ML20195G961

Technical Evaluation of Proposed Redundancy Requirements for Helium Circulation Tech Specs to Accommodate Rapid Depressurization Accident, Technical Evaluation Rept

ML20195G961
Person / Time
Site:	Fort Saint Vrain
Issue date:	12/14/1987
From:	Ball S, Moses D OAK RIDGE NATIONAL LABORATORY
To:	NRC
Shared Package
ML20151M154	List: ML20151M148 ML20151M160 ML20195G961 ML20195G968
References
CON-FIN-A-9478 NUDOCS 8801080075
Download: ML20195G961 (20)

Text

_ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .

. a TECHNICAL EVALUATION REPORT FORT ST. YRAIN NUCLEAR GENERATING STATION -

DOCKET 50-267 LICENSEE: PUBLIC SERVICE CO. OF COLORADO TECHNICAL EVALUATION OF TE PAOPOSED REDUNDANCY REQUIREMENTS ft)R HELItN CIRCULATION TECHNICAL SPECIFICATIONS TO ,

ACCOP910DATE TE RAPID DEPRESSURIZATION ACCIDENT PREPARED BY:

D. L. Moses S. J. Ball Oak Ridge National Laboratory Oak Ridge, TN. 37831 December 14, 1987 NRC Lead Engineer: K. L. Heitner - NRP Project: Selected Operating Reactor Issues - Technical Assistance for Fort St. Vrain (FSV) - Support for FSV Technical Specification Upgrade Review (A9478 - Project 1. Task 7).

1 m

NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumed any legal liability or responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report or represents that its use by such third party would not infringe privately owned rights.

. - - ,-- . - - - . -- , , ., - - - - ,a -. -- -- , - --- - , , , - . - . , - -,

l

]

Technical Evaluation of the Proposed Redundancy Requirements for Helium Circulator Technical Specifications to Accosanodato the Rapid Depressurization Accident

. D. L. Moses S. J. Ball

1. Introduction and Summary For Safe Shutdown Cooling, the proposed upgrade of the Fort St. Vrain Technical Specifications would require no more than one of the two helium circulators in each of the two primary cooling loops to be OPERABLE on water turbine drive when the reactor is operating above 5% of rated thermal power or has significant levels of decay heat as detenmined by the magnitude (>760 F) of the CAICULATED BULK CORE TEMPERATURE. The Economizer-Evsporator Superheater (EES) Section of each of the two steam generators is also required to be OPERABLE under the same conditions so that two OPERABLE cooling loops exist each consisting of at least one OPERABLE helium circulator and one OPERABLE EES Section. These requirements assure minimum redundancy in the structures and components of the Safe Shutdown Cooling System that interface with the primary coolant.

However, to assure adequate core cooling following a Rapid Depressurization Accident (RDA), which is described in Updated FSAR Section 14.11 as the Design Pasis Accident No. 2 (or DBA-2), analysis has shown that two helium circulators operating at a speed of 8000 rpm are required to prevent fuel damage in the depressurized core following prolonged operation of the reactor at 105% of rated thermal power. Achieving 8000 rps on two circulators requires the use of high pressure feedwater that is provided by at least one boiler feed pump, two of which must be OPERABLE at all times per the Technical Specifications. As described in Updated FSAR Section 14.11.2.2, no fuel

, damage is predicted to occur as long as feedwater drive of two helium circulators can be initiated within 60 minutes of the reactor depressurization and assuming no other cooling takes place within that time. The licensee for Fort St. Vrain, Public Service Company of Colorado (PSC), has presented an analysis (Attachment No. I to Ref.1) to support a position that the occurrence frequency for a Rapid Depressurization Accident (RDA) is

, sufficiently low (>10-' per reactor-year) as to be incredible so that Technical Specifications are not needed to require both helium circulators in -

each loop to be OPERABLE on water turbine drive.

This Technical Evaluation addresses the adequacy of the Fort St. Vrain design

! to provide forced cooling in the event of a RDA or RDA-equivalent event. This Technical Evaluation documents a review of the occurrence frequency for a RDA and concludes that the frequency of the event could be as high as 3 x 10-5 per reactor-year insteed of 10-* per reactor-year as concluded by the licensee in Attachment No. I to Ref. 1. However, the frequency of core damage given that a RDA occurs is estimated to be 2.5 x 10-3 per event based on analysis performed Science Applications International Corporation (SAIC]

(Attachment 1). Thus, the occurrence frequency for core damage due to a RDA or equivalent event is estimated to be about 7.5 x 10-8 per reactor-year.

4

Previous cnalyses have shown that for extended FSV operation at 35% power, there would be no fuel damage expected for a complete loss of forced cooling accident. In this case, the cooldown is due entirely to heat losses to the liner cooling system (LCS). Considering that the current 82% limitation on FSV operating power level would reduce the cooling needed to prevent fuel damage as compared to the 105% power FSAR case, an independent ORNL analysis was mede of the poter.tial for core damage for intermediate scenarios. In the came considered in the present analysis, only one seismically and environmentally qualified circulator with a class 18 driver (boosted firewater) is assumed to be available for the cooldown. This is a highly reliable system not dependent on offsite power. Even so, it was determined that there would be very little fuel damage expected for <824 power scenarios.

