ML20195J417
| ML20195J417 | |
| Person / Time | |
|---|---|
| Issue date: | 11/30/1988 |
| From: | Emrit R, Milstead W, Pittman J, Riggs R NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | |
| References | |
| NUREG-0933, NUREG-0933-S08, NUREG-933, NUREG-933-S8, NUDOCS 8812020170 | |
| Download: ML20195J417 (212) | |
Text
-_ _ _ _ _ _ _ _ _ _ .
- /" '*eo
' 't, UNITED STATES 4 I #' I NUCLEAR REGULATORY COMMISSION (n
m o
s., . . . . . .<.?
' WASHINGTON D. C,20655 June, 1988 SUPPLEMENT 8 TO NUREG-0933 "A PRIORITIZATION 07 GENERIC SAFETY ISSUES" REVISION INSERTION INSTRUCTIONS Remove Insert Introduction pp. 21 to 54, Rev. 7 pp. 21 to 54. Rtv. 8 A Section 1 pp. 1.1.A.4-1 to 10. Rev. 4 pp. 1.1.A.4-1 to 11 Rev. 5 pp. 1.1.0-1 to 12, Rev. 3 pp.1.I.0-1 to 13 Rev. 4 pp. 1.11.E 1 to 13 Fev. 1 pp. 1.!!.B-1 to 14. Rev.2 pp. 1 !!.E.4-1 to 10 pp. 1.!!.E.4-1 to 11, Rev. 1 pp. 1.!!.F-1 to 6 pp. 1.!!.F-1 to 6 Rev. 1 Section 2 p. 2.A.44-1 pp. 2.A.44-1 to 2, Rev. 1 pp. 2.B.5-1 to 4 pp. 2.8.5-1 to 5, Rev. 1
- p. 2.C.14-1 pp. 2.C.14-1 to 2. Rev. 1 Section 3 pp. 3.43-1 to 5 pp. 3.43-1 to 7, Rev.1
- p. 3.57-1 pp. 3.57-1 to 8 Rev. 1 pp .3.86-1 to 3 pp. 3.86-1 to 3. Rev. 1 pp. 3.93-1 to 5 pp. 3.93-1 to 5, Rev. 1 pp. 3.125-1 to 58, Rev. 2 pp. 3.125-1 to 66, Rev. 3
- pp. 3.126-1 to 13
- pp. 3.136-1 to 3 Sect. ion 4 pp. 4.HF6-1 to 7. Rev. 1 pp. 4.HF8-1 to 7, Rev.2 0912020170 881130 PDR NUREQ PDR 0933 R
~. _ --.
I l
i o
R w
?
TASIE II tt$ Ting OF Att Tm! ACTI% ptan ITEMS, Tass ACTION Ptm IT[us, uv a= uic issuu. aus . _ _ _ e m..un u swu lhls table contains the priority ersignations for all issues listed in this report, for these issues found te he covered in other issues, the appropriate notatie.es have been made in the Safety Priority Ranking celen, e.g., I. A.2.2 in the Safety Priority Ranking colisen means that Item I.A.2.6(3) is covered in Item I.A.2.2. For resolved issues that have resulted in now requirements for operating plants, the appropriate multiplant licensing action nim 6er is listed. The licensing actlen numbering system bears no relattenship to the numbering systems used for identifying the prioritized issues. An emplanattee of the classificatten and status of the issues is provided in the legend telow.
Lesead NCTES: 1 - Possible Aeselr. tion Identified for Evaluetten 2 - Resolutlen Aveitable (Documented in MMAEG, mRC namorande, SER, er equivalent) 3 - Reseletion Resulted in either: (a) The Estabilshment of how Regulatory y Requirements (by Aule, SW Change, e er equivalent) er (b) he New Sequirements l 4 - Issue to be Prioritized in the Ntvre l 5 - Issue that is not a Generic Safety Issue but should be Assigned Besources for Completion l MIGN - Nigh Safety Priority l IEDItSt - Medians Safety Priority l LOW - Low Safety Priority i DecP - Issue Dropped as a Generic Issue j E - Environmental Issue I - TMI Action Plan Item With Implementation et Resolution mandated by I mueEG-0737
LI - ticensing Issue 9FA - Multiplant Action NA - Net Appilcable RI - Segulatory Impact Issue tf5I - Unresolved Safety Issue N e" g; 1
! ?
o O
40 ~3 w
w tD 1
l l
l l
m*1{o3 co A .
P o MN e
1 0
F 6666 2
0 F
333 000 Fff 111 A
N 1111 AA Nh AAAAAAA hNMNNhN 1111111 AAAA hNNh 4
h 8 c 8888 888 8888 66666 88 8 t n //// 8388888 888F8 88 8 sa 1111 /// ////1111/////// 1111111 ///// // /
eue t st 3333 111 333 3333 3~s 3 3 3 3 3 11111 33333 00 33 0
3
//// ///
asa LID 2222 1111 222 //// ///////
2222 2222222
/////
22222
// /
66 6 111 1111 1111111 11111 00 C n
ti o
ss ei 2222 55$ 5555 t v 5555555 55$55 55 5 ae LR
) )
3 3
) ) ) )) )) )
y a ))) )) )
t g (
b Eb ab bb b bbb1 ba a yi n ( T( (( ( ( (((1 (( (
t ri 3 3 03 h
33 2. (3 3 3 3330 33 3 eei r in E
T E
T (E
T EE TT 2.EEPE EEE(
N
[E E ara sPR O O IO OO A.OORO T T GT T TT OOO1 iT T O
II1N - I1I NILN- NN1NNDN INNNL - WON - N
/ S 8 8 8 e B8sR Q0QB B8S BBSB I BB888B 8B58E 8S l c L1tf QQQ QQOQ FQQOQQQ CtF Qf LL i i/ ///H tl t LLtL HLLLLLt tOHL H 00 H f n s5S/ /// ////5555 S55 /////// i555555 ///// // /
f o ifI0 Iif 5505s 55 i Oih HHHf HhH f f f f HHHH f ff f fff f f Aff f F f sc DDDD HHHHHHH HHR Hi HH H di n ava ////
DDD
///
DDDD
////RRRR /////// RRRRRRR DDDDDDD DDDDD
/////
// /
D RRR5 RRR RRSRR RR R eir ERR f ERR kRR R E ERE RRR lDB hNNR &2 ERR - RA R
- NNN hNNN - NNNhNNh hhRNN NM h n 5 yi o
r M
[
T rr rr ittaee I r r rr rrrrrrr ee ee run a a aa rhh hh r aaacaaa tt arc cc a ol i ag A N m m mml mmmummm iimtt t t m irvn PEE 7 t - - - lo C lo C
loo CC l l l l l ll ooooooo rrl aa eeohh aa hh l
o CCCCCCC EECTT Tt C 4
(
I C
A I
M t r
o f el ose s
nn s
n m a
s n
o E
O D
d n
9
_ T a sen o r i a r
e sco g t eis it o a O O
p nL r e a r n P it rP c P i l M r
i n eI F o if g g a n g io t s n n m nh dan i E ot n n nro g la n it si s s e aei n u s a g rw rs e it S pt i Q ia n r n e or a eOa n r e i P g t oe it r d c r*i d T io p s n D
u e p
n a nrema eopar n a t O ns si latd aa g
n e O r
tiOrT en g g r
o t u
f eesnd cgson mup ul i v f o pef or n f
it o i neia imps L antt SiUr f i o t mSoro s s n ht as o f t a o Pt i
n e n o rCirr tM n gS a a s rse Cdsnnge ci 8.1 r I i o f ee e ngoart t
S t r
s io n enc pon f aonp o
a r11 us dl g ean t
a f m aron pd msintl g eniau d ri t Oie ti iis rt nn T
e-1 cti ic aro igtl u o vi nl m n on a oaiui a si c f ar oce noaiI f d0 onn f roaaf le rramS im i i p iot airn ca oi8 u
rei Pma i
errno v pT ri e m TSg L l e dA vd g n if gf s niE t rfTi gG R ar l
a itPeo pit D If n
[
M n A aei in R sndI pon u rgOt i ne o n gi l l c pl f n yN q Cn 0
h n o l o r id a
a u
6da-au Oaoo dr 5oiuf
- i rdm d
n r i oy inni as if u i aof5htf o R f sode a tdsna 5
R s
r cigg r Q _ rQs g n itr of rQnt oa rt ga o sc onfAt aueir e np Rk ern d e a e l t gat E
P P iniu n
d n
pdo Uni e d i p s pl wI r ntil U ueCosp c. io n a
ecsf t pit oS s uSnr U m aT n hen a at Csaacl gi Wnot ol n inh o G g cpnn 2 l eG g ac g yt n gt triimev0 IP a gl c e gh r S rC n h n euar rrR e1 r t n e S rmns o e rh
) e TI A
i t TSMe i n od n i n liciia T e et oad T
nnanint niifii ansrDe R opri i n s n et rsl oeii t iT mec a
la itr-iT r d R attt -
iilanvav iinnPt - rel sfr sal ee n o sainb a f a ngifi e s ir uea e
u lt I P
rUfhh a in o
ia rss aaacpamE re il ev cc c r v eqct ut rege mi o t ns AhPtR5kODNA i
n T O ,SSt T T T'e r uraprdkl oet epe c i eepeis isbnoe i
TQTfA1 tTEORLE ST$ILR t
n o
C
( / ))) )))))) )) )
m . l23 123456 12 1 I
I eo t h
((( (((((( (( (
1234 1 23456666665,1 12345 ni o e 11I1I 2 2
- l. l.l.
222
. 11.l.22 f
1 inu - . .
222222222222 3 33333 444444 8 t as _ A A cl s, A K A.A.A.
- A. A. A. A. A. A.A.A. A.A.A.A. A.A. A.A. A. A. A.A.A.A. A - I A.A.A.A.
A' M__ IT111 9
1 I 1 I1! 1I!11I111II1 I I1!I1 !T1III M , od e' z" A oeU
_ . _ - _ ~ _ . _. -- - - -- - - -
v v TARif !! (Continued) o m
y A(tton Priority lead Office / Safety latest o Plan Item / Evaluation Division / Pricrity latest Issuance MPA g Issue ko. Title ingineer Frenc h Ranting Revision Date ho.
co 1.A.4.2(2) Upgrade Training Simulator Standards Colmar RE S/DF0/HIBR hoff 3(a) 5 06/30/88
- 1. A. 4. 2( 3 ) Regulatory Guide on Training Simulators Celaar RIS/DF 0/HIBR N0tt 3(a) 5 06/30/88 f.A.4.2(4) Review simulators for Conformance to Criteria Colmar NRR/DLPQ/L0tB NOTE 3(a) 5 06/30/88 I.A.4.3 Fenibility Study of Procurement of NRC Training Colmar R15/DAE/R5R8 LI (NOTE 3) 5 06/30/88 MA Simulator I.A.4.4 feasibility Study of kRC Engineering Computer Colmar RES/DAE/R5RS L1 (NOTE 3) 5 06/30/88 h4 1_ ft_ SUPPORI Pius 0 W L l 8.1 Nnagt for Operations I~Bl .1 05anuation ana %nagement Long-Tern Improvements - - -
1.8.1.l(1) Prepare Draft Criteria Colmar hRR/DHFT/HF IS NOTE 3(b) 3 12/31/86 MA 1.8.1.1(2) Prepare Commission Paper Colmar 42R/DHFT/HFIS NOTE 3(b) 3 12/31/86 NA 1.8.1 1(3) Issue Requirements for the Upgrading of Nnagement and Colmar htR/DHF T/HF IS ()it 3(b) 3 12/11/86 h4 Technical Resources I.8.1.l(4) Review Responses to Determine Acceptability Colmar NRR/DHF T/HF 18 NOTE 3(b) 3 12/31/ % NA I.8.1.l(5) Review Implementation of the Upgrading Activities Colmar 01E/DQA51P/ORP8 NOTE 3(b) 3 12/31/86 MA 1.B.I.1(6) Prepare Revisions to Regulatory Guides 1.33 and 1.8 Cola:r hRR/DHF 5/LQS I.A.2.6(1), 3 12/31/ M MA 15 U I.8.1.l(1) Issue Regulatory Guides 1.13 and 1.8 Colmar hRR/DHF$/LQB I . A. 2. 6( 1) , 3 12/31/86 hA 15 1.8.1.2 Evaluation of Organtiation and k nageernt Improvaments - - -
of hear-Ters Operating License Applicants I.B.I.2(1) Prepare Draft Criteria -
hER/DHF5/LQ8 h0TE 3(b) 3 12/31/86 hA 1.8.1.2(2) Review hear-Ters Operating License Facilities -
heR/DHF5/LOS NOTE 3(b) 3 12/31/86 hA
- I . 8.1. 2( 3) Include F indings in the 5[R for Each hear-tera -
NRR/DL/ ORT 8 NOTE 3(b) 3 12/13/86 NA l Operating License Facility ~
I I . 8.1. 3 Loss of Safety function - - -
1 I . 8.1. 3(1) Require Licensees to Place Plant in Safest Shutdown Sege RES LI (NOTE 3) 3 12/31/86 NA l Cooling Following a Loss of Safety Function Due to l Personnel Error l 1.8.1.3(2) Use Esisting Enforcement Optior.. to Accomplish safest Sege R15 LI (NOTE 3) 3 12/31/ % NA Shutdown Coolinq 1.8.1.3(3) Use don-Fiscal Approaches to Accomplish Safest Shutdown Sege RES L1 (NOTE 3) 3 12/31/86 NA Cooling i 1.8.2 Inspection of Operating Reactors I T 2.1 Eevise GIE Inspection Program - - -
7 1. 8. 2.1( 1) Verify the Adequacy of k nagement and Procedural Controls Sege CIE/DQASIP/RCP8 LI (NOTE 3) 11/30/83 NA c- and Staff Discipline y
,o y I.B.2.l(2) verify that Systems Required to Be Operable Are Properly Sege 01E/DQA51P/RCP8 LI (NOTE 3) 11/30/83 NA <
c3 Aligned _
o O
.3 w oo l
b
o TARIi !!(Continued]
m
]o At t ion P l ari Item /
Priority trad Of fice/ Safety latest tvaluation Division / Priority latest I s s . pc e MPA g Issue %o. Title E ng ineer Branc h Ranting Revision Dato N.
co I 8.2.i(3) f ollo is on Completed Nintenance W>rk Orders to Sege OIE/DQ451P/RC78 LI '. NOTE 3) 1100/83 kA Assure Proper Testing and Return to Service I.8.2.1(4) Dbserve surmeillance Tests to Letermine W*etter fest Sege OIE/DCA5IP/RCP8 LI (h0ft 3) 11/30/81 hA Instrumeet s Are Property Calit. rated 1.8.?.l(S) Verif y that Licensees Are Complying with Technical Sege OIE/DQA51P/RCPB LI (h0TI 3) 11/30/83 hA Specife(ations I . 8 2.1(f,) Observe Routine Nintenance Lege Oll/DOA51P/PCP8 LI (NOTE 3) 11/30/83 h4
!. B. 2. l( 7) Inspec t Terminal Boards, Parsts, and Instrument Ract s Lege Ol[/DQA51P/kCP8 LI (NOTl 3) 11/30/83 h4 f or Unauttwirited Jumpers and Bypasses I.B 2.7 kesident Inspector at Operating Reactors Sege O!!/DQASIP/ORPB 11 (NOTE 3) 11/30/83 MA I . 8. 2. 3 Regional [ valuations Sege OIE/DQ451P/0RPS tl (NOTE 3) 11/30/83 NA 1.B 2.4 Overview of Licensee Performance Sege Oll/DQA51P/0RP8 LI (N0i! 3) 11/30/83 NA
!_,C OPlu.ThE PROCf DURf 5 I.C.1 Short-Tere Accident Analysis and Procedures Eevision - - -
I.C.1(1) Small Break LOCAs -
hkR I 3 12/31/86 I . C .1( ? ) Inadequate Core Cooling -
NRP I 3 12/31/ % F-04 g I C.1(1) Transients and Acc tdents -
NkR I 3 12/31/86 F-05 4 1.C.l(4) Confirmatory Analyses of Selected Transients Riggs h2R/D51/R 2 N0ff 3(b) 3 12/31/86 MA 1.C.2 St.if t and kelief f urnover Procedures -
NRR I 3 12/31/f6 I C. 3 Shift Supervisor Responu bilities -
h4R I 3 12/31/86 1.C.4 Control Raos Ac(ess -
NRR I 3 12/31/86 I.C S Procedures for f eedt.ack of Operating Esperience to -
hRR/DL I 3 12/31/8o F-06 Plant Staff ICf Procedures for verification of Correct Performance of -
MRR/DL I 3 12/31/86 F-07 Operating Activities I.C.7 h555 vendor Review of Procedures -
NER/DHf5/PSRB I 3 12/31/86 I C.8 Pilot Nnitoring of Selected [mergency Procedures for -
hkR/DHf 5'P5kB I 3 12/31/86 hear-f ern Operating License Applicants I.C.9 tong-Term Program Plan for Upgrading of Procedures Riggs hRR/Dhf5/P5k8 NOIE 3(b) 3 12/31/86 NA M CGmiPot ROOM DISIGN I.D 1 Control Ecum Design Revices -
hkR/DL 1 4 %/30/88 F-ca 1.0 ? Plant Safety Parameter Display Co% ole -
h2R/DL i 4 % /30/S8 f-09
- 1. D 3 Safety Systen Status Monitoring T hatc he ' RE S/DL/Ml 8 PlDIUM 4 % /30/88 1.D.4 Co-ntrol koom Design Standard t hatc rer R[5/DRPS/RHf8 NOTE 3(b) 4 % /30/88 44
[x
!.D 5 Improved Cor. trol Eous Instrumentation Research Operator-Proc ess Convuni.at ion y
rn 1.0.5(1) that(ber Rf5/Cf0/Hf8R Mi[ 3(b) 4 % /30/88 MA <
O W o N m
~'
m O O O
O O O TAeti 11 (Cantinuco) c)
m y Action Priority lead Office / Safety latest o Plan Itca/ Evaluat %n Division / Priority latest Issuance MPA g !ssue ho. Title Eng ineer Branch Ran6ing Revision Date No.
(o
! D.5(2) Plamt Stat 6s and Post- Accident Monitoring t hatcfer RIS/DF0/Hf BR MOTE 3(a) 4 06/3J/88
- 1. D 5( 3) On-line Reactor Surveillance Systee Thatcher RIS/CE/ Mi B OIE 1 4 06/30/88
! . D. 5( 4 ) Process he-6ter%J Instrument tion ' hatcher El5/Of 0/ICER NOTE 3(b) 4 Ob/ M/88 NA l !.D 5(5) Ci sturteni e Analc ib Systees thatcher R15/D U 5/RHf8 LI (h0f t 5) 4 06/30/83 hA
!.D.6 Te&netyy Iransfer Conference Thatcher RES/Df0/ Hits LI (h0TE 3) 4 On/30/88 hA I
!_F ANA:'v515 AC DI%INNAllCM Of OPf F ATING f RPIRIing I.E.1 Of f ue f or Analysis and Evaluation of Operational Ntt tews Al00/P18 t! (NOTE 3) 1 6/30/84 hA Data i
!.t.2 Program Office Operational Cata toaluation Ntthews NM/DL/0kA8 11 (hoff 3) 1 6/30/84 NA
- 1. t 3 Operational Safety Cata Analysis Ntttws RI5/DRA/RPER LI ( CIE 3) 1 6/30/84 kA I E.4 Coordu.ation of ticensee, Industry, and Regulatory Ntthews AIOD/F18 LI (M0il 3) 1 6/30/34 NA i Programs
- .f.5 hw icar Plant Ecliability Data System Ntthews AE00/PT8 LI ( CTE 3) 1 6/30/84 NA
!.I 6 Feporting Feguirements Matthews AEOD/PTB L1 ( mTE 3) 1 5/E/34 NA I.t.7 f or e ign ',ourc es Matthews IP 11 (ETE 3) 1 6/ 30/ 84 hA I f. 8 % ean frror Rate Analysis Ntthe=s R15/Df0/HF8tR LI ( C TE 3) 1 6/M/64 NA
$ ! _I G AAt i f Y ASWRANCI I f .1 lepa'+J QA list Pittman RE S/VVAEIB #f!CJi 1 12/31/65
!.I 2 Dr.clep Mure Detailed QA Criteria - - -
I.I.2(1) Assure the In*pendence of tre Organization Performing Pittsaa 0!E/DQASIF/ff.)AB LOW I 12/31/85 NA the Chec k sng f unction 1 i.2(?) Include QA Personnel in Riview and Approval of Plant Pittman OIE/DQASIP/QtAS W IE 3(a) 1 12/31/85 MA Protedures 1.F.2(3) Include QA Personnel in All Design, Construction, Pittman DIE /DQA51P/QbA8 20fL 3(a) 1 12/31/f5 hA Installation. Testing, and Operation Activities
! I.2(4) (stablish Cetteria for Determining QA Requirements Pittman O!E/DQA51P/QUA8 LOW 1 12/31/85 kA for Specific Classes of (quipment 1.f.2(5) Istablish Qualification Requirements for QA and QC Pittman O!E/DQ451P/QUAB 10d 1 12/31/85 NA Fersonnel I f 2(6) Increase the Size of Licensees
- QA Staf f Pittman Olf/DQA5!P/QUAB NOTE 3(a) 1 12/31/85 NA I F.2(1) Clarify that the QA Program Is a Condition of the Pittman Ol[/DQA5]P/QUA8 LOW 1 12/31/85 MA Construction Pernit and Operating iicense 13.2(H) Compare WRC QA Requirements alth Those of Other Pittman Olf/DQA5!P/QUA8 LOW 1 12/31/85 hA
, Agencies 2; I J . 2(9) Clarify Organisational Reporting levels for the QA Pittman 01E/DQASIP/QuA8 NOTE 3(a, 1 12/J1/85 NA N Organisation 3
- 1.f.2(10) Clarify 8eovirements for Maintenance of "As-Sullt" Doc umentat ion Pittman DIE /DQA5!P/QUA8 LOW 1 12/31/85 NA 7 O
w I.F.2(11) Define Role of QA in Design ans. Analysis Activities Pittman 0]E/DQ45!P/QUA8 LOW 1 12/31/85 NA $
w 0)
TABtf !! (Cs.ntinued) o
(
u Action Priority teaa Of fice/ Safety latest g Plan Itce/ Evaluation. Division / Priority latest Issuance MPA x Issue ha. Title E ngineer Branch Rading Revision Date N.
co oo PRiort RAT!CMAt AND 10W-POWE R T[5 TIC 1.0.1 Training Requirements -
NRR/TMf 5/PSRB I
!.G 2 Scope of Test Program V'Nien NR4/DHF 5/P5RB h0TE 3(a) 1 12/31/84 h4
!! 4 5111 %
II A 1 Sitiag Policy Seformulation V'Melen hER/DE/5A8 N0ll 3(b) 1 12/31/84 hA II.A 2 Site 1 aluation of Isisting f acilities V'Molen hRR/D(/5AB V.A.1 1 12/31/84 NA
!! B CO* SIDE RA1104 OF Of GRActD OR Mt tTW CCRf 514 "JTFTV EFviF4
!!.B 1 Rea(tor Coolant System vents -
mRR/DL I 2 06/30/88 F-10
, II.h 2 Plant Stielding to Provide Access to Vital Areas and -
kRR/DL I 2 06/30/88 F-11 l Pretect Safety Iquipment for Post-Accident Operation
!!.B.3 Post-f4cident Sampling -
hRR/DL I 2 M/30/88 T-12 l m 11 8 4 Training for Mitigating Core Damage -
hER/DL I 2 06/30/88 F-13 m 11.8 5 Research on Phenoerna Associated mith Core Degradation - - -
and f uel Melting
!! B.5(1) Echav 6er of Severely Damaged f uel V'Molen R15/DRAA/AIB 11 (NCIE 5) 2 06/30/88 hA 11.8 5(2) Behavior of Core Melt V'Molen Rf5/DRAA/PRA8 L1 (NOTE 5) 2 06/30/88 h4
!! . R. 5( 3) Iffect of Hydrngen Burning and implosions on V'Molen RE5/DRAA/AlB 11 (NOI[ 5) 2 06/30/88 hA Containment Structure 11.8.6 Rio Ec4uction for Operating Reactors at Sites with Pitteen NRR/05T/RRA8 8CIf 3(a) 2 06/30/68 High P wulation Densities ll.H./ Analysis of Hydrogen Control Nt thews hER/D51/C58 11.B.8 2 C6/30/88
!!.8.8 Rulemaking Proceeding on Degra$ed Core Accidents V'Molen R15/DRA0/RAMR h0TE 3(a) 2 06/30/68
!! C Rt t l AP!llTV imG!nf!RIE AND RIM A55f 5', Mini II.C 1 Inte rie Reliatillity 1 valuation Program Pittman RES/DRAC/RRB N011 3(b) I 12/31/85 NA
!!.C.2 Contle.uation of Interie Reliability Evan,ation Prospaa Pittmaa hER/D5T/RRA8 moff 3(b) 1 12/31/85 NA II.C 3 5 ptres Interaction Pittman NRR/051/GIB A-17 1 12/31/85 mA
!!.C 4 Reliat,ility Engencering Pittman RI5/DRP5/RHIB HIGH I 12/31/85 7 II D Rf Af f 0R C00t ANT sv5T14 Rit if f AND 5Af f TV VAtVE5 C -
- r3 ,,u b !!.D.1 Testing Requireernts -
h&R/DL I f-14 e
!!.L.2 Resear(% on Relief and Safety Walve Test Requirceents Riggs Ris LDW 11/30/83 h4 i j w
!!.D.- Relief and Safety Walve Position Indication -
h4R I o 1 3 1 W I D}
N TA8tf II (Caatinued)
S N Action Priority Lead Office / iafety latest
$ Plan item / Evaluation Division / Priority latest Issuance MPA g Issue ho. Title Engineer Branch Banking Revisten Date No.
cc M
SY5ffM Df5IGN I! I.1 Ausi1iary Feed ater System TTT3.1 Auxiliary Feedwater System Evaluation -
NRR/DL I 1 12/31/86 F-15 II.E.1.2 Avalliary f eedwater System Automatic Initiation and -
NRR/DL I 1 12/31/M F-16, f-17 flo. Indication II.E.1.3 update Standard Review Plan and Develop Regulatory Riggs RES/ dea / Rest NOTE 3(a) 1 12/31/86 j Guide II.I.7 faergency Core toeling System IT T 7.1 neliance en t a s Riggs m R/DSI/nsa II.E.3(17) 1 12/31/85 M
- 11. E . 2. 2 Research on Small treak LOCAs and Annealous Transients siggs RE5/DAE/R5as 1 12/3U85 NA NOTE 3(b)
II.E.2.3 Uncertainties in Performance Predktions V'Molen MAR /D51/R58 LOW I 12/31/85 M II.f.3 Detay Heat Seensal ITT3.1 Reliability of Power SuppIles for Natural Circulation -
NRR I II . E . 3. 7 Systees Seliability V'Noten NAR/D5T/GIS A-45 11/30/83 M II.E.3.3 Coordinated Study of Shutdoor.: 6teet Removal Requirements V*Molen hAR/ DST /GIS A-45 1U30/83 M y II . E . 3. 4 Alternate Concepts Research Riggs RES/DAE/fBAB NOTE 3(b) 11/30/83 M y II.E.3.5 Regulatory Guide Riggs NAR/ DST /G1B A-45 11/30/83 M
( II.I.4 N tainment Design TI I7.1 Ledicated Penetrations -
NaR/DL I 06/30/es F-la 11.E.4.2 Isolation Dependability -
NER/DL I 06/30/08 F-19 II.E.4.3 Inte9eity Check Milstead RES/DePS/RP51 NOTE 3(b) 06/30/88 NA II.E.4.4 Purging - - -
II.E.4.4(1) Issue Letter to Licensees Requesting Limited Purging Milstead NRR/DSI/CSB N01E 3(a) 06/30/88 II.E.4.4(2) Issue Letter to Licensees sequesting Information on Nilstead NAR/D51/C5B NOTE 3(a) 06/30/88 Isolation Letter II.E.4.4(3) Issue tetter to Licensees en valve Operability Nilstead NRE/D51/C58 NOTE 3(a) 06/30/88 II.E.4.4(4) Evaluate Purging and Wenting During Normal Operation M61 stead NOR/DSI/ CSS ISTE 3(b) 06/30/88 M II.E.4.4(5) Issue Modified Purging and venting moguireernt Milstead NAR/D5I/058 NOTE 3(b) 06/30/08 M II.I.5 Design Seasitivity of SSW Beacters TI T 3.1 Lesign Evaluation Thatcher NRR/D51/R5a NOTE 3(a) 1 12/31/e4 11.E.5.2 84W Reacter Transient Response Task Force Thatcher PRE /DL/Dems NOTE 3(a) 1 12/31/8s II.T.6 In 5ttu Testing of Valves TTr3.1 Test Adequacy study Thatcher aES/DE/EIs stDIns 11/30/83 E I B :
_ _ - _ _ ___ _______._ - _ -- _.-.._ --. _ - - - - . . _ _ _ _ . - . - ~ . , _ _ _ , _ _ _ _ . _ . _ _ . . - . - _ _ _ _ _ . _ _ _ _ , . - - _ _ _ . - - .
'A81( lI (fontinued)
O cn d 4 tion Priority lead office / Safety latest o Plan item / Evaluation Division / Priority tatest Issuance MPA g Issue ha. Title Engineer Branch Ranking Revision Date me.
Ip Iw',TRioW t:1 Ai104 AND C0h1R0t 5 II . F .1 Additional Acident Monitoring Instrumentation -
kRR/DL I 06/30/88 F-20 F-21 F-22 F-23 F-24, F-25 Il f.2 Identification of and Recovery from Conditions -
NRR/DL I 06/30/88 F-26 Leading to Inadequate Core Cooling II.f . 3 Instruments for Monitorirg Accident Conditions V'Malen RES/DF0/ICBR NOTE 3(a) 06/30/88
- 11. f . 4 5tudy of Control and Protective Action Design Thatcher NRR/D51/IC58 DROP 06/30/88 NA Requirements
!!.f.5 Classification of Instrumentation Contrel, and Thatcher RES/DE LI (NOTE 5) DC/30/88 EA Electrical Equipment
!!.C ftlCTRICA1 POWIR II.G.1 Power Supplies for Pressurire- Relief Valves, Block -
NRR I Walves, and level Indicators
$ TMI-2 Cif us;P AND IIAMinATION II.M.1 Maintain Safety of iMI-2 and Minimise Environmental Matthews NRR/TMIPO NOTE 3(b) 11/10/83 NA Impact II.H 2 Obtain Technical Data en the Co-usitions Inside tte Milstead RIS/DRAA/AIB HIGH 11/30/83 iMI-2 Containment Structure
!! . H. 3 (valuate and f eed Back Information otstained f rom IMI Milstead haR/TMIPO II.H.2 11/30/83 NA II.H.4 Determine Impact of IMI on Socion onomic and Real Milstead RES/DH%dM/5tER 11 (N01E 3) 11/30/83 NA Property Values II J GI M RAL IMPt1CATIF OF TMI F0a Df 51GN AN3 U E TEUCTIGN ACTIsliits II.J.I Vendor !*spection Pro tram TTT11 C ULlish e Prio I W 5ydem for Conducting Vendor Riani 01E/DQA51P LI (NOTE 3) 11/.%/83 mA impections
!!.J.1.2 Modify Entsting tendor Inspection Program Riani OIE/DQAsir LI (NOTE 3) 11/30/83 MA z I I . J.1. 3 Increase Regulatory Control Over Present Mon-Licensees Riani 01E/DQA5!P LI (NOTE 3) 11/30/83 NA m Riant 11 (NOTE 3) 11/30/91 hA
- E II.J.1.4 Assign Resident Inspectors to Reactor Ve e rs and 01[/DQA51P rn Art.httMt-f nginee, s .
w.
O O
w n W C)
W O O O
- lIil1ll ,1 li l' l' llI !
'l)I'f' \lllllll1
=$ey ,n z
~
sl C' Y(
A f2.
PN AA NN M A N
A N - - - - - - - - - - -
e 33 3 3 3 3 4 4 4 4 44 4 4 4 4 4 c 88 8 8 8 8 8 8 8 6 88 8 8 6 6 B tn // / / / /
sa eue 00 33 0
3 0
3 0
3 0
3 U
3 U3 /
1 3
U UU 3 33 U3 U U 3 3 U U3 t st 3 asa LID U/
I1 1 /11 U I
/11 U I
/ /
2 2
/
2
/
2
// / / /
22 2 2 2
/ /
2 2 1 1 1 1 11 1 1 1 1 1 n
o ti ss ei t v ae LR
)) )
33 3 y ) ) ) ) )) ) ) ) ) )
EE E a a a a aa a a a a a t g TT T 1 1 yi n ( ( ( ( (( ( ( ( ( (
0O O 2 3 3 3 3 33 3 3 3 3 3 t ri hN N 1 1 eok (( ( E E E E E E[ E E E E E fin 8 8 T T T T T TT T T T T T SPB ara II I O O O O O OO O O O O O LL L I I N - N N N N NN N N N N N
/ B B 8 A e Q Q C c PP P L L R i/ 1I I / / /
f n 5S S 5 5 P f o AA A F F 5 Oih GQ Q H H D sc DD D D D /
din // / / / D ava EE E E R O R R R R RR R t R R R eit II I R L R E R R RR R R R R R LD8 CO C M N A - N N N N NN N N N h N n
o yi r tte i ae n
a a n
run oli ii i nn n t m mt !
n t
itr t tt t t t t t irvn ag iiaa ia t t ia - it-e e i
r e
i ii i i i r
e ao rr r m Ia a[
r r i i e olr r
N) P[E RR R i i P P R [ f E E tL t f
((& s e
it -
S T t y e n d N e n n t h i n n A h o n s e e t o a t t i g ev d f y t
e i
n 0 et ,n i n ef a l fl c
t g 0 f va gI s l e vo S eor a n ru c 0 s o au n e a p n me i
s s
- hl in nD V e itt g nsE ar s
e f i y a zo g o md c u n oescn ru t t n n t O- n g t v ii n in non ao v rnii n o nD s t o aE nt i t e elI o gs e e 5 l h ga n pt f id o ee ud oa o i e 5 w o TC om s o ar e R Peea m m i it d e m re C t e e e 0 .
n R cr a ra Vw gn u
l PM c s r r t o 2N eo r ci oTT R r u r A r - e r nn cs l i i Rf T st rA nt l r e u u K h Id ei t e tf ,
m t v q q A R C Mn rd d Dn ntr as o aoo a To ea nm A s O n
e e f H T a el n I oau h n f nCt ridro g c n gt o o R K R P, A d
e os f o V
a n on Ces T a r
e t eeo o pprs f s s e. t d p n r
C t g g n n 1 p
u l i
t e s i eg e s io ti neA oD eT r
ecnnue d riia P sePr d g i i 1 i a rt r n r it i t ut yuva gi nd n I nnt o na n tt r r u t t e
ai ui s u sa it eh ra sol drMsnc o
i e ll dttd ol sNt ee sic n
I oc f e o p p o 9 - D ii eane Po s T A ncSdedA it entp ie nf g id e e r
O- imcatoido cgec s oe eeo nna cl ecs e t en iG s L G u R E f
f A
d n
a Sf nrti r ePicP eI v
l t Pssl eerh ertrmase2 estArP o e rgo uL -
p cspI s uis e
D d y c y y c
C n c s srv Mc t eEg Ag an W e i vout s s v yf nisM I
I rdaeedf i rnI n rsnt n r n n T t N nh nd n m t pep rsaist eo I t aI n r a ot e e I Pteteindi dnsimc uandeaSi e sh e o i i M niOst ant eiesooudGI oer th n npnd o oaoi q f nna oel c ic O m
A s2es sa ,aast aroCree Mt seect i iu i dnt er in Ii aaBegseol nd rnat uP Pl cdt ph A i Cli s t f f T d f onndyOt ,
t t e n tt g e e > tMcr - pnt pieeetl t raenS sf c t ecR e ace D D 5 ;
eT c T d sOi n C t Bc-C c n u n W P ea l f uo u su m zuR f n l A ei t e oeoeT sn dl oo
) e r
iearn e ir g nt e s ee B l w wrv wniwuywrmCmAwdi weA e
es d
t s rrsi et g a asu i is 0 5 w Bi ue2eraeesert ePe eiaet ene e
l n ecns n gns v v A iuDivnit ei veavsf vdpap0 vqnvl h ara l tl1i u t i aeros vI vc a
n it aenos fKICA ares MCCI R E e e l a A
[ eMecf errenaenmh m0eioeeamrh T M IRTSOoRPTRISR aITI2RLCRRMAtP ita o
C
( ) )
/m . ) ) ) ) )) ) ) ) 0 1 I ee 12 3 1 2 l 1 2 3 4 56 7 8 9 1 1 I t h ( ( ( ( (( ( ( ( ( (
I nI o a 222 2 33 3 4l 11 1
- l. l. l. l. l. l.
1 1
l.
I B
A T
In t
il s KPI au J. J. J.
III I II J.
I I
I J.J.
II I
J.
I I
J. J.
I I
I J K. K.
II II I
K.
I K.
I I
K.
I I
K. K.
II II I
K.
I R.
I I
K.
I I
K.
I I
K.
I I
o(wRcc oo me 2cgofe~~
1 APJ f !! (Coatiaued) o ce N Artion Priority lead Of fice/ Safety latest
$ Plan Item / fvaluation Division / Priority latest Issuance MPA g Issue hu istle ingineer Brancti Ranking Revision Date No.
cu ll_R.l(12) One Hour hetification Seguirement and Continuous tarit kRR WIE 3(a) 12/31/84 -
Communaatiens Channe1s II E. E(13) Propose fechnical Specification Changes Seflecting [ erit NRR su0f( 3(a) 12/31/84 -
Ig lementation of All Bulletin Itees
!!.E.l(14) Review Operating mo des and Procedures t.e Deal with (erit NRR suoit 3(a) 12/31/84 -
significant Aeovnts of Hydrogen II . s.. l(15 ) f or f ac ilities with non- Automatic Af d Initiation, terit MR NOTE 3(a) 12/31/84 -
Prinide Led nated Operator in Continuous l C m ication with CR to Operate AlW
!!.R.l(16) !wiceent Procedures That Identif y PRI PCarv "Open" [orit mRR N0ft 3(a) 12/31/84 -
Induations and that Direct Operator to Close Navally at "8eset" 5etpoint II.E.Ill1) Trip PIR tevel Bista%1e se that PIR to. Pressure terit kka st3YE 3(a) 12/31/84 -
bill Initiate Saf, . ajection II a.l(18) De.elop Proced2res Irain Operators en Methods terit kRR NOTE 3(a) 12/31/84 of I statel t shing and e., staining hteral Circulation 11.8.l(19) Deuritec Design and Prncedure Ndifications to terit kRR EIE 3(a) 12/31/84 -
Sedure Lt6elihood of Automatic PIR POWW Actuation in Iransients g !!.E.1(20) Provide Procedures and Training to Operators for terit NRR te0TE 3(a) 12/31/34 -
c, Prosti Nnual Reactor Trip for LOlW. 11. sr.IV Closure,100P. LO% level, and to PIR te.cl II . K. l(21) Provide Auteoatic Saf ety-Grade Anticipatory Reactor
- erit hER seOl[ 3(a) 12/31/84 -
Trip f or 103 W, II, or Significant Decrease in %
tevel II A. l(??) Descrite Autumatic and Nnual Ations for Propee terit NRR sof t 3(a) 12/31/64 -
f unc t ioning of Availiary heat Removal Systees Wen f W System isot Operatile II E.1(23) Deurite uses and lypes of RV te.el Indication f or [ erit NRR NOTI 3(a) 12/31/84 -
Autumatic and Nnual Initiation Safety Systees
!! . K. l(24 ) Perf orm (OCA Analyses fur a Range of Small-Breat torst NRR ts0TL 3(a) 12/31/84 -
Sises and a Range of Isme lapses Between Reactor Irip and RCP Trip I I . m . l( 25 ) De. clop Oserator A tion Guidelines terit kRR NOTE 3(a) 12/31/84 -
I I . 8L 1( 2f,) Revise Isergency Procedures and Irain R3s and SROS terit NER 91011 3(a) 12/31/B4 -
!! a.l(21) Provide Analyses 4 M Develop Guis:elines and terit hkR NOTE 3(a) 12/31/84 -
Procedures for Inadequate Core Cooling Conditions
!!.R l(28) Provide D*stgn That Will Assure Automatic RCP Trip f or s t NWR h0!L 3(a) 12/31/B4 -
f or All Circumstances Wiere Seguired II .L 2 Coseission Orders on B&W Plants - - -
7-- II. A NI) Upgrade i tseliness and Beliabilit y of Af W System terit kRR/D51 N011 3(a ) 12/31/84 -
- s2 n I I . R. 2( G Proceduces and training to Initiate and Control terit mirR sOTE 3(a) 12/31/84 - "*
$ AIW Independent of Integrated Control System 1 II.E 2(3) Mard-hired Control-Grade Anticipatory Reac ter Trips terit NRR/D$l NOTE 3(a) 12/31/d4 -
E 8
w
!!.K.2(4) '. mall-Break LOCA Analysis, Prxedures and Operater fraining lorit niiR/DHf 5/ Dis Ett 3(a) 12/31/84 -
o co O O O
_ _ _ _ _ . _ _ _ _ . . ._ _m.________. _ _ _ _ _ . _ - _ _ ___...___m . ~ _ _ _ _ _ _ _ _ _ ~ _ . _. . _ _ _ _ _ __
T_AN T II (Coat tawed)
S D Action Priority Lead Office / Safety latest o Plan Item /
y Isave he. Title Evalsation Division / Priority latest Isseance NPA co ingineer tranch Rar. king Bevision Date lee.
II.R 7(5) Cosplete inI-2 Simulater Training for All Operators ferit maa I I . E . 2(8,) Reewalvate Analysis for Deal-tevel Setpaint Centrol NOTE 3(a) 12/3U84 -
I I . k . 2( 1)
Eerit atR/DSI liofE 3(a) 12/3U84 -
Ecevaluate transient of September 24, 1977 terit mat /DSI NOTE 3(a) 12/3UM -
11 A 218) Centtaved Upgeading of AlW Systee terit met I I . E .1.1, 12/3UM IRA
!!.E.2(9) II.E.1.2 Analysis and upgrading of Integrated Centrol System ferit met I 12/3UM F-27 11.E.2(10) Hard-W6 red Safety-Grade Anticipatery Reactor Trips II.E.2(11) ferit mRR I 12/3U M F-28 Operator Tra6ain9 and Drilling terit seat I 12/ LUM F-29
- 11. E. 2(12) transtent Analysis and Procedures for knayment of Small Breats terit 1RR I.C.1(3) 12/31/94 8e4 II.E.2(13) Thermal- bchanical Report en Effect of NPI en vessel terit met I Integrity for Small-Break LOCA With Ile M W 12/3UM F-30 II.E.2(14) Demonstrate that Predicted lif t Frepency of P0evs ferit met I and SVs Is Acceptable 12/3U M F-31 II . E.2(15) Analysis of Ef fects of Slag Flow on Once-Through met I terit 12/2t/m -
Steam Generator fatnes titer Primary Systae Weiding II.E.2(E) Impact of 9C7 Seal Damage f ollowing Small-Break (erit mea I 12/3U84 F-32 LOCA With less of Offsite Power II.E.2(17) Analysis of Potential Volding in RCS During [arit met I 12/3U84 F-33 w Anticipated Transients e II.E.2(18) Analysis of Less of feedmater and Other Anticipated met Transients terit I.C.1(3) 12/IUM mA
! II.E.2(19) Benchmars Analysis of Sequential MW Flow to Once- Eerit met I l Ihrough Steam Generater 12/31/64 F-34 II.E.2(29) Analysis of Steam aesponse to See11-treak LDCA terit use I 12/3UM F-35 That Causes System Pressere to Enceed Peev 5etpoint II.E.2(21) 1051 L1-1 Predictlens [ erit mat /D5I m0TE 3(a) 12/31/G4 -
II. E. 3 i
final Secommenestions of Belletins and Orders Task - - -
l force i
II.E.3(1) Install Antaastic PGov Isolation System and Perfere Eerit man I 12/3UM F-M l Operational Test II.E.3(2) seport en Overall Safety Effect af P0ev Isolatten Eerit man I 12/3Use F-37 Systee II.E.3(3) seport Safety and selief Valve Failures Promptly [orit met I 12/3U84 F-36 and Challenges Aswomally II.E.3(4) Review and upgrade Seliability and - ' 'ry of terit met II.C.I. 12/3Ua4 hn men-Safety (gulpment for Small-treat LOCA feitigatten II.C.2 II . E. 3(5)
II.C.3 Automatic frip of #?acter Coelent Pumps Enrit mee I 12/3Us4 F-39, C-01 7 11. E. 3(6) Instrumentation te verify etural Circulatten ferit mat /D5I I.C.1(3), 12/3US4 24 l c-7' I1.f.2, II.F.3 7
"o II.E.3(7) Ivaluatten of Potv Openieg Probahility Ovriag terit met I 12/3US4 f Overpressere Transient 7
U g w "
CD
\
[
l t-_ _ _ . _ _ __ .. _ _ _ _ _ __ __ _ . _ - . _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
T AP.t ( lI g aatinueo) o (1
N Attion Priority lead Dffice/ Safety latest
$ Plan Item / laatuation Division / Priority latest I ssuanc e MPA g !ssue ho istle Engineer Branch Ranking Revision Date he.
cr>
!! . K. 3(81 Further Staf f Consideration of heed for Diverse ferit MR/D57/G18 II.C.1, 12/31/8: hA De(ay Heat Removal N thod Independent of SGs ! ! . E . 3. 3
!!.t. F.s Proportional Integral Derivative Contro11ec Eerit MR I 12/3 U84 F-40 N dification II.K.3(10) Anticipatory Trip Ndification Proposed by same (seit mRR I u/3U84 6-41 1itensees to Confine Range of use to Nigh Po.cc levels II.E.3(11) Cor. trol use of Pcry 5,, plied t+y Control Ceepenents, ferit NRR I 12/3 U64 -
Inc. Until f urthee Review Complete II . M . 3(12) Confire taistence of Anticipatory Tr4 upon furtnine ferit hat I 12/3Uwe f-42 Trip
! ! . K . 3( 13 ) '.,eparation of HPCI and RCIC Systee Initiation levels ferit MR I 12/3U84 F-43 I I . K . 3( 14 ) Isolation of Iselattos. Condensers en High Radiation ferit hRR I 11/3U64 I-44
!!.K.3(15) Esisfy Sreak Detection logic to Prevent Spurious ferit MR 1 12/3UB4 I-45 Isolation of HPCI and RCIC Systees II R.3(16) Redoc _ien of Challenges and f ailures of Relief ferit Me 1 12/3U84 T-46 l Valves - f ea;ibility Stedy ant? System Ndification l
II.E.3(11) Report on Dutaae of ICC syste=s - Licem ee Report [ erit NRR I 12/31/84 f-47 and fedeical Spec 6f kation Changes II . R. 3( 18) Edification of ADS tegk - f easibility Study and lerit MR I 12/3U84 I-43
% Ndefitation f or increases Diversity f or Some Event Sequentes
!!.K.3(19) Intertect en Recirculation Pwp toops fecit hat I 12/3U84 f-49 I I . M. 3( 20 ) Less of Service bater for dig Rock Point lorit MR I 11/3UB4 -
!!.K 3(21) Restart of Core $* ray and LPCI Systems on tow terit h2R I 12/1U84 T-50 level - Design and Modifica'lon .
!!.R.3(22) Automatic Switchover of RCit System Suction - ferit NWR I 12/3 U84 f-51 Werify Protcoures and Ndify Design
!!.n.2;23) Central water tevel Recording terit MR I D.E. 12/3U84 2A III.A.1.2(1).
Ill.A.3.4 Il E.3(24) Confire Adequacy of Space Coo:ing for HPCI and f erit hRR I 12/3U84 I-52 RCIC Systees
!! . K . 3( 25) Effe(t of less of AC Power en Pump Seals ferit MR I 12/3UB4 F-53 II . K 3(2f.) Study Iffe(t on RHR Reliability of Its use for terit kRR/051 11.1.2.1 12/3U84 MA fwe1 Pool Coelieg II.K.3(27) Provide C.maun Reference tevel for vessel tevet ferit htR I 12/3UB4 I-54 Instrumentation I I . R. 3(28) Study and verify Qualification of Accumulate.s ferit MR I 12/3U B4 I-55 on ADS Walves
[
- n II.R 3(29) Study to Demonstrate 7erformance of Iselation Condenwrs with A,n-Condeasibles ferit MR I 12/3U64 f-56 ,",
$ II . K . 3( 30 ) hev6 sed *.e411-Brea6 (OCA Methods to Show Compliance ferit MR I 12/3UB4 I-57 7 e with 10 CfR 50. Appendia K w
11.E. i( 31) Plant-kn if k falt utst tons to ihm, Compliance with 10 CfR 50 46 foret 'iFR I 12/3 U64 '-58 w CD e O O
TA81f II (Continwd)
O g Action Priority lead Of fice/ Safety tatest o Plan Item / Evaluation Disisten/
% Issue me. Title Priority latest Issuance 19A Engineer Srancts Ranking Revislen Date 3 me.
II. E. 3( 32) Provide Emperteental verificat6on of Two-Phase terit teht/D51 II.E.2.2 12/3U84 mA heteral Circulation anodeis II.E.3(33) twelvate flietnetten of P0av function ferit met II.C.1 12/3UM les II . K. 3( 34 ) Relap-4 flodel Sewelopment terit teet/D51 II.E.2.2 12/31/84 15 4 II.E. 3( 35) ivaluation of Mfects of s. ore find Tant Injection terit maa I.C.1(3) 1*/3US4 24 en Small-Break LRAs II.K.3(36) Addittenal Staf f Aue!! Calculattens of MM Small- Enrit met I.C.I(3) 12/3U64 mA Breas LOCA Ar.alyses II.K.3(37) Analysts of Saw sesponse to Iselated small-Break terit met I.C.1(3) 12/3UM sen LOCA II.E.3(38) Analysis of Plant Sesponse to a Smell-5 reek LOCA in ferit met I.C.1(3) 12/3U84 m4 the Pressuriser Spray Line l II.E.3(39) f eelvatten of Effects of water Slugs in Piping terit IIAR I.C.1(3) 12/31/44 mA Caused tey MPI and D T flaws l II . E. 3(40) Eval.atten of aCP Seal Damage and teakage During (erit met II.E.2(16) 12/3U8s an I
a Small-tress LOCA l
II.E.3(41) Sutnet Predktions for tof f Test L3-6 with acPs terit met I.C.1(3) 12/]U84 mA Running II .E. 3(42) Swiseit Segw.sted Informatlee on the [f fects of (erit ut? 1.C.1(3) 12/3UB4 h4 1
men-Cendensible Cases l
U II.R.1(43) toaluat6en of stectanical Ef fects of Slug flew en terit met 11.E.2(15) 12/3U84 NA Steam Generater Tubes II. E. 3(44) (valuat6on of Anticipated Transients with Slagle tarit mIMt I 12/31/44 f-59 f ailure te verify me $lgnificant f uel failure II.E.3(45) fuelmate Depressertration with Other tim f ull A0i ferit mat I 11/31/M F-60 II . E. 3(40 Besponse to List of Concerns free ACm5 Consmitant tarit IIAR I 12/3 U M F-61 II.K. 3(47) fest Program for Small-Breat LOCA Model verification ferit met I.C.1(3). 12/3U94 sta Pretest Predktion. Test Program, and feedel II.E.2.2 l Verification II.E.3(48) Assess Change in Safety Reliability as a Seselt cf terit met II.C.I. 12/3U84 mA Implementing b40TF 8eceamendations II.C.2 II . E. 3(49) Revie. of Procedures (espC) (erit une/gess/Psat I . C. 8 12/3UM 91 4 I.C.9
!!.E.3(50) acelew et Procedures (m555 venders) terit einR/DMF5/Psas I.C.7 12/3UM 8e4 I.C.9 II.E.3(51) 1Fymptem-Sased fuergency Procedures ferit NAR/DNF5/Psat I.C.9 12/3 U M sen II . E. 3(52) Operater A=areness of aceised terrgency Procedures terit anE I . 8.1.1 12/3U M mn I.C. 2 I . C. 5 II . K. 3(53) Two Operators in Centrel sees ferit met 1.8 1.3 12/3UM IIA
[
m II.E 3(54)
II.K.3(55)
Simulater upgrade for small-Break LDCAs Operater stenstering of Centrol Seard ferit 918R I.A.4.I(2) 12/3U M mA 2 g;
terit aset I.C.I(3). 12/3 U M NA <
e 1.s.2 ;;-
I.O.3 -
w II.E.3(56) Simulater Training neguirements ferit mes/Det!/DLB I.A.2.6(3), 12/3UM ma g
- a* I.A.3.1 II. E. 3(57) Identify Water Sources Prior to seenual Activatten tarit met I 12/3UM F-62 CS of ADS
Revision 8
.. 33G 3 3 12 ala 11 1 a il 1 11 1 11 1 111 GG GG G GG G GG ss GQ GGC r ss s ss s-C3. p%
- 24 2 22 2 22 Ed MR2 s ss 4'
--a as
-- 33 3 33 3 33 33 333 5
j3 ,,
.t
-=
ma m- a em mm
- em mem yT et
-m et 6m $$ $ m t' tt $$$
-m -m m- -m m--
'37 r =2 = == = =z == :::
J24 .- -.---.99 .--- - - .99 9 29 9.99 29.999 s
s e e ere ce cc- e- b5 c
5 e cc 55 5 30 ce 55 555
-s 05
k ==
rr rrr rr
2 =D = == 2 == =Dc een ==
rr r rr r rr rr rer !
"31 E E EEE EE E EE E EE E EE EE EEE 2: = = === - -
-on so os ooo =n= o ire ar oI . =o o== == = == ==.ee=
o oo osoo oo oon s
- d .
al.
c asp
.. ..,,,,En as
,,,, . . , .n . .. . :) 3]
a a a; s, :-
ac : as a te -r er:
2
. ::g .
I e : . s a ; ,
4 t ; i* g
-cr3g 2 j l ,t 2 :
c 4 t e:: : -
s
=
=
- ) o
- fig rI , !
n !e "
! 5. 2 * =r 11: Ia a 1ge r 1 a
=" i
= :t tv- +2 r t t s:t:i .5k i- s
- a p
- lt;g r 5 pe p; : e: ti:=-- ! 2s
,s- 4 : I=g }
9 lt(gy 1- agt}:-
_e N** .1 7,
i i.
a 3: 2): .;
- *w ra5 g : :2 y
hf a:[yJar -g'j.
sa g y.a m - ,4 lT,jg:a . t[r r: .41ramIGk-' , 't.g 2-w .
2s 3 533 7 ao e
2 g t: -gr.
P t gtL' r,
gTd en g 3 gistr._f2fv ;-r-t_g 3.T ,3y' .
g%:l g t,r '- -
erg .# -
1:i r.g e va-$;tys*a:%g 2 "
- - % -za=1- [
E . gs: Jg 8 J :g l=i;a -
4' 1-23 p**1._!- 55i 3 -i -g t-4--r:1 S
- 8 nt :,f 3c-i1 5 1
v g i..t35$
r< > t r* . ,3ri e
.:t ers s- YZe ri- .E 1t t 11 2 l 2323k3).thr. 2
- l r:!y 0.
- pt=h u,::-
3,z-
.} -
r
- -s--r -ahans - sur. -r a a h t :. 7.s.e:d pr . .:::5
- w- a < a2 - - . .
- 2. g.9:
= 3 -= =~nnn == === = , == = == ~-== .,42 1
,e s n a - aaa-a- sg~sq s s r-- - -a ---- a--aq 3,g
<i <-< <<<<.... <<<<< < < <<<< < << <<<< <<<<<<
i
- t .3 :
- -=l =: n"- ========
b==d d = = b== = == ==d: d====
06/30/88 34 NU4EG-0933
A i .
N s \ \
T APa l 11 iCtatnouedJ o
0%
d e
A( t son P l aei Item /
Priority lead Dffite/
toaluetteen Divisten/
safety Priority latest tatest Issaance PFA g Issue he. fttle Engineer Branch Rant ig Sevision Date me.
un
!!! 8 IMIKleerv M1 PAS 4taf*A D8 stall AND (DCAL CCvi nMfmTS 111 It 1 Transfer of sesponsib614t6es to itsqA Milstead Dit/DEPit/IRD8 20TE 3(b) IU30/83 mA
!!! 8 . Implementation of kRC and I(MA Rewensibil6 tics - - -
til.a 2(1) De titenser.g Process Milstesd DIE /DEPlR/IRDB NOTE )(e) IU30/83 u l 11! 8.?(2) f ee.-al Guidame Milstead DIE /Dt Pit /IRDS NOTE 3(b) 1U33/83 h4 g l_C net ic :wculom l
l l Ill.C.1 Have information Available for the hews Media and the - * -
Put.l it I I I . C .1( l ) Seview P t.1scir Available %(unents Pittman PA 11 (N0lt 3) IU30/83 hA Ill C.l(?) ketonmend Pdel nation of Addit 6onal Inf ormation P6ttman PA L1 (NOTE 3) 11/30/83 h4
!!!.C.1(3) Program of Seminars for news N dia Personnel Pettman PA il (NOTE 3', 1U30/83 h4 Ill C.2 Develop Petity and Previde Training for laterfacing -
with the hews Media it!.C.?(1) De.elop Pelsty and Procedures for Dealing With tr.*fing Pittman FA 11 (N0lt 3) IU30/83 M l w Requests un !!!.C.2(2) Preesde Training for Meimars of the Te(hnical Staf f Pittman FA LI (N011 3) IU33/83 h4
_III D EADiaison Pen?!CTIra I
!!! n i Batt s at ion %.vec e (4.et rol IIT U .1 FrT ary C. etat Sour (es outside the containment - - -
stra tere III.D. I. l(l) Seview Infeemation Semitted trw titensees Pertaining -
hRR I to Sedur.ing tea 6 age f ree Dgerating Systees 111. D.1.1(? ) Re.ie. Information on Pro 6stens for teak Detection Imrit NRR/D5I/4 1B NGit 4 Ill .D 1.1( 3) Tw.elop Prysed System Acteptance Criteria ferit hat /DSI/ MET 8 N0ft 4 111.D.1.2 Sadioa(16ve Gas Manarment terit NRR/D5UMt1B DRDP IU30/83 #A
!! ! . D.1. 3 Ventilatten Systes and Rad 6eiedine Adsorter Criteria - - -
III D.1. 3(1) Det tde dether licensees Show14 Perf ere studies and terit akR/DSI/METB DROP IU30/83 h4 Nse Modif 6(atlans
!! I . 0 1. 3(7) sev6ew and ae.tse 5ar teret mea /DSUME T3 1$40P IU30/83 h4 III.D I.3( 3) S v eire Licensees to upgrade filtratten Srstaes forat mas /D51/METB Da0P 11/3C/83 h4 Ill.D 1.3(4) Sponsor Studi-es to tvaluate Charcoal Adserter torit NER/D51/M TE NOTE 3(b) IU30/83 h4
, 111.D.1.4 ame aste Systee Design features to Aid in Accident terit NRR/D51/stIB 000P IU30/83 24 E
n Recoweey and Dec s taminatten y
$* !!! 0 2 IITIO.1 Public Radlet 'en Protection la~re.ement IIedreT e gTGr%Weeias orTffi.entF - - -
7 w
Ill.D.2.1(1) Ivaluate the f eastb616ty and Perform a Walue-Impact Ar.alysts of Ndifying Ef fluent-Monitaring Design tarit hRR/D51/MTB LDW 2 12/31/85 h4 Crtteria
I i
l TA8t f II (Continued)
O -~.
x Activ Priority Lead Office / ofety latest y Plan Item / Evaluation fuvision/ Priority latest issuance MPA
% lssue No. Title E r.gineer Branch Ranking Revi> ion Date No.
g _ _ _ _ . _
III.D.2.I(2) Study the feasibility of Requiring the Development Enrit hRR/DSI/MEIB LOW 2 12/31/85 NA of Ef fective Nans for Monitorina awt Septing Noble Cases and Radiciodine 8.Irased to the Atmosphere III.D.2 (3) Revise Regulat,ry Guides Enrit :4RR/DSI/METB LOW 2 'tA I II . L' 2. 2 Radioicane, Carbon-14, and Tritius PatNay Dose - - -
b elysis III.D.2.2(1) Perf orm Study of Radiciodine, Carbcn-14, and Tritive Enrit NRR/DSI/RA6 NOTE 3(b) 2 -
Behavior III.D.2.2(2) Evaluate Data Collected at Quad Cities Enrit NER/DSI/RAB III.D.2.5 2 III.D 2.2(3) Determine the Distribution of the Ct.emical Species of Emrit NRR/D51/RAB III.D.2.5 2
- Radioiodine in Air-Wter-Steam Mixtures Ill D.2.2(4) Revise SRP and Regulatory Guides farit NRR/DSI/RAB III.D.2.5 2 12/31/35 NA III.D.2.3 Liquid Patbay 2aJiological Control - - -
!!! D.2. 3(1) Develvp Procedures to Dia riminate Between Enrit hRRfDE/EHEB OTF 3(b) 2 12/31/85 NA Sites /PIsnts III.D.2.3(2) Discriminate Between Sites and Plants That Require Enrit NRR/DL/iHEB NOTE 3(b) 2 12/31/85 NA Consideration of Liquid Pathay Iriterdiction lechniques III.D.2.3(3) Establish Feasible Method of PatNay Interdiction tarit WRR/DE/EHE8 N0lE 3(b) 2 12/31/85 NA III.D.2.3(4) Prepare a Summary f.ssessment Enrit NRR/DE/EHEB NOTE 3(b) 2 12/31/35 NA III.D 2.4 Offsite Dose Measurements - - -
M I II . D. 2. 4; 1. )
111.D.2.4(2)
Study Feasibility of Envirormental Mocitors Place 50 TLCs Around Each Site V'Mulen v'Molen NRR/D51/RAB OIE/DRP/0RP8 h0TE 3(b)
L1 (NOTE 3) 2 2
12/31/85 12/31/85 NA NA III.D.2.5 Offsite Dose Calculation Manual V'Molci NRR/051/RA8 NOTE 3(b) 2 12/31/85 NA III.D.2.6 Independent Radialogical Measurements V'Holen OIE/DRP/DRPB LI (NOTE 3) 2 12/31/85 NA III.D.3 Worker Radutt >n Protection Improvement ITT T 3.1 Radiatica Protection Pians v'Molen NRR/DSI/RA8 NOTE 3(b) 3 12/31/87 NA
!!!.D.3.2 Health t nysics Improvements - - -
I l ! . D . 3. 2( 1) Amend 10 CfR 20 V'Molen RE5/DfC/ORPBR LI (h0TE 3) 3 12/31/67 NA III.D.3.2(2) Issue a Regula bry Guide V'Molen EES/DiO/DRPBR LI (NOTE 3) 3 12/31/87 NA III.D.3 2(3) Develop Standard Performance Criteria V'Molen Ff5/DF0/0RP8R L1 (NOTE 3) 3 12/31/87 NA III.D.3.2(4) Develop Method for Testing and Certifying Air-Purifying V' Nien RES/DFD/0RP8R ti (NOTE 3) 3 12/31/87 M.
