of redundant safeguards trains is of ten lacking. This exists for both front line and support systems, from a safety standpoint, this is an undesirable situation. This ' type of general arrangement of equipment creates significant vulnerabilities in that single events such as a fire, flood, or insider sabotage can disable multiple. trains of safe-guards equipment resulting in an inability to cool de m the plant. Another major shortcoming in the systems used to accomplish the DHR function is the lack of independence. There is much sharing and interconnection between redundant safeguards trains. This is particularly prevalent at the support system level. This lack of independence creates single point and other impor-i tant vulnerabilities such as the RHR system minimum flow line problem in BWRs , (Reference 5). In addition, the lack of independence creates and further f aggravates potential adverse system interactions. The special-emergency events 1 , of fire, flood, and earthquake were treated in a quantitative probabilistic ( fashion in A-45 and were found to contribute significantly to the DHR-related risk. l Table 2.3.1 summarizes relevant data from a group of "representative and reliable j PRAs," where "representative and reliable PRA" is defined to mean the six case ! studies in USI A-45 together with those PRAs in the NUREG-1150 program and those that have been reviewed by NRC, but it excludes plants that had been { improved already as a result of previous PRAs. Table 2.3.2 summarizes the f results from which the values reported in Table 2.3.1 were derived. In those ' l "1*" E*It f th' 1 g(.'I' E Yl"# M caf h 9' % ***"' $" M A's"dI M N E d 'j E N'h b "l U Oi
"' "'*d * **DII'h*'I"9I'Mvaluetouseint !
0H
^ / able T 2.3.1. Based on these results and with external initiating events and common-cause events fully taken into account, it is believed that the mean ,
value of p(cm)DHR f r most existing plants will be in the range of IE-4 to 3E-4 i per reactor year, with a few exceptions extending the total range from 3E-5 to , 6E-4 per r yr. If events that A-45 has not considered (e.g. , ATVS, Event "V," l Dil i j 4/25/88 2-7 NUREG 1289 SEC 2 DRAFT 4/88
Table 2.3.1 Suneary of data relevant to freque'cy n of DHRfailuresavailablefrom"reliablePRAs"(gremeltdueto p(cm)0HR (per rd- r Mean Range , PWR Without Feed and Bleed Capability (Sample of 6)* Internal Initiating Events Only 3.82E-4 0.4E-4 to 1.24E-3 Special Emergency Events Only 0.99E-4 0.1E-4 to 1.7E-4 - Total 4.81E-4 1.0E-4 to 1.33E-3 PWR With Feed and Bleed Capability (Sample of 6)* . Internal Initiating Events Only 1.34E-4 0.1E-4 to 3.4E-4 Special Emergency Events Only 0.87E-4 0.1E-4 to 1.7E-4 Total 2.21E-4 0.7E-4 to 3.5E-4
- Millstone 3, Point Beach, Turkey Point, Zion, St. Lucie, and ANO-1 ;
(F&B) PWR With Feed and Bleed Capability (Sample of 9)** V
/\
t 4 Internal Initiating Events Only 1.14E-4 0.1E-4 to 3.4E-4 Special Emergency Events Only 1.22E-4 0.1E-4 to 3.8E-4 (' Total 2.36E-4 0.7E-4 to 4.4E-4 i .
** Millstone 3. Point Beach, Turkey Point, Zion, ANO-1, Indian Point 2 and 3, Oconee, and St. Lucie i
BWR w/o Containment Ventina Capability (Sample of 4)# , 1 Internal Initiating Events Only 1.98E-4 0.5E-4 to 5.0E-4 ! Special Emergency Events Only 0.68E-4 0.8E-5 to 1.5E-4 Tocal 2.67E-4 0.7E-4 to 6.5E-4 I
#yuad Cities, Cooper, Limerick, and Snoreham BWR With Containment Ventina Capability (Sample of 3)##
Internal Initiating Events Only 1.54E-4 0.8E-4 to 2.8E-4 (Insufficient Information on Special Emergencies)
## Quad Cities, Cooper, and Limerick (1) Data extracted from PRAs for 10 PWRs and 5 BWRs l
l , 4/25/88 2- NUREG 1289 SEC 2 DRAFT 4/88 1
- e. ,.
g Table 2.3.2 Summary of results of "reliable PRAs" for p(cm), U. g P(ca)DHR x 105 of PRA Plant Total Intn'1 Extn'1 High Light-Results Plant State Total Int'l Spec'1 Seismic Fire Flood Floods Winds ning Remarks pwg # Ir 34IR A-45 A w/oF)p 36.J 18.7 17 87. - - - - - - - E 5 s.3 Y. g g. m A w FN8 31. 13.9 17.j,f 6.1 3.3 7. 7 - 0.4 g - 8 Fh 2k.5 10. If.5 - - - - - - - 8 w Ft(8 k.6 7.1 If.5 b 7.5 - 4.6 ' 2.4 0.26 - C 10.8 4.8 6.04 - - - - - - - h4 C w 7.44 1.4 6.04 1. 3 4.4 - 0.32 - 0.02 - i D Jow 132.2 123. 9.15 - - - - - - - D wF 17.9 8.8 9.15 7.3 0.58 - d E Mean
.ao z a 39.1 3 h
= FK 51.f 12.g Mean w Fh 7.8 12.k
=
! NRC M o Review IP2 w/o FNB - - - - - - - - - - IP2 w FN8 43.5 6.0 37.5 14.0 19.2 - - 4.3 * - - o ka IP3 FN8 - - - - - - - - - - R IP3 w FNB 15.7 9.0 6.7 0.31 6.3 - - 0.13 - - E -
--- - ^ ^
.k :W%
\h; G
i . . Table 2.3.2 Summary ef results o' reliable PRAs" for p(cm)DHR (Continued)
~.
u - 3 p(ca)0HR x 105 Source High of PRA Plant Total Intn'1 Extn'1. Light- . Results Plant State Total Int'l Spc'1 Seisric Fire Flood Floods Winds nl.1 Remarks
~
53-58.9 52.9 0.1-6. 4. '- - - - Seismic values - NRC Zion w/o F . are NRC Review - estimates Zico w 34.3-40.2 34.2 0.1-6. <0.1-6 - - - - MG 19.7-30.3 18.6 1.1-11.7 0.6-9.4 0.5-2.3 - - - - Higher values '. for seismic w !'2,pl 14.7 0.8-8 Est - - - - and fire from .* 15.2-22.7 MS3 use of data g,'} - - - - - - - from Seismic e Oconee El NI Hazard r2.or. Q 0,PRA 1.3,PRA. l Proj. 6.0 - - Oconee wfp' 15-28 7.4 8-21 1.PRA 10,NRC - 2.5,NRC 2.3,NRC' - [k -; 7 Mean 36.4-44.6 35.8 0.6-8.9 Mean wF 24.8-30.1 14.3 10.6-15.8 } g NUREG- Surry w - 2.6 - - - - - g 1150 . y - - - - r o PRAs. Zion wF -
- 15. - - -
g . g Sequoyah w -
- 10. - - -
f Mean - 9.2 O O - E
)
g Table 2.3.2 Summary of results of "relisle PRAs" for p(ca)g (Continued) U . h P(cm)DM x 105 of PRA Plant Total Intn'1 Extn't High Light-Results Plant State Total Int'l Spc'1 Seismic Fire Flood Floods Winds ning Remarks BWR 0.ol d.*l o. a. A-45 E w/o vent 25.7 15.9 9.8 8.3 1.3 - g Gr2-4.gg o.el o. 'a. E w vent 19.7 9.9 9.8 f.3 1.3 - 9-E-f A-45 F g,pwent 657 50.9 14.8 8.1 1.1 -
- 5. 0.4 0.2 F t 43.7 28.9 14.8 8.1 1.1 -
- 5. 0.4 0.2 g ,NRC Limerick w/o vent 9.2 8. 4 0.8 0.5 0.3 - - - -
u Review Limerick w went <9 d.1 - - - - - - - Shoreten vent 7.4 5.4 2.0 - - 2.0(NRC) - - - Shoreham w vent - - - - - - - - - Mean (4) vent [27 20.2 6.8 - - - - - - h Mean (2) vent 31.7 19.4 12.3 - - - - - - E i -
! % NUREG- PS - -
0.82 - - - - - - - 1150
$ GG - -
2.8 - - - - - - - 1 a i n c, NOTES: ! 5 IP2/IP3 - Indian Point 2/ Indian Point 3 A MS3 -Millstone 3 - t P8 - Peach 80ttoa j g GG - Grand Gulf . s * *
. i
and large LOCAs) were included, these values woJ _, 1 d be d :,2; higher. Discussion-of the relationship of the above core' m W ffoquencies to the Commission's
- Policy Statement on Safety Goals is provided in Section 4.2.1.
The experience gained from application of PRAs to 0.5 LWRs in the USI A-45 and other programs suggests that, when the systematic examinations for' severe acci- i i dont vulnerabilities called for as part of the Severe Accident Policy have been completed, the existing plants will fall into three broad categories as far as I the quantifiable adequacy of their DHR function is concerned: L _. , ykTovd M /1Y S jOb $# - l l '
, /
~
1 i l l I ( l
/
l 4/25/88 2-8 NUREG 1289 SEC 2 ORAFT 4/88 l r
l
/ /g Category 1 l FrequencyofcoremeltduetofailuresofDHRfunction(p(cm)0HR) acceptably small or reducible to an acceptable level by simp 1 improvements.
Cai.vgory 2 DHR performance characteristics intermediate between Categories 1 and 3. Category 3 Frequency of core melt so large that prompt action to reduce p(ca)DHR to an acceptable level is necessary. Pending further guidance from the Commission, the following quantitative values (expressed as means) have been used by the staff as a basis for categorization: Category 1 p(ca)DHR less than 3 x 10 5 per reactor year. Category 2 p(ca)DHR less than 3 x 10 4 per reactor year but greater than 3 x 10 5 Category 3 p(cm)DHR greater than 3 x 10 4 per reactor year. The choice between the various alternatives for the resolution of USI A-45 takes into account this. variability in the performance characteristics of the DHR function in the existing LWRs. In the following sections, alternative measures for improving the overall reliability of the DHR funct'on are assessed. References (For Section 2)
- 1. "Interim Reliability Evaluation Procedures Guide," NUREG/CR-2728, SAND 82-1100, Sandia National Laboratories, January 1983.
- 2. Letter Report, "Shutdown Decay Heat Removal Analysis Plan," Sandia National Laboratories to USNRC, August 15, 1984.
- 3. "Shutdown Decay Heat Removal Analysis - General Electric BWR3/ Mark 1 Case Study," NUREG/CR-4448, SAND 85-2372, Sandia national Laboratories, March 1987.
- 4. "Shutdown Decay Heat Removal Analysis - Westinghouse 2-loop Pressurized Water Reactor Case Study," NUREG/CR-4458, SAND 85-2496, Sandia National Laboratories, March 1987. .
- 5. "Minimum Flow Logic Problems that Could Disable RHR Pumps," IE Bulletin No. 86-01, May 23, 1986.
4/25/88 2-13 NUREG 1289 SEC 2 DRAFT 4/88
3 ALTERNATIVE RESOLUTIONS The staff considered six specific alternative courses of action irr reaching its proposed resolution of USI A-45: Alternative 1 - No Action
- Alternative 2 - Limited-Scope PRA as a Basis for Modifications ,
Alternative 3 - Application of Specified System Modifications to All Plants Alternatise 4 - Depressurization and Cooling Capability < Alternative 5 - Dedicated Hot-Shutdown capability Alternative 6 - Dedicated Cold-Shutdown Capability i Each alternative is discussed briefly below. More complete descriptions of each alternative along with the value-impact analysis are presented in [ Section 4. , 3.1 Alternative 1 - No Action For this alternative, no action would be taken. A complete "status quo" of the decay heat removal function would be maintained; that is, no action would be taken on USI A-45. 3.2 Alternative 2 - Limited-Scope PRA As a Basis for W iifications For this alternative, each licensee would conduct a limited-scope probabilistic riskpssesine3(PRA)onitsplantstoestablishtheexpectedcontributionto core mM frTquency and risk from OHR system failures. The results would then l be compared to preestablished quantitative objectives as one indication of l acceptability. The licensees would propose modifications, if required, based l on the results of the PRA analysis. lne scope of the PRA in terms of initiating l events, systems considered, level of modeling detail, and resources that would j l be required are presented in Section 4.2.2. The A-45 case studies provide examples of the types of modifications that would be required if the i 04/25/88 3-1 NU1289 SEC 3 ORAFT 4/88 L
quantitative safety criteria are not met. These case studies form the basis for the recommendations put forward in Alternative 3. - 3.3 Alternative 3 - Application of Specified System Modifications to All Plants A common characteristic of the USI A-45 analyses, supported by other PRAs per-formed to date, has been the identification of oport g ten failures as signi-ficant contributors to the probability of core m N l hfs insight and others that have emerged from USI A-45 are of two types: 'those relating to broad groups of plants and those that are very plant specific. This commonality of results suggests that one approach to the resolution of USI A-45 would be to require that several classes of modifications already identified in the USI A-45 program and in other related generic issues be implemented at nuclear power plants currently licensed. Modifications p t individually and in com-- bination serve to reduce the probability of core W aral dentified. Some of the modifications are the same as those required to resolve other current generic issues. Consequently, if this alternative were adopted, the resolution of these other generic issues would be accomplished by the implementation of this alternative. 3.4 Alternative 4 - Depressurization and coolino Capability This alternative consists of the following methods of decay heat removal:
- 1. Primary-side bleed and feed or secondary-side blowdown capability for PWRs,
- 2. Containment venting for 3WRs.
The first method for PWRs involves using primary safety or relief valves (e.g., PORVs) to reduce system pressure and to remove decay heat by blowing down to containment followed by primary coolant makeup using the high-pressure injec-tion (HPI) system. The second method for PWRs involves using steam generator secondary-side relief valves (e.g., ADVs) to reduce system pressure and to remove decay heat by blowing down to the atmosphere, followed by secondary-side coolant makeup by means of any available secondary-side pumps with sufficient head. Both of those methods would provide increased protection against total 04/25/88 3-2 NU1289 SEC 3 DRAFT 4/88
loss-of-feedwater events. The BWR method of decay heat removal involves provi-sions for (1) additional reactor coolant system makeup from, for example, ' existing diesel-driven fire protection system pumps and (2) long-t 7m heat removal by venting the containment. Operating BWR plants are already imple-menting a version of this venting strategy using existing hardware. In an upgraded system, air-operated containment vent valves would be ope' rated from a separate structure to control containment pressure and allow heat rejection from the suppression pool by bolloff. For BWRs, this upgraded method of decay heat removal could also provide increased protection against long-term station-blackout events. The capability of existing plants to use one of the above alternative methods of depressurization and cooling varies from plant to plant. Accordingly, for this alternative the licensees would be required to ensure that the capability exists either with existing equipment or by adding new hardware. For example, in the case of PWRs, this could involve increasing the primary or secondary relief capacity. In the case of BWRs, this could involve adding qualified containment vent valves and a dedicated diesel-dri en fire water pump with f_ suitable RCS connections. Licensees would also be required to ensure that adequate procedures and instrumentation are in place to successfully accomplish the above means of decay heat removal. 3.5 Alternative 5 - Oedicated Hot-Shutdown Capability This alternative involves the addition of indepen'ient and dedicated makeup and cooling trains to enhance the capability to maintain the reactor coolant inventory and to transfer decay heat from the reactor to the environment to achieve hot shutdown conditions. The dedicated trains would be located in new Seismic Category I buildings and would have their own independent power supply (AC and DC), component cooling systems, essential service water systems, ventilation, instrumentation, controls, and ultimate heat sink. This approach would involve limited modifications and interconnections to the existing plant. The existing plant could be kept operating while the dedicated system was being constructed. Connections to the existing plant could be made during normal refueling and maintenance outages. The dedicated systems would be capable of automatic in-itiation and control for up to 10 hours without operator intervention. 04/25/88 3-3 NU1289 SEC 3 ORAFT 4/88
The new Seismic Category I buildings that would contain most of the dedicated system components would also contain a remote control station from which plani, personnel could shut down the reactor and monitor important plant parameters in the event that the main control room had been damaged or occupied by third party intervention. This alternative does not have the capability of achieving and maintaining cold-shutdown conditions. A dedicated cold-shutdown capability is considered in Alternative 6. 3.6 Alternative 6 - Dedicated Cold-Shutdown Capability This alternative consists of adding to the dedicated hot-shutdown capability (Alternative 5) those features and components that would enhance the capabili-ty to achieve ar.d maintain cold-shutdown conditions. Therefore, instead of stopping at hot-shutdown conditions as in Alternative 5 Alternative 6 would also provide for a completely independent and dedicated means of reaching i . cold-shutdown conditions. Depending on the capability of existing plants, this alternative could involve the addition of increased primary and secondary ] relief capacity, as well as an additional train of RHR and all of the necessary
, support systems. As is the case with Alternative 5, most of the additional components would be located in new Seismic Category I buildings. A remote control station would be located in the new Seismic Category I building where, following a 10-hour period of automatic initiation and control at hot-shutdown conditions, the operators would have an increased capability to manually bring the plant down to cold-shutdown conditions.
1 i i l r ! 04/25/88 3-4 NU1289 SEC 3 rRAFT 4/88 L
4 VALUE-IMPACT ASSESSMENT This section begins with a brief overview of the value-impact (V/I) methodology used for most of the alternatives described in Section 3. This is followod by a detailed description of each alternative, which includes a plant-specific V/I assessment. That is, an estimate is made of the value and related impact if the stated alternative were implemented at one of the six case study plants. Finally, a generic V/I analyois that demonstrates the basic consistency of the plant-specific analyses and provides information for a generic approach to the
- resolution of the USI is presented.
4.1 Summary of Value-impact Analysis Methodolony and Treatment of Uncertainties 4.1.1 Objectives of the Value-Impact Analysis The main objectives that the methodology is structured to achieve are:
- 1. The requirements of the backfit rule (10 CFR $ 50.109) and the guidance' of current NRC policy set out in the Commission's Policy Statement, "Safety Goals for the Operations of Nuclear Power Plants"; NUREG/BR-0058, "Regula-tory Analysis Guidelines of the U.S. Nuclear Regulatory Commission";
NUREG/CR-3568, ",% Handbook for Value-Impact Assessment"; and NRR Office Letter No.16, Revision 3 "Regulatory Analysis Guidelines," should be met.
- 2. The analysis must take account of the uncertainties. -
- 3. The method of presenting the results must facilitate the application of the data in the decisionmaking process in the context of generic resolution of the USI.
While most of the analysis was done prior to the E00's January 2,1987 memo andum on the Safety Goal Implementation Status, the estimates of probability, risks, 04/20/88 4-1 NUREG 1289 SEC 4 ORAFT 4/88
and costs are presented separately so that comparisons can be made using the proposed supplemental guidelines for the review of generic issues. . The approach used is described briefly in the following sections. A more com-plete description is presented in Reference 1. The quantitative results are presented in Section 4.2 (plant-specific results) and Section 4.3 (generic results). 4.1.2 The Approach to Value-Impact Analysis in USI A-45 A major challenge in the development of a method of V/I analysis for USI A-45 has been the derivation of meaningful generic results from the si case ( study f PRAs. A further difficulty has been that of presenting the generic results g in a way that facilitates their use in the decisionmaking process in view of the uncertainties. The method adopted to overcome these difficulties has been to use."indices" that provide a measure of the V/I relationship as the principal parameter for presenting the results of the analysis. Values are defined as the improvements ( in the protection of the public health and property that would be achieved by the proposed requirements. Impacts measurt the other consequences, which are mainly economic, that result from implementing the proposed requirements. When defined in this way, values and impacts may be either positive or negative. By consideration of the known site-to-site and plant-to plant variations in para-meters affecting both the value and impact terms and applying corrections for these to the results of each of the case studies, mean values for these indices foq each modifica'. ion or alternative (i.e. , group of modifications) for the average site and plant combination were obtained. PWRs and BWRs were considered separately in this analysis. One index is value-impact ratio (or more correctly, the impact-to-value ratio) l in the form of cost per person-rem, which may be compared with any criterien l (e.g., $1000 per person-rem) that a decision maker wishes to use to judge cost I effectiveness. Thus the value-iepact ratio, as used here, maintains a clear separation between the measure of protection against direct effects on public l health being sought and the economic consequences that are likely to result from the implementation of a requirement. Both gross and net value-impact 04/20/88 4-2 NUREG 1289 SEC 4 DRAFT 4/88
ratios are presented. The gross value is measured by the total radiation dose to the public within 50 miles of the plant weighted by the probability of the' dose. The total radiation dose includes both external radiation and internal radiation from inhalation and ingestion. The dose is calculated using the CRAC-2 computer code, which averages the results of dose calculations over a large sample of site-specific meteorological conditions and assumes an organize'd emergency response that would limit the lifetime projected dose to any individual to 25 rem by evacuation, relocation, and restrictions on consumption of food and water. The net value is calculated by adjusting the g.*oss value to account for occupational ' radiation exposure to onsite plant workers. The radiation dese incurred by workers during installation operation, and maintenance of any required modifi-cations is subtracted, and the probability-weighted radiation dose that would be incurred by workers in the cleanup and repair of the plant following an acci-dent is added, The gross impact is the present worthf of the implementation cost of installing, o erating, and maintaining the modifications that would be needed to comply with the proposed requiremen h 1985 U.S. dollars h These costs include the different-( ial cost of any replacement power needed if the plant must be shut down to install or maintain the modifications. T.'e net, impact is calculated by subtracting from the gross impact the averted onsite cost, which is the probability-weighted present worth of the replacement power, plant repair or replacement, and onsite cleanup costs associated with accidents. While all previous analyses have pre-sented value-impact ratios based on gross impact, only some previous analyses have also presented these ratios based on net impact. For the reasons discussed briefly telow and more extensively in Reference 1, a new index (Specific Net Benefit, SFB) has been introduced. This uses monetized radiation dose as an avertible offtite cost. This index presents the results in a form similar to a "cost savings to implementation cost" ratto, where net benefit is analogous to cost savings. As defined here, the offsite net benefit is the difference between the orchability-weighted present worth of the public dose (i.e., the present wort. tte gross valu monetized at $1000 per person- 4 remgind the present worth k the istplementation costs (i.e., the gross impact). ,g Thus in this index, both the public dose and the implementation costs are adjusted to a present worth basis. Most previous NRC analyses did not adjust dose to a present worth basis. 04/20/88 4-3 NUREG 1289 SEC 4 ORAFT 4/88
t
,/ !
0 j The offsite specific net benefit is then the dimensionless ratio of the offsite e i not benefit to the present worth of the gross impact. l The total net benefit is the offsite not benefit less the present worth of the worker radiation dose incurred during implementation monetized at $1000 per ! l person-rem plus the sum of the probability-weighted present worths'of (1) the i averted onsite costs of cleanup, repair, and replacement power and (2) the I ! averted worker radiation dose that would have been incurred during this plant cleanup and repair monetized at $1000 per person-rem. The total specific net l benefit is the dimensionless ratio between the total not benefit and the gross
! lmp ni, (i.e., the present worta of the implementation costs). In the absence [
cf uncertainty, an SN8 greater than Zero would indicate cost effectiveness and l vice versa. A method for intterpreting SN8 values in the presence of uncertainty [ l ] is desc"ibed in this section. ] The reasons for introducing the SN8 concept are discussed below. When the con-f . l ventional averted onsite costs (mainly cost of site cleanup, cost of replacement [ ! power, and loss of investment) as well as the avertible offsite costs are taken f l [, into account, a simple nondimensional V/I ratio could be used if the offsite )' costs were monetized. However, if the averted onsite costs tre treated as negative impacts, as required by NRR, the denominator of the ratio is the dif-j i ! forence of two similar quantities, and both numerator and denominator are sub- f j ject to large uncertainties. This leads to difficulties in the interpretation of the results. SN8 avoids some of these difficulties without treating onsite l I costs as a positive value since the niin uncertainties appear only in the { I numerator of the first ters. l 1 8ecause mean values are used for all parameters in estimating the generic values. l J SN8 is a good measure of cost effectiveness in terms of the expectation of the I avertible loss, Consequently, in considering a large number of nuclear power plants, the effects of the random gr .4tions are adequately taken into account, and it is necessary to consider in detail only the unceri;ainties due to sys-f [ j tematic errors in the various parameters. For this purpos , a sensitivity ! ) analys.s has been used to obtain upper and lower limits to the generic V/! [ ] indices, as described in Reference 1. i l i j . 1 04/20/88 4-4 fNREG 1289 SEC 4 DRAFT 4/88
~ , i To facilitate the use of the generic V/I indices and the results of the sensi-tivity analysis in the decisionmaking process, the upper and lower limits of the ratios obtained in the sensitivity analysis are treated as bounding values.
Below the lower limit it is assumed that there is no chance that a proposed modification would be cost effective if the modification were judged only in , terms of the quantifiable. benefits. Above the upper limit, it is assumed that the modificatlan would be certain to be cost effective. The limits are too wide, however, to be of much practical utility, but with the assumption that the systematic errors of unA.1own sign can be regarded as having log-normal dis-tributions, the bounding values can be used to estimate the er,or factors. It is then possible to estimate the values of the value-impact indices that repre-sent a specified pr sat ility of a given modification being cost effective. The method used for interpreting results in the Regulatory Analysis is shown in Table 4.1.1. The procedure for constructing the interpretation tables is descrioed in Reference 1. Since the uncertainties associated with internally initiated events are smaller than for events initiated by the "special emer-gencies" described in Section 2.2, the V/I indices have to be interpreted dif-ferently for these two event categories, and provision ic made for this as shown in Table 4.1.2. Similarly, the uncertainties in the avertible offsite and onsite costs are different and, when these are combined, the interpretation of the numerical value of the indices changes as shown in Table 4.1.3. To apply the generic results to other site- or plant-specific cases, Tables 4.1.4 and 4.1.5 have been prepared. In these tables, known variations from the average site and plant parameters (e.g., population density out to 50 miles, replacement power costs) are taken into account. As discussed in Reference 1, the interpretation tables can also be used to obtain preliminary indications of the changes in cost offectiveness due to the inclusion of other possible avertible cost components in the "value" term, for example, the effects on the V/I indices of including the indirect %blic costs arising from a nuclear moratorium of the form discussed in Referer.:' 4. Tnese indications must be regarded as preliminary since the uncertainties in the ! additional components of the "value" term have .not been taken into account l specifically in the preparation of the interpretation tables. l l 04/20/88 4-5 NUREG 1289 SEC 4 DRAFT 4/88
Table 4.1.1 Interpretation of probabilities of cost effectiveness . Estimated probability of cost effectiveness Interpretation
<0.10 Treat as Not C.E.*
0.1 to 0.3 Small Chance of Being C.E.
- 0.3 to 0.7 Fair Chance of Being C.E.
0.7 to 0.9 Good Chance of Being C.E. ;
>0.9 Treat as C.E. l
*C.E. = Cost Effective Table 4.1.2 Interpretation table for estimated specific net benefit, average U.S. site, offsite costs only s... .___._. . _ - _ ,
I
~$pecijicNetBenefit(SNB)
Internal plus Internal External external [-- Interpretation of SNB initiators initiators initiators
. Treat as Not C.E * <-0.6 <-0.6 <-0.6 Small Chance of . -0.6 to -0.1 -0.6 to 0.2 -0.6 to 0.0 Being C.E.
Fair Chance of -0.1 to 2.7 0.2 to 6.5 0.0 to 3.7 Being C.E. Good Chance of 2.7 to 6.5 6.5 to 17 3.7 to 9.0 Being C.E. Treat as C.E. >6.5 >17 >9.0
*C.E. = Cost Effective 04/20/88 4-6 NUREG 1289 SEC 4 DRAFT 4/88
Table 4.1.3 I.1terpretation table for estimated specific net benefit, average U.S. site, offsite plus onsi.te . costs Specifhe Net Benefit (SNB) Internal plus > Interpretation Internai External external of SNB initiators initiators initiators Treat as Not C.6.* <-0.60 <-0.60 <-0.60 Small Chance of -0.6.to -0.2 -0.6 to 0.0 -0.6 to -0.15 Being C.E. Fair Chance to -0.2 to 1.3 0.0 to 4.0 -0.15 to 2.2 Being C.E. . Good Chance of 1.3 to 2.8 4.0 to 10 2.2 to 5 Being C.E, Treat as C.E. >2.8 >10 >5
*C.E. = Cost Effective h
I l I i l l l 1 l 1 04/20/88 4-7 NUREG 1289 SEC 4 DRAFY "/88
/
__ - __ -. - --. . - - -- - ~ _ . _ _ _ _ _. m, .- 2 _ o Table 4.1.4 Interpretation table for estimated specific net benefit, high- and low population U.S. sites, cffsite costs only 5 ' h ' Specific net benefit High g$9ulation density low population density Type of initiating evest I Type of initiating event Interpretation af Intl.& Int. & specific net benefit Internal External Ext 1 Internal External Extnl. L
- % r-Treat as Not C.E.* <-0.9 <-0.9 <-0.9 <+0.3 <+0.4 <+0.4 Small Chance of Being C.E. -0.9 to -0. 7 -0.9 to -0.6 -0.9 to -0.7 0.3 to 1.6- 0.4 to 2.5 0.{ to 1.9 y Fair Chance of Being C.E. -0.7 to +0.2 -0.6 to 125 -0.7.to 0.6 1.6 to 10 2.5 to 21 1.9 to 13 Good Chance of Being C.E. +0.2 to -0.3 1.5 to 5 0.6 to 2.3 10'to 21 21 to 54 13 to 29
- Treat as C.E. >1. 5 15 >2.3 >21 >54 >29
-- _ - ~ -
"C.E. = Cost effective E
=
0 m g .
- - - - --- ,y ., , n n - -- -- ,
~
c3 Table 4.1.5 Interpretation table for estimated specific net benefit, d high- and low population U.S. sites, offstte costs and E! s onsiie costs i Specific net benefit Highpppulationdensity low population density Type of initiating event Type of initiating event Interpretation of Intl.& Int. & specific net benerit Internal External Ext 1 Internal External Extnl. Treat as Not C.E.* <-0.9 <-0.8 <-0.9 <+0.2 <+0.3 <+0.3 Small Chance of Being C.E. -0.9 to -0.7 -0.8 to -0.7 -0.9 to -0.7 0.2 to 1.2 0.3 to 2.0 0.3 to 1.6 Fair Chance of Being C.E. -0.7 to +0.2 -0,7 to +0.7 -0.7 to 0 1.2 to S.9 2.0 to 14 1.6 to 8.6 Good chance of being C.E. +0.2 to +0.3 0.7 to 2.7 0 to 1.0 S.9 to 10 14 to 32 8.6 to 17
}* ,
Treat as C.E. >0.3
>2.7 >1. 0 >10 >32 237
*C.E. e Cost effective E
A O M u, . s. - 8: -
P Reference (For Section 4.1) -
- 1. "The Application of Value-Impact Analysis to USI A-4 $ Summary Report of UCLA Studies on Value-I a g pnalysis in Relation to USI A-45," NUREG/
CR-4941, SAN 087-7116, -.c,2 1987. -I l -l t I I e i a 3 [ ,t + l l l l 1 ( i v \ l , 04/20/88 4-10 NUREG 1289 SEC 4 DRAFT 4/88 l l
4.2 Plant-Specific Value-Impact Analysis for Each Alternative ( In this section, the six . alternatives presented in Section 3 are discussed in more detail and the rr,sults of a specific value-impact analysis for each of the A-45 case study plants are summarized in tabular form for each alternative. The plant-specific data are then used as the basis for the generic' value-impact analysis described in Section 4.3. Besides value-impact and specific net benefit ratios, core damage probability, population and occupational doses, and costs are shown explicitly in the tables. It should be emphasized that persen-rem is a measure of the total low-level dose risk to a population given certain assumptions about such factors as relocation and decontamination but yields no information about environmental contamination. Interdiction and decontelnination can, at a cost, reduce the person-rem value, and this is modeled in the CRAC-2 code. The specific onsite costs, offsite costs, threshold health effects, person-rem values, and other CRAC-2 code consequence estimates are all risk indicators of reactor accidents; no single parameter can be expected to measure all types of consequences. In assessing the balance between regulatory action and the benefits of that f action, it is important to examine all indicators linked to the protection 0 public health and property. In addition, for information and for possible future use, factors not previously considered in NRC value-impact studies have been incorporated in alternative results shown below. This inc1Ldes, for example, the possibility of a nuclear moratorium resulting from another severe reactor accident because of the fears of the public concerning the health effects of such accidents. 4.2.1 Alternative 1 - No Action This alternative assumes that no additional action is necessary based on the evaluations of the o frent decay heat removal systems. It also assumes that all applicable requirements and guidance approved to date have been implemented, but no implementation is assumed for related generic issues that are still currently unresolved. However, the effect of the pNposed resolution of one unresolved safety issue j uSI A-44, "Station Blackout," on this analysis of USI A-45 is discussed in Appendix A. 04/20/88 4-11 NUREG 1289 SEC 4 ORAFT 4/88
.2. ?'
To assess the status of the current decay heat removal systems as part of the A-45 program, quantitative and deterministic analyses of a number of light water reactors were performed. Probabilistic risk assessments (PRAs) were performed for several plants where qualitative screening indicated potential OHR vulner-abilities. In the analyses presented here, credit was given for feed and bleed . in PWRs and containment venting in BWRs. These analyses assumed both internal and special emergency (fire, flood, earthquake, wind) accident initiators. How-ever, since the purpose of the program is to evaluate the adequacy of the DHR function, accident sequences that did not involve this function are not included in the analyses. These excluded sequences involve large LOCAs, reactor vessel ruptures, including the pressurized thermal shock sequence that was extensively reviewed under USI A-49, interfacing system LOCAs, which are being assessed
- under GI-105, and anticipated transients withoutwscram (ATWS), which was resolved Q W 'itter derived under this program do
,(-
under USI A-9. Thus, thy core j .g.: 1i not represent the total P ai'l U :: for the case study reactors. Including R the cytribution) from the above excluded events would result in higher estimated coreid @ i:[. * [ Table 2.3. liststhemeanandtherangeofthefrequenciesofcoreme[4 'M { (p(cm)DHR) due to OHR failures that were determined based on the facilities X aluated und r the A-45 ram and other PRAs. h
& % b 'E.3. I .40 3 E ~ id W M@f.W.
valuef were within an acceptable range, it would be one indication X hfif 'I that the current design of the decay heat removal systems is satisfactory, and t no modifications would be necessary. As indicated in Section 2.1, the recent k
- NRC Policy Statement on Safety Goals (Reference 1) together with the staff's interpretation of the goals as part of the Severe Accident Policy Statement (Reference 2) provides guidance as to the quantitative value of p(cm)DHR that would be acceptable in order to meet the Commission's objective of "pre ding l
reasonable assurance while taking due account of the uncertainties involved, that a severe core damage accident will not occur at U.S. nuclear power plants."
- E.bvC]
7 hM A/ Jbe- gaff ho g e t he 4r mil raneae nf caue. c o n _, , , , , , _ , _ _ ut)[s , ~ C' e,4.r,cj ir t s[ 7t ludi 1 a ice for nquantifi,a[e con), e er c e r a ili y, m), need to I e ss hn1 [ { 74 Thu ien ivr m i > Lil :: f : be "" A A ,, a - * ::t-tM a .,je d.i. (' vi
,1 /f-/ ?.
p (cm) used throughout this document refers to [ g_['- 4 Xpe core damage frequency, QQt core melt frequency. The choice of acronym letters is a carryover from ear 11er analyses where distinctions were not made between core gamage and core celt.3 ]
. ... . . - . . . . . . . ..r. .. .._ .. . . . . . aal
>; .q ; , . a . g.h) iQ ,
.i The Cornnission 's Saf ety Goal (Reference 1) specifies that large releases should occur with a frequency no greater than 1E-46 per ,
reactor year. On several A 4 occ asions/ F P 9 ' the staff has also applied an additional goal that the h total core damage frequency from all causes should be no greater than 1E 44 per r eac tor- year . A h In choosing a goal to be applied to the results o analyses 4 dhoh as the case studies discussed in this Regulatory Analysis, W ompatible with the above goal the NRC staff
. W the fel l m i g r ational e) b
- s.cyf .h.l e+tr.
The case study results rf'present thy best estimate of the risk f h resultingfromthrausc1Litablenett).enofjdEEaxbesttemexel
- j'="M 4 *f W $ &
=,r'n M
These :; -.M ggt includes fallutgtilI.iv.t (yngygottfi',ghtgcontributionstothecoredamage 1,
.WWN d ecay heat removal fallure ac1:t:i f requency ems =dre4 y-% such as c.perator errors of ommission and unidentifind "common cause" ' '" events. The staff has estimated that the frequency of these unquantifiable e.eata may total approximately t ice the frequency of ,
i W b:y e p m ; $ ^!e the quantifiable portion of the decay heat removal l i y - / 3 4 _.
_ 4 r.
.l'l'.'
Y
~
{ failureja-ted re : d:....,. ..=niv, i.e the total
/
(quantifiable plus unquantifiable)/ decay heat removal W J%) failure damage frequency may be three
- times the result actually obtained by the PRA, which by definition represents only the quantifiable portion of thefreqkncy.*
A
'2, contributions f rom events agt rel ated to decay heat y __ -
-w removal failures. Based on results of numerous PRAs, the staff believen that the scav heat removal failure no cirted edamagefrequencKepresentsatleastone third of the tote.1 core damage frequency from all causes; i.e., the total core damage frequency is three times the quantifiable plus unquantifiablejv'dscay heat removal failure m*=M edamagefrequencyN factor of three p allows for contributions from such causes as l
j large LOCA, vessel ruptures, interfacing system LOCAs, t and ATWS without exceeding the total 1E-k4 goal for all core damage events. l l The staff will therefore apply a goal of 1E-$5coiedamageevents (
,3er reactor year to the PRA results fro j dscay heat removal failurgr:12ted. analyses his goal is appropriate, since application of one factor rif three h to this goal to account for 4-QJ --_ _. - - - - -
--.a.... . _ . . . _ . _... . . . . . . . . - . _ . _ . . -.
.au l
4h 5
~ '
I unquantifiables and another factor of three $ to account for events not related to decay heat removal failures will allow the above z quoted total % core damage frequency goal of "not greater than 1E-44" to be satisfied. The staff notes that this DHRpailure relate PRA goal of 1E-h5 i s EM compatible with the precedent set4W USI A-44 (Station Blackout)j :
, which applied a goal of 1E-[5 tot /'equantifiableportionof core
, damage events related to that cause.
4 s
'GDe b I h
, N- / / . Vb 7-
- I9
}l58AM. -,
;a "-'
"MM
\ / -
am. . , . . . . .. = =,m.. m..._. , am... .. _._ _ . J e s t ... _ . . _ _, . . ; === s.;-..m s _ : . =;= =-e :~. : , . t T4 4 u - 4 A M Tdde p.3./ , AMc W W /4 w%" M rer U M
*g5 p~f IE4 4
# - /76
fwe Table 4.2.1@ sents estimates of the probability that at least one N severe core damage r c. = t will occur in the next 10 or 30 years given a range h( of mean frequencies of this event for u: MM M~ M gu U d. FM 3 E-ti V =T==110w reactors.
/5-i hh!!%w y Based on a mean probability of a severe core damage cciden%of3x1044-t per 4s N 4 0'),
r yr, it can be seen that there would be less than a 10% probabilit.y of a severe core damage accident occurring in a population of 110 plants during the next 30 years. Table 4.2.1 # ~~ [ 7 hbabilityofb P tIO w Mean frequency of Probability of at least one
' ' ' N
- g = W ente in 10 years in 30 years y
~
1 x 10 5 per r yr 0.01 0.03 3 x 10 5 1 x 10 4 0.03 0.10 0.09 0.25 / [ 3 x 10 4 0.26 0.60 / edonareview(aftheavailabledraftreports,NUREG-0956andNUREG-1155 the co ional probability of contair, ment failure given that a large scale core melt has o red depends on the type of containment and neertainties i s of direct containment ng. The magnitude and k f9nvolved,e.g.,thee Ifitypeofreleasemayvary(e.g., rough results in the smaller j Category 6 or 7 releases), e largest ses (Categories 1 and 2) may j7 have less than a 2% 'ditional probability in a large containment. However j the probabil of failure of a small pressure-suppression con ment for a PWR or a typical BWR resulting in a large release is much greater, he or er of 0.1 per demand, fhus, for those types of plants, the probability of a large release would be about 3 x 1NS g x 10 84 per r yr. y
/ .L _- > : . , & ~ , : - . , , h- f The Policy Statement on Safety Goals (Reference 1) also deals with the individual risk of early fatality and the public risk of latent cancer. In both instances, the language of the Policy Statement requires that the risk from an accident at a nuclear plant be no greater than 0.1% of that normally encountered by the public.
04/20/88 4-13 NUREG 1289 SEC 4 DRAFT 4/88 _ - - - - - - - - - - J
Estimates of the mean individual early fatality. risk were generated for the case study plants using the CRAC-2 code. These estimates are for an individual within one mile of the site boundary. The results of this estimate are tabulated below. t Individual Risk of
- Plant Early Fatality per r-yr A 3.2E-8 B 2.6E-8 C 2.1E-8 0 2.1E-8 E 8.8E-8 F 1.3E-7 Because the focus of USI A-45 is on those initiating events (small LOCAs and transients) that will require decay heat removal, these reported values do not represent the total early fatality risk. However, based on available PRA inform-ation (e.g., References 3, 4, and 5), they do include the majority of the risk.
Therefore, if o e gos}uljt.tp that failure to remove decay heat represents 60 to 80% of the total /6 Pdue to7 core melt (Reference 6) (it may well be greater), the USI A-45 case study plants would meet the requirements of the Policy State-ment with respect to early fatalities if the fatality risk due to other accidents were, on the average, greater than 1.6E-4 to 2.2E-4 per year. Based on inform-ation available for 1983 (Reference 7), the individual risk of accident-caused fatality in the U.S. is approximately 4.0E-4 per year. Therefore, the case study plants meet the goal of a risk limited to 0.1% of that from other causes even if the contribution from failure te remove decay heat were less than one-half nf the total risk due to core melt. However, it must be remembered that the i estimates of core melt probability that are inherent in the risks tabulated above do have uncertainties associated with them. In the case stddies, it was estimated that this uncertainty in core melt probability could be approximately a factor of S. In addition, there are the uncertainties inherent in the CRAC-2
- models and calculations, the size of the source term, and related issues. It is therefore not unreasonable to assume an uncertainty approaching an order of magnitude on these estimates. Thus the early fatality. risk could be much less or much greater than the fatality risk from other accidents.
04/20/88 4-14 NUREG 1289 SEC 4 ORAFT 4/88
The CRAC-2 code was also used to estimate the expected number of latent cancer fatalities out to ten miles due to failure to remove decay heat at the case . study plant sites. These estimates were combined with the total population out to 10 mMes to generate an estimate of the latent cancer fatality risk. The results are tabulated below. ' Risk of Latent Cancer Plant Fatality per r yr A 3.1E-8 8 2.2E-8 C 1.1E-8 0 2.3E-8 - E 3.8E-8
, F 3.2E-8 -
As noted above, failure to remove decay heat may account for 60 to 80% of the latent cancer risk. Thus, given these results, if the nominal or background (.ancer risk is greater than approximately 6.5C-5 per year, the plants would meet the goal of no greater than 0.1% of the nominal risk. The most recent data (Reference 7) indicate that the total fatality rate from cancer in the U.S. (- ' is 189.3 per 100,000 persons, or a risk of 1.9E-3 per year. Therefore, the estimated latent cancer risk for the nuclear plants is significantly less than 0.1% of the nominal risk, and the case study plants meet the goal. Again, it must be remembered that there are uncertainties on the order of a factor of 10 l in the estimates but, even so, the plants seem to meet the latent cancer risk goals. I s indicat above, the to al re damage frequency als needs o be con i r . As iscuss d eviously, the prob ilities o severe core ama acci nts 1 sted abov do not in ude t e contributio fro accident sequence otptthan o involv g failure the DHR function. hile DHR failure st major ntrib - tor th total c e age frequenc , so margin bel the obje ti e needs to e maint ed allow thes other acci nt se ences and f the ) unquantifiable contributions tsc ssed below. The above-stated goal (p(cm) less than 1x10 5 per reactor year) does not quanti- < I tatively allow for the uncertainties listed below, which could cause the actual l probability of a core melt in the next thirty years to exceed the value of 0.09 04/20/88 4-15 NUREG 1289 SEC 4 DRAFT 4/88
- - - - - - . _ - _ . _ _ . . , , . _ , y _ . - _ _ _ _ _ __.
y ._ _ - - , -
of Table 4.2.2 even if all plants meet the 1x10 5 per reactor year goal. Thus the staff cannot recommend use of a goal any higher than 1x10.s per reactor year.
- 1. One of the uncertainties in all PRAs is whether any significant accident sequences have been inadvertently omitted. While analysts attempt to identify all significant sequences and each analysis builds o'n previous analyses, there is no way to demonstrate with complete confidence that all important sequences have bedn included. Of most concern are hidden inter-actions or other common-mode faults. The nonstandard desi,gns of the cur-ru t generation of plants makes each PRA unique in many respects and reduces the confidence gained from previous analyses. Many of the IE Bulletins and Information Notices and the current generic issues are illustrations of failures that were previously unrecognized and were not treated in PRAs.
- 2. A second major uncertainty is the possible degradation in reliability.
The analyses include failures due to operator errors and incorrect main-tenance and testing as assessed from current operating experience. But
. continuing equinment reliability depends on proper operation, maintenance, and testing. However, these are human activities that can deteriorate quickly and without warning. The NRC attempts to monitor these activities, but the measures are imprecise and not predictive; that is, they indicate degradation only after it has occurred. .
- 3. A third type of uncertainty is whether the equipment will operate reliably as intended under accident conditions. Components, equipment, and systems are required to be both qualified and surveillance tested. Some qualifica-tion is based only on analyses that may use some data established by limited testing. Even the more comprehensive qualification and surveillance tests can not completely simulate actual operating conditions, especially if those conditions are the result of a partially understood accident, i
The models and data used in the PRAs are, of necessity, based on assumptions that may in some cases be conservative and in other cases nonconservative. A more complete description of these assumptions is provided in the individual cas. studies and the technical findings / summary report (Reference 4). 04/20/88 4-16 NUREG 1289 SEC 4 DRAFT 4/88
Some estimate of these uncertainties can be inferred from actual core damage
, precursor events in the U.S. commercial LWRs, which have completed nearly 1000 reactor years of operation. Based on the 1980-81 post-TMI experience, the industry-average potential severe core damage frequency has been estimated to be less than 2E-4 per reactor year (Reference 8). This estimate is based only on reports of internal event initiators and does not include the s ecial emer-gency events (fire, flood, earthquake, and storms). The de.minant sequences identified for PWRs were split between small-break LOCAs and transients. For BWRs the dominant sequences were initiated by transients. Thus the functions that provided the most significant potential risk reduction were functions related to decay heat removal: feed and bleed for PWRs and long-term cooling for BWRs. This evaluation of actual operating experience is consistent with ~
the quantitative estimates of core damage frequency and the identification of the most significant vulnerabilities based on the A-45 case studies and other PRAs. , The possible effects of sabotage are not included in the core damage frequencies listed here and are also excluded from the safety goals by the Commission. The core melt frequency contribution from internal sabotage was determined on a con-ditional basis and was found to represent a significant additional contribution. sts ar sually attributed to a "No Action" alternative because the future costs of accidents are conventionally counted as averted costs in the assess-ment of the alternative actions. However, a, severe core damage accident is estimated to result in about $1.4 billion of replacement power costs, $0.5 ( billion to replace the generating capacity, and $1.2 billion to clean up the plant end site. If the accident also resulted in a large release of radioactivity offsite, the costs of relocating people, restricting food and wg g and cleanup would cost a few billion dollars more. The Soviets are reporting the costs Y associated with the accident at Chernobyl are about $15 billion. In addition, accidents less severe than a core damage accident can occur and would require ( shutdown and possibly cleanup. At $200,000 to $500,000 per day for replacement power alone, such precursor events would also result in significant costs. Thus the convention of accounting for these averted costs in the resolution of i other alternatives should not obscure the possible costs associated with the f "No Action" alternative. l 04/20/88 4-17 NUREG 1289 SEC 4 ORAFT 4/88
In summary, the staff believes that, to provide a reasonable margin for the con-tribution to p(cm) due to non-OHR sequences and for the uncertainties, the mean value of the quantifiable component should be shown to be not more than 1x10 5 per r yr. 4.2.2. Alternative 2 - Limited-Scope PRA As a Basis for Modifications
- A common finding of probabilistic risk assessments (PRAs) conducted to date has been that failures in support systems (e.g., emergency power, service water, component cooling) contribute significantly to core melt probability. Support systems also exhibit the largest plant-to plant differences in design and. layout.
Therefore, their precise influence on the estimates of the probability of core d melt is difficult to ascertain and document in a generic study, particularly as related to those operator actions (usually te med recovery actions) that can significantly reduce the effect of a'given system failure. Such actions are usually controlled by a set of operating or emergency procedures that are them-selves plant specific. Thus it may be possible for two plants that are nominally similar to have quite different likelihoods of core melt given that an initiating (., event occurs. Therefore, one alternative for reducing the anticipated risk from decay heat removal (OHR) is for each licensee to conduct a limited-scope PRA on its plant to establish the expected contribution to core melt from potential DHR function failures and identify modifications that would reduce this risk. 4.2.2.1 07finition of a Limited-Scope PRA The scope of any PRA may be limited in a number of ways: the analysis may be set up to exclude certain accident-initiating events or the level of detail in sys-tem models may be prescribed. Prior PRAs have shown that the principal chal-lengas to decay heat removal arise from accidents initiated by transients and small !.0CAs. Therefore, for the purposes of the resolution of USI A-45, a limited-scope PRA is defined as one that considers at least the following initiating events:
- 1. Small LOCAs (those referred to as 52 and 5 3),
- 2. Loss-of-offsite power transients, 04/20/88 4-18 NUREG 1289 SEC 4 DRAFT 4/88
- 3. Transients caused by loss of the power conversion system,
.( .
- 4. Transients with offsite power and power co'nversion systems initially available,
- 5. Transients caused by the loss of an AC or DC bus.
The following initiating events are not included in a limited-scope PRA as defined here:
- 1. Large and medium LOCAs,
- 2. Reactor vessel ruptures,
- 3. . Interfacing systems LOCAs,
- 4. Anticipated transients without scram,
- 5. Steam generator tube rupture.
- 6. Special emergencies.
- In addition, special issues such as pressurized thermal shock are excluded from consideration.
4.2.2.2 Rationale for Conducting the PRA . From the case studies conducted for the resolution of USI A-45, it was observed t1at modifications uld be , defined that, if implemented, would serve to reduce the estimated core Wequency. These modifications include both hardware and procedural components. It is also acknowledged that in some instances the results of the analyses conducted for USI A-45 may be more conservative than necessary for some plants because (1) generic failure rates and initiating event frequencies were used and '2) plant-specific operating and emergency procedures were not reviewed in depth. On the other hand, these analyses could be shown to be op onservative for the same reasons. Therefore, a plant-specific PRA conducted by analysts familiar with and with access to plant data and procedures, even though limited, can better establish the level of decay heat removal relia-bility at a particular site. t 04/20/88 4-19 NUREG 1289 SEC 4 DRAFT 4/88
The effort resulting from the decision to expedite the completion of a "sys-tematic examination for severe accident vulnerabilities" for each of the exist-ing plants will be integrated with this option for use in the resolution of USI A-45. 4.2.2.3 Objectives of the Assessment - The objectives of this assessment are multifaceted. First, the limited-scope plant-specific PRA could demonstrate the adequacy of exts, ting decay heat removal function by documenting that its centribution to core W friquency was rela- # tively low, on the order of 10 5 perreactoryearorlesc.pcond,if,onthe other hand, the PRA indicates that the contribution to core m M frequency due .V
- N L to DHR function failures is significant, the results of the analysis could be used to identify specific vulnerabilities and potential modifications to reduce or eli5iinate them.
4.2.2.4 Incorporation of PRAs into the Individual Plant Evaluation Program In general, the PRA should be conducted using the techniques outlined in the Interim Reliability Evaluation Program Procedures Guide (Reference 9) for the "internal events" or those events related to random failures of plant equipment and human error. Those events characterized as "special emergencies" (often called external events) may be treated using simplified procedures outlined in USI A-45 program documentation (References 10 and 11). The analyses conducted as part of the case studies developed under USI A-45 have indicated that seven special emergencies have a significant potential for influencing the decay heat removal core melt frequency: earthquake, fire, internal flooding, external , flooding, winds, lightning, and sabotage. The NRC staff is presently formulating a requirement for all licensees to perform a PRA-based individual plant evaluation (IPE) to identify significant risks due to severe accidents. For a typical plant, well over half of the "severe acci-dent" risk is closely associated with loss of decay-heat-removal capability (i.e., with DHR sequences of the type addressed by USI A-45). Therefore, it is considered likely that the analy described in this section will be performed as part of the overall IPE program and need not be performed separately and in 04/20/88 4-20 NUREG 1289 SEC 4 ORAFT 4/88
, - _ . . ~ . . . _ _ . .' ~, g -+1 d , nh' A.Nld f O u h N A / Mf '
-1 .-
addition to the IPE. It is believed that such combination will allow a more. efficient as well as a more comprehensive evaluation to be performed compared with separate evaluations for DHR-related events and for other severe events under the IPE generic letter. 4.2.2.5 Value-Impact Considerations for Limited-Scope PRA The conduct of a limited-scope PRA is not, in and of itself,*of value in terms of reducing risk. A PRA is, however, of value in that it provides a better understanding of the actual state of the plant with respect to its capability to cope with a requirement for decay heat removal. There would also be a value associated with having demonstrated in a logical and structured manner that the contribution to p(cm) from a failure to remove decay heat is less than 1x10.s per reactor year if that were in fact the case. Such limited-scope PRAs can result in risk reduction if, on any given site, there are vulnerabilities in the decay heat removal function that are identified and then eliminated or at least reduced. The USI A-45 case studies have shown rh'WM %j/O'y C. that reductions in core damage frequency as large as 3 X 1
- per reactogyear can be obtained at costs in the range of $2 to 425 million per n N Examples from the case studies are summarized in Tables 4.2.2.1(A) and Thus the results of PRAs can be used to determine how best to reduce t. vulnerabilities in a cost-e,ffective manner. .
It should be noted that the variations shown in Tables 4.2.2.1(A) and (B) (A1, A2, etc., designated as alternatives in the case studies) show both similarities and differences from plant to plant. For example, A2 and 81 both include modi-fications designed to deal with long-term station blackout as do El and F2, although the approach is somewhat different. However, the common result is that the modifications or reductions of vulnerabilities identified provide reductions in the probability of core melt due to OHR failures of up to 60L These variations are described in Table 4.2.2.2. 04/20/88 4-21 NUREG 1289 SEC 4 ORAFT 4/88
,.,..o q . g i
i l' i. o Table 4.2.2.1(A) Alternative 2. modifications based on ilmited-scope PRA, results i
- of value-impact analyses for specific plants
~ l e Averted I
8 Averted Dose: Impact Onsite Value-Impact ,
#;y' State Base (ca) ($/ person-res) r Var. p(ca) ar. (person-res) (Gross) Costs of Net Plant No. (per r yr) (per r yr) Offsite Net Onsite ($x10 8) ($x10 s) Gross f Plant (4) (5) (6) (7) (8) (9) (10) (11) !
(3) (1) (2) ,, , . :. F&B n - 239 b 4.72 1.)E4 4 4E3 .
- j
- A kI 458D B Al A2 3.1;'E-4 2.16E-4 2.51E-4 642 741 279 14.9 5.50 2.0E4 9.2E3 f.7 I 3 ;
840 126 b.7T 3.66 66E3 . N. 3 ; B wh i s8o 81 2.f6E-4 1.13E-4 lip C1 7. 4 E-5 4.1E-5 144 51 1.49 C ' a[8D e f.'WE-M 15.4 s. , D1 1-0E-4 1. 28E-4 167 142 E4 3.93 9.AE4 3.jE4 ,
. D $8 4 BD E ent El 1.97E-4 5.84E-5 1630 66 1.74 1.fE4 NE3 E4 9.11E-5 2521 103 gg 2.72 2.4fE3 1.W3 ;
F wt.'ent F1 4.37E-4 -4 2 27k 2# # 6.h 1.1E4 E3
=
r2 g4 ggff gr gpg yg fgE3 50 2 Notes: qg/ - Column 2, Fg8= Feed and Bleed; 5 - Secondary Blowdowng g Column 3. Contents of variations are described in Table 4.2.2.2.
" Column 7 = Averted Onsite Dose - Installation Dose ,
Column 8 = Installation Costs + Operation and Maintenance Costs + Replacement Power Costs During Installation
% in 1985 Dollars
-4
- Column 9 = Present Worth of Replacement Power Costs + Loss of Investment + Cleanup Costs Column 10 = Col 8/ Col 6 Column 11 = (Col 8 - Col 9)/(Col 7 + Col 6)
[ r
. a '
~
t s i o Table 4.2.2.1(B) Alternative 2. modifications based on limited-scope PRA, results of a
- value-impact analyses for specific plants in terms of "specific net M benefit" using monetized radiation dose '
s i Averted Cost ! i State Base @(cm) Offsite Net Onsite Impact of Var. p(ca) ~@Ia r. (PW) (PW) (Gross) Specific Net Benefit . Plant Plant No. (per r yr) (per r yr) ($x10 8) ($x10 8) Offsite Total . (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) ! hA w F) B
& SED Al A2 3.1$E-4 2.16E-4 2.51E-4 0.38 0.43 4.87 5.67 b
14.9
-0.95
-0.97 -0.3}.
-0.59 \@#
A* -3 gg B w Fh B1, 2.f6E-4 1.13E-4, 0.50 3.74 -0.91 -0.24 J[:
& SBD C w Fh C1 7.4E-5 4.1E-5 0.083 1.f9 -0.% -0.15 *
& SBD
- 4- l'~.77E-l/ d.too 3 : W.4 !
,, O w F#8 01 -
1.28E-4 0.085 3.9f 1&r2 -0.99 -0.75 [
" & SBD T 16 5 4 E w Vent El 1.97E-4 5.84E-5 0.9k 1.79 H -0.94 -0.8K E4 9.11E-5 1.51 3-fe).73 6-79 f.9sf -0.76 -0.27 z F w Vent F1 4.37E-4 -4 1. -0.9N -0.6dr E F2 2-tE-4 W +. W 4r04 -0.77 2 ?"f !. 3! fM 3.!7 -d. M K,,H7 g Notes:
N Jh
- Column 2, F B = Feed and Bleed; SBC= Secondary Blowdow g E Column 3, Contents of variations are described in Table 4.2.2.2. ,
a S Column 6 = Present worth of Averted Offsite Dose Monetized at $1000 per person-t M W Column 7 = Present worth of Averted Onsite Dose and Installation Oose Monetized at
* $1000 per person-rem plus Averted Onsite Costs. ,
E Column 9 = (Col 6/ Col 8) - 1.0. Column 10 = [(Col 7 + Col 6)/ Col 8] - 1.0. I
Table 4.2.2.2 Contents of example modifications from the case studies Hodification Var. No.* Vulnerability Al Failure to switch over to sump Add alarm and procedure for recirculation Loss of power due to battery Add additional.DC power failure source Loss of cooling flow due to valve Add a manual bypass valve failure RWST failures and electric Provide water from spent switchgear failures from seismic fuel pool and add events restraints to switchgear and batteries Service water pumps lost from Install shield wall to failure due to spray protect pump motors Loss of safety systems due to fire Install added fire in CSR and AFW rooms suppression j A2 (A1+) Loss of heat removal due to Install additional turbine-station blackout driven power source B1 Surge floods safety systems Increase height of existing flood wall Loss of cooling due to loss Increase strength of , of water tanks and CCW heat ta.1ks and heat exchanger exchangers from seismic event supports Loss of safety systems due Install additional to fire in CSR suppression in CSR C1 Loss of safety systems due to Enclose one train of safety-CSR fire related cables in fire barrier Loss of cooling due to Increase strength of tanks loss of water tank with addition of external supports 01 Loss of cooling due to Install provisions to power failure of EFWS pump auxiliary feed pump from Class 1E bus and to take water from CST
- Var. No. - Variation number used here to distinguish them from the six alternatives in this study. These "variations" were labeled alternatives in the individual plant case studies.
04/20/88 4-24 NUREG 1289 SEC 4 ORAFT 4/88
Table 4.2.2.2 (Continued) Var. No.* Vulnerability Modification Loss of emergency electric Install turbine-driven power to diesel generator and generator for emergency battery failures loads Loss of cooling due to failure Install third RHR pump l of low pressure pumps in parallel to existing ! trains Loss of cooling'due to' Add redundant / parallel valve failures manual valves to ensure ficu nath , Loss of safety systems due Add redundant deluge valve
. to fire in CSR with separate sensing and control Loss of cooling due tp Strengthen tanks with loss of tanks and emergency external supports and electric power due to seismic anchor switchgear event .
El ' Loss of cooling due to Add an additional DG loss of AC power to plant
, {'.
loss of circuit breaker Provide for autotransfer
- DC control power of some DC loads E4 Loss of AC power due to failure Add a dedicated battery to flash field to one DG i
Loss of AC power due to loss Add a third OG cooling- i of OG cooling water pump l Loss of circuit breaker DC Provide for autotransfer control power of some DC loads i Loss of decay heat removal Enhance operating pro-due to fires in CR or CSR cedures for the safe-shutdown pump J Loss of electric power due Upgrade battery racks to seismic events and add restraints to ' SWGR and buses i h i l , I j 04/20/88 4-25 NUREG 1289 SEC 4 ORAFT 4/88 1 4
- - - - - - - **,_ _,, -,7- ,-,-,, - , - , _ ,_ _ . _ - , _ _ - - , - - - - - - - -
Table 4.2.2.2 (Continued) Var. No.* Vulnerability Modification F1 Loss of electric power due Install a third diesel to diesel generator failures generator Loss of cooling flow due to Add bypass link around valve failures or flow isolation valve and install diversion additional isolation on noncritical loads Loss of cooling due to Add automatic closure of diversion of service water isolation valve Loss of safety systems due Add fire barrier around to fire in CSR HPCI and RBSW power cables Loss of cooling due to failure Install added anchorage to tanks and heat exchangers or tanks and heat exchangers from seismic event Loss of emergency electric Add supports and tiedowns power due to seismic events to switchgear and transformers Loss of DC power Add a dedicated battery (. F2 to one DG Loss of cooling water due Add bypass valve, second to valve faults and flow isolation valve, and auto-diversions closure for valve Loss of cooling due to fires Add a 1-hour fire barrier in cable expansion room to HPCI and R85W cables Loss of cooling due to seismic Strengthen HTEX mounts, events valve, CST, and transformer tiedowns Loss of decay heat removal due Develop procedures for to floods safe shutdown in high flood crests 04/20/88 4-26 NUREG 1289 SEC 4 ORAFT 4/88 l
l instances The information available from the case studies also shows that { some,# ( there can be a substantial reduction in the probability of core'a44,F e.g. , A1, E4 in Tables 4.2.2.1(A) and (B), without a concomitant cost-effective reduction in public risk as measured by the specific net benefit or the cost per person-rem to avert offsite exposure. In all instances, the inclusion of averted onsite costs substantially improves the cost effectiveness of the modifications , identified. Thus the limited-scope PRA can be an effective tool to demonstrate that a plant as configured meets the quantitative criterion, or if it does not, to determine the most cost-effective means to improve the situation. It is estimated, based on the USI A-45 case studies and similar efforts in other NRC sponsored ,nrograms, that a limited-scope PRA could be accomplished with a PRA team of the following makeup. 1 Team Leader 2 System Analysts for Internal Events () full time) - 2-3 System Analysts for Special Emergency Events (part time) 1 Human Reliability Analyst (part time) 1 Computational Specialist This level of PRA would require on the order of 55-45 person-months of effort per unit at a cost of $650-850K. There would be some economies on multiple nit sites since a number of special inmergencies affect the total plant site, not just specific units. 4.2.3 Alternative 3 - Application of Specified System Modifications to All Plants A common characteristic of the probabilistic risk assessments conducted to date, including those for USI A 45, has been the identification of the significant contribution of support system failures to the probability of core melt. These support systems include electric power, component cooling water, service water, etc. This commonal';ty of results suggests that one approach to the resolution of USI A-45 is to require that certain types of modifications already identified here and elsewhere be implemented at nuclear power plants currently licensed. 04/20/88 4-27 NUREG 1289 SEC 4 ORAFT 4/88
4.2.3.1 Rationale for Modifications l In the analyses conducted to support the resolution of USI A-45, insights that relate' to broad groups of plants and insights that are very plant specific have emerged. Most of the identified vulnerabilities occur in support systems, are generic, and apply to both PWR and BWR plants. The actual contribution to core melt is plant specific, but the potential vulnerabilities listed below made a ; significant contribution for the plant tyoes evaluated in the A-45 analyses. These vulnerabilities may also be addressed in other generic issues as indicated by the generic issue designations in parentheses.
- 1. Inadequate e:nergency AC power due to diesel generator failures, i.e. ,
station blackout. (BWR/PWR; A-44/3-56)
- 2. Loss of diesel generators due to failure to flash field due to station ;
battery failures, i.e., station bisckout. (BW7/PWR; A-30, A-44/B-5C)
- 3. Loss of 125 VDC power division. (BkR/PWR; A-30)
- 4. Loss of 125 VOC circuit breaker control power. (BWR/PWR; A-30)
- 5. Long-term station blackout due to battery depletion. (PWR/BWR; A-44)
- 6. Electrical switchgear/ battery failures due to seismic excitation. (BWR/PWR; A-46) ,
- 7. Water storage tank (CST, RWST) failures due to seismic excitation.
. (BWR/PWR; A-46)
- 8. Pump and valve common-mode feilures (AFW, CCW, SWS, HPI(R)S, LPI(R)S, etc.). (PWR/BWR) ,
- 9. Fires in cable spreading rooms, switchgear rooms, or common cable run areas.
(BWR/PWR) 04/20/88 4-28 NUREG 1289 SEC 4 DRAFT 4/88
The following typer, of vulnerabilities have appeared in at least one of the case studies conducted for A-45. ,
- 10. Loss of diesel generator cooling provided by a single train of cooling '
water susceptible to single failures. (BWR)
- 11. Loss of safety systems from cooling failures due to closed cooling water or service water headers with single isolation valves in which failure to open prevents flow to safety systems. (BWR/PWR) .
- 12. Loss of safety systems from inadequate cooling due to closed cooling water or service water headers in which failure of a single isolation valve to close diverts flow from safety systems. (BWR)
- 13. Emergency core cooling system failures from loss of cooling due to blocked flow caused by failure of manual isolition valves. (BWR/PWR)
Since many of these vulnerabilities have been identified as generic issues, i ( implementation of any modification needed to correct these vulnerabilities can be accomplished as part of the resolution and implementation of the associated i issues (i.e., A-30, A-44, A-46, and B56). Those vulnerabilities that are not subjects of current generic issues (vulnerabilities listed as 8 through 13) would be proposed as new generic issues. 4.2.3.2 Modifications To Be Installed l
- The following modifications are possible but not necessarily the only means of i
reducing the vulnerabilities discussed in the previous section. The actual [ modifications would be based on the resolutions of the generic issues, but these ! J modifications have been identified for the purpose of evaluating the probable value-impact of implementing resolutions to these generic issues. Further discussion 4rdOM44 of the impact of implementing the currently identified ; issues that relate to the improvement in the decay heat futtetion is prc.sented in Section 4.4. j l
}
04/20/88 4-29 NUREG 1289 SEC 4 DRAFT 4/88
a
- 1. Inadequate Emergency Power I .
- a. For those plants with less than tw's diesel generators per unit, instal an additional diesel generc.oa.
- b. For those plants with two diesel units per unit, take action tn i
, improve overall diesel generator reliability,
- 2. Loss of DC Power for Diesel Generators .
For those sites where DC power for diesel generator start, control, and field flashing is drawn from the station batteries, install a dedicated battery for at laast one diesel generdtor train.
- 3. Loss of 125 VDC Powtr -
)
For plants where two station batteries are shared betwcen units, install l an additional battery or alternative source of power that can power either !f i DC division. I
- 4. Loss of Breaker Control Power For those plants that use 125 VDC power for circuit breaker control on vital AC buses and motor control centers, provide a c&pability to transfer ;
DC loads between trains.
- 5. Battery Depistion For those plants w54re current battery capacity is insufficient to provide adequate system operation beyond two hours, install additional battery capacity or alternative sources of power.
l
- 6. Seismic Resistance of Batteries and Switchgear
- a. Review battery installations to ensure that racks meet current seismic requirements. All racks should be steel with appropriate tiedowns to prevent motion under seismic excitation.
04/20/88 4-30 NUREG 1289 SEC 4 ORAFT 4/88
- b. Review electrical equipment (transformers, switchgear, buses, battery charg' rs, and motor control centers) for adequacy of anchorage.
Provide additional ties to floor to prevent cabinet motion during seismic acceleration. For tall cabinets, provide additional restraints to prevent toppling.
- 7. Seismic Resistance of Tanks For water storage tanks (RWST and CST) designed using the procedures of TIO 7024 and with H/0 ratios greate than 1, review for adequacy under current standards. Upgrade anchorage and walls as appropriate.
! 8. Pump and Valve Common-Mode Failures I
Wherever multiple trains of safety equipment have components of common manufacture or type, especially motor-driven pumps, turbine-driven pumps, ciotor-operated valves and air- or selenoid-operatea valves, provide pro-
, cedures to ensure staggered testing and maintenance and, where feasible, f provide for alternative means to reduce the potential for common-mode failures.
- 9. Fire Protection
! Where safety-related cabling is concentrated, ensure that adequate fire protection is provided by installation of additional suppression systems, thermal protection, etc. Review all procedures to ensure that minimal ; quantities of fuels are present in fire-susceptible areas (control rooms and cable spreading. -ooms in particular), i
- 10. Diesel Generator Cooling 1
Where diesel generators have single-train cooling, provide a redundant ) cooling path or at least provide redundant active components, e.g., pumps and motor-operated valves. I ! 04/20/88 4-31 NUREG 1289 SEC 4 ORAFT 4/88 (, . _ _ _ _ _ _ _
- 11. Failure to Open a Single Isolation Valve For cooling water systems (component cooling, closed cooling, service water) that have single isolation valves whose failure to open coulo prevent cool-ing, install a redundant valve. The parallel valve should be motor operated if prompt cooling is required. For those instances where early cooling is not imperative, manual bypass valves may be installed if the valve location is accessible to operators under accident conditions.
- 12. Failure to Close a Single Isolation Valvr.
For cooling water systems (component cooling, closed cooling, service water) that have single isolation valves whose failure to close could divert flow away from safety equipment, install a second isolation valve in series. The second valve should be motor operated if prompt cooling ir required. ; The valve may be manual if a reasonable delay in establishing flow is acceptable and the valve is accessible to operators under accident
- conditions.
- 13. Failure of Manual Isolation Valves For equipment with manual isolation valves (e.g., heat exchangers) tne
- failure of which could prevent adequate cooling, provide a parallel valve, normally open, to reduce likelihood of operator error.
l \ Each of these modifications has had a demonstrable effect on the estimates of ! core melt probability in the case studies. In some instances, a review of the f l + plant systems may indicate that several of these modifications should be implemented. 4.2.3.3 Value-Impact Considerations for System Modifications i It was not possible to conduct a fully quantified PRA and value-impact assessment on every modification. Nevertheless, it has been possible in some instances to l make reasonable stimates of the values (reduction in core melt probability) of l single proposed modifications or a set of two. As expected, the value and the 04/20/88 4-32 NUREG 1289 SEC 4 ORAFT 4/88 t
impact of any given modification are plant and site dependent. This is illustrated in Tables 4.2.3.1(A) and (B), in which a number of the modifications li: Ced above are analyzed for a particular plant or plants. None of the modifications is cost effective based on avertible offsite costs alone. However, about 50 percent of all modifications are cost effective if onsite costs are included. Decisions on whether to implement any of these modifications would be based on the more extensive value-impact analyses that would be provided to support the recommended resolutions c./ the associated generic issues. Embarking on this alternative would be likely to result in some cost-effective actions and would therefore be worth the NRC resources needed to devcup requirements related to these issues. Note, however, that these actions are not believed to be capable of reducing DHR-related risk to meet the goal of less than 1x10 5 per reactor year, i 4.2.4 Alternative 4 - Depressurization and Cooling Capability
. For this alternative, the following methods of decay heat removal were examined:
- 1. Bleed and feed or secondary-side blowdown capability for PWRs
- 2. Containment venting for BWRs.
Both of these alternatives, including the results of the value-impact analysis, are described in detail in the following sections. 4.2.4.1 Bleed and Feed Capability for PWRs 4.2.4.1.1 Existing Capabilities 4 Many PWRs currently have some capability to cool the reactor by a process called bleed and feed. Thismethodisnormallyconsideredasalastresort[andwould be used only in the event that main and auxiliary feedwater are lost. To cool j the core in the bleed and feed mode, the power-operated relief valves (PORVs) on the pressurizer are opened by the operator to reject energy from the primary system (bleed). The high pressure injection (HPI) system is then used to add r fluid to the system (feed) to make up the inventory lost through the PORVs. 04/20/88 4-33 NUREG 1289 SEC 4 ORAFT 4/98
+
, I .* .
o Table 4.2.3.1(A) Alternative 3. Application of Specified System Modificatfors, results , y of value-impact analyses for specific plants , Averted ; E State Base g(ca) Averted Dose impact Onsite Value-Impact '. of Var. Xcm) tgrar. (person-rem) (Gross) Costs ($/ person-res) Plant Plant No. (per r yr) (per r yr) Offsite Net Onsite ($x10 8) ($x10 *) Gross Net p (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) l 4 ell A s h J 38D 2 5 3.lfE-4 K 3.7E-6 2.7E-5 11 80 4 30 0.46 3.42 0.08 0.59 4.2E4 4.3E4 2.5E4 2.6E4 9 1.2E-5 36 15 0.99 0.26 2.8E4 1.4E4 6b 1.5E-5 45 18 0.24 0.33 5.3E3 50 , B 9 2. 6E-4 7.2E-5 535 81 3.10 2.33 5.8E3 1.3E3 E579 7 1.3E-5 99 15 0.91 0.42 9.2E3 4.3E3 I C 9 7.44E-5 2.9E-5 100 37 0.60 1.05 1.05E4 $0 80 7 1.2E-5 42 15 0.052 0.44 1.2E3 50 ,
# 4 0.11 0.46 1.6ES 7.4E4
/, O F 5 1.79E-4 1.5E-5 20 16 i i
- IdBD 6b/7 6.4E-5 84 7- 0.131 1.97 1.6E3 $0
) E ent la 1.97E-4 4.4E-5 1240 50 10.9 1.32 8.8E3 7.7E4 2 1.7E-5 480 20 0.42 0.51 8.8E2 $0 3 1.1E-5 310 10 0.37 0.33 1.2E3 1.3E2 -
- 2 10 1.7E-5 480 20 4.25 0.51 8.8E3 7.5E3 .
E . 8 F ent la 4.37E-4 2.1E-4 1590 190 14.9 4.55 9.4E3 5.8E3
- 11 1.2E-5 91 11 0.17 0.26 1.9E3 50 i M 12 1.2E-5 91 11 0.28 0.26 3.1E3 1.9E2
- 13 1.2E-5 91 11 0.14 0.26 1.5E3 50 M
i Notes: , a
% Column 2. F = Feed and Bleed; 580 = Secondary Blowdownd)
Column 3. Modifications are as described in Section 4.2.3.2. ! Column 7 = Averted Onsite Dose - Installation Dose.
- Column 8 = Present Worth of Installation Costs + Operation and w intenance Costs + Replacement .
$ Power Costs During Installation + Cost of Limited Scope ria.
I Column 9 = Present Worth of Replacement Power Costs + Loss of Investment + Cleanup Ccsts. Column 10 = Col 8/ Col 6. Column 11 = (Col 8 - Col 9)/(Col 7 + Col 6) ,
* =
i,
. . A. ,
, r
.R a.
* ~
a e o Table 4.2.3.1(8) Alternative 3, Application of Specified System Modifications, results ; t of value-impact analyses for specific plants in terms of "specific net 3 benefit" using .aonetized radiation dose .
'm
<a
. Averted Cost ;
State Base (cm) Offsite Net Onsite Impact i of Var. p(cm) ar. (PW) (PW) (Gross) Specific Net Benefit Plant Plant No. (per r yr) (per r yr) ($x10 8) ($x10 *) Offsite Total (1) (2) (3) (4) , (5) (6) (7) (8) (9) (10) ;
# w Fh 2 4 3.7E-6 0.007 0.123 0.46 -0.98 -0.72 f F&B
& SBD 5 7
3.lfF W 2.7E-5 1.2E-5 0.048. 0.02 0.61 0.295 3.42 0.99
-0.99
-0.98
-0.81
-0.70 .,
gg 8b 1.5E-5 0.026 0.343 0.24 -0.89 -0.54 4-
- p B w fpu 7 2.j6E-4 7.2E-5 0.32 2.38 3.10 -0.89 -0.13
& SBD 9 ng 1.3E-5 0.053 0.44 0.91 -0.94 -0.45 C w Fh 7 7.44E-5 2.9E-5 0.058 1.06 0.60 -0.90 -0.86 ,
, & SBD 9 1.2E-5 0.024 0.44 0.052 -0.54 7. 8 t-D w FJl8 5 1.79E-4 1.5E-5 0.012 0.47 3.11 -1.0 -0.85
& 5BD 8b/9 , 6. 4 E-5 0.05 2.01 0.131 -0.62 14.7 E w Vent la 1.97E-4 4.4E-5 0.74 1.35 10.9 -0.93 -0.81 x / 1.7E-5 0.29 0.52 0.42 -0.31 0.93 -
15 3 1.'IE-5 0.18 0.34 0.37 -0.51 0.41 2 10 1.7E-4 0.29 0.52 4.25 -0.93 -0.81 h** F w Vent la 4.37E-4 2.1E-4 0.93 4.65 14.9 -0.94 -0.60 11 1.2E-5 0.053 0.266 . 0.17 -0.69 0.88 M o 12 1.2E-5 0.053 0.266 . 0.28 -0.81 0.14 13 1.2E-5 0.053 0.266 0.14 -0.62 1.28 4 - S Notes: N
-4 Column 2, f p = Feed and Bleed; 580 = Secondary Blowdowrg
& Columr 3, Modifications are as described in Section 4.2.3.?g. .
$ Column 6, Present worth of Averted Offsite Dose Monetized at $1000 per persorrres.
Column 7 Present worth of Averted Onsite Doses Monetized at $1000 per person-res plus Averted Onsite Costs Column 9 = (Col 6/ Col 8) - 1.0 Column 10 = [(Col 7 + Col 6)/ Col 8] - 1.0 -
There are two main concepts for bleed and feed cooling. For many PWRs designed I by Combustion'Engineerina (CE) and Westinghouse, the discharge pressure of th,e HPI pumps is not sufficient to pump against the pressure setting of the PORVs. For these plants, the operator must open the PORVs and reduce the primary system pressure to a level that allows sufficient HPI coolant to be added to the system (bleed and feed). Successful operation in this mode of cooling requires that botn PORVs be opened, f,ome PWRs designed by CE have no PORVs and can not bleed i and feed. However, this is a separate issue (GI-84) for which resolution has been acferred until after A-45 is resolved. The other method of cooling (feed and bleed) is representative of most B&W-designed PWRs. The HPI syste" for these reactors develops sufficient pressure to add inventory to the system at both the PORV and safety valve pressure set-tings. Thus feed and bleed cooling can be initiated by turning on the HPI pumps and the increased system pressure will lift the PORV and safety valves. Cooling by the bleed and feed process has been added to the emergency operating
- procedures at most PWRs. However, since this process would result in extensive contamination of the contair. ment, it is anticipated that the operators may be reluctant to initiate tnis mode of cooling as was noted during the loss-of-feedwater transient at Davis Besse on June 9, 1985. There is also uncertainty -
as to whether all the equipment that is necessary to bleed and feed would j operate under the environmental conditions that would exist. Of particular I concern is the electrical equipment (e.g., terminal blocks) that have not been qualified for the environmental conditions that would exist. This mode of cool-ing has the further disadvantage $ that it must be initiated within a relatively short time. This time is dependent on the plant and the nature of the loss-of-feedwater transientj d is nerally in the range of 20 to 30 minutesh M E N
/ =) W W & k W W As 4.2.4.1.2 Upgraded Capabilities The capability to successfully cool the reactor core by the bleed and feed technique is limited in some plants by the pressure relief capacity of the PORVs (or some other more reliable type of relief valve) and the makeup capacity of the HPI iystem at high pressure. Bleed and feed cooling could be enhanetd by improvi g the capability of either component. Various methods exist for 04/24/88 4-36 NUREG 1289 SEC 4 DRAFT 4/88
increasing the relief capacity,of the PORVs. These include increasing the size of the existing valve, adding an additional PORV, or installing a special line and valve for bleed operations. The makeup capacity of the HPI system could be increased by upgrading or replacing the existing HPI pump with one of higher i flow capacity and discharge pressure. [ An additional method has been discussed for increasing the relief capacity of the pressurizer valves. This method would require the installation of an air-operated assist device on the existing safety valves. The safety valves could then be manually controlled by the operators to open and close in a manner l similar to the PORVs. The air-assist device would not interfere with the nor-mal operation of the safety valves and would function only on demand by the operators. The assist devices have been installed on a few plants as a means ] to readily test the pressure relief setpoint of safety / relief valves. 4.2.4.1.3 Value-Impact Analysis 4.2.4.1.3.1 Value E'stimates for Risk Reduction The potential use of bleed and feed as a decay heat removal method is considered in various ways at operating plants. At most plants, the emergency procedures have been modified to include cooling'the core by this method as a last resort if all feedwater is lost. To estimate the value of bleed and feed, the PWR i plant analyses performed for USI A-45 calculated the total (i.e., for both I
; internal and external events) core melt probabilities with and without bleed t and feed cooling. The following core melt probabilities due to DHR system !
failures were detormined: I (For Internal and External Events) I p(cm)/r yr cm)/r yr Plant w/o BAF,w 500 F,4 500 Ap(cm)/r yr
! A 3.6fE4 # '3.N E-4 4.8E-5 j B 2.45E-4 2.36E-4 2.9E-5 !
, C 1.0SE-4 7.4E-5 3.4E-5 0 1.79E-4 1.15E-3 [ l 1.3{-3 i I 04/20/88 4-37 NUREG 1289 SEC 4 ORAFT 4/88
/
The initiation of bleed and feed is not an autoinatic action, but must be initiated by the operator. The above case studies assumed that the failure , rate for the operator to initiate manually is 3E-3 per demand, which was determined from the Handbook for Human Reliability Analysis (NUREG/CR-1278). The operator error factor can be considered in three parts: (1) s4mple j procedural error, (2) time stress, and (3) reluctance to initiate bleed and feed. The procedural error considers the probability that the operator will make a mistake in initiating, monitoring, and controlling the process. This , failure probability is assumed to range from 1% to 5% for most plants but could
- be as high as 10%. The time strass factor depends on the time available for successful initiation of bleed and feed and the failure rate is essentially
)\ zero for long times and could be as high as 50% for a few plants with initiation i periods of about 10 minutes. The reluctance factor considers the fact that initiation of bleed and feed will release primary coolant to the containment ! and result in severe economic ramifications for the ;tility tacause of the
! resultant long shutdown for cleanup. This factor is d so plant specific depend-ing on the time available for successful operatinn. The success probabilities
( are ascumed to be approximately 95 to 99%, which may be overly optimistic. ] In consideratior, of the above, it appears that the operator error factor could 1 range from a few percent up to approximately 50%. The sensitivity of this factor l was evaluated for the case studies. The operator error factor was arbitrarily ] raised to 10%, 50%, and 75% per demand, and the effect on p(cm)0HR was determined i for internal events only, i The following results were obtained-j _ _(For3ter.1a1EventsOnly)
~
I Plant A Plant B Plant C Plant 0 )1 Operator Error
+
p(cm) p(cr) p(em) p(cm)
- Probability per r yr per r-yr per r yr per r yr
- 1 0.75 1.8}E-4 1.76E-4 1.00E-4 0.93E-4 0.48E-4 0.40E-4 1.f3E-34[.1 7.92E-4 0.5 1.63E-4 0.85C-4 0.31E-4 5.56E-4 0.1 1.44E-4 0.74E-4 0.17E-4 1.79E-4 0.003 (Base Case) 1.39E-4 0.71E-4 0.14E-4 0.88E-4 04/20/88 4-38 NUREG 1289 SEC 4 DRAFT 4/88
1 M* " t (,,.dilo'en M Coc' d N *' I Amme4 g,Ilee+i J e Failure Proba- 4etta,e p, ,4 d ,ocy.neere k h Mode bility cafy,,y (inP M'j ,g 1.1E4
/
' A gama delta 0.014 0.18 2
3 7.5E5 6.2E5 1.1ES
<g
'. ; epsilon 0.25 6 2.2E4 5.5E3 (A
1.27ES g Y } gama 0.014 2 2.4E6 3.4E4 delta 0.18 3 1.8E6 3.2E5 epsilon 0.25 6 4.1E4 1.0E4
. )- 3.6ES C gama 0.014 2 8.6E5 1.2E4 delta 0.18 3 6.7ES 1.2E5 epsilon 0.25 6 3.2E4 8.0E3 1.4E5 p gama 0.014 2 4.9ES 6.9E3 delta 0.18 3 3.5E5 6.3E4 epsilon 0.25 6 2.3E4 5.8E3 7.6E4 l
- e a
e r
The above results indicate that the estimated core melt probability is roughly ' a linear function of the operator error probability. As the operator error . probability increases, the probability of core melt approaches the value for no bleed and feed. 1 The offsite consequences were determined as described below. The accident sequences under consideration involve a core melt with no large breaks initially in the reactor coolant pressure boundary. The reactor is likely to be at high
. pressure (until the c' ore melts through the reactor pressure vessel). These conditions are likely to produce significant hydrogen generation and combustion and overpressurization due to steam.
Previous studies (Zion and Indian Point) used a 0.01 probability of containment i failureduetohydrogenburn(the"gamma"failure),anhmilarvaluewillbe used for this evaluation (0.014). The containment could also fail because of overcressurization (the "delta" failure), and based on recent results from " l NUREG-1150, a value of 0.18 was assume'd for this failure mode. If the contain-ment does not fail by overpressure or hydrogen burn, it is assumed to fail
- f. eventually by basemat meltthrough (the "epsilon" failure) with an assumed probability of 0.25. For large dry containments, recent studies suggest a j
.! significant nonfailure probability. However, the uncertainties associated with containment failure by the direct containment heating mode (see NUREG-1150) , could significantly increase the probability of overpressurization failure. i The following consequences were determined for the base case studiesM:;:. 9 e_ g e... p 2 " " h y r' O.:::L hl
@kva # - Re-Plant A Person Conse- Person Conse- Person Conse- Person Conse-Plant B Plant C Plant 0 '
lease Rem quence Rem quence Rem quence Rem quence ! I failure Proba- Cate- (50 (pe r- (50 (per- (50 (pe r- (50 (pe r- ! i Mode bility gory Miles) rec) Miles) rem) Miles) rom) Miles) rem) , l 7.5E5 1.1E4 2.4E6 3.4E4 8.6E5 1.2E4 4.9E5 6.SE3 a i 6.2E5 1.1E5 1.8E6 3.2E5 6.7E5 1.2E5 3.5ES 6.3E4 2.2E4 5.5E3 4.1E4 1.0E4 3.2E4 8.0E3 2.3E4 5.8E3 1.27E5 3.6E5 1.4E5 7.6E4 / I. ' 4 l \
-- N 04/20/88 4-39 NUREG 1289 SEC 4 ORAFT 4/88 1
The averted offsite dose is determined by multiplying the consequence (50 miles) , by the change in core melt probability (Ap(cm)) and the 22 to 24 r..taining years of plant operation. T b M M # M YM N 7. O l e The averted onsite dose is estimated by assuming a dose of 51,000 person-rem ,I for cleanup of a core melt accident. The onsite dose is then multiplied by the reduction in core melt probability (Ap(cm)) and the number of years of operation remaining, i j 4.2.4.1.3.2 Impact Estimates + ) In considering the costs associated with the bleed and feed option, several e cases are considered:
- 1. Case 1 applies to existing PWRs where some capability to bleed and feed i
- already exists, but it is decided to increase the relief capacity of the d
pressurizer by adding air-operated assist devices for the existing safety -
. valves. *
- 2. Case 2 considers adding additional relief capacity to the pressurizer for j depressurization and using the present HPI system for reactor coolant
] 1 system (RCS) inventory makeup. I 3. Case 3 considers adding additional relief capacity to the pressurizer for . depressurization and adding a new HPI pump and piping system for RCS inventory makeup. [ The stimated cost for each air-assist device in Case 1 is approximately , 6 no ,
$ based on discussions with the manufacturer of such devices. The esti- 1(
i 1 mated costs associated with Cases 2 and 3 are discussed in Reference 12. The l Case costisapproximately$Neillion,andtheCase3costisapproximately z'
- v. ,
J $NHi million. Based on a review of NUREG-1044, "Evaluation of the Need for a ,{ Rapid Depressuritation Capability for Combustion Engineering Plants," we esti-mate that the occupational radiation dose incurred to implement Case 1, 2, or 3 ; would be 50, 400, and 550 person-rem, respectively. The costs and benefits are l
. surnarized in Tables 4.2.4.1(A) and (B).