2. The PSC Position on the Need for Helium Circulator Redundancy Attechnent No. I to Ref. I presented the PSC position as follows:

With the singular exception of the Rapid Depressurization Accident (DBA-2), one circulator on Pelton wheel drive assures safe shutdown cooling and requiring two circulators to be operable provides protection against a single failure. In the depressurized condition after DBA-2, the less dense helium requires that two circulators be operating on 8000 rpm Pelton wheel drive to assure safe shutdown cooling. For this case, requiring two operable circulators does not allow for a single failure.

This is acceptable because of the extremely low probability of the occurrence of DBA-2. A probabilistic analysis performed by GA Technologies has indicated that the probability of a DBA-2 depressurization is less than 1 x 10-' per year with an uncertainty factor of such less than 90. This analysis is included at the end of this discussion. This is much less than the safety goal currently being considered by the NRC.

l The proposed Technical Specifications assure sufficient operable equipment to provide safe shutdown cooling for this low probability event. PSC does not consider that it is appropriate to require

, additional operable equipment to allow for an additional failure.

l The FSAR (Section 10.3.10, Safe Shutdown Cooling with Single Failures in l

Cooling Water Supplies), does not indicate that single failure protection is provided for DBA-2, where two circulators are required. PSC considers that this de ;ree of protection is not a feature of the FSV design or licensing basis.

The occurrence frequency for a RDA (the DBA-2) at Fort St. Vrain was estimated by GA Technologies. Inc. for PSC. The basis for this estimate was documented in GA internal letter, L. L. Parse to A. J. Kennedy, Frequency of Large Leaks in FSV, SR:LLP:105:85, dated November 8,1985. This letter is enclosed as part of Attachment No. I to Ref. 1. The discussion section of the cited letter is quoted as follows with explanatory inclusions in brackets:

l 5

l -

l

l 1

Of the various penetrations in the FSV PCRV, 57 are capable of leading to substantial depressurization rates if they were to fail. These are the 12 steam generator module, 37 refueling, I top head access, I bottom head access and 4 circulator penetrations. (The sua is only 55, not 57. See l Updated FSAR Table 14.11-2. ) The evaluation in the FSV FSAR for DBA-2  !

consists of postulating and analyzing the failure of the closures for '

these penetrations.

A commonly quoted median failure rate of a nuclear pressure vessel is 10-7. per vessel-year with an uncertainty factor of about 10 (Ref. 2) (The reference is: An Assessment of the Integrity of the PWR Vessels. Report by a Study Group under the chairmanship of Dr. W. Marshall, CBE, FRS, Oct 76.] Since such a vessel may contain on the order of 100 penetrations, the probability of a single structural failure in any given penetration cannot be significantly greater than 10-' per year. This failure frequency is used as an estimate for the likelihood of failure for any single primary closure on the FSV PCRV, all of which are designed in accordance with the principles of the ASME Boiler and Pressure Vessel Code,Section III, Class A.

The failure of a single closure, however, is not enough to cause a

, transient such as that described by DBA-2. Each penetration of the PCRV is closed by two independently secured closure structures. Thus a failure of these two closures must occur before such a leak can be i experienced. Significant effort has been expended to assure independence in the design of these closures. Continuous leak monitoring and vertical movement stops are two examples. Nevertheless, they are subject to a variety of common factors such as materials, welding, environment, etc.

which could possibly lead to common mode failure. While quantifications of this common mode factor could be somewhat difficult, a conservative value, representative of active components, can be used as an estimate.

In this case a Beta factor of 0.02 (Ref. 3) is assumed between the redundant penetration closures. (The reference is: HTGR Accident Initiation and Progression Analysis Status Report - Vol.III. GA-A13617.

i Nov 1979)

Therefore, taking the 57 penetrations included within DBA-2, a penetration failure frequency of 10-Sper year and the probability that the second closure fails given that a first fails, the median frequency of a DBA-2 type depressurization occurring is about 1 x 10-' per year.

i Prob = (57 penetrations) x 10-*/ year x 0.02

= 1 x 10-8 per year In a 30 year plant life this corresponds to a 3 x 10-* probability of l such an accident occurring.

The uncertainty of this estimate is due to both the uncertainty in the assessed frequency of a single closure failure, 10, and that of the common mode failure between closures. While the assumed use of a Beta factor characteristic of active, powered components is very likely 6

conservative, there is significant uncertainty. However the common mode factor cannot be greater than unity bounding the common mode uncertainty at 50. So, assuming log normal distributions, the total uncertainty for j this estimate is less than 90.

3. Evaluation of the PSC Estimate of the DBA-2 Frecuency of Occurrence 3.1 Basis for Vessel Rupture Frequency Estimates As stated above, the PSC/GA estimate of the DBA-2 frequency of occurrence is derived from GA's use of "a commonly quoted median failure rate of a nuclear pressure vessel" as "10-7 per vessel-year with an uncertainty factor of about ,

10." GA provided a reference for this estimate as being the British Central Electricity Generating Board (CEGB) Study Group Report dated October 1976.

This report has not been reviewed here, but susmary papers authored by Dr. W. Marshall in 1977 have been examined (Refs. 2 and 3). In addition, testimony relative to vessel integrity was briefly reviewed from the CEGB proof of evidence for the Sizewell "B" power station public inquiry in 1982-83 (Refs. 4 and 5). The thrust of the CEGB positions is that field experience with pressure vessels that are similar to reactor pressure vessels yields a vessel failure or rupture frequency of about 10-4 to 10-5 per vessel year but that a comprehensive program of volumetric examinations (primarily, radiography and ultrasonic inspection) during vessel fabrication sho'uld reduce the failure rate in reactor vessels to less than or equal to 10-* per vessel year. To preclude exceeding this estimate for the rupture frequency throughout vessel life, a comprehensive inservice inspection program is to be implemented by the CEGB employing both surface examinations such as magnetic and dye penetrant methods and volumetric examinations such na eddy current testing, radiography and ultrasonics. The CEG3's emphasis on surface and volumetric examinations during vessel fabrication and subsequently during inservice inspection is consistent with the recommendation of Article IWA-2000 (Examination and Inspection) and Table IWB-2500-1 (Examination Categories) in Division 1 (Light Water Reactor),Section XI of the ASME Boiler and Pressure Vessel Code.