Respirators
!!I. D. 3. 3 In plant Radiation Nnitering - - -
III.D 3. 3(1) Issue Letter Requiring Imprc.ed Radiation Sampling -
NRR/DL I 2 F-69 Instrumentat'n III.D.3.3(2) 5et Criteria Requiring Licensees to Evaluate Need for -
NRR NOTE 3(a) 2 12/31/86 NA Additional Su.sey Enuipment III.D_3.3(3) Issue a Rule Change Providing Acceptable Metbois for -
RES NOTE 3(a) 2 12/31/8s NA Calibration of Radiation-Noitoring Instruments y III.D.3.3(4) Issue a Regulatory Guide -
RES NOTE 3(a) 2 12/31/86 NA m x III.D.3.4 Control Room Habitability -
hRR/DL I F-70 (D m III.D.3.5 Radiation Worker tsposure - - -
1 9
o III . D. 3. 5(1) Develop Format for Data To Be Collected by utilities V'Nien RES/Df0/DRPBR LI (NOTE ') 2 12/31/86 NA e
^
Regarding Total Radiation Esposure to Workers o w III.D.3.5(2) Investigative Methods of Obtaining Employee Health V'Molen RES/DFD/DEPBR LI (NOTE 3) 2 12/31/86 NA 3 W D-sta by Onlegislative Means e 111.0.3.5(3) Revise 10 CFR 20 V'Molen RES/DF0/ORPBR LI (NOTE 3) 2 12/31/86 NA O O O
i k,j TA8tE II (Continued) o
<n D Action Priority Lead Office / Safety Latest o Plan Item / Evaluation Division / Priority Latest Issuante MPA y Issue ho. Title Engineer Branch Ranking Revision Date No.
(n M
STREETHEN E;iGRCEMENT PROCiS5 IV.A.1 Seek Legislative #uthority Enrit GC LI (NOTE 3) 11/30/83 NA l IV.A.2 Revise Entercement Policy Enrit ole /ES LI (NOTE 3) 11/30/83 NA IV 8 ISSME Of INSTNJCTIONS A" IMORMATIOf8 TO * !CENSEE5 IV.B.1 Revise Practices for Iss- of instructions and Estit OIE/DEMR L1 (NOTE 3) 11/30/83 NA informatior* to Licensees EXTEh31E550Ms (EARNED TC LICENSED ACTIVITIES OTtrig THAN POWER EEACIGas IV.C.1 Entend Lessons Learned f rom TMI to Other NRC Programs Enrit NM55/W1 NOTE 3(b) 11/30/83 NA IV.D NRC STAFF TRAINI C w _
N IV.t 1 NRC 5taff Training Eerit ADM/ NOTS LI (NOTE 3) 11/30/83 NA I
M
$AFETY DEC15 ION-MAKIM i IV. E.1 Espand Research on Quantification of Safety Colmar RES/DRA/RABR LI (NOTE 3) 2 12/31/86 kA Decision-Making IV.E.2 Plan for Early Resolution of S. fety Issnes Enrit hRR/D5T/5PE8 LI (NOTt: 3) 2 1?/31/86 NA IV.E.3 Plan for Resolving Issues at the CP Stage Colmar RES/DRA/RA8R LI (NOIE 2) 2 12i31/86 M4 IV. E. 4 Resolve Generic Issues by Rulemaking Colmar RES/DRA/RABR L1 ( WIE 3) 2 12/31/P6 hA IV.E.5 Assess Casrrently Operating Reactors Matthews NRR/DL/$EPB NOTE 3(b) 2 12/31/86 NA t IV.F FIhANCIAL DISINCENTIVE$ TO SAFETY i
IV.F.1 Increased OIE Scrutiny of the Power-Ascension Test Thatcher CIE/DQASIP NOTE 3(b) 1 12/31/86 NA Program
, IV.F.2 Evaluate the Impacts of Financial Disincentives to MM* hews 5P NOTE 3(b) 1 12/31/86 NA z the Safety of Nuclear Power Plants i
M a
1 a a i,
w a
1 1
I TA8tf !! (Continued) o o
d o
Action Priority Lead Office / Safety latest Plan Itee/ Evaluation rivision/ Priorit, La t*st Issuance MPA y Issue No. Title Engineer Branch Rankir.g Rev.ston Date No.
co LG IMPkOVE SAFETY RULEMAKING PROCEDURES IV.G.1 Cevelop a P d lic A ynda far Rulemaking Enrit ADM/RP8 L1 (NOTE 3) 1 12/31/86 NA IV.G.2 Periodic and Systematic Reevaluation of Existin , R91es Milstead RES/DRA/RABR L1 (NOTE 3) 1 12/31/86 NA IV.G.) Improve Rulemaking Precedures Milstead RESiDRA/RABR LI th0TE 3) 1 12/31/86 NA iv.G.4 Study Alte. natives for improved Rulemaking Piocess Milstead RES/CRA/RA8R LI (NOTE 1) 1 12/31/86 NA hRC PARIICIPA110N IN THE RADIATION POLICY COUNCIL IV.H.1 NRC Participatian in the Radiation Policy Council Sege RES/DH5WM/HEBR LI (h0!E 3) 11/30/83 NA V_ A D&ELCPHENT OF SAFETY P0llCY V.A.1 Develop hRC Policy Statement on Safety Enrit GC LI (NOTE 3) 12/31/86 NA POSSIBLE Et!MikATION Of !$NSAFETY RESPON5181t! TIES
$ V.8.1 Study and Recommend, as Appropriate. Elimination of Enrit GC L1 (NOTE 3) 12/31/86 NA honsafety Responsibilities VC ADVISORY COPHITTEES V C.1 Strergthen the Role of Advisory Committee on Reactor Enrit GC L1 (t.0TE 3) 12/31/86 NA Safeguards ,
V.C 2 Study heed for Additional Advisory Committets Earit GC L1 (NOTE 3) 12/31/86 hA V. C. 3 study the heed to Establish an Independent huclear tarit GC L1 (NoiE 3) 12/31/66 N4 Safety Board V_D LICENSING PROCESS V. D. a Imp : Public and Intervenor Participation in the Emrit GC L1 (feJTE 3) 12/31/86 NA Hearing Process V.D.2 Study Construction-During-Adjudication Rules Emrit GC ti stMTE 5) 12/31/86 NA v.D.3 Reenas:ne C e ission Role in Adjudicattan Enrit GC L1 (% DIE 5) 12/31/86 NA V.D.4 Study the Reform of the Licensing Process Emrit GC L1 (NOTE 5) 12/31/86 NA h M LEG 15 tai!VE NEEDS y p -
9 V.E.1 Study the Need for TMI-Related Legislation Enrit GC L1 (NOTE 5) 12/31/86 NA uT o
e g
W O O O _
s
(
TASTE II (Continued)
S D Acticn o Plan Item /
Priority Lead Office / Safety L& test Evaluation Division / Priority Latest Iss.ance MPA g Issue No. Title ingineer Branch Ranking Revision Date No.
c)
J V ORGANIZATION AND MMClf8(NT V. F .1 Study NRC Top Management Structure and Process Enrit GC LI (NOTE 3) 12/3U86 NA v.F.2 Reexamine Orc 4nization and Functions of the NRC Offices Enrit GC LI (NOTE 3) 12/31/86 NA V.F.3 Revise Delegations of Authority to Staff Enrit GC LI (NOTE 3) 12/31/86 NA V.F.4 Clarify and Strengthen the Respective Roles of Chairman, Eerit GC LI (NuTL 3) 12/3U86 NA I Commission, and Ex.cutive Director for Operations V. F . 5 Authority to Delegate Emergency Response functicas Enrit GC LI (NOTE 3) 12/3U86 NA to a Single Commissioner VG CONSOLitmTION OF NRC LOCATIONS V.C.1 Achieve Singie Location, Long-Tern Enrit GC LI (NOTE 3) 12/3 U86 b.G.2 Achieve Single Location Interim 12/31/86 NA dA l
Enrit GC LI (NOTE 3) i l
TASK ACTION PLAN ITEMS
$ A-1 Water riammer Eerit MR/ DST /GIS USI (NOTE 3(a)] 1 6/30/85 NA A-2 Asymmetric Blowdown toads on Reactor Prieary Coolant Enrit NRR/ DST /GIS USI [ NOTE 3(a)] 1 6/30/85 D-10 Systems A-3 bestinghouse Steam Generator Tube Integrity -
MRR/ DEST /ENT8 USI 11/30/33 A-4 CE Ste a Generator Tube !ntegrity -
NRR/ DEST /ENIB USI 11/30/83 A-5 B&W $*eam Generator Tut;e Integrity -
MRR/ DEST /ENT8 USI 11/30/83 A-6 Nrk I Short-Term Progras Enrit NRR/ DST /GIB USI (NOTE 3(a)] 1 6/30/85 A-7 m rk I Long-Ters Frogram Enrit NRR/ DST /GIB USI [ NOTE 3(a)) 1 6/30/85 0-01 A-8 m rt II Containment Pool Dyannic Loads Long-Tern Enrit NRR/ DST /GIS USI (NOTE 3(a)] 1 6/30/85 NA Program A-9 ATVS [orit NRR/ DST /CIS USI [ NOTE 3(a)] 1 6/30/85 l A-10 DWR Feedwater Mozzle Cracking Enrit NRR/ DST /GIS USI [ NOTE 3(a)) 1 6/30/85 B-25 A-11 Reactor Vessel Materials Toughness Enrit NRR/ DST /GIS USI (NOTE 3(a)] 1 6/30/85 A-12 Fracture Toughness of Steam Generator and Reactor Eerit NRP' DST /GIS USI [ NOTE 2] 1 6/30/85 NA Coolant Pump Sw ports A-13 Snubber Operability Ass rance Enrit NRA/DE/NE8 NOTE 3(a) 11/30/83 A-14 Flaw Detection h tthews NRR/DE/NTES DRom IU30/83 NA A-15 Primary Coolant System Decontamination ar.d Steam Pittman MR/DE/CHEb NOTE 3(b) 11/30/83 NA Generator Chemical Cleaning A-26 Steam Effects on BWR Core Spray Distribution Enrit NRR/DSI/ cps NOTE 3(a) IU30/83 D-12 z A-17 Systems Interaction -
RES/DE/EIE USI 11/30/83 m E A Pipe Rupture Design Criteria Digital Computer Protection System Eerit NRR/DE/NE8 DROP 11/30/83 NA (D rn A-19 Thatcher NER/DSI/ICS8 NOTE 4 1U30/83 5.
9 o
A-20 Impacts of the Coal Fuel Cycle -
NRR/DE/EHE8 LI (NOTE 5) 1U30/83 NA
{
A-21 min Steamline Break Inside Containment - Evalaction of V'mleg NRR/DSUCS8 LOW 11/30/83 NA c3 w
Environmental Conditions for Equipment Qualification -)
go
TAf tE II (Continued)
O N Action y Plan Item /
Priority Lead Of' ice / Safety Latest Evaluation Division / Priority latest Issuance MPA g Issue No. Title Engineer Branch Ranking Revision Date No.
oo A-22 PWR Main Steamline Break - Core, Reactor Vessel and V'Molen NRR/DSI/ CSS DROP 11/30/83 kA Containment 8uilding Response A-23 Contairment Leak Testing Matthews NRR/DSI/C58 RI (NOTE 5) 11/30/83 A-24 Qualification of Class IE Safety-Related Equipment -
A-25 Non-Safety Loads on Class IE Poe Sources NRR/ DST /GIS USI [ NOTE 3(a)) 1 6/30/85 8-60 Thatcher NRR/D51/f38 NOTE 3(a) 11/30/83 A-26 Reactor Vessel Pressure Transteat Protecticn -
NRR/ DST /GI8 USI [NOIE 3(a)) 1 6/30/85 8-04 A-27 feload Applications -
A-28 Increase in Spent fuel Pool Storage Capacity NRR/DSI/ CPS LI (NOIE 5) 11/30/83 NA Colmar NRR/DE/5GE8 NOTE 3(a) 11/30/83 A-29 Nuclear Power Plant Design for the Reduction of Colmar RES/DRPS/RPSI MEDIUM 11/30/83 Vulnerability tc Industrial Sabotage A-30 Adequacy of Safety-Related DC Power Supplies Sege NRR/051/P58 128 1 12/31/86 NA A-31 RMR Shutdown Reqcirements -
A-32 Missile Effects NRR/ DST /GI8 USI [ NOTE 3(a)) 1 6/30/85 Pittman NRR/DE/MIE8 A-37, A-38, 11/30/83 nA A-33 8-68 NEFA Review of Accident Risks -
NRR/DSI/AE8 E(NOTE 3) 11/30/83 NA F34 Instruments for Monitoring Radiation and Process V'Malen NRR/051/IC58 Variables Durir.g Accidents
".F.3 11/30/83 NA A-15 Adegaacy of Offsite Power Systems Eerit NRR/DSI/PSB A-36 Control of Heavy toads Near Spent Fuel NOTE 3(a) 11/30/83 NRR/DSI/GIB USI [ NOTE 3(a)) 1 6/30/85 C-10 C-15 A-37 Turbine Missiles Pittman NRR/DE/MTEB DROP 11/30/83
$ A-33 A-39 Tornado Missiles Sege NRR/051/A58 LOW 11/30/83 NA NA Determination of safety Relief valve Pool Dynamic -
NRR/ DST /CIB USI [ NOTE 3(a)) 1 6/30/85 Loads and Temperature Limits A-40 Seismic Design Criteria - Short Term Program -
RES/DE/EIB USI 11/30/83 A-41 Long Tera Seismic Program Colmar NRR/DE/MIB A-42 NOTE 3(b) 1 12/31/84 NA Pipe Cracks in Boiling Water Reactors -
NRR/D5T/GIB USI [ NOTE 3(a)) 1 6/30/85 B-05 A-43 Containment Emergency Sump Performance A-44 Station Black Nt NRR/ DST /GIB USI [ NOTE 3(a)) I 12/31/87 RES/DRPS/RPSI USI [ NOTE 3(a)] 1 06/30/88 A-45 Shutdown Decay Heat Removal Requirements -
RES/DRPS/RPSI A-46 USI 11/30/83 Seismic Qualification of Equipment in Operating Plants -
NRR/DSR0/EIB USI [ NOTE 3(a)) 1 12/31/87 A-47 Safety Implications of Control Systems -
RES/DE/EIB USI 11/30/83 A-48 Hydrogen Control Measures and Effects of Hydrogen Burns -
NER/DRAA/5AIB on Safety Equipment USI 11/30/83 A-43 Pressurized Thermal Shock -
NRR/DSR0/R518 h-1 USI [ NOTE 3(a)) 1 12/31/87 Environmental Technical Specifications ,
NRR/DE/EHEB E (NOTE 3) 11/30/83 NA 8-2 Forecasting Electricity Demand -
8-3 NRR E (NOTE 3) 11/30/83 NA Event Categorization -
NRR/D5!/R58 LI (DROP) 11/30/83 NA 8-4 ECCS Reliability Eerit NRR/051/R$8 8-5 II.E.3.2 11/30/83 NA Ductility of Two-Way $1 abs and Shells and Buckling Thatc her RES/DE/EI8 NOTE 3(b) 1 06/30/88 NA 2'
Behavior of Steel Containments B-6 Loads, Load Combinations, Stress Limits Pittman NRR/DSR0/ IIB 119.1 12/31/8' M E
m 8-7 Secondary Accident Consequence Modeling -
NRR/051/AE8 LI (DROP) 11/30/83 NA NA @
g.8 Locking Out of ECCS Power Operated Valves Riggs NRR/DSI/R58 11/30/83
@ B-9 Electrical Cable Penetratioris of Containment Enrit NRR/051/P58 DROP NOTE 3(b) 11/30/83 NA NA y
<> B-10 -.
Behavior of BWR Mark I!! Containments V'Molen NRR/DSI/CSB NOTE 3(a) 1 12/31/84 NA O w
B-11 Subcompartment Standard Problems -
NRE/D51/C58 LI (NoiE 5) 11/30/83 NA
cD e O O
TAeif if (Continued]
S d A Plan
- ionitem / Priority lead Office / Safety Latest o Evaluation Division / Priority Latest Issuance MPA D Issue No. Title Engineer Branch Ranking Rev*sion Date No.
co B-12 Containment Cooling Requirements (Non-LGCA) Enrit NRR/DSI/C58 NOTE 3(b) 1 12/31/86 NA B-13 Marviken Test Data Evaluatio. -
NRR/05UC58 LI (NOTE 5) 11/30/83 NA 8-14 Study of Hydrogen Mising Cap 4ility in Containment Enrit NRR/ DST /GIB A-48 11/30/83 NA Post-LDCA 8-15 CGNTEMPT Computer Code Maintenance -
NRR/DSI/CSB LI (DROP) IU30/83 NA ,
8-16 Protection Against Postulated Piping Failures in Fluid Enrit NER/DUMEB A-18 IU30/83 NA I Systees Outside Containment B-11 Criteria for Safety-Related Operator Actions Milstead RES/DRPS/RHFB MEDIUM 2 12/31/86 6-18 Vorten Suppression Requirceents for Containment Susps Enrit NRR/ DST /GIB A-43 11/30/83 NA l
B-19 Thermd - w aulic Stability Colmar NRR/051/CPB NOTE 3(b) 6/30/85 NA B-20 Standard Probles. N 1ysis IU30/83 9ES/DAE/AMBR LI (NOTE 5) 8-21 Core Physics -
MAR /DSUCP8 LI (DROP) 11/30/83 NA l
8-22 LWR F uel V'Molen NER/05I/CP8 NOTE 4 11/30/83 i
B-23 LMf62 Fuel -
NRR/DSI/CP8 LI (DROP) 11/30/83 NA B-24 Seiseic Qualification of Electrical and Mechanical Enrit NRR A-46 11/30/83 NA Components B-25 Piping Benchmark Problems -
NRR/DE/MEB LI (NOTE 5) 11/30/83 8-26 Structural Integrity of Contai m nt Penetrations Riggs NRR/DE/NTE8 NOTL 3(b) 1 12/31/82 NA 8-21 Implementation and Use of Subsection NE -
NRR/DE/MES L1 (NOTE 5) IU30/83 3 S-28 Radicnuclide/ sediment Transport Program -
NRR/DE/EHEB E (POTE 3) 11/30/83 NA e B-29 Effectiveness of Ultimate Heat Sinks Pittman NRR/DE/EHEB NOTE 4 11/30/83 S-30 Design Basis Floods and Probatlity -
NRR/DE/EHEB LI (NOTE 5) 11/30/83 8-31 Dem failure Model Milstead NRR/DE/5GE8 NOTE 4 1U30/83 B-32 Ice Effects on Safety Related Water Supplies Milstead NRR/DUEHEB NGTE 4 11/30/83 8-33 Dose Assessment Methodology -
NRR/051/RA8 L1 (NOTE 3) 11/30/83 NA 8-34 Occu,34tional Radiation Exposure Seduction Enrit NRR/DSURA8 111.D.3.1 11/30/83 NA B-35 Confirmation of Appendia I Models for Calculations of -
NRR/D51/METB LI (NOTE 5) IU30/83 Releases of Radioactise Materials in Gaseous and Liquid Ef fluents f rom Light Water Cooled Fower Reactors B-36 Develop Design. Testing, and Maintenance Criteria f or Enrit NRR/DSUMETB NOTE 3(a) 1U30/83 Atmosphere Cleanup System Air Filtration and Adsorption Units for Engineered Safety Feature Systees and for Normal Ventilation Systems B-31 Chemical Discharges to Receiving Waters -
NRR/DE/EHE8 E (NOTE 5) IU30/83 B-33 Ecconnaissance Level Investigations -
NRR/CE/EHEB E (DROP) 11/30/83 NA B-39 Transmission Lines -
NRR/DUEHEB E (DROP) 11/30/83 NA 8-40 Ef fects of Power Plant Entrainment on Plankton -
NRR/DE/EHEB E (DROP) 11/30/83 NA B-41 Impacts on F isheries -
NRR/DUEHEB E (DROP) 11/30/83 NA 8-42 Socioeconomic Environmental Impacts -
NRR/DE/SA8 E (NOTE 3) IU30/83 NA
_ 8-43 valae of Aerial Photographs for Site Evaluation -
NER/DE/EHIB E (NOTE 5) lu30/83 E
x B-44 Forecasts of Generating Costs of Coal and Nuclear -
NRR/DUSA8 E (NOTE 3) IU30/83 NA ."
Plants
$ B-45 Need for Power - Energy Conservation -
NRR/DU5A8 E (B-2) 11/30/83 11/30/83 NA NA 7
f 8-46 Cost of Alternatives in Environmental Design -
NRR/DUSA8 E IDROP)
D s CD
. ?
, r .
M ~
, l x . .
TABLE II (Continued) c3
( Action y Plan Item / Priority Lead Office /
Evaluation Division /
Safety Priority latest N Issue No. Title latest Issuance MPA co Engineer Branch Ranking Revision Date No.
co B-47 Inservice Inspection of Supportt-Classes 1, 2, 3, and Colmar NRR/DE/Mi[B CROP 11/30/83 kA MC Components 8-48 84R CRD Mechanical f ailure (Collet Housing; B-49 Enrit kPR/DE/MTEB NOTE 3(b) 11/30/83 Inservice Inspection Criteria and Corrosion Prevention -
NkR Criteria for Containments LI (NOTE 5) 11/30/83 8-50 Post-0perating Basis Earthquake Inspection 8-51 Colmar NRR/DE/5GEB RI (LOW) 1 06/30/85 NA Assessment of Inelastic Analysis icchniques for Eerit NRR/DE/MIB A-40 Equipment and Comporants 11/30/83 NA B-52 fuel Assembly Seismic and LOCA Responses 8-53 Enrit NRR/D5T/CIB A-2 11/30/83 NA Load Break Switch Sege NRR/DSI/PSB 8-34 Ice Condenser Containments SI (NCIE 3) 11/30/83 8-55 Milstead NRR/DSI/CSB NOTE 3(b) 1 12/31/84 NA Improved Reliability of Target Rock Safety Relief v'Molen RES/DE/EIS MEDIUM Valves 11/30/83 8-56 Diesel Reliability 8-57 Milstead RES/DRPS/RPSI HIGH 11/30/83 D-19 Station Blackout Enrit NRR/ DST /CIB A-44 B-58 Passive Mechanical Edilures 11/30/83 8-59 Colmar NRR/DE/EQB NOTE 3(b) 1 12/31/85 NA (N-1) Loop Operation in BwRs and PWR$ Colmar 8-60 NRR/051/R58 RI (N0lE 3) 1 6/30/85 E-04,E-05' too.c Parts Mr.itoring Systes Enrit NRR/091/CPB B-61 Allowable ECCS Equipment Outage Periods NOTE 3(b) 1 12/31/84 NA B-62 Pittman RES/DRAA/PRA8 MEDIUM 11/30/83 Reemanination of Technical Bases for Establishing 5ts, -
NRR/051/CPB
& B-63 L5555, and Reactor Protection System Trip Functions L1 (DROP) 11/30/83 NA Isolation of Low Pressure Systems Connected to the Enrit NRCJDE/MEB Reactor Coolant Pressure Boudary NOTE 3(a) 11/30/83 S-64 Decoreissioning of Reactors 8-65 Colmar RES/DC/MEB NOTE 2 11/30/83 lodine Spiking Milstead B-66 NRR/DSI/AEB DROP 2 12/31/84 NA
%F Control Room Infiltration Measurements Matthews NRR/051/AE8 NOTE 3(a) 11/30/83 Etfluent and Process Monitoring Instrumentation Colmar NRR/051/PETB 111.D.2.1 b-M Pu m Overspeed During LOCA 11/30/83 NA B- W Riani NRR/051/ASB DROP 11/30/83 MA ECCS teakage Ex-Containment Riani 8-10 NRR/D5I/METB 111.D.1.1(1) 11/30/63 NA Power Grid frequency Degradation and Effect on Primary Enrit NRR/D51/PSB NOTE 3(a) 11/30/83 Coolant Pumps B-71 Incident Response B-12 Riani NRR III.A.3.1 11/30/B3 NA Health Effects and Life Shortening from Uranium and -
NRR/DSI/RAB Coal Fuel Cycles LI (NOTE 5) 11/30/83 NA 8-73 Monitoring for Excessive ViSration Inside the Reactor Thatcher NRR/DE/MEB C-12 11/30/83 NA Pressure Vessel C-1 Assurance of Continuous Long Term Capability of Hermetic Milstead Seals on Instrumentation and Electrical Equipment ' NRR/DE/EQB NOTE 3(a) 11/30/83 C-2 study of Contaimacnt Depressurization by inadvertent Eerit NRR/D51/C58 NOTE 3(b) 11/30/83 NA 2'
5 pray Operation to Determine Adequacy of Containment External Design Pressure E
m C-3 Insulation usage Within Containment Enrit NRR/ DST /GIB A-43
- o C-4 Statistical Methods for ECCS Analysis 11/30/83 NA T C-5 Decay Heat Update Riggs Riggs NRR/DSR0/SPEB RI (NOTE 3) 1 06/30/86 NA --
O WRR/05R0/SPEB R1 (NOTE 3) 1 06/30/86 NA f,,
=
e G G
ry p.\
% J %_d, TA8tf 11 (Continued)
S y Action Priority Lead Office / Safety latest a Plan Item / Evaluation Division / Priority Latest issuance MPA g Issue N . Title Engineer Branch Ranking Revision Date No co C-6 LOCA Heat Sources Riggs NRR/DSRO/SPEB RI (NOTE 3) 1 06/30/86 NA C-7 Pha System Piping Enrit NRR/DE/MTEB NOTE 3(b) 11/30/83 NA C-8 Main Steam Line Leakage Control Systems Milstead lies /DRPS/RP51 HIGH 11/30/83 C-9 RHR Heat bchanger Tube f ailures V*Molen NRR/051/R58 DROP 11/30/83 NA C-10 Effective Operation of Containment sprays in a LOCA Enrit NRR/DSI/AEB NOTE 3(a) 11/30/83 NA C-11 Assessment of Failure and Reliability of Pumps and Enrit hRR/DE/MEB NOTE 3(b) 12/31/85 NA Valves C-12 Primary System Vibration Assessment Thatcher NRR/DE/MEB NOTE 3 M 11/30/83 NA C-13 Non-Randoe Failures Enrit NRR/ DST /GIB A-17 11/30/83 NA C-14 Storm Surge Model for Coastal Sites Enrit NRR/DE/EHEB L1 (DROP) 06/30/88 NA C-15 huREG Report for Liquids Tank Failure Analysis -
NER/DE/EHES L1 (DROP) 11/30/83 NA C-16 Assessner.t of Agricultural Land i.. Relation to Power -
hRR/DE/EHEB E (DROP) 11/30/83 FA Plant Siting and Caoling Systea Selection C-17 Interim Acceptance Criteria for Solidification Agents Enrit NRR/DSI/M TB NOTE 3(a) 11/30/83 N4 for Radioactive Solid Wastes D-1 Advisability of a Seismic Scram Thatcher RES/DET/M5EB LCW 11/30/83 NA D-2 Emergency Core Cooling Systes Capability for Future Enrit NRR/051/R58 NOTE 4 11/30/83 Plants D-3 Control Rod Drop Accident Enrit NRR/DSI/CPB NOTE 3(b) 11/30/83 NA D
HEW GENERIC ISSUES
- 1. Failures in Air-Monitoring. Air-Cleaning, and Eerit NRR/D5I/METB DROP 11/30/83 NA Ventilating Systems
- 2. Failure of Protective Devices on Essential Equipment Colmar NRR/051/IC58 NOTE 4 11/30/83 M
- 3. Set Point Drift in Instrumentation Enrit NRR/D$R0/R$18 NOTE 3(b) 1 06/30/86 NA
- 4. End of-Life and Maintenance Criteria Thatcher NRR/DE/[QB NOTE 3(b) W 30/83 hA
- 5. Design Check and Audit of Balance-of-Plant Equipment Pittman NRR/DSI/ASB I.F.1 ) *.M/M NA
- 6. Separation of Control Rod from Its Drive and BWR High V'Molen NRR/0$I/CP8 NOTE 3(b) '/34 .1 NA Rod Wurth Events
- 7. Failures Due to Flow-Induced Vibrations V'Molen NRR/DSI/R58 DROP 11/3C/03 NA
- 8. Inadvertent Actuation of Safety Iqjection in PWRs Colmar NRR/DSI/R$8 I . C.1 11/30/d3 NA
- 9. Reevaluation of Reactor Coolant Pump Trip Criteria Enrit NRR/DSI/R$8 II.K.3(5) 11/ E 3 NA
- 10. Surveillance and Maintenance of TIP Isolation Valves Riggs NRR/DSI/IC58 DROP 11/10/83 NA and Squib Charges
- 11. Turbine Disc Cracking Pittman NRR/DE/MTES A-37 11/30/83 NA
- 12. BWR Jet Pump Integrity Sege NRR/DE/MIEB, NOTE 3(b) 1 12/31/84 NA z MEB ao 5
rn
- 13. Small Break LOCA from Extended Overheating of Pressurizer Hesters Riani NRR/DSI/R5B DROP 11/30/83 NA Q
? 14. PWR Pipe Cracks Eerit NRR/DE/MTEB NOTE 3(b) 1 12/31/85 NA
{
o 15. Radiation Effects on Reactor Vessel Supports Enrit NRR/DE/MTEB LOW 11/30/83 NA o w "
w co
TABLE II (Continued) o o
D Action Priority Lead Office / Safety Latest o Plan Item / Evaluati>n Division / Priority Latest Issuance MPA
$ Iss.4 As Title Engir.eer Branch Ranking Pevision Date No.
co
- 16. BhR Main Steam Isolation Valve leakage Control Systems Milstead NRR/D51/ASB C-8 11/30/83 NA
- 17. Loss of Of f site Power St.bsequent to LOCA Colmar NRR/051/P58, DROP 11/30/83 NA IC58
- 18. Sican Line Break with Consequential small LOCA Riggs NRR/D51/R58 I . C.1 11/30/83 NA
- 19. Safety Implications of Nonsafety Instrument and Control Sege NRR/ DST /CIB A-47 11/30/83 NA Power Supply Bus
- 20. Effects of Electromagnetic Pulse on Nuclear Pcwer Thatcher NRR/051/IC5B NOTE 3(b) 1 06/20/84 NA Plants 21 Vibration Qualification of Equipment Riggs NRR/DE/EIB DROP 1 06/30/86 NA
- 22. Inadvertent Boron Dilution Fvents V'Molen NRR/051/R58 NOTE 3(b) 1 12/31/84 NA
- 23. Reactor Coolant Pump Seal Failures Riqqs RES/DE/EIB HIGH 11/30/83
- 24. Automatic Emergency Core Cooling System Switch to V'Molen NRR/051/R$8 NOIE 4 11/30/83 Recirculation
- 25. Automatic Air Header Dump on 8hR Scrau System Milstead RR/D51/R5B NOTE 3(a) 11/30/83 26 Diesel Generator Loading Problems Related to SIS Reset Enrit NRR/D5I/A58 17 11/30/83 NA on Loss of Offsite Power
- 27. Manual vs. Automated Actions Pittman NRR/DSI/RSB B-17 11/30/83 NA
- 28. Pressurized Thermal Sfa k [mrit NRR/ DST /GIB A-49 11/30/83 NA
- 29. Bolting Degradation or Failure in Nuclear Power Plants V'Molen RES/DE/EIB HIGH 11/30/83 a 30. Potential Generator Missiles - Generator Rotor Pittman NRR/DE/MEB DROP 1 12/31/85 .A A Retainir.g Rings
- 31. Natural Circulation Cooldown Riggs NRR/051/R$8 I . C.1 11/30/83 NA
- 32. Flow Blockage in Essential Equipment Caused by Corbicula Enrit NRR/051/A5B 51 11/30/83 NA
- 33. Correcting Atmospheric Dump Valve Opening Upon toss of Pittman NRR/D5I/IC58 A-47 11/30/83 MA Integrated Control System Power
- 34. RCS teak Riggs NRR/DHF5/PSRB DRCP 1 06/30/84 NA
- 36. Loss of Service W.ter Colmar NRR/D51/A58, NOTE 3(b) 2 06/30/86 NA AEB, RSB
- 37. Steam Generator Overfill and Combir.ed Primary and Colmar NRR/ DST /GIB, A-47, 1 06/30/85 NA secondar/ Blowdawn NRR/D5!/R5B I.C.1(2)
- 33. Potenti.31 Recirculation System Failure as a Consequence Milstead RES NOTE 4 11/30/83 of Injection of Contairment Paint Flakes or Other Fine Debris
- 39. Potertial for Unacceptable Interaction Between the CRD Pittman NRR/DSI/ASB 25 11/3C/83 NA System and Non-Essential Control Air Systes
- 40. Safety Conceras Associated with Pipe Breaks in the BWH Colmar NRR/DSI/A5B NOTE 3(a) 1 06/30/84 B-65 Scram System E 41. BhR Scram Di; charge Volume systems V'Molen NRR/D51/R58 NOTE 3(a) 11/30/83 B-58 y y 42. Coa.bination Primary /Secordary System LOCA Riggs NRR/051/R58 I . C.1 1 06/30/85 NA <
o 43. Reliability of Air Systems Milstead RES/DRA/AicGIB HIGH 1 06/30/88 11/30/83 7
d
- 44. Failure of Seltwater Cooling System Milstead NRR/DSI/A5B 43 NA ---
1 Las G)
O O O
N M tE II (Continued) cn Safety N Action Priority Lead Office / latest y Plan Item / Evaluation Division /
Engineer Branch Priority Ranking Latest Issuance Revision Date MPA No.
N Issue No. Title
$ 06/30/84
- 45. Inopera;ility of Instrumentation Due to Extreme Cold Milstead NRR/D51/IC58 h0TE 3(a) 1 Weather
- 46. Loss of 125 Volt DC Bus Sege hRR/D51/P58 76 11/30/83 NA
- 47. Loss of Off-Site Power thatcher NRR/051/R$8, NOTE 3(b) 11/30/82 A58
- 43. LCO for Class 1E Vital Instrument Buses in Operating Sege NRR/DSI/P58 128 1 12/31/86 NA Reactors
- 49. Interlocks and LCOs for Redundant Class IE Tie Breakers Sege NRR/D51/P58 128 2 12/31/86 NA
- 50. Reactor Vessel level Instrumentation in SVRs Thatcher NRR/051/R58 NOTE 3(b) i 12/31/84 NA i IC58 j
- 51. Proposed Requirements for Improving the Reliability of Emrit RES/DE/EIB MEDIUM 11/30/83 ;
l Open Cycle Service Water Systems
- 52. 55W Flow Blockage by Blue Nssels Enrit NRR/DSI/ASB 51 11/30/83 NA
- 53. Consequences of a Postulated Flow Blockage Incident V'Molen NRR/D51/CP8 DRGP 1 12/31/84 NA in a BWR R$8 54 Valve Operator-Related Events occurring During 1978, Colmar NRR/DE/MES II.E.6.1 1 06/30/85 NA 1979. and 1980
- 55. Failure of Class IE Safety-Related Switchgear Circuit Enrit NRR/DSI/PSB DROP 1 It/31/85 NA Breakers to Close on Demand
- 56. Abaormal Transient Operating Guidelines as Applied to Colmar hRR/DHF5/HF EB A-47, 11/30/83 NA a Steam Generator Overfill Event I.D.1
@ 57. Effects of Fire Protection System Actuation Milstead RES/CRA/ARGIS MEDIUM 1 06/30/83 on Safety-Related Equipment
- 58. Inadvertent Containment flooding Sege NRR/DSI/A58, DROP 11/30/83 CSB
- 59. Technical Specification Requirements for Plant Shutdown Eerit NRR/ DST /TSIP RI (NOTE 5) 1 06/30/85 NA when Equipment for Safe Shutdown is Degraded or Inoperable
- 60. Lamellar Tearing of Reactor Systems Structural Supports Colmar hRR/ DST /GIB A-12 11/30/83 NA
- 61. SRV Line Break inside the BWR Wetwell Airspace of Mark 1 Milstead NRR/051/C58 NOTE 3(b) 2 12/31/86 NA and II Containments
- 62. Reactor Systems Bolting Applications Riggs RES NOTE 4 11/30/83
- 63. Use of Equipment E t Classified as Essential to safety Pittman RE5 NOTE 4 11/30/83 in BWR Transient Analysis
- 64. Identification of Protectica System Instrument sensing Thatcher NRR/051/IC58 NOTE 3(b) 11/30/33 Lines
- 65. Probability of Core-Melt Due to Component Cooling Water V'Molen NRR/051/A58 23 1 12/31/86 NA System Failures
- 66. Steam Generator Requirements Riggs NRR/ DEST /EMTB NOTE 2 1 36/30/85
- 67. Steam Generator Staff Actions -
'z 67.2.1 Integrity of Steam Generator Tube Sleeves Riggs NRR/DE/ME8 RI (135) 1 06/30/85 NA :D E 67.3.1 Steam Generator Overfill Riggs h2R/05T/G18 A-47 1 06/30/85 NA 2 rn NRR/DSI/R58 1.C.1
? 67.3.2 Pressurized Thermal Shock Riggs NRR/ DST /GIS A-49 1 06/30/05 esA $.
Riggs NRR/DSI/ICSB NOTE 3(a) 1 06/30/65 A-17 o g 67.3.3 Improved Accident Monitoring 00 U
TAELE II (Continued) o e
]o Action Plan Item /
Priority Lead Office /
Evaluation Division /
Safety P-iority latest latest issuance MPA g Issue No. Title Engineer Branch Ranking Revision Date No.
co 67.3.4 Reactor Vessel Inventory Measurement Riggs NRR/051/CPB II.F.2 2 12/31/87 NA 67.4.1 RCP Irip Riggs NRR/D51/R58 II.K.3(5) 2 12/31/87 NA 67.4.2 Control Room Design Review Riggs NRR/DHF%/HFEB 1.D.1 2 12/31/87 NA 67.4.3 Emergency Operating Procedures Riggs NRC/DHtS/P5RB 1.C.1 2 12/31/87 NA 67 5.1 Reassessment of SCig nesign Basis Riggs RES/DEPS/RPSI L1 (NOTE Si 2 12/31/87 hA 67.5.2 Reevaluation of SGTR Design Basis Riggs RES/DRPS/RPSI it (NOTE 5, 2 12/31/87 NA 67.5.3 Secondary System Isolation Riggs hRR/DSI/R58 CROP 2 12/31/87 NA 67.6.0 Organizational Responses Riggs OIE/DEPER/IRDB III.A.3 2 12/31/87 NA 67.7.0 Improved Eddy Current Tests Rigg, RES/DE/EIB 135 2 12/31/87 NA 67.8.0 Denting Criteria Riggs NRR/DE/MTEB R1 (135) 2 12/31/87 NA 67.9.0 Reactor Coolant System Pressure fontrol Riggs hRR/DSI/CIB A-45, 2 12/31/87 NA NRR/051/R58 1.C.) (2,3) 67.10.0 supplement Tube Inspections Riggs NRR/DL/ DRAB LI (*101E * ) 2 12/31/87 NA
- 68. Postulated Loss of Auxiliary Feedwater System Resulting Pittman MRR/DSI/ASB 124 2 12/31/86 NA from Turbine-Driven Auniliary feedwater Pump Steam Supply Line Rupture
- 69. Nke up Nozzle Cracking in B&W Plants Colmar NRR/DE/MEB, N01E :(b) 1 12/31/84 (later)
MTEB
- 70. PORV and Block Valve Reliability Riggs RES/DE/EIB MEDluM 1 6/30/34
- 71. Failure of Resin Demineralizer Systems and Their Pittman RES NOIE 4 11/30/83 3
m Effects on Nuclear Power Plant Safety
- 72. Control Rod Drive Guide Tube Support Pin failures Riggs RES NOTE 4 11/30/83
- 74. Reactor Coolant Activity Limits for Operating Reactors Milstead NRR/DSI/AEB CROP 1 06/30/86 NA
- 75. Generic Implications of AIWS Events at the Sales Thatcher RES/DRA/ARGIB NOTc 1 11/30/83 B-76,8-77 haclear Plant B-78,B-79 B-80,8-81 B-82.B-85 B-86,B-87 B-88,B-89 B-90,B-91 B-92 B-93
- 76. Instrumentation and Control Power Interactions Pittman RES/cRA/ARGIB NOTE 4 11/30/83
- 77. Ilooding of Safety Equipment Compartments by Back-flew Colm.sr RES/DE/EIB A-17 12/31/87 NA Through F loor Crains
- 78. Monitoring of Fatigu a Transient Limits for Reactor Riggs 013RA/ARGIB N0iE 4 11/30/83 Caolant System
- h. Uunalyzed Reactor vessel Ibermal Stress During Colmar NLi'DE/EIB MEDIUM 1 12/31/84 Natural Convection Cooldown
- 00. Pipe Break Effects on Control Rud Drive Hydraulic Lines V * **. i e4 nRR/051/R58, LOW 11/30/83 NA
[ in the Drywells of EWR Mark I and II Containments ASB, y
- O CPB <
$ 31. Iepact of Lod ed Doors and Barriers on Plant and Colmar NRR/DHf5/PSR8 DR2P 1 12/31/84 NA g-
- Personnel Safety
@ 82. Beyond Design Basis Accidents in Spent Fuel Pools V*nolen RES/DRPS/RPSI Mt01UM 11/30/83 g w 83. Control Room Habitability Emrit RES/DRAA/5AIB NOTE 1 1 12/31/86
" 06/30/85 CD
- 85. Reliability of Vacuum Breakers Conr.ected to Steam Milstead NRR/051/C58 DR0r 1 12/31/85 NA Discf arge Lines inside BWR Containments O O O
J' 4
TABLE II (Continued)
O N Action Priority Lead Office / Safety latest "c3 Plan Item / Evaluation Division / Priority latest Iss :ance MPA g Issue No. Title Engineer Branch Ranking Revislun Date No.
Cp
- 86. Long Range Plan for Dealing with Stress Corrosion Enrit NRR/ DEST /EN18 NOTE 3(a) 1 06/30/88 8-84 Cracking in 8WR Piping
- 87. Dailure of HPCI Steam Line Without Isolation Pittman RES/DRPS/RPSI HIGH 12/31/85
- 88. Earthquakes and Emergency Planning Riggs RES/DRA/A EIB NOTE 3(b) 12/31/87 NA
- 89. Stiff Pipe Cl wps Riggs RES NOTE 4 (later)
- 90. Technical Specifications for Anticipatory Trips V'Molen NRR/051/R58 LOW 12/31/84 M IC58
- 91. Main Crankshaft Failures in Iransamerica DeLaval Enrit RU/DRA/AE18 NOTE 3(b) 12/31/87 NA Emergency Diesel Generators
- 93. Steam Binding of Auxiliary feeduater Pumps Pittman RES/DRPS/RPSI NOTE 3(a) 06/30/88
- 94. Additional Low Temperature Overpressure Protection Pittman RES/DRPS/RPSI HIGH 13/31/85 issues for Light Water Reactors
- 95. Loss of Effective Volume for Containment Recirculation Milstead RES/DRA/AEIB NOTE 4 (later) j 5 pray i 96. RHR Suction Valve Testing Kilstead RES/DRA/AE18 NOTE 4 (later) l 97. PWR Reactor Cavity Uncontrolled Exposures V*Molen NRR/DSI/RA8 111.0.3.1 06/30/85 M
- 98. CRD Accumulator Check Valve Leakage Pittman NRR/D51/A58 OROP 06/30/85 NA
- 99. RCS/RHR Suction Line Valve Interlock on PWR5 Pittman RES/DRPS/RPSI HIGH 1 06/30/86 D 100. OT5G Level Riggs RES/DRA/AEIB NOTE 4 (later) 06/30/85
,101. Break Plus Single Failure in BWR Vater Level V'Molen RES/DE/ElB HIGH Instrumentation
~
102. Human Error in Events Involving Wrong Unit or Wrong Enrit NRR/DLPQ/LPEB NOTE 1 12/31/86 Train 103. Design for Probable Maximum Precipitation Enrit RES/DE/EIB NOTE 1 12/31/85 ;
104. Reduction of Boron Dilution Requirements Pittman RES NOTE 4 (later) 105. Interfacing Systems LOCA at 8WRt Milstead RES/DE/EIB HIGH 06/30/85 106. Piping and Use of Highly Combustible Gases in Vital Milstead RES/DRPS MEDIUM 12/31/87 Areas 107. Generic Implications er Main Iransformer Failures Milstead RES NOTE 4 (later) 108. eWR Suppression Pool Temperature Limits Colmar NRR/D5!/C58 RI (LOW) 06/30/85 NA 109. Reactor Vessel Closure Failure Riggs RES/DRA/AEI8 NOTE 4 (later) 110. Equipment Protective Devices on Engineered Safety Milstead RES/DRA/AEI8 NOTE 4 (later)
Features
- 111. Stress Corrosion Cracking of Pressure Boundary Riggs NRR/DE/MTE8 LI (NOTE 5) 12/31/85 NA Ferritic Steels in Selected Environments l 112. Westinghouse RP5 Surveillance Frequencies and Pittman NRR/DSI/IC58 RI (NOTE 3) 12/31/85 NA l Out-of-Service Times ' l 113. Dynamic Qualification Testing of Large Bore Riggs RES/DE/EIR HIGH 12/31/87 m 114.
Hydraulic Snubbers Seismic-Induced Relay Chatter Riggs NRR/DSR0/SPE8 A-46 06/30/86 NA $"
8 115. Enhancement of the Reliability of Westinghouse Milstead RES/DRPS/RPSI HIGH 12/31/86 y e Solid State Protection System 8 116. Accident Management Pittman RES/DRA/ARGI8 NOTE 4 (1.ter) [ l U
oo
TAElf !! (Continued)
O D
o Action Priority Lead Office / Safety latest Plan Item / Evaluation Division / Priority Issuance D
co Issue N. Title Engineer Branch Ranking latest Revision Date MPA No.
117. Allo =4t,le Outage Times for Diverse Simultaneaus Pittman Equipment Outages RES/DRA/ARGIB NOTE 4 (later) 118. Tendon Anchorage failure Milstead 119. Piping Review Committee Recommendations -
RES/DRA/ARGIB NOTE 4 (later) 119.1 Piping iiupture Requiresunts and Decoupling of Riggs NRR/DE RI (NOTE 5) 12/31/85 NA Seismic and LOCA Loads 119.2 Piping Damping values Riggs NRR/GE 119.3 Decoupling the 081 from the SSE RI (NOTE 5) 12/31/85 NA Riggs hER/DE RI (NOTE 5) 12/31/85 NA 119.4 8.R Piping Nterials Riggs NRR/DE RI (NOTE 5) 12/31/85 NA 119.5 teak Detection Requirements Riggs kRR/DE 120. RI (NOTE 5) 12/31/85 NA On-Line Testability cf Protection Systems Milstead RES/DRA/ARGIB NOTE 4 (later) 121. Hydrogen Control for Large. Dry PwR Containments Enrit RES/DRA/RDB HIGH 12/31/85 122. Davis-Besse toss of All feedwater Event of June 9 - - -
W5 - Short-Tere Act ions 122.1 Fotential MIity to Temove Reactor Decay Heat - - -
1 2.1.a failure of Isolation Valves in Closed Position V*Molen NRR/05RO/R518 122.1.b 124 1 12/31/86 NA Recovery of Auxiliary feedwater V'Molen NRR/D5R0/RSIB 124 1 12/31/36 NA 122.1.c. Interruption of Auxiliary feedwater Flow V'Molen NRR/05R0/R$18 124 1 12/31/86 NA a 122.2 Initiating Feed and-Bleed V'Molen hRR/ DEST /5RX8 HIGH 1 12/31/86 CD 122.3 Physical Security System Constraints V'Molen NRR/05R0/SPE8 LOW l 12/31/86 NA
)
123. Deficiencies in the Regulations Governi..g D8A and Riggs Single-failure Criteria Suggested by the Davis-Besse RES/DRA/ARGIB NOTE 4 (later)
Event of June 9,1985 124. Auxiliary feedwater system Reliability Enrit NRR/ DEST /SR)tB N0!E I 1 12/31/86 125. Davis-Besse toss of All Feedwater Ever.t of - - -
1 June 9,1%5 - Long-Term Actions l
125.1.1 Availability of the STA V'Nlen RES/DRA/ARGIB DROP 3 06/30/88 NA l
l 125.I.2 PORV Reliability - - - -
125.I.2.a Need for a Test Program to Establish Reliability of V'Molen NRR/05R0/$PE8 70 3 06/30/88 MA l the PORY 125.I.2.b Need for PORV Surveillance Tests to Confirm V'Molen NRR/DSR0/SPE8 70 3 06/30/88 NA l
j Operational Readiness 1
125.I.2.c Need for Additional .Notection Against PORV Failure V'Molen NRR/DSR0/SPE8 DRCP 3 06/30/88 NA 125.I.2.d Capability of the PORV to Support Feed and-Bleed V'Molen NRR/05RO/SPE8 A-45 3 06/30/88 NA z 125.I.3 SPDS Availability Milstead RES/DRA/ARGIB NOTE 1 3 06/30/88 c- 125.I.4 Flant-5pecific Simulator Riggs RES/DRA/ARG!8 DROP 3 06/30/88 NA y A
c) 125.I.5 Safety Systems Tested in All Conditions Required by Riggs RES/DRA/ARGIB NOTE 4 3 06/30/88 <
Design Basis Analysis d 125.I.6 Valve Torque timit and Bypass $ witch Settings V'Nlen RES/DRA/ARGIB DROP 3 06/30/88 NA 7
e 125.I.7 Operator Training Adequacy - - -
w @
CD O O O
x e
% %J %J TA8tf II (Continued) l O l ( Action Priority Lead Office / Safety Latest y Plan Item / Evaluation Division / Priority latest Issuance f1PA x Issue No. Title Engineer Branch Ranking Revision Date No.
125.I.7.a Recover f ailed Equipment Pittman RES/DRA/ARGIB DROP 3 06/30/88 NA 125.I.7.b Realistic Hands-On Training V'Molen RES/DRA/ARGIB DROP 3 06/30/88 NA 125.I.8 Procedures and Staffing for Reporting to NRC Emergency V'Molen RES/DRA/ARGIS DROP 3 06/30/88 NA Response Center 125.11.1 MW System Evaluation - - -
125.11.1.a Two-Train MW Unavailability V*Molen NRR/DSR0/5FEB DROP 3 06/30/88 NA 125.II.l.b Review Existing MW Systems for Single Failure V'Nien NRR/05R0/SPEB 124 3 06/30/88 NA 125.II.I.c NURtG-0737 Reliability leprovements V'Molen NRR/05R0/SPEB DROP 3 06/30/88 NA 125.II.l.d MW/ Steam and FeeAter Rupture Control System /ICS V'Holen NRR/DSRO/SPES DROP 3 06/30/88 NA Interactions in B&W Plants 125 11.2 Adequacy of Emisting mintenance Requirements for Riggs RES/DRA/A EIB DROP 3 06/30/88 NA Safety-Related Systems 125.11.3 Review Steam /feedline Break Mitigation Systems for V'Molen NRR/D5R0/SPES DROP 3 06/30/88 NA Single Failure 125.11.4 Thermal Stress of OI5G Components Riggs hRR/DLRO/SPEB DROP 3 06/30/88 NA 12111.5 1hermal-Hydraulic Effects of Loss and Restoration Riggs RES/DRA/ARG18 DROP 3 06/30/88 of Feedh.ater on Primary System Components 125.!I.6 Reenamine PRA-Based Estimates of the Likelihood of V'Molen RES/DRA/ARGIB DROP 3 05/30/86 kA a Severe Core Damage Accident Based oa toss of All Feedwater
$ 125.11.7 Reevalua'e Provi, ion to Automatically Isolate Feedwater trom steam Generatcr During a Line Break V*Molen RES/DRPS/RPSI HIGH 3 06/30/88 125.11.8 Reassess Critaria for Feed-and-Bleed Initiation V'Molen RES/DRA/ARGIB DROP 3 06/30/88 NA 125.11.9 Enhanced Feerand-Bleed Capability V'Molen NRR/DSRO/SPER DROP 7 06/30/88 NA 125.11.10 Hierarchy <.f Impromptu Operator Actions Riggs RES/DRA/ARGIB DROP 3 06/30/88 NA 125.11.11 Recovery af Nin Feekter as Alternative to MW Riggs RES/DRA/ARGIB DROP 3 06/30/88 NA 125.11.12 Adequacy of Training Regarding PORV Operation Riggs RES/DRA/ARGIB DROP 3 06/30/88 NA 125.11.13 Operator Job Aids Pittman NRR/DRA/ARGIS DROP 3 06/30/88 NA 125.11.14 Remote Operation of Equipment With Must Now Be V'Molen NRR/D5R0/SP[11 LOW 3 06/30/88 NA Operated Locally 126. Reliability of PWR m in Steam Safety Valves Riggs RES/DRA/ARGIB L1 (NOTE 3) 06/30/88 NA 127. 'esting and Nintenance of Manual Valves in Safety- Pittman RES/DRA/ARGIB LOW 12/31/8s NA Related Systems 128. Electrical Power Reliability Enrit RES/DE/ElB HIGH 12/31/86 129. Valve Interlocks to Prevent Vessel Drainage During Milstead RES/DRA/ARGIB NOIE 4 (later)
Shutdown Cooling 130. Essential Service Water Pump Failures at Multiplant Riggs RES/DRPS/RPSI HIGH 12/31/87 Sites 131. Potential Seismic Interaction Involving the Movable Riggs RES'DRA/ARGIB NOTE 4 (later)
In-Core Flum m pping System in Westinghouse Plants y 132. RHR Pumps Inside Containment Riggs RES/DR NOTE 4 (later) y n 133. Update Policy Statement on Nuclear Plant Staff Pittman NRR/DLPQ/LHFB LI (NOTE 5) 12/31/87 NA .c r" working Hours -
? 134. Rule on Degree and Emperience Requirement Pittman RES/DRA/R08 HIGH 12/31/87 E C) 135. Integrated *. team Generator Issues Eerit RES/DE/EIB MEDIUM 12/31/87 o 8
W 136. Storage and Use of Large Quantities o* Cryogenic Milstead RES/DRA/ARGIS L1 (NOTE 3) 06/30/88 NA co Combustibles On Site
i I
l l
l TABLE II (Continued)
O
]
o Action Plan Item /
Priority Lead Office / Safety latest g issue No. Title Evaluation Division / Priority latest Issuance MPA Engineer Branch Ranking Revision Date No.
co 131. Refueling Cavity Seal failure Milstead 133. Deinerting upon Discovery of RCS Leakage Milstead RES/DRA/ARGIB NOTE 4 (later) 13'). Thinning of Carbon Steel Piping in LbRs Riggs RES/DRA/ARGIB NOTE 4 (later) 140. Fission Product Removal by Containment Sprays Riggs RES/DRA/ARGIB NOTE 4 (later) 14L LBLOCA with Consequential SGTR Riggs RES/DRA/ARGIS NOTE 4 (later) 142. Leakage Through Electrical isolators Milstead RES/DRA/ARGIB NOTE 4 (later) 143. Availability of Chilled Water Systems Milstead RES/DRA/ARGIB NOTE 4 (later) 144. Scram Without a Turbine / Generator Trip Riggs RES/DRA/ARGIB NOTE 4 (later)
RES/DRA/ARGIB NOTE 4 (later)
HUMAN FACTORS 155Uf 5 M1 STAFFI S AND QUAL!FICATIONS rf 1.1 Shift Staffing Pittaan NF 1. 2 Engineering Empertise on Shif t RES/DRPS/RHFB HIGH I 12/31/86 Hf l. 3 Pittman NRR/DNFT/HFIB NOTE 3(b) 1 12/31/86 Guidance on Limits and Conditions of Shift Work Pittman NRR/DHFT/HFIB NOTE 3(b) 1 12/31/86 NF 2 TRAINING 2.1 Evaluate Industry Training Pittman NRR/DHFT/HFIB L1 (NOTE 5) 1 12/31/86 NA HF 2. 2 Evaluate 1%P0 Accreditation Pittman NRR/DHTT/HFIB hf 2. 3 Revise SRP Section 13.2 LI (NOTE 5) 1 12/31/86 NA Pittman NRR/0HFT/HFIB L1 (NOTE 5) 1 12/31/86 NA HF 3 OPERATOR LICEN51teG EXAMINATIONS HF 3.1 Develop Job Knowledge Catalog- Pittman hRR/DHFT/HFIB L1 (NOTE 3) 2 12/31/87 NA Hf 3. 2 Develop License Emanination H.ndbook Pittman NRR/DHFT/HFIB FF 3. 3 Develop Criteria for Nuclear Power Plant Simulators L1 (NOTE 3) 2 12/31/87 NA Hf 3. 4 Pittman hRR/DHFT/HFIB !.A 4.2(4) 2 12/31/87 NA Examination Requirements Pittman HF 3. 5 Develop Computerized Exam System NRR/DHFT/HFIB 1.A.2.6(1) 2 12/31/81 NA Pittman NRR/DHFT/HFIB LI (NOTE 3) 2 12/31/87 NA HF4 PRSCEDGRES Ht4.1 Inspecticn Procedure f or Upgraded Emergency Pittman Operating Procedures hER/DLPQ/LHFB HIGH 1 12/31/86 HF4.2 Procedures Generation Package Effectiveness Evaluation Nf 4. 3 Pittman kRR/DHFT/HFIB L1 (NOTE 5) 1 12/31/86 NA Criteria for Safety-Related Operator Actions Pittman NRR/DHFT/HFIB B-17
- - M 4. 4 Guidelines for Upgrading Ottier Procedures 1 12/31/86 NA Pittman RE S/DRPS/Rhf B HIGH 12/31/86 E
rn NF 4. 5 Application of Automation and Artificial Intelligence Pittman NRR/DHFT/HFIB HF5.2 I
1 12/31/86 NA x
'D 9
o -
HF5 MN-MCHIhE INT [Rf ACE
- D o w HF5.1 Local Control Stations 3 Hf5.2 Pittman DES /DRPS/RHfB HIGH 1 12/31/86 Review Critecia for Human f actors Aspects of Advanced Pittman RES/DRPS/RHFB HIGH I 12/31/86
- Controls and Instrumentation e 9 9
s TABLE II (Continued)
S N Actist Priority Lead Office / Safety Latest
$ Plan Ites/ Evaluation Division / Priority Latest Issuance MPA g
co Iswe No. Title Engineer Branch Raniting Revision Date No.
HF5.1 Evaluation of Operational Aid Systees Pittman NRR/DHFT/HFIB HF S.2 1 12/3U86 NA HF5.4 Computers and Computer Displays Pittman NRR/DHFT/HFIB HF5. 2 1 12/3U86 NA H_F6 MANAGEMENT AIO CEAN!?ATION HF6.1 Cevelop Regulatory Position on % nagement and Pittman NRR/DNFT/HFIS 1. 8.1.1 1 12/31/86 NA Organization (1.2.3.4)
HF6.2 Regulatory Position on Management and Drganization Pittaan NRR/DHFT/HFIB 1.8.1.1 1 12/31/86 NA at Operating Reactors (1,2,3.4)
HF7 NtmAN ret 1A81tITY If 7.1 Himan Error Data Acquisition Pittaan NRR/DHFT/HFIB LI (NOTE 5) 1 12/3U M MA HF7.2 Human Error Data Storage and Retrieval Pittman NRR/DNFT M 18 LI (NOTE 5) 1 12/3U M NA 1W 7. 3 Reliability Evaluation Specialist Aids Pittaan NRR/DHFT/MFIB L1 (NOTE 5) 1 12/3UM NA HFF.4 Safety Event Analysis Results Applications Pittman NRR/Difi/MFIS LI (ISTE 5) 1 12/3UM MA HIS h intenance and Surveillance .$rogram Pittaen NRR/DLPQ/LPEB NDTE 3(b) 2 06/30/88 NA E
E E' A 5.
? ":.
8 8 t: m
Revision 8 O
1 l
l l
l THIS PAGE LEFT BLANX INTENTIONALLY 9li O
06/30/88 52 NUREG-0933
J l
o o
N w
o N
CD CD l
l TASTE III supeenaf 0F THE PRIORITIIATION OF Att TMI ACTION PLAII ITEses.
TASK ACTIOst PLAN ITEMS sufW Clmf AIC liSUES, AsID Mastpfe F AClGR5 ISSUES tegend an0IES: 1 - Possible Resolution Identified for Evaluetten m 2 - Resolution Available W 3 - Resolution Resulted in either the Establishment of Itew Requirements or Ito Itow Sequirements 4 - Issues to be Prioritized in the Future 5 - Issue that is not a Generic Safety Issue ( -t should be Asslymed Resourtes for Completten HICH - High Safety Priority fEDIUM - feediue Safety Priority LOW - tow Safety Priority DAOP - Issue Oropped as a Generic Issue USI - Unresolved Safety Issue I - TMI Action Plan Itap with Implementation of Resolution flendetad by IEfAEG-0737 l
2
=
4 c <
l :o
- m
=**
O O 3 D
CD
l l
l l
TAstt III (Continued) o
<n N CovtaID RE50tvfD STAGES
$ ACTICm ITEM /155uE GR7JP IN OTHER NOTE N01L NOTE g I 1550E5 1 2 3 USI HIGH MEDItat LOW OROP NOTE 4
NOTE 5 TOTAL
- 1. Tm! ACTION PtAm ITtw5 (369)
(a) Safety (t) Gener c Safety 88 46 1 1 124 0 3 2 12 7 2 5 291 (b) mon-safety (f) Lice ting -
0 - -
73 - - -
0 0 5 78
- 2. TASE ACTION PLAN ITip6 (142]
(a) Safety (t) USI - -
0 1 18 8 - - - - - -
27 (ii) Generic Safety -
19 0 29 1 -
2 4 3 9 6 -
73 (s ti) Regulatory Impact -
0 0 0 5 - - -
1 0 0 1 7 (b) hon-Safety w (4) Licensing -
0 0 0 1 - - - -
8 0 11 20 (86) Enstronmenta! -
1 0 0 6 - - - -
6 0 2 15
- 3. MW Cf hrRIC 155ut5 (19sy (a) Safety (t) Generic Safety -
45 7 1 22 0 16 7 8 37 35 -
178 (11) Regulatory Impact -
2 0 0 1 - - -
1 0 0 6 10 (b) hon-Safety (1) Licensing -
0 0 0 2 - - - -
0 0 5 7
- 4. HUMAN FACTCa5 ISSUES (77)
(a) Safety (t) Generic Safety -
8 0 0 3 0 5 0 0 0 0 -
16 h (b) Em-Safety y
y (t) Licensing -
0 0 0 3 - - - - -
0 8 11 <
O .