04/20/88 4-40 NUREG 1289 SEC 4 ORAFT 4/88 l
The above case studies were performed assuming that bleed arjd feed capability I is added to a plant that currenti doesnophavethatcapability. The studies h(
~
suggest that a reduction in core '
- N A " is 'obtained (0.3 to 11.5E-4 per r yr depending on the reactor) by adding this capabi ity but that only xge ures for Case 1 (about $650K, per Table 4.2.4.1(A ) could be justified g based purely on quantitative cost-benefit considerations and considering only y averted offsite dose. In most cases, however, some bleed and feed capability already exists. This case was evaluated in the NRC prioritization of Generic Issue 125.II.9, "Enhanced Feed and Bleed Capability," (NUREG-0933). The change in core melt probability was estimated assuming that the existing bleed an feed capability was enhanced. As expected, the resulting change in core m M V -f.
N $ N h was significantly less than for the case there no initial capabil- )( ity'is assumed. Several cases were evaluated in the GI 125.II.9 prioritization, e The maximum andtheaveragjap(cm),rangedfrom1.4E-6to6.0E-6perryr. , change in core siiELit frequency was 3.3E-5 per r-yr. That value implies that >< expenditures must be less than $ to justify enhancing bleed and feed capa- K bility based solely on quantitative value-impact considerations. This assumes
. that the probability that bleed and feed will not'be initiated because of the operator's reluctance is only 5% to 10%. If the operators are very reluctant to initiate bleed and feed and this probability is 50%, the change in value and the justified costs are about a factor of ten less.
4.2.4.2 Secondary-Side Blowdown Capability for PWRs 4.2.4.2.1 Existing Capabilities A second method exists to reduce primary system pressure and remove decay heat l for PWRs in the event that main and auxiliary feedwater aie lost. This method involves use of the' steam generator secondary-side relief valves, sometimes l referred to as atmospheric dump valves (ADVs), to blow down to the atmosphere I rather than blowing down the primary system through the pressurizer valves in the case of bleed and feed. After the depletion of the initial inventory of steam generator water, it may be possible to add secondary coolant using the condensate pumps. These pumps operate at low pressure and are designed to pro-vide suction to the main feedwater pumps. If the secondary pressure has been 04/20/88 4-41 NUREG 1289 SEC 4 DRAFT 4/88
vSM 3 '
~
o Table 4.2.4.1(A) Alternative 4/1, feed and bleed, results of value-impact analyses for specific PWRs t 1 Base M Averted Dose 4 M r~te~~
$ State p(cm) op(ca) (person-res) . Impact Onsite Value-InfwKt')d of Case /o F&8 var Net (Gross) Costs ($/ person-ree)
Plant Plant No. per r yr) (per r yr) Offsite Onsite ($x10 8) ($x10 8) Gross Net
! (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11)
R A w F&B 1 3.6gE-4 4.79E-5 143 6 .65 1.06 4.SE3 <0
$ SBD 2 A -344 7.00 4.9E4 3ee Note
( 3 -494 22.8 1.6ES See Note 8 As A 1 2.65E-4 2.91E-S 230 -17 .65 .943 2.8E3 <0 2 -367 7.00 3.0E4 5ee Note 3 -517 22.8 9.9E4 See Note C As A 1 1.08E-4 3.39E-S 114 -9 .65 1.22 S.7E3 <0 2 -359 7.00 6.1E4 See Note a 3 -509 22.8 2.0ES See Note L D As A 1 1. -3 1.18E-3 1923 1240 .65 35.3 3.4E2 <0 2 890 7.00 3.6E3 50 3 740 22.8 1.2E4 <0 Note: In these cases the assumed installation dose exceeds the averted onsite and ot'fsite dose; therefore, no , z value-impact is computed. I E i 8 Column 3: Cases are described in Section 4.2.4.1.3.2
~ Column 7 = Averted Onsite Dose - Installation Dose M Column 8 = Installation Costs + Operation and Maintenance Costs + Replacement Power Costs During Installation
- Column 9 = Repipcement Power Costs + Loss of Investment + Cleanup Cost
- 1 M Column 10 = Col 8/ Col 6
] Column 11 = (Col 8 - Col 9)/(Col 7 + Col 6) , ,
E 4 4 I; (
G sm 3 o Table 4.2.4.1(8) kiternative 4/1, feed and bleed, results of value-impact analyses for specific PtAts n terms of "specific net benefit" using monetized radiation dose { ~ $ Base Averted Costs State p(ca) ) Offsite Net Onsite Impact of Case /o F&B ar (PW) (PW) (Gross) Specific Net Benefit Plant Plant No. per r yr) (per r yr) ($ x 10 5) ($x10 *) Offsite Total (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) A w F&8 1 3.6h-4 4.79E-5 0.084 1.04 0.65 .87 .73 dw/e58D 2 3,y '> 693
. 7.00 .99 .89 3 0.543 22.8 .99 .97 8 As A 1 2.65E-4 2.91E-5 (1138 '>. 912 4.65 .79 .62 2 0.562 7.00 .98 .90 3 0.412 22.8 .99 .98 C As A 1 1.08E-4 3.39E-5 d065 1.19 .65 .90 .93 . 2 0.844 7.00 .99 .87
- j. 3 v.694 22.8 .99 .97 w
D As A 1 1.3 -3 1.1k-3 1.15 35.3 0.65 .62 55.1 2 35.0 7.00 .84 4.2 3 34.8 22.8 .95 +.58 z Notes: E E Column 3: Cases are described in Section 4.2.4.1.3.2 c Column 6 = Present worth of Averted Of fsite Oose Monetized at $1000 per person-rem Column 7 = Present worth of Averted Onsite Dose Monetized at $1000 per person-rem Column 9 = (Col 6/ Col 8) - 1.0 Column 10 = [(Col 7 + Col 6)/ Col 8] - 1.0 s - 4
reduced to about 200 psi, the condens' ate pumps can add water to the steam generators, although their use will depend on the availability of an adequate. power supply. J Water for the condensate pumps would be provided from the condenser wetwell. If the ADVs have sufficient reitef capacity, it is expected that the primary system pressure and temperature could be reduced to the residual heat removal ( RHR) system cut-in conditions before the inventory of water from the wetwell is depleted. If additional water sources are needed, they may be provided by the service water or fire systems. Eventual long-term cooling of the primary system would be maintained by the RHR system. 4.2.4.2.2 Upgraded Capabilities 1 The capability to achieve RNR cut-in conditions by blowing down th econdary 4 system through the ADVs has been investigated by Harris (Reference ) and / Jenks (Reference 14 The Harris study indicates that some plants may not g
- have sufficient relief capacity, particularly if a concurrent single failure is ,
( assumed. This concern could be corrected by adding an additional relief valve i or valves or by opening the safety valves to assist the blowdown process. The j valves could possibly be opened manually by an operator in an emergency or could be opened remotely if air-assist opening devices were installed as dis-cussed in Section 4.2.4.1.2. For some plants, there is very restricted access to the ADVs, and manual operator action say not be feasible. A limitation in the potential use of this concept is the need to reduce secondary pressure to the point where the condensate pumps can be used to provide secondary water. The capability could be enhanced by providing an alternative source of secondary water at higher pressure such as the fire system. 4.2.4.2.3 Value-Impact Analysis , 4.2.4.2.3.1 Value Estimates for Risk Reduction The potential benefits of secondary-side blowdown were evaluated in the PWR case studies performed for USI A-45. An evaluation was made of various accident 04/20/88 4-44 NUREG 1289 SEC 4 ORAFT 4/88
sequences both g g withy e {owdoy.n]apability. The following i h Core m(lt probabillLles wars estimaT.em , p(cm)/r yr p(cm)/ Plant w F&8,w/oc . g - w F&B, p rg p 7._c ap(cm)/r yr A 3.40E-4 # 2.7E-5 -F 8 3.06E-4 7,00 0**7*7pg f 3.!6E-4h-4 2 7.0E-
~
C 7. L4E-5 2.8E-6 , D 1.95E-4 1.79E-4 1.6E-5 The potential offsite consequences for the base cases were determined in the same manner as discussed in Section 4.2.4.1.3.1. The above consequence values were determined for a distance of 50 miles from the plant location. The averted offsite dose to 50 miles was determined as discussed in Section 4.2.4.1.3.1. Following the above model, the averted onsite and total averted (onsite and offsite) doses were estimated. The results are summarized in Tables 4.2.4.2(A) and (B). ( 4.2.4.2.3.2 Impact Estimates The costs associated with obtaining the capability for secondary-side blowdown are very plant specific. Some plants may already have sufficient secondary relief capacity, sources of water, and methods to deliver the water to the steam generators (without use af the main or auxiliary feedwater systems). In those instances, there would be no costs for this option. As indicated by the Harris study, a number of plants may not have sufficient relief valve capacity or available sources of water. This study assumes that an expenditure of approxi-mately $3 million is needed to upgrade the capability although the cost could [ be significantly greater. Upgrading the condensate system or providing an alternative system to deliver the water is expected to cost much more than
$9million. Basedonanestimatedcostof$3million,thevalue-impactratios y are shown in Table 4.2.4.2(A). '
04/20/88 4-45 NUREG 1289 SEC 4 ORAFT 4/88
o Table 4.2.4.2(A) AlternaE.ive 4/2, secondary-side blowdown, results of value-impact analyses for specific PWRs Base Averted Dose Averted
- p(ca) op(ca) (person-res) Impact Onsite Value-Impact State of Case wh F&8 w Yar. Met (Gross) Costs ($/ person rec)
Plant Plant No. (per r yr) (per r yr) Offsite Onsite ($x10 5) ($x10 s) Gror,s Net (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) A w $80 1 3.40E-4 2.7E-5 81 32 3.0 .60 3.7E4 2.1E4
$ cinder FSB B As A 1 3.06E-4 7.0E-5 554 79 3.0 2.27 5.4E3 1.2E3 C As A 1 7.7 -5 2.8E-6 9 3 3.0 .10 3.3E5 2.4E5 D As A 1 1.95E-4 1.6E-5 27 18 ,3.C .49 1.1ES 5.6E4 2.>n6 3. 7%
$ Column 7 = Averted Onsite Dose - Installation Dose Column 8 = Installation Costs + Operation and Maintenance Costs + Replacement Power Costs During Installation Column 9 = Replacement Power Costs + Loss of Investment + Cleanup Cost Column 10 = Col 8/ Col 6 Column 11 = (Col 8 - Col.9)/(Col 7 + Col 6) E = c. 3 - CD 4.; a -
o Table 4.2.4.2(8) Alternative 4/2, secondary-side blowdown, results of value-impact analyses for
- specific PtNts in teres of "specific net benefit" using monetized radiation dose S
$ Base Averted Costs State p(ce) op(ce) Offsite Net Onsite Impact of Case 5 F&8 w Var. (PW) (PW) Gross Specific Net 8enefit P1.nt Plant No. (per r yr) (per r yr) ($x10 8) ($x10 8) Offsite Total _(1) (2) (3) (4) . (5) (6) . (7) (8) (9) (10) A w 580 1 3.40E-4 2.7E-5 .047 .619 3.0 .984 .778
& amia. FSB 8 As A 1 3.06E-4 7.0E-5 .333 2.32 3.0 .889 .144 2
C As A 1 7.7p-5 2.8E-6 .005 ,
.102 3.0 .998 .%5 0 As A 1 1.95E-4 1.6E-5 .016 .501 3.0 .995 .828 4 Notes: ,
i " Column 6 = Present worth of Averted Offsite Dose Monetized at $1000 per person ree Column 7 = Present worth of Averted Onsite Dose Monetized at $1000 per person-ree Column 9 = (Col 6/ Col 8) - 1.0 Coleann 10 = [(Col 7 + Col 6)/ Col 8] - 1.0 E . y . O $ ~ N a Jm O A t . 2 .
The above analysis indicates that, for plants that currently do not have the ( capability for secondary-side blowdown, the expenditure of additional funds to achieve this capability is not justified. Since this capability would be used only in the event that all feedwater is lost and since it is still questionable whether the water could be delivered to the steam generators by alternative means if offsite power is not available, this option is not considered a practical method of resolving this issue. 4.2.4.3 Containment Venting For BWRs , t 4.2.4.3.1 Existing Capabilities A severe accident management strategy including venting of the containment l atmosphere as a last resort to save the containment is being implemented on many BWR plants (Reference 15). Existingharyareisbeingusedasavailable. l Staff guidance'(as documented in Reference J acknowledges that controlled [ venting of the containment by an operator is preferablehr ':::d MA-ee
^ *
, ! %:i N :f of an uncontrolled containment rupture. w ._
- M&
As indicated in References 15 and 16, the BWR Owners Eroup (BWROG) Emergency 4 Procedure Guidelines (EPGs) call for containment venting as the last resort in a sequence of procedural steps involving operator actions to reduce containment kt pressure. The staff SER on the EPGs (Reference 15) recommended an interim limit of twice the containment design pressure for venting, with the understanding that more precise analyses may be used on each plant to establish a venting pressure limit. These plant-specific analyses could consider containment inte-grity structural tests, purge valve operability, and leaktightness of gaskets i and seals. BWR licensee responses to date (mostly from near-term operating j license applicants) have shown mixed success in implementing this containment venting strategy. Typical proposals (Reference 17) establish a venting pressure somewhat lower than the interim limit of twice the design pressure (1.3 x de-sign) owing to difficulties in demonstrating vent valve operability and the desire to ensure continued availability of safety / relief valves at these higher containment pressures. Safety / relief valve availability in this case refers specifically to the pneumatic supply pressure requirements for the automatic 04/20/88 4-48 NUREG 1289 SEC 4 DRAFT 4/88
depressurization system (ADS) safety / relief valves (SRVs). Since ihe SRVs re-4 g quire a pneumatic system differential pressure (above containment pressure), - the defined venting pressure would ensure that the SRVs will be operable if called upon. The NRC staff initially encouraged utilities to remain within the general intent of the staff interim limit (i.e., that of an imminent threat to l the containment structure) pending follow-up reviews of generic EPG updates
! that could change this objective. Subsequent submittals (see Reference 18 for i example) have proposed a methodology for the determination of the venting limit that includes a consideration of sizing criter'a for the vant lines (e.g.,
capable of removing decay heat 10 minutes after reactor shutdown); however, the j details and application of this methodology had not been reviewed by the NRC !, staff at the t'.me of this publication. In summary, some limited capability to vent containment probably exists at most BWRs; however, this capability varies from plant to plant'with the greater flexibility (understandably) present in the newer plants. Operating reactor considerations on implementing the emergency p ocedure guidelines for venting r were underway but not complete at the time of this publication. A typical pro-( posal receiving interim approval is shown in Table 4.2.4.3. As shown, vent l paths consist of a number of existing lines, which may range from a 2-inch sup-pression pool vent line to a 24-inch purge line. N Table 4.2.4.3 Typical containment vent paths Venting the primary containment would be initiated at 70 psig (containment pressure limit) using the following vent paths in the indicated order of preference: 2-in. Suppression pool vent to SGTS 2-in. Orw ell vent to SGTS 6-in. ILRT line from supp. pool 4 18-in. Supp. pool purge ! 24-in. Supp, pool purge 4-in. Drywell sump drain lines (2) 24-in. Drywell purge in, drywell supply 6-in. ILRT line from drywell Containment design pressure ano ultimate structural capability are 55 psig
- and sig, respectively.
l T ection of the lines to be opened and the sequence of opening the lines W w h m .'. M nn the basis of fission product retertion and the potential i for adverse containment environmental effects. 1 l l 04/20/88 4-49 NUREG 1283 SEC 4 ORAFT 4/88 k
, t USI A-45 case studies on two operating BWR plants (References 19 and 20) have
( indicated that it is reasonable to allow limited credit for containment venting i in certain severe accident sequences. Certain of these accident scenarios have l also assumed the availability of a last-resort makeup pump (e.g., a diesel fire j pump or safe shutdown pump) for manual recovery of core inventory. It is also noted that the A-45 PRA studies assumed DC-controllvd air-operated containment j vent valves. Some capability for air-operated purge line valves is expected to exist; however, the extent of this capability (as well as makeup capability) is i plant specific. Both Reference 19 and Reference 20 assumed that the probability of not performing containment heat removal by manual venting was 0.1. When the i need for supplemental makeup existed in conjunction with venting, the recovery l action unavailabilities of 0.8 and 0.5 were assumed for References 19 and 20,
, respectively. The effect of these assumed values of unavailability on core melt j frequency is discussed in Section 4.2.4.3.3. The next section describes a more
- recent proposal on GESSAR-II for an upgraded containment venting system.
1 4.2.4.3.2 Upgraded Capabilities l
- s.
- 1 More forward-looking designs incorporating containment venting as a means of l long-term decay heat removal are being studied. A d9 sign feature called the Ultimate Plant Protection System (UPPS) has been incorporated by General Electric .
I in their standardized plant design, GESSAR (see Reference 21). This design feature would:
- 1. Provide an independent means to depressurize the reactor vessel, I
/ 2. Provide low pressure coolant injection from existing diesel-driven fire '
( protection system pumps and through a connection that enables a hookup i to a fire truck,
- 3. Provide long-term heat removal by venting the containment.
i 1 i Dedicated air bottles will be used to provide motive power for air-operated
) injection valves as well as for operation of the safety / relief valves that must !
l be used to depressurize the plant before injection from the low pressure fire
! pumps. Air-operated containment vent valves will also be included to permit !
l
}'
heat removal from the containment. General Electric has incorporated UPPS into (
; the GESSAR-II design; however, because of the preliminary nature of this design, t I the staff did not arrive at definitive assessments of the system's performance j and capabilities. This design has a decay heat removal capability based on a l total station blackout for 2 hours using the RCIC, after which, if offsite or f 1 i emergency AC power were not restored, no further conventional means would be l I
f available to provide makeup to the reactor vessel (Reference 22). At this point, i the UPPS would be initiated by manual action to open the safety / relief valves (SRVs) to depressurize the primary system below the delivery head of the plant f
)g fire pump. The air-operated valves would be manually realigned and the fire l i f 04/20/88 4-50 NUREG 1289 SEC 4 ORAFT 4/88 l
pumps started by their dedicated battery supply. Utilizing local level a.d I pressure instrumentation, plant operators would provide low pressure makeup - flow to keep the reactor core covered. Steam flow from the vessel would be directed by the SRVs to the suppression pool. Containment vcnt valves would be opened to control containment pressure and allow heat rejection from the sup-pression pool by boiloff. The UPPS is not specifically designed for special emergencies such as seismic ev'ents, fires, and floods, although it is possible that there could be some benefit for these emergencies. The UPPS is designed to be totally independent of existing AC and DC power systems and the emergency core cooling systems, Incorporating a system such as the UPPS into an initial plant design will car-tainly have cost ans implementation advantages. However, for the operating BWRs being analyzed for USI A-45, the advantages of UPPS over any other DHR system are less clear. The UPPS could not be as efficiently integrated into the existing plant design as is the case in the GESSAR design. However, keeping in mind from the previous section that some capability already exists for venting and is being implemented (including use of existing fire pumps for backup core ( cooling - ree Reference 16), it is expected that the basic features of the UPPS function are now present on many BWRs (depressurization, makeup, venting). The status of existing equipment qualification (motive power, seismic, etc.) would require a plant-by-plant evaluation of the current design variations. The UPPS controls and components would be housed in a separate structure that would be unique for each plant and does not currently exist. 4.2.4.3.3 Value-Impact Analysis 4.2.4.3.3.1 value Estimates for Risk Reduction As indicated in Section 4.2.4.3.1, some consideration of credit for containment venting was given in the BWR case studies (References 19 and 20). Although a specific value-impact analysis for containment venting was not conducted in these references, the observation was made that the overall effect of recovery credit (manual actions) was to reduce the internal event core melt probability by approximately a factor of four (Section 2.6.1 of References 19 and 20). For 04/20/88 4-51 NUREG 1289 SEC 4 ORAFT 4/88
these two PRA studies (;1 ants E and F), recovery actions are defined as those manual actions that rvstore failed safety-related equipment or safety functions. Such actions include using alternative flow paths or electrical configurations, restoring equipment from test or maintenance procedures, and performing emergency procedures such as containneat venting. Failure to perform a recovery action after certain combinations of safety system failures have occurred'was assumed to result in core damage. Appendix B of References 19 and 20 may be consulted for a more detailed discussion of each recovery action. Using the ground rules described in these studies, which tended to limit the severe accident scenarios that gave credit for containment venting (for example, the possibility of vent-ing subsequent to core melt was not considered; also, core melt frequencies for . special emergencies were assumed not to change), these PRAs report that contain- . ment venting has relatively little effect on core melt probability or risk. It was estimated in References 19 and 20 that, if no credit for venting was given in the studies, the total core melt frequency would increase by less than 30 percent. An inspection by the staff of the dominant internal event cut sets for each PRA study was made in an attempt to verify this small increase. After subtracting credit for containment venting in all the dominant cut sets but (. retaining credit for the other manual recovery actions, the total core melt frequency is determined to increase by a value closer to 50 percent in the study of Reference 20. This increase in total core melt frequency for plant F was due solely to the increase in internal event core melt frequency (an increase of about 75 percent). These combined results are shown in Tables 4.2.4.4(A) and (8). These tables show that the reduction in core melt frequency due to containment venting is 2.2E-04 for plant F and is 6.0E-05 for plant E. An inspection of Table 9.4a in References 19 cnd 20 shows that this change in core melt probability (central values) is comparable to the change produced by some,of the other referenced alternatives considered for USI A-45 resolution. A repeat of the value-impact method described in Section 7.2 of References 19 and 20 for offsite dose was performed to estimate the influence of containment venting on public risk. Table 7.3 in both referenced reports provides a summary of each accident sequence type for each internal and external sequence. The new internal event core melt probability contributions for er.ch sequence type were then calculated. The new total core melt probabilities (internal and special emergencies) for each sequence type (with and without credit for 04/20/88 4-52 NUREG 1289 SEC 4 DRAFT 4/88
m ~ [4~ vem+i , g Table 4.2.4.4(A) Alternative 4/3, containment venting, results of value-impact analyses for specific BWRs s E! Averted .' g State Base g(ca) Averted Dose Impact Onsite Value-Impact of Case (cm) War. (person res) (Gross) Costs ($/ person-res) Plant Plant No. (per r yr) (per r ys ) Offsite Net Onsite ($x10 ') ($x10 8) Gross Net (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) E CV1 2.6E-4 6.0E-5 1723 68 1.053 1.78 611 <0 Con . CV2 2.6E-4 6.0E-5 1723 68 2.053 1.78 1192 152 Venting F CVI -4 2.2E-4 1661 202 1.027 4.77 618 <0 CV2 4,6E-4 2.2E-4 1661 202 2.027 4.77 1221 70 Venting 6.4 Notes: Column 3: CV2 = CV1, except the installation costs are assumed to be double Column 7 = Averted Onsite Dose - Installation Dose t $ Column 8 = Installation Costs + Operation and Maintenance Costs + Replacement Power Costs During Installation Column 9 = Replacement Power Costs + Loss of Investment + Cleanup Cost Column 10 = Col 8/ Col 6 Column 11 = (Col 8 - Col 9)/(Col 7 + Col 6) N c2 U m s. O 4 t g . .
1
)
Ml0 Y& . g Table 4.2.4.4(8) IAlternative 4/3 containment venting, results of value-impact analyses for g specific IMts in terms of "specific net benefit" using monetized radiation dose R @ Averted Cost State Base (ca) Offsite Net Onsite Impact of Case (cs) a r. (PW) (PW) (Gross) Specific Net Benefit Plant Plant No. (per r yr) (per r yr) ($x10 8) ($x10 8) Offsite Total (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) E Aw CV1 2.6E-4 6.0E-5 1.034 1.82 1.053 -0.02 +1.71 CCont. CV2 2.6E-4 6.0E-5 1.034 1.82 2.053 -0.50 +0.39 Venting F CVI -4 2.2E-4 0.975 4.89 1.027 -0.05 +4.71 on . CV2 2.2E-4 0.975 .4.89 2.027 -0.52 +1.89 Venting 0Q. -4 Notes: Column 3: CV2 = CV1 except that the installation costs are assumed to double Column 6 = Present worth of Averted Offsite Dose Monetized at $1000 per person res Column 7 = Present worth of Averted Onsite Dose Monetized at $1000 per person-rm Column 9 = (Col 6/ Col d) - 1.0 Column 10 = [(Col 7 + Col 6)/ Col 8] - 1.0 E - =, c U - 3 - CD
$kh . g . s, ,
&ilf. '
i
,. .- 5 .: i containment venting) were then mu1Itip1' led by their associated containment f
. , I failure mode probabilities. Next,4t;he, core melt probabilities that contribute to each release category were summed.pThe release category probabilities were then multiplied with the site possis)ation_dese' obtained from CRAC-2 in Refer-ences 19 and 20. The expectatiovy hofeashcategoryarethensummedto f
obtain an overall offsite expectattert deae for each of the two pla*nts. Before ' allowing ' credit for containment M..a,ig7. Its ,the overall offsite expectation dose 1 for plant E is 330 person-rem per r yy. After credit for containment venting, the overall offsite expectation dose is 252 person-rem per r yr. Therefore, the averted offsite do'es per reactor year for ptant E is 70 person-rem. This is 1723 persor.-rom over the 22 years of. remaining operatf or. This latter value
]
for plant F is 1661 person-rom. .' . i These estimates of offsite doses consider en1) the change resolting from the , reduction in core damage frequency that improtements in containment venting L would be likely to produce. However, containment venting can also protect the containment even after severe damage or melti g of the
- ore has occurred. Con- l
.. tainment venting can reduce the containment faiiure mode probabilities and ;
the consequences of these failures modes. These expectation values of offsite I do:es may therefore be underestiestes of the totd dose reduction that can be achieved by containment venting. i h I The averted onsite dote when credit for containment venting is assumed 16 esti-mated from the onsite dose received during an accident As described in Section 9.1.2 and Appendix L of Reference 20 for plant F, a rule-of-thumb value I of 40,000 person-res is assumed to be-the same for a core melt accident in a j i single-unit plant. ,, b References 23 and 24 provide the regulatory background for this asdumption. [ The onsite dose is then multiplief by the reduction in core melt reobability [ ap(es)0HR and by the number of years of operation remaining (23): [ l t Vi = (40000) x ap(cm)DHR
- 2 Vi = (40000) x (2.2E-04) x 23 ,
\
Vi = 202 person-rem I l 04/20/88 4-55 NUREG 1289 SEC .1 DRAFT 4/E8
r
.Therefore, the total averted dose for nt F (offsite and onsite) is 1863 f person-rem. A summary of the averted dose values is provided in Table 4.2.4.4(Ai for plants E and F. These results can be compared to the central values for (
the five alternatives described in Table 9.6* of References 19 and 20. However, , it should be noted that such a comparison should be made with caution since the base case for this venting study is not exactly the same as the re'ferenced ! Alternative 1 through 5 studies. The venting base case is analogous to the f referenced Alternative 1-5 base case minus credit for containment venting. A f more accurate comparison involving new base case- for all five referenced i.1ter- ! natives would probably artificially increase the value of each proposed modi- i ficatior,. Like most of the other referenced alternatives, negative values for '
. containment venting due to installation dose and inservice occupational dose were considered to be negligible. The next section describes an assestment of costs associated with containment venting. ;
With regard to the base case selected for the containment venting study, one l sight argue that starting with an assumption that no containment venting exists !
, is not realistic since some capability is known to be present. The ap(cm) and ;
h therefore the overall value-impact ratios would change for a given venting upgrade depending on the amount of credit initially assumed for the venting [ recovery action. For example, let us allew the ant F base case in Sec- , tion 4.2.4.3 to change from a situation of "no vent capability" to the situa-t tion of credit for venting to the degree assuned in the Reference 20 PRA (fail- ! ure, probabilities of 0.1 and 0.5, see Section 4.2.4.3.1). If we now a:.sure that the $1 million per plant would even further reduce these failure probabil- ( ities (say, to 0.01 and 0.05), the new internal event dominant accident sequen- ( ces shown in Table 5.1 ' Appendix 8) of Reference 20 would pro 1uce a new total f p(ca) of 2.25E 4 per r yr. The resulting change in core inelt frequency reduc- ! tion (2.06E-4 per r yr) is now less than for the ca% where no inhial venting 7 capability is assumed (2.17E-4 per r yr). It is to :a expectwd that allowing the initial base case more credit for venting capability would show a given j venting upgrade to be less cost effective. I
- Note that the alternatives referenced are different from those cu.sidered l herein (see Section 3). l L
1 04/20/88 4-56 NUREG 1289 SEC 4 DRAFT 4/88 l r
'4.2.4.3.3.2 Impact Estimates l
1 As indicated in Section 4.2.4.3.1, the hardware used in allowing credit for containment venting in the PRAs of References 19 ano ;'o v. assumed to exist at the plants along with the emergency proceduras and tran - n taed to instruct the operations staff. If this is true for all BWRs, the t averted dose presented in the preceding subsection ft.. each plant has , agible cost impact. The credibility of this' assumption is helped by the knowledge that ongoing implementation of contsinment venting emergency procedures (Reference 15) should eventually take place on many BWRs. However, since the intent of the existing emergency procedure guidelines is to prevent imminent containment rupture, it is reasonable to expect that the scenarios using containment venting for decay heat comoval in the studies of References 19 and 20 would necessitate a reconsideration of the actual venting criterion (as used in emergency prccedures). In addition, it is not unrea-sonable to assume that some hardware optimization would be needed by some plants
- to ensure that components were consistent with PRA assumptions. Total hardware costs of $1 million per plant were arbitrarily selected to bound any system optimization needed. The methods described in Section 9.2 of References 19 and 20 for assessing further costs were followed. The work associated with any needed hardware optirtization was assumed to be performed outside radiation areas (occupational do.e during installation = 0). Annual operation and maintenance costs over what already is being (or has been) implemented were assumed to be minimal and set equal to the lowest value of the five OHR alternatives identi-fied in Table 6.2 of References 19 and 20. Tables 4.2.4.4(A) and (B) include a summary of the impacts associated with a conservative (but arbitrary) assump-l l
tion of a $1 million system optimization (the CV-1 values). A sensitivity study l of doubling the installation cost to $2 million per plant is provided for com-l ! parison (the CV-2 values). For ant E, the value-im act ratio based only on I offsite cost is $611 per person-rem for CV-1. For nt F, the value-impact Y ! ratio based only on offsite cost is $618 per person-rem for CV-1. Therefore, the 5 numbers suggest that limiting hardware costs to any upgrades necessary on I existing systems to those needed to produce the risk reductions calculated in References 19 and 20 ($1 illion per plant) h cost effectivo. Doubling such costs ($2 million per plant) is shown in Column 10 for CV-2 to be still l 04/20/88 4-57 NUREG 1289 SEC 4 ORAFT 4/88
approximately cost effective. Averted onsite effects'due to an accident are i also presented in Table 4.2.4.4(A) and show that these cest-benefit numbers . become.even more favorable (Column 11). As shown in the Specific Net Benefit column of Table 4.2.4.4(B), including the averted onsite effects would negate the preceding cost estimates of the upgrade, translating to an overall cost savings, - 4.2.4.3.3.3 Other Factors for Containment Venting As discussed in Section 4.2.4.3.2, more forward-looking designs incorporating containment venting as a means of "13 cay heat removal are being studied. The described UPPS system has had a lin.ited review by the staff (see Reference 22). This review included a staff investigation of cost-benefit. Estimates for the reduction of total core melt frequency and risk were obtained for the effect of UPPS on accident frequency. The addition of the GE proposed UPPS system reduced core melt frequency by a factor of 5 for internal events (from . 3.8 E-5 per reactor year to 8.2 E-6 per reactor year) and reduced the public risk from internal events from about 130 person-rem per reactor year to about 30 ' [.. person-rem per reactor year. The following essumptions were made for this referenced value-in. pact assessment:
- 1. The UPPS is a GESSAR-II standardized system; it is not an add-on system.
- 2. The UPPS will be manually operated.
- 3. The equipment is not seismically qualified.
- 4. The plant life is 40 years.
Reference 22 also presents the staff's estimate for overall reduction in risk due to addition of the UPPS system (internal events plus external events).
*ihis reduction is 170 person-rem per reactor year (compared to the '00 person-rem pe reactor year noted above for internal events only). Itcr:f:r:, t% /
amu c i m i u U,*"? = = oredic+ed +^ he est e##artiva
- ce&uing Ue uvi e me
~
[ 4* agency ^' '^te -a1!y in i;;d :;c-tc , M tM$ - reduction of 70 person-r per reactor year for external cents alons is noted. 04/20/88 4-58 NUREG 1289 SEC 4 DRAFT 4/88
With no design details of UPPS available to the staff, implementation costr ( quoted in the GESSAR-II SSER (Reference 22) were approximated at $1 million for the entire system. Combined with the preceding estiftate of total risk reduction after the UPPS ins,tallation (170 person rem per reactor year), a favorable cost-benefit ratio of 6.8 can be calculated. This also translates to a favorable value-impact ratio of 5150 per person-rem. The NRC staff noted in. Reference 22 that a seismic upgrade of UPPS would further reduce risk by an additional 120 person-rem per reactor ye v (see Table 4.2.4.5, which is from Reference 22) at a cost of an additional $1 million. With a total risk reduction of 290 person-rem per reactor year and a total cost of $2 million, a revised value-impact ratio of $172 per person-rem is obtained. With the preceding favorable value-impact ratio, the staff concluded that .he seismic upgrade of UPPS (com-
. bined with several other modifications less related to UPPS) was necessary to satisfy the Commission's concerns related to severe-accident considerations for future designs. Howe':er, the staff did acknowledge that the risk estimates inherently include large uncertainties, the details of which can be found in Reference 22.
' Table 4.2.4.5 Summary of values (Reference 26)
Base Seismic case UPPS UPPS (person-rem /r yr) Internal Events 130 30 30 External Events 630 560 4- ; Totals 760 590 470 , As discussed in the preceding section, considering averted onsite health effects due to an' accident produces even more favorable cost-benefit values. The onsite benefit would well exceed the staff's cost estimate of the UPPS upgrade (pages 15-26 af Reference 22). It is to be expected that implementatton of the upgraded containment venting configuration (UPPS) during the construction phase is more cost effective than 04/20/88 4-59 NUREG 1289 SEC 4 DRAFT 4/88
a backfit on an operating reactor (it has been estimated in Reference 25 that f backfitting 'na UPPS-type system, including a remote station, would cost approxi-mately $4.2 million). The conclusion is that the UPPS with* seismic upgrade is cost effective for future GESSAR designs and that backfitting containment' vent-ing (at least to the degree assumed in the Plant E and Plant F PRAs) could also be cost effective. . 4.2.5 Alternative 5 - Dedicated Hot-Shutdown Capability 4.2.5.1 Introduction . This alternative consists of the addition of an indepenMent, completely separate, d and dedicated decay heat removal system to achieve hot shutdown conditions. It involves mainly the addition of an independent makeup and cooling train to effect the transfer of decay heat from the reactor (in the ca:e of a PWR) and the suppression pool (in tha case of a BWR) to the environment. This dedicated train will meet safety grade standards except the single-failure criterion, will be located in new Seismic Category I buildings, and will have its own independent power supply (AC and DC), component cooling systems, essential service water systems, ventilation, instrumentation, controls, and ultimate heat sink. This approach involves only limited modifications and interconnec- - tions to the existing plant. The dedicated systems will be capable of automatic initiation and control for up to 10 hours without operator intervention. The new Seismic Categoiy I buildings that contain most of the dedicated system com-ponents will also contain a remote control station from which plant personnel can shut down the reactor and monitor important plant parameters in case the main control room has been damaged or occupied by third party intervention. The existing plant can be kept operating while the dedicated system is being constructed. Connections to the existing plant can be made during normal re-fueling and maintenance outages with careful planning over several outages. The principal value of this alternative lies in its independen'ce. With self-contained water supplies and emergency electric power, the system can attain significant isolation from other plar.t support systems. Therefore, it is less likely to be affected by such events as fires, floodu, or pipe breaks that may occur in other plant areas such as the auxiliary building or the pump house. 04/20/88 4-60 NUREG 1289 SEC 4 DRAFT 4/88
The dedicated system will bu, designed for 10 hours of automatic operation at - hot-shutdown conditions, which further enhances its independence by not requir-ing operc+6r action. In addition, because the system is located in its own dedicated ,ildings, strict access control measures can be enforced to provide significant protection against insider sabotage. Based on the A-45 case studies and other observations, many plants have redundant makeup or cooling trains located side by side in the same area, so that one insider has the capability through a malevolent act to disable the means to cool the plant down. Such an arrangement of plant equipment also creates vulnerabilities to internal fires and floods ia erms of disabling redundant trains. The dedicatwd system can be a generic design using conventional components and existing technology. The structure and interconnections will require plant-specific design to fit a particular site, but that should be significantly less complex than designing a number of plant-specific modifications. The experience of European countries (see Section 4.2.5.2.4) was that adding a dedicated system designed so that its construction program is essentially independent of plant operating status i's more economical than attempting to make piecemeal changes [ throughout the plant. This alternative does not have the capaallity of achieving and maintaining
- old-shutdown conditions. A dedicat'ed cold-shutdown capability is considered in Section 4.2.6.
4.2.5.2 System Descriptions Various dedicated system options were considered during the course of the A-45 program. All the options that were considered are described in detail in Reference 4 and the individual case studies. Those options that are considered to hold the most promise with respect to improved plant safety and engineering feasibility for backfitting into operating PWRs and BWRs are described below. 4.2.5.2.1 PWR Add-On System The function of this dedicated DHR system option for PWRs is to ensure core cooling and reactor coolant makeup following transientr. and small-break LOCAs. 04/20/88 4-61 NURCG 1289 SEC 4 ORAFT 4/88
This alternative consists of single trains of emergency feedwater and primary ,( makeup housed within a Seismic Category I structure. Core cooling is accom , plished by injecting emergency feedwater into the steam generators and releasing
# steam via dedicated atmospheric dump valves. Reactor coolant system pressure y is maintained by one group of pressurizer heaters and the emergency primary \
uakeup system, which can also supply makeup water for small-break LOCAs. A schematic diagram is included in Figure 4.2.5.1. The Add-On Decay Heat Removal System (ADHR) is self-contained within the ADHR tank building and ADHR structure. These additional st.actures would be required because existing structures do not have space to house the new equipment. The feedwater and makeup lines use spare penetrations and are connected to the existing plant systems inside the containment. The ADHR tank building houses one large (approximately 100,000 gal) condensate storage g fg e,mergep feedwater and a borated water storage tank (approximately 120,000 gal). ebr ' the ADHR tank building and the ADHR structure in Reference 4. Both structures are Seismic Category I and, in addition to housing the components identified herein, they provide missile protection (turbine and tornado). The [ structures desc.ribed here are not "bunkered" in the sense of being designed to withstand aircraft crashes, gas cicud explosions, or attack by saboteurs. The tank building is connected to the ADHR structure, which houses a single-train motor-driven feedwater pump, a single-train motor-driven primary makeup pump, a diesel generator complete with all auxiliaries, and the power, control, and systems necessary for operation. To ensure diversity from tne normal a : p ,ds systems, the dedicated system should use components of a different size and manufacturer. The normal power supply is offsite power via the switchyard and a 34.5/4.16 kV i - stepdown transformer located outside the ADHR structure. Power and control distribution are provided by way of the 4160 V and 480 V switchgear located within the ADHR structure. The diesel generator is aligned for automatic start and load transfer on the loss of offsite power. Diesel cooling is provided through a closed-loop service water system arranged to transfer jacket water and lube oil heat to the atmosphere via a service-water-to-air heat exchanger (radiator) located within the ADHR. Diesel air intake and exhaust systems are protected from missiles as are the inlet louvers and exhausts of the diesel 04/20/88 4-62 NUREG 1289 SEC 4 ORAFT 4/88
o -. - s ( . L a.
,: $ :: P ' *
+
c a -
;, C
!8"s$ %
@=e { g.
5 e- t .
- r, 3 lI g$ 1;@ ::8I%
m E t
<i. v g m -
=
fE2 l5 Q$ l :
& 53 9
'Pi!g 1 C -
.x ! .,
s"+
.e I ya :~: h.
= 1 u ;
em = a g =. n! s m: - e b*1 s e".s. p._ m:. ~pI =
.s
;! 1-tan,a, s
( ,,
.2 n
o
.I n
u
+ E g
=
1
.s 5.-
e ac y & ) e
.r .. .
~ _
x< x
.i
~ e .
/ g ..- * ,
( w p
-- g m .
'r e - E l
'g g 3l n Q',
= x - .s % g l
5, .* -
= & f' 8l e .
! ; i8 c j gJ gJ s g n Ej s!, p!
= P. e i, ,s a- = a l E *
, I .1 1 C I
i i 04'/20/88 4-63 NUREG 1289 SEC 4 ORAFT 4/88
1 room air-cooling system. Component heat loads are removed through the dedicated building ventilation system. A more complete cystem description of this alter-native is provided in Reference 4 and the individual case studies. 4.2.5.2.2 BWR Add-On System The function of this dedicated system option for BWRs is to ensure core makeup and suppression pool cooling following transients and small-break LOCAs. This BWR Add-On Decay Heat Removal System (ADHR) provides suppression pool cooling and high- and low pressure reactor vessel injection. The system consists of a single train with a high pressure injection pump in parallel with a low pressure pump used for suppression pool cooling or low pressure injection. A common
*-. suction line is connected to the suppression pool suction line of the existing RHR system in the wetwell area. Both pumps share a minimum flow recirculation line that is connected to the suppression pool cooling return line in th6 torus area. A schematic diagram is included in Figure 4.2.5.2.
The low pressure pump discharges through the A0HR heat exchanger and then branches into a suppression pool cooling return line and a low pressure injec-( tion line. The suppression pool cooling return ties into the existing suppression pool spray line in the wetwell area. The common injection line ties into the existing plant feedwater piping inside the outboard containment isolation valve. The high pressure makeup pump discharges directly to the common injection line bypassing the ADHR heat exchanger. Each injection line is equipped with its own level-control valve. The system is equipped with valves to allow the use of both pumps simultaneously: the low pressuco pump for sup-pression pool cooling and the high-pressure pump for injection. Diversity of the dedicated system will be ensured through use of components that differ in' size and manufacturer from those of the normal safeguards systems. The Add-On Decay Heat Removal System is self-contained within the ADHR building and ADHR pump house. The ADHR pump house is located at the ed'ge of the ultimate heat sink (river, lake) and contains the ADHR service water pump, pump d'scharge control valve, and service water system discharge isolation valve. The ADHR building houses a single-train ADHR pump and ADHR heat exchanger, a high pressure
- injection pump, a diesel generator with all auxiliaries, and the power, control, 04/20/88 4-64 NUREG 1289 SEC 4 DRAFT 4/88
and service systems r.ecessary for operation. The locatien and equipment arrange-( ments of the ADHR building and pump house are shown in Reference 4 for some , typical plants. Both structures are Seismic Category I and, in addition to housing the components identified herein, they provide missile protection (tur-bine and tornado). As with the PWR add-on buildings, the structures described here are not "bunkered" in the sense of being designed to withstand aircraft crashes, gas cloud explosions, or actack by saboteurs. Thenormalpowersupplyisoffsitepowerv'athes.[itchyardanda 34.5/4.16 kV stepdown transformer located outside the ADHR building. Power and control dis- - tribution are provided by way of the 4160 V and 480 V switchgear located within
; the ADHR building. The diesel generator is aligned for automatic start and
\
load transfer on the loss of offsite power. Diesel cooling is provided from the ADHR service water system. Diesel air intake and exhaust systems are pro-tected f'.om missiles as are the inlet louvers and exhausts of the diesel room air-cooling system. The ADHR buildings have their own separate, dedicated ventilation systems to remove component heat loads. 4.2.5.2.3 Dedicated Primary Blowdown System for PWRs This dedicated primary blowdown system (DPBS) concept is described in detail in Reference 26. A schematic diagram for the system is shown in Figures 4.2.5.5 M) and (B). The main components of the system consist of primary systerr. blowdown lines with control valves, a blowdown flash t ok wit.h a condenser and after-cooler, a high-head return pump, cold-leg return lines, a reactor water storage tank and transfer pump, a service water system, and a separate AC/DC power source. Since the steam generators are not relied on for decay heat removal, l this system is diverse from the normal safeguards systems. The OPBS components would be enclosed in one or more Seismic Category I structures located outside containment to provide increased protection against fire, flood, seismic events, environmental qualification concerns, and insider sabotage. Bunkered structures are not part of this system concept. I The proposed system would permit manual blowdown of the primary system to the blowdown flash tank, with integral spray cooling, via lines and blowdown valves
- connected to the hot legs. Fluid can be returned to maintain primary system i
04/20/88 4-65 NUREG 1289 SEC 4 DRAFT 4/88
^
~
o, I k l, 14 M: > " ""n e , I of' F' h2 50erptS580M POOL COOLluG I f LIK l I_ h w. ( _ POOL , IO BlVER Ameet e(AT ' 60 l l Este w sct e L k g HIGH PRESSURE PN t istusrust tLow m Llw I B i___ e s n I z E 5-I I g >@4 7Y 7 ,, 54 m Afhe PUPP U Amoet stavitt I - fg watta rure m , J k REACTOR DUILDING n Jb = n AN g Fast'ivtm i
)
N Figure 4.2.5.2 BWR add-on decay heat removal system (with high pressure injection capability) * (D . l
inventory by a condensate return pump through a heat exchanger. This closed-I cycle concept would avoid contamination of the containment that would result , from the currerit open-cycle "bleed and feed" concept and precludes concerns about associated equipment qualification. This concept might contribute toward resolution of a number of current issues and might preclude the need for other plant changes to address such issues as fire protection, flooding, equipment qualification, system interaction, and insider sabotage. A more complete de-scription of the system is contained in Reference 26. 4.2.5.2.4 European Practice and Experience on Backfitting Dedicated Systems A detailed account of the approach to backfitting reactors in Europe is reported in References 27 and 28. Several European countries have increased the safety margins in their older nuclear power plants in one or more of the following areas: small loss-of-coolant accidents (LOCAs); insufficient separation of electric cables; qualification of equipment for seismic events, LOCAs, and flooding; and inability to survive special emergencies such as aircraft crashes, major fires, gas explosions, lightning strikes, loss of the control room, and f sabotage. To overcome these problems, a decision was made by these countries to provide qualified equipment dedicated to certain functions in a new protected building rather than to upg'.*ade the capability of existing systems. This in-volves primarily the addition of extra cooling trains aimed at effecting the transfer of decay heat from the reactor and containment to the environment in emergencies where it is postulated that a large part of the existing safety systems become unavailable. These extra cooling systems are usually located in new bunkered buildings (designed for aircraft crash and gas cloud explosion) that have special rein-forcing and their own independent power supply, ultimate heat sink, ventilation, component cooling systems, controls, and instrumentation. This approach was designed to increase the overall safety of an old plant with only limited design changes in the existing plant itself. In most cases, the new cooling systems have automatic initiation and control for three to ten. hours without operator intervention. The philosophy is not to burden the operators with too much l responsibility during special-emergency conditions. The bunkered buildings are i 04/20/88 4-67 NUREG 1289 SEC 4 ORAFT 4/88 i _
ef 1 e 4 g is fg. . Is. . r t i I i u
' o M s y, b .
li 8J I l l r ' 3 L 1 i . 8I :: 2: g i
~ I,I
- L e 1, ,, .
e s % 9 , v*. ( ?* 8 l i
,,- u P, Q.
' e e
" m
, ,9 jj,e .6 6 ., "1"4 %
ei
~ .
1 . 4 l ,!!. . :1 : -- 1 g 2 3 i n : F), ,, m
) :
.o % 4
.a C.1 I nu )
'~ "~
f i 3 "1
>v -
q 3
=
. :-o .
. 3 - >
3 53,.
$I, I 1
a 4 T.E.r.ee a T E N-e
~'
c = .-.: f l
; %. .-... ,uae .. .. s . . ,. ,.. .. . ~
l [ t l d4/20/88 4-68 NUREG 1289 SEC 4 ORAFT 4/88
4 ( .!E E . , gs i!2ps! anse u [g
\x x s' s sssxs s s' sssx s s s s s s sx
> A
\ I 5
} g) s s b*
)
b ' j {\ h k[h,d
\
\ U Ig
{g 8 N
\
\
\
f
' I lil! al si E I\
3* \
\ \
\
f ^ Is I
\ liI Es aj \ . \
- r=
l r I' \ M N ( ll l !s \
\ w 5
\
\
!= '
N l$: \ g- lr L -m N ,g: h !
- 4. i 8 % v s se5 e
\ l i je \ N I I il
\ 1
\
\
u l .!,I s i s
" N
\
"' i i
I l I. s
\
~5
= j
- ==1T =- ==d.!
-t-
\ w- :
s s in a or e ,(
,. s N.
y - g q -\ T Q .g . m ss - s -s s x, ssxm E s -s -s s s -s s s , s s\ e I
, s s s s -s s -s s s s s -s s s s s s s s s s s ,
E syv q
\
\
VdWoKWdj
.. ,r
------- }X !\
i s 9 y u
\ 55 55 55 s.r., S --
\ .
\ "
IA______.-------;M l - \ l
\
\
vojvMig.. _ _____________m th. ! ss I \
\ m (
- b' E
\
\ y y h\
\ T o
[vs u \
\ ^ e--
\ .I.
I [- IS *
\ sv- \
' I'!"
g! i-E - \ b \ I{IEl o itG ' 5I"l h4/20/88 4-69 NUREG 1289 SEC 4 DRAFT 4/88 l ____.
usually provided with a remote control station where plant personnel can shut down the reactor, achieve and maintain a cold-shutdown condition, and monitor. important plant parameters in case the main control room has been damaged or is not habitable. Decisions to take this course of action were based on a combination of engineer-ing judgment, political and national sensitivities, and economics, but not on probabilistic risk assessments. As reported in Reference 28, it was found in a , number of cases that the most economical approach was to add an extra package of safety systems in a new building connected to the existing plant at a limited number of points, as opposed to local modifications and additions to existing safety-related components, systems, and structures. It was claimed that this approach can reduce costs by solving many problems it once and by minimizing the downtime needed to connect the new systems. It was concluded that, with careful planning, the new building can be built and the equipment installed in it without special plant shutdowns for this purpose. Replacement power costs, which often exceed equipment costs, are thus kept to a minimum. Reference 29 contains an example of a recent decision in Europe to backfit an operating reactor with a bunkered special emergency system. 4.2.5.3 Value-Impact Analysis The plant-specific value-impact analysis results for Alternative 5 are presented in Tables 4.2.5.1(A) and (B). The value-impact results for the primary blowdown system are not presented here because it is believed they would be similar to those for the PWR add-on system; however, a cost comparison is presented in Section 4.2.6. Results for PWRs and BWRs are presented separately. In addi-tion, results are presented that consider (1) offsite costs alone and (2) off-site and onsite costs together. Noneofthevaluo-impactratios(eithergrossornet)calculat,edforkiternatives in any of the case studies is less than $7000/per person-rem. The specific net benefit (SNB) indexes for all case study plants are such that there is less than a 10% chance of the alternative being cost effective based on quantitative considerations. Thus it is unlikely that any variation of Alternative 5 would 04/20/88 4-70 NUREG 1289 SEC 4 ORAFT 4/88 l
be cost effective unless the consequences of sabotage or a moratorium on . ( nuclear power plants are considered. - t 4.2.5.4 Other Design Considerations and Variations . Various design configurations were considered for the independent *and dedicated DHR system alternative:
- 1. Safety grade versus non-safety grade system,
- 2. Multiple trains versus a single train,
-.~
- 3. Seismic Category I structure containing the add-on system versus bunkered structures,
- 4. Cold-shutdown capability from the ADHR building versus an additional train of RHR as part of the dedicated system (see Section 4.2.6). .
f For the safety grade versus non-safety grade comparison, estimates were made of the reduction in the cost of the ADHR facility if non-safety grade equipment were substituted for safety grade equipment. The detailed cost estimates for the ADHR facilities prepared for the Plant Modification Reports were reviewed and the cost of the various equipment and commodities reduced appropriately to arrive at a total cost reduction. The reduction in the total cost of the facility was found to range from 15 to 20% depending on the length of the piping tunnels. The justification for this magnitude of reduction and the qualifica-tions on the accuracy of these estimates are discussed below. The costs of the structures, including tunnels, account for approximately 45% of the direct cost of the ADHR facility and are not affected by downgrading the equipment safety classification. This percentage varies slightly with the length of the tunnelt. The remaining 55% is related to equipment, piping, cabling, cable trays, and conduits; however, not all of that will be subject to change. Roughly 30% of this remainder (*15% of the total direct costs) involves either piping that ties into existing safety systems or the labor hours that are included for in plant work. Where the ADHR system ties into existing 04/20/88 4-71 NUREG 1289 SEC 4 DRAFT 4/88
A r o Table 4.2.5.1(A) Alternative 5, Dedicated Hot-Shutdown Capability, results { g of value-impact analyses for specific plants R
$ Averted State Base Ap(cm) Averted Dose Impact Onsite Value-Impact of p(cm) w Var. (person-ren) (Gross) Costs ($/ person-rem)
Plant Plant Var. (per r yr) (per r yr) Of fsite - Net Onsite ($x10 8) ($x10 s) Gross Net (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) A w/o B ADHR [3.6 E-4 3.36E-4 955 -88 64.16 8.47 6.7E4 6.4E4 wFp M 3. -4 2.92E-4 830 -140 64.16 7.36 7.7E4 8.2E4 8 w/o ADHR 2.6h-4 2.47E-4 1850 220 80.89 8.01 4.4E4 3.5E4 wF8 2.36E-4 2.20E-4 1650 224 80.89 7.13 4.9E4 3.9E4 C w/ogF ADHR 1.08E-4 1.01E-4 329 104 58.59 3.62 1.8E5 1.3E5 wFp 7 7E-5 228 66 58.59 2.51 2.6ES 1.9ES a D w/ogf ADHR 1.3fE-3 1.25E-3 1650 1375 59.36 38.4 3.6E4 6.9E3
, .s F58 1.79E-4 1.65E-4 218 164 59.36 5.07 2.7ES 1.4E5 m
E w/o Vent ADHR 2.5 E-4 1.62E-4 4553 -1020 89.32 4.78 1.9E4 2.5E4
;, Vent (w RCIC . E-4 1.05E-4 2951 -1080 89.32 3.15 3.0E4 4.6E4 Dep) f- W z F w/o Vent ADHR- 6. E-4 5.98E 4572 -213 69.69 13.1 1.5E4 1.6E4 E w Vent (w/o 4.37E-4 4.04E-4 3089 -468 69.69 8.85 2.3E4 2.3E4 8 RCIC - Dep)
E$ Notes: k Column 2, Fl(B = Feed and Ble d g g Column 3. ADHR for PWR is train of feedwater and f train of primary injection; for 8WR it is m E D train of suppression pool cooling and k train of injection.
% Column 7 = Averted Onsite Dose - Installation Dose Column 8 = Present worth of Installation Costs + Operation and Maintenance Costs + Replacement Power Costs & During Installation $ Column 9 = Present worth of Replacement Power Costs + Loss of Investment + Cleanup Costs -
Column 10 = Col 8/ Col 6 Column 11 = (Col 8 - Col 9)/(Col 7 + Col 6)
o Table 4.2.5.1(B) Alternative 5, Dedicated Hot-Shutdown Capability, results of value-impact t analyses for specific plants in terms of "specific net benefit" using
@ monetized radiation dose ,
D oo Averted Cost State 8ase ap(cm) Offsite . Net Onsite Impact of p(ca) w Var. (PW) (PW) (Gross) Specific Net Benefit Plant Plant Var. (per r yr) (per r yr) ($x10 8) ($x10 8) Offsite Total (1) (2) (3) (4) (S) (6) (7) (8) (9) (10) A w/og h ADH2 f3.6$-4 3.36E-4 0.57 7.60 64.16 -0.99 -0.88 w Fli8 K3. -4 2.92E-4 0.49 7.57 64.16 -0.99 -0.88 8 w/o ADHR 2.tSE-4 2.47E-4 1.11 8.28 80.89 -0.99 -0.88 wF 2.36E-4 2.20E-4 0.99 7.37 80.89 -0.99 -0.90 C s/o ; ADHR 1.08E-4 1.01E-4 0.19 3.41 58.59 -1. 0 -0.94 w gg 7E-S 0.13 2.37 58.59 -1. 0 -0.96 k D w/o, ADHR 1. 3h-1 1.2SE-3 0.83 38.6 59.36 59.36
-0.99
-1. 0
-0.34 wF 1.79E-4 1.6SE-4 0.11 S.1 -0.91 E w/o Vent ADHR 2.5 E-4 1.62E-4 2.73 3.74 89.32 -0.97 -0.96 w Vent Ir96E-4 1.0SE-4 1.76 3.53 89.32 -0.98 -0.95
- f. 77 2 F w/o Vent ADHR 6.kE-4 ~ 5.88E-4 2.68 9.22 69.69 -0.96 -0.87
?, w Vent 4.37E-4 4.04E-4 1.81 9.1 69.69 -0.97 -0.84 E
y Notes:
- Column 2, = Feed and Bleed.
M Column 3 ADHR for PWR is 1 train of feedwater and 1 train of primary injection; for BWR it is 1 train of suppression pool cooling and 1 train of injection. ,
- Column 6 = Present worth of Averted Offsite Dose Monetized at $1000 per person-rem.
E Column 7 = Present worth of Averted Onsite Doses Monetized at $1000 per person-rem plus Averted Onsite Costs. Column 9 = (Col 6/ Col 8) - 1.0. Column 10 = [(Col 6 + Col 7)/ Col 8] - 1.0. t 8 -
safety systems, it must be safety grade and seismically supported so it will ( not endanger the existing system. It cannot be downgraded. The very high labor rates associated with in plant work are mostly related to these tie-ins and also will not change when the overall ADHR system is downgraded. The other 70% of the remainder (4 0% nf the total direct costs) will be reduced by some 40-50% when the safety grade equipment is downgraded. This represents a 15-20% reduction in total direct costs as discussed previously. The impacts of the other design variations are presented in Section 4.2.6.5. 4.2.6 Alternative 6 - Dedicated Cold-Shutdown Capability
.This alternative consists of adding to Alternative 5 those features and com-ponents that would provide the capability to achieve and maintain cold-shutdown conditions. Therefore, instead of limiting the upgrade' to hot-shutdown conditions as in Alternative b, Alternative 6 would also allow for a completely independent and dedicated means of reaching cold-shutdown conditions. Depending on the capability of existing plants, this alternative for PWRs could involve f the addition of increased primary and secondary relief capacity as well as an additional train of RHR and all of the necessary support systems. For BWRs, this alternative could involve the addition of a dedicated RHR train and all of the necessary support systems.
There are two approaches for combining a residual heat removal (RHR) capability with the Alternative 5 ADHR system. One approach is to simply provide appro-priate controls within the ADHR structure so that the operators can also take control of the existing RHR system from that location. The other is to provide an additional train or trains of RHR as a part of any add-on system. These two I options are discussed further in the following sections. 4.2.6.1 Control of Existing RHR from ADHR Building It has been a frequent practice in Europe (References 27 and 28) to have pro-visions within the add-on system building for assuming control of normal plant RHR systems and taking the plant to cold shutdown. This approach generally i follows the European philosophy that the preferred condition after any incident 04/20/88 4-74 NUREG 1289 SEC 4 ORAFT 4/88
is cold shutdown with closed-cycle cooling at relatively low temperatures and pressures. However, there are several factors involved in this decision that. have to be taken into account when considering such an approach for U.S. plants. First, because of the general n + 2* approach to safety systems in Europe, there may be a higher probability that at least one train of the RHR system will be available after an accident. - Second, the RHR and necessary support systems in Europe are safety grade, which may also increase the probability that the system will be available. Finally, because of the separation and physical protection of redundant trains, there may be an increased likelihood that RHR is available even for special emergencies. In contrast, the usual safety philosophy in the U.S. is n + 1 redundancy and, although there usually are redundant trains (exceptions include a single RHR suction line supplying both 3HR systems), the RHR and support systems are not fully safety grade in some instances, particularly in cider plants. It is dif-ficult to quantitatively demonstrate better component reliability in safety-grade systems based on the existing data bases. A recent study (Reference 30) suggests that RHR reliability can be improved significantly by just reducing seismic vulnerabilities as opposed to making the RHR function fully safety grade. Taking all of thcse factors into consideration, it was considered reasonable to examine the costs associated with implem nting at least the concept of RHR control from the ADHR building. Because there is a minimal addition of new hardware, it could be a relatively low-cost addition to Alternative 5. This option will include a capability to control any or all of the redundant RHR trains from the ADHR building as well as the main control room. 4.2.6.2 Dedicated RHR Train Option In several instances in Europe (Reference 28), it was noted th,at, in spite of the n + 2 redundancy in existing systems, concern about special emergencies has led to the installation of additional RHR capability. To alleviate the problems The number of t.'ains provided is n + 2, where n is the number required to j perform the function. 04/20/88 4-75 NUREG 1289 SEC 4 DRAFT 4/88
associated with lack of independence and inadequate separation and physical I protection, an add-on RHR system as shown in Figure 4.2.6.1 will be investigated here. It is proposed that the redundancy of any such add-on would be consistent with that of the ADHR system. Therefore, the costs associated with implementing both a single-train and a dual-train system were explored. This alternative includes the subsystems for the base case ADHR system described in Section 4.2.5 plus a single train of residual heat removal, including service water and pressurizer spray. The RHR train is safety grade except that it will not' meet the single-failure criterion. It is sized to bring the plant to cold-shutdown conditions in 3 hours from normal RHR entry conditions of 300 psig and 350*F. Three hours was selected since this is the time at which the existing
\ plant RHR system is designed to achieve cold shutdown. The dedicated RHR system would be manually actuated from the main control room or the new dedicated con-trol station during or following the automatic operation period of the ADHR system. The RHR train is connected to the primary coolant system via the exist-ing RHR systein piping. All of the necessary equipment, including auxiliaries, is housed in Seismic Category I' structures similar to the base ADHR structurcs
( and a new dec.icated service water pump house. The main structure, shown in Reference 4, houses all process and auxiliary equipment and, although it is the same size in plan view as the base ADHR building, it is approximately 10 feet higher owing to the, relocation of the HVAC equipment. The tank building is identical to the base ADHR system building. The design of the service water , pump house is based on that used in conjunction with the BWR add-on DHR system. 4.2.6.3 High-Pressure RHR System for PWRs This dedicated system would permit taking the reactor from a post-scram condition all the way to cold-shutdown conditions with a single system. The high pressure RHR system would consist of a single train of equipment designed to provide closod-cycle core cooling approximately one hour after reactor shutdown. This system will utilize existing RHR system connectiuns and will be sized to cool the primary system to cold-shutdown conditions in several hours after initiation. i The cooldown rate should preclude primary system coolant voiding. A makeup I l connection is provided to maintain primary coolant inventory following a 1 04/20/88 4-76 NUREG 1289 SEC 4 DRAFT 4/88
3 ,. 2-n
? I O 8
SIS ACC 2 LJ F' f ,I 1 I LINE LOOP B I a I (OR SINILAR) , SDilR r ' - - l SERVICE WATER 4 IEAT EXCHANGER Q 4 10 RIVElt % dl S
\
l j N X I a 'g a > g4 9ei N x (3 LEG h e i E
~
INSIDE l OUTSIDE n ! s. . ! E 2-7 j g Figure 4.2.6.1 PWR add-on residual heat. removal system (long-term) E . i l l i
small-break LOCA. A schematic diagram of this system is shown in Figure 4.2.6.2. l The equipment arrangement 11 the dedicated structura is shown in Reference 4.. Service water is supplied from a dedicated pump house similar to that shown in Reference 4. 4.2.6.4 Dedicated Residual Heat Removal Capability for BWRs - As was noted under the discussion for PWRs, there are two approaches.to includ-ing a residual heat removal capability with the ADHR system. One approach is to simply provide appropriate controls within the ADHR building so that the operators can take control of the normal RHR systems from that location. The alternative is to provide additional trains of RHR as part of any add-on system The rationale and proposed actions for the first option were discussed in Section 4.2.6.1; similar actions will be taken here. Also, an independent add-on RHR system was examined for BWRs based on the arguments, presented in Section 4.2.6.2. A simplified piping and instrument diagram for an independent system is shown in Figure 4.2.6.3. 4.2.6.5 Impacts of Adding Cold-Shutdown RHR Capability to PWRs and BWRs Plus Other Options Conceptual designs for four alternative systems were evaluated for dedicated cold shutdown capability in PWRs. The four systems, including structures, ranged from $23 million to $40 million direct costs as reported in Reference 4. The four systems evaluated for PWRs are: i
- 1. Base ADHR - A single train of auxiliary feedwater and high pressure primary makeup sized for a small-break LOCA (Figure 4.2.5.1).
- 2. Base ADHR with RHR - A single low pressure residual heat removal train added to the Base ADHR system to provide cold-shutdown capabilities (Figure 4.2.6.1). This is also the option 4 described below.
- 3. Primary Blowdown System - A closed primary blowdown system utilizing a flash tank and high pressure injection pump (Figure 4.2.5.3).
04/20/88 4-78 NUREG 1289 SEC 4 ORAFT 4/88
( 4 I m am..we x 3., , 8g T$ fx' (O
. -:: e+
i ..z
.,=,3_ ;, ,,
l
< . .". .: " '.'t. . ' ,,,,,
O E 2 M $j M ->+- # wa >t fs 3 5 . di E
. r ,
- e
{
$ ! .* d E I- :
- 8 8 El sa a P
a\ b
- o-X o-X 2s i * .
m: 9., l g w i. 3
.?
w T ( J s b : e I I I a !
- viI ,
a 3
.I l j. '
T a {
. i 2
1 . 3' :1 1
.-I n.
=
3 ( O'4/20/88 4-79 NUREG 1289 SEC 4 ORAFT 4/88
- 4. High-Pressure RHR - A single train of residual he6t removal equipment
( designed ror operation at full reactor operating pressure and temperature (Figure 4.2.6.2). Table 4.2.6.1 shows a comparison of costs for the base case dedicated system and the base case with RHR capability. Also shown is the cost associated with implementing a high pressure RHR system. As discussed in Section 4.2.6.3, the high pressure RHR system would consist of a single train of equipment designed to permit taking the reactor from a post-scram condition all the way to cold-shutdown conditions with a single system. Also shown for comparison are the Table 4.2.6.1 Impacts of adding RHR capability to.PWRs - direct cost comparison ($ in thousands) Base with Primary High-pressure Base RHR blowdown RHR Structure 7,966 9,203 8,898 8,595 Equipment 5,784 7,425 6,967 5,766 Pipirg 7,150 11,800 21,035 18,831 Instrumentation 1,060 1,196 1,277 1,057 Conduit and Cable 1,212 3,359 1,811 1,499 Total 23,172 32,983 39,988 35,748 Direct Cost 23,172 32,983 39,988 35,748 Indirect Cost 19,206 27,879 33,390 29,850 Total 42,379 60,862 73,378 65,598 Contingency 10,595 15,215 18,345 16,400 Owners Cost 4,238 6,086 7,338 6,560 Escalation & AFU0C 8,580 12,094 14,582 13,036 Total 65,792 94,257 113,643 101,594 costs associated with implementing the primary blowdown system that was de-scribed in Section 4.2.5.2.3. As is evident, adding RHR capability increases the cost of the base dedicated system (hot-shutdown capabili.ty only) by about 43%. The high pressure RHR system increases costs by 54% over the base case dedicated system. 04/20/88 4-80 NUREG 1289 SEC 4 ORAFT 4/88
E _ C H1W t RP OI VEi M RRRTt FAEAP - SW - 4 . R E A V 4 n I .
'g 9 R
t I
' 7 .W O T
)
sr e t g n l o ( i n
... a r
t l a R v o E m r G e N r n n E u t. a n C x e h E l
\'i N d i
a u s e r n N o
, I -
P d
> d a
R l i R R W B D ' E 3 D . D 6 n J 2 4 e r C u a N g i 1 F C E R r XK'3O o E I E5g Mn 4 O5 g2
1 i 4.2.6.5.1 Other PWR Options
- ( .
Other additions to the base PWR ADHR system to improve the reliability or expand the capability of the system were evaluated. Several options were examined to determine the impact on the cost of the PWR base ADHR system. In order to assess the cost impact of each option, the ADHR system for case stbdy Plant A was used as the base system. The four PWR options examined are: Option 1: Increase the re*itability of the add-on system by providing redundant and separated active components to allow continued operation following a single active failure. Option 2: Increase the reliability and the duration of operation of the system by providing redundant water supplies. . ,
,. Option 3: Improve the operability and capability of the add-on system to include
( cold-shutdown capability by adding control of the existing plant RHR and ulti-mate heat sink systems from the ADHR building control room. Option 4: Improve the operability and capability of the add-on system to include cold-shutdown capability by acding RHR and ultimate heat sink systems to the ADHR facility. The rescits of the evaluations are summarized in Table 4.2.6.2. All costs are given in real dollars levelized over the remaining economic life of the plant. Costs shown are "generic" in nature and are basea on data (unit material costs, labor rates, labor productivities) consistent wi'h DOE's Energy Economic Data Base (EE08). However, the EEDB labor productivities were adjusted to account for known "complicating factors" such as accessibility, interferences, conges-tion, and the special health / safety considerations inherent in backfit work. Option 3, which adds only additional RHR control capability, minimizes hardware needs and requires no additions) structural facilities; it is the least expen-I sive of the options. Option 4, which adds an entire RHR train to the add-on 1 04/20/88 4-82 NUREG 1289 SEC 4 ORAFT 4/88
facility, is the most expensive of the options, not only because of the addi-I tional hardware and facility size required, but mainly because of the service, water pump house and additional tunnels required. Options 1 and 2, which increase the reliability of the existing add-on OHR system by adding additional equipment, require additional facilities to house them but are less costly than Option 4. . Table 4.2.6.2 PWR add-on decay heat r6moval system option comparison ($ in thousands, 1/85 cost base) Base ADHR Option 1 Option 2 Option 3 Option 4
-. o Direct cost 23,173 30,784 25,894 24,832 32,983
, Indirect cost 19,206 25,919 21,775 20,955 27,879 Total 42,379 56,703 47,669 45,787 60,862 Contingency 10,595 14,176 11,917 11,428 15,215 Owners cost 4,238 5,670 4,767 4,579 6,086
. Escalation & AFUCC 8,58Q 11,268 9,473 9,096 12,094 Total 65,792 87,817 73,826 70,890 94,257 All of these options add equipment that will result in increased operating and maintenance costs for testing and inservice inspection. Option 2, which adds only tanks, piping, valves, and instrumentation, results in the smallest increase in O&M costt The other options, because of the additional active components, require much more testing of equipment and controls. However, European experi-l ence suggests that, during tne life of the plant, the saving of outages that otherwise would have been necessary to comply with Technical Specifications requirements may be substantial and could offset some of the increase in operating and maintenance costs.
1 1 Options 1, 3, and 4 involve work in t'io existing plant beyond u.'o aquired for the base ADHR system. Option 3 does not involve significant work in radioactive i areas and therefore does not accumulate any additional radiolo'gical exposure over the base ADHR system. Option 1 requires the addition of redundant valves, l and Option 4 requires tie-ins to the existing RHR system, both of which will i result in additional aadiological exposure. The additional exposure for both options is expveted to be approximately 20-30 person-rem in addition to the 486 person-rem associated with the base modification. 04/20/88 4-83 NUREG 1289 SEC 4 ORAFT 4/88
Guidelines for adjusting the ADHR system at other pla".ts are summarized in ( Reference 4. The costs (or impacts) are broken down as actual additions for-natw facilities and independent work and plant-dependent work expressed as a percentage of the direct cost. TMse guidelines for adjusting to other plants' do not account for differences in plant size or site conditions. The effects of hardenina or '"bunkering" the PWR ADHR f acility structure agcinst aircraft impact were also reviewed and evaluated. The evaluation was not as detailed as those conducted for the options to the ADHR facility. The direct cost impact of hardening both structures for a PWR system is approximately
$725,000 or a 12% increase in the structure cost. This represents a 3% increase in the total direct cost and results in a $1,277,000 increase in the indirect costs and a $399,000 increase in the annualized costs for the entire ADHR facility. Since the structures are common to all sites, these costs may be added directly to the existing ADHR facility costs for further evaluation.
'These costs are based on average requirements for two plants with two different postulated missiles that were evaluated in the past, rather than any specific aircraft missile (Reference 4).
a 4.2.6.5.2 Other BWR Options , Other additions to the base BWR add-on ADHR system to improve the reliability or expand the capability of the system were evaluated. Several options were examined to determine the effect on the cost of the BWR base ADHR system. To assess the cost impact of each option, the ADHR system for case study Plant E was used as t'e b's system. The four BWR vp?i 6 ,o the base ADHR system that were examined are: Modified Base ADHR: Provide the capability of accepting decay heat loads immediately after loss of other cooling modes by adding a high pressure injec- , tion system to the ADHR base facility. Option 1: Increase the reliability of the add-on system by providing redundant and separated active cort.ponents to allow continued operation following a single active failure (Figure 4.2.6.4). 04/20/88 4-84 NUREG 1289 SEC 4 DRAFT 4/88
m . __ __,b. o. e eo, I _ .:::: M I
.=
s b 4 TA--cI .. A a a
'p g _._ ,, = ,
Dl : D::
, ... .' -A-N-i d-r _,
e ps X' "U Q M
$ 4 33-
'ki(-
- gl3 - I
- =* '
4 y
.-- , HP ,4 HP-e
.==
i, *m M t Xi
- e ,
d= _ , , , , 8.5 - - -
's a
- = -- ,a,- 92 I;,:
Un l - - - - i 4 b tl g -- . - .
- I l :
, I ! 2 ,
4 c- , m %. .= .. E
- US
-{I -S - %. -
m - m - o ==. m
==
a se .em. 1 M
\ 0
, rigure 4.2.6.4 BhR redundant active component ADHR system with high pressure injection s .
CD .
- __ - - . . - - _ -- ~ - _ - . . - . - - - - - , , , - - - - - - - - -- . .. .-- - --- ,
Option 2: Improve 'the operability and capability of the add-on system to
.(, include cold-shutdown capability by adding control of the existing plant RHR -
and ultimate heat sink systems from the ADHR building con *,'ol room. Option 3: Improve the operability and capability of the add-on system to include cold-shutdown capability by adding complete RHR capabilitiM to the ADHR facility. The reaults of the evaluations are summartied in Table 4.2.6.3. As is the case with the PWR options, all costs are given in real dollars levelized over the ! remaining economic life of the plant. Costs shown are "ger.eric" in nature and are based on data (unit material costs, labor rates, labor productivities) con-sistent with DOE % Energy Economic Data Base (EEDB); however, the EEDB labor productivities were adjusted to account for known "complicating factors" such 1 as accessibility, interferences, congestion, and the special health / safety ! considerations inherent in backfit work.
. Table 4.2.6.3 BWR add-on decay heat removal system option comparison 4
($ in thoussnds, 1/85 cost base) Modified base Base ADHR ADHR Option 1 Option 2 Option 3 , , Direct cost 30,891 32,118 42,063 35,264 32,460 Indirect cost 26,E93 27,634 36,128 30,365 27,927 1 Total 57,484 59,752 78,191 65,629 60,387 Contingency 14,371 14,938 19,548 16,407 15,096 Owners cost 5,748 5,975 7,819 6,563 6,039 Escalation & AFUDC 11.640 12.070 15,833 13,257 12,198 , Total 89,243 92,735 121,391 101,856 93,720 a l The modified base ADHR facility removes the base add-on system.'s dependence on existing plant systems to remove heat immediately after shutdown by providing a single-train high pressure injection system. This modification requires mini- l mum equipment, has no impact on the ADHR structures, and is less expensive than l I any of the other options. Option 1, which il; creases the reliability of the add-on system by providing redundant equipment, requiras larger facilities to l 04/20/88 4-86 NUREG 1289 SEC 4 DRAFT 4/08 .
house the equipment and is the most expensive of the options. Options 2 and 3 imorove the operability and capability of the add-on system by providing con-trol of the existing RHR system from the ADHR facility and adding complete RHR capability, respectively. These options require no additional structural facilities and are therefore less costly than Option 1. All of these options will rescit in increased operating and maintenance costs for testing and inservice inspection. However, as in the case of PWRs, these costs may be partially offset by increased availability. Options 1, 2, and 3 involve work in the existing plant beyond that required for the base ADHR system. Option 2 does not involve significant work in radioactive areas and therefore does not accumulate any additional radiological exposure over the base ADHR system. Option 1 requires the addition of redundant valves, and Option 3 requiret tie-ins to the existing RHR syste both of which will result in additional radiological exposure. The additional exposure for both - operations is expected to be approximately 100 to 200 person-rem in addition to the 1200 person-rem associated with tha base modification. Guidelines for adjusting the ADHR systeia at other plants are summarized in Reference 4. The ctsts are broken down as actual additions for new facilities and independent work and plant-capendent work expressed as a percentage of the direct cost. These guidelines for adjusting to other plants do not account for differences in plant size or site conditions. The base ADHR system was modified to include a single high pressure injection train in parallel with the existing low pressure train. This modification eliminates dependence on existing plant systems for decay heat removal im. mediately following reactor shutdown. Tnis mod'fication was deemed necessary to upgrade the BWR ADHR facility to a level comparable to the PWR system and was 17cluded in the base ADHR for both BWRs evaluated in this program. This modification was treated separately here to identify the specific changes resulting from the addition of a high pressure injection train. The resulting "modified base ADHR facility" was then used as a comparison basis for the remaining options so that adjustments to other plants would be consistent. 04/20/88 4-87 NUREG 1289 SEC 4 DRAFT 4/88 l
Comparing Option 2 to Option 3 shows that increasing the capability of the add-on system by adding a train of RHR is less expensive than making provisions for' controlling the existing RHR system from the add-on /,DHR building control room. The effects of hardening or "bunkering" the BWR ADHR building stru'cture against aircraft impact were also reviewed and evaluated. The evaluation was not as detailed as those conducted for the options to the ADHR facility. The direct ccst impact of hardening both structures for a BWR system is approximately
$556,000 or a 14% increase in the structure cost. This represents a 2% increase in the total direct cost and results in a $1,277,000 increase in the indirect * , , costs and i $288,000 increase in the annualized costs for the entire ADHR .
facility. Since the structures are common ca all SWR sites, these costs may be added directly to the existing ADHR facility costs for further evaluation. These costs are based on average requirements for two plants with two different postulated missiles that were evaluated in the,past, rather than any specific aircraft missile (Reference 4). 4.2.6.6 Values of Adding Cold-Shutdown Capability 4.2.6.6.1 (Jalitative Values Many of the primary benefits or values of providing a dedicated cold-shutdown capability have not been quantified but are nevertheless described here. Should an accident occur, it is more desirabla from a saf.ity standpoint to be in a closed-cycle cooling mode with relatively low temperatures and pressures. Hands-on maintenance and repair work can proceed once the temperatures and pressures are reduced to cold-sbutdown levels. M-intaining the reactor at 4 hot-shutdcwn levels for considerable periods of time following an accident would be a less desirat,le condition from a safety standpoint. This is because the reactor would have to be cooled in an open-cycle cooling mode by venting steam from the steam generators. Unit 2 at TMI operated in this mode for an extended period of time. As reported in Reference 28, the European view is that cold shutdown is the safest endpoint in an accident sit ation. This view has led to a high degree of redundancy and the requirement that cold-shutdown systems be fully safety grade. 04/20/88 4-88 NUREG 1289 SEC 4 ORAFT 4/88
In many plants, the equipment required to achieve and maintain cold shutdown ;
,( also suffers from lack of indecendence and inadequate separation and physical, protection of redundant trains. This is particularly true at the support system level. Redundant trains are often interconnected, and there is considerable j sharing at the support system level. Redur. dant triins of ten sit side by side ,
in the same area, making them vulnerable to internal fires, floods, and insider ~! sabotage by one person. As discussed in References 31 and 32, there have been l many events in which RHR has been lost while the reactor has been shut down. l Improved procedures and administrative co'ntrols to correct such loss-of-RHR ! events are advocated in Reference 32 and are being evaluated as part of.the resolution of GI-99. Besides improved procedures, an impreved system design configuration also m6rits consideration. If operators are working with poorly I *w configurwd systems, procedural changes, although warranted, may already have i reached a point of diminishing returns. The lack of independence, intertieing, and sharing of redundant trains of equipment complicate the operators' job. There are ample opportunities.for adverse system-interaction situations to l i arise. P*ovision of a dedicated cold-shutdown capability that is independent, l separate, and physically protected from the normal safeguards systems would l (, help alleviate the above problems and would produce (so far unquantified) benefits or values. For many plants, some of the equipment n;tcessary to achieve and maintain cold-shutdown conditions is not fully safety grade. Because of this, the systems ! may not meet the single-failure criterion and may fail under adverse environ- l i mental conditions since the cquipment has not been environmentally and seis- l mically qualified. There are environmental qualification concerns associateo ! with nuclear power plants no wered by the SEP studies. These concerns are l largely associated with the long-term decay heat removal phase. Providing l dedicated cold-shutdown capability that is safety grade and is contained within its own separate Seismic Catego.y I building would help to alleviate many of , l the concerns associated with environmental qualification issues, thereoy producing (as yet unquantified) safety benefits or valuec. l In regard to protection against seismic events at and beyond the SSE intensity I ! level, the dedicated system, including the dedicated building, would be designed j to Seismic Category I standards. For many existing plants, the support systems l 04/20/88 4-89 NUREG 1289 SEC 4 DRAFT 4/88 ; 1
,.m- - ,__ _.- ,_ _ , _ _ ,
that support the front-line safety systems and that are required to achieve hot-shutdown and cold-shetdown conditions are not entirely designed to Seismi,c Category 1 standards. The six USI A-45 PRA case studies examined seismic events at and beyond the SSE level. It was found that there is a significant seismic risk for :ome plants at the SSE level and beyond. For example, in the range cf two to three times the SSE level, there is a significant centribution tc seismic risk. However, as explained below, the dedicated system could effer additional protection for seismic events at and beyond the SSE level. l The dedicated system would be designed to a consistent and coherent set of Seismic Category I standards and would be designed to the SSE intensity level. l This would help to alleviate the problems with support systems that are designed to an inconsistent level of seismic standards. Considering the earthquake
?
intensity, it would be inconsistent to design for earthquake levels beyond the SSE because the primary. coolant system is designed only for the SSE level. However, the primary circuit still has margin to resist earthquakes beyond the SSE level. The dedicated system design would also take advantage of insights from the USI r A-46 program on seismic qualification of equipment. The A-46 studies found that most of the problems with seismic risk at and beyond the SSE level are due to equipment anchorage, relay c:atter, and seismic interactions. Recommenda-tions stemming from the USI A-46 program to alleviate these seismic problem areas would t'? used in the design of the dedicated system. For example, USI A-46 recommendations are provided on how to properly' anchor equipment, how to conduct a walkdown to identify seismic interactions, and how to select the most i seismic-resistant type and best location of relays. Accordingly, by designing the dedicated system to current Seismic Category I standards and the SSE intensity level and by paying close attention in its design to equipment anchorage, relay chatter, and seismic interactions, significant protection may be afforded , for seismic events at and beyond the SSE level. With the possible exception of l the primary coolant bound s, the capability to withstand earthquakes beyond
- the SSE level might be t .ar for the dedicated system than that for the rest of the plant.
l , 04/20/88 4-90 NUREG 1289 SEC 4 ORAFT 4/88 l
4.2.6.6.2 Quantitative Analysis - e
. Because most PRAs have not included the long-term or cold-shutdown decay heat removal phase, there is insufficient quantitat.tve information to treat this on an individual plant basis. However, a simple generic treatment is provided in Section 4.3. .
References (For Section 4.2)
- 1. "Safety Goals for the Operation of Nuclear Power Plants: Policy Statement,"
Nuclear Regulatory Commission, Federal Register, Vol. 51, pp. 28044-49, August 4, 1986.
- 2. "Implementation Plan for the Severe Accident Policy Statement," SECY-86-76, USNRC, February 28, 1986.
- 3. "Reactor Risk Reference Document," NUREG-1150, February 1987.
I 4. "Shutdown Decay Heat Removal Analysis Plant Case Studies and Special j Issues, Sunnary Report," NUREG-1292, November 1987. i
- 5. "Lessons Learned from 21 Nuclear Plant PRAs," 8. John Garrick, Meeting on Probabilistic Safety Assessment and Risk Management (PSA 1987), ANS/ ENS, Zurich, Switzerland, September 1987.
- 6. "On the Development and Application of Quantitative Methods in Nuclear Reactor Regulation," L. Cave and W.E. Kastenberg, Nuclear Technology, Vol. 71, October 1985.
I l l 7. "Statistical Abstract of the United States, 1987," 107th Edition, U.S. Department of Commerce, Bureau of Census.
- 8. "Precursors to Potential Severe Core Damage Accidents: 1980-81," NUREG/
CR-3591. [
]
04/20/88 4-91 NUREG 1289 SEC 4 DRAFT 4/88 )
- 9. "Interim Reliability Evaluation Procedures Guide," NUREG/CR-2728, SAN 082-1100 Sandia National Laboratories, January 1983. ,
- 10. Letter Report, "Shutdown Decay Heat Removal Analysis Plan," Sandia National Laboratories to USNRC, August 15, 1984.
- 11. Letter Report, "Recommended Procedures for the Simplified Seismic Risk Analysis in TAP A-45 " M.P. Bohn, Letter to USNRC, September 1984.
- 12. Letter from J.B. Mulligan (UE&C) to 0.M. Ericson (SNL), Contract No. 58-8657, "Decay Heat Removal Systems Evaluations, Updated Cost Estimate for the Addition of Dedicated Feed and Bleed System," dated July 3, 1986.
- 13. J.D. Harris, "Cooldown Peformance Capability of Atmospheric Steam Dump System," Nuclear Safety. Vol. 24, No. 4, July-August 1983.
- 14. Richard B. Jenks, "Cooldown to Residual Heat Removal Entry Conditions
- Using Atmospheric Dump Valves and Auxiliary Pressurizer Spray Following a Loss-of-Offsite Power at Calvert Cliffs - Unit 1," LA-UR-84-3947,
( December 19, 1984i
- 15. Generic Letter 83-05, dated February 8, 1983.
i .
- 16. Letter, T.J. Dente (BWROG) to D.G. Eisenhut (NRC), dated December 22, 1982.
- 17. Letter, J.S. Kemper (PECO) to Mr. A. Schwencer (NRCO), dated August S, 1984.
cEW
- 18. Letter, H.R. Edelman (646) to B.J. Youngblood (NRC), dated January 10,1985dp
'{ ~ ,] _
- 19. "Shutdown Decay He ' Removal Analysis - General Electric BWR3/ Mark 1 Case
! Study," NUREG/Ch 4448, SAN 085-2373, Sandia National Laboratories. March 1987. l ' 04/20/88 4-92 NUREG 1289 SEC 4 DRAFT 4/88
- 20. "Shutdown Decay Heat' Removal Analysis ef a General Electric BWR 4/ Mark I I Case Study," Sandia National Laboratories, NUREG/CR-4767, SAN 086-2419, -
July 1987.
- 21. Letter, G.G. Sherwood (GE) to Mr. Jesse C. Ebersole (ACRS), dated June 28, 1984. *
- 22. "SER Related to the FDA of the GESSAR-II BWR/6 Nuclear Island Design,"
NUREG-0979,* Supplement No. 4, dated July 1985.
- 23. "A Handbook for Value-Impact Assessment," NUREG/CR-3568, PNL-4646, dated December 1983.
- 24. Memorandum, H.R. Denton to All NRR Staff, "NRR Office Letter No. 16, Revision 2'- Regulatory Analysis Guidelines," October 30, 1984.
- 25. Letter, J.B. Mulligan (UE&C) to Dr. David M. Ericson, Jr. (SNL), dated September 30, 1986. .
- 26. G.A. Reed and J.H. Flacks, "Primary Blowdown for Enhanced Core Cooling of PWRs," Proceedings of the ANS Thermal Reactor Safety Meeting, San Diego, 4 California, February 2-6, 1986.
- 27. M.J. Lewis and S.N. Akson, Ed., Decay Heat Removal Systems, Proceedings of -
the CSNI Specialist Meeting, Wurenlingen, Switzerland, April 25-29, 1983.
- 28. NRC Memorandum, A. Marchese to K. Kniel, "Trip Report - Foreign Travel in Support of USI A-45 and Generic Issue A-29 Programs," January 15, 1985.
- 29. Nucleonics Week, p. 4, November 13, 1986.
- 30. "Potential Benefits Obtained by Requiring Safety-Grade Cold Shutdown Syste.as," Sandia National Laboratories, NUREG/CR-4335, SAND 84-1339, l November 1985. f I
i 04/20/88 4-93 NUREG 1289 SEC 4 DRAFT 4/88
- 31. "Decay Heat Removal Problems at U.S. Pressurized Water Reactors," AE00 I Case Study Report, AE00/C503, July 1985. -
- 32. G. Vine et al., "Residual Heat Removal Experience Review and Safety
. Analysis
- Pressurized Water Reactors," NSAC 57, Safety Analysis Center, EPRI, January 1983. ,
D4/20/88 4-94 NUREG 1289 SEC 4 DRAFT 4/88
4.3 Generic Value-Impact Analysis . ( . In this section, the plait-spacific results of Section 4.2 are translated into generic terms to provide a more representative value-impact analysis than is i possible on a plant-specific basis. The methodology is described in detail in , Reference 1, but a brief summary is provided in Section 4.3.1. Th'e generic l value terms are derived in Section 4.3.2, and the calculations are shown in J tabular form in Tables 4.3.3 through 4.3.6. The derivation of the generic impact terms is described in Section 4.3.3. The generic value and impact terms are combined in Section 4.3.4 to obtain two h value-impact indices, / munuty, the cost per person-rem averted and the "Specific Net Benefit," wt h 4 is defined in Section 4.1.2. 4 The results of the generic value-impact analysis for each alternative are shown in Section 4.3.4, Tables 4.3.7(A) and (B) through 4.3.10(A) and (B). The A tables show the results in terms of "Best Estimates" for the cost per i persor.-rem for an average U.S. site / plant combination but with no indication of the extent of the uncertainties. The B tables show the "Specific Net (,_ Benefits" and the translation of these into "Chant:e of Being Cost Effective" , l for that alternative based on the "interpretation tables" described in Section ! 4.1.2 (Tables 4.1.2 and 4.1.3). The implications of the results of the generic value-impact analys,is are discussed in Section 4.3.5.@ ~ [ ; ! Fince Sections 4.3.2 and 4.3.3 are included simply to support the results shown I in Tables 4.3.4 through 4.3.10, they may be omitted by the general reader without loss of continuity. . t i 1 4.3.1 Methodology for 1ho Generic Treatment of Value-Impact Analysis The extr.nt to which a generic treatment of the value-impact analysis is possible - l depends or. the degree of ce'h istency of the results for the USI A-45 case study l PRAs when known differences that can readily be taken into account (e.g., size i of reactor, population density out to 50 miles) have been included. In addition, because of the major differences in some of the possible alternatives that are 1 l i available for PWRs and for BWs, it is considered advisable to treat these two ji classes of reactors separately. ! 04/20/88 4-95 NUREG 1289 SEC 4 ORAFT 4/68 j i _ _ _ _ _ _ _ _ . _ _ _ - - _ - _ . . . _ _ _ _ _ - , , _ _ . _ _ _ _ _ _ _ _ _ _ _ , _ _ _ - _ . ~ . . _ , _ _ . - , _ _ _ _ _ , _ _ - _ _ - - _ . - _
4.3.1.1 Generic Treatment Based on Averted Offsite Costs - I, To convert the results cf the USI A-45 case studies to a common basis, a generic correction factor has been derived. This factor accounts for variations in population density, plant size, age, and probability of a large release. The individual factors are derived as follows: -
- 1. Population density out to 50 miles - Correction factor is:
average for U.S. sites out to 50 miles (218 per so mile) site-specific value based on Reference 2.