It is noted that previously, as part of the preliminary results from the Accident Initiation and Progression Analysis (AIPA), GA also quoted the same value of 10-7 per vessel year for rapid depressurization events baced on 100 square inch failures in PCRV penetrations (see page 4-20 through 4-21 Ref. 6). The earlier GA usage cited WASH-1500 (Ref. 7) er quoting a "disruptive failure probability of 1 x 10-8 failures per nessel year" but further noted that "the median estimate for a large disruptive failure of an LWR pressure vessel was estimated at 10-7 per vessel year." The AIPA l evaluation of the RDA for the large RIUR did not proceed beyond the screening l

stage because the large HTGR that was evaluated within the AIPA was to be housed in a containment building and so the consequences of PCRV leakage were minimized. It is also noted that the large RTGR used single closures only for the PCRV rather than the double closures used at Fort St. Vrain.

There are several problema inherent in the logic of using the 10-7 per vessel year failure frequency for HTGRs and particularly for Fort St. Vrain. The WASH-1400 analysis, as documented on page V-45 of Appendix V (Ref. 7), is 7

derived from the Advisory Committee on Reactor Safeguards ( ACRS) Report, Integrity of Reactor Vessels for Light Water Power Reactors, dated January 1974. The ACRS logic, which is quoted verbatia in WASH-1400, is that world-wide field experience on non-nuclear vessels has shown failure rates "by modes pertinent to reactor vessels" as being less than 10-s per vessel year.

The ACRS also concluded that "the disruptive failure probability of reactor vessels designed, constructed and operated to Sections III and XI of the (ASME Boiler and Pressure Vessel) Code" is less than 10-* per reactor year. It is l noted that "construction per Section III of the Code" implies complying with ,

the fabrication inspection provisions of that section and that "operation per l section XI of the Code" implies complying with the inservice inspection provisions of that section. Further, the ACRS concluded that "disruptive failure probability of such reactor vessels beyond the capability of engineered safety features is even lower". The WASH-1400 analysts therefore concluded that a value of 10-7 per reactor year was pertinent "for ruptures of

' the reactor vessel large enough to be beyond the espability of the ECC (Emergency Core Cooling) systems." The British CBGB summary papers and proof of evidence cited above also concluded that vessel rupture fregttencies would be below 10-* per reactor year, but the British conclusion also emphasized the importance of a comprehensive and aggressive fabrication and inservice inspecticn program in assuring confidence in that estimate.

3.2 Comparison of PWR Rationale to Fort St. Vrain Unlike that of the pressurized water reactor (PWR), the Fort St. Vrain neergency core cooling requiraments are judged to be less dependent on the size and the location of the vessel failure because .he coolant is a pressurized gas and not a two phase fluid. The PWR ECCS is designed to acconsodate the largest double-ended break in the primary coolant piping.

Such a break would be located at or slightly below the inlet / outlet nozzle to i

the pressure vessel (at most only slightly below at the loop seal). The only PWR vessel penetrations below the nozzles are the multiple amm11 (<<0.5 inch -

diameter) instrument penetrations through the bottom head. The offset rupture of one of the bottom head penetrations is not sufficient to prevent core flooding by the PWR ECCS, Multiple ruptures of the PWR small bottom head penetrations or a PWR vessel through-wall rupture would have to occur in order to exceed the PWR BCCS capability.

Unlike the PWR, Fort St. Vrain has no high capacity charging (makeup) or

, safety injection systems to replenish coolant or to maintain coolant density.

Cooling is provided by assuring adequate mass flow of the available coolant at the pressure and density that result from a decrease in the gas coolant inventory. The rupture of virtually any sized penetration at any PCRV location at Fort St. Vrain can require the same level of long tern pressurized

! cooling as the large sized rupture depending upon whether forced cooling is lost subsequently to or simultaneously with the initiation of the depressurization. The maximum credible depressurization rate, as discussed in Updated FSAR Section 14.8 and as illustrated in Updated FSAR Figure 14.8-2, never exceeds a helita leak rate of 3.5 lb/s with complete depressurizatien of the PCRV within about 85 min (i.e., an exponential time consistant of 1600 s), e As described in Updated FSAR Section 14.4.3, during depressurization at the

{ maximum credible rate, adequate core cooling can be provided by steam drive of J

8 I

one helium circulator or, with five minutes delay in startup, by feedwater drive of one helium circulator assuming an arbitrary (non-mechanistic) loss of the steam drive. In this case, only one circulator needs to be operated at a high speed because the helium density decreases relatively slowly. However, if for any reason forced circulation were lost throughout the time that the PCRV slowly depressurizes, the cooling requirements would be more like those for a RDA. Updated FSAR Section 7.3.10.4.2 indicates that actuation of the Steam Line Rupture Detection and Isolation System (SLRDIS), which effects a trip of the steam driven circulators, will not occur as the result of the postulated accident leading to the maximum credible depressurization rate.