TOTAL:
f 88 121 8 4 237 8 26 13 25 67 43 43 733 w "
m O O O
l l
Revision 5 O
TASK I.A.4: SIMULATOR USE AND DEVELOPMENT The objectives of this task were as follows: (1) to establish and sustain a -
high level of realism in the training and retraining of operators, including !
dealing with complex transients involving multiple permutations and combinations of failures and errors, and (2) to improve operators' diagnostic capability and general knowledge of nuclear power plant systems. ;
ITEM I.A.4.1: INITIAL SIMULATOR IMPROVEMENT ITEM I.A.4.1(1): SHORT-TERM STUDY OF TRAINING SIMULATORS DESCRIPTION i The TMI Action Plan 48 called for a short-term study of training simulators. l The purpose was to collect and develop corrections for presently identified weaknesses. A study of training simulators was undertaken and a report, NUREG/CR-1482,299 was issued in June 1980.
CONCLUSION ;
5 This item has been RESOLVED and no new requirements were established.
ITEM I. A.4.1(2): INTERIM CHANGES IN TRAINING $1MULATORS DESCRIPTION The THI Action Plants stated that requirements to correct specific training i simulator weaknesses should be developed based on the short-term study resulting from Item I.A.4.1(1). This item was completed with the issuance of -
Regulatory Guide 1.149,438 "Nuclear Power Plant Simulators for Use in Operator Training," in April 1981.
CONCLUSION This item has been RESOLVED and new requirements were established. !
?
ITEM I.A.4.2: LONG-TEPA TRAINING SIMULATOR UFGRADE i
The four parts of this item have been combined and evaluated together.
1 L
! DESCRIPTION !
I I Historical Background j
l Nucicarpowerplantsimulatorsarerecognizedasanimportantpartofreactor i operator training. The THI Action Plan a called for a number of actions to :
I l
' l 06/30/88 1.I.A.4-1 NUREG-0933 i
I, '
Revision 5 improve simulators and their use. There is significant interaction among the simulator-related action items and clear separation is difficult.
Item I.A.4.2 has a number of components dealing with long-term upgrades. The NUREG-066048 description calls for research to: (1) improve the use of simu-lators in training operators; (2) develop guidance on the need for and nature of operator action during accidents; and (3) gather data on operator perfor-mance. Specific research items mentioned include simulator capabilities, safety-related operator action, and simulator experiments. The item also calls for the upgrading of training simulator standards, specifically updating of ANSI /ANS 3.5-1979. A regulatury guide endorsing that standard a.id giving the criteria for acceptability is also mentioned. The final portion of Item I.A.4.2 calls for a review of simulators to assure their conformance to the criteria.
A significant portion of the activities to be conducted under this item has been completed For ex e ple, ANSI /ANS 3.5 was revised and issued in 1981. The regulatory guide endorsing this standard, Regulatory Guide 1.149,438 "Nuclear Power Plant Simulators for Use in Operator Training," as well as numerous research reports have been published.
It is clear that the regulations, the ANS standard, and the regulatory guide do not require a site-specific simulator. 10 CFR 55 states that, if a simulator is used in training, it "... shall accurately reproduce the operating charac-teristics of the facility involved and the arrangement of the instrumentation and controls of the simulator shall closely parallel that of the facility involved." ANSI /ANS 3.5-1981 calls for a high degree of fidelity between the simulator and the "reference plant." However, there is no requirement that the reference plant be the same facility that the personnel in training will in fact operate. Regulatory Guide 1.149438 explicitly makes the distinction stating
"... the similarity that must exist between a simulator and the facility that the operators are being trained to operate is not addressed in the guide and should not be confused with the guidance provided that specifies the similarity that shoult' exist between a simulator and its reference plant."
The work that has been completed for Item I.A.4.2(1) includes the issuance of NUREG/CR-2353300 (Volumes I and II), NUREG/CR-1908,418 NUREG/CR-2598,417 NUREG/CR-2534,414 NUREG/CR-3092,418 and NUREG/CR-3123.853 This item, however, has long-range requirements calling for: (1) the review of operating experi-ence to provide data on eperator responses, and (2) the design and conduct of experiments to determine operator error rates under controlled conditions.
Items I.A.4.2(2) and I.A.4.2(3) were completed with the issuance of Regulatory Guide 1.149.488 Item I.A.4.2(4) concerns the long-term training simulator improvement criteria which were also established in Regulatory Guide 1.149,4as issued in April 1981, and the critoria were initiated in FY 1982. However, the staff review of submittals from simulator owners for conformance with the criteria was an ongoing task in 1983. Therefore, the outstanding portions of this issue (the continuation of simulator research and the review for conformance to acceptability criteria) were evaluated.
The assessment of this safety issue was conducted by PNL staff8 4 with experience in reactor operator licensing, reactor operation, and general reactor safety, in consultation with General Physics Corporation. General Physics Corporation 06/30/88 1.1.A.4-2 NUREG-0933
l l
\
l Revision 5 l provided utility training services and had experience in reactor simulators, t
' providing procurement and startup assistance, operation and maintenance services, and simulator modifications.
l i
fn the assessment of this issue it was necessary to acknowledge that many of the I THI items associated with operator training were interrelated and that ranking problems surface when an attempt is made to assess these independently. For example, the present issue relates to Items I.A.2.6(1,2,3, and 5), which deal with training improvements including the enhanced use of existing simulators, l
and I.A.4.1, which deals with initial simulator improvement, including short-j term and interim changes in training simulators. However, it is useful to note I
that the final safety ranking of this issue is relatively insensitive to changes in the basic assumptions used to distinguism these interrelated issues by the very nature of the ranking matrix. Therefore, it is possible to estab-lish a priority ranking for this issue, despite the possible overlapping of potential benefits and costs with the other interrelated issues.
Safety Significanca Use of simulators with high fidelity to the reference plant would significantly r
I improve operator training in dealing with abnormal conditions thereby reducing operator error. The operators' performance under accident conditions is l expected to be enhanced. Thus, a potential core-melt would be avoided and overall core-melt frequency reduced.
l Possible Solution A possible solation would be to establish a high level of realism in the train-l- ing and retraining of plant operators by developing simulators with a high degree of fidelity to the reference plant.
PRIORITY DETERMINATION I
Assumptions It was assumed that the major effect of these issues, both in terms of safety benefit and cost incurred, would be in the enhancement of the level of realism imparted by simulators. The specific modeling capabilities given under Item I.A.4.1(2) and in the specification of ANSI /ANS 3.5-1981 specify this feature.
It was assumed for the resolution to this safety issue that, in order to pro-vide the intended level of realism, site-specific simulators would be acquired.
Such simulators would be significantly more realistic when compared to the specific facilities, both in layout and operation, tiian existing generic simu-lators. In addition, they are assumed to enhance transient and accident modeling capabilities.
In this assessment, it was clear that provision of site-specific simulators, while not explicitly required, would moet the requirements of Item I.A.4.1(2),
the fidelity requirements of ANSI /ANS 3.5-1981, and the accurate reproduction requirements of 10 CFR 55. Less sweeping simulator enhancements might also fulfill these requirements, but would have to be decided on a case-by-case basis. Therefore, for risk and cost estimates, it was assumed that the enhancement would be effetted by the introduction of site-specific simulators.
06/30/88 1.I.A,4-3 NUREG-0933
Revision 5 The public risk reduction (and occupational dose roduction due to accident avoidance) are associated with the reduction in operator error expected to result from the training and requalification of operators on improved simulators.
Inasmuch as any studies relating human error rates to the realism of simulator training are not available, this assessment will be based primarily on PNL engineering judgment. Therefore, it is estimated that a reduction in operator error rate of 30% will result from the resolu. ion of this safety issue. This sole-value estimate implies that for specific instances the improvement could be much greater, but the 30% reduction is used as an estimate of the average improvement for the purposes of calculation.
The number of plants and the average remaining lifetimes are assumed to be 90 plants and 28.8 yrs for PWRs and 44 plants and 27.4 years for BWRs, respec-tively. The plants selected for analysis are Oconee 3, representative of PWRs, and Grand Gulf, representative of BWRs. (It is assumed that the fractional risk and core-melt frequency reductions for Grand Gulf will be equivalent to those for the PWR which is calculated directly.)
The dose calculations are based on a reactor site population density of 340 people per square mile and a typical midwest meteorology i= issumed.
Frequency Estimate All release categories are affected by the resolution of this issue. The calculated core-melt frequencies are 8.2 x 10 5/RY for PWRs and 3.7 x 10 5/RY for BWRs. The reduction in these frequencies, based on the 30% reduction esti-mated for operator error, is 1.3 x 10 5/RY for PWRs and 5.9 x 10 5/RY for BWRs.
Consequence Estimate The resulting total reduction in public risk is 150,000 man-rem 64 The estimated reduction in occupational dose is 820 man-rem based on accident avoidance only since there are no implementation or maintenance dose reductions associated with resolution of this issue.
Cost Estimate Industry Cost: The major effect of the resolution of these safety issues was assumed to be the acquisition and use of site-specific simulators. The costs to industry of such an undertaking would be substantial. It is important to recognize that, if improved modelling changes were possible on existing simula-tors, the cost to industry would be substantially smaller. However, this was not clear at the time of the evaluation and it was assumed that new simulators would be required. (The impact of this assumption can be weighed subsequently in the final safety priority ranking. The assumption can be reevaluated at that titre for any appropriate modifications. )
Assuming that new simulators would be required, the principal industry costs for implementation of this safety issue would be the purchase of the simulators and provision of the new training materials. The capital cost of a simulator is estiliated to be $7H. The provision of training materials is estimated to be equivalent to a 7 man year effort.
O 06/30/88 1.I.A.4-4 NUREG-09'
l Revision 5 It was assumed that all reactors, both operating and planned, would be affected.
However, not every reactor would require a simulator. Many reactor sites have two or more reactors located together. If these reactors are sufficiently similar, a single simulator could serve them. Examining the list of 134 operating and planned power reactors, it was estimated that 62 additional site-specific simulators would be adequate. This assumed that 20% of the potential simulators are not required because either a site-specific simulator already exists or the plant in question is an older facility with limited lifetime remaining.
The costs for the 62 new simulators spread over 134 reactors yields $3.2M/
reactor in capital cost and 3.2 man year / reactor to provide new training materials. The operation and maintenance of the rew simulators is estimated to require 3 man years of effort per simulator. Again, sharing the expense for 62 simulators over 134 reactors yields 1.4 man years / reactor. Industry may also experience costs stemming from participation in simulator experim:ints and research. However, in comparison to the costs related to new simulators, these costs would be small.
Based on these assumptions the total industry costs are obtained as follows:
(1) Safety Issue Resolution (SIR) Implementation (a) Labor: (7 man yr) (62 simulators) ($100.00_0) = $320,000/ plant simulator 134 plants man year (b) Equipment: (6 t
) (simu ator) = $3.2M per plant 3 nt Thus, the total industry cost for implementation is (134 plants) ($320,000/ plant + $3,200,000/ plant) or $470M.
(2) Operation and Maintenance of the SIR (1.4 **, "r) ($ r ) ((90 PWRs)(28.8 yrs) + (44 BWRs)(27.4 yrs))
= $530M Therefore, the total combined industry cost is $(470 + 530)H or $1,000M.
NRC Cost: The principal costs to the NRC are the continuation of research and the conduct of the confirmatory reviews. No additional development costs are foreseen as ANSI /ANS 3.5 is currently being revised and will necessitate a revision to Regulatory Guide 1.149. "
The continuing research is treated as an implementstion cost. It is estimated to require one NRC man year and $1H in contractor support. (This included the remaining costs associated with Item 1.E.8.) The confirmatory reviews are also treated as an implementation cost and are estimated to require 4 man-weeks /
simulator, or a total of 248 man weeks for thn assumed 62 new simulators.
06/30/88 1.I.A.4-5 NUREG 0933
Revision 5 The operational review cost to the NRC is minimal. It is assumed that annually each simulator will be audited to assure that reference plant updates have been adequately represented on the simulator. Such an annual review is estimated to require 2 man weeks / simulator or 124 man-weeks / year for all 62 new simulators assumed.
NRC costs are estimated as follows:
(1) SIR Development There is no cost for SIR development sin:e all work is essentially complete and a solution has been identified.
(2) SIR Implementation (a) Continuing Research: 1 man-yr man-wk 134 plants = 0.33 plant (b) Initial Simulator Reviews: 248 man-wk , 1,9 man-wk 134 plants plant Based on a total NRC manpower of 2.23 man-wk/pient, the NRC manpower cost for implementation is (2.2 man wk) I n
) (134 plants) = $078,300 (c) NRC Contractor Support = $1H Therefore, total NRC Cost for SIR Impismentation is ($678,300 + $1M) or $1.7H.
(3) Review of SIR Operation and Maintenance 2 man-wk
( simulator yr ) (67134 simulators) plants (m$2,270 an-wk ) = $2,100/RY The total NRC cost for review of SIR operation and maintenance for all affected plants is ((90 PWRs)(28.8 yr) + (44 BWRs)(27.4 yrs)]($2,100/RY) = $8H.
Thus, the total NRC cost is $(1.7 + 8)H or $9.7H.
Therefore, total industry and NRC cost for the SIR is $(1,000 + 9.7)H or $1,010H.
Value/ Impact Assessment Based on a public risk reduction of 150,000 man-rem, the value/ impact score is given by:
150,000 man-rem b
$1,010H
= 148.7 man-rem /$H O
06/30/88 1.1.A.4 6 F'UREG-0933
Revision 5 [i I
CONCLUSION !
Based on the estimated risk reduction of 150,000 man-rem and the value/ impact ;
score of approximately 150 man-rem /$M, the safety priority ranking of this issue would be HIGH. In view of the large estimated risk reduction, this safety i
priority ranking is essentially unaffected by any reasonable uncertainties in ,
tha cost estimates.
[
ITEM I. A.4.2(1): RESEARCH ON TRAINING SIMULATORS i t
This item was evaluated in Item I.A.4.2 above and was determined to be high priority. i In April 1987, the issue was RESOLVED with the pubi' cation of Revision 1 to Regulatory Guide 1.149.438 New requirements were established.1045 l
ITEMI.A.4.2(M: UP6 sDE TRAINING SIMULATOR STANDARDS i
This item was and RESOLVED with the issuance of Regulatory Guide 1.14948' in April 1981 and new requirements were established. !
ITEM I. A.4.2(3): REGULATORY GUIDE ON TRAINING SIMULATORS This item was RESOLVED with the issuance of Regulatory Guide 1.149489 in !
April 1981 and new requirements were established.
ITEM I.A.4.2(4): REVIEW SIMULATORS FOR CONFORMANCE TO CRITERIA !
1 l This item was evaluated in Item I.A.4.2 above and was determined to be high l priority. Staff efforts in resolving the issue resulted in the publication of i
a rule and a simulation facility evaluation procedure.
I l When this item was originally identified in 1980, the staff's approach was to i require a submittal from each licensee in compliance with a regulatory guide l (which later was issued as Regulatory Guide 1.1494a9) and to conduct a review of t L
4 each simulator; there was no simulator regulation in effect at that time. How-
- ever, in 1983, Section 306 of the Nuclear Waste Policy Act (P.L.97-425) directed
i the NRC, in part, to establish: ". .. requirements for operating tests at civil- ;
l ian nuclear power plant simulators...." This Congressional mandate had the !
l effect of superseding the original intent of Item I.A.4.2(4) and required !
l the staff to develop regulations for simulators. As a result, the approach I r
taken by the staff for the resolution of Item I.A.4.2(4) was modified to l
! comply with the Congressional mandate. The work scope was changed to reflect l 1 the fact that licensees, under the proposed regulation, would be required to l
certify their plant-referenced simulators to the NRC, and that NRC would perform (
I an audit only when a need was identified, or upon request. Only in the case of
- those few licensees (estimated to be six), which were expected to seek NRC
{
I approval for a simulation facility that did not include a plant-referenced sin-ulator, would the staff be obligated to review simulator documentation.
}
l O The final rule was published on March 25,1987 (52 FR 9453)20" as 10 CFR Part
$5.45 and states, in part: "The operating test will be administered in a plant 06/30/88 1.1.A.4-7 NUREG-0933
Revision 5 walkthrough and in either (i) a simulation facility which the Commission has approved for use after application has been made by the facility licensee, or (ii) a simulation f acility consisting solely of a plant-referenced simulator which has been certified to the Commission by the facility licensee." In support of these regulations, the staff initiated a program to develop a procedure for its evaluation of selected certified simulation facilities. This procedure was subjected to a pilot test prior to being issued in draft form for comment. As a result of comments received, the procedure was revised and was issued in final form as NUREG-12581084 in December 1987. Thus, the item was RESOLVED and new requirements were established.t as ITEM 1.A.4.3: FEASIBILITY STUDY OF PROCUREMENT OF NRC TRAIN!NG SIMULATOR DESCRIPTION The description of this safety issue in NUREG-]66048 is as follows:
"In addition to the increased use of industry simulators for training of NR(. Staf f (notably, the work by OIE with the TVA training center simu-lators), a feasibility study of the lease or procurement of one or more simulators to be located in the NRC headquarters area will be performed.
These simulators would be used in familicrizing the NRC staff with reactor operations, in assessing the effectiveness of operating and emergency procedures and in gatnering data on operator performance. The study will include development of specifications, development of procurement and com-missioning schedules, estimation of costs, and comparison with other methods of providing such trcining for NRC personnel."
Technical studies 262 263 264 that have been performed by BNL on this issue have indicated that existing simulators have significant modelling limitations. It was established that the capability of existing simuiators was not acceptable at any but near normal operating conditions, and that the lack of technical capability during two phase conditions was significant. These results have an adverse ef fect on the feasibility of a training simulator for the NRC staf f.
The intent of this issue is to improve the NRC staff's familiarization with reactor operations. The study is in effort to establish the feasibility of procuring an NRC training simulatot. The resolution of this issue has no direct bearing on any public risk ieduction and, therefore, it is concluded that this issue is a licensing isste.
C_0NCLUSION This Licensing Issue has been resolved.
IlEM !.A.4.4: FEAS!BILITY STUDY OF NRC ENGINEERING COMPUTER DESCRIPTION The purpose " ef this study is to fully evaluate the potential value of and, if i
warranted, propose development of an engineering computer that realistically 0
06/30/88 1.1.A.4-8 NUREG-0933
l Revision 5 modelsPWRandBWRplantbehaviorforsmall-breakLOCAandothernon-LOC,k accidents and transients that may call for operator actions. Final development of the proposed engineering computer will depend on a number of research efforts. Risk assessment tasks (interim reliability evaluation program, or ,
IREP, for example) to define accident sequences covering severe core damage will also provide the guidelines for the experimental and analytical research ,
programs needed to improve the diagnostics and general knowledge of nuclear i power plant systems. The programs will assist the development and testing of l
fast running computer codes used to predict realistic system behavior for these ;
multiple accident studies. These codes will provide the basic models for use !
in the improved engineering computer as well as the capah lity for NRC audit of i NSSS analyses.
I A report on the review of PWR simulators was co>r.pleted and issued by BNL.asa A final report on BWR simulators was also completed by BNL.2ea Work on Plant l Analyzers continued at BNL, INEL, and LASL. The RES staff believed that Plant e i Analyzers (Engineering Computer) would be helpfJI in uncovering potential !
, operational safety problems in LWRs, caused by operator errors, or equipment :
l malfunctions, which will lead to risk reductions through increased operator c awareness, improved procedures, and equipment redundancy.
l 6
l The Plant Analyzer is not a design tool but rather an aid to the NRC staff in j
! performing an audit function in the licensing process. Thus, this issue will 1
- not result in a direct reduction in public risk and, therefore, is considered ,
l a licensing issue. ;
CONCLUSION i
After the second year of research on the Enginetrir.g Computer (Nuclear Plant .
Analyzer), it was concluded that it was not feasible to develop a device that
! would be sufficiently accurate and function with suffi<.ient speed (i.e., faster l than real accident progression time) to give a plant operator information ade- A quate to guide action he or she should u ke during an accident. It was found,
< however, that a Nuclear Plant Analyztr, Shich takes output from an NRC safety l analysis code such as TRAC or RELAP and displays plant accident conditions in
- schematic form on a vf deo screen, will considerably ease the burden of under- )
standing the results of conplex safr.ty analysis calculations. The Plant Ar.alyzer [
j also a, lows the safety analyst to 'nterpose simulated operator actions into an ;
accident calculation underwy. Gased on these findings, the objectivts of the [
- development program were reoriented toward assistance for plant safety analysis (
and away from operator accident assistance, p 1
t r
i A Management Plansas for the Nuclear Plant Analyzer was prepared by the staff
! and included a listing of products expected to 9nter the regulatory arena in f l fiscal years 1985 through 1989. The staff concluded that it was not feasible i i
to develop an Engineering Computer to provide input for operator actions during !
1 plant accidents; it was feasible to develop a device to give NRC an improved [
l capability to audit NSSS analyses and this is being done in accordance with the !
Management Plan. Thus, this Licensing Issue h.* been Rsolved. ;
l -
! REFERENCES i i
NUREG 0660, "NRC Action Plan Developed as a Result of the THI-2 Accident,"
43.
q U.S. Nuclear Regulatory Comission, May 1980, l l
i z 06/30/88 1.1.A,4 9 NUREG 0933
{.
h
! l
Revisten 5
- 64. NUREG/CR-2800, "'luidelines for Nuclear Power 3)an'. Safety Issue Prioriti-zation Information Development " U.S. Nuclear s.Sulatory Commission, February 1983.
262. BNL/NUREG-28955, "PWR Training Simulator and Evaluation of the Thermal-Hydraulic Models for Its iain Steam Supply System," Brookhaven National Labora tory , 1981.
263. BNL/NUREG-29815, "BWR Training Simulator and Evalettion of the Thermal-Hydraulic HSdels for It s Main Steam Supply Systeni," Brookhaven National Labo ra to ry , 1981.
264. BNL/NUREG-30602, "A PWR Training Simulator Compariron with RETRAN for a Reactor Trip from Full Power," Brookhaven National Laboratory,1981.
299. NUREG/CR-1482, "Nuclear Power Plant Simulators: Their Use in Operator Training and Requalification," U.S. Nucidar Regulatory Commission, August 1980.
300. NUREG/CR-2353, "Specification and Verification of Nuclear Power Plant Training Simulator Response Characteristics," U.S. Nuclear Regulatory Commission, 1982.
416. NUREG/CR-1908, "Criteria for Safety-Related Nuclear Power Plant Operator Actions: Initial Pressurized Water Reactor (PWR) Simulator Exercises,"
U.S. Nuclear Regulatory Commissicli, September 1981.
417. NUREG/CR-2598, "Nuclear Power Plant Control Room Task Analysis: Pilot Study for Pressurized Water Reactors," U.S. Nuclear Regulatory Commission, July 1982.
418. NUREG/CR-2534, "Criteria for Safety-Related Nuclear Power Plant Operator Actions: Initial Boiling Water Peactor (BWR) Simulated Exercises," U.S.
Nuclear Regulatory Commission, Ncvember 1982.
419. NUREG/CR-3092, "Criteria for Safety-Related Nuclear Power Plant Operator Actions: Initial Simulator to cield Data Calibration," U.S. Nuclear Regulatory Commission, February 1983.
439. Regulatory Guide 1.149, "Nuclear Power Plant Simulators for Use it.
Operator Training," U.S. Nuclear Regulatory Commission, April 1901, (Revision 1) April 1987.
651. NUREG-0985, Revision 1, "U.S. Nuclear Regulatory Commission Human Factors Program Plan," U.S. Nuclear Regulatory Commission, 0+ptember 1984.
653. NUREG/CR-3123, "Criteria for Safety-Related Nuclear Power Plant Operator ctions: 1982 Pressurized Water Reactor (PWR) Simulator Exercises," U.S.
9uclesr Regulatory Comission, June 1983.
954. Memorandum for V. Stello from E. Beckjord, "Closecut of TM1 Acsion Plan Items," November 13, 1986.
O 06/30/x8 1.I.A.4-10 NUREG-0933 l
i j
i i i Revision 5 i
IO b 968. Memorandum for J. Roe from R. Minogue, "Nuclear Plant Analyzer (NPA) Manage- ,
ment Plan," December 12, 1985.
~
1045.Memoranuum for V. Stello from E. Beckjord, "Resolution of TMI Action Plan Items and Human Factors Issues," May 18, 1987.
1 l 1077. Federal Register Notice 52 FR 9453, "10 CFR Parts 50 and SS, Operators'
- Licenses and Conforming Amendments," March 25, 1987.
I 1084.NUREG-1258, "Evaluation Procedure for Simulation facilities Certified q Under 10 CFR 55 " U.S. Nuclear Regulatory Coemission, De: ember 1987.
l 1098. Memorandum for V. Stello for T. Murley, "Resolution of Generic Issue
- 1.A.4.2(4) ' Review Simulators for Conformance to Criteria,'" May 28, 1988.
n 0'.'30/88 1.I.A.4-11 NUREG-0933
f Revision 4 l l
it t
TASK !.0: CONTROL ROOM DESIGN The objective of this task is to improve the ability of nuclear power plant control room operators to prevent accidents or cope with 4ccidents if they occur by improving the information provided to them. l l
l 1
ITEM I.D.1: CONTROL ROOM DESIGN REVIEWS :
i This item was clarified in NUREG-0737 sa requireme wasestablishedbyDLforimplementatIonpurpuses,ntswereissued,andMPAF-08 j
ITEM I.O.2: PLANT SAFETY PARAMETER DISPLAY CONSOLE
} This item was clarified in NUREG-0737,es requirements were issued, and MPA F-09 !
l was established by DL for implementation purposes.
I [
j ITEM I.O.3: SAFETY SYSTEM STATUS MONITORING t
DESCRIPTION t
i Historical Backaround 1 !
i This TMI Action Plan itep s recommended that a study be undertaken to determine !
the need for all licensees aad applicants not committed to Regulatory Guide '
- 1.47150 to install a bypass and inoperable status indication system or similar !
system.
4 Safety Significance Implementation of a well-engineered bypass and inoperable status indication sys-l ter could provide the operator with timely information on the status of the plant i safety systems. This operator aid could help eliminate operator errors such as i i those resulting from valve misalignment due to maintenance or testing errors.
Possible Solutions A study of current industry (nuclear and others) practices could be undertaken to I evaluate possible methods / systems for verifying correct system alignment. In j
] conjunctionwiththis,astudyoffailuresofsystemsduetopumporvalveun- t availability could be undertaken. Based on the results, a requirement to backfit [
or not backfit Regulatory Guide 1.47150 (or a revision thereof) would be set forth, i i
i PRIORITY DETERMINATION !
{ Assumptions i 1 r l If the system is integrated with the overall control room, then it could be
, expected that it would reduce operator error, which in turn will lower the risk (
! associated with operation of the monitored safety systems. ;
) 06/30/88 1.I.0-1 NUREG-0933 i I i
1 :
Revision 4 For soma utilities this "new" system may result in a modest but significant reduction in operator error during an emergency whereas in others the system may have no discernible effect. An average of about 2% was applied to all pres-ently operating plants. Plants not committedtoRegulatoryGuide1.47.1getlicensedorundergoinglicensingare In an analysis of this issue performed by PNL,64 Oconee 3 was selected as the representative PWR.
It was assumed that the fractional risk and core-melt frequency reductions for a representative BWR (Grand Gulf 1) will be equivalent to those calculated for the representative PWR.
Frequency / Consequence Estimate lhe reduction in core-melt frequency (IF) ,or Oconee was calculated to be 8.7 x 10 7/RY, based on adjustment to the risk equation psrameters affected by issue resolution and then a calculation of a core-melt frequency and comparison to the base core-melt frequency.
l Based on a scaling calculation (see NUREG/CR-280064), the frequency reduction (aF) for Grand Gulf was 3.9 x 10 7/RY. The reduction in public risk was calcu-lated (assuming WASH-140016 release categories, typical midwest-site meteor-ology, and a uniform population density of 340 people per square-mile) to be 5.9 man rem /RY for C onee and 7.1 man rem /RY for Grand Gulf.
The total risk reduction for this issue was calculated to be 1.2 x 104 man-rem, based on 5.9 man-rem /RY for 47 PWRs, 7.1 man-rem /RY for 24 BWRs, and average remaining lives of 28 years and 25 years for PWRs and BWRs, respectively.
Cost Estimate Industry Cost: Installation costs (including labor and equipment) were esti-mated as follows:
Equipment Cost (a) Cable 30 miles @ $6.00/100 Lft $ 9,500 (b) Elec. Penetration Limitations 300,000 (c) Cable tray and additional termination 10,000 (d) Intermediate Logic Panel 100,000 (e) Control Room Alarms / Indications 10,000 Total: T4 W i Other Cost (a) Design labor @ 12 man-months $ 75,000 (b) Installation Labor = 17 man-months 100,000 (c) QA 40,000 Total: '5215,000 Therefore, the total industry implementation cost is $644,500/ plant.
06/30/88 1.1.0-2 NUREG-0933
Revision 4
( Maintenance of the solution by industry is estimated to require 1 man-week / ,
plant. At a cost of $1,000/RY, this amounts to a total industry cost of $1.9M.
Therefore, the total industry cost is $48H.
NRC Cost: NRC labor for development of the resolution is estimated to be 0.5 man year. Review and implementation of the solution is estimated to take 4 man-weeks / plant. 'herefore, the total NRC cost is $0.6M.
Thus, the total cost associated with the solution to this issue is $(48+0.6)M or $48.6M.
Value/ Impact Assessment Based on a public risk reduction of 1.2 x 104 man-rem, the value/ impact score is given by: '
man-rem 3 = 1.2 x 104 548.6M
= 240 man-rem /$M Uncertainty Because the estimate of the value/ impact score relies heavily on the estimated value of the possible reduction in human error, there may be wide variance in the effective improvement.
/
(v\/ Additional Considerations (1) To resolve this issue effectively, it should be done in conjunction with Item I.O.1 which addresses control room design review. This issue was noi explicitly included in the present Commission requirement for Control Roam Design SECY-82-1112(ItemI.O.1)whichistobeimplementedinaccordancewith 1 and a letter 376 issued to licensees of all operating plants.
(2) As another potentially significant consideration, resolution of this issue may provide a reduction in safety system unavailability due to the contri-bution of maintenance and testing.
(3) OHFS is presently contracting with various groups to study this issue.152,tss These studies could better define the assumptions (for risk reduction) used in the calculation. This would then provide better data fot a bene- ,
fit / cost study to determine implementation.
CONCLUSION Based on the estilated public risk reduction and the value/ impact score, this issue was given a ME01UM priority ranking.
l 06/30/88 1.1.0-3 NUREG-0933
Revision 4 ITEM I.D.4: CONTROL ROOM DESIGN STANDARD DESCRIPTION Historical Background This issue was documented in NUREG-06604s and emphasized a need for guidance on the design of control rooms to incorporate human factor considerations.
Safety Significance Control rooms a1d control panels which incorporate human ractor considerations can greatly enhance operator performance. This could contribute to a reduction in operator error and, therefore, a potential reduction in the frequency of core-melt accidents.
Possible Solution An NRC Regulatory Guide endorsing industry standard (s) could be developed with the intention of providir.g: (1) guidance for the design of centrol rooms and, (2) the evaluation criteria for use in the licensing process.
PRIOk!TY DETERMINATION Assumptions PNL did an assessment of this issue.64 From the representative PWR (Oconee) and BWR (Grand Gulf), those arameters in the risk equations requiring direct
.perator actions were considered affected. That is, it was assumed that the probability of operetor error for these parameters were decreased by 3% based on resolution of this safety issue. It was assumed that only plants to be licensed beyond 1986 would be affected.
Frequency / Consequence Estimate The af fected accident sequences and associated uc-case frecuenr% were deter-mined. From these frequencies, the (Affected Release Categories) base case fre-quencie, were determined and a new base case core-melt frequency was calculated.
This was 3.1 x 10 5/RY for the PWRs and 6.1 x 10 6/RY for the BWRs. In addi-tion, a new base case public risk was calculated for the affected parameters.
This was 79.1 man-rem /RY for PWRs and 40.4 man rem /RY for BWRs. To determine a change in public risk due to issue resolution, the affected parameters were ad-justed by 3% and the frequencies of tht associated sequences and release cate- ;
gories were determined, A new overall core-melt frequency was then determined. '
The new core-melt frequency was 3.01 x 10 5/RY for PWRs and 5.95 x 10 6/RY for BWRs. Also a new public risk was then calculated: 76.9 man rem /RY for PWRs and 39.2 man-rem /RY for BWRs.
From the above numbers, the reduction in core-melt frequency (due to issue resolution) was calculated to be 9 x 10 7/RY for PWRs and 1.8 x 10 7/RY for BWRs. The public risk reduction was calculated to be 2.2 man-rem /RY for PWRs and 1.2 man-rem /RY for BWRs. Therefore, the total public risk reduction, based i on 10 PWRs and 5 BWRs and an average remaining life of 30 years, was calculated to be 840 man-rem. ,
06/30/88 1.1.0-4 NUREG-0933
Revision 4 Cost Estimate Industry Cost: It was assumed that for those plants expected to be completed after 1990, the cost to implement the standard will be part of the basic cost.
For those plants expected to be completed between 1987 and 1990, the cost to redesign the control room was estimated to be $100,000/ plant. This is based on the assumption that, in all likelihood, draft standards will be available and will be used and then only minor changes will be needed. Also, it is assumed that the standards will not require significa.it equipment additions, but only reworking of preliminary designs. Since there are about 10 plants to be completed between 1987 and 1990, total industry cost for implementation is
$1M. No additional cost for yearly industry operation and maintenance was assumed.
NRC Cost: The NRC cost estimate was based on an assumed $300,000 expenditure for regulatory guide development. It was assumed that additional NRC labor of about 4 man-weeks / plant would be necessary to review the modifications that would be required for the 10 plants completed between 1987 and 1990. This equals a cost of about $9,000/ plant or $90,000 total. The total NRC cost is then $390,000.
Thus, the total cost associated with the solution to this issue is $(1+0.39)H or $1.39M.
Value/ Impact Assassment O Based on a total public risk reduction of 840 man-rem, the value/ impact score is given by:
84P man-rem b ~_ 7 1.39M
= 600 man-rem /$M Uncertainty The human error reduction is not easily quantifiable. Three percent was used here, but it is subject to large uncertainty.
Other Considerations (1) The issue was assumed to affect only future plants. NRC guidelines in NUREG-0700474 were to be applied to all existing plants and NT0Ls.
(2) IEEE Standards are under development.
CONCLUSION Based on the above value/ impact score, this issue was given a me .um priority ranking. Although no action was taken on Item I.0.4, all commercial nuclear power plants in the United States, whether operational or under construction, are being subjected to a Detailed Control Room Design Review (DCRDR) in response to TMI Item I.D.1, NUREG-0700474 and acceptable substitutes (e.g.,
the Boiling Water Reactor Owners' Group "Control Room Survey Program" and "Checklist Supplement") are being used as control room design standards. In N
06/30/88 1.I.D-5 NUREG-0933
Revision 4 accordance with 10 CFR 50.34(g), all future applications for LWRs shall include an evaluation of the proposed facility agains+ SRP11 Section 18.1 which addresses control room design and references NUREG-0700i?4 as appropriate guidance for control room design.
Thus, staf f actions have negated the need for evaluation of industry control room design standards and for the development of a Regulatory Guide endorsir; those standards. NUREG-0700 and acceptable substitutes are the de facto
- nntrol room design standards for evaluating commercial nuclear power plants in the United States. Design standards for advanced control rooms will be addressed as a research issue under the Human Factors Research Program.
Therefore, this issue was RESOLVED and no new requirements were established.1101 ITEM 1.D.5: IMPROVED CONTROL ROOM INSTRUMENTATION RESEARCH ITEM I.D.5(1): OPERATOR-PROCESS COMMUNICATION DESCRIPTION Historical Background This issue was documented in the TM1 Action Plan 4s and focused on the need to evaluate the operator machine interface in reactor control rooms. The emphasis of this portion of the overall issue was the use of lights, alarms, and annun-ciators.
Safety Significance The method of presentation of information can significantly enhance the performance operator error.
of the control room operators and thereby potentially affect Possible Solution It was proposed that current prr e and use of lights, alarms, and annunciators be reviewed to aaar. .aw well they facilitate operator-machine interaction and minimize errors. RES has studied the area of control room alarms and annunciators (through a contractor) and the results were reported in NUREG/CR-2147.244 Based on this report, RES issued a Research Information Letter 245 (p}t.124) which provided a recommendation for further action.
CONCLUSION This item was RESOLVED and no new requirements were established.
O 06/30/88 1.1.0-6 NUREG-0933
Revision 4 ITEM I.D.5(2): PLANT STATUS AND POSTACCIDENT MONITORING DESCRIPTION Historical Background This issue was documented in the TMI Action Plan 48 and focused en the need to improve the ability of rea: tor operators to prevent, diagnose, and properly ,
respond to accidents. The emphasis was on the information needs (i.e.,
indication of plant status) of the operator.
Safety Significance In order for the operators to perform their functions it is necessary that they receive all the necessary information on the plant status. This can enhance operator pe formance (and therefore reduce operator error).
L Possible Solution i Accident sequences should be analyzed to determine the information required to provide unambiguous indication of plant status. Specific instrumentation and ESF status monitoring needs wovid then be determined. PWR instrumentation requirements wers analyzed in NUREG/CR-1440241 and BWR instrumentation require-ments were analyzed in NUREG/CR-7100.242 ESF Status Monitoring requirements I were also studied in NUREG/CR-2278.243 Research Information Letter (RIL) No.
9824s was issued in August 1980. This RIL transmitted "the results of com-pleted research describing an improved method for analyzing accident sequences."
4 Revition 2 to Regulatory Guide 1.9755 was issued in December 1980. (See also Item II.F.3, "Instrumentation for Monitoring accident conditions.") Present plans include implementation of this guide at all plants.151'878 ,
CONCLUSION This item wa RESOLVED and new requirements were established.
! i ITEM I.D.5(3): ON-LINE REACTOR SURVEILLANCE SYSTEM l DESCRIPTION This item was documented in the TMI Action Plants based on the work being per-formed by ORNL. A continuous on-line automated surveillance system was installed at Sequoyah-1 (PWR) and information has been obtained throughout the first fuel :
i cycle. !
1 a The demonstration at Sequoyah was to continue through the second fuel cycle l
! (mid-1984). A similar demonstration at an operating BWR was planned for l initiation in 1964. The system has the potential to provide diagnostic infor-mation to predict anomalour behavior of operating reactors which could be used l to maintain safe conditions.
Noise surveillance and diagnostic techniques associated with the on-line reactor surveillance system have shown their safety significance and the results of the ;
i 06/30/88 1.I.0-7 NUREG-0933 l l
i
Revision 4 i
research have been and are being used by NRC in regulatory activities as dis-cussed below. Monitoring of neutron noise in BWRs was used to detect and moni-9 I 1
tor the impacting of instrument tubes against fuel boxes. The technique was j used by NRC and its consultants to verify that partial power operation was safe until the next scheduled fuel outages for some 10 BWRs. Pressure noise sur-veillance was used at TMI-2 to monitor and guide degassification of the primary loop. The data obtained from the on-line surveillance demonstrated at '
Sequoyah-1 were used by NRC and its consultants in the assessment of loose thermal shields in Oconee Units 1, 2, and 3. In yet another example, NRR used results of this research in BWR stability determinations associated with regulatory actions pertaining to Dresden. I CONCLUSION Based on the ongoing programs, we conclude that the technical resolution of this issue has been identified.
l ITEM I.D.5(4): PROCESS MONITORING INSTRUMENTATION l
DESCRIPTION I This item was documented in the TMI Action Plan 48 and was to explore the feasibility of using new concepts for measuring certain reactor parameters. A directly related issue, Item II.F.2 in NUREG-0737,98 mandated that industry develop and implement PWR liquid level detection systems. NRC evaluated a number of systems at the LOCA experiment facilities at ORNL and INEL.
l CONCLUSION This item has been RESOLVED and no new requirements were established.
I ITEM I.D.5(5): DISTURBANCE ANALYSIS SYSTEMS DESCRIPTION l
Historical Backaround This issue was documented in the THI Action Plan 48 and its objective was to explore advanced disturbance analysis systems for possible application to l nuclear power plants.
Safety Significance If potential transient events could be anticipated and terminated earlier end if operator response could be enhanced, then the core-melt frequency may be reduced. Advanced disturbance analysis systems could possibly provide the capabilities to achieve this.
Possible Solution The purpose of this item was to assess the need, feasibility, and adequacy of advanced disturbance analysis systems. EPRI is presently doing research in this area.
06/30/88 1.I.0-8 NUREG-0933
- - - - I
r_-_______ _ ___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ - _ _ _
Revision 4 PRIORITY DETERMINATION Assumptions To evaluate this item, we assumed that the advanced disturbance analysis system would include the implementation of a continuous on-line surveillance system, as discussed in Item I.D.5(3). (A liquid level detection system was assumed available because it is already required - Items I.O.5(4) and II.F.2.]
In a PNL assessment of this issue,84 it was decided that a risk reduction could be estimated by assuming a reduction in operator errors. Operator error was assumed to be reduced by 2% due to the implementation of this additional operator aid. Also, a reduction in the number of transients requiring shutdown was assumed based on the potential that the operators will be able to terminate some transients before the need for shutdown. Reduced transient frequencies were calculated based on a recent EPRI analysis.807 The basis for choosing the transients was that either the detection time leading up to the transient or the time from the transient occurrence to shutdown was perceived to be longer than 30 minutes, enabling the advanced diagnostic system to diagnose the prob-lem and provide possible solutions for the operator.
Furthermore, for purposes of this study, it wts assumed that the operator could only respond with actions to 80% of the transients listed that would occur duringtheremaininglifetimesofthesubjectplants. Of the 80%, only 25% of the operator's actions was assumed to prevent the need for shutdown. The average plant shutdown was assumed to last 0.75 day. Therefore, reduction in unscheduled outages is calculated as follows:
PWR: (4.63 transients /RY)(0.80)(0.25)(0.75 day / shutdown) = 0.69 day /RY BWR: (5.20 transients /RY)(0.80)(0.25)(0.75 day / shutdown) = 0.78 day /RY Frequency Estimate The parameters which included direct operator action were adjusted based on the 2% operator error reduction. In addition, the reduced transient frequency cal-culated from above were divided by the total PWR and BWR transient frequencies (i.e., 9.8 events /RY for PWRs and 8.9 events /RY for BWRs) to give a percent transient reduction. Then the parameters for transients (Ta and T3 for PWRs and T 3 for BWRs) were adjusted.
Combining the reduction in operator error and the reduction in transient fre-quencies, the reductions in core-melt frequencies are 4.4 x 10 8 event /RY for PWRs and 2.6 x 10 8 event /RY for BWRs.
Consequence Estimate The associated per plant reduction in public risk was calculated (assuming 340 people per square mile) to be 12 man-rem /RY for PWRs and 18 man-rem /RY for BWRs. Assuming 90 PWRs and 44 BWRs with remaining lives of 28,8 and 27.4 years, respectively, the total public risk reduction was calculated to be 53,000 man-rem.
06/30/88 1.I.D-9 NUREG-0933
Revision 4 Cost Estimate Industry Cost: For the advanced diagnostic system, implementation costs (harcNare and installation), were estimated to be $1.5M/ plant. The on-line surveillance system was estimated to cost $125,000/ plant for hardware and
$375,000/ plant for installation. For 134 plants, the total implementation cost is approximately $270M.
Industry labor for operation and maintenance was estimated to be about 10 man-weeks /RY beyond that currently required for control room instrunentation.
Therefore, this cost would be: l l
(10 man-wk/RY)($2,270/ man-wk)(134 plants)(30 years) = $91M. i Therefore, the total industry cost was estimated to be $360M.
NRC Cost: NRC costs for issue resolution were considered to be relatively minor (52M), based on the assumption that EPRI would continue to do the major portion of the research on this issue. NRC costs for labor to approve and monitor hardware changes to backfit plants were based on an average of 4 man wk/backfit per plant. This cost is given by:
(4 man wk/backfit plant)($2,270/ man-wk)(71 plants) = $650,000, i Therefore, the total NRC cost is $2.65M.
l l Thus, the total cost associated with the resolution of this issue is l $(360 + 2.65)M or $362.65M.
l Value/ Impact Assesnent Based on a total public risk reduction of 53,000 man-rem, the value/ impact score is given by:
g = 53,000 man-rem
$362.65M r 150 man-:em/$M Uncertainty The assumed benefits of resolution and cost for implementation of this safety issue are ee.remely hard to quantify because of the uncertain nature of possible future developments in this area.
Other Con:idy ations (1) If it is a>5umed that replacement power costs $300,000/ day and, as pre-viously calculateo, the issue resolution will reduce down time by 0.69 day /RY for PWRs and 0.78 day /RY for BWRs, the industry cost saving is:
($300,000/ day)[(0.69 day /RY)(90 plants)(30 years) +
(0.78 day /RY) (44 plants)(30 yrs)) = $870M 06/30/S8 1.1.0-10 NUREG-0933
Revision 4 Combining this with the industry costs (implementation and operation) would show an industry saving of about $500M. Including accident avoidance costs would further increase this saving.
(2) EPRI is doing research in this area which is being followed by HRC.
CONCLUSION Based on the judgement that a disturbance analysis system could reduce operator errors by 2% and the number of transients by a factor of 2, the issue was assigned a medium priority ranking.
After a more detailed review of this issue, the staff concluded that, although disturbance analysis systems might decrease plant shutdowns and thereby reduce plant costs, this economic benefit should not be a reason for requiring instal-lations of such systems because the assumed safety benefit is too uncertain.
The staff further concluded that, in order to determine whether or not a spec-ific safety problem exists, more research was necessary to determine the effect l that disturbance analysis systems may have on operator performance.10SS Thus, the issue was reclassified as a Licensing Issue and integrated into the research activity, Human Factors Aspects of Advanced Controls and Instrumentation.1100 ITEM I.D.6: TECHNOLOGY TRANSFER CONFERENCE DESCRIPTION V NRC and IEEE jointly sponsored a technology transfer conference in January,1980.
The conference was entitled "Advanced Electrotechnology Applications to Nuclear Power Plants," and had as its objective to consider the practicality of applying advanced technologies from other industries (e.g. aerospace, defense, aviation) to the nuclear power industry.
During the conference, eight parallel workshops were held including: Systems Management Techniques; Reliability En0ineering; Risk Assessment; Software Reliability Verification and Validation; Smart Instrumentation; Operational Aids-Command Control and Comunications; Education,308 training and Simulators; and Simulation and Analysis. The conference report was issued in June 1980.
This item is related to increasing knowledge and understanding of safety issues and, therefore, is considered a licensing issue.
CONCLUSION This Licensing Issue has been resolved.
REFERENCES
- 48. NUREG-066U, "hRC Action Plan Item Developed as a Result of the THI-2 Accident," U.S. Nuclear Regulatory Commission, May 1980.
- 55. Regulatory Guide 1.97 "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," U.S. Nuclear Regulatory Commission.
\
06/30/88 1.1.0-11 NUREG-0933
Revision 4
- 64. NUREG/CR-2800, "Guidelines for Nuclear Power Plant Safety Issue Prioritiza-tion Information Development," U.S. Nuclear Regulatory Commission, February 1983.
- 98. NUREG-0737, "Clarification of THI Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980.
150. Regulatory Guide 1 ;/, "Bypassed and Inoperable Status Indication for Nuclear Power P %nt Safety Systems," U.S. Nuclear Regulatory Commission, May 1973.
151. SECY-80-111, "Requirements for Emergency Response Capability," March 11, 1982.
152. NUREG/CR-2417 "Identification and Analysis of Human Errors Underlying Pump and Valve Related Events Reported by Nuclear Power Plant Licensees,"
U.S. Nuclear Regulatory Commission, February 1982.
153. "Safety System Status Monitoring: Draft Report on Current Industry Practice," Battclle Pacific Northwest Laboratories, June 1982.
241. NUREG/CR-1440, "Light Water Reactor Status Monitoring During Accident Con-ditions," U.S. Nuclear Regulatory Commission, May 1980, 242. NUREG/CR-2100, "Boiling Water Reactor Status Monitoring During Accident Conditions," U.S. Nuclear Regulatory Commission, May 1981.
243. NUREG/CR-2278, "Light Water Reactor Engineered Safety Features Status Monitoring," U.S. Nuclear Regulatory Commission, October 1981.
244. NUREG/CR-2147, "Nuclear Control Room Annunciators," U.S. Nuclear Regula-tory Commission, October 1981.
245. RIL-124 "Control Room Alarms and Annunciators," U.S. Nuclear Regulatory Commission.
246. RIL-98, "Light Water Reactor Status Monitoring During Accident Conditions," U.S. Nuclear Regulatory Commiss, ion, August 18, 198l 306. IEEE Catalog No. TH0073-7, "Record of the Working Conference on / tanced Electrotechnology Applications to Nuclear Power Pit,ts, January 1. 17, 1980, Washington, D.C." Institute of Electrical and Electronics E.,gineers.
307. EPRI NP-2230, "ATWS: A Reappraisal, Part 3 " Electric Power Research Institute, 1982.
376. NRC Letter to All Licensees of Operating Reactors, Applicants for Operating Licenses, and Holders of Construction Permits, "Supplement 1 to NUREG-0/37, Requirements for Emergency Response Capability (Generic Letter ih. 9/-33)," December 17, 1982.
474. NUREG-0700, "Guidelines for Control Room Design Reviews," U.S. Nuclear Regulatory Commission, September 1981.
06/30/88 I.1.0-12 NUREG-0933
Revision 4 1099. Memorandum for B. Morris from B. Sheron, "Updated GIMCS for GI 1.D.5(5)," February 2, 1988, 1100. Memorandum for V. Stello from E. Beckjord, "Redesignation of Generic issue 1.D.5(5) ' Disturbance Analysis Systems,'" February 22, 19f9.
1101. Memorandum for V. Stello from E. Beckjord, "Closure of Generic Isst.'
l.D.4 ' Control Room Design Standard,'" March 28, 1988.
I l
a l
l 1
l ,
B i-i 06/30/88 1.I.D-13 NUREG-0933
^
]
Revision 2 TASK II.B: CONSIDERATION OF DEGRADE 0 OR MELTED CORES IN SAFETY REVIEW The objective of this task is to enhance public safety and reduce individual and societal risk by developing and implementing a phased program to include, in safety reviews, consideration of core degradation and melting beyond the design basis.
ITEM II.B.1: REACTOR COOLANT SYSTEM VENTS This item was clarified in NUREG-0737,es requirements were issued, and MPA F-10 was established by DL for implementation purposes, ITEM II.B.2: PLANT SHIELDING TO PROVIDE ACCESS TO VITAL AREAS AND PROTECT SAFETY EQUIPMENT FOR POST-ACCIDENT OPERATION This item was clarified in NUREG-0737,es requirements were issued, and MPA F-11 was established by DL for implementation purposes.
ITEM II.B.3: POST-ACCIDENT SAMPLING This item was clarified in NUREG-0737,88 requirements were issued, and MPA F-12 was established by DL for implementation purposes.
ITEM II.B.4: TRAINING FOR MITIGATING CORE DAMAGE This item was clarified in NUREG-0737,es requirements were issued, and MPA F-13 was established by DL for implementation purposes.
ITEM II.B 5: RESEARCH ON PHENOMENA ASSOCIATED WITH CORE DEGRADATION AND FUEL MELTI_NG ITEM II.B.5(1): BEHAVIOR OF SEVERELY DAMAGED FUEL Items !!.B.5(1) and II.B.5(2) have been combined and evaluated together.
DESCRIPTION Historical Background "For a number of key severe accident sequences, there are critical phenomenolog-ical unknowns or uncertainties that impact containment integrity assessments and judgments regarding the desirability of certain mitigating features. The phenomena fall into three broad categories: (1) the behavior of severely dam-aged fuel, including oxidation and hydrogen generation; (2) the behavior of the core melt in its interaction with water, concrete, and core-retention materials; 06/30/88 1.II.B-1 NUREG-0933
Revision 2 and (3) the effect of potential hydrogen burning and/or explosions on con-tainment integrity. Steam explosions will also be considered in this category.
Previous work in these several areas has received less attention, since these areas relate to accidents beyond the design basis (of power plants)... RES (is) conducting major programs to support the basis for rulemaking and to confirm certain licensing decisions. Complementary efforts conducted within NRR will address specific licensing issues . elated to the subject research."4a (1) Behavior of Severely Damaged Fuel (a) In pile studies: Fuel behavior research will include in pile testing to help evaluate the effects of conditions leading to severe fuel damage. Such tests are being performed in the INEL Power Burst Facility (PBF) in FY 1983 and later in the ACRR at Sandia and in the NRU reactor at Chalk River National Lab, Canads.
In the PBF (and NRU, if funding permits) RES will perform a series of in-reactor fuel experiments to determine the effect of heating and cooling rates on damage to the bundle, rod fragmentation, distortion, and debris formation. Fission product release and hydrogen generation will also be measured during the test.
Separt.te effects studies will be conducted on rubble beds in the ACRR at Sandia.
(b) Hydrogen studies: The objective of this work is to increase under-standing of the formation of hydrogen in a reactor from metal-water reactions, radiolytic decomposition of coolant, and corrosion of metals, and to determine its consequences in terms of pressure-time histories and hydrogen deflagration of detonation. This work will also include: (1) the preparation of a compendium of information related to hydrogen as it affects reactor safety, (2) analysis of radiolysis under accident conditions, (3) a review of hydrogen sam-pling and analysis methods, (4) a study of the effects of hydrogen embrittletent on reactor vess11 materials, and (5) a review of means of handling accident generated hydrogen, with recommendations on improving current methods. Results of these studies were considered to support USI A-48, "Hydrogen Control, Measures and Effects of Hydrogen Burns on Safety Equipment," and were not considered further in this issue.
(c) Studies of postaccident coolant chemistry: The RES objective in this area is the development of a relationship between fission product release and fuel failure, and the improvement of postaccident sampling and analysis techniques. This will be accomplished by the investiga-tion o+ fission product release in a variety of fuel failure experiments.
(d) Modeling of severe fuel damage: The effort in this area is the development of fuel models for fuel rods operating beyond 2200'F which suffer a loss in geometry in order to compute extensive damage phenomena (such as eutectic liquid formation, fuel slumping, oxida-tion and hydrogen generation, fission product release and interaction 06/30/88 1.II.B-2 NUREG-0933 0
l 1
Revision 2 with the coolant, rubble-bed particle size, extent of fuel and clad melting, and flow blockage).
(2) Behavior of Core Melt The RES fuel melt research program will develop a base and verified method-ology for assessing the consequences and mitigation of fuel melt accidents.
The program addresses the range of severe reactor accident phenomena from the time when extensive fuel damage and.Aajor core geometry changes have occurred until the containment has failed and/or the molten core materials have attained a semiparmanent configuration and further movement is termi-nated. Studies of improvements in containment design to reduce the risk of core-melt accidents are also included.
The program is composed of integrated tasks that include scoping, phenomeno-logical and separate effects tests, and demonstration experiments that provide results for the development and verification of analytical models and codes. These codes and supporting data are then used for the analysis of thermal, mechanical, and radiological consequences of accidents and for decisions related to requirements of design features for mitigation and performance confirmation.
The technical scope of the program includes work in the following areas:
fuel debris behavior, fuel interactions with structure and soil, radio-logical source term, fuel-coolant interactions, systems analysis codes, and mitigation features.
Safety Significanca The results of the research programs described above will find broad applica-tion in areas such as probabilistic risk analysis, accident analysis, siting, evacuation planning, emergency procedures, code development, etc. Thus, these programs would have considerable value just as licensing improvement efforts.
However, these programs do have a sufficiently well-defined scope to permit some estimates of direct safety significance.
These programs are directed at a better understanding of severely damaged and molten cores. Once a core is in this state, any be in the area of minimizing radioactive releases, and consequent safety significance dose to the has to public.
Possible Solutions As with any research program, if the uitimate result were already known, the research would not be necessary. For r,rioritization purposes, we will assume that means will be devised to reduce the probability of containment failure and release of activity to the environmr.nt. Nevertheless, it should be remembered that completely dif ferent approacNs may suggest themselves af ter the results of the researc5 programs are in.
The "classical" engineering spproaches to handle degraded or melted cores are filtered vents to prevent containment overpressure and core retention devices (core catchers) to prevent containment basemat melt-through. These approaches will be used for cost estimates, but the other priority parameters are not specific to these approaches.
06/30/83 1.!!.B-3 NUREG-0933 C
Revision 2 PRIORITY DETERMINATION These items were originally investigated by PNL.si However, PNL's work con-sidered only containment basemat fnelt-through, The approach presented here has been expanded to include other aspects.
We will consider the effeet on a PWR with a dry containment (based at least partly on the availability of information.) It is not expected that the results for other containments or for BWRs will be greatly different, at least in the context of the uncertainty of such an analysis.
Frequency Estimate Essentially all core-melts are assumed to result in containment failure in WASH-1400 lS To estimate the effect of being able to deal with a severely damaged core, this assumption will be relaxed.
The modes of containment failure for PWRs are usually designated by Greek letters. These definitions are:
o- Containment rupture due to a reactor vessel steam explosion.
s - Containment failure due to inadequate isolation of openings and penetrations, y- Containment failure due to hydrogen burning.
6- Containment failure due to overpressure.
c- Containment vessel melt-through.
If the research programs are successful in the sense of leading to engineering solutions, we might, based purely on judgment, envision reductions in the frequency of the various failure modes as follows:
o - 10% (little can be done about steam explosions) p - 0% (this dees not affect isolation failure) y,6 - 90% (venting containment should be quite effective if we know how to size the vent and what filtration is needed) t - 90% (should be achievable if we Can design a core catcher)
Consequence Estimate The consequences are straightforward in the sense tnat the consequences of each release category have been studied. Ho,.ever, the reduction in consequences is more dif ficult to assess, since the release f ro'n a molten core in a tight con-tainment is still not Zero. Instead, it depends on the containrent design leak rate, the efficiency of filtration of a containment relief vent, etc. To allow for this, we will assume that the prevented releases corresponding to th' u, ),
6, and t failure modes instead release activity corresponding to a PWR-9 release.
The results of this calculation are sum.*arized and snown in Table II.B-1, 06/30/88 1.II.B-4 NUREG-0933
1 Revision 2 d Table II.B-1 6 Release Frequency * % Reduction ** AF R Category (RY).1 in Frequency (RY) 1 (man-rem) AFR PWR-1 5.3 x 10 8 10% 5.3 x 10 8 4.9 x 106 2.6 x 10 2 PWR-2 6.7 x 10 S 90% 6.0 x 10 6 4.8 x 108 2.9 x 101 ,
PWR-3 2.6 x 10 8 81% 2.1 x 10 5 5.4 x 108 1.1 x 101 PWR-4 2.1 x 10 11 -- --
2.7 x 106 -- I PWR-5 4.9 x 10 8 -- --
1.0 x 108 --
PWR-6 6.3 x 10 7 90% 5.7 x 10 7 1.4 x 105 8.0 x 10 2 l l PWR-7 3.4 x 10 5 90% 3.1 x 10 5 2.3 x 108 7.1 x 10 2 PWR-8 8.0 x 10 7 -- --
7.5 x 104 --
PWR-9 4.0 x 10 4 --
-3.9 x 10 5 1.2 x 102 4,7 x 10 3 l TOTAL: 4.0 x 101 "Because the specific containment failure mode is of interest here, the frequencies above are "unsmoothed." This is in contrast to the calculations in WASH-140016 which assume a 10% contribution in frequency from adjacent f release categories.
- Release Category PWR-1 is made up entirely of a f ailures and thus is assigned !
a 10% reduction in frequency. Categories PWR 2, PWR-6, and PWR-7 are made l up of y, 5, and t failures and are thus assigned 90%. Category PWR-3 :
contains both a and 6 failures which results in a net assignment of 81%. ,
i Cost Estimate )
l PNL estimated the cost of a core retention device at $1.4M for a forward fit.64 [
Sandia estimated the cost cf a filtered containment vent to be "on the order [
of a few million dollars."212 We will postulate a cost to the licensee of f
$10H per reactor.
l PNL estimated total NRC costs at $2.3H, assuming implementation at 134 l reactort.64 In reality, implementation might take place at a far smaller num- t
, ber of plants due to considerations of containment type, backfit vs. forward
- However, even if only 10 plants were affected, the NRC cost would be fit, etc.
insignificant compared to licensee costs. Therefore, NRC costs will be ,
neglected. I Value/ Impact Assessment For a new (forward-fit) plant (which is the most likely candidate for imple-
! eentation), the public rist reduction is 1,600 man rem, Therefore, the l value/ impact score is given by t
b _~ 1,600 man-rem / reactor i 510M/ reactor l L
.I
- 160 man-rem /$M [
(
06/30/8S 1.I1.B-5 ' -0933 i
l
Revision 2 CONCLUSION Based on the factors considered above, this issue was given a high priority.
However, after further evaltation by the staff, the is.ue was determined to be clearly within the realm of severe accident research. As a result, the issue was reclassified as a L(censin' Issue to be addressed in the implementation of the Severe Accident policy.110 ITEM !!.B.5(2): BEHAVIJR OF CORE-MELT This item was evaluated in Item !!.B.5(1) above and determined to be high priority. However, after further evaluation by tne staff, the issue was dttermined to be clearly within the realm of severe accident research. AS a result,theissuewasreclassifiedasaLicensingIssuetobeaddressedinthe implementation of tine Severe Accident policy.110
! TEM II.B.5(3): EFFECT OF HYDROGEN BURNING AND EXPLOSIONS ON CONTAINMENT STRUCTURE DESCRIPTION Historical Back,qround TMI Action Plan Item II.B.5 called for research into the phenomena associated with severe core damage and core melting." Item II.B.5(3) deals with the effect of hydrogen burns and/or explosions on containment integrity.