- 2. Plant size - Correction factor is:
average for type of reactor)0.3 plant-specific value The exponent. 0.3, reflects the observed nonlinearity in the variation of popula-tion dose to 50 miles with source size. It is based on the calculations sumarized in Reference 1. . The average size for both PWR and BWR is 900 MW(e).
- 3. Age of plant - Correction factor is:
average effective lifc for type of reactor plant-specific value where "effective life" is the remaining service life based on an initial life of 40 years of comercial operation corrected for discounting annual avertible costs at an appropriate rate (5 percent for ecoromic effects; zero for health effects). In practice, this correction factor is virtually the same for all , the case study plants. Consequently, it need not be included in the generic factor for each plant but instead can be applied in the generic value-impact calculations. 04/20/88 4-96 NUREG 1289 SEC 4 ORAFT 4/88
- 4. Probability of large release, p(r) - Correction factor for the variations in i
probability of large release is approximated by: - averace p(cm) for. type of reactor plant-specific value of p(cm) The base for estimating "average p(cm)" for this correction factor has broadened w 4 from the four PWR and two 8WR A-43 case study plants by the addition of some comparably thorough PRAs (reviewed by NRC) listed in Table 2.3.1 to a total of ten PWRs and five BWRs, including the A-45 plants of each type. The use of this broader base helps to offset the possible bias in the results
- due to the method of selecting the case study plants for A-45. The selected plants were those for which a qualitative screening process had indicated potential weaknesses in the DHR function.
The "Generic Factors" (product.of the above factors) for individual plants are shown in Table 4.3.1. The use of correction factors 1 through 3 does not intro-duce any new uncertainty; correction factor 4 is empirical, but its use is justified by the unificat'en it imparts to the "expectation of population dose" for the two samples. The results for the USI A-45 case study PRAs are summarized in Table 4.3.2. Columns (7) and (8) of the table show the annual expectations of population
! dose to 50 miles before and after the generic correction is applied.
In the case of P' irs, it was assumed for the base case estimates that a "bleed 4 and feed" capability already exists, and the quoted popal.V. ion doses are based ] on this assumption. However, in view of the uncertainties about the procedure for bleed and feed (see Section 3.4.1), two sets of generic values have been developeJ for the PWRs. , 04/20/88 4-97 NUREG 1289 SEC 4 ORAFT 4/88
Table 4.3.1 Derivation of generic factors for estimating population dose (1) Type p(r)(2) of Population Plant Siz Factor Generic - 4 Flant Plant Factor Factor (p(cm) x 10 ] Factor PWR w/o A 218/73=3.0 (900/485) * =1.2 4.81/3.6,1=1.34 4.82 F&B 8 218/211=1.03 (900/666) ' =1.1 4.81/2.65=1.82 2.06 C 218/42=5.19 (900/822) * =1.03 4.81/1.08=4.46 23.8 0 218/19=11.5 (900/836) ' =1.02 4.81/13.b0.36 4,23, 3.77
~
PWR w A 3. 1.2~ 2.21/3.13=0.71 .56
. F&B B 1.03 1.1 2.21/2.36=0.94 1.07 '
C 0 5.19 11.5 1.03 1.02 2.21/0.744= . 2.21/1.79=1.23
$59 14.4
-. BWR w/o E 218/85=2.56 (900/789) 2.67/2.5 1.0f ' 2.7f Cont.
Venting F 218/22=9.9 (900/778)h'f==1.04 1.04 2.67/6. 0.41 4. lT 8WR w E 2.56 1.04 1.54/0.99=1.5g3) 4.15 ! Cont. Venting F 9.9 1.04 1.54/2.8%0.53 .5$ BWR w E 2.56 1.04 2.22/1.97=1.12(4) 2.98 Cont. F 9.9 1.04 2.22/4.3p0.5I, 53 ( Venting Notes: (1) For the reasons discussed in Secti;n 4.3.1.1, the "age factor" has been ' omitted, at this stage, in deriving the generic factors. (2) Based on p(ca); see Section 4.3.1.1 of text. (3) Based on internal initiating events only. (4) Based on assumption that average value p(cm) for special emergencies is same with venting as without venting. From Table 4.3.2 it can be seen that:
- 1. After the corrections described above have been applied, there is reason-able consistency in the annual expectations of population dose for each class of reactor.
) l
- 2. Although y for the A-45 case studies, the makeup of the total contribution g to p(cm) attributable to events initiated by "special emergencies" varies 04/20/88 4-98 NUREG 1289 SEC 4 ORAFT 4/88 t
=
?
g Table 4.3.2 Derivation of generic parameters for value-impact analysis D R -
@ Expected p(cm) (per r yr) Offsite Dose Generic Type Type of Initiating Event (p-rem per r yr) Dose Over of Special Generic Plant Lifetime 2 Plant Plant internal Emergency Total Factor 1 Specific Generic (p-res)
(1) (2) (3) (4) (5) (6) (7) (8) (9) i PWR,w/o A 1 87E-4 1.74E-4 3.61E-4 4 .82 45 217 fjtc B -- P 1. 0E-4 1.65E-4 2.65E-4 2 s06 90 1Pf C 0.479E-4 0.60E-4 1.08E-4 23)8 15 357 D 12:3E-4 0.92E-4 13 3E-4 4 2L 81 34A a Mean8 3 82E-4 0.99E
- 4.81E-4 27f 8.2h3 1
w A 1 39E-4 1.74E-4 3.13E-4 2 ,56 39 100 a B I- 0 .71E-4 1.65E-4 2.~$E-4 1 ,07 80 86 4 C 0 14E-4 0.6E-4 0.74E-4 15 ,7 10 IST D 0 88E-4 0.92E-4 1.79E-4 14,4 11 158 Mean2 1 ,34E-4 0.87E-4 2.21E-4 12 6 3.7E3 BWR w/o E 1 58E-4 0.98E-4 56E-4 2 ,76 335 $8 Cont. F 5 0$-4 1.48E-4 2.M-4 6 4.$8 215 9073'ff x Vent. g Mean8 1 .98E-4 0.68E-4 2.67E-4 , 913 2.74E4 c2 y BWR w E O ,99E-4 0.98E-4 1.97E-4 2[98 248 739
@ Cont. F -- D 2.,8%-4 1.48E-4 4.37-4 5 144 99175)
- Vent N
Mean8 . 1.54E-4 I 0.68E-4 2.22E-4 790 N G 2 44 Notes: YN_ ~
/ '
y 1. From Table 4.3.1 - Q 2. Generic plant lifetime 30 years (undiscounted)
. 3. Mean p(cm) from all available "reliable" PRAs (see Table 2.3.1); represents best available sco generic value.
from one plant to another, the total contribution varies over a relatively 'i narrow range (0.6 x 10 4 to 1.8 x 10 4 per r yr). The ratio of the con , l tribution due to internal initiating events to that arising from the "special emergency" events shows a larger spread (factor of 2 greater). The mean value of the ratio is 0.78. - The data of Table 4.3.2 can also be used to obtain the weighted test values of the SNB index for a combination of both types of initiating events as indicated in Section 4.1.2. Some perspective on the Itkely cost effectiveness of the l possible alternatives can be obtained as described below. The generic values for p(cm), effective plant life, and the annual expectation .
*^
of population dose in Table 4.3.2 can be used to obtain best estimates for the maximum cost-effective expenditure on modifications that can be justified on the basis of averted radiological costs (1.1., the present worth of the expec-tation of conventional offsite dose monetized at $1000/ person-rem). (These maxima correspond to those modifications that lead to a reduction of more than, j say, 90% in p(cm).) Averaged over the total U.S. population of PWRs and BWRs, ( these limits are: l
- 1. PWR without bleed & feed capability -
$3.7 x los per plant
- 2. PWR with bleed and feed capability - $1.7 x 10s-per plant j
- 3. BWR without containment venting -
$12 x 108 per plant
- 4. BWR with containment venting -
$10 x 10e per plant I o
Thus the limit of cost-effective expenditures is in the range of $2 to 10 iatilion considering only averted offsite costs. For any specific alter-native, the value and impact terms are known for the case study plants. The < value terms can be converted into the generic form by means of the correction factors described above (Tablis 4.3.3 through 4.3.6). In principle, the impact term should also be corrected for plant size and local labor costs to obtain ' generic values. Ia practice, however, the plant-specific gross impacts averaged over the appropriate case studies have been used. Generic V/I indices can then be obtained from these values for the suggested alternative. These will be best-estimate values based throughout on means and thus can be tested for cost effec-tiveness by means of the interpretation tables (Tables 4.1.1 through 4.1.5) l l 04/20/88 4-100 NUREG 1289 SEC 4 DRAFT 4/88 I
o
.[ .
- s l .
g 14 ale 4.3.3 Ceneric value terms for Alternattwe 3. Applicatloc of Specified System sendifications (average values for modifications q g er groups of modifications with gross impact 14108 ) o f h (EstimatedGenericValues) Estleeted m alene Estlemted f4;wa(d erted 4%Eammend Estimated 4verage Average Average majeur Averted Off- Avertible Averted 6ffsite and Averted p(ca) p(ca) 4(ca) site Cost Onsite Cost Onsite Cost Onsite Cost Populatten Type of t+(ca) @(ce)/ Avertible Giant (per r yr) p(ce) (per r yr) Dose (p-rom) ($) ($) ($) ($) Bose (p-rum) ) (1) . (2) (3) (4) (5) (6) (7) .(8) (9) (le) (11) (12) M 7.L ** 4.f 7 %.I7 3 7F 7.M6 f.37 !.M N.T[ w tb h e ft-5 2.016-4 0-ti 2.21E-4 F4K-5 M3 3,46E5 9.9E6 AreKE 4-fee 6 4.30E2 i H with .} t-5 3.3FE 4 0.04 2.22E-4 8.9E-6 Y E4 15 5 9.99th 4.CIE5
. 5 W9M2 contairment ,
a wenting U
" sectes:
Columns 2 & 3 are from Table 4.2.3.1 (Cols 5 & 4. respectively) . Column 5 ts the mean from Col 5 of Table 4.3.2 Cclumn 6 = Col 5 m Col 4 E Column 7 is f ree Col 9 of Table 4.3.2 ( A erage life 30 years undiscounted) E Cclamus 8 = 1/2 a 1000 m Col *7 m Col 4
Cclumn 9 is based on SMS per plant 15 y ar life (30 years discounted at 51). Col 9 = M9 x 15 m Col 5 % Cclumn 10 is free Col 5, 6, & 9. Col 10 = Col 9 m Cel 6/Cel 5
- 3 Column 11 = Col 8
- Col 10 m Cclumn 12 = Col 7 m Col 4 E , .
4 . a
~
. A *..
\
o Table 4.3.4 Generic value terms for Alternattwe 4. Additional Depressurization and Coeling Capab!Ilty I
~
R Estimated istimated i E Type of Estimated Generic Values Averted Heminus Estimated Averted Estimated j Plant Average Average Average flaminum Offsite Avertible Averted Offsite & Averted i 880di f i- Ap(ce) p(ce) Ap(ce)/ p(ce) Ap(ce) Avertible Cost Onsite Cost Ons)*.e Cast Onsite Cost e'opalaties cation (per r yr) p(cs) (per r yr) Dose (p-ree) (S) ($) (S) ($) Dese (p-res) (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) , it?) PWR; 3.15t-4 5.1% -4 0.61 2 [-4 2.91[-4 . 43 2.5216 21.M 6 13.2t6 15.7E6 5.M3 Prswblon cf fy PWR 2.89[-5 2.29[-4 0.13 4.81E-4 6.2k-5 8.2k3 5.3[5 21.6E6 2.h6 3.k6 1.07f 3
' j kithout IP)/
Prowlsion
\
*NEC
- a. cf Sec. N '
l . 39t -4 t-4 0.30 2.67t-4 cil-5 2.74E4 6 12.0[6 6 6 3 Prowlsion I cf Con-i tairument Venting . E CV1 & CV2 A o g foote : . 3 Column 1. Variations 8 1, 2. and 3 f. ave the same value terms but dif ferent gross lapacts. Variations CV1 and CV2 have thd same value terms but different
. gross impacts.
E Celumns 2 & 3 are fram Tables 4.2.4.1. 4.2.4.2, and 4.2.4.4 (Cols 5 & 4. respectively)
- a. Column 5 is time mean f rom Col 5 et Table 4.3.2 o Column 6 is from Columns 4 & 5. Col 6 = Col 5 s Cet 4
! C Column 7 is from Col 9 et Table 4.3.2 (Average life 30 years undiscounted) O Cclumn 8 is f rom Columns 5. 6. & 7 Imt average life 15 years (30 year Ilfe discounted at 5 Mrcent per anness; value per persen ree averted. $1000)/ [ !' Column 8 = 1/2 m (Cel ? m Col 6/Cet 5) m $1000 8
- a. 4 4
3 Column 9 is based en $319 per plant 15 year life (30 years discowited at 5%). Column 9 = 3E9 m 15 m Col Sr . i
- Column 10 is f ree Column 5. 6. & 9. Column 10 = Col 9 m Col 6/ Col 5 Cclumn 11 = Col 8
- Col 10 Column 12 = Col 7 m Col 4
- - . . . , , - - _ _ - , , , _ _ , _ . _ _ . , _ _. _ . - _ . - - - . , ,m .y_ .-, - . _ - - - - , , _ , . - . _ . . - _ , . _ _ , ,
-=
A ,. g Table 4.3.5 Generic value terms for Alternative 5, Dedicated Hot-Shutdemn Capability A E Estimated Generic Values Estiented Maa leism Estimated 14eminam Estleeted Averted Estimated Average Average Average p(ce) Averted Averted ^- dd
- Averted Offsite and Avert d Type of ap(ca) p(cm) ap(ca)/ Averted ap(ca) Offsite Oftsite Cost Onsite Cost Onsite Cost Onsite Cost Populatten Plant (per r yr) p(ca) (per r yr) Dose (p-ree) ($) ($) (5) ($) Dose (p-rem)
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (12) rue y.7G Tout f &B 4.841-4 5.1k-4 0.94 4 .81E-4 4.52E-4 3 2h 3 ~3}&EG 6 21.6E6 20.3E5 24 2E6 h4E3 with f18 1.87L-4 2.0l[-4 0.93 2.21E-4 2.06E-4 3 78L3 kJ 6 9 6 6 6 3
& Sec. 8-0 ;
8WR
~
i T.fE 6 3.37 3,JE4 w/out 3.801-4 4.5K-4 0. S 2 67E-4 2.2A-4 2. 74[4 12.0E6 16.-H 6 21 9 ' 11h6 I g Cont. vent. l ~
- with g. pt, (,75 Cont. Vent. 2.551-4 3.17E-4 0.80 2 22[-4 1.M-4 2 M4 SfL6 9.99E6 7.99E6 1M$6 LJE4 960tes: %
= Columns 2 & 3 are f rom Table 4.2.5.1 (Cols 5 & 4 respectively)/
3 Cclumn 5 is the mean from Col 5 of Table 4.3.2 g Column 6 is from Columns 4 & 5. Col 6 = Col 4 m Col 5 % Column 7 is from Col 9 of Table 4.3.2 (Average life 3u years undiscounted) , "' Column 8 is f ree Columnas 5, 6 & 7 trut average life 15 years (30 year life discounted at 5 percent. per annen; value per persen ree averted, $1000) M Column 8 = 1/2 m (Col 7 m Col 6/ Col 5) m $1000 " Cclumn 9 is taased on $3[9 per plant 15 year Ilfe (30 years discounted at SE). Col 9 = 3E9 m 15 m Col 5
- Cclumn 10 is from Columns 5, 6. & S. Column 10 = Col 9 m Col 6/ Col 5 yColumn11= Col 8*Cel10
,, Column 12 = Col 7 m Col 4 -
F
e o Table 4.3.6 Generic value terms for Alte ed Cold-Shutdown Capability R Estimated Generic Values Estimated S Iteminum Estimated Manteum Estlested Avertad Istimated Average Average Average p(cm) - 7,.. . ; -4 Averted Aweeted Averted Offsite and Averted Type of Ap(cm) p(cm) Ap(ce)/ Averted Ap(ce) Offsite Offsite Cost Onsite Cost Onsite Cost Onsite Cast Population Plant (per r yr) p(cm) (per r yr) Oose (p rem) (S) ($) ($) (S) Dese (p-res) (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (L2) IW 5.81-4 0.94 5.71E-4 5.Q-4 9.9K3 4.6dE6 6 24.4E6 29.1E6 3 out f&S 6. lf-4 with E68 2.ht-4 2.41E-4 0.93 2.65[-4 2. 47E-4 4M3 2.NE6 11.9E6 11.k6 13.g6 3 6 Sec. 8-0 M 5.07E-4 6.$-4 0.19 3.56E-4 2.*4E-4 3.h4 15.%6 6 13 3 6 28$6 [4 4.23E-4 2.96E-4 2.37E-4 E6 13.3E6 10.6E6 22.dE6 4
. Ven g 3.iOE-4 0.80 4 E Motes:
4 Columns 2 and 3. In the absence of specific data, this table nas been constructed from Table 4.3.5 by assuming that M (c) p(ca) would be higher try 20 percent and 33 percent for PWes and SWits, respectively. If the PRAs were entended 3 to cover the phase from het to cold shutdown and subsequent prolonged cold shutdown and (b) the percentage reductlen la p(ce) is the same as m la the earlier phase. /- O Column 5 is the mean f rom Col 5 of Table 4.3.2 and scaled og by 201 or 331/
. Column 6 is from Col 4 & 5. Col 6 = Col 4 m Col 5 o Column 7 is f rom Col 9 et Table 4.3.2 ( Average life 30 years undiscounted. Col 9) and scaled g by 20E or 33EI
[ C Column 8 is f rom Col S. 6. & 7 Ist average life 15 years (30 year life discounted at 5 percent per annum; value per persen-ree averted. $1000) O Column 8 = I/2 m (Cel 7 m Col 6/ Col 5) a 11000
. Cclumn 9 is based on 1319 per plant 15 year life (30 years discounted at 51). Col 9 = 3E9 x 15 m Col 5
- g Cclumn 10 is from Col 5. 6. & 9. Cel 10 = Col 9 m Col 6/ Col 5 .
Column 11 = Col 8
- Col 10 Columme 12 = Cel 7 m Cel 4
in Section 4.1.2. The results of the generic value-impact analyses for Alternatives 3 through 6 are shown in Tables 4.3.7(A) and (B) through 4.3.10(A) and (B). 4.3.1.2 Generic Triatment Based on Averted Offsite and Onsite Costs In this case, the generic offsite costs and the impact are obtained as described in the previous section. To obtain generic onsite costs, the following proce-
- dure is adopted to correct the monetary values. >
1.. Replacement power cost - This is corrected for size of plant (linear relationship) and local cost of replacement as compared with the average (linear relationship).
- 2. Loss of investment - This is corrected for size of plant (linear relation-ship) as compared with the average.
- 3. Cost of cleanup - This is assumed to be independent of plant size.
Variations from the average for p(cm) and remaining plant life are corrected on the basis of linear relationships. The generic values, on the best-estimate basis, for the combined uffsite and i onsite costs can then be used to estimate the maximum cost-effective expenditure on modifications, as in the previous section. These limits are:
- 1. PWR without bleed & feed capability - $23 x 108 per plant
- 2. PWR with bleed & feed capability - $11 x 108 per plant
- 3. BWR without containment venting - $23 x los per plant -
- 4. BWR with containment venting - $19 x los per plant Thus the inclusion of onsite costs in:reases the limit on cost-effective expen-ditures by a factor of 2 to 6.
04/20/88 4-105 NUREG 1289 SEC 4 DRAFT 4/88
l o Table 4.3.7(A) Results of generic value-impact analysis for Alternative 3, Specified System l t Modifications (average values for modifications or groups of modifications l { with gross impact 5 5108) l @ l Generic CM Probability Data Generic l Type of Plant Initial p(ca) Generic Impact Population Generic Value-Impact ared p(ca) ap(ca) After Mod Gross Net Dose Averted (5/ person-res) l Initial State (per r yr)(per r yr) (per r yr) (5) (5) (person-res) Gross Net l (1) (2) (3) (4) (5) (6) (7) (8) (9) V 32t 347 M -1. f bl.9f Es1 PWR w fpB 3.4E-4 3,4E-5 1.9E-4 . 5 -S-fE5 M E2 B ftr $0 BWR w Vent 2-fE-4 8.9E-6 2.13E-4 2.8E5 -1.2E5 E2 g 50 Notes: Column 2 is the Mean (All Events) from Col 5 of Table 4.3.2 Column 3 is the Generic Value from Col 6 of Table 4.3.3 4 Column 4 = Col 2 - Col 3 Column 5 is the Average Value for PWR or BWR from Table 4.2.3.1 8 Column 6 = Col 5 - Col 10 of Table 4.3.3 Column 7 is from Col 12 of Table 4.3.3 Column 8 = Col 5/ Col 7 Colum; 9 = Col 6/ Col 7 E . A o l l 3 ~ l X: i O ? 4 . O l -4
- t .
l 8 .
~
-- q ,.
. )
o Table 4.3. 7(s) Results er generic waleimpact analysis for Alternative 3, hif ted System stadifications, la teres of t
- specific net benefit" (SMS) using menetized radiation dose (wrage values for modificatfees er gregs
- of modifications with gross impact $$10*)
y s Type of Chance of Cost Effectiveness l Plant Generic Offsite & Onsate Cost
& Gross Generic A= cried Cost Specific feet Benefit Offsite Cost Only Lour Pop Hi-Pop offsite & Laer Pep 808-Pep Initial Impact Offsite Onsite site 5 S Offsite Onsite Avg site site . Site Avg site site state 5 (6) (7) (s) (s) (le) (II) (12)_
(I) (2) (3) (4) (5) Nts
~
4h 5 t Dene w C E.- \ M $4 N 4.Cith *0. W +2.0) Fair Small Good fair fair 4ese With 2.8f5 +-@9t5 Containment Venting 7 o
- snotes:
Column 2 is the average value for PWRs er Stats f ree f able 4.2.3.1 (not yet corrected for e/se cr local labor Costs). Columns 3 amt 4 are Cs,Is 8 and 10, respectively, f res Table 4.3.3. Column 5 = Cel 3/Cel 2 - 3.0 86ete that, try definition of See, easite costs api, car in the *IIet Benefit" term but not in the Column 6 = ((Cel 4
- Col 3)/(Col 2)] - 3.0.
E
- Gross Impact" tete.
f or relation between
- Chance of Cost (f rectiveness" and $sse, see Tables 4.1.2 through 4.1.5.
g 3 M . am ap C
-a .
? 2
m .
~
o Table 4.3.8(A) Results of generic value-impact analyses for Alternative 4, Additional Depressurization { and Cooling Capability R
@ Generic CM Probability Data Generic -
Type of Plant Initial p(cm) Generic Impact Population Generic Value-Impact and p(ca) Ap(cm) After Mod Gross Net Dose Averted ($/ person-res) Initial State (per r yr) (per r yr) (per r yr) ($) ($) (person-res) Gross Net (1) (2) (3) (4) (5) (6) (7) (8) (9) PWR w/o , var 1 4.81E-4 2.93E-4 1.88E-4 0.65E6 -12.6E6 5.$3 130 <0 2 7.0E6 -6.2E6 1390 <0 3 Of 22.8E6 9.6E6 453) 19U0 w/o Sec. B-D 4.81E-4 M.-5 4.19E-4 3.0E6 0-ME6 1.07E3 2800 JRIA / g 0.t996G 8WR w/o CV, Var 1 2.67E-4 E-5 1.8}E-4 1.04E6 -2.56E6 N3 130 <0 0 2 2.04E6 -1.56E6 2$D 70 Notes: Column 1, PWR variations 1, 2, and 3 have the same value terms but different gross impacts. BWR variations 1 and 2 have the same valua terms but different gross impacts. Column 2 is the Mean (All Events) from Col 5 of Table 4.3.2 E Column 3 is the Generic Value from Col 6 of Table 4.3.4 A Column 4 = Col 2 - Col 3 -
" Column 5 is from Tables 4.2.4.1, 4.2.4.2, and 4.2.4.4 0 Column 6 = Col 5 - Col 10 of Table 4.3.4
$ Column 7 is from Col 12 of Table 4.3.4 m Column 8 = Col S/ Col 7 8 Column 9 = Col 6/ Col 7 .
u 5: a; 3
9 . l Table 4.3.8(8) Results of generic value-impact analysis for Alternative 4. Additlanal Depressurizat?e .and l g Cooling Capability, in terms of "specific net benefit" (588) using monetized radiatioe dose l s l $ s 3 Type of Plant Generic Camace of Cost Effectiveness
& Gross Generic Averted Cest Specific Net Benefit Offsite Cost Only Offsite & Onsite Cost Initial Impact Offsite Onsite Offsite & tow-Pop Hi-Pep tow-Pep Hi-Pep l
State 5 5 5 Offsite Onsite Avg Site ilte site Avg Site Site Site (I) (2) (3) (4) (5) (6) (7) (8) (9) (18) (11) (12) M 1 7A cc Good w/oIp 0.6516 2. 16 13.2t6 2.$ 23 4seet fair CE CE CE
& sed C E 7.00t6 -0.64 1.2 Mot E hot E Fair Fair Small 22.816 -0.89 -0.31 Not CE Not E Small Small 18et E Falc w/o Sec. 3.016 2.N6 -0.82 0.1 A seet CE Not CE Small Fair seet E 5.3[5 8-0 $g M Fair E
, w/o vent. 1.04t6 sk'.Il 4-f16 3.6(6 3. 0 6.M Good- Fair CE E
?.04E 6 1. 0 2.8 Fair Small Good Good Fair CE l
l Notes: l Column 2 is free Tables 4.2.4.1. 4.2.4.2, and 4.2.4.4. l l $ Columns 3 and 4 are f rom table 4.3.4 (C'Is 8 and 10, respectively) I R Column 5 = (Col 3/ Col f) - 1.0 n Column 6 =" ((Col 3
- Col 4)/ Col 2)] - 1.0. soote that, by definition of SNB. onsite costs appear in the "seet Benefit" ters het not in the
% Gross Impact" term.
3 For relation between "Chance of Cost E f f ectiveness" and SMS, see Tables 4.1.2 through 4.1.5.
- l N a
l a. l 4; e . 2 _ . _ _ . , . , - s--- - __ - - - - - , - ,% r , , . _ , - - , ---,,y- - - - - - - - - - - - - - . , . - - , . - -- - - , . . , . c y- -
o Table 4.3.9(A) Results of generic value-impact analysis for Alternative 5, Dedicated Hot-Shutdown Capabi1ity { R E Generic CM Probability Data Generic Type of Plant Initial p(ca) Generic Impact Population Generic Value-Impact and p(ca) ap(cm) After Mod Gross Net Dose Averted ($/ person-rem) Initial State (per r yr) (per r yr) (per r yr) ($) ($) (person-res) Gross Net (1) (2) (3) (4) (5) (6) (7) (8) (9) PWR w/o F 8 4.81E-4 4.52E-4 2.9E-5. 65.8E6 45. 3 - 8,4IO 5,8d0 w Sec 8-D With F B 2.21E-4 2.06E-4 1.5E-5 65.8E6 56.[6 3 18,h '&
& Sec 8-D BWR a w/o Cont. 2.67E-4 2.2M:-4 4.[-5 79.5E6 69.[6 E4 3,0do O Venting 4,h
~
With Cont. 2.22E-4 1.78E-4 4.4E-5 79.5E6 71.5E6 4 3,9% Venting Notes: 2 Column 2 is the Mean (All Events) from Col 5 of Table 4.3.2 E Column 3 is the Generic Value from Col 6 of Table 4.3.5 2 Column 4 = col 2 - Col 3
- Column 5 is the average value from Table 4.2.5.1 % Column 6 = col 5 - Col 10 of Table 4.3.5 Column 7 is from Col 12 of Table 4.3.5 M Column 8 = Col 5'/ Col 7 Column 9 = Col 6/ Col 7 ] , ,
O 7 a> I
g Table 4.3.9(S) Results of generic value-lapact analysis for Alternative 5, Sodicated slet-Shutdeman g Capellity, in teres of "specific net benefit" (5s3) using monetized radietlen dose R R Type of Plant Generic Chance of Cost Effectiveasss
& Gross Generic Averted Cost Specific feet Benefit Offsite Cost Saly Offsite & Ansite Cost Impact Offsite Onsite Offsite & tow-Pep Ni-Pop tent-Pop Nf-Pop Initial state 5 5 s Offsite Onsite Avg Site site site Aoss ite site site (1) (2) (3) (4) (5) (6) (7) (s) (9) (le) (11) (12)
M w/o out 65.8[6 3.46 20. 3E6 -894 -0.63 Isot E Not E Isot E isot E Ilot E Fair (48 w/ Sec. B-D 65.8[6 6 6 -0.97 -0.83 Ilot E bot E Isot E leet E Isot E Small ( with I&S
& Sec. .
B-0 out 79.5E6 6 -0.sh -0.73 leet E het E Small Ilot E sent E Seell 11.$6 . l cent. l wert with 79.516 6 7.99E6 -0. ( -0. T II=t E Met E Small Not E Not E Small g cont. g went. I p festes: , h. Columwi 2 is the value free idle a.2.5.1.
'n" Columns 3 and 4 are from i d le 4.3.5 (Cols 3 ane 10, respectively) . Column 5 = (Col 3/ Col 2) - 1.0 o Column 6 - [(Col 3
- Col 4)/Cel 2] - 1.0. Mete that, by definitten of See, ensite costs appear in the "seet 5 Benefit" Lre but not in the "Gross lapact" term.
f or relation t.etueen "Chance of Cost [f rectivene s" and 583, see Teles 4.1.2 through 4.1.5. 2 . 2
9 .. o Table 4.3.10(A) Results of generic value-impact analysis for Alternative 6, t Dedicated Cold-Shutdown Capability t E s
@ Generic CM Probability Data Generic Type of Plant Initial p(cm) Generic Impact Population Generic Value-Impact and p(cm) Ap(ca) After Mod Gross Net Dose Averted ($/ person-res)
Initial State (per r yr) (per r yr) (per r yr) ($) ($) (person-res) Gross Net (1) (2) (3) (4) (S) (6) (7) (8) (9) PWR 9,y f w/o B 5.77E-4 S.4AE-4 3. k-S 94.3E6 69.9E6 9-3E3 10,130 7,5l0 or Sec B-D with F 8 2.6SE-4 2.47E-4 1.8E-S 94.3E6 83.AE6 E3 22,350 19,D ]
& Sec B-D
) BWR c*g 43,7 y,g 3,0 y Of0 '2,GFD w/o Cont 3.56E-4 g/8 DE6 2.ME-4 54. E-S 83-5E6
. A4E4 , h269 a Venting with Cont 2.%E-4 2.37E-4 S.9E-S E6 6 E4 Venting Notes.
z The data and computations f or Alternative 6 are the same as for Alternative S except that p(ca) is assumed to be E 20 percent. greater for PWR and 33 percent greater for BWR and the Gross Impacts are greater; note that the E fractional reductions in p(cm) are assumed to be the same as for Alternative S. U 8 . R - 4 . . O
?
t
? .
1 p o ) r l r l l Pe2 l a i a
- t1 i a m a m e
^. ii( tNS F S F S rh s ot . o f C e p rb ee E E E E e tP ) C C C C t o i- e1 at swt1 t t t t e noi( o o o o rd ge OLS N N N N s m s& t u e ns es ne et e ca vi t i s i) E E E E C re er tf S0 C C C pa cf 1 eO g( . t t t t f v o c o o f A N N N N 0 2 )a c E e( . t bp
- s a p E E oa tl
. C o C C l l
l l 6 Pe) t a a ds c f t9 t o en ei o ii( N N o S m S m
- a. o
. vf ti ey NS ti tc cl st ee nn sc np aop E
aud rs h e E E E e e CtP C C L C se t" l f o s s- e) owt8 t t t t i r o o o ., Aod Coi( tS N N o N N
)l ma cn rsn e (pi o oeo f ri i t -
t et s tc st a f f t e aa i i snd O i) E E E E hr yi a S7 C C C C tf l
,r ( t e a g t t t t n yd v o o o o ph at e A N N N N et iz c tli xt cit eah abe 5t pan mpo & ee i am t vt C g ie io e r unn l wi ft e eit) nsi6
( 6 h8 N. d7 t n a n; aos ef s( 0 0 0 rr vdu Bf n 0 ee t OO - - - - t t ce) t e l a ihP Ae rSN N r eS rg . nd( c o el i e f e g Co "t f i t i) 5 8 4 7 8 sa r f i c s5 9 9 8 a odf e t( s ee p f 0 0 0 0 et S o - - - st n t ae mc l cb aa sp ui m sdt ei eee BDn h t s s
) e eo rr 8 tt
( si aG 0 os ) b 6 6 6 1 C nS4 [ [ 6e h 3 d O (
$. et v
e " 1 1 id 4 t t n r aa e e n l v rR b A eW a tS T it ce 6 6 [ 6 6 l ri esS3 nf
)
(
@ 1 1.
4 p [ kd 2 : Ar rf o 3 M o ef 4 5 2' 1 1' f r GO e . st5 m na oee ir v i c rsc t 6 6 E 6 [ 6^ I _ t gi a tt a t esa ) 1 3 3 7 unn per n o p$ era 2 ( 4 4 3 7. 3 & mcet GG! 9 9 9 9 e t rl eA dp
. . n r t t a3 o n a 3f a
f o t l a rB D D B N N td s
- ana sda en&tt1 i e) t o u h &. t .
- s. t ht e e pa t8c R t i t eR m yl TP ia(
iS nt W R_ P obc
/&e wTS i&e wIS W
B oh ib Nohva T f s o SEA. =hw E U* E 4 <- b (. D
Generic V/I indices for the suggested alternatives can be derived as in the previous section and tested against the appropriate interpretation tables ' (Tables 4.1.1 through 4.1.5). 4.3.2 D timates of the Generic Value Terms In this section the generic value terms for the possible alternatives are estimated using the methodology described in the previous section. 4.3.2.1 General Discussion
. In principle, the methodology described in Section 4.3.1 can be used to esti- ,
mate, on a generic basis, the value term (i.e., monetized value of the risk reduction) achievable by the various alternatives and the variations of these desi:ribed in Sections 3 and 4.2. However, two difficulties arise from the generic point of view: ' l
- 1. Some of the alternatives embody several modifications, sume of which are
(, of a plant-specific nature; thus the data in Sections 3 and 4.2 do not immediately yield generic information in all cases.
- 2. It is not always possible from the PRA esu{tsfortheUSIA-45casestudies J
todeterminehowmuchofthereducNo(ac eved by a possible solution { embodying several modifications is attributable to any particular modi-fication. Similarly, it is not always possible to determine how much this i reduction would be altered if the order irt which the modifications are
! assumed to be made were changed.
Thus, in terms of seeking broad insights frcs the plant-specific analyses, gen-eric conclusions cannot be derived for all the alternatives considered in those studies. The available data for each of the main variations of the alternatives I defined in Section 3 are considered in the following sections and are then sum-i marized in Section 4.3.4.2. No conclusions are drawn in these sections as to the relative merits of the various design alternatives since che importance of j the unquantifiable - ,__::: _ .__. i r attributes are not reflected in the [ i value-iupact indices. ! 04/20/88 4-114 NUREG 1289 SEC 4 DRAFT 4/83
4.3.2.2 Alternative 1 - No Action ( . There is no "value" associated with this alternative in the conventional sense, but there is a penalty in the form of a lost "opportunity cost" to reduce the existing expectation of loss. , l 4.3.2.3 Alternative 2 - Limited-Scopo PRA as a basis for Modifications Since the execution of a limited-scope PRA does not 'of itself reduce the risk presented by a plant, the cost effectiveness of such a PRA must be judged by the likely net saving (i.e., cost of required change indicated by PRA plus the , cost of the PRA, as compared with the cost of changes prescribed on a deter-ministic basis) that would be achieved. In this estimate of cost effectiveness, it is necessary to bear in mind that, in this alternative, a ceiling on cost-effective expenditure for improvement is imposed by the avertible costs (either offsite or offsite plus some fraction of the "public interest" costs). , To assess whether a limited-scope PRA coulci be cost effective, the following
- assumptions are made:
- 1. The cost of a limited-scope PRA of the same quality and scope as the ;
USI A-45 ca e studies would be about $800,000.
- 2. In the absence of an adequate PRA, deterministic arguments could lead i j to expenditures on improvemen' equal to or greater than the maximum cost-effective amounts based on the generic avertible costs using j l
the methodology of Section 4.3.1.
- 3. Given an adequate limited-scope PRA, it should show that one of the fol- i lowing situations exists:
- a. No further inprovement to reduce the public risk is necessary within the limits of the PRA.
i 04/20/88 4-115 NUREG 1289 SEC 4 ORAFT 4/88 {
- b. Further improvements are necessary, but specific modifications k identified by the PRA are sufficient to reduce public risk at -
a cost loss than maximum cost-effective expenditure referred to in Item 2.
- c. Further improvement is necessary, but the identified mod'ification costs more than the maximum cost-effective amount; i.e., the r.itua-I, tion is not widely different from what would exist if there were no PRA.
i The USI A-45 case studies indicate that some plant-specific modifications could cost less than the maximum cost-effective expenditure minus the cost of the
} PRA; i.e., they could be cost effective. Thus there is an economic incentive I for licensees to choose to execute a limited-scope PRA rather than to proceed on a purely deterministic basis.
It should be noted also that the USI A-45 case study PRAs have demonstrated that a high proportion of p(cm)0HR f r any given plant is likely to be , attributable to detailed design features of the support systems, which differ in important respects from one plant to another, and to site-specific "special emergencies." This characteristic limits,the usefulness of the concept of grouping plants on the basis of similarity of "front-line" systems (as far as the DHR function is concerned) to utilize the results of a PRA for a "parent *' plant. Thus, in addition to the economic incentive te execute a limited-scope PRA (for the DHR function) identified above, tt.sre is also e direct application of this analyses to the Severe Accident Policy Statement. The cost effectiveness,
- on a reneric basis, of some modifications and sets of modifications examined in the PRAs for the A-45 case studies is discussed in the next section. ,
i I 4.3.2.4 Alternative 3 - Application of Specified System Hodifications to All . Plants , i i 1 ) In this alternative, the results of the USI A-45 case study PRAs have been used i , to identify relatively simple modifications or combinations of mo.iifications that appeared likely to give cost-effective reductions in p(cm) or in the , 04/20/88 4-116 NUREG 1289 SEC 4 DRAFT 4/88 I ,
probability-weighted population dose. Because of the extensive analysis that f would be needed, the contribution to the reduction in p(cm) and the populatio.n dose due to each of these modifications alone or possible modifications in sequence has not been established. Thus values can be estimated only for each group of modifications (i.e., each complete "alternative" as defined in the case studies). . To obtain an indication, on a generic basis, of the cost effectiveness of this
. type of alternative for variations costing less than $1 million, the generic values of p(cm) and the reduction in population dose have been estimated for each of these low-cost variations for each plant so that generic value terms can be estimated using the methodology of Section 4.3.1. These generic values are shown in Table 4.3.3.
From the generic vclues shown in Table 4.3.3 and the generic impact data in Section 4.3.3, the mean V/I indices (i.e., the cot? per person-rem averted and the SNB) can be obtained. These ar'e shown in Tables 4.'3.7(A) and (B). As
- discussed in Section 4.3.4, the mean V/I indices and the range of the indices provide a useful indication of the cost effectiveness of this alternative.
4.3.2.5 Alternative 4 - Depressurization and Cooling Capability 4.3.2.5.1 PWR - Bleed and Feed In the case of PWRs, provision for bleed and feed (or feed and bleed in the case of most B&W plants) is a possible generic modification that could lead to a reduction in p(cm) in situations where both main and auxiliary feedwater supplies were lost but the ECCS systems remained operable. In the USI A-45 case study PRAs, ap(cm) has been estimated for situations in which the only difference is the capability to bleed and feed. In Table 4.2.4.1) f individual .falues for Ap(cm) attributable to this capability and the correspond-ing reductions in population dose to 50 miles are tabulatad for four plants. l The individual values for the changes ia population dose can be converted into generic values using the method described in Section 4.3.1. t 04/20/88 4-117 NUREG 1289 SEC 4 ORAFT 4/88
The derivation of the generic mean values,for Ap(cm) and for the reduction k in population dose is shown in Table 4.3.4. The numerical values are: , Averted
- Ap(cm) i Type of Initiating Event (per r yr) PopulathDose (p-res ,N ALL 2.f-4 5.0 -
From these generic alues and the genwric results for the othe parameters, the generic vaines,of 5 andcostperperson-remavertedandofj8,forthisalter-native can be obtained immediately. These are shown in Tables 4.3.8(A) and (B). It should be noted that the values of Ap(ca) that are given in Section 4.2.4 take into account possible operator erM rs in following established procedures, but they do not include a conditional probability to reflect the observed reluctance of operators to initiate the bleed and feed procedure. Such a con- ; sideration would tend to further reduce the cost effectiveness of feed and bleed, as discussed in Section 4.2.4.1. 4.3.2.5.2 PWR - Secondary-Side Blowdown Capability i In the case of PWRs, provision for rapid secondary-side depressurization is also a possible generic modification that could lead to significant reduction j in p(cm) in those situations where there has been a complete loss of main and auxiliary feed supplies but where other low pressure supplies of feedwater can i be improvised (see Section 4.2.4.2.3). ( l Using the same approach as in the previous section, the corresponding generic ; j mean values for op(ca) and for the reduction in expected population dose to 50 miles can be estimated. The derivation of these is shown ir, Table 4.2.4; i the numerical values are: i i [ i Averted Ap(cm) Population Oose (p-re g _ ; Type of Initiating Event (per r yr) ; ALL 1.07E3 6.f-5 04/20/88 4-118 NUREG 1289 SEC 4 ORAFT 4/88 i _____.____ _ _ ____. _. _
In this type of emergency operation, there is no disincen,tive to deter the I operator from initiating the appropriate procedures as soon as he has , diagnosed the situation. Therefore, it is not necessary to introduce a further conditional probability. The generic values of cost per person-rem averted and SNS are shown in 1 Tables 4.3.8(A) and (8) f.or offsite costs and for offsite and onsite costs combinedg ...r. .ively. ~ }/
\
4.3.2.5.3 BWR - Containment Venting i l In the case of BWRs, if containment pressure were rising to a level considerably l '- above the design basis, provision for venting the primary containment is a asys,teMorreplenishingreactor possible generic modification, sources. Fromcoupled wip, d in'the USI case studies (Se coolant fre.m improvised the K tion 4.2.4.3), the generic mean values of ap(cm) and reduction of population dose for this alternative as the only modification are estimated to be: .( ap(cm) Population Oose Averted Type of Initiating Event (per yr) (p-re j ALL . E-5 8A 3
, '720s3 j In this type of emergency operation, it is possible that the operator might be reluctant to initiate the procedure because it could lead to some release of radioactive material to the atmosphere. Consequently, it might be necessary to introduce a further conditional probability.
The generic values for cost per person-rem avorted and SNB are shown in Tables 4.3.8(A)and(B)foroffsitecostsandfaroffsiteandonsitecostscombineg y
, ;;;;: S eb " I 4.3.2.6 Alternative 5 - Dedicated Hot-Shutdr,wn Capability Generic estimates in terms of avertible offsite and of avertible offsite plus onsite costs can be established from the results of the USI A-45 case study 6 PRAs, as was done for Alternative 3 (generic system modifications). As in that case, it is necessary to consider PWRs and BWRs separately and also to consider 04/20/88 4-119 NUREG 1289 SEC 4 ORAFT 4/88
~
the effect on the value of this modification if it is carried out in conjunction with other simplar modifications. The derivation of these estimates is shown-in Table 4.3.5. The estimates for the generic means of ap(cm) and for the reduction in popula-tion dose when Alternative 5 is the only modification and no credi't is taken for any other possible generic modifications ere: Averted Ap(cm) Population Dose Type of Initiating Event (per r yr) (p re
- 1. PWR d
i s a. w/o Feed & Bleed, All 4. -4 7.
- b. w Feed & Bleed, All 2. -4 3 .* 3 l
.065-l{
- 2. BWR
- a. w/o Cont. Vert, All 2.f-4 2.*I4
- b. w Cont. Vent All 12)E-4 1.* 4 b.77hy l
From these generic estimates and the generic data for the other parameters. the i generic V/I for this alternative can be obtained immeritately. These are shown in Tables 4.3.9(A) and (B). I The effect on ap(cm) and on the probability-weighted population dose of a .{ comoination of Alternative 5 with feed and bleed or containment venting has ; been examined. The generic results of this ansiysis are shown in Table 4.3.5. 1 It can be seen from Table 4.3.5 that, for these combinations of Alternative 5 and other modificat, ions, the value of Alternative 5 in tarms of averted off-l site dose is reduced by a factor of 1.5 or more. l 6 The incorporation of an independent and dedicated DHR system introduces the possibility of an increase in p(cm) due to adverse system interactions. ! Care in the detailed design of a proposed add-on system should ensure that { r such interactions are minimized. t I 04/20/88 4-120 NUREG 1289 SEC 4 ORAFT 4/88 i
4.3.2.7 Alternative 6 - Dedicated Cold-Shutdown capability ( As discusse,t in Section 4.2.6, this alternative adds to ternative 5 the addi-tional capability to reduce the probability of severe accidents once the cold-K shutdown condi1. ion has been reached. The i'ncreased capability of this dedicai.ed system leads to 1'urther decreases in p(cm) and the probability of a large release [p(r)], although tiese have not been quantified. The increase in cost of this alternative, al compved with Alternative 5, is 43 percent on a generic basif, for PWRs and percent 'or BWRs. . It is unlikely that the furtM r d in p(cm) or p(r) as a percentage of the original values will exceed 2 A for PWRs or 30% for BWRs. A generic value-impact analysis has been performed for Alten<ative 6 on the basis of assumptions statM above. The ricrivation of the generic value terms is abnwn in Table 4.3.6, and the results of the analysis are shown in Tibles 4.3.10(A) and (B). _ 4.3.3 Impact Estimates As was indicated in Section 4.1.2, to obtain generic estimates of the V/I
.6to, the impact term can be corrected foi de artures from thn average.
This is desirable in those alternatives where size of the plant or other fac' tors summarized in Reference 1 (e.g. , local labor costs) would have had a sigolfi:: ant effect on the impact in the individual case rtudies of USI A-45.
-The berection factor plied to the impact term n"u
$ 1 Lamb-&desen or items of equipment of the type used in moet of the possible modift.ations, the direct costs (i.e., capital and installation costs) vary approximately as the ratio X
(Average Thermal 4 werSpecific flant Tiermal-power)0.6 ;q t 04/20/88 4-121 NUREG 1289 SEC 4 ORAFT 4/88
-y . . _ _
~. Q & TO )
3
- W, &e A M (
\
e value of 0.6 for this index is commonly used in cost-engineering , studies (e.g., Reference 4). However, for modifications to existing i plants,,the enginee ing costs amount to about 50 percent of the whole)* ^ f .n edownot vary s nificantly with plant size.s Themer ...~ . .... .ry. _ +- _m,__ .- u,, ,..._4.. M[1 - GC 'ut .; .i&L
~
. s E A.n h Cm: The generic values for the labor costs are based on tho2e in Eastern Pennsylvania, and the nationwide local variation can be as much as f,30 percent. Values for individual plants are given in the case studies L ... , l.vvi 7. _ $
, di-ect-n;t, r_ adequate adjuwuienpairve mace y using tne tactor:
0.5{1 + [900/Act. Size]O.6(0.4 + 0.6(Gen. Labor Cost /Act. Labor Cost)])
$ 04MPeGeM>r- None of the other factors discussed in the case studies (i.e., discount rates and fixed charges, remaining service life, owners-costs, contingency, and replacement power costs) has a significant effect on the impact term in the cases considered. This is partly because of the assumption that extension of normal refueling outages to install the alter.intives can be avoided. If this were not so, local variations in replacement power costs could have a significant effect on the generic
< value.
4.3.4 Value-Impact Indices 4.3.4.1 Basis of the Value-Impact Indices and Treatment of Uncsrtainties The plant-specific data and the generic data for the value and impact terms are combined to obtain the plant-specific and generic mean V/I indices for each of the alternatives. Plant-specific indices are shown for the individual alterna-tives of Section 4.2.2 (for those cases where indices can be derived), and the generic indices (for average conditions) are shown in Tables 4.3.7 through 4.3.10. The gener are the more useful of the two fasts as an input to the decision-making procets. In using the generic indices, it is necessary to 04/20/88 4 4-122 NUREG 1289 SEC 4 ORAFT 4/88
take account of the large uncertainties in these estimates. This 14 facilitated ( by the "B" set of tables; in these tables, the effect of large changes (factor of 3) in site population. density is shown in the columns for sites with low, average, and high population densitie h fully into account in the "B" tables ":;r : ,j of fsitiiFetoQcgaggistaken '( 7 orTsite and onsite l costpr: ::= f d:r;d. However f the other partly quantified additions to the g value term (e.g., salotage and, possibility of a nuclear moratorium) are con- X sidered, a sensitivity analysis is required. The basis of the interpretation , tables and uncertainty analysis is discussed more fully in Reference 1. 4.3.4.2 Interpretation of the Generic Value-Impact Indices for the Various Alternatives In the "A" set of Tables 4.3.7 through 4.3.10, value-impact in terms of "cost per person-rern averted" is presented for two cares. In the first, Column 8, the gross impact is divided by the averted offsite dose. In the second, Column 9, the gross impact is reduced by the averted onsite costs and this net impact
, is then divided by the averted offsite dose. In those instances in which the averted onsite costs exceed the gross impact, the result is simply reported as
<0. ,
i t 1 The interpretation tables (Tables 4.1.2 through 4.1.5) provide a simple means l l for interpreting $ the Specific Net Benefits (SN8) shown in the "B" set of Tables 4.3.7 through 4.3.10 for Alternatives 3 through 6, respectively. The ! . interpretation tables make allowance for the uncertainty in the estimated SNB. f i
! 4.3.5 An Overview of the Results of the Generic Value-Impact Analysis The data presented in Tables 4.3.7 through 4.3.10 provide a means of assessing
- the cost effectiveness of each of the alteraatives for which a fully 1
; quantitative value-impact analysis can be carried out given a wide range of initial conditions, i
For an alternative to have a "fair chance" of being cost effective (where "fair"iskefine in Section 4.1. i.e, a probability of cost effectiveness j; between 0.3 and 0.7), the SNB for a given alternative at an average U.S. siYe i l 04/20/88 4-123 NUREG 1289 SEC 4 ORAFT 4/88 4
- . - , _ - . - . . - - . - - _ - _ _ _ _ . . _ _ _ _ _ _ _ . -_ _ - , . ~ _ . _ _ - , , _ - . - , - . , , - - , . , . ___ ,_ . ____-y-- - - _ - , - . .
j would have to be in the .*angc of zero to 3.7 if cost effectiveness were judged . I intermsofavertibleoffsitecostonlyor-0.[to+2.2ifjudgedonavertible g offsite and or, site cost. I For the purpose of eg g ng an overview, it is suffi-1 cient to use the nidpoints of these ranges, i.e.,42s4 and 14, respectively, in f the following analysis. These values then correspond approximately to a 50/50 chance of cost effectiveness.
- From the relationship:
SNB = (Averted Cost) . y' Gross Impact itcanbeseenthatthecorrespondingvaluesoftheV/Iratioare3dand2g ,y Thus the maximum impacts (i.e., the maximum cost-effective expenditure) at the 50/50 chance level would be the maximum avertible offsite costs and offsite plus onsite costs times the appropriate I/V ratio (in this case, 1/3 4 and 4 1/2 respectively.) That is, ,y X. ( Maximum impact = val (i.e., safety improvement t
/V w-*
The generic values for the maximum likely avertible costs (i.e., when
. ap(cm)/p(cm) = 0.9) for an average U.S. plant / site combination are given in Section 4.3.1.1, namely:
PWR without F&B offsite cost only $3.7xEG per plant [ Offsite and onsite costs $23xE6 per plant BWR without containment Offsite cost only' $12xE6 er plant v venting Offsite and onsite costs $23xE6 per plant y It can be seen that (using generic values) the maximum expenditure (impact) on any alternative that would give a 50/50 chance of being cost effective for an average U.S. plant / site combination would be: 04/20/88 4-124 NUREG 1289 SEC 4 ORAFT 4/88
l, PWR (Upper Limit) BWR (Upper Limit) *; I ' Based on Avertible $3.7E6 = $1.2E6 $12E6 = $4E6 Offsite Cost Only 3 3 i Based on Avertible $23E6 = $11.5E6 $23E6 = $11.5E6 Offsite and 0.isite 2 2 Costs . 1 j The generic gross impacts at average sites for the various alternatives have j l the following ranges: . Alternative PWR BWR j 2/3* $0.6E6 to $3.3E6 $0.3E6 to $12.9E6 l
,.. 4 $0.1E6 to 2.1E6 $1.0EG to 2.0E6 t
from Tables 4.3.3 through 4.3.5, it*can be seen that the ratio ap(cm)/p(cm), for the DHR function is in the range 0.1 to 0.95. The mean generic values are j approximately 0.4 for PWR and 0.5 for BWR. 5 Cumparing the generic gross impacts with the estimated limits on cost-effective ( I
! expenditure, it can be seen that, based on purely quantitativo considerations for average sites and averted offsite costs, only the less expensive variations j of Alternatives 2, 3, and 4 could have any prospect of showing a 50/50 chance l l of being cost effective. However, based on a methodology that includes both (
l averted offsite and averted onsite costs, most variations of alternatives 2, ' l 3, and 4 have a prospect of showing a 50/50 chance of being cost effective. References (For Section 4.3)
! 1. "TheApplicationofValue-ImpactAnalysistoUSIA-4pummaryReport [
of UCLA Studies on Value-Impa AplyjisinRdiationtoUSIA-45" i NUREG/CR-4941 SAN 087-7116, _ M 1987. N , j I 2. "Technical Guidance for Safety criteria Development," NUREG/CR-2239, l SAN 081-1549, Sandia Natimal Laboratories, December 1982. l I l I i 1 l< khe lower end of the range corresponds to modifications costing less than $1E6; the upper end. corresponds to modifications costing over $1E6. t l 04/20/88 4-125 NUREG 1289 SEC 4 DRAFT 4/88 , 2 ! 1
t j I I
- 3. "Implementation Plan for the Severe Accident Policy Statement," SECY 86-76, !
I ! USNRC, February 28, 1986. - i ! 1 l 4. "Generic Cost Estimates: Abstracts from Generic Studies for Use in l 1 Preparing Regulatory Impact Analyses," Contract NRC-33 84-407 (Task 004), i i April 1986 (DRAFT). ' f ] I I c I i j
.- l t
?
l f. f I f i t l I l, I i t ( l i 04/20/88 4-126 NUREG 1289 SEC 4 ORAFT 4/88 i I
I t 4.4 Other Outstandina Generic Issues . ( . j 4.4.1 Overview i f Thissectionpresentfadiscussionofwhethertheinstallationofoneofthe y(, DHR alternatives described in Section 3 could affect other defined generic ; safety issues. The answer ites in the realization that, if a modification is made to improve the OHR function for any given plant, the total plant risk is ! reduced and the benefit that can be achieved through additional modification to improve the DHR function is' reduced. Making a significant reduc *.'t.n in I plant risk lessens the importance of other safety issues related to that ri n l because the potential for further improvement is reduced to a lower value. In l other words, implementation of any of the A-45 alternatives could make one oc j more potential modifications being considered in other US!s and Generic Issues f less cost effective or even moot. In addition, the NRC FY 1987-1988 Program i ! Guidance (Reference 1) developed in support of the NRC policy and planning guidance emphasizes management attention needed t' integrate USIs and generic / l l issues. In particular, Item 7c of this guidance states: !
"NRR should implement an approach for integration of similar or [
related USI's and generic issues to achieve the most cost beneficial ( ! resolution of the separate issues involved." ! i l An examinativa of the generic safety issues under staff review is warranted. I and the cumulative effect of making such modifications unnecessary should not i { be ignored whe9 making conclusions about the cost effectiveness of the various
- alternatives. Table 4.4.1 indicates which unresolved and generic safety (
issuss are closely related and most affected by Alternative 5 or 6. It should (
, be noted that other USI A-45 alternatives (see Section 3) could also be shown i to render one or more of the other safety issues in Table 4.4.1 moot; however, it is expected that Alternative 5 or 6 would affect a larger number of issues.
! Implementation of a dedicated decay heat removal system might be so effective I that it would allow the relaxation of some current requirements while still ! l maintaining an adequate level of risk. For example, a dedicated DHR has been l accepted , compensate for the oeission of some of the requirements for fire , t 04/20/bo 4-127 NUREG 1289 SEC 4 ORAFT 4/88 , { 5 l
i s Table 4.4.1Totalcos(t gengun,resIve,danjgenergqse (, , l qE(o% &*qlWEn Wh & n 4 5% , Cost Comment USI A 44: Station Blackout 33.5 h x/p - USI A-46: ?,eismic Qualification of Equipernt in Operating Plants 14.0 Generic Issue 84: CE PORV 61.7 Includes adding capability for bleed and feed to six CE operating reactors, M0. 9%,8 W OM Generic Issue 23: Reactor ombined with Generic
*- Coolant Pump Seal Failure I sue 65. W A -17k Q . At'/ M kM Generic Issue 29: Bolting 2.0 Degradation or Failure in Nuclear Power Plants Generic Issue 51: Improving Reliability of Open Cycle w Service Water Systems Generic Issue 101: Break Plus haya y Single Failure in BWR Water Level Instrumentation M (7344 b h 46C '
Generic Issue 124: Auxiliary 10.0 Includes Generic Feedwater System Reliability Issues 68, 93, 122 Total gf V M V A 26e4 G/ A N #.hp ' M
- protection. However, a comprehensive review of the potential relaxations of current requirements that might be allowed if a dedicated DHR system were installed has not been performed, and the subject is not considered further in this report.
4.4.2 Safe y Issue Summary xf This section is limited to a review of he identified issues focusing on the degree of quantification of risk redu ton and costs available in the literature, g A subjective determination is then made as to what extent each issue would be 04/20/88 4-128 NUREG 1289 SEC 4 ORAFT 4/88
influenced by implementing an add-on DHR system. This determination is then
! translated to cost savings. The primary sources of information for a definition of existing Unresolved Safety Issues and Generic Safety Issues are' References 2, 3, 4, and 5. Additional references used for individual issues are identified wifinthetextforeachissue. As indicated in Table 4.4.1, if the add-on DHR {
is implemented, a total of approximately $898 million ir estima'.ed'in cost j savings to the industry resulting from reducing or eliminating the need to implement the technical resolution to the identified issues. None of these costs includa the cost of replacement power that might be required during shut- l downs to implement the resolution of each issue. A ~ .teff :::t ::t h is. - no y,v id; ; ::n;;rv;tiv;1y 1:1 evere e*"-t 11MU , f;1 h ins .. pteeni mu;;, ..- ef - [ 1 The total cost savings for resolving the sabotage issue in Generic Issue A 29, "Nuclear Power Plant Design for the Reduction of Vulnerability to Industrial l
- Sabatoge," are estimated separately at 55.34 billion,. These savings are stated y
separately because they do not represent a solution that is likely to be imposed I . and therefore are not likely to be cost savings. Two other issues (USI A-17, "Systems Interactions," and Generic Issue 105, "Interfacing 5 stem LOCA") were examined and were judged to be relevant to US! i l A-45. GI 10 was not included because of the nominal cost of identified pos- g '
! sible resolutions. n. I f UIA-17wasnothcsideredrecausethjcossare Mg A4as u.& 2 -- - - -
~
w m , Jd &
< w w, Theresdutionconsideredfortheprioritizationstur.yonGI105wastoinstigate I
a program of more rigorous valve inspections and relatively minor hardware modi-i fications; however, since the value impact score is so high (15,000 person-rem / !
$M), it is expected that, even with a lower core melt probability, the more ;
! rigorous valve inspections should still be cost effective. Therefore, no cos't savings from Generic Issue 105 are assumed by implementation of the USI A 45 ADHR(,hternative5or6). k l ! .6l The proposed reso ion o A-17 concludes t,4 hat systematic evaluation of A N M , as
' M ' M 1 plant for system interactions ase not cost effective g phy X l t= - := _ - -A j g i 61. . . I C': .
Q4{One m em m interactions are identified, they#are corrected ustif d. g y/jud 04/20/83 4-129 NUREG 1289 SEC 4 ORAFT 4/88 / f
t A m-nA. , _ g 6
. _ . _ ~_& b* ,
interact'_oin m . w; flooding of : N W sl has been identified and may need . . I, to be E: H__M. :
- Other system interactions may be identified in the future. -
- A dedicated decay heat removal system might compensate for any such interactions, ,
but the cost savings are not now known. The relationship of the individual issues with potential correctiv'e measures , related to USI A-45 are discussed in more detail in Appendix A. References (For Section 4.4) l r l
- 1. Memorandum, V. Stello, Jr., (E00) to Distribution, "FY 1987-1998 Program Guidance," dated November 3, 1986.
l l 2. "A Prioritization of Generic Safety issues,: NUREG-0933, December 1983, i
- 3. Memorandum from Thomis P. Speis (NRR).to Harold R. Denton (NRR) "Generic ,
Issue Management Control System," dated January 29, 1986. 5 ) f 4. "Unresolved Safety !ssues Summary," NUREG-0606, August 16, 1985.
- 5. "NRC Action Plan Developed as a Result of the THI-2 Accident," NUREG-0660, May 1980.
- 4. 5 Effect on Value-!mpact Analysis of Including Sabotaae M , v'kg
/ /
Generic issue A 29 evaluates whether design changes other than a dedicated OHR system could provide cost effective additional protection against insider sabotage. Althougi the rbsolution is not complete, the likely conclusion is that such design changes in operating plants are too costly. The potential for insider sabotage has been addressed as a separate topic in the special emergency analysis for USI A-45. Although there are ongoing efforts (References 1, 2) to place sabotage into the risk framework, that effort has not yet received widespread acceptance. A major difficulty lies with defining the probability of the initiating event - the likelihood of sabotage. Therefore, in the sabotage analyses conducted for USI A-45, the question has been addressed 04/20/88 4-130 NUREG 1289 SEC 4 ORAFT 4/88
from a conditional (or sensitivity) sense. That is, given sabo,tage occurs (or I occurs with scae arbitrary probability), what are the consequences and what a'e r the impacts associated with countering sabotage. The insights from those investigations are summarized in this section. 4.5.1 Semiquantitative Benefits An important value of a separate decay heat removal syst6m is its greater independence. With self-contained water supplies and emergency electric power, the systems can be isolated from most other plant systems. This greater indepenheisimportant'intermsofreducingsabotagepotential. Because an add-on is in a separate structure, the situation is more amenable to stricter and more structured access control. Some core melt sequences would be more difficult to produce with the add-on in place: the "front-line" responde systems would have to be disabled (all redundant trains), the add-on would have to be out of service, and then a transient or small break LOCA would have to be initi-ated. Thus the direct risk and even the residual risk from a number of poten-tial vulnerabilities can be reduced with such a system. However, the proposed f ADHR system does not have the capability to prevent some accident sequences. A knowledgeable sabotetir could be aware of the vulnerability to these sequences. 4.5.2 Conditional value-Impact Analysis The principal difficulty in attempting to deal with sabotage issues in a l quanti'ative manner is that the Boolean structure of the fault trees is not I really amenable to conditional analyses. In general, the system fault trees l l are quantified on the basis of failure probabilities per desand. When this l
"Solution" is subsequently multiplied by the frequency of the initiating event, it defines a p(cs) por reactor year. In the case of insider sabotage, these failure probabilities per demand may be altered; however, that alteration may, in fact, have a time dependence. That is, a device or system may be damaged or put out of service, but because there are periodic maintenance and surveillance tests, the induced failure should be detected at come point in time. In addi-ion, the frequency of the sabotage initiating event, or probability of sabotage, is an unknown and not necessarily constan*. quantity. Therefore, in an attempt to scope the problem, the analysis sas conducted in the manner described dt\
04/20/88 4-131 NUREG 1289 SEC 4 ORAFT 4/88 (
Appendix B. It should be noted that, for the most part, the analysis examines l f only the effect of incider sabotage on the internal event core melt sequences, . The example chosen,' sabotage cf the offsite power and onsite diesels, shows the i significance of insider sabotage. References (For Section 4.5) !
- 1. "Measures of Safeguards Risk Employing PRA (MOSREP) (Probabilistic Risk i Assessment): A Methodology for Estimating Risk Impacts of Safeguards -
Measures," NUREG/CR 4392, BNL-NUREG-51926 Brookhaven National Laboratory, j October 1985.
- 2. "A Ranking botage/ Tampering Avoidance Technology Alternatives,"
NUREG/CR-4462,PNL5690,PacificNorthwest[ Laboratories, January 1986. s ! j f i !
- a. .
i.( t e i l f k i 7 1
- I
, i I
, i
! L i 1 2 i i l L I 04/20/88 4-132 NUREG 1289 SEC 4 DRAFT 4/88 [ i !
4.6 Fffects of Unquantifiable Contributions, Source Term Variations, and Nuclear ( Moratoria p (/ M . h g h , A - This section discusses considerations that heretofore have not been included in value-impact analyses. These considerations are particularly important to the dedicated system approach in Alternatives 5 and 6 discussed in Sec'tions 4.2.5 and 4.2.6. Although the costs or impacts for those alternatives are relatively straightforward to quantify with modest uncertainties, many of the benefits or values are difficult to quantify without large uncertainties. This section provides a descriptive sumary of all the additional considerations. In some of the cases where quantification is possible, estimates are provided in
. Appendix C.
It should be emphasized that including special considerations (i.e., unquanti-fiables) in the decision-making process is consistent with the "Reverse Decision Analysis" principle presented in Reference 1 as follows:
- "Reverse analysis may be used to determine whether the value-impact
( imbalance could be upset by countervailing considerations. (A "reverse calculation" concerns the question, "What facts would justify the action?", rather than "What action do the facts justify?") The advantage of such an approach is that it diminishes pressures for quantifying factors that are problematical to quantify. One need not determine what quantitative value to assign to an unquantified factor. It suffices to determine (judge] 4 whether the quantitative value (of the unquantified factor] should be above i or below (greater or less than] the value that would establish value-irpact equipoise." , 4.6.1 Importance of Unquantifiable Contributions The methodology for performing quantitative value-impact analyses for proposed changes to existing nuclear power plants is still being developed. For the dedicated system alternative, there are significant values or benefits achieved by implementing this option that are difficult to quantify without large uncertainties. The uncertainties in the value term are discussed in ,i i 04/20/88 4-133 NUREG 1289 SEC 4 ORAFT 4/88
Section 4.1 and Reference 2. Some of the values that are difficult to quantify I. are discussed below. As the technology of performing value-impact analyses , develops, better quantitative treatment may eventually be possible. Anupperboundcanbgestimat,edforthecorebinedeffectoftheunquantifiable component of the h M oW n M al initiating events and specia.1 erergencies based on the unquantified (p ior to its occurrence) TMI-2 accident per -108 K
~~
U.S. reacto7 ~- ' years)and the m .,b event (1 per ~9 08 ~ foreign tra ,s, re _ actor years,)i a )( gen,more, precis' e values- sdfortheojera}ingyears,thhuppergouna} W estYatedtobe6E-4r tw .( h ear g j % his v g ar the A 8 per r yr fdr thep;_:ge compargwi y j staff'sguidelineva) o r,e, To.' example, .,quan O per T 'darfageA igegepgnentp}pfem)yr, f r *
^b f .
h~
' f 'A -
N(7A)J ' '"...mmi ZF/1% AUAW- *Le. lus t, rate s h +oortanafd-P vi 1.no 'JLll'. unquanu11aDie ? ~ "~ contribution.
- _l_
4.6.1.1 Internal Initiati~g Event Because of obscure common-mode faults, there are risks from unquantifiable internal initiating events att.ibutable to design and maintenarce errors that - 3 have not been encountered in the past. In fact, many of the generic safety issueJ are failure modes that were recognized only through operating experience or continuing analysis. For example, it has takeri Myears of nuclear plant operation to recognize steam-binding of the pumps as a potential source of f ailure in the auxiliary feedwater (AFW) system, although the problem has always been present. In addition, the incident at Davis-Besse in June 1985 and the analysis of Reference 3 show that the estimated reliability of AFV systems used in PRAs may be too high because of obscure cormon mode faults, unexpectedly high nutnbers of coincident f aults and uperational errors. Thus some unquantified residual risk may be present. 4.6.1.2 Special Emergency Event Although the special-emergency events such as fire, flood, and earthquake h&ve been treated probabilistically in A-45, the"e still remains residual risk in 04/20/88 4-134 NUREG 1289 SEC 4 ORAFT 4/88
these area.. The PRA methodology for t.' eating these events is still in develop-I ment. Such events are* treated only in an approximate fashion, and simplifying assumptions are made. The PRAs do indicate, however, that these events make'a substantial centribution to g qra11, core melt frequency. A dedicated and independent OHR system would prdvid'e otection against ase resid k from Yg fire and internal flooding. The other alternatives are likely to ,ee4subject to ,Y , such residual risk. It is also necessary to consider the extent to which the equipment and plant items required for Alternatives 5 or 6 should be capable of withstanding such events as floods ano earthquakes that are beyond the design basis. Section 4.2.6.6.1 contains a discussion of the capability of a dedicated system to withstand earthquakes beyond the SSE intensity level. 4.6.1.3 Environmental Qualification Adding a safety grade dedicated system,in its own separate building may alleviate c[tainconcernsassociatedwithenvironmentalqualificationissuesrelativeto safe shutdown under accident sonditions. Depending on the plant vintage, many of the existing plants have support system equipment that has not been environ-mentally qualified but nevertheless is required in plant cooldown under transient and accident conditions. If a LOCA or seismic event occurred, there are out-standing safety concerns associated with whether the equipment would satisfy its intended safety function. Although this type of failu;e does not lend itself to a quantitative probabilistic treatment, deterministic considerations suggest that appreciable safety benefits would be derived from reducing envi.onmental qualification concerns. A safety grade, independent, and dedicated system would be a means of compensating for inadequacies in equipment qualification. 4.6.2 Effects of Source Term variations The approach adopted in the standard CRAC-2 code (Reference 4) includes interdiction and decontamination when evaluating population dose. Thus, when this dose is integrated out to 50 miles, no individual lifetime dose is allowed to exceed 25 rem. Consequently, the population dose is insensitive to the source tern size. For example, in the six cases investigated as part of the USI , A-45 program, the mean reduction in population dose for a 10-fold reduction in l size of release was found to be abnut 2.3. For the largest releases (corresponding 04/20/6o 4-135 NUREG 1289 SEC 4 DRAFT 4/83
i t i to $$T1 of Reference 5),* the site to-site variation in the reduction factor was { ( r'r - "; small, the range being from 2.0 to 2.6. For smaller relcases (corresponding to releases in the range of 15 to 0.1% $$T1), the variation in g j j the reduction factor was greater, the range being from 1.1 to 5.3, although the l mean was virtually the same as for the large releases. !
\
t Therefore, for practical purposes, if $1000 per person rom is used for evaluating l the value ters, this term is relatively insensitive to large changes in the j source term. Consequently, the value-impact ratios derived in the value-impact i e M p is for U$! A-45 are unlikely to be affected markedly by changes in the v 'a M the source ters. ! Results from the current programs on the nature of the releases that could , [ occur in severe accidents suggest that the relati a fractions of the various (' isotopes are likely to dif N from those estimated previously. In general, the cesium content is like)y in se 'ower. This should reduce the long-term popula-tion dose outside the decont- aation zone, but it has not yet beer, possible to take this change into account in the value/ impact analysis for US! A 45. 1 ( 4.6.3 Nuclear Power Plant Moratoria
\
j The value-impact analyses in Section 4.1 present only the economic costs to provida replacemeat power following accidents until the damaged plant can be repaired or replaced. The economic effects on other nue. lear power plants resulting from an accident at one plant are not presented. Contamination of other units at a multi unit site is quite Itkely and could cause the shutdown of the other units. Less certain is whether a shutdown of eMee units at other sites would be required for inspection or modification. The possibility that some type of moratorium on nuclear power could be adopted should also be considered. The likely costs of possible short term shutdowns of otner plants are estimated to be about 40% of the convertional onsite costs (see Reference 2) and thus would not have a major effect on the value impact indices. As discussed in Reference 6, the effect of the cost of a long term moratorium on the value-04/20/88 4-116 NUREG 1289 SEC 4 ORAFT 4/88
a i
+
9 9 e 0 , 37 i l , i 1 8 C'p lc a /n /ie n
- det*rit*wl d po e
, (', waan 14 smede A//enar%Ve p<,w.y'Os / aS60c,o/
ford; ay or e no,aw,a,n naesef.e/Riiefive .wm/
.in n a ra / fion e; hou.e% /*
or siblgagis _caianlas:,, 9f,ey
-r' ~f wysaac,p s w..
1 I o asp #
,,, */
impact indices is highly dependent on the nature of the moratorium and the conditional probability attached to it. Three types of moratorium were J analyzed:
- 1. Immediate and complete,
- 2. Complete after a 3 year period of grace to replace enough nuc' lear plants with peak-topping plants to avoid "brownouts," and
- 3. Complete after a 10 year period of grace to replace nuclear plants with fossil-fired or hydro plants.
Md Tha an='yre: .ho-.J th;t , r! er " + he c :t:ri;; i, i......u i a 6e anu cvuip ; c m a dedHtedd:::3h;trearsb.,, tem. :. ..et 1!Lo', t; be c'e+ e "ect';;. M. q g Deta'iled results are presented in Appendix C. References (For Section 4.6)
- 1. NRR Office Letter No. 16, Revision 3, "Regulatory Analysis Guidelines,"
May 13, 1986.
/"
k
- 2. "'she Application of Value-Impact Analysis to USI A-45pSummary Report of y UCLA Studies g-Ig 1pg io ,"
NUREG/CR-4941, h087-7110,fu ' Mr- 198 .
- 3. K. N. Fleming et al , "A Systematic Procedure for the Incorporation of Common Cause Events Into Risk and Reliability Models," Pickard, Lowe, and Garrick, Inc., PLG-0427, August 26, 1985.
- 4. "CRAC-2 Model Description," NUREG/CR-2552, SAN 082-0342, Sandia Naticnal Laboratories, March 1984.
- 5. "Technical Guidance for Siting Criteria Development," NUREG/CR-2239, SAND 81-1549, Sandia National Laboratories, December 1982.
04/20/88 4-137 NUREG 1289 SEC 4 ORAFT 4/88
( - 5 SUMARY OF ALTERNATIVES AND FACTORS FOR DECISION MAKING USI A-45 case studies show that the present reliability of the DHR function may be inadequate in some existing plants leading to unacceptably high values of the probability of core melt. This section presents a sumary of alternatives that were considered to remedy this situation'and the factors that the NRC staff has taken into account in reaching its decision to recommend that Altar-native 2 (Limited-Scope PRAs) be pursued as the resolution of USI A-45. i All results and recommendations are based on the standard 40 year licence. It is likely, however, that many licenses will be extended well beyond 40 years. This would tend to make the @ expensive corrective actions justifiable on a benefit / cost ratio basis. 5.1 Summary of Alternatives Section 3 presented a brief surraary of the six specific alternative courses of action the staff considered in pursuing the resciution of USI A-45. Section 4 presented the value-impact analysis results for sach alternative. This section presents a summary of the factors the staff has taken into account in deciding to recommend Alternative 2. As previously discussed, the six alternative courses of action are: Alternative 1 - No Action Alternative 2 - Limited-Scope PRA as a Basis for Modification Alternative 3 - Application of Specified System Modifications to All Plants Alternative 4 - Depressurization and Cooling Capability Alternative 5 - Dedicated Hot-Shutdown Capability Alternative 6 - Dedicated Cold-Shutdown Capability 5.1.1 Alternative 1 - No Action ( For this alternative, no action would be taken. This alternative achieves no reduction in core melt frequency and risk a7d has no costs or other d'irect ~ 04/25/88 5-1 NUREG 1289 SEC 5 ORAFT 4/88
impacts associated with it. Because it does not resolve any of the significant ( concerns and vulnerabilities with respect to the decay heat removal function as identified herein, the staff does not recommend this course of action. As discussed in Appendix A, even if the proposed resolution for USI A-44 is imple-inented, it achieves on average only a 25% reduction in core melt frequency due to DHR function failures. This is not nearly enough to reduce p(cin)0HR t the order af 1x10.s per p.yr, as discussed in Section 4.2.1. Therefore, the deter-ministic weaknesses discussed in Section 2.3 and the core melt. frequencies shcwn in Section 4.2.1 are sufficient to warrant an improvement in many exist-ing plants. However, as discussed in Section 4.2.1, the plants studied do appear to meet the early and latent fatality portions of the safaty goal; i.c. , the DHR-related risk appears to be less than 0.1% of the risk normally encountered by the public. Also, the probability of a major release for a plant typical of the case study plants with a DHR-related core damage frequency of ~3E-4 per reactor year weald be less than 1E-6 per reactor year if the plant could demonstrate that the product of "conditional severe core damage" (number of core damage sequances resulting in severe core damage divided by the total number of sequences resulting in core damage) and "conditional containment failure" (number of containment failures resulting in a large release divided by.the number of severe core damage sequences) is less than 1E-6/3E-4 (= 1/300 = 3.3E-3). Such a demonstration may be possible for some plants. 5.1.2 Alternative 2 - Limited-Scope PRA As a Basis for Modifications As discussed in Section 2, it was originally visualized in the USI A-45 program that one possible alternative would be for each licensea to conduct at least a limited-scope PRA of its plant to establish the expected contributions to core melt frequency and to risk from DHR function failures. The ORA would also indicate the vulnerable aspects of the DHR function so that modifications could be devised. As a result of the insights gained during the USI A-45 program, the staff now considers that this alternative is a necessary precursor to any of the other l l 04/25/88 5-2 NUREG 1289 SEC 5 ORAFT 4/88 l
alternatives. The systematic individual plant examin'ations for severe acci-( dent vulnerabilities called for in the Severe Accident Policy should provide-the quantitative information required to categorize the plants in accordance with the scheme described previously (see Section 2.3). As a result of these examinations, some plants may be placed in Category 1, i.e., acceptable without major modification. Other plants will be able to utilize the quan'titative results of their analyses to identify 'the most desirable corrective action. While implementation is expected to be considered on a case-by-case basis, the overall intent is that the schedule for resolving DHR vulnerabilities should'be concurrent with the schedules negotiated for overall plant risk reduction identified from implementing the Severe Accident Policy. 5.1.3 Alternative 3 - Application of Specified System Modifications to All Plants
, For this alternative, the staff would apply certain preestablished deterministic guidelines to establish whether a licensee vould be required to take preventive measures at any iridividual unit or site. Since the improvements would be based on the resolution of generic issues, some plant-specific vulnerabilities and
( plant-specific roodifications might not be identified. Although the partial PRAs of the DHR function as carried out in USI A-45 can reveal weaknesses that can be remedied by relatively inexpensive modifications of a plant-specific Dature, there cannot be a high degree of confidence that all the existing weaknesses have been identified. By their very n..ture, few of the plant-specific modifications that would remedy the uncovered weaknesses are likely to be effective against other vulnerabilities. Also, this alternative would not provide a sufficiently comprehensive resolution to all the DHR vulnerabilities identified during the course of the USI A-45 program such as sabotage, environ-
~
mental qualification, general arrangement of equipment, and residual risk. 5.1.4 Alternative 4 - Depressurization and Cooling Capability For this alternative, the following methods of decay heat removal would be required:
- 1. Bleed and feed or secondary-side blowdown capability for PWRs and
( 04/25/38 5-3 NUREG 1289 SEC 5 DRAFT 4/88
- 2. Containment venting for BWRs.
I The capability of existing plants to use one of the above methods of depres-surization and cooling varies from plant to plant. Accordingly, for this alter-ative, the licensees would be required to ensure that the capability exists , either with existing equ'pment or by adding new hardware. For example, in the case of PWRs, this alternative could involve increasing the primary or secon-ary relief capacity. In the case of BWRs, it could involve adding qualified containment vent valves and a ' dedicated diesel-driven pump. Licensees would also be required to ensure that adequate procedures and instrumentation are in place to successfully accomplish the above means of decay heat removal. There are several. major drawbacks to this alternative, assumed here to represent the only required improvement at all plants. (The "fixes" in this alternative may be desirable as part or all of the actions to be taken at certain plants, as identified by the analyses to be performed under Alter-native 2.) For PWRs, the USI A-45 case studies show that this mode of decay heat removal is unlikely (at some plants) to achieve a sufficiently large reduction in core melt frequency. To initiate bleed and feed successfully { requires relatively nrompt operator action, i.e. , approximately 30 minutes. However, operators are more likely to concentrate their efforts on. restoring feedwater and may be unwilling to be distracted from this task before 30 minutes have elapsed. The operator's decision to put an alternative mode of decay heat removal into use may be inhibited by the possibility that its use could lead to a prolonged plant outage with adverse economic effects on the licensee (such as the cost of an extensive cleanup and checkout of instrumentation and cabling within containment). Operating experience indicates that the probability of initiating feed and bleed under conditions where its need is indicated may be on the order of 0.5. In June of 1985, main feedwater was lost at the Davis-Besse plant. This was fol-l lowed by a series of events resulting in loss of auxiliary feedwater (i.e. , all feedwater was lost). The steam generators were allowed to boil down until l they were essentially dry (i.e., all cooling capability through the secondary 1 system was lost). The operators did not initiate feed and bleed cooling al-though its need was indicated believing (as it turned out, correctly) that they 04/25/88 5-4 NUREG 1289 SEC 5 DRAFT 4/88 l - .
would be able to restore cooling through the secondary system in time. This ( event is regarded as an example of a procedural situation where feed and blee,d should have been initiated but was not. On the other hand, in February of 1980, a malfunction of the integrated control system at the Crystal River Plant caused opening of a primary system power-operated relief valve (PORV). The subsequent plant transient caused the criteria for the initiation of safety injection to be exceeded, and it was properly initia,ted by the operator. The plant remained in the resulting feed and bleed mode until the required [ subcooling margin was, reached, which took about 20 minutes. This is an example where feed and bleed existed, and it was maintained. Thus, the two cases (with admittedly poor statistical significance) indicate that the probability of proper initiation of feed and bleed when needed may be no better than 0.5. Since existing PORVs and associated electrical equipment are not safety grade on many plants, there are uncertainties that they would operate under the en-vironmental conditions that could exist unless this equipment were upgraded. Bleed and feed does not provide a comprehensive resolution of all the OHR func tion vulnerabilities discussed in Section 2.3. The secondary-side blowdown in PWRs does not achieve significant reductions in core melt frequency and does not give a comprehensive resolution to all the vulnerabilities associated with the DHR function. An important disadvantage of the BWR part of Alternative 4 is that containment venting must be manually initiated. As in the case of the PWR, concern exists as to the operator's willingness to take such a drastic step since venting the containment atmosphere to the surrounding environment is an acknowledged last-resort maneuver. The analysis in Section 4.2.4.3 shows that late venting is unlikely to achieve significant reductions in core melt frequency in a substantial proportion of existing plants. This alternative does not provide a comprehensive resolution of all the vulnerabilities associated with the DHR function. 5.1. 5 Alternative 5 - Dedicated Hot-Shutdown Capability This alternative involves mainly the addition of independent and dedicated make-up and cooling trains to effect the transfer of decay heat from the reactor (in the case of a PWR) or suppression pool (in the case of a BWR) to the environment. t 04/25/88 5-5 NUREG 1289 SEC 5 DRAFT 4/88
*/
This alternative does not include the capability of achieving and maintaining
! cold-shutdown conditions. The cost of this alternative is substantially greater than that of Alternatives 1 through 4, and the extent of the quantifiable im-provement in p(cm)DHR is also much greater as shown in Tables 4.2.5.1 and 4.3.9(A) and (B). The USI A-45 case studies show that an alternative of this type will achieve the. factor of 10 reduction in p(cm)0HR necessary to achieve values of p(cm)DHR on the order of 1x10 5 per r yr in a substantial proportion of existing plants. The addition of an independent system would also have a, beneficial effect on unquantified contributions to p(cm)0HR such as sabotage, lack of environmental qualification, unanalyzed internal initiating events, and residual risk. Nevertheless, although this alternative would provide a compre- . nensive solution to many of the DHR function vulnerabilities, it does not alle-viate those problems associated with the long-term decay heat removal phase. [/g C re, "!: ita vuli..cobility> : th; :::: ::';:i: cr.d xterr.:? ::di g; :.;.. u gth: ; G inw .T" :y:+ - "culd b; ;t,vi,31 , dg:rb e nn its desian. it wa"u be v:ry diTTl suit, to eliminate o ioiwa irawwivo or 1.n i s cvmun" vui.. .;bilitj, -
5.1. 6 Alternative 6 - Dedicated Cold-Shutdown Capability ( This alternative consists of adding to Alternative 5 those features and compo-nents that would provide the capability to achieve and maintain cold-shutdown conditions. Therefore, instead of stopping at hot-shutdown conditions as in Alternative 5, Alternative 6 would also allow for a completely independent and dedicated means of reaching cold-shutdown conditions. A more complete descrip-tion of this alternative was provided in Sections 3.2 and 4.2.6. This alternative provides a solution to the DHR function vulnerabilities identi-fied in the A-45 program. It provides all of the benefits of Alternative 5 in addressing the short-term decay heat removal vulnerabilities and also addresses additional vulnerabilities associated with the long-term decay heat removal phase. The additional vulnerabilities during the long-term DRR phase include use of non-safety grade equipment, use of nonqualified equipment, lack of inde-pendence (i.e., considerable sharing and interconnections between redunaant trains), and lack of cdequate separation and physical protection of red adant trains. The implementation of Alternative 6 would reduce the dependence on
\
04/25/88 5-6 NUREG 1289 SEC 5 ORAFT 4/88
l I l operating procedures and administrative controls so that most of the long-term . I { DHR operational coreerns identified in References 1 and 2 would be alleviated. Therefore, Alterritive 6 would provide a generic and integrated approach to resolving most of the problems associated with the DHR function. 5.2 Factors for Decision Making 5.2.1 Summary of Approaches to Value-Impact Analyses The value-impact analyses were performed and the results were displayed using three separate methods to assist the decision maker.
~
Method 1. The value term was limited to the reduction in the population dose to 50 miles as estimated by d current version of the CRAC-2 code. The impact term was defined as the total gross economic cost of installa-tion, including replacement power cost, if appropriate, with no reduc-tion for the anticipated economic advantages in the form of averted onsite costs (i.e., loss of investment, replacement power, site clean-up). The criterion for cost effectiveness was assumed to be a maxi-mum expenditure of $1,000 per person-rem averted. Method 2. The value term and the cost-effectiveness criterion were defined as in Item 1; however, the impact term was reduced by the costs to the licensee (not previously used bythe thedecision-NRC Y,K, avert making process). Method 3. The value term was based on the reduction in population dose as in Items 1 and 2 out monetized at $1000 per person-rem and increased by the monetary value of other averted cost savings that would affect the public interest, such as consideration of a nuclear moratorium, insider sabotage, other outstanding generic issues,.unquantifiable internal initiating events, and residual risk from special emergency events (not previously used by NRC in the decisionmaking process). i 04/25/88 5-7 NUREG 1289 SEC 5 DRAFT 4/88
Judged on the basis of the first method defined above, few of the nur, rous ( variations of the alternatives that are based on modifications to existing systems (i.e., A?tarnatives 2, 3, and 4) would ba regarded as cost effective. Judged in terms of the second method defined above, many variations of Alterna-tives 2, 3, and 4 (but not Alternatives 5 or 6) would become cost effective. In several cases, the averted onsite cost would be greater than th'e total engi-neering costs; that is, there is economic incentive for the licensees to make the modifications irrespective of the safety aspect. The two alternatives (5 and 6) that embody an additional independent and dedi-cated DHR system are costly solutions. They are not cost effective judged on
. the basis of either of the first two methods defined above. However, when other considerations not usually taken into account in value-imp t analyses are included as well as the uncertainties (i.e., the third method W these al-ternatives are shown to have a good chance of being cost effective. These other considerations include the full range of the effects on public interest that would result from a' nuclear moratorium, the reduction in the vulnerability of DHR systems to insider sabotage, the resolution (without additional cost) of other related outstanding Generic Issues, and the averted costs estimated to arise from the unquantified contribution to the probability of severe accidents associated with failures of the OHR function.