A mechanistic rationale for the possible high-speed trip of the circulators on steam drive is providea by the blow down loads on the circulators if a RDA (DBA-2) occurs as described in Updated FSAR Section 14.11. In addition, the DBA-2 RDA is predicted to actuate SLRDIS as indicated in Updated FSAR Section 7.3.10.4.2. Because of the low helium density following a RDA, if the circulators are tripped on steam drive, restart of two helium circulators on feedwater drive is required to provide adequate cooling, and adequate cooling is predicted to be provided even if the restart of the two circulators on feedoater drive is delayed up to 60 min. Thus, at Fort St. Vrain, the location and size of a PCRV penetration failure can affect the cooling requirements by determining whether the blowdown rate is large enough to cause an overspeed trip of the helium circulators on steam drive and by affecting the local environment which may influence operations necessary to recover forced cooling as has been addressed separately by the licensee per 10 CFR Part 50.49. Since a helium leak smaller than DBA-2 but larger than the postulated maximum credible depressurization rate may produce local conditions that can actuate SLRDIS, which has been installed to comply with 10 CFR Part 50.49, the recovery from a small leak causing SLRDIS actuation could lead to conditions and delay times that require the same level of cooling as the RDA with delayed recovery. The current Updated FSAR does not provide parametric analyses to show what range of leak rates can result from

, the failures of the amaller penetrations and whether such failures can actuate SLRDIS thereby leading to a loss of forcui cooling. Thus, the Updated FSAR provides a bounding analysis in terms of the effects of depressurized core cooling as required to accommodate a RDA but does not provide sufficient analysis of effects as a function of potential cause to support probabilistic analysis of the occurrence frequency of RDA-equivalent events that could be caused by smaller leaks.

It is judged to be beyond the scope of this Technical Evaluation to determine conclusively whether the construction, preservice and inservice inspections performed on PCRV penetration closures at Fort St. Vrain are equivalent to the intent of the fabrication and inservice inspection programs for PWR vessels as envisioned by the CEGB (Refs. 2 through 5) and in Division 1 of Sections III and XI of the ASME Code. Article CB 2535.1 (b) of Division 2,Section III of the ASME Code stipulates the volumetric and surface examinations required during fabrication of Class A and B pressure retaining metallic components of a PCRV. Updated FSAR Section 5.8.2 describes the PCRV primary and secondary closures as having been "designed" to the ASME Code's principles respectively for Section III Class A and Section III Class B. Also, Updated FSAR Section 5.11.6 indicates that inspection and testing were required to comply 9

with Class A requirements; however, no information is provided that such examinations were octually performed or as to the type of examinations, if any, that were actually performed. In contrast, Updated FSAR Section 5.11.5 details the volumetric and surface examinations performed on the PCRV liner welds, which may include primary closure attachments but is not so indicated, and Updated FSAR Section 5.11.7 details similar volumetric and surface examinations that were performed on the thermal barrier. The only fabrication examinations described in detail for the penetrations and closures are the leak testa as documented in Updated FSAR Sections 5.8.2.3, 5.11.6 and 5.13.1.2 and in Updated FSAR Appendix E.22. Thus, nowhere in either Updated FSAR Chapter 5 or Updated FSAR Appendix E has there been found a description of or reference to the specific volumetric and surface examinations that were actually performed during fabrication of the. penetration liners and closures; only pressure decay tests and leak testing are described per se. Because of the FSAR's ambiguity with regard to the fabrication of the PCRV penetrations and closures and without an indepth audit of the licensee's construction records, the applicability of the criteria used by the CEGB and the WASH-1400 analysts for assessing vessel integrity canaot be readily established for Fort St. Vrain based on available documented record of the breadth, depth and quality of examinations during fabrication.

In addition, PSC's initial proposals for inservice inspections of penetration closures were based solely on leakage monitoring of the penetration interspaces (see Section 4.8, Enclosure 2 to Ref. 8). A review of the PSC proposals for inservice inspection was perfonned for NRC by ASTA, Inc. , under subcontract to Los Alamos National Laboratory (Ref. 9). Appendix A-1 of Ref. 9 addresses ASTA's interpretation of inservice inspection requirements for the PCRV penetrations and closures based on a comparison to Division 2,Section XI of the ASME Code. PSC responded by incorporating several of ASTA's recommendations, including surface inspection for certain circumferential and attachment welds, as documented in Section A-1 of the Attachment to Ref.10 and in Enclosure 1 to Ref.11. PSC's incorporation of some of the ASTA recommendations was approved by NRC in license Amendment 33 (Ref.12) and is described in Technical Specification SR 5.2.28 and Updated FSAR Section 5.13.11. PSC found no basis for requiring volumetric examinations and recommended that NRC not require examination of flow restrictors and the circulator penetration limit stop due to their inaccessibility. The hold-down plates for refueling penetrations were accepted by NRC as performing the equivalent function to flow restrictors and were subject only to visual inspections. It is judged that PSC's proposed surveillances do provide nominal compliance with the requirements of Division 2,Section XI of the ASME Code. However, ASTA made two important points in their review, and these j points were apparently not addressed by either PSC or NRC in the available l documentation.