Safety Significance Whereas Items II.B.5(1) and !!.B.5(2) deal with (among other things) the gener-ation of hydrogen via radiolysis, metal-water interaction, interaction of a molten core with concrete, etc. , Item !!.B 5(3) is concerned with the ef fects on the containment of the burning and/or detonation of this hydrogen. If the containment retains its integrity, even a severe accident resulting in a damaged or molten core produces relatively low offsite consequences.
Item II.B 5(3) also includes the effect of steam explosions. Again, the emphasis here is not in preventing the explosion but, inst'ead, is in maintaining contain-rent integrity.
Possible Solution Most of the work on Item II.B.5(3) has been couched in terms of a stronger con-tainnent. Ho.ever, as with any research program, other solutions may surf ace as work progresses.
PRIORITY DETERMINATION Item II.B.5(3) is, to a large extent, similar to U5! A-48, "Hydrogen Control Feasures and Effects of Hydrogen Burns on Safety Equipment." US! A-48 is soce. hat more general in that it includes the effects of a hydrogen burn or detonation on containment penetrations and on safety systems located within the contairment, not just the structural response of the containment. In 06/30/88 1.II.B-6 NUREG-0933 l
l 1
Revision 2 addition, USI A-48 includes measures for control of the hydrogen burn and thus has preventive as well as mitigative aspects.
However, even though USI A-48 will use the results of Item II.B.5(3),
Item II.B.5(3) is not subsumed in USI A 48 because (1) the scope of USI A-48 is still under discussion, and (2) Item II.B.5(3) includes steam explosions as well as hydrogen burns.
Frequency / Consequence Estimate In WASH 1400,18 the PWR sequences refer to steam explosion induced containment failures as "o" failures. Containmer.t failures induced by a hydrogen burn are called "y" failures. Sequences including these two failure modes can be found in Release Categories PWR-1, PWR-2, and PWR-3, We will assume that the efforts of Item II.B.5(3) will result in a 90 percent reduction in the probabilities of the sequences involving these two failure modes. The results are tabulated as follows:
Release a Frequency y Frequency Consequences 0.9FR Category (RY 1) (RY 1) (man-res) (a,an-rem /RY) idR-1 5.3 x 10.s .. 4,9 x los 0.23 PWR-2 -- 7.0 x 10 7 4.8 x 108 3.0 PWR-3 3.4 x 10 7 -- 5.4 x 108 1.7 PWR-7 -3.9 x 10 7 -7.0 x 10 7 2.3 x 108 -0.002 TOTAL: 4.9 The PWR-7 negative contribution comes in because a molten core still gives some release, even if containment failure is prevented. Thus, we assuw that the events which would have been a or y failures instead lead to PWR-7 releases.
Over a 40 year plant lifetime, the et.r reduction above corresponds to about 200 man-rem / reactor. This was ;alculated using the WASH-140015 PWR numbers which were calculated for a plant with a large dry containment. 8WR pressure-suppression containments and PWR ice-condenser containments have a much smaller free volume, and thus are more susceptible to a affd y failure *; Therefore, the number for these plants could well be considerably higher.
Cost Estimate, Without the results of the research, it is difficult te assess costs. A stronger containment could cost $15M based on doubling the 3\ f Jot wall thickness of a (150 ft x 200 ft) structure. (Such structures cost roughly $1,000/ cubic yard of concrete.) NRC costs are likely to be negligible in comparison.
06/30/88 1.II.B-7 NUREG-0933
Revision 2 Value/ Impact Assessment Based on a total estimated risk reduction of 200 man-rem / reactor, the value/
impact score is given by:
$ , 200 man-rem / reactor 515H/ reactor
= 13 man-rem /$H CONCLUSION The public risk estinate for this issue is significant even for dry contain-ments. Because of the difficulty in determining a cost effective solution, the issue was assigned a medium priority. However, after further evaluation by the staff, the issue was determined to be c early within the realm of severe accident research. As a result, the issue is reclassified as a Licensing Issue to be addressed in the implementatio. of the Severe Accident policy.1102 ITEM II.B.6: RISK REDUCTION FOR OPERATING REACTORS AT $1TES WITH HIGH POPULATION DENSITIES DESCRIPTION Historical Bach round 1
This TH! Action Pl.in item 48 involved "... the review of operating reactors in areas of high population density to determine what additional measures and/or design changes can and should be implemented that will further reduce the probability of a severe reactor accident and will reduce the ccnsequences of such an accident by reducing the amount of radioactive releases and/or by delaying any radioactive releases, and thereby provide additional time for evacuation near the sites."
Risk studies were proposed for the Zion and Limerick sites, which were completed in 1981, and Indian Point, which was completed in 1982. Although risk assess-ments of other sites either have been, are, or will be conducted by other NRC programs e.g., National Reliability Evaluation Program (NREP), no further risk studies are presently envisioned as part of this issue. Further efforts directed towards this issue will be reviews of the analysis and the poscible implementation of rite-specific fixes to reduce the risk at these sites.
Currently, special hearings are scheduled to review possible design changes for Indian Point. The Indian Point hearings are scheduled for fiscal year 1902.
However, follow-up work in connection with the accepted fixes is foreseen subsequent to these hearings.
Safety Significance Concern exists over the pctential for above-averagm societal risk due to accidents at reactor sites located near regions of high population densities.
Possible Solutions 06/30/88 1.II.B-8 NUREG-0933
Revision 2 As mentioned above, hearings are c m w W n.neduled on possible fixes at the Indian Point site to reduce the rise. M present, the actual fixes that will result from these hearings are unknown. Nevertheless, it seems reasonable to assume that fixes will be made to reduce the likelihood of the most dominant accident sequences contributing to the frequency of core-melt accidents.
PRIORITY DETERMINATION Assumptions Based on a review of similar RSSMAP and IREP analyses, it is assumed that two sequences contribute to a large portion (50%) of the likelihood of core-melt.
It is further assumed that it will be possible to reduce the frequency of each sequence by a factor of 10.
Frequency / Consequence Estimate Resulting from age of design and other related factors, reactors in this category may have an increased frequency of core-melt over the baseline plant (Oconee) by a factor of 5.5 and an increased exposure increase over the mean population density (340 persons per square mile) and release fractions by a factor of 3 This results in a revised baseline of the following:
Core Melt Frequency = (5.5) (8.2 x 10 5/RY)
= 4.5 x 10 */RY Exposure Increase = (3) (2.5 x 105 man-res)
= (7.5 x 105) man-rem Assuming that we can reduce the dominant sequences (50% of the frequency) by a factor of 10, the revised core melt frequency would become, (0.55) x (4.5 x 10 4)/RY = 2.5 x 10 */RY.
The baseline public risk is (4.5 x 10 4/RY) (7.5 x 108 man-rem) or 3,380 man-rem /RY. The revised public risk becomes (2.5 x 10 */RY) (7.5 x 10 8 man-rem) or 1,880 man rem /RY. The resulting change in public risk is then 1,500 man-res/RY resulting from the reduction in core-melt frequency of 2 x 10 4/RY. Over the 27 years of plant life remaining, this would result in a total risk reduc-j tion of 40,500 man rem / reactor.
Cost Estimate Utility costs are estimated to be $4M/ reactor to implement the changes required to reduce the two dominant sequences. NRC costs are estimated to be $22,000.
Therefore, total implementation costs are $4,02M/ reactor.
Value/ Impact Aspessment Based on a total public risk reduction of 4.05 x 104 man-rem, the value/ impact score is given by:
S = 4.05 x$4.02M/
104 man-rem reactor
/ reactor l
= 10,000 man-rem /$M l
06/30/88 1.II.B 9 NUREG-0933 l
N __ . _-- - -
Revision 2 Other Considerations Another f actor which can be considered in this issue is the accident avoidance cost, estimated to be approximately $11M, a potential cost saving of $7H considering ?.he $4M implementation coste.
CONCLUSION Based on the above value/ impact score, this issue was given a high priority ranking. A staff review of PRAs submitted by the affected licensees was used to identify the strengths and weaknesses of the various plants and to assess the risk associated with their operation. A special adjudicatory proceeding was held from 1982 to 1983 during which time the issues regarding continued operation and risks of the Indian Point plants were heard. Following these hearings, the Commission concluded that neither shutdown of Indian Point Units 2 or 3 nor imposition of additional remedial actions beyond those already imple-mented by the licensees was warranted. sos The staff also reviewed the Zion PRA and concluded that the risk posed by the Zion plants was small. The dominant contributors to severe accidents at the Zion plants wtre examined and the staff recommended that: (1) the integrity of the two motor-operated gate valves in the RHR suction line from the RCS be checked each refueling outage; and (2) the diesel-driven containment spray pump be modified so that it is capable of operating without AC power.aoc Thus, this item was RESOLVED and new requirements were established. OL was to be respon-sible for managing the implementation of the above recommendations.806 ITEM II.B.7: ANALYSIS OF HYDROGEN CONTROL DESCRIPTION The accident at THI-2 nn March 29, 1979 resulted in a metal water reaction which involved hydrogen generation in excess of the amounts specified in 10 CFR 50.44.
As a result, it became apparent to the NRC that additional hydrogen contcol and mitigation measures would have to be considered for all nuclear power plants.
The purpose of this TM! Action Plan item" was to e'stablish the technical basis for the interim hydrogen control measures on small containment structures and to establish the basis for continued operation and licensing of plants, pending long-term resolution of the hydrogen control issue. The long-tern resolution of this issue is being accomplished by rulemaking as part of item II.B.8.
Thus far, a final rule was published on December 2, 1981 requiring inerting of the small MARK I and !! (BWR) containeents. In addition, based on Comission guidance, interim hydrogen control systems are required as a licensing condition for the interfrediate volume ice condenser and MARK !!! containments. A proposed rule was published on December 23, 1981 (Federal Register 46FR62281) which would require these systems for the intermediate volume containnents. Except for pending CP and Manuf acturing Li:ense (ML) applications, no additional hydrogen control requirements or requirements for hydrogen analyses have been imposed at this time for large dry containments. However, the proposed rule would require that dry containments be analyzed to determine their ability to Accomodate the 06/30/85 1.II.8-10 NUREG-0933 I
l 1
Revision 2
) release of large quantities of hydrogen (75% metal-water reaction). Also, J
hydrogen :ontrol requirements have been established as part of the final Near Term CP and ML Rule published on January 15, 1982.
I CONCLUSION i Based on the accomplishments above, the basis for continued operation and I licensing of plants with respect tc. the hydrogen control issue has been estab-i lished. Future work reiated to finalizing the proposed rule dealing with inter-j mediate volume (Ice Condenser and MARK !!!) and large dry containments will I continue as part of Item !!.B.8. 1herefore, priority ranking of this issue I was not warranted, i
ITEM II.B.8: RULEMAKING PROCEEDING ON DEGRADED CORE ACCIDENTS DESCRIPTION Historical Background i In the past, safety reviews concentrated on how to prevent a core from being damaged. Consequently, little attention was given to how a severely damaged core could be dealt with after damage occurred. Other subtasks within Task !!.B
] were concerned with the study of the characteristics of degraded and melted 3
j cores (research programs) plus some immediate actions to be taken at plants in operation. Item !!.B.8 envisioned both a short-term and a long-term rulemaking to establish policy, goals, and requirements to address accidents resulting in i core damage greater than the present design basis.
I item !!.B.8 included an Advance Notice of Proposed Rulemaking and an Interim a
i Rule. The Advance Notice was issued in December 2, 1980 (45FR65474). The
) Interim Rule was issued in two parts: the first was issued in effective form in I October, 1981 (46FR58484) and the second was issued as a proposed rule on j December 23, 1981 (46FR62281).
1 On January 4, 1982, the staff sent a policy paper SECY 82-1,30' to the Commis-
- sion for action. The paper asked the Comission to reconsider the approach to
- long-term rulemaking. The events which prompted.this request were as follows
4
- The Commission had required more protection from severe accidents in some i licensing actions (e.g., Sequoyah) than was envisioned in the Action Plan.
3 i - A rule was developed to specify additional requirements for pending con-struction permit and manufacturing license applications. Again, these
. reqirements are somewhat more extensive than what was envisioned in the i Action Plan.
j
- New probabilistic risk assessments have indicated lower risk than was previously estimated for large dry PWR containments.
) - The safety of current plants has been considerably improved by the modi-fications guided by NUREG-0737.38 j 06/30/88 1.I!.B-11 NUREG-0933 1
Revision 2 The industry has initiated a program to study the costs and benefits of design features for mitigsting severe accidents.
An extensive research program to study damaged and melted core behavior is underway.
A safety goal statement, based on probabilistic risk assessment, has been developed.
The substance of SECY-82-13" was that the uncertainty associated with long-term rulemaking was and is an inhibiting force on the industry. The paper then recommended that, since new applications are to be standardized anyway, licensing could proceed on these standardized designs using the information presently available. Probabilistic risk assessments and the safety goal would be used to assess plant safety and, if the plant needed safety features beyond the present requirements to meet the safety goal, they could be included.
This approach would not need rulemaking specifi ally directed at severe accident mitigation.
3 The Commission directed 10 the staff to make several changes in SECY-82-1,3" The staff then submitted revised papers, SECY-82-1A,311 on July 16, 1982, and SECY-82-18, on Nov nber 24, 1982. These revised papers incorporated the changes directed by the Commission including ACR$ input. The revised papers are still under Commission consideration. The evaluation of this item includes the con-sideration of item II.B.7.
Safety Significance Most of the engineered safety features at nuclear power plants of the current generation are intended to prevent severe core damage. Relatively little attention was given in the past to dealim) with a severely damaged or velted core. Once a core is damaged, tha containment will still prevent the release of large amounts of radioactive material. However, once the core melts, the containment is likely to fail (although the hazard to the public varies widely, cepending on the way in which the containment fails).
The degraded-core accident rulemaking is intended to require means for dealing with a damaged core. This translaten into preventing the release of radio-activity and providing means for recovering from the accident. Specific items to be considered included the following: use of filtered, vented containmeat; hydrogen control measures: core retention devices (' core catchers"); re-esamination of design criteria for decay heat removal, and other systems; post-accident recovery plans; criteria for locating highly radioactive systems; effects or accidents at multi-unit sites; and comprehensive review and evalua-tion of related guides and regulations.
PRIORITY DETERMINATION The safety significance of this issue is essentially the same as that of the research programs described in the analyses of items II.B,5(1) and II.B 5(2) above. Examination of the estimited frequency of core damage and/or melt, coupled with estimates of the potential effe-tiveness of engineering solutions (and their cost) led to a recernendation for high priority for items II.B.5(1) and ll.B.5(2). In the save runner, Item II.B.8 has the potential for a significant (and cost-effectise) reduction in public risk.
06/30/88 1.II.B-12 NUREG-0933
Revision 2 l
\
in addition, it should be noted thht some of the plant modifications contemplated are f ar more expensive to backfit than to forward fit. Unnecessary delay may w.sil redace the cost-effectiveness of thin item. ,
CONCLUSION Based in the above evaluation, this item wits given it high priority ranking.
Work ' formed by RES on the hydrogen control aspect of the item resulted in a l Hydrogen Control Rule that was approved by the Commission and published in the f Federal Register on January 25, 1985.* " ihe severe accident portion of the i item was addressed in April 1983 by a Policy Statemeat that set forth the Com- -
J mission's intentions fnr rulemakings and o*.her regulatory actions for resolving '
safety issues related to reactor accidents more sevitre than design basis acci-1 dents (48 FR 16014). Certain severe accidint technical issues identified onder ;
the discussion of long-term rulemaking will be drait with for future and exist- ;
i j ing plants through procedures and ongoing everr- accident programs identified j in the Policy Statement and described more fully in Chapter IV of NUREG-1070.80' !
4 Thus,withtheissuanceoftheruleonh{drugancontrol,thisitemwatRESOLVED t
)
and new requirements were established.ao
. i l
j-REFERENCES f, j 2. NUREG 0371, "Task Action Plans for Generic Activities (Category A)," U.S. I
- Nuclear Regulatory Comissien, November 1978.
1 j 16. WASH 1400 (NUREG-75/014), "Reactor Safety Study, An Assessment of Accident i
)
Risks in U.S. Commercial Nuclear Power Plants " U.S. Nuclear Regulatory d Commission, October 1975. [
- 48. NUREG-0660, "NRC Action Plan Developed es a Result of trie THI 2 Accident," [
q U.S. Nuclear R(gulatory Comission, Miy 1980. l
! 64. NUREt1/CR-2800, "Guidelines for Nucler.c Power Plant Safety Issue Prioritiza- l
{
tion Information Development," U.S. Nuclear Regulatory Commission, ;
- February 1983. !
I l j 98. NUREG 0737, "Clarification of TH! Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980. ,
309. SECY-82-1, "Severe Accident Rulemaking and Related Matters," January 4, i 1982. I i
l 310. Memorandum for W. Dircks f rom S. Chilk "Staf f Requirements - Briefing l
- on Status and Pla,. for Severe Accident Rulemaking (SECY-82-1)," January 29, ;
j 1982. ;
311. SECY 82-1A, "Proposed Comission Pelicy Staterent on Severe Accidents and [
l Related Views on Nuclear Reactor Regulation," July 16, 1982.
i l 312. NUREG/CR-0165, "A Value-Impact Assessment of Alternate Containment Concepts," [
i U.S. Nuclear Regulatory Comission, June 1978. l l
I !
l j 06/30/88 1.II.B-13 NUREG-0933 j
R. vision 2 1
806. Memorandum for W. Circks from H. Denton, "Closecut of THI Action Plan, Task II.B.6, 'Ris deductior, for Operating Reactors at Sites With High Population Densitles,'" September 25, 1985.
807. Memorandum for W. Dircks from R. Minogue, 'Closecut of THI Action Plan Task II.B.8 'Rulemaking Proceeding on Degraded Core Accid 2nts - Hydrogen Control,'" July 19, 1985.
808. Memorandum for W. Oir ek; from H. Denton, "Close Out of TMI Actic n Plan, Task II.B.8," August 12, 1985.
809. NUREG-1070, "NRC Policy on Future Reactor Designs," U.S. Nuclear Regulatory Commission, July 1985.
1102. Memorandum for T. Speis from R. Houston, "Integration of Generic Issue Resolution," November 4, ?^87.
O O
06/30/c1 1.II.B-14 NUREG-0933
.7 -
Revision 1 m 1 TASK II.E.4: CONTAINMENT DESIGN The objective of this task is to improve the reliability and capability of nuclear power plant centainment structures to reduce the radiological con-sea 6 'is and risks to the public from design basis events and degraded-core and ..e-melt accidents.
ITEM II.E.4.1: DEDICATED PENETRATIONS This : tem was clarifled in NUREG-0737,9s requirements were issued, and MPA F-18 was established by DL for implementation purposes.
ITEM II.E.4.2: ISOLATION DEPENDABILITY This item was clarified in NUREG-0737,98 requirements were issued, and MPA F .9 l
.tas established by DL for implementation purposes.
ITEM II.E.4.3: INTEGRITY CHECK DESCRIPTION O
i Historical Background i
This THI Action Planes item proposes a requirement for the performance of a feasibility study to evaluate the need anti possible methods for performing a periodic or continuous test to detect unknown gross openings in the contain-ment struchre. A prime example of the type of operational error this issue is directed at is the incident at the Palisades plant. At Palisades, the reactor was operated for about 1.5 years while the containment isolation valves in a purge system bypass line were unknowir. gly locked in the open position.
Safety Significance Should a LOCA resulting in major fuel damage cecur in a plant which has an undetected breach in the containment building, severt offsite exposure would i be expected.
P ssible Solutions Systems which can continuously monitor containment pressire t,nperature, in- ,
flow or outflow of fluids, and alarh upon abnormal condit.sns could be provided ;
for some containment designs such as inerted BWR MARK I and 11 containments,
, subatmospheric containments, and possibly some PWR dry containments which l
+
operate with a small positive differential containtent pressure with resoect to atmospheric pressure. Most PWR dry containments might require a system which can produce a seall positive pressure in the containment period Sally, perhaps quarterly, and perform a gross containment leak rate test to assure the plant (q is not operated for an extended time period with an undetected breach of j i containment integrity. t 06/30/08 1.II.E.4-1 NUREG-0933 j
[
Revision 1 PRIORITY DETERMINATION Frequency / Consequence Estimate Using known incidents in which breaches in containment integrity were revealed (mostly during the containment integrated leak rate testing required by Appendix J), estimates of the duration of the breached condition, and the average number of plants in operation, an estimate of the expected f reque;)cy of an undetected breach in containment integrity was derived. The Palisades incident and three other incidents (in the past five years) in which holes were detected in the containment liner were considered. The estimated frequency of an undetected becach in containment integrity was determined to be 1.1 x 10 2/RY.
Th: ' ..avo11 ability of containment due to a breach of containment integrity was also estimated to be about 1 x 10 2 years /RY, assuming in two instances the breach remained undetected for about 1.5 years, in another instance the breach was undetected for one year, and the remaining one was detected immediately.
From WASH-1400,16 the dominant risk sequences which are affected by containment isolation (or integrity) failure are those which result in Category 4, 5, and 8 releases for PWRs and Category 4 for BWRs. These are all scenarios in which the containment failure mode is containment isolation failure. Since the WASP-1400W containment isolation failure frequency did not include contribution from unde-tected breach of containnent integrity, the frequencies of the dominant scenarios from these categories ware adjusted to include the additional probability of unde-tected breach of containment integrity. The base case risk was then calculated using the adju>ted frequencies and the dose equivalent factors from Table 0.1 of NUREG/
CR-280084 for the affected scenarius for both PWRs and BWRs.
An estimate was then mace of the potential effects of the above possible solutionc in reducing the expected extent of containment unavailability as a result of undetected briach of containment integrity. Breaching of containment integrity is almost always found during containment integrated leakage rate tests which are perfortred about every 3.5 years. Continuous or quarterly test-ing will assure early detection of operational error resulting in breach of containment integrity. We estimate that systems like those assumed could reduce the expected unavailability of containment due to breach of containment integrity events to 1.6 x 10 3/ demand. For the purpose of this estimate, it was assumed that the frequercy of unknown containment integrity violations is 1.1 x 10 2fpy, as determined above, and that the average duration of such events (including detection and correction time) is 3 days for plants having continuous detection means and 1 1/2 months for plants utilizing periodic detection means. In the a talysis, it was conservatively assumed that all breaches of containment integ-rity are found by periodic testing. Using this new unavailability, the base case risk was adjusted to represent the expected risk at PWRs and BWRs follow-ing implementation of the envisioned "fix."
The difference between the base case risk and the adjusted risk represents the potential risk reduction which might be gained by the resolution of the issut.
The potential risk reduction was found to be 10.1 man-rom /RY for PWRs and 6.1 man-rem /RY for BWRs.
With an expected population of 95 PWRs and 48 BWRs and an expected average remaining life of 28 years per plant (Table C.1, NUPEG/CR-2800),64 the total expected public risk reduction from resolution of this issue is calculated to 06/30/88 1 II.E.4-2 NUREG-0933
m Revision 1 O be 3.5 x 10' man-rem. The average public risk reduction por plant is estimated to be 3.5 x 102 man-rem, Resolution of this issue is not expected to affect the frequency of core-melt events.
Cost Estimate ,
NRC Cost: NRC costs for resolution and implementation of this issue are expected to be about $2.84M. All NRC and consultant nianpower was estimated at the rate of $100,000/ man year. The expected manpower for resolution and t implementation of this issue is defined as follows:
(a) Data collection, analysis, aad definition of the expected frequency of breach of containment - 1 man year (b) Preliminary design of containment integrity test methods, systems, and equipmaat - 3 man years i (c) Cost analysis - 0.5 man year i (d) Development of NRC requirements, review and approval, issuance of order to licensees - 2.5 man years (e) Review of licensee implementation - 0.05 man year /olant ,
(f) Surveillance of test results of all operating plants - 0.5 man year / year.
! Industry Cost: For the purpose of estimated licensee costs for implementation ,
of the assumed resolution of this issue, the population of 143 reactors was divided into two groups. !
One group represents those plants which, be:ause of specific containment design !
features, may find it relatively easy to develop and install a continuous j monitoring system. Plants with BWR MARK I and II inerte<1 containments, sub- :
2 atmospheric containments, and PWR dry containments which normally operate with ;
a small positive containment pressure would be expected to fall into this ,
group. We found that about 56 plants might fit into this group. We expect t that these plants might require a control room alarm, some containment pressure !
4 and/or temperature instrumen+.s to augment existing capacity, a flow measuring i device, and a software routine which may be suitable for operation on the plant ;
i computer. We n uld not exptet this equipment to be safety grade as it would >
4 have no postaccident function. We estimated this equipment, installed, to cost '
i' about $80,000/ plant. Operation, maintenance, and repair costs for the system were estimated at $20,000/ plant year. This results in a total plant cost for i j these 56 plants of $36M. :
j l i The remaining plants (87) were felt to be more suitable for a periodic test >
, system which might pressurize the containment to a small positive pressure and
- check containment integrity by performing a low pressure leak rate test. These plants would be expected to require quite a bit more special pressure and tem- ;
perature initrumentation than needed for a continuous monitoring type system. '
4 In addition, a high volume compressor would be needed. A program suitable for l
- operation on the plant computer would also be required for data redu. tion anu '
analysis. We estimate that such a system, installed, would cost about $250,000.
Maintenance and operaticn of this system is estimated at $40,000/RY. This I results in a total plant cost for these 87 plants of $121M. '
06/30/88 1.II.E.4-3 NUREG-0933
Revision 1 Thus, the total expected industry cost is $157M.
Value/ Impact Assessment Based on a total risk reduction of 3.5 x 104 man-rem, the value/ impact score for this issue is given by, S _ 3.5 x 104 man P m
$(2.84 + 157)W
= 220 man-rem /$M CONCIUsION A value/ impact score of 220 man-rem /$M was indicative of a medium priority.
However, the evaluation uf expected frecuency for undetected breach of contain-ment integrity performed for this effort indicated an unexpectedly high fre-quency (1.1 x 10 2/RY). This exceeded our perception of the safety goal max-imum probability for loss of a layer of "defense-in-depth" (i.e., the contain-ment). For this reason, the staff recommended that the issue be pursued on a high priority basis with the first order of business to be the establishment (as accurately as possible) of the expected frequency of undetected breach of containment integrity and the expected unavailability of containment and their uncertainty bounds.
The staff concluded its review of this issue and the results were presented in NUREG-1273. " 4 The study included a review of relevant LERs, the sensitivity of offsite dose to the containment leakage rate, and ar. assessment of poter.ial methods for continuous monitoring of containment integrity.
All relevant LERs for the period from April 1965 through May 1983 were reviewed to evaluate occurrences of suspected containment isolation failure.
LERs are required to be submitted when the measured leakage exceeds the Tech-nical Specification limits (0.6 of allowable containment leakage). This study indicated that reporteble occurrences were divided about equally for BWRs and PWRs (~2/RY), and that only 16% of the reportable events were for components (mainly valves) located in systems that could provide a direct air path outside of containment (assuming failure of the sec,ond isolation valve). In addition, less than 5% of the events could be charecterized as larg? or very large leaks (more than ten times allowable) within direct air pathways, and only a few csuld be considered as extended undetected breaches in the contain-ment building. The probability of an und(.tected direct open air path in a BWR containment is estimated to be about 0.1 for small leaks to 0.001 for large .
leaks. l'or PWRs, the comparable values are about 0.3 and 0.07.
A study of the potential risk as a function of containment leakage rate was provided in NUREG/CR-4330.971 These anal.,ses indicate that containment leakage provides only a small contribution (1 to 2 man-rem /RY) to the total exposure from postulated design basis accidents. Therefore, increasing the containment leakage up to a factor of 10 results in only a very small increase in total risk. Thus, containment leakage rate was not found to be an important contributor to the total risk on a probabilistic basis.
0(
06/3GJ88 1.II.E.4-4 NUREG-0933
Revision 1 O
Ite.a II.E.4.3 deals with containment leakaga during postulated (i.e., design basis) accidents and does not address the issue of containment integrity and l associated radiation consequences during severe accidents. This last issue is being addressed as part of implementation of the Commission's policy on severe accidents and, more specifically, in the Individual Plant Examination (IPE) and Containment Performance Improvement programs. Thus, this issue was RESOLVE 0 and no new requirements w ee established. M03 ITEM II.E.4.4: PURGING The primary purpose of this item is to reevaluate the acceptability of purging /
venting nuclear power plant containments during the reactor operating modes of startup, power operation, hot standby, and hc: shutdown. The five parts of this item are listed below.
ITEM II.E.4.4(1): ISSUE LETTER TO LICENSEES REQUESTING LIMITED PURGING DESCRIPTION A number of events occurred over a span of several years during and prior to 1978 that were directly related to containment purging during normal plant oper-ation. Some of these events raised questions relating to automatic isolation of the purge penetrations which are used during power operation. Instances occurred at Millstone Unit No. 2 where intermittent containmeit purge opera-3 i tions were conducted with the safety actuation isolation signals to both in-board and out-board containment isolation valves in the purge system inlet and d outlet lines manually overridden and inoperable. Other instanccs occurred at Salem Unit No. I where venting of the containment through the containment ven-tilation system valves to reduce pressure was conducted. In certain instance),
this venting occurred with the containment high particulate radiation monitor isolation signal to the purge and pressure vacuum relief valves overridden.
These events raised concerns relative to potential failures affecting the purge penetration valves which could lead to a degradation in containment integrity and, for PWRs, a degradation in ECCS perfortnance because of insuf-ficient containment back pressure.
In order to reduce the probability of these potential accident scenarios, the NRC was to issue letters to licensees of operating plants requesting limited purging of containment and justification for additional purging.
CONCLUSION NRR issued a letteru2 to all licensees of operating plants on November 28, 1973 (Docket No. 50-348) requiring compliance with specific requests enclosed with tuat letter. This issue was RESOLVED with the issuance of the letter to the licensees.
O OG/30/88 1.II.E.4-5 NUREG-0933
l Revision 1 ITEM II.E.4.4(2): ISSUE LETTER TO LICENSEES REQUESTING INFORMATION ON ISOLATION VALVE DESCRIPTION By letter dated November 28, 1978,142 [see Item II.E.4.4(1)] the NRC requested all licensees of operating reactors to respond to generic concerns about containment purging or venting during normal plant operation. The generic concerns were twofold:
(1) Events occurred where licensees overrode or bypassed the safety actuation isolation signals to the containment isolation valves. These events were determined to be abnormal occurrences and reported to Congress in January 1979.
(2) Licensing reviews required tests or analyses to show that containment purge or vent valves would shut without degrading containment integrity during the dynamic loads of a design basis LOCA.
NRC staff has since made site visits to several facilities, met with some licensees, and held telephone conferences with many other licensees and valve manufacturers.
As a result of these meetings and conferences and in light of the new infor-mation gained, NRC has determined that an interim commitment from all licensees of operating plants is warranted.
CONCLUSION NRR issued a letter 143 to all licensees of operating reactors on October 22, 1979 (Docket No. 50-298) requesting compliance with the specific items of the interim position enclosed with that letter. This issue was RESOLVED with the issuance of the letter to the licensees.
ITEM II.E.4.4(3): ISSUE LETTER TO LICENSEES ON VALVE OPERABILITY DESCRIPTION By letter dated November 28, 1978,142 NRC requested all licensees of operating reactors to respond to generic concerns about containment purging and venting during normal plant operation. As a result of the review of licensee responses to this letter, NRC learned that at least three valve vendors reported that their valves may not close against ascending differential pressure and the resulting dynamic loading of the design basis LOCA. For plants utilizing valves from these manufacturers, it was determined that the containment inte-grity could be sufficiently assured by maintaining the valves in the closed position or by restricting the angular opening of the valves whenever primary containment integrity is required. NRC is to issue guidelines to all affected licensees in order to ensure operabilitj of purge and vent valves.
O 06/30/88 1.II.E.4-6 NUREG-0933
Revision 1 O> CONCLUSION NRR issued a letteric2 to all licensees of operating plants on September 27, 1979 requesting compliance with the specific guidelines enclosed with that letter. All licensees that utilized valves identified by the three manufac-turers as having potential clo wre problems were required to either maintain the valves closed or install ices to limit the opening angle at all times when containment integrity is iequired, until such time that full opening was justified to the NRC. This issue was RESOLVED with the issuance of the letter to the licensees.
ITEM II.E.4.4(4): EVALUATE PURGING AND VENTING DURING NORMAL OPERATION Items II.E.4.4(4) and II.E.4.4(5) have been combined and evaluated together. l DESCRIPTION Historical Background This item requires NRR to generically evaluate the radiological consequences of containment purging of nuclear power plants while in the power operation mcde.
Item II.E.4.4(5) establishes a requirement for NRR to utilize the results of the radiological evolution from Item II.E.4.4(4) and other efforts already com-pleted to reevaluate current NRC requirements established in SRP11 Section 6.2.4 and the associated BTP CSB/6-4. Item II.E.4.4(5) anticipates a need to l
{ require modification of the current requirements on the use of purge systems of nuclear power plants. Therefore, Items II.E.4.4(4) and II.E.4.4(5) have been combined and prioritized together.
S,afety Significance
, Should a LOCA occur during a period in which the containment building is being purged while the plant is operating at power, radiation releases will occur.
, If the purge system containment isolation valves meet the closure requirements of BTP/CSB 6-4, the containment purge system should be closed prior to any LOCA-induced fuel damage and releases to the public would be small. However, if the LOCA resulted in major fuel damage and the containment purge system is not isolated (due to isolation valve or signal failures), releases and, therefore, public exposure would be large.
Possible Solution A possible solution to further reduce the probability of failure to isolate the purge system is to limit the use of the purge system when reactor coolant sys-tem temperatures are greater than 200'F. The imposition of limits on the use of purge systems which have containment isolation valves meeting the staff's operability requirements for active valves (BTP/CSB 6-4) has been considered from time to time but as yet has not been implemented. A few of the older operating plants require either very frequent or even continuous purging to control containment temrerature and/or pressure. If containment purge system use were limited to some small fraction of the time (1% to 10%) that the plant i is in operating modes 1-4, these plants would either have to shut down to purge
. 06/30/88 1.II.E.4-7 NUREG-0933
Revision 1 or modify the plant to add larger containment cooling or pressure control systems. In addition, a few plants which require frequent entry by operators to perform safety-related surveillance and maintenance would find it necessary to add containment air filtration systems to reduce operator exposures in order that plant shutdowns not be incurred to purge the containment prior to an entry, if use of the purge syst:m is drastically limited.
PRIORITY DETERMINATION Assumptions It was assumed that the solution would entail some limit on the use of purge systems. Using existing knowledge of current operating practices, we estimated that, of the 72 currently operating plants, 25 inerted BWRs and 8 PWRs with subatmospheric containments do not purge during plant operation. There are about 20 to 22 newer PWRs with dry containments that purge very little (s1% to 5% or less). This leaves 17 PWRs which we assumed purge continuously. Of these 17 plants, we assumed that 7 (about 10% of all operating plants) need to purge continuously for containment temperature or pressure control (violation of current requirements). We assumed that the remaining 10 plants purge continuously because they have no containment air filtration systems and thus purge frequently or continuously for the purpose of maintaining operating personnel exposure as low as possible. If low percentage use limits are placed on containment purge systems, it was assumed that the group of 7 plants would be required to purchase and install containment pressure and temperature control systems and suffer replacement power costs during plant shutdowns to purge until these systems are installed. The group of 10 plants was assumed to have to purchase and install filtration systems for containment air, but were not assumed to encounter plant shutdown and replacement power costs prior to installation, it was 4 .tead assumed that higher in plant personnel exposures were incurred until the '..odifications were completed.
Frequency Estimate Use of the containment purge system during plant power operation will result in two distinct scenarios by which significant radiation release to the environ-ment would be expected. The two scenarios are: (1) LOCA with core-melt and the containment purge system fails to isolate, and,'(2) successfully mitigated LOCA but the containment purge system fails to isolate. In early 1981, SPEB evaluated 20c three different positions regarding the use of containment purge systems during plant operation and reported on these efforts. This report developed best estimates of the frequency of accident scenarios which might result while the containment purge system is in use. This study showed the expected frequency of the two scenarios above to be 4 x 10 9/RY (Scenario 1) and 7 x 10 8/RY (Scenario 2). These frequencies were for an assumed purge usage of 20% of plant operating time. In this analysis, the above values were adjusted to determine the expected frequency of the scenarios as a function of purge limit (from 0% to 100%).
Consequence Estimate WASH-1400 " PWR release Category 4 represents the offsite consequences o' core-relt events in which the containment is not isolated, in this scenaric, a 4-inch penetration was assumed to be open resulting in atmospheric releases.
06/30/88 1.II.E.4-8 NUREG-0933
Revision 1 Most PWR purge system penetrations are large (24" to 60" in diameter). We assumed a 40" diameter purge line. We ratioed the releases by the square of the ratio of the diameter of the purge line to the diameter of the unisolated line in the WASH-1400 " PWR-4 event. In this case, the raticed consequence would have exceeded the consequence of the PWR-1 event (early overpressure failure of containment with energetic release of the greatest fission product inventory). We, therefore, limited the release for core-melt scenarios in which the containment is not isolated to that for the PWR-1 event. This resulted in a calculated dose of 5.4 x 106 man-rem / event (Table 0.1, NUREG/
CR-2800),64 assuming a core-melt LOCA in which the purge system fails to isolate (Scenario 1), midwest-type meteorology, and a uniform population density of 340 people /sq mile.
The same ratioing technique of the dose resulting from a PWR-8 release was used to determine an expected dose for the mitigated LOCA in which the containment is not isolated (Scenario 2). For this event, the offsite dose was found to be 2.3 x 105 man- rem / event.
The expected frequencies of the two scenarios were multiplied by the dose con-sequence of the appropriate scenario and summed. This resulted in an averted public risk, assuming the base case in which there is no limit on purge system use (.100% limit), of 0.106 man-rem /RY for the case in which there is no use of i
! the pt rge system allowed (0% limit). When applied to the 17 plants for their l
average expected remaining life (25 yrs), this results in a maximum total averted public risk of 46 man-rem for a 0% limit on the use of purge systems l during plant power operation. Averted total public risk varies linearly from l
nothing, when 100% use of purge systeins is allowed, to the maximum (46 r an-rem),
when no purging is allowed The maxinum potential total risk reduction afforded l
I ( by a complete ban on the use of purge systems while the plant is in PWR operat-ing modes 1 through 4 (about 46 man-rem) represents less than 0.02% of the total plant risk as determined by WASH-1400.16 The average public risk averted j
per plant if a 0% purge limit is imposed is 0.32 man-rem / reactor.
Cost Estimate v.0 Cost: We estimated a total of 19..i man years of staff and consultant effort to do the following: study purge system use, operational data, and designs; prepare preliminary design of potential plant modifications; perform cost analysis; develop, review, and approve new requirements and issue orders; review licensee responses to orders, including plant modifications when proposed; and perform yearly surveillance of plant purge system usage. At $100,000/ man yr, these efforts were estimated to amount to about $2M.
Industry Cost: Industry costs were limited to the 17 plants which are expected to purge frequently or continuously. Industry costs were estimated to cover both the cost of containment pressure and temperature control systems or filtra-tion systems as appropriate. The cost of replacement power at $300,000/ day was also estimated for the 7 plants which were assumed to require pressure and temperature control system additions. In the analysis, we assumed that the affected plar,ts could purge for 1 day and then operate for 3 days before con-tainment purging would be required again. We estimated the cost of a pressure /
temperature control system addition to be $2.5M and a filtration system addi-tion to be $1M. Industry costs were limited to the 17 affected plants and were calculated as a function of containment purge limit. Due to the above assump-06/30/88 1.II.E.4-9 NUREG-0933
Revision 1 tion on the amount of purge versus non purge operation attainable, there are no industry costs between 25% and 100% of the purge limit. Different ratios of purge to non purge time would alter the purge limit at which negligible industry cost would be reached.
Value/ Impact Assessment The value/ impact score as a function of containment purge limit increases slightly to about 0.4 man-rem /$M in the purge limit range of zero to 25%. At 25%, a maximum value/ impact score of 17 man-rem /$M was found. The value/ impact score decreases as the purge limit is increased from 25% to 100%.
Other Considerations The value/ impact score as a function of purge limit varies from low category to the drop category. The value/ impact score calc u ted is a direct function of the probability of the failure of the containment purge system isolation valve (large butterfly valve) to close. The best estimate value fur failure to close (which was used in the prior SPEB study) was conservatively chosen to be 3 x 10 3/ demand. WASH-140026 found the mean failure rate of all qualified safety system valves (including butterfly valves) to be 3 x 10 4/ demand. If the failure rate of containment purge system isolation valves were found to be much greater than the value assumed in these studies (i.e., on the order of 10 1/ demand),
the public risk associated with containment purging during power operations would be greatly increased. The public risk due to containment purging during plant operations, instead of being less than 1% of total plant risk, could be large enough to become a dominant risk factor. In that case, action to reduce the public risk from purging of plants during power operation would probably be warranted. The resolution of the issue might take the form of increased relia-bility requirements for active purge system isolation valves, strict limits on the use of purge system during normal plant operation, or a combination of both approaches. This analysis indicates that, if the isolation valve failure rate is high at all plants, the more attractive means to reduce risk would be to improve the valve reliability.
CONCLUSION The value/ impact score has been calculated to be los for Items II.E.4.4(4) and II.E.4.4(5). The key to a better risk / benefit insight to the value of further changes in criteria for the use of containment purge systems centers around the failure rate of the large butterfly valves utilized as containment isolation valves.
At the time prioritization of Items II.E.4.4(4) and II.E.4.4(5) was initiated, work was not yet completed on these items. Since that time, AEB229 and CSB2ao have recommended that the efforts called for by these items have been completed.
All NRC action required by these it. ems has been completed.an2 DSI informed the EDO of the completion of items 11..:.4 4(4) and !!.E.4.4(5) on June 2, 1982.23:
Thus, these issues have been RESOLVED.
ITEM II.E.4.4(5): ISSUE MODIFIED PURGING AND VENTING REQUIREMENT This item was evaluated in Item II.E.4.4(4) above and was determined to have a low value/ impact score. However, all NRC action required by this item has been 06/30/88 1.!!.E.4-10 NUREG-0933
l i
Revision 1 O completed as described in Item II.E.4.4(4) above.
RESOLVED.
Thus, this issue has been l
REFERENCES
- 11. NUREG-0800, "Standard Review Plan," U.S. Nuclear Regulatory Commission.
- 16. WASH-1400 (NUREG-75/014), "Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975.
l
- 98. NUREG-0737, "Clarification of TMI Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980.
]
' 64. NUREG/CR-2800, "Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," U.S. Nuclear Regulatory
< Commission, February 1983, ,
t 142. NRC Letter to Alabama Power Company, "Containment Purging During Normal >
Plant Operation" (Docket No. 50-348), November 28, 1978, i 143. NRC Letter to Nebraska Public Power District, "Containment Purging and Venting During Normal Operation" (Docket No. 50-298), October 22, 1979. -
I 162.NRCLettertoAllLightWaterReactors,"ContainmentPurgingandVenting !
During Normal Operation - Guidelines for Valve Operability, September 27, ,
, 1979.
206. Memorandum for L. Rubenstein from M. Ernst, "Proposed Position Regarding Containment Purge / Vent Systems," April 17, 1981.
229. Memorandum for T. Speis from R. Houston, "Containment Venting and
. Purging-Completion of TMI Action Plan Item II.E.4.4(4)," March 3,1982.
230. Memorandum for R. Mattson from T. Speis, "Containment Purge and Venting-Completion of TMI Action Plan Item II.E.4.4(5)," April 9, 1982. ,
231. Memorandum for W. Dircks from R. Mattson, "Status Report on Containment i Purge Evaluations," June 2, 1982. i
! 382. Memorandum for W. Minners from R. Mattson, "Schedules for Resolving and Completing Generic Issues," January 21, 1983. j
- 971. NUREG/CR-4330, "Review of Light Water Reactor Regulatory Requirements," [
i U.S. Nuclear Regulatory Commission, (Vol.1) April 1986, (Vol. 2) i June 1986.
1103. Memorandum for V. Stello from E. Beckjoro, "Resolution of Generic Safety ,
i Issue II.E.4.3, ' Containment Integrity Check,'" March 22, 1988. I a !
1104.NUREG-1273, "Technical Findings and Regulatory Analysis for GSI f II.E.4.3," U.S. Nuclear Regulatory Commission, April 1988. [
- 06/30/88 1.II.E.4-11 NUREG-0933 h
( !
v ,
I
I l
Revision 1 NY TASK II.F: INSTRUMENTATION AND CONTROLS The objective of this task is to provide instrumentation to monitor plant vari-ables and systems during and following an accident. Indications of plant vari-ables and status of systems important to safety are required by the plant oper-ator (licensee) during accident situations to: (1) provide information needed to permit the operator to take preplanned manual actions to accomplish safe plant ,
shutdown; (2) determine whether the reactor trip, engineered safety features systems, an manually-initiated systems are perfortning their intended functions (i.e., reactivity control, core cooling, maintaining reactor coolant system integrity, and maintaining containment integrity); (3) provide informatiun to the operator that will enable him to determine the potential for a breach of the barriers to radioactivity release (i.e., fuel cladding, reactor coolant pres-sure boundary, and containment) and if a barrier has been breached; (4) furniah data for deciding on the need to take unplanned action if an automatic or manually-initiated safety system is not functioning properly or the plant is not responding properly to the safety systems in operation; (5) allow for early indication of the need to initiate action necessary to protect the public and for an estimate of the magnitude of the impending threat; and (6) improve requirements and guidance for classifying nuclear power plant instrumentation control and electrical equipment important to safety.
ITEM II.F.1: ADDITIONAL ACCIDENT MONITORING INSTRUMENTATION This item was clarified in NUREG-0737,ss requirements were issued, and MPAs F-20, F-21, F-22, F-23, F-24, and F-25 were established by OL for implementation purposes.
ITEM II.F.2: IDENTIFICATION OF AND RECOVERY FROM CONDITIONS LEADING TO INADEQUATE CORE COOLING
' This item was clarified in NUREG-0737,ss requireindnts were issued, and MPA F-26 was established by OL for implementation purposes.
ITEM II.F.3: INSTRUMENTS FOR MONITORING ACCIDENT CONDITIONS DESCRIPTION l l After the TMI-2 event, Task II.F of the TMI Action Plan 4s addressed several [
! concerns regarding the availability and adequacy of instrumentation to monitor l plant variables and systems during and following an accident.
Prior to the TMI-2 event, Regulatory Guide 1.97,55 "Instrumentation for Light- !
Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions Dur-ing and Following an Accident," (August 1977) had been used as guidance during i lico , og reviews. Item II.F.3 called for this regulatory guide to be updated
- to include the TMI-2 concerns. ;
06/30/88 1.II.F-1 NUREG-0933 l \
1 l
1 Revision 1 I
Revision 2 of Regulatory Guide 1.9755 was published in December of 1980 and implementation is being carried out as discussed in SECY-82-111151 and a Ol lettera7c issued to all licensees of operating. reactors.
CONCLUSION This item was RESOLVED and new requirements were established.
ITEM II.F.4: STUDY OF CONTROL AND DROTECTIVE ACTION DESIGN REQUIREMENTj DESCRIPTION Historical Background Af ter the THI-2 event, the Special Inquiry Group made reccinmendations161 for the staff to study three items in the area of control anJ protection systems.
These were: (1) automatic reactor protection actions should be derived, to the degree possible, from independent process variables; (2; automatic actions through coincidence of independent process variables shoeld be limited, to the degree possible, for non-reactor protection functions; (3) control circuit components should be designed and periodically tested at expected degraded power supply conditions to ensur9 that they are capable of performing their intended function.
Safety Significance The report 161 concluded that improvemelts in these areas may help prevent specific occurrences which were noted upon evaluation of the THI-2 event.
Possible Solutiens This TMI Action Plan'18 item addresses the performance of a study that could indicate potential deficiencies and identify possible fixes which could be incorporated as design criteria in the SRP.13 Industry would then be required to meet these criteria.
PRIORITY DETERMINATION We have not attempted to estimatt a value/ impact score for this issue. It would appear that the non-specific nature of these recommendatiens (i.e., use of words like "to the degree possible") would require a large amount of additional study prior to defining any soecific implementation requirements. Therefore, we could not make an estimate. of !ither potential risk reduction or costs. The following considerations were taktn into account.
(1) Our understanding of the first criterion has led us to believe that, to a large degree, it is typically addressed by existing protection systems.
The use of a number of different plant parameters to initiate the protec-tion system is an indication of the application of this criteria. We grant that there may be instances in different plant designs where, for certain events, these criteria have not been adequately addressed; however, we tend to believe that these would be isolated instances. Furthermore, the proposed ATWS rule which included NUREG-046020t requirements will address 06/30/88 1.1I.F-2 NUREG-0933 l
l l
Revision 1 monitoring of i'. dependent process variables. As another consideration, we believe that rrotection system design requirements will undergo another review as standard a result of pre 603-1977.200arationofaRegulatoryGuidetoendorseindustry IEEE (2) The second criterion addresses non protection systems. At present the staff does not have detailed design criteria for these systems (typically referred to as "control systems") in the SRP.11 We believe that if any criteria are to be included, they will be the result of a c0mprehensive program such as the existing program addressing 051 A-47, "Sifety Implications of Control Systems."
(3) One part of the third criterion is addressed in present SRP11 criteria (SRP Section 3.11, "Environmental Qualification of Equipment"). Specifi-cally, safety-related components are designed for performance at varying power supply conditions. Typically, they are initially tested to these conditions as oart of their qualification program. The other part of the third criterio1 is not presently rey' ired. Under conditions with offsite power feeding all plant components, it ould be postulated that redundant components could experience some degrads1 power supply conditions; however, this concern was addressed through variui3 plant fixes as part of their degraded grid analysis. Under condition' with onsite power feeding the components, the independence of the systems would prevent redundant com-ponents from experiencing degraded power.
CONCLUSION N Bast d on the considerations listed above, this issue was placed in the DROP category.
ITEM II.F.5: CLASSIFICATION OF INSTRUMENTATION, CONTROL, AND ELECTRICAL EQUIPMENT DESCRIPTION Historical Background After IMI, the staff recommended 48 that the present method of classifying instrumentation, control, and electrical equipment needed revision to allow graded criteria which would more closely correspond to the equipment's importance to safety.
Safety Significance Such a grading could place emphasis on improvements in the non-class 1E systems which could affect core-melt frequency. It could also allow more design flexibility and result in potentially more cost-effective electrical, instru-mentation, and control system designs.
Possible Solution It was recommended that the NRC, in conjunction with IEEE, develop a standard p which would provide a classification approach based on the level of importance to safety of equipment. The standard would then be endorsed by a Regulatory i
06/30/88 1.II.F-3 NUREG-0933
Revision 1 Guide. Utility conformance to important criteria such as redundancy, relia-bility, etc. for selected systems would be mandated.
PRIORITY DETERMINATION Assumptions A program to classify and upgrade non-1E instrumentation, controls, and electrical systems is assumed to improve balance-of plant system reliability and thus reduce transient frequencies. Based on EPRI transient data,ao7 a l number of transient categories and frequencies of interest were identified. !
In a PNL assessment 64 of this issue, it was assumed that 50% of all these l transients were attributable to iilstrumentation, tsntrol, and electrical system l failures. Then it was assumed that resolution of this issue would result in l l about a 10% reduction in such failures. l 1 l Frequency / Consequence Estimate l
The reduction assumed above translates into about a 6% reduction in transients (other than loss of offsite power) for PWRs and a 4% reduction in transients for BWRs. Therefore, the 6% reduction was divided between the T2 and T3 transients for PWRs in the Oconee risk equations. The 4% reduction was applied I to the T2a transients for BWRs in the Grand Gulf equations. This resulted in I
reductions in core-melt frequency of 2.1 x 10 6/RY for PWRs and 9 x 10 7/RY for l
BWRs. This translates (assuming a population density at 340 people / square-mile) l to a per plant reduction in public risk of 5.6 man-rem /RY for PWRs and 7 man-rem /RY l for DWRs. Assuming 90 PWRs with an average remaining life of 28.8 yrs siid 44 BWRs l with an average remaining life of 27.4 yrs, this results in a total pubile risk I reduction of 23,000 man-rer, i Cost Estimate I
I An estimate of costs for imple enting improved non-1E systems was based on the f installation cost ($1M) of a safety parameter display system (SPDS) at Yankee
- Rowe. The SPDS is considered a non-1E system which includes certain design l features beyond those of a typical non-1E system. It was assumed that classi-fication and upgrading nf all remaining non-1E systems will represent a similar cost of $1M per plant, divided utnly between equipment costs and manpower costs for backfit plants. Forward-fit plants should only require additional equipment costs. Total industry cost woulti then be (based on 47 backfit and 43 forward-fit PWRt and 24 backfit and 20 forward-fit BWRs) about $100M.
Since the IEEE Trial Use Guide, 4EEE-827pa3 has been released, the NRC cost for development is considered minimal (i.e., on the order of 0.5 man year). We believe that the NRC cost for support of the resolution would potentially be significant. Wa assumed 1 man year / plant. This results in NRC support cost of $13.4M.
O 06/30/88 1.II.F-4 NUREG-0933
Revision 1
( ) Value/ Impact Assessment Based on a total risk reduction of 23,000 man-rem, the value/ impact score is given by:
b ~_ 23,000 man-rem 5(13.4 + 10U)TI
= 200 man-rem /$M.
Uncertainties (1) The estimates of the transient frequency reductions are subject to many assumptions which themselves are uncertain.
(2) Cost estimates are extremely hard to make without a clearer fix in mind.
(3) NRC review time would also vary based on the actual fix involved.
Op Considerations (1) A significant industry cost saving (which would outweigh the industry cost) could be calculated based on a saving in plant outage time due to improved non-1E tystem reliability. For example, if it were assumed that a reduction of non-loss of offsite power transients would occur (7 to 6.58/RY), then assuming one day of power generation lost per transient, this reduces the unscheduled outages by 0.42 day /RY. Based on a replace-ment power cost of $3000,000/ day, the cost savings would be (0.42 day /RY)
(O l ($3000,000/ day) = $130,000/RY. For 134 plants with a remaining lifetime ef 30 years, the total cost savings would be (134 plants)(30 years)
($130,000/Ri) = $523M.
(2) IEEE-827, Trial Use Guide, "A Method for Determining Requirements for Instrumentation, Control and Electrical Systems Important to Safety,"2aa has been issued.
(3) RES is in the process of developing a draft regulatory guide for the classification of systems important to safety,which will provide for a Class 2E instrumentation, control, and electrical power system and equipment. This effort is proceeding independently of the IEEE/ANS efforts.
CONCLUSION Based on the favorable value/ impact score, the effort expended up to the time of the analysis, and the potential risk reduction and cost saving, this issue was given a nedium priority ranking. However, after further evaluation, the issue was reclassified as a Licensing Issue. The staff will continue to support the IEEE efforts to develop a standard to define requirements for equipment and systems that are not safety-related, but are sufficiently important to safety to warrant special consideration.1105 1 (D d 06/30/88 1.II.F 5 NUREG-0933 1
L
r-Revision 1 REFERENCES
- 11. NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (1st Edition) November 1975, (2nd Edition) March 1980, (3rd Edition)
July 1981.
- 48. NUREG-0660 "NRC Action Plan Developed as a Result of the THI-2 Accident,
O.S. Nuclear Regulatory Commission, May 1980.
55.
Regulatory Guide 1.97, "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," U.S. Nuclear Regulatory Commission.
- 98. NUREG-0737, "Clarification of TMI Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980.
151. SECY-82-111, "Requirements for Emergency Response Capability," Harch 11, 1982.
161. NUREG/CR-1250, "Three Mile Island: A Report to the Commission and to the Public," U.S. Nuclear Regulatory Commission, January 1980.
200. IEEE 603-1977, "Trial-Use Standard Criteria for Safety Systems for Nuclear Power Generating Stations," Institute of Electrical and Electronics Engineers.
201. NUREG-0460, "Anticipated Transients without SCRAM for Light Water Reactors," U.S. Nuclear Regulatory Commission, April 1978.
233. IEEE P-827, "A Method for Determining Requirements for Instrumentation Control and Electrical Systems and Equipment Important to Safety,"
Institute of Electrical and Electronics Engineers.
307. EPRI NP-2230, "ATWS: A Reappraisal, Part 3," Electric Power Research institute, 1982.
376. NRC Letter to All Licensees of Operating Reactors, Applicants for Operating Licenses, and Holders of Construction Permits, "Supplement 1 to NUREG-0737, Requirements for Emergency Response Capability (Generic Letter No. 82-33),"
December 17, 1982.
1105. Memorandum for T. Speis from G. Arlotto, "Generic !ssues Program,"
January 14, 1988.
O 06/30/88 1 ll.F-6 NUREG 0933
Revision 1 O
ITEM A-44: STATION BLACKOUT DESCRIPTION The complete loss of AC electrical power to the essential and nonessential l switchgear buses in a nuclear power plant is referred to as a "Station i
Blackout." Because many safety systems rnquired for reactor core decay heat removal are dependent on AC power, the ..asequences of a station blackout could be a severe core damage accident. The technical issue involves the likelihood and duration of the loss of all AC power and the potential for severe core damage after a loss of all AC power.
The issue of station blackout arose because of the historical experience regarding the reliability of AC power supplies. There had been numerous reports of emergency diesel generators failing to start and run in operating f plants. In addition, a number of operating plants experienced a total loss of offsite electrical power. In almost every one of these loss of offsite power events, the onsite emergency AC power supplies were available to supply the power needed by vital safety equipment. However, in some instances, one of the redundant emergency power supplies had been available. In a few cases, there was a complete loss of AC power, but during these events AC power was restored in a short time without any serious consequences.
f The results of WASH-140018 showed that, for one of the two plants evaluated, a
( station blackout occident could be an important contributor to the total risk from nuclear power plant accidents. Although this total risk was found to be small, the relative importance of station blackout accidents was established.
inis finding and the concern for diesel generator reliability based on opera-t:ng experience raised station blackout to a USI in the 1979 NRC Annual Report. A detailed action plan for resolving this issue was published in NUREG-0649,1081 Revision 1.
CONCLUSION The final evaluation of station blackout accidents at nuclear power plants was performed by the staff and published in NUREG-1032.89o In resolving this issue, the staff performed a regulatory analysis which was documented in NUREG-1109.tios In June 1988, this USI was resolved with the publication of a new rule (53 FR 23203)210S and Regulatory Guide 1.155.1110 Thus, this issue was RESOLVED and new requirements were established.
REFERENCES
- 16. WASH-1400 (NUREG-75/014), "Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975.
890. NUREG-103C, "Evaluation of Station Blackout Accidents at Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Draf t) May 1985, (Final)
June 1988.
06/30/88 2.A.44-1 NUREG 0993
Revision 1 1061. NUREG-0649, "Task Action Plans for Unresolved Safety Issues Related to Nuclear Power Plants," U.S. Nuclear Regulatory Commission, February 1980, (Revision 1) September 1984.
1108. NUREG-1109, "Regulatory /Backfit Analysis for the Resolution of Unresolved Safety Issue A-44. Station Blackout," U.S. Nuclear .
Regulatory Commission, June 1988. l 1109. Federal Register Notice 53 FR 23203, "10 CFR 50, Station Blackout,"
June 21, 1988.
1110. Regulatory Guide 1.155, "Station Blackout," U.S. Nuclear Regulatory Commission, June 1988.
O
\
O 06/30/88 2.A.44-2 NUREG-0993
Revision 1 t77)
LJ ITEM B-5: DUCTILITY OF TWO-WAY SLABS AND SHELLS AND BUCKLING BEHAVIOR OF STEEL CONTAINMENTS This item has been divided into two parts which have been evaluated separately.
PART I - Ductility of Two-Way Slabs and Shells DESCRIPTION Historical Background This issue was identified in NUREG-04713 and involved concern over the lack of information related to the behavior of two-way reinforced concrete slabs loaded dynamically in biaxial membrane tension (resulting from in-plane loads), flexure, and shear. A task is defined which involves developing a more dependable and realistic procedure for evaluating the design adequacy of Category 1 reinforced concrete slabs subjec' to a postulated LOCA or high-energy line break (HELB).
Safety Significance If structures (concrete slabs) were to fail (floor collapse or wall collapse) due to loading caused by a LOCA or HELB, there would be a possibility that other portions of the reactor coolant system or safety-related systems could be N damaged. Such loads would be caused by very concentrated high energy sources causing direct impact on the structures of concern. The damage could lead to an accident sequence resulting in the release of radioactivity to the environment.
Possible Soluticn A task was defined to determine with sufficient accuracy the influence of biaxial membrane tension in the plane of the slab on the resistance function and the permissible ductility ratio of two-way slabs loaded in flexure and shear. The end product of the task was to be the development of a simplified practical method which could be used for design and analysis of a slab subjected to the above loading.
CONCLUSION SEB has concluded 215 that there is sufficient information pertaining to the design of two-way slabs subjected to dynamic loads and biaxial tension to enable a reasonably accurate analysis. Based on this information, we conclude that a solution has been identified for this part of the overall issue.
O 06/30/88 2.B.5-1 NUREG-0933
1
}
1 Revision 1 PART II - Buckling Behavior of Steel Ccatainments DESCRIPTION Historical Background This issue is identified in NUREG-04713 and involves concern over the lack of a uniform, well-defined approach for design evaluation of steel containments.
The structural design of a steel containment vessel subjected to unsymmetrical dynamic loadings may be governed by the instability of the shell. For this type of loading, the current design verification methods, analytical techniques, and the acceptance criteria may not be as comprehensive as they should be.
Section III of the ASME Code does not provide detailed guidance on the treat-ment of buckling of steel containment vessels for such loading conditions.
Moreover, this Code does not address the asymmetrical nature of the contain-ment shell due to the presence of equipment hatch openings and other penetra-tions. Regulatory Guide 1.5747s recommends a minimum factor of safety of two against buckling for the worst loading condition provided a detailed rigorous analysis, considering inelastic behavior, is performed. On the other hand, the 1977 Summer Addendum of the ASHE Code permits three alternate methods but requires a factor of safety between 2 and 3 against buckling, depending upon the applicable service limits.
Safety Significance If steel containment shells were to fail due to loading which may cause buckling, one of the plant's levels of defense would be lost and could result in release of radioactivity to the environment. The loading would have to be due to a high-energy source. A 1;srge LOCA or HELB near the containrr.ent wall could possibly provide such a load.