5.2.2 Industry-Sponsored Study of Point Beach As part of a nuclear-industry-sponsored effort regarding DHR-related risk, a reanalysis was performed for one of the limited-scope PRAs considered in the A-45 case studies described in this Regulatory Analysis (Reference 3). Discus-sions held between industry representatives and the NRC staff regarding simi- ! larities and differences between the two analy'ses are sumcarized in Reference 4. Considerable detail regarding those discussions is presented in the several : enclosures to Reference 4. The results of those discussions are summarized in Appendix 0, "Insights Gained From Industry-Sponsored Study of Point Beach." 3 04/25/88 5-8 NUREG 1289 SEC 5 DRAFT 4/88
6 i 1 Licensees embarking on an analysis of DHR-related risk may wish to refer to ( the "insights" in Appendix D)I for information and guidance in deciding which - methods and assurptions could be most appropriately applied. References (For Section 5)
- 1. AE00 Case Study Report, "DHR Problems in U.S. Pressurized Water Reactors," July 1985.
- 2. G. Vine et al., "Residual Heat Removal Experience Review and Safety Analysis: Pressurized Water Reactor, NSAC 52, Nuclear Safety Analysis Center, EPRI, January 1983.
- 3. "EPRI/WOG Analysis of Decay Heat Removal Risk at Point Beach," SAI Corp.
and Westinghouse Electric Corp., NSAC-113, March 1988.
- 4. Memorandum, R. Woods to K. Kniel, "Summsry of 3/31/88 Meeting to Discuss Reanalysis of DHR Risk at Point Beach, With Followup Coorespondence,"
April 26, 1988. { l. d 04/25/88 5-9 NUREG 1289 SEC 5 DRAFT 4/88
APPENDIX A '(' G NERIO ISSUES POTENTIALLY RELATED TO US) A-45 CORRECTIVE ACTIONS (F.'Aates to Section 4.4) The A-45 case studies evaluatad the plants .in their current condition. The risk due to failure of the decay heat removal function, as discussed in Alternative 1, and therefore the reduction in risk.that would result from'the implementation of the five other alternative actions could be affected by the c implementation of other USIs or generic issues that would result in changes in the design or operation of these plants. Ideally, the effect of all currently
- unresolved generic issues should be evaluated. However, such an extensive evaluation would require a large effort. Thedetailedevaluationhythere-fore been limited to the discussion in Section A.1 [ one issue A-44, "Station X Blackout.," which is nearly esolved, could be implemented before USI A-45 is resolved, and would have a significant effect on the risk from failure of the tl decay heat removal function. Less detailed di ssions of other generic issues A are presented in Sections A.2 through A.9.
C, h '
& & dJ Ne %
A.1 USI 4-44: Station Blackout h r (prA , " m m - p g A .1.1 Proposed Resolution of USI A-44 %"M) The term "station blackout" means the loss of AC power to all essential and non- i essential electric hses concurrent with turbine trip and the unavailability of the redundant ensite emergency AC power systems. If a station blackout persists for a sufficient time, the capability of the AC-independent op tems to remove
- decay heat may be exceeded, and core melt and containment failure could result.
Existing regulations do not require explicitly that nuclear power plants be able to cope with a station blackoat for any specified period of time. Station , blackout sjquences were found to be sinnificant contributors to core melt fre-quency ir:,ome of the A-45 hease stud and insignificant in others. [ i 04/25/88 A-1 NUREG 1289 APP A DRAFT 4/88
The technical, findings of the staff's studies of the station blackout issue ( are presented Reference 1. Additional information is provided in References " 2, 3, and 4. A.1. 2 Relationship Between USI A-44 and USI A-45 As a result of the station blackout studies, the staff's proposed resolution of U I A 4gjfor specific guidance relating to the design and operation of of emergency AC power systems as well as a requirement that plants be )( able to cope with a station blackout for a specified period of time. The general objective of the proposed requirements is to reduce the risk of severe acidents associated with station blackout by making station blackout a rela-tively small contributor to total core melt frequency (<1E-5 per r yr). The USI A-44 concern for maintaining adequate core cooling under station blackout conditions can be considered a subset of the overalt A-45 issue. The resolutions of these two issues have been coordinated so that the technical information resulting f om both studies was shared among the major participants,' ( including NRC staff and contractors. A .1. 3 Evaluation with USI 44 Implemented Thepignt-specificmodificationsconsideredintheUSIA-45programbasedon d e PRk results (Alternative 2) often addressed the vulnerabilities to station K blackout. Virtually all the reduction in core melt frequency from USI A-45 alternatives that reduce vulnerabilities to long-term station blackout events would be accuplished by USI A-44. For the plants evaluated in USI A-45, USI A-44 would achieve about 40 to 70 percent of the estimated reduction in core melt frequency associated with modifications considerea in USI A-45. Implementation of Alternative 3 includes the implementation of USI A-44. Imple-l mentationofA-44woulddecreasetheriskreductionprovidedbyblefdandfeed in PWRs and containment venting in BWRs (Alternative 4), but the exact amount has not been calculated, f 04/25/88 A-2 NUREG 1289 APP A DRAFT 4/88
~
f,ada 6 4 D) c=y) nM & m;= e=k Q,l., p& of VSI m: ~44 A comparisor of the reduction in core melt frequency that would result from l the implementation of USI A-44 and of an ADHR (Alternative 5) is shown in Table A.1.1. Overall, implementatien of the propos g sglugijn S would result in an estimated reduction in core melt freque'ncy in T.nepta
- =Leted =du ^-15 ranging from zero to 1.2E-4 per reactor year and agesti-mated duction of 4.2E-5 per reactor year. Those plants "with a zero reduction in core melt frequency associated with the resolution of USI A-44 according to our analysis. That is, they have sufficient battery and conden-sate storage tank (CST) capacity to cope with a station blackout for 8 hours. s
-+ ^
Table A.1.1 Comparisons of reduction in core melt frequency for USI A-44 and USI A-45 Reduction in Core Reduction in Core
. Melt usquency from Melt Frequency from Implemeatation of Dedicated DHR system acm w USI A-44 Plant USI A-44 (per r y) (per r y)a acm w/o USI A-44 A 3.0E-5 2.92E-4 0.10 B 4.8E-5 2.2E-4 0.22 D b b 4.8E-5 9.9E-4 0.04 c
( C O 7.0E-5 0 c 0 O 1.7E-4 0 E 5.4E-5 1.1E-4 0.49 F 1.2E-4 4.0E-4 0.31
/
i a Estimates based on giving credit for bleed and feed for PWRs except where no t.e d . c Estimated without giving credit for bleed and feed. r e f='r*1 C5 Basedonadeterminationthatth[plantalreadyhasan8-hourTtationbattery Nf l capability and aTror core meltf5ssociated with long-term station blackou (e.g. , adequate CST inventory and no core uncovery resulting from loss jof fe seal integrity). The efore, no plant modifications would be. required to comply with the res ion of USI A-44. q l l 04/25/88 A-3 NUREG 1289 APP i ORAFT 4/88
Without the implementation of USI A-44, the addition of an independent decay ( heatremovalsystemwouldresultinan[estimatedfaverageTreductionincore - melt frequency of 2.1E-4 per reactor year. For the plants evaluat (, estimated M reduction in core melt frequency from fE-5perUSI A-44 (g reactor year) is approximately 25 percent of the USI A-45 reduction. In other words, this sample suggests that ifj USI A-44 were implemented befo're USI A-45, X the average reduction in core melt frequency from USI A-45 (Alternative 5) wculd be diminished by about 25 p,ercent compared to the estimated reduction associatedwithUSIA-45alone(N.9,1.6E-4perreactoryearcomparedto X 2.1F-4 per reactor year). But this reduction varies from zero to approximately 45 pe: cent of the reduction resulting from the addition of an ADH9. However, the estimated costs for these two backfits differ substar,tially. USI A-44 is estimated to cost an average of $600,000 per plant /9eference 5) whereas an independent DHR system could cost on the order of $70,000,00d per plant. A.1.4 Comparison of Estimates of p(cm) Due to Station Blackout - USI A-44 and USI A-45 8ecause the technical studies supporting both USI A-44 and USI A-45 examined ( the station blackout contribution to the probability of core melt, it is useful to compare the results from the two programs in order to understand any dif-ferences in the treatment of station blackout in the USI A-45 analysis, h A.1. 4.1 Pressurized Water Reactors W05 A SY M S A JynL hWf . The following table presents the contribution to p(cm) from station blackout calculated under the USI A-45 program and for various coping capabilities under the*A-44 program. 4 0 04/25/88 A-4 NUREG 1289 APP A ORAFT 4/88
i p(cm) A-44 - (per r-yr) p(cm) A-45 (per r yr)
. Plant 2hr 4 hr 8 hr A 3.4E-5 2.2E-5 1.2E-5 3.6E-5 8 14E- 8.8E-5 4.0E-5 7.5E-7 a
[ C 12E-5 8.7E-5 5.1E-5 a 0 1.9E-5 1.1E-5 0.7E-5
- Assumed to be negligible based on the determination that the plant has the capability to cope with an 8-hr bisckout.
-+ .
It may be observed that the values for ant A are in good agreement. Any ( differences in failure rate data smalldifferencesareattributabletomino;lant8,there1s or recovery assumptions. In the case.off , gnificant difference betwten the two studies; however, this is readily explained by differences in the analyses. The A-45 study gave credit for new batteries at the site and use of the station black-start diesels as a recovery action ( within two hours. Without credit for this recovery, the A-45 p(cm)SB0 I3 3.7E-5/r yr. If certain common-mode recovery actions are also removed, the p(cm)SB0 is 4.6E-5/r yr. Finally, the A-45 analysis used the national average frequency for loss of offsite power (0.086/yr), while the A-44 analysis uses a site-specific value that is approximately three times greater. If the p(cm)SB0 of 4.6E-5 is multiplied by a factor of 3, the result is close to the A-44resultwithasf-hourcopingcapability. In,the case of ants C and D, there was no specific analysis for station blac t in A-45. The plants were examined on the basis of the criteria in g[ NUREG-1032, i.e., are battery capability and CST capacity adequate for eight hours? Because the answer was in the affirmative, no further analysis was performed. Had the analysis been pursued, it is presumed that,the results would have been similar to those for A-44. However, in addition to CST and battery capacity, USI A-44 would require additional analyses to determine that p g v g - g -hour station blackout capability (e.g., equipment operaoitity, y seal behavior). 04/25/88 A-5 NUREG 1289 APP A DRAFT 4/88
A.1.4.2 Boiling Water Reactors k - In the BWRs, both A-44'and A-45 provide three values for p(cm); however, the time frames are different. fhe results are compared in the following table: F -+ ._ p(ca) A- [ p(ca) A-44 (per r-vr) (per r-yr) [. Plar.t 2 hr 4 hr 8 hr ~0.5 hr 4 hr 30 hr E 3.3E-5 1.2E-5 3E-6 2.7E-5 2.3E-5 1.1E-6 .
'F 3.6E-5 1.9E-b 6.6E-6 2.9E-5 4.6E-5 1.4E-6 b,
for the A-45 analysis, the three time frames represent the following sequences, which are defined in Reference 6:
~0.5 hr T2 0'& T PO 4 hr T YZ* & 7 PYZE t
30 hr T tYZ It should be noted that, in A-45, the p(cm) estimates for the two shorter time frames are dominated by failures in emergency electric power; in the 30-hour case, however, emergency electric power'is initially available and therefore failures other than electric power also play a role. Based on these results, any differences between the two analyses are attributable to variation in failure rates and event frequencies. A.1. 5 Summary and Conclusions It is difficult to draw general conclusions regarding the relationship between USIs A-44 and A-45 based on the plant-specific evaluations completed under USI A-45. The impact of USI A-44 on USI A-45 depends on a number of factors. These include (1) the plant's likelihood of station blackout initiating events. (2) the vulnerability to other internal events and special emergencies, and (3) the specific alternatives considered as plant modifications to rosolve USI A-45. For example, the existence of a non-safety grade gas turbine ganerator at cne plant provides a significant benefit in terms of reducing the frequency 04/25/88 A-6 NUREG 1289 APP A ORAFT 4/88
of station blackout due to nonseismic events. Without the gas turbine generator, ( the estimated core melt frequency for station blackout for nonseismic events - would be about a factor of five higher than with the generator, and the resolu-tion of USI A-44 would have a correspondingly greater impact on the resolution of USI A-45. In conclusion, the implementation of USI A-44 for some plants would reduce the cost effectiveness fur Alternative 5 (an ADHR). For other plants, implementation of USI A-44 would have little effect on the cost effectiveness of USI A-45 modifications since, for these plants, the core melt frequency reductions asso dated with the USI A-45 modification are much larger than those due to USI A-44. A.2 USI A-46: Seismic Qualification of Equipment in Operating Plants This issue examines the need to verify the seismic adequccy of mechanical and electrical equipment required to safely bring the reactor and plant to a safe shutdown condition and to maintain it in a safe condition. The specific objec-tive of the A-46 task is to develop viable, cost effective alternatives to cur-rent seismic qualification requirements to be applied to operating nuclear power ( plants. Reference 7 includes a regulatory analysis that addresses the proposed resolution to require verification of seismic adequacy and functional capability of equipment. This verification is to be accomplished by performing an on-site inspection of anchors and supports, comparing plant equipment with seismic exper-ience data and test experience data, and reviewing the functional capability of electrical relays. Table 2 of Reference 7 presents representative costs to verify seismic adequacy and includes estimates of the cost of replacing certain equipment. The proposed implementation procedure (Section IV of Reference 7) includes the guideline that safe shutdown means bringing the plant to a hot-shutdown condition and maintaining it there for a minimum of 72 hours. The proposal further indicates that, in the event that maintaining safe shutdown is dependent on a single compone whos fa}ureduegi,pegose1ge,lo}ds,optoy _ , 3 , _ randomfailurewouldprecludeuswynenremovalphelicensee,shouldshowthat there exists at least one practical alternative for ach gnt ning is not dependent on that ' safe shutdown tha .v a+ase a greatdr of components est involved in achieving and maintaining hot shutdown than would K be associated with the USI A-45 independent and dedicated heat removal system l g (i.e. control rod drive mechanisms - see Table 1 of Reference 7), one could 04/25/88 A-7 NUREG 1289 APP A ORAFT 4/88 ; } . - _ _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ __ ___ _ ._
conclude that no cost savings from USI A-46 would be obtained by installation ,I of an. independent and dedicated heat removal system for USI A-45. However, while it is t. rue that some equipment needed for safe shutdown would not be covered by an independent and dedicated decay heat removal system, it still may be concluded that sufficient safety benefit could be gained oy the proposed DHR system to render the remaining seismic risk sufficiently low to resolve USI A-46. As a minimum, installation of the proposed DHR system woulu reduce the list of existing safe-shutdown components that would need to be seis-mically "verified" using the Reference 7 methodology. Regardless, for the fore-going reasons, some cost savings of USI A-46 would be realized with the USI A-45 l Alternative 6 Seismic Category I ADHR system. The total industry costs estimated l in Reference 7 (page 34) for 70 plants (units) participating in a generic seis- l 6 mic verification program would be $28 to $59 million. If a utility decides not to participate in the proposed generic resolution, additional costs of preparing and submitting a plant-specific report and the review and audit by the NRC staff would be incurred. This would add an estimated $50,000 to $100,000 to each utility's cost and $10,000 to $30,000 per utility to NRC staff cc,sts. Ignoring ( the latter costs for a conservative bias (e.g. , all utilities select the lower-cost generic approach) and focusing on the lower value in the estimated $28 to 59 million range, again for a conservative bias (i.e., lower cost savings), it would not be overstating the proposed impact of USI A-45 Alternative 6 on USI A-46 to choose a factor of 0.5 of this lower range. .This translates to an estimated total industry cost savings of $14 million. 1 A.3 Generic Issue 84: CE PORVs . As indicated in Section 4.2.4.1, several CE plants, including the newer CE System 80 plants, are not provided with PORVs. The earlier staff position on ] this issue for CE plants, as discussed in References 8 and 9, was that on the basis of risk reduction and cost-benefit considerations, no overwhelming benefit would result from requiring the installation of PORVs,in CE plants that currently do not have them. However, the staff also concluded thatjbecause of % defense-in-depth considerations and g other unquantifiable consideration woo + 4
! factored into the evaluation, more substantial benefits could be realized. The staff further concluded that a final decision should await resolution of USI A-45, 04/25/88 A-8 NUREG 1289 A.nP A DRAFT 4/88 f
i
l but the inference was left that, if "no action" was decided for USI A-45, i installation of PORVs in CE plants would be recommended by the staff.
- The total cost associated with installing a depressurization system such as PORVs was estimated in Reference 9 as $9.2 million per plant. It is expected that, if an add-on OHR system is implemented as the resolution to (JSI A-45, the safety benefit to be gained (by also adding just PORVs to CE plants) would be sufficiently reduced to preclude the need for the PORV addition with estimated total cost savings of $55.2M for six CE plants.
4 Related to this issue would be an upgrade of non-safety grade PORVs on existing WRs to increase relief area and possibly change the valve body to a globe or angle valve to improve reliability (as addressed in Section 4.2.4.1). As dis-cussed, such upgrading is shown to be cost effective up to an estimated $100,000 to implement (on 65 reactors). If an add-on OHR is implemonted for USI A-45, the PORV upgrade would not be needed. Therefore, a total additional. cost savings . of $ 5 million is estimated. Averted onsite costs were not included in this [
; eval ion.
A.4 Generic Issue 23: Reactor Coolant Pump Seal Failures
~
, W" g
E '::::0M has & been ( V integrated into Generic Issue y robability of Co hitDuetoComponentCoolingWaterSysteRailures oth of these issues
~
concentrate on reducing the core melt freyuency due to failure of reactor ( coolant pump seals. Reference 10 presents the 1983 prioritization of these l issues in which preventive t.nnual seal replacement b ~e H:r:d fer r;=! t';a-
; o?--Usu -0.3 and the addition of a steam + turbine-driven charging pump eal, injection (less vulnerable to a loss of'AC power) is considered for ::~ R @
A regulatory oposing the g f's fi a' reso g n et been i documented, ste i l a ltr I<T7bb, , con t; :, tim.ted a=mm.merun.c;w,w m;s,w w,,_,=_ wh ' Mc~tr no ba-at 'a l 40 -
.Th A ee>v @u-&m/W4 '
The proposed USI A-45 independent and dedicated DHR system would reduce the total risk due to RCP seal failures since a backup supply of high pressure ! makeup would extend the time during which operator action / system repair could 04/25/88 A9 NUREG 1289 APP A DRAFT 4/88
take place (prior to the need to shift the water source to the ECCS sump). ( While implementation of a USI A-45 add-on OHR would have no effect on reducing the frequency of seal failures, it is presumed for this evaluation that a combination of the proposed USI A-45 add-on and selected procedures and training (RCP cperating procedures and emergency procedures) would be enough to allow operatorrecoveryactionsufficienttoresolveIssue62pu W Reiereni.e 15 uv.i. lii ou suv.ei, fe, . cuo erva1.ively w .~ , , , . . .m iv... Lies (0700.
, f
[ M 114:n) c' att i-=t:d cest :=i,,v.. A r;= diag tc $700 ;;illt:r f: ::d: tv , aswomuovai. (af,ei- vi+h a m e erv.e!1. Lin ) Pre;dw... # t e= 4 a d ;; . , A.5 Generic Issue 29: Bolting Degradation or Failure in Nuclear Power riants There are numerous bolting applications in nuclear power plants. The most crucial bolting applications are those constituting an integral part of the primary pressure boundary sucn as closure studs and bolts on reactor vessels, reactor coolant pumps, and steam generators. Failure of these bolts or studs could result in the loss of reactor coolant and thus jeopardize the safe opera-tion of nuclear power plants. Other bolting applications such as component ( support and embedded anchor bolts or studs are essential for withstanding transient loads created during abnormal or accident conditions. In recent years, the number of bolting-related incidents reported by the licensees of operating reactors and reactors under construction has increased. A large number of the reported bolting incidents are related to primary pressure boundary applications and support structures of major components. Therefore, thera is increasing concern regarding the integrity of the primary pressure boundary in operating nuclear power plants and the reliability of the component support structures following a LOCA or earthquake. Reference 10 provides a 1983 prioritization evaluation of this issue that resulted in a rating of "high." Refcrence 11 provides a 1985 proposed value-impact analysis. These studies indicate that the small-break LOCA event was the most limiting scenario and resulted in a large risk reduction factor. The proposed cost-effective alter-native for Generic Issue 29 is to replace bolts or studs with stainless steel materials that are more resistant to corrosion. Since the proposed USI A-45 add-on OHR includes a small-break makeup and decay heat removal capability, it g is expected that the USI A-45 irnplementation would preclude the need for a bolt 04/25/88 A-10 NUREG 1289 APP A DRAFT 4/88
J
~
replacement program. The total industry costs associated with Generic Issue 29 were estimated at approximately $2 million. Averted costs due to an accident. l are not included in this estimate. A.6 Generic Issue 51: Proposed Requirements for Improving Rtliability of Open-Cycle Service Water Systems - i i Reference 10 applies a 1983 priority ranking of "medium" to this issue. The service water system (SWS) is the ultimate heat sink that, during an accident , or transient, cools the reactor building component cooling water heat exchangers that, in turn, cool tne RHR heat exchangers as well as provide cooling for . l , safety-related pumps and area cooling coils. Fouling of the safety-related SWS by mud, silt, corrosion products, or aquatic bivalves has led to plant shJtdowns, l reduced power operation for repairs and modifications, and degraded modes of ! The resolution considered in Reference 10 consists of improvements ogration. at surveillance and preventive maintenance programs at sites where bivalves are g known to exist. A regulatory analysis proposing the staff's final resolution has not yet been documented for Generic Issue 51; however, since major hardware i
,( modifications are not being proposed, it is presumed for this study that a l cost-effective preventive maintenance resolution would eventually be imple-mented. As indicated in Section 4.2.6 of this Regulatory Analysis, the add-on
! OHR (ADHR) is completely self-contained within an ADHR building and an.ADHR pump house. The ADHR pump house would be located at the edge of the ultimate heat sink (river, lake) and would contain the ADHR service water pump, pump discharge ! control valve, and discharge isolation valve. Therefore while implementation i of the USI A-45 ADHR system would not reduce the frequet.cy of fouling of con-ventional service water systems, sufficient separation of the ADHR system would I help to reduce the probability of simultaneously fouling all service water I systems. This factor, combined with the added expectation that improvement in engineering, operation, and surveillance of the ADHR service water would occur j at those sites experiencing fouling, lead to a conclusion that, implementation of the USI A-45 add-on would resolve Generic Issue 51. N: ". for:r " lo e i en ::iet u .ith lmp hm. U nv in, yi.,enti.. int u n ce a-^'~ - ^ "' r M t : a - ne 005.5 d'i4^^ == 1 mmwpma4 e f 4hN
~^ 'A.W4TN A e4m .
s i 04/25/88 A-11 NUREG 1289 APP A DRAFT 4/88
A.7 Generic Issue 101: 8reak Plus Single Failure in BWR Water Level ( . Instrumentation . Thisconcernpertainstotheconse,quenesassocigtg,withabreakinaBWR instrumentlinecombinedwiththeworstsing1'ejfail'ure."Reference 10providesa X, prioritization analysis for this issue. A regulatory analysis pro *posi6g the staff's fir,a1 resolution has not yet been documented; h'owever, the sta' 's
. priority ranking of "5igh" indicates that a cost-effective solution is l'.kely.
The resolution could include modifications to the logics that use reactor level as an input. A cost of $1M per reactor was implied in Referenes 10 as a reason-able velue to consider for resolution of this issue. The number of BWRs affected was not provided in Reference 10; however, a conservatively low estimate or 48 % plants is selected for this eveluation. Since the add-on DHR system for USI A-45 would include a limited makeup capability as well as decay heat removal, it is expected that the dominant core melt scenarios for Generic Issue .101 would be improved (i.e., become less likely). As a minimum, more time would ;;,e avail able for the operator to understand the scenario and take emergency action. Implementation of a USI A-45 add-on OHR would therefore be expected to resolve (. GenericIssue101atacostsavingsofapproximately$hmillion. A.8 Generic Issue 124: Auxiliary Feedwater System Reliability Refercnce 10 provides the prioritization for this issue. A backfit analysis proposing the staff's final resolution has been drafted and is soon to be pub-lished. Because of the significance of the AFWS in reducing core melt frequency, the staff determined previously that PWRs should meet the reliability criterion specified in SRP section 10.4.9, except for operating reactors. Operating experience as well as industry studies indicate that AFWSs continue to fail at a high rate. The draft backfit analysis on this issue proposes that certain operating plant licensees demonstrate thst their AFWS complies with an unavail-ability criterion equivalent to no more than 10 4 per demand. Those utilities that cannot satisfy the criterion would be expected to propose appropriate modi-fications. These modifications may be in the hardware, maintenance, testing or surveillance, procedures, or Technical Specifications. Elements of Generic Issue 68, "Loss of AFWS Oue to AFW Steam High Energy Line Break," Generic Issue 04/25/88 A 12 NUREG 1289 APP A ORAFT 4/88
4 93, "Steam Binding of AFW Pumps", and Generic, Issue 122, "Loss of all Feedwater," ( are also covered by Issue 124. . Based on previous staff evaluations of W, CE, and B&W plant AFWs (NUREG-0611, NUREG-0635, B&W plant SERs), estimates are made in the draft backfit analysis as to which plants are likely to require modifications. Based on these esti-mates, a total industry backfit cost of $19.3 million is shown (plant-specific PRAs plus selected modifications). Although the backfit analysis proposes moving forward with implementation of Generic Issue 124'(i.e. , do not wait for 1 USI A-45), it is likely that implementation of the USI A-45 independent and dedicated DHR would sufficiently improve overall AFWS reliability to render most hardware modifications proposed in GI-124 unnecessary. However, it still would make good engineering sense to improve poor maintenance practices and j inadequate testing. It is therefore expected that such an improvement program would continue. From the draft backfit analysis cost of $19.3 million, it is t conservatively estimated that about $10 million can be saved from Generic Issue 124 if the USI A-45 ADHR system is implemented. A.9 Other Estimates of Cost Savings From Integrating Generic Issues ( Reference 12 provided a preliminary study of the cost savings from solving in an integrated manner selected generic issues. For those issues that have a high degree of relationship to USI A-45, cost savings are estimated to be $5.69 billion. If those issues that have a medium and low degree of relationship l to A-45 are included, the cost savings are increased to $7.06pan 1.33 billion, respectively. Therefore, the cost savings provided in Table may consider- , ably underestimate the true savings in resolving in an integrated fashion other generic safety issues. However, as previou:,1y mentioned, combining 4he total 111on) for resolving the sabotage issue with the savings ' cost' savings ($5.34b{21yieldstotalcostsavingsof$6.24billionforresolv-reflectedinTableh1 ing other generic issues, which is reasonably close to the estimates provided in Reference 12 for those issues that are closely related to USI A-45. i lt ! l 04/25/88 A-13 NUREG 1289 APP A ORAFT 4/88
References -(For Appendix A) - I .
- 1. "Evaluation of Station Blackout Accidents at Nuclear Power Plants, Technical Findings Related to Unresolved Safety Issue A-44'," NUREG-1032, Draft, May 1985.
- 2. "Station Blackout Accident Analyses," NUREG/CR-3226, May 1983.
- 3. "Reliability of Emergency AC Power Sources at Nuclear Power Plants,"
NUREG/CR-2989, July 1983.
- 4. "Collection and Evaluation of Complete and Partial Losses of Offsite i Power at Nuclear Power Plants," NUREG/CR-3992, February 1985.
- 5. "Regulatory Analysis for the Resolution of Unresolved Safety Issue A-44, Station Blackout," NUREG-1109, Oraft, January 1986.
\h3vWn " ==
o a > _b_ y _', f ,' '; 2 - F G 6.)ShutdownDecayHeatRemovalAnalys Plant Case Studies and Special 4' (, Issues Sumary Report," NUREG-1292, November 1987. W h * ; O lrv~ A O M d U w : ' A W tb'W
- 7. g =ismic' ualification of Equipment in Operating Nuclear Power Plants,"
Ase' NUREG- ,
- 8. "Power Operated Relief Valves for Combustion Engineering Plants,"
SECY-84-134, March 23, 1984.
- 9. "Evaluation of the Need for a Rapid Depressurization Capability for CE Plants," NUREG-1044, April 1984.
- 10. "A'Prioritization of Generic Safety Issues," NUREG-0933, December 1983,
- 11. Memorandum, V. Stello, Jr. , (E00) to Distribution, "FY 1987-1988 Program Guidance," dated November 3, 1986.
- 12. Letter, L. J. Ybarrondo to M. A. Taylor, "Transmittal of Draf t Material on Integration of Regulatory Issues," January 22, 1986.
04/25/88 A-14 NUREG 1289 APP A ORAFT 4/88
- k. .
APPENDIX B FURTHER DISCUSSION OF SABOTAGE ISSUES (Relates to Section 4.5) . B.1 Sabotage of Diesel Generators Analyses have shown t5at diesel generators can be vulnerable to deliberate destruction because they are complex, have multiple supporting systems, and are usually separated and isolated from other plant areas for safety reasons.
*-. Unfortunately, the redundant diesel trains in older plants are often in close proximity to one another with relatively easy access between them. Therefore, this sabotage analysis assumes that the diesel generators fail (when demanded) '
with a probability of 1.0. However, because the diesel generators are run on a monthly basis, it is further argued that the condition would not exist for more than 30 days. Thus, to properly compare the base case and the situation with insider sabotage, it is appropriate to divide the r.sndom initiating event fre- { quencies by 12 so that the core melt probability is defined as p(cm) per reactor- I month, with and without disablement. These values are shown in Table B.1, Columns 3 and 4. It may be observed that p(cm) per reactor' -month, given a deliberate act against the diesels, exceeds the p(cm) per reactor-month for the base case by factors of 2 to more than 300, ' " exact ratio being very plant specific. Again, it must be kept in mind that these values are conditional on the diesel generator being disabled. Furthermore, for the reasons cited above, i it woh <t .c improper to multiply these values by twelve in an attempt to get a l p(cm)sab per reactor year. B.2 Sabotage of Diesel Generators and Offsite Power It has been amply demonstrated that the electric power distrib'ution grid is vulnerable to deliberate attack. If this is coupled with the potential vulner-ability of the diesel generators, the possibility of a severe situation is raised. Alsc, as above, the analysis is complicated by two factors: (1) the 04/25/88 B-1 NURFG 1289 APP B ORAFT 4/88 l
Table B.1 ' Comparison of probability of core melt given ( sabotage has occurred (internal events only) , DG Disabled Base Case Base Case DG Disabled LOSP Induced p(cm) p(ca) p(ca) p(cm) Plant (per r yr) (per r-mo) (per r-mo) (Conditional) (1) (2) . (3) (4) (5) . A 1.39E-4 1.lfE-5 #SdE-5 7 1,3E-2 B . 7.1E-5 5.9fE-6 -5 -3 C 1.4E-5 1.2E-6 3.3%-4 5.75E-2 0 8.8E-5 7.3E-6 4.35E-4 3.86E-2
- E 9.9E-5 8.3E-6 /.8dE-3 E F 2.8 E-4 2.41E-5 2.82E-3 -1 n
i l f ( Table B.2 Probabilitu of core melt given the combined sabotage event, die.s1 generator disabled and loss of.offsite power induced, as a function of probability of the event
- ar.d including random initiating events I p(sab)=0.1 p(sab)=0.01 p(sab)=0.001 ;
p(cm) p(cm) p(cm) . Plant (per r yr) (per r yr) (per r yr)
'7.Vil I.0)5~3 A h44E-3 1.255 ' 3.74E-4
- B 0 E-4 2.43-4 C E-3 E-4 1.32E-4 D 4.04E-3 5.61E-4 2.1%-4 E NE-2 h. 5 ,
F 6.78E-2 E-3 1.11E-3 l; I 04/25/88 B-A NUREG 1289 APP B ORAFT 4/88 l
likelihood of an adversary attempting the combined event, i.e. , disable the i diesel generators and cause a loss of offsite power, is unknown and (2) if the loss-of-offsite power event is not close in time to the disabling of the diesel generators, the synergism is lost to the adversary. Therefore, the combi.7ed analysis proceeds with, first, a conditional analysis in which it is assumed that the diesel generators are disabled and a loss of offsite power is induced. Under these conditions, the only accident, sequences of interest are the ones initiated by loss of offsite power. For these sequences, the p(cm).is conditional on the combined event. The results for this case are shown Y Table 8.1, Column 5. It can be observed here that the N
;, p obability of a core melt, if the combined event occurs, varias from about 0. M
;o nearly 40%, depending on the plant and its dependence on AC power for l
emergency systems. This is essentially a bounding case, a "what if" situation. Because the li ihood of such an event is really unknown, the only reasonable X way to examine the question is with a limited sensitivity study. This has been done for sabotage by postulating that the probability (frequency) of the com-bined event is 0.1, 0.01, and 0.001 per year. As with the conditional case i described above, this affects only the T or3 LOSP sequences. As a result, because this combined event has been given a frequency, it becomes, in essence, an added random event. The total core melt probability under these conditions is the sum of the base case p(cm) for randomly initiated events and the ,p(cm) l estimated for this events The results for these three cases are shown Y Table' 8.2, Although the anslysis of sabotage considers only its effect on the l ! internal sequences, to obtain a better estimate of the total p(cm), the base case p(cm), including internal events and special emergencies, is used. l Because this is a sensitivity calculation, it is appropriate to consider the i realism of any particular assumption. A frequency of 0.1 per year seems high; i to accept it would imply a strong belief that such an event will occur. But j the 0.001 value can be argued to be a bounding value since the,re have been no 4 such events in about 1000 reactor-years of o'peration. The difficulty with this approach is that current studies of terrorism and similar events strongly suggest that history is a very inadequate indicatnr of the future. The number and nature of such events is changing continuously. Therefore, the selection 04/25/88 B]3 NUREG 1289 APP B ORAFT 4/88
of the appropriate value for the likelihood of the combined event is very much
! a matter of judgment. -
Because these potential sabotage events relate to just the diesel generators, it is considered unlikely that any of the specific modifications discussed , elsewherewillhavefignificanteffectintermsofreducingtheco'nsequences N of such an event. On the other hand, because the add-on decay heat removal systems are completely independent of the base plant systems, it is antici-pated that there will be a positive benefit in countering such sabotage events. Therefoye,,t,hevalue-impacto,fthead,d-o g em,i e ned in
*b.
Table B.3 for t'h{tir'ee postulated @:B 'iPJ:5 '4:t:Om From Table B.3 it may be observed that the likelihood of the combined event must become substantial in order for the add-on to be cost effective (against a
$1000/ person-rem criterion) for all the case study' plants when considering only offsito dose. However, if both onsite and offsite costs are considered, the add-on becomes cost effective for four of the six plants when the itkelihood of the combined event is near 0.01 per year. If the postulatt.d prot $ ability is
(, 0.001 or less per year, the costs (dollars per person-rem) approach those of the base cases plus add n. B cause . .. _ _ _ . no eMuor sabotage analyses X c= J e similar to th re empt to develop a generic treat- M e4 ment sFAR as was done in Section 4.3. 'N It must be understond that this treatment does not directly account for the uncertainties in such analyses. This can be done to a limited e:ttent by examin-ing the results of a Specific Net Benefit (SNB) analysis such as those described in Sections 4.2 and 4.3. To do this, the plant-specific results from fable B.3 are averaged and these results are used to generate the SNB indices. The results are shown in Table B.4. It. is observed that "on average" the add-on fo PWRs is not cost effective on purely quantitative grounds (considering only offsite costs) at sites of any population density. If both offsite and onsita costs are included, there is a fair chance that the add-on would be cost effec-tive for the high probability event at average- to high-density sites. For [ 04/25/88 B-4 NUREG 1289 APP B DRAFT 4/88
,Q .
( o Table B.3 Limited value-impact assessment for effects of add-on decay heat removal system given t'w t combined sabotage event, diesel generators disabled and loss of offsite power induced, as y a function of the probability of the event and including randon initiating events. D Iopactf M 'f O# Value-Impact p(cri) ap(ca) (Gross) .gN Averted Cost ($) Offsite Net Plant (per r yr) (per r yr) ($) Offsite (Person-Res) Net Onsite Offsite Net Onsite ($/p-res) (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) p(DG Dis & LOSP Induced) = 0.1 + Randon IE A 1 M 43E-3 M 2- 4 4 E-3
. t.+%9 B t.aie-3 8. 20E 4 t.o* ti -3 7. E "
64.2E61.94 4-72L.1{ 4.114-97E31.12E4 2.18EE 3.20E7 J F 3..?'Et <0
' 80.9E61.0 5r60E3 3.io SAGEf 4.s'z -3r35E6 3. War 4fE7 t.e71-44E4 # /765 C 5132e 5-69E-3 S.$1t 4-26E-3 58.6E6t.% 1-7fE4 6.s3 Gr45E3 Lot 61 ASSE6s>3-Ire 5E8 J.$53 41E3 <0
,9 D 4.01E-3 3.M 3-64E-3 59.4E6fet4 4r81E3 9.tr 4:04E3 2..e- 2-89E6.f.see8 f.524rE4E4 <0 2
E 2.w 7. 50E 2 tsti -4 7. 000 2 90.3 -3E6(dt4r00E6'RMefh45E4 4.it 1-3E9 -As52-09E9 f,3Fl4dl0E1 <0
-- F 6.75E-2 6.2fE-2 69.7E6 4.16ES 5.6AE4 2.81E8 1.22E9 o 1.4sE2 <0 n .c z. L yt f.7eci .9 p(DG Dis & LOSP Induced) = 0.01 + Randon IE a ,. -
E A tr4 E-3 ' 20E 4 4.55 -sr94E-4 64.2E6 M ir4EE3 fem.5 Cit.5Leb 5 ECES J.915d3E4 f.zz461E4 B 5.z.5 3r84E-4 S.so e--73E-4 80.9E6 ).55 3.06E3 3.7 Gre0E2 140 143E6soze 0EEC 3.47 363E4 J.C7Ilr46E4 C ~1.91 Gr49E-4 ( s4 S:e9E-4 58.6E6 3.234.83E3 L'.o Jr00E2 t.18 4-10E63. War 44E7 J.y2.2r92E4 0 :7.Gt 5-51E-4 5.0 -5:4-3E-4 59.4E6t,ts: Ere0E2 6M S 60E2 4.2 4:97ES /.cGr60E7 wSt./Je/ s.t.c 8-70E4 *e .5.vwf-E 2.'hE-2 794E-31.gc-L -? 1950 90.1 SS.JE6(..64r7eES 1.43 6-60E4 .g it. 1-tSE8 7.582:01E8 /.5o 4 68E2 <0 F 7. M E-3 6.66E 3 69.7E6 4.08E4 5.ME3 2.9EE7 Iv47E8 1. NE3 <0 g 01 51 6.oA .ot i l 7*/- .St
$ p(DG Dis & LOSP Induced) = 0.001 + Randon IE he A 3.14E-4 3.22E-4 64.2E6 lot 4 N-4-20EI Ot4-erg 4E5 6 L d4.4gE4 K"".75E4 B SNt & 4fE-4 1.'M Gr26E-4 80.9E6 LP 1<69E3 1.35 Br-30E2 f.oz.4:GIE67.3 7r43E6
> C 1.32E-4 1.22E-4 4.7JE43J773.""E4 58.6E6 4.00E2 1.30E2 2.30E5 3 0 A.13 Br4BE-4 . .it ev00E-4 4.46E6 Lc.o 4-58E5 4Str-e7E6 1.47ES 1.0jE5 59.4E6t'tt 2 Mar 64E2 2.2SES 1. NES
= E 3.%.o A&lE-4 2;p4T.J S.0^E " So;& -09:4E6 e-i?E4 a. he1.Q2:63E2 2.2552 4.43 4-53E7 7 200-29E7 /.2 z- 4:26E3*M 03E2 o F 1.11E-3 1.02E-3 69.7E6 7.p> E3 -5.41El 4.54E63 702+3E7 8.9p35@efdE3
?
??
%.pn.~ty ms .;,s ~ 9 n w n % R c ,? c A & ,.
j % p G J e - Q k f A O M _. J~
q ,.. o Table B.4 Value-impact analysis for effects of add-on decay heat removal system in - g terms of specific net benefit (SN8) E g Chance of Cost Effectiveness Average Average Averted Offsite Costs Net Costs Prob of Gross Cost ($) Specific Hrt Benefit Population Density Population Density Event Impact Offsite Net Onsite Offsite . Net Avg High Low Avg High low NR l 0.1 65.8E6 6 8M T -0. 95W 1. Not CE Not CE Not CE Fair Small ! 0.01 65.8E6 JJi M IE6 1.39E7 -0. 93 - 48 Not CE Not CE Not CE Not CE MM Not CE I 0.001 65.8E6 E00.62E5 gE6 -0 99 -0. 9PTf Not CE Not CE Not CE - Not CE Not CE Not CE BWR 3 1G.3- '4,;IL d E. ./ 0.1 'fJ.379-SE6 Ef 1, E9 $9- 29] + Good CE CE CE
, 0.01 F1.J79d5E6 N)7:24E3 #141-74E8 f,77%W f(W.F3 SmalN# hhCM CE kt [E CE Fair
-0!ff -Og l 4 0.001 gg,379:SE6 g.94Tp.952r26E7 Not CE Small Not CE NyoE- Fair Not CE g .
O M 2 4 . O _ . _ _ _ . - . _ _ g __
~
the BWRs, the results are much more "mixed" even for the case of offsite costs ( only, ranging from not cost effective (all population densities, low probability of event) to cost effective (high population density, high probability of event). When both offsite and onsite costs are considered, it has a fair or better chance of being cost effective even down to the high population-density, low probability situation. - It must be emphasized that this conditional treatment of sabotage does not directly account for the threat due to all the plant layout shortcomings discussed in l Section 2.3. k r i i l 1 l I l 04/25/88 B-7 NUREG 1289 APP B ORAFT 4/88 , l
e t - a APPENDIX C COSTS DUE TO NUCi. EAR MORATORIA (Relates to Section 4.6) . Detailed cost estimates were made for three different types of moratoria:
- 1. Immediate and complete,
- 2. Complete after a 3 year period of grace to replace enough .iuclear plants
- with peak-topping plants to avoid "brownouts," and
- 3. Complete after a 10 year period of grace to replace nuclear plants with fossil-fired or nydro plants.
Table C.1 shows the present worths (in 1985) of the potential losses arising from the three different types of moratoria if applied at specific times (1985, , 1990, and 2030). With the passage of ti'ne without a nuclear accident, these e { potential losses have diminished by about 10 percent since the estimates were ; made. It can be seen from Table C.1 that the maximum potential loss was [ estimatedtobeabout$200billionjpWWforthemoratorium with a 10 year , I perivd of grace, this was reduced to about $28 billion.
- It should be noted that the model estimates only the direct costs to the ,
nuclear industry and the electricity consumer that would r2sult from a nuclear moratorn.m. Secor.dary costs such as the effects on other industries or l incraastd interest rates to the utility have not been included. ! t Table C.2 shows t3e present worths of the expectation of loss (in 1985) for [ the three types of moratoria. As in the esse of Table C.1, the estimated values have decreased by about 10 percent acause of the passage of time. How- ( ever, in view of the other sources of uncertainty, notably in the estimated I frequency of severe core accidents, this change is insignificant. The other l major source of uncertainty is the cost of replacement power unless a period of } gesce of at least 10 years is assumed. The sensitivity of tts results for the ( l
; 04/25/83 C-1 NUREG 1289 APP C DPAFT 4/88 j
l l1lIl l< t
) ss
-- e
; ol t ' ' ' t n
ceu _ a 8 0 '0 '0 e l f r l 1 1 1 e t a ne t a 8 m 1 m 2 x ut f n _ at o ; e i t T 4 3 0 4 l m r e 5 t ae ic ol f s t a t a oed nl a r s c ep o e e re er m t w t - ' ' ae f r s e 8 rn fd . e c o 0 a
'0 e l l tf i n da e 1 e
1 no cM r 0 l m m i t c l 2 p u 8 7 n u hr u e s o e 3 2 os ct Ma I e n fas _ P sn l _ rc ia f o . ' ' 8 8 dl p eu pn
- 8 0 ;
s a. - 0 1 0 1 1 rr if e p t m m ao l o p s s m ef y 5 ev s 6 4 2 l est iM e y t 5 n L O 9 O )
- t 2 re e(
0s 3o n e , pf t C r e h d e t h n a t r a y . f f r _D# n [ ' 0e 4 p rl i d t e -
'0 *'0 1 '0 .
/
10 ee t v n 1 m = 1 0 ci m o o u 0 0 m t0 at f r c i s mD t e n T 8 1 g1 8 2 2 a2 n$ f c dp as e . e ed g d n t n ee l r t a i . i s
- a. [m ia'n 4 cg t ,
ne r p ' ei ec a ' rs ca E 7 '0 8 0 pe rr s S eg ~ e s s s 0 9 9 je t r 1 2 x 1 5 m 1 l n ed d g rn p 5 o f _ e ra 1 c a 3 3 ai 6 l l 1 et s _
, l ns nd oel _
h l l ii a e
.m i 3 t
n e
. t s
'0 1
e 0 1 8 0 1 l x g nf e dr ee sp t S. et s m m m ios a _ v e n os 5 2 br p o U n S. ss e st )s e a . 5 I mt 4 3 2 y 9 sn s- . f o 9 aal e l9 1 ep r1 . s m e . - - h n t i i r tds ane r o s 8 8 8 0 8 8 8 t e eow rar e e ._ w es 9 1 1 1 hp srt - a t s l m m m t r eel - n e el s t a e 8 9 7 5 1 S. 2 ta ael t ya ee l3r . el l i 2 ec p r p a s s e a m rn ( t n ooi ,
- o . cf 5
8 s vre ou rl a r _ 9 e ' gfl ol e _ - 1 i m 5 8 - ) '8 8 n a f ay _ i) v f t o 9 1 e 2 c ( 0 1 0 1 ne (dr sne c a r m m t l e (sn "e rap _ l t e s 9 5 i a i f p n n eI g rva es5 n r e e e 0 i c e p R e P 4 1 1 s el npa ee2 yr5 a _
- s e s l y y -
0 _ d0" e5t r7b o 1 s1 n f oe -
) * ' ' a$e tt C - 1 8 b c redl a -
e t ( 0 'e l
'G 1 soe f r wea -
l s 1 s m s p occ b e t s m 8 ee pus a v n s 9 2 l u0 de T n e o 5 5 2 l 4 t e I m t ta nro - e t e ml mn eed t a e , r si at m nvMct e e f f et l au t e e o r a o vi nn prs ees s _ f a t V e d Rda _ o m i e - d Ii
- u d l p
e o e Y o e , _ - T e a i p y r r bto I e m d m s naC o u e i c r h e r T P G r a
- i c n
e e r T P G r a ) 1 (
)
2 ( ( ( _ OC 3a R.= 3
- 2~gg* 7u $ A c) wm$ , _
3
O ,.. Table C.2 .Sammary of 1985 present worths of espectattens of less due to cerless types of mesclear moraterle (all N (eelmes in 1995 dellers. E discount rate. 2.55 escaletten rate la feel costs) Preeemt teerth (1985) of Espectatten of less Propertlen Proportlen Investment teos aselecement Pomer_ Total _ of Invest- of asplace-Im E3 IIe ED W All ment Sue to eget Cost Sue e's EB (Typeof S Et tes ED Tetal toss S S S breterium S S S lamedlete 6.8mle' '42.9 10' S.Fals' 51.6s10' 52E 33E 2WE 8.6a108 1.9els' N.3 ale' (and Complete Ihree-Veer 37.4m10' 411 SEE 21% 6.2mle' 1.5s10' 24.sm10' 4.9 ale' 31.9u10' 6.4m19' (Periodof Gr.ce 9 w gien-r.e, 1.1mle' all 3.2m10' 1.1x10' 4.3m10* F55 Ise'. 1005 Perled of 3.2mle' all Relevant Grace . ED = leucteer Power Plo of Entsting Sosigny 100 = leucleer Pouer Plan of slow Sosigny U a .
"o
- n . .
c3 C 0
= .
(D
-- q ,,.
h 30 3 Tet.le C.3. Sensitivity of present worth of egociatten of less essecleted with* replacement pouer costs to rate of \ escaletten la fuel prices (nucleer and coal) due to two types of nuclear eersterle (M discount rete) / Fore Esceletlem M fueletten 1 5 Esceletten Es se All te us All Et le All
/ypeof
$ $ $ S S
%reterliam S S S S L
21.9mle* 2.9m188 24.em10' 51.9mle* 15.5mle* 69.4 ale
- 151.3mle" 301.1=18' 252m10'
( Complete Ihree-Year 16.3mle* 2.2mle* 18.5mle' 3F.7mle* 10.3mle* 48.6mle' 98.3mle" 65.7mle" 164=10' v- Lerlodof ( ( is . ~1.or r . {ef Emlett.e e.sie., ( . ~le.r , , leg e, - mle., 2 C o 5 v . O O , a'> R ~ 3
zero- and three year periods of grace to the rate of escalation of fuel costs ' ( ' (in real terms) is shown in Table C.3. Equal escalation at a rate of 5 per . cent pe'r year would increase the replacement fuel cost by a factor of about 3. C.1 Application of the Results With the Moratorium Model The results from the model can be used to estincte the maximum cost-effective expenditure on existing reactors to reduce the chance of a moratorium. To do this it is also necessary to estimate the c'enditional probability that, giv n a severe core accident, a particular type of moratorium would be applied, n.. I an estimate of this conditional probability, the total expectations summed over all plants in Table C.2 can be reduced to an average single plant basis. As an example, it is assumed i. hat the <:onditional probability of a deferred moratorium (3-year deferment) being imposed on all LWRs of existing designs in the event of a severe core accident is 0.3 per event. Since a high proportion of the total risk is attributable to plants of existing designs, it is assumed that the expenditure on improvement would be confined to those plants. Thus the maximum cost-effective expenditure per plant would be the total present worth ( of the expectation of loss, $37 x 10' x 0.3 divided equally among the 110 plants, or $100 x los per plant. C.2 The Effect of Moratoria Costs on the Value-Impact Analyses For illustrative purposes, Table C.4 shows the effect on plant-specific value-impact analyses (for Alternative 6) of inciding the costs of various types of nuclear moratoria with some arbitrarily assumed conditional probabil-ities for their application. As discussed in the next section, the translation , of the Specific Net Benefit values into "Chance of Being Cost Effective" should be regarded as indicative only. C3 Quantification of the Conditional Probability of a Nuclear Moratorium Although quantification of the conditional probability.of a moratorium is difficult at present, the following qualitative discussion suggests tha N N is very high. The response of the public, particularly in Western Eur pe, to the Chernobyl accident indicates that the margin between the contin g Jr :f [ , 04/25/88 C-5 NUREG 1289 APP C DRAFT 4/88
1 S ,.. 2 N PG ve N
$ lable C.4 (ffects including moratoria costs on the specific set benefit and cost effectisomose of Alternettee 6 for the case study teocific met genefit Ch ace of Seles Coot Effectlee" Averted Aserted Averted Averted Averted Averted Averted Averted Aserted Averted Amerted Aserted State OffsIte Offsite Offsite Offsite Offs!to Offsite
- ef.fsite ef.fette 6f.fette e e. site Of.fstte Of.fsiteit. h Of.fsite i
.f . O. sit. . O. site 0 site . . . sit. . .ait. . . . site . iie
,y,,,,, ,b . O,. sit. gb Costs
. Desite A Plant Plant, Cests
- Iters. 1 . stors. 2
- Iters. 3 ,, ,,,, e fiera. 1 Itere. . stora. a e stora. 4 QIters.5" A w/o Ig5 -0.80 13.9 0.59 8.35 -S.76 2.98 Ilot Cf Good Felr Fele not CE Fale w
8 w/o -0.90 F.68 -0.05 -0.19 -0.83 1.35 het G Good Small Small not CE Fair , C w/o I -8.94 3.9 -0.46 -0.54 -0.90 0.33 Not G telr Small Small shot M Fair 1 g 0 w/o fy -0.44 58.5 5.44 4.49 0.05 15.1 Small CE Fair fair Small Ceed E w/o tent -9.99 6.6 -0.14 -0.21 -0.53 1.08 Isot G CE Smell Small Itet CE Fair (w RCIC) Q F =/e tent -0.71 M.9 2.84 2.25 -0.42 8.62 not u u fair Fair Smell Good o, (m/s aCIC) i
* 'See cessment la test (Sectica C.4) conceratag the laterpretattee of "Je values when eersterim costs are included.
O b " lype end probability of fleratorium l stora. 3 Preamblilty of Imediate and Complete Iteraterle,1.9 [Re. pense te very large release at blgir Pepolottom-density site] hea. 2 Probability of Imediate and Coastete storaterte, 0.1 [Re. pense te very large releese et lee pepelotten-doestly site] [ Mora. 3 Probability of storstoria Af ter 10-Veer Grace Perled,1.0 [Besponse to core melt with same release] 23 g flora. 4 Probability of Iteraterlies Af ter 10-Veer Grace Perled. 0.1 [ Response to core melt with me release] sa stora. 5 Probability g Prob in, of
.f lamediate and Period, i.-ve.r Gr-. Camolete storaterim,
. 2; 0.1; Frabability d P,et.abiiit, of 3-Veer. Grace
.f .o ner.te,im. .5 Perled. 0.2; LD .
D o f") O
- 0 1
-4 4=
N - OD CD
piic acceptance h nuclear power and 4desh rejectio e+-4+ i s s m'a l l . For -
) K k example, in Sweden there is now public pressure to accelerate the previously ,
planned deferred moratorium even though this would entail a severe economic penalty. Similarly, in the U.K. only one of the four major political parties now supports the previous national policy of expanding the proportion of the total generating capacity in the form of nuclear power. There is now a wide-spread belief' that ~another severe reactor accident in the U.S. in circumstances that gave the public the impression that the risk of nuclear power is not ade-quately controlled would lead to the loss of the nuclear option. Thus, until there has been a long period (say 10 years) of nuclear plant operation free from major accidents, the conditional probability of a severe moratorium in the event of an accident leading to severe core damage is high. As indicated 1.1 Section 4.2.1, the chance of another severe accident in the U.S. if the average value of p(cm) for the existing plants is not reduced sub-stantially is about 20 percent during the next 10 years and about 50 percent during the next 30 years. Thus the chanc1 of some form of moratorium within the next 10 years is high. The effect of including the cost of a moratorium on the value-impact analysis for USI A-45 has therefore been considered with par-ticular reference to Alternative 6. As this has the largest impact, it provides a useful bounding case. The results shown in Tables C.2 '.nd C 3 may be used in value-impact analyses in the following ways:
- 1. It is assumed that the value of 1.4 x 10 4 per reactor year is representa-tive for the mean frequency of severe core damage accidents in the whole population of 110 nuclear power plants of t h existing desig With this assumption, a generic estimate, E g, of the maximum cost-ef fective expendi-(
ture for the average plant (in the absence of uncertainty) for a moratorium [ of type i and conditional probability p , given g a severe core damage accident, is given by the equation: l Eg=pg x x (PW of expectation of loss in 1985) x C (C.1) l10 T 04/25/88 C-7 NUREG 1289 APP C DRAFT 4/88
where TC is a factor to correct the results in Table C.2, which are based
't on the situation in 1985, to the situation in 1985 However, this correc-tion is small (about 10'per cent) compared with the other uncertainties and can be ignored.
- 2. The PRA results summarized in Table 2.3.1 suggest that the ne'an frequency of severe core accidents in the.110 plants of tihe existing desig/is a factor of at least 2 greater than the value assumed in the moratorium c>odel K
(1.4 x 10 4 per reactor year). This can be taken into account approximately by doubling the values of Ej obtained from Equation C.1,
- 3. The case of a specific plant, j, for which a modification is proposed that would reduce p(cm)DHR for that plant by an amount Ap(cm)DHR(j) can also be treated. In this case, the maxie"m cost-effective expenditure to avoid a
- moratorium of type i, denoted by E j), can be estimated approximately from the equation: , ,
i E, x Ap(cm)0HR(j.' (C.2) [ E jj = 1.4x10
- i It should be noted that Ap(cm)DHR(j) can be greater than 1.4x10 .
In oroer to illustrate the change in cost effectiveness of Alternative 6 if the i cost of a moraturium is taken into account as an avertible cost in the value- ; l impact analysis, a set of Specific Net Benefit (SNB) Values for the USI A-45 case ( study plants is shown in Table C.4. The set :ontains serious assumptions con- ! cerning the conditional probability of different types of moratoria, given that l a severe core damage accident ha,d occurred. Moratorium 5 provides an illustra-tion of the relative weighting that a decision maker might give to the various possibilities, j l It can be shown that, in the case of an immediate and complete' moratorium (Moratoria 1 and 2 !n Table C.4), if the conditional probability of the mora-torium given a severe core damage accident were greater than 0.2, the SNB would j be greater than zero for each of the six plants. However, in the case of a r I moratorium with a 10 year period of grace (Moratoria 3 and 4), the SNB i 04/25/24 C-8 NUREG 1289 app C ORAFT 4/88
, _ . - , _ _ _ , . _ . - - _. . _ _ _ . _ _ . _ = - _ , _ _ _ _ _ . _ _ , _ _ _ - . _ _ , _ _
would be less than zero for three of the six plants when the conditional prob-ability is unity. For the "best-estimate" moratorium (Moratorium 5), the SNB. is greater than zero for all six plants. Thus, in the absence of uncertainty, the averted cost associated with'the reduction in the probability of a morator-ium would make Alternative 6 a cost-effective modification in a wide range of , possible situations. . AlsoshowninTableC.4arethechancesofbeingcosteffectivewhenuncerapty istakenintoaccount)usingthaassumptionsdescribedinit..;ntIectioA b
- g will be seen that, wfth the exception of Moratorium 4 for all plants and some other exceptions in the case of Plant E, the chance of being cost effective
, ranges from fair (i.e., in the range 0.3,to 0.7) to cost effective (i.e.,
greater than 0.9). In considering these results, it should be noted that: 1 The moratorium costs are based, as indicated above, or an everage value 1.
- ,for the fr
- ,wency of sovera core damage, p(cm), wbt.n may be too Icw by a factor of about 2.
)( 2. As discussed in Reference 1, the w ratorium costs used in this analysis are only the "direct" costs % the various parties (utilities, electricity consumers, and possibly tax payers) arising from the increase in genera-tion en:ts and l w, of investment that would result from the moratorium.
"Indirect" ;r "secondary" costs due, for example, to the effect of increased power costs on industry or tc the reduction in credit rating of the util-J iti se have not been included. Studies by other organizations aimed at estimating the cost of closing down various specific plants have suggested I that the secondary co,sts would be substantially greater than the "direct" costs.
l l If the moratoria costs were increased by a factor of 4, the chance of Alterna-l tive.6 being cost effective in the case of Moratoria 1, 2, 3, and 5 would be
) good (i.e., 0.7 to 0.9) or cost effective in 72 percent of the cases shown in Table C.4. In the remaining 28 percent of the cases, there would be a fair chance (i.e., 0.3 to 0.7) of being cost effective. In the case of Moratorium 4, the chances would range from small to good (i.e., 0.1 to 0.9).
04/25/88 C-9 NUREG 1289 APP C DRAFT 4/88 i
C.4 Translation of Specific Net Benefit (SNB) into Chance of Being Cost
~k Effective .
It should be noted that, in those situations where the averted moratoria costs are the dominant factor, the probability of the moratorium being applied is the sain cause of uncertainty. Consequently, the interpretation tables derived in Section 4.1 are not strictly applicable. At the present time, it is difficult to see how the uncertainty concerning the application of a moratorium can be , i quantified sufficiently to incorporate it satisfactorily into the interpretation l tables. Hewever, a preliminary attempt at quantification of the interpretation tables is discussed in Reference 1. This suggests that, if the probability distribution for the cost of the moratorium can be regarded as log normal, it would hay an error factor of about 15. Thus the interpretation table for offsite costs only of externally initiated events (Table 4.1.2) should provide a fairly good guidegas this is based on an error factor of 12. This is true l unless the assumption about the form of the distribution is not valid. Reference (For Appendix C) ( ;
- 1. "TheApplicationofValue-ImpactAnalysistoUSIA-45gSummaryReportof 7 ;
i UCLA {tydie,s, ogVgmjagt Aylypisg~lat,f o to USI A-45," NUREG/ - ' ' ) CR-4941, dAND87-7116,rQ64eeer 1987Y- - 1 i r 1 l t . i I 04/25/S8 C-10 NUREG 1289 APP C DRAFT 4/88 l
i l l L
. r \ -
l i APPENDIX D i IN51GHTS GAINED FROM INDUSTRY-SPONSORED STUDY 0F POINT BEACH l, As part of a nuclear-industry-sponsored effort regarding DHR-related risk, a ! reanalysis was performed for one of the limited-scope PRAs considered in the l' A-45 case studies (Reference 1). Discussions held between industry representa- l tives and the NRC staff regarding similarities and differences between the two l l* analyses are summarized in Reference 2. Considerable detail regarding those l discussions is presented in the several enclosures to Reference 2. This ; g pendix summarizes the results of those discussions. l 1 1 ? l In terms of predicted DHR-related core damage frequency, the A-45 case study { forPointBeachcalculatedavalueof3E-{4per eactor year, whereas the ! ( industry-sporgts cad ,s udy calculated IE-T5 reactogyear(i.e.,afactorof pe / f 30 lower). 24 bhhifamany identifies the major differences in assurap- g l l tions and methods and their resulting contributions to the total difference, j In addition, areas where agreement was possible are indicated. The NRC staff j j believes that the approximate core damage frequency that would result from use , ; i l oftheseagreementsinarevisedstaff-sponsoredanalysiswouldbeabout9EOS l per reacter' year. At ghen halog small fraction (less than 205) of the revi- X sion is due to changes that have been made in the plantj aus the remainder is I f due to changes in the methods, assumptions, and data. t It should be cautioned that the revised values quoted b 4 ens and the specific methods and correlations discussed were examined only in the context of the Point Beach analyses discussed in this Appendix. Their applicability to other plants would have to be determined by specific analyses of the other plants { since dominant sequences, plant equipment, and operating procedures could be j dif ferentt, and the "revised" values quoted and methods discussed may not be I ( directly applicable. ; I f i i 04/25/88 0't NUREG 1289 APP D ORAFT 4/88 l l
Table 0.1 Comparison of Point Beach udies na d >< Core _ sben Fremuency_per ReactorwYear Pame:, DC A n _ - we L . Sequence
- NRC Case Study EPRf/WOG Study Revised NRC value**
S MHgH 4.7E-05 , 5.8Eh7 7.0E-76 m The staff y te g 3E-p3 per reactor year value proposed by EPRI/WOG for the initiating S LOCA event after considering operational data presented by X ., EPRI/WOG. However,thestaffbelievesthattheIE-Mproposedforoperator action failure per demand is tou optimistic since operating data (though limited) do not appear to support the lower value, and the NRC value of IE-03 was not changed. T tMLE 6.7E-[5 7.7E-f/ 7.7E-37 ( The staff accepted the initiating event frequency proposed by EPRI/WOG based on plant-specific data. The staff.also tentatively accepted credit for new batteries (since they are now installed and operational), but informatic,o is needed to verify the quantitative credit given.
- T3QHtH 2.5E-35 0 3.6E-j6 The staff used a new value of Q = 0.01, which is below the Q = 0 97 value previously used in the NRC studies but still above the (believed optimistic) valueofzeroproposedbyEPRI/WOG(EPRI/WOGcontendsthatfortransgtT, y 3 g reactor / turbine trip, it is not possible to cause opening of a POR therefore X Q is zero. The staff believes the probability is small but non-zero),
p a*"" Sequences are described in narrative form in Table 0.2. / This represents the likely value that would be used if a "revised" RC-sponsored study were to be conducted for Point Beach as of the date of this writing. The narrative below each entry summarizes thir bases. 9-- 04/25/88 0-/ NUREG 1289 APP 0 ORAFT 4/88
Table 0.1 (Continued) O_ =_ - ' ' D. r_e_ Frequancy per Reector-Year (mine: t OeQuence NRP Cuse Study EPRI/WOG Study Revised NRC*value n n T MQH H 3.5E-p6 1.9E n47 5.0E$7 8ecause of uncertainty in the operational data presented (it varied greatly from year to year), the staff does not recommend the EPRI/WOG proposed credit for PORVs being available (f.e., unblocked) a portion of the time. The staff tharefore continues to endorse the conservative assumption that PORVs are not ! available to prevent SRV opening. The staff did, however, agree with a reduc-tion in the probability of inadvertent opening of an SRV from the nreviously used0.07to0.01perdemand(basedonoperationaldata)withh.01perdem probabilitykhatanSRVwillfailtorecloseonceopen. 4
, n
( - 5: MD3 0: 8.7E-f6 9.5E-f8 9. E-A7 The staff agreed witti the initiating event frequency of 3E-}3 as previously l discugse g Based on pump manufacturer's data, the staff agl o ag eed with removFcarthe SI pumpsjependencNn component cooiing wate( but additionai X i i information is needed to quantitatively confirm the risk change due to that 1 removal. The source of the remaining difference could not be identified * ) therefore, additional information is also needed to consider accepting the 1 remaining difference. I l \ n n > T3QD3 0 4.6E-$6 0 1.8E-j7 l The note for a previous "T3 . . ." sequence also applies here.. In addition to ! thatnote,moreinformationwouldbeneededtoidentifythesourceof[andto y l
~
consider accepting any part e remainIn'g difference (1.8E-07 vs. O g g i ) I i e i 04/25/88 0-/ NUREG 1289 APP O ORAFT 4/88
~
Table 0.1 (Continued) ' I _ m . -- 4 Core fittt FEequency per Reactor-Yea _r 4,aN y -. -_
,-..g -
l
\
- Sequence NRC Case Study EPRI/WOG Study Revised NRC value s es e T2MLE 6.6E-97 1.0E-47 6.6E-47 No changes. The A-45 case study initiating event frequency of 1.0 per reactor- )(
year is not significantly different from the 0.91 proposed by EPRI/WOG, and it is not clear how MFW recovery differs in the EPRI/WOG study. Also, additional information would be needed to identify the, ce o andtoconsideraccepting$h, , eremainingdifference(6.6E-J7vs.1.0E-p7)h m n T MQO t-02 6.6E-)7 4.1E-$8 4.1E_f $8 l j The staff used a new value of Q = 0.01, which is below the Q = 0.07 value used j f in the A-45 stucies but above the lower (not directly specified) value used by j- EPRI/WOG. The staff recommends recognizing.the low (but non-zero) probability i thata[SRVwillbeliftedduringthisevent. The staff agrens with removal of g SI dependencf on CCW (per manufacturer's data)gt djd gtghpng,tge t frequency, as the !""' M -' q ;:: " frequency or o.s1{is net signTricantly < dif ferent from the 1.0 used in the case studies. The above changes resulted in a value that was loyer than the EPRI/WOG .'esult. The staff therefore agrees l with the EPR!/WOG result. !
- <- n n ,
S MXDs 5.7E-)7 1.0E-$8 ,
- 1. 0 E-p Asalreadydiscussed,thestaff,basedondata,agreedwiththe3.0E-[3 j initiating cvent frequency proposed by EPRI/WOG and with removal of the depen-
- e. CCV dencg of the SI pueps on the :r;;n;nt :re' 9; -. m system, out information is {
needed to justify the quantitative credit given, d 04/25/88 0-4 NUREG 1289 APP 0 DRAFT 4/88
Table 0.1 (Continued) n e , ( QNrecuency Der Reactor-Year _{'g L . Sequence NRC Case study EPRT/WOG Study Revised NRC value ( TsMLE 9.1E-9 1.3Eh 9.1E-9 T MLE 6.2EU7 0 6.2El D TsMLH 2.0EE I8 1. 0E-9 2. 0 E-9 Is TsQO Ds 1. 0 E-1 % 1.0E-D 1.0E4 I8' '
% h h '
No changes were made by tha staff for these four sequences. EPRI/WOG credits considerable additional recovery in the form of operator actions that have not ! been' adequately justified. The A-45 study assumed that loss of an AC bus would either trip the plant of lead to a manual trip, and the staff has elected to l l retain the modest conservatism associated with that assumption (no significant impact). l( l LTSB 3.6E- 5.4E- 9.9E-l t The staff agreed to plant-specific (lower) values for the Tt frequency and diesel generator local faults but has not takon additional credit for CST f refill and other long-term recovery actions proposed by EPRI/WOG because of uncertainty regarding the operator's ability to recognize the need and perform , the actions in the time available. It is considered likely that further reduc- l l tion could reasonably be justified provided the bases for assuming offsite , power recovery within a few hours are sufficient. TOTAL 1.3E- 2.5E' 2.5E-h (Internalj - (Events only) ' The above represents the total for all significant "interna,1," events as listed above. "External" events are listed below. [ l 04/25/88 0-/ NUREG 1289 APP O DRAFT 4/88 l
Table 0.1 (Continued) I _- 2 Care _ h Frequency mer Reactor -Year f% Sequence NRC Case Study EPRI/WOG Study Revised NRC'value Seismic 6.1E- 7.4E- 4.1E-The staff agreed with credit for the added hatteries. Credit for additional operator actions in the EPRI/WOG analysis is not recommended because of con-corns about how qu,ick,1,gecpytry3agccur 7 in post-quake conditiors. The staff also does not recomen'd hAI/WOGp' ' : .. for survival of the RWST I and continues to believe that the unique high-aspect-ratio design of the RWST tank at Point Beach makes it difficult to justify the EPRI/WOG credit. Fire 3.2E-[5 6.3E- 2.2E-The staff agreed that credit should be given for the second Halon system in the AfN room since it is actually present and operational. However, insuffi-cient tira were available to justify added credit for a lower Halen failure rate. Internal Flood 7.7E- 1.0E- 9.8E-Although applicability of the Thomas correlation used by EPRI/WOG has not been fully demonstrated, use in the Thomas correlation of the length of pipe actually in the pamp room and within line-of-sight of the pumps results in an initiating event frequency of 2.5E- [ This value is consistent with data reported in 1987 by Wright, et al., which yield an initiating event freque,ncy of 2.8E-per reactor year. Useofthe2.8E-[frequencyfromthe"Weight"dataresults in the revised NRC value shown. 6 04/25/88 0-/ NUREG 1289 APP 0 ORAFT 4/88
Table 0.1 (Continued) , I m._s '
' Core WFreouency
-an per Renctor-lear ih,ht I
(
-4 1
(
- l '
Sequence NRC Case Study EPR!/WOG Study Revised NRC value Wind 4.0E- 1.0E- 1.7E- - The staff agreed with the portion of the :hanges that are due to implementation of modifications to the stacks. ] TOTAL 1.7E- 7.5E- 6.4E-(External E ve ( Conly) [ , GRAND i TOTAL 7 3E- 1E- 9E-1, < .nt.,na, . E.te,na+ a,> i ? I i [ } ! l 1 1 04/25/88 D-A NUREG 1289 APP D ORAFT 4/88
l Table D 2 Dominant sequence definitions t . I S:MH H Ima11-breakLOCAwithsubsequentlossofmainfeedwaterandfailure of emergency core cooling in recirculation. { T MLE - ss-of-offsite power transient with failure of auxiliary feedwater x and feed and bleed. i TaQH H - A transient followed by& stuck-open r lief valve (transient-induced [ LOCA) and failure of emergency core cooling n ocirculation M . 4 g TMQH He - Loss-of-feedwater transient followed by a s' tuck-open relief valve (transient-induced LOCA) and failure of emergency core cooling in the i recirculation mode, i S M0:0 - Small-break LOCA with loss of main feedwater and failure of emergency
. core cooling in the injection mode.
T3 Q0:0 - A transient followed by a stuck-open relief valve (transient-induced l I LOCA) and failure of its emergency core cooling in the injection mode. / , T:MLE - # ass-of-feedwater transient with failure of auxiliary feedwater and y i 4 feed and bleed. . TMQ0:02 bssof-feedwatertransientfollowedbyastuck-openreliefvalve g (transient-induced LOCA) and failure of inut-emergency core cooling in the g injection mode. i ( i S:MXD: - Small break LOCA with failure of emergency core cooling in injection * ] l , mode and failure to achieve secondary blowdown. . l i ! l TsMLE - Loss-of-DC-bus transient with failure of auxiliary feedwater and feed [ I and bleed. l l i i f 04/25/88 0-W NUREG 1289 APP 0 ORAFT 4/88 i
Tabla 0.2 (Continued) . k T.MLE - Loss-of-AC-bus transient with failure of auxiliary feedwater and feed and bleed. T:MLH - Loss-of-feedwater transie with failure of auxiliary feedwater and failure of emergency core cooling in recirculation 4M. [ L TQO:Os - Loss-of-offsite power transient followed by stuck-opengr lief valve g (transient-induced LOCA) and failure of emergency core cooling in Tnjection mode. P LTS8 - Long-term station blackout caused by 1oss-of-offsite-power transient ,>o. 4 and failure to recover offsite power with subsequent failure of diesel generators. ( . l e 4 l 04/25/88 0-3r NUREG 1289 APP O DRAFT 4/88
i The bases for this revised result of 9E-05 per reactor year are given in Tabl,e 0,.g In ummary, it was considared reasonable to accept a lower frequency foftligL CA and to allow more credit for the presence of new batteries and y the la Q g pendence of the SI pumps on the availability of the CCW system (the SLOCA frequency change is the dominant one). It was not considered pru- y < dent to allow more credit for many of the operator recovery actioni as proposed in the EPRI/WOG study. s previojdy noted t e revis ues quoted the mothe nd corr a ens App scuss ix. were exa d only f he Point B ch nalyses seu ed in
' ei applic 11 y to o er nts woul h to be dew ined b aj
(\
- , specif anaps of the t plant. '
l It is considered likely tnat further review of the EPRI/WOG analyses, along I with closer critical scrutiny of the A-45 engstudies, could result in further
- changes. However, 6 ; M5fany such effortffthe NRC staff would expect DLs r f Y
,.__ - .,,- . to identify and include items that are not currently Q"'" I ~ ^ y
, in the analyses. An example in this category would be a greater effort to ,
3 ( include detrimental actions by operators (i.e., errors of "commission"). [ j We consider the EPRI/WOG work to be a comprehensive adjunct to the A-45 case
- studies. We note particularly the necessary cooperation and resources of the I utility to prnvide accurate data on design and operations. l We also note a greater reliance nn operator action in severe accident manager. ant )(
(
" NRC-sponsored risk studies performed to date. While it is worthwhile f I to understand the important role of the operator in recovering from a severe i accident, optimistic support of this capability must be terepered to avoid the opposite effect, which is a perception that vulnerabilities to severe accidents (
are "covered" by valiant efforts of the operations staff. The world history of l severe accidents, although (thankfully) sparse, suggests that credit for recovery from such events cannot be taken as a "given" and that critical appraisal of I severe accident vulnerabilities must also include considerations of design l l 1eprovements. Alongthoselines,wemakespecialge tge uggtgddi-tions made and under consideration by Point Beach to reduca decay heat removalg w t l
/6 l ! 04/25/88 0-J NUREG 1289 APP 0 DRAFT 4/88 f
l l t r t
! There is considerable uncertainty in all of the above resuits. However, if a ( ) ( "balanced" approach is used in future analyses, it is likely that factors will be found that would tend to change the result in competing (opposite) directions, i It is therefore believed that the "true" result would not differ significantly I from the above "revised" NRC result. That is, radically different conclusions l , regarding the risk and the need (or lack of need) for corrective actions should I not be expected. l l
I 5 N i kW g*+ W
. i b
) ! i l i ! r ! 1 1 ; t ) ! 4 i 1 l r i i t l I I ! i i I [ ' ! It l 04/25/88 0-A NUREG 1289 APP 0 ORAFT 4/88
,_,.,---_._...r -._-,,,--_.-----n-_--_ , --,, n_,,__.-.n,.-_,,..mp,
NUREG-1292 ; l Shutdown Decay Heat Removal Analysis-l P ant Case Studies and Special Issues: Summary Report - ! l l Technical Findings Related to Unresolved Safety issue A-45 i Draft Report
~
U.S. Nuclear Regulatory Commission - Office of Nuclear Regulatory Research ' Office of Nuclear Reactor Regulation A. R. Marchese, D. M. Ericson, Jr. , i 4 ,,.. ... ,,# e C, 3, s ., j
\
I i r
NUREG 1292
.-----,--y----.-,----~... .- - - -. ----__ . . - . -. . . . _ __ _.. - - . . , ..___ . . , _ _ _ , , _ , , , , . _
m Shutdown Decay Heat Removal Analysis-Plant Case Studies and Special Issues: Summary Report Technical Findings Related to Unresolved Safety Issue A 45 Draft Report Manuscript Comp:eted: october 1987 Date Pubbshed: A. R. Marchese, D. M. Ericson, Jr,'
'Sandia National Laboratories Office of Nuclear Regulatory Research Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20666 .
s ..: /- .
l ABSTRACT l ' Shutdown Decay Heat Removal Requirements" has been designated I as Unresolved Safety !ssue (USI) A-45. The overall objectives of the US! A-45 program were to evaluate the safety adequacy of ! decay heat removal (DNR) systems in existing light water l reactor s 11 ear power plants and to assess the value and impact l (benefit-g st) of alternative measures for improving the overall roolability of the DNR function. To provide the technical data required to meet tnese objectives, a program was i developed which examined the state of DNR system reliability in a sample of existing plants. This program identified potential vulnerabilities and identified and established the feasibility of potential measures to imptove the reliability of the DNR l A value/ impact (V/!) analysir of the more promising function. of such seasures was conducted and documented. This report nummarias : those studies. In addition, because of the evolving nature et V/! analyses in support of regulation, a number of supporting studies related to appropriate procedures and measures for the V/I analyses were also conducted. These studies are also summarized herein. This report only documents part e.f the findings of technical studies performed as part of the program to resolve this issue. The reader is also referred to a companion document. NUREG-1209 "Regulatory and Backfit Analysis for the Resolution of Unresolved safety Issue A-45, shutdown Decay Heat Renoval Requirements." Both of these documents taken together constitute the staff's proposed technical resolution of Us! A-45. ! iii/iv l
i I l I i TABLE OF C6NTENTS l l Abstract ............................................ iii Contents ............................................ v ' List of Figures ..................................... vii List of Tables ...................................... viii Glossary ............................................ xiii Acknowledgem5nts .................................... xvii 1.0 INTRODUCTIOd ........................................ 1-1 1.1 Objectives ...................................... 1-1 1.2 Background ...................................... 1-1 1.3 The Shutdown Decay Heat Removal Analysis......... 1-2 2.0 INTERNAL ANALYSIS - METHODS ......................... 2-1 2.1 Analysis Methods ................................ 2-1 2.1.1 Modeling ................................. 2-1 2.1.2 Accident Sequence Analysis ............... 2-0 2.1.3 Vulnerability Identification ............. 2-6 2,1.4 Containment System Integration ........... 2-7 2.1.5' Interface with Accident Phenomenology .... 2-8 2.1.6 Value Analysis ........................... 2-9 2.1.7 Assumptions and Bases f or the Ar.alyses ... 2-9 3.0 SPECIAL ENPRGENCY ANALYSES .......................... 3-1 3.1 Seismic Analysis ................................ 3-6 3.1.1 Analysis Methods ......................... 3-6 3.2 Fire Analysis ................................... 3-10 3.2.1 Analysis Methods ......................... 3-10 3.3 Internal Flood Analysis ......................... 3-13 3.3.1 Analysis Methods ......................... 3-13 3.4 External Flood Analysis ................ ........ 3-15 , 3.4.1 Analysis Methods ......................... 3-16 i 3.5 Extreme Wind Analysis .............. ............ 3-18 3.5.1 Analysis Mathods .......................... 3-18 3.6 Lightning Analysis .............................. 3-20 3.6.1 Analysis Methods ......................... 3-20 3.7 Sabotage Analysis ............................... 3-22 3.8 Assumptions and Bases for the Analysen .......... 3-23 i 4.0 INTERNAL EVENTS ANI. LYSIS RESULTS .................... 4-1 4.1 Introduction .................................... 4-1 4.2 Pressurized Water Reactors ...................... 4-1 4.2.1 Example Plant A .......................... 4-1 4.2.2 Exampla Plant B .......................... 4-4 4.2.3 Example Plant C .......................... 4-10 4.2.4 Example Plant D .......................... 4-10 4.2.5 Comparisen of Dominant Accident Soquences - PWR ........................... 4-13 4.3 Boiling Water Reactors .......................... 4-19 4.3.1 Example Plant E .......................... 4-19 ! 4.3.2 Example Plant P .......................... 4-19 4.3.3 Comparison of Dominant Accident Sequences . BWR ........................... 4-23 v
I l 1 1 5.0 SPECIAL EMERGENCY EVENTS ANALYSIS RESULTS ........... 5-1 5.1 Introduction .................................... 5 5.2 Pressurized Water Reactors ...................... 5-1 5.2.1 Example Plant A ........................... 5-1 5.2.2 Example Plant B ........................,.. 5-10 5.2.3 Example Plant C ........................... 5-20 5.2.4 Example Plant D ........................... 5-29 5.2.5 Comparison of Results - PWR ............... 5-38 5.3 Boiling Water Reactors .......................... 5-40 5.3.1 Example Plant E ........................... 5-40 5.3.,2 Example Plant F ........................... 5-49 5.3.3 Comparison of Results - BWR ............... 5-56 5.4 Discussion of Overall Special Emergency Event Results ................................... 5-58 6.0 ALTERNATIVE DEFINITIONS AND INTEGRATION ............. 6-1 7.0 DEDICATED DECAY HEAT REMOVAL SYSTEMS ................ 7-1 7.1 Pressurized Water Reactors ...................... 7-1 7.2 Boiling Water Reactors .......................... 7-3 7.3 Other Decay Heat Removal Alternatives ........... 7-5 7.3.1 Primary Blowdown for Enhanced Core Cooling of PWRs ........................... 7-5 7.3.2 Ultimate Plant Protection System for BWRs .................................. 7-7 8.0 ALTERNATIVE IMPACT ANALYSIS ......................... 8-1 8.1 Methodology and Approach ........................ 8-1 8,1.1 Objectives ................................ 8-1 8.1.2 Approach .................................. 8-1 8.2 Results .......................................... 8-2 9.0 %LTERNATIVE VALUE ANALYSES .......................... 9-1 ' v.1 Core Melt Probabilities ......................... 9-1 3 9.2 Public Hisk Estinctes ........................... 9-3 9.2.1 Base Case Estimates - PWR ................. 9-3 9.2.2 Alternative Estinates - PMP. ............... 9-11 9.2.3 Dase Case Estinates - BWR ................. 9-11 9.3 Non-Quantifiable Values ......................... 9-14 9.3.1 Effects upon Residual Riat ................ 9-14 9.3.2 Effects Upon Equipment Qualification ...... ?-18 ,
- 9. 3. 3 Ef f ects Upon Plaht Availability . . . . . . . . . . . 9-19 3.3.4 Regulatory Issues ......................... 9-19 .