In Appendix A-1 of Ref. 9, ASTA noted that:

(1) Penetrations, failure of which will results in a RDA (ASTA used the tern DBDA in reference to a Design Basis Depressurization Accident), may not be considered as being exempted from volumetric and surface examination for precsure-retaining boundaries, and 10

(2) The Fort St. Vrain penetration double closure design concept places this component in a unique inspection category not directly addressed by the proposed [ Division 2 of the ASME) Code although the basic precepts are generally applicable. l 1

Essentially, PSC with NRC concurrence (Ref.12) is judged to be employing a  :

limited inservice inspection program for penetrations and closures utilizing unspecified methods for surface examination of a few accessible welds and visual examinations elsewhere but again only where components are accessible.

Without a detailed audit of records it cannot be established whether the Fort St. Vrain program of fabrication examinations combined with inservice inspection has been or is equivalent to the intent or extent of the fabrication examination and inservice inspection programs of PWR vessels as described above. Therefore, it is difficult to judge whether the one to two orders of magnitude reduction in vessel rupture frequency that is accounted for in the logic employed both by the ACRS as quoted in WASH-1400 and by the British CEGB in their deliberations on Sizewell-B is applicable to assessing the failure frequency of the Fort St. Vrain penetration closures.

Another potential problem in the Fort St. Vrain penetrations is the possibility of undetected corrosion or aging effects on the closures.

Division 2,Section XI of the ASME Code addresses only irradiation damage and only in the surveillance of liner materials (IGK-3340). It is judged that the ASME Code Division 2 requirements were written with the assumption of absolute dryness in the penetrations and ignored the potential for moisture-induced corrosion of metallic components in the penetrations, and therefore the ASME code limited aging considerations to irradiation effects only. Irradiation damage has been a nsjor concern for PWR pressure vessels. Therefore, the ASME Code Division 2 inservice inspection requirements are consistent with Division 1 (LWR) requirements in terns of one specific aging mechanism (that is, irradiation embrittlement of the liner) addressed but are judged not to be consistent in terms of intent (that is, identifying and responding to all major potential causes of loss of vessel function). As noted in the NRC draft

, safety evaluation appended to Ref.13, NRC has yet to adopt formally the ASMI Code, Division 2 requirements although the Code is recosusended by NRC for guidance.

It is noted that large pressurized but not purged penetration interspaces at Fort St. Vrain tend to be located near the bottom of the reactor vessel.

These penetrations are subject to relatively frequent repressurizations which will tend to drive contaminants which might have entered the purification supply train during shutdown into these interspaces. They are subject to moisture ingress from stema generator header leaks, circulator bearing water leaks and water backup and redistribution through the purification supply train (see for example Reportable Occurrence [20] 50-267/85-007). Based on inforsation supplied by the licensee in the NRC review of 90 50-267/85-013, the licensee currently does not test water drained from the lower head penetration interspaces for chemical impurities. It might not be too unfair a characterization to describe the lower head penetration interspaces as often having been moisture leden sumps that collected whatever "stuff gets picked up in, injected into or leaked into the purified helium supply header and train downstream of the purification system. The primary and secondary 11 -

closures may also be potentially exposed to chlorides and other corrosive agents as evidenced in the circulator housing by Ros 50-267/85-002 and 50-267/87-019. It is also not determined whether chlorides were used to speed up the curing of Fort St. Vrain PCRV concrete during cold weather. Such practice was reportedly used at reactor construction sites during the time at which Fort St. Vrain was being constructed. Chemical corrosion or chemical induced degradation of the penetration closures is a potential probles that is apparently not being addressed in the Fort St. Vrain inservice inspection program.

3.3 Alternate Frequency Estimate for Fort St. Vrain RDA or RDA-Eauivalent Event -

Based upon considerations discussed above, the frequency for vessel penetration closure ruptures at Fort St. Vrain is judged to lie between 10-5 and 10-8 per reactor year using the same data base as the 1974 ACRS study.

From Attachment 1 to Ref. 1, there are 57 (actually 55) penetrations that could lead "to substantial depressurization rates if they were to fail."

However, there are judged to be more than 57 penetrations that could lead to a depressurization that could also potentially actuate SLRDIS and thus initiate a delayed depressurized core cooling in terms of requiring more than one circulator on feedwater-drive. .

GA divided the PWR vessel rupture frequency estimate among the projected number of PWR penetrations. The derivation of the PWR estimate for WASH-1400 is based on the rupture size and location (that is, exceeding the capabilities of the ECCS and having to be below the vessel nozzle locati a) and not the number of penetrations. The GA analogy is judged not to be ipplicable, Instead it can be argued that, since each Fort St. Vrain pene' ration interspace represents a separate pressure vessel because the penetration closures are separate noncontiguous welded units, the pertinent pressure vessel failure rate should simply be multiplied by the number of Fort St.

Vrain penetrations. This conclusion also assumes that treating each penetration interspace as constituting a separate vessel is consistent with the ACRS data analysis of field experience of vessel ruptures "by modes pertinent to reactor vessels." This analogy is judged to be closer to ACRS logic than the GA analogy. But if this analogy is unacceptable, the GA analogy is also unacceptable, and a new data base is needed for pertinent failure modes.

l Thus, the frequency estimate for closure failure rate should be on the order of 60 (the number of penetrations that might actuate SLRDIS if failed) times a value of about 4 x 10-* Per reactor year for one closure in each penetration.

Therefore, the closure rupture frequency estimate is 2.4 x 10-4 per reactor year for the failure of a single closure among all penetrations. The failure of the second closure in a penetration given the failure of the first closure in the same penetration was estimated by GA using a beta factor of 0.02.