Possible Solutions At present, SEB has developed and is using a set of interim criteria for evalu-ating steel containment buckling for plants undergoing operating license review.
A longer term project with RES is also underway.
PRIORITY DETERMINATION Assumptions The events for which containment may be impacted by a high enough energy source would be a large LOCA or a HELB. A small fraction of these would occur close enough to the containment wall to have the potential to rupture the barrier.
If the containment is not adequately designed, a fai wre could occur.
Frequency Estimate The total event frequency is a combination of the above events. The frequency of a large LOCA or HELB can be compared to the frequency of a PWR-9 event or a BWR-5 event.18 Therefore, the frequencies are assumed to be 4 x 10 4/RY for a PWR-9 and 1 x 10 4/RY for a BWR-5.
O 06/30/88 2.B.5-2 NUREG-0933
Revision 1 Given the LOCA or HELB, then the probability of the large LOCA or HELB occur-ring close enough to containment wall and the break causing buckling is 0.1, based on conservative analysis (for priority determination) that assumes there I would be around 10% of all LOCAs with enough energy and close enough to the l wall to cause buckling. Combining event frequency and conditional probabilities, For PWRs, F = (4 x 10 4/RY)(0.1) = 4 x 10 5/RY For BWRs, F = (1 x 10 4/RY)(0.1) = 1 x 10.s/RY.
Consequence Estimate We assume that the containment fails and that the ECCS and other levels of defense in depth would be available. It would be possible that recirculation in a PWR may be affected (i.e., boil off to atmosphere); however, it would be espected that sufficient sump water would be collected for recirculation.
Therefore, we chose the consequences of these events to be comparable to a PWR-8 event and a BWR-4 event which involve significant damage and containment leakage.
Assuming midwest typical meteorology and a uniform population density of 340 people per square mile, PWR-8 Consequence = 75,000 man-rem BWR-4 Consequence m 610,000 man-rem.
Cost Estimate Assume that structural reinforcing would be required for some containments and all steel containments are affected at a cost of $300,000 per plant. There are abott 33 steel containments (existing and proposed). Assuming 2 staff years of NRC effort to develop crtieria and 1 staff-week / plant to review modification and prepare SERs, the NRC manpower cost is $300,000. Assuming $300,000 for technical assistarce, the total NRC cost is $0.6M. Therefore, the total cost is $[(33)(0.3) + 0.6]M = $10.5M.
l Value/ Impact Assessment l
Based on a risk reduction of 810 man-rem for 9 PWRs and a risk reduction of 4,392 man-rem for 24 BWRs, the total risk reduction for this issue is 5,200 man-rem. Therefore, the value/ impact score is given by 3 , 5,200_ man-rem t 610.5M
= 495 man-rem /$M.
Uncertainties (1) The severity of the safety issue, if one exists, is unknown and therefore the cost to industry of fixing the<"problem" is also an unknown because no fix is presently proposed.
06/30/88 2.B.5-3 NUREG 0933
revision 1 (2) Present staff requirements are contained in an interic position "5 which is being used for NT0Ls. I Other Considerations The scope and significance of this issue is not well-defined because the issue deals more with a potential problem than with a problem that is occurring or is even predicted to occur. Since steel containments are designed to :
available standards requirennts, this issue is not as significant a problem .
as if no criteria existed for the design.
CONCLUS10d Because the safety significance of this issue was unclear with the current state of knawledge, it was recommended that the NRC continue to investigate, better define, and possibly resolve this issue. Since this issue is directed towards assersing the design adequacy of safety-related structures (i.e., con-tainment), it was believed to have an inherent importance that justified fur-ther consideration. The results of the investigation could then be used to assess the potcatial safety be m fits and costs that would be obtained if new design requirements for steel containments were implemented. Thus, this issue was determined to be of medium priority with a large uncertainty.
l RES efforts in resolving this issue resulted in a proposed revision to SRP11 Section 3.8.2 that would be applicable to CP and OL applications filed after the effective date of the SRP Section revision. Operating plants were not affected by the proposed SRP revision because there was a general staff con-sensus that existing steel containments had adequate design conservatism i regarding buckling. The proposed SRP revision was a formal promulgation of l the changed staff review practices since the first SRP had been published in 1975 and added guidance for the review of asymmetric containment designs. It i included an interim set of criteria for evaluating steel containment buckling that had been developed several years earlier by the former Structural l Engineering Branch of NRR and had been applied to plants undergoing operating license reviews.
During the review process, the Structural and Geosciences Branch of NRR identified two concerns with the proposed resolutign: (1) although the I prcposed revision to SRP11 Section 3.8.2 reflected NRR practice on the most
! recent licensing reviews, NRR expressed the concern that it contained I technical requirements that were overly conservative; and (2) there was a general consensus that existing plants with steel shell cnntainments had l acceptable margins regarding buckling.1108 However, there was no readily available documentation to show this. ,
in March 1988, the Structural and Geosciences Branch of NRR issued a memorandum that: (1) summarized NRR's concern with the proposed revision to the SRP Section; (2) provided an evaluation that concluded that existing steel containments had adequate margins against buckling; and (3) stated that it was NRR's judgment that the issue of steel containment buckling had very little safety impact and was not worth pursuing further, considering the staff resource constraints. Thus, the issue was RESOLVED and no new requirements ,
were established.11'"
O '
06/30/88 2.B 5 4 NUREG-0933
- _)
i Revision 1 i 1 REFERENCES j
- 3. NUREG-0471, "Generic Task Problem Descriptions (Categories B, C, and D),"
U.S. Nuclear Regulatory Commission, June 1978. !
, 11. NUREG-0800, "Standard Review Plan for the Review of Safety Analysia i Reports for Nuclear Power Plants," U.S. Nuclear Regulatory Comission, (
(1st Edition) November 1975, (2nd Edition) March 1980, (3rd Edition) July l 1981.
r
- 16. WASH-1400 (NUREG-75/014), "Reactor Safety Study, An Assessment of Accident
. Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory >
j Commission, October 1975. l 145. NRC Interim Criteria for Evaluating Steel Containment Buckling, June 21, 1982.
l 215. Memorandum for E. Sullivan from R. Bosnak, "Generic Issues," September 17, i 1 1982.
478. Re ulatory Guide 1.57, "Design Limits and Leading Combinations for Metal I i Pr mary Reactor Containment System Components," U.S. Nuclear Regulatory !
- Commission, June 1973.
! l j 1106.MemorandumforR.BaerfromG.Bagchi,"ProgosedResolutionofGeneric
- Issue B-5, ' Buckling of Steel Containment,' March 1, 1988, i
. 1107. Memorandum for E. Beckjord from G. Arlotto, "Closeout of Generic Issue I i
B-5, Buckling Behavior of Steel Containments," April 28, 1988. !
I i
i F l
- t l
i i f I
(
i :
I i i i
i l f
l 06/30/88 2.B.5-5 NUREG-0933 i :'
1
1 Revision 1 n
ITEM C-14: STORM SURGE MODEL FOR COASTAL SITES DE SC R I PT IO_ _N.
Licensees are required to estimate the design basis water levels for each nuclear plant site. For coastal and estuarine sites, the design basis water level is of ten caused by a storm surge which results froin the wind and pressure fields of an intense storm acting on the water. The primary tool used for estimating storm surge has been the "bathystrophic" model as developed by the U.S. Army Corps of Engineers, Coastal Engineering Research Center (CERC). This model is called SURGE and is based on the bathystrophic approximation, relating sea surface slope to wind stress, bottom stress, and pressure gradient, with a correction for coriolis force on along-shore currents. The model has served its intended purposes well but is now considered obsolete.
Bigger and faster computers are now capable of solving multidimensional dynamic equations which account for many effects not included in the bathystrophic model.
The multidimensional dynamic mathematical models can account for irregular shorelines, while the shape of the shoreline is not considered at all by the bathystrophic model. True long wave dynamics are simulated by multidimensional dynamic tenthematical models but are completely neglected by the bathystrophic models.
This NUREG-04713 task called for the development of a replacement for the O bathystrophic model so that the staff's evaluation of storm surge reflects state-of-the-art techniques. The storm surge model is applied at the CP stage and is possibly reviewed at the OL stage. Therefore, only future plants located at coastal or estuarine sites will be affected by the issue.
CONCLUSION This issue involves development or acquisition of a multidimensional model which will reflect state-of-the-art mathematical techniques. It is believed that a new multidimensional dynamic model would eliminate the need for initial estimates (required by the bathystropic model) and would reduce the total required analysis time. Thus, this item is related to increasing knowledge that would increase confidence in assessing levels of safety and, therefore, is considered to be a Licensing Issue.
The staff believes that the existing bathystrophic model (SURGE) is adequate for calculating design basis water levels at future nuclear plant sites.
This model is very conservati.e and is still used by the CERC. Its use is specified in SRP21 Section 2.4.5-3. Furthermore, as stated in the SRP, the use of other verified modes is not precluded. Thus, this licensing issue does not require any changes to be made by the staff and it is recommended it be dropped from further consideration.
REFERENCF.S
- 3. NUREG-0471, "Generic Task Problem Descriptions (Categories B, C, and D),"
U.S. Nuclear Regulatory Commission, June 1978.
06/30/88 2.C.14-1 NUREG-0933
Revision 1
- 11. HUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (1st Edition) November 1975, (2nd Edition) March 1980, (3rd Edition)
July 1981 l
l l
O l
t O
06/30/88 2.C.14-2 NUREG 0933
)
i
, Revision 1 ISSUE 43: RELIABILITY OF AIR SYSTEMS ;
DESCRIPTION j Historical Background This issue was initiated in response to an immediate action memorandum"'
. issued by AE00 in Septemt.er 1981 regarding desiccant contamination of % tru-ment air lines. NRR responded to the AEOD memorandum by establishing 4 eorking '
. groupes to determir.e the generic implications of air system contamination and to develop recomendations accordingly. Tbc AE00 memorandum was prom ted by an
. incident at Rancho Seco where the slow closure of a containment isolation valve i resulted from the presence of desiccant particles in the valve ope'ator.
- Desiccant contamination of the plant instrument air system (IAS) was also found
- to be one of the contributing causes of the loss of the salt water cooling system at San Onnfre in March 1980; this incident resulted in issue 44, "Fail- I ure of Saltwater Cooling System." Since the only new generic concern to be j found in the evaluation of the San Onofre event is the comon cause failure of !
safety-related components due to contamination of the IAS, Issue 44 was I combined with Issue ,
i 1
- Issue 43, "Contamir - ion of Instrument Air Lines," as defined above, was l 1 evaluated in 1983 and a recomendation was made to drop it from further ;
consideration. Coments received from the ACRS and AE00, af ter the publication ;
j of the priority evaluation in November 1983, indicated that the issue should be !
J broadened to include all causes of air system unavailability, as opposed to the l restrictive limits that were imposed on the issue previously. NRR concurred ;
with the ACRS and AE00 recernendations and agreed to reevaluate the issue af ter
! the completica of an extensive AE00 case study of air systems at LWRs in the U.S. ,
AE00 Case Study C/7012078 was completed in March 1987 and later published in ;
- NUREG-1275.1079 As a result, Issue 43 was reevaluated, broadened as suggested !
above, retitled, and reprioritized. !
Safety Significance i i , ,
- U.S. LWRs rely upon air systems to actuate or control safety-related equipment l
! during normal operation; however, air systems are not safety grade systems at !
l most operating plants. Safety system design criteria require (and plant l accident analyses assume) that safety-related equipment dependent upon air
- systems will either "fail safe" upon loss of air or perform its intended l function with the assistance of backup accumulators. The AEOD case study 1078 d
highlights 29 failures of safety-related systems that resulted from degraded or p' malfunctioning air systems. These failures contradict the requirement that safety-related equipment dependent upon air systems will either "fail safe" upon loss of air or perform their intended function with the assistance of backup accumulators- So.re of the systems that may be significantly deCraded i or failed are decay heat removal, auxiliary feedwater, BWR scram, main steam j isolation, salt water cooling, emergency diesel generator, containment isolation, and the fuel pool seal system. The end result of degradation or l
failure of safety or safety-related systems is an increase in the expected frequency of core-relt events and, therefore, an increase in public risk.
06/30/88 3.43 1 NUREG-0933
Revision 1 Possible Solution This iss e is applicable to all operating and planned LWRs. From the compilation of operating and planned reactors found in Appendix C to NUREG/CR-2600,84 the total population of affected plants (N) is 134. When adjusted for the current date, the average remaining life time (T) for the population is 24.6 years.
For the purpose of this analysis, the safety issue resolution (SIR) is assumed to be the imposition of the following requirements upon the nuclear power i.idus try:
(1) Licensees would be required to evaluate their air system (s) to ensure that the air quality is consistent with the equipment specifications and that it is periodicsily monitored and tested.
(2) Licensees would be required to review and revise anticipated transients and system recovery procedures and related training for loss of air systems as necessary.
(3) Licensees would be raquired to t in the plant staff regarding tre importance of air systems.
(4) Licensees w ild be required to verify the adequacy of safety grade backup air umulators for safety-related equipment and institute periodic 3; sillance programs.
(5) Licensees m. be required to perform gradual loss of instrument air system pressut. tests.
PRIORITY DETERMINATION Assessment of this ncue is based partly o1 work performed by PNL and will be reported in a Supplement to NUREG/CR-2800.84 Frequency Estimate This analysis uses the Oconee 3 PRAsse because it is the only readily-useable PRA that includes an assessment of the effects of air systs.n malfunctions on safety systems in the event trees for accident evaluations.
Although the air system modeling in the Oconee PRA is not very sophisticated, it offers the best treatment of air systems currently available. As a remit, the analysis used for assessment of this issue uses the Oconee PRI as repre-sentative of all LWRs rather than the usual approach of using two representa-tive PRAs: one for PWRs and one for BWRs. It is assumed that the reduction in affected public risk end core-melt frequency can be estimated as reductions in air systems contribution to the total Oconee 3 risk. The dominant sequence type involves the following scenario: A loss of instrument air (T6) occurs as an initiating event, as a result of a loss of offsite power, or as a result of system faults after a reactor trip. Main feedwater is not available because of the loss of instrument air, and the special operation of the emergency feed-water system after a loss of instrument air also fails (only the steam-driven pump is available and it requires special actions). Feedwater is not '
recovere- 'nd HPl cooling fails to be initiated.
06/30/88 3.43-2 NUREG-0933
i
~
Revision i The dominant cut sets involving air systems malfunctions, along with their frequencies, are shown below:
Event Frequency Cut Set ,, / Probability Frequency /RY T6 0.17/yr 1.4 x 10.a )
- REIA2/6 0.055 i
- EFTOST6H 0.15
- REEF 122/6 0.1 l
- UTHPIH 0.01 ,
l, i T6 0.17/yr 5.2 x 10 7 I
- REIA2/6 0.055 i
- EFM17 0.056 i I
- REEF 122/6 0.1 !
- UTHPIH 0.01 I J !
T6 0.17/yr 6.8 < 10 7 !
- EFUSTF 0.0004 i
)
- UTHPIH 0.01 l' l
i Total: 2.6 x 10 8 ;
l The events in these cut sets are defined as follows: r l
1 Event Description l
k ,
. T6 Loss of instrument air i i
i REIA2/6 Failure of operator to recover instrument air in 2 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> !
] after the initiating event, i
EFTOST6H Operator's failure to provide sucticn to the steam-driven !
! emergency feedwater pump after the opper surge tank is depleted, j given loss of instrument air; the operator is required to j perform remote manual actions, including a position change on a
- locked valve.
, REEF 122/6 Failure to obtain feedwater from the SSF (Safe Shutdown Facility) j efter the failure of emergency feedwater 2 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after the j initiating event, i UTHP!H Operator's failure to initiate HPI cooling.
1 i EFM17 Failure of the steam-driven emergency feedwater pump thrtis ,h I
] local hardware faults and human errors. (
) i EFUSTF Frilure of the emergency feedwater pump because of insuf ficient
- inventory in the upper surge tank at the start of the r xuence.
1 j To support the NRC's review of the Oconee 3 PRA, BNL performed a denb 1 i i
review of the Oconee 3 PRA core damage sequence analyses.toso BNL' . n lew !
found that the values chosen in the Oconee PRA were non-conservative ith regard l to the IAS. Based on interviews with plant personnel and operating experience l l
1 06/30/88 3.43-3 NUREG-0933 l ,
Revision 1 reviews, the BNL study concluded that the loss of instrument air was the dominant contributor to core damage frequency. Specifically, BNL found that examination of the pertinent data indicated an initiating frequency (T6 - loss of instrument air) cf 0.21/RY. However, BNL's evaluation of the IAS pressure decay characteristics and its effect upon the upper surge tank drain valve, which fails open on loss of instrument air, indicate that instrument air must be recovered quickly (significantly less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) and thus a recovery probability (REIA 2/6) of 0.5 should be used.
Repeating the affected cut set calculations using the above values, a base case affected core-melt frequency of 2.2 x 10 5/RY is determined. It should be noted that this high estimate of core-melt frequency is determined because of the effects of one valve which, moving to its "fail safe" open position upon loss of instrument air, drains the upper surge tank thus depriving the plant of its source of emergency feedwater. In this specific instance, the failure made of the vMve was ultimately revised to f ail closed to reduce the core-melt frequency which could be attributed to loss of instrument (control) air. If one conservatively assumes that all plants have at least one safety or safety-related function which has an unknown high degree of sensitivity to the loss of control or instrument air, the use of the Oconee 3 PRA, as adjusted by the BNL recommendations, is considered to be an acceptable model for all plants. We j have, therefore, assumed a base case core-melt frequency of 2.2 x 10 5/RY for loss of thi air systems at LWRs.
For the purpose of evaluating the potential public risk reduction which might be achieved by the proposed SIR for this issue, we have assumed that imple-menting the SIR would result in a reduction of the frequency of the T6 events (loss of air systems). In order to evaluate the adjusted case core-melt fre-quency, it is assumed that the T6 initiating event frequency will be reduced approximately 30% as a result of SIR implementation. This assumption is based on an evaluation of the potential effects of the proposed resolution on each of several factors that contribute to *be overall frequency of loss of instrument air, T6. It is believed that this assumption is conservative (some plants may realize greater inprovements). One conservatism of this estimate is that no credit was given for potential improvements in operator recovery actions which could, in fact, reduce the consequences of air systems-related problems. An upper bound that assumes a 90% improvement in instrument air reliability is evaluated to show the potential effects on plants,which may have greater improvement in air systems performance. '
When the base case cut-set frequences are reevaluated using a 30% and 904.
reduction in the frequency of the T6 event ( e. T6 = 0.12 and 0.02/RY respecsively), the new core-melt frequencies are found to be 1.6 x 10 5 and 2.3 x 10 6/RY. Subtracting post-SIR core-melt frequencies above from the base case affected core-melt frequency (2.2 x 10 5/RY) results in an expected reduction core-melt frequency (afem) of 6 x 10 6/RY anc 2 x 10 5/RY for the best estimate and upper bound cases, respectively. >
Consequence Estimate An average dose from all core-melt sequences for an LkR (R ) was estimated by PNL in the development of other issues to be 3.3 x 106 man9 rem / event. The 06/30/88 3.43-4 NURtG-0933 0
potential averted public risk (aW) is given by:
AW = (N.T)(ofem)(R,) l For this issue, the best estirrate and upper bound values of averted public risk ,
are determined to be: i Best Estimate AW = (134)(24.6)(6 x 10 8)(3.3 x 108) man-rem
. aW = 65,300 man-rem Upper Bound t
AW = (134) (24.6) (2 x 10 5) (3.3 x 108) man-rem AW = 218,000 man-rem i
Cost Estimate ,
Industry Cost: Of the total pcpulation of 13A plants, 104 are currently operating with the remaining 30 in the construction phase. If the resolution i actions assumed above are implemented, the following resource estimates are l assumed for the 104 operating plants: :
(a) Labor: 2.4 man-weeks / plant to evaluate air system (s) ;
4.3 man-weeks /plar.t to review recovery procedures 1 0.6 man weeks / plant on average to revise recovery procedures :
2.8 man-weeks / plant for additional staff training I 3.3 man-weeks / plant to verify adequacy of back-up f accumulators t 7.9 man-weeks / plant for planning and executing tests I 21.3 man-weeks / plant for SIR Implementation ,
(b) Equipment: Additional testing equipment, moisture indicators, ,
contamination sensors. !
For the 30 planned plants, no .sdditional laoor, down-time, or equipment is (
anticipated because it is assumed that air systergs will be adequately evaluated '
at the pre-operational testing phase. t At the standard labor ccst rate ($2270/ man-week) and conservatively assuming an !
equipaent cost of $5,000/ plant, the total industry cost to implement the SIR is estimated to be $5.5M t f
It is assumed that all 134 affected plants will institute increased maintenance i and surveillance orograms. This labor intensive activity is estimated to require an additional 8 man-hr/ month / plant for periodic monitoring and testing. ;
At the standard labor rate, the increased labor costs are estimated to be $18M '
for the industry over the expected remaining plant lifetimes. At a 5% i discount rate, the present value of the industry recurring maintenance and !
surveillance cost is $9.4M. ,
i The total industry cost for implementation, maintenance, and surveillance is
$(5.5 + 9.4)M = $14.9M.
06/30/88 3.43-5 NUREG-0933 !
i I
a
Revision 1 NRC Cost; Analysis and development costs for the SIR are estimated to be
$275,000. This includes the cost associated with the issuince o' an order imposing the SIR on the industry. The staff labor expenditure assumed for review, inspection, and approval of industry implementation of the SI'i is as follows:
Review and approval of licensee evaluations = 2 marcmonths Onsite Inspections = 1 man-month Total: 3 man-months / plant or 0.25 man yr/ plant This is assumed to apply only to the 104 operating plants since these activities will presumably be incorporated initially into the norma' review and inspection accorded new plants prior to oper3 tion. At the standard labor rate, the NRC cost for the review, inspection, and approval of licensea implementation of the SIR is estimated to be $2.6M. The total NRC cost fcr SIR developmant and implementation is thus estimated to ue $(0.275 + 2.6)H = S2.9M.
Staff oversight of industry maintenance and surveillance programs for air systems is estimated to require 0.5 man-week /RY. At the standard labor rate, the total NRC cost for SIR surveillance is estimated to be $3.7M. At a 5%
discount rate, the present worth of the NRC recurring SIR surveillance c"ts is $1.9M. The total NRC cost for SIR implementation and surveillance is
$(2.9 + 1.9)M = $4.8M.
The total NRC and industry casts are thus estimated to be $(14.9 + 4,8)M =
$19.7M.
Value/ Impact M essment Based on the *,otal best estimate risk reduction of 65,300 man rem and the total industry and NRC rrst of $19.7M, the value/ impact score is givea by:
g, 65,30), man-rem
$19.7M
- 3,314 man-rem /$M Other Cons:dorations It was assumed in the analysis of this issue that 75% of the licensee's labor used to perform annual air quality tests and to take appropriate actions c ere s eguired woulu be performed in a low level radiation environment which was assumed to be 2.5 millirem /hr. As a result, an ORE of about 600 man-rem was calculated for the implementation of the assumed solution for this issue.
06/30/88 3.43-6 NUREG-0933 O
Revision 1 t
- CONCLOSION The value/ impact score for this issue is indicative of a high priority ranking.
In addition, the expected ORE is small in comparison to the expected public risk reduction. We, therefore, recommend that this issue be assigned a HIGH priority for resolution.
It is recognized that this conclusion is driven by the analysis of risk due to instrument air failure at a single plant. This analysis re.eals a high degree of sensitivity to instrument air failures due primarily to a poor selection of "fail safe" position due to loss of operating air for one particular valve, (which has subsequently been changed). Accordingly, the analysis used as a surrogate for all plants is very plant-specific in nature. However, recent air system LERs have revealed numerous additional instances in which a high degree of risk sensitivity is apparent.3078 We, therefore, have used the Oconee 3 PRA, as modified by BNL, in order to ascertain a risk estimate for the industry, recognizing that it would not be appropriate for all plants and is no longer appropriate for Oconee 3. We recommend that the limitations of the analysis provided herein be recognized in the resolution of this issue.
REFERENCES
- 64. NUREG/CR-2800, "Guidelines foa Nuclear Power 91 ant Safety issue Prioritization Information Development, "U.S. Nuclear Regulatery Commission, February 1983, (Supplement 1) May 1983, (Supplement 2)
December 1983, (Supplement 3) September 1985.
\ 407. Memorandum for H. Denton and V. Stello from C. Michelson, "Imr ediate Action Memo: Common Cause Failure Potential at Rancho Seco - Dosiccant Contamination of Air Lines," September 15, 1981.
498. Memorandum for C. Michelson f rom H. Dentori, "AEOD Immediate Action Memo on Contamination of Instrument Air Lines at Rancho Seco,"
October 26, 1981.
889. NSAC-60, "A Probabilistic Risk Assessment of Oconee Unit 3," Electric Power Research Institute, June 1984.
1078. AE00/C701, "Air Systems Problems at U.S. Light Water Rtactors,
Of fice for Analysis and Evaluation of Operational Data U.S.
Nuclear Regulatory Commission, March 1987, 1079. NUREG-1275, "0rerating Experience Feedback Report - Air Systems Problems," U.S. Nuclear Regulatory Commission, July 1987.
1080. NUREG/CR-4374, "A Review of the Oconee 3 Probabilistic Risk Assessment," U.S. Nuclear Regulatory Cornission, (Vol. 1) March 1986, (Voi, 2) March 1986, (Vol. 3) June 1986.
a
\
06/30/88 3.43-7 NUREG-09'1
i Revision 1 i
ISSUE 57: EFFECIS OF FIRE PROTECTION SYSTEM ACTUATION ON SAFETY-RELATED EQUIPMENT i
DESCRIPTION
~
Historical Background i This issue is concerned with fire protection system (FPS) actuations which have resulted in adverse interactions with safety-related equipment at operating nuclear power plants. The issue was identified at the NRC Operating Reactor ,
Events meeting on January 7, 1982.2o27 Events showed that safety-related equip- ;
ment subjected to FPS water spray could be rendered inoperable. The events t also indicated numerous spurious actuations of the FPS initiated by operator ,
testing errors or by maintenance activities (e.g., welding), steam, or high humidity in the vicinity of FPS detectors. At the Reactor Events meeting, IE !
was assigned the responsibility to review recent FPS actuations and consider
- development of a? Information Notice; in addition, NRR/DE was to review the ;
events and consider the need for modifications to FPS requirements or licensing ;
review procedures.
, An AE00 memorandumtors issued on January 28, 1982 provided examples of FPS f
actuation lateractions in addition to those identified at the Reactor Events
[' meeting and suggested that all types of FPS cuppression systems, e.g., water, i i
( halon, carbon dioxide, and other chemicals be considered in the IE and NRR j reviews. An NRR response to the AE00 concerns was provided in August 1982.510 i 1
In November 1982. NRR/DE presented a review of FPS regulations and guidelines '
i regarding interactions between FPS features and plant safety systems as well as a review of operating experience involving such interactions. It was concluded i l that, if existing guidelines are properly implemented, such interactions should i be minimized. However, LERs indicated that the guidelines had not been prop-erly implemented at some plants. !
i l
l On Jurca 22, 1983, IE Information Notice 83-41102s was issued to alert licensees and provided examples of recent experiences in which actuation of fire suppress-ion systems caused damage or inoperability of systems important to safety. The L r IE Notice indicated that the plant Fire Hazards Analysis required by Appendix R i I to 10 CFR 50 and by the related NPR BTP11 requires, not only consideration of the i consequences of a postulated fire, but also consideration of the effects of fire- ,
fighting activities. The IE Notice stated that a properly conducted Fire Hazards Analysis in conjunction with a physical walk-down of plant areas would have l r
identified instances where minor sodifications such as shielding equipment and
- i sealing conduit ends would have reduced equipment water damage from inadvertent .
FPS operation. The IE Notice indicated that none of the reported events
[
resulted in a serious impact on the functional capability of a plant to protect !'
l public health and safety. However, examples were given where it would not be difficult to extrapolate actual occurrences into a sequence of events that i l could lead to more serious consequences. I l
\
l e
06/30/88 3.57-1 NUREG-0933 i
h
Revision 1 Safety Significance FPS actuations which result in adverse interaction with plant safety systems reduce the availability of such safety systems needed to achieve safe plant shutdown or to mitigste a postulated accident.
Possible Solution A ponible solution is to follow up IE Information Notice 83-411025 with an IE Bulletin which would require licensees to reevaluate their implementation of the FPS system guidelines regarding adverse interactions with safety systems to assure that safety-related equipment, not damaged by fire itself, can perform its intended function during and following an FPS actuation.
PRIORITY DETERMINATION Frequency Estimate In order to estimate the frequency of FPS actuations resulting in adverse inter-actions with plant safety systems, a review was conducted of plant operating events over a four year period from 1979 through 1982. During this period there were 30 FPS actuations where FPS suppressant (water or gas) was released or the FPS actuation circuitry isolated a safety system. Of these 30 occurrences, 24 were inadvertent and directly related to personnel error during maintenance and/or test work en ths FPS or systems adjacent to FPS detectors, 2 occurrences resulted from system steam leaks which actuated FPS heat / smoke detectors, and 2 occurrences were FPS water valve gradual leaks without actual FPS actuation.
One occurrence was a planned FPS suppressant (CO 2 ) release test and one occurrence was due to a fire in the area.
During this same time period, there were some additional inadvertent FPS actua-tions without release of fire suppressant since there was no heat to melt the sprinkler head fusible links. These cases had no potential interaction effect and were not considered further. Of the thirty FPS actuations summarized above, eighteen of them caused an interaction with a safety system. Sixteen of these interactions involved only a single train of redundant (2) train system while two of the interactions involved redundant trains of a given safety system.
All but two of the eighteen interactions involved open head deluge water sprinkler systems spraying water onto safety system equipment or oil supplies.
The remaining two interactions involved FPS actuation circuitry interacting with the control circuitry of a single train of a safety system but no release of suppressant. The systems affected by the single train and redundant train interactions are tabulated in Table 3.57-1.
In crder to estimate the contribution of these interactions to potantial core-melt accidents, the above table was used to identify typical interactions with systems represented in plant dominant accident sequences leading to core-melt.
The FPS interaction with redundant trains of a diesel generator system (in the above case-water contamination of the fuel oil common to both diesel generators) represents a potential common-mode failure of the onsite emergency AC power function.
O 06/30/88 3.57-2 NURM-0933
i ,
i Revision 1 k TABLE 3.57-1 i
Systems Affected by Interactions t
Redundant Train Interactions Single Train interactions
}
System Occurrences System Occurrences Diesel-Generator 1 Diesel Generator 4 !
Aux Bldg., Fuel Bldg. 1 ESF, SGTS Charcoal 4 l Ventilation-Charcoal Filters i Filters RCIC 2 Core Spray 2 HPCI 2 H Recombiner 1 RPS MG Set 1 2 16
} The HPCI and RCIC interactions above actually constitute safety system single j train interactions since each system is backed by the Automatic Depressurization i System (ADS) plus Low Pressure Coolant Injection (LPCI). However, to be con-i servative, this analysis assumes these dcta are equivalent to one redundant l train interaction representing potential common mode failure of high pressure
- injection protection against a small break LOCA.
l There was one redundant train and severa1(4) single train interactions causing 4
inoperability of charcoal filters of various safety grade ventilation systems.
However, these interactions are not contributors in core-melt accident sequences i' even though they can adversely affect radiation rele&ses from a plant following an accident. These occurrences were not considered in estimating contribution of these interactions to core-melt accidents, j Consequently, for this analysis it is assumed the above data represents a poten-i tial common-mode failure of onsite emergency AC power or high pressure injection 1 function during the operating period reviewed. During this period, an average J of 75 reactors were operating. Thus the frequency of common-mode for either system is estimated to be once in 300 R$ or 0.0033/RY.
4 To evaluate the freguesty of the cut sots and sequences affacted by these common-i mode failures, it is necessary to estinate the resulting additional system un-availability esing the above common-mode failure frequency of 0.0033/RY per
- system.
l Two sequences were considered in deterniining the increased system unavailability.
J The first sequence considers a potential inadvertent FPS actuation resulting in
{ total loss of either HP1 or onsite emergency AC power followed by a thirty-six
- hour period when either the HPI or diesel generators are out of service. The I thirty-six hour period was selected based on plant technical specification con-j siderations assuming that plant personnel are aware that the inadvertent FPS t actuation has occurred but is unable to restore operability to the affected
}
06/30/88 3.57-3 NUREG-0933
Revision 1 system. Plant technical specifications require that in the event of total inoperability of such systems, the operators must restore operability of at least one train within one hour. If operability cannot be restored, then the plant must be in hot standby in the next six hours and in cold shutdown in the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. It is assumed that the plant is no longer vulnerable to loss of these systems after cold shutdown is achieved.
The second sequence considers a potential plant transient or small break LOCA followed by a three day period during which the plant would be vulnerable to an inadvertent FPS actuation which could cause total loss of the diesel-generators or the HP! system. The three day vulnerability period was assumed on the basis that three days is long enough to restore AC power from offsite; depressurize the Reactor Coolant System and operate in a recirculation mode. Also, after three days reactor decay heat flux is low enough that various auxiliary system small capacity, low head pumps could be aligned to keep up with atmospheric j boil off of decay heat in a feed and bleed mode, if necessary. '
Assuming that Sequence 2 is additive to Sequence 1, the total period of plant vulnerability from outage of either system could be 4.5 days. Using 4.5 days, the additional unavailability of either system is estimated to be:
(0.0033/RY) (4. 5 day) = 4.1 x 10 5 365 day /yr This additionil unavailability was then added to each of the parameters asso-ciated with core-melt sequences involving loss of onsite emergency AC power or HPI system function, The resulting increase in core-relt frequency is estimated to be 3.4 'x 10 7/RY, of which 551, is associated with diesel generator unavail-ability and the remaining with HPI system unavailability.
Based on the operating experience used and the derived additional system un-availability, safety system interactions associated with inadvertent FPS actuations represent non-dominant contributors to the overall core-melt risk of a plant.
With regard to spurious FPS actuations interacting with a single train of a safety system, the operating experience in Table 3.57-1 above indicates that one train of a given system could have been affeqted as often as 18 times during the 300 Ri operating period reviewed. Thus, a single train interaction frequency as high as 6 x 10 2/RY can be derived. Ho ever, even at this frequency, such occurrences ara considered insignificant contributors to total system unavail-ability since the redundant train is still available. Also, in all the single train interactions reported, the affected train was restored to operability within the outage time for a single system train allowed by plant technical specifications.
Consequence Estimate Because the contribution to core-melt is low, no analysis to talculate potential reduction in public risk (man rem) was considered warranted.
O 06/30/68 3.57-4 NUREG-0933
i r
Revision 1
)
( Cost Estimate it can easily be estimated that the minimum cost per plant to comply with an IE Bulletin which required all licensees to reevaluate their implementation of FPS guidelines concerning FPS interactions would involve three-quarters of an engineering staf f year (s$75,000) to conduct the review and submit a report to NRC. Any resulting changes to plant procedures or FPS hardware would be addi-tional cost and would be unique to a given plant. Also, NRC effort to review ,
the response from each plant would average 2 to 3 staff-months per plant or I approximately $20,000/ plant. Thus, a minimum cost per plant to comply with an IE Bulletin is estimated at $100,000/ plant, exclusive of plant-unique FPS modifications.
Value/ Impact Assessment No priority score was calculated since the frequency and consequence estimates are so low, Uncertainty As noted above, approximately 80% of the 30 FPS actuations reviewed were a direct result of personnel error during maintenance and/or test work on the FPS or systems adjacent to FPS detectors. This fact coupled with the consideration that, following a plant transtant or LOCA it is very unlikely that plant per-sonnel would be engaged in such work, makes the likelihood of inadvertent FPS actuations as postulated for the second sequence considered in the frequency analysis above to be low. If only the first sequence of events is considered, O the core-melt contribution due to unavailability of onsite emergency AC power or the HPl system reduces to 1.1 x 10 7/RY.
Other Considerations Surry 2 Feedwater Line Rupture: The data base used in the frequency analysis does not include the feedwater line rupture event at Surry 2 on December 9, 1986. During the event, the Cardox and Halon fire suppression systems were actuated by steam / water intrusion into their control panels. The security repeater (located approximately five feet from a Cardox discharge nozzle) f ailed and was later found to be covered with a thick layer of ice. As a re-sult, security communications were limited to the non-repeater hand-held radios. Therefore the actuation of the Surry FPS resulted in the loss of a single train of a safety system. This is the first such occurrence at the Surry plant in its 14 years of operation. Therefore, one could calculate a frequency of occurrence of actuation of the FPS resulting in the loss of a single train of a safety system at Surry of 1/14 or 7.1 x 10 8/RY. The data base used in the analysis of this issue identified 18 events in which actuation of the FPS resulted in the loss of a single train of a safety system. For the 300 plant years represented by the data base the 18 events would result in the calculation of a frequency for FPS actuation causing loss of one train of a safety system of 6 x 10 2/RY. We thus conclude that the operational history at Surry is in sufficient agreement with the data base used for analysis of this issue and the significance of the Surry event with regard to the interaction of the FPS with plant safety systems is encompassed within this issue, Carbon Dioxide Releases: Ouring the operating period reviewed, three of the twenty-eight releases of fire suppressant were releases of carbon dioxide. Two 06/30/88 3.57-5 NUREG-0933
Revision 1 of these three releases were inadvertent; the third was a planned carbon dioxide system acceptance test. One event caused evacuation of maintenance personnel from a cable spreading room following the FPS pre-release alarm. In most plants, the cable spreading room is an unmanned area. The second event resulted in sufficient pressure buildup to force open a closed door in an ECCS penetration room. The third event was a planned acceptance test which failed to achieve the specified carbon dioxide concentration but also caused rapid temperature reduction in a cable spreading room such that some instrument cabinets approached their operating temperature lower limit. In thf s latter ct.se, the carbon-dioxide system was replaced with a halon gas system. None of these releases resulted in an adverse interaction with safety systems or a plant transient.
It is worth n3 ting that the staff FPS guidelines address the possibility of each of the conditions described above.
External Events: An additional consideration concerns a potential external event such as a large smoke cloud due to a large offsite fire or a seismic event which could cause actuation of multiple smoke detectors which could cause inadvertent release cf fire suppressant in several plant areas.
During the operating period reviewed, there was one occurrence of a large external smoke cloud due to a large grass fire near a plant that actuated several smoke detectors. in this instance, no suppressant was released since the smoke detectors were used with pre-action water sprinkler systems which require heat 17 the vh:inity of the sprinkler head to melt the fusible link before releasing suppressant. Also, the operators had advance notice of the approaching smoke cloud and had time to start operation und to have personnel available to establish fire watches in an area where smoke detectors were actuated. For a plant with open head deluxe sprinklers, the advance warning would permit time to deactivate the deluge system and post a fire watch in an area where safety equipment might be exposed.
We estimate a core-melt frequency of 3 x 10 9/RY for large offsite fires caus-ing an inappropriate or inadvertent actuation of the FPS and further f aGured resulting in core-relt events. The one precursor event mentioned above gives us a frequency estimate of 1.4 x 10 3/RY for offsite fire-induced FPS actuation.
We assumed a 0.1 probability of failure to post a fire watch and take manual control of FPS. Auxiliary feed water system (AFWS) failure assumptions are as follows: probability that AFWS is protected by an open head deluge system (0.02), and probability of AFWS electrical failure due to deluge (0.02), and probability of operator error defeating manual operational of AFWS (0.1).
Failure of feed-and-bleed heat removal is assumed to be 0.5/ demand. These estimates and assumptions are used to calculate the 3 x 10 S/RY core-melt estimate for offsite fire-induced FPS actuation. We thus find the offsite fire contribution to core-melt for this issue to be negligible.
We estimate the frequency of a core-melt event initiated by a seismic event of OBEmagnitudeorg/RY.reater systems to be 10- causingthat We believe an inadvertent there is stillactuation of the fire protection some conservativism inherent in this estimate and that a more rigorous development of a best estimate frequency for this sequence of events would result in a lower frequency estimate.
The LLNL Report (UCRL-53037), which provided estime.tts of earthquake f requency I at the Zion site and the cciditional probabilities of transient or LOCA initi-ators given an earthquake, was used to develop a frequency of 2 x 10 6/RY for 1
06/30/S3 3.57-6 NUREG-0933 l j
Revision 1 earthquake-induced LOCA and 5.6 x 10 4/RY for earthquake-induced loss of offsite power (T ) transients. Examination of systems and equipment at 109 different major industrial facilities (including power plants) that experienced seismic events (peak ground accelerations from 0.lg to 0.75g) reveal no inadvertent operation of fire protection systems. We therefore assumed a conditional prob-ability of FPS actuation, given an earthquake, of 10 8 The 30 inadvertent FPS actuation events yielded only one event in which complete loss of safety func-tion (emergency on-site power diesel generators) resulted. We therefore assumed a conditional probability of loss of safety function of 1/30 or 3.3 x 10 2, given an earthquake, We applied the 3.3 x 10 2 probability for both a loss of emergency onsite power for Tg transient events and loss of high ,
pressure injection for LOCA events. Solution of the LOCA andt i transient event trees results in the 10.s/RY estimated core-melt frequency due to seismic-induced FPS actuations. When compared to the estimated core-melt fre-quency of 3.4 x 10 7/RY from other scenarios resulting from inadvertent FPS actuation, we find the seismic contribution is negligible.
Periodic Fire Protection Program Audits: There already exists a mechanism for mandatory review of the Fire Protection Program and implementing procedures for each plant without requiring an IE Bulletin. The Technical Specifications for each plant requires under Administrative Controls:
(a) An independent fire protection and loss prevention inspection and audit annually utilizing either qualified offsite licensee personnel or an outside protection firm.
(b) Audit of the Fire Program and implementing procedures at least once per 24 months.
(c) An inspection and audit of the fire protection and loss prevention Os program by an outside qualif hd fire consultant at intervals no greater than 3 years.
The issuance of IE Notice 83-41to2s and periodic INPC Significant Event Reports provide timely operations feedback to enable licensees to consider applica-bility of such events in the periodic program reviews indicated above. Several plants have documented instances where their periodic reviews in conjunction with the feedback information identified an area where there was potential for FPS interaction with part of a safety system and corrective action was taken.
CONCLUSION Based solely on the quantitative analysis performed in this report, this issue
- would be ranked low priority. However, the external events portions of the analysis, although resulting in a low safety significance, have (by their very
- nature) large uncertainty error bands inherent in the determination of frequen-i cies of occurrence for rare events (i.e. earthquakes), in addition, the 1 analysis of events resulting in core-melt from inadvertent FPS actuation con-l sidered the frequencies of initiating events (particularly transients) to be i independent of the FPS actuation. Initially, one most assume that, if inadver-l tent FPS actuations can result in the loss of a safety system train or func-i tion, in some instances it can also result in the initiation of a reactor transient. The limited analysis provided herein will not and, by the nature of the cost and time limitations on a prioritization analysis, cannot incorporate such subtle effects of FPS actuation. Hence, one could assume that the true core-melt frequency would be greater than that calculated above. The ACRS and j
06/30/88 3.57-7 NUREG-0933
Revision 1 the nuclear industry have also perceived a higher interest in this concern than that which should be warranted of a low priority safety issue. In fact, the nuclear industry, through EPRI, has recently initiated a study of the effect of inadvertent FPS actuation on plant safety. The EPRI study is, one of three research initiatives suggested by the Edison Electric Institute's Fire Pro-tection Committee as a result of their review of electrical utility experience with the design and operation of fire protection systems at both nuclear and non-nuclear electric generation facilities. In consideration of the above factors, we find that this issue should be assigned a MEDIUM priority.
REFERENCES
- 11. NUREG-0800, "Standard Review Plan," U.3. Nuclear Regulatory Commission, (1st Edition) November 1975, (2nd Edition) March 1980, (3rd Edition)
July 1981.
510. Memorandum for C. Michelson from H. Denton, "Effects of Fire Protection System Actuat{ n on Safety-Related Equipment," August 22, 1982.
1025. IE Information Notice 83-41, "Actuation of Fire Suppression System Causing inoperability of Safety-Related Equipment," U.S. Nuclear Regulatory Commission, June 22, 1983.
1027. Memorandum for D. Eisenhut from G. Lainas, "Summary of the Operating Reactor Events Meeting," January 28, 1982.
1028. Memorandum for R. Vollmer and E. Jordan from C. Michelson, "Effects of Fire Protection System Actuation on Safety Related Equipment,"
January 20, 1982.
06/30/83 3.57-8 NUREG-0933 O
L i
Revision 1 .
m
{
l ISSUE 86: LONG RANGE PLAN FOR DEAllNG UITH STRESS CORROSION CRACKING IN \
BWR FIPING DESCRIPTION Historical Backaround In March 1982, le&ks were detected in the heat-affected zones of the safe end- [
to pipe welds in two of the 28 in, diameter recirculation loop safe ends at i Nine Mile Point Unit 1. Subsequent UT revealed extensive cracking at many weld i joints in the recirculation system. The cause of the cracking was determined to be intergranular stress corrosion cracking (IGSCC). L Although cracking in large diameter piping had been found previously in Germany and Japan, the finding at Nine Mile Point Unit 1 was the first known U.S. ;
occurrence of IGSCC in large piping (pipe diameters > 10 in.). IE Information ;
Notice 82-3960s was issued on September 11, 1982 to alert all BWR licensees to !
the problem. The staff held meetings with GE, EPRI, and BWR Owners to discuss the relevance of the Nine Mile Point cracking to other BWRs. The near-term ,
inspection of welds in large-diameter recirculation piping was discussed at a i meeting of the staff with BWR licensees on September 27, 1982. Following this, .
IE Bulletin 82-03609 was issued on October 14, 1982 and required the 8 BWRs T that were scheduled for outages through January 31, 1983 to pteform inspections f of a reasonable sample of the recirculation system welds during their ,
respective outages.' [
After cracking in large-diameter piping was observed in 5 of the first 7 plants inspected in response to IE Bulletin 82-03,80S the staff issued IE I Bulletin 83-02820 to extend the inspection requirements to all other BWRs. On August 1,1983, the EDO established a Piping Review Comittee to investigate i specific incidents of pipe cracking at all plants with emphasis to be placed !
on IGSCC that had been reported in the recirculating systems of BWRs. Under t the auspices of the NRC Piping Review Comittee, a Task Group on Pipe Cracking !
was convened to develop a long-range plan for dealing with IGSCC. ;
The status and results of inspections of piping welds for IGSCC conducted at l various operating BWRs were reported to the Comission in SECY-83-267,st SECY-83-267A,813 SECY-83-2678,614 SECY-83-267C,835 SECY-84-9,818 SECY-84-9A,8 " j and SECY-84-166.sta The short-term reinspection and repair criteria were issued to BWR licensees in Generic letter 84-11sto on April 19, 1984, and were f to be used in inspections subsequent to the issuance of IE Bulletins 82-0380S I and 83-02.sto The Task Group report (NUREG-1061,53 2 Volume 1) was drafted in April 1984 and submitted to the Comission in July 1984 with SECY-84-301,818 !
the staff's long-range plan for dealing with IGSCC in BWR piping. NUREG-1061,811 }
Volume 1, which includes value/ impact analyses for the four possible solutions !
discussed below, was publi*ihed in August 1984. j i
06/30/88 3.86-1 NUREG-0933 l,
Revision 1 Safety Significance Pipe cracking resulting from IGSCC can cause a LOCA which, in turn, contributes to core-melt frequency.
Possible Solutions The results of the Task Group study indicate that there are four possible solu-tions for preventing IGSCC in BWRs: (1) piping replacement without hyorogen water chemistry (HWC) - cor.sidered to be a long-term fix; (2) induction heating stress improvament and HWC - considered to be a long-term fix; (3) augmented inspection, weld repair, and HWC - considered to be a partial intermediate fix; and (4) augmented inspection and weld repair without HWC - considered to be only a short-term fix. j The staff's long range plan for resolving the problem called for the following l
actions: (1) issuance of NUREG-1061:611 (2) incorporation of the Task Group recommendations into NUREG-0313,750 Revision 2, and issuance of this document; (3) preparation of a generic letter that incorporated NUREG-0313,750 Revision 2, and issuance of this letter to all BWR licensees requesting their proposals for bringin0 their plants into compliance with 10 CFR 50.55a(g); and (4) pur-suance with the appropriate industry Code Committees changes in the areas of NDE personnel qualification and inspection procedures to bring ASME X184 requirements into conformance with the staff's recommendations.
CONCLUSION In January 1988, NUREG-0313,750 Revision 2, was published and Generic letter 88-011111 was issued outlining the staff positions on IGSCC in BWR austenitic stainless steel piping; MPA B-84 was established by NRR for implementation purposes. Thus, this issue was RESOLVED and requirements were established.
REFERENCES
- 14. ASME Boiler and Pressure Vessel Code,Section XI, "Rules for Inservice Inspection of Nuclear Po,.er Plant Components," American Society of Mechanical Engineers, 1974.
608. IE Information Notice No, 82- 4 , "Service Degradation ot' Thick-Walled Stainless Steel Recirculation Systems at BWR Plants," U.S. Nuclear Regulatory Commission, September 21, 1982.
609. IE Rulletin No. 82-03, "Stress Corrosion Cracking in Thick Wall Large Diameter, Stainless Steel Recirculation System Piping at BWR Plants,"
U.S. Nuclear Regulatory Commission, October 14, 1982.
610. IE Bulletin No. 83-02 "Stress Corrosion Cracking in large Diameter Stainless Steel Recirculation System Piping at BWR Plants," U.S. Nuclear Regulatery Commission, March 4,1983.
611. NUREG-1061, "Report of the U.S. Nuclear Regulatory Comission Piping Review Committee," U.S. Nuclear Regulatory Commission, (Vol.1) August 1984, (Vol. 2) April 1985, (Vol. 3) November 1984, (Vol. 4) December 1984, (Vol. 5) April 1985.
06/30/88 3.86-2 NUREG-0933
l l
Revision 1 612. SECY-83-267, "Status Report on Observation of Pipe Cracking at BWRs,"
July 1, 1983.
613. SECY-83-267A, "Update of Status Report on Observation of Pipe Cracking at BWRs (SECY-83-267)," July 11,1983.
614. SECY-83-2678, "Update of Status Report on Observation of Pipe Cracking at BWRs (SECY-83-267 and 267A)," August 8, 1983.
615. SECY-83-267C "Staff Requirements for Reinspection of BWR Piping and Repair ofCrackedPIping,"November 7,1983.
616. SECY-84-9, "Report on the Long Term Approach for Dealing with Stress Corrn-sion Cracking in BWR Piping," January 10, 1984.
617. SECY-84-9A, "Update of Status Report on BWR Pipe Cracks and Projection of Upcoming Licensee Actions," January 27, 1984. ;
618. SECY-84-166,"UpdateofStatusReportonBWRPipeCracksandProjectionof a Upcoming Licensee Actions," April 20, 1984.
619. SECY-84-301, "Staf f Lon CrackinginBWRPiping,gRangePlanforDealingwithStressCorrosion July 30, 1984.
1 620. NRC Letter to All Licensees of Operating Reactors, Applicants for Operating s
License, and Holders of Construction Permits for Boiling Water Reactors,
) "Inspections of BWR Stainless Steel Piping," (Generic Letter 84-11), '
April 19, 1984.
750. NUREG-0313, "Technical Report on Material Selection and Processing Guidelines for BWR Coolant Pressure Boundary Piping," U.S. Nuclear Regulatory Commission, July 1977, (Rev. 1) July 1980, (Rev. 2)
January 1988, i
1111. NRC Letter to All Licensees cf Operating Boiling Water Reactors (BWRs), i and . Holders of Construction Perit its, "NRC Position on IGSCC in BWR !
Austenitic Stainless Steel Piping (Generic Letter 88-01)," January 25, 1988. l r
4 l
f I
i 3.86-3 NUREG-0933 06/30/88 f
Revision 1 4
U ISSUE 93: STEAM BINDING OF AUXILIARY FEEDWATER FUMPS DESCRIPTION Historical Background
- This issue was recommendedC35 for prioritization by OSI after a review of the AE00 engineering evaluation report (AE00/E325)C38 on vapor binding of the AFW pumps at H.B. Robinson Unit 2. Further AE00 study of the event resulted in recommendations which were documented in AE00/C404.587 I The reports 87 discusses thirteen occurrences reported in 1983 of steam binding of one or more AFW pumps resulting from the leakage of heated main feedwater 3
into the AFW system. The systems are isolated by various combinations of check valves and control valves. The back-leakage occurred through several valves in series. The heated main feedwater, leaking into the AFW system, flashed to steam in the pumps and AFW discharge lines and resulted in steam binding of the AFW pumps.
Operating experience to date includes 22 events of reported back-leakage in 6 operating PWRs in the USA and at I foreign reactor. In other cases, back-leakage has been observed but was not considered as reportable occurrences.
The potential for common mode failure is present whenever one pump is steam-bound because the pumps are connected to common piping with only a single check valve to prevent back-leakage of hot water to the second or third pump. Steam
- binding of more than one pump was reported to occur in 3 of the 13 events reported in 1983.
i j Although steam binding of the pumps was reported on only W designed plants, a l back-leakage event is believed to have renderec an AFW flow sensor inoperable at Crystal River, a B&W-designed plant, The actual operating status of the
- pump and train during this event remains unknown. However, the AFW system in
, all PWRs is sufficiently similar so as to consfier it a generic problem for all
! PWRs.
Safety Significance I The back-leakage of steam represents a potential CCF for the AFW system that could result in the loss of its safety function.
l I
Possible Solutions I
) AE00 has recommendedC27 that regular monitoring of the temperature of the AFW t pumps be implemented to provide early detection of back-leakage of main feed-water. This will permit bleeding of f the heated water and/or steam before i acute steam binding of the pumps can occur. The addition of a pyrometer on the AFW discharge line at or near the pump would permit monitoring of the tempera-ture of the fluid in the system by the plant operators during their routine visual inspections. Records of the temperature readings would show the onset of leakage at an insidious level. Trends of temperature rise times would also 06/30/88 3.93 1 NUREG-0933
Revision 1 provide for the determination of optimal reading and recording intervals which would provide adequate assurance of system availability. The use of a pyrometer would reduce the possibility of error resulting from estimating the temperature by the operator placing his hand close to the auxiliary feedwater pumps or discharge lines.
PRIORITY DETERMINATION Assumptions The events experienced in 1983 are considered typical even though the number of events reported annually (prior to 1983) are less. The reporting of back-leakage is only required in those cases in which the pump has been rendered inoperable. Back-leakage which may have been detected on the steam bled from the system before a pump was rendered inoperable might not be considered a reportable occurrence, in fact, it is believed likely that the number of back-leakage events exceeds the number of events reported in 1983 and prior years.
However, for this analysis 13 events will be used as the annual occurrence frequency of back-leakage events.
In the calculations, all plants will be assumed to have three auxiliary feed-water pumps although some may have two. The effect of this assumption will be that the total unavailability of the auxiliary feed.ater system for those plants having only two pumps will be about 50% lower than the actual unavailability.
However, due to the small number of plants having only two pumps, this error is not expected to significantly impact the results.
Frequency / Consequence Estimate There were 13 events of pump unavailability reported in 1983. Based upon an expected 15 system demands /RY, 3 pumps / plant, and 47 plants, the unavailability /
pump-demand (Q) is calculated as follows:
Q = 13/(47 x 3 x 15) = 6.1 x 10 3 A second pump failure occurring simultaneously was reported to have occurred in 3 of the 13 events. The failure of a second pump is then expected to occur 3 times in 13 events, or at an occurrence rate of 3/13 or 0.23. Assuming that given two pumps having become steam bound, the conditional probability that the third pump will also become steam bound is 0.1 results in a demand unavail-ability of all 3 AFW pumps of 1.4 x 10 4 The original prioritization was based upon the Sequoyah R55 MAP 54 study. This analysis had a IML sequence which led to core melt and the dominant containment failure mode was due to hydrogen burning, it is the belief of many in the PRA risk analysis field that the IHL sequence will not lead to core-melt, and that the probability of containment failure due to hydrogen burning may be reduced by orders of magnitude. Further, to assure that the Sequoyah containment (an ice condenser) can be utilized in generic calculations may not be valid. Hence, the consequences were reexamined using the results of the Reactor Safety Study " (RSS) and the Surry containment.
O 06/30/83 3.93-2 NUREG-0933
Revision 1 In the RSS for Surry, the unavailability of the AFW system was calculated to be 1.5 x 10 4/ demand which did not include steam binding of the AFW pumps.
The major sequsnce af fected is the TMLB' sequer.ce which is increased from 3 x 10 S/RY to S.8 x 10 S/RY by the addition of steam binding to the AFW unavailability, in addition, a very small contribution is made by a TML sequence, The PWR release categories are ao defined in the RSS. The whole body man-rem dose is obtained by using the CRAC codeC4 assuming an average population density of 340 persons per square c.ile (which is the mean for U.S. domestic sites) from an exclusion area of a one-half mile radius about the reactor out to a 50-mile radius about the reactor. A typical midwest plain meteorology is also assumed. Based upon these assumptions, +he public dose resulting from each category is as follows:
Release Dose Category Q,an-rem) 1 5,4 x 108 2 4.8 x 10' 3 5.4 x 105 5 1.0 x 108 6 1. 5 ): 105 7 2.3 x 103' The steam binding of the AFW pumps will increase the frequency of the following listed sequences in the categories shown resulting in the listed dose.
O Category Sy uence Frequency increase (RY-1)
Oose (man-rem /RY) 1 TMLB'-a 2.8 x 10.s 1.5 x 10 1 2 TMLB*-6 1.9 x 10 5 9.12 TMLB* y 6.5 x 10 7 3.12 3 TML-o 5.6 x 10 8 3.0 x 10 1 5 TML-p 2.8 x 10 10 3.0 x 10 4 6 TMLB-c 5.6 x 10 7 8.4 x 10 2 7 TML-c 5.6 x 10 8 1.3 x 10 8 Considering only the TMLB' sequences the resulting dose is 12.5 man-rem /RY. The TML sequences are excluded due to the present uncertainty regarding core melt of this sequence. For the 90 PWRs which are expected to be operating having an average list of 28.8 years, the total public dose will be 3.2 x 104 man-rem.
The assumed probability of 0.1 for the third pump failing from steam binding, given that two has so failed, may not be conservative, but rather may be overly optimistic. If it is assumed that of the three events, where 2 pumps were reported to have been steam bound, that one event also involved 3 pumps, then the public dose risk would increase by a factor of 3 to the value of 9.6 x 104 man rem.
06/30/88 3.93-3 NUREG-0933
Revision 1 Cost Estimate Industry Cost: The cost estimate was based upon a number of engineering assump-tions which are believed to be conservatively biased toward the high side of the costs involved. Equipment costs for the pyrometers are estimated to be
$7,500/ plant ($2,500 each); the selection, installation design, ordering, installation and test were estimated to be 10 person-weeks / reactor, or $22,700.
No increase in operating cost is calculated, it is believed that the reading and recording of the temperature of the AFW pumps can be included as part of the plant surveillance activities which are normally accomplished each operating shift. Test and maintenance costs were estimated to be 1 man week /RY. For the 47 backfit reacters with an average remaining life of 27 years, the maintenance costs total $2.9M. For the 43 forward-fit reactors having a life of 30 years, the maintenance costs total $2.9M. It is further estimated that each pyrometer will be replaced twice during the plant life at a cost of $32,000/ plant. The total industry cost to install pyrometers at or near each pump, based upon the above, is $11.4M.
NRC Cost: The NRC cost is estimated to not exceed 1 man week / reactor or $0.2M for all affected plants.
Value/ Impact Assessment (1) For the scenario in which the probability of the third pump failing steam bound is 0.1, the value/ impact score is given by:
104 man-rem 5 = 3.2 f(11.x_4 + 0.2)M
= 2.8 x 103 man-rem /$M (2) For the scenario in which the probability of the third pump failing steam bound is 0.33, the value/ impact score is given by:
5 = 9.6 x 1M man m m
$(11.4 + 0.2)H
= 8.4 x 103 man-rem /$M.
CONCLUSION Both the total dose in man-rem and the value/ impact score vary from bordering between medium to high priority for the third pump failure of 0.1 to high priority for the third pump failure, if the third pump failure were 0.33. In light of the uncertainty associated with this issue, a HIGH priority was assigned.
In October 1985, IE Bulletin 85-011212 was issued to licensees with require-ments to develop procedures to detect or correct steam binding, in resolving tnis issue, the staff surveyed the back-leakage experience in operating plants following the implementation of monitoring procedures. Although the number of back-leakage events varied from an average of less than 1/RY at a large major-ity of plants to more than 100/RY at others, none of the back-leakage events 3.93-4 NUREG 0933 06/30/88
i f
Revision 1 i
\
that occurred during the review period resulted in the steam binding of an AFW pump. This indicated that the various monitoring methods employed can be highly effective in preventing steam binding if back-leakage occurs. For the .
, plants with a high back-leakage event rate, the installation of continuous !
monitoring systems with contol room alarms was instrumental in providing for i
- early warning to the operator and timely corrective action.
i l The results of the staff's regulatory analysis indicated that the !
i recommendations in IE Bulletin 85-012 H 2 would ensure that the contribution of ;
AFW pump steam binding to core-melt frequency and public risk was sufficiently i j low and that there was no need for new recommendations beyond those in IE Bulletin 85-01. Thus, the staff concluded that the recommended monitoring 1
actions of IE Bulletin 85-01 should be continued. In February 1989, IE j
i Bulletin 88 031M 3 was issued to reinforce this conclusion. Thus, this issue was RESOLVED and requirements were established. The staff also agreed to
] revise NRC Inspection Procedure 71707-03C to include the matter of monitoring the AFW pumps for steam binding as an example of a recurring operational f I
event that should i>e periodically checked by NRC inspectors.'H !
l REFFRENCES 1 16. WASH-1400 (NUREG-75/014), "Reactor Safety Study, An Assessment of Accident Risks in U. S. Commerical Nuclear Power Plants," U.G. Nuclear :'
Regulatory Commission, October 1975.
- 54. NUREG/CR-1659, "Reactor Safety Study Methodology Application Program,"
U.S. Nuclear Regulatory Commi sion, 1981.
- 64. NUREG/CR-2800, "Guidelines for Nuclear Power Plant Safety Issue i Prioritization Information Development," U.S. Nuclear Regulatory
) Comnission, February 1983.