9.3.5 Summary of Non-Quantifiable Values ........ 9-19 10.0 INTEGRATED VALUE-IMPACT ANALYSIS ................... 10-1 10.1 Methodology .................................. 10-1 10.1.1 Value and Impact Analysis Variables ............................. 10-1 10.1.2 Value Impact Analysis Measures ........ 10-3 10.2 Results ...................................... 10-7 vi
11.0 ALTERNATIVE DECAY HEAT REMOVAL METHODS ............. 11-1 11.1 The Feed and B.leed Process for Decay Heat Removal ........................................ 11-1 11.1.1 Value of Feed and Bleed ................ 11-1 11.1.2 AFW System Reliability ................. 11-3 i 11.1.3 Effects of PORV Block Valve Position ... 11-4 11.1.4 Other Considerations on Feed and Bleed, 11-5 11.2 Impacts Associated with Feed and Bleed ........ 11-8 11.2.1 Thermal-hydraulic Phenomenology ........ 11-8 11.2.2 Operational Issues ..................... 11-14 11.2.3 Environmental Qualification Concerns ... 11-14 I 11.3 Summary of Feed and Bleed ..................... 11-15 11.4 Secon' "'owdown as an Aid to Decay Heat h._sval .................................. 11-16 11.4.1 Value of Secondary Side Blowdown ....... 11-16 11.4.2 Systems Required for Successful Depressurization ....................... 11-20 11.5 Summary of Secondary Blowdown ................. 11-23 12.0 SPECIAL COST AND FEASIBILITY STUDIES ............... 12-1 12.1 Costs for Backfit of Additional Steam Dump Valves ................................... 12-1 12.2 Feasibility and Cost Evaluations of Special Issues Related to ADHR (PWRs).. ............... 12-1 12.3 Options for Increased Reliability / Range of Operations-PWR ............................. 12-6 12.4 Options for Increased Reliability / Range of Operations-BWR ............................. 12-9 12.5 Cost Differences Between Safety Grade and Non-safety Grade .......................... 12-12 12.6 Costs of a Dedicat'ed Feed and Bleed System .... 12-13 12.7 Cost Estimate for Implementation of the Ultimate Plant Protection System (UPPS) for BWRs ...................................... 12-15 13.0 UNCERTAINTY AND SENSITIVITY CONSIDERATIONS ......... 13-1 13.1 The Nature of the Problem ..................... 13-1 13.2 The Uncertainty in the Offaite Costs........... 13-2 13.2.1 The Structure of the Offsite Cost Terms .................................. 1 3 ,2 13.2.2 The Uncertainty in n egg ................ 13-3 13.2.3 The Uncertainty in C(D) ....-........... 13-3 13.2.4 The Uncertainty in F(D) ................ 13-3 ( 13.2.5 The uncertainty in P(m) and q .......... 13-5 13.2.6 Overall Uncertainty in the Value Term V(T) .............................. 13-6 13.3 The Uncertainty in Combined Onsite and Offsite Costs ................................. 13-7 13.3.1 The Struct*1re of the Onsite Cost Term . . 13-7 13.3.2 Uncertainty in n ogg .................... 13-9 13.3.3 Uncertainty in ap(m) ................... 13-9 13.3.4 Uncertainty in the Differential Cost of Replacement Power ................... 13-9 vii
13.3.5 Uncertainty in the Evaluation of the Loss of the Utility's Investment ............................. 13-11 13.3.6 Uncertainty in the Cost of Cleanup After Core Melt ........................ 13-11 13.3.7 Uncertainty Due to the Omission of Possible Components of the Onsite Costs .................................. 12-11 13.3.8 Summary of the Uncertainty in the Onsite Cost Term ....................... 13-12
. 13.3.9 The Uncertainty in the Combined Onsite and Offsite Costs ............... 13-12 13.4 Effects of Uncertainties in the Impact Term ... 13-14 13.5 The Overall Uncertainty in the Value-Impact Analysis ............................... 13-16 14.0
SUMMARY
AND CONCLUSIONS ............................ 14-1 14.1 PWR Summary and Conclusions ................... 14-1 14.1.1 Internal Dominant Accident Sequences ... J S-1 14.1.2 Sensitivity Studies .................... 14-5 14.1.3 Probability of Core Melt ............... 14-5 14.1.4 Potential Plant Vulnerabilities ........ 14-8 14.1.5 Effect of the Alternatives .............. 14-10 . 14.1.6 Value-impact Measures .................. 14-10 14.1.7 PWR Conclusions ........................ 14-14 14.2 BWR Summary and Conclusions ................... 14-18 14.2.1 Internal Dominant Accident Sequences ... 14-19 14.2.2 Probability of Core Melt ............... 14-19 14.2.3 Potential Plant Vulnerabilities ........ 14-19 14.2.4 Effect of the Alternatives ............. 14-19 14.2.5 Value-Impact Measures .................. 14-24 14.2.6 BWR Conclusions ........................ 14-24 REFERENCES APPENDICES: A. Summary of Initiating and Basic Event Data B. Recovery Actions and Associated Probabilities C. Dedicated Decay Heat Removal Systems D. Special Cost and Peasibility Studies DISTRIBUTION I l l l l l viii I
LIST OF FIGURES l No. Puce ; 1.1 Shutdown Decay Heat Removal Analysis ............... 1-8 2.1 Pictorial Representation of the Internal Analysis .. 2-2 3.1 Risk Analysis Flow Chart ........................... 3-17 7.1 Simplified Sc, hematic for Dedicated Add-on With Emergency Feedwater and High Pressure Make-up Water. 7-2 7.2 Add-on Residual Heat Removal System ..'.............. 7-4
, 7.3 Dedicated Primary Blowdown System ............. . .. 7-6 7.4 Ultimate Plant Protection System ................... 7-8 a
G i l 4 h I i ix I
LIST OF TABLES . No. Pace 1.la TAP A-45 Plant Characteristics - PWR ............... 1-3 1.lb TAP A-45 Plant Characteristics - BWR ............... 1-6 2.1 Information Sources ................................ 2-3 2.2 Systems Considered in the Analysis ................. 2-4 4.1 Point Beach Internal Event Core Melt Sequences ..... 4-2 4.2 Accident Sequence Event Definitions - PWR .......... 4-3 4.3 Cut Sets Contt!buting Significantly to the - Probabilit.y of Core Melt and the Associated Vulnerability for Point Beach ...................... 4-5 4.4 Turkey Point Internal Event Core Melt Sequences .... 4-7 4.5 Cut Setre Contributing Significantly to the Probability of Core Melt and the Associsted Vulnernbility for Turkey Point...................... 4-8 4.6 St. Lucie Internal Event Core Melt Accident Sequences .......................................... 4-11 4.7 Cut Sets Contributing Significantly to the Probability of Cora Melt and the Associated Vulnerability for St. Lucie ........................ 4-12 4.8 ANO-1 Internal Event Core Melt Sequences ........... 4-11 4.9 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated Vulnerability for ANO-1 ............................ 4-15 4.10 Dominant Accident Sequences for TAP A-45 PWRs - Number of Occurrences for Each Sequence ............ 4-17 4.11 Summary of Dominant Sequences for PWRs Showing Fractional Contribution to Internal p(cm) .......... 4-la 4.12 Quad Cities Internal Event Core Melt Sequences ..... 4-20 4.13 Accident SGquenca Event Definitions - BWR .......... 4-21 4.14 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated ' Vulnerability for Q~a ad Citiec ...................... 4-22 4.15 Cooper Internal Event Core Melt Sequences .......... 4-24 4.16 Cut Gots Contributing Significantly to the Probability of Core Melt and the Associated Vulnerability for Cooper ... ...................... 4-25 4.17 Summary of Dominant Sequences for BWRs Showing Fractional Contribution to Internal p(cm) .......... 4-26 5.1 Sequence Core Melt Probabilities Summed Over All Earthquake Magnitudes - Base Case - Point Beach .... 5-3 5.2 Sequence Core Melt Probabilities Summed Over All Earthquake Magnitudes - Base Cane - Turkey Point ... 5-11 5,3 Sequence Core Melt Probabilities Summed Over All Earthquake Magnitudes - Base Case - St. Lucie ...... 5-22 5.4 Sequence Core Melt Probabilities Summed Over All Earthquake Magnitudes - Base Case - ANO-1 .......... 5-31 5.5 Summary of Special Emergency Analyses - PWR Planto . 5-39 l X
1 5.6 Sequence Core Melt Probabilities Summed Over All l Earthquake Magnitudes - Base Case - Quad Cities .... 5-41 i l 5.7 Sequence Core Melt Probabilities Summed Over All Earthquake Magnitudes - Base Case - Cooper ......... 5-50 ! l 5.8 Summary of Special Emergency Analyses - BWR Plants . 5-57 6.1 Potential Vulnerabilities and Proposed Modifications for Example Plant A - Point Beach .................. 6-3 6.2 Potential Vulnerabilities and Proposed Modifications for Example Plant B Turkey Point ................. 6-5 6.3 Potential Vulnerabilitier and Proposed Modifications for Example Plant C 'St. Lucie .................... 6-7 6.4 Potential Vulnerabilities and Proposed Modifications for Example Plant D - ANO-1 ......................... 6-9 6.5 Potential Vulnerabilities and Proposed Modifications for Example Plant E - Quad Cities .................. 6-11 6.6 Potential Vulnerabilities and Proposed Modifications for Example Plant F - Cooper ....................... 6-12 6.7 Definition of Alternatives Evaluated - Example Plant A - Point Beach .............................. 6-14 6.8 Definition of Alternatives Evaluated - Example Plant B - Turkey Point ............................. 6-14 l 6.9 Definition of Alternatives Evaluated - Example Plant C - St. Lucie ................................ 6-14 6.10 Definition of Alternatives Evaluated - Example i Plant D - ANO-1 .................................... 6-15 6.11 Definition of A'..ternatives Evaluated - Example Plant E - Quad Cities .............................. 6-15 6.12 Definition of Alternatives Evaluated - Example Plant P - Cooper ................................... 6-15 8.1 Economic Ground Rules and Assumptions for Impact Analyses .................................... 8-4 8.2 Impact Analysis Results ............................ 8-5 8.3 Genecic/ Local Cost Ratios .......................... 8-6 9.1 Summary of Calculated Core Molt Probabilities - Internal Event and Special Emergency Analyses ...... 9-2 9.2 Summary of Probabilistic Core Mel*. Estimates ....... 9-4 9.3 PhR Accident Sequence to Release Category Mapping .. 9-5 9.4 Example Base Case Release Category Mapping ......... 9-6 9.5 Example Dominant Accident Sequences and Special Emergencies Contributing to Release Categories ..... 9-7 9.6 Central Estimate of Offsite Population Dose in Person-rem for the Base Case ....................... 9-10 9.7 Expected Values of the Population Dose and Averted Population Dose Within 50 Miles Using Central Estimate Source Term ....................... 9-12 9.8 Estimated Containment Failure Modes for BWRs ....... 9-13 9.9 Weighted Core Melt Probabilities for Each Accident Sequence Type ............................. 9-15 9.10 Central Estimate Offsite Population Dose in Person-rem for the Base Cacc ....................... 9-16 xi
9.11 Expected Values of the Population Dose and Averted Population Dose Within 50 Miles Using Central Estimate Source Term ..................... 9-17 l' 10.1 Value and Impact Analysis Input Variables ........ 10-2 10.2a Point Beach Value-Impact Analysis Ercor Factor ... 10-4 10.2b Value-Impact Analysis Error Factors .............. 10-4 10.3a Point Beach - Summary of Impacts ................. 10-11 10.3b Point Beach - Summary of Positive Values ......... 10-12 10.3c Point Beach - Summary of Negative Values ......... 10-13 10.3d Point Beach - Summary of Value-Impact Analysis ... 10-14 l 10.4a Turkey Point - Summary of Impacts ................ 10-15 ! 10.4b Turkey' Point - Summary of Positive Values......... 10-16 l 10.4c Turkey Point - Summary of Negative Values ........ 10-17 10.4d Turkey Point - Summary of Value-Impact Analysis .. 10-18 l 10.Sa St. Lucie - Summary of Impacts ................... 10-19 10.5b St. Lucie - Summary of Positive Valuss ........... 10-20 10.Sc St. Lucie - Summary of Negative Values ........... 10-21 10.5d St. Lucie - Summary of Value-Impact Analysis ..... 10-22 10.6a ANO Summary of Impacts ....................... 10-23 10.6b ANO Summary of Positive Values ............... 10-24 10.6c ANO Summary of Negative Values ............... 10-25 10.6d ANO Summary of Value-Impact Analysis ......... 10-26 10.7a Quad Cities - Summary of Impacts ................. 10-27 10.7b Quad Cities - Summary of Positive Values ......... 10-28 10.7c Quad Cities - Summary of Negative Values ......... 10-29 10.7d Quad Cities - Summary of Value-Impact Analysis ... 10-30 10.8a Cooper - Summary of Impacts ...................... 10-31 10.8b Cooper - Summary of Positive Values .............. 10-32 10.8c Cooper - Summary of Negative Valuet .............. 10-33 10.8d Cooper - Summary of Value-Impact Analysis ........ 10-34 10.9 Point Beach - Summary of Value-Impact Measures ... 10-35 10.10 Turkey Point - Summary of Value-Impact Measures .. 10-36
- 10.11 St. Lucie - Summary of Value-Impact Measures ..... 10-37 10.12 ANO Summary of Value-Impact Measures ......... 10-38 l 10.13 Quad Cities - Summary of Valuo-Impact Measures ... 10-39 l
10.14 Cooper - Summary of Value-1mpact Measures . ...... 10-40 11.1 Core Melt Pcobability With and Without Feed and Eleed from the Case Studies with Recovery .... ... 11-2 11.2 AFW System Unavailability as a Function of Acci-dent Sequence Initiating Event Without Recovery .. 11-3 11.3 Effect of Block Valve Position on Probability of Core Melt ..................................... 11-5 11.4 Effect of FNB on Probability of Core Melt ........ 11-7 11.5 Selected Westinghouse Plant Parameters ........... 11-11 11.6 Selected Westinghouse Plant Parameturs ........... 11-12 11.7 Selected B&W Plant Parameters .................... 11-14 11.8 Effects of Secondary Blowdown Upon Esti.mstes of Core Melt Probability ............................ 11-17 12.1 Comparison of Direct Costs of Alternative Add-on Decay Heat Removal Systems for Pressurized Water Reactors ......................................... 12-3 xii
12.2 Comparison of Major Equipment Design Parameters for Add-on Decay Heat Removal Systems ............- 12-5 12.3 Comparison of Evaluated Costs of Alternate Decay Heat Removal Systems for Pressurized Water Reactors ................................... 12-7 12.4 Comparison of Costs for Options to Increase Reliability / Capability of ADHR for Pressurized Water Reactors ................................... 12-8 12.5 Comparison of Costs for Options to Increase Re11 ability / Capability of ADHR for Boiling Water Reactors ................................... 12-11 12.6 Comparison of Prior and Current Cost Estimates for the Addition of a Feed and Bleed Capability to System 80 Plants .............................. 12-14 13.1 Remaining Service Life and Effective Service Life for TAP A-45 Example Plants .................. 13-3 13.2 Summary of the Variation in the "Value" Term, if Based on Offsite Costs Only, with the Principa' Parameters Subject to Uncertainties .... 13-8 13.3 Present Worths of 10 Years Replacemant Power . at Exarple Plant Sites as Function of the Escalation Rates ................................. 13-10 13.4 Summary of the Variation in the "Value" Term, if Based on Onsite Costs Only, with the Principal l Parameters Subject to Uncertainties .............. 13-12 : 13.5 Central Values of Maximum Expectations of Loss Associated with Failures of DHR Systems .......... 13-13 13.6 Uncertainty in Combined Offsite and Onsite Costs Due to Factors NOT Dependent on NRC Decisions Using the Add-on Decay Heat Removal System Data .. 13-15 14.1 Plants Represented in the Analysis ............... 14-2 14.2 PWR Internal AnalyJis Dominant Accident Sequences. 14-3 14.3 Sensitivity Otudies .............................. 14-6
- 14.4 PWR Internal and Special Emergency Core Helt Probabilities .................................... 14-7 14.5 PWR Core Melt Probability by Vulnerability -
Base Case witn Recovegy........................... 14-9 14.6 PWR Core Melt Probability of Alternatives ........ 14-11 14.7 PWR Population Dose out to Mile Radius ...... 14-11 14.8 PWR Summary of Value-Impact Measures - One Unit .. 14-12 14.9 PWR Summary of Value-Impact Measures - Two Units . 14-13
; 14.10 BWR Internal Analysis Dominant Accident Sequences. 14-20 14.11 BWR Internal and Special Emergency Core Melt Probabilities .................................... 14-21 ; 14.12 BWR Vulnerabilities and Proposed Modifications ... 14-22 14.13 BWR Core Melt Probability of Alternatives ........ 14-23 14.14 BWR Population Dose Out to a 50-Mile Radius -
Central Value. Person-rem / Reactor Year ........... 14-25 14.15 BWR Summary of Value-Impact Measures - One Unit .. 14-26 i 14.16 BWR Summary of Value-Impact Measures - Two Units . 14-27 l l xiii/xiv
GLOSSARY
\
ADR Averted Dose Ratio ADV Atmospheric Dump Valve AE Architectual Engineer AFWS Auxiliary Feedwater. System AFUDC Allowance for Funds Used During Construction l ANO-1 Arkansas Nuclear One - Unit 1 l AOV Air Operated Valve AP&LC Arkansas Power and Light Company ASEP Accident Sequence Evaluation Program ATWS Anticipated Transient Without Scram B&W Babcock and Wilcox BAT Battery BLK Blocked (referring to PORV block valve) BNF Bleed and Feed (for medium pressure capability) BWR Boiling Water Reactor BWST Borated Water Storage Tank CARCS Containment Air Recirculating System CCC Check Valve - Normally Closed Fails Closed CCWS Component Cooling Water System CE Combustion Engineering CEC Commonwealth Edison company CFCU Containment Fan Cooling Unit CFM Containment Failure. Mode (e.g., a, S,y, 6, e) CM Common Mode or Core Melt COP Containment Overpressure Protection CR Control Room CSI/RS Containment Spray Injection / Recirculation System CSR Cable Spreading Room CST Condensate Storage Tank CV Check Valve DAS Dominant Accident Sequence DDP Diesel Driven Pump (also PDD) DG Diesel Generator DPR Dollars per Person Rem ECC Emergency Core Cooling (= ECI + ECR) ECI Emergency Core Injection ECR Emergency Core Recirculation EFWS Emergency Feedwatei 3ystem EPS Emergency (Electric) Power System ERV Electromatic Relief Valve ESAS Emergency Safeguards Actuation System ET Event Tree j FB Flow Blocked l FNB Feed and Bleed (for high pressure capability (also P&B) FP&LC Plorida Power and Light Company PSAR Final Safety Analysis Report FT Fault Tree FTO Pails to Open l FTOP Pails to Operate FTR Failure to Run FTS Failure to Start GE General Electric xv
i HPI/RS High Pressure Injection and Recirculation System l HR Decay Heat Removal i HTX Heat Exchanger IE Initiating Evert I IGLD International Great Lakes Datum IIG&EC Iowa-Illinois Gas and Electric Company IREP Interim Reliability Evaluation Program LOCA Loss of Coolant Accident LOHT Loss of Heat Transfer LOSP Loss of Offsite Power LPI/RS Low Pressure Injection and Recirculation System LPLS Loss of Power Conversion System - MDP Motor Driven Pump (also PMD) MFWS- Main Feedwater System (part of PCS) MLW Mean Low Water MOV Motor Operated Valve MSIV Main Steam Isolation Valves MSL Mean Sea Level MSL Meat. Sea Level MV Manual Valve NBV Net Benefit Value NCC Pneumatic-Hydraulic Valve - Normally Closed Fails Closed NI Net Impact (Cost) NPP Nuclear Power Plant NPPD Nebraska Public Power District NR Normally Running NSSS Nuclear Steam Supply System NV Net Value OE Operator Error PAHR Post Accident Heat Removal (same as RHR) PARR Post Accident Radio Activity Removal PCS Power Conversion System PMH Probable Maximum Hurricane PORV Power Operated Relief Valve PRA Probabilistic Risk Assessment PWR Pressurized Water Reactor R-yr Reactor Year (also Rx yr) ' RA Recovery Action RB Reactor Building RC Release Category ~ RCS Reactor Coolant System RHR Residual Heat Removal RHRS Residual Heat Removal (usually the same as LPRS) RWST Refueling Water Storage Tank SB Standby SBD Secondary Blowdown SBLOCA Small Break Loss of Coolant Accident SDHR Shutdown Decay Heat Removal SG Steam Generator SGTR Steam Generator Tube Rupture SIS Safety Injection Signal SRV Safety Relief Valve SWS Service Water System xvi
TDP Turbine Driven Pump (also PTD) TI Total Impact (Cost) - TNK Tank UTM Unavailable Due to Test or Maintenance (also TM) VCC Motor Operated Valve - Normally Closed Fails Closed VIR Net Value Impact Ratio W Westinghouse WEPC Wisconsin Electric Power Company
-XCC Manual Valve - Normally Closed Fails Closed -CO - Normally Closed Fails Open -OC - Normally Open Fails Closed -00 - Normally Open Fails Open d
xvii /xviii
ACKNOWLEDGEMENTS Major portions of the study were done by other Sandia staff members and supporting subcontractors. These people are listed below.
- David M. Ericson, Jr.
Wallis R. Cramond Gary A. Sanders. Steven W. Hatch . Michael P. Bnhn Sharon L. Daniel Sarah J. Higrins Mark J. Jacobus John A. Lambright Wallace T. Wheelis Sandia National Laboratories John B. Mulligan Frank A. Cook John G. Simon United Engineers and Constructors. Inc. Leslie cave William E. Kastenberg University of California at Los Angeles Martin W. McCann, Jr. John W. Reed Jack R. Benjamin and Associates William J. Galyean* Walter L. Farrell Science Applications International Corp. James J. Johnson Brian J. Benda NTS Structural Mechanics
- Currently with NUS Corporation XiX/XX
l
1.0 INTRODUCTION
1.1 Obiectives ! The overall objectives of Task Action Plan A-45 are to evaluate ! the safety adequacy of decay heat removal (DNR) systems in exist-ing light water reactor nuclear power plants and to assess the value and impact (benefit-cost) of alternative measures for improving the overall reliability of the DHR function if required, i To provide the technical data required to meet these objectives, i a pr.ogram was developed which examined the state of DNR system } 4 reliability in a sample of existing plants. This program identi- : fied potential vulnerabilitie,s and identified and established the feasibility of potential measures to improve DHR. A value/ impact l ' (V/I) analysis of the more promising of such measures was conduc- ! ted and documented. This report summarizes those studies. In l addition, because of the evolving nature of V/I analyses in , support of regulation, a number of supporting studies related to f appropriate procedures and measures for the V/I analyses were ; also conducted. These studies are also summarized here. i 1.2 Backaround ! Because Unresolved Safety Issue A-45, Decay Heat Removal . Requirements encompasses the entire industry, the population of nuclear power plants to be considered for analysis started with i approximately 173 units in 1981. Seventy units were excluded l from study because: 1) they were of special types (e.g., HTGR) l or included in the Safety Evaluation Program; 2) there are l sufficiently similar units included in the remaining base; or i
- 3) the units were not far enough along in the design / construction process to have information readily available. The remaining 90 plus units formed the base of the TAP A-45 study.
The initial steps in assessing the state of DHR were to: [
- 1) characterize the units in terms of their physical parameters, t i.e., number and location of safety pumps, number of redundant l emergency power trains, etc., and 2) develop a set of qualitative screening questions against which the plant characteristics could i be compared. These qualitative screening questions were based I upon a thorough review of existing guidance such as the standard i Review Plan and the various Regulatory Guides, previous Probabi- j listic Risk Assessments, special topical studies such as the i Auxiliary Feedwater Studies, etc. The intent was to establish a ,
set of questions which would reveal potential deficiencies in DHR , capabilities for both Design Basis Events and for beyond Design Basis Situations. After review and reduction, some 135 questions remained for use in the qualitative screening process. There are four possible outcomes of such a qualitative screening: the ! plant meets the postulated condition, the plant does not meet the postulated condition; there is insufficient plant information in ; the data base to evaluate the design; or the question does not ! apply to that plant. The sole purpose of this qualitative ! 1-1 l mm mm
screening was to highlight DotentiAl DHR vulnerabilities for further study. Because each plant has a unique configuration, an inability to meet the conditions of a particular question at one
- plant may be more or less serious than a similar inability at i
another plant. For example, consider the case of a single valve in a DHR water supply line. There was a screening question ! designed to identify such valves which, if closed, would fail the t system. If this valve is in the line from the only source of ] water, it may be a potentially serious single failure mode. J However, if there exist redundant sources of water, redundant , lines, or other systems which perform the same function, the i single valve may be'of little concern. Such differences can only 1 be established by detailed analysis. Nevertheless, the !
- qualitative screening served as a tool to focus program resources i
< and direction. l On the basis of the initial qualitative screening, approximately twenty plants, which included all vendor types, were potential ! candidates for further study. From this group seven plants were , selected initially; six case studies have actually been j completed. This selection process was subjective and took into I account other issues in which a particular plant might be ; I involved, operational status, utility willingness to participate, . t , and similar concerns. The characteristics of these plants are
; shown on Table 1.1.
- 1.3 The Shutdown Decay Heat Removal Analysis As noted above, several plants were identified in the initial (
qualitative screening as having sufficient Datential vulnera- i bilities to wartant additional study. This initial screening and j then subsequent identification of vulnerabilities and eval-uation of alternatives for improving DHR were the subjects of : i the case studies summarized in this report. Some potential ! j accidents which could result in core melt have not been analyzed. l Since the purpose of this program is to study the capabilities ; of shutdown decay heat removal systems, large LOCAs, reactor ! vessel ruptures, interfacing system LOCAs, and anticipated i transients without scram (ATWS) were excluded. Furthermore, special issues being studied in depth elsewhere, such as ' pressurized thermal shock and reactor coolant pump seal LOCAs, were also excluded. 1 I The flow of the analysis and value-impact assessment are , illustrated in Figure 1.1. The internal analysis proceeded I along the well-documented approach used for other probabilistic j risk assessments (PRA).1 The potential accident initiating [
- events were identified and combined with the required safety ;
) functions in event trees. Then using Boolean solutions to the ! ! fault trees describing the safety systems required to perform i the safety functions combined with the initiating events, ;
j accident sequences were defined which could lead to situations i resulting either in safe conditions or core melt. The 1-2 L _ _ _ _ _ _ _ . - _ _ . _ _ _ _ _ _ _ _ _ _ _ -
Table 1.la TAP A-45 Plant Characteristics - PWR Characterist ics Plant A Plant B Plant C Plant D Type 2-Loop W 3-Loop W CE B6W Number of Units 2 2 2 1 + (1 CE same site) Date Operational 12/70 12/72 12/76 12/74 10/72 9/73 5/83 Megawatts Electric 497 666 777 836 Utility WEPC FP&LC FP&LC AP&IE containment Type Steel-Lined Reinf. Steel-Lined Reinf. Steel-Lined Reinf. Steel-Lined Reinf. Concrete Cylinder Concrete Cylinder Concrete Cylinder Concrete Cylinder Y Containment Volume 1.0E+6 cu fL 1.6E+6 cu ft 2.5E+6 cu ft 1.9E+6 cu fL " (large dry) (large dry) (large dry) (small dry) Containment Design 60 psig 59 psig 40 psig 59 psig Pressure Type Steam Cenerator Vertical Shell Vertical Shell Vertical Shell Once Through U-Tube U-Tube U-Tube Site West Shore East Coast East Coast On Lake Lake Michigan Florida Lake Michigan Dardanelle CST Capacity 10.000 gal TS Min 185,000 gal TS Min 250,000 gal Max Existing 107.000 gal 45.000 gal Max 250,000 gal Max (2 tanks inter- TS Min (for Unit 1) (2 tanks inter- (2 tanks inter- connected) New 350,000 gal Max connected) connected) (shared between units) kWST Capacity 275.000 gal 320.000 gal Min 371,800 gal Min 380,00 gal 338,000 gal Max SWST
Table 1.la TAP A-45 Plant Characteristics - PWR (cont.) Characteristics Plant A Plant B Plant C Plant D Design Pressure 2485 psig 2485 psig 2485 psig 2500 psig Operating Pressure 2235 psig 2235 psig 2235 psig 2155 psig' SRV k . & Set Point 2, 2485 psig 3, 2485 psig 3, 2485 psig 2, 2500 psig l PORY No. & Set Point 2, 2335 psig 2, 2335 psig 2, 2385 psig RRV 1, 2455 psig Systems Modeled LPI/PS & HTIS LPI/RS & HTIS LPI/RS LPI/RS & HTIS (No. & type pumps, 2 MDP 600 palg 2 MDP, 600 psig 2 MDP. 500 psig 2 MDP 160 psig shutoff head, sharing with other HPI/RS HPI/RS HPI/RS HPI/RS unit, and main line 2 MDP, 1750 psig 4 MDP, 1750 psig 3 MDP, 1600 psig Needs LPRS for dependencies as Needs LRS for Needs LPRS for 3 MDP, 300 psig applicable) Recirculation Recirculation Recirculation AFWS AFWS AFWS RFWS 2 MDP (shared) & 3 TDP + 2 MDP (non- 2 MDP + 1 TDP 1 MDP & 1 TDP l 1 TDP (dedicated) safety grade)
- l (all shared)
PCS PCS PCS PCS 2 MDP 2 MDP 2 2 TDP + 1 AFWS MDP (not modeled) (not modeled) (not siodeled) (neither modeled) CSI/RS CSI/RS CSI/RS & HTIS RBSI/RBSR 2 MDP 2 MDP 2 MDP 2 MDP Needs LPRS for Needs LPhtS for Recirculation Recirculation CARCS CARCS CFCS RBCS 4 CFCU 3 CCU 4 CCU 4 Fan Trains SMS SWS ICWS SWS 6 MDP (shared) 3 MDP (shared) 3 MDP 3 MDP
Table 1.la TAP A-45 Plant Characteristics - PWR (cont.) Characteristics Plant A F l an t___B Plant C Plant D Systems Modeled CCWS CCWS CCWS No CCWS (continued) 2 MDP 3 MDP (shared 3 MDP Components Cooled . Requires SWS Requires SWS Requires ICWS , Directly from SWS for Cooling for Cooling for Cooling EPS-AC EPS-AC EPS-AC EPS-AC 2 DC-2 Trains 2 DC-4 Trains 2 DC-4 Trains 2 DC-2 Trains Plus CTC (all Plus 5 (non-safety shared) grade) DG (all shared) EPS-DC EPS-DC EPS-DC EPS-DC 2 Batteries-2 Trains 4 Batteries-4 Trains 2 Batteries-2 Trains 2 Batteries-2 Trains e (shared) (shared) 8 Hr Station 8 He Station d 2 He Station 2 He Station Blackout Rating Blackout Rating Blackout Rating Blackout Rating but Credit for 8 Hr. Due to Backup Equipment ESAS ESAS ESFAS ESAS
Table 1.lb TAP A-45 Plant Characteristics - BWR Characteristics - Plant E Plant F Type BWR3 BWR4 Number of Units 2 1 Date Operational 8/72 7/74 10/72 Megawatts Electric 789 778 Utility Coma Ed NPPD Containment Type MK1 Pressure MK1 Pressure Suppression Suppression Containment Design 56 psig 56 psig Pressure Site Mississippi River Missouri River NW Illinois E Nebraska Design Pressure 1250 psig 1250 psig Operating Pressure 1000 psig 1000 psig No. Rocirculation 2 2 Loops Systems Mod 0 led HPIC- HPIC (No. & type pump, 1 TDP, 21150 psia 1 TDP, shut 0ff hea.1, sharing CST or suppression CST or suppression with other unit, main pool for water pool for water line dependencies as Steam pressure steam pressure applicable) 1 100 psig 1 100 psig RCIC RCIC 1 TDP, > 1135 psia 1 TDP, ~1500 psig CST cr suppression CST or suppression
- pool for water pool for water ADS ADS 8 S/SRV, 1115 psig 11 S/SRV, 1080-1240 psig RHR (LPIC) RHR (LPIC) 4 MDP, ~325 psig 4 MPD, ~ 295 psig Suppression pool Suppression pool or CST for water or CST for water I RBCCW RHRSW 2 MDP 4 MDP, > 65 psig 1-6
Table 1.lb TAP A-45 Plant Characteristics - BWR (cont.) . Characteristics Plant E Plant F CS RBSW 2 MDP, > 325 psig 4 MDP, > 55 psig Suppression pool or CST for water EPS-AC CS 3 DG - 1 per unit 2 MDP, ~295 psig ) One shared Suppression pool i or CST for water DGCW EPS-AC l ! 2 MDP 2 DG l O e l d 1-7
i 4 i INTEasAL IMPACT
~
I ANALYS15 ANALYSIS l l EST.ABLISH ALTECNATIVES , I SPECIAL i m ast Cv L_ v& Luc
- ANALYSIS g gy3g$
l VALUE/
}
1MPACT "s annan vsIs l l
,i GENERIC I' RECesetEuSAileNS l
i l i
)
I
! Figure 1.1 Shutdown Decay Heat Removal Analysis 1
i 1 1 I 1 _ - _ -_ . - _ _ . -
probability of those sequences occurring which result in core melt was quantified using available computational tools. This quantification also identified the specific random failure events (e.g., equipment failure, operator error) which contributed to the core melt and the magnitude of that contribution. In addition, for core melt sequences the performance of containment systems was also examined. Then using the results of past PRAs, these results are used to determine the containment failure modes. This leads to delineation of potential release category probabilities which can be used to establish public risk in terms of expected population radiation dose and other measures. The results of the internal analysis are estimates of the probability of , specific failures and their contribution to core melt and ! public risk. This information can then be used to suggest modifications to equipment or procedures which reduce or eliminate those failures. The special emergency analyses were done in a similar manner although perhaps more qualitative than the internal analysis and certainly more dependent upon engineering judgment. Generally the special analysis for earthquake, flood, and high winds proceeded by identifying the hazard and its frequency of occurrence. Then an assessment of the response of the plant to this hazard was established. A key aspect of this assessment was an onsite inspection of the plant and its equipment. Once the response was established, individual equipment fragilities were developed. Then using the internal event fault trees and events, the potential contribution of specific failures to core melt probability were estimated. Using this information, specific modifications were defined to reduce or eliminate the effects of certain vulnerabilities. The special emergency analyses for fire and internal flood were dono differently. First, potentially significant fire areas were identified using the transient event trees and system fault trees to establish the critical front line and support systems. Second, the physical arrangements of equipment and potential fire sources were verified by a site visit. The effects of the special emergency were then quantified based on historical fire occurrence frequencies, analytical models of fire growth, and fire suppression probabilities. In addition, l random failures and human factors were considered as l applicable. Based upon these results, modifications designed to reduce core melt were proposed. Based upon initial engineering estimates of the possible reductions in core melt probability that might be achieved by the various modifications, the modifications were combined into l groups for engineering evaluation of feasibility and impact. These combinations are called alternativeo in the case studies. The alternatives uere reviewed by the Architectural Engineer (AE) and the plant staff for feasibility and 1-9
reasonableness. Based upon this initial review, the AE proceeded with the conceptual designs. After an onsite inspection to insure that the proposed designa could be implemented and to gather site specific cost and related data, the AE performed the impact analysis. The results include, but are not limited to, capital costs for engineering and installation, radiation exposures incurred, maintenance and operational costs. Once the conceptual designs were reasonably well established, the internal and special emergency analyses were repeated for each alternative to determine its value in terms of reduced core melt probability and reduced public risk. These analyses are summarized in Sections 4, 5, and 9. respectively. The impacts and values were then integrated into a value-impact analysis. This analysis was structured according to existing NRC guidelines. Further discussion and summary of the value-impact analyses are provided in Section 10. A brief uncertainty discussion is provided in Section 13 and an 1 analysis of special issues (i.e., bleed and feed, and secondary blowdown mode of operation) is provided in Section 11. Special studies on costs related to specific options are discussed in Section 12. Finally, the analyses suggest generic insights or conclusions that might be inferred from the results of the case studies (Section 14). 4 1-10
l l 2.0 INTERNAL ANALYSIS - METHODS l 2.1 Analysis Methods The internal analysis methods described in this section use the pictorial representation of the internal analysis shown in Figure 2.1 as a guide. After the various tasks are explained l an example will be given in the symbols that act typical of l probabilistic risk assessments and of these case studies, i l 2.1.1 Modeling i The process began with the selection of the initiating events 13.3 I to be considered. Since the purpose of this program was to study the adequacy of the shutdown decay heat removal (SDHR) j 'ff function. Large LOCAs, ceactor vessel ruptures, interfacing .Efo , system LOCA3, and anticipated transients without scran (ATWS) OI T were excluded. Furthernore, special issues being studied ? - l' elsewhere such as pressurized thermal shock and RCP seal LOCAs @%Jed were also excluded. Thus, the initiating events analyzed were: Small LOCA l Loss of Offsite Power Transients ! l Transients resulting from initial Loss of, the Power I Conversion System (PCS) l Transients with offsite power and the PCS initially available Transiento cesulting from the loss of an AC or DC bus l l The accident sequences to be analyzed were delineated by event ' l treco. In order to develop these event trees foc each of the init.iating events, the success criteria foc the aystems i contributing to the SDHR function were defined using the
- intocuation sources listed in Tablo 2.1. The objective was to l
define the success critecia and potential options to address ! the various accident conditions realistically and not be overly conservative. The f:ont line and support systems thac were considered are shown in Table 2.2. Each of the front line systems or combinations of those systems is a column heading or decision branch in the event trees. The event tree starts with an initiating event and successively asks whether or not the functions / systems (in each of the headings) are successful or fail. In some branches previous success / failure answers make later decisions irrelevant ecoulting in an asymmetric event tree that most simply represents D e sequence of events leading to the potential outcomes, success or core melt. A transient event tree is shown in Figure 2.1 in the upper left hand part of the diagram. A LOCA event tree is shown to the right of the transient event tree representation. LOCAs may be initiated independently or can cesult from transient induced LOCAs as depicted in the diagram. The final cesult in any of the cases, trancient, transient induced LOCA, or LOCA, 2-1
Transient Event free LOCA [went free Containment Systees Centainment Failure Event Tree Modes I CE -
--1 a C, . -
" .I Y
ig Cn CH 0 OK f k cess ! g Initiating u og I Event (IE) I ryg { I8II"* { 8 Transient Induced U __ 8 l_OCA Core Melt (CM) Accident
- C, ore MeltRontainment Phenomenology Accident 8
sequences Systems Accident Code 8 Sequences e 1 2 3 4 5 6 7 N Fault f rees f or tavst I I I I I I I i b Event Tree Headin9s Release Categorfea l Containment Overpresture Protection g Post Accident Radioactivity Protection ,p sequence Code Y d Public Risk v Measures - Cxtc Event - Popunction Dose - l l Component Failures j Test css Maintenance Unavailability Operatur Error Data-Failure Support System - Probabilities Service water, AC Pawer , --- l Figure 2.1 I'ictorial Representation of the Internal Analysis l
7 l l l l TABLE 2.1 INFORMATION SOURCES l
- 1 .
Final Safety Analysis Report (FSAR) General Arrangement Drawings Electrical One-Line Drawings System Piping and Instrumentation Drawings Interin Reliability Evaluation Program Procedures ' Guide (References) l Technical Specifications l Appendix R Submittals Emergency Procedures l Topical Reports . Discussions with Plant Personnel l l l 1 2-3
TABLE 2.2 SYSTEMS CONSIDERED IN THE ANALYGIS Fcont Line Systems Pressurized Water Reactocs Auxiliary Feedwater System High Pressure Injection and Recirculdtion System Low Pressure Injection and Recirculation System Power Conversion System Pressurizer Safety and Relief Valves Secondary Safety and Relief Valves Reactor Building Spray, Injection and Recirculation System Reactor Building Cooling Systems Boilinc_ Water Reactocs High Pressure Coolant injection System Reacto: Coce Isolaf. ton Cooling System Low Pressuce Coolant injection System Residual Heat demoval System Coco Spray System Safety / Relief Valves Spaport Systt31 Emergency Electric Power System (PWR/BWR) Service Water System (PWR) Component Cooling Water System (PWR) Residual Heat Removal Service Watec System (BWR) Diesel Generator Cooling Water System (BWR) Reactor Building Closed Cooling Watec System (BWR) Emergency Safeguards Actuation System (PWR/BWR) Reactor Building Service Water (BWR) 24
is an accident sequence made up of the success or failure of events (i.e., event tree headings representing front line ' sy coms) leading to either success or core melt. The accident sequences are carried further into the analysis, but first it is instructive to look at the development of the event tree headings. These are modeled on fault trees such as the one shown in the lower left side of Figure 2.1. Each fault tree is composed of all the components in che flow paths of the I systems involved in an event tree heading. Often the event tree heading is simply one specific system. Sometimes more than one system may be combined in a fault tree. In any case, the fault tree represents all the potential failure combinations that could lead to failure of the system based on its system success criteria, e.g., flow from 2 out of 3 pump trains. The individ-ual components are the key to the development of the fault tree. At the component level all the ways that component can fail are modeled including the support systems required by that compon-ent. Interactions between components and trains of a system are implicitly modeled by the step-by-step process of constructing ! the fault tree and identifying these potential failures. In this program the event trees were small and the fault tree medium in size which reflects the detail permitted by the scope of the program. This was deemed to be the proper mix to meet the objectives of the program. The outcome of each branch of an ovent trea is an accidont sequence such as S HLO ? , where the initiating event is a small I.OCA (32) followed 2 by koks of the PCS (M), failure of the auxiliary feodwater system (I,), st;ccess of the high pressure l injectiin system (6 ), and finally, failura of the pressurizer l power operated relikt valves (Pt) leading to an early core melt. l l The last part of the modeling task was to establish the data I base to be used to quantify tha accident sequences. Each initiating event frequency and basic fault tree ev6nt probability must be derived from data or engineering judgement. The data used in this analysis is essentially generic in nature. A tabulation of the data is presented in Apendix A. Within the analysis some failure rates apply to many components. For example, the local fault (LF) failure probability of a motor operated valve (V) whicn is normally closed (NC) and fails to open, i.e., fails closed (PC), VCC-LP is 3E-3 per demand. Thus, any valve fitting this description regardless of the system in which it appears would be assigned the same failure probability. As noted elsewhere, recovery factors applied are a function of the particalar accident sequence and plant conditions. The model then consists of event troos for each initiating event, fault trees for each event used in the event trees, and the data base (or value block in the computer program terminology). 2-5
o j i I
' i 2.1.2 Accident Sequenca Analysis !
l The output of this modeling is a det of accident sequences in i
- which each accident sequence is composed of the product of the ;
i Boolean equation for each of the accident sequence events. The i number of sequences potentially leading to core melt varies ! from plant to plant. The SETS Boolean reduction computer code l was run on each of these accident sequences to obtain the core l melt probability and the significant combinations of basic ! i events that result in care melt. The Boolean reduction results ! l in a sua of products of basic events. Each of these products i is called a cut set such as PUMP 1 times VALVE 7 times OPERATOR ! ACTION A. l 1
)
f Every accident sequence is made.up of unmodeled and modeled I i events. For example, in the eccident sequence 8 ML6 P ' i the 8 2M events are not modeled but are assigned I fchqde,ncy . l of S2 and a probability for M from the data base. The events } ! LD,P are the Boolean part of the accident sequence leading to , j the .ut sets. The product of f(8 )*p(M)*p(LD P is the core
- i melt contribution for this accidedt sequence.g )he T sua of the !
i core melt probabilities for all accident sequences identified i is the shutdown decay heat removal (SDHR) core melt probability [ for the internal events analysis. However, there v e recovery j actions that can be taken which were not included in the basic j model due to the complexity that would.have been incucced. ; i Therefore, the next step was to apply the appropriate recovery ' factors to all the significant cut sets of the dominant ! accident sequences (that is those accident sequences which l i combined conctibute approxisctely 90% of the core melt i j probability). There are typically 5 to 15 dominant accident I j sequences carried through the recovery analysis. Application i j of recovery results in a lower SDHR core melt probability. The ! j recovery actions consi.lered and their probabilities are { j tabulated in Appendix 13. f 2.1.3 Vulnerability Identification The most significant cv.t sets of the dominant acnident sequences . after recovery was applied are the basis for identifying the !
- potential internal vulne*rabilities. When these cut sats were I i examined and grouped by types of failures a pattern developed l 1
in that certain basic event failures appeared in the cut sets ! from several accident sequences. The outcome was a relative [ ranking of potential vulnerabilities, the cause of each ' j < vulnerability and the cc.;stribution of each vulnerability to the f } total SDMR coce melt probability. The objective was to i identify those vuln(' abilities which contribute something ovec . 1 40% of the total SDER core melt probability and then address l l possible modifications to ceduce or eliminate them. I 1 ! l A further screening of the accident sequences was provided by I the vulnerability identification which often resulted in a i j 2-6 [ l l 1 _ _ _ ._.__ __ __ _ .i
t l i reduction of the number of accident sequences requiring further consideration. While the vulnerabilities were selected based ' on core melt probability, the input needed for the value-impact 7alysis is risk to the public. The risk measure used is l 13pulation dose in person-ren within a 50 mile radius of the +
; plant. In ord0r to obtain population dose the dominant i j accident sequences must be extended to include containment l i failure, environmental transport, and consequence analyses.
j 2.1.4 Containment System Integration l
- Many containment systems do not directly affect the probability ;
, of core melt, especially when it is assumed, as was done here, ; that containment failure prior to core damage does not cause i failure of the enorgency core cooling systems. It may be noted that in past PRAs for PWRs it was assumed that failure of the containment resulted in sump flashing and subsequent failure of the emergency core cooling systems due to pump cavitation. ' { This was considered to be an overly conservative approach, thus l j in these analyses core melt does not depend on containment ' t systems. However, containment system operability during a core ! melt can influence'the ultimate radioactive material release, { and thus consequences to th) public. Successful operation of ! i containment sprays (or suppression pool scrubbing in case of I
- BWRs) will lower the radioactive material release by scrubbing
4 out and retaining fisson products inside containment. I
- Operation of containment fans, sprays, or suppression pool
j cooling systems may also prevent or delay containment failure ; j from overpressure. Any delay between initiation of core melt ; I and containment failure provides time for deposition of air i borne particles which also reduces the potential offsite , i release. A typical containment systems event tree is depicted in Figure 2.1 on the extension of one of the core melt (CM) 3 accident sequences. Each of the dominant accident sequences l was rerun with each of the Boolean containment syst".as event ! tree outcomes to establish the probabilities for the 1 containment systems outcomes or states. This is the input for j the next stage of the analysis. The containment systems censidered for PWRs were: Reactor Building Spray Injection and Recirculation System (PWR) Reactor Building Cooling System (PWR) Outcomes of the containment systems event tree are success or failure of the containment overpressure protection function and success or failure of the post accident radioactivity removal function. These outcomes and the early/ late core melt state determine the release category assignment for each accident sequence. 2-7
After the dominant accident sequences wete run with each of the containment systems sequences, a further screening was performed resulting in a limited number of sequences as candidates for the next recovery analysis. Another recovery analysis is needed since the previous recovery analysis could not be conveniently brought forward not would it necessarily be applicable since the cut sets change in the new Boolean reduction. The development of a sepacate containment system event tree was not necessary for the BWRs studied. The sequences delineated by the transient and small LOCA event tree inherently define the containment status for each core melt accident. There are two ' containment functions that are important: containment over-pressure protection (COP) and post-accident radioactivity removal (PARR). In BWRs successful COP is defined as successful blowdown of steam from the reactor vessel to the suppression pool (or in some cases the main condenser). Successful long-term COP requires that heat be removed from the suppression pool via the Residual Heat Removal System. PARR also involves the suppression pool and is dependent upon successful COP. If the suppression pool water inventory is maintained and kept cool, then a large fraction of the fission products released from the core will be retained in the pool. Knowledge of the status of COP and PARR was the starting point for estimating containment failure modes and accident releases for the BWRs. 2.1.5 Interface with Accident Phenomenology The sequences to be assigned to release categories each consist of an initiating event, a core melt event sequence, and a con-teinment systems event sequence. Detailed thermal-hydraulic analyses of the core melt processes, containment response and ultimate release of radioactive material to the atmosphere were beyond the scope of the TAP A-45 program. Therefore, initially the results of past PRA accident phenomenological codes were reviewed for applicability to these plants and tables developed to map each containment system /early-late core melt state into a celease category. This mapping assigned a containment failure mode and apportions the containment failure between these modes. Subsequently, a number of more recent studies which have I considered containment response in detail were reviewed for I applicability to the TAP A-45 program. As a result, new I information was used to revise the containment failure probabilities although the six failure modes adapted from the RSSMAP studies were retained. These containment failure modes are: a In-vessel steam explosion 8 Containment leakage Y Hydrogen burn overpressure 6e Ex-vessel steam spike 6g Steam and noncondensible gas overpressure c Base mat melt through 1 2-8
The sum of the probabilities for the sequences placed in each release categocy is then combined with the corresponding results (com the special emergencies. The CRAC2 consequence code was run for each site providing a conditional population dose (out to 50 miles cadius) for each release category. The total population dose (out to 50 miles radius) equals the sum of the probability of release category i a population dose i for i = 1 to 7. This total expected population dose is used in the value-impact analysis. 2.1.6 Value Analysis , The core melt probability and population dose described in the previous subsections comprised the ba,;e case. The modifications proposed for each of the vulnerabilities identified were grouped along with special emergency modifications to form alternatives. The value of an alternative is the decrease in core melt probability or the decrease in population dose from the base case. Therefore the entire process was repeated for each alternative. The number of alternatives varies from plant to plant. 2.1.7 Assumptions and Bases for the Analyses The following assumptions / guidelines or conditions were used in the conduct of the intern &1 event analyses. The majority apply to both pWRs and BWRs, however, where the assumption is testricted to one type that is so indicated.
- 1. System configurations and equipment locations were derived from the FSAR, drawings supplied by the utility, plant visits, and communications with plant personnel.
- 2. Operational proceduces in general were not analyzed in detail and we relied upon statements from plant personnel regarding pcoceduce .
- 3. The scope of initiating events was limited to small LOCA and transients including loss of an AC bus or a DC bus but excluding the loss of service water initiator. ATWS was not considered.
- 4. System success criteria used are generally conservative.
- 5. Containment failure and sump flashing do not cesult in ECCS failure due to pump cavitation (PWR).
- 6. Containment failuce will cause loss of all emergency coce cooling systems for sequences where the ECCS initially succeeda, but all containment heat removal fails (BWR).
- 7. Auxiliary Feedwater System (AFWS) or Emergency Feedwater System (EFWS) success is sufficient for cote cooling (PWR).
2-9
r
- 8. Even if the pressurizer safety relief valves are not required to provide RCS overpressure protection, these valves have a 7% chance of opening anyway (PWR).
- 9. The frequency of loss of offsite power quoted in NUREG/CR-2728, i.e., 8.6E-2 per reactor year, was used rather than other suggested generic or plant specific numbers. This provides a consistency between analyses.
- 10. Various component failure probabilities were derived in these analyses and may differ from other data bases, t
; 11. Circuit breaker failures were grouped with the associated buses for simplicity, i 12. Common mode pump and valve failure probabilities were derived based upon ASEP information.
I
- 13. Control circuit failures were combined with the local fault probabilities for pumps and motor operated valves.
- 14. Recovery of the PCS was only permitted for selected l accident sequences depending on the availability of power '
and whether the initial loss occurred as part of the initiating event or subsequent to it.
- 15. Only one recovery action was allowed in addition to recovery of LOSP or PCS, except when the allowable
.: recovery time is greater than 2 hours. 2 recovery actions l were permitted. ! 16. Cut sets with two UTM eventt from the same system were l considered invalid. I l l 17. Hardware failures of pumps and valves were not considered l 4 recoverable except for that part of the failure attributed to control circuit failures for valves which did have a
- recovery applied.
- 18. Normally-closed motor-operated valves in pump suction lines were considered recoverable since it was assumed operators would shut down the corresponding pumps before '
cavitation occurs based on discharge pressure and flow indication, thus making the recovery meaningful.
- 19. Actuation system failures are assumed to be remotely j recoverable by manual initiation of the particular system.
1
- 70. Successful safety injection extends any accident sequence time to core melt by approximately 3 hours (PWR).
- 21. Recovery was only appliad to the top cut sets of the top accident sequences--approximately 95t.
2-10 1
- 22. Feed and Bleed is a viable mode of generation and no containment overpressure protection is required in this '
- mode (PWR).
- 23. Containment venting is a viable mode of operation for decay heat removal in BWRs when adequate makeup water is available (BWR).
l 24. Station 125 VDC batteries will deplete in approximately 4 hours without any charging (BWR).
- 25. The High Pressure Coolant Injection (HPCI) system requires room cooling shortly after starting (BWR).
- 26. Residual Heat Removal. Core Spray and RCIC systems require room cooling in approximately four hours when all 1
containment heat removal is lost (BWR). 2
- 27. Power Operated Relief Valves (PORV) or Electromatic Relief Valves (ERV) are blocked (PWR).
- 28. Neactor coolant pump seal cooling w&J not modeled.
therefore, it is assumed in the analysis that seal does not require cooling (PWR). l ) l 1 I i t i i i 2-11
3.0 SPECIAL EMERGENCY ANALYSES Task Action Plan A-45 has been develcped to assess the adequacy of decay heat removal in existing 1.isht water reactors in response to both "internal" and "external" challenges. While internal challenges ste generally defined as those prob-abilistic random failures normally analyzed in a probabilistic risk assessment (PRA), frsv PRAs have considered the potential contribution to core melt probability due to the "external" l events. Since many of these "external" challenges actually , occur inside a plant (e.g., fire, turbine-generated missiles, pipe whip). TAP A-45 labels them all special emergencies to avoid confusion.
; The list of special emergencies that can be postulated to occur is quite extensive and a thorough analysis of each one would have required resources beyond the scope of this program.
However, reasonabis rationale can be applied to exclude many special emergencies from consideration. It should also be noted that combinations of special emergencies from different causes occurring simultaneously cre not being analyzed here. 1 The PRA Procedures Guide 2 lists four bases.for excluding - special emergencies from detailed analyses. These are: i 1) The event is of equal or lesser damage potential than the I events for which the plant has been designed. This requires an j evaluation of plant design bases in order to estimate resistance to a particular external event. 1 2) The event has a significantly lower mean frequency of occurrence than other events with similar uncertainties and could not result in worse consequences than those events.
- 3) The event cannot occur close enough to the plant to affect it. This is also a function of the magnitude of the event.
4: 3 The event is included in the definition of another event. For th6 purposes of TAP A-45, two additional arguments were l developed to exclude certain special emergencies from further j analysis.
- 5) The event does not directly affect the decay heat removal systems and, therefore, the proposed protection does not 1
involve modifications to the systems used for decay heat removal, l 1 i I 1 6. The event is slow in developing and there is sufficient time to go to cold shutdown, to eliminate the cource of the threat, or to prepare an acceptable alternative for the removal of decay haat. 3-1 s
.. ,~_-_n -,,-n , - . _ . --__------____,,--._-.,-----_--...-------,.--._.---n -
One event desecving further discussion is aircraft impact. Due to the solid construction of plant structures, only a large . aircraft would be capable of damaging decay heat comoval systems. Aircraft impact is a low probthility event. In addition, in the newet plants the sepa:asion (of cedundant trains) used to satisfy fire, flood and sabotage concerns also serves to ceduce the vulnerability to common mode failure due an aiceraft crash. In some older plants, redundant trains may not be as well separated, however, diverse systems (e.g. Ouxiliary feedwatec and high pressure injection) usually are sapacated so that it is unlikely that a single event would disable all decay heat comoval capability. Certainly, the addition of a dedicated decay heat comoval system (in sepacate buildings) to ceduce the core melt contcibution from thoce special emetgencies which are found to be important contributocs to cisk, would also ceduce the aicecaft vulnecability. The impact (com aieccatt crash debris is similac to tocnado missiles, the resulting fice from the crash would be cov(ced by the fire event, and any explosion would be similar to the explosion events. Therefore, aircraft decident analfses will not be pursued further. Applying the focogoing rationale to the other postulated special engigencies gives the following results: Applicable Event Rationale Renacks Avalanche 3 Can be excluded for most sites in the United States Biological Phenomena 6 Sufficient time to prevent damage Coastal Ecosion 4 Included in the effects of external flooding Dan Failuce 4 Included in the effects of external flooding Drought 1.6 Excluded under the assumption that thoce are multiple sources of ultimate heat sink oc that the ultimate heat sink is not affected by drought (e.g., cooling tower with adequately sized basin) Explosions 1 Tornado missiles, tornadoes, and high winds goveen 3-2
Applicable - Event Rationalt_ Remecks . External Flooding - Requires detailed study Extreme Winds and - Rwquires detailed study 3 Tornadoes Fire (internal) - Requires detailed study . Fog 1 Could, howevec, increase l the frequency of man-made hazard involving surface vehicles or aircraft Forest Fire 1 7 ice cannot propagate to , the site because the sits is cleared Frost / Freezing 1 Snow and ice govern Hail 1 Other missiles govern High Tide High Lake 4,6 Included undet external Level, or High River , flooding Stage High Summer Temperature 1 Ultimate heat sink is designed for at least 30 days of operation, taking into account, evaporation, drift, seepage, and other water-loss mechanisms Huccicane - Requires detailed study-partially' included under external flooding: wind forces can be covered under extreme winds and tornadoes Ice Covec 1,4 Ice bicekage of civer is partially included in flood Internal Missiles 4 Included under turbine-genecated missile Industrial or Military 5 Included undet explosions Facility Accident or toxic gas Internal Flooding - Requires detailed study 3-3
l l
~
Applicable Event Rationale Remarks . Landslide 3 Can be excluded for most sites in the United States Lightning Requires study l Low Lake oc Rivec 1 Ultimate heat sink is l Water Level designed for at least 30 days of operation, taking into account evapocation, dcift, seepage, and other water-loss mechanisms ) l Low Winter Temperatuce 1,6 Thecmal stresses and embrittlement are insig-l nificant or covered by i design codes and standards l for plant design; gen- l ecally, thece is adequate warning of icing on the l . ultimate heat sink so that comedial action can be taken Meteorite 2 All sites have approxi-mately the same frequency of occuccence Pipeline Accident 4,5 Inc1'udad undet explosions t (gas, etc.) and toxic gas Pipe Whip - Requicos detailed study Intense Precipitation 4 Included under external and internal flooding Release of Chemicals 4,5 Included undet explosions in Orsite Storage and toxic gas Rivec Diversion 1,4,6 Considered in the evalua-tion of the ultimate heat sink: should diversion become a hazard, adequate stocage is provided Sabotage - Requires detailed study Sandstorm 1,5 Included under tornadoes and winds Seiche 4 Included undet external flooding 3-4
Applicable Event Rationale Renacks . Seismic Activity - Requires detailed study ship Collision 2 A loss of the crib house would not immediately threaten the core . Snow 1,4, Snow melt causing river 5,6 flooding is included undet extecnal flooding Soil Shrink-Swell 1 Site-suitability evaluation Consolidation and site development for the plant are designed to preclude the effects of this hazard Stoca surge 4 Included under external flooding Tcanspottation 4,5 Included undec explosions Accidents and toxic gas Tsunami 4 Included undet extecnal flooding and seismic events Toxic Gas 5 Does not threaten DHR systems Turbine-Genecated - Requires detailed study Missile . Volcanic Activity 3 Can be excluded tot most sites in the United States Waves 4 Included under external flooding Therefore, this cather Cocmidable list of special emergenclos was caduced to the following: Extetnel Flooding Extreme Winds and Tocnadoes Fire (internal) Huccicane Internal Flooding Lightning Pipe Whip Sabotage Seismic Activity Turbine-Generated Missi..es The methods for analysis of pipe whip and turbine-genecated 3-5
t i missiles are beyond the resources of this program. These subjects are considered in the Safety Evaluation Reports (SERs), for individual plants and were considered again in the Standard Review plan evaluations. Therefore, they were not considered in the A-45 study. This left eight potential special emergencies , for further consideration. Each of these special emergencies is ! addressed separately in this section. l It should be recognized that the quantification of the special ; emergencies has large uncertainties in many cases. Because the state of the art is not very advanced in the analysis of many ; special emergencies, it was necessary to make assumptions in ' order to perform the'calcu'lations. These assumptions are i described in the summaries as well as in the appropriate analyses. As a result, an unquantified risk may comain for such ! special emergencies as fire, flood, and earthquake, j 3.1 Seismic Analysis Seismic events have a wide range of factors which affect their ! threat to nuclear power p.lants. The location of the earthquake, { the magnitude of the ground acceleration, the soil transfer of energy, the elevation of plant equipment, and the seismic equipment supports are only a few of the factors to be ' considered in an analysis of plant vulnerabilities. However, the fact that earthquakes in the United States have affected large portions of the country requires an analysis of the probability and uncertainties of a resulting core melt. Successful completion of this program required a simplified seismic cisk assessment methodology 3 which could be applied to particular plants being studied in a far shorter time than previous PRA studies. The procedures developed for the simplified seismic analysis are described below. More detailed descriptions of the seismic analyses are presented in Appendix C of the case studies. 3.1.1 Analysis Methods There are seven steps required for calculating the seismic risk at a nuclear power plant:
- 1) Determine the local earthquake hazard (Hazard Curve and Site Spectra).
- 2) Identify accident scenarios for the plant which lead to radioactive release (Initiating Events and Event Trees).
- 3) Detecmine failure modes for the plant safety and support systems (Fault Trees).
- 4) Determine fragilities (probabilistic failure criteria) for the important structures and components 3-6
( l t i
- 5) Determine the responses (accelerations or forces) of all structures and components (for each earthquake level). .
- 6) Compute the probability of core melt using the information from Steps 1 through 5.
- 7) Estimate uncertainty in the core melt probabilities.
Only the level of detail differentiates a. simplified seismic analysis from a detailed seismic PRA. The seven steps of the TAP A-45 simplified seismic cisk analysis procedure aret , Sten 1 - Seismic Hazard Characterization Sa) If a seismic hazard curve existed for the plant'(e.g., from the Systematic Evaluation Program (SEP) program or from an existing PRA of a nearby plant) it was used, b) If no such curve existed, a hazard curve scaled to an exceedance probability of 2.5E-4/yr at the safe shutdown earthquake (SSE) was used. The slope of the curve for higher peak ground acceleration (PGA) values was estimated from other hazard curves for the same broad seismological province. c) Analyses of plants west of the Rocky Mountains really requires site specific hazard curves due to the high levels of seismic activity, but most existing plants have hazard curves already available. Sten 2 - Initiatina Events and Event Trees The scope of TAP A-45 includes only the initiating events associated with small loss of coolant accident (LOCA) and transient events. Two types of transients were considered: those in which the power conversion system (PCS) is initially available (denoted Type T3 transients) and chose in which the PCS is failed as a direct consequence of the initiating event (denoted Type T; transients). The event trees derived for the internal event analyses for TAP A-45 were utilized. The small LOCA initiating event frequencies were being computed based on the statistical distribution of small pipe failures computed as part of the NRC-sponsored Seismic Safety Margins Research Program (SSMRP).4 The restriction to small LOCAs is not particularly limiting because existing PRAs have shown that large and medium LOCAs are not major contributors to total risk of core damage. The frequency of Type T2 transients is based on the probability of loss of offsite power (LOSP). This will be the dominant cause of transients (for the majority of plants LOSP causes loss of main feedwater). The Type T3 initiating event is computed from the condition that the sum of the initiating event probabilities considered must be unity. The hypothesis is 3-7
that, given an earthquake of reasonable size, at least one of the initiating events will occur. Step 3 - Fault Trees Systems fault trees for six plants were developed as pact of TAP A-45 (for candom failures only). These fault trees were used, although they required some modification to include basic events for seismic failure modes and re-solving the trees for pectinent cut sets to be included in the probabilistic calculations. Probabilistic culling was used in co-solving these trees to assure that important coccolated failuce modes were not lost. Steo 4 - Component and Structure Failute Desceiotions Component seismic fragilities were obtained both from a generic fragility data base and from plant specific fragilities derived for components identified during a plant walk-down. The genecie data base of fragility functions for seismically-induced failures was originally developed as part of the SSMRP. Fragility functions for the generic categories were developed based on a combination of experimental data, design analysis reports, and an extensive expect opinion survey. The experimental data utilized in developing fragility curves were obtained from the cesults of component manufactucec i a qualification tests, independent testing lab fallute data and data obtained from the extensive U.S. Corps of Engineers SAFEGUARD Sub-system Hardness Assurance Program. These data were then statistically combined with the expect opinion survey data to produce fcagility curves for the genetic component categories. Inasmuch as several years have passed since this data base was originally developed, the site-sp-scific fragilities developed for some 20 PRAs performed in the intecia were examined, and compaced against the original data base. This cesulted in modifications of median (cagility levels of 5 of the original 37 generic categories. For tipping and sliding of cabinets, and for dynamic analyses of tanks, graphical methods of analysis have been developed to greatly simplify the required fragility development. Within the time scale prescribed, structural fragility development was not possible, and could not be included for TAP : A-45. This was appropriate since it is the design cequirements foc decay heat removal systems which ace being evaluated, and not the structural design. However, the approach being described here should prove widely useful in examining other generic and value/ impact issues not directly concerned with adequacy of power plant structures. St6p 5 - Seismic Response of Structures and Components Building and component seismic cesponses were estimated from 3-8
peak ground accelerations at several probability intervals on the hazard curve. Three basic aspects of seismic response-- . best estimates, variability, and correlation--were estimated. i SSMRP Zion analysis results and simplified methods studies form the basis for assigning scaling, variability and correlation of responses. In each case, SHAKE code calculations were performed to assess the effect of the local soil column (if any) on the surface peak ground acceleration and soil-structure interactions. This permitted an appropriate evaluation of the effects of non-homogeneous underlying soil conditions which can strongly l affect the building responses, i Two situations are commonly encountered in developing ! structural responses. First, for many early plants, only design floor spectra acre available from the design reports. l For this situation, the results of a detailed soil-structure . interaction investigation made as part of the SSMRP may be used r to scale the computed design floor slab accelerations to be.ht estimate values including the effects of the soil; and to estimate best estimate floor response spectra. Second, one has the situation where fixed-base mass-spring or i eigen-system descriptions are available for one or more : buildings at the site. For this case, one can compute the ' floor slab accelerations using the CLA3SI code. This code 1 takes a fixed base eigen-system model of the structure and l input-specified frequency dependent or independent soil i impedances and computes the structural response (as well as i variation in structural response if desired). : Variability in responses (floor and spectral accelerations) was assigned based on the SSMRP results. The recommended uncer-tainties (expressed as standard deviations of the logarithms of , the responses, 8) are shown below: i Quantity 8 candos [ Peak Ground Acceleration 0.25
- Floor Zero Period Accoloration 0.35 i Floor Spectral Acceleration 0.45 !
Correlation between component failures was included explicitly in TAP A-45. In computing the correlation between component i failures (in order to quantify the cut-sets) it was necessary to consider correlations both in the responses and in the fragilities of each component. Inasmuch as there are no data i as yet which show correlation between fragilities, the l fragility correlations between like components are taken as , zero and 1, and the possible effect of such correlation ; quantified in a sensitivity study. The correlation between l responses was assigned according to a set of rules given in t Reference 3. These are applied to both BWR and PWR plants. l t 3-9 I
Step 6 - Probabilistic Failure and Core Melt Calculations Given the input from the five steps above, the SEISIM4 and SETS 5 codes were used to calculate the required output (probabilities of failure, core melt, etc.). Use of the SEISIM code for the final computation of accident sequences permits proper inclusion of seismically induced correlation between component failures. Failures identified in this step formed the basis of the seismic l vulnerabilities. Specific modifications were proposed to l eliminate or reduce those vulnerabilities which made a significant contribution to the core melt probability. S3ep 7 - Estimate Uncertainties Uncertainties in core damage estimates were based entirely on upper and lower confidence limits for the hazard curve. Generic recommendations for such limits are given in Reference 3. This simplification is appropriate since previous seismic PRAs have shown the hazard curve to contribute 70-90% of the total seismic risk uncertainty. ' 3.2 Fire Analysis Based on plant operating experience over the last 20 years, it has been observed that nuclear power plants will probably have three to four significant fires over their operating lifetimes (i.e., on the order of one fire every ten years for a frequency of .1 fice/Rx yr), reevious probabilistic risk assessments have shown that fires are a significant contributor to the overall core melt probability, contributing from 7% to 50% of the total core melt probability. Large strides have been made in the fire protection for nuclear power plants in recent years. In particular, 10 CFR 50, Appen-dix R and the associated Branch Technical Position 9.5-1 have led to improved fire protection measures at nuclear power plants. However, even with these improvements, there remains a residual risk from fires which has not yet been quantified with the exception of those plants that have performed fire-related PRAs. l i.2.1 Analysis Methods This analysis evaluated the casidual risk from fires that could affect decay heat removal systems. In doing so, existing pro-cedures used in published fire PRAs were employed, but t simplifying assumptions were made to allow the analysis to proceed without requiring the level of detail required for these other fire PRAs. Most of the simplifying assumptions are based on insights gained from the previous PRAs or from the historical fire data base. These issumptions are as follows: 3-10
a) only fires in a single area (room) are considered since only. single areas have been seen to be significant contributors. to core melt probability. Because no room to room issues were being considered, barriers between adjacent areas are assumed to remain intact during a fire, b) Fire frequency and suppression reliability was based on available industry data. The fire frequency used was the mean value of generic data collected from fire PRAs. Suppression system data was based on American Nuclear Insurers data and on the HTGR tire methodology PRA. c) Two transient combustible exposure fires were' assumed to bound all transient and electrically-initiated fires. A trash can size (30 gallons) container of refuse with an energy output of approximately 500KW for 15 minutes was one exposure fire used in the computer calculations. The other combustible was a 10 gallon spill of' acetone spread over a square area with sides of 2 meters. This fire resulted in an. intensity of 4.67MW tot approximately three minutes. Electrically-initiated fires were not being explicitly evaluated, but it is assumed that the exposure fires postulated for this analysis bound any transient or electrically-initiated fire that might occur at a plant. The worst case geometries were used in assessing fire growth and spread and the fire code'COMPBRN is used to determine if the cables or components of interest would be damaged by the fire. d) Transient event trees were used to determine the systems I components, from a success-oriented outlook, that had to be l considered. Transient event trees are used in this analysis
- since it was assumed that a fire occurs independently of any I initiating event and the operators will always insure that at least a transient will occur once they know that there is a fire (i.e. scram the reactor),
e) Components attected by a fire are electrical / active components in nature (e.g., cables, motors, switchgear, buses). Only temperature will be used to evaluate component vulnerability to a fire. Passive components, such as pipes and manual valves will be assumed to be unaffected by fire.
- 2) Randon failures of those systems not directly affected by the fire at a particular location were considered it applicable, g) offsite power was assumed to be available during a fire
} unless the fire was capable of causing a loss-of-ottsite power, h) Fire growth and spread and suppression of fires were treated as independent of each other. i) No explicit core melt timing was evaluated, f 3-11
j) Where exact locations of cables could not be accurately determined, assumptions as to their locations were made. . l The basic approach usad in determining the risk from a fire contains four basic steps: a) Initial screening for potentially important fire areas, i b) Plant visit for verification. 1 i c) Quantification of risk. d) Proposed fixes to reduce the fire risk in affected areas. l The initial screening determined which areas of the plant l contain enough front line or support systems in their l boundaries such that fire damage could invalidate all of the I success branches on the transient event trees. These transient l event trees identify the success criteria of the frontline systems or combinations of systems that prevent a core melt scenario. The internal systems analysis is also used as a - starting point for the fire analysis to identify the success criteria for such support systems as cooling systems and the AC/DC power requirements. Plant schematics and piping diagrams supplemented this information whera appropriate. Available l documentation then allowed screening of fire areas to determine I the small set of areas where a single fire could lead to a core l melt, i The plants were visited to see first hand what the physical arrangements are in each of the vital areas. The locations of major fuel sources and some estimate of the coordinates of components and cables were obtained. In the quantification step, the deterministic fire code COMPBRN was used to ascertain if an exposure fire could damage components / cables of interest in the area. An event tree is utilized to probabilistically estimate the risk of core melt from a fire in those areas not eliminated by the code calcula-tions. The basic elements of the event tree are as follows: a) Fire occurrence frequency for the area of interest, b) Suppression system probability (both for automatic and manual suppression), c) Operator error and random failure of unaffected systems from a remote shutdown location. Based on the quantification steps, engineering modifications were proposed for those areas which have a fire-induced core melt probability contribution of greater that 1.0E-6. For any proposed modification. a new core melt probability was 3-12
calculated by modifying the event tree to reflect the change. l This new core melt probability indicated the "value" of a - l modification in terms of core melt reduction. 3.3 in133 sal Flood Analysis Operating experience at nuclear power plants has shown that the > potential for damage to safety-related equipment as a result of internal flooding is of concern. Examples of '.nternal flooding initiators that have occurred include operators overfilling water tanks, in-leakage of ground water, hose and weld cuptures, , pump seal leaks, improper maintenance procedure, and various other circumstances. Several of these events resulted in damage to high pressure coolant injection systems, reactor l building spray pumps, service water pumps, emergency feedwater ' pumps, diesel generator control cabinets and other redundant
; and diverse safety-related components. Although to date, none of these floodings have led to a serious accident, there is ;
still a risk that needs to be evaluated to determine what the ' chances are that an internal flood, despite a conscious effort to design the plant to withstand this threat, could lead to a core melt scenario. This program specifically addressed these concerns including the vulnerability of the decay heat comoval systems to equipment damage due to spray from ruptured water piping. The sections that follow will represent the methodology and assumptions employed to carry out these analyses. ; 3.3.1 Analysis Methods The methods used to analyze internal flooding in TAP A-45 followed the existing procedures employed in published PRAs. However, since a full-scope PRA is beyond the resources of this program, a number of simplifying assumptions were made. Most of these assumptions are based on insights derived from ! previous PRAs or by consideration of the physical constraints ! of a flood in a building. The major assumptions are as follows: a) Internal flood frequencies, component damage thresholds, and physical room considerations are based on previous industry i wide data bases. The flood sizes have been grouped according ' i to the flow rate from a flood source and estimates have been made for the room drainage and equipment volume based on the Seabrook PRA assumptions. .
, 1 l b) Transient event trees were used to determine the l I
systems / components, from a success-oriented outlook, that need l I to b4 considered. Transient event trees were used in this i analysis since it was assumed that an internal flood occurs i independently of any initiating event and the operators will always insure that at least a transient will occur once they ! Know that there is a flood (i.e. scram the reactor). LOCA f event trees were not examined since pipe ruptures have already
- been considered in these trees.
i I h ! 3-13
c) Front line mitigation systems (such as high and low pressure injection) were not considered as flood sources. This. simplifying assumption was based on the fact that these front line systems, 1) have been designed to higher standards, 2) have controlled chemistry, 3) in general do not see large temperature gradients, and 4) have been involved in few catastcophic failures, d) Flood barriers maintain their structural integrity. e) Flooding via drains backing up into other areas are not considered. f) only single flood sources were analyzed. g) Components will fail from submergence in water to a critical point or from direct spray from the flood source. It was assumed that switchgear and buses will fail if they are standing in six inches of water or more. An electric motor is assumed to fail when the water level reaches the bottom of the motor casing, h) Random failuces of those systems not directly affected by the internal flood at a particular location were be considered if applicable. I i) Offsite power was assumed to be available during an internal flood unless the flood is capable of causing a loss of offsite power.
)) No explicit core melt timing was evaluated.
Th? approach used in determining the cisk due to internal clooding used the following four basic steps: a) Initial screening for potentially important internal flood levels, b) Plant visit for vecification. c) Quantification. d) Proposed changes to reduce the risk due to internal flood in affected areas. The initial screening involves using the transient event trees to identify the front line and support syctems needed to prevent core melt and their success criteria. Once the systems of intecost were identified. all available documentation was analyzed to determine those areas whece enough components could be disabled by an internal flood so as to cause core damage. 3-14
I i
- A plant visit was then conducted to see the physical
- arrangement of equipment, verify the accuracy of documentation . ,
j and obtain the plant location coordinates of vital components. j I l The step of quantifying the contribution to core melt began ! ! with examining whether a flood source could damage the l 4 components of interest and the time available for operator i
! mitigation of the event. With the flowcate, room volume, and j capacity for water removal known, the time to damage of I components may be calculated based on the water depth in the I room and the assumptions governing component damage j l thresholds, spray was considered when a flood initiated in a !
) room and the critical components were in a direct line of sight 1 with the flood source. An event tree was then constructed to ; j quantity the area flood damage scenario following the following l
- steps: i i
q a) Internal flood occurrence frequency for the area. l i l b) Probability of detection of the flood. ! I c) Isolation potential of the flood source, j l ' ! d) ope'eator error and random failures of unattected systems, f 1 i j Based on the quantification steps, engineering modifications [ 4 were proposed for these areas which have an internal-flood- , j induced core melt probability contribution of greater than !
- 1.0E-6. For any proposed , modification, a new core melt l probability is then calculated (by modifying the event trees to l
- reflect the changes) to indicate how much the cote melt l probability could be reduced.
f 3.4 External Flood Analysis l 3 Sources of potential flooding external to a plant are numerous j i for most plant sites because nearly all plants are located near - ! large bodies of water. River bank overflow, snow melting, ; j heavy precipitation, storm seiches, upstream das failure, and [
] wave runup are examples of potentially large flood water [
i sources. Flood waters can cause damage or failure to i components located in the plant yard as well as damage to l equipment inside buildings which may be penetrated by the
} water. In addition, the buildings themselves may not be .
I designed to withstand the hydrostatic forces of flood waters, resulting in catastrophic structural failures. l However, unlike other natural hazards such as earthquakes and extreme winds, external flood hazards may not represent a i hazard because of topographic or other physical conditions l which preclude site flooding, or reduce the frequency of ) occurrence. This is due in part to the fact that the design basis floods for newer nuclear plants are generally [ i ! 3-15 ,i b
conservative. However, since the uncertainty in design floods was not considered, the likelihood of extreme floods and theic . contribution to plant is not known. 3.4.1 Analysis Methods It was beyond the scope of the TAP A-45 program to perfoca an in-depth probabilistic cisk assessment. Instead, the objective was to conduct an analysis that quantified the significant threats to a plant. However, the proceduce used to pectorm this flood analysis embodies the basic philosophy of a full scope probabilistic risk assessment. To evaluate the probability of plant damage due to external flood events, the following tasks were pectormed: 1) plant famil'ia:ization, 2) hazard analysis, 3) fragility / vulnerability evaluation, 4) systems analysis, and 5) risk quantification. Figure 3.1 shows the celationship of these elements. The steps in the analysis are summarized below: E133? Famillacitation - This task gathered infocmation on the occuccence of external floods hazards at a plant and on the vulnerability of the plant structures and equipment to flooding. Regional studies pectocned by the Acay Corps of Engineers vece combined with plant site studies to evaluate the flood frequency. In assessing the reliability of shutdown decay heat comoval systems, a review of available documentation (i.e., FSAR, plant drawings and topical reports) and a walkdown i of the plant was perfoceed. Safety related components were visually inspected to verify locations and to analyze foc possible flooding via all possible pathways. Hazard Analysis - For external flooding, the hazard analysis was conducted in two steps. First, a screening of the potential sources of flooding (i.e., upstream dams, local precipitation, stoca surge, etc.) in the vicinity of the plant was conducted. For sources of flooding that can impact the plant site, an analysis was conducted to evaluate the frequency e of occuccence of increasing levels of flood intensity (i.e., depth of inundation, hydrodynamic forces, etc.). An uncertainty analysis was also performed to assess the modeling oc engineering uncertainty in estimating the frequency of occuccence. ConDonent Fracility Evaluation - yet structures and equipment items vulnerable to flood hazards the traction of failuce defined as a function of a flood hazard parameter (i.e., depth of inundation) or fragility curve, was assessed. This was done by 1) identifying the flood protection devices. 2) estimating the depth of submergence necessary to fail a component. 3) detecnining moder of flooding a room, and 4) transforming local fragility values or critical depth estimates to a global flood 3-16
l Merard Analysis
- F
*3 M
a3 20 . Ilarard latensity nest e tsricati Plant Familiarizatlea x b g,,, gg,y g m m
.E 3
Pg I.b b e9 e neview avellable K e w plant documenta-
~
~
,i 2*E t
~
i d4 tion ~ gB-E e Plant welb Event Trees Notard latensit'y Frogmency l Faelt Trees l < , Plant Systems Analysis c - r
.e _2 1
e l L' O' l d Nazard latensity . I Camponent fragility / - vulnerability Evaluation Figure 3.1 Risk Analysis Floor Cleart l [ l
I 1 l l hazard characterization. The modeling uncertainty in the evaluation was also considered. , 1 Systems Analysis - The decay heat removal systems analysis was ! perfoceed by developing event teces and fault trees with an i external flooding event as the initiator. The system cuccers I criteria were examined for common mode failure due to flooding which could lead to a core melt scenacio. The component fragilities are used as input to evaluato the conditional fraction of failure of different safety systems as defined by the systems logic model. l Risk Quantification - The quantification of the likelihood of ' plant damage was accomplished by properly weighting the conditional fraction of plant damage (i.e., fragility) over the entire range of flood intensities, by their frequency of occuccence. The probability distribution for the likelihood of plant damage was evaluated by propagating the uncertainty in the frequency of flood hazards and fragility. 3.5 Extcome Wind Analysis A wind hazards anal sis was performed for all the plants covered in Task Act on Plan A-45. Botn straight winds of excessive speed and tornado winds with their associated I pressure differentials pose potential challenges to specific plant components, in addition, high winds can generate missiles with sufficient impact to penetrate doors, louvers, and metal buildings and severely damage water stocage tanks, diesel generators, pumps, and othet safety related systems. These combine 1 and potentially simultaneous threats of high wind focce and wind generated missiles are discussed briefly in this cection. 3.5.1 Analysis Methods To evaluate the pcobability of plant damage due to external wind events, the following tasks were pectormed: 1) plant familiarization, 2) tocnado and straight wind hatard analysis,
- 3) tornado missile and wind pressure fragility analyses.
- 4) systems analysis, and 5) cisk quantification. Figure 3.1 shows the intercelationships of these elements.
Plant Fagiliarization - This task gathered information celated to the occuccence of external wind hazards at a plant and the vulnerability of plant structures and equipment to wind effects. In assessing the reliability of decay heat removal systems, a review of available documentation (i.e. FSAR, plant drawings and topical reports) and a walkdown of the plant was pectormed. Potential missile population at the site, missile pathways, tank locations, equipment exposure, and building design were all visually evaluated for use in later analyses. Previous studies of structural design capacities and regional 3-18
high wind frequencies were obtained as well as emergency operating procedures. , Manand namivais - Mean wind hasard curves for tornadoes and strasght wsads were developed by the Meteorology and Ettluent Treatment tranch of the 44WRC for use in the TAP A-45 program. The purpose of the hasard analysis was to develop the uncertainty in the hasard curves. Independent tornado hasard analyses were conducted which include consideration of the uncertainty in the tornado plant strike model, site sise, tornado analysis data, tornado damage area and length variation, and Fujita F-scale intensity / wind speed conversion. The resulting curves were scaled so that the resulting mean tesquencies of exceedance equal the UsNac values. An analysis of straight winds was conducted to develop the uncertainty in a similar manner as was done for tornados. Uncertainty in the wind speed data bases, applicability of recording station to the site, and terrain roughness ditterences were considered. Tornaoo Massale and Wind Pressure Fracility knalyses - A tornato mussale analysis was performed to develop the conditional probability distribution of missile impact on exposed equipment and on structures containing equipment which could fait due to missile penetration or by secondary impact tron spalled concrete. The analysis considered the occurrence frequency of tornados, number of avai'lable tornado missiles, target exposure, and target area. Results of past tornado missile impact studies which were based on detailed missile simulations of mass, terminal velocity, def ormation I characteristics, and angle of impact were used. For structures and equipment vulnerable to wind pressure hazards, the cumulative traction of failure defined as a function of the windspeed, called a tragility curve, was assossed. Due to uncertainty, multiple tragility curves were determined for each component. systems Analysis - The decay heat removal syster.s analysis was performed by utt11 ing the event trees and fault trees developed in the internal analysis to identity the systems needed to prevent core melt. An event tree was then developed in which wind generated tailures were an initiating event with a simultaneous loss of ottsite power due to the severity of the storm. The component tragilities and missile impact factors were used to evaluate the conditional probability of failure of ditterent safety systems. Risk Ouantification - The likelihood of plant damage was assessed by properly weighting the conditional traction of plant damage (i.e., fragility) over the entire range of wind intensities by the frequency of occurrence of wind hazards. Recovery actions for each sequence were given credit for where appropriate and, by propagating the uncertainty in the 3-19
troquency of wind hazards and tragility, the probability distribution of the likelihood of plant damage was evaluated. . 3.4 Liahtnina analysis Each year at nuclear power plants lighting strikes occur which result in reactor trips, loss of otteite power, and equipment failures. The unconsonly high frequency of this special emergency requires an analysis of the consequences and potential contributions to core melt probability. This section presents an overview of the methodology for evaluating the vulnerability of a power plant to lightning strike. 3.4.1 Analysis Methods The evaluation of plant vulnerability to lightning strikes and subsequent determination of potential contribution to core melt probability utilised the following stepet
- a. calculation of the lightning frequency at the site,
- b. calculation of the percentage of "damaging" strikes,
- c. evalua' tion of plant lightning protection.
- d. evaluation of critical components, j
- e. evaluation of core acit probability contribution.
The calculation of lightning frequency wa's determined partial',y by the number of thunderstora-days each year for a region and then by the number of cloud-to-ground strikes for a particular site latitude. The number of thunderstora-days per year was taken from a figure provided by the U.S. Meteorological Service. Several correlations exist to calculate the number of cinud-to-ground strikes for various regions of the United States. For this study the relationships used are: Ground Flash Location Density (ke-2yg-1)
~
Northern U.S. 0.11T Southern U.S. 0.17T where T is the number of thunderstorm-days for the locality of interest. To confits this correlation and to obtain the range of possible values, a second correlation developed by Pierce was used as follows: cloud-to-ground Clash density (0.1+0.35 sin latitude) x (0.4010.20)T ka-2yr-1 3-20
The percentage of these ground strikes which can dumago a plant ace highly plant specific and dependent upon the adequacy of . lightning protection systems. NRC cecommendations suggest that plants be designed to withstand a strike of up to 200 kilo-amperes (kA). Since it is beyond the scope of this program to verify the successful operation of these devices, it was assumed that existing plant lighting protection is adequately designed and maintained. Studies indicate that between one out of one hundred and one out of every thousand ground strikes exceeds 200 kA in current. In this program, the probability of a lightning strike being powerful enough to exceed the protective features was estimated to be .01. That is, one strike out of every hundred will have a current greater than 200kA and may cause damage to the plant. The evaluation of plant protection included a literature , review, a site visual confirmation, and discussions with plant ! personnel. The literature review was limited to studies performed by the plant or information provided in the Final Safety Analysis Report which describe the lightning protection and ground grid system. A site visit was then conducted where the air terminals, earth shield wires and ring conductors are visually confirmed. Additional discussions were held with plant personnel to fill any informational gaps concerning the ground grid system or past lightning occurrences. The evaluation of critical components was performed using the internal analysis of transient initiated events. This appcoach allowed the analyst to identify the success critecid of front line and support systems needed to assure decay heat removal following a reactor trip, loss of offsite power, or other transient which could be caused by a lightning strike. If multiple systems, or multiple trains of a single system, are available for decay heat comoval, their sources of water, electric power, instrumentation and control, etc., must be investigated for common mode failures. Again, use of the internal analysis fault tree methodology allowed a straight forward appcoach to this analysis. This results in a concentrated list of front line systems and necessary support systems which will prevent core melt if protected against either simultaneous lightning initiated failures, or a lightning strike in conjunction with any number of random system failures. The calculation of the probability of failure of decay heat removal systems following a lightning strike was the final step in quantifying the contribution to core melt. Given the frequency of lightning striking the site with a cuccent greater than 200kA, estimates must be made concerning the probability of striking a critical system. If only a single system must be hit to lead to core melt, the assumed probability of such a critical hit, given all of the available targets on the plant site, was very conservatavely assumed to be one in ten (0,1). 3-21
However, if a second independent train ir available for success-ful operation, then the probability of either a second lightning strike or a andom system failure must be multiplied by the initiating system failure probability. Multiple systems would likewise require multiple lightning strikes or multiple random failures according to the following equation: Core Melt Probability = T ((Ef)(A)(Pg3)(Ph!"t] (NR)+ l I (R)(T)((Ey)(A)(PkA)(Phit))n-1 g (NR)+. . .+ (Ry)(R2 ) . . . (R -2)(Rn-1)T g N )(3)gpkA)(Phit))(NR) where T = humber of thunderstorm-days per year for the ; region ' l Ng = Numcor of lightning strikes per km2-year l A = Area of the plant site in km2 PkA = Probability that the lightning current exceeds the design bevis Phit = Probability that lightning hits a critical component NR = Probability of nonrecovery (0.1) n . Number of independent, redundant trains available to prevent core melt Rn
- Probabil!ty of random failure of the nth train 3.7 Sabotace Analysis Prior studies have suggested that unauthorized activities by insiders (i.e., plant personnel) can be a major source of vulnerabilities.o.7.8 Such acts may include deliberate valve misalignment, improper set point adjustments, physical damage to small diameter cooling lines (e.g., oil and bearing cooling on safety pumps and diesel generators), improper installation of bearings or couplings and so on. Many such acts, in and of themselves do not cause core melt or a significant radiological telease, but given an initiating event such as a loss of offsite power, the failure of these safety components can lead to an increase in public risk. It should be noted that in these investigations the use. of explosives by insiders was not considered. This war based upen the carlier studies 10 which 3-22
suggsst that there is such a variety of ways an insider can dip,5ble equipment that explosives are not really required. - $ Also, it is presumed that current security measures will prevent the introduction of commercial explosives into the plant. For purposes of this program, direct overt acts on the part of ' an outside group are not considered. The evaluation of site security is outside the scope of these investigations. It is presumed here that those plants which meet the requirements of , 10 CFR 73.559 are capable of adequately dealing with the
. exteinal threat. Further, the emphasis on these insider ,
I activities is directed toward the potential system vulnerabili- ' ties and what can be done to reduce or eliminate them. The analysis takes note of existing administrative and security policy and procedures as appropriate, including their potential influence upon insider activities, but it does not examine in detail the effects of changes in such procedures. t A common characteristic of the USI A-45 analyses, shared with i other PRAs performed to date, is the identification of support system failures as significant contributors to the probability of core melt. It is often observed that at the support system level there is insufficient redundancy, considerable sharing of systems, a lack of separation and independence between trains, 4 and poor overall general arrangement of equipment from a safety and safeguards viewpoint. However, existing regulations do not require systematic review and approval of the general arrangement of plant equipment from an integrated safety viewpoint. In the course of these studies it was observed that some plants have redundant trains of safety, or safety support, equipment > co-located in a single area. This is undesirable from a safety i standpoint. Such arrangements create significant vulnerabili-ties in single events such as fire, flood, or insider sabotage in that multiple trains can be disabled leading to an inability - i to cool the plant. Because of the potential sensitivity of detailed discussions of such vulnerabilities, they are not summarized here but are discussed separately in Reference 10. That repert is issued separately under appropriate SAFEGUARDS controls. i 3.8 Assumptions and Bases for the Analyses i A number of external events (special emergencies) were excluded i because they were beyond the scope and depth of our analysis to examine carefully or because of one of the following reasons. ! a. The event is of equal or lesser damage potential than the l event for which the plant has been designed. i l b. The event has a significantly lower mean frequency of l occurrence than other events with similar uncertainties. ! 3-23 . E __ ._ ___ ___ _. _ _
- c. The event cannot occur close enough to the plant to affec't ~
it.
- d. The event is included in the definition of another event.
- e. The event does not directly affect the decay heat removal system,
- f. The event is slow in developing and there is sufficient time to go to cold shutdown.
This left six events described above for further consideration. The corresponding assumptions and/or conditions for the analyses are given below. Sabotage is not discussed here. Seismic
- 1. Seismic hazard curves were taken from other studies and not developed specifically for this program.
- 2. It was assumed that loss of DC fails turbine driven emergency (auxiliary) feedwater pumps.
- 3. Generic component fragility data was used augmented as required by plant specific estimates. -
Fire
- 1. Only fires in a single room were considered.
- 2. Fire frequency and suppression reliability was based on available industry data.
- 3. Two transient combustible exposure firer, were assumed to bound all transient and alectrically initiated fires.
- 4. It is assumed that a fire occurs independently of any other initiating event and the operators will always scram the reactor once they know there is a fire.
- 5. Passive components will be assumed to be unaffected by a fire.
- 6. Offsite power is assumed to be available during the fire unless the fire is capable of causing a LOSP.
- 7. Fire Growth, spread, and suppression were treated independently.
- 8. !!o core melt timing was considered in the analysis.
- 9. When exact locations of cables could not be accurately determdined, their locations were assumed.
3-24
- 10. Credit was given in the calculations for radiant energy shields, conduit, solid bottom cable trays, and completely' enclosed cable trays.
Internal Flood
- 1. Internal flood frequencies, component damage thresholds, and physical room considerations were based on previous industry wide data bases.
- 2. It is assumed that an internal flood occurs independently of any other initiating event and the operators will always scram the reactor once they know flooding is occurring.
- 3. Flood barriers always maintain their structural integrity.
- 4. Flooding via drains backing up into other areas was not considered.
- 5. Only single flood sources were analyzed.
- 6. Components fail from submergence in water to a critical level or from direct spray from the flood source. It is assumed that switchgear and buses will fail if they are standing in six inches or more of water. An electric motor is assumed to fail when the water level reaches the bottom of the motor casing.
- 7. Offsite power is assumed to be available during the internal flood when the flood is capable of causing an LOSP.
- 8. No core melt timing was considered in the analysis.
External Flood
- 1. It is assumed that loss of offsite power will occur during an external flood event.
- 2. Flooding due to rain or snow melt would be slow developing and thus not present any threat.
- 3. Equipment failure is assumed given submergence.
Extreme Wind
- 1. Equipment prot oc ced by concrete structures at least 12 inches thick are adequately protected against tornado missiles.
- 2. All openings were either protected by barrier walls, tornado missile barriers, or if less than 100 square feet were considered too small to be vulnerable due to a low mean frequency of impact.
3-25 L
r- 3
- 3. Loss of offsite power is assumed in extreme winds that could damage the plant.
- 4. Recovery of the diesel generator is possible, given bent exhaust stacks, by cutting the stacks to allow air intake.
Lichtnina
- 1. Lightning protection equipment was not specifically evaluated as to proper installation or maintenance.
- 2. It is assumed offsite power fails with a likelihood of 0.5 when lightning strikes the plant.
- 3. A generic ground flash density for either the southern or northern U.S. was used in the analysis as applicable.
- 4. It was assumed from the literature review, site inspectio'n, and discussions with plant personnel that the plant was designed according to NRC recommendations to be able to withstand a lightning strike of 200 kA.
- 5. The plant sites were assumed to be 1/4 square kilometer in area.
l l l l i l 3-26
i l 4.0 INTERNAL EVENTS MALYSIS RESULTS 4.1 Introduction The internal events analysis provides a basis for many of the special emergency analyses which use the fault trees and event trees. In addition, these core melt probability results may be compared more or less directly with other PRAs. Therefore, it is appropriate to prasent these results in some detail. In this section the bat's case dominant accident sequences from the internal analysis are presented and plant to plant similarities or differences are discussed. In those instances where specific cut sets of the sequences are particularly important, they are identified. The decay heat removal vulnerabilities that were identified are Summarized. The PWR results are covered first followed by those for the BWRs. 4.2 Pressurized Water Reactors Applying the analysis methodology discussed in Section 2 generally led to the initial identification of tens (50 to 70) accident sequences for the PWRs. However, many of these , sequences have negligible contribution to the probability of core melt; individual sequence probabilities are less than 10-8 per reactor year, therefore they are not carried through the analysis. In addition, after the individual sequences and cut sets are examined and operator recovery actions applied, requantification of the sequences increases the number whose individual contribution is less than 10-8 The result is a list of accident sequences called dominant accident sequences which contribute more than 90-95% of the core melt probability. For the PWRs atudied, there were usually 10 to 20 dominant accidant sequences, and generally only three to five of these are major contributors. The dominant accident sequences, cut se'.s and vulnerabilities for the four plants studied are presented below. 4.2.1 Example Plant A - Point Beachll This plant was analysed with credit taken for bleed and feed and secondary blowdown procedures. Sensitivity studies on the effects of feed and bleed are discussed in Section 11. Initially 64 accident sequences were identified for this plant. However, after the negligible contributors werc eliminated, recovery applied and the sequences requantified, this number was reduced to 12 sequences that are important con-tributors to the probability of core melt. These twelve sequences are shown on Table 4.1. In addition to these twelve sequences, there is a significant contribution from long term station blackout (LTSB) due to battery and/or condensate storage tank depletion which is also included in Table 4.1. A complete listing of sequence event definitions is presented in Appendix C, but for convenience those which appear in the dominant sequences are defined in Table 4.2. 4-1
Table 4.1 Point Beach Internal Event Core Melt Sequences - Dominant Probability Accident After Secuences Recovery S2 MH1'H2 ' 4.7z-5 T3 9H1'H2 ' 2.5E-5 S 2MD D12 .7E-6 T IMLE 6.7E-6 T 3QD D12 4.5E-6 T2MQH1'H2 ' 3.5E-6 T 5MLE 9.lE-7 T 2MLE 6,65-7 T 2MQD D12 6.6E-? T 4MLE 6.2E-7 S2MXD1 5.7E-7 T 2MLH1 2.0E-8 LTSB 3.56E-5 Total 1.34E-4 i i 4-2 , I
' Table 4,,2 Accident Sequence Event Definitions - PWR Initiatina Events S2 Small LOCA <2 Inch Diameter
- Ti Loss of Offsite Power Transient T2 Loss of power Conversion System Transient T3 Transients with Main Feedwater Initially Available T4 Transients Induced by Loss of AC Bus T5 Transients Induced by Loss of DC Bus System Events M Failure of Main Feedwater Q Failure of SRVs or PORVs to Reclose Given
. That They Were Opened L Failure of Auxiliary Peedwater System E Failure of Feed and Bleed Mode D- 1 Failure of high Pressure Injection System D2 Failure of Low Pressure Injection System
.H1' Failure of High Pressure Recirculation System Without RHR Heat Exchanger H' 2 Failure of Low Pressure Recirculation System Without RHR Heat Exchangers Hi Failure of High Pressure Recirculation 2
System With RHR Heat Exchangers , X Failure of Depressurization with Secondary Blowdown
" For ANO-1 S2 is a small LOCA of 1.2" to 1.66" diameter and S3 is a small LOCA of 0.38" to 1.2" diameter.