However, the GA beta factor is based on active components which are presumably tested or surveilled periodically as well as maintained. This estimate is judged not to be adequate for a thin structure that is infrequently and perhaps inadequately inspected if it is inspected at all. Given the questionable adequacy of inservice inspection that fails to account for 12

potential corrosion mechanisms, a conditional probability of 0.1 per failure is a more reasonable estimate thnt the second closure would also fail due to similar undetected degradation effects. Therefore, an alternative estimate is made of about 3 x 10-5 per reactor year for the frequency of accidental depressurization in the Fort St. Vrain vessel to an extent requiring DBA or DBA-2 equivalent cooling capability.

Surveying a different set of data bas **, the SAIC investigation found, as described in Attachement I to this te's cal evaluation, that pressure vessel disruptive failure rates were estime. .o range between 7.4 x 10-4 per vessel year to 3 x 10-* per vessel year. The estimate that was derived above for the Fort St. Vrain penetration closure disruptive failure falls within this range.

1

4. Core Damage Frecuency Given a RDA or RDA-Eauivalent Event Attachment 1 to this Technical Evaluation presents the results of a probabilistic analysis performed by SAIC to estimate the core damage frequency given the occurrence of a RDA or RDA-equivalent event. As indicated in Figure 1 of Attachment 1, the frequency of the core damage sequence is dominated by the probability that the PCRV penetration failure occurs in a steam generator penetration with secondary contribution (1) from the independent occurrence frequency for loss of offsite power resulting from reactor trip and (2) from the conditional probability that the operator trips the undamaged loop and then fails to recover it.

The latter conditional probability on operator error and recovery is possibly misstated since SLRDIS and not the operator will most likely cause the loss of forced cooling at Fort St. Vrain. The actuation of SLRDIS is expected for the 55 penetrations whose failure could effect an RDA (compare Updated FSAR Table 14.11-2 to Updated FSAR Section 7.3.10.4.2) and is judged to be's Possibility due to failure of other penetrations. It is for this reason that the 60 penetrations were assumed in the above-documented estimation process of the occurrence frequency for RDA or RDA-equivalent events. If SLRDIS actuates, the operator must be relied upon to recover forced cooling within 60 min and the estimated recovery failure rate of 0.01 per demand as given in Table 1 of Attachment 1 is consistent with the current screening criteria (Table 2 of Ref. 14). Given the occurrence of a RDA or RDA-equivalent event, the estimated core damage frequency obtained by SAIC is 2.5 x 10-a per demand which is judged to be a reasonable estimate.

As discussed in Sections 3 and 4 of Attachment 1, the SAIC analysis of failure to recover forced cooling was based on the combined failure to provide two helium circulators with either steam drive or high-pressure feedwater drive 1 and to provide at least one steam generator with either feedwater, condensate or firewater. In Section 5 of this technical evaluation, depressurized cooling capability is examined for the cases of a helium circulator being driven by either condensate or firewster.

4 An SAIC preliminary analysis of risk (dose frequency) was also provided in a

Section 5 of Attachment I to this Technical Evaluation. Although the purpose

! 13 i

l

_-L

cf the SAIC preliminary risk analysis was to assess the risk of core damage events, for the purposes of scoping, the dose estimates were based on the effect of primary coolant blowdown resulting from the RDA as projected in Updated FSAR Table 14.11-1 and not on the effect of core damage resulting from a permanent loss of forced cooling as calculated in Updated FSAR Table 14.10-1. The hypothetical blowdown duration doses are based on a design inventory of coolant and plateout radioactivity that is known by plant operating experience to be higher than the actual radioactivity by about a factor of 100 for noble gases and between 100 and 1000 for iodine. The projected duration (six month) dose based on core damage can be estimated conservatively for the RDA by factoring out the filtration effect on the doses in Updated FSAR Table 14.10-1. The filtration effect is factored out because the PCRV has an opening via the blowdown flowpath and the reactor building overpressure louvers are assumed not to have effectively resented nor subsequently been repaired following their lifting after PCRV blowdown. These assumptions are conservative because the radionuclides passing through the reactor building to the louvers will be attenuated due to the orientation of the leak path from the PCRV and the effect of the reactor building ventilation and filtration system.

Using the GA calculated source term in Updated FSAR Table 14.10-1 as opposed to the somewhat higher values from TID-14844, the combined durstion blowdown and core damage dose at the boundary of the low population zone can be estimated as follows in Table 1 for the RDA with subsequent permanent loss of forced cooling:

Table 1. Duration Dose (rea) at the Low Population Zone Boundary Blowd wn Core Damage Type of Dose Contribution Contribution Total Whole body gamma (WBG) 0.073 0.0001 0.073 Thyroid 0.300 0.99 1.29 Bone 0.006 0.056 0.062 The duration (six month) dose at the exclusion area boundary due to core damage was not provided in Updated FSAR Section 14.10 for the permanent loss of forced cooling. As given in Table 2, this can be estimated by backing out an effective dilution factor from the information in Updated FSAR Table 14.11-2 for the blowdown doses.

14 i

l

Table 2. Duration Dose (rem) Estimate at the Exclusion Arca Boundary Type of Dose Dose Whole body gamma (WBG) 2.5 Thyroid 21.5 Bone <0.775 i

I These estimated doses are less than the limits for the exclusion area boundary as given in 10 CFR Part 100.11(a)(1) for two hours immediately following the initiation of the release. Using TID-14844 source terms would yield a higher duration dose but the expected doses in the first two hours would still be  !

much less than the Part 100 limit. The risk from the RDA is estimated as l follows in terms of dose consequence times the accident frequency. Using the range of values discussed by SAIC in Attachment 1 for pressure vessel failure (7.4 x 10-4 per vessel year to 3 x 10-s per vessel year, which bracket the estimate of 3 x 10-s per reactor year estimated above for the Fort St.