I 635. Memorandum for G. Holahan and W. Minners from R. Mattson, "Disposition {
{ of AE00 Engineering and Technical Evaluation Reports," April 10, 1984. ;
q 636. Memorandum for R. DeYoung and H. Denton from C. Heltemes, "Vapor Binding j
- of Auxiliary feed ater Pueps," November 21, 1983. ,
! 637. AE00/C404, "Steam Binding of Auxiliary feedwater Pumps," Office for l Analysis and Evaluation of Operational Data, U.S. Nuclear Regulatory ,
j Comission, July 1984. '
l 1112. IE Bulletin No. 85-01, "Steam Binding of Auxiliary Feedwater Pumps," l t
U.S. Nuclear Regulatory Commission, October 29, 1985. ;
! 1113. NRC Letter to All Licensees, Applicants for Operating Licenses, and t j Holders of Construction Permits for Pressurized Water Reactors, i
! "Resolution of Generic Safety Issue 93, ' Steam Binding of Auxiliary !
Feedwater Punps' (Generic Letter 88-03)," February 17, 1988. I 1
] 1114. Memorandun fer E. Beckjord from T. Murley, "Resolution of Generic !
j Safety Issue 93, ' Steam Binding of Auxiliary Feedwater Pumps,'"
August 14, 1987, }
I
! l
) 06/30/88 3.93 5 NUREG-0933 !
1 !
4
Revision 3 C
k l
ISSUE 125: DAVIS-BESSE LOSS OF ALL FEEDWATER EVENT OF JUNE 9,1985 - LONG TERM ACTIONS On June 9, 1985, Davis-Besse had a partial loss of feedwater while operating at 90T, power. Following a reactor trip, the loss of all feedwater occurred. The two OTSGS became dry and were ineffective as a heat sink. Consequently, the RCS pressure increased indicating a lack of heat transfer from the primary to secondsry coolant systems. The PORV automatically opened and closed twice during the event upon reaching the approximate pressure setpoints; it opened a third time, but did not close for some unknown amount of ti.ne. The delayed response to close the third time aggravated the recovery of the event and allowed a rapid depressurization of the RCS.
In addition to the short-term actions identified and addressed in Issue 122, a staff report on the event was published in NUREG-1154886 and an EDO memoran-dum**5 identifying 29 NRR action items was issued or. August 5,1985. These items became known as long-term generic actions and, in November 1985, were forwarded by DL to DST for prioritization.'*0 The items were broken down into two groups:
(1) Issues raised in NUREG-1154 and the EDO memorandum and (11) Other Issues.
These 29 items are prioritized separately below and are identified by the num-bering system established in the DL memorandum.'40 O
ITEM 125.1.1: AVAILABILITY OF THE SHIFT TECHNICAL ADVISOR DESCRIPTION Historical Background This issue was identified as Item 5 in the EDO memorandusses and is based on Finding 14 and Section 6.1.3 of NUREG-1154. ass During the event, neither the shift supervisor nor any of the other licensed operators requested the assist-ance of the shift technical advisor (STA). One reason for not doing so was the fact that the STA was not in the control room or immediately available when the event occurred, but rather was on an on-call status. (Note: he it, allowed 10 minutes to reach the control room after being called.) Moreover, the event occurred so rapidly that it was essentially over when he did arrive.
STAS were first required as part of the TMI Action Plan Item 1.A.1.1, "Shift Technical Advisor." The purpose of the 51A was to provide readily available technical support to the plant operators. The STA's expertise was intended to aid in the mitigation of those transients and accidents which involve complex thermal-hydraulic behavior in the primary and secondary coolant systems. In sumary, having the STA available was a post-THI improvement to provide the shift supervisor with additiunal technical expertise, but his potential assistance and guidance was not available nor required during this event.sse O
06/30/88 3.125-1 NUREG-0933
Revision 3 Safety Signif t:;ance The safety question posed by this issue is whether the STA should be in the control rocm, or immediately available, to support the shift supervisor rather than being on an on-call status.
CONCLUSION One year after the Davis-Besse incident, the staff ceiducted a suivey to a fulfill a Staff Requirements Memorandum to provide t'.te Commissioners with the implementation results of the Commission Policy Statement on engineering exper- ,
tise on shift and reported their findings in SECY-86-231.2023 This survey found that there were only three plants that did not have "on-shift" STAS.
On-shift STA means that there is an STA, or en STA-qualified SRO, in or near the control room on a shift basis during operations. The STA shift may or may not correspond to the same shift times and length as the licensed operators' shift. It further means that the STA does not work on an extended assignment period, e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, during which time the STA is provided quarters to res*.
during a portion of his extended duty and is available on on on-call oasis.
Based on the staff's findings,1023 STAS are in the control room or immediately available at the majority of operating plants, for the three plants identified with a deficiency, licensee action is being reviewed by the staff on a plant-specific basis. Thus, this item should be DROPPED as a generic issue.
ITEM 125.I.2: PORV RELIABILITY The PORV common to most PWRs (with the exception of CE 3110 and 3800 Nt plants and ANO-2) is designed to limit system pressure if a transient recovery exceeds the capability of the pressurizer spray system. Davis-Besse has a solenoid-controlled PORV. However, many other PWRs have PORVs that are op3 rated pneu-matically (instrument air or nitrogen). Both designs have the same purpose.
The PORV is designed to receive an actuation signal to open from the pressurizer pressure instrumentation at a design setpoint (typically 2425 psia) in order to prevent reactor pressure from rising and activating the code safety valves.
If a PORV is used for feed-and-bleed, it can either be: (1) set to stay open by the operator dropping the setpoint low enough such that the valve will remain open until reaching the lower setpoint for LPIS or RHR initiation, or (2) cycled open and closed many times, should there be a neeo for feed-and-bleed. Option 1 appears to be the more cc-"non practice. PORVs are also used in other functions such as mitigating SG1 accidents, LTOP, or RCS venting.
Its performance is required for plant protection and accident mitigation.
The following is the evaluation of the four parts of this issue.
06/30/88 3.125-2 NUREG-0933 O
Revision 3 ITEM 125.1.2.A: NEED FOR A TEST PROGRAM TO ESTABLISH RELIABILITY OF THE PORV OESCRIPTION Historical Background This issue was identified as item 9e in the E00 memorandumass and is based on finding 13 and Section 5.2.8 of NUREG-1154.sas Safety Significance Although the PORV can be used successfully in recovering from certain plant transients, there has been no suitable test program established to verify its reliability.nas This issue affects all PWRs that can use PORVs.
CONCLUSION The need for improving the reliability (f PORVs and block valves, in light of plant protection and accident mitigation requirements, is being addressed in the resolution of Issue 70, "PORV and Block Valve Reliability." Revised licens-ing criteria may be developed, if needed, to include testing requirements. ass Therefore, this issue is covered in Issue 70.
ITEM 125 I.2.B: NEED FOR PORV SURVEILLANCE TESTS TO CONFIRM OPERATIONAL READINESS DESCRIPTION Historical Background This issue was identified as Item 9d in the E00 memorandum *85 and is based on Finding 13 and Section 5.2.8 of NUREG-1154.su Safety Significance The review of the PORV maintenance and operating history reveals that the mechanical operation of the valve had not been tested and that the valve had not otherwise been operated for over 2 years and 9 months prior to the June 9, 1985 event. Therefore, it seems that there exists a need for surveillance tests to confirm operational readiness. This issue affects all PWRs that can use PORVs.
CONCLUSION The number of times that PORV/ Block Valves are used during a typical fuel cycle will be reviewed in the resolution of Issue 70, "PORV and Block Valve Reliabil-ity " in order to determine if a surveillance program thould be initiated to confirm operational readiness.a" Therefore, this issue is covered in Issue 70.
O 06/30/88 3.125-3 NUREG-0933
Revision 3 ITEM 125.I.2.C: NEEDFORADDITIONALPROTECT]ONAGAINSTPORVFAgl[RE, O
DESCRIPTION Historical Background This issue was identified as Item 9e in the EDO memorandum *S5 and is based on Sections 5.2.8 and 6.2.1 of NUREG-1154.8*6 The PORV will receive an actuation signal from pressurizer pressure instrumenta-tiun at a design setpoint (typically 2425 psig) to open in order to prevent reactor pressure from activating the code safety valves. After the opened PORV has reduced the pressure sufficiently to reach its closure setpoint (typically 2375 psig), it is sent a signal to close. A simultaneous signal is also sent to the control room indicating to the operator that a close signal was sent to the PORV. PORV closure can be verified by an acoustic monitor installed on the tailpipe downstream of the PORV on all PW'6 after the THI-2 accident. At Davis-Besse, the PORV closure is indicated by a light located on a wall several feet from the operator's control panel. This was available to the operator at Davis-Besse to verify whether the PORV was closed, but was not looked at. Addi-tionally, there is the SPDS, also a post-TMI improvement, that displays a summary of the most safety significant plant status information on a TV screen.
Both channels were inoperable prior to the event.886 This left the operators with only the pressurizar pressure indicator is a source of determining if the PORV was open or closed. Since the indicator appeared steady, the operator assumed that the PORV had closed, but closed the block valve as a precautionary measure. In actuality, however, the FORV had not closed until some time later into the event.
Safety Significance There have been several stuck open PORVs documented due to a variety of malfunc-tions some of which were identified to be mechanical failure, broken solenoid linkaae, inoperability due to corrosion buildup, and sticking caused by foreign material.**6 As a precaution, the PORV block valve can be closed to insure no LOCA, but this can only be achieved if the 09erator closes the block valve by remote-manual operation from the control room. in the Davis-Besse event, the operator did close the block valve to prevent a further decrease in pressure and loss of primary coolant through the PORV when it did not reseat.
Possible Solution Knowing that a stuck-open PORV may result in a potentially dangerous scenario (i.e., LOCA), this issue addresses the concern of whether thete is a need for an automatic block valve closure in plants that have PORVs.
i Considering available control room indicators such as an acoustic monitor, a I
' "eliable SPDS and the operator's acute sensitivity to the FORV's status because of historical events such as TH1-2 and Davis-Besse, another redundant feature (i.e., automating the block valve) would not neces,arily result in a significant i
decrease in core-melt frequency. The acoustic monitor was available to the operator at Davis-Besse; the SPDS was not. However, there is an NRC requirement I for the installation of "a cancise display of critical plant variables to the 06/30/88 3.125-3 NUREG-0933
Revision 3 A
control room operators to aid them in rapidly and reliably determining the safety status of the plant."376 4
Additionally, there is a DHFT program underway "to determine the need for and, if necessary, the scope of the NRC's SPOS post impleeentation reviews."800 The information obtained will "allow an assessfrent of how well the SPOS objectives are being met and provide the basis for an NRC regulatory position on SP05 post-implementation reviews. Following completion of this program OHFT will, if 1 necessary, work with industry ta develop appropriate standards for SPOS i
- availability."S0O
\ The staff performed SARs on the three vendor group responses (CE, B&W, W) to !
) TM1 Action Plan Item II.K.3(2), "Report on Overall Safety Effect of Power- '
- Operated Relief Valve (PORV) Isolation System." (References 897, 898, and 899).
The SARs included an estimate of core-melt frequency due to a stuck open PORV- !
6 induced SBLOCA. The calculations were based on PORV operating data from April 1,
! 1980 to March 31, 1983 and concluded that post-THI actions such as lowering the setpoint of the high pressure reactor trip and raising the setpoint of the t PORY opening, eliminating the turbine runback feature, and improving operator t
! capability decreased the challenge to the PORV and the probability of a SBLOCA-4 PORV sufficiently so as not to warrant a requirement for automatic block valve closure, i ,
i The Davis-Besse event may be viewed as another "data point" that should be !
} considered in this determination. However, upon consideration of the occur- '
] rence of a PORV actuation and the conservative estimates made in the staff's I i
SARs (References 897, 898, and 899), we conclude that the SBLOCA-PORV fre- <
quency would still remain within the range of the SBLOCA frequencios given in
! WASH-140016 (10 2 to 10 4/RY). The opening of the PORV resulted from a loss I j
of all feedwater to the steam generators and is regarded as a legitimate '
1 response and fulfillment of the real purpose for incorporating a PORV into the -
l design. Therefore, the Davis-Besse event does not enange the statistics for
[
] recessary challenge to the PORV. Consequently, the staff's SARs (Refer-i ences 89/, 898 and 599) which concluded that block valve automation is unneces- '
j sary are unaffect(d.
l 2
) Also it is clear that the automation of the block valve might reduce the i initiator (SBLOCA PORV) f requency, but not necessarily the net core eelt fre- i I quency. Since it has the potential for spurious actuation (e.g., spurious
! electrical signal sensed by the block valve could force it closed during a ;
{ transient requiring use of the PORV) which would increase core-melt fret;uency.
[
The occurrence at Davis-Besse was the result of an initiator already considered !
in the SARs, i.e., the failure of the AFW system. It was an occurrence that
[
would have resulted in no other outcome should an automatic block valve have '
i been available because the operator closed the block valve himself as a result of his sensitivity to the PORV from post-THI training. i
! l j CONCLUSION r
In light of the control room indications available to the operators and the I results of the staff SARs (References 897, 893 and 899) that concluded that an [
] automatic PORV isolation system is not necessary, the safety concerns of this '
j issue base been resolved. Thus, this issue should be DROPPED as a new issue.
7 i
l
] 06/30/88 3.125-5 NUREG-0933 t
1 1
1
_ _ _ _ J
Revision 3 ITEM 125.I.2.0: CAPABILITY OF THE PORV TO SUPPORT FEED-AND-BLEED DESCRIPTION Historical Background This issue was identified in the E00 memorandum"5 and was also raised at an ACRS Subcommittee meeting on Emergency Core Cooling Systems held on July 31, 1985.
Safety Significance Upon loss of the main and auxiliary feedwater systems, the feedwater flow to the steam generators is insufficient to maintain level. As the level of water in the steam generators decreases, the average temperature of the RCS increases because of the reduced heat transfer from the primary to the secondary coolant systems. When all steam generators are "dry," the plant emergency procedure l requires the initiation of makeup /high pressure injection (MU/HPI) cooling of l the primary system.asc This method of decay heat removal is known as "feed-and-i bleed" or "bleed-and feed" depending on the HPI capability of the injection pumps and system design. When this method is initiated, the PORV and high point vents on the RCS, specifically the pressurizer, are locked open breaching one of the plant's radiological barriers and releasing radioactive coolant inside l
the c::.tainment building.sas MU/HPI is often considered a drastic action because of the radioactive contamination of the containment. Nevertheless MU/HPI cool-
[ ing provides a diverse method of core cooling if the main and auxiliary feedwater systems should fail.
This issue is based on an ACRS concern that the PORVs are not qualified for the "hostile" environment in which they are placed when used for feed-and-bleed operation. There are several reasons for this concern. PORVs are usually called j upon to respond when all other methodt of removing decay heat are not evailable.
The temperature, pressure, and moisture conditions of the containment environment can create a differential thermal expansion of the valve disc and body and may cause the PORV to stick sss f ailing open or closed, or the PORV can close shortly after beginning feed-and-bleed because of short circuits.
C,0NCLU510N Under USI A 45, "Shutdown Oecay Heat Removal Requirements " the NRC staff is investigating alternative means of decay heat removal in PWR plants using existing equipeent or devising new methods. The use of the "feed-and-bleed" procedure is included in this program as well as the need for environmental qualification of the PORV for this raethod of emergency decay heat removal.
Therefore, this issue is covered in USI A 45."'
O 06/30/88 3.125-6 NUREG-0933
Revision 3 E,
/ i
(,/ ITEM 125.1.3: SPDS AVAILABILITY a- ,
DESCRIPTION Historical Background This issue was identified as Item 10c in the EDO memorandums 9s and in a :
September 19, 1985, DHFS memorandum.900 The issue addresses the concern as to wh('.her NRC requirements should be revised regarding SPDS availability.
Investigations subsequent to the THI-2 accident have indicated a need for improving how information is provided to control room s 9rators both during normal aid abnorm 31 conditions. THI Action Plan Item I.u.2, "Safety Parameter Display System (SPDS)," required that licensees install a system to continuously display information from which the plant ' safety status can be readily assessed.
Generic Letter 8;l 33318 (Supplement 1 to NUREG-0737) mandated that licensees install ar, 5?DS. Licensee implementation of Item I.D.2 is revie"ed and tracked i as MFA F-09. The staff requirement imposed on the licensees dos. not contain specific reliability or availability requirements for the SP05.
The schedule for operating reactors to meet the requirements of Generic Letter 82-33378 was proposed to the Commission in SECY-33-484toa7 and formalized in confirmatory orders or licensing conditions. Some plants have incorporated the SPDS implementation into their.living schedules; however, other plants have not yet installed the SPDS. Staff actions on MPA F-09 are ongoing to perform NRC S post-implementation audits to determine the status of the plants that have
) installed the SPDS and to modify the schedule for those that have not.
A 1985 survey of six operating plants indicated that two of the plants did not have an operational SPDS although they indicated that they met the requirements of Item I.O.2 (MPA F-09). Three plants were identified as having SPDS avail-ability problems (less than desirable availability). At some of the plants, the SPDS presented potentially misleading information while others suffered from poor operator acceptance or lack of management support.
Recent post-implementation verification inspections have indicated that, of
, the 37 plants that claimed to have completed the implementation of M A F-09, less than 1/3 satisfactorily met all the SPDS req'uirements and were accepted by the NRC staff as operational. Fifty-five plants that claim to have completed the implementation of MPA F-09 have not yet been inspected. Fifteen plants ,
have r',t yet declared the implementation of the SPDS to be completed and three ;
plants have not yet scheduled the implementation of SPDS. ;
l Safety Significance ;
Events such as those that occurred at THI-2, Davis-Besse, Oconee, Rancho Seco, and others may have been less severe if an operable SPDS had been availsble to
. the operators. For the Davis-Besse event, "...The inoperability of the SPDS ,
i and lack of adequate indications of steam generator conditions contributed to ;
the control room operators not knowing that the steam generators were dry i
which, resulted in their failure to follow the appropriate procedures.us &
(
( The requirenants of MPA F-09 indicate that each operating reactor :.hould have a SPDS that will display to oper W ng personnel a minimum set of parameters in i
\ ,
t t 06/30/88 3.125-7 NUREG-0933 r
, --,- r - , . - , . , , , ,
. ,.n--- . . , .n , , , , ,n,, -
, , , - ,e n-n,,---c, _ -, - - - - . , - - - , - , , - - - . - .. . , , , - - - _ _ - _ . . , , - - . , - - - -
Revision 3 order to determine the safety status of the plant during normal and abnormal conditions. It should provide enough information to alert the control room operators who should then verify the information presented by the SPDS before taking any action to avoid a degraded core event. The parameters should provide, as a minimum, information about the following: reactivity control; reactor core cooling and primary system heat removal; reactor coolant system integrity; radioactivity control; and containment conditions.
The primary purpose of an available SPDS would be to display a full range of these important plant parameters in order to aid the control room personnel in determining the safety status of the plant during abnormal and emergency condi-tions and in assessing where abnormal conditions warrant corrective operator action to avoid a degraded core event. We assume that operators need all avail-able parameter inforrntion for their decision-making in avoiding a degraded core event and that a properly funct.ioning SPDS would result in a lower fre-quency of control room operator errors and a corresponding reduction in core-melt frequency. -
Possible Solution For the analysis of this issue, it is assumed that all plants have or will have installed an SPDS. It is conservatively assumed that, at 75% of the plants, the SPDS is not operational (i.e., not available for use) and that, at the remaining 25%, the SPDS is operational but, due to errors in design and/or construction, may provide misleading information to plant operators. For the resolution of this issue, we have assumed that improvements in design and hard-ware charges, as well as improved maintenance and test p ocedures, will be required to assure the availability of a properly functioning SPDS at all operating plants.
PRIORITY DETERMINATION Assumptions During the prioritization of a selected group of MPAs in October 1984, MPA F-09 was analyzed by PNL.1039 The PNL analysis evaluated the risk reduction benefit obtained by the design, installation, and maintenance of an operating SPDS. The PNL cost analysis evaluated the NRC and licensee costs expected for the design, procurement, installation, and operation of the SPDS over the expected plant lifetime.
The PNL risk analysis for MPA F-09 is based on NUREG/CR-32461040 and the IREP risk assessment for Arkansas Nuclear One, Unit 1 (ANO-1) ace NUREG/CP 3246104 deals with the risk reduction related to three improvements in the cor.h al room: (1) installatior of a SPDS; (2) installation of a margin to satu otion annunciator; and (3) Increased control room staf fing. Since the risk reduction associated with the availability of an operabie SPDS is the concern of 1,2s issue, the analysi' ., NUREG/CR-32461o40 was used and modified to sep matr cut the effect on co N-melt frequency due to having an operable SPDS. Tb m hct on core-melt frequency due to the SPDS was then carried through the m spriate event sequences and minimal cut sets in the IREP risk assessment to detarmine j the potential level of public risk afforded by an operable SPDS.
l For the purpose of the analysis of this issue, we have conservatively assumed that 75% of all plants have an SPDS which is installed but not operationally 06/30/88 3.125-8 NUREG-0933 I
l t
Revision 3 i
, available and 25% of the plants have an operational SPDS which provides mis-leading information. It is assumed that resolution of this issue would assure that all plants have a properly operating SPDS available and continuously in use.
Frequency Estimate The level of risk presented by having SPOS installed but not available is the [
same as not having an SPDS. Therefore the PNL risk analysis for MPA F-09 is '
used to estimate the risk reduction afforded by resolution of this issue (i.e., !
making the installed SPOS continuously available and correcting any existing l 1
design or operational deficiencies) for the 7YG population of the plants. For i the remaining 25% of the plants, which are assumed to have an SPDS which might i mislead the control room operators, we have assumed a two order of magnitude ;
increase in the frequency of failure to notice relevant annunciators, failure '
to properly diagnose the event, errors of omission in following emergency proce-dures, errors of commission in establishing HPI cooling and recovery factors for ope,ator err)rs and have repeated the PNL analysis using these modified probabilities for specific events in the cut set analysis.
The population of plants (75%) assumed to have an installed but unavailable i SPDS was estimated to consist of 60 PWRs and 27 BWRs with remaining life times of 32 years and 30.8 years, respectively. The event tree (HPI-PUMP-CM), which depicts failure of HPI, was assumed to be affected by the addition of an SPDS.
The event tree includes failure of adequate core cooling as the initiating ,
event and individual probabilities for the failure to notice relevant annuncia- l
- ) tors, failure to properly diagnose the event, + -'s of omission in following emergency procedures, errors of commission in . olishing HPI cooling, and recovery factors for various operator errors. ise base case probability from ,
NUREG/CR-3246to40 for the HPI-PUMP-CM event is 2.18 x 10-3 I In the SNL study of control room improvements (NUREG/CR-3246),2040 the addition [
of an SPDS in the control room was assumed to reduce the probability of the i operator failing to recognize the loss of margin-to-saturation annunciators }
} from 1.3 x 10 2 to 10 4 (an improvement in the recovery factor) and provide a !
- capability to detect omission of steps in the emergency procedure (an additional )
. path on the event tree with a failure probability of 10 4). The ad sted case .
probability of the HPI-PUMP-CM event was determined to be 4.4 x 10- !
i In the MPA F-09 analysis, PNL calculated the change in core-melt frequency
- using the ANO-1 ! REP analysis with the base case and adjusted case frequencies '
for the HPI-PUMP-CM event. The calculated change in core-melt frequency repre-sented the addition of an SPDS for each dominant sequence of events in which i the affected event (HPI-PUMP-CM) appears. For the purpose of determining the '
potential risk reduction for resolution of this issue for the 75% population t (i.e, improving availability of existing SPDSs), this is the same as the MPA :
F-09 analysis with and without the SPDS as determined by PNL. The affected i base case core-melt frequency (without SPDS) was calculated to be 1.04 x 10 8/RY and the adjusted case affected core-melt frequency (with SPDS) was calculated to be 2.09 x 10 7/RY. The core-melt frequency reduction (8.3 x 10 7/RY) deter-mined by PNL was assumed to be typical of all PWRs.1038 When the change in core-melt frequency for PWRs was multiplied by the appropriate dose conversion
,i t
06/30/88 3.125-9 NUREG-0933 i
Revision 3 factors, the number of affected PWRs (60) and their average remaining lifetime (32 years), a risk reduction of 3802 man-rem was estimated. The astimates of core-melt f requency and risk reduction for BWR plantt were determir.ed by pro-portioning the total core-melt frequency and total puulic risk from the ANO-1 IREP and Grand Gulf 1 RSSMAP risk assessments and multiplying the ratio to the PWR core-melt frequency and risk reduction estimates determined above. Core-melt frequency and total risk reduction estimates, due to the addition of an SPOS, of 6.1 x 10 7/RY ar.d 4,116 man-rem, respectively, were thus calculated for 27 affected BWRs for their average remaining lifetime (30.8 years). Thus, summing the BWR and PWR estimates, we calculated a total public risk reduction of 7,918 man-rem for resolution of this issue for the 75% population of plants assumed to have poor availability, based on PNL's MPA F-09 calculations.
We determined that the remaining 25% population of plants, which we assumed had an available SPDS capable of misleading the plant operators during abnormal operations, consists of 20 PWRs and 10 BWRs with a remaining life time of 32 years and 30.8 years, respectively. Due to the detrimental effect a faulty SPDS '
can have on a situation in the control room, we considered an increase in the probability of two orders of magnitude from the case where no SPOS was consid-ered, for the following parameters: failure to notice relevant annunciators, misdiagnosis, and errors of omission in the respective steps of the emergency procedures. Repeating the PNL MPA F-09 analysis of using the higher operator error values, we calculate a PWR HPI-PUMP-CH probability of 1.75 x 10 2 and, using the ANO-1 minimal cut sets, a PWR core-melt frequency of 8.76 x 10 6/RY.
Using the above ratioing technique we estimate a BWR core-melt frequency of 6.6 x 10 6/RY. Subtracting the base case ( ood SPDS continually available) estimated core-melt frequencies (2.09 x 10 g/RY for PWRs and 1.55 x 10 7/RY for 8WR5) from th' adjusted case values for the 25% pupulation of plants with
' faulty" SPDS, r -stimate a cere-melt frequency reduction of 8.55 x 10 6/RY for PWRs and 6.44 x 10 6/RY for BWRs.
Consequence Estimag Multiplying the core-melt frequency by the appropriate dose conversion factors, numoer of affected plants (20 PWRs and 10 BWRs) and their respective average remaining lifetimes (32 yrs for PWRs and 30.8 yrs for BWRs) we estimate a potential public risk reduction of 13,376 man-rem for the PWRs and 16,301 man-rem for the BWRs of the remaining 25% population of plants. Summing the PWR and BWP estimated risk reductions for the 25% population of plants assumed to have a faulty SPOS we estimate a total risk reduction for this fraction of the total population of plants of (13,376 + 16,031) man-rem or 29,407 man-rem.
Since resolution of the issue is assumed to both greatly improve availability of the SPOS and correct the deficiencies in those SPDS which may be "faulty,"
the total risk reduction estimated for the issue is (7,918 + 29,407) man-rem or 37,325 man-rem.
Cost Estimate Industry Cost: For the MPA F-09 cost analysis, PNL consulted industry vendors who supplied SPDS systems. PNL estimated an industry SPDS implementation cost of $3M/ plant equally divided between vendor procurement costs and licensee design and installation costs. For the purpose of this analysis, we assumed that modifications to an existinq SPDS to correct either severe availability 06/30/88 3.125-10 NUREG-0933
Rcvision 3 problems or design deficiencies cannot be accomplished for less than 10% of the original design, procurement, and installation cost. We, therefore, estimated a total industry implementation cost for this issue of $35.1M.
In the MPA F-09 analysis, PNL estimated 2 man-weeks /yr/ plant of industry ef fort required to operate, inspect, and maintain the SPDS. For this analysis, we estimate that one additional man week of industry maintenance and surveillance effort will be required per year to mair.tain and demonstrate adequate SPDS availability. We calculated a total present worth industry cost of $8.4M for operation and maintenance of an improved SPDS at all affected plants. We, therefore, estimated a total industry cost of $43.5M.
NRC Cost: We estimate that 12 man-weeks / plant of NRC effort would be needed to review the SAR on a modified SPDS, prepare an SER supplement, inspect the SPDS after its modification, and review and issue revised technical specifications for the operation and surveillance of the SPOS. The staff estimated the cost to be $270,000/ plant or $3.2M total cost for the safety issue resolution (SIR) implementation support. In addition we estimate that one man-week / plant /yr of NRC effort would be required to review and monitor the licensee's improved (expanded) maintenance and surveillance program. When costed out a $2.270/ man-week, an NRC present worth cost of $8.4M for SIR operation and maintenance review is estimated. We, therefore, estimate a total NRC cost of $11.6M.
Value/ Impact Assessment The value/ impact score derived from the above estimates is as follows:
- 37,325 man-rem ,
b _ 5(43.5 + 11.6)M '
= 677 man-rem /$M -
Other Considerations Control room instrumentation systems have been designed in compliance with GDC 13 and 19 of Appendix A to 10 CFR 50 and, as such, are required to provide the i' operators with the information necessary for safe reactor operation under normal, transient, and accident conditions. The SPDS is used in addition to the control room instrumentation system to aid and augment the control room instrumentation system. Revision 1 to NUREG 0737 requires that licensees develop procedures which describe the timely and correct safety status assessment when the SPDS is ,
and is not available. It also requires that operators be trained to respond to accident conditions both with and without the SPOS evailable. The SPDS is therefore viewed as enhancing the operator's perception and understanding of plant status under normal and abnormal conditions, but the SPDS is not essential #
to proper and timely diagnosis and effective recovery from abnormal events. ;
The normal plant instrumentation system is a redundant safety grade system. l The SPDS addition provides a diverse and improved diagnostic system but in itself is redundant to the plant instrumentation system, which by the nature of its design requirements, is redundant within itself.
1 06/30/88 3.125-11 NUREG-0933 A _ _ . _ _ _ _ _
I Revision 3 CONCLUSION The value/impacc score (677 mannem/$M) and the best estimate of potential public risk reduction (37,325 man-rem) place this item in the medium priority range. Since all modifications, maintenanco, and surveillance will be performed in the control room complex, there is no potential ORE expected fnr this issue.
The SPDS is a redundant (but enhanced) back-up system for the redundant, safety-grade control room plant instrumentation system. Intuitively, one would, there-fore, not suspect that the risk sensitivity to SPDS availability (7,918 man-rem) would be so great as to warrant improvements in SPDS availability regardless of cost. In addition, the risk analysis performed for this issue was performed conservatively assuming that poor availability meant 1WT unavailability of the SPOS for the population (75%) of plants assumed to suffer from less than desired availability.
If the availability concern were considered separately, i.e., the total population of plants (100%) were assumed to have an SPOS which is unavailable the maximum public risk contribution (calculated conservatively) would be about 10,400 man- rem. In this instance, a medium priority would be warranted unless the total cost per plant to increase availability significance were less than
$30,000, which seems highly unlikely.
If the smaller population of plants (30) assumed to have "faulty" SPDS (i.e.,
one which may mislead control room operators during their response to a tran-sient or LOCA) is considered separately, a much larger potentiel public risk contributien (29,407 man-rem) is estimated. This averages out to si;ghtly less than 1,000 man-rem / reactor for this smaller population. A medium prior-ity is appropriate for this concern unless the cost to modify the SPDS equip-ment to correct the design faults were less than approximately $300,000/ plant (10% of the SPDS original cost). We feel that reanalysis of design and equip-ment replacement or modification for less than 10% of the original procurement cost are unlikely.
Conversely, recognizing that the foregoing treatment of the case of the operator being misled is conservative, if one were to assume that there is no chance of the SPDS misleading the operator (i.e., no public risk impact), the priority assignment would be based solely on the risk potential associated with the availability concern and the issue would still warrant a medium priority assign-ment. Therefore, considering both the overall risk and cost calculations and the separate ef fects for the two separate concerns identified by the Davis Bese event (i.e., availability and design adaquacy) and the limited surveys of SPDS status at operating plants, the potential risk reduction and the value impact ratio would indicate a medium priority assigment.
As of June 1988, NRR has prepared a draft generic letter (
Subject:
Task Action Plan I.D.2 - Safety Parameter Display System) to provide all licensees, appli-cants, and construction permit holders the benefit of the staff's experience in order to aid them in acceptably implementing SPDS. The generic letter describes various methods used by some licensees / applicants to implement SPDS requirements in a manner that is acceptable to the staff. Also documented are design features found to be unacceptable as well as the staff's reasons for reaching this conclusion. Included are guidelines and specific exampl o for providing an SPDS with acceptable reliability (availability). We, therefore, ]
conclude that the solution to this issue has been identified and the issue is expected to be resolved with the issuance of the generic letter.
06/30/88 3.125-12 NUREG-0933 fx
Revision 3
) i
, x ITEM 125.I.4: PLANT-SPECIFIC SIMULATOR l DESCRIPTION Historical Background This issue was identified as Item 10c in an F00 memorandums 9s and was based on
" Findings 10 and 17 and Sections 6.1.1 and 6.1.2 of NUREG-1154.sse Following '
the Davis-Besse reactor trip, the operator manually initiated actuation of the Steam and Feedwater Rupture Control System (SFRCS) in anticipation of the auto-tatic initiation of the SFRCS; however, tne operator pushed the wrong buttons.
This was the first time he had manually actuated the SFRCS and had not received specialized classroom or simulator training on correctly initiating the SFRCS. 1 The buttons pusned by the operator activated the SFRCS on low pressure for each steam generator instead of low level. By manually actuating the SFRCS on low pressure, the SFRCS was signalled that both steam generators had experienced a steamline break or loak and the system responded, as designed, to isolate both steam generators. Thus, the operator's anticipatory action defeated the safety func. ion of the AFW system. The error was corrected within approximately one minute by resetting the SFRCS and, therefore, had no significant bearing on the <
outcome of the event. However, the lack of plant-specific simulator training '
was noted by the investigating team.
This event, however, was not the first event that indicated the need for plant-specific simulator training. The THI-2 event on March 28, 1979, clearly focused industry and NRC attention on the need for better human engineering in control l (A) v room design and for plant-specific simulator training. TMI Action Plan Task I.A48 contained a series of requirements related to simulator uses and develop-ments addressing short-term end long-term actions centered on simulator training.
Some of the Task I.A items 4s were subsequently integrated into the Human Factors ;
Program Plan (HFPP)sst which was develved in response to NUREG-08852to and l
.iection 306 of the Nuclear Waste Policy Act of 1982 (PL 97-425). In this '
regard, PL 97-425 required NRC to establish simulator training requirements for plant-licensed oporators and operator requalification examinations. Item I. A.4.1, Initial Simulator Improvement," has been completed; the "Long-ferm Training Simulator Upgrade" [ Item I.A.4.2(4)] will be completed upon publica- :
, tion of 10 CFR 55 and related NRC guidance on the evaluation of simulation j facilities.
Safety Significance A plant-specific simulator would improve operator actions and timing in response to plant transients and accidents. Thus, plant damage and possible core-melt accidents could be significantly reduced. This issue affects all licensed I nuclear power plants. :
Possible Solution i
The use of plant-specific simulators is being addressed in the proposed rule-making 057 amendments to 10 CFR 55 [TMI Action Plan Item I.A.4.2(4)]. This !
action will ccdify requirements that include the use of nuclear power plant !
simulators in initial and requalification examinations. In brief, the proposed !
rulemaking includes three choices for plants that are not the reference plant i for a simulator: (1) acquire a plant-referenced simulator that meets the l m
06/30/88 3.125-13 NUREG-0933
Revision 3 intent of Regulatory Guide 1.149;439 (2) use a simulator that conforms to Regu-latory Guide 1.149439 and has been demonstrated to be suitable; or (3) substi-tute any device or combination of devices that meets the requirements of 10 CFR 55.45(b) and would be approved by the NRC.
CONCLUSION Based on the above, the resolution of the need and use of plant-specific simu-lators is being addressed as part of the proposed rulemaking amending 10 CFR 55 under Item I.A.4.2(4). Thus, Issue 125.I.4 should be DROPPED as a separate issue.
ITEM 125.1.5: SAFETY SYSTEMS TESTED IN ALL CONDITIONS REQUIRED BY DBA This item is currently being prioritized.
ITEM 125.1.6: VALVE TORQUE, LIMIT, AND BYPASS SWITCH SETTINGS DESCRIPTION Historical Background One of the primary sources of failure of the Davis-Besse AFW isolation valves to reopen (see Issue 122.1) was ultimately traced to the torque, limit, and bypass switches which control the motor operators of the valves.940 During the event, these valves were closed due to an operator error, shutting off all AFW flow. Once closed, the resulting high differential pressure across the closed valves necessitated a relatively large force to start valve motion. The valve motor-operator torque bypass switches were not adjusted to accommodate such a force and manual operation was needed to reopen the valves.
Issue 122.1.a, "Failure of Isolation Valves in Closed Position," deals specifi-cally with the case of AFW isolation valves. However, at least some of the other motor-operated valveL in the plant are designed by the same people that designed the AFW system and virtually all the valves in the plant are maintained by the same crews. Therefore, the problems with torque, limit, and bypass switch set-tings are not limited to AFW systems, but may af fect any motor-operated valve in the plant. Moreover, such problems have a high potential for causing common mode failures since redundant trains are probably maintained by the same main-tenance personnel.
Safety Significance l
The safe'.y concern of this issue is exactly that of IE Bulletin No. 85-03,2038 l "Motor-0perated Valve Common Mode Failures During Plant Transients Oue to Im-proper Switch Settirgs." This Bulletin required all licensees to develop and implement a program to ensure that valve operator switches are selected, set, and maintained properly for all valves in the high pressure injection, core spray and emergency feedwater systems (including BWR RCIC), that are required to be tested for operational readiness in accordance with 10 CFR 50.55a(g).
O 06/30/88 3.125-14 NUREG-0933 1
Revision 3
[o)
Q /'
Possible Solution IE Bulletin 85-031036 should resolve the safety concern of this issue for switch settings on valve operators in these specific safety systems. The extension of this issue to other valves and/or extension of the issue to more general testing adequacy also needs to be considered. However, the general question of test adequacy for ail safety-related valves is the subject of Issue II.E.6.1, "Test Adequacy Study." Given the existence of II.E.6.1, there is no need to extend or generalize Issue 125.1.6.
CONCLUSION The safety concern of this issue is being addressed by IE Bulletin 85-031036 and in the resolution of Issue II.E.6.1. Thus, Item 125.I.6 should be DROPPED as a separate issue.
ITEM 125. I. 7: OPERATOR TRAINING ADEQUACY This item was broken down into two parts that were evaluated separately as shown below.
ITEM 125.I.7A: RECOVER FAILE0 EQUIPMENT DESCRIPTION
) Historical Background This issue is based upon Finding 8 of the Incident Investigation Team's (IIT) report 886 which states:
"The operators' understanding of procedures, plant system designs, and specific equipment operation, and operator training all played a crucial role in their success in mitigating the consequences of the event. However, if the equipment operators had been more familiar with the operation of the auxiliary feedwater pump turbine trip-throttle valve, auxiliary feedwater could have been restored several minutes sooner."
During the Davis-Besse event, both AFW turbines tripped on overspeed. These trips are not remotely resettable from the control room, but instead must be i
reset manually at the turbines. Two equipment operators were dispatched to the AFW turbines, but were unable to get the turbines running because they had never performed this operation before. (Hands-on practice of this task is not now a part of operator training.) The turbines were not started until after the arrival of a more experienced operator.
Safety Significance The safety significance of this issue lies in the probability of nonrecover-ability of safety systems. In many cases, a given train of a given system may trip or otherwise fail to start on first demand, but may still successfully be Q placed in operation by prompt, knowledgeab13 human intervention.
06/30/88 3.125-15 NUREG-0933
Revision 3 Possible Solution TMI Action Plan Items I.A.2.2 and I.A.2.6 have addressed the issue of training and resulted in a policy statement 966 that endorsed the Institute of Nuclear Power Operations-managed training accreditation program which includes an ele-ment toprograms.
training ensure that feedback from operating events is included in all utility NRC monitors and evaluates industry implementation of the INP0 accreditation program to ensure that: (1) plant personnel are able to meet job performance requirements; (2) training properly accounts for pertinent safety of issues; training and (3) mechanisms exist for upgrading and assuring the quality programs. Criteria to evaluate the industry training programs have been developed in NUREG-1220993 in the resolution of Human Factors Issue HF2.1.
CONCLUSION This issue has been resolved by the issuance of the Commission Policy State-ment 966 on Training and Qualifications and by Issue HF2.1. Therefore, a new and separate issue for this concern is not warranted and the issue should be DROPPED from further consideration.
ITEM 125.1.7.B: REALISTIC HANDS-0N TRAINING DESCRIPTION Historical Background The issue calls for an assessment of the adequacy of hands-on training with respect to conditions that may be encountered in realistic situations, such as the loss of feedwater event that occurred at the Davis-Besse plant on June 9, 1985.940 The assessment may involve the operator's understanding of procedures, plant systems designs, specific equipment operations, and hands-on training in handling plant transient and upset conditions.
The issue stems from Findings 8 and 16 of the NRC investigation 886 of the Davis-Besse event in which the NRC staff noted that the post-THI improvements that focused on E0Ps and training played a crucial role in mitigating the Davis-Besse event. However, if the equipment operators had been more familiar with the operations of the AFW pump turbine trip throttle valve, AFW could have been restored several minutes sooner. Also, for events such as the Davis-Besse event involving conditions outside the plant design basis (multiple equipment failures), operator training and operator understanding of systems and equip-ment are crucial to the likelihood that plant operators can successfully handle similar events.
Safety Significance Assessments of the hands-on experience, referred to as performanct-based training or Systems Approach to Training (SAT), are considered essential to providing as-surance that nuclear power plants are operated in a safe state under all operat-ing conditions. This issue effects all operating nuclear power plants.
O 06/30/88 3.125-16 NUREG-0933
1 1
Revision 3 i
A \
Q Possible Solution TMI Action Plan 48 items I.A.2.2 and I.A.2.6 included development of procedures to provide assurance that: (1) plant personnel are able to meet job perfor-mance requirements; (2) training properly account for pertinent safety issues; and (3) mechanisms exist fnr upgrading and assuring the quality of training programs.
To help meet these objectives, NUREG-1220980 was developed for use by NRC person-nel to review the INP0-managed performance-based training programs in nuclear '
power plants. NRC will continue to closely monitor the process (INPO Accredita-tion) and its results to independently evaluate implementation of these programs.
The NRC review procedures developed in NUREG-1220893 considered the following five elements as essential to these training programs: (1) systematic analysis of the jobs to be performed; (2) learning objectives that are derived from the analysis and that describe desired performance after training; (3) training design and implementation based on the learning objectiver; (4) evaluation of trainee mastery of the objectives during training; and (5) evaluation and revi-sions of the training based on the performance of trained personnel in job settings (hands-on experience).
In accordance with NUREG-0985,851 the training issues included the closeout of the following TMI Action Plan 48 items: 1.A.2.2, "Training and Qualifications of Operations Personnel"; I.A.2.7, "Training Accreditation"; I.A.2.5, "Plant Orills";
and I.A.2.3, "Acministration of Training Programs." The specific issue of real-3 istic hands-on training on equipment such as AFW pumps is a performance-based element of on-the-job training (0JT). As such, mastery is determined by comple-
[Q 1
tion of a job qualification card to the satisfaction of a qualified OJT instruc-tor using approved evaluation criteria. The INPO Accreditation Program is in-tended to provide assurance that such training is included in industry programs.
NRC evaluates industry implementation of the Accreditation Program in accordance with the Policy Statement on Training and Qualification.S88 CONCLUSION Based on the above discussion, this issue is covered by the Policy Statement9ss on Training and Qualifications and by the Human Factors Issue HF3.1. Therefore, a new and separate issue for this concern is not warranted and the W ue should be DROPPED from futher consideration.
ITEM 125.I.8: PROCEDURES AND SfAFFING FOR REPORTING TO NRC EMERGENCY RESPONSE CENTER DESCRIPTION Historical Background This issue is based upon Finding 12 of the IIT report 888 which states:
"The event was not reported to the NRC Operatiuns Center 'n a manner reflecting the safety significance of the event. The more serious the event, the more operator involvement required to O maintain plant safety. For example, if the June 9 event had been U
06/30/88 3.125-17 NUREG-0933 l
Revision 3 protracted, knowledgeable personnel would not have been available to maintain an open telephone line with the NRC."
Safety Significance It is evident from the IIT reportssc of the event that there were two problems:
one associated with staffing and one associated with procedures. The staffing problem was that all knowledgeable persunnel were kept busy in dealing with the event. No one could be spared to keep the NRC Operations Center informed.
Moreover, even if more plant staff had been available, it is likely that these additional persons would have been pressed into service for plant operations.
Of course, bringing the plant to a safe condition does and should have priority.
But this also calls into question the usefulness of the dedicated phone lines to the NRC Operations Center.
The procedural problem was evident in the fact that there was confusion because the emergency plan was silent on how to determine the emergency action level if the emergency classification thanged during the event. Obviously, the emergency procedures contained soae ambiguity.
For both problems, the result is a delay in notification of the NRC Operations Center. Although it can be argued t.'at notification of the NRC can have little or no effect on plant events in the st. ort term, tha NRC can provide technical support and assistance over a period of several hours. Moreover, the NRC can assist in coordinating evacuations, etc., if such should ever prove necessary.
Finally, the NRC has other responsibilities not directly related to plant safety but nevertheless of importance, such as providing accurate and timely information to the public, other government agencies, and the governments of other nations.
CONCLUSION The staffing problem is a duplication 1003 of the concern of THI Action Plan 48 Item III.A.3.4, "Nuclear Data Link." In addition, the procedural problem has already been addresstd in existing regulatory requirementi (10 CFR 50.72) and IE Information Notice No. 85-80. Furthermore, the IE Manual addresses the NRC regional responsibility for assuring that these reporting requirements are met.3003 This issue consists of two problems: the first is a duplication of TMI Action Plan 48 Item III.A.3.4 (which has been resolved) and the second has been resolved independently.2003 Therefore, this issue should be DROPPED f rom further con-sideration as a separate issue.
ITEM 125.11.1: NEED FOR ADDIlIONAL ACTIONS ON AFW SYSTEMS During the event, the main feedwater system was lost and the reactor scrammed.
The AFW system should have activated and supplied feedwater to the steam geriera-tors to enable them to remove decay heat. However, during the course of the event, several failures occurred (see issue 122) that precluded using the steam generators to remove decay heat from the primary system, lhe event highlighted the importance of the AFW system and also demonstrated that the AFW system might not have a reliability commensurate with its importance.940 06/30/88 3.125-18 NUREG-0933 1
1 Revision 3 If the main feedwater system shuts down for any reason, the AFW system will supply sufficient feedwater to the steam generators to remove reactor decay heat. If the AFW system were to fail also, there would be no feedwater supply at all. The steam generators would boil off their remaining liquid water inven-tory and then dry out. Depending on specific plant design, core uncovery will take place roughly 30 to 90 minutes after the transient begins. After steam generator dryout, there would be no decay heat removal and the continuing thermal energy production in the core would result in primary system heatup.
In most cases, the only means of decay heat removal involve use of the AFW sys-tem, recovery of the main feedwater system, or the use of feed and-bleed tecn-i niques. Of the three means, the use of the AFW system is subject to the highest availability. The failure of the main feedwater system has roughly a 20% prob-ability of not being recoverable in time. Moreover, use of feed-and-bleed tech- '
niques will release primary coolant to the cor.tainment necessitating extensive (and expensive) cleanup. The use of feed-and-bleed techniques, which remove decay heat by venting hot primary coolant to the containment and replacing the lost inventory in the primary system by means of the high pressure ECCS, could
- still prevent core uncovery. If feed-and-bleed fails, the primary system will increase in temperature and pressure to the point where the primary system safety 1 valves open. The pressure increase will then terminate, but the primary coolant will boil off until the core is uncovered and melts.
}' [
J AFW systems are safety grade systems. In addition, the availability of feed-and-bleed techniques provides a diverse backup. Nevertheless, AFW reliability is very important for two reasons. First, loss of main feedwater is a relatively i
, common event, occurring roughly three orders of magnitude more often than (for i example) small break LOCAs. Thus, the AFW system is challenged far more often j
than the high pressure ECCS and therefore has a commensurately greater need for high reliability. Second, although feed-and-bleed techniques provide a backup to AFW for removing reactor decay heat, feed-and-bleed is a means of core cool- ,
ing for which the plant was not designed and may have a relatively high failure :
probability (see Item 125.11.9). Because of these two reasons (frequent challenges and poor backup capability), it is very important that the AFW system ,
have very high r0 liability. '
Because loss of feedwater events are relatively frequent, the AFW system is subject to frequent challenges. Therefore, the AFW system must be character-ized by very high availability. This issue consists of four parts, each of which seeks to ensure adequate AFW reliability:
(a) Two-Train AFW Unavailability i This issue is concerned that AFW systems consisting of enly two-trains ,
, may not have adequate reliability. !
(b) Review Existing AFW Systems for Single Failures I lhis issue seeks confirmatory deterministic reviews of AFW systems at :
operating plants to ensure that they meet the single failure criterion. '
. l (c) NUREG-0737 Reliability Improvements This issue proposes that PRA analyses (i.e. fault trees) be performed on [
- AFW systems at operating plants to ensure adequate reliability. '
L
)
1 06/30/88 3.125-19 NUREG-0933 [
, :i
Revision 3 (d) AFW Steam and Feedwater Rupture Control System /ICS J teractions in B&W Plants This issue is concerned explicitly with a possible design problem at B&W plants.
These four parts of the issue are prioritized separately below.
ITEM 125.II.1.A: TWO-TRAIN AFW UNAVAILABILITY DESCRIPTION There are seven older PWRs that have two-train AFW systems. (Originally, there were more but some plants have since added a third train or made other equiva-lent upgrades). These AFW systems generally consist of one motor-driven train and one turbine-driven train and thus possess some diversity as well as redun-dancy. However, the turbine-driven trains have not proven to be as reliable as the motor-driven trains (except, of course, for the case where all AC power is lost). The more modern practice has been to use a three-train system where two trains are motor-driven and one is driven by a steam turbine. Such a system will, in principle, be more reliable than the two-train systems described above, both because of the greater redundancy of the three vs. two trains and because of the lower reliance on the steam turbine.
CONCLUSION This issue is the same as Issue 124, "AFW System Reliability." Issue 124 will consider whether AFW system unavailability needs to be improved for plants with two-train designs. m Therefore, this issue should be DROPPED as a separate issue.
ITEM 125.II.1.B: REVIEW EXISTING AFW SYSTEMS FOR SINGLE FAILURE DESCRIPTION Historical Background The AFW system is considered an engineered safety feature and t!us is required to meet the single failure criterion which can be considered a very primitive reliability requirement. An unsuspected single failure susceptibility could increase the AFW system failure probability by two orders of magnitude or more.
Safety Significance The issue addresses the concern that there may be some unsuspected single fail-ures which were not detected during the licensing process. Therefore, this issue proposes to re-review the AFW systems of all operating PWRs to make doubly sure that no single failures exist which by themselves could cause all AFW trains to fail.
Possible Solution The systems to be examined have already been subjected to licensing review.
Therefore, any single failures are not going to be obvious, but instead are 06/30/88 3.125-20 NUREG-0933
Revision 3
\ likely to be quite subtle. Very thorough reviews will be required. It must also be remembered that AFW trains are intentionally designed to be independ;!nt.
Any single failure found is most likely to be a subtle design anomaly which the designer (as well as all subsequent reviewers) failed to notice.
Several AFW systems have been examined by OIE in the course of the Safety System Functional Inspection (SSFI) program. Conversations with the SSFI team have indicated that some single failure problems as well as other potential common mode failures have been found by this program. However, these problems were not discovered by examining system design, but instead arose in the course of very thorough investigations involving extended site visits, equipment in-spection, and interviews as well as design reviews. Therefore, the proposed solution is not a simple design review, but instead is a more thorough investi-gation along the lines of the SSFI program.
Frequency Estimate The sequence of interest is straightforward. It is initiated by a non-recoverable loss of main feedwater. If the AFW system fails, the SUFP is not re enabled in time, and feed-and-bleed techniques fail, core-melt will ensue.
For the initiating event frequency (non-recoverable loss of main feedwater willuse0.64 event /RY,basedupontheOconeePRAdonebyDukePowerCo.94),we This figure is based upon fault tree analysis and should be reasonably representative of most main feedwater system designs.
For a three-train AFW system, a "typical" unavailaoility is 1.8 x 10 5/ demand.894
) The presence of a single failure susceptibility will greatly increase this
./ figure to perhaps the square root of the original figures because half the redundancy would be removed. The change in AFW unavailabiiity would then be about 4.:. x 10 3 failure / demand. We will assume a typical value of 0.20 for the failure probability of feed-and-bleed cooling, based upon the calculations presented under Issue 125.11.9, "Enhanced Feed-and-Bleed Capability." Hulti-plying these figures out, the change in core-melt frequency is:
(0.64/ year)(4.2 x 10.a)(0.20) = 5.4 x 10 4/ year Consequence Estimate The core-melt sequence under consideration here involves a core-melt with no large breaks initially in the reactor coolant pressure boundary. The reactor is likely to be at high pressure (until the core malts through the lower vostel head) with a steady discharge of steam and gases through the PORV(s). These are conditions likely to produce significant hydrogen generation and combustion.
The Zion and Indian Point PRA studies used a 3% probability of containment failure due to hydrogen burn (the "gamma' failure). We will follow this example and use 3%, bearing in v.ind that specific containment designs may differ signif-icantly from this figure. In addition, the containment can fail to isolate (the "beta" failure). Here, the Oconee PRA figure of 0.0053 will be used. If the containment does not fail by isolation failure or hydrogen burn, it will be assumed to fail by basemat melt-through (the "epsilon" failure).
Using the usual prioritization assumptions of a central midwest plains meteorology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequences are:
06/30/88 3.125-21 NUREG-0933
Revision 3 Failure Percent Release Consequences '
Mode Probability Category (man-rem) gamma 3.0% PWR-2 4.8 x 108 beta 0.5% PWR-5 1.0 x 108 epsilon 96.5% PWR-7 2.3 x 103 The "weighted-average" core-melt will have consequences of 1.5 x 105 man-rem.
There are 80 PWRs operating or under construction. As of March 1988 (the earliest that any hardware changes are likely to be made), these 80 plants will have a combined remaining license lifetime cf 2508.4 calendar years. At a 75%
capacity factor, this is about 23.5 years of operation per plant. Thus, the estimated risk reduction associated with the possible solution to this issue is (5.4 x 10 4)(23.5)(1.5 x 10 5) man-rem / reactor or 1904 man-rem / reactor.
Cost Estimate Th( SSFI program has required about 1000 staff-hours per plant and system.
This is about $50,000 of salary and overhead. In addition, hardware changes are likely to cost on the order of $100,000 per plant (i.e. more than $10,000 but less than $1,000,000) plus another $50,000 in paperwork. Thus, we will assume a cost on the order of $200,000/ plant.
Value/ Impact Assessment Based on a potential risk reduction of 1,904 man-rem / reactor and a cost of
$0.2M/ reactor, the value/ impact score is given by:
S = 1,904 man-rem / reactor 50.2M/ reactor
= 9,520 man-rem /$H -
Other Considerations (1) The AFW system and its support systems do not contain contaminated fluids and are located outside of containment. Thus, there is no ORE associated with the fix for this issue. -
(2) Averted accident costs and averted cleanup exposure are considerations, but will only drive the priority figures still higher. Thus, they will change no conclusions and will not be treated here.
(3) The high values of the parameters are predicated on finding at least one plant that needs upgrading. The SSFl personnel emphasized that this is not likely to happen without an approach similar to that of the SSFI, but such an approach h likely to bear f ruit. It may be feasible to incorpo-rate this issue into the SSF1 program.
CONCLUSION Based upon the figures generated above, this issue was given a high priority, but was later integrated into the Phase 11 activities scheduled for the re'olu-tion of Issue 124.57a Thus, this issue is now covered in Issue 124.
06/30/88 3.125-22 NUREG-0933
Revision 3 ITEM 125.II.1.C: NUREG-0737 RELIABILITY IMPROVEMENTS J
OESCRIPTION Historical Background After the THI-2 accident, all PWR licensees were asked to perform an unavailabil-ity analysis of their AFW systems. This information is now somewhat out of date partly because the AFW systems were subject to some (NUREG-0737)S8 modifi-cations after the analyses were made948 and partly because the analyses them-selves are rather primitive by modern standards.
Safety Significance This item seeks to upgrade the AFW unavailability analyses to reflect the NUREG-073798 modifications and improvements and to ensure that the AFW system reliability is commensurate with the system's safety importance.
Proposed Solution l
The proposed solution for this issue is to perform a PRA of all AFW systems and require modification of any systems which have an unacceptably high failure probability.
PRIORIfY DETERMINATION Issue 124, "AFW System Reliability," will consider whether seven PWRs with two-train AFW systems have AFW system unavailabilities that need to be improved.
Therefore, this issue need cover only the three-train AFW systems.
To prioritize this issue, several questions need to be answered. First, how reliable must the AFW system be to have reliability commensurate with its safety importance? Generic Issue 124 has selected an unavailability of 10 4 failure /
demand as the upper limit of acceptability.947 he will use this same figure.
The second question is, how many plants are likely to be found which cannot meet the 10 4 failure / demand cutoff? Analyses of ten three-train AFW designs are summarized in an RRAB memorandum 894 as follows:
Design Failure / Demand log (failure / demand)
Summer 1 1.2 x 10 5 -4.92 McGuire 2.0 x 10 5 -4.70 Comanche Peak 2.0 x 10 5 -4.70 i Diablo Canyon 3.7 x 10 5 -4.43 1
San Onofre 2&3 2.2 x 10 5 -4.66 SNUPPS 2.0 x 10 5 -4.70 Waterford 1.4 x 10 5 -4.85 Midland 1.0 x 10 5 -5.00 Seabrook 2.0 x 10 5 -4.70 Catawba 0.7 x 10 5 -5.15 Arithmetic Hean: 1.8 x 10 5 Arithmetic Standard Deviation: 8.4 x 10 8 Logarithmic Mean: -4.78 i Logarithmic Standard Deviation: 0.22
)
06/30/88 3.125-23 NUREG-0933
Revision 3 These 10 analyses can be considered a statistical sample. The cutoff of 10 4 O
failure / demand is 9.76 standard deviations above the mean on a linear scale and 3.55 standard deviations above the mean on a logarithmic scale. The shape of the distribution is unknown, of course, but we will examine both a normal and a log normal distribution and use the worst case. Based upon these distributions and in the absence of any other information, if another three-train AFW design were evaluated, the probability of this new design being above the cutoff is:
Normal Distribution: essentially zero Log Normal Distribution: 2 x 10 4 What this means is that 10 sample designs are all well below the cutoff. Had the sample average been close to just below 10 4, one would be confident of finding a plant or two over the limit. H; wever, the mean is far below the limit (where "far" is defined in terms of the width of the distribution) and the per-plant probability of being over tte limit is small.
There are 80 PWRr operating or under construction. Seven of these have two-train AFW systems and are covered by Issue 124; this leaves 73 plants. The probability greater thanof10detecting 4/ demand one is: or more of these plants with an AFW unavailability 1 - (1 - 2 x 10 4)'3 = (73)(2 x 10 4) 2 0.014 That is, based upon the available knowledge regarding three-train AFW designs and in the absence of other information, a PRA of all three-train AFW systems has only a few percent chance of finding a system that needs upgrading.
does not mean that these AFW systen are problem free. It does mean that(This the problems probably will not be found by means of PRA, unien considerably more information is available.)
Frequency Estimate The sequence of interest is straightforward. It is initiated by a non-recoverable loss of main feedwater. If the AFW system fails and feed-and-bleed techniques fail, core-melt will ensue.
For the initiating event frequency (non-recoverable loss of main feedwater) we will use 0.64 event /RY, based upon the Oconee PRA done by Duke Power Co.947, This figure is based upon fault tree analysis and should be reasonably representative of most main feedwater system designs.
Next, the change in AFW failure probability must be estimated. We will assume that the AFW system "as is" has an unavailability equal to that of a "typical" two-trainAFWs{stemwhichwouldbeabout6.7x104/
seven plants.94 demand,theaverageofthe The AFW system failure probability after upgrading would be at most 10 4 Therefore, the change in probability would be about 5.7 x 10 4 We will assume a typical value of 0.20 for the failure probability of feed-and-bleed cooling, based upon the calculations presented under Issue 125.II.9, "Enhanced Feed-and-Bleed Capability." Multiplying these figures, the change in core-melt frequency is:
(0.64/ year)(b.7 x 10 4)(0.20) = 7.3 x 10 5/ year 06/30/88 3.125-24 NUREG-0933
Revision 3 Q(3 The nut.ber of hypothetical plants needing modification (expectation value) is 0.014. Thus, the change in core-melt frequency for all reactors is 10 8/ year.
Consequence Estimate The core-melt sequence under consideration here involves a core-melt with no large breaks initially in the reactor coolant pressure boundary. The reactor is likely to be at high pressure (until the core melts through the lower vessel head) with a steady discharge of steam and gases through the PORV(s). These are conditions likely to produce significant hydrogen generation and combustion.
The Zion and Indian Point PRA studies used a 3% probability of containment fail-ure due to hydrogen burn (the "gamma" failure). We will follow this example and use 3%, bearing in mind that specific containment designs may differ signif-icantly from this figu.'e. In addition, the containment can fail to isolate (the "beta" failure). Here, the Oconee PRA figure of 0.0053 will be used. If the containment does not fail by isolation failure or hydrogen burn, it will be assumed to f ail by basemat melt-through (the "epsilon" failure).
Using the usual prioritization assumptions of a central midwest plains meteor- ;
ology, a uniform population density of 340 persons per square mile, a 50-mile '
radius, and no ingestion pathways, the consequences are:
Failure Percent Release Consequences Mode Probability Category (man-rem) gamma 0.3% PWR-2 4.8 x IOS T beta 0.5% PWR-5 1.0 x 106 epsilon 96.5% PWR-7 2.3 x 103 The "weighted-average" core-melt will have consequences of 1.5 x 105 man-rem.
Because this issue deals with only an expectation value for the number of plants, but does not necessarily expect to affect any specific plant, the per plant parameters (core-melt /RY and man-rem / reactor) are not meaningful. Instead, the "aggregate" parameters (core-melt / year and total man-rem) are appropriate.
As of March 1988 (the earliest that any changes are likely to be made), the 73 subject plants will have a combined remaining life of 2317.8 calendar years.
At a 75% capac!t/ faclae, tMs wurns out to an average of 23.8 years of opera-tion remaining per plant.