4-3
The twelve dominant sequences and LTSB account for 96% of the internal event core melt probability estimated for this plant - and over three-quarters of that comes from the three sequences, S2MH 1 'H2', T3QH1'H2'e S2MD Dt 2 and the LTSB. Although sequences are present with failure of auxiliary feedwater, they do not dominate because of the credit given for an ability to fecd and bleed. When each of the sequences is examined in br: ail, a number of system cut sets are identified which often appear in more than one sequence. These cuts sets, which in fact define the decay heat removal vulnerabilities, are shown on Table 4.3 along with their contribution to core melt probability and a description of the vulnerability. - Based upon this-analysis, it is clear that one of the major contributors to vulnerabililty is common mode failures in safety related pumps. Unfortunately, in the modified 8-factor method used, the actual nature of the failurcs remains undefined, therefore, it is not possible to specify remedies. For other key vulnerabilities, i.e., failure to switchover, failure in recirculation, failure of auxiliary feedwater and long term station blackout, it is possible to make recommenda-tions for modifications which will reduce or eliminate the vulnerabilities (see Section 6). 4.2.2 Example Plant B - Turkey Point 12 Turkey Point was analyzed initially without credit for feed and bleed and secondary blowdown. However, after several reviews the analysis was redone to incorporate feed and bleed in the base case. Again, the sensitivity of the estimate of core melt probability to the absence or presence of feed and bleed is discussed in Section 11. For this plant the initial 64 sequences are reduced to 11 dominant sequences and the long term station blackout (LTSB) after eliminating the negligible contributors, applying recovery. taking account of procedure availability and requantifying. These 11 sequences are shown in Table 4.4 and the sequence events are defined in Table 4.2. The 11 dominant sequencos and LTSB account for 99% of the internal event core melt probability estimated for this plant, with two-thirds of that coming from the sequences S MH'H', S MD D , and LTSB, a situation very similah tb khat TQH{H',adon id P13nt A.12 Here again, although there are sequences in which failures of auxiliary feedwater are present, they do not dominate. Also, when each of the sequences is examined in detail, a number of cut sets can be identified which appear repeatedly. These cut sets and the associated vulnerabilities are presented in Table 4.5. 4-4
Table 4.3 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated - . Vulnerability for Point Beach Cut Set Contribution to p(cm) When Included in Sequences
- 1. SUMP-VCC-OE 3.13E-5 Vuln: Failure to switchover from injection to recirculation.
- 2. GTF* BAT-CM 4.89E-6 GTF*LF-BATTA-DO5*LF-BATTB-DO6 Vuln: Station blackout due to battery failure (early).
- 3. GTF*DESGENA-GEN-LF/TM*DESGENB-GEN-LP/TM 5.49E-7 AFWTP3-PTD-LF GTF*DG-CM*AFWT3-PTD-LF/UTM Vuln: Station blackout due to diesel generator failures.
- 4. CCWXV30-XOC-UTM/LP 1.50E-5 - .
Vuln: Failure of ECC Recirculation due to loss of RHR pump cooling caused by a valve failure.
- 5. CCWHXA-HTX-PB and Assoc Valves 1.04E-6 Vuln: Failure of ECC Injection due to CCWS failure caused by loss of cooling from the SWS through the CCW heat exchanger.
- 6. AFWSP-CM 2.42E-5 CCWMP-PMD-CM LPIMP-PMD-CM SWSP-CM HPIMP-PMD-CM Vuln: Common mode f ailure of saf ety system pumps
- 7. HPRMV-SUMP-CM 1.25E-5 Vuln: Common mode failure of safety system valves.
- 8. (LPIMP1-PMD-LF/TM + HPRMV4-VCC-LP + 2.24E-5 HPRMV36-VCC-LF) * (LPIMP2-PMD-LP/TM +
HPRMVS-VCC-LP + HPRMV38-VCC-LP) Vuln: Failure of the LPIS in recirculation mode. 4-G
Table 4.3 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated - Vulnerability for Point Beach (Continued) Cut Set Contribution to p(cm) When Included in Secuences
- 9. AFWTP3-PTD-LF/UTM*0ther Singles 1.04E-5 Vuln: Failure of the AFWS turbine driven pump
- 10. CCWMPA-PMD-LF*CCWMPB-PMD-LP 1.83F-6 CCWMPA-PMD-LP*CCWMPB-PMD-UTM Vuln: Failure of the CCW pumps.
- 11. DG-CM 3.56E-5 DESGENA-GEN-LP*DESGENB-GEN-LP DESGENA-GEN-LF*DESGENB-GEN-TM DESGENA-GEN-TM*DESGENB-GEN-LF DESGENA/B-GEN-LF*SWSMPX-PMD-LF DESGENA/B-GEN-LF*SWSMPX-PMD-TM DESGENA/B-GEN-TM*SWSMPX-PMD-LP .
DESGENA/B-GEN-TM Vuln: Long term station blackout caused by depletion of the station batteries or the condensate storage ta'tk. NOTE: Description of these component failure modes may be found in Appendix B. A I l 4-6
Table 4.4 Turkey Point Internal Event Core Melt; Sequences - Dominant Probability Accident After Sequences Recovery S 2 MH 1'H 2' 1 9E-5 T 3 0H 1'H 2' 1.5E-5 , SgMD12
- 1.4E-5 -
T 3 QD 1 ; 8.7E-6 T 5MLE 6.6E-6 T2MQH1'H2 ' 2.0E-6 T IMLE 1.7E-6 T 2MQD12 1.2E-6 S2MXD1 8.3E-7 T 2MLE 6.1E-7 T 3QXD1 6.0E-7 LTSB 7.5E-7 Total 7.10E-5
- In this nomenclature, D12 is equivalent to D , i D, 2 etc.
i \l 1 4-7
l Table 4.5 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated - Vulnerability for Turkey Point Cut Set Contribution to p(cm)
- When Included in Sequences
- 1. LPIMP-CM 7.4E-6 Vuln: Common mode failure of the low pressure injection pumps.
- 2. LPIMPlA-PMD-LF/UTM*
LPIMB-PMD-LF/UTM 4.7E-6 (In various combinations) Vuln: Local fault of one safety injection pump and unavailabililty of the other due.to test or maintenance.
- 3. HPIMV27/28-VOC-UTM
- HPIMPl.0/1C-FMD-LF 4.0E-6 (In various combinations)
Vuln: Local fault of one high pressure injection pump with test , or maintenance unavailability of an HPI motor operated valve
- 4. SISACT-A-LP 3.9E-6 Vuln: Local fault of safety injection signal actuation train A.
- 5. AFWTPB-PTD-UTM 5.2E-6 Vuln: Unavailability of AFW pump B due to test or maintenance following a failure of DC bus 3 Dol. ,
- 6. LPIMPlA-PMD-LF*LPIMPlB-PMD-LP 2.8E-6 Vuln: Local faults of both low pressure injection pumps.
- 7. AFWTPB-PTD-LP 3.0E-6 Vuln: Local fault of AFW pump B following a failure of DC bus
- 3D01 as initiating event.
- 8. CCMDP-CM 1.1E-6 Vuln: Common mode failure of the component cooling water pumps.
- 9. SWSMP-CM 1.lE-6 j Vuln: Common mode failure of the service water pumpn. ;
i 4-8
Table 4.5 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated - Vulnerability for Turkey Point (Continued) Cut Set Contribution to p(ca) When Included in Secuences
- 10. SWNV2201-NOO-LF 1.lE-6 Vuln: Service water diversion due to failure of isolation valve CV-2201.
- 11. DG-CM DGA-LF
- DGB-LF DGA-LF
- DGB-UTM DGA-UTM
- DGB-LP 7.5E-7 Vuln: Long term station blackout.
l l l l l l ' 4-9
As was noted under the discussion of the Point Beach results, it is not possible to identify specific common mode f ailures in-the modified B-factor analysis used here, so no component specific modifications are defined to counter these failures. In general the other internal vulnerabilities are of such a nature, and their contribution to p(cm) so small, that specific modifications were not proposed. 4.2.3 Example Plant C - St. Luciel3 The St. Lucie plant was analyzed taking credit for a feed and bleed capability based upon the availability of appropriate procedures. As with the other plants there are initially 64 accident sequences identified. After the elimination of those sequences which are negligible contributors, application of appropriate operator recovery actions, and requantification 12 dominant accident sequences remain. Because of the batteries ir. stalled at St. Lucie and the availability of feedwater, the long term station blackout contribution which appeared in the two previous analyses does not occur in this analysis. The dominant accident sequences are listed in Table 4.6 and the events are as defined in Table 4.2. The 12 dominant accident sequences account for 98% of the inter-nal event core melt probability and the bulk of that (>85%) comes from the 4 sequences T MLE, S MD D T QD D , and S MH'H' Although credit is givhn for 3 the3,and ble$d capab$liky2 . one sequence which involves loss of main and auxiliary feedwater after a loss of offsite power transient contributes approxi-mately 50% of the core melt probability. However, because this plant appears to have a reasonably balanced design, this contribution is less than 10-5 As with the earlier studies, examination of the cut sets associated with these accident sequences identifies some recurring events which are in fact che decay heat removal vulnerabilities. These cut sets and their contribution to the core melt probability are defined in Table 4.7. As noted above, no specific modifications for countering common mode failure are readily available. The other internc1 vulnerabilities are individually su Jh minor contributors to p(cm) that no modifications were proposed. 4.2.4 Example Plant D - ANO-1 14 The Arkansas Nuclear One, Unit 1 was analyzed taking credit for a feed and bleed capability based upon the availability of appropriate procedures. In this analysis there were initially , 60 accident sequences identified. After the elimination of : those sequences which are negligible contributors, application of appropriate operator recovery actions and requantification 14 dominant accident sequences remain. As with St. Lucie, the design of the plant and the installed capabilities are such i 4-10 i l
Table 4.6 St. Lucie Internal Event Core Melt Accident Sequences - Dominant Probability Accident After Sequences Recovery T IMLE 7.9E-6 S2ND DI2 1.9E-6 T 3QD D12 1.2E-6 S2 MH 1'H 2' 1.lE-6
.T3 0H1 'H 2' 8.3E-7 i
T IMQLD1 2.9E-7 T IMQD D12 . 1.9E-7 T 2MLE 1.9E-7 T 2MQD Dl2 1.7E-7 T 4MLE 1.7E-7 T2MQH1 'H2' l.2E-7 ; T SMLE 4.1E-8 Total 1.418-5 l l l ) i 1 .i i ! 4-11
l l Table 4.7 Cut Sets Contributing Significantly to the l Probability of Core Melt and the Associated ' Vulnerability for St. Lucie Cut Set Contribution to p(cm) When Included in Secuences
- 1. BATTERY-CM 2.9E-6 Vuln: Common mode failure of the batteries.
- 2. bCW-PUMP-CM 1.4E-6 Vuln: Common mode failure of the component cooling water pumps.
- 3. SIS 072B-VCC-LF* SIS 072A-VCC-LP 8.5E-7 Vuln: Local fault failures of the containment sump recirculation motor operated valves.
- 4. DIESEL-CM*AFW1C-PTS-LF 8.2E-7 Vuln: Common mode failure of the diesel generators combined with local failure of the turbine driven AFW pump.
- 5. DGN1-GEN-LF*DGN2-GEN-LF*
AFW1C-PTS-LP 8.0E-7 Vuln: Local failures of the two diesel generators combined with local failure of the turbine driven AFW pump.'
- 6. DGN1-GEN-LE* BAT 125-B-LF 4.5E-7 vuln: Local fault of diesel generator 1A combined with local failure of DC battery 1B,
- 7. ICW-PUMP-CM 3.5E-7 Vuln: Common mode failure of the intake cooling water pumps.
- 8. DGN1-GEN-LF* BAT 125-B-ZBT-UTM 2.7E-7 Vuln: Local fault of diesel generator 1A with test or main-tenance unavailability of the 125V battery 1B.
! 9. SISLOG-UTM-CM 1.5E-7 Vuln: Common mode failure of the safety injection system logic due to test or maintenance errors.
- 10. RASLOG-UTM-CM 7.0E-8 Vuln: Common mode failure of the recirculation actuation signal logic due to test or maintenance errors.
4-12
l 1 l 1 I that long term station blackout is not a factor at this plant. l The dominant sequences are listed in Table 4.8 and the events - l are as defined in Table 4.2. The 14 dominant accident sequences account for 95% of the inter-nal event core melt probability and the majority of that (>66%) comes fromcredit Although the three hassequences been givenS MH'H', f$r de$d T MLE akdand T QH{H'.dhe s$quence bleed, involving a loss of offsite power initiator followed by a loss of main and auxiliary feedwater still contributes 25% of the estimated core melt probability. The small break LOCA followed by a loss of main feedwater and the failure of high pressure injection and recirculation contributes slightly more to the probability of core melt. However, this plant, due in part to modifications based upon earlier risk assessments has an internal core melt probability less than 10-4 As before. - examination of the cut sets associated with the dominant accident sequences identifies a number of recurring events which are, in fact, the decay heat removal vulnerabilities. These cut sets and their contribution to the core melt probability are defined in Table 4.9. 4.2.5 Comparison of Dominant Accident Sequences - PWR
. Tables 4.10 lists the dominant accident sequences which occurred at two or more of the PWR plants. Table 4.11 shows the fractional contribution of each sequence to the internal p(cm). It may be noted that eight sequences appear in the dominant set for all four plants. However, their r31ative contribution varies significantly from plant to plant. For example, sequence T t MLE contributes more than 50% at Plant C and more than 25% at Plant D but less than 10% at plants A and B. On the other hand the small break sequence S is the largest contributor at three of the four plants 363)MH'H'in tRe fourth it is one of the top five sequences. This commonality of dominant sequences appears to suggest some strong similari-ties between plants even though three NSSS vendors and three utilities are involved. Closer examination of the individual case studies indicates, however, that there are some signifi-cant differences. For example, in sequence S MH'Hj at Plant A, 31% of the sequence probability comes from fallude of LPI motor driven pumps and valves in the recirculation mode and 16% comes from component cooling water valve failures. At Plant B, 40%
of the sequence probability arises from LPI motor driven pump failures and unavailabilities due to test and maintenance. At Plant C more than 40% of the sequence probability comes from SIS valve failures. Finally, in Plant D, 40% of the sequence probability arises from common mode failures in HPIS, LPRS, and SWS valves. Thus, although the same sequence appears in the analyses for all four plants, the root causes vary from plant to plant. On the other hand, in sequence T iMLB, there are more similarities, although some differences still exist. For example, at Plant A. 73% of the sequence probability is l i 4-13
Table 4.8 ANO-1 Internal Event Core Melt Sequences Dominant Probability Accident After Sequences Recovery S 3 MH 12 H ' 2.24E-5 T iMLE 2.13E-5 l T3QH12H ' 1.21E-5 S3MED2 6.60E-6 T 30D D12 4.57E-6 T 4MLE 4.08E-6 T SMLE 2.46E-6 T 2MLE 2.38E-6 S 3MXE 2.33E-6 T 2MQH H1 2' l.71E-6 T 3MLE 1.13E-6 T IMQLD1 7.84E-7 ,
, T 3MQH H1 2' 7.32E-7 T 2MQD D12 6.66E-7 Total 8.32N-5 l
I , i i l 4-14
Table 4.9 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated Vulnerability for ANO-1 Cut Set Contribution to p(cm) When Included in Secuences
- 1. EFNOP7AX-PTD-LF*0ther Singles and Doubles 6.77E-6 Vuln: Failure of emergency feedwater turbine driven pump along with other single and double failures.
- 2. HPISV-CM LPRSV-CM HPSV-CM SWSV-40-41-CM SWSV-02-03-CM 2.01E-5 Vuln: Common mode failure of valves in various safety systems.
- 3. LPSP-CM SWSP-CM HPSP-CM -
2.56E-6 Vuln: Common mode failure of safety system pumps.
- 4. DG-CM*EFWOP7AX-PTD-LP DG1-GEN-LF*DG2-GEN-LF*
EFWOP7AX-PTD-LP . DGl-GEN-LP or DG2-GEN-LP
- EFWOP7AX-PTD-LF*
Other Single Failures 5.25E-6 Vuln: Diesel generator failures with failure of the emergency feedwater turbine driven pump.
- 5. BATT-CM BATT-CM* LOSS-OSP BATTD07-ZBT-LP*BATTDO6-ZBT-LP 1.56E-5 Vuln: Battery local faults and common mode failures.
- 6. LPIOP34A-PMD-LP*LPIOP34B-PMD-LP LPIOP34A-PMD-LP or LPIOP34B-PMD-LP* Other Singles 1.063-5 Vuln: Failure of low pressure injection pumps.
- 7. FNB MANACT FNB-MANACT*Variouc singles & doubles HPRS-MANACT*Various Singles 5.11E-6 Vuln: Failure to manually initiate feed and bleed or high pressure recirculation, i I
4-15 ' i
Table 4.9 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated Vulnerability for ANO-1 (Continued) Cut Set Contribution to p(cm) When Included in Seouences
- 8. LPIBWIX-XOC-LF LPIl407A-VCC-LF or LPIl408B-VCC-LF*
Various Singles 5.92E-6 Vuln: Failure of single manual discharge valve from the BWST or the BNST valve leading to the safety system train. I' 9 Q e l I e i , l i .l 4-16 4
Table 4.10 Dominant Accident Sequences for TAP A-45 PWRs - Number of Occurrences for Each Sequence - (Credit Given for Feed and Bleed) Number of Sequence Occurrences T yMLE 4 S2MH{Hj 3* T30H{Hj 4 T 3QD),D2 4 T MLE 4 5 T MLE 4 2 T2MQH{Hj 4 T 2MQDy2 D 4
$ 2 MD y2D 3 T MLE 3 4
T 3MLE 3 T 2MLH g 2 T gMQD12 D 2 LTSB 2
- Essentially 4 since for Plant D, S MH'H' does not appear but sequence S M {Hj does and it is a ig i icant contr butor.
3 4-17
l Table 4.11 Sumnary of Dominant Sequences for PWRs (Credit given for feed and bleed) Showing Fractional Contribution to Internal P(cm) Fract. Fract. Fract. Fract. Plant A Contel. Plant B Contr1. Plant C Contri. Plant D Contel. 3MH{Hj 0.35 3MH{Hj 0.27 T gMLE 0.56 S3 M{Hj 0.27 2 T3 @{Hj 0.19 TQH{Hj 0.21 S D 0.14 Tg EE 0.26 3 2 12 S ND D 0.064 T3QD D 2 0.12 SMH{Hj 0.078 S MED 0.079 2 2 2 3 T MLE 0.049 T "' 0'0' TQH{Hj 0.059 T3QD12D *' 3 5 3 7 EE <0.01 3 0.15 5 2 ""1 D 2
- 3QD g2D . 85 TQH{Hj 3
T MLE <<0.01 TMQH{Hj 0.03 T gMQLD g 0.020 T MLE 0.049 2 2 4 T MLE 4
<<0.01 Tg EE 0.02 TMDD g g2
- E 0.029 5
T3QDg2D
- 2 D
12 2
- 0.029 2
TMQH{Hj 2 0.026 S MID g 0.01 T 2MQDg2D 0.012 S ME 0.028 2 3 T MLH g 2 nog T MLE 2
-0.010 T MLE 4
0.012 TMQH{Hj 0.020 2 T 2MQD Dg 2 <<0.01 T3QE g ~0.01 E 0.014 T"S"k"h 2 3 S MXD <<0.01 T 8 ~0.011 Tg SD g 2 1 5
~ .026 T3%H{H2 LTSB 0.21 LTSB 0.01 T 2MQDg n
~ ~
p(cm)D5 * * * ~ 4-18
related to battery failures (common-mode and local faults) combined with a failure of the gas turbine. At Plant B, 82% of-the sequence probability is related to battery commou mode failures. At Plant C, 44% of the sequence probability is related to battery failures and combinations of battery failures and diesel generator failures. For Plant D, 69% of the sequence probability is related to battery failures. Therefore, although the relative contribution of this sequence to p(cm) varies from plant to plant, the root cause, battery failures, is relatively common for the four plants. In summary, there is significant commonality in the dominant cutsets across the four PWR plants in that the eight sequences which are "common" contribute anywhere from 57 to 82% of the internal p(cm), but their relative contributions vary considerably. Furthermore, the root failures can change significantly from plant to plant. 4.3 Boilina Water Reactors Applying the same analysis methodology as was used in the PWRs, and as discussed in Section 2 above, led to the initial identification of tens (20 to 40) accident sequences for the BWas. However, here too, many of the possible sequences have a negligible contribution to the probability of core melt; they . have individual probabilities less than 10-8 per reactor year, and so they were not carried in the analysis. After the individual sequences and cut sets are examined and operator recovery actions applied the number of sequences with probabilities below 10-8 was increased. When these were eliminated the remaining seqbences, the dominant accident sequences (>90-95% of p(cm)), number 16 to 20 for the two units studied. These dominant sequences are presented and discussed in the following sections. 4.3.1 Example Plant E - Quad Citiesl5 This plant was analyzed using the techniques described earlier and credit was given in the recovery actions for containment venting to prevent rupture in the long term sequences (on the order of 24 hours). Early time venting to prevent core melt was not taken into account in these studies. The dominant accident sequences (> 98% of p(cm)) for Plant E are shown on Tabla 4.12 and the sequence events are defined in Table 4.13. The major contributing cut sets and associated vulnerabilities are listed on Table 4.14. 4.3.2 Example Plant F - Cooper 16 This plant was analyzed using the techniques described earlier ! and credit was given in the recovery actions for containment venting to prevent rupture in the long term sequences (on the order of 24 hours). Early time venting to prevent core melt ! 4-19
Table 4.12 Quad Cities Internal Event Core Melt Sequences - Dominant Probability Accident After Sequences Recovery T-AC-YZE 3.7E-5 T1D 2.7E-5 T1YZE 2.3E-5 T2YZ 3.4E-6 T-AC-D 2.4E-6 T2YZE 1.3E-6 T1YZ l.lE-6 T3YZE 1.1E-6. T3D 1.0E-6 T3YZ 4.1E-7 T1PD 2.2E-7 T2D 2.0E-7 i T1PYZE 1.9E-7 .l
- T-DC-D 1.6E-7 SZ 1.3E-7 T-DC-YZ 1.1E-7 1
l 9.85E-5 - l l l 4-20
Table 4.13 Accident Sequence Event Definitions - BWR Initiatina Events S Small LOCA T1- Loss of Offsite Power Transient T2 Loss of Feedwater Transient T3 Transients with Feedwater Initially Available T-AC Transient Induced by Loss of AC Bus T-DC Transient Induced by Loss of DC Bus System Events D Immediate Failure of All Emergency Core Cooling E Long Tara Failure of All Emergency Core ! Cooling -l P Relief Valve Sticks Open ! Y Loss of Main Condenser Z Failure of All Suppression Pool Cooling l i t l j i 1
- 4-21 I
Table 4.14 Cut Sets Contributing Significantly to the Probability of Core Melt and the Associated - Vulnerability for Quad Cities Cut-Set Contribution to p(cm) When Included in Secuences
- 1. DIESEL-CM DGN1-2-GEN-LF*DGN1-GEN-LF DGN1-2-GEN-LF*DGN1-GEN-LF*
Various Singles 5.51E-5 . Vuln: Local Faults of Two Diesel Generators.
- 2. BATTERY-CM 3.20E-5 Vuln: Failure of Diesel Generator Field Flashing
- 3. DSW3903S-FMS-LF*Various Singles DSW39031-PMS-LF*Various Singles DSW-PUMP-CM 1.98E-5 Vuln: Diesel Generator Cooling Water System Faults
- 4. BAT 125-1-ZBT-LF*Various Singles BAT 125-1-ZBT-UTM*Various Singles 125BISl-125-LF*Various Singles TB1251A-125-LF*Various Singles 2.37E-6 Vuln: Failure of 125 VDC Circuit Breaker Control Power.
4-22
was not tasen into account in these studies. The dominant sequences (> 98% p(cm)) for Plant F are shown on Table 4.15 and-the requence events are defined in Table 4.13. The major contributing cut sets and vulnerabilities are listed on Table 4.16. 4.3.3 Comparison of Dominant Accident Sequences - BWR on Table 4.17 the dominant accident sequences for the two BMHs studied are shown along with the fractional contribution to core melt from each sequence. There is not as much variation between these two plants as there van for the PWRs which is to be expected since they are both BWRs with Mark I containments although the reactor itself is of a different model. It may be noted that the same sequences appear at both plants studied, although at Plant F four additional sequences are noted. How-ever, none of these added sequences are major contributors to the probability of core melt. Seven of the top ten sequences are common to both plants but their relative contributions vary somewhat. At Plant E about 68% of the estimeted core melt probability is contributed by three sequencec T1YZE,T1D, and T-AC-YZE. At Flant F these same three sequences contribute only about 60%, with the sequence T2YZE in this instance being the' other major contributor. Nevertheless, in both instances the sequence T-AC-YZE, a loss of AC bus transient followed by loss of the main condenser, loss of suppression pool cooling, and long-term failure of emergency cool cooling, is the most significant contributor. In fact, its relative contribution at the two plants is quite similar. At both plants the dominant cut sets in this sequence are those involving unavailability of cooling water due to test and maintenance or local faults of cooling system valves. Similar commonality of failures is noted in sequence T1D, where the dominant cut sets in both instances involves battery common mode failures. For both of the BWRs failure of emergency power, both AC and DC, is a significant contributor to the probability of core melt. 4-23
Table 4.15 Cooper Internal Event Core Melt Sequences Dominant Pzobability Accident After Sequences Recovery T-AC-YZE 9.5E-5 T2YZE 7.9E-5 TlYZ4 4.6E-5 T1D 2.9E-5 T-DC-YZE 2.2E-5 T2YZ 2.6E-6 T-AC-YZ l.7E-6 SZE 1.5E-6 T1YZ 1.4E-6 T-DC-D 9.8E-7 T3D 8.6E-7 T2PYZE 6.4E-7 T3YZE 6.3E-7 T3YZ 5.0E-7 T1PYZE 3.75-7 T1PD 2.42-7 T-AC-D 2.3E-7 T2D 1.8E-7 SZ 1.5E-7 T-DC-YZ 1.2E-7 2.83E-4 4-24
Table 4.16 Cut Seta Contributing Significantly to the Probability of Core Melt and the Associated - Vulnerability for Cooper Cut-Set Contribution to p(ca) When Included in Secuences
- 1. DIES 3L-CM DGN1-GEN-LF=DGN2-GEN-LF DGN1-GEN-LF*Various Singles DGN2-GEN-LF*Various Singles 8.29E-S -
Vuln: Local Fanits of Two Diesel Generators ,
- 2. BATTERY
- CM DGN2-GEN-LF
- BAT 125-3-2PT-LF ;
DGN2-GEN-LP
- BAT 125-1 - T t*?M 3.18E-S Vuln: Loss o$ 125 VDC 1 ver Division
- 3. RBC714-VCC-LP* LOSS AC BUS RBC714 VCC-LF*RBC711-VCC-LP RBC-LOOP 2-UTM* LOSS AC BUS 8.1E-5 Vuln: Reactor Building Closed Cooling Water Valve Faults
- 4. RBC700-VOO-LF* LOSS AC/DC BUS RBC700-VOO-LF*Various Singles 9.4E-5 Vuln: Reactor Building Closed Cooling Water Flow Diversion.
S. SWS653-VCC-LF'SWS652-VCC-LF l SWC653-VCC-LF*Various Singles SMS6F2-VCC-LF*Various Singles SWS117-VOO-LF*Various Singles 2.5E-6 ! Vuln: Reactor Building Service Water Flow Diversion. i l { 4-25 l
Table 4.17 Summary of Dominant Sequences for BWRs (Credit Given for Late Time Venting) - Showing Fractional Contribution to Internal p(cm) Fractional Fractional Plant E Contribution Plant F Contribution T-AC-YZE 0.375 T-AC-YZE 0.335 TID 0.274 T2YZE 0.279 l TlYZE 0.234 TlYZE 0.162 T2YZ 0.035 TlD 0.102 T-AC-D 0.024 T-DC-YZE 0.078 T2YZE 0.013 T2YZ 0.009 l T1YZ 0.011 T-AC-YZ 0.006 T3YZE 0.011 SZE 0.005 l l T3D 0.010 TlYZ 0.005 l T3YZ } T-DC-D TlPD T3D , T2D { T3PYZE TlPYZE 0.013 T3YZE
) .
T-DC-D T3YZ r SZ TlPYZE 0.047 T-DC-YZ / T1PD ! r T-AC-D ! T3D sZ ! T-DC-YC i 4-26 i
5.0 SPECIAL EMERGENCY EVENTS ANALYSaS RESULTS 5.1 Introduction Although special emergency events, notably seismic and fire, have received attention in other PRAs, the analysis in this program provides a broader integrated approach. As noted in Section 3, the areas receiving attention in this program included seismic, fire, internal and external flooding, extreme winds, lightning, and sabotage. The analysis results are summarized here on a plant by plant basic according to reactor types. 5.2 Pressurized Water ReactoI1 The four reactors considered provide a range of siting condi-tions although the higher seismic activity zone of the far west is not included at this time, climatic variations are included in the north, central and southeastern locations of the sites. As will be noted, only one plant revealed any significant sens-itivity to internal flooding under the constraints of the analyses, and only one plant showed potentially significant contributions from extreme wind. initiated events. 5.2.1 Example Plant A - Point Beachll Seismic. An earthquake may initiate a core melt scenario by causing one of the following plant states: a small loss of coolant accident (S2), a transient in which the power conversion is initially available (T 3), and those transients
; in which the power conversion system has failsd as a direct consequence of the initiating event (T 2). The frequency of l Type T2 transients is based on the probability of loss of offsite power since this will always be the dominant cause of these transients. While the probability of a small LOCA or a j loss of offsite power increases as the earthquake lovel
- increases, the probability of a Type T3 transient will decrease accordingly.
The safe shutdown earthquake for Point Beach has an acceleration of 0.12 g, however TAP A-45 is examining the vulnerability of decay heat removal systems to initiating i events which are beyond the design basis. Therefore, probabilities of seismically induced core melt were calculated for eartnquakes in the rangew of 1-2 SSE, 2-3 SSE, 3-4 SSE, and 4-5 SSE. For the Point Beach site, the frequency of earthquakes of these magnitudes are estimated to be:ll SSE Level Precuency/vr 1-2 1.57E-3 2-3 1.34E-4 3-4 1,49E-5
- 4-5 3.18E-6 5-1
Since all of the plant systems feel the effects of an earthquake, the quantification of core melt scenarios involves calculating component fragilities for the various earthquake i levels and using these values in the fault trees developed in the internal event analyses. Table 5.1 summarizes the probability of each of the seismically induced sequences summed across the earthquake levelc. The total core melt probability is calculated to be approximately 6.lE-5/r-yr. At Point Beach the major contribution to core melt comes in the three to five SSE range. This is because Point Beach has , an SSE of only 0.12, which is roughly half of the design basis acceleration of most plants. Therefore, the range of 0.36 g to 0.6 g is consistent with the ground accelerations where most components of this type are expected to fail. The vulnerability to seismic events is doninated by: (1) a small LOCA followed by failure of HPI and LPI after auxiliary feedwater (AFW) succeeds, and (2) a transient with a loss of offsite power followed by failure of AFW and feed and bleed. The most important failure in the loss of HPI and LPI is ti.s failure of the RWST. The AFW dominant failure is the loss of batteries after/with the loss of otraits power. Failure of the i CST along with failure of the RWST is also important. Elte. Using the transient event trees, the following systems and success criteria were identified ao crucial to preventing core damage at Point Beach: 1 a) Power Conversion System: 1 out of 2 trains l b) Auxiliary Feedwater System: 1 out of 2 motor driven pumps or , 1 out of 1 turbine driven pump c) Safety Injection System: 1 out of 2 trains d) Residual Heat R9moval 1 out of 2 RHR pumps in series with SI pumps and 1 out ot 2 RHR heat exchangers The support systems required for these frontline systems are: a) Service Water: 1 SW pump per unit (6 pumps total) b) Component Cooling Water: 1 of 2 pumps c) AC/DC Power Because the success criteria usually only require 1 train or pump from each cystem, in order to invalidate the criteria locations must be found in the plant where all trains of a system can be damaged by fire. This means that, in general, 5-2
i Table 5.1 Sequence Core' Melt Probabilities Summed l over All Earthquake Magnitudes - ' l Base Case - Point Beach Probability of Core Melt Sequence (ner r-year) S2 H{Hj 6.2E-9 S2gD Nj 9.8E-8 SDD 2g2 1.6E-5 5DX 2y 8.6E-7 S2LH y 4.3E-9 S2LP g 2.8E-8 S LD y 7.7E-6 2 T 2 LE 2.5E-5 T LP 9.0E-7 2 T 3MLE 9.oE-6 l T MLP 1.0E-7 3 6.lE-5 I 4 I i l l 5-3
) i for this analysis only those locations where all trains of'the [ above systems can be damaged are important. ! Reference 11 includes a review of each plant area to determine t the potential for core melt following a fire. This analysis ! pointed to the auxiliacy feedwatec pump coon and the 4160 V { i switchgear room as potential areas of concern. 1 i i The generic auxiliary building fire frequency used in this > analysis is 4.8E-2/c-yr. To obtain the frequency of fire in i the AFW pump room, the building fire frequency was multiplied ! by the ratio of AFW coon in situ fuel load to the building fuel i
! load (.0495). This produced an AFW pump room fire frequency of l
2.376E-3/r-yt. ; i ! l Using the COMPBRN fire code to analyze the AFW pump coon, it j was determined that an acetone spill is expected to damage the cedundant service water system cables in 25 minutes and, thocefore, manual suppression must occur befott then. The . j probability of failure of manual suppression in 25 minutes is ! estimated to be 0.2, and the probability of failure of the : I automatic Halon suppcession system is 0.2. An uncontrolled i
- fice in the auxiliacy feedwater pump roos at Point Beach could eventually cause the loss of all service water pumps, the two motor driven auxiliary feedwater pumps, all safety injection l l pumps, all component cooling water pumps, and ultimately all t i RHR pumpc as well as the power conversion system. The only remaining system to prevent cote melt would be the one tutbine f
, driven AFW pump for each unit. The failuce probability of '
!' plant personnel to manually
- operate the turbine driven pump is :
estimated to be 0.1, while randon failure of this system to operate is estimated to be 3.48E-2. These calculated l l probabilities produce a core melt probability for this scenario l , of 1.25E-5/r-yr. l , The second area of concern is the 4160 V switchgear toon. For f i this analysis the generic frequency of fire in the auxiliary : ) building (4.8E-2/r-yr) is multiplied by the ratio of fuel load ) j in this area (0.1034) resulting in an area fire frequency of ; i 4.95E-3/r-yc. The area contains two independent automatic l I ' Halon suppression systems each of which has a failure probability of 0.2. Manual suppcession is needed within one l hour and the probability of failure of this suppression is l estimated to be 0.1. Given fire damage is this area, the j j turbine dciven AFW pump is assumed to be unavailable to prevent ; , core melt. This results in a core msit probability of , j 2.00E-5/r-yc. 4 Thus, the total core melt probability due to fice is estimated to be 3.3E-5 per c-yr. l l Internal Flood. The Point Beach transient event trees were l l used to identify the DHR system combinations which are needed l l I' l 5-4 i lo . _ __ _ _ _ .. _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ __ _.
c to prevent core damage. The results and success conditions are l the same as those described above for fire. . The areas which contain no systems important to decay heat i removal were eliminated from further analysis. For the ; comaining areas this study examined the flood sources available i for tilling the room of concern with watec. Tanks wete ! examined for volume and probable flow paths along operings, , stairwells, gratings where water could travel from loom to ; room. It was found that no components were located under i openings where cascading water from a tank cupturt could damage ! the equipment. It was also ascertained that the switchgeac ; coon, auxiliary feedwater pump room and control r1om and cable j spreading rooms were physically in a separate building than the ! safety injection, component cooling water and RHR pumps. i Because of this physical separation, it was difficult for flood i waters from a tank rupture to originate in one building and i also be able to affect the other set of components in the other i building. The RHR pump room could be flooded; however, the PCS ! and auxiliary feedwater systems would still be available. I Therefore, tank failures do not appear to be a flooding threat ! at Point Beach, i The circulating water, service water, and fire main headecs I were then examined for flooding along flow paths into actas of I concern to this analysis. Although components could certainly , be damaged by rupture of any of these systems, it was detec- l mined that all postulated breaks were isolable and the diverse I systems were physically separated sufficiently to preclude a core melt scenacio, f
+
The final portion of this study focused on the damageability of [ equipment due to spray from a water source. The service water f pumphouse was identified as the only plant location where spray could damage enough redundant equipment to produce a core melt , scenario. The initiating event for such a sequence begins with i a cupture of the fire main header which spcays water on the six L service water pumps as well as the electric driven fire pump and the diesel driven fire pump. Since the fire pumps are a backup system for the service water, this scenario would cause loss of primary and secondary cooling sources. The frequency of an initiating flood in the service water pump ! area is estimated to be 2.2E-2/r-yr.ll The probability that l the pumps will fail due to high pressure spray impingement is { estimated to be 1 in 10. The loss of the service water pumps is important because it leads to loss of the PCS system (lube oil cooling), component cooling water system, and eventual loss of the safety injection pumps, kHR pumps, and the two motoe [ driven auxiliary feedwater pumps. This leaves the plant with only the turbino driven auxiliary feedwater pump which has a random failure probability estimated to be 3.4E-2/demsnd. This sequence then has a probability of occurrence of (2.2E-2 , 5-5
rupture /r-yr)(.1 chance of pump failure)(3.4E-2 probability of random failure of the AFW turbine driven pump) = 7.66-5/r-yr. External Flood. Two principal sources of flooding exist near the plant; runoff due to local precipitation and/or snow melt, and rising lake levels combined with wind wave effects and runup. Experience at the plant and in the surrounding area suggests that due to the less pervious nature of the clay content of local soils and frozen ground conditions in the spring ponding can occur in local depressions. Experience at the plant indicates that some leakage into plant structures due to runoff does. occur. Safety-related equipment important to removal of decay heat at Point Beach is located in the Pumphouse and the Turbine and Auxiliary Buildings. The service water pumps are located in the Pumphouse, while all other safety-related components are in the Turbine and Auxiliary Buildings. A number of these items are located on the ground floor (Elev. +8.0 feet). These include the diesel generators, batteries, 4160 V switchgear, auxiliary feedwater pumps, safety injection pumps, and the containment spray pumps. The RHR pumps and heat exchangers are at elevation -19.0 feet. . As part of plant operations, emergency procedures have been established in the event of high lake water level. These procedures are designed to respond to wave runup that could occur near the Pumphouse and/or Turbine Building. The principal action called for is sandbagging doorways that are susceptible to leakage and are located at or near critical areas. These include exterior access doors to the Turbine Building and the Pumphouse and interior doors to vital equipment areas in the Turbine Building. The assumption is made that a simultaneous loss of offsite power will occur during an external flood event. This is because of the large storms and high winds that are required to cause water runup to the plant. Core melt would require failure of both the emergency coolant injection system and the secondary cooling system. The water level req' aired to flood the Service Water Pumphouse. Turbine Building, and Auxiliary Buildings is estimated to be 590' International Groat Lakes Datum (IGLD). This is due to the fact that all buildings would be sandbagged to 589' and could be sandbagged higher if necessary. In addition, the slow initiation and long lead times vould allcw additional measures to be taken. l If no sandbagging above 589' were performed, it could be conserv-atively assumed that flood levels that crest one foot higher than the initial sandbags could be sufficient to supply water that which could penetrate all subsequent doors and reach a room depth that could fail the diesel generators, batteries 4160 V switch-gear, auxiliary feedwater pumps, containment spray pumps, safety 5-6
injection pumps, residual heat comoval pumps, and service water pumps. The mean frequency of occurrence of a lake level of 590' is estimated to be on the order of 10-15 /yr. This frequency is considered negligible. However, it was also assumed that a lower lake level combined with large wave eunup could impound water between the Service Watec Pumphouse and the ' Turbine Building. If the stoca drains wuce cloqqed with debcis, it was calculated that waves would have to runup to 596' in order to impound water two feet high on the site. Again, it was assumed that the water must be two feet high in order to top the one foot high sandbags with enough water to L fisod all coons'to a depth which would fail the safety equipment. The frequency with which the lake level would reach a high level from which excessive wave cunup would be present to flood the buildings is calculated to be 1.9E-8/yr. As noted earlier, a flood of this magnitude would have long lead times in which additional flood protection measures could be taken. However, given the extent of simultaneous equipment damage, the frequency of a flood of this magnitude is assumed ! to casult in core melt. Therefore, the conditional probability of coce melt as a result of flooding is equal to one, and the frequency of a flood of sufficient magnitude to exceed the flood pcotection (590' ast) is calculated to be 4E-15 + 1.9E-8 = 1.9E-8/c-yr. Extcene Winds. In general, most safety-related equipment is contained within and protected by concrete stcuctures which are at least 18 inches thick. It was assumed in the development of the list of vulnecable structures and equipment that concrete walls and roof slabs greater than 12 inches thick provide adequate protection against tornado missiles. Hence, openings in the structures , for doors and exhaust stacks were found to be vulnerable areas for tornado missiles. The roof of the Pumphouse is only 5 > inches thick, thus, it also was analyzed. Possible paths thcough the metal siding of the Tucbine Building and ; Containment Facade were also consideced. ' Only the condensate storage tank, refueling water storage tank and diesel generator exhaust stacks were found to be vulnerable to wind pressuces at Point Beach. However, the analysis suggests that the CST and RWST won't fail until the wind speeds reach approximately 350 mph. Straight winds will not coach these speeds, and tornade winds of this magnitude occur with frequencies of about 7E-8. It was estimated that the diesel generatoc exhaust stacks could collapse at wind speeds of 160 mph or greatec. Straignt winds of this speed have a frequency of 1.0E-5 while 160 mph tornado winds have a frequency of 5.0E-5/yc. Collapse of these exhaust stacks would fail the diesel generators (DG), Since the 5-7
initiating event was assumed to be wind damage with simultaneous loss of offsite power, loss of the diesel generators would result in less of all AC electric power. Core melt would not occur until the batteries depleted (four hours) or within 30 minutes if the remaining DC powered turbine driven auxiliary feedwater pump faileu (3.48E-2/ demand). The probability of nonrecovery of offsite power within 30 minutes is 0.8 and the probability of nonrecovery within 4 hours is 0.38. If the turbine driven AFW pump operates, the diesel generators may still be recovered by cutting off the collapsed stack. This recovery is given a probability of 0.1. Therefore, the calculated core melt probability is: (Frequency of 160 mph winds) (Probability of DG failure) (Probability of loss of offsite power) x ((Probability of failure of turbine driven AFW pump) (Probability of nonrecovery of offsite power in 30 minutes) + (Probability of nonrecovery of offsite power in 4 hours)(Probability of nonrecovery of diesel generator exhaust stacks)] . (6.0E-5)(1)(1) x ((3.48E-2)(.8) + (.38)(.1)) = 3.95E-6/c-yr. 1 Lichtninc. Using the U.S. Meteorological Services citart of thunderstorm days in the United States for Point Beach,ll it is estimated that the site would expect approximately 38 thunderstorm days each year (T). The correlations for ground flashes (Ng) for the northern U.S. derived by Horn and Ramsey is Ng=0.11(T). This correlation predicts 4.18 ground flashes km-2yr-1 for this northern U.S. site. It is assumed that the plant was designed according to NRC recommendations that the plant be able to withstand a lightning strike of 200 kA. The probability of exceedance of this cuttent is taken to be 0.01 as seen in Reference 11. Therefore, the probability of lightning strikes in the Point Beach region which will exceed the design basis is estimated to . be (4.2)x(0.01) = .042/km2yr. To simplify calculati'ons, the ! Point Beach site will be conservatively estimated to be 1/4 i square kilometer in size. t The transient event trees developed for Point Beach in this program show that either the auxiliary feedwater system or the bleed and feed. node will successfully remove decay heat following a transient. The auxiliary feedwater system consists of multiple trains such that the probability of candom failure 2 of all trains is exceedingly small and a single lightning strike cannot fail all of the independent trains. Likewise, the high pressues injection system has multiple trains which are very unlikely to independently fail. However, electric power is l needed for the starting and running of pumps, operation of
- valves, and instrumentation and control. Therefore, the limit-ing core melt scenario would require loss of both DC electric power trains to cause damage to both units. Both units would be damaged because they share the two DC power trains.
5-8
Each'DC bus can receive power from offsite power, the gas turbine generatoc, the associated diesel generator, oc the , battecies dedicated to that train, however, the diesel generator requires the DC battecies in order to statt. The scenacio where both'DC power trains fail due to candom oc common mode failures is part of the internal analysis. Here < the postulated transient involves either two lightning strikes
' hitting the two DC buses, oc a single lightning strike hitting one DC bus while the other DC power train candomly fails.
These sequence probabilities are calculated as follows: CoreMeltProbability-T((Ey)(A)(PkA)(Phit)) (NR) + T((Ey)(A)(pkA)(Phit)) ( R)(Ry) where T = 38 thunderstorm days /yr l Ng = (4.2 ground flashes /km2y r)(1/4 km2) = 1.05 flashes /yr
; A = 0.25 km2
- PkA = 0.01 i
Phit = 0.1 NR = 0.1 The calculation for random failure of a single DC train of power, R 1 , then, is as follows: R1 = (DC bus failuce) + (Loss of offsite power) x (Gas Turbine failuce) x (Battery failuce) Rt= (3E-5) + (.5)(.2)(SE-3) = 5.30E-4 , The probability of coce melt in then calculated to be: Core melt = 2.9E-9 + 5.54E-8 = 5.8E-8/c-yr Summary. The special emergency analyses (exclusive of sabotage) for Point Beach are summarized as follows:
- p(cm) Vulnerable Initiatine Event (Dec t-year) Area / Component Seismic 6.1E-5 RWST, electrical cabinets and battery cacks, PORV aic Fire 3.3E-5 AFW Pump Room, 4160 Switchgear ,
Internal Flood 7.7E-5 Service Water Pump Room i (Spray) i External Flood 1.9E-8 Turbine, Auxiliacy and Service ' Water Buildings , Strong Winds 4.0E-6 DG Exhaust Stacks , j Lightning 5.8E-8 DC Bus ' 5-9
1 l 5.2.2 Example Plant B - Turkey Point 12 Seismic. An earthquake may initiate.a core melt scenario by causing one of the following plant states: a small loss of coolant accident (S2), a transient in which the power conver-sion is initially available (T 3), and those transients in which the power conversion system has failed as a direct consequence of the initiating event (T 2 ). The frequency of type T2 transients is based on the probability of loss of offsite power since this will always be the dominant cause of these transients. While the probability of a small LOCA or a loss of offsite power increases as the earthquake level incrosses, the probability of a Type T3 transient will decrease accordingly. The safe shutdown earthquake for Turkey Point has an ' acceleration of 0.15 g Peak Ground Acceleration (PGA), however TAP A-45 is examining the vulnerability of decay heat removal systems to initiating events which are beyond the design basis. Therefore, probabilities of seismically induced core melt were calculated for earthquakes in the ranges of .5-1 SSE, 1-2 SSE, 2-3 SSE, 3-4 SSE, and 4-5 SSE. For the Turkey Point site, the frequency of earthquakes of these magnitudes are estimated to be: PGA Level (g) Freouency/vr 0.15 3.5E-5 0.30 5.9E-6 0.15 1.3E-7 0.60 1.0E-7 0.75 4.0E-8 Because all of the plant systems feel the' effects of an earth- , quake, the quantification of core melt scenarios involves calcu-lating component fragilities foe the various earthquake levels and using these values in the fault trees developed in the internal event analyses. Table 5.2 summarizes the probability of each of the seismically induced core melt sequences summed across all earthquake levels. The total estimated probability i of core melt from seismic events is 7.3E-6 per reactor year. l The vulnerability to seismic events is dominated by a loss of l offsite power transient followed by the loss of auxiliacy feedwater, and/or the feed and bleed capability. Failures of these systems are the result of failure in the water storage i tanks (both condensate and refueling water) which have a large l height-to-diameter ratio. [ Ei te . Using the transient event trees, the following systems and success criteria were identified as crucial to preventing core damage at Turkey Point: ( a) Power Conversion System: 1 out of 2 trains b) Auxiliary Feedwater System: 1 out of 3 turbine driven pump trains i 5-10 1
Table 5.2 Sequence Core Melt Probabilities Summed over All Earthquake Magnitudes -
- Base Case (l) - Turkey Point Sequence Probability of Core Melt S2MH{Hj < E-10 S MD g 1.08E-7 2
S ML 0.41E-7 2 T MLE
- 4.73E-6 2
4 T MPL < E-10 2 T 3MLE 1.6E-6
, T MPL < E-10 3
7.27E-6 (1) The values reported here reflect a revised analysis assuming feed and bleed available and used. This value is approximately 50% less than that used in the value-impact assessment discussed in Sections 7 and 9 which use an earlier value without feed and bleed of 1.67E-5. This difference has no significant effect upon the results or conclusions because the difference is less than 5% in the total p(cm). 1 i I 5-11
c) Safety injection System: 2 out of 4 trains d) Residual Heat Removal 1 out of 2 RRR pumps in socios System (in recirculation with 1 out of 2 SI pumps and mode): 1 out of 2 RHR heat exchangers The success critecia for the support fluid systems are: a) Service Water: 1 out of 3 SW pumps b) Component Cooling Water: 1 out of 3 CCW pumps with 2 out of 3 CCW heat exchangers Because the success critecia notaally only requite 1 train or pump from each system, in order to invalidate the success cei-tecia locations must be found in the plant where All trains of a system can be damaged by a fire. This means, in general, that for this analysis only those locations where all of the trains of the systems listed above can be damaged are important. Reference 12 Appendix D presents a Leview of each plant t.cea to determine the potential for a core melt following a fire in this area. This analysis cavealed three areas requiring a more detailed review: 1) auxiliary building north-south breezeway and cable riser area, 2) cable spreading coom, and 3) control coon. The breezeway cable riser area is a fire zone through which contcol and instrumentation cables pass from the auxiliary building into the cable spreading room. This zone has both automatic and manual fire suppression. The cabling is generally found in vertical open-ladder type trays. The detailed analysis, including COMPBRN fire code calculations, eliminated this area from further consideration. The cable spreading room houses coactor pcotection system cabinets, test equipment, and 1&C cabling foc all plant systems. This coom has automatic and manual fire suppression systems. The fire occuccence frequency for this room is taken directly fcom the genecic fire frequency data base to be 6.7E-3/c-yc. COMPBRN fice code calculations established that an acetone fire could ignite overhead cables in about 240 seconds while damaging redundant cables across the room in about 960 seconds. The automatic Halon suppcession system has a failure probability of 0.2, while the failure probability of manual suppression in 16 minutes (960) seconds is 0.3. To overcome the loss of control of systems due to a fire in this cable spreading room, operators would use the Auxiliary Shutdown Panel (ASP). The failure probability of lining up the ASP in the predicted confusion is assumed to be 0.1. Even if the system is properly aligned, the turbine dciven pump B which can bu operated from the ASP has a candom failure probability of 3.5E-2/ demand and an unavailability due to test oc maintenance of 6.0E-2/ demand. The total failure probability of the pump is 9.5E-2/ demand. 5-12
The core melt probability for this area, then, is: (6.7E-3)(.2)(.3)((.1) + (.9)(9.5E-2)] = 7.46E-5/c-yr. The control coom contains control and instrumentation for all cedundant safe shutdown systems and the normal plant operating systems. In general, the systems of interest have their controls on various control coom panels that are sepacated from each other. The sepacation between the panels is on the order of 20 linear feet. This means that for the fice to cause damage to the systems listed above would require a fire to spread a minimum of this distance. In addition, because the cabling of interest only comes up about a metet into the coom, hot gas layer effects would not be expected to play a major part in causing damage; only the dice.:t impingement of a flame or radiation would cause damage. Because the safety system cables are not in the direct line of sight (i.e., cables cannot "see" the other safety-related cables due to obstruction from cabinet walls and supports), the time for flame oc radiation damage to occur would be, in all likelihood, long. In addition, because this zone is continually managed, the chance of a fire spreading to a size where it could cause this type of damage is deemed to be negligible. Internal Flood Again the Turkey Point transient event trees were used to identify the DHR system combinations needed to prevent coce damage. The results, including succesa critecia, are the same as those reported above for fice. Tuckey Point's physical layout can best be described as a detached system of structures. Specifically, the coce of the
, plant is the ceactor containment building. Since Tuckey Point is a two unit plant, an auxiliacy building is nestled between the two reactor containments and contains RHR, SI and charging pumps as well as associated heat exchangers. The auxiliary building has a cruciform design with the long axis being open to the outside on both ends. In addition, there are curbs installed at the entrance to each pump coom which would inpede the flow of watec. All pumps are mounted on concrete pedestals at least a foot high so that a considerable volume of water would be required to damage them due to submergence. This would obviously be difficult since the area has large openings to the outside. ,
A control structuce, housing the control coom, cable spreading room, battery cooms, and other electrical equipment is found at the end of the auxiliary building. The ground floot of these two structures is connected by an open ended passageway (called the nocth-south breezeway). ' From the control structuce, there is a wide passageway that separates it from the main power producing turbine generators. The "main turbine deck" contains the main turbine and its associated systems (i.e., condensate, feed, etc.). This 5-13
structuce has multiple openings to the outside so that any internal flood would not be able to build up any appreciable water level. Found at the end of the "main turbine deck," but physically separated from it, are the electrical distribution centers (4160 volt, 480 volt). This area is also open to the outside, and is provided with drains both outside and inside this area for drainage control. Also found in this area are the auxiliary feedwater pumps, which are essentially out in the open in the passageway. The physical separation between the various safety components of interest for this analysis is on the.otder of several hundred feet. Specifically, the AFW pumps. SI, and RHR pumps are widely sepacated, and because they are housed in structures that are open to the outside, any potential internal flood would not have the capability to physically damage both of these systems. Support systems for front line systems (i.e., CCW and ICW) are . all locate:d in outside areas. The CCW pumps are located at the back of the auxiliacy building and are mounted on pedestals several feet high. The area is completely exposed to the environment; thus intecnal flooding could not affect these pumps. Similacly, the ICW pumps are located several hundred feet from the auxiliary building and are completely exposed to the outside environment. Both the CCW and ICW pumps are specifically designed for exposure to rain and are housed in NEMA enclosures. A ceview of available tanks with sufficient water to fill a critical area identified only the RWST, CST and main condenser i as potential flood sources. Based on an analysis of potential L flow paths, and noting that no equipment was located where it could be damaged by water cascading from higher levels, it was ; ascertained that the only room which could be flooded was the t RHR pump coom. However, because of the remote location of the tasks with cespect to this coom and the installed curbing, it is unlikely that floods could disable the pumps. The cicculating water, secvice watec, and fire main headecs were then examined for flooding along flow paths into areas of con-cecn in this analysis. Althougn some isolated components could cercat.nly be damaged by cupture of any of these systems, it was established that postulated breaks were isolable and the diverse systems sufficiently sepacated to preclude a coce aelt scenario. All the areas of concecn have internal flood sources that are the same size as those presented above, oc have smallet size sources (typically wet pipe fire suppression systems with two inch diameter pipes) which could not cause damage oc have been i provided with special protective measures making the possibility of an internal flood in an area remote or have redundant capa-bilities available elsewhece. The battery cooms fall into the 5-14
i latter case in that they have wet pipe suppression systans, but ; because there are several of them, redundant capabilities are . provided. Other areas, such as the switchgear rooms and auxiliacy feedwater pump area, do not have any fluid sources in their areas. The cable spreading room also has a small flood source from a chilled water coolec; however, the only important safety components in this coon are cables, so that spray from this source would have no damaging effects (i.e., cables are not damaged by flood soucces). Thus, from this analysis for the electrical distribution and control centecs of interest, flood sources within the actual coons are not capable of causing oc leading to a core melt situation. In summary, there do not appear to be any credible internal flood initiated coce melt scenarios for this plant. External Flood Turkey Point is located on the west shore of
- Biscayne Bay, approximately 25 miles south of Miami, Florida.
The principal causes of extreme flooding in the vicinity can be attributed to stoca surge and wave action due to tropical storms and hurricanes. Ducing extreme tides and tropical , storms oc huecicanes, the low lying areas near the plant are inundated as much as several miles inland. T.n addition, cainfall can cause ponding and sheet flow in the low lying mangcove swamps. The pecneability of the limestone bedrock in Flocida results in a major fcaction of the rainfall being techarged directly to the ground water. In the area near the plant, local canals and drainage ditches provide conveyance of surface cunoff from the succounding area to the bay. Onsite, runoff is provided by drainage ditches and surface cunoff to low lying aceas, and to the intake and discharge canals. Safety-related structures and equipment are located throughout the plant site. Equipment items which are pact of the shutdown decay heat comoval system are located in the Containment. Auxiliacy. Diesel Genecator, Control and Switchgeae Buildings. In addition, a number of components such as the stactup auxiliacy feedwater pumps, the intake pumps, the diesel fuel oil transtec pumps and'the switchyard are located outside. In the event of a hurcicane, emergency proceduces are designed to protect plant structures and equipment. Exterior doors are shut and flood wall openings are closed with stop logs. Flood levels will have to exceed 20 feet Mean Low Water (MLW) for flooding of plant areas to occuc. The switchyard, situated west of the discharge canal and the main plant site, is at an elevation of 15 feet MLW. In the event of a severe hurcicane, it is anticipated that offsite power will be unavailable, primarily due to high winds. If flood levels reach 19 feet MLW, the diesel fuel oil transfor 5-15
pumps located outside the flood wall will fail. This will cause failure of the diesel generators once their day-tank fuel. oil supply is exhausted in approximately eight hours. Failuce of the diesel generators will result in core melt if offsite AC power is not recovered. Failure of the AFWS is assumed to occur i in approximately two hours aftet the diesel generators have ; failed due to battery depletion and steam generatoc dryout. Due to a ceduced decay heat level at this time, there is an addi-tional 4 hours before core melt proceeds. This gives a total of 14 houts befoce coce melt commences. The frequency of a flood level that exceeds 19 feet but is less than 20 feet MLW (including wave actioh) is 6.40E-5 (see Table 3.4-2). This yields a coce melt frequency of 6.40E-5/yc if no cecovery actions are taken. This sequence of events could be terminated, however, if offsite power is recovered within 14 hours. .The nonrecovery probability of offsite power p(LOSP NR) within 14 houts is approximately 0.02. Thecetore, when offsite power ; cecovery is included the core melt frequency becomes 1.20E-6. At 20-feet MLW the diecel generators and all the safety system : pumps except the AFWS pumps are flooded. The frequency of a ' flood level that exceeds 20 feet MLW but is less than 20.5 feet is 1.60E-5/yr. This is t,he coce melt frequency without , includin'g cecovery. The AFWS will fait due to battery t depletion in two hours. The probability of nonrecovery of l offsite power p(LOSP NR) in two hours is 0.2; therefore, the ' core melt frequency with recovery for a 20-foot MLW flood is (1.6E-5) * (0.2) = 3.2E-6. At 20.5-feet MLW all the safety systems including the AFWS will fail. Core melt is expected to commence in approximately 30 , minutes. Recovery of offsite poker within 30 minutes is not considered since the pumps are all submerged; therefore, the i possibility of any recovery actions is highly unlikely. The ! frequency of a flood exceeding the 20-foot MLW 1evel is 4.20E-5/yr. For the above three cases no credit is taken for operatoc actions to prevent floodings. This is because the proceduces are basically designed to prevent leakage but not a major flood, i For example, the emergency proceduces do not specifically call for the plant to be shut down in the event of a hurricane. l l The results for the extecnal flood analysis are shown below. i Flood Level Core Melt Frequency ! (x feet MLW) Without Recovery With Recovecy i 19 < x <20 6.4E-5 1.28E-6 l 20 < x <20.5 1.6E-5 3.2E-6 l 20.5 < x 4.20E-5 4.20E-5 l 4.6E-5 t 5-16 l l 1
I It should be noted that for the first two flood levels, the offsite powar recovery times of 14 hours and 2 hours assume that power is.not lost till the flood level is reached. In fact, the power may be lost considerably before that allowing more time to restore power if the stoca conditions let up. This yields some conservatism in the 19 and 20 foot MLW core melt results. Extreme Winds The safety-celated equipment which is part of the shutdown decay heat comoval system is contained within the containment, auxiliary, diesel generator, control or switchgear buildings. The condensate storage tank (CST), the retualing water storage tanks (RWST) and the distel fuel oil stocage tank ace located at ground level outside of the buildings. Also, the diesel fuel oil transtec pumps, the intake pumps, the startup auxiliary feedwater pumps and the diesel generator exhaust stacks are outside. In general, the safety-celated equipment is protected in Class I structures with exterior concrete walls and roofs at least 12 inches thick. In some locations the walls and root slabs are thicker. In addition, some components (e.g., auxiliary . feedwater and component cooling water) are protected by heavy steel grating with bars 3 inches deep. All Class I structures at Turkey Point were designed as a minimum tot a loading cocresponding to 145 mph windspeed and to resist the ettacts of a tornado. The only structure vulnerable to wind speeds that have a relatively high frequency is the Unit 2 400-foot high concrete chimney. The chimney is predicted to fail if the wind exceeds 165 mph and it could impact various safety related systems. Core melt may occur it the chimney impacts the diesel fuel oil tank, the diesel genecat9e building and condensate storage tank, or the 480 volt switchgear building. The combined frequency of winds (straight and tocnado) tailing the chimney ace approximately 2.22E-4/yr. If the chimney fails onto the diesel generator tuel oil tank, the diesel generator can draw fuel from the day tanks for approximately eight hours before it depletes. Loss of the diesel genecators will casult in a station blackout since it is presumed that ottsite powee is lost during the hurricane or tornado. The auxiliary feedwater system could be operated via the station battactes for about 2 hours until they deplete. Attet these 10 hours, due to the reduced decay heat levels in the coce, core melt will not commence until after the steam generators boil dry (approximately 4 hours after AFW Cailure). In all, then, thece are 14 hours in which to recover otisite power to prevent a core melt. The core melt probability from this scenario is calculated by: 5-17
I (Probability of 16L aph wind) * (Probability of chimney impacting the diesel tuel oil. tank) * (Probability of not . ' recovering olisite power in 14 hours) . (2.22E-4) * (.04) l
* (.02) = 1.78E-7/r-yr. [
If the chimney falls on the diesel generator building it will ! probably fail the diesel generators and condensate storage i tank. Since no-credit is given for AFW supply via the hotwell ; or domineralised storage tank, and since the AFW pumps will ! likely cavitate due to the catastrophic tank failure, both l emergency coolant injection and secondary cooling have been ; lost in this scenario. Core melt is expected to occuc in 30 minutes it olisite power is not restored for the power conversion system. The sequence probability ist [ (Probability of 165 mph wind) * (Probability of chimney failing Diesels and CST) * (Probability of not recovering otisite power in 30 minutes) . [ (2.22E-4) * (.06) * (.8) = 1.07E-5/r-yr ; 12 the chimne talls and destroys the 480 V switchgear, the AFWS will aga n fail after battery depletion. Recovery of I ottaite power will not help recover AC or DC power to the loads { since the 440 V AC buses would be damaged. In this scenario, : the core melt probability would be the product of the ! probability of winds in excess of 165 mph and the probability t of the chimney falling on the 440 V switchgear: l (2.22E-4) * (.06) = 1.33E-5 l The total core melt probability due to high winds is the sum of ! the probabilities of the three scenarios, or 2.42E-5/r-yr. l 5 Lichtnino Using the U.S. Meteorological Services chart of i thunderstorm days in the United States (see Reference 12, l Appendix H) C'or Turkey Point, it is estimated that the site would expect approximately to thunderstorm days each year (T). [ The correlations for ground flashes (Ng) toe the southern U.S. derived by Horn and Ramsey is Ng = 0.17(T). This correlation predicts 13.6 ground flashes ka-2y r-1 for this southern U.S. site. { It is assumed that the plant was designed according to NRC recommendations that the plant be able to withstand a lightning strike of 200 kA. The probability of exceedance of this current is taken to be 0.01 as seen in Reference 12. Ther0 fore, the probability of lightning strikes in the Turkey Point region which will exceed the design basis is estimated to be /0.01)x(13.6) = 0.136/km2yr. To simplify calculations, , t t '. 4 Turkey scint site will be conservattavely estimated to be
' equat+ Aitonater in size.
i s-te i f
The transient event trees developed for Turkey Point in this program show that either the auxiliary feedwater system 21 the bleed and feed mode will successfully remove decay heat following a transient; however, loss of either of the emergency diesel genecators or station batteries will fail the bleed and feed ability to open the PORVs or block valves which are necessary. The auxiliary feedwater system consists of multiple trains such that the probability of candom failuce of all trains is exceedingly small and a single lightning strike cannot fail all of the independent trains. However, electric power is needed for the starting and cunning of pumps, operation of valves, and instrumentation and control. At Turkey Point there are four 125 VDC buses; however, only two of the buses are used to start the diesel generators. The 125 VDC Buses 4D01 and 3D01 are cequired to start diesel generatocs 4B and 3A cespectively. In addition, the 125 VDC 3023 bus supplies the powec that opens the feedwater control valves so that the AFW pump B train can function. The 125 VDC Bus 3D01 supplies the powec that opens the feedwater control valves that allow the AFW pump A and C trains to function. DC Buses 3001 and 4D01 are also needed to open the Unit 3 steam supply valves to two of the three turbine driven auxiliary feedwater pumps. The third valve is AC powered and failuce of Buses 3D01 and 4D01 will fail the emergency diesel generatoes. The most conservative scenario occucs if lightning stcikes the DC Bus 3D01 during a loss of offsite powec. Failure of Bus 3D01 will fait diesel generator 3A as well as feedwatec control valves foc trains A and C and the steam supply valve from Steam Generator 3C. The postulated transient that leads to a core melt at one unit involves a loss of offsite power and a lightning strike of 125 VDC Bus 3D01. A two unit core melt in 30 minutes requices a second lightning strike of either Bus 4D01 or 3D23, or a failure of either of these buses or their associated batteries. A long term station blackout induced core melt of both units will occur it diesel generator 4B tails after Bus 3D01 is hit by lightning. These sequence probabilities ace calculated as follows: 1 Unit Coce Melt Probability T((Ef)(A)(PkA)IPhit)I
* (LOSP)(NR30 min) 5-19
r where T = 80 thunderstorm-days /yr Ng = 13.6 ground flashes /km2yr A = 0.25 km2 PkA = 0.01 Phit = 0.01 LOSP = 0.5 NR3 o min = 0.5 1 Unit Core Melt Probability = 8.5E-5/r-yr without recovery The internal analysis has determined that the operator has a probability of 0.03 of not successfully realigning the feedwater valves numbered 3001A and 30018 on Figure 3.6.2 to recover full auxiliary feedwater flow. This recovery action will drop the core melt probability for one unit to 2.55E-6/4-yr. Another possible recovery action involves use of the startup feedwater pumps powered by the black start diesel generators. However, credit was only given for one recovery action in the 30 minute time frame. Summary. The special emergency analyses (exclusive of sabotage) for Turkey Point are summarized as follows: ! p(cm) Vulnerable lall(atino Event (per r-year) Area / Component Seismic 7.3E-6 CCW Heat Exchanger, RWST and CST l Fire 7.5E-5 Cable Spreading Room Internal Flood -- -- l External Flood 4.6E-5 Diesel FO Transfer Pumps. I Diesel Generators, AFW Pumps l Extreme Wind 2.4E-5 400' Chimney l Lightning 2.6E-6 DC Bus l 5.2.3 Example Plant C - St. Luciel3 i seismic. An earthquake may initiate a core melt scenario by ) causing one of the following plant states: S2, a small loss ! of coolant accident; T 3 . a transient M i th the power . conversion system initially available T,2 transients in which the power conversion system fails as result of the j initiating event. t i Tho frequency of type 2 transients is based upon the i probability of the loss of offsite power due to the initiating event since this will always be the dominant cause of these ' transients. While the probability of a small LOCA or loss of i offsite power increases as the earthquake level increases, the l prcbability of a type T3 transient will decrease accordingly. The safe shutdown earthquake (SSE) for St. Lucie has an acceleration of 0.1 g, however TAP A-45 is examining the ! 5-20 ,
vulnerability of decay heat removal systems to a full spectrum of initiating events. Therefore, probabilities of seismically - induced core melt were calculated for earthquakes in the ranges of 1-2 SSE, 2-3 SSE, 3-4 SSE, and greater than 4 SSE. For the St. Lucie site, the frequency of exceedance for earthquakes of these magnitudes were estimated to be:13 Exceedance PGA Level (c) Freauency/Yr 0.1 2.5E-4 0.2 5.0E-5 0.3 1.9E-5 0.4 8.0E-6 Because all of the plant systems feel the effects of an earthquake, the quantification of core melt scenarios involves calculating component fragilities for the various earthquake levels and using these values in the fault trees developed in the internal event analysis. Table 5.3 presents th9 probability of each of the seismically induced core melt sequences, summed across the earthquake levels. The detailed analysis in Reference 13 shows that the major contribution comes in the two to four SSE range. This occurs because St. Lucie has an SSE of 0.1 g, which is approximately half the design basis acceleration of most plants, but the plant is located in a low seismic hazard region. The vulnerability to seismic events is dominated by a loss of offsite power transient followed by the loss of auxiliary feedwater, and/or a feed and bleed capability. Failures of these two systems are the twsult of failures in the water storage tanks (both condensate and refueling water) which have a large height-to-diameter ratio. Fire. Using the transient event trees, the following systems and success criteric were identified as crucial to preventing core damage at St. Lucie: a) Power Conversion System: 1 out of 2 trains b) Auxiliary Peedwater System: 1 out of 3 pump trains (2 motor driven and 1 turbine driven) c) Safety Injection System: 1 out of 3 trains d) Residual Heat Removal 1 out of 2 RHR pumps in series System (in recirculation with 1 out of 2 Riip heat mode): exchangers 5-21
I I Table 5.3 Sequence Core Melt Probabilities Summed Over All Earthquake Magnitudes - Base Case - St. Lucie i Secuence Probability of Core Melt S2 H{Hj < 1.E-10 S2 D.Hj < 1.E-10
+ 5DD 2g2 3.20E-8 S2Dg.X 6.82C-9 5 2 LH g 8.09E-9 5 bE 5.78E-8 i 2 l 5 LD g 4.18E-7 l 2
T2LEH g 7.24E-9 ! T2LQE (T 2KLQE) 9.34E-6 T2LP < 1.E-10 T MLH g 3 1.5PE-9 T 3MLE 3.42E-6 T2HLP < 1.E-10 1.33E-5 i i l i 5-22 f f
/
The success critecia for the support fluid systems are: a) Intake Cooling Watec: 1 out of 3 ICW pumps b) Component Cooling Watec: 1 out of 3 CCW pumps with 1 out of 2 CCW heat exchangers Because the success criteria usually only requite 1 train oc pump from each system, in order to invalidate the succesc criteria locations must be found in the plant where all trains of a system can be damaged by a fire. More importantly, this means, in general, that for this analysis only those locations where all of the trains of the systems listed above can be damaged are important. Reference 13 includes a review of each plant area to determine the potential for a coce melt following a fire. This analysic pointed to only the cable spreading coom requiring a more detailed ceview. This zone houses the Unit 1 coacto protection cabinets, battery chargers, inverters and distribution panels for DC buses 1A, 1B and 1AB, as well as other test equipment. The only other items Cound in this zone are the instrumentation and control circuit cabling for both safety-related and nonsafety-telated systems in the plant including the intake cooling, component cooling water, safety injection, RHR, auxiliary feedwater, and PCS systems that are of interest. The 79ne has a thcee hout fice rating (coof, floor, walle, doors, penetratiens). Fice protection systems found in this zone ine'ude (a) photoelectric smoke detectors. (b) automatic, single failure proof Halon suppcession system, and (c) portable CO2 fire extinguishers. In addition, a tncee-hout cated battier has been built around the "A" battery charger, inverter, and DC distribution panel. Cables are couted into cable trays above this enclosure. Located outside this zone are manual hoce i stations. This zone is a large enclosure and as such, because of its function, has a large amount of cabling overhead (cable trays stacked 6 high, several stacks next to each other). Only a limited number of power cables enter this room. l The fire occurrence frequency for this room is taken directly from the generic fire frequency data base to be 6.7E-3/c-yc. The COMPBRN fice code determined that an acetone fire could ignite overhead cables in about 240 seconds while damaging redundant cables across the room in about 900 seconds. The automatic Halon suppression system has a failure pcobability of 0.2, while the failure probability of manual suppressior, in 15 minutes (900) seconds is 0.3. To overcome the loss of control of systems due to a fire in this cable spreading coom, operators would use the Hot Shutdown Panel (HSP). The failure probability of lining up the HSP in the predicted confusion is assumed to be 0.1. Even if the system is properly aligned, the tucbine driven pump train which can be operated from the HSP has a failure probability of appcoximately 1.0E-2/ demand. 5-23
The core melt probability for this area, then, is: (6.7E-3)(.2)(.3)((.1) + (.9)(1.0E-2)] = 4.388-5/1.-yr. Internal Plood. The St. Lucie transient event trees were used to identify DHR system combinations required to prevent core damage. The results are the same as those presented in the fire analysis above. As in the fire analysis, the success critoria means that in general only those locations where all of the trains of the systems listed above can be damaged are important. However, locations may exist where a front line system may not have all its trains together, but its support systems are all in near proximity and are vulnerable to a common flood. St. Lucie's physical layout can best be described as a detached system of structures. Specifically, the core of the plant is the reactor containment building. An auxiliary building, next to the containment, contains the RHR, SI, and charging pumps as well as associated heat exchangers. The auxiliary building has, in essence, a large basement area whero all these pumps are located. There are curbs installed at the entrance to each pump room which would impede the flow of water. All pumps are mounted on concrete pedestals at least a foot high so that a considerable volume of water would be required to damage them due to submergence. However, because of the large area involved, a "large" volume of water would be required to cause any damage. A control structure, housing the control room, cable spreading room, battery rooms and other electrical equipment is located on top of the auxiliary building structure. These areas are above tanks found at St. Lucie. The o'nly water found in these areas is for firefighting purposes (i.e., manual hose systems, no automatic water suppression systems). The turbine generators are located in a separate structure. The "main turbine deck" contains the main turbine and its associated systems (i.e., condensate, feed, etc.). This structure has multiple openings to the outside so that any , internal flood would not be able to build up any appreciable water level. Also found in this general area are the auxiliary feedwater pumps which are essentially out in the open. The RWST, CST and main condenser were identified as potential internal flood sources. However, even though there was sufficient water to submerge critical equipment if confined, I the analysis indicated that the general open nature of the plant precluded sufficient build-up with the possible exception of the RHR pump room. However, because the tanks are remote i j and the room has foot high curbing, loss of the RHR system l appears unlikely. A rupture in the main condenser would fail the PCS, however, the AFW systems are protected by location and 5-24
openness. In addition, large volume piping such as that for circulating watec, intane cooling water and Cice main as water sources. Again, because of location and openness, it was determined that cuptures in these lines could not cause sutticient damage to be of concern. All of the areas of concern, i.e., safety system locations, have internal flood soucces that are the same sise as those presented above, oc have smaller size sources (typically wet pipe fire suppression systems with two inch diameter pipss) which could not cause damage oc have been provided with special protective measures making the possibility of an internal flood in an area negligible or have redundant capabilities available elsewhece. Th6 battery toons fall into the latter case in that they have wet pipe suppcession systems, but because there are several of them, cedundant capabilities are provided. Other areas, such as the switchgear rooms and auxiliacy feedwater pump area, do not have any tiuid sources. The control rooms do have small flood sources due to a kitchen area that is recessed off the main control coom area; however, the sink area is not in a direct line of sight with cabinetty so that the question of spray damage is not applicable and the chance 'of getting six inches of watec into the cabinets is deemed incredible from this source. The cable spreading room also has a small flood source from a chilled water cooler; however, the only important safety components in this room are cables, so that spray from this source would have no damaging 1 ettects (i.e., cables are not damaged by flood sources). From this analysis tot the electrical distribution and control centers of interest, flood sources within the actual roous are not capable of causing or leading to a core melt situation. Thus, at St. Lucie it appeact that none of the plant areas are susceptible to internal flooding oc spray. This is primarily due to the tact that the physical layout of the plant is such that almost all potential flood sources are found at ground ; level, while the ground level accangement is such that there I are many openings to allow the drainage of water. Thus, the likelihood of pooling of water in any significant quantities is remote, g_xternal Flood. The principal causes of extreme flooding in the vicinity of St. Lucie can be attributed to storm surge and wave action dua to tropical stocos and hurricanes. During extreme tides and tropical storms or hurricanes, the low lying , areas surrounding the plant site are inundated. In addition, cainfall can cause ponding in the low lying areas. However, high soil permeability provides significant ground water , recharge from local precipitation, with little cunott. On site, runott is pcovided by a storm sewer system and surface cunott to low lying areas and to the intake and discharge canals. 5-25
Based upon a review ct plant documents and a walkdown of the plant, an assessment of the location anu vulnerability of safety-related equipment led to the following conclusions. At 19 feet mean low water (MLW) the auxiliacy feedwater systems will fail. This will result in the ions of the secondary cooling function. The emergency AC and high pressure injection systems are still available to provide the EC1 function via feed and bleed (F&B). The random failure of feed and bleed is conservatively estimated to be 1E-1 at St. Lucie. Therefore, the cote melt frequency becomes: (probability the watec level exceeda 19 feet MLW but is less than 22 feet MLW) x (tailure probability of P&D) = 9.21E-6 x 1E-1 = 9.21E-7. At 22 feet MLW the Antake cooling water and the component cooling water systems will tail. Therefore, the ECI function will tail in addition to the Secondacy coolino funetton that fails at 19 feet MLW due to flooding of the AFWS. The frequency of cote melt in tnis case is 2.29E-6. Thia is just the probability that the water level exceedw 22 feet MLW. For *he above two cases no credit is taker tot operator actions to rvent floodingo. Thie is because the proceduces age bar 11y designed to prevent leakage but not a majoc flood. For ,mple, the emergency procedures do not specifically call tot the plant to be shut dowr. in the event of a huccicane. This contribution to feequency of core melt of external floods can be summacized: Stillwater Flood L9 vel (feet MLW) p(cm) (Dec c-vc) 19 < X < 22 9.21E-7 22 < X 1219E-6 3.21E-6 Extceme Windt. The safety-related equipment which is pact of the shutdown decay heat removal system is contained within the Reactor Building. Reactor Auxiliary Building, and Diesel Gene <ator Building. '4hich are Class I stevetures. The I condensate storage tank (CST), the refueling water storage tank (RWST) and the diesel fuel oil storage tanks are located at ground level outside of the buildings. Finally, the diesel fuel oil transfer pumps, the intake coelin, water pumps, and the CCW heat exchanger and pumps ace also located outside. Based on the design and review criteria, all the plant Class I structures exposed to wind were designed tot a hurcicane wind velocity of 194 mph and the saftty.4414ted buildings and structures were designed to resivt e tocnado of 300 mph tangential wind velocity and a 60 mph rianslational wind velocity (toc fuel handling building only). A wind speed of 300 mph coctesponds to a mean frequency of occurrence of 1.5E-7 s -
per year. Based on this result the capacities of the buildings were not considered furthe.v. In the case of tornado-generated missiles, it was determied that the only credible scenario that could lead to core melt (i.e., failure of both the emergency coolant injection and secondary cooling) is failure of the diesel generators and subsequent battery depletion. This could occur if miasiles were to fail both of the diesel oil storage tanks. T probability of thi's occurring is the following: Peore melt = (Pt ornado)*(P missile hits one diesel oil storage tank)*(P missile hits the othec diesel oil storage tank) Pcore melt = (1.70E-4)*(2.15E-3)*(2.15E-3) = 7.86E-10/c-yr The core melt probability due to the failure of one diesel oil stocage tank due to a tornado-generated missile, depletion of the related day tank after one hour, and a random failure or test or maintenance unav.ailability of the redundant diesel genecator is calculated to be: Peore melt " (Pt ornado)*(P missile hits one diesel oil stocage tank)*((P candom tailure of cedundant diesel + P test or maintenance availability of redundant diesel)) Pcore melt = (1.70E-4)*(2.15E-3)((3.8E-2)+(6.1E-3))
= 1.6E-8/c-yc When the additional probability of not recovering offsite AC power before the 8-hour battecies deplete is considered, the core melt probability is negligible (less than 1E-9). In addition, there exist two locked closed cross-connections between the diesel oil storage tanks that would allow fuel to be transferred to the unaffected diesel generatot from the undamaged tank after the day tank is depleted. This capability would fucther reduce the core melt contribution due to this accident scenario.