Vrain RDA and RDA-equivalent event) and using the SAIC probability estimate of core damage given pressure vessel failure (2.5 x 10-3 per failure), the following dose rates (risk) are estimated assuming no significant additional release beyond the first six months:

Table 3. Risk: Duration Dose Rate (rem per year)

At the Exclusion At the Low Population Type of Dose Area Boundary Zone Boundary Whole body gamma (WBG) 4.6 x IO-* - 1.9 x 10-e 1,4 x 10 5.5 x 10-20 Thyroid 4.0 x 10-s - 1.6 x 10-7 2. 4 x 10- * - 9. 7 x 10-

• Bone 1.4 x 10 5.8 x 10-8 1.2 x 10 4.7 x 10-20 The resulting risk estimates, which are shown in Table 3, are judged to be very conservative.

5. Independent Analyses of Reduced-Power. Reduced Cooling Scenarios In the event of a RDA from power levels lower than that assumed in the FSAR DBA-2 case (105%), it is clear that the cooling required to prevent fuel damage would be less. Previous analyses made by the licensee and confirmed by ORNL have shown that even with no forced circulation co-1ing, no fuel failure 15

is expected for postulated RDAs below 35% power, where sufficient ~ cooling would be provided by heat transfer from the core to a single operational train of the LCS. In the present analysis, it is assumed that limited forced circulation cooling of the depressurized primary coolant is made available via operation of one of the four circulators powered by the Pelton wheel drive.

Motive force for the Pelton wheel (and cooling for a single EBS train) is assumed to come from either the boosted firewater or condensate water supply, at least one of which can be assumed to be available following either a design

. basis seismic event or fire in noncongested cable areas. The boosted firewater is provided by Class 1E pumps.

The independent analysis was done using the ORNL ORECA code, the pertinent features of which were described in a recent ORNL TER (Ref.15). LCS cooling '

was assumed to be available. The forced circulation cooling flow estimated to be available for the (limiting) boosted firewater drive case was derived from Ref.16, and was found to be 2.1 lba/s or ~0.22% of full rated flow. A parametric study was made for RDAs occurring from various power levels between 35% and 82%, and for minimum (5-min) and maximum (60-min) assumed delays in starting up the single circulator. In no case was the design temperature of the circulator exceeded. The results are summarized in Table 4 below, and an example of the calculated response (82% power, 5-min delay) is shown in Fig. 1.

I -

Table 4. ORECA Code Predictions for RDA Scenarios Max Peak Max Avr 4 Fuel  !

5-Min Delay-Cire. Restart Fuel (F) Fuel (F) Failure Initial Power 50% 2289 1544 0 60% 2508 1654 0 70% 2738 1763 0 ,

) 82% 3011 1910 <0.1

! 60 Min Delay-Cire. Restart Initial Power 50% 2305 1575 0 60% 2553 1691 0 70% 2779 1806 <0.1 4

82% 3045 1958 -1 As noted in the table,- no fuel failure is predicted for RDAs from power levels i up to 70% for the case where forced circulation is available with minimum

! delay (60% with maximum delay), and even for the worst case (82%, maximum 4

delay), the fuel failure is only on the order of 14. Thus, the risk from

, having to rely on boosted firewster instead of high pressure feedwater to ,

provide forced cooling is lower than the dose rates given in Section 5 of this i TER because only 1% as opposed to about 95% of the fuel is predicted to fail.

1 16 r

v

.,m., - - - . - - - - , , , , , , , , , . _ . . . , . _ . . _ - , . , _ , _ , , , , , , , , . , , . - , , , _ , _ , ,

y _ , , _ , __ _.p_. .,,,_7,m._,_,,g,,y

6. References

1. PSC letter. H. L. Brey to H. N. Berkow (NRC), Technical Specification Upgrade Program Redraf ted LCO's, P-86169 February 28, 1986 (PDR Accession No. 8603050288).

2. J. G. Collier and W. Marshall "How UK Experts Assess the Integrity of PWR Pressure Vessels" Nucl. Enr. Intl. 22 (259), 41-45, July 1977.

3. W. Marshall "An Asses'sment of the Integrity of PWR Pressure Vessels:

A U.K. Study Group Report", Paper G 6/1, Transactions of the 4th International Conference on Structural Mechanics in Reactor Technolory.

San Francisco, California. 15-19 August 1977, CONF-770807-Part G.

Commission of European Commuunities, Brussels, 1977

4. J. Whittle, Sizewell "B" Power Station Public Inquiry: CEGB Proof of Evidence, CEGB-P-13, Central Electricity Generating Board, London (UK),

November 1982.

5. J. R. Harrison, Sizewell "B" Power Station Public Inquiry: CEGB Proof of Evidence, CEGB-P-45, Central Electricity Generating Board, Lon-don (UK), February 1983.

6. T. Pasternak, et al, HTGR Accident Initiation and Progression Analysis Status Report: Volume III. Preliminary Results (Including Design Options GA-A 13617, Volume III, General Atomic Co., San Diego, California, November 1975.