Therefore, the change in risk for the hypothetical plant is 11 man-rem / year and the total risk reduction for all reactors is 3.7 man rem.
! Cost Estimate The costs involved would include administrative charges, the costs of the PRAs, and possibly costs of hardware changes, should they be required. It is not i clear at this point whether the PRAs would be done by the licensees or the NRC. !
In any case, the cost of the PRA of one AFW system is likely to be on the order of $50,000 or more (half a staff year). For 73 plants, this is $3.65M. We will not calculate the administrative and hardware costs, but inttead will use the $3.65M as a minimum figure.
<V 06/30/88 3.125-25 NUREG-0933
Revision 3 Value/ Impact Assessment Based on an estimated risk reduction of 3.7 man-rem and a minimum cost of $3.65M associated with the possible solution, the value/ impact score is given by:
3.7 man-rem I
$3.65M 5 1 man-rem /$M Other Considerations (1) The statistical logic presented above does not rule out specific systems needing attention. The proper conclusion is that, unless mois infomation is forthcoming (for example, specific design or performance problems), a non-specific general search such as this is difficult to justify because there is no specific reason to believe a problem will be found this way, based on past experience. Also, the continuous distribution assumption implies that design anomalies, such as the single failures of Item 125.II.1.B. have been fixed. This item must not be viewed in isolation.
(2) Issue 124, "AFW System Reliability," in addition to its attention to plants with two-train AFW systems, also is considering whether to require confir-mation that the remaining PWRs have AFW system reliabilities that are less than 10 4/ demand. However, Issue 124 has not produced a decision at this time, nor does a decision appear to be forthcoming in the near future.
Therefore, this issue cannot be subsumed within Issue 124.
(3) In most cases, the fix will not involve work within radiation fields and thus will not involve ORE.
(4) The ORE averted due to post-feed-and-bleed cleanup and post-core-melt cleanup is a minor consideration. ORE associated with cleanup is esti-mated to be 1800 man-rem after a primary coolant spill and 20,000 man-rem after a core-melt accident.64 If the frequency of feed-and-bleed events is 5 x 10 6/ year, the actuarial cleanup ORE averted is only 0.2 man-rem.
Similarly, a total core-melt frequency of 10. 6/ year corresponds to an actuarial averted cleanup ORE of only 0.5 man-rem. If averted ORE were added to the man-rem / reactor and man-rem /$M figures above, no conclusions would change.
(5) The proposed fix would reduce core-melt f requency a.;d the frequency of feed-and-bleed events and, therefore, would avert clear.up costs and re-placement power costs. The cost of a feed-and-bleed usage is dominatad by roughly six months of replacement power while the cleanup is in progress.
If the average frequency of such events is 5 x 10 8/ year and the average remaining lifetime is 31.7 calendar years at 75% utilization, then making the usual assumptions of a 5% annual discount rate and a replacement power cost of $300,000/ day, the actuarial savings for feed-and bleed cleanup are
$3,300. Similarly, the actuarial savings of averted core-melt cleanup (which is assumed to cost one billion dollars if it happens) are about
$12,000. The actuarial savings from replacement power aftar a core-melt up to the end of the plant life are also about $12,000. (This last figure 06/30/88 3.125-26 NUREG-0933 l
Revision 3 l represents the lost capital investment in the plant.) If these theoretical cost savings were subtracted from the expense of the fix, the man-rem /$H would not change significantly.
CONCLUSION Based upon the figures above, this issue should be DROPPED from further ,
consideration. l ITEM 125.11.1.D: AFW STEAM AND FEEDWATER RUPTURE CONTROL SYSTEM /ICS INTERAC-TIONS IN B&W PLANTS i l
DESCRIPTION j This issue is centered upon the subject of the reliability of the AFW system which is safety grade. This item is targeted specifically at B&W plantsS40 and )
would require a reexamination of the AFW system reliability.94s The reasons given are two-fold. First, assessments made shortly after the TMI accident ;
indicated that the AFW system in B&W plants had (at that time) an unavailabili- i ty approximately an order of magnitude higher than those in neost other PWRs.848 (This does not account for the subsequent modifications to these AFW systems.)
Second, this item calls for explicit attention to the interactions between the l
AFW system and the Steam and Feedwater Rupture Control System (SFRCS) and between the AFW system and the Integrated Control System (ICS), Such interactions are l
important because the initiating transient may well be caused by a problem with l j the ICS and any possible interactions between the ICS and AFW or SFRCS would be a potential source of a common mode failure, defeating the system needed to I mitigate the transient. l PRIORITY DETERMINATION l OnthegeneralquestionofAFWunavailability,theB&Wplantshavealreadg4S (
updated their reliability analyses to reflect the post-THI modifications. !
These updates have satisfied the original concern.849 The specific issue of the ICS-SFRCS-AFW Interactions deserves more discussion. !
The function of an SFRCS is to control the AFW system. The name (Steam and i Feedwater Rupture Control System) is somewhat misleading in that the SFRCS also l in tiates AFW for loss of main feedwater events. Those plants with an SFRCS i
should have no interactions between the ICS and the SFRCS or AFW systems.
There ate some B&W plants that have used the ICS to control the AFW system. Of
- these, two plants (Crystal River and ANO-1) have installed an "Emergency Feed-water Initiation and Control (EFIC) System" to replace the ICS as the control 1 system for AFW. (The EFIC system is an improvement over SFRCS in that the EFIC l 1 system will not allow both steam generators to be isolated simultaneously. The y
SFRCS at Davis-Besse has also been modified such that it will no longer allow i j both steam generators to be isolated simultineously.) Of the two remaining !
plants, Rancho Seco will install an EFIC system at its next refueling outage j and THI-1 will install a system similar to EFIC, but designed by the licensee, ,
at its next refueling outage. l i
l 1
06/30/88 3.125 27 NUREG-0933 l l-t
Revision 3 Under these circumstances, the concern is not with SFRCS-AFW interactions, but instead reduces to ensuring that there is no interaction between the ICS and the AFW or its control system that can cause a comon mode failure. For plants with 124.
two-train
'940 AFW systems, this will be covered by the analyses of Issue The remaining plants will be examined under the B&W Reassessment Program which places considerable emphasis on the ICS.950 CONCLUSION This item is covered in Issue 124 and the B&W Reassessment Program and should be DROPPED as a separate issue.
ITEM 125.11.2: E Y OF EXISTING MAINTENANCE REQUIREMENTS FOR SAFETY-RELATED DESCRIPTION Historical Background The objective of this issue is to assess the adequacy of existing maintenance requirements and their impact on the reliability of safety-related systems.94 The IIT concluded that the underlying cause of the Davis-Besse event was the licensee's lack of attention to detail in the care of plant equipment.886 Safety Significance Inadequate and/or improper maintenance of equipment, components, and systems relied on for safe operations of the plants can lead to loss of safety func-tions. The loss of safety functions of the safety-related systems can increase the severity of transients and lead to severe core damage and possibly a core-melt. Given a core-melt and loss of containment integrity, public radiation exposure would result from the release of fission product materials. The issue is applicable to all operating nuclear power plants.
Possible Solutions For the Davis-Besse plant, the staff conducted a maintenance survey consistent with the H K Maintenance and Surveillance Program Plan (MSPP) as a result of the 11T o nclusions.886 As a result of the survey, the staff identified a number of weaknesses impeding the conduct of maintenance activities at the Davis-Besse plant,tott A subsequent NRC follow-up survey of the Davis-Besse maintenance activities in March 1986 indicated that the licensee had made con-siderable progress in all maintenance areas except maintenance backlog since the previous survey. Particular strengths noted were in the areas of mainte-nance training, spare parts, and material readiness. Based on the results of the March 1986 survey, the NRC concluded that the Davis-Besse new maintenance organization was functioning as planned, and no major identifiable weaknesses were evident. The few remaining problem areas noted by the staff were not con-sidered programmatic weaknesses th3t would adversely affect the functioning of the maintenance organization.1011 0
06/30/88 3.125-28 NUREG-0933
l Revision 3 4
In response to Issue 3 of the Commission Policy and Planning Guidance,2to the I staff developed the MSPP that consisted of two phases: Phase I and Phase II.
The findings of the Phase I activities are reported in NUREG-1212.1013 Essen- !
tially, the Phase I objectives (which are complete) have addressed the objec- :
tives of this issue. In brief, Phase I of the MSPP was designed to survey current naintenance practices in the nuclear utility industry, evaluate their effectiveness, and address the technical and regulatory issues of nuclear power plant maintenance. !
i
, Thirty-one measures of maintenance were developed for Phase I of the MSPP.
These measures were ther, organized into the following five categories:
(1) overall system / component reliability; (2) overall safety system reliabil-ity; (3) challenges to safety systems; (4) radiological exposure; and (5) regu- ;
latory assessment. An analysis of the overall trends and patterns across the !
above five categories of maintenance revealed several important trends. In general, although plant maintenance performance showed some improvement from 1980 to 1985, the safety systems reliability for all plants did not signifi-cantly change since 1981. Thus, the contribution of maintenance to reliabil-ity problems indicated that some maintenance programs and practices are not effective. The Phase I findings confirmed that there are wide variations in maintenance practices among utilities and the industry has established a variety of programs aimed at self-improvement that do not appear to be well-integrated or effectively implemented in some cases. The resolution of the issues identi-i fled in Phase I of the MSPP will be addressed in Phase II of the fiSPP.
The Phase !! activities of the MSPP are being addressed under Issue l'F8. In ;
brief, Phase II of the MSPP requires the staff to: (1) gather data to support [
a definition of the role of maintenance in safety; (2) develop goals for plant reliability in ensuring effective maintenance; (3) assess data to determine performance-oriented maintenance criteria; (4) make recommendations for en- '
dorsement of good maintenance practi es; (5) recome N improvements te th?
maintenance / operations interface; @ ) provide input co draft industry standards for maintenance; and (7) assess industry programs in self-improvement of main-tenance programs.
CONCLUSION l
The maintenance-related problems identified by the NRC IIT for the Davis-Besse plant were resolved.1011 For all operating plants, the objectives of this issue were essentially completed by Phase I of the existing itSPP. Phase II of the MSPP (Issue HF8) will follow up and address problem issues identified in Phase I of the MSPP that warrant further NRC and industry actions.1013 There-1 fore, this issus should be DROPPED as a separate issue. l l
J ITEM 125.11.3: REVIEW STEAM /FEEDLINE BREAK MITIGATION SYSTEMS FOR SINGLE l
i FAILURE
- I
{ DESCRIPTION i
{ Historical Background !
4' t During the investigation of the Davis-Besse event, the importance of the SFRCS l became evident. Although the name of this system implies that its purpose is i
- 06/30/88 3.125-29 NUREG-0933 i, !
Revision 3 to mitigate steam and feedwater line breaks, in actual practice this is the AFW control system. Thus, the functions of this control system are more general than the name implies.
Safety Significance Steam / feed line break mitigation systems vary in title and in detailed design from plant to plant and from vendor to vendor. However, they are generally composed of two logic trains in order to meet the single failure criterion.
The presence of an unsuspected single failure would have the potential to greatly increase the probability of system failure. This has safety signifi-cance for several accident scenarios.
First, the reliability of mitigation of a steam or feedwater line break would be adversely affected. During such an event, the mitigation system isolates both the steam line and the feedwater (main and auxiliary) lines associated with the depressarizing steam generator. For most breaks outside containment, this stops the blowdown. For a break inside containment, the secondary side cf the affected steam generator will blow down to the containment atmosphere, but isolation of feedwater to the affected steam generator will prevent continued long-term steaming due to decay heat from the. reactor core. This is necessary to ensure that the containment design pressure is not exceeded.
This scenario is also the concern of Issue 125.11.7, "Reevaluate Provision to Automatically Isolate Feedwater from Steam Generator During a Line Break." The safety concern expressed here is not a duplication of Issue 125.11.7; rather, Issue 125.11.7 questions the necessity of having this automatic isolation provi-sion and thus is opposite in its thrust. Nevertheless, a detailed examination of tne significance of this scenario is presented in the prioritization of Issue 125.II.7 and will not be treated further here.
The second scenario is the loss of feedwater transient. If main feedwater is lost and not readily recoverable and a single failure in the AFW control system defeats AFW, most plants will have to use feed-and-bleed core cooling technioues to prevent core-melt. Because the viability of feed-and-bleed cooling is often questionable, and because non-recoverable loss of main feedwater events have in fact occurred many times, the reliability of the AFW system and its control system is of considerable importance. This is exactly the safety concern of Issue 125.II.1.b, "Review Existing AFW Systems for Single Failure." Thus, this safety concern is a duplicate of Issue 125.II.1.b.
The third scenario is specific to B&W plants. These plants provide AFW to the steam generators by means of a special AFW sparger. This sparger is located high in the steam generator and sprays water onto the steam generator tubes.
The advantage of this arrangement is that it enhances natural convection through the primary system when forced circulation is lost. If a loss of forced circu-lation (i.e. trip of all four reactor coolant pumps; transient were to occur and AFW were to fail, natural circulation might not provide sufficient core cooling to prevent cladding failure, even if some feedwater were being supplied to the secondary side of the steam generators. This is somewhat different from the safety concern of Issue 125.II.1.b which is concerned with AFW reli-ability during loss of feedwater transients. Nevertheless, any upgrades brought about by the resolution of Issue 125.II.1.b should address the loss of forced 06/30/88 3.125-30 NUREG-0933
Revision 3 m
circulation concern as well. Therefore, this concern is also covered by Issue 125.II.1.b.
CONCLUSION lhis issue has three aspects: (1) line break mitigation, which is covered in Issue 125.11.7; (2) loss of feedwater, which is covered in Issue 125.II.1.b; and (3) loss of forced circulation, which is also covered in Issue 125.11.1.b. I Therefore, this item should be DROPPED as a new and separate issue.
ITEM 125.11.4: THERMAL STRESS OF OTSG COMPONENTS i
DESCRIPTION I Historical Background !
This issue addresses the effects of thermal stresses induced on the OTSG from a loss of feedwater transient and was based on RES concerns.8"'942 <
Safety Significance The' safety concern raised was that the introduction of the recovered feedwater to the dry OTSG, following the Davis-Besse transient, may have degraded the i structural integrity of the OTSG and the steam generator tubes. The resulting i transient-indnced thermal stresses might lead to increased rupture frequencies for the steam generator components which, in turn, would increase the plant's core-melt frequency and the potential radiological risks to the public, i i
PRIORITY DETERMINATION !
Following the Davis-Besse transient, the staff reviewed 43 9 the B&W analysis f
regarding the possible effects of the transient to the structural integrity of the Davis-Besse 015G. Comparisons were made between the Davis-Besse event and the B&W design basis analyses. Therefore, the conclusions reached herein are
) r considered applicab'e to similar transients of similar OTSGs (B&W) plants, t i
This issue is not aoplicable to CE or W PWR plants that have U-Tube heat l
- exchanger designs and AFW injection that does not, spray directly on the steam I j generator tubes, I
' The following components were considered to be the most highly stressed during :
transients involving boiled-dry OTSGs and subsequent recovery of auxiliary and l main feedwater: (1) AFW Nozzle, (2) Main Feedwater Nozzle, (3) AFW Jet Impinge- ,
, ment on Steam Generator Tubes, (4) Stresses on Steam Generator Tubes Due to
- Steam Generator Shell/ Tube Thermal Stress, (5) Degraded Steam Generator Tubes, i and (6) Thermal Shock of Lower Tube Sheet. !
AFW Nozzle: The stress and fatigue analyses of the AFW nozr' resulting from l the Davis-Besse transient were compared to the original design basis temperature I i'
difference of 530'F between the hot steam generator shell and the AFW injection [
temperature. During the transient, the temperature difference was 501*F which I is within the design basis analyses. The fatigue usage factor that was predt- i
] cated on 875 AFW initiations, was also considered acceptable.948 j i
06/30/88 3.125-31 NUREG-0933 1
- -- - . _ . - - - . -- - A
Revision 3 Similar design basis analyses are conducted for all B&W OTSG designs except that the numbers of transients and nozzle designs are plant-specific.945 There-fore, the thermal stresses and fatigue component resultino from similar events are bounded by the original B&W design basis analyses.
Main Feedwater Nozzle: The original design basis stress analysis for the Davis-Besse OTSG was based on a temperature difference of 445 F between the main feed-water nozzle and the feedwater. During the Davis Besse transient, the tempera-ture difference was approximately 162 F.943 Therefore, the theimal stresses and fatigue factor resulting from the transient were considered bounded by the original B&W design basis. Similar design analyses are conducted for all B&W OTSG designs with the same exceptions as noted for the AFW nozzles.945 AFW Jet Impingement on Steam Generator Tubes: The original design basis assumed a temperature difference of 586 F between the AFW coolant and the steam gsnera-tor tube surfaces. Based on thermocouple data, the temperature difference between the steam generator tubes and the AFW was detsrmined to be approximately 523 F.943 Therefore, the thermal stresses and the fatigue f actor (based on 2S,400 cycles in the original Davis-Besse OTSG design basis) resulting from the transient were considered bounded by the original B&W dision basis. Similar analyses (with the exception of the number of transier.ts) have been conducted for all B&W OTSGs.945 Steam Generator Shell/ Tube Thermal Stress: Temperature differences between both steam generator shells and their tubes and the pressure differences across the tube sheets were analyzed based on thermocouple readings. The maximum temperature difference in one of the two steam generators was estimated to be approximately 72 F. The resulting stresses and fatigue component were deter-mined to be acceptable by the staff.943 Degraded Steam Generator Tubes: In NUREG-0565," the staf f discussed its evaluation of B&W's analyses of potential defective steam generator tubes with up to 70% through-wall defects. The B&W thermal stress conditions included ten transients with maximum flaw orientations following a SBLOCA. The second-ary side was postulated to have boiled dry and the primary system was signifi-
.antly voided. The cold AFW impinging on the steam generator tubes and the pressure loads resulting from the tube-to shell temperature differences, in combination with the potential effects of slug flow in the steam generator tubes from the voiding primary system, was evaluated. The staff concluded that the combination of conservative analyses and the test results provided assur-ance that structural integrity of the primary coolant pressure boundary (steam generator tubes) would be maintained.
Thermal Shock of _ Lower Tube Sheet: The stress and fatigue analyses relative to thermalby reviewed shock of the lower tube sheet from the Davis-Besse transient'aere the staff. The stresses and fatigue usage factor resulting from the transient were determined to be negligible. Therefore, it was concluded that the tube sheet was essentially unaffected by the Davis-Besse transient.*i3 CONCLUSION The staff has raised concerns relative to potential beyond design basis condi-tions that may increase the primary system temperatures above those previously analyzed. The higher superheat temperatures will lower the steam generator tube 06/30/88 3.125-32 NUREG 0933 0
Revision 3 v strength or, in combination with injected cold AFW temperature, might increase the thermal stresses. These conditions might then further degrade or fail the primarg*pressureboundary. This potential phenomenon is being studied by the staff.
The staff concluded that transients similar to the Davis-Besse transient are bounded by the original B&W design basis analyses. Therefore, the B&W OTSG design basis adequately accounts for such anticipated operational occurrences.
Based on the staff findings, this issue involves no increase in risk to the public and should be DROPPED from further consideration.
The potential superheat phenomena being studied by the staff is beyond the current design basis. Should the results of the superheat studies indicate a need for changes in the design basis of the primary and secondary pressure boundaries, it is recommended that any follow-up effort be prioritized as a new and separate issue.
~
ITEM 125.!!.5: THERMAL-HYDRAVLIC EFFECTS OF LOSS AND RESTORATION OF FEEDWMER ON PRIMARY SYSTEH COMPONENTS DESCRIPTION Historical Background The Davis-Besse plant recovered feedwater flow following the loss of feedwater transient on June 9, 1985. With the loss of feedwater to the steam generators, heatup of the reactor coolant system peaked at about 592'F and then, following recovery of the feedwater, decreased to 540*F in approximately six minutes (normal post-trip average temperature is 550'F). Thus, the reactor coolant system experienced an overcooling transient rate of 520 F/hr for the 6-minute i time interval.
Due to concerns identified,S41'942 the staff was requested S80 to review and ;
evaluate the safet9 significance of the thermal-hydraulic effects (potential pressurized thermal shock) to reactor pressure vessels, nozzles, and downcomer surface areas from such overcooling transients. '
Safety Significance The potential for pressurized thermal shock (PTS) to the reactor pressure vessel (RPV) and components from overcooling transients is more critical to ,
PWRs by virtue of their designs. Thr.refore, this issue is applicable to all PWRs. With increased neutron radiation exposure, the temperature at which the ;
RPV materials fracture toughness decreases to unacceptable limits increases.
Thus, with t.ime (neutron radiation exposure), the magnitude of the thermal stresses which are also compounded by pressure-induced stresses during over-cooling transients, could approach reduced fracture toughness can %ilities of the RPV materials.
Structural failure (fracture) of the RPV, to an extant that would make the RPV unable tr contain sufficient water to cover the reactor core, would result in a core-n.elt. Given a core-melt and subsequent loss of containment integrity, I
06/30/88 3.125-33 NUREG 0933 l
, . - , , , , - - , - - - - . .n,-----,,-----.,a.--- -------,,-----.--,e -m.e--,-e--
Revision 3 put,lic radiation exposure would result from the release of fission product materials.
Possible Solutions For the Davis-Besse plant, the staff reviewed and evaluated the licensee's PTS calculations and results related to the June 9, 1985 event. Based on the staff's findinos,1 11 the temperature of the limiting weld in the Davis-Besse RPV would have had to drop an additional 377'F to cause crack-initiation to become a significant PTS event.
lo ensure that nuclear power plants do not operate with unacceptable PTS risks, the NRC promulgated a final ruleto12 in July 1985 that amended its regulations to: (1) establish a screening criterion related to the fracture-resistar,ce of PWR vessels; (2) require analyces and a schedule for implementation of neutron flux reduction programs to avoid exceeding the screening criterion; and (3) require detailed safety evaluations to be performed before plants commence operations beyond the screening criterion. The final PTS rule was a result of extensive analyses performed by the NRC staff (USI A-49, "Pressurized Thermal Shock") and several industry groups. The analyses covered all conceivable PTS events, including RPV overcooling transients, that were more severe than the Davis-Besse event.
CONCLUSION The PTS concern from the Davis-Besse event was resolved in NUREG-1177.1011 All other conceivable PTS concerns were addressed in the resolution of USI A-49 and the final PTS rule.1 12 Therefore, this issue should be DROPPED as a separate issue.
ITEMS 125.11.6: REEXAMINE PRA ESTIMATES OF CORE DAMAGE RISK FROM LOSS OF ALL FEEDWATER DESCRIPTION The memorandum which initiated this action recommends that plant-specific reliability data be solicited from Toledo Edison Company (the licensee for Davis-Besse).1 This information would then be used by the NRC staff to formulate a new and revised nodel for estimating the frega ncy of severe acci-dents involving loss of main feedwater at the Davis-Besse plant. The purpose of 'ais effort was to provide information, in addition to the results of deterministic reviews, to aid in decision-making concerning the restart of the Davis-Besse plant.
PRIORITY DETERMINATION This task is a legitimatt action on the Davis-tA sse unit, but is not intend-ed to address other plants since they are not in need of a restart decision.
Therefore, the issue is not generic but is specific to one unit. However, before dismissing the issue, its generic potential should be explored: What benefits would be reaped if other plants were investigated and modeled with plant-specific data? Evaluations of plants with two-train AFW systems are being nade in the resolution of Issue 124, "AFW System Reliability," and 06/30/88 3.125-34 NUREG-0933
Revision 3 ;
investigations along this line for all plants are also being considered. In g addition, Issue 125.II.1.b, "Review Existing AFW Systems for Single Failure,"
deals with gathering of plant-specific information and Is Ne 125.II.1.c, "NUREG-0737 Reliability Improvements," deals with specific AFW system reliabil-itier. Finally, USI A-45, "Shutdown Decay Heat Removal Requirements," deals with the question of plant safety for events (such at loss of all feedwater) where the plant's heat sink is lost. In view of the existence of all these issues, there is little to be gained by generalizing this new proposed action to form an Rdditional generic task.
CONCLUSION Based upon the abova, this issue should be placed in the DROP category.
ITEM 125.11.7: REEVALUATE PROVISION TO AUTOMATICALLY ISOLATE FEE 0 WATER FROM 5 TEAM GENERATOR DURING A LINE BREAK r
DESCRIPTION Historical Background During the course of the investigatior) of the event, it was pointed out that the benefits of AFW isolation are probably more than outweighed by the negative aspacts of this fea ure.840'952 Safety Significance
( The automatic isolation of AFW from a steam generator is provided to mitigate the consequences of a steam or feedwater line break. The isolation logic, usually triggered by a low steam generator pressure signal, closes all main l steam isolation valves and also isolates AFW from the depressurizing steam
- generstor. (The AFW flow is diverted to an intact steam generator.) The l
pu* poses of the AFW isolation are three-fold:
(1) The break blowdown is minimized. Shutting off AFW will not prevent the initial secondary side inventory f rom blowing down. However, the isola- t tion will prevent continued steaming out of the break as decay heat cont inws to produce thermal energy.
(2) Overcooling of the primary system is r2deced. As the depressurizing steam generator blows down to atmospheric pressure, the primary system is cooled down, causing primary coolant shrinkage and (if the event occurs near the end of the fuel cycle) a return to critictlity, which adds a modest amount '
of thermal energy to the transient. Shutting off feedwater to t',e faulted steam gunerator will reduce this effect, although once again the initial blowdown will be the dominant factor.
The significance of these first two considerations is in containment pressure. The containment is designed to accommo ute a primary system [
blowdown followed by decay heat boiloff (the large break LOCA). A steam or feedwater line break within containmerit might cause the containment
) design pressure to be exceeded if the AFW isolation were not present.
\
!G 06/30/88 3.125-35 NUREG-0933 4
l l
Revision 3 (3) The AFW isolation is needed to divert AFW flow to the intact steam genera-tor (s). For the case of a two-loop plant with a two-train AFW system, this is needed to meet the single failure criterion in supplying feedwater to the intact steam generator. (The situation becomes more complex for other cases, e.g. a f our-loop plant with a three-train AFW system. ) Note that, uniess the line break is in the AFW line, core cooling would still meet the single failure criterion even without the ifiolation, since the faulted steam generator would still be capable of heat transfer, in summary, the automatic isolation is needed only to help mitigate a relatively rare event (steam or feedwater line break) and even then is only remotely connected with sequences leading to core-melt.
In contra;t, this isolation has definite disadvantages. If both channels of the controlling system were to spontaneously actuate during normal operation, all AFW would be lost and the MSIVs would close. Most newer plants use turbine-driven main feedwater pumps. Thus, main /eedwater would be lost also. If the plant operators fail to correctly diagnose and correct the problem, only feed-and-bleed cooling would be available to prevent core-melt. Similarly, i f spur-ious AFW isolation were to occur during the course of anothtr transient, once again only feed-and-bleed cooling would be available to prevent core-melt.
The long-term success of AFW for main feedwater transients, steam generator tube ruptures, and small LOCAs may also be compromised.951 During controlled cooldown, the thresholds for automatic AFW isolation are crossed. Procedures call for operators to lock out the isolation logic as the steam generator pres-sure approaches the isolation setpoint. Under the circumstances, the accompany-ing distractions make it possible t'iat the op;rators will forget to override the AFW isolation logic in the permissive window. Thus, AFW reliability in these scenarios may be significantly degraded.
The safety significance of this issue arises from the fact that the negative aspects involve accident sequences which have more frequent initiators, and more significant consequences, than those of the positive aspects.
Possible Solutions A very straightforward solution has bean proposed: simply disconnect the AFW isolation valve actuators from the automatic logic and depend on plant proce-dures, i.e., have the operators close th? AFW isolation valves (by remote manual operation from th? control room) in the event of a line break.S51 These proce-dures would require careful verification of the existence of a lit- break before isolating a steam generator f rom AFW.
PRIORITY DETERMINATION Frequency Estimate it is necessary to calculate estimates of both the positive and negative aspects of disabling the automatic AFW isolation. The positive aspects are due to a decrease in the frequency of loss of all feedwater events. There are three accident sequences of interest.
O 06/30/88 3.125-36 NUREG-0933
Revision 3 (1) The first sequence is initiated by a spontaneous actuation of both chan-nels of the isolation logic. (We will assume a two-loop plarit design for prioritization purposes.) There is no data readily available for such actuations. However, it is possible to make an educated guess. EPRI NP-2230307 provides sorne perspective, based upon actual experience with other systems:
Inadvertent Safety Injection Signal, PWR 0.06/RY MSIV Closure, PWR 0.03/RY :
- Steam Relief Valve Open, PWR 0.04/RY Inadvertent Startup of BWR HPCI 0.01/RY Based upon these figures, it is expect (ed that spontaneous actuations will occur with a frequency on the order of 0.03/RY. Of course, this would isolate only one steam generator. However, such systems generally have a common mode failure probability on the order of SL (In addition, the second train of AFW has an unavailability due to other causes of roughly 1%. However, the main feedwater systen would still be available in this
! case.) Thus, the frequency of both steam generrtors isolating is (0.03/RY)
, (0.05), or 1.5 x 10 3/RY. Of course, the plant operators are likely to 1
reset the logic and turn the tiansient around. We will assume a 1% (mini-mum) failure probability for recovery by operator action. This leaves feed-and-bleed c.coling for which we will assign a typical failure probabil- ,
ity value of 0.20 and a maximum failure probability of 0.60, based on the I calculations presented under Item 125.11.9, "Enhanced Feed-and-Bleed Capability." Hultiplying these figures gives a core-melt frequency of l' 3 x 10 6/RY typical, 9 x 10 8/RY maximum.
(2) The second sequence is initiated by another, independent transient. During the course of this transient, and the consequent perturbation of a great many plant systems, the AFW isolation logic is triggered. The tiSIVs close, causing a loss of main feedwater (if main feedwater has not previously been lost), and the ArW isolates. Again, unless the AFW isolation valves
] are reopened, caly feed-and-bleed is available as a means of core cooling.
The AFW isolation logic can be triggertd during a transient in two ways. l i
The first is by some type of inadvertent systems interaction, e.g., elec- t i
tromagnetic coupling. The proper fix for this problem ir to eliminate the systems interaction which may well have other consequen:es in addition to AFW isolation. Therefore, this effect will not be considered here. >
i The second way to trigger AFW isolation is by the actual existence of low I pressure in the secondary system, caused by the initiating transient. In l this case, the isolation is working as designed (but not as intended).
I Low pressure transients are relatively rare, since the steam space in l question is usually right on top of a significant quantity of water at ;
i saturation temperature. Low pressure will occur only if steam is vented -
! at a rapid rate in sufficient quantity to cool the water inventory via l l bolloff to the point where saturation pressure drops below the AFW isola- i tion setpoint. The other possibility is a cryout of the steam generator. l l
- This is possible for B&W plants because of the relatively low water inven-tory in the steam generators. However, such an event in a Westinghouse or 06/30/88 3.125-37 NUREG-0933 I
i l
= , - - - . , . . , - - - - - - . -,-__--- - _ ----. , - . . . - - - , , .
Revision 3 CE plant would probably imply that the main feedwater and AFW had already failed.
There is no readily available way of estimating the probability of a pressure drop, given a transient. However, EPRI NP-22303o7 gives a fre-quency of 0.04/RY for events where PWR steam relief valves open. Thus, we can assume tMt depressurization events occur with at least this fre-quency. If we further assume that perhaps 10% of these pressure drops are deep enough to trigger AFW isolation, and again assume a 1% probabil-ity of failure of the operators to recover AFW the resulting core-melt frequencies are 8 x 10 6/RY typical, 2.4 x 10 E/RY maximum.
(3) The third sequence involves the long term success of AFW for main feedwater transients. During controlled cooldown, the thresholds for automatic AFW isolation are crossed. Procedures call for the operators to lock out the isolation logic as the steam generator pressure approaches the setpoint.
If the operators fail to do so, both trains of AFW will isolate. Main feedwater is also unavailable, since its loss initiated the transient.
Again, only feed-and-bleed would be available for core cooling.
Non-recoverable loss of main feedwater events are estimated to occur with a frequency cf 0.64/RY 952 We will assume a 1% minimum probability of operator failure to bypass the isolation logic and another 1% minimum pro-bability of failure of the operators to recover the AFW system. In addi-tion, there is still feed-and-bleed cooling which, because the plant is already partially cooled down, should have a better than usual chance of succeeding. We will therefore assume 10% instead of 20% or 60% for feed-and-bleed failure probability. The result is a core-melt frequency of 6.4 x 10 6/RY.
The three sequences above add up to a "typical" core-melt frequency of 1.7 x 10 5/RY and as much as 3.9 x 10 5/RY for a plant with marginal feed-and-bleed capability. Now we must estimate the negative aspects of the proposed fix.
The first negative scenario is the feedwater line break. Here, a break in the feedwater line to one steam generator initiates the sequence. With the pro-posed fix, the line is not isolated and one train of AFW simply pumps water cut of the break. If the operator fails to manually isolate the break, the remain-ing AFW train fails, and feed-and-bleed techniques fail, core-melt will result.
Steam and feedwater line breaks are estimated to occur at a combined rate of 10 3/RY (see Issue A-22). Because steam lines are larger and not as subject to water hammer phenomena, the feedwater lines are expected to be more likely to break than the steam lines. We will therefore assume that feedwater lines will break with a frequency of 9 x 10 4/RY, i.e. 90% of the total line break frequency.
The unaffected single train of AFW should have a failure probability on the order of 0.01 or less. Consistent with the positive scenario calculations, we will assume a 1% probability of operator failure to manually isolate the affected steam generator and a 20% typical, 60% maximum feed-and-bleed failure probability.
The product is a core-melt frequency of 1.8 x 10 8/RY typical and 5.4 x 10 8/RY maximum.
06/30/88 3.125-38 NUREG-0933 f
Revision 3
( The rertaining scenario is a steam line break. This scenario ma .
theoretical possibility of containment failure by overpressure,ybut involve does the not lead to core-melt. We will assume a 10 3/RY frequency of line break as before and a 10% probability that the line break is in the steam lines as opposed to the feedwater line breaks of the previous scenario. Once again, the probabil-ity of the operator to fail to manually isolate is assumed to be L%. The fre-quency of higher than expected containment pressure due to long term steaming in the faulted steam generator 1s then 10 8/RY.
The change in core-melt frequency is the algebraic sum of the various scenarios:
s Core-melt Averted /RY Typical Maximuan r
' Spontaneous Actuation 3.0 x 10 6 9.0 x 10 8 i Transient Initiated 8.0 x 10 6 2.4 x 10 5 -
Cooldown Initiated 6.4 x 10 6 6.4 x 10 8 !
Feedwater Line Break -1.8 x 10.s 5.4 x 10.a >
t Net change in core-melt frequency 1.7 x 10 5 3.9 x 10 5 The estimated reduction in core-melt frequency for all reactors is 3.5 x 10 4/ year.
. Consequence Estimate t
The core-melt sequences under consideration here involve a core-melt with no large breaks inittaily in the reactor coolant pressure boundary. The reactor j
i is likely to be at high pressure (until the core melts through the lower vessel ,
head) with a steady discharge of steam and gases through the PORV(s). These '
are conditions likely to produce significant hydrogen generation and combustion. -
i The Zion and Indian Point PRA studies used a 3% probability of r:ontainment
] failure due to hydrogen burn (the "gamma" failure). We will follow this example and use 3%, bearing in mind that specific. containment designs may 4
i dif fer significantly from this figure. In addition, the containment can fail j l to isolate (the "beta" failure). Here, the Oconee PRA figure of 0.0053 will ;
} be used. If the containment does not fail by isolation failure or hydrogen I
i burn, it will be assumed to fail by basemat melt-through (the "epsilon" l failure). !
Using the usual prioritization assumptions of a central midwest plains meteor- I ology, a uniform population density of 340 persons per square mile, a 50-mile
- radius, and no ingestion pathways, the consequences are
i l
} Failure Percent Release Consequences l
l Mode Probability Cateqcry (man-rem) gamma 3.0% PWR-2 4.8 x 108 beta 0.5% PWR-5 1.0 x 106 epsilon 95.5% PWR-7 2.3 x 103 l 06/30/88 3.125-39 NUREG-0933 k 1
Revision 3 The "weighted-average" core-melt will have consequences of 1.5 x 105 man-rem /
event.
These figures should cover all PWRs with large dry containments. They do not apply to ice condenser containments. Because of the low free volume in such a containment, failures due to overpressure are more likely and the averaged con-sequences may be significantly greater. However, we are not aware of any ice condenser plant which has an automatic AFW isolation affected by this issue.
The steam-line-break / containment-rupture scenario is dif ferent. The contain-ment pressure is unlikely to exceed the design pressure by more than a few per-cent, if at all. In most cases, the containment is calculated to fail at 2 to 2.5 times its design pressure. Therefore, containment failure by overpressure is at most a very remnte theoretical possibility. We will assume that the over-pressure failure probability cannot be greater than 3%, the hydrogen burn figure (a highly conservative assumption). The only radioactive release comes from the containment atmosphere and any primary coolant leakage or discharge from the PORV(s). We have no consequence estimates for such an event. However, the consequences con be conservatively bounded by those of a PWR-8 event, which is a successfully mitigated LOCA with failure of the containment to isolate. The PWR-8 consequences are 7.5 x 104 man-rem. Thus, the steam line break event will have "average" consequences of at most (0.03)(7.5 x 104) or 2250 man-rem, and probably much less.
It is not known how many plants are affected by this issue. In many plants, the AFW isolation logic has provisions to prevent isolation of feedwater to more than one steam generator. Others may not even have this isolation logic.
We will assume that about 25% of the PWRs will be affected by this issue.
There are 83 PWRs and, as of spring 1987 (the earliest that this issue is likely to result in changes), the remaining collective calendar life will be 2571 RY.
At a 75% utilization factor, this is 1928 RY or about 23 operational years per reactor.
The net change in man-rem /RY is obtained by multiplying the change in core-melt frequency by 1.5 x 105 man-rem (average) per core-melt, Then, the steam line break scenario must be subtracted. The consequences of the steam line break scenario (upper bound) are simply (10 S overpressure /RY) [2250 (average) man-rem / overpressure], or 2.3 x 10 3 man-rem /RY.
Change in man-rem.'RY Typical Maximwm Core-melt Scenarios 2.6 5.9 Steam Line Break 50.0023 50.0023 Net change: 2.6 5.9 The estimated risk reduction is 140 man-rer/ reactor (maximum) and 1,300 man-rem for all reactors.
06/30/88 O
3.125-40 NUREG-0933
Revision 3 b
Cost Estimate The proposed fix for this issue is simply to remove some leads from some equip-ment, an action which is likely to be more than paid for by decreased maintenance and testing. Nevertheless, even a relaxation of requirements as this will require review of each affected plant's isolation logic, to be certain that the net effect is an increase in plant safety. In addition, technical specifica-tion and procedural changes, with their associated paperwork, will be neces-sary.
We will assume per plant costs of $32,000 to the industry and $25,000 to the HRC, which are typical for a complicated and controversial technical specification change. Thus, the estimated total cost associated with the resolution of this issue is (0.25)(83)($0.057M) or $1.18M.
Value/ Impact Assessment Based on an estimated risk reduction of 1,300 man rem and a cost of $1.18M, the value/ impact score is given by:
$ _ 1300 man-eem
$1. lC
= 1102 man-rem /$H Other Considerations (1) It should be noted that the maximum values are based upon a plant with marginal feed-and-bleed capability. The subset of PWRs which are affected
( by this issue may not include such a plant. Thus, the "maximum" plant may not exist.
(2) The proposed fix does not involve work within radiation fields and thus does not involve ORE. However, the ORE averted due to post feed-and-bleed cleanup and post-core-melt cleanup is a consideration. NUREG/CR 280064 estimates the ORE associated with cleanup to be about 1800 man-rem after a primary coolant sp'ill and about 20,000 man-rem af ter a cors-melt acci-dent The "typical frequency of feed-and-bleed events is simply the "typical" core-rielt frequency (1.8 x 10 5/RY) divided by the feed-and-bleed failure probability (0.20). The actuarial figures are:
Averted Feed and-Bleed Cleanup ORE / plant 3.6 man-rem Averted Core-melt Cleanup ORE / plant 7.9 man-rem Total: 11. 5 man-rem The total averted ORE for all plants is 240 man-rem. Thus, the averted ORE is not dominant, but is still a significant fraction of the averted public risk.
(3) The proposed fix reduces core-melt frequency and the frequency of feed-and-bleed events and therefore averts cleanup costs and replacement power costs. The cost of a feed-and-bleed usage is dominated by roughly six months of replacement power while the cleanup is in progress. If the average frequency of such events is 1.7 x 10.s/0.20 or 8.5 x 10 5/RY and x the average remaining lifetime is 23 operational years-at 75% utilization, 06/30/88 3.125-41 HUREG-0933
Revision 3 and making the usual assumptions of a 5% annual discount rate and a replacement power cost of $300,000/ day, the actuarial savings for feed-and-bleed cleanup works out to be $55,000. Similarly, the actuarial sav-ings of averted core-melt cleanup (which is assumed to cost $1 billion if it happens) are about $200,000. The actuarial savings from replacement power af ter a core-melt up to the end of the plant life are about $260,000.
(This last figure represents the lost capital investment in the plant.)
Obviously, these savings would more than offset the cost of the fix if they were included.
(4) ihe analysis of the first negative scenario, the feedwater line break, assumed that non-isolation of the ruptured line would cause one AFW train to fail. A special situation can arise for plants with a limited AFW water supply (e.g. saltwater plants). In such a case, the cnntinued loss of clean water out of the feedwater line break can in theory cause failure of the second AFW train by exhausting the water supply, provided that the loss is not terminated either by the operator or by protective trips (for runout protection) on the first AFW train. In such a case, the scenario's negative contribution (typical) to the averted core-melt frequency of the proposed fix rises from (-1.8 x 10 8) to (-1.8 x 10 8). The net change in core-melt frequency would then drop from 1.7 x 10 5 to 1.6 x 10 6, which would not change the conclusion.
CONCLUSION Based upon the figures above, particularly the core-melt frequencies, this issue should be placed in the HIGH priority category.
ITEM 125.II.8: REASSESS CRITERIA FOR FEED-AND BLEED INITIATION DESCRIPTION Historical Background During the course of the investigation of this event,
- it was discovered that the Davis-Besse emergency procedures (EOPs) criteria for initiation of feed-and-bleed cooling were inadequate. The procedures directed the plant operators to initiate feed-and-bleed either if steam generator levels were below 8 inches on the startup range or if the steam generator secondary pressures were less than 960 psig and decreasing. The difficulties with these criteria were:
(1) the control room instrumentation was inadequate for the operators to deter-mine that levels were below 8 inches, and (2) there is calculational evidence that stea'n generator secondary pressures are unlikely to f all below 960 psig before the opportunity for successful feed-and-bleed cooling is past.2002 Licensees have been supplied with feed-and-bleed procedures by NSSS vendors.
Safety Significance Feed-and-bleed capabilities are not currently required by the NRC although the techniques, benefits, and costs are being evaluated in the resolution of USI A-45.
Basically, feed-and-bleed cooling is a method of last resort which can avert core damage if main and auxiliary feedwater are lost and other methods of decay heat removal are unavailable. PRAs give considerable credit for feed-and-bleed 06/30/88 3.125-42 NUREG-0933
l Revision 3 ,
i cooling. A failure rate of une or two percent is a typical assumption. However, the Davis-Besse event chronology leaves an impression that this failure pro-bability may be overly optimistic.
Possible Solution ;
The Davis-Besse E0Ps have been changed; there is now a single criterion for initiating feed-and-bleed which states that feed-and-bleed will be initiated if the primary coolant hot leg temperature rises above 610'F. This parameter (
is much easier to monitor with existing control room instrumentation and there- !
fore the new criterion is much clearer and unambiguous. The purpose of this f proposed generic action is to confirm that all of the remaining B&W plants are ;
using the new criterion rather than the two old criteria.too2 t CONCLUSION l
[
The safety concern and possible solution of this issue are covered in Issue !
122.2, "Initiating Feed-and-Bleed." Issue 122.2 is one of the short-term [
Davis-Besse issues and is somewhat more general in that it is also concerned with the reluctance of the operators to initiate feed-and-bleed (because of the economic consequences) in addition to being concerned with inadequacy of the criteria. (See References 885, 887, and 940). The two are related; less ambiguity in the written procedures implies less opportunity for reluctance to affect operator actions. Thus, this issue should be DROPPED as a new and sepa- t rate issue. ;
ITEM 125.II.9: ENHANCED FEED-AND-BLEED CAPABILITY t
+
DESCRIPTTON ,
Historical Background This particular issue arose because of the very limited capability of the l Davis-Besse plant to remove decay heat using feed-and-bleed techniques. *
- The Davis-Besse plant had a relatively low capacity PORV on the pressurizer and thus limited "bleed" capability. In addition, the HPI pumps (a part of the ECCS) did not develop sufficient discharge pressure to provide injection at operating pressure. To supply coolant at elevated pressure, the plant i operators would have to "piggyback" the makeup pumps on the HPI discharge, a complex procedure which will supply only rather limited flow. Thus, the "feed" capability was also limited. The issue is divided into two parts:
Part A deals with pressure relief capacity (i.e., enhanced "bleed" capability),
and Part B deals with makeup capacity and pressure (i.e., enhanced "feed" capability).
Safety Stanificance ,
l Feed-and-bleed cooling is normally considered a method of last resort which can !
avert core damage if main and auxiliary feedwater are lost and not recovered, t Nevertheless, main and auxiliary feedwater did both fail (but were recovered) f at Davis-Besse and so this need for feed-and-bleed, although remote, is a :
possibility.
06/30/88 3.125-43 NUREG-0933
Revision 3 Feed-and-bleed cooling has the advantage of being a redundant and diverse method of core cooling. Its disadvantage (in addition to the economic consequences of releasing primary coolant to the containment) is that the plants'were not designed for this mode of core cooling and thus their capabilities are uncertain.
An upgrading nf the feed-and-bleed capability would benefit the viability of feed and bleed cooling in several ways: (1) the probability of failure due to component failure would be reduced. (Feed-and-bleed cooling can fail due to a single failure at most plants); (2) the thermal hydraulic uncertainty would be reduced. (Feed-and-bleed cooling is often only marginally viable. A slight change in the thermal hydraulic initial or dynamic conditions may well prevent adequate core cooling); (3) the "window" or time interval during which feed-and-bleed is viable would be lengthened, giving more time to (and less stress upon) the operating crew; and (4) the procedures for initiating feed-and-bleed would be simpler, thus reducing the probability of operator error.
Possible Solutions The possible solutions for this issue are implicit in the definitions of the tm parts: (1) increased pressure relief capacity and (2) increased makeup capacity and pressure. Increased relief capacity could be accomplished by installing larger PORVs, installing more PORVs, or installing a special valve intended fcr bleed operations. Increased makeup capacity would involve upgrad-ing or replacing the pumps (and their motors) with ones of higher discharge pres ure.
PRIORITY DETERMINATION Frequency Estimate To estimate changes in core-melt frequency due to the upgrades in pressure relief and makeup capacities, it is first necessary to calculate the change in failure probability of feed-and-bleed cooling. In the past, the usual assump-tions have been either that the feed-and-bleed failure probability was dominat-ed by the human failure mode (in NRC generated PRAs) or that it was governed only by a few hardware failure probabilities (in industry generated PRAs).
Obviously, there is an inconsistency. Moreover, the issue to be addressed here affects both hardware and human failure rates. It is necessary to introduce a (somewhat) more sophisticated treatment of the problem. To do this, we will define four classes of plants.
Class 1: In this class, the plant's HPI puTps develop sufficient discharge pressure to lift the pressurizer safety valves. For such plants, feed-and-bleed cooling does not need the PORVs. Moreover, the HPI pumps are capable of raising the coolant level at any time right up to the point of core uncovery. There is no time interval "window" phenomenon.
Class 2: In this clats, the plant's HPI pumps and/or charging pumps can force sufficient coolant in at operating pressure, but cannot lift the safety valves.
Here, both PORVs must open for feed-and-bleed cooling to work. In addition, the viability of feed-and-bleed techniques is limited in time. Once the steam generators dry out, primary system pressure rises as the pri:cary coolant heats up and expands. The PORVs will open and help keep pressure down, but eventually the pressure will rise up to the safety valve setpoint, t'y which ti:ne the HPI
- 06/30/88 3.125-44 NUREG-0933 l
l
Revision 3 O' can no longer force coolant into the primary system. Thus, there is a definite "window" of time, pressure, and temperature during which feed-and-bleed cooling will work.
Class 3: In this class, the HPI pumps and/or charging pumps cannot force ;
sufficient coolant into the primary system at operating pressure. Such plants '
must open the PORVs and reduce pressure to below normal in order to force suf-ficient coolant in. Of course, the timing is still more critical for such plants. Once the steam generators dry out, the PORV capacity will soon be overcome by primary coolant expansion and heating.
Class 4: This class is similar to Cltss 3 exc.ept that the PORV or PORVs are small. Such plants cannot sufficiently depressurize using PORVe after the steam generators dry out, but instead must open the PORVs and depressurize while the I steam generators are still removing decay heat. In some cases, cdiculations i have shown that the PORVs must be opened within 5 to 10 minutes after the '
beginning of the transient for core cooling to be successful. I L
It must be emphasized that real plants may not be easily classified into four '
neat classes. Nevertheless, these four classes will enable the benefits of enhanced feed-and-bleed to be scoped out. The benefit of enhanced pressure relief capacity can be seen by comparing Class 4 with Class 3 and the benefit of enhanced makeup by comparing Classes 2, 3 and 4 with Class 1.
tilven the four classes of plants, it is now necessary to discuss the sources ,
of failure for feed-and-bleed. These may be grouped into equipment, thermal- :
hydraulic, and human failure probabilities. ll For feed-and-bleed to work, there must be both feed and bleed capabilities. l Thus, a source of coolant at sufficient flow and pressure is necessary. This can be supplied either by the "charging" or "makeup" system (if of sufficient flow capacity) or by the HPI system (if of sufficient discharge pressure). In e dher case, the supply will generally be from a two-train system. Such systems
- generally have a failure probability on the order of 11 Class 1 plants will discharge through the safety valves which have a failure probability of essentially zero for our purposes. The other three classes i must use (usually two) PORVs for coolant discharge. Each PORV has a probabil- t
- ity of failure to open of about 1L H When used for feed-and-bleed, these l l valves are not redundant; both must open, f Thermal-hydraulic effects are reasonably straightforward. For Class 1 plants, k the thermal-hydraulic failure probability is essentially zero, since the high '
head HP! pumps will raise coolant level at any time. For Class 2 and Class 3,
) we will define two time intervals. The first is T1, which runs from the begin- j i ning of the transient up to the point of steam generator dryout. The second is l l T2, which starts at steam generator dryout and ends at the point of no return, i when feed-and-bleed will no longer work. During interval T1, the initial con-I ditions for feed-and-bleed onset are reasonably stable and there is high con-
- fidence that feed-and-bleed will work as planned. Thus, the probability of l failure due to thermal-hydraulic effects is assumed to be zero during fl. '
- During the second interval T2, the dynamic behavior of the reactor coolant '
( system is much more complicated. In addition, the course of the transient may l be signifi n ntly affected by a number of factors such as reactor coolant pump
, 06/30/88 3.125-45 NUREG-0933 l
l
Revision 3 operations, PORV cycling, pressurizer sprays, etc. We estimate, based primar-ily on judgment, that the probability of failure is 50% during this interval.
For Class 4 plants, the point of no return come; well before steam generator dryou t. Thus, it will be assumed that the probability of failure due to thermal-hydraulic ef fects is essentially zero for the first 10 niinutes and unity thereafter.
Finally, we must account for human error. This will be divided into three parts:
(1) Simple Procedural Error: Assuming a decision has been made to go ahead with feed-and-bleed, and assuming alsa that all equipment is operable, there is pill a finite probability that the operator will make a mistake in initiating, monitoring, and controlling the process. This failure probability is lowest for Class 1 plants since the rperator need only ini-tiate HPI and watch. We will assume 1% failure probability for this class.
For Class 2, the initiation and control of feed-and-bleed are more compli-cateo and we will assume 5% for interval T1. For Class 2 interval T2 and for Classes 3 and 4, the operator must depressurize first and then feed, being carefal to keep pressure low enough to get adequate injection flow but hiDh enough to avoid bulk boiling in the core (if possible). For this situation, we will assume a 10% failure rate.
(2) Time Stress: For this, we will use Swain's screening model. ass The Class 2 and Class 3 interval T1 ends roughly 25 minutes into the transient, for which the screening model estimates a stress failure rate of about 3%.
For the case of Class 4, where the point of no return is 10 minutes after the start of the transient, the screening model predicts a 50% failure probability. All the nther classes and intervals are . ell over half an hour and the time stress failure rate is essentially zero.
(3) Simple Reluctance: The use of feed-and-bleed will release primary coolant to the cortainment atmosphere, contaminsting the containment and necessi-tating a long expensive shutdown for purposes of cleanup. Moreover, feed-and-bleed techniques cause a small LOCA and thus have safety implications.
Quite naturally, the plant operators will delay the use of feed-and 'aieed as long as possible in the hope of recovering either main or auxiliary feedwater. Thus, there is a finite probability that initiation of feed-and-biced will be delayed into interval T2 (for Classes 2 and 3) or uen past the point of no return. Once again, it is necessary to use judgment.
We will assume a 5% probability that the operators will wait until after the point of no return. For Classes 1 and 4, this translates directly into a 5% failure probability. For Classes 2 and 3, we will further assume that there is a 5% chance that feed and-bleed will be started before the point of no return but after the point of steam generator dryout. Tnis can perhaps best be understood in terms of success probabilities: there is a 90% chance of initiation during interval 11, a 5% chance of initiation during interval T2, and a 5% chance of either no initiation or initiation after interval T2.
For feed-and-bleed to succeed, all the potential pitfalls discussed abov must be successfully overcome. Thus, the probability of successful feed-and-bleed is obtained by multiplying the success probabilities (not the failure probabilities) of the various contributors listed above. This is summarized in the following Table 3.125-1.
06/30/88 3.125-46 NUREG-0933
l l
Revision 3 1
,Q 1
( Table 3.125-1 Class 1 2 3 4 Interval T1 T2 T1 T2 Success Probabilities:
HPI 0.99 0.99 0.99 0.99 0.99 0.93 PORV ---
0.99 0.99 0.99 0.99 0.99 PORV ---
0.99 0.99 0.99 0 99 0.99 Thermal-Hydraulic 1.00 1.00 0 50 1.00 0.50 1.00 ,
Operator:
Procedural 0.99 0.95 0.90 0.90 0.90 0.90 Time Stress 1.00 0.97 1.00 0.97 1.00 0.50 Reluctance 0.95 0.90 0.05 0.90 0.05 0.95 Interval Success Probability 0.9311 0.8047 0.0218 0.7624 0.0218 0.4148 Interval Failure Probability 0.0689 0.1953 0.9782 0.2376 0.9782 0.5852 i
s Class Failure j Probability 0.0689 0.1910 0.2324 0.5852 For Classes 1 and 4, the failure probability is calculated by first multiplying i
- the equipment, thermal-hydraulic, and operator suc..ess probabilities together to obtain a net success probability. This success probability is then subtracted from unity to get a failure probability.
Classes 2 and 3 are more complicated. Wit;in each time interval, the various success probabilities are multiplied togetur to get a net success probability for the interval. The interval success procabilities are then subtracted from un.+/ to get an interval failure probability (i.e. , the probability of no feed-and-bleed during that interval). Both intervals must fail to feed and bleed for feed-and-bleed to not take place at all. Therefore, the failure probability for the plant class is the product of the two interval failure probabilities.
With feed-and-bleed failure probabilities available, the next step is to calcu-
, late the changes in core-melt frequencies from these numbers. This is rela-tively straightforward in that the dominant sequence is almost always a transient involving a non-recoverable loss of main feedwater coupled with a failure of the AFW system and (of course) a failure to cool the core by means of feed-and- i bleed techniques. - '
l For the initiating event frequency (non-recoverable loss of main feedwater 1 willuso0.64 event /RY,basedupontheOconeePRAdonebyDukePowerCo.88j,we 06/30/88 l
3.125-47 NUREG-0933 l l
l
Revision 3 This figure is based upor, fault tree analysis and should be reasonably repre-sentative of most main feedwater system designs.
For a three-train AFW system, a "typical" unavailability is 1.8 x 10 5/ demand.894 The analogous figure for a two-train system is significantly higher. However, anexistingprogramisattemptingtoupg/
the maximum unavailability would be 10- demand.947rade all AFW Thus, we systems to a point whe will consider 1.8 x 10 5 to be an average unavailability and 10 4 to be the maximum.
With the figures in hand, core-melt frequencies (F) can be estimated by taking the product of the transient frequency, the AFW unavailability, and the change in the feed-and-bleed failure probability.
From To Change in Core-Melt Frequency
- Class Class Typical Maximum Reason 2 1 1.4 x 10 6 7.8 x 10 6 Enhanced makeup capacity 3 1 1.9 x 10 6 1.1 x 10 5 Enhanced makeup capacity 4 3 4.1 x 10 6 2.3 x 10 5 Enhanced relief capacity 4 1 6.0 x 10 6 3.3 x 10 5 Enhanced makeup and relief capacity
- in units of core-melt /RY Consequence Estimate The accident sequenca under consideration here involves a core-t1elt with no large breaks initially in the reactor coolant pressure boundary. The reactor is likely to be at high pressure (until the core melts through the lower vessel head) witn a steady discharge of steam and gases through the PORV(s). These are conditions likely to produce significant hydrogen generation and combus-tion. The Zion and Indian Point PRA studies used a 3% prcbability of contain-ment failure due to hydrogen burn (the "gamma" failure). We will follow this example and use 3%, bearing in mind that specific containment designs may differ significantly from this figure, in addition, the contaiament can fail to i:olate (the "beta" failure). Here, the Oconee PRAsas figure of 0,-)053 will be used. If the containment does not fail by isolation failure or hydrogen burn, it will be assumed to fail by base mat melt-through (the "epsilon" failure).
Using the usual prioritization assumptions of a central midwest plains meteor-ology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequences are:
O 06/30/88 3.125-48 NUREG-0933
Revision 3
(
\
v Failure Percent Release Consequences Mode Probability Category (man-rem) gamma 3.0%
be' a PWR-2 4.8 x 108 0.5% PWR-5 1.0 x 106 epsilon 96.5% PWR 7 2.3 x 108 The "weighted-average" core-melt will have consequences of 1.5 x 105 man-rem.
These figures should cover all PWRs with large dry containments. However, they do not apply to ice condenser containments. There is no modern PRA currently available for such a plant. However, because of the low free volume in such a containment, failure due to overpressure is more ilkely and the average conse-quences may be significantly greater.
Cost Estimate The core-melt figures for this issue are such that cost considerations will not affect the priority. Consequently, a quantitative cost analysis has not been attempted. However, it should be noted that these are not inexpensive fixes.
A new or upgraded high pressure pump is likely to cost between $2M and $5M per train installcd. Replacement PORVs or an additional, dedicated depressuriza-tion valve will not be as expensive, but will probably require replacement dis-charge piping with stronger bracing. The quench tank might also require extensive modification.
hlue/ImpactAssessment !
To make the value/ impact assessment, it is necessary to estimate the number of plants in ev.h of the four classes. The first statement to be made is that all ;
i-B&W plants except Davis-Besse have injection pumps capable of lifting the pres-surizer safety valves. Thus, these plants are already in Class 1 and are out-side the scope of this issue. This leaves 71 PWR plants. The earliest imple-mentation of fixes for this issue is not likely to be before the spring refueling '
outages in 1988, at which time these plants will have a collective remaining L lifetime of about 2240 RY. At a 75% utilization figure, this is about 23.7 i years of operational lita per plant. It is not clear how these 71 plants are [
distributed among Classes 2, 3 and 4. A plant-by plant investigation is beyond i the scope of a prioritization. Therefore, it will be assumed that roughly one-third fall in each class: 24 in Class 2, 24 in Class 3, and 23 in Class 4. (
With this data, priority paraaeters can te estimated. 4 l
r i
i 06/30/88 3.125-49 h'JREG-0933
Revision 3 Part (a), Part (b),
Enhanced Enhanced Relief Makeup Plant Class 4-3 2-1 3-1 4-1 Number of Plants 23 24 24 23 AF (average) 4.1 x 10 6 1.4 x 10 8 1.9 x 10 6 6.0 x 10 8 AF (max) 2.3 x 10 5 7.8 x 10 8 1.1 x 10 0 3.3 x 10 5 Core-Melt /RY (max) 2.3 x 10 5 3.3 x 10 5 Man-rem / reactor (max) 80 120 Core-Melt / year 9.4 x 10 5 2.2 x 10 4 (Total, all plants)
Man-rem (Total, all plants) 330 770 Other Considerations (1) Upgrading the makeup capability would involve worx on pumps which are located outside of containment. This should not result in a significant amount of ORE. However, upgrading the relief capacity involves work achcent to the pressurizer which would have implications for occupational exposure. There is no readily available data upon which a direct estimate of this exposure can be based. However, it should be noted that pres-surizer inservice inspection involves roughly 20 man-rem and pressurizer spray valve repair involves roughly 10 man-rem. Thus, because the average (not maximum) plant would avert a public risk of about 15 man-rem, the ORE involved in the fix may well be equal to or greater than the public ex-posure averted.
(2) In addition to ORE associated with the fix, there is averted ORE associated with cleanup of a core-melt. For prioritization purposes, core-melt cleanup exposure is assumed to be 20,000 man-rem. Using this and the core-melt frequencies calculated previously, the actuarial values (total, all plants) of averted core-melt cleanup ORE are about 45 man-rem for Part (a) and 100 man-rem for Part (b). On a per plant basis, this is 2 man-rem / plant for both Parts (a) and (b). Thus, this is not a significhnt considevetion.
(3) There are also averted costs associated with this issue. There are no averted precursor events that involve major cleanup, but there are averted cleanup costs associated with the reduction in core-n.elt frequency. In addition, averted core-melt implies averted replacement power costs for the rer.aining life of the plant. (Because the plar.t was built for the purpose of avoiding replacement power costs, this latter item represents the depreciated capital loss of the plant). Using the maximum core-melt frequencies above, a 31.5 calendar year average remaining plant life, and the usual prioritization assumptions of $1 billion for core-melt cleanup,
$300,000 per day for replacement power, and a discount rate of 5%, the actuarial cost credits are:
06/30/88 O
3.125-50 NUREG-0933
Revision 3 Part (a) Part (b)
Core-melt Cleanup $270,000 $390,000 Averted Replacement Power Costs $350,000 $510,000 Total: $620,000 $900,000 This is probably not sufficient to offset more than a fraction of the cost of the proposed figures.