Lichtnino. Using the U.S. Meteorological Services chart of thunderstorm days in the United States (see Reference 13) for St. Lucie, it is estimated that the site would expect approxi-mately 80 thunderstocm days each year (T). The correlations for ground flashes (Ng) for the southern U.S. derived by Horn and Ramsey is Ng =2 0.17 ground flashes km yg-1(T). This cocrelation predicts 13.6 for this southern U.S. site. It is assumed that the plant was designed according to NRC tecommendations that the plant be able to withstand a lightning strike of 200 kA. The probability of exceedance of this curcent is taken to be 0.01. Therefore, the probability of 5-27
lightning strikes in the St. Lucie region which will exceed the design basis is estimated to be (0.01)x(13.6) = 0.136/km2yr. The St. Lucie site was conservatively estimated to be 1/4 square kilometer in size. The transient event trees developed for St. Lucie in this program show that either the auxiliacy feedwater system og the bleed and feed mode will successfully cemove decay heat follow-ing a transiert. The auxiliary feedwater system consists of multiple trains such that the probability of random failure of all trains is exceedingly small and a single lightning strike cannot fail all of the independent trains. Likewise, the high pressure injection system has multiple trains which a:e very unlikely to independently fail. However, electric power is needed for the starting and cunning of pumps, operation of valves, and instrumentation and control. Therefore, the limiting core melt scenario would require a loss of offsite power with simultaneous loss of both DC electric power trains to cause damage. Each DC bus can receive power from offsite power, the associated diesel generator, or the batteries dedicated to that train; however, the diesel generator requires the DC batteries in order to start. The scenario where both DC power trains fail due to random oc common mode failures is pact of the intecnal analysis. Here the postulated transient involves either two 1.ightning strikes hitting the two DC buses, oc a single lightning strike hitting one DC bus while the other DC power train randomly fails. Core melt will commence after about 30 minutes when the steam genecatocs have boiled dry. These sequence probabilities are calculated as follows: Core Melt Probability p(cm) =T + ((Ef)(A)(PkA}I hit)] (LOSP)(NR) T ((Ey)(A)(PkA)I hit)](LOSP)(NR)(Ry) where T = 80 thunderstorm days /yr Ng = 13.6 ground flashes /km 2 ye A = 0.25 km2 PkA " 0.01 Phit = 0.01 LOSP = 0.5 NR3 o min = 0.5 lt should be noted that the term denoted Phit is a conservative assumption that one out of one hundted lightning strikes gceatex than 200 kA will damage this particular DC bus. This assumption is probably too high, however, it is beyond the scope of this analysis to teace the pathways of lightning pulses 0-1 then assign probabilities to these pathways. The 5-28
use of a value of 0.01 for P hit will yield an estimate foc' the damage of a DC bus. - Random failure of a DC power train following a loss of offsite power would require either failure of the bus itself oc loss of the power c.upply from the battery. The failute of the battery will cause failure of the emergency diesel generator to start. The calculation of the random failure of a DC train of power, then, is as follows: Rt= (Bus 1B local fault) + (Bus 1B test oc maintenance) + (Battery B local fault) + (Battery B test or maintenance) Rt= (3E-5) + (c) + (1.2E-3) + (1.1E-3) = 2.33E-3 The rl.sability of core melt due to lightning is then calculated to be using the above equacion: p(cm) = [4.OE-10 + 1.98E-7] = 1.98E-7/t-yc. For the case where lightning strikes the 125 VDC B train and the train A diesel generator fails to start, the A train of DC power will be available foc instcumentation and the AFW steam supply valves to the turbine driven pump as well as one feedwater valve could be manually opened. The safety grade batteries are sufficient for eight hours of electric power without cecharging. Summary. The special emergency analyses (exclusive of sabotage) for St. Lucie are summarized as follows: Initiatinc Event p(cm) (Der c-ve)_ Vulnerable Area / Component Seismic 1.3E-5 RWST/ CST ' Fire 4.4E-5 Cable Spreading Room Internal Flood -- -- Extecnal Flood 3.21E-6 AFW, CCW & ICW Pumps Strong Winds -- -- Lightning 1.9E-7 DC Bus 5.2.4 Example Plant D - ANO-114 Seismic. The safe shutdown earthquake for ANO-1 has an acceleration of 0.20 g PGA. However, because TAP A-45 is examining the vulnerability of DHR systems to initiating events beyond the design basis, pcobabilities of seismically induced coce melt were calculated for eacthquakes of four levels. The frequency of earthquakes of these magnitudes are estimated to be: 5-29
Exceedence
- PGA Level (c) Freouency/Yr 0.1 1.2E-3 '
0.2 3.0E-4 O.4 5.0E-5 0.6 1.6E-5 Because all of the plant systems feel the effects of an earthquake, the quantification of core melt scenarios involves calculating component fragilities for the various earthquakr levels and using these values in the fault trees developed in the internal event analyses. Table 5.4 presents the probability of each of the seismically induced core melt sequences, summed across the earthquake levels. The total contribution to core melt is 7.3E-d per reactor-year. The detailed analysis in Reference 14 shows that the major contributions to core melt occur in the 0.1 to 0.4 g range (0.5 + 2 SSE) and not from the larger earthquakes. It is also evident from Table 5.2.4 that more than two-thirds of the p(cm) due to seismic arises from the transient sequence loss of offsite power followed by a loss of the auxiliary feedwater system and the feed and' bleed capability. Failures in the latter two systems involve combinations of failures of electrical buses and either the CST or the EFW turbine-driven pump. Fire. Using the transient event trees, the following systems and success criteria were identified as crucial to preventing core damage at ANO-1. Power Conversion System: 1 of 2 trains and 1 of 3 condensate boost pumps Emergency Feedwater System: 1 of 1 motor driven pumps or 1 of 1 turbine driven pump High Pressure Injection 1 of 3 trains System: Auxiliary Feedwater System: 1 of 1 pumps and 1 of 3 condensate boost pumps The support systems required for these frontline systems are: Service Water: 1 of 3 SW pumps AC Power: Normal offsite power or 1 of 2 diesel generators , DC Power: 1 of 3 battery chargers or 1 of 2 station batteries. 5-30
Table 5.4 Sequence Core Melt Probabilities Summed ' Over All Earthquake Magnitudea.- Base Case - ANO-1 Secuence Probability of Core Melt S2MD D12 2.54E-6 S 2 MD 1 X 7.02E-8 S2MLD1 1.54E-6 S3MED2 7.54E-6 S3MEX 1.93E-7 S3MLE 3.03E-6
'T 2MLE 5.08E-5 T 3MLE 7.26E-6 7.297E-5 5-31
Because the success criteria only require 1 train or pump from a given system, in order to invalidate the success criteria . locations must be found in the plant where all trains of a system can be damaged by fire. The cable spreading room (CSR) contains circuitry for all safe shutdown syttems. An automatic water suppression system and a remote shutdown are provided for this area. The cables in this toom are located in cable trays throughout the room at various elevations from the floor to the ceiling. Some cable trays also cross one another at various elevations. Because the exact locations'of redundant cabling in the CSR are not known, assumptions concerning the location of certain cables are necessary. Based on the control room layout, a horizontal distance of 2.13 meters (7 feet) was estimated between the emergency systems cables and the PCS cables in the CSR, Consequently, these estimated distances were used in COMPBRN calculations. These calculations indicate that for the acetone fico, the redundant cableo would ignite approximately two minutes into the fire. The generic mean probability of a CSR fire is 6.7E-03/r-yc. A water suppression system is installed in the CSR for which the genetic unreliability is 0.04/ demand. In the event of automatic suppression failuce, manual suppcession may still succeed. The generic probability of nonsuppression in five minutes (the appcoximate time to damage of redundant tcains) 1u 0.4/ demand. The probability of failuce to correctly align and start the primary remote shutdown system (EFW) is taken as 0.1/ demand. This value is based on Seabrook data for the conditional frequency that the operators will not do the cight thing at auxiliacy chutdown panels. Once the system is running, the probability of failure is taken as 0.01/ demand. In cases where the operator has failed to start the primacy cemote shutdown system or the primary cemote shutdown system has failed, a backup shutdown method is available using the HPIS system in a "feed-and-bleed" mode of operation. The probability of success-fully aligning and starting the secondary shutdown method, given failure of the primary shutdown system, is taken to be 0.5. Once the backup system is started, the pcobability of, candom failures in the system is taken as 0.01. The cesulting core melt ptobability from fires in the CSR is 5.8E-6/c-yr. Intecnal Flood. The ANO-1 transient event trees were used to identify the DHR system combinations which are needed to pcevent core damage. The results, as expected, are the same as those for the fire analysis above. Again, because the success cciteria only requite 1 train, to evaluate the flood threat cequires that locations must be found where all of the cedundant systems could be disabled by an internal flood. 5-32
Based upon the initial screening..no individual areas were identified that might bc vulnerable to internal flooding. Howevec, one plant level, elevation 335' which is below grade, does have a sufficient amount of equipment such that safe shutdown could be prevented if water were to accumulate from intecnal flooding at highet elevations. Internal flooding of all of this level has the potential of damaging the PCS, HPIS, AFW and EFW, although both the turbine building and auxiliary building would have to be flooded to do so. The PCs and AFW could be disabled because the condensate booster pumps are at this level in the tur'bine building while all the EFW and HPIS pumps are at this level in the auxiliacy building. These two buildings are separated by fire walls at ' this level, but sources above could possibly flood both areas simultaneously. The acea that would have to be flooded is approximately 4200 m2 (45000 ft2). An estimated water level of 0.46 meters (1.5 feet) would be cequiced to damage all the pumps. Even a complete emptying of the bocated water storage tank (approxi-mately 1,440,000 litecs) onto this elevation would not provide the cequired water volume. Also, pipe breaks of the sizes postulated for this analysis would requite hours of unmitigated flooding before they could even approach the cequired volume of water. Because of these considerations, flooding of both buildings at this elevation to a sufficient water depth to cause problems is unlikely. A flood in the turbine building would still leave several automatic safety systems available and a flood in th- auxillacy building would leave the PCS , available. Extecnal Flood. The principal cause of flooding in the area is the Arkansas River and its tributaries. Historically, the worst floods have occucced in the spring. Intense cainfall can also cause local flooding. The Arkansas River Navigation System consists of 17 locks and dams, however only one, Ozack Dam, presents a potential thceat to ANO-1 coincident with a probably maximum flood (PMF). The anticipated flood level at the site due to a PMF is 358 feet. If the Ozack Dam were to fail during a PMF, a maximum watec surface level of 361 feet (8 feet above plant grade) would cesult. The design basis flood level is 361 feet. Safety-telated equipment which is pact of the shutdown decay heat cemoval system is located is the Reactor Building, Auxiliacy Building. Turbine Building, and intake Structuce. Outside are the Condensate Storage Tanks (CST), Borated Water Storage Tanks (BWST), and Emergency Diesel Fuel Oil Stocage Tank. Category I plant structures (Reactoc Building, Auxiliary Building, pottion of Intake Structure housing, Emecgency Diesel 1 Fuel Storage Vault) wete evaluated to assess the effects of 5-33
flood level elevation to plant grade. Safe *v-related equipment is either located on floors at or above elevations 369, or in Category 1 structures with wall thicknesses of at least 2 feet. Uatertight doors are provided at entrances to the Auxiliary Building such that flood protection is provided to at least elevation 361 feet. The switchyard is situated east of the plant, approximately at elevation 354 feet. Thus for floods that could impact the plant, failure of the switchyard and loss of offsite power is anticipated. Based on a review of plant documents and a walhdown of the plant, the vulnecability of plant equipment was assessed. The assumption is made that a simultaneous loss of offsite power will occur during an external flood event since the switchyard is lowec than the rest of the safety systeas. The critical DHR functions are secondary cooling (using the EFWS) and emergency coolant injection in the feed and bleed mode (using the HPIS), Both the EFWS pumps and the HPIS pumps are at elevation 361 feet, while the diesel genecators and battery rooms ace at highec elevations. A flood of 361 feet fails the critical safety systems. Recovery of offsite power is not an issue since the critical , safety pumps are submerged. The possibility of any other recovecy actions is highly unlikely. To be conservative, no credit is taken for operator actions even though emergency procedures have been established to shut the plant down should the Arkansas River exceed elevation 350 feet. This is because it is not known how long it would take to reach 361 feet NGVD from 350 feet. In addition, even though the plant was shut down, there still would be some residual heat that would need to be cemoved and no safety systems would be available to remove the heat. Thus the potential core melt probability is the */.23-6/ year frequency of a 361 foot flood. Extceme Winds. ANO-1 is located on a peninsula of the Dardanelle Reservoir in an area with a celatively high rate of tornado occuccence. The site is also subject to straight wind hazards. The BWST, the CSTs, and the diesel oil stocage tank are located outside and ace vulnerable to wind effects. The tanks were not analyzed in this study foe wind pressure effects based on expecience with similac tanks at other nucleac power plants. Because the newly built 321,000 gallon tank was designed for seismic loads, the capacity of this tank is sufficient to resist wind velocities greater than 360 mph. The othec CST is not seismically designed but probably has a high wind pressuce capacity. However, these tanks ace both vulnecable to toenado missiles and were included in the toenado missile analysis. t 5-34
L The exhaust stacks which go from the diesel generators up" through the auxiliary building to the roof are exposed to , tornado missiles above the roof. As indicated in the FSAR, the auxiliary building is designed to resist winds up to 300 mph, however the part of the auxiliary building where the exhaust Stacks are attached consists of metal siding which is assumed to be Class 2 construction. The coce melt probability due to straight winds without recovecy is 5.69E-6 based upon the frequency of occurrence of winds of 140 mph. This core melt probability arises from the failure of the DGs at 140 mph due to exhaust stack collapse. If the battery operated EFW turbine driven pump starts and runs successfully, this is a long-term sequence since steam generator dryout will not begin until after battery depletion occurs in approximately 8 hours. It will take an additional 4 houts until steam genecatoc dryout occurs. This is longet than the 30 minutes needed for a transient without the EPW system at the onset of the accident due to the reduced heat level after 8 hours. The nonrecovery ptobability of offsite power p(LOSPNR) is 0.03 in 12 hours. In addition to LOSP recovery there is a possibility of recovery by having someone cut off the bent portions of the DG exhaust stacks (caused by the straight winds) within the 12 hours. This is given a nonrecovery probability of 0.1. If the EFW turbine driven pump candomly fails to start, core melt will occur after appcoximately 30 minutes. The probability of nonrecovery of offsite power in 30 minutes is 0.5 and it is not considered possible that the DG exhaust stacks could be fixed in this time. Failure of the tutbine dciven EFW pump to start on demand is estimated to be 3.5E-2/ demand. Test and maintenance outage is a negligible contribution to EFW turbine pump failuce. The incocporation of reco"ecy is shown below for the loss of the DGs when the tutbtne driven pump successfully opecates and when the tutbine dciven pump has failed to start. p(CMlSTRAIGHT WIND) e p(DGs fail for 140 mph winds) * (p(LOSP nontecovecy in 12 houts) a p(nonrecovecy of DG exhaust stacks by cutting open when bent by winds) + p(LOSP nonrecovery in 30 minutes)
- p(TDP fails to stact)
- p(nontecovery of DG exhaust l
stacks within 30 minutes))
- p(140 mph winds) p(CMlSW) = 1.0 * (0.03
- 0.1 + 0.5
- 3.5E-2
- 1.0)
- 5.69E-6 l 2.05E-2
- 5.69E-6 = 1.16E-7/c-yc l
l The coce melt pcobsbility due to tocnado winds and missiles is 2.53E-4ft-yc based upon the frequency occurrence of tornado l winds of 140 mph if no cecovery actions ace considered. This l probability is due to failuce of the DGs at 140 mph as desccibed for straight winds. The DG failuce sequence is a 5 - 3 f. L
long term sequence as described above. In fact, the probability is estimated using the same equation, except for the probability of core melt without recovery. Therefore, for tornado winds: p(CMl Tornado Winds & Missiles) = 2.05E-2
- 2.53E-4 p(CMlTW&M) = 5.19E-6/r-yr The contribution to core melt due to tornado winds and missiles is 2.53E-4 without recovery and 5.19E-6 with recovery. In summary, the total contribution to core melt du9 to straight winds and tornadoes (wind and missiles) is 2.59E-4 without recovery and 5.31E-6 with recovery.
Lichtnino. Using the U.S. Meteorological Services chart of thunderstorm days in the United States (see Reference 14, Appendix H) for ANO-1, it is estimated that the site would expect approximately 58 thunderstorm days each year (T). The correlations for ground flashes (Ng) for the southern'U.S. derivedbyHornandRamseyisNg=0.17(T). This correlation predicts 9.9 ground flashes km yr-1 for this southern U.S. site. It is assumed that the plant was designed according to NRC recommendations that the plant be able to withstand a lightning strike of 200 kA. The probability of exceedence of this current is taken to be 0.01.14 Therefore, the prebability of lightning strikes in the ANO-1 region which will exceed the design basis is estinated to be (0.01)x(9.9) = 0.099/km2 yr. The ANO-1 site will be conservatively estimated to be 1/4 square kilometer in size. The transient event trees developed for ANO-1 in this program show that either the emergency feedwater system or the feed and bleed mode will successfully remove decay heat following a transient. The emergency feedwater system consists of two trains such that the probability of random failure of both trains is small and a single lightning strike should not fail , both of the independent trains. However, electric power is needed for the starting and running of pumps, operation of valves, and instrumentation and control. Therefore, the limiting core melt scenario would require loss of both DC electric power trains. Each DC bus can receive power from offsite power, the associated diesel generator, or the batteries dedicated to that train; however, the diesel generator requires the DC batteries in order to start. The scenario where both DC power trains fail due to random or common mode failures is part of the internal analysis of Chapter 2. In this section, the postulated transient involves either two lightning strikes hitting the two DC buses, or a single lightning strike hitting one DC bus while the other DC power train randomly fails. Core melt will commruce in less than 30 minutes when the steam generators have boiled dry. 5-36
These sequence probabilities are calculated as follows: CoreMeltProbability=T((Ef)(A)(Pgg)(Phit)) ( )'+ T((Ey)(A)(pkA)I hit)] (LOSP)(NR)(Ry) where T = 58 thunderstorm days /yr Ng = (9.9 ground flashes /km2yr) A = 0.25 km2 PkA = 0.01 Phit = 0.1 LOSP = 0.5 NR30 min = 0.5 It should be noted that the term denoted Ph it is a conservative assumption that one out of one hundred lightning strikes greater than 200 kA will damage this particular DC bus. This assumption is probably too high, however, it is beyond the scope of this analysis to trace the pathways of lightning pulses and then assign probabilities to these pathways. The use of a value of 0.1 for Phit will yield an estimate for the damage of a DC bus. Random failure of a DC power train !!ollowing a loss of offsite power would require either failure of the bus itself or loss of the power supply from the battery. The failure of the battery will cause failure of the emec9ency diesel generator to start. The calculation f.or random failure of a DC train of power, then, is as follows: R1= (DC bus local fault) + (DC bus test or maintenance) + (Battery test or maintenance) (Batte'.y local f ault) + Rt= (3E-5) + (c) + (1.8E-3) + (1.lE-3) = 2.9E-3 The probability of core melt is then calculated to be: p(CMl lightning) = 2.64E-10 + 1.79E-7 = 1.79E-7/r-yr For the case where lightning strikes the 125 VDC B train and the train A diesel generator fails to start, the A train of DC power will b9 available for instrumentation and the AFW steam supply valves to the turbine driven pump as well as one feedwater valve could be manually opened. The safety grade batteries are sufficient for eight hours of electric power without recharging. Summary. The special emergency analyses (exclusive of sabotage) for ANO-1 are summarized as follows: 5-37
Vulnerable
- Initiatino Event o(cm) Der r-vr Area / Component Seismic 7.3E-5 BWST, CST and Electrical Cabinets Fire 5.8E-6 Cable Spreading Room Internal riood -- --
External Flood 7.2E-6 Turbine & Auxiliary Bldgs. Extreme Winds 5.3E-6 DG Exhaust Stacks Lightning 1.8E-7 DC Buses 5.2.5 Comparison of Results - PWR Even a cursory review of the results of the special emergency analyses indicates that even though there are differences between plants, there are significant similarities. The results for the four PWR plants are sumnarized on Table 5.5. The total contribution to p(cm) from special emergencies only varies by about a factor of three across the four plants. However, individual contributions (e.g., seismic, fire) show much more variation. Nevertheless, there is substantial correlation in the areas / equipment deemed vulnerable. For example, at these plants water storage tanks, especially those designed to earlier criteria, exhibit vulnerabilities to seismic initiating events which can be readily reduced with wall stiffeners and improved anchorage. In several instances electrical switchgear performance could also be improved with added tie downs. All four plants have fire vulnerabilities remaining and in general it appears in the cable spreading room where high concentrations of cabling exist. The AFW pump room at Plant A has a substantial concentration of safety related cables which make it somewhat comparable to a cable spreading room. None of the plants exhibited significant vulnerability to internal flooding except Plant A. In this one instance there is a potential vulnerability due to spray from a ruptured pipe, but the vulnerability is easily remedied. External flooding provides some interesting contrasts. At Plants A and D there is a potential for lake or river flooding to affect significant areas of the plant and the equipment located therein. On the other hand, at Plants B and C, which are coastal, but southern sites, the potential flooding is limited to some very specific locations or equipment. Except for Plant B, at which diesel generator fuel oil transfer pumps have a significant vulnerability, external flooding does not contribute substantially to p(cm). Extreme winds can affect diesel generhtor performance at several sites by collapsing exhaust stacks, however ir %,th l instances the contribution is less than 10% of that due to special emergencies. The 400 foot chimney at Plant B has a l l l 5-38 l
Table 5.5 Summary of Special Emergency Analyses - PWR Plants p(ca) (per reactor-year) Vulnerable Area / Equipment Ecent/ Plant A B C D A B C D Seismic 6.lE-5 7.3E-6 1.3E-5 7.3E-5 SWCR CCW HTI RWST BWST, CST - Batteries RWST, CST CST SWGR PORY Air Fire 3.3E-5 7.5E-5 4.4E-5 5.8E-6 AFW Pump Cable Cable Cable Room, 4160 Spreading Spreading Spreading
; SWGR Room Room Room Internal Flood 7.7E-5 -- - -
SW Pump Rn - - -- aa;ternal Flood 1.9E-8 4.6E-5 3.2E-6 7.2E-6 Turbine, DC Fuel Oil AFW, CCW Turbine 'T Aux. & SW Pumps DG CW Pump Auxiliary y Pump Bldgs AFW Syst. Bld:s. Extreme Wind 4.OE-6 2.4E-5 -- 5.3E-6 DG Exhaust 400' - DC Exhaust. l Stacks Chimney Stacks J l 1 Lightning 5.8E-8 2.6E-6 1.9E-7 1.BE-7 DC Bus DC Bus DC Bus DC Bus i 1.74E-4 1.55E-4 6.058-5 9.15E-5 l I I
-_-__7 , ,
potential to cause significant failures, but even here the ' contribution to p(cm) is only on the order of 15%. Liqhtning can affect DC buses at all four plants but the con-tribution to p(cm) is so small as to be negligible. 5.3 Boilinc Water Reactors The two reactors studied do not provide as broad a spectrum of siting conditions as the PWR plants; both BWRs are located on major rivers in the mid-continent. However, the vulnerabilities revealed are addressable and show some commonality with those for PWRs. 5.3.1 Example Plant E - Quad Citiesl5 Seismic. An earthquake may initiate a core melt scenario by causing one of the following plant states: a small loss of coolant accident (S2), a loss of offsite power transient (T1), or a reactor trip with offsite power available (T 2)- While the probability of a small LOCA or a loss of offsite power increase as the earthquake level increases, the probability of a T2 transient will decrease accordingly. The safe shutdown earthquake for Quad Cities has an acceleration of 0.24 g PGA, however TAE A-45 is examining the vulnerability of decay heat removal systems to initiating events which are beyond the design basis. Therefore, probabilities of seismically induced core melt were cciculated for earthquakes in the ranges of 1-2 SSE, 2-3 SSE, 3-4 SSE, and 4-5 SSE. For the Quad Cities site, the frequency of .arthquakes of these magnitudes are estimated to be:15 SSM Level PGA Rance Frequencv/yr
.5-1 0.12-0.24 g 1.0E-3 1-2 0.24-0.48 g 2.3E-4 2-3 0.48-0.72 g 1.4E-5 3-4 0.72-0.96 g 5.3E-6 4-5 0.96-1.20 g 1.5E-6 Since all of the plant systems feel the effects of an earthquake, the quantification of core melt scenarios involves
, calculating component fragilities for the various earthquake levels and using these values in the fault trees developed in the internal analyses. Table 5.6 summarizes the probability of
- each of the seismically induced sequences summed across the i earthquake levels. The total seismically induced core melt probability is calculated to be approximately 8.3E-5/r-yr.
I 5-40
r Table 5.6 S9quence Core Melt Probabilities Summed Over All Earthquake Magnitudes - ' Base Case - Quad Cities Probability of Core Melt Sequence foer r-year) SZ l.9E-6 SZE 2.16E-6 SD 1.35E-5 ' SPD' l.52E-7 TlYZ l.03E-5 T1YZE 1.25E-5 T1D 4.06E-5 T2YZ 1.2E-7 T2YZE 1.3E-6
- T2D 1.2E-7 8.26E-5 t
4 5-41
At Quad Cities at the time of the analysis it was found that the battery racks (both 125 and 250 VDC) were constructed of wooden' battens with a side rail that was expected to fail if batteries tipped against it. The vulnerability results from common mode failure of the 125 VDC batteries leading to failure of all emergency coolant injection systems and is evidenced in the T1D sequence. It was also found that 2 of the 4 kV switchgear cabinets are inadequately anchored for an earthquake. The common mode failure of circuit breakers mounted in these cabinets are dominant in sequences T1YZE and TlYZ where the loss of offsite power is followed by failure of containment cooling. The seismic cnntribution to p(cm) is dominated by failures in the 1-3 SSE range (86%) with the single major contributor being the early failure of injection, sequence T1D (~ 50%). Fire. Using the transient event trees, it was determined that the systems required for safe shutdown following a fire initiated transient might include main feedwater, the reactor core isolation cooling (RCIC), high pressure coolant injection (HPCI), core spray (CS), the safe shutdown pump (SSP), the residual heat removal system (RHR), and the safety relief valves. Critical support systems include the diesel generators (DGs), normal power, and the RHR service water. An analysis of each fire zone for critical systems which would be vulnerable to fire is detailed in Reference 15. Those areas ' identified for which a fire could lead to core melt are discussed below. All front line safety systems required for core coolant injection and decay heat removal could be directly affected, except the safe shutdown pump which has independent local control could be affected by a fire in the control room. Specifically, main feed-water, RCIC, high pressure coolant injection (HPCI), power operated safety relief valves (SRVS), core spray (CS), low pressure coolant injection (LPCI), and RHR all have the potential to be affected. Additionally, all supporting systema could be affected to some extent. Potential recovery is provided via the RCIC or the SSP local control. The RHR also has local manual control capability as do the critical support systems. The generic frequency of a control room fire is 4.9E-3/r-yr which should represent an upper bound on the fire frequency. Smoke detectors are located in the cabinets and the control room is continuously attended, making the probability of detection in a short period of time very high. Early detection combined with essentially instantaneous manual suppression response makes the use of generic suppression probabilities misleading. Manual suppression equipment is located in the control room along with self-contained breathing apparatus and at least one fire brigade member. Therefore the probability of non-suppression is taken to be 0.025. 5-42 l
The probability of failure to correctly align and start the primacy remote shutdown system (RCIC) is taken as 0.1. Once the system is running, the pcobability of failure is taken as 0.01. In cases where the operatoc has failed to align and start the primary remote shutdown system, a backup system (SSP) will still be available. The probability of failure to align the backup system in sufficient time given f.ailuro of the primary remote shutdown method has been taken as 0.5. An event tree for the control room is given in Reference 15, Appendix D, with the resulting core melt probability from fires in the control room estimated to be 6.7E-6/r-yr. A fire in the cable spreading room could affect all of the same systems as a control room fire. The generic frequency of a fire in the cable spceading room (CSR) has been estimated to be 6.7E-3/c-yr. A water suppression system is installed in the CSR; the generic unreliability of this system is 0.04/ demand. In the event of automatic suppression failure, manual suppcession may still succeed. Based on the configuration of the cable trays, computer calculations using COMPBRN indicate that redundant cable trays would be damaged within the first five minutes of an exposure fire of acetone oc within appcoximately seven minutes for a trash can fire. The generic probability of , non-suppcession in this time frame is 0.4 The probability of failure to correctly align and start the pcimacy cemote shutdown system (RCIC) is taken as 0.1. This ' value is based on Seabrook data foc the conditional probability that the operators will not do the cight thing at auxiliary shutdown panels. Once the system is cunning, the probability of , failure is taken as 0.01. In cases where the operatoc has failed to align and statt the primary remote shutdown system, a backup system will still be available. The probability of failure to align the backup system in sufficient time, given failure of tne primary cemote shutdown method, has been taken as 0.5. An event tree for the CSR is shown in Reference 15 with the cesulting core melt pcobability from fires in the CSR being 5.8E-06/c-yc. The total contribution from fice is thus 1.3E-5/c-yc. Intecnal Flood. No areas wece identified at Quad cities where cedundant equipment could be damaged by a single internal flood source. Electrical distribution systems are generally located in wide open areas at elevations 615'6" and 623'0". Potential flooding on these levels would dcain to lowe: levels via open stairwells, preventing damage to equipment on these levels. No spray damage sources wece identified in the immediate vicinity of the powet distribution system components. 4 5-43
Four corner rooms, one room adjacent to the NW corner room, and three rooms on the west sid6 of the turbine building house most' of the major active safety system components. All of these coons are located on the basement floor and as such could be vulnerable to internal flooding. One experience with internal flooding at Quad Cities has resulted in the installation of watertight doors in all of these rooms. The watectight doors provide internal flood protection up to approximately eight feet above the floor level where unsealed penetrations could allow passage of watec between the corner rooms and the rest of the reactor building. However, no flood sources were identified . which could appcoach the eight foot level. Although beyond the scope of this study, it appeats that even a gross cupture of the suppression pool would be insufficient to flood the four corner rooms. Additionally, floor drain pumps were installed in the residual heat removal service water pump rooms to pump water out in the event of any leakage in the coon. Consequently, intecnal floods in any one of these rooms would not be likely to propa-gate not would water from outside these rooms be likely to entet. The control coon and the electrical equipment room would be the only other areas wheca flooding could potentially damage ! cedundant equipment. No significant flood sourcec s'ere identi-fled in these rooms not outside these cooms in the general vicinity. Flooding in areas where cables are the only safe shutdown equipment was not considered because of the low probability of submergence damage to cables. External Flood. The pcincipal cause of flooding in the Quad Cities area is the Mississippi Rivec and its tcibutaries. Historically, *he worst floods have occurced in the spring caused by snowmelt or a combination of anowmelt and rainfall. In addition, intense thundecstorme can also cause local flooding. At elevations susceptible to the effects of extecnal flooding, i plant structuces are constructed of reinforced concrete. Thece are no watectight exterior doors or temporacy or permanent flood barriets designed to prevent flow into the Tucbine or Reactor Buildings should flooding occur. The majority of the safety-telated equipment items needed for decay heat removal are located in the Control, Turbine and Reactor Buildings. Categocy I plant stcuctures have been designed to withstand the effect of hydrostatic focces produced by a water-surface elevation of 590 feet, which is 4.5 feet below plant grade. In the PSAR it is estimated that structural integrity of the plant a can be maintained foe water-suctace elevations up to elevation 603 feet by flooding the plant to match the tivec elevation. Above this elevation, it is anticipated that damage to plant structures will occur. Equipment items located within buildings vary in theit degree of available flood protection. Many electrical equipment items (i.e., switchgear, buses, etc.) are situated at upper levels in l l 5-44
- , =- -_ _-___ _ _ _
plant structures, 20 oc'more feet above plant grade. The diesel generator cooms and the safe shutdown pumps, however, are at elevation 595 feet. Doors leading to these rooms are not watectight. Other equipment items such as HPCI pumps and RHR and containment spray pumps are located at the lower elevations of the Reactor Building. These items are partially oc totally isolated in rooms with watectight doors. Their design was based mainly on internal flood scenarios. Protection against external flood sources was not considered. In the event that a flood should. exceed elevation 589 feet asl, emergency proceduces have been established to shut the plant i down and comove the decay heat. This involves cooling the plant l down to a point where the coactor vessel head can be removed and natural cicculation cooling can be relied upon. Due to the possible damaging effects of hydrostatic forces, plant doors are then opened to equalize the pressure on structure walls. These proceduces are predicated on the assumption that adequate time exists to pectorm the necessacy steps to shut down and maintain i the plant in a safe condition. ! 1 The 345 kV switchyard is situated east of the plant on a rise which has an average elevation of 610 feet asl. Thus, for floods that could impact the plant, coincident failure of the < switchyard is not anticipated, unless the flood exceeds elevation 610 feet mal. The equipment located at, oc below, plant grade that could be damaged by a flood includes the Unit 1 diesel generatoc, Unit 2 diesel generator, swing diesel genocator, condensate storage tanks, high pcessure coolant injection (HPCI) pumps, residual heat removal (RRR) pumps, and safe shutdown pump. The reactoc coolant isolation cooling (RCIC) pumps, core spray pumps and RHR service water pumps are in the watectight cooms, while the battery cooms and switchgear.cooms are well above plant grade, l Howevec, we will consecvatively assume that these pumps will also fail due to flood waters penetrating cracks in the powee cables oc shortini of tecminal boxes. In addition, there is the l possibility that av :able conduit could channel water directly , I i to the pump motocs and result in theic failuce. l Therefore, it will be conservatively assumed that if the plant was not placed in safe shutdown condition before the flood ceached plant grade, then the flood waters would fail the HPCI, i RCIC, RHR, coce spray and safe shutdown pumps as well as the diesel generatoes. Plant geade is at elevation 594.5 feet mal, however the floot levels of the Turbine Building and Reactor Building are six l inches higher (i.e., 595 feet). It was assumed that the watec , 1 level would need to exceed this thceshold by one foot in ordec ' ! to cause damage to equipment. This assumption was based on the 4 idea that the watec would need to crest well above the dootsill ' 5-45
, 4 elevation in order to supply sufficient water for enough time to fill the lower plant cooms. In addition, the safe shutdown pump, diesel generatocs, and other safety related equipment located at elevation 595 feet would need to be submerged in about one foot of standing water in order to cause failure.
Although the initial plant's structural design was based on a water level of elevation 590 feet, the plant structural integrity can be maintained to a flood level of 603 feet by flooding the plant to match the civer elevation. Since flooding of the plant building is planned if water ceaches - plant grade, and a water level of 596 feet asl is assumed to be necessary to damage equipment, then the fcequency of flooding to 596 feet is defined as the frequency of the initiating event. Flooding in excess of this level was calculated to occur with a frequency of 9.8E-7/yc. It was conservatively assumed that a flood of this level would fail sufficient pumps, electric powec supplies, and terminal boxes to lead to core melt. Thocefore, the probability of coce melt is defined as 9.8E-7/c-yc. Extceme Wind. In general, most safety-celated equipment is I contained within and protected by concrete structures which are at.least 12 inches thick. It was assumed that such walls provide adequate pcotection against toenado missiles. However, openings in the ateucturas for doocs, blockoucs, air intakes and exhaust stacks were found to be vulnerable aceas for such ' missiles. Wind pressuce effects were considered for the diesel generator aic intake and exhaust stacks, condensate stocage tanks and the 310 foot concrete chimney. The important components vulnecable to high winds have been assessed to fail at winds of 350 mph. The single exception is the 310 foot chimney stack which would fail at appcoximately 250 mph but would have only a .07 pcobability of falling on the 4 kV buses which would cesult in loss of all AC power to Unit i loads since both offsite and diesel genecatoc powee flow thcough these buses. The only comaining power would be the DC battery supply to the HPCI and RCIC pumps until battery depletion in 4 houts. The frequency of 250 mph wind was estimated to be negligible for stcaight winds and 5.0E-6/yc for tornado winds. The cecovecy action of crossconnecting to the Unit 2 battecy supplies in the 4 houca is estimated to be highly likely (i.e., nontecovecy is 0.01). Therefoce, the contribution to coce melt due to the chimney falling on the 4 kV buses would be equal to: (frequency of 250 mph wind) (probability of chimney hitting the 4 kV buses) (probability of nontecovecy within 4 hours) = (5.0E-6)(.07)(.01) = 3.5E-9/c-yc. Coce melt could also be the result of multiple system failuces caused by winds in excess of 350 mph. At this speed, the CSTs fail and cavitation of the HPCI and RCIC pumps would probably occur. In addition, the swing diesel genecatoc and DG #1 intake 5-46
and exhaust stacks would collapse and fail the diesels. Failure of all emecgency AC power and the CSTs would lead to core melt - in about 30 mi'nutes. The HPCI and RCIC are consideced to be nonrecoverable because the pumps are assumed to cavitate. The nonrecovery probability of offsite power in 30 minutes is estimated to be 0.8. This results in a coce melt probability calculated as follows: Core melt probability = (frequency of 350 mph winds) (conditional probability of failure of both CSTs and both DGs) (probability of nonrecovery of offsite power in 30 minutes) Core melt probability = (1.65E-7)(1.0)(.8) = 1.32E-7/c-yr. The contribution to core melt probability from wind generated missiles is much smaller since the missiles must hit both CSTs (2.96E-4) and collapse the intake or exhaust of both diesel genecators (3.8E-6). These cumulative probabilities must be multiplied by the frequency of high winds (1,04E-3/yr) and can be seen to be exceedingly small. Victually the entice core melt probability contribution from high winds, then, is due to component failure at wind speeds of 350 mph. The total coce melt probability is calculated to be 1.35E-7/c-yc if recovery of offsite power is included. Lichtnino. Using the U.S. Meteocological Services chact of thunderstorm days in the United States for Quad Cities, it is estimated that the site would expect approximately 48 thunderstocm days each year (T). The correlations foc ground flashes (Ng) foc the northern U.S. derived by Horn and Ramsey is Ng = 0.11(T). This coccelation predicts 5.28 gcound flashes km-2yc-1 for the Quad Cities region. It is assumed, based on available data, that the plant was designed according to NRC cecommendations that the plant be able to withstand a lightning stcike of 200 kA. The probability of excoedance of this current is taken to be 0.01. Therefoce, the probability of lightning strikes in the Quad Cities cegion which will exceed the design basis is estimated to be (5.3)K(0.01) = .053/km2yc. The Quad Cities site will be conservatively estimated to be 1/4 square kilometer in size. Two units share the two DC batteries so that failuce of the batteries will lead to core melt, The scenacio where both DC power trains fail due to candom oc common mode failuces is part of the internal arialysis. Here the postulated transient involves either two lightning strikes hitting the DC buses or battecies, oc a single lightning strike disabling one DC train while the other train candomly fails. These sequence pcobabilties ace calculated as follows: 5-47
Core melt frequency =T[(Ef)(A)(PkA)I hit)] (NR) + T[(Ey)(A)(PkA}I hit)]( R)(Ry) where T = 48 thunderstorm days /yr Ng = (5.3 ground flashes /km2yr)
'A = 0.15 km2 PkA = 0.01 Phit = 0.1 NR = 0'.1 Because the battery chargets are not sized to handle the emer-gency DC loads without the battecies being available, random failure of a DC power train would require failure of the battery alone (1.3E-2). Failuce of the battery due to test and main-tenance is a negligible contribution (8.0E-5). Additionally, the DC bus could fail with a fac smaller probability of 3.0E-5.
The calculation for random failure of a DC train of powce, then, is as follows: R1= (DC battery) + (DC bus failure) + '(DC battery test'and maintenance)
= 1.3E-2 + 3E-5 + S.0E-5
= 1.3E-2 The probability of core melt is then calculated to bo Core melt =
T((Ef)(A)(PkA}IEhit)] (NR) + T((Ef)(A)(PkA)(Phit)) (NR)(Rg )
= 48((6'3)(.25)(.01)(.1)]2 g,1) .
48(( 8)(.25)(.01)(.1)1(.1)(1.3E-2)
= 3.7E-9 + 1.73E-6 = 1.73E-6/c-yc Summacy. The special emecgency analyses (exclusive of sabotage) for Quad Cities are summarized as tollows:
5-48
Initiatina Event o(cm)_Ipor r-vr) Vulnerable Area / Component Seismic 8.3E-5 Battery Racks, 4160 VAC Buses Fire 1.3E-5 Control Room / Cable Spreading Room i Internal Flood -- -- l External Flood 9.8E-7 Reactor and Turbine Bldge i Extreme Wind 1.4E-7 CSTs and DG Stacks Lightning 1.7E-6 DC Power Train 5.3.2 Example Plant F - Cooper 16 Seismic. An earthquake may initiate a core melt scenario by causing one of the following plant states: a small loss of coolant accident (S2), a loss of offsite power transient (T 1), or a reactor trip with offsite power available (T 2)- While the probability of a small LOCA or a luss of offsite power increases as the earthquake level increases, the probability of a T2 transient will decrease accordingly. The safe shutdown earthquake for Coopor has an acceleration of 0.2 g PGA, however TAP A-45 is examining the vulnerability of decay heat removal systems to initiating events which see beyond the design basis. Therefore, probabilities of seismically induced core melt were calculated for earthquakes in the ranges of .5-1 SSE, 1-2 SSE, 2-3 SSE, 3-4 SSE, and 4-5 SSE. For the Cooper site, the frequency of earthquakes of these magnitudes are estimated to be: . SSE Lovel PGA Rance Precuency/vr
.5-1 0.1-0.2 g 5.8E-3 1-2 0.2-0.4 g ) lE-3 2-3 0.4-0.6 g 1.38-4 3-4 0.6-0.8 g 2.8E-5 4-5 0.8-1.0 g 9.5E-6 Since all of the plant aystems feel the effects of an earthquake, the quantification of core melt scenarios involves calculating component fragilities for the various earthquake levels and using these values in the fault trees developed in the internal analyses. Table 5.7 summarizes the probability of each of the seismically induced accident sequences summed across all earth-quake levels. The total core melt probability is calculated to be approximately 8.1E-5 per e-yr.
Several safety-related items of equipment were found to have vulnerabilities during earthquakes near or greater than the SSE. The significant vulnerability is the common mode failure of the 125 VDC batteries leading to failure of all emergency coolant injection systems. This is evidenced in sequence T1D. A second vulnerability involves common mode failures of diesel 5-49
Table 5.7 Sequence Core Melt Probabilities Summed
- Over All Earthquake Magnitudes -
Baco Case - Cooper Probability of Core Melt Sequence (Der f-Year) SZ 7.15-7 SZE 2.91E-6 SD 3.99E-6 T1YZ 8.24E-6 T1YZE 2.27E-5 T1D 3.14E.5 T2YZ 6.19E-6 T2YZE 2.32E-6 T2D 2.88E-6 8.14E-5 l l I s-So
generators oc failures of one battery and one diesel generator leading to failures of containment cooling and long-term coolant injection. This situation is cettected in sequence TlYZE. Multiple failures of unlike components ace also cesponsible for loss of containment cooling and injection as evidenced in sequence TlYZ. The seismic contribution to p(cm) is dominated by failuces in the 1-3 SSE range (69%) with the single major contributor being the early failure of injection, sequence T1D (39%). Fice. Using the transient event trees, it was determined that the systems required for safe shutdown following a fire initiated transient may include main feedwater, the reactor core isolation cooling (RCIC), High Pressure Coolant Injection (HPCI), Coce Spray, Automatic Depcessucization, and the Residual Heat Removal system (RHR). critical support systems include the diesel generators (DGs), normal power, and Reactor Building Service and Closed Cooling Water Systems. An analysis of each fire zone foc critical systems which would be vulnecable to fire is detailed in Refecence 16, Apendix D. The only area found to be important is described below. All power cables in the Cable Expansion Room (CER) are enclosed in steel conduit, preventing those cables from contributing fuel to a fire and pceventing the cables from acting as ignition sources. Redundant power and I & C circuits run thcough this room. The powet cables aco cequired as pact of the temote shutdown opecations, indicating that their failure would cender the primacy cemote shutdown path useless. In pacticular, these powet ciccuits could cause a loss of HPCI, RCIC, and SWS. Loss of service water also implies a loss of RHR heat exchanger cooling, RHR coom cooling, RHR motor cooling, drywell fan coolers, and CS coom cooling. , A set of COMPBRN calculations indicate that damage to cedundant ! cables could occur from the acetone fice, but not from the , trash fire, Damage from the acetone fire would occcc in about l five minutes, with hot layer effects causing damage to all cables in the room. The hot layer tempecature is pcedicted to coach 631*C (1167'F), sufficient to damage all of the cables in the coom. Since this room is similar to the Cable Spreading Room (CSR), generic CSU fire frequency data is scaled to the CER based on floor area. The genetic probability of a CSR fire is 6.7E-03/c-yc. The Cable Expansion Room is about 1/10 the area of the CSR and thus the fire frequency is taken as (0.1) x (6.7E-03) = 6.7E-04/c-yc. A watec suppression system is installed in the CER, the genetic unreliability of this system is 0.04/ demand. In the event of automatic suppression system failuce, manual suppcession may still succeed. The genocic 5-51 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ i
i , probability of non-suppcession in five minutes (the time to I damage of cedundant trains) is O.4/ demand. , i Because the postulated fire can cause dassge to all cables in this room, no credit can be given for the remote shutdown since the remote shutdown power cables Are run through this coon. l This scenacio casults in a core melt probability of 1.1E-05/c-yr of operation. Internal Flood. No areas were identified at Coopec Nuclear Station which are vulnecable to internal-flood-induced core damage accidents with a probability of greater than 1.0E-06/c-yr. Much of the active safe shutdown equipment is located in individual concrete-walled rooms in the lowest floor of the coactor building. Electrical distribution equipment is located in individual areas which have significant drainage paths available in the immediate vicinity of the areas. Finally, the control coon is protected by its location, its continuous manning, and drain paths immediately outside the area. External Flood. The principal cause of flooding in the acea is the Missouci Rivec. Historically, the vocst floods have occucced in the spring and summer months, the cowult of snow melt oc a combination of snow melt and rain. At elevations susceptible to the effects of external (11oding. plant structures are constructed of ceinforced concrete. There j are no watectight extecioc doors oc tempocacy or permant.'t i flood bacclecs designed to prevent flow into the contcot ac Reactor Buildings should flooding occur. The majority of the safety-celated equipment items needed for decay heat c o mo ?.'1 ace located in the Control Tucbine and Reactoc Buildings. A levee was constructed along the west bank of the Missouci Rivec which was designed to prevent flooding to elevation 902 feet. Safety-celated equipment which is pact of the shutdown decay heat comoval system is located in the Control Building, Reactoc l Building, Intake Stcuctuce, and the Diesel Generator Building. Equipment items located within buildings vary in theic degree of flood pcotection. The Control Room, for example, is located at elevation 932.5 feet asi. Other components such as the ' secvice water pumps, diesel generators, batteries, and switchgear ace located at the ground flooc at elevation 903.5 feet mal. Doors leading to these rooms are not watectight. Mechanical components such as the HPCI pumps, the RHR pumps, and containment spray pumps are located at the lower elevations of the Reactor Building. These items are located in cooms with watectight doors, howevec, their design was based mainly on intecnal flood scenacios. Thus, pcotection against external flood soucces is not assuced. In the event that a major flood is expected, emecgency operation proceduces (EOP) exist to construct temporary flood protection 5-52
devices. The EOP for flood calls for continued surveillance ; and monitoring of river conditions if elevation 895 feet asl is reached and the river level is increasing. If the river level reaches elevation 897 feet asl and continues to rise, exterior barricades are constructed at designated locations at the t Reactot Building, Control Building, Turbine Building, Pumphouse, and Diesel Generator Building defined in the EOP. Interior barricades are also provided as a second line of 1 defense. ; In estimating the fragility of equipment it was assumed that the plant site must be inundated to an elevation of 906.5 feet i mal. This is 3.5 feet above plant grade and 3.0 feet above the clevation of the ground floot in plant structures. It was assumed that the flood barricades must be overtopped by 0.50 feet of water in order to inundate components in the plant. Therefore, it will be conservatively assumed that if the plant was not placed in a safe shutdown condition before the flood reachv0 plant grade, then the flood waters would fail the HPCI, RCIC, RHR, core sp:ay and safe shutdown pumps as well as the diesel generatocs. As a cesult, core melt would occur with the same probability as the frequency of occuccence of a flood of that magnitude. The only significant external flood scenario identified for Cooper was the failure of the Oahe Dam, 540 miles upstream. Based on historic data the icequency of failure of the Oahe Dam is 5.0-5/yeac. The flood from the dam break will exceed plant grade by 13 feet, however 3.5 days warning will be available. This flood level is significantly highet than the maximum flood addressed in the EOps. 'It was conservatively assumed that a flood of this level would fail sufficient equipment, including offsite power, to lead to coce melting. Therefoce, the probability of core melting as a cesult of extecnct flooding is taken as 5.0E-5/c-yc. Extreme Wind. In genecal, most safety-celated equipment is contained within and protected by concrete structures which ace at least 18 inches' thick and in some cases the bacciers ace 36 inches thick. One exception is the diesti generator exhaust stacks which are anchoced to the sides of the Turbine Building. However, each stack can be bypassed through a two-foot thick pcotective enclosure on top of the diesel genecator building in case of damage. All Class I structures at Coopec which contain the safety-related equipment coquired for decay heat comoval are at least 18 inches thick; thus they uece considered adequate to cosist wind hazacd effects. A review shows that adequate protection also has been provided for openings. For example, vents through the control coom coof 5-53
slab ace protected by small 18-inch thick vented concrete enclosure structures which prevent a straight path into the - control room. A door to the outside is generally protected by an 18-inch concrete baccier which prevents a direct path for a missile to entet the building. There ace no tank' clich are outside of the class I buildings which are relied tpor in the event of an accident. The two condensate storage'canks, which are safety-related, are located in the basement area of the Control Building. In contrast to other nuclear powec plants, Coopec has no structures or equipment (except for the diesel generatoc stacks as discussed above) which are vulnerable to *ither toenado missiles oc wind pressuce effects. Consequently, no structural vulnucability analyses vece conducted. Given these conditions extreme wind events at Cooper only contribute to two accident sequences. These accident sequences involve losses of offsite power (assumed in the event of high winds), failuce of diesel generator exhaust stacks and othec component and/oc operator eccots. The probability of occuccence of this initiating event has been estimated to be 1.0E-03/c-yc. These two sequences will now be briefly discussed. Coce melting begins quickly in the ficst sequence becAuae in addition to the loss of offsite power and failuce of the diesel exhaust stacks the opecatocs fail to open the bypass valvos which would prevent the diesels from failing, offsite powee is not recovered and the turbine-dciven injection systems (HPCI and RCIC) both fail as a cesult of candom failuces. In this situation there is no coolant injection to the core and damage begins in approximately one half hour. This scquence has been estimated to have a coce melt probability of 8.0E-00/c-yc of opecation. Tne second sequence is similac to the first except that HPCI and RCIC do not fail immediately, but only aftec the diesels fail and offsite power is not recovered in approximately touc houca. At this time HPCI and RCIC ace assumed to fail because of depletion of the station 125 VDC battecies, loss of coom cooling, oc from othee time-dependent causes. This sequence has been estimated in Appendix G to have a ence melt pcobability of 3.7E-06/c-yr of operation. The total coce ett probability casulting from extcome windo at Cooper is that see e,1timated to be 3.88-06/c-yc. kichtnino. Using the U.S. Meteocological Secvices chact of thundecstocm days in the United States for Coopec, it is estimated that the site would expect appcoximately 50 thunderstocm days each yeac (T:. The coccolations for ground 5-54
flashes (Ng) for the nocr.hcrn U.S. decived oy Horn and Ramsey is Ng =10.11(T). This coccolation predicts - ground flashes - ka-2fg- for the Cooper region. e it is assumed Lased on available data that *he plant was designed according to NRC cecommendations that the plant be able to withstand a lightning strike of 200 kA. The pcobability of 4xceedance of this cuccent is taken to be 0.01. Therefore, the probability of lightning strikes in the Cooper cegion which will excee6 the design basis is estimated to be (5.5)x(0.01) e .055/km2y c. The Cooper site will be conservatively ectimated to be 1/4 squace kilometer in size. The transient event trees developed for Cooper in this progcam show that several independent systems are available to comove decay heat following a transient. The likelihood of candom failure of these multiple trains, after lightning has failed one of them, is mathematically comote. However, electric powec is needed to start and cun pumps, operate valves, and for instrumentation and control. At Cooper there are two diesel generators (DGs). The 125 VDC Bus 1A supplies power to one-half of the ECCS and DGl. The 125 VDC Bus 1B supplies power to the othet one-half of the ECCS and the other diesel generator DG2. Thecefoce, failure of both the 125 VDC Buses 1A and 1B will cesult in core melt, a1suming that a simultaneous loss of offsite power occurs. The postulated transient involves either two lightning strikes hitting 125 VDC Buses 1A and 1B, o r .T single lightning strike disabling one of the 125 VDC Buses while the other 125 VDC Bus fails eithec candomly or its 125 VDC battery that powers it is unavailable. These sequence probabilities are calculated as follows: Coce melt frequency T((Ef)(A)(PkA)(Phit)) (NR) + T((Ey)(A)(PkA)(Phit)](NR)(Ry ) where T = 50 thunderstocm days /yr Ng = 5.5 ground flashes /km2yr A = 0.25 km2 PkA = 0.01 Phit = 0.1 NR = 0.1 The second 125 VDC Bus fails either candomly due to shocts or by the 125 VDC battery that powers it being unavailable. The battery is unavailable either by candom failure oc due battery test and maintenance. The failure of the 125 VDC Bus is calculated then as follows: 5-55
R1 = (DC battery) + (DC bus failure) + (DC battery test and maintenance)
= 1.30-2 + 3E-5 + 8.0E-5
= 1.3E-2 The probability of core melt is then calculated to be Core melt =T[(Ef)(A)(PkA)(Phit)) (NR) +
T((Ef)(A)(PkA)(Phit)) (NR)(Rg ) g 4,g) ,
=50((Eh)(.25)(.01)(.1))2 50((Ejf)(.25)(.01)(.1))(.1)(1.3E-2)
= 3.4E-8 + 1.79E-6 m 1.82E-6/r-yr I Summary. The special emergency analyses (exclusive of sabotage) for Cooper are summarized as follows:
- Initiatino Event ofcm) (Der r-vr) Vulnerable Area / Component ,
Seismic 8.lE-5 125/250 VDC 3WGR CST, XFMR, HTEX , Fire 1.1E-5 Cable Expansion Room Internal Flood -- -- - External Flood 5.0E-5 Control & Reactor Bldgs. ' Extreme Wind 3.8E-6 DG Exhaust Stacks Lightning 1.8E-6 DC Power Train 1 5.3.3 Comparison of Results - BNR As with the PWRs, the special emergency analyses for BWRs l 1 exhibit some differences between plants, but also significant ; vimilarities. This is not surprising since the two units are , very similar and they are both located in the midwest. The l cesults for the two plants are summarized on Tabla 5.8. The contribution to p(cm) from special emergencies only varies l by about 50% between the two units and this is directly : attributable to the contribution from external floods which is l signifiantly h! 3er at Cooper based upon the conservative analysis. Ar e4 the case with PWRs, the seismic vulnerabili-l, ties can be vficed with relatively straightforward measures to improve equinheht anchorage. Both plants have some remaining i fire vulnerab.lities, but they are minor contributors to the probability of core melt. l i 5-56
- _ - . - _ _ ._ - . .- - ___ _ = _ _ - _ _ _ _ _ - - - _
1 Table 5.8 Summary of Special lusergency Analysos - BWR Plants P(en) (Der reactor-Year) Vulnerable Area / Component E E K L Seismic 8.3E-5 8.1E-5 Battery Racks 125/250 VDC SWGR
, 4160 VAC Buses CST, XFMRs, HTEX Fire 1.3E-5 1.1E-5 Control Room Cable Expansion Cable Spreading Room Room Internal -- -- -- --
i Flood a j External 9.8E-7 5.0E-5 Reactor & Turbine Control & Reactor Flood Bldgs Bldgs ! Extreme 1.4E-7 3.8E-6 CSTs & DC Stacks DG Exhaust Stac)r1 Wind I l Lightning 1.7E-6 1.8E-6 DC Power Train DC Power Train 9.83E-5 1.48E-4 1 i ) 1 ) e T l I 1 5-57
5.4 Discussion of Overall Special Emercency Event Results A comparison of the results on Tables 5.5 and 5.8 indicates that the special emergency contribution to the probability does not vary dramatically over the six plants studied. As would be , expected the 4 inland plants (A, D, E & F) which have a reasonable proximity to the New Madrid quake zone exhibit the higher seismic vulnerability. For the PWRs the failure of water sources is a major consideration, while electrical system failures dominate for the BWRs. For both types of plants the remaining fire vulnerabilities are related to areas where control and instrumentation cables for redundant trains are co-located, usually in the cable spreading room, although for Plants A and F other areas are of interest. Internal flooding does not play a role in core melt events except at one plant and in that case it could be dealt with in a straightforward - manner. External floods are of some concern at two sites (B l and F), but again there are straightforward remedies. Extreme , winde pose some threat to DG exhaust stacks at several of the plants, but again there appear to be relatively simple changes to eliminate the problem. Finally, lightning, although it has some potential for affecting the DC power system, is not a
' major factor.
I 1 I l 5-58
6.0 ALTERNATIVE DEFINITION AND INTEGRATION Numerous potential vulnerabilities were identified during the internal and special emergency analyses as described in Sections 4 and 5. These vulnerabilities (V) are summarized on a plant-by-plant basis on Tables 6.1 through 6.6 along with the modifica-tions (M) proposed to reduce or eliminate the vulnerability. In many instances potential vulnerabilities are listed although their absolute magnitude may seem relatively low. This occurs because vulnerabilities which contributed to the dominant accident sequences were identified, but for some plants the individual dominant accident sequences make relatively small contributions. It also should be emphasized that even though these particular vulnerabilities were identified using probabil-istic type analyses, the overall diversity of modifications is such that many potential difficulties that might otherwise be anvisioned are also covered. It will be noted that, a.s has been the experience in most risk assessments, it is failures in the support systems (e.g., electrical power, service water), not front line systems, which cause the majority of the problems. While modifications were defined or suggested for many of the vulnerabilities identified, only a limited number were carried into the value-impact analysis. Available resources did not permit a full probabilistic treatment of the value (core melt reduction potential) of each possible modification independently. Therefore, in each case study the range of potential modifications was reviewed and various modifications were assembled into groups labeled alternatives. These alternatives were then evaluated to establish the change in core melt probability p(cm) if the alternative were implemented. It is recognized that this approach does not provide as much detail as would be provided by treating each modification individually. Furthermore, it does not examine the effect of changing the order of modification. That is, is a particular modification more or less effective in reducing the probability of core melt if it is done before, or after, some other modifi-cation. However, it is believed ' hat the spectrum of alterna-tives covered does include sufficient diversity that effective measures of value-impact can be developed and that the results provide necessary insights for the development of generic solu-tions to decay heat removal concerns. The alternatives examined for each of the plants are defined on Tables 6.7 through 6.12. It will be noticed that in most instances it was considered appropriate to address special emergency vulnerabilities in the alternatives, especially seismic and fire, even when internal vulnerabilities were not. The rationale for this approach is evident in Table 9.1 which summarizes the contributions to core melt from internal event and special emergencies. As noted in Section 9.1, special emergencies are often the doiainant contributors. 6-1 ms
f In order to provide a more complete spectrum of alternatives for the improvement of decay heat removal, one alternative for
- each plant is an add-on dedicated decay heat removal system. 1 For PWRs, this shutdown decay heat removal (SDHR) system is defined as one train of primary coolant injection and one train of auxiliary feedwater. For BWRs the system is called the alternate residual heat removal (ARHd) system and includes one train of low or high pressure injection (depends upon configuration) and one train of suppression pool cooling, i These systems are self-contained and independent of other plant systems. These alternatives are described in more detail in Section 7 and Appendix C.
! + i 1 I i I l i I 6-2
Table 6.1 Potential Vulnerabilities and Proposed Modifications for Example Plant A - Point Beach ,
- 1. V. Failure to switchever from injection to recirculation.
M. Add a more prominant alarm warning that switchover from injection to recirculation is required.
- 2. V. Station blackout due to battery failure (early).
M. Install dedicated startup batteries to each diesel generator to eliminate dependence on statAon batteries.
- 3. V. Station blackout due to diesel, oc uerator failures.
M. Install a turbine-driven generator to supply vita'l AC and DC loads.
- 4. V. Failure of ECC recirculation due to loss of RHR pump cooling cause by valve failure.
M. Install parallel manual valve on RHR component cooling water line and check once'per shift.
- 5. V. Failure of ECC injection due to CCWS failure caused by loss of cooling from SWS through the CCW heat exchanger.
M. None proposed.
- 6. V. Common mode failure of safety system pumps.
M. None proposed.
- 7. V. Common mode failure of safety system valves.
M. Included in modification 8.
- 8. V. Failure of the LPIS in recirculation mode.
M. Install third independent low pressure train with additional suction line to sump and cross ties to existing trains.
- 9. V. Failure of the AFWS turbine-driven pump.
M. Install independent diesel driven AFW pump in parallel. sharing suction and discharge lines.
- 10. V. Failure of the'CCW pumps.
M. None proposed.
- 11. V. Long term station blackout caused by depletion of the station batteries or the condensate storage tank.
M. Same as modification 3 plus an additional 270.000 gal, shared CST.
- 12. V. Loss of HPI and LPI due to failure of the RWST under seismic conditions.
M. Provide alternate source of water from spent fuel pool via new pumps and piping. 6-3
Table 6.1 (cont.)
- 13. V.
Loss of DC power due to failure of battery racks and chargers under seismic loads. M. Provide additional anchorage of electrical components and upgrade battery racks.
- 14. V. Failure of PORVs to function under seismic loads due to <
failure of air system. M. Install Safety Class 3 gas storage bottles with appropriate control to enhance ability to depressurize. I 15. V. Failure of redundant trains of service water due to l fires in vicinity of cables routed through AFW pump l room. < M. Install automatic water suppression system of the dry l pipe, preaction type. Waterproof components. , i
- 16. V. Loss of redundant cooling systems due to fire in the 4160 switchgear room. t l M. Relocate main battery distribution bus including inverter and charger to another zone to insure power to AFW.
- 17. V. Failure of service water system due to spray on pumps from ruptured fire main.
M. Install shield wall to prevent water from reaching pumps.
- 18. V. Loss of redundant trains of cooling due to flooding in 1 service water pumphouse, turbine and auxiliary buildings.
M. None proposed due to low contribution to probability of , i core melt, i
- 4
- 19. V. Failure of diesel generator exhaust stacks oue to {
extreme winds. , M. None proposed due to requirement for other random i failures in AFW for this to be a significant contributor. 6
- 20. V. Failure of a DC bus due to lightning strike.
M. None proposed due to small contribution from this i source. l l h 6-4
~
Table 6.2 Potential Vulnerabilities and Proposed Modifications for Example Plant B - Turkey Point,
- 1. V. Common mode failure of the low pressure injection (LPI) pumps. ,
M. None proposed due to undefined nature of common mode l failures. '
- 2. V. Local fault of one LPI pump and unavailability of the ;
other due to test and maintenance. l M. None proposed. !
- 3. V. Local fault of one high pressure injection (HPI) pump with test or maintenance unavailability of an HPI MOV.
M. None proposed. :
- 4. V. Local fault of safety injection signal actuation train A.
M. No physical acdifications, recovery actions based on l procedures. ; j 5. V. Unavailability of AFW pump B due to test or maintenance ! following a failure of DC bus. ' M. None proposed. Technical specifications are being developed for use of standby feedwater pumps as AFW I backup.
- 6. V. Local faults of both LPI pumps.
M. None proposed.
- 7. V. Local fault of AFW pump B following failure of DC bus.
, M. See vulnerability 5.
- 8. V. Common mode failure of the component cooling water pumps. l
! M. None proposed due to undefined nature of common mode l failures. ;
l 1 9. V. Common mode failure of the service water pumps. ! M. None propos1d due to undefined nature of common mode t
; failures. !
i
- 10. V. '3ervice water diversion due to failure of isolation i valve. ;
M. Installation of second valve in series with signal from 4 separate SIS train. l
- 11. V. Long term station blackout. l M. Technical specification revisions for use of startup l t feedwater pumps and non-safety diesels will extend time, j
- 12. V. Common mode battery failure.
M. None proposed. See vulnerability 11. 4 6-5 , t
l I Table 6.2 (cont.) 1
- 13. V. Local fault of AFW steam supply valve following loss '
of DC bus. M. See vulnerability 11.
- 14. V. Loss of cooling due to failure of RWST and CST from seismic event.
M. Provide additional external bracing for RWST and CST.
. 15. V. Loss of cooling due to failure of component cooling water heat exchanger in a seismic event. i M. Provide additional seismic-rated supports for heat exchanger.
lo. V. Loss of redundant trains of cooling due to fire in cable spreading room. M. Install automatic dry pipe preaction water suppression system and waterproof cabinets.
- 17. V. Loss of cooling due to failure of diesel generators, f,uel oil transfer and AFW pumps from flooding event.
M. Extend floodwall to a four foot height.
- 18. V. Loss of cooling due to collapse of chimney onto diesel generators, CST or 480 V switchgear under extreme winds.
M. Provide guide wires to direct fall in event o', failure.
- 19. V. Loss of DC bus due to lightning.
M. None proposed due to relatively low contribution. 6-6
Table 6.3 Potential Vulnerabilities and Proposed Modifications for Example Plant C - St. Lucie ,
- 1. V. Common mode failure of the batteries.
M. None proposed, however it is recommended that procedures be in place for use of non-safety batteries to power safety loads or that diesel generators be capable of hand crank starting.
- 2. V. Common mode failure of the component cooling water pumps.
M. None proposed due to the undefined nature of the common mode failures.
- 3. V. Local fault failtires of containment sump recirculation MOVs.
M. None proposed due to relatively low contribution.
- 4. V. Common mode failure of the diesel generators combined with local failure of the turbine-driven AFW pump. ;
M. None proposed *due to relatively low contribution. However timely AC power from Unit 2 would be a beneficial feature. , 5.*V. Local t' allures of the two diesel generators combined with local failure of the turbine-driven AFW pump. M. See vulnerability 4.
- 6. V. Local fault of diesel generator 1A combined with local failure of DC battery 1B.
M. None proposed due to relat'ively low contribution. ; however locking open selected MOVs and providing DC power from another bus would add diversity to turbine-driven AFW train.
- 7. V. Common mode failure of the intake cooling water pumps.
M. None proposed due to undefined nature of common mode failures.
- 8. V. Local fault of diesel generator lA with test and ;
maintenance unavailability of 125 V battery 1B. l M. See vulnerability 6.
- 9. V. Common mode failure of the' safety injection system logic due to test or maintenance errors.
M. None proposed due to relatively low contribution.
- 10. V. Common mode failure of the recirculation actuation signal logic due to test or maintenance error.
M. None proposed at this time due to relatively low , contribution. t 6-7
Table 6.3 (cont.)
- 11. V.
Loss of AFW and HPI/LPI systems due to failure of CST and RWSt from a seismic event. . M. Provide external bracing to RWST, provide spaced braces ! between CST and surrounding missile shield wall.
- 12. V. Loss of emergency cooling due to cable spreading room fire.
M. Provide a 3M wrap for train B cable trays.
- 13. V. Loss of AFW, ICW, and CCW pumps due to flooding.
M. None proposed. ;
- 14. V. Loss of long term emergency power due to failure of diesel oil storage tanks in extreme wind.
M. None proposed due to relatively low contribution.
- 15. V. Loss of DC bus due to lightning.
M. None proposed due to relatively low contribution, j r I
- l l
t i 6-8
! Table 6.4 Potential Vulnerabilities and Proposed Modifications for Example Plant D - ANO-1 .
- 1. V. Failure of the emergency feedwater system turbine-driven pump coupled with other safety system failures.
M. Reconfigure the auxiliary feedwater motor-driven pumps to be connected directly to CST and operate off Class 1E I power. ,
- 2. V. Common mode failures of valves in various safety systems.
M. None proposed due to undefined nature of common mode j failures.
- 3. V. Common mode failures of safety system pumps.
M. None proposed due to undefined nature of common mode failures, i 4. V. Diesel generator local fault and common mode failures i coupled with failure of EFW turbine-driven pump. M. Same as modification 1.
- 5. V. Battery local fault and common mode failures.
M. Install a turbine-driven generator to provide vital AC and DC and instrumentation and control for EFW l I turbine-driven system, 1
- 6. V.
2 Failure of low pressure injection pumps. M. Install third low pressure pump to the existing pumps. ! 7. V. Failure to manually initiate feed and bleed or high I l pressure recirculation. { M. Improve operator awareness of manual operations. , l emphasize in-training. t 4 8. V. Failure of single manual valve for BWST or BWST valves
- leading to safety system trains, t
) M. Add parallel discharge valves in the BWST and to ( connecting safety systems.
- 9. V. Failure of EFWS and HPIS due to failure of BWST and CST ,
from seismic event, l i M. Add external wall bracing to existing tank. f i 10. V. Loss of LPIS and HPIS due to electrical bus failures ! i from seismic events, i
- M. Provide additional anchorage for 4160 V buses. 480 V l l transformer buses and MCCs in switchgear room.
I 11. V. Loss of redundant safety trains due to fire in cable
- spreading room.
- M. Install redundant deluge valve controlled by.an i l
additional sensing system. ( l ! i l j 6-9 !
Table 6.4 (cont.)
- 12. V. Loss of redundant cooling trains due to flooding in turbine and auxiliary buildings.
M. None proposed.
- 13. V. Loss of emergency electric &1 power due to failure of diesel generator exhaust stacks in extreme winds.
M. Provide added structural steel supports for each stack.
- 14. V. Loss of DC buses due to lightning.
M. None proposed due to low contribution from this source. 6-10
Table 6.5 Potential Vulnerabilities and Proposed, Modification for Example Plant E - Quad Cities .
- 1. V. Loss of emergency power due to local faults of two diesel generators.
M. Add a fourth diesel generator.
- 2. V. Loss of emergency power due to failure of diesel generator field flashing.
M. Add a dedicated 125 VDC battery to one diesel generator.
- 3. V. Loss of emergency power due to diesel cooling water ,
system failures. M. Install an additional diesel generator cooling water pump. I
- 4. V. Loss of cooling due to failure of 125 DC breaker control power to ECCS components.
M. Provide for automatic transfer of ECCS control logic and circuit breaker DC power loads.
- 5. V. Loss of emergency cooling'due to fire in control room.
M. Provide additional procedures for use of safe shutdown 4 pump. ) 6. V. Failure of emergency DC power due to loss of batteries in a seismic event. M. Install metal battery racks with appropriate wall and i floor anchors, i
- 7. V. Failure of emergency AC power due to loss of 4160 buses in seismic event.
M. Add seismic restraints at tops of bus cabinets. ;
- 8. V. Loss of cooling due to flooding in reactor and turbine buildings. -
l M. None proposed due to low contribution from this source. , . 9. V. Loss of emergency AC power due to collapse of chimney in [
! extreme winds. ! ! M. None proposed due to relatively 1o9 contributions from this source.. ,
- 10. V. Loss of emergency cooling due to failure of diesel generator exhaust stacks and CST in extreme winds.
M. None proposed due to relatively low contribution from I this source. i
- 11. V. Loss of DC power train due to lightning.
M. None proposed due to relatively low contribution from ! this source. 1 i 6-11
4 Table 6.6 Potential Vulnerabilities and Proposed Modifications for Rxample Plant F - Cooper , ! i
- 1. V. Loss of emergency AC power due to local faults of two diesel generators.
! M. Add a third diesel generator.
1
- 2. V. Loss of emergency AC power due to loss of 125 VDC power l l division. .
I M. Add a dedicated battery to one diesel generator for ! start and field flashing. !
- 3. V. Loss of emergency power due to loss of 125 VDC powet [
division. : M. Provide an additional 125 V station battery which can be 1 aligned to either train.
] 4. V. Loss of emergency cooling due to failure of RBCCW valves !
to open. ! , M. Provide a parallel bypass line with manual valves. I j i i 5. V. Loss of emergency cooling due to flow diversion when i i RBCCW valves fail to close. 7 M. Add a second MOV in series to insure isolation of { non-critical cooling loads, i
- 6. V. Loss of emergency cooling due to flow diversion when (
- RBSW valve fails to close.
M. Provide an MOV with automatic closure for one valve 4 currently manually operated.
- r i i
. 7. V. Loss of redundant trains of emergency cooling due to j l fire in cable expansion room. t l M. Provide separate 1-hour fire barrier around HPCI and ( ) RBSW power cables, & f
- 8. V. Loss of emergency cooling due to seismic induced j failures, j
! a. loss of RBCCW due to failure of heat exchanger mounts : . b. loss of 125 and 250 VDC power due to switchgear 4 + tripping over
! c. loss of RCTC due to failure of RCIC alni-flow valve l d. loss of water supply due to failure of CST ,
'l
- e. loss of 400 VAC due to failure of station !
I transformers i M. Reduce contribution from seismic event by: ! j a. welding heat exchanger connection i j b. providing additional floor anchors to 125/250 VDC l j switchgear [
- c. install support to reduce valve motion !
l d. provide additional anchor bolts for CST i l e. Provide additional floor anchorage to prevent motion. [ l I
- l c
6-12 I i
- u. _ _ _ . _ .__ _. . . _ _ . _ _ . _ ..- .. -_
Table 6.6 (cont.) ;
- 9. V. Loss of emergency cooling due to flooding in control !
and .eactor buildings. M. Modify external flood emergency operating procedures. , l
- 10. V. Loss of emergency power due to failure of diesel '
exhaust stacks under extreme w'.nd. M. None proposed. , d
- 11. V. Loss of a DC power train due to lightning.
M. None proposed. l H I
, i l
r 1 I 4 i l 4 4 } i I 1 } 6-13
l l 1 Table 6.7 Detinition of Alternatives Evaluated Example Plant A - Point Beach , i
' Modifications Included ITable 6.11 Alter- ,
natives 1 2 4 6 9 11 12 13 14 15 16 17 SDHR 1 1 X X X X X X X X 2 X X X X X X X X X X 3 1 X X X X X X X X X X X 4 , K r Table 6.8 Definition of Alternative Evaluated Example Plant B - Turkey Point Modifications Included fTable 6.21 Alter- , natives 14 15 16 17 SDH2 1 1 1 K X X 2 K Table 6.9 Definition of Alternatives Evaluated Example Plant C - St. Lucie i Modifications Included fTable 6.31 [ Altec- t natives 11 12 SDHR ! l x x 2 X i I
- r i
i i 6-14 ; J !
Table 6.10 Definition of Alternatives Evaluated Example Plant D - ANO-1 . Modifications Included fTable 6.41 Alter-natives 1 4 5 6 8 9 10 11 13 SDHR 1 X X X X X X X X X 2 X , Table 6.11 Detinition of Alternatives Evaluated Example Plant E - Quad Cities Modifications Includ?d fTable 6.b1 Alter-natives 1 2 3 4 5 6 7 ARRR
- i j 1 X X 2 X X X
- 3 X X X X X 4 X X X X X X
.; 5 X Table 6.12 Detinition of Alternatives Evaluated Example Plant F - Cooper Modifications Included fTable 6.61 Alter-natives 1 2 3 4 5 6 7 8 9 ARRR 1 X X X X X X X 2 1 X X X X X X 3 X X X X X X X
, 4 X X X X X X 5 I i
i ' 6-15
7.0 DEDICATED DECAY HEAT REMOVAL SYSTEMS 7.1 Pressurized Water Reactors The add-on dedicated shutdown decay heat removal (SDHR) system suggested for PWRs is a single train of high pressure makeup l water and a single train of energency feedwater with dedicated power and water sources. This type system was selected based upon results from eactier NRC studies (Reference 17) and upon the belief that forced or natural circulation throuth the steam generators provides the most effective path for decay heat removal from the core. Such a system is also consintent with much of the current European practice (Reference 18). The SDHR system is a backup system designed to provide emergency core cooling in the unlikely event of a failure of the existing safety systems during a small LOCA or transient. Core cooling is accomplished by injection of emergency feedwater into the steam generators and release of steam via dedicated atmospheric dump valves. Natural circulation in the l reactor coolant loops insures flow and heat removal in the core. The reactor coolant system pressure is maintained above i saturation pressure by the use of one group of pressurizer heaters in conjunction with the alternate makeup system. t offsite power will be used when available, otherwise the add-on system is completely independent of the plant systems. The system consists of a high pressure emergency feedwater type J pump, a high pressure makwup pump, a storage tank for borated water, a storage tank for feedwater, and the required piping, valving, instruments, and controls for initiation, monitoring j and operation of the system. This system is automatically actuated given failure of the primary systems. The structures and connections to the existing system are designed to seismic Category I specifications. A simplified piping and instrumen-tation diagram for the SDHR is shown in Figure 7.1. A complete - descriptiJn of this system can be found in Refecence 17 and in
! Appendix C.
l There are other options for a SDHR system. It could have two
. trains of completely independent feedwater and primary makeup; it could be housed in a bunkered (i.e., highly reinforced) l .
structure; or there could be redundant active components coupled with a single train of piping and tankage. A single i train system, housed in a Seismic ! structure, was selected for several reasons. First, the Seismic 1 structure is then comparable with the structures (containments) housing the systems to be protected. Based upon the simplified reliability analysis described in Appendix C, the single train add-on i failure cate is .052 or 0.098 per demand, depending upon whether or not offsite power is available. A two train system ) would have failure rates of 2.7E-3 to 9.6E-3. However, this reliability is only achieved at substantially increased cost. l Because the add-on is considered a "last ditch" or final resort 7-1
,l jl l
- g' 3/
8 85 89 2 - 6 R r Ce
^
- /r Cu Eg e
t I i a 7 g' Q UF N e6 h tp W c1 n-0 ef wi O . f
. i O e2 r
iU W-1 N ee f g ea nk e 5 O RP Oa XL O ~ t e m - s i 2 XL d de M l Ar S u ds es 9 xL O a t N % 2 N te ar cP i 5 dh eg 3 N 2 1 N 1 N Di l n I B 3 I g 8 I r I g B g , g I i 3 ,' ,,I ei$ I , i I g s ' od
- 2 fn a
, 6?
1 2 c ir te at ma 6& 5 1
& 1 2
hd ew ce Se P dey 5 m 4 1
= 0 2
ic fn ie l g
- pr 3 4 O me 4
xt o p a m i 1 D L e in SD pP m m U rgg g a
) ee p0 1
C ,,Mw2 ,
=t0 4 a0 vip 1wa0m f e 2 7 s e e r r u 3
xO L 2 1 xto f t o r e i F g n I 1 1 : n o- s f a s 2 ?: i.. 1
; t.
d se At e
"w#00 T0 s S0 ey F 0, C o, rS T0 To t
- c. s L2 1 Lo wew A1 xO L A2
\
t. e s i i t
% loa Pt
/
)
,z
measure and becauae it provides approximately a 90% reduction in p(co) a single train system was considered adequate. 7.2 Boilina Water Reactq11 The first alternate residual heat removal (ARHR) system proposed for BWRs was a single train of low pressure makeup and suppression pool cooling. As with PWRs. this system was selected based upon previous NRC sponsored workl7 as well as an understanding of current European practice.18 l As originally envisioned in Reference 17 the alternate l residual heat removal (ARHR) system was to provide emergency residual heat removal capability for anticipated transients and small LOCAs independent of all other plant systems. The original ARHR design was to include a combination of automatic' depressurization low pressure coolant injection and residual heat removal functions. In addition, the ARHR system would automatically actuate on low reactor vessel water level and continue to operate without operator intervention for a period of 10 hours. In order to perform the low pressure coolant injection function immediately after a scram, the briginal ARHR concept proved to be too large to be retrofitted into an existing plant. Accordingly, the concept was revised in Reference 17 to take credit for reactor core isolation cooling (RCIC) system operation during the first two hours following a scram. By designing the ARHR system to begin functioning two hours after scram, the size of its components and piping was substantially reduced. Unfortunately, requiring successful RCIC system operation for two hours prior to ARHR system operation reduces the beneficial effects of the add-on cystem. A full-sized ARHR system would reduce the probability of core melt for all internal and special emergency sequences while a scaled-down ARHR system would only affect those accident sequences in which RCIC (or some other ECCS pump) succeeds for at least two hours. Despite this disadvantage, the two-hour delayed operation was selected in Reference 17 and also in this current t ady as the design basis for purposes of evaluating the value and impact of the ARHR system for the Quad Cities Case Study. Subsequently, an ARHR without the RCIC dependency was investigated in the Cooper Case Study. The RCIC dependency is removed by the addition of a high pressure pump as shown in Figure 7.2. The ARHR system shown in Figure 7.2 consists of a low pressure coolant injection pump, high pressure injection pump, a residual heat removal heat exchanger, an independent service water system. diesel generator and required piping, v41ving, instrumentation and controls for automatic initiation and control of the system. The flow rate of the ARHR pump was 7-3 _ _ _ _ _ __ - - - - - - - - - - _ _ _ - - - - I
l 1
\
L f E s e e w m e o t t s
" y w S I
l a v
. o
@T."'s59 A' m e
s R Se Sa sr M Ew t Pr a c
,' A' wse an La aa cm r
pas I I l a l1 u d i s
&e s W
O R e L F n a sE e
- t o oI
- w -
l L e d sc sac 8 pE es d 8 8 lI eL A nd t 8 mcL ot - ' 2 p d 7 f - e p t i v e r mr ( ' C E J u g M e i IEru E MuP F a nst s R eto eam QL E V Fpa 1J 2 2 2 t r o p F 4 A U W: a o 1 1ll ji
based on the rete required to handle the decay heat load fron l the core immediately after a reactor trip due to a transient or 1 small LOCA and to cool the suppression pool from approximately 4 [ 170*F to 140*F in 10 hours. The flow is delivered at a pressure consistent with reactor pressure conditions existing , at actuation. The ARNR system is housed in two separate, l Seismic Category I structures. The ARHR pump, valves, ! j instrumentation and controls are powered from a dedicated. l l Class lE bus which receives offsite power directly from the j i switchyard. In the event of a loss of offsite power, a , dedicated emergency diesel generator will start and provide I power for the system. ; r Other options for the ARHR do exist. It could have independent j i redundant trains (high and low pressure, service water, power), 1 it could be housed in a bunkered structure, or there could be l 1 redundant active components but single teams of piping and ['
- tankage. A single train system housed in a Seismic 1 structure was selected for several reasons. As was the case with PWRs. l
!l using a Seismic 1 structure makes the system comparable with l l' the reactor systems it is designed to protect. The simplified i reliability analysis described in Appendix C indicates that the , i unavailability of this system is dependent upon the initiating ' ) event, as well as the function being performed, i.e., ci-ly ) injection or late time supprossion pool cooling. Howet r, in l all cases the single train ptovides for 90% reduction . i p(cm). Because the ARHR is viewed as a last resort meat 1re to existing plant systems the single train was considered adequate. ? 7,3 Other Decay Heat Removal Alternatives I Euring the course of the USI A-45 studies several concepts were 1 proposed for removing decay heat. One of these proposed by Reed and Flack 19 relates to PWRs the other for BWRs is based upon concepts proposed for the standardized design GESSAR. 7.3.1 Primary Blowdown for Enhanced Core Cooling of PWRs Figure 7.3 depicts a closed loop dedicated primary blowdown system (DPBS). In essence the system consists of:
- hot leg and pressurizer blowdown lines with control valves
- a blowdown flash tank with a side arm cooler
- a condensate return pump
- a heat exchanger
- cold leg return lines
- supporting power services and ultimate heat sink water supply The DPBS components may be enclosed in "pill box" like structures outside containment to provide protection against sabotage. fire and other external events. As shown in Figure 7.3, 0111 box 1 (near containment building) would house thu 7-5
lg I!!f!_i! e s m m sssx v m u sssxssss
\ " ! h0-k! ! j !! I ; r :3a s e O [$d N ci r 1, i, ,j s
{
=
s i v l-l 19n [ , s 3 i g s i i s ,. men s , s a s ; i i s ili E s .! s - - s s -
~' c ts I i ; ll ls -
,r==O
- 11 r s
j s I i I,. s a i s ,. b '
- g] e s I s ,, ,
l_ i 3"_ _. _ _t[ ,. _____ q, ' s s e e s 5 , lf , b s s . O , ) s d v s us uu- u s, c?xxxxxxxxxxx x "g x , xx xxxx xxxxxxxxxxxxxxxxxT m s pif s l s I s 8 g Wd W'X Vd j j a----- 1 _____., 15 s s Ei 55 25 c. ;
.}e c.t, p -- g s N (,(-------' ______.o g s s WM(Wp(V% _g }S s s \
c rp s 14(V N s w. s s - [ --D s , s g.l g is, ; s s b itE .
\
' a{l El 3
*G
. 5 \
7-6
radioactive DPBS components. Fill box 2, located near the main heat sink, would contain support equipment including a , dedicated diesel capable of supplying all PRS loads. This concept was not analysed as part of the Case Studies. However, additional descr1ptions, including a preliminary reliability estimate and costs are included in Appendix C. 7.3.2 Ultimate Plant Protection System for SWRs . A number of groups (e.g. the Advisory Committee on Reactor Safeguards) have expressed interest in the DHR systen being considered by General Electric in their standardized plant design (GESSAR). This system is called the Ultimate Plant Protection System (UPPS) and wouldt
- 1. Provide an independent means to depressurite the reactor vessel.
- 2. Provide low pressure coolant injection from existing diesel-driven tire protection systen pumps and/or through a connection that enables a hook-up to a fire truck, and
- 3. Provide long-tera heat removal by venting the containment.
The UPPS is designed to be used during an extended station blackout. It is composed of diesel-driven fire pumps, fire trucks, or other pumping capability outside containment linked with a system of piping which will remotely depressurite the reactor and permit core cooling for an indefinite time. A diagraa.of the UPPS appears in Piquee 7.4 (Reference 20). No conventional controls. AC power, DC power, or other systems would be required for UPPS operation. Some remarks are in order regarding how the UPPS compares to the ARHR systen evaluated in the Case Studies. The UPPS is primarily designed for station blackout accidents. It is not specifically designed for special emergencies such as seismic events, tires and tioods although it is certainly possible that there could be some benefit for these energencies. The ARHR system is designed to withstand some special energencies (the dependence on RCIC operation limits the ARHR system capability against special energencies). The UPPS would be a manually actuated and controlled system which may introduce the possibility of operator error. The . ARHR design automatically actuates and would not need operator actions tot a period of to hours. The UPPS is designed to be totally independent tros existing AC and DC powc: systems and the energency core cooling systems. The ARHR design described in the Quad Cities study would depend 7-7
J N i I P lili,!!,i - E Ir X-l \ *\ll 1,1,l\ , il Il - s E o ll
- E m
j i ,_ __ __ _y _ . ,[ i
~
p u i L$ d L JL I I t o l t in . I
' Y i *
(' l Hni : l , 5 i ., .,
" m .
I a - btI 1 i is\ / T3i! s g\t ., l i
\ _
) i E
l l ,,
+: : +;i e i
l 1 1 I o. O vgf rf S b II r W I,s I ir lAI 1:2 i i 7-3 i
on successful RCIC or ECCS operation for a period of two hours after scram. This makes the ARHR system somewhat less attractive for mitigating accidents involving proinnged loss of > offsite and DC power system faults. However, in the TAP A-45 studies the ARHR design is also independent of existing plant systems but it does use a conventional diesel generator as the emergency AC backup source. The UPPS is incorporated into the standardized G1neral Electric Mark 111 containment BWR/6 design. Incorporating a system such
. as the UPPS into the initial design will certainly have coat-and implementation advantages. However, for the BWRs being analyzed for TAP A-45, the advantages of UPPS over any other DHR system are not as clear. First, most current BWRs have beer, in operation fo' many years. It is unlikely that a UPPS could be as efficiently integrated into the existing plant design as dono in the GESSAR. It is likely that a UPPS would have to be housed in a separate structure similar to the ARHR i eystem design. This would lessen any cost advantages the UPPS may have over the ARRR system. Furthermore, the older reactor designs and containments may not be as conducive to an UPPS as the GESSAR design. A limited cost assessment of UPPS as a back-fit measure is included in Appendix C. however a complete value-impact assessment has not been completed.
The UPPS relies or. containment venting for long-term heat ) removal whereas the ARHR system incorporates a heat exchanger and service water line to provide suppression pool cooling. The UPPS in this respect has definite cost advantages over the ARHR system. It should be noted that the UPPS design presumes l that the suppression pool effectively scrubs the particulate l fission products regardless of the pool temperature. There is i some disagreement with this presumption by people working in l the area of radiological source terms, however, the [ decontamination factor for suppression pool scrubbing is an i extremely strong function of tne aerosol !' article di6 meter which can only be quoted with large error bars. [ It is estimated that the unavailability of the UPPS would be similar to that for the ARHR system (approximately 0.1 per demand) not counting possible operator errors or failure modes associated with special emergencies. 7-9
l l 8.0 ALTERNATIVE IMPACT ANALYSIS
- j The impact analysis for each plant addresses the alternatives j identified in Section 6.0 which consist of various combinations -
of potential plant modifications including a dedicated shutdown ! decay heat removal system. Each of the modifications are first l considered separately, then combined to account for potential interactions between modifications during construction such as scheduling or accessibility conflicts. These combinations are called alternatives. 8.1 Methodoloav and Apocoach 8.1.1 Objectives The objectives of the impact assessment wece to determine the potential impacts resulting from the implementation of each a l t e r na t . .ve . These are:
- 1) Cost of equipment and installation of the modifications included in a specific alternative in 1985 dollars,
- 2) Cost of replacement power, if required, in order to implement an alternative in 1985 dollars,
- 3) Cost of subsequent annual operation, maintenance, and in-service inspectione that would be associated with the alternative in 1985 dollars, and
- 4) Radiation exposure involved in the installation of the alternative in person-tem.
It was also desired to obtain potential yearly changes to occupational cadiation exposure due to the alternatives and ceplacement power costs if the alternatives would affect the normal outige times. These two impacts may be positive oc negative theoretically, however, they were both judged to be negligible for the plants otudied. 8.1.2 Approach Given the vulnerabilities and modifications identified in the internal and special emergency analyses and the proposed alter-natives, initial design reports were prepared on each modifica-tion. These reports described the proposed design, interfaces with other systems and structuces, the scope of work to be pectormed including bill of matecials and rip-o cequ. red, and majoc constcuction activities. The preliminary uesign was done based upon drawings such as building layouts and piping and instrumentation drawings that were obtained prior to the plant visit and the experience of the architectural engineet from previous similar act ivities. After this initial design stage, 7 a site inspection plan was prepared for each modification. 8-1
This identified the specific areas to be visited and questions to be asked in order to properly estimate the impact of the , alternatives if they were installed in a given plant. The next step was a plant visit to verify the design and to collect further information to estimate costs relative to such factors as congestion, access, feasibility of equipment locations, and radiation levels. The plant visit is essential and in many instances numecous improvements were made to the proposed modifications during or as a result of the visit. Details that would be effectively impossible to obtain from the available wcitten material were obtained by observation and discussions with knowledgeable plant personnel. Using the information collected during the site visit to improve the initial design, a final design was accomplished for each modification. Costs and radiation exposuces associated with implementing the designs were then estimated using standard industry practices to produce the impact analysis. Details of the specific designs and costs are reported in Appendix J of References 11 through 16. . 8.2 Results The cesults for the various plants are based on a set of economic ground rules and assumptions shown in Table 8.1 for both generic and local factors such as labor cates, ceplacement power costs per day, cemaining economic life of the plant, ownec's costs, and contingencies. The details of these factors are described in the case studies. However, one example is owner's costs which consider factors such as cettaining operatoes, health physics, quality assurance, ceview of contcactor design, interaction with the NRC, and preparation of proceduce and manual changes. Much of the detail available in the case studies is provided for completeness of the impact estimates and possible use in any follow-on analyses. The basic information needed for the value-impact analyses is summarized in Table 8.2 using the local basis costs which is consistent with the use of local values in the value-impact analysis. The value-impact analysis vaciables shown in Table 8.2 (i.e., I t, 13, and V3) ceflect the fact that occupational dose is treated as a negative value cather than as a positive impact. Furthermore, the yearly occupational radiation dose (V4 ) is also treated as a negative value but is considered to be negligible in the estimates f,oc most of the alternatives. Similacly, the yeacly replacement power costs (14) are generally considered to be negligible. Thus, Table 8.3 contains the necessary information to perform the value-impact analysis. Although the local cost basis was used in the value-impact 8-2
analysis, it is interesting to note the ratio of the generic
- to local engineering and installation costs which are shown in
- Table 8.3. This illustrates that across the range of plants considered, the local costs were generally somewhat lower than the generic values. This would suggest that an analysis which used the generic values would provide a modestly conservative estimate of costs except perhaps for plants located in the Northeast.
1 h
- The "generic" costs represent a data base maintained and used by the architect-engineer referenced to an Eastern Pennsylvania site; but it in no way implies an average or representative site.
8-3
Table 8.1 Economic Ground Rules and Assumptions For Impact Analyses PARAMETER CENERIC LOCAL
- 1. Plant Location Eastern Southern iJorthern Northeast Northwest Southeast Penna. Florida Wisconsin Arkansas Illinois Nebraska
- 2. Remaining Economic Life (yrs) 19 yrs 18 yrs 16 yrs 22 yrs 18 yrs 19 yrs
- 3. Inflation Rate (1) 6 6 6 6 6 6
- 4. Discount Rate (1) 10.5 10 11.5 10 11.8 8.75
- 5. Fixed Charge Rate (%) 17.0 16.5 18.6 16 16.5 8.75
- 6. O&M Levelization Factor 1.47 1.57/1.63 1.46 1.69 1.54 1.63 a3 7. Replacement Power Costs 550(1) 584 240 4?3 430 159 1 ($/tW(e) - Day)
- 8. Average Refueling Shutdown Length (Days):
PWR 60 60 60 60 - - BWR 70 -- - -- 70 70
- 9. O&M Labor Rate ($/Hr)(2) 22.60 20.61 19.80 16.02 16.10 15.82 1
1
- 10. O&M Labor / Materials Ratio 40/60 ^
J 40/60 40/60 40/60 40/60
- 11. Owner's Costs (%) 10 10 10 10 10 10
- 12. Contingency (1) 25 25 25 25 25 25 Note: (1) MAAC Power Pool Average (2) Includes employer's social security and -
workmen's compensation contributions .