7. U.S. NRC, "Quantitative Results of Accident Sequence", Appendix V.

Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Reactors, WASH-1400 (NUREG-75/014), U.S. Nuclear Regulatory Commission, Washington, D.C. , October 1975.

8. PSC Letter, J. K. Fuller to S. A. Varga (NRC), Fort St. Vrain Inservice Inspection & Testing, P-80034, March 3,1980 (PDR Accession No. 8003260561).

9. Review of the Public Service Company of Colorado Proposed Inservice Inspection Program ASTA. Inc, December 22, 1981, forwarded to NRC by LANL letter, C. A. Anderson to R. A. Clark, untitled. 0-13: 82:5 January 5, 1982. (PDR Accession No. 8201130206).

10. PSC letter, H. L. Brey to R. Clark (NRC), Fort St. Vrain Inservice Inspection and Testing, P-82061, March 29, 1982 (PDR Accession No. 8204120153).

11. PSC letter, H. L. Brey to R. A. Clark (NRC). Fort St. Vrain Inservice Inspection and Testing - Additional Surveillance Requirements, P-82430, September 30, 1982 (PDR Accession No. 8210060273).

17 i

1 t __ __. _.- ,.

12. NRC letter, P. C. Wagner to 0. K. Lee (PSC). Fort St. Vrain_Fuelcar Generating Station. Amendment No. 33 to Facility Operating License DPR-34, March 8,1983 (with Safety Evaluation enclosed)

(PDR Accession No. 8303150001).

13. U.S. NRC, Draft Safety Evaluation Supporting Utility 851127 Proposed Technical Specification Changes for Category I & II Inservice Inspection and Testing per ASME Code Section XI Division 2 "Rules for Inspection and Testing of Gas Cooled Reactor", Docket No, 50267 U.S. Nuclear Regulatory Commission Washington, D.C., May 30, 1986 (PDR Accession No. 8606120097).

14. A. J. Oswald, et al, Generic Data Base for Data and Models Chapter of the National Reliability Evaluation Progras (NREP) Guide EGG-EA-5887 Idaho National Engineering Laboratory, Idaho Falls, Idaho, June 1982.

15. S. J. Ball and D. L. Moses Technical Evolution Report - Fort St.

Vrain Safe Shutdown Fros 82% Power, June 4 1987.

3

16. W. Strohmayer, Fort St. Vrain Circulator. Pelton Wheel Driven circulator Performance, 907274/A, GA Technologies Inc., April 25, 1984, 18

FSV DBA-2 82% Power S-min Rwtort Dow +

3.2

" n

_ f ,-

2.8 -

2.6 2.4

~f 2.2

/ s ~

- _ q bq ***

l p n: : - 3;T -

t.8 m -3 , ,,

j{ f f- _

=

i= ' ' ' .f_.Ar-I'"

5:

4 1.2 1.0 _

0.8 0.6 0.4 0.2 0.0 - 26 12 16 20 24 0 4 e Time (hr) .

+ WAX CORE o AVO CORE -

O TC-OUT Figure 1. FSV Rapid Depressurization Accident from 82% power. Cooldown on one circulator with boosted firewster drive, minimum delay.

ATTACF0 TENT 1 SAC _ . _ _ . _

August 11, 1987 Dr. Syd Ball Oak Ridge National Laboratory Martin Marietta Energy Systems, Inc.

P.O. Box X Oak Ridge, TN 37831

Dear Dr. Ball:

Forwarded for your use are five copies of the final report describing the results of a mint-PRA analysis of the Ft. St. Vrain DBA 2 accident sequence.

Three concerns raised by K. Heitner have been addressed during preparation of the final package:

1. The range of restoration times following a loss of offsite power should be addressed.

Loss of offsite power (LOOP) resulting from the loss of generation capability at the time of a DBA 2 event was considered in the analysis using a conservative conditional probability of 10'3 for the likelihood of the initial LOOP and short term recovery. Even with these values LOOP sequences contribute insignificantly to the overall frequency estimate.

Additional modelling to addres; time dependent restoration of offsite power is not considered warranted. Note that, based on a review of the Ft. St. Vrain design, it was concluded that a LOOP as an initiating event would not appreciably increase the likelihood of a subsequent DBA-2 event, and hence event sequences initiated by LOOP were not developed.

2. No consequence analysis was included in the preliminary report.

', A simplified estimate of dose rates based on FSAR Chapter 14 dose estimates and actual fission product levels has been included.

3. Actuation of the steam line rupture detection and isolation system following a DBA 2 initiator has not bn. addressed in the sequences.

A probability of 0.01 has been assumed for a non recoverable trip of the undamaged loop. This value is considered adequate j to bound actuation of this system and its non-recovery.

l A10 One Mcge TMe. P 0. BLe 2501. Ook Mcge. TN 37K11 (61si ME? 9031

% 54< c% 4% cw., o  % a. u m Le % one se o.,. s sww. kwi ew %* o c I

Dr. Syd Ball August 11, 1987 Page 2 If you have any questions concerning this analysis, please call myself or Steve Hurrell at (615) 482-9031.

Siircerely, SCIENCE APPL.ICAT10slS INTERNATIONAL CORPORATION STH f,. 9..G).77)Q J. W. Minarick JWM/pr cc: K. Heitner, NRC D. Moses, ORNL J. Buchanan, ORNL

,,4, , , , , . , -,,n,- - - , , . . . - . . ..

-,-,,,-,--.,e,.n---., , ,- . , , , ,. . . . , * . . - . - - .