Table 8.2 Impact Analysis Results Engineering and Operation and Occupational Dose Installation Costs Maintenance Costs During Installation in 1985 Dollars in 1985 Dollars (person-rem) ($ x 10-6) (3 x 10-6) Plant / Alter-native I* 1 I*2 V*3 Plant A 2 7.42 0.011 17 2 14.4 0.037 17 3 22.5 0.171 27 4 59. 0.379 486 Plant B 1 4.79 0.0 0 2 74.5 0.480 20 Plant C 1 0.88 0.015 0 2 53.8 0.348 20 Plant D 1 14.3 0.080 0 2 54.7 0.353 20 Plant E 1 15.2 0.097 0 2 5.82
- 0.004 0 3 15.3 0.097 0 4 5.89 0.004 0 5 82.4 0.528 1200 6 83.9 0.528 1200 Plant F 1 22.7 0.119 0 2 3.10 0.007 0 3 3.04 0.007 0 4 2.43 0.002 0 [
5 64.1 0.418 1000
*I,I2 t and V3 are variables in the'value-impact analysis. I 8-5
Table 8.3 Generic / Local Cost Ratios Plant / Alternative 19neric/ Local Cost Ratio Plant A 1 1.20 2 1.25 3 1.25 4 1.11 Plant B 1 1.15 2 1.09 ! t Plant C 1 1.14 2 1.11 Plant D 1 1.13 2 1.08 1 ^ ' Plant E 1 1.07 2 1.17 3 1.07 4 1.17 5 1.08 Plant F 1 1.10 4 2 1.20 3 1.19 4 1.22 5 1.15 a I' O i '1 I' s-6 i
- - - - ~ _ . . - _ - - . _ - - - _ - . _ , . . . _ . . . . _ _ , . . - _ _ _ _ - - _ _ _ _ _ _ _ - - - , . - - - - - . - . _ , - - - - _ - - - - - . . _ . - -
9.0 ALTERNATIVE VALUE ANALYSES This section summacizes: 1) the core melt probabilities and public cisk estimates foc the base case before any suggested modificationo are applied, and 2) the estimated improvements resulting from the implementation of the various alternatives; i.e., the combination of modifications described earlier. 9.1 Coce Melt Probabilitites The core melt probability p(cm) is the sum of the probabilities from the internal analysis and each of the special emergencies except for sabotage which, as noted, is not yet clearly quantifiable. For the case studies reported hece the intecnal and special emergency analyses are essentially independent although thers are impact dependencies. The details of the analyses are reported in the case studies (References 11 through 16). Each topic is covered in the same section oc appendix as noted below. Topic . Case study Sec_ tion Intecnal Sections 2, 7 and Appendix B . 4 Seismic Sections 3.1, 7 and Appendix C Fire Sections 3.2, 7 and Appendix D Internal Flood Sections 3.3, 7 and Appendix E Extecnal Flood Sections 3.4, 7 and Appendix F Extreme Wind Sections 3.5, 7 and Appendix G Lightning Sections 3.6 and 7 The base case analyses for the pressurized water teactors were conducted assuming that the feed and bleed option was available and viable. The analyses for the boiling watec teactors assume that late time suppression pool venting is available and viable. These options are discussed further in 3ection 11. The results f ccm the base case special emecqency atalyses and ' the intecn&1 event analyses are summacized togethet on Table 9.1. It may be observed that in those plants with p(cm)intecnal = 10-4 (A, D, E, and to a lesser extent F), the special emergency and internal events contribute about the same to p(cm) total. On the other hand, when the internal event contribution is less than 10-4 (B and C) the special emergency initiated events are the dominant contributocs. These results confirm the early decision to include special emergencies in the USl A-45 program. Reviews of the seismic portion of the individual case study analyses suggested that the contribution from seismic might be low by factors of 2 to 5 because median values wece used tot some data cather than mean values. A d.etailed examination of the analysis for Plant C indicates that the seismic contcibution would be 3.9E-5/c-yr cathec than the 1.3E-5/c-yc repotted 9-1
Table 9.1 Summary of Calculated Core Melt Probabilities - Internal Event and Special Emergency Analyses Event / Plant & B C D E F Seismic 6.1E-5 7.3E-6* 1.3E-5 7.3E-5 8.3E-5 8.1E-5 Fire 3.3E-5 7.5E-5 4.4E-5 5.80-6 1. 3 E-5 1.1E-5 Internal Flood 7.7E-5 -- -- -- -- -- External Flood 1.9E-8 4.6E-5 3.2E-6 7.2E-6 9.8E-7 5.0E-5 Extreme Wind 4.0E-6 2.4E-5 -- 5.3E-6 1.4E-7 3.88-6 Lightning 5.8E-8 2.6E-6 2.0E-7 1.8E-7 1.7E-6 1.8E-6 Total Special 1.74E-4 1.55E-4 6.04E-5 9.15E-5 9.79E-5 1.48E-4 Emergency Internal 1.39d-4 7.1E-5 1.4E-5 8.8E-5 9.9E-5 2.83E-4 Total 3.13E-4 2.26E-4 7.44E-5 1.79E-4 1.97E-4 4.37E-4
% Contribution:
Internal 44 31 19 49 50 66 Special Emergency 56 69 81 51 50 34
- This value results from a re-estimation of the seismic induce,*. probability of core melt. It is approximately 50% loiter than the value used in the value-impact analysis. However, the vulnerabilities are the same and the total core melt probability only differs by about 5%. Therefore the ;
subsequent analyses were not revised. t 9-2
if the calculations were revised. Even if such an' adjustment (factor 3) were made to al), the seismic results, there would be-no subatantial change in the results. The total p(cm) would increi.se by 5% to 85% based upon current estimates of p(cm) depending upon the plant, but the nature of the vulnerabilities would remain unchanged.- The alternative probabilities are determined from the combina-tion of internal and special emergency modifications included in that alternative. For convenience only the total p(cm) is presented on Table 9.2 The value analysis for each modifica-tion is found in the applicable appendix of the case studies. The effects of the various altsrnatives may be viewed in several ways. One would be to compare the new estimate with some pre-defined standard. The second is simply to examine the relative improvement over the base situation. In general it may be noted that those alternatives which address relatively spr.cific issues provide reduction factors of 1.2 to 5.9, or stated another way, the new p(cm) is 17 to 86% of the original. The independent add-on decay heat removal systems provide significantly more reduction for all cases with reduction factors of 12.3 to 19.7 for the completely independent systems or a p(cm) with a single train add-on that is only 5 to 8 percent of the original. Further conclusions are discussed in Section 14. 9.2 Public Ris'. Estimates In past PRAs a variety of public risk measures were used (e.g., early deaths, early injuries, latent deaths, property damage). The principal risk measure used in this analysis is the offsite dose resulting from the release of radioactive material to the atmosphere and subsequent dispersion out to a radius of 50 miles from the plant site. (The measure of value will be the amount of offsite dose averted by a given alternative.) All other values (positive or negative) are considered in the impact analysis. 9.2.1 Base Case Estimates - PWR The base case estimate of the public risk measure (population done) is computed from the base case probabilities for each accident sequence including containment systems, the containment failure mode probabilities and release category assignments, and the consequences for each release category.
- 'he
. containment failure mode (CFM) probabilities and release categ;ry assignments for each type containment systems sequence are summarized in Table 9.3 for the PWRs studied (large dry containments).
An wxample of intermediate results is shown in Table 9.4 using data from Plant B. Example results are also characterized by dominant accident sequence in Table 9.5 in a format similar to that used in past PRAs, e.g., WASH 1400 and RSSMAP. Similar 9-3
Table 9.2 Summary of Probabilistic Core Melt Estimates Change in Probability of Probability of Factor of Core Melt, p(cm) Core Melt, Ap(cm) Improvement i Plant / Alternative (per e-year) (per e-year) from Base Case Plant A Base Case 3.13E-4 1 9.7E-5 2.16E-4 3.2 2 6.3E-5 2.51E-4 5.0 . 3 5.4E-5 2.60E-4 5.9 L 4 2.2E-5 2.92E-4 14.6 Plant B Base Case 2.36E-4* 1 1.23E-4 1.13E-4 1.9 2 1.6E-5 2.20E-4 14.9 P'lant C Base Case 7.5E-5 1 3.31-5 4.1E-5 2.2 l 2 4.9E-6 6.9E-5 15.3 Plant D Base Case' 1.79E-4 1 5.1E-5 1.28E-4 2.9 2 1.5E-5 1.65E-4 12.3 Plant E Base Case i.97E-4 1 1.39E-4 5.8E-5 1.4 2 1.70E-4 2.7E-5 1.2 3 1.23E-4 7.4E-5 1.6 4 1.06E-4 9.1E-5 1.9 5 9.0E-5 1.07E-4 2.2 6 1.0E-5 1.87E-4 19.7 , Plant F Base Case 4.38E-4 1 1.36E-4 3.02E-4 3.2 2 1.42E-4 2.96E-4 3.1 3 1.75E-4 2.63E-4 2.5 4 1.79E-4 2.59E-4 2.4 5 3.4E-5 4.04E-4 12.9
- This value is approximatmly 5% higher than that reported on Table 9.1; see footnote to Table 9.1.
9-4
Table 9.3 PWR Accident Sequence to Release Category Mapping Contain- Special Containment Failure Mode with ment Conditions Probability and Release C.2tecocy Systems Sequence Core Melt a a Y,6, 6g c 20 P, lE-4 2E-3 1.4E-2 1.8E-1 2.5E-1 2 1 5 3 5 7 gg IE-4 2E-3 1.4E-2 1.8E-1 2.5E i 20 F, 1 5 3 4 6 2 gg lE-4 2E-3 1.4E-2 1.8E-1 2.5E-1 1 4 2 3 6
~
lE-4 2E-3 1.4E-2 1.8E-1 2.5E 1 2 1 4 2 3 6 ZC P, lE-4 2E-3 1.4E-2 1.8E-1 2.5E-1 2 1 5 3 5 7 lE-4 2E-3 1.4E-2 1.8E-1 2.5E-1 EM 1 5 3 4 6 ZC F' 2 gg lE-4 2E-3 1.4E-2 1.8E-1 2.5E-1 1 4 2 3 6 lE-4 2E-3 1.4E-2 1.8E-1 2.5E-1 2 1 4 2 3 6 The exact definition of the containment sequence varies foc the PWRs depending upon the system success criteria. See Appendix B, References 11 thcough 14. EM E early coce melt, LM E late coce melt. 9-5
e
*ab&e 9.4 raample same Ca se deae. Cnt e,w y es*59' A"*L*
ecciBeet WC 1 BC 2 WC 3 PC 4 BC S eC 6 eC 7 We Free. Demse Pss In. hee tsub. saw.te p s ee, >=le Pree, seu.te Psett. pende Proth, stinSe Prots, Isr"TsunAL-E F* E rse) 8.223-4 e 8.22y-te y,4 1.143-7 a 1.64E-4 g g ( 2.86E-6 2 3arrgassAL-5E F*f BA) 3. Sea-S e 3.%er-9 y,4, 4.9er-7 dg 6.les-6 e 7 eer-e a e.75a-6 IsrrrasaharE r*drmt 2.S*r-4 e 2.%9r-te y,4 3.6 3r-e Sg 4.668-7 e S let-9 C 6.4er-7
~
IsrrasseAL-EC 1.ler-5 e 4.ter-9 y,4 8.54a-7 4g I .Wu-6 a 2.2er-e g 2.7%E-6 a srrassias.-Ef* t errEshAL-E F* d B18 4 4 .789 e 4.7er- E l y,4e 6.Ser-Et & S.44R-le a 9.4ey-82 g 1.183-9 4 InrryssaAL-W y S.26h e 4.M-9 y,4_ l ?w-7 Sg 2.27p-6 e 2. Sly-a g 3 t$r-6 Itasc Trase StaTIoms Starrar -ze, 7.45s-7 e 7 %%E-tt y,4, t.esr-e 4g 1.3Ar-7 e 1.51r-9 g 1.39a-7 FImE - 20 7.46r-S e 7. 4w-9 y,4, t.e4r-6 Og 1.34F-S 4 1.49E -7 g 1.s7R-S C yttaio - EC **'S$
- g 2 **'$' $I7 4 **I#"-' " '**3**
Y* e 4 ' I'l$ Q LaurNetteG - 2c, 2.%%s4 e 2.5%E-te y,4 3.%7r-e 4g 4.S9y-7 e S.33r-9 g 6.383-7 es ts ->zC y 2.425-S e 2.42r-9 y,4, 3.39r-7 Og 4.3ent-6 e 4. eda-a a 6.e%E-s EE15seIC - SC h* 1.47E-S e 4.47E-9 y,4e 2.e*R-7
- 2 4g 2.6%E-6 C 3.6eE-6 SKIsse1C - SC 2
1.S4E-7 e B.54r-Et y,4e 2.B6E-%' 4 2.772-e a B. Set-13 g 3.35R-8 4 SElsselc - 302 f* 8.eer-e e R.eer-12 y,4 1.4er-se e dg 1.ter-9 g 2. Set-9 SEISsEIC - N F'(F1a) 1.64E-e es t.ser-12 y.4 2.24r-te 4g 2.ser-9 e 1.2er-It g 4.049-9 EFisseIc - EC, R.m%r-4 e 4.e%r-te y,4 1.19r-e 4 '.317-7 a 3.7er-9 'g 4.633- 7 ftPrata 2. 3%r-aB 2.93r-6 3.8)r-5 S.Ber-7 4.15r-6 S.3er-S 5.74m-6
- feta d e ts an Fleet B, Defeeomre B2
T.ue 9.s . ,1. 8 . - 8 e .. 4 sr.<t. --8 c . I3 i., i. c.. t .
.ri ,..,c m n. irs 1 2 3 4 % l 6 l 7 s, s, ,;-r -. s p ,;-r -v.4 , s,,#.,;-r-4, s p ,;-r -. s, f. s p ,;-r -. s,mo,,-.
Soc. i.9.-, ,.=-7 3.=-. 3.. -. 2. -i. 4. -. 2.s.-. + s p ,;-c e s e ,;-c,-v.4 sp ;-c,-4, s p i;-c e s p ,2-4, s p ,;-c a-< s,==p i.7.-in 2. -9 3.in-. 3.4 ,-i. i. -. 4.3.-. i.=-, sp,e s e ,,-c,-v.4 , spi,-v. 4,, sp,,-r -4, s p , p -. sp,p -.
- i. -in v.s.-. i . =-9 a. -7 2. -9 2.s.-7 .
sp,p s,no,3 .c,-1.4, s,no,f r -v 4, sp,g-. s p o,-. s, ,,-4 f.
- i. -l. i...-, i . =-. i.i.-. i.i.-9 a.4.-.
s p .-c ,-. s,==,-se,-1.4 s p i p ,-4 , sp,per spa,-4, s p a c e,-.
- s. =-i. 3.i.- , i...-. i.e.-. 9.s.-. i. -. .
sp,per s p ,,-se,-4 , spo,.sep a p .,-se p 1.2.-i. s.3.-. 4.4.-i. s.s . sp s p o,-1.4, s.3.-Il 7.4.-9
. sy mme '8C -e s 2 s2 "**t'2'01 6 2.2.-il 4..r-.
E g Tg T gt.24
- gNER-EC 2 'I*4e L MB'I'4e T1etB'F*'4 1 7 atB'e 1
T 1 KB'P'~s TL .2-.
> Teamsteur 2.2.-12 . 37-9 3.1r-8. 4. -. 4.4.-11 s.st-. s.S.-9 4 N Y g s.2-r*-e Tg n 7-r**v.4, T gt.2-4 g TgIEER-er*-.
?g88EE-Er*-4 g 2.2.-11 3.1.-9 ..st-1. 4. -9 1.2.-9 O
T gMER-Er*-e T gees-EC -. T gs.2-r*-. 2 ?ge42-2Cg -v 4 , g T gSIB 2-=Cy -. 4.7.-t3 . 6.-t1 1.2.-9 a.4.-1. 1.s.-7 Y gaat.-sc "* 2 T "'#C i 2 t l"t##
- s.9.-It 1.1.-7 9.4.-12 ee 8* T 2
T uut ~* 2 T2 *La'2C2 'I'8e 2t 'I'6e T sut 2
-=C . T Int 2-. T sa 'sC '
2 2 T Ht 's 2 T m.Isut s.Ra-11 1.2.-9 7.t.-9 1.7.-i. i. -9 2.i.-. 1.3.-7
=
7 8EE2-3C -6 3 2 TjnQEr g *-r*-1.4 Tp2-2C y-4g T,MQelj-r*-. g TyB.2-4 g T28 0'eg j-r*-. T 28u0p12""
. . .- i a 2. -. a.s . . , 9.2 s. -7 2.s.-i.
T2 8'U'tt h' "" 2 82 2'I* e 2 th' 1 2 th 2' 2 12' 2 ih 2'"
- 2. -l. 2.sr-1. 3.6r-7 3.6F-11 2. .i2 e.s.-9 '
~
2 12 2 2 32 2'I' e 2 12 2' t 2 12 2' 2 12 1 2 12
~
- 1. -12 . 37-9 3.2.-9 3.2r-9 1. -l. 2.1.-.
T2D*12'* ?2 "C*t [ C2 'I*4e 2"t*I 2'I' e 2 52 2' 2 12' 2 12 2'"
- t. -t3 7.6.-. t.4r-31 1.IF-9 1.7.-t. 1.s.-7 T2 "0*12' ~2 12'# 'I* e 2 82' & [2 12 2
..s ,-ir i.2r-9 a.s ,-. i.47-7 2 12 2 2 12 2' 4 g .
s.9.-Rt 5.1.-7 Ty fEpp g g -e T 8voo gy -scy-4g s.4.-11 9.7.-.
. te f ree. et t B. Defes. ace 8 7
.?
', f= ?
yat r1 1
~ - s g" ; g i g * [4 J Y
~ .
. y . y W ~
$1
- ~ : 9" .~ n?': -L i y" ~ s T
['~s i [ * .T Y
- f. n?
i I
- E"
- Y u~s ~ n ut- T I ;T Yi us a
gagag g g_ ; g' s v e y~agag:iqa
.- e e e satesils c E s ::
gi a a ? \ I . . > , z .. , t, ..e, 1 i -
?4.i4,'~42i.!-4!,;i;yg,
- I, A. 84
. -g~
S t. 5 3~% 1 % - - i, D t i 4 9 I 1 6 u . 3 1 0 = 5 : 1 3 * .
- 9
' * * [ ?
I j 4 9.9 ~.g . . - . 1 . . ~
. t? Ti; i ~ ~i ? '~ T 'd * {t
. a
~
2 vl. .'~ 3 .(~ 3 '2 ~ (thiHT.'o
~4 t '- 3 ? A v'3 7 ,A [? 2ht a EA g %. %
- !' 6 ,~ as 8
~
s a 9
~
g a (, i s~ s 6 i s I 8 a s >s >. i i 2 a 2 i g ha[hi&JhJ iJ b h 3 d 5a W i 61 . .r: , f . 7 .
#.* f~ . i~ *. ,. #, #. .* 1 h' .'.
T, ti ? A7i! ' i ~f$17igi , a V ;~ > .9~ 3 -~> ' ? .' t v's ? { ' h. =.4 a e. a' mx. E,i *H3 i 3?Jr=r t* hI.t'e. ~ :*r*
~ .
e a. e a. z.
~
g* ,.g ,.8*Ed 3. 2 Y,n. c'- :.
- . - - -. - 'g*g~
3* ~ se
- a
. % m.~t - -
I e b e. e s. 4 / s' r/ e' a
- s$ '.
E : h N , 3 , e'
- I y !
. . J
- y .,
.' , '., A
; ; ; 7~ *. ; 4 *. '.
l 7,. ~ - h,
. . . - , . g g?
- t. . ; at '? g'.1"w h' *i ' ~ i .d ?" . =
- . Y:". 4"y? h."y? h,-*!. y. *. H* i
. 6 =
~
- *
- i.
I ~ 4c **.$* h *'. ~5" *.'[= "'. n.
. ~ , -. g ,. g
- E.
- a, ' 4 I*'.
i-s. 0 > l' > G- 3 ( b E 3 d W () w I I~ 5
!. .? ,::~. 7: g. 7,, aY~ ,~.f , i 3 v [2 ?
j ..I ., :: ~ ~ ar .- y,. :: h* 2, e~ : .~2
,~ m. .'m .I ::
.y . , :: H" :.:
e: t s ha,rb: s: e
] - ~ .
,~ 4 (J g.4 fi f ~4n (4 ' , r {-4r '-2J l4lev4j4 l, 4 d j
s , , 4 3: 4(4 -5d !. 25 !" b b b b b s. I 6
> b b b E 3 =8 A
,. d
. 4 i
,- d N
> I p
w t .g l41 j i t saw2As ouravtarNr l 9-8
results are obtained ih each of the PNRs (see References 11 through 14). The release category (RC) probabilities are then combined with the conditional consequences determined using the CRAC2 code for a specific site to obtain the expected population dose in person-rem per reactor year in Table 9.6. In the case studies three values are presented in the Table 9.6 format: an upperbound for purposes of this study which is based upon WASH 1400 type source terms, a central estimate which we have defined as 0.3 times the WASH 1400 source term, and a lower bound which is defined as 0.1 times the WASH 1400 source term. This selection of source terms should not be interpreted as an endorsement of any particular set. The "real" source term may be larger or smaller. These were selected in order to provide some indication of the sensitivity cf these results to variations in the source term. For pu: poses of this summary only the central estimate values are shown for each of the PWRs. Two examples may be useful to show how the calculation was done. First, consider the internal accident sequence S MH{Hj. 2 For this sequence only the ZC F' containment sequence is significant. Its probabil$ty is 1.9E-5, i.e., p(S2 MH{H2 - 2 2 F') = 1.9E-5. This is a late melt sequence resulting from the ECR failure (i.e., H1'H2'). Going to Table 9.3 this falls in the third row of the table where 5 containment failure modes (CFM) are possible. As an illustration consider the most likely CFM which is c with a probability of 2.5E-1 and a celease category 6 (RC6) assignment. Thus, p(S2 MH{Hj - 282 F' - c) = (1.9E-5)*(2.5E-1) = 4.8E-6. This sequence is placed in row 1 (S2 initiating event) column 6 (RC6) in Table 9.5. The initiating event segregation in Table 9.5 is not important for any reason except perhaps to make it easy to locate a sequence. This same procedure is repeated for every significant internal accident sequence. Next consider a seismic special emergency sequence with the associated containment systems sequence ZC2+ Its probability is 1.85E-6, i.e., p(SEISMIC - ZC ) = 1.85E-6, 2 In this case let us consider all the CFMs. These are, p(SEISMIC-ZC2 - a) = (1.85E-6)*(lE-4) = 1.85E-10 RCl, 9-9
Table 9.6 Central Estimate of Offsite Population Dose in Person-Rem for the Base Case (person-tem / reactor-year) Conditional Release Population Dose (PR) Probability of Category Within 50 Miles. D Releaso Category. P DP Plant A 1 6.6E+5 3 0E-8 0.0 2 7.5E+5 4.lE-6 3.2 3 6.2E+5 5.4E-5 33.5 4 2.7E+5 6.4E-7 0.2 5 1.0E+5 7.3E-7 0.1 6 2.2E+4 7.5E-5 1.7 7 1.7E+3 1.1E-6 0.0 38.7 PR Plant B 1 2.2E+6 2.4E-8 0.1 2 2.4E+6 2.9E-6 7.0 3 1.8E+6 3.8E-5 68.9 4 7.5E+5 8.9E-7 0.7 5 2.8E+5 4.2E-6 1.2 6 4.1E+4 5.3E-5 2.2 7 1.3E+4 5.7E-6 0.1 80.2 PR Plant C 1 8.5E+5 7.3E-9 0.0 2 8.6E+5 9.8E-7 0.8 3 6.7E+5 1.3E-5 8.5 4 3.9E+5 1.4E-7 0.1 5 3.6E+5 5.2E-7 0.2 6 3.2E+4 1.8E-5 0.6 7 4.8E+3 7.2E-7 0.0 10.1 PR Plant D ' 1 4.7E+5 1.8E-8 0.0 2 4.9E+5 1.8E-6 0.9 3 3.5E+5 2.3E-5 8.1 4 2.lE+5 5.8E-7 0.1 5 1.2E+5 9.0E-6 0.1 6 2.3E+4 3.lE-5 0.7 7 2.4E+3 1.3E-5 0.0 10.9 PR 9-10
r - p(SEISMIC-ZC 2 - 8) = (1.85E-6)*(2E-3) = 3.70E-9 RC4, p(SEISMIC-ZC 2 ~ T'5e) = (1.85E-6)*(1.4E-2) = 2.59E-8 RC2, p(SEISMIC-ZC2 - Sg) = (1.85E-6)*(1.8E-1) = 3.33E-7 RC3, and p(SEISMIC-ZC 2 - c) = (1.85E-6)*(2.5E-1) = 4.63E-7 RC6, Again, the example serves to demonstrate the mapping of sequences into release categories. Actually, each sequence could also be carried on to the population dose but it is easier to combine all the sequences in the release categor,ies. 9.2.2 Alternative Estimates - PWR , The population dose estimates for the alternatives are determined by the same procedure used in the base case. The results are provided in-Section 7.0 of the individual case ' studies. The expected population dose and averted population dose for the central estimpte source term for each alternative for each plant are summarized in Table 9,7. The averted population dose is used in the value-impact analysis discussed in Section 10. 9.2.3 Base Case Estimates - BWR The public risk estimates are computed from the core melt probabilities of each internal and special emergency sequence and the containment failure mode probabilities, release category placements and conditional consequences calculated for each release category using the CRAC2 code as described in Appendix K of the case studies. For BWRs. the first step in this computation is to identify the accident seguence type or category for each internal and external event sequence. Three accident sequence types are defined for BWRs and are presented in Table 9.8 along with the containment failure modes and release category assignments for each accident sequence type. The second step is to sum the core melt probability contributions for each accident type. The next step is to multiply the probabilities for each accident type by their associated containment failure mode probabilities. Then, since eacn containment failure mode maps to a particular radioactive material "release category," the core melt probabilities which contribute to each release category can be summed. These release category probabilities represent the portion of the total core melt frequency which is expected to result in a particular release. It should be noted that the release category probabilities are weighted by the containment failure mode probabilities. The next step is to multiply the release category probabilities with site-specific population doses 9-11
Table 9.7 Expected Values of the Population Dose and Averted Population Dose Within 50 Miles , (person-tem per reactor year) Using Central Estimate Source Tern Expected Alternative Egoulation Dose Averted Dose Plant A Base Case 38.7 - 1 10.8 27.9 2 6.5 32.2 3 5.6 33.1 4 2.6 36.1 Plant B Base Case 80.2 - 1 42.0 38.2 2 5.2 75.0 , Plant C Base Case 10.1 - 1 4.1 6.0 2 0.6 9.5 Plant D Base Case 10.9 - 1 3.3 7.6 2 1.0 9.9 r ? 1 4 1 i r I i I 9-12
Table 9.8 Estimated Containment Failure Modes for BWRs Accident (1) Containment Accident Sequence Sequence Failuce Mode Release (2) Tvoe Identifiers Probability Catecocy
- 1. LOCAs with loss SE a = 1.0E-2 QC-1 of coolant injection SZE 8 = 7.0E-2 QC-2 systems and station SD Y'= 1.8E-1 QC-2 blackout accidents SPE Y = 7.3E-1 QC-3 SPZE 6 - 1.0E-2 QC-4 SPD TYZE TPYZE
- 2. Transients with TYE a = 1.0E-2 QC-1 loss of coolant TD Y'- 2.0E-1 QC-2 injection systems TPYE Y = 7.8E-1 QC-3
! TPD 6 = 1.0E-2 QC-4
- 3. LOCAs and tran- SZ a = 1.0E-2 QC-1 sients with successful SPZ Y'= 2.0E-1 QC-2 injection but no SM Y = 7.9E-1 QC-3 containment heat SV comoval oc suppces- TYZ sion pool bypass TPYZ I
TPV TM Whece, a = containment failure from a steam explosion in the . ceactor vessel, 8 = Containment failuce from a steam explosion in the containment. Y'= Containment failure from overpcessure with celease direct to the atmosphece, ! Y = Containment failure from overpcessure with celease thcough the coactor building, ! 6 - Containment isolation failuce (1) Refec' to Appendix B of References 15 and 16 for a detailed discussion on the specific event trees and accident sequences. (2) These categocies are labeled C-1 thcough C-4 in the Coopec Case Study. l i 9-13
calculated by the CRAC2 code. This gives the expectation value of population dose for each celease category. The final step . is to sum the expectation doses for each category to obtain an overall expectation dose. For the same reasons as outlined for PWRs, thcee source tecms were considered in the analysis and presented in the case studies. Only the central estimate results are summarized hece. Table 9.9 provides an example of the calculation in which each accident sequence type is weighted with the appropriate containment failure mode probability for the base case and.each alternative using the Quad Cities data. Table 9.10 summarizes the centcal estimate of site dose for the BWR I base cases and Table 9.11 summacizes the expected population dose and averted dose for each alternative. It may be noted that even though the conditional population doses for the BWR 4 plants are comparable to those for the PWRs, the expected population doses and averted doses are greater. This arises ] from the fact that the containment failure probabilities for
- the PWRs reflect the concensus of recent industry and NRC sponsored wock that failure probabilities for large dcy containments are much lower than was peeviously believed. Ic contrast, cecent NRC wock on NUREG-1150 still suggests that the Mack 1 containments may have a significant failure probability. Because this is still a subject of discussion the more conservative approach using the Reactoc Safety Study Methods Application Program (RSSMAP) values was retained for the BWRs.
9.3 Non-Ouantifiable values The previous sections have outlined the value of the potential alternatives based upon probabilistic considerations. As was noted earlier, these alternatives wece selected using the systematic pRA appcoach, however the scope of the modifications
- is such that they also pcovide value which is in many cespects non-quantifiable. These potential values include such diverse aceas as
- 1)the overall effect such altecnatives may have on residual risk, 2) the potential effect of at least some of them on some issues such as equipment qualification and fice j (Appendix R), and 3) the possible effects on plant
' availability. Other issues which may well be affected aca cegulatocy stability and decisions as to the need for changes ! to decay heat cemoval coquirements. Of course, the pcimary
- objective of TAP A-45 is, in fact, to evaluate the adequacy of existing cequirements. These vacious areas are discussed furthec in the following subsections.
l 9.3.1 Effects Upon Residual Risk l The total coce melt probability foc the case study plants has not been estimated. The unknown traction of the total core melt probability stems from 1) the scope of the TAP h-45 9-14 l
Table 9.9 Weighted Core Melt Probabilities for Each Accident Sequence Type CORE MELT PROBABILITIES WEIGHTED WITH CONTAINMENT FAILURE MODES: ACCIDENT SEQUENCE TYPE 1 Alternative Base Case 1 2 3 4 5 0 9.3E-07 4.1E-07 8.9E-07 2.4E-07 7.2E-07 3.8E-08 8'6.5E-06 2.9E-06 6.3E-06 1.7E-06 5.0E-06 2.6E-07 7 1.7E-05 7.5E-06 1.6E-05 4.3E-06 1.3E-05 6.8E-07 7 6.8E-05 3.0E-05 6.5E-05* 1.8E-05 5.2E-05 2.7E-06 d 9.3E-07 4.1E-07 8.9E-07 2.4E-07 7.2E-07 3.8E-08 CORE MELT PROBABILITIES WEIGHTED WITH CONTAINMENT ' FAILURE MODES: ACCIDENT SEQUENCE TYPE 2 - Alternative Base Case 1 2 3 4 5 a 8.6E-07 7.9E-07 6.2E-07 3.5E-07 1.9E-07 8.6E-07 7'1. 7 E-0 5 7.9E-07 1.2E-05 7.0E-06 3.7E-06 1.7E-05 76.7E-05 1.6E-05 4.9E-05 2.7E-05 1.5E-05 6.7E-05 6 8.6E-07 6.2E-05 6.2E-07 3.5E-07 1.9E-07 8.6E-07 CORE MELT PROBABILITIES. WEIGHTED WITH CONTAIRMENT FAILURE MODES: ACCIDENT SEQUENCE TYPE 3 Alternative Base Case 1 2 3 4 5 a1.8E-07 1.7E-07 1.7E-07 1.5E-07 1.5E-07 9.6E-09
>'3.5E-06 3.5E-06 3.5E-06 2.9E-06 2.9E-06 1.9E-07 71.4E-05 1.4E,05 1.4E-05 1.2E-05 1.2E-05 7.6E-07 l COMBINED ------- ------- ------- ------- ------- -------
TOTALS 2.0E-04 1.4E-04 1.7E-04 7.4E-05 1.1E-04 9.1E-05 Note: All values are par reactor-year of operation L 9-15
Table 9.10 Central Estimate Offsite Population Dose in Person-rem for the Base Case . (person-rem per reactor year) Conditional Popula-Release tion Dose (PR) Probability of Catecory Within 50 miles (D) Release Catecorv. P DP Plant E QC-1 1.5E+6
- 2.0E-6 3.0 QC-2 1.7E+6 4.4E-5 72.4 QC-3 1.2E+6 1.4E-4 172.3 QC-4 1.7E+5 1.8E-6
- 0.3 248.0 PR Plant F C-1 3.8E+5 4.4E-6 1.6 C-2 4.7E+5 1.0E-4 47.4 C-3 2.9E+5 3.3E-4 95.1 C-4 5.8E+5 4.2E-6 0.2 144.4 PR 9-16
1 Table 9.11 Expected Values of the Population Dose and Averted Population Dose Within 50 Miles (person-rem per reactor year) Using Central Estimate source Tern Expected Averted Alternative Population Dose Dose Plant E Base Case 248.0 1 173.9 74.1 2 214.2 33.8 3 93.1 154.9 4 133.4 114.6 5 113.9 134.2 Plant F Base Case 144.4 1 44.6 99.8 2 47.0 97.4 3 57.6 86.8 4 59.2 85.2 5 11.1 133.3 l 9-17
program, 2) analytical techniques, and 3) general uncertainties associated with plant phenomena. As discussed earlier, large LOCAs, AFWS and other special types of accidents are not considered in TAP A-45. For those events which are quantified there is a threshold of probability that establishes a level below which events ace "not counted". This proceduce is dictated in pact by the capabilities of existing analytical tools. However, many of these "uncounted" events may be affected by the support system vulnecabilities such as are identified here. Therefore, improvements in support systems (e.g., emergency electrical power) would (should) reduce core melt probability even more than is shown here. Furthermore, since modifications often address potential vulnerabilities in suppoct systems, there also can be improvements in the response to other initiating events such as large LOCAs which have not been addressed here. Furthermore, any overall impcovement in safety systems reliability will obviously reduce risk even though it may not be quantified. It should be noted that the add-on system has a significant effect upon residual risk, whatevat the source of that risk. l This beneficial effect arises fcom the fact that the add-on is independent from other planc systems except for the required tie-ins inside containment. Therefore, the add-on is unaffected by any fires or floods which might occur elsewhere in the plant. As noted earliec, the unreliability of the add-on is a function of the availability of offsite powec (OSP), and because this unreliability becomes a multiplicative factor, i.e., it reduces core melt probability. 9.3.2 Effects Upon Equipment Qualification A subject of concecn in many cuccent discussions is equipment qualification, that is, whether the equipment is truly qualified to withstand the enviconments it may experience undet accident conditions. The question acises, for example, if one considecs primacy system feed and bleed options for decay heat cemoval in the PWRs, oc venting of the pcimacy containment for decay heat comoval in the BWRs. It also arises if one considers piping failuces that might till a coom oc compactment with high temperature water oc steam, oc both. Similar concerns have been expressed by some with respect to inadvectant actuation of fire suppression systems that use watec spray. Some of the modifications proposed in the above alternativen do deal with equipment qualification issues. For example, the modifications designed to prevent submergence of pumps and diesels as the result of an external flood insure that the components do not see an enviconment foe which they ace not qualified. In a similac vein, the seismic based modifications which provide additional supports for heat exchangers to strengthen them as well as stronger refueling l water and condensate storage tanks are both intended to improve t system survivability in an earthquake enviconment. The add-on 6 j 9-18
system provides an altecnative approach to dealing with equipment qualification concerns. As noted above, a completely independent train of equipment can be (and is, in this design) isolated from adverse environments that might occur in the vacious plant buildings. Also, the separation into a dedicated building allows more stringent controls to insure that advecse environments are not created within that building. The dedicated system does not solve environmental qualification problems, if they exist, but it does reduce their impact and influence. 9.3.3 Effects Upon Plant Availability All the modifications proposed here have improvement of decay heat cemoval as the goal. It is clear that such modifications could affect in-service plant availability in either a positive (improved) or negative (decreased) manner. A modification which adds equipment to a system could possibly lead to an increase in the spucious scram cate, and thus deccease availability. oc in other situations, the addition of equipment could lead to a situation in which failuce of existing components with a similar function are covered by the added cedundancy oc diversity. Thus, in some situations, plant operation could continue without intectuption, that is, technical specifications would be met while equipment was cepaired rather than having to shut down while the wock was being done. It seems self-evident that if the additional equipment is in the form of a standby system the probability of spucious scrams should be small. Certainly the frequency of those situations for which additional equipment could obviate a plant shutdown would be dependent upon the design of the plant and the nature of the added equipment. 9.3.4 Regulatory Issues It has been suggested that cevisions to decay heat comoval capabilities could cesult in celaxation of cequicements and pechaps contribute to increased cegulatocy stability. These issues should be pursued as pact of the ovecall TAP A-45 pcogram. However, the proper forum oc agency for those evaluations is not as obvious. Certainly the technical analyses beat upon these issues, but they also cequice policy and cequlatory pecspectives which are moce propetly the purview of the NRC. It is also apparent that these issues should not (and perhaps cannot) be cesolved on the basis of only a few plant studies. This question also will be pursued fucthec in subsequent analyses. 9.3.5 Summary of Non-Quantifiable Values Based upon the work to date, it is quite apparent that the modifications being proposed can reduce risks beyond that quantified hece. It is equally obvious that some altecnatives 9-19
such as the independent add-on system provide another means to address equipment qualification issues. The effect of DHR modifications upon plant availability will be plant specific but it is being pursued. Several regulatory issues can also be affected by DHR modifications but definitive discussion l requires added input in terms of plant analyses and NRC regulatory policy. 1 I
- e 1
k i
)
1 i 1 .I l 1 l l I i i l 9-20
* * ,.----___y---._______, , _ ._ , _ _ _ _ _ _ _ _ , _ , _ _ _ . __ _ _ _ , _ _ _ _ _ __
10.0 INTEGRATED VALUE-IMPACT ANALYSIS [ In this section the quantitative value analysis (Section 9.0) and the impact analysis (Section 8.0) see combined to form an i integrated value-impact analysis. Unquantifiables are not l treated in this section but are addressed in various other sections. The goal of this assessment is to provide measures that can be used by the NRC to make decisions on the adequacy of decay heat comoval requirements (11S1 A-45). The methodology foc the value-impact analysis is presented in Appendix L of the case studies. In order to implement the value-impact aralysis and i i illustrate the steps pectocmed, the methodology will be reviewed l bciefly using the Point Beach infocmation as an example. 10.1 Methodolocy 10.1.1 Value and Impact Analysis Variables - l Each of the variables to be used as input in the V-I analysis is l defined in Table 10.1 and chacacterized in several ways. First, J the costs and values may be incuccod one time oc on an annual l basis. All cecuccing costs oc cos.s which might occar at any 1 time during the remaining plant lifetime must be present valued. i The precent wocth factor for Point Beach based upon 23 years j . comaining life is 13.5 at a 5% discount cate, and the other > j plants have similar values. Second, there are positive and negative values and impacts. Foc example, in the case of I4 , and V4 the modifications could result in an increased oc ; decreased value or impact. The modifications could requice 3 additional maintenance resulting in increased cadiation exposure and/or longer. outage peclods and thus more replacement power costs. On the other hand, the modifications could make mainten-ance easier, thus reducing cadiation exposure and/or ceplacement puwee costs. Thir;d , costs oc doses result from either the
- proposed modifications oc an accident. Fourth, each vaciable I may affect the utility, and the NRC, oc the public. Last, the j infocmation foc each vaciable comes (com the acchitect engineet, i the value analysis, or other, previously documented, analyses.
In addition to the value and impact vaciables, the change (reduction) in coce melt probability (6Pm) for each alternative from the base case coce melt probability (i.e., L without any modifications) is used. 1 6Pm(}) " Pm - pm(j), centcal value where Pm = base case core melt probability, and pm(j) = core melt probability of the jth alternative. These values are given in Section 9.0. The upper (U) oc lowee (L) bounds for the change in coce melt probability aco detecmined as follows: L 10-1 f
l Table 10.1 Value and Impact Analysis '.nput Variables , i se ree of Byubel geeerlation Results free Affects the 13(21781196 Ig engineering and Instellation Positive Modifications Utility Architect Engineer Cost one Llea Ispec t 12 operatione and stelntenence Positive Modifications Utility Architett Sngineer Cests/ year - present worth lePact 13 Installation peplacement Positive Modifications Public Architoqt Engineer Power Costs . one time Impact I4 In. service Replacement Positive Modifications Public pot evellebte . but Power Coots . Per year - er Bese. Probably negligible present worth tive taPact !$ Avectable Onsite Costs . Wegative Accident Utility Based on prevleus one thee . present worth Impeet Molyses
!$3 Replacement Power Costs i
153 L4se of Investment Costs
!$3 site Cleanup costs 16 Other Coste . one time Positive Modifteetions Utility got covered in this tapact & WRC progres V3 Averted Onsite Dose Over Positive Ace! dent Utility Based on previous Plant Lifetime Value entlyses Vg' Present Worth of Averted Positive Accident Utility Based on previous Onsite Dose 9 $1000/p-ree Valua Analyses V2 Averted Offette Dose Positive Accident Public Proe value analyses Over Plant Lifettae Velue V'2 Present Worth of Averted Positive Accident Pub!!c Proe value snelysee Offsite Dose 9 $1000/p ree value i V3 Instellation Dose . one time Wegettre Modif tsatlens Utility Arth!Lett Engineer Venue V'
3 Present Worth of installe. Wetative Modificellens Util!Ly Architett tagineer tien Dose 9 $1000/p ree Valse Ve In.eervlee operstlenal Dese Positive Modifttettens Ut111ty 50% ovellette ever Plant Lifetime er ; segettve Value V' 4 Present Worth of Otevpe. Positive Modifttettone Ut!!!ty Not evellable thonel Dese 9 $1000/p ree er segettve Value 10-2
\
Uppec bound apm(3) = Opm(j) x5 , Lower bound opm(j)
- Apm(j) +5 The factor of 5 uncertainty in opm was estimated by assuming a factor of 3 uncertain *y for the internal event sequences and a factor of 10 for the special emergency sequences ac shown in Table 10.2-a. When these factors c.ce applied to tha tentral value oc best estimate for each initiator, i.e., internal, seismic, spray, etc., and summed, the overall core melt bounds for the initiators considered in this program ace 6.64E-5 for the lower bound and 2.16E-3 for the upper bound. While these bounds are not exactly symmetrical about the central value, the range coccesponds to approximately a factor about 5. Similar estimates were made for each plant and are summacized in Table 10.2-b.
10.1.2 V4'ue Impact Analysis Measures Impact Me,asuces - Impacts 12 and 14 (cefer to Table 10.1) must be multiplied by the present worth factor, 13.5 for Point Beach assuming 5% discount cate. The present worth factor accounts for the ceduced worth of the payments made or incucced at some future date. Therefoce: Total Positive Impact of the alternative, TI(j) =11(j) + 13.5 1 2(3) + 1 3(j) + 13.5 14(j). This is the total of all the positive impacts. The negative impacts sum to the, Total avercable cost. Ig(j) = Igy(j) + I$2 I)) *I 53 I)) * , where 141(3) = ap,(j) x1 51()) , I$2(3) = ap mI )) *1 52 53) Ig3(3) = apm I)) *I 53 I3)
- Upper and lower bounds are Introduced at this point in the impact analysis summary using the ector factor of 5 discussed previously. That is.
Lower beund (L) Ig (j) = Ig (j) + 5 = Ig(j) x ap,(j) + 5, Central value (C) Ig(j) = Ig(j) x ap,(j), and Upper bound (U) Ig(j) = Ig(j) x5 = 1 5(j) x ap m(j) x 5, 10-3
Table 10.2-a Point Beach Value-Impact Analysis Error Factor , Core Melt Probability Analysis Lower Bound Central Unoer Bound Internal 4.7E-5 1.4E-4 4.2E-4 [ Seismic 6.1E-6 6.1E-5 6.1E-4 l Speay 7.7E-6 7.7E-5 7.7E-4 ; Fire 3.2E-6 3.2E-5 3.2E-4 i Wind & Missiles 4.0E-7 4.0E-6 4.0E-5 t External Flood 1.9E-9 1.9E-8 1.9E-7 Lightning 5.8E-9 5.8E-8 L.8E-7 6.64E-5 3.13E-4 2.16E-3 l Table 10.2-b Value-Impact Analysis Error Factors Core Melt Probability i Analysis Lower Bound Central Upper Bound Plant A 6.64E-5 3.13E-4 2.16E-3 [ Plant B 4.05E-5 2.36E-4 1.86E-3 Plant C 1.07E-5 7.44E-5 6.46E-4 l Plant D 3.81E-5 1.79E-4 1.18E-3 i Plant E 4.20E-5 1.97".-4 1.28E-3 i l Plant F 9.45E-5 4.37E-4 2.19E-3 i i 10-4 s
The same is true for Igy(j) . Ig2()) , and I53(j). Therefore, for the jth alternative, Net Impact = Total Inpact - Total Avertable Impacts or NI(j) = TI(j) - Ig(j) . The discounted values for the negative impacts due to avertable onsite costs, conditional upon an accident, t' rom Appendix L of Reference 11 are: Igt = $3.93E+9, 152 = $2.04E+9, and 153 = Sl.62E+10 in 1985 dollars. Value Measures - The averted onsite dose (V1 ) for each alternative was estimated frca onsite dose received during an accident. For purposes of this analysis, this onsite dose (51,500 person-ree) was assumed to be the same Cor any core melt accident as discussed in the case studies). The onsite dose (51,500 person-rem) was multiplied by the APm for the jth alternative and by the number of years of operation remaining. Thus, t V i (j) = (51500) x dpm(j) x 23 . The present worth, V 1'(j), of the above avgrtable onsite dose, valued at $1000 per person-ren is: V1'(j) = (51500) x $1000 x opm(j) x 13.5 . The offsite averted dose (V2 ) for each alteinative was j estimated from the avertable offsite dose per reactor year n (given for each alternative in Section 9.0) multiplied by the remaining years rd plant operation. Thus (Averted doses from Table 9.8) x 23 V 2 (j) a . In this case the OPm is not required because the core melt probability is inherent in the calculations in Section 7. The present worth V 2 '(j) of the avertable offsite dose valued at $1000 per person-rem is: V2'(j) = (Averted doses from Table 9.8) x $1000 x 13.5. The totals of the positive values (onsite + vffsite) for averted dose and costs are: V12(3)
- Vl(3) + V2 (3)
V12'(3) " V l '(3) + V2 '(3) - 10-5
The ratio of the averted offsite dose (V ) Snd 2 the base case dose is: Averted dose catio, offsite 5 V2 ($1) ADR, = Base Case Dose (i) x 23 - where i represents the lower, central, and upper bound values. ! Similacly, the ratio of the total averted dose (V12) ar.d the total base case dose is ~ Averted dose ratio, onsite and offsite E i V12(ji) ADR n
- Base Case Dose (i) x 23 + Vy())
The negative values consideced for the jth alternative included ; the dose received ducing installation (a one time dose). V 3 (j), and the in-service occupational dose received over the i comaining plant life time, V 4 (j). These doses can be presented valued at $1000 per person-ren in a manner analogous to that used for the positive values, thus, ) V 3 '(j) = V 3 (j) x $1000 r V 4'(j) = (V4 (j)/23) x S1000 x 13.5 . V 3 *(j) does not include the present worth factor (13.5) because it is a one time dose, whereas the dose associated with ' operations, V 4 (j) is recurcing. ' l The not averted dose. NV(j), and net averted costs, NV'(j) - associated with each alter. native can be calculated by i subtracting the negative values from the positive. Thus l Net averted dose = NV(j) = V i(j) + V2 (3) - V 3(3) - V4(3) Net present wocth = NV'(j) = V{(j) + Vj(j) - Vj(j) - Vj(j) i of averted costs t at $1000/p-tem i Va'_ue-Imcaet Measureg - The value-impact measures can be l constructed from the variables defined above. Each of the ! value-tapact measures is calculated vith the centcal cost foe , the total impact (TI) and the central cost for the net impact : (NI) as opposed to using the upper and lower bounds for NI. The ficst measure consideced is the a ratio of averted costs to impacts. This value-impacat catio (VIR) is calculated twice. One ratio considats only thu averted offsite costs and the
- total impact. Thus for the jth alternative 10-6
VIRO (offsite) = V2 '(3)/TI(3)
- The second ratio is the net value-impact ratio which accounted '
for the not averted costs and the net impacts. VIRn (offsite and onsite) = NV'(j)/NI(j) . Similarly there f>4 two not benefit values. The first again considers only averted offsita costs, while the second uses not averted costs and impacts. So one has, NBVo (offsite) = V 2 '(j) - TI()) NBVn (offsite and onsite) = NV'(j) - NI(j) The final value-impact measure presented is the estimated cost in dollars per person-rem of Dose Averted if the alternative is implemented. Again there are two values, one considering only the offsite averted costs, the second the not costs. DPRo (offsite) = TI(j)/V 2(3) DpRn = (offsite and onsite) = NI(j)/NV(j) . A more complete discuasion of the reasons for selecting thase measures is provided in Appendix L of the case studies. 10.2 Results The values, impacts, and value-impact seasures defined in the , previous section were calculated for the case study plants i using the results of the internal a.nalysis, special emergency , analyses, and the impact analysis. These results are tabulated ' on e plant by plant basis on Tables 10.3 through 10.8, It is j important to note that the offsite population dose is an ', integrated dose out to a radius of 50 miles from the site and the conversion from dose to cost is at $1000 per person rem. All present value estimates are based upon a 5% discount rate. I Each of these tables gives the upper (U), central (C), and lower (L) bounds when applicable, i L The symbols for the values, impacts, and measures are given at I the heading of each column to avoid any possible confusion : abmit the entries in the table or how the numbers were ! datermined. L Table 10.3-a summarizes the impacts for Point Beach by alternative. The four positive impacts are individually tabulated and then totaled to obtain the Total Impact (TI) of modifications associated with each alternative. One timo costs ; of installing the modifications and replacement power during the installation are already in present worth dollare. The in i 10-7 i
service operations and maintenance costs and replacement power costs must, however, be multiplied by 13.5 to account for the present worth of these impacts. The installation of modifications at Point Beach can be accomplished during normal outages so that there are no replacement power costs. Although replacement power costs due to in service maintenance were not specifically estimated, our judgment is that these costs will have a negligible impact. It is obvious from the table that alternative 4 will cost substantially more than alternatives 1, 2, or 3 due to the extent of the modifications. The neoative impacts result from the averted onsite costs attributed to a potential accident. The costs are, of course, probabilistic. Thus the potential costs for 1 51 1 52, and 1 53 in 1985 dollars must all be multiplied by the lower (L), central (C), and upper (U) bound values for apm. The net impact (NI) is the positive impacts minue the negative impacts. The lower the net impact the more favorable the alternative appears. In fact, in three cases (alternatives 1, 2, & 3 upper bounds) the net impact is negative which means that the averted onsite costs due to a possible accident at the upper bound change in core melt probability are greater than the cost of installing the modifications for those alternatives. Similar results for the other plants are in Tables 10.4-a, 10.5-a, 10.6-a, 10.7-a, and 10.8-a. Table 10.4-b presents the positive values for each alternative. These are onsite averted dose (V1) and offsite averted dose (V2) due to a potential accident. These are both probabilistic in nature, however, the calculation of offsite averted dose (V 2 ) does not explicitly include opm sinea it is implicitly included in the analysis to obtain V2 Upper and lower bounds are given for V2 as derived from the risk analysis in Section 7 and based on the source term bounds assumed in Section 7. Both averteo doses must include a factor to account for the remaining plant life which t is 23 years in 1985. j The total averted dose (V12) is also given as are the present worth dollar values. Each of the dollar values is based on
$1000/p-tem and a 13.5 percent worth factor as described in ,
Appendix L. The averted deses increases from alternative 1 through alternative 4 due to the increase in apm from alternative 1 through alternative 4. Similar results for the other plants appear in Tables 10.4-b, 10.5-b, 10.6-b, 10.7-b, and 10.8-b. Table 10.3-c summarizec the neaative values for each alternative. The installation dose (V3) results from radiation exposure to 10-8
contractor personnel during installation of the modifications for any particular altecnative. The V3 values for alterna-tive 4 is nottceably higher since that alternative requires ' entry into containment whereas alternatives 1, 2, and 3 do not. In-service occupational dose is considered to be negligible at Point Beach for the alternatives ptoposed here. In each case the doses are converted to dollacs by $1000/p-com. V3 is already a present worth but V4 requires a 13.5 , pcesent worth factor,
, The net value is the positive values V12 Of V12' minus the negative values for V3+V4 and V3' +V4' respectively.
Upper and lower bounds are given for NV and NV' which result from the bounds from the positive values only. Again, similar cesults for each plant appear in Tables 10.4-c. 10.5-c. 10.6-c, 10.7-c, and 10.8-c cespectively. Table 10.3-d is a summary of the Value-Impact analysis and as such sevecal measures are cepeated from Tables 10.3, 10.4a, and
+ 10.4b. These repeated measures are TI, NI, V 2+ V2'e ADRn, and NV'. The value-impact measuces derived from these measures are the Value-Impact Ratio (VIR), the Net Benefit Value (NBV), and the Dollars per person-cem (DPR) based on offsite costs alone (subscript o) and based on offsite and i onsite costs combined (subsecipt n). Uppec and lower bounds ;
are shown where applicable. Recall that the V 2+ V2'e ADRn, and NV' value measure bounds are decived from the soucce term bounds discussed in Section 9 (that is approximately a i 3 error factor). The impact measures TI ' and NI ace centcal values even though uppet and lower bounds " ] are shown tot NI in Table 10.3 to illustrate the range these j onsite costs could have, j The results given in Table 10.3-d show moderate diftetences in 4 value-impact measures (VIR, NBV, and DPR) between and analysis i 1 based on offsite costs alone and an analysis based on offsite l and onsite costs combined, the later showing a more favocable advantage for the alternatives 1, 2, and 3. There is only a i , s, mall differences for alternative 4 (the add-on SDHR system). , Negative nec benefit values indicate that the present worth of the avected dose is less than the cost from the impact. In fact, all the net benefit values are negative.
- similac result tabulations appear in Tables 10.4-d, 10.5-d. ,
10.6-d, 10.7-d, and 10.8-d. ' Table 10.9 provides a further condensation of the results which
- show eight measures extracted from Table 10.3-d for the centcal '
value only. While 6Pm and avected offsite dose (V2 ) t improves as the alternatives become more extensive (i e., titesnative 1 4 4) the tevecse is true of the three value- ' i.mpact measures (VIR, NBV, and DPR). In particular the dollars !
- per person-cem are better for alternatives 1, 2, and 3 if both l l
1 10-9 ! . b
onsite and offsite costs are considered. Unfortunately the '. alternative 4, which has many unquantifiable celated qualities, has less favocable value-impact measures. However, this part i of the analysis does not consider any of the unquantifiables, thus judgments are defacced to Section 11 of this ceport where the quantifiable results found in this section are brought together with the unquantifiables. Similar summaries for the ' other plants are pcovided in Tables 10.10 through 10.14. l I i l i t 10-10
__.___ _ _ . _ _ _ _ ~ _ _ _ _ _ - - . . - _ . _ _ _ . . - _ . . . - . m. -
- _ _ _ _ - ~ _ . . - _ . __m. _ . .
. .m ._..-.-mm-- . _ . _ . . - - . . . - _ . . _ , _ _ t ,
I i a i 1 i 4 ) j Tat,'e 10.3-a Pulat teacts - saammary of Impacts (Game.tElvin- St tilacement i 1 . POSITIVE 19eAC"r5 Assot'I ATFD 081798 MODIFICATIOteS NPGATIVE Isent*;S IiUE TO AvreTaeER (Psesamt weershal _ _ (esSITE OOSTS (Freemat tenrtles) ttt a lit y cost s change in Installa- operations Deplaceanent Ponser cost a seplace. Imes of w at Alter- Core feelt t ies a-d and fealmten- In Service TorrAL meet Invest- Sit e Avert- ter? rea t ive Protaatallit y ragineer- ance Costs Instal- ( Ptf ) POSITIVE Ponser ment cleasesp able IIeACT seo. Icentsat ing costa ( tw) lat iese IsePACT cost s Caste costo Cost s f $ alS~ 3 ($ wie 3 ($ ale 5 ($ mie 3 ($ ale' ) ($ alS~ p ($ mie' ) ( $ _ _ml e 3 ($ mie ) ($ ale ) so. c. . I.V.i.e. I, f I g 13.5 I y 1 3 13.5 4I TI I{g E gy I{3 1 5 mot I. 8.17 a.09 4.69 S.95 6.618 1 2.16E-4 7.419 8.149 e.0 Available 7.%e c e.m4 c.43 3.45 4.72 2.848 Fsotaelaly 88 4.19 2.17 17.25 23.61 -16.842 googligible g O 3 L e.19 0.14 8.88 1.39 1 3.7186 H 2 2.51E-4 14.376 e.See 0.8
- 14.876 c 0.97 0.%1 4.02 5.50 9.376 H es 4.87 2.53 28.09 27.49 -12.614 L 6.23 0.12 8.93 1.28 23.526 3 2.ME-4 22.497 2.309 0.0
- 2 4.deO6 c 1.33 0.59 4.65 6.37 18.436 81 5.64 2.93 23.25 31.32 - 7.814 I. e.26 S.14 1.Gep 1.48 62.684 4 2.92E-4 59.84' $.117 c.e
- 64.164 c 1.34 c.68 5.38 7.36 56.384 U 6.52 3.39 26.99 3c.ee 27.364 TI
- 11 e 13.5 12+I3 e 13.5 14 IS' = 351*
- 152*
- 153' NI
- TI-Ig*
Not e s L, C, and U repsesent the tower, central, an1 espper twseuwt estimate for core melt preheb*1ity j- w -w.---------.,m-,m- ~
--3--- y,m, m,,,, ,%.,,,wv. ..
. . , . - , - - ~ , - , ,m-- e m--,-e _- ,w-. ,4 ,my- .,-. . y s
Talsle 8 0. 3-t* swas nt Isaacts - Sommear y of values (Itamed ens Popialat ion Tw>se ten 50 Miles, St Discenent pate) M15 E 557 vat 13v5 Ons i t 3 Offsite Total AIter- Ot.ange in fresent tsorth Averted Pr*sent North Averted Present metawe ca er e pea l t Awerted e>f Aver te*5 Averted. These I a. Averte.1 Averted -Dose I har t h of Nea. Pr edaniel l i t y fanse twese 9 twee Base Case twese # Dose Base Case Averted Dose grantral (ge-r ee ) $1000/greem (p-ree) Imase $1000/gn-reen (p-ren ) Dose # $1000/p-see
'*I"*I ~
($ sie 3 s$ sin ') ($ sie ) Irt, c, & s. values) (tv, c, & L valses] Ap v v. v Are v- v 12 aDe v-12 a 1 1 2 e 2 m L 3a2 72 0.224 6)e .at 0.374 3 2.14.E-4 256 0.350 e 642 72 0.377 84a 7s 0.527 8 987 72 0.579 1243 76 0.729 g L 444 .e3 0.261 741 .m9 0.436
- cj 2 2.SAr-4 237 0.175 c 741 8) 0.43% leia .a7 0.61P l U 1836 .P3 0.d.67 1433 .as6 0.842 I L 4sa .a6 0.24 9 767 91 0.449 3 2.60F-4 309 0.180 c 761 .H% 0.447 1970 99 0.627 l U lla a .H5 0.6a6 1477 .Os 0.866 L 4% 93 0.291 041 96 0.494 4 2.92E-4 346 0.203 c m30 93 0.4a7 1176 9% 0.690 U 1279 .93 0.7$1 1625 95 0.954 I
v3 - Sl'As0 m Ag , a 2 5 v3' = *.1500 m Ap. m $1000 m 13.5 vy - Averted Isame a 23 Vy* = Averted pnee a $5000 m 13.5 Af > E4,3 = vy I (Basecame Dose a 23) V12 "VI*Y2 A D9t. = vgy I (Isasecame Duse a 23 e vg) vgy* = vg*
- vy*
Notes L, C, and ti stand for Imr, cent ral, aw" ugg,er tM sonarce term est imat e
Tabl e 14. 3-c Swist De=ch - saammary of Values f aased on twpnelation Ewee to 50 N!!es, 54 541scoesnt Kat e n NEC.Af!VE VAIJFFS Installation egerat lant total teet Value Change ia Pr esent In-Sery*re Present Inot a1la- Present tent t b Present A1ter-matSwe for e 99el t I nst all- teos t h of Opera. mur t h of tien an.1 of lastall. 6 Avert ed North of In-service Operation- Oswr.twee Dose Averted posa ho. Ps chaLJ 11t y ation I nst alla- tlonel Dose t ion twee O N>ee Oper , th>me . al pose 0 $1000/gv-rea (gereal e $1000/gv-rem Icentral
* "*' ( g. -r ea l $1000/p-ree (p-reel J$ ul0 ~ ) ($ ale I ($ ale' I
- lit, C, 6 T. Valueel V V V* V +V Vg+V' NV NV* ,
Ap, 3 V '3 4 3 L A21 0.357 1 2.l*E-4 17 017 Negligible 17 017 C stel 0.510 6* O g, 1226 0.712 8 t-* L 724 0.419 w 0.593 2 2.53E-4 17 017 tsegli gi ble ' 17 017 C 1921 U 1416 0.025 L 740 0.422 3 2.60E-4 27 .027 Negligible 27 927 C 3043 0.600 U 1450 0.849 L 355 0.000 l 4 2.92E-4 406 4n6 toegligible 41s6 486 C 690 0.204 U 1839 0.4F4 l I V3* = Vj u $1000 v* a = (V4 5 23 5 m $1000 m 13.5 . NV = Vg + V3-V3 - Vg NV*
- V g *
- 2V *
- I)* *I4*
Nest e s I., C, ased if stand for loneer, cent ral, and uger twet source t erm estimate l l l t
Table le.3-4 tolat se.ch - saammary of valine-Impact Analysis (eased on Popalation Emmse to se Miless %e Discument eate l v-I AIGAS.YS3G EASED 058 OF7SITF COSTS l V-I ANALYSIS m N Ou OFFSITE AND OSISITE G =T4 Claange la Total Present teorth Measures of V-1 Present teortlk Steasures of "f-I Otter- core stelt Of f sit e Aven t ed Tot al of Ayerted teet of ewerted native Frede- Averteel Dome
- Impact flose e $1ete/ V-t aset rmallare impact pnee e $1004/ V-I seet Dollaa a tellit y pose 5 some lrentral eatia semefit ger ICentral p-rem eatio semefit per Beo. 5" 8
case pose (U,c,6L valueel p-rem onett (tv.c,6L valueel p-rem Irentral (p-r.el costi
**I"*I lu,c,6L valueel ($ mie) ($ alel ($ ute n ($ ale) ($ mie N ($ ale i Ap v are a TI v* WIe essov pro set sev
- vie seer a
orea o 2 2 e o a a 342 81 8.224 0.034 -7.144 19el2 8.357 e.125 -2.491 4586 L , 1 2.10E-4 c 642 7e 7.56e e.377 0.e50 -7.191 47ee 2.shes e.53e 4.179 -2,33e J233 0 987 76 0.579 e.077 -6.9st9 7M8 , 8.732 e.25e -2.136 2323 H O L 444 99 0.261 0.018 -I4.615 33505 - e.419 e.e45 -0.957 12950 c 741 24.876 0.029 -14.418 20076 9.376 e.593 0.063 -e.743 9183 l [ 2 2.53E-4 .s7 e.435 U *136 .e6 0.667 8.045 -14.209 13e94 e.825 e.ees -e.551 6621
- g. ;
L 454 91 e.269 e.011 -24.537 54162 4.422 0.e23 -10.014 24914 3 2.6er-4 c 761 .e9 24.006 e 447 e.018 -24.359 32597 18.436 4.600 0.033 -17.836 17t.76 U 16. .se 4.6es e.828 -24.i2. 2:23e 0.849 8.e46 -17.5e7 22714 l i. 4,5 9fa e.2,i 0. 05 -o .873 129624 e.ees e.ee. -56.796 16eeni 4 2.92E-4 C ela 95 64.164 8.4e7 0.007 -63.677 77306 56.004 4.264 0.044 -56.60e e2325 l U 127, .,5 . 75: ..ei2 -o.4:3 Sono . 46. e.ee. -56.336 49 72 I 4 l' WIs,= Vy* 4 TI VIs, = IfW' 4 HI saevo=v - TI 888Ta
- 88W'
- NI
, on,o = ,2' I . v2 o,s. = I .v Deut e s L, C, and U stand for looser, cent ral, and aggwr teesad monarce term estimaate 4
i i i l l 4-____ _ . _ _ _ _ _ . . _ - , _ _ _ - _ _ - _ _ . . _ - _ - -_, , __ _ , _ _ _ _ _ _ _ _ __ - _ _ _
Table 10.4-a Tierkey Point - Summary of Impacts (Based te St Discoesnt) , UFCATIVE 10M I48E TO AVF5ffasts fraSITIVE IMPACTS ASSOCI ATPID WITIS IEf01FICATIOW85 (Present St>r t bs ) OgBBI1W COSTS (Present leerthe) Ett$1ity Costa Chan9e la Installa- open at ione 9eplacement swr Comra Seplace- Imma of Total Alter. Core feelt tican and and staintee- In Service iTFPAL anent Invest- Site Avert- IEET nat?ve Probability Engineer- ance Costs Instah- ( Ptf) IM Power ment cleanup able IsePACT teo. (Centsal Ing Costs ( Pti) lat tosa Costs Cocts Costs cost s ($ ale ) ($ mie 3 ($ ale ) ($ ale ~ ) ($ ale' ) ($ ale 3 ($ al8~ ) ($ m 10 ) ($ ale 3 ($ mit ) tu, c, & L valueel 13.2 I, " Ap, I g 13.2 I, 1 3 TI Igg 1 52 I53 I5 r not I. e.23 4.04 4.26 8.s3 4.2s. CA 1 1.13E-4 4.786 0.000 0.0 Available 4.796 C 1.50 8.27 1.01 3.M 1.126 Prokebly II 11.07 1.90 12.M 25.63 -29.e44 [ un toegligible I. e.44 4.ee 8.58 1.02 79.877 2 2.20E-4 74.53% 6.362 0.6
- 90.097 c 3.ee 0.53 . 3.S2 7.13 73.767 II 21.7.4 3.70 24.64 49.94 34.997 TI =13 e 13.2 I2*I3 + 13.2 14 IS' = 151*
- 152'
- 153' WI = TI-I 5*
Not e s L C, and if repseeemt the lower, central, and apper teennd estimate for core melt probability
Table 10.4-b Turkey Point m-ry of values (Based on Populatican rkmee to 50 Miles, 50 Dinavient Date) SCSITIVF VAIJUFS Oas i t e Of'fsite ' rot al Change in PTesent hk>r t h Ave r t ed Present Werth Averted Present Al t er s.at ive Core Melt Averted of Averted Averted im ene I of Averted Averted Dose f Worth of e>>. Pr sJet,ili t y Emise fusse o Dose Base Case tusse # Dnee same case Averted Dose fremtral (p-reel $1000/yr een (p-seal Dose $1000/p-rem (p-ram) pose # $1000/p-rem Valenel ($ m20~ l ($ alo I ($ ale ) . lif, C, & L Valanes) lti, C, 6 L Values] a 1 k '2 o b 12 sn $2 L 471 47 0.232 597 .53 0.357 1 1.11F-4 126 0.075 c 040 48t 0.504 966 .51 0.579 e U 1440 4a 0.869 1574 .50 0.944 C, I L 910 94 0.557 !!72 95 0.704 m 2 2.20E-4 244 0.147 c 16%0 94 0.990 1894 94 1.137 ts 2842 95 1.705 3046 94 1.052 Vg = S0500 m Ap s 22 Vg* = 50500 m Ap ,s $1000 m 13.2 V2 = Averted Emese a 22 Vg' = Aves t ed (kase u $1000 m 13.2 ADk, = Vy 6 (Basecame those a 22) V12 "Y!*V2 A DD, = Vgy 5 (namecame Dome a 22 e Ygl Vgg* = vg'
- Vy' Not e s L, C, and U stand for Ionsor, central, and upper 1 veseed monarce term estimate
i;i1; ]j lI jl ll ,l il lljjl lll lil I ll Illi l! 11 lI11Ii1 ' , s a ee or f D -p s l 794 472 . , te od/' e 574 s1 3 sht4 . e4 n *
- e. V 359 63 8 -
st r8 i l sI 8SS 411 - ere1 - a . r uv$ sn Po t A V ._ e e 9 s L ~ l . a & . V , , t e c ?64 246 e s d l , 967 57 4 . e e e v p 595 1 84 . t e f s 1 1 1 3 . e=r r
- va p LCU Lce n
Am( , n i & m - t o r . r - eoll e- * - t aen /p 's V 0 0 0 2
. t t O0 - e 0 4 t no 0 .
- em sI r1 e e p$
0 i j V - rf e - l PoO9 s - t_ m ts e a T ad o l nie n v 4 G 8 2 c l at s
. a au e -
s e.rp t nE e , mipi V I t O a i
- l. ee s
. cs' t.
s tn ovOn. fi r v i e l e i t eh . .i st S r - b i b i t.
. es - e m r mng s i g
i g a Pet I o < l g l e D t j. t e e t
. e e s c p
. r c i e i t ip v i r a r r l 4 .
i eaa S r ne r
- v .
e - e.m npi o I Ot D v e 8
- e . r.
n f es r t ol u et e a
. st t s l D r f.
j V 0 0 0 0 8 2
. c es se . .
S i r nni . .
.e M at Pet I t i i I s .
a L l l V A l a W a r t -
. K s l .
, 0 0 t.
W n l . 2 . r I T I an t oe t
. V .
A G E E sim nt o I ag <n r . r.
. O 2 3 .
- 1
- g ,
y a V ,.
- t. t 4 4 e 4-4 nt i - -
il l l E E tV .
. eia e
3 0 e * . ef g b r , 1 2 l
- 3 .
r $ V neinet e e ) t.
~,
ar h or oe i. A 1 2 e mY - , t c c P (C V n3 ~
- y o2 .
i2 2V . s V . e 8 *
- o = * .
t w 3V 4 g g
- c t
e . V( VV . n08 1 2 . = =
- r3 .
e t . l *
- t A 3 '4 v V a 8 VVt 8 goi
mee s t teate 8e.4-4 toetey e=See - euemeey of Wakee-%1 emelyste (somed es esupasteelen smee se Se ellees %e 64 .
~
~ ~
W-5 3 aa'rsi's SIsseTime Earr'g3Te rbeTe
~
T-f esaLTSIS SaSEs 05 MFNs asen omsITs 4
~
STo e~n ee Waem asse eem er w-s reemose m Jem weeeos or v-s set er seeeees enese- n.e. ,e se 44 re s e s eseee.a ves en es seees.4 V-I eielles a mee4ee roee eneie eooseed sees 3 eyes a goes S$ 1996/ w-I see Bed I** e lepert Dumme 4 $ieGS/ that p-s ee mete eseefle pee treme s el p-e en See se seest&t per see. Pee. hee a s se y e S men. Iremeset roses ja,r,6L valueel p-s ee resel go r,6L Telesel p eo frame s el (p-e em s reos a==ee
- 44 e le p ($ ele 6 ($ ele $ q$ ele p Se,r,6L weleoel ($ ele B 4$ e le $
new Ap w~ ease 71 F* Use new seee as er* Wie. e spre. e 2 e 2 e . e.e6 - 4.%ee leB&R e. 7% P e.12 - S.796 Sees
- 3. 4 75 9) e.se2 r ese 4.7e6 S.%e4 0,38 - 4.2s2 %ete 8.lM e.179 G .S t - G.447 116e t 8.8 De-4 .%R e.e4 - 4.182 78%
e seee .Se e.se9 S.58 - B.987 S teS 6.444 978 9% 0.%S7 e.at -ee. 64e e7873 e.ame d.48 - F ).es ) 64459 L r 26%8 94 ee.097 S.999 4.44 -79.967 49eJe 7 3.M7 8.R57 e $2 -72.654 39363 2 2.tes-e
-79.872 2e46% 1.e32 9.42 -71.95% 24eoe 3 2842 94 4.7e% 0.92 g
CJ .- p 1 ven,= Wy* 8 PE tis. = ust' 8 JI 00 newe
- v2' - tt evs. = esv' - et Enre. = T3 4T3 ste = m3 $ MW abd e s L, r, med a eteed fee Seeses, emmee ., and egges W essessee seem ese neese a
9 G
.--s _.-, - - - -- --
Tatle le.S-a St. Imcle - Seemmary of Impa<.t a t hemed agem St placoennt ) [ wyrJ TIVE IMPAM fM*E ""O AVhir~TAe1Jt STMEITIVE 18sf%f"PS ASSim'I ATFD ndIMG pmWit F1CATIOes5 ( 8 s emeent Idese t ke l ONSITE (YSTE (Present teosthet sw a lit y crest s Change la Imatalla- Deplacement penser Coat s peplace- 14es of Total of. erat temme ame steineen- In service HFA L meet Invest - site Avert- teET Al t er- Case Melt t lesen and Instal- ( 8v p 3 MPAt=" Pameser sent cleansep able IstPACT native Fredshility Emitmeer- asece Coet s lat lawn Cest s Caets Costa Costs shs. (Centsal a seg Cuat s ( tel ($ al0 ~l ($ pie 3 ($ sie 3 ($ miO~ ) ($ sle B ($ ale ) ($ ale ~ ) ($ m 1e ? ($ mie 3 ($ ple ) { tt, C, & L Valenesl f.p, I g 13.# I y I 3 13.8 3 4 TI 3*g I*y I*3 I{ NI sent L 4.08 8.42 0.09 9.19 0.898 0.6 Available 1.683 C 0.65 8.1% 0.61 1.49 - S.402 1 4.lar-S .as! .2e7 rrohably c S.17 1.23 S.58 11.90 -18.e12 P O esegligible 8 6-* L e.14 0.43 0.1% 0.32 58.273 up 2 6.99E '1 S).791 4.ne2 9.9 = 58.8L9 3 c 3.09 9.26 ,1.16 2.S1 56.083 U n.72 2.e7 9.23 29.07 33.S23 TI =33e 13.s 12* Il e 13.s 14 I g* = 353'
- IS2* *IS 3*
NI = 71-Ig* Nest e4 L, C, and 13 regegement ( See lesser, cent r al, and ogsgeer $dassed est imate for cose melt gorgdebility 2
Tal.le 8 0.S-Ge St . lancie - Bessunary of valeses (stmoed ee Pegnalat teen tonee to 58 Miles, St telectent pate) reast-Ivy VAssers Esie'e U fe$te "wet a 1 AIeer- Clamage &n Present terms t In ' 4weraed Prement terir t to Aeerted Psesent metave Cease stelt avert ed et A yer t ed Averted rmee S est Avested Averted riose 9 tenttle of eso. Ps.A et,811t y Duse twee # twee Pase case tweee rmee same case Averted pose Iceed r al (3 -ree) $1004/gesee ( 5'- 8 8* I I"=se $ 1848/g=-s een (gs-rem ) gwise # $1004/g=-rem
-6 -4 -t valmel s$ mie 3 ($ mie 3 ($ mIt 3 in, c, s,s. valee 1 in, c, 6 t. values:
Ap, vg vg
'~w 3 Are, v3 v,g ads, vj, L 94 .%8 6.954 14% 68 4.083 1 4.94F-% SI 8.029 c 144 59 0.6a3 19% 66 8.112 g to 221 .%# 8.127 272 63 8.156 O
3 5, 1%1 94 4.OR7 237 96 S.1 36 M 2 (>.ME-S a6 0.049 r 228 . *b4 8.531 Die 96 8.lR8 o 3% to . *s4 a.264 441 95 4.253 vg =
% 2 008 a 91 . m 24 Vg* = St&OS a Agg a $3See a 13.5 V2 = Avert ed fame a 24 Vy' = Averted t=me a $ leos m 13.a Af*o =yy 6 ( Damecame twooe a 24)
Vgy = Wg
- V2 ADR, = Wgy I (hamecame Desse a 24 e Vg)
W12*
- V*
I *V2* seness 8., C, ased tf staae feet Ismeser, cent ral, ame ogper t=senswt monarce tese est isaate
va) le le.S-c St . Imcle - Summary of Walese (same4 en Ptyeestat ion Ekm. to Se alles, S4 placount mate) WEGATIVE VA1JFS f est al lat lesen rgnera t isest Total Not Valese ch asHye la Present In-ser vice Pressent Imotalla- Presset wortin Present Alternattwo core Melt Install- Wor t h of (ipe r a - Wr>rt h of tiria and enf Install. . Averted tkuth of me. Predel.lli t y atire Installa- tienel In-Service Operatten- Oper. pose pose Averted pose (Central (m me tien Does W skwe Oper. Ik>ee al Dome # $ lees /lwase (gn-rean ) # $ lees /p-rom Valesel ( p-r ee l $1000/p-ree (p-ree) ($ u le 3 ($ ele 3 ($ ale 3 i,,, c . i. Va ie.es 1.p, V Vj V, V3 + V, V*3 eVj MV Mv' 3 V} o L 14S 6.es) 1 4.14E-S e 000 escapilapil,le e 000 c 19S 9.112 0 278 0.156 w O g L 217 0.116 tJ 2 6.99r-S 20 029 Neast iaslble 2e 420 c 294 0.16d b' D 421 0.233 L W3' -V3 e $1980 Va* = (Vg i 243 m $ lees e 13.s NV = Vg
- Vy - V3 + Vg NV' e Vg* eV 3* - V * = Vg*
3 tout e s L, c, and U etand for looser, cent ral, aan.1 agiger SmW eceerce term estimato
j ;3 [ . , ..
... ge3 l Ill I. SI:
!1
'".'3
- 1. k 3. 8. ,s Ei m
1 1
-l
-'n.
l l: Il e lis
,! ' s .* !!! lii .'
!l l
II 5 fii ddd sli
!Ls ]
i 15 4 1 1 2. y. -ag gg-I :: -: 444 444 7 l ft)j'lligg I**g"g y . - - I 1.iT - 8 3 x 3 lhl s' 1 '
. - 3 I 02 :-l 43 1.,
J t itt 1' E 7 ' 3 I f f I E h !. $. I. $. I. I. -(E
}' II s'l II* III ))p
~
i i
.! 4 .'
r e - 11'! 1
.1 :[ I y 1i .
,I e ' I
; l.li! it 8
i.,li.t sev T fi5 151 1 v 444 444 fft) [ *' * " ih
?1 1 e }
} -l11:::
a i i i 3 I I' g ;t
- . . . a. s. s. j i
.1,
- 1. s . l .j -
]
il i i' **I E3E - 2 3
- ll 3.
.t i i 2jfs;
; e I4 j
y .. i. - e g j g i s J. 4 C
. .i
$ I -
- 3 A il ]
10-22
. _ _ _ _ _ . _ . _ - - - _ . - _m= ___ ___._.m. _ _ _ . . m m__,-._,- - -
.._-_--.m._m._ m__.- ..m._ - . . . . _ _ . - _ _ =
Table Is.be AasO Semmaary of Impacts (Saeed igene SS Diocessat ) BEDGATIVE IaIPACTS EMIE TO AVEsrTASEK STasITIVE IsePACTS ASSfCI ATFft teIT98 amOIFICATIOeBS (hement terwthal (GISITE CDetS (Present teerthel 17eSIlry Cnete change in Installa- operations Seplacement Praser Comte Seplace- Imme of Tutal Core feelt tion and and paelaten- In Service 1tyrAL meet Inveet- Site Awort- 8EET Alt er nat t wo Probability F.ngineer- ance Comte Instal- (W) POSITIVE Paeser meat cleanup able IsIPACT sea. [ Central ing Comt e (W) lation IseracT Comte Coot e Caete Ceete Valenel ($ ale ) *$ mie ) ($ MIS 3 ($ ale ~ p ($ ale' ) ($ alt B ($ att 3 ($ m 16 3 ($ ale' 3 ($ ale' ) 158, C, 6 L Valese) A, 13.2 I y 13.2 3 4 TI I{g X* wx P I g I 3 Ih2 H Hh g anot L 6.3e e.te e.44 e.7e 24.574 O 1 1. 28st-4 14.24 1.e56 a.e Available 15.354 C 1.52 0.39 2.92 3.93 11.424 1 Prohetely 83 7.62 3.95 10.11 19.6s - 4.326 teegtigi11e Y L 4.39 e.10 0.52 4.31 54.347 2 1.ME-4 54.697 4.64.0 e.S
- 59.357 c 1.96 9.50 2.61 5.07 54.267 ts 9.e2 2.52 13.44 25.3e 33.977 71 = Ig * .3.2 53*I3
- 13.2 I4 I g* = I g g * + I g3*
- I g 3*
WI = TI-Ig* Notes L, C, and U represent the lauer, central, and esgyer La-d estimate for core melt probability 4
7 r l l Talale le .ble ANO Sesamary of values (Based en Popestat !<sm Dose to 50 st!!es, St Disceenat Ratel POSITIOE VAIJJES Onsi t e (sf feite Total Cleane in Present wortin Averted Present wortin Averted Present AlternetSwe Cos e stel t Averted of Averted Averted fuese I of Averted Avert ed Dnee 9 thartin of eks. Ps etelell it y Emes pose e pnee lease Case riose O Dose Base Case Averted Dome (Central (p-rom) $ 1000/g-ree f yr-r cua l Dnae $ leos /p-ree tyree) pose # $1000/p-rem j valuel t$ ale ) !$ ale n ($ ale 3 (ss, c, s L Valeeel its, c, a L Valeneel l Ap V v' Y ADR W* V App e 1 1 2 e 2 12 m V'2 1 L 103 .e.m 0.062 245 33 0.147 l 1 1,28E-4 142 0.08% (* 167 78 0.109 309 31 S.185 l 3 U 288 70 0.171 430 .77 0.25e O 8 L 139 92 0.083 323 96 0.193 2 1.4.SE-4 144 0.110 c 21e 91 0.131 402 9% 0.241 U 373 91 0.227 562 94 S.337 l l V3 - 548.84 m op,, a 22 Vg* = See,60 m Ap. m $1000 m 13.2 V2 = Avert ed Imme a 22 V'2 = Aver t ed fersee m $1000 m 13.2 At%, =V2 1 (basecame twee a 22) Vg2 =V3*V2 Alea, = Vg2 1 (Saeecame Esome a 22
- Vg)
V12* *V**V' l 2 esot e s L, C, and U stam4 f or Ineser, cent ral, and empper Isonend on=erre teren est imate l l i l t I l
, ll. l se ee or D - f p i n tn od/ e 7s0 31 7 ee e
. V
- 4a5 2
721 123 eh t t e 1 l. st re l i N er el a a 4ee 444 r V e e P teov$A e ( i l a . V , t e c e t d l , S94 3 22 e e o W 4 93 484 t e s B f 234 335 r er eo-AvnD (p Lcy LcU s t & m t e ra . e hl t l eg e r I V 0 ae/ 2 ts t De
- e 8 e s t e en . e i *3 sI rl s V e e$
u rf g $
) P oOS (
e l t a a t - e o - m T lad e 4 t nt e V e 4 na la et e 2 t nrtaw a
- e c
s oee migl V 3
. a t
I t ( a f
% e ee cm 3 t a
s f i o j m e tn ovD e e e i el eer ,l l V l. l t s i l b m st S r a t i e er r u nge$
- g g e
e n r l i s S o P et I O ( i l i g g e b, t e e t e a e t o se r c e e e iv c e g l r i r - l a 4 e t w eaa e V u S r n a- r o l n a I
- (eom n ig o t D i r "
t a l "- m a e r g P c f ae
- e e. 9 e
g e s e tebola w p n l t
/
V e 2 8 g o
= mt t n e A d a es s e t n e St s e n$ e a m
E'a PWI t l s a 1~t 3'l l ( Al a V a r s t - t e E s l l n e s V n l am e 0 e c l a I T I t e _ s w V 2 A , . W al a r (g G mt r f E I e o N 2 w n y . 3 A r 1
- a g w m y a V e m t 4 4 f
- a. nti - - e 4- S
- f. i il l 5 E t V w p ia v % e
- s
- - s b s f l 2 6 l - j a g at .
g $ V t e.
. 3 e
- et e 1 - J. a 1
- s oe l e
av- s rs s 'c C osP g r oV t 3
- e A e2 y e l 2 3W m
$ V a c 8 *
- e m . ,
6 w 4 3V a g
- C S ~
9 t V( VV L 1 e .e e m s m
,I 2 = ==
s l, e t t e a l T A 3 '4 V V A. s VVwa s s POI 4t9U
f, 2:t is-3s a nnn I 4dd 44" :1 lli lE
!1 . t 22: :st sig j,l* s 'g' i. i. i. s. i. i. .
g . gg, I,[' ??" ??? ... 41 2 s' E51ass
;;s !!! .r Il -
!es It i-I.ii
,a d.
f
- ss,
! g. .k ... ...
';21 L A .. -
- i. . ,- . -
4 : . a n-1 I I .,, = 3 I se
. ::: -se a . 3e 3. * *. ** .
s 4
](( t* :** '"- r u g.
3 - 1 ,. 8 1 ***
- - cs :,.,
~ 'i'
$ [' I } il. fii fii II'i
}I r . ::t -it
- a. nas . n, a.
j 1: i,
.1 5
i- .u -. --- 1
=
g i a s .
.{llii!it.
i
.. in!q :r
.s .<.
I L l;t1 LE - -
. 1 1 1 4 2. E s 1 .I j},t} 3 ?* i i j
Ii* _6 .1 . 2 t - 1 .. 8 1 s
* ;)
j,- ill !!8 f n., i.t ... ... 1
. . i h I3h
,3
? ?
-s s. 1
, .. i- 4
( 3 E x S A. 4 6' S. 2
- l. I * "
i
.1 3 10-26
Tali!.E 10. 7a QUAD CITIES -
SUMMARY
OF IMPACTS (Based Upon 5% Discount) uncaT17. Eur. CTS su 7. aventa.Ls
.est7s c Ts G - 2 worthe)
JP1111M_19EP. cts associarsit wtTW useIFIceTIos:F trreeomt worthe) emelecesant Pogser Ceeig_ utility Coets i soplace- tase of Tetel C3=en la Imetette- eyeretiene avert-ammt Inseet- Site Citer- Core semit ties and one meloten- Cleanup able uT Ig_geg yhg TUTAL Pomer meet nettee Prebebility .glemer- ence Coete Eastel-Coets Coote Im lation (PW)
- IIW'ACT Coets Coets me. Icontrol las Caete (PW) i.-'s is ie -
'i ts =i."> ts i -'i ts i."> ts i."> ts i.-'s
' 5- 8 1014 3 t o i.-'i a s =i.-'i is n.2 1 T q, q, g, y .i j a,, i, 13.2 i, i,
.et y ..aise6:e, L . 13 ... . 19 . 35 16.1 F.2
,a . .o 1.F. a.F ~ ... cre6emi, a.S2. C .. a . 17 3 S. .S n.2u 3.2n ..a ..a ..= F..a
.e.li.imie . 3.2.
- 1. ... .. 2 .. .. a S.n2 S. 73 C ..w .. ..o .. 1 S.u F 2 2.F.-S S..a . ..n 1.u.
= 1. ..n 2. a ...
L . 27 ...F . 29 . 73 15..$.
" M.S9. C 1.3% . 35 1.96 3.u 12.931 3 1.2.-4 85.383 3.2FF ...
s 6.F3 1.FF 9.79 1..). -1.P.S L . 2. ...S . 29 . 54 S.39.
- C . 26 1.46 2.72 3.21.
S. 9. .. 53 ... S.943 1. 4 9.1. -S W S. 1 1.32 F.29 13.42 -F.6 1 L . 23 ..6 . 34 . 63 619
~
.9.323 C 3.16 . 31 1.6. 3.15 .6.1F2 1.5.-4 .2.373 6.94 ... 73.577 S W S.79 1.S3 . 42 15.74 n
71 . Eg e 13.2 33e33 e 33.2 34 IS' . 333' e s53' e su* tKrrEs L. C, asul U stand for lower, central, and Cs - TI-*S* upper bound estisaate for core smelt probability.
l(l l\lll1 j d n ne a e e er
) S - ) ,
e d p 454 234 31 4 1 O5 57 S l 2 41 2 965 428 9F 1 63F t a tnehts edeie/ "e k 664 24 6 31 9 9. S. 2 1 0. S. a r R st r e m S11 944 122 412 11 2 t . er rpheAseR ne t 4 ta et n s cams m , i e rt s e es i d s a we D 1 e C m 21 1 4 4 4 7 34 9F 4 eS5 o t e t 333 1 11 666 444 S.55 l a c oee s 49e e44 S44 4e4 S4S T aDrsee* vo a B f re ot s e e d c l nr i d e
)
e 660 94 4 569 F 43 41 0 au M t e 2 7 90 07 9 4 48 S20 47 8 t o r e r om- 1 963 1 12 47 8 1 2S9 234 6 67 1 23 983 1 34 ss . O S esot (p Ud n o d u t n >e h at e t r _. l od
, r m e Ce a e We e 1 441 0e3 4 F e D 8 L t r t
r4e 454 47 8 456 7 43 63 8 3 e1 9 g p 4 n e G p- 693 246 289 9. S. 1 e. 5. S. O n V ee / i 2 Lu o sSeemtm GS1 SSS 122 S12 112 i E e t V rd oe a pens t : I _ a I E l I T 3 e g O P e e t
> s N d a I
e e C e G84 44 4 222 6 4 44 1t 333 1 1 1 666 4. M. M. S. S. 5 4 n 1reo e* n* 40S 009 S94 GS0 o 3ee Ce6 . f vw e* f aS B* d O e s a. - s d ) . I ( e e e04 843 67 1 41 0 811 t e 2 t 31 5 4 6 085 S20 219 rmr e63 47 8 1 4 e S56 891 S ee - sep l 1 2 1 234 I23 1 24 2 . E l AD( i 3 1 L LC5 LCW LCW LCO LCW _ A . V es
- F h t . e O 2a r
od e re 2S Y Wed e i 9 a 3 2 1 .. 1, ._ R t er'- - 3 l 0 6 7 t r k rr w A neep e 4 0 0 8 ._ M es / l e. ee ee e M sA ss e S 4 4 e 4 U e rd oe a ee 2.w z ) 2 3 rr2 2 S peDl t 1 ee2 e . ee. t i .t
- l e d t ucm.
31 9 m t e rer em-e e 1 6 1 9 3 3 0 9 1 28 enae 0 n - I T eep 6 3 1 1 1 28 rpps e c. e e 2 et( . e e. C . ,m ees ,s D A J y pyme-AAam. eydee s< e e eti t Set t ee( ' .e t l l l t 3 eie S- 4- S- 4- Gerre* , 6 emb at r3 $. SS eo,l s 5 5 5 5 I I ve ,g n*
- h F
;eb a 7 2 8 1 SSaaw' v I
7 - r o o 8" e. I orc '* S 2 1 9 1 - . - . .. 0 9 "CpE 1 f E I s E L A re el e. , L t t m 5 2 3 4 S
- e 20 ,
B l e
- g g 2,t s s A
T ae vvvvav.3 v
,3 wo8,a
2 j lt
,i' a ,-. .
.52 z*.
x=1 3,.4: 22. ., - 2 {" I 444 444 .: 4 4 444 ((f j, I ** 83 t R i *l
$ g s' B 5 lU
! tij 22.l'2l 225 24]
, g 083 32 3:2 , ,
e i
- . '2 i., ,
w _J W A
- 7 8 0
, Y,j,4'. *. . . . . -
- j{ 2 7 Di
- 14. "
g 1 ll 1~ s E ** I d5 5 S}) 213 33
.a aa
,e 0 3: 41
,3 -.
a - tit
?. 1
- 1. 5 - ..
Il tl18.A 2 s - .
? ! 3 s s s a 1 2 2
2 2 2 3 1 1 1 1 1 9 a l l*l hl:gli 1 "- O I { l t :je v1j:( e . 4 4 . a ; I g H l G 3 . 3 : 4 a s! g ~. . j 1116 - . . . . - j ," c .. . . . . . ... s'j
. a=i h K' *g 5 s: '
3*O*
*j:] e . . e y . .
4' 5
- EI e tj,_]g e
~
$}}