(4) The estimates of feed-and-bleed failure probability are based upon a time window assumption. That is, after continuing decay heat production in the reactor core has caused primary system pressure to rise to a certain point, the HPI pumps can no longer force coolant into the primary system. In addition, the PORVs are then venting at capacity and thus the primary system cannot be depressurized. Therefore, feed-and-bleed is assumed to fall if initiated after such conditions are reached.
However, a second opportunity for successful feed-and-bleed may exist.
This would occur after the primary coolant boils away to the point where the core is starting to uncover. The steaming rate then begins to dimin-ish and the PCRVs may be able to depressurize the primary system to the point where the HDI pumps can reflood the core.
Of course, this depressurization is only possible because the decay heat is causing the uncovered fuel's temperature to rise instead of going into steam production. The pressure may not drop fast enough for core melt to be averted, Also, if the uncovered fuel slumps or crumbles and falls into the remaining liquid coolant, pressure will rise again. It is beyond the scope of a prioritization to address this (theoretical) second window possibility. However, any subsequent value/ impact analyses should address the possibility of a second window.
(5) The analysis assumes a 1% failure probability for the PORV(s). Some plants have operated for extensive periods with the PORV block valves closed and electrically disabled. Restoration of power to the block valve operators, and subsequent opening of the block valves and PORVs to permit feed-and-bleed cooling, would take a significant amount of time aw well as opening new possibilities for equipment malfunction and operator error. Thus, such plants might nave feed-and-bleed failure probabilities significantly greater than those calculated in the analysis above.
CONCLUSION Based upon the above analysis, particularly the maximum core-melt frequencies, this issue would normally be placed in the hi h priority category. However, feed-and-bleedtechniquesarebeingevaluatedg38 and will be considered as one option in the resolution of USI A-45.*53 Therefore, this issue should be OROPPED as a separate issue.
05/30/88 3.125-51 NUREG-0933
Revision 3
_ ITEM 125.II.10: HIERARCHY OF IMPROMPTU OPERATOR ACTIONS DESCRIPTION Historical Background During the event, the operators did not initiate feed-and-bleed cooling imme-diately upon reaching plant conditions where feed-and-bleed operations were required by the emergency procedures.940 The feed-and-bleed method of cooling was delayed because of the operators' belief that recovery of feedwater was imminent and their reluctance to release reactor coolant to the containment structure. Even though feedwater flow was recovered t,efore serious damage resulted, the event highlighted the need for establishing a hierarchy of actions in the procedures and/or training which would focus impromptu actions during an event to assure that decisions will be in the direction of safety, and not based on potential plant operational difficulties ,and financial impacts.
Safety Significance Delays in implementing emergency operating procedures (EOPs) in a timely manner could defeat the design safety function of equipment and increase the severity of a transient or accident.
Possible Solution Issue HF4.4 is to provide assurance that plant procedures are adequate and can be used effectively; the objective is to provide procedures that will guide the operators in maintaining the plant in a safe state under all operating condi-tions, including the ability to control upsct conditions without first having to diagnose the specific initiating event. This objective is to be met by:
(1) developing guidelines for preparing, and criteria for evaluating E0Ps, normal oparating procedures, and other procedures that affect plant safety; and (2) upgrading procedures, training the operators in their use, and implementing the upgraded procedures.
In accordance with Appendix A of NUREG-0985, Revision 2, W comparative stuotes have been completed which examined the impact on operator performance in making the transition from procedure to procedure, using either event-based or func-tion-oriented E0Ps. The results of these studies are being incorporated into a larger, ongoing project to develop guidance for achieving successful transitions with nuclear power plant operating procedures. DHFT concluded that, while the procedural guidance package may develop the correct guidance to place the reat-tor in a safe state, it may not prevent reluctance on the part of supervision or an operator to take action which will invariably result in a financial pen-alty. The TMI Action Plan Item I.B.1.3 (Loss of Safety Function) resolution to use existing enforcement options (citations, fines, and shutdowns) provides a deterrent to such actions, including willful violations that could effect'the health and safety of the public (10 CFR 2, Appendix C).IS7 The Commission noted that, while the procedures for enforcement actions may not ensure com-pliance, civil penalties and possibly criminal prosecution for willful viola-tions are strong incentives to comply. NRC policy is that noncompliance should be more expensive than compliance. In cases involving individual operators licensed under 10 CFR Part 55, the Commission policy statementW states that generally licensees are held responsible for the acts of their employees.
06/30/88 3.125-52 NUREG-0933
Revision 3 A
( ) Accordingly, the NRC policy should not be construed as excusing personnel errors.
V Thus, enforcement actions involving individuals, including licensed operators, will be determined on a case-by-case basis. The NRC policy is directed toward encouraging licensee initiativos for self-improvements and identification and correction of such problems.
CONCLUSION The concern raised reiative to reluctance of the licensee (or plant operators) to proceed with appropriate actions to place the plant in a safe state of operation, based on potential plant operational difficulties and financial impacts, is addressed by existing NRC policies.1H '234 Based on the above dis-cussion, the issue involving development of the hierarchy of impromptu operator actions is to be addressed in Issue HF4.4. Therefore, Issue 125.II.10 should be DROPPED as a separate issue.
ITEM 125.11.11: RECOVERY OF HAIN FEEDWATER AS ALTERNATIVE TO AUXILIARY FEEDWATER DESCRIPTION l Historical Background
! The issue deals with alternate means of recovering feedwater, should the AFW l m systems fall, and applies to all PWR plants 840
, Safety Significance j Failure to provide feedwater makeup to the steam generators will cause them to boil dry in approximately 30 minutes or less. (This time varies for plant type and power level). As steam generator water level decreases, heat removal rate is impaired and the temperature of the primary side increases. This leads to 4 an imminent need to initiate feed-and-bleed cooling or find an alternate method i of steam generator makeup. If no means of cooling is provided, the resulting j
loss of primary coolant inventory out of the pressurizer relief and safety
! valves will lead to core uncovery and meltdown.
Possible Solution In the resolution of Issue 124 "Auxiliary Feedwater System Reliability," the staff evaluated potential alternate recovery methods for both main and auxiliary feedwater systems for those plants (7 plants) with two-train AFW systems. The staff effort was predicated on the lower AFW reliability associated with only two-train AFW systems as opposed to the majority of plants that have three-train AFW systems. The staff reviews and evaluations consisted of plant-specific reviews and on-site audits. Contingeat upon implementation of the staff recommendations proposed as the resolution of Issue 124, Issue 125.!!.11 should be dropped as a new and separate issue for these plants.
As a more generic approach, toss previous staff reviews of emergency procedure
, guidelines (EPGs) recognized that alternate methods to provide flow to the l steam generator in the event of a loss of both main feedwater and AFW were 06/30/88 3.125-53 NUREG-0933 i
L
Revision 3 desirable. Therefore, the EPGs for the W and CE plants were revised to include instruction for an alternate means of feedwater recovery. A similar change was also required for inclusion in the B&W EPGs by Generic Letter No. 83-31.1085 CONCLUSION On the basis of the above, this issue should be DROPPED as a separate generic issue.
ITEM 125.11.12: ADEQUACY OF TRAINING REGARDING PORV OPERATION DESCRIPTION Historical Background This issue affects all operating PWRs with PORVs in the primary coolant loop and calls for an assessment of the adequacy of training regarding PORV opera-tions.S40 The issue stems from Findings 8 and 14 of the NRC investigation of the Davis-Besse eventses of June 9, 1985 in which the NRC staff noted that the post-THI improvements that focused on E0Ps and training played a crucial role in mitigating the event. Following actuation of the PORV during the event, the operator observed that the PORV open/close indicator showe.1 that the PORV had closed. In fact, the PORV had not completely closed and, as a result, the reactor pressure decreased at a rapid rate for about 30 seconds. The operator however did not verify closure of the PORV by looking at the acoustical monitor installed after the TMI accident; instead, he looked at the indicated pressure level which appeared steady. As a precautionary measure, the operator closed the PORV block valve. Fortunately, when the block valve was subsequently opened to assure PORV availability, the PORV had closed during the time the block valve was closed. Had the operator looked at the acoustical monitor, the need to close the block valve may have been factually confirmed and may have precluded the need for relying on the precautionary action taken. However, it should be noted that the operators have not generally placed high reliance on the acousti-cal monitors because of PORV leakage problems.
Safety Significance Assessments of the adequacy of training and hands 2on experience, referred to as performance-based training or Systems Approrch to Training (SAT), ir con-sidered essential for providing assurance that nuclear power plants are operated in a safe state under all operating conditions. The adequacy of training regarding the PORV operation is part of the assessments of the performance-based training evaluations described in Issue 125.I.7.b, "Realistic Hands-on Training."
Possible Solution A possible solution to this issue is to include an assessitent of the adequacy of training regarding PORV operations in the job catalog c'f necessary tasks and functions required to safely operate and centrol nuclear power plant operations.
O 06/30/88 3.125-54 NUREG-0933 i
Revision 3 y PRIORITY DETERMINATION Frequency Estimate PORY Challenge Frequency: The PORV challenge frequency was determined to be approximately 1/RY in Issue 70, "PORY and Block Valve Reliability."
PORV/ Block Valve Failure Frequenje : The frequency of failure of the PORV to close, given that it has opened, is estimated to be 0.01/ demand (See Issue 70).
The frequency of failure of the block valve to function is estimated to be 0.003/ demand (See Issue 70).
Operator Error Frequency: Based on the information in Issue 70, the human error probability (HEP) to close the PORV after the TMI Action Plan <s improvements and increased emphasis on operator training is estimated to be 0.05.
PORV-SBLOCA frequency: The estimated base-case PORV/ block-valve SBLOCA fre-quency (5.3 x 10 '/RY) is the product of the PORV challenge frequency (1.0), the probability that the PORV sticks open (0.01), and the probability that the operatar will not close the PORV or the block valve fails to close (0.05 + 0.003).
To assess the potential improvement in HEP for PORV operations that may result from adequate hands-on training in upgraded simulators, a 30% reduction in HEP is assumed. (See Issue I.A.4.2, "Long-Term Training Simulator Upgrade.")
Adjusting the above HEP = 0.05 to account for the potential reduction in HEP, I the adjusted HEP = (0.7)(0.05) = 0.035. The resulting potential reduction in l O PORV-5BLOCA frequency derived by requiring the PORV training in the job catalog V (Issue HF3.1) is therefore estimated to be [(5.3 x 10 4)/RY - (1.0)(0.01)
(0.035 + 0.003] = 2.5 x 10 4/RY. Given the visibility of PORV training since l the TMi-2 accident, the above 30% reduction in HEP may over-estimate the poten-tial HEP benefit. However, the assumed 30% reduction is expected to bound the safety significance of this issue.
! Consequence Estimate Ratioing the above reduction in PORV-SBLOCA frequency (2.5 x 10 4/RY) to the PORV-SBLOCA frequency from Issue 70 (1.05 x 10 3/RY) and multiplying by the yields the potential reduc-core-melt tion in core-melt frequency from Issue frequency for this70 (4.2ofx (0.
issue 10 S/RY)24)(4.2 x 10 4/RY) = 10 S/RY.
Fae public risk reduction is therefore (0.24)(31 man-rem / reactor) = 7.4 man-rem /
reactor (See issue 70).
CONCLUSION Issue HF3.1 evaluated the task selection process for training program content based on the relative importance of operator tasks and requirements. Tasks involving the use of PORVs for both feed-and-bleed cooling and for identifica-tion of potential LOCAs are included in the generic INPO task analysis listings for PWRs and in NUREG-1122,574 Item EK3.03, "Actions Contained in E0P for PZR Vapor Space Accident /LOCA." This event has one of the highest importance ratings (4.6 of 5.0) for PWRs and is included in both training and NRC exams.
The high frequency of PORV challenges is to be addressed in Issue HF3.1. There-fore, Issue 125.II.12 should be OROPPED as a separate issue.
06/30/88 3.125-55 NUREG-0933
Revision 3
_ ITEM 125.II.13: OPERATOR JOB AIDS O
DESCRIPTION In a DHFT memorandums 00 on September 19, 1985, it was suggested that an assess-ment be made of the availability of appropriate job aids to obviate operators having to rely heavily on laemory in emergency or "crisis" conditions. In a OSR0 memorandum 10" of June 12, 1986, it was requested that OHFT evaluate this issue for inclusion in the Human Factors Program Plan (HFPP) or perform an analysis of the issue to determine its priority.
Safety Significance In the Davis-Besse occurrence, two operator-related problems were encountered which were involved in the sequence of events that transpired. The first problem occurred when the secondary side operator, anticipating the automatic trip of the Steam feedwater Rupture Control system (SFRCS), which would start the AFW system, elected to perform a manual trip. However, the operator selected and, and of instead actuated the initiating anwrong SFRCS pairtriof pushbuttons from a set of five pairs obtained a trfp for low steam pressure.p for low water in the steam generators, This action isolated both steam generators from the AFW system by closing the isolation valves. At about the sane time, both AFW pump turbines tripped oc overspeed.
due room. to the overspeed trips could not be accomplished by actions in the controlRecovery The second problem was encountered when two equipment operators were unable to reset thetoAFW delivery pump generators.
the steam turbine trip throttle valves and promptly restore feedwater Both equipment operators, while having a reasonable amount of nuclear power plant experience, had never previously per-formed the task of resetting, latching and opening the turbine trip throttle valves, particularly under full operating pressure. One equipment operator had successfully reset and latched the No.2 trip-throttle valve but, due to the high friction caused by large differential pressure across the valve gate, removed only the mechanical slack in the valve mechanism and did not open the valve.
The other operator had latched but did 90t reset the No. I trip-throttle valve and torque to open had partially the valve opened further.the valve, but was fearful of applying more 2/3 its normal speed, which did not provide enough discharge pressure toThe tu inject water into the steam generator, it was nnt until tht assistant shift supervisor came into the pump room that the operators knew that the trip-throttle valves were not opened enough. At about the same time, another, more experienced, equipment operator arrived with a valve wrench; using this tool '
he valve. successfully opened the No.2 valve then also reset and opened the No. 1 P ,sible Solution It is conceivable that opetator aids could have reduced the likelihood of the first operator error and decreased the time required for the equipment opera-tors to open the turbine trip-throttle valvas. "Operator aids" is a term which applies toina accomplishing mentally, broad categorytheir of items tasks.which assist the operators, physically or Operator aids may be markings or cod-ings, tags, tools or devices to physically assist the operator, thr. layout or 06/30/83 3.125-56 NUREG-0933
Revision 3 O
arrangement of equipment items, and the equipment design features including provision for human interf ace. Examples of operator aids which could have assisted the control room and equipment operators include, but should not be limited, to the following:
(a) The markings on the SFRCS pushbuttons could have described the results of actuation rather than the trip which they generate. For example, instead of low steam pressure trip, the inscription might read SG feed-water isolation; and instead of low water level trip, they might be labeled AF initiation.
(b) Since a valve wrench is required to open the trip-throttle valves under pressure, a valve wrench might be permanently stored in the AFW pump rooms for use in emergencies.
(c) Since there existed some confusion about resetting and latching the trip-throttle valves, linkage guidance or instructions could be depicted on the AFW pump room walls to guide the unfamiliar. The mechanical link-age could also have been color-coded or conspicuously marked.
Again, the preceding are only examples of operator aids and are not intended to be an exhaustive list of all such operator aids which could have 2nhanced the operators actions in the Davis-Besse event. Other generic issues that are related to the safety concern of this issue include: 125.I.7.a. "Recovery of Failed Equipment"; 125.I.7.b. "Realistic Hands on Training"; and 125.11.10 "Hierarchy of Impromptu Operator Actions."
CONCLUSION There certainly is no dispute that operator job aids can enhance an operator's ability to perform his task. However, any attempt to define what job aids are needed on a generic basis is very difficult. Even more difficult are efforts to quantify the risk reduction which can result from efforts to improve or pro-vide absent job aids. Any attempt at quantification would be very arbitrary and without much justification. Operator job aids is not a solution that stands on its own merit, but is supportive of other human factors elements such as staffing, qualifications, and training. While the availability of operator job aids may enhance an operator's ability to accomplish his task, the absence of job aids only reduces the reliability of human performance and does not neces-sarily imply operator failure.
The presence or absence of operator job aids becomes a factor which is consid-ered in the job task analysis and upon which training requirements are estab-lished. Provisions are included in the INP0-managed training accreditation program to ensure that the feedback from operating events such as the Davis-Besse event are included in utility training programs. In addition, a portion of the operator job aids is to be addressed in the resolution of the man-machine interface Issue HFS.1, "Local Control Stations."
The safety concern of this issue has been addressed by the INPO Training Accreditation Program which was endorsed in March 1985 by the Commission Policy Statement on Training and Qualification of Nuclear Power Plant Personnel."'
Therefore, this issue will be DROPPED from further consideration as a separate issue.
06/30/88 3.125-57 NUREG-0933
Revision 3
.! TEM 125.11.14:
__ LOCALLY REMOTE OPERATION OF EQUIPMENT WHICH MUST NOW BE OPERATED DESCRIPTION Historical Background During the course of the investigation of the event, it was noted that a startup feedwater pump (SUFP), a part of the main feedwater system that would have been very helpf al in the mitigation of the transient, had oeen intentionally disabled because of an NRC concern with high energy line breaks in tie area of essential safety equipment and the ability of ECCS equipment to meet single failure criteria.
Although the Davis-Besse event specifically involved a SUFP, it is intended that this issue cover all equipment that has been discbled such that it is no longer remotely operable from the control room.
Safety Significance The significance of purposely disabled equipment lies primarily in timing, Generally, it is possible to restore such equipment to an operable status, However, plant personnel must be dispatched to the equipment to perform local, l
manual operations snd closing breakers, such etc.as unlocking and manipulating manual valves, restoring This can require considerable time and restoration to operability may well come too late to aid in accident mitigation. Moreover, the relatively are complex procedures involved, done under emergency conditions, prone to error.
the disabled equipment is rendered inaccessible. Finally, the nature of the incident may Possible Srlution The solution preposed 900 is straightforward:
"Peview each piece of motor-operated equipment originally designed to be operated from the control room or other panel areas which has been disabled physically such that it can only be operated locally to determine whether such disabling truly is in the interest of overall plant safety."
_ PRIORITY DETERMINAT!6N Oser the years, intentionally there base been many instar...s where equipment has been disabled. In the case of the Davis-Besse SUFP, the reason was to ensure that the discharge lines, which are not seismically qualified and disablealso which this are routed near essential safety equipment, couM not rupture and equipment. Other reasons also exist. For example, equipment has to meet the single failurebycriterion.
in the past been disabled removal of breakers to permit older ECCS designs l
' This issue is non-specific in the sense that it addresset equipment. any of this disabled Thti, re-enabling transient-inititted sequence;, of etc.
tnis equipment may affect LOCA sequences, is upossible to quantify all aspects explicitly.Because of this we The approach very willgeneral use is nature, it to evaluate a SUFP similar to that of Davis-Besse, but (unlike the case of Davis-Besse) capable of providing sufficient flow by itself to permit decay heat remosal by means of the steam generators. Because such a pump would help mitigate transient-initiated sequences, which are relatively frequent compared 06/30/E8 3.125-58 l
Revision 3 Ov to (for example) LOCA-initiated sequences, this scenario should provide an upper bound to the priority parameters.
Frequency Estimate The sequence of interest is straightforward. It is initiated by a nonrecover-able loss of main feedwater. If the auxiliary feedwater system fails, the SUFP is not re-enabled in time, and feed-and-bleed techniques fail, core melt will ensue.
For the initiatinr, event frequency (non-recoverable loss of main feedwater) we will use 0.64 mnt/RY, based upon the Oconee PRA done by Duke Power Co.I*8 This figure is based upon fault tree analysis and should be reasonably repre-sentative of most main feedwater system designs.
For a three-train AFW system, a "typical" unavailability is 1.8 x 10 5/ demand.as4 The analogous figure for a two-train system is significantly higher. However, an existing program (Issue 124) is considering whether to upgrade all AFW systems to a point where the maximum unavailability would be 10 */ demand. These plants would almost certainly upgrade their SUFPs (if present) to help meet this crite-rien, which makes this issue moot for these plants; thus, we will use 1.8 x 10 5/ demand.
We will assume a typical value of 0.20 for the failure probability of feed-and-L'eed cooling, based upon the calculations presented under Issue 125.11.9, "Enhanced Feed-and-Bleed Capability."
( The SUFP non-recovery probability remains to be calculated. According to the Investigation Team's report on the Davis-Besse event,888 restoration of the SUFP normal'y takes 15 to 20 minutes. Nevertheless, the assistant shift super-visor manai<d to do it in roughly 4 minutes during the June 9, 1985 event.
Obviously, not all plant personnel are going to go through the procedure as rapidly as the assistant shift supervisor at Davis-Besse even given the extra motivation of a real event. We will assume that the time needed to restore the SUFP to operability can be described by a normal distribution, centered at 17.5 minutes and with a width such that the assistant shift supervisor's performance of 4 minutes is at the first 95 percentile point.
The time intervals above are measured from the start of the restoration proce-dure. It is desirable for calculational purposes to measure time from the initiation of the transient. Noting from NUREG-1154ase that the $UFP was restored at t = 16.38 minutes (measured from the start of the transient) after four minutes of rapid work on the part of the assistant shif t supervisor, the significant times are:
t = 0, start of transient t = 12.38 minutes, start work on SUFP 195 = 16.38 minutes, 95 percentile point t0 = 29.88 minutes, mean time for restoration 0 06/30/88 3.125-59 NUREG-0933
Revision 3 Thus, the probability of the SUFP being restored within the interval from t to (t + dt) is given by:
P(t)dt=([ldc)1 exp { li [(t-t )/o] jdt 0
where o = 8.93 minutes (based on0 t -t95 = 13.5 minutes)
If one is willing to wait long enough, the integratert probability of restora-tion approaches unity. However, there is a point in time af ter which restora-tion of the SUFP will no longer save the core. Although it is not clear just when this tim 6 is, it is safe to assume that it occurs after steam generator dryout which is typically at least 25 minutes into the transient. The proba-bility of no restoration is given by:
P p (T) = [ P(t) dt, where T 2 25 minutes T
There is no closed form solution to this integral. However, standard statis-tical tables readily give an answer of Pp(T) 5 0.29.
One last effect needs to be considered. Consistent with Issue 122.3, "Physical Security System Constraints," an additional 1% probability of the plant per-sonnel being unable to reach the equipment location because of locked doors, etc., must be considered. The core-melt frequency then becomes:
Core-melt /RY 5 (0.64 loss nf main feedwater events /RY) x (1.8 x 10 5 AFW failure probability) x (0.20 feed-and-bleed failure probability) x (0.29 + 0.01 SUFP non-restoration probability) 5 6.9 x 10 7 Consequence Estimate The core-relt sequence under consideration here involves a core-melt with no large breaks initially in the reactor coolant pressure boundary. The reactor is likely to be at high pressure (until the core melts through the lower vessel head) with a steady discharge of steam and gases through the PORV(s). These are conditions likely to produce significant hydrogen generation and combustion.
The Zion and Indian Point PRA studies used a 3% probability of containment failure due to hydrogen burn (the "gamma" failure). We will follow this example and use 3Ti, bearing in mind that specific containment designs may differ significantly from this figure.
In addition, the containment can fail to isolate (tne "beta" failure). Here, the Oconee PRA figure of 0.0053 will be used. If the containment does not fail by isolation failure or hydrogen burn, it will be assumed to fail by base-mat melt-through (the "epsilon" failure).
O 06/30/88 3.125-60 NUREG-0933
Revision 3 1 m Using the usual prioritization assumptions of a central midwest plains ucteor-ology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequences are:
Failure Percent Release Consequences Mode Probability Category (man-rem) 1 gamma 3.0% PWR-2 4.8 x 108 beta 0.5% PWR-5 1.0 x 108 epsilon 96.5% PWR-7 2.3 x 103 ,
The "weighted-average" core-melt will have consequences of 1.5 x 105 man-rem.
The plants to be examined include all operating plants (presently 94). As of the f all of 1987 (the earliest that changes are likely to be stade), these plants will have an aggregate remaining license lifetime of 2718 RY. This corresponds to an average lifetime of 29 calendar years per plant. At a 75% utilization factor, this is 22 operational years per plant. ,
It is not known how many plants would be affected by this issue. We will assume that at least a few plants will be found and will calculate priority l parameters on a per-plant basis. Thus the estimated risk reduction per plant is (6.9 x 10 1) (22)(1.5 x 105) man-rem, or 2.3 man-rem.
Cost Estimate 1
i The tix for this issue, once equipment is identified, is to do a detailed l
analysistoseeifthedisablingofthesubjectequipmentistrulyinthe interest of plant safety. If the analysis indicates that the equipment should not be disabled, the original reason for disabling must still be addressed.
I (Alternatives to disabling may be necessary to address the original concern.) ,
l i
The minimum cost would correspond to a case where the ;,quipment is process equipment, which is fully maintained and needs only to have valves opened and breakers re-installed, which would take (we assume) roughly 17.5 minutes of f labor. If it also turns out that no other alternatives are necessary, the cost would be dominated by analysis and paperwork. We estimate that prob-abilistic analyses would require approximately 10 weeks of staff time (NRC ar.d
[
industry combined) par plant, at $100.000/ staff year. In addition, per-plant !
costs of $13,000 for NRC and $16,000 for the licensee would be incurred for a t typical straightforward technical specification change. The minimum cost is then about $50,000/ plant.
! Value/ Impact Assessment i
3 Based on a potential risk reduction of 2.3 man-rem / reactor and a cost of
$50,000/ reactor, the value/ impact score is given by:
b
- 2.3 man-rem / reactor
~50.05M/ reactor i l
1 = 46 man-rem /$M
\
i
\
06/30/88 3.125-61 NUREG-0933
Revision 3 Otner Considerations The aggregate paramett (total man-rem, all reactors, and total corc-melt / year, all reactors) are not c<lculated here. An examination of the scale factors for these parameters readily shows that at least 50 plants must be affected before it is possible for these parameters to be limiting, in most cases, the fix will not involve work within radiation fields and thus will not involve ORE. The ORE averted due to post-feed and-bleed cleanup and post-core-melt cleanup is a minor consideration. The ORE associated with cleanup is estimated to be 1800 man-rem, after a primary coolant spill, ar.d 20,000 man-rem, after a core-melt accident.64 If the frequency of feed-and-bleed events is 3.46 x 10 8/RV, the actuarial cleanup ORE averted is only 0.14 man-rem / reactor. Simi16rly, a core-melt frequency of 6.9 x 10 7/RY corresponds to an actuarial averted cleanup ORE of only 0.30 man-rem / reactor.
If averted ORE were added to t.he man-rem / reactor and man-rem /$M figures above, no conclusions would change.
The proposed fix would reduce core-melt frequency and the fregt;ency of feed-and-bleed events and th'retore would avert cleanup costs and replacement power costs. The cost of a feed-and-bleed usage is dominated by roughly sia months of replacement power whilt the cleanup is in progress. If the average frequency of such events is 3.46 x 10 6/RY and the average remaining lifetirae is 21 calendar years at 75% utilization, then making the usual assumptions of a 5% annual discount rate and a replacement power cost of $300,000 per day, the ,ctuarial savings for feed-and-ble'J cleanup is estimated to be $2,200.
Simi;arly, the actuarial savings of averted core-melt cleanup (which is assumed to cost one t,illion dollars if it happens) are about $7,900. The actuarial savints from replacement power af ter a core-melt up t. the end of the plant life a e about $9,600. (ihi:, last figure represents the lost capital invest-ment ir, the plant.) If these theoretical cost savings were subtracted from the emptnse of the fix, the man-rem /$M would rise to 76 and would not change any conc.usions.
Some caution is needed in the use of the numbers calculated above. it must be remembered that these are maximum numbers, calculated for a worst case scenario, it must also be remembered that equipment has often been disabled for good reasons. Re-enabling such equipment will generally have drawbacks as well as benefits and the net effect on plant safety is not necessarily positive.
CONCLUSION Based upon the figures presented above, this issue sc.ould be placed in the LOW priority category.
O 06/30/83 3.125-62 NUREG-0933 s
Revision 3 REFERENCES
- 16. WASH-1400, (NUREG-75/014), "Reactor Safety Study, An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975.
- 48. NUREG-0660, "NRC Action Plan Developed as a Result of the THI-2 Accident,"
U.S. Nuclear Regulatory Commission, May 198U.
- 54. NUREG/CR-1659, "Reactor Safety Study Methodology Applications Program,"
U.S. Nuclear Regulatory Commission, 1981.
I
- 64. NUREG/CR-2800, "Guidelines for Nuclear Power Plant Safety fi?ue Priori-tization Information Development," U.S. Nuclear Regulatory t.ommission, February 1983, (Supplement 1) May 1983, (Supplement 2) December 1983, (Supplement 3) September 1985.
- 96. NUREG-0565, "Staff Report on the Generic Evaluation of Small-Break Loss-of-Coolant Accident Behavior for Babcock and Wilcox Operating Plants,"
U.S. Nuclear Regulatory Commission, January 1980.
- 98. NUREG-0737, "Clarification of TMI Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980.
197. Code of Federal Regulations, Title 10, Energy.
210. NUREG-0885, Issue I, "U.S. Nuclear Regulatory Commission Policy and Planning Guidance," U.S. Nuclear Regulatory Commission, January 1982.
O~ 234. Federal Register, Vol. 47, No. 46, "10 CFR Part 2, General Statement of Policy and Procedure for Enforcement Actions," March 9, 1982.
307. EPRI NP 2230, "ATWS: A Reappraisal, Part 3," Electric Power Research Institute, 1982.
339. NUREG/CR-1278, "Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications," U.S. Nuclear Regulatory Commission,
/ebruary 1983. ,
366. NUREG/CR-2787, "Interim Reliability Evaluatio.: Program: Analysis of the Arkansas Nuclear One-Unit 1 Nuclear Power Plant," U.S. Nuclear Regulatory Commission, June 1982.
376. NRC Letter to All Licensees of Operating Reactors, Applicants for Operating Licenses, and Holders of Construction Permits, "Supplement 1 to NUREG-0737, Requirements for Emergency Response Capability (Generic Letter No. 82-33),"
December 17, 1982-439. Regulatory Guide 1.149, "Nuclear Power Plant Simulators for Use in Operator Training," U.S. Nuclea. Regulatory Commission, April 1981.
. 651. NUREG 0985, Revision 2, "U.S. Nuclear Ret'latory Commission Human Factors Program Plan," U.S. Nuclear Regueatory Commission, April 1986.
06/30/88 3.125-63 NUREG-0933
Revision 3 738. NUREG-1044, "Evaluation of the Need for a Rapid Depressurization Capability for CE Plant," U.S. Nuclear Regulatory Commission, December 1984.
$w 885. Memorandum for H. Thompson from D. Crutchfield, "Potential Immediate l
f- Generic Actions as a Result of the Davis-Besse Event of June 9, 1985,"
August 5, 1985.
I 886. NUREG-1154, "Loss of Main and Auxiliary Feedwater Event at the Davis-Besse Plant on June 9,1985," U.S. Nuclear Regulatory Commission, July 1985.
887. Memorandum for T. Speis from H. Thompson, "Short Term Gentric Actions as s .ksult of the Davis-Besse Event of June 9, 1985," August 19, 1985.
889. NSAC-60, "A Probabilistic Risk Assessment of Oconee Unit 3," Electric Power Research Institute, June 1984.
894. Memorandum for 0. Parr from A. Thadani, "Auxiliary feedwater System - CRGR Package,' November 9, 1984.
895. Memorandum for H. Dentoq, et al. , f rom W. Dircks, "Staf f Actions Result-ing from5,the August Investigation of the June 9 Davis-Besse Event (NUREG-1154),"
1985.
896. SECY-86-56, "Status of Staff Study to Determine if PORVs Should be Safety Grade," February 18, 1986.
897 Memorandum for G. Lainas from F. Rowsome, "Safety Eval tion of the CE Licensees' Responses to TMI Action Item II.K.3.2," August 26, 1983.
898. Memorandum for G. Lainas from F. Rowsome, "Safety Evaluation of the B&W Licensees' Responses to TMI Action Item II.K.3.2," August 24, 1983.
899. Memorandum fo G. Lainas from F. Rowsome, "Safety Evaluation of the West-inghouse Licensee Responses to TMI Action Item II.K.3.2," July 22, 1983.
900. Momorandum for H. Thompson from W. Russell, "Comments on Draft List of Longer Term Generic Actions as a Result of the Davis-Besse Event of June 9, 1985," September 19, 1985.
940. Memorandum for T. Speis from H. Thompson, "Longer-Term Generic Actions as a Result of the Davis-Besse Event of June 9, 1985," November 6, 1985.
941. Memorandum for B. Morris from D. Basdekas, "Concerns Related to the Davis-Besse Incident on June 9, 1985," August 13, 1985.
942. Memorandum for F. Gillespie from D. Basdekas, "Concerns Related to the Davis-Besse Incident on June 9, 1985," September 27, 1985.
943. Memorandum for A. DeAgazio from D. Crutchfield, "Davis Besse Restart Safety Evaluation (TAC No. 59702)," December 17, 1985.
944. Letter to G. Ogeka (BNL) f rom T. Speis (NRC), "BNL Technical Assistance to the D tision of Safety Review and Oversight, Office of Nuclear Reactor Regulation, 1986.
NRC . ira .1uction of Risk Uncertainty' (FIN A-3846)," April 28,
Revision 3 O 945. Memorandum for K. Kniel from R. Riggs, "0TSG Thermal Stress (GI 125. II.4),"
June 17. 1986.
946. Memorandum for H. Thompson from R. Bernero, "Auxiliary Feedwater Systems "
August 23, 1985.
947. Memorandum for H. Thompson and T. Speis from R. Bernero, "Request for Com-ments on Draft CRGR Package with Requirements for Upgrading Auxiliary Feedwater Systems in Certain Operating Plants," October 3, 1985.
948. Memorandum for H. Thompson from G. Edison, "Recommendation for Longer Term Generic Action as a Result of Davis-Besse Event of June 9, 1985,"
September 11, 1985.
949. Memorandum for F. Miraglia from G. Edison, "Prioritization of Generic Issue 125.II.I.D," April 25, 1986.
950. BAW-1919, "B&W Owners' Group Trip Reduction and Transient Response Improvement Program," May 31, 1986.
J 951. Memorandum for H. Thompson and W. Minners from i. Rowsome, "Another Generic Safety Issue Suggested by the Davis-Besse Incident of June 9, 1985,"
September 9, 1985. '
952. Memorandum for W. Minners from K. Kniel, "Value/ Impact Assessment for Draft CRGR Package Requiring Upgrading of Auxiliary Feedwater Systems in Certain Operating Plants," January 16, 1986.
I
;3.
Memorandum for G. Mazetis from A. Marchese, "Revised Outline of Regulatory l Analysis for USI A-45," January 14, 1986.
i 957. Federal Register Notice 49 FR 46428, "10 CFR Parts 50 and 55, Operator's .
Licenses and Conforming Amendment," November 26, 1984. '
966. Federal Register Notice 50 FR 11147, "10 CFR Ch.1, Corenission Policy ,
) Statement on Training and Qualification of Nuclear Power Plant Personnel,"
March 20, 1985.
t 973. Memorandum for T. Speis from W. Minners, "Schedule for Resolving Generic Issue No. 125.II.1.b, ' Review Existing AFW Systems for' Single Failure,'"
December 10, 1986.
I 993. NUREG-1220, "Training Review Criteria and Procedures," U.S. Nuclear R2gulatory Commission, July 1986.
996. Federal Register Notice 50 FR 436?l, "Commission Policy Statement on Engineering Expertise on Shift," October 28, 1985.
' "':orandum for H. Clayton from B. Sheron, "Criteria for Initiation of l cnd Bleed," September 13, 1985, 1003. Memorandum for W. Russell from K. Perkins, "Generic Issue 125.I.8,
' Procedures and Staffing for Reporting ta NRC Operations Center,'"
November 25, 1986.
06/30/88 3.125-65 NUREG-0933 l
1
Revision 3 1004. Memorandum for G. Lainas and D. Crutchfield from F. Rowsome, "Davis-Besse Restart Considerations," August 13, 1985.
1005. Memorandum for V. Stello from D. Ward, "ACRS Comments on Proposed Resolution of Generic Issue 124, ' Auxiliary Feedwater System Reliabil-ity,'" September 17, 1986.
1011.NUREG 1177, "Safety Evaluation Report Related to the Restart of Davis-Besse Nuclear Power Station, Unit 1, Following the Event of June 9, 1385,"
U.S. Nuclear Regulatory Commission, June 1986.
1012. Federal Register Notice 50 FR 29937, "10 CFR Part 50, Analysis of Potential Pressurized Thermal Shock Events," July 23, 1985.
1013.NUREG-1212, "Status of Maintenance in the U.S. Nuclear Power Industry 1985 " U.S. Nuclear Regulatory Commission, (Volumes 1 and 2), June 1986.
1023.SECY-86-231, "Survey on Engineering Expertise on Shift," August 6, 1986.
1036.IE Bulletin No. 85-03, "Motor-Operated Valve Common Mode Failures During Plant Transients Due to Improper Switch Settings," U.S. Nuclear Regulatory Commission, November 15, 1985 1037.SECY-83-484, "Requirements for Emergency Resporse Capability,"
November 29, 1983.
1038.IE Information Notice No. 86-10, "Safety Parameter Display System Malfunctions," U.S. Nuclear Regulatory Corrmission, February 13, 1986.
1039. Memorandum for H. Denton from T. Speis, "Prioritization of Selected MPA; (Operating Plan, Item VI.B.6.b)," October 19, 1984.
1040.NUREG/CR-3246, "The Effect of Some Operations and Control Room Improvements on the Safety of the Arkansas Nuclear One, Unit One, Nuclear Power Plant," U.S. Nuclear Regulatory Commission, June 1983.
1072. Memorandum for W. Russell from T. Speis, "Generic Issue 125.11.13 -
Operator Job Aids," June 12, 1986.
1083. Memorandum for T. Speis from F. Gillespie, "Review of RES Proposed Prioritization of Generic Issue (GI) 125.11.11, ' Recovery of Mai, Feedwater as an Alternative to Auxiliary Feedwater,'" April 27, 1988.
1085.NRC Letter to All Operating Reactor Licensees, Applicants for an Operating License and Holders of Construction Permits for Babcock &
Wilcox Pressurized Water Reactors, "Safety Evaluation of ' Abnormal Transient Operating Guidelines,' (Generic Letter 83-31)," September 19, 1983.
O 06/30/88 3.125-66 NUREG-0933
o ISSUE 126: RELIABILITY OF PWR MAIN STEAM SAFETY VALVES DESCRIPTION Historical Background The rel! ability of PWR main steara safety valves (MSSVs) was identified as a generic issue in a OSR0 memorandum on March 19861047 in which it was noted that individual PWR plant FSARs assume credit for MsSV functional capability to provide overpressure protection for the secondary system. This protection includes the ability of the MSSVs to achieve full ASME Code rated discharge flow at the design setpoint, to relieve in a stable manner, and to re-close at the design reseat prnssure. However, 'n accordance with IE Information Notice No. 86-05.1048 two representative ASML Class 2 MSSVs from the Seabrook plant did not meet the ASME Code requirements wh:n subjected to full-flow testing at Wyle Laboratories. The Wyle tests were uriginally intended to determine the proper vent stack size to be used with the MSSVs at the Seabrook plant.
The staff noted1048 in the Wyle test report that one of the Seabrook valves was tested at the factory ring-setting at c pressure greater than 1325 psi. This pressure was approximately 7% greater than the valve setpoint. In this test, the valva achieved a full-lift disc travel of approximately one inch. However, when both valves were tested at the factory ring-settings and pressures cor-respcnding to the ASME 3% accumulation pressures, their discs only traveled x approximately 50% of the full lif t necessary to develop the rated steam flow.
) To proceed with the vent stack testing, the guide-ring settings on both MSSVs j were adjusted down approximately 130 notches. At the lower MSSV ring-settings, full lifts within the specified ASME 3% accumulation were achieved and the vent stack tests were cor,ipleted.
In accordance with Supplement 1 to IE Information Notice No. 86-05,1048 MSSV testing by Wyle Laboratories for the Vogtle (PWR) plant also indicated the as-shipped MSSV rirg-settings would not achieve the fuli-lift travel within the ASME 3% accumulation requirement for full relief capacity. The typical result was 75% of the full lift. The proper ring-settings to achieve full lift were significantly different than the ring-settings of the Seabrook MSSVs.
l While inspecting the Millstone Unit 3 MSSVs, licensee personnel found th the i ring-settings were not set to the valve vendor's recommendations. After an in-l vestigation, it was determined that the valve vendor had not reset the rings i following functional testing. The cause was attributed to a wndor procodm al deticency.
The licensee (Pennsylvania fr e ! Light) for the Susquehanna BWR Units 1 and 2, recogn Ding the valve designations described in IE Information Notice No. M-05, 3 " '
- became concerned that the Susquehanna valves were the same type as those tested for Seabrook. However, it was later found that the Susquehanna valves were not the same model as the Seabrook or Vogtle valves. Because the Susquehanna valves also contained adjusting rings which determine the flow d 06/30/88 3.126-1 NUPEG-0933
capacity and blowdown, Supplement 1 to IE Information Notice No. 86-052 48 was addressed to all reactor facilities holding an operating license or a construc-tion permit.
The PWR MSSV ring-setting problem; described above are similar to the improper ring-cetting problems encovatered in the 1982 EPRI primary safety valve tests completed in response to Item II.D.1 of NUREG-0737.98 NRC verification of the adequacy of all operating PWR plants primary Class 1 safety valve ring-settings are currently being pursued under MPA F-14; the ring-settings of the operating BWR plants Class 1 MSSVs and MSSRVs are not being pursued under MPA F-14. Many BWRs licensed since the TMI-2 accident have MSSRVs with adjusting rings.
Because of NSSS vendor equipment qualification requirements, these valves have been full-flow tested and the rings adjusted to assure full lift. However, a few of the older BWRs may have MSSRVs which have not been full-flow tested and their ring settings may be based on extrapolation from smaller valves.
For future plants, changes were incorporated in 1985 to the ASME Code require-ments for Class 1 valves (which include PWR primary safety valves, BWR MSSVs, and BWR MSSRVs) to require full-flow testing of prototype valves. These changes should resolve future concerns for Class 1 valves. Because the Class 2 PWR MSSVs on most PWRs (while not necessarily having the same vendor) are at the upper end of the valve size range, the general capacity certification may have been by the ASME coefficient of discharge method. Therefore, certification by full-flow testing of the PWR MSSVs may not have been performed.
The staff has raised the Class 2 PWR MSSV ring-setting concerns for these Class 2 valves with the ASME Code Committee. The NRR proposal which would require full-flow testing of the Class 2 PWR MSSVs passed the ASME Main Boiler and Pressure Vessel Code Committee with no negative and no abstention ballots.1 50 Future revisions to the ASME Code Class 2 valve requirements are not sufficient to resolve the ring-setting concerns or the need for full-flow testing of the existing PWR MSSVs on operating plants.
Based on the above discussions, this issue is a generic issue for the Class 2 MSSVs in operating PWR plants. It is also the staff's opinion that the BWR Class 1 valves, which have iii general been full-flow tested, may have similar ring-setting problems, but the problems may edst only for a few of the older BWR olants and may therefore be best classified as a plant-specific issue for BWR plants.
Safety Significance PWR plant FSARs assume credit for MSSV functional capacity to prcvide overpres-sure protection for the secondary system. This includes the ability to achieve full ASME Code rated discharge at the design setpoint for the secondary system.
Inadequate MSSV relief capacity might therefore result in overpressurization of the secondary system, a degradation of secondary heat removal from the primary system, or MSSV instability. MSSV instability (valve chatte-) could result in stuck-open MSSVs which could result in excessive secondary system blowdown (loss of secondary system inventory) and overcooling of the primary system.
Additional equipment failures and/or operator errors in combination with the above cases are evalaated herein to assess the potential safety significance O
06/30/88 3.126-2 NUREG-0933
,...____m..__ m.____ _____- _ _ _ __ _ _ .- ___ _ ___ _ __ _ ~ _ . . _
! i 1
and potential public risks associated with imnroper Class 2 MSSV ring-settings (p) v in PWR plants.
j Possible Solution l To assure valve rated capacities for the PWR Class 2 MS$Vs and the capability
) to function and properly reseat, it may be necessary to conduct full-flow
- l tests of the PWR MSSVs. Changes to the ASME Class 2 safety valve requirements,
- similar to the ASME changes already made for the ASME Class 1 safety valves, are currently being pursued by the staff and the ASME Code Committee. The staff j has requested Regional inspections to verify adequate flow capacity of the ;
j MSSVs and proper ring adjustments.1 M ;
e
~
PRIORITY DETERMINATION l
Evaluation of this issue includes potential MSSV failures (stuck-open) from in-adequate M35V flow capacities and improper ring settings that may result in L SGTRs. The staff's evaluations of SGTRs (as initiating events) are reported in I NUREG-0844,6"2 which constitutes the proposed resolution of USIs A-3, A-a, and A-5. The following conditions (cases) that may result from improper MSSV ring settings will be considered:
Case 1: Improper MSSV ring settings that result in inadequate MSSV lifts may result in degraded secondary side heat removal capabilities and lead to over-pressurization of the primary side RCS.
Case 2: Improper MSSV ring settings may lead to MSSV instabilities causing valve chatter and MSSV failures to close. Failure to close (stuck-open) of the MSSVs can lead to overcooling of the RCS. Case 2a involves failure of a single MSSV to close. Case 2b involves failure to close of multiple (two or more)
MSSVs, with various combinations of SGTRs induced by the rapid pressure reduc-tion resulting from the stuck open MSSVs.
Case 1: RCS Overpressurization (Inadequate MSSV Lift)
The frequency of pressurizer overpressure events in operating reactors is 3 x 10 2/RY.ao7 For the purposes of this analysis, we will attribute all the pressurizer overpressure events to inadequate MTSV lift capacities. This assumption will bound any subset frequency of degraded secondary side heat removal events that may have resulted from improper MSSV ring settings.
Frequency Estimate Assuming at least one PORV is operable, and that it has lifted during the initiating pressurizer overpressurization transient involving MSSV inadequate.
lift capacity, we assume i 10% chance that the primary safety valves will also lift. If the primary safety valves fall to close (10 3/ demand), a small break LOCA frequency of (3 x 10 2)(10 1)(10 3)/RY = 3 x 10 6/RY is estimated, if the high pressure safety injection fails (2.8 x 10 2/ demand) or the long-term cool-ing system fails (1.2 x 10 3/ demand), the potential severe core damage frequency is 1.2 x 10 k/RY.
06/30/88 3 1M-3 NUREG-0933
If the primary safety valves close, but the PORV fails to close (10 2/ demand) and the operator fails to close the PORV block valve (10 1), the small-break LOCA frequency is estimated at (3 x 10 2)(10 ')(10 2)(10 1)/RY = 3 x 10 6/RY.
Again, failure of the HPI or failure of the i.ng-term cnoling system (2 x 10 3
. +
1.2 x 10 3)/ demand results in an estimated core damage frequency of 1.2 x 10 3/PY.
Should the pressurizer overpressure transient that is attributed to inadequate MSSV lift capacities lift the PORV and not lift the primary safety valves (9 x 10 1/ demand), the PORVs might fail to close (10 2/ demand). Failure of the operator to block the failed-open PORV (10 1/ demand) and failure of the HPI (2.8 x 10 3/ demand) or failure of the long-term cooling (1.? x 10 3/ demand), is estimated to result in a core damage frequency of (3 x 10 2)(9 x 10 1)(10 3) x (4 x 10 a)/RY = 10 7/RY.
The combined core damage frequency for the above described Case 1 primary overpressure transient events is approximately 10 7/RY.
Case 2a: RCS Overcooling (Single MSSV Stuck-open)
Frequency Estimate Failure to close (stuck-open) of a single MSSV following a successful reactor trip with MSSV challenges is equivalent to a small steam line break. This initiating transient is estimated to have a frequency of 10 2/RY. Because failure to close of a single MSSV would be equivalent to small steam line break flows of approximately 2% to 10% of the plants' rated steam flow, no conditional SGTRs are assumed for Case 2a. The initiating transient and con-ditional failure frequencies estimated to lead to potential severe core damage are as follows:
<riuence Frequency Transient (One MSSV Stuck-open) 10 2 Fail to Isolate SG 1.2 x 10 3 Fail HPI 2.8 x 10 3 3.4 x 10 8 Transient (One MSSV Stuck-open) 10 2 Fail AFW 10 4 Fail HPI or Long-term Cooling _4 x_10 3 4 x 10 ')
Transient (One MSSV Stuck-open) 10 2 PORV Opens 8 x 10 '
PORV Fails to Close 10 2 Failure to Block PORV 10 1 Fall Long-term Cooling 1.2 x 10 3 10 8 The sum of the Case 2a core damage frequencies resulting from the small steam line break transient / failure to close one MSSV) is approximately 4.8 x 10 8/RY.
O
'J6/30/88 3.126-4 NUREG-0933
O
\
Case 2b: RCS Overcooling (Multiple MSSV Failures)
Transients that involve failure of more than one MSSV to close cessful reactor trip, are astimated to have a frequency of 10 5 /RY. given The a suc-initia-ting transient involving multiple MSSV failures to close is assumed equivalent to an MSLB. The top events following the equivalent MSLB transient in the systemic event tree involve SGTRs, failure to isolate the steam generators, failure of the AFW system, failure of the HPI system, opening of the PORVs, failure to block the PORVs, and failure of the long-term core cooling system (RHR). The systemic event tree contains 40 event sequences, sixteen of which are judged to potentially result in severe core camage. The Case 2b frequency estimates are described below.
Frequency Estimate SGTRS Given Multiple MSSVs Stuck Open: The conditional probabilities for single and multiple SGTRs, given an MSLB (considered herein as multiple MSSVs stuck open), were estimated in NUREG-0844.sst The estimated conditional prob-abilities for the range of potential SGTRs are:
1 SGTR/MSLB 3 x 10 2 2 to 10 SGTRs/MSLB 1.5 x 10 2
> 10 SGTRs/MSLB 3 x 10 3 The severity and timing of secondary side pressure reductions followirg multiple (two or more) MSSV failures (stuck open) could vary significantly and, therefore, s alter the potential effects of SGTRs, given various multiples of MSSV failures.
T Therefore, this evaluation includes events with multiple MSSV failure sequences j and no SGTRs, in addition to multiple MSSV failures with the above range of potential SGTRs.
Steam Generator Isolation: An estimate of the probability (1.2 x 10 2/ event) of failure to isolate the steam generators, given multiple MSSV failures and no i SGTRs, was obtained from NUREG/CR-249776 and INP0 82-025.1 51 For multiple l MSSVs stuck open, these two documents estimated the failure to isolate the steam generators as a factor of 10 greater than the value (1.2 x 10 3/ event) l used for small steam line breaks. The factor of 10 increase was to account for potentially higher functional degradations that may result from the more rapid pressure reductions.
l Transients involving SGTRs are difficult to handle. Because there may be poten-I I
tial delays in diagnosing the combined equivalent MSLB and SGTRs and possible improper operator actions, given the occurrence of combined multiple MSSV fail-urcs and SGTRs, we estimate an additional factor of 10 increase in the failure to isolate the steam generators (1.2 x 10 1/ event) for these combined events.
ECCS Unavailabilities: Depending on the numbers of SGTRs induced by the equivalent MSLB, the success of the HPI and long-term cooling can be jeop-ardized to various degrees by the continuous loss of primary coolant flowirg out the failed-open MSSVs. Because the MSSVs are outside containment and O 06/30/88 3.126-5 NUREG-0933 I
1 l
typically in-board of the MSIVs, the primary and ECCS coolant inventory loss would not be available for recirculation from the containment sump. Thus the RWST inventory could be depleted and the ECCS could fail by cavitation. The times and probabilities that operators might fail to take action to depressurize the RCS to atmospheric pressure before the RWST is exhausted (as a function of the number of SGTRs) were obtained froc NUREG-0844.68-The basis for the estimated ECCS unavailabilities, given a combined MLB with single and multiple SGTRs, is that the faulted steam generator is boiled dry even in the case of double-ended SGTRs of up to five steam generator tubes.880 Under these conditions, the leaks are flashed to steam on the secondary side masking the unexpected primary coolant flow into the steam generator. If the operator fails to get local visual observations or radiation monitor readings from the steam line break, it is possible that the SGTRs would remain unnoticed and the situation would be diagnosed as a steam line break. It was thus judged possible that the primary pressure could remain high and uncontrolled leakage of primary coolant directly to the atmosphere could continue for hours. Without proper operator actions to decrease the primary coolant loss, the ECCS recir-culation would be lost. The estimated ECCS unavailability for the following ranges of SGTRs are:
Condition ECCS Unavailability /SGTR 1 SGTR 10 3 2 to 10 SGTRL 10 2
> 10 SGTRs 5 x 10 2 When combined with ECCS functional unavailabilities, the conditional ECCS unavailabilities are:
Condition Total ECCS Unavailability /SGTR HPI Long-term ECCS No SGTRs 2.8 x 10 3 1.2 x 10 3 1 SGTR 3.8 x 10 3 : e x 10 3 2 to 10 SGTRs 1.3 x 10 2 1.1 x 10 2
> 10 SGTRs 5 x 10 1 5 x 10 2 E Unavailability: The unavailability of the AFW systems in operating rea '. ors range from 10 3 to 10 5 per demand. In the resolution of Issue 124, "Au, 11ary Feedwater System Reliability," the staff contemplates that licensees will schieve and n intain AFW system reliability in operating reactors at leve between 10 4 to 10 5 per demand. This goal is consistent with SRP11 Sect).1 10.4.9. Therefore, for the purpose of this analysis, we will use an AFW u e.vailability of 10 4/ demand.
PORV Es.imates: In NUREG/CR-249776 and INP0 82-025,2051 the probability of lifting the primary system PORV, given a steam line break (equivalent multiple HSSVs stuck open), was estimated at 0.8. The value of 0.8 is also used in this analysis.
O 06/30/88 3.126-6 NUREG-0933
The PORV failure to close (stuck open), given that it has opened, is estimated at 10 2/ demand. This estimate is consistent with Issue 70, "PORV and Block Valve Reliability." In Issue 70, the estimated probability that the operator would fail to close the PORV block valve, given that the PORV stuck ope.i, was 5 x 10 2/ demand. For the purpose of this analysis and the additional complex-ities and stresses that may be involved in the combined multiple MSSV failures and SGTRs, this analysis (Case 1 and Case 2) uses a value of 10 2/ demand for failure of the operator to isolate (block) a stuck-open PORV. Because of the attention focused on blocking the PORVs since the TMI event, the above PORV estimates are judged to be conservative.
Event Frequencies: The Case 2b event sequences described in the previous sec-tion that may lead to potential se.ere core damage are tabulated below. The event sequences not expected to lead to core damage are omitted.
Case 2b(0): Multiple MSSVs Stuck Open (No SGTRs)
Transient 10 3 Failure to Isolate SG 1.2 x 10 2 HPI failure 2.8 x 10 3 3.4 x 10 8 Transient 10 3 AFW Failure 10 4 HPI Failure 2.8 x 10 3 2.8 x 10 10 Transient 10 3 AFW Failure 10 4 RHR Failure 1.2 x 10 3 1.2 x 10 10 Trensient 10 3 PORV Opens 8 x 10 1 PORV Stuck Open 10 2 Failure to Block PORV 10-1 RHR Failure 1.2 x 10 3 9.6 x 10 10 TOTAL: 3.5 x 10 8 Case 2b(1): Multiple MSSVs Stuck Open (1 SGTR)
Transient 10 3 SGTR (1) 3 x 10 2 Failure to Isolate SG 1.2 x 10-1 HPI Failure 3.8 x 10 3 1.4 x 10 8 06/30/88 3.126-7 NUREG-0933
i l
l l
i Transient SGTR (1) 3x .2 AFW Failure 10 4 HPI Failure 3.8 x 10 3 10 11 1
Transient 10 3 l SGTR (1) 3 x 10 2 AFW Failure 10 4 l RHR Failure 2.2 x 10 3 j 6.6 x 10 12 Transient 10 3 SGTR (1) 3 x 10 2 PORV Opens 8 x 10 1 PORV Stuck Open 10 2 Failure to block PORV 10 1 RHR Failure 2.3 x 10 3 5.3 x 10 11 TOTAL: 1.4 x 10 8 Case 2b(2): Multiple MSSVs Stuck Open (2 to 10 SGTRs)
Transient 10 3 SGTR (2 to 10) 1.5 x 10 2 Failure to isolate SG 1.2 x 10 1 HPI Failure 1.3 x 10 2 2.3 x 10 8 Transient 10 3 SGTR (2 to 10) 1.5 x 10 2 AFW Failure 10 4 HPI Failure 1.3 x 10 2 2 x 10 11 Transient 10 3 SGTR (2 to 10) 1.5 x 10 2 AFW Failure 10 4 RHR Failure 1.1 x 10 2 1.7 x 10 11 0
06/30/88 3.126-8 NUREG-0933 1
jfMem.
Transient 10 3 (L') SGTR (2 to 10) 1.5 x 10 2 PORV Opens 8 x 10 1 PORV Stuck Open 10 2 Failure to block PORV 10 1 RHR Failure 1.1 x 10 2 1.3 x 10 11 TOTAL: 2.3 x 10 8 Case 2b(10): Multiple MSSVs Stuck Open ( > 10 SGTRs)
Transient 10 3 SGTR ( > 10) 3 x 10 3 Failure to Isolate SG 1.2 x 10 1 HPI Failure 5 x 10 1 1.8 x 10 7 Transient 10 3 SGTR ( > 10) 3 x 10 ?
AFW Failure 10 4 HPl failure 5 x 10 1
{3 1.5 x 10 10 Transient 10 3 SGTR ( > 10) 3 x 10 3 AFW Failure 10 4 RHR Failure 5 x 10 1 1.5 x 10 20 Transient 10 3 SGTR ( > 10) 3 x 10 3 PORV Opens 8 x 10 1 PORV Stuck Open . 10 2 Failure to Block PORV 10 1 RHR Failure 5 x 10 1
, 1.2 x 10 9 TOTAL: 1.8 x 10 7 Consequence Estimate The core-melt sequences for Case 1 involve failed-open safety /PORV valves in the primary side and failure of the emergency core cooling systems. These U
06/30/88 3.126-9 NUREG-0933
r sequences are similar to the WASH-140026 small-break core-melt sequences. In accordance with NUREG/CR-22281os2 and assuming that containment fan coolers /
sprays are available to limit steam pressure buildup in containment, a potential for containment failure by a hydrogen ignitio, and burn is assumed. Based on the Zion and Indian Point PRA studies, we use a 3% probability of containment failure by hydrogen burn. This containment failure mode is representative of a PWR Category 3 type of release. We also assume a 1% probability for failure to isolate the containment (PWR Category 5 release). If the containment does not fail by hydrogen burn or isolation failure, it will be assumed to fail by base-mat melt-through (PWR Category 7 release).
Core-melt from accident sequences described in Case 2a and Case 2b(0) will pro-gress similar to the TML sequence described in NUREG/CR-4752. loss Assuming containment fan coolers / sprays available, the containment responses, failure probabilities, and releases are similar to the above Case 1 sequences.
Based on the above, the weighted average core-melt release for Cases 1, 2a, and 2b(0) is 1.7 x 105 man-rem / core-melt. Cases 2b(1), 2b(2), and 2b(10) involve multiple stuck-open MSSVs and SGTRs. The dominant contributors to core-nelt conditions are potential inadequate secondary side heat transfer (failure to isolate the steam generator) and SGTRs that result in primary side inventory losses with increased ECCS unavailability. The path for the primary coolant SGTR LOCAs is into the secondary side steam generator and out the stuck-open MSSVs. Thus, the primary coolant inventory losses are not recoverable from the containment sump for recirculation. In time, depending on the number of SGTRs, the RWST is depleted and the ECCS fails. The decreasing probabilities of increasing numbers of SGTRs are overcome by the increasing unavailabilities of the ECCS water supply (depleted RWST).
The fission product release from the melting core follows the same path as the primary coolant inventory loss and, therefore, bypasses the containment barrier (containment bypass). Under these conditions, the probability of containment failure is assumed at unity.
For the above accident progressions, it may be possible to terminate or mitigate the accident results by dispatching operators to the MSSVs (which are outside containment) to attempt to manually close the stuck-open MSSVs. However, this analysis does not consider such heroic recovery actions on the part of the plant operators.
The release consequences for less than 10 SGTRs could be modeled as . PWR Category 4 failure to isolate containment release. For greater than 10 SGTRs, the PWR Category 2 or 3 containment rupture releases could be assumed. How-ever, possible dilution or a water seal in the assumed unisolated steam gen-erator, plate-out in the piping and steam generator structures, and aerosol attenuations will tend to reduce the fission product release. An example of possible reductions in the fission product release can be inferred from the MB-2 Aerosol Attenuation Tests described in NUREG/CR-4752.1 53 The purpose of tne MB-2 tests was to model the TMLB' accidents in which the core-melt is ac-
, ccmpanied by dried-out steam generators, where the high pressure primary side i steam could cause a SGTR to vent to the secondary side, open the safety relief l valve and release radioactivity directly to the atmosphere. Results from the MB-2 tests (which should be considered preliminary) showed aerosol attenuation l
06/30/88 3,126-10 NUREG-0933
[m\
G/ facto.s ranging from approximately 3 to 11. The tests did not include conditions which would capture additional reductions that might result from temperature, steam condensation on the secondary walls, plate-out, or possible water sealing and dilution by the secondary side.
Based on the above discussion, the PWR Category 5 releases should bound the releases for the MSSV/SGTR events. The PWR Category 5 release is a failure to isolate containment similar to the PWR Category 4 release, except containment sprays are available. The Category 5 release (108 man-rem / core-melt) is approxi-mately a factor of 3 less than the Category 4 release, and approximately a fac-tor of 5 less than the Category 2 or 3 releases.
For the purpose of this analysis, we assumed that all MSSV partial lifts and 50%
of the stuck-open MSSVs will be eliminated by the possible solutions described earlier. The estimated changes in core-melt frequencies and the consequence (risk) reductions for each case are tabulated and summed below in Table 1
3.126-1.
l TABLE 3.126-1 l
Case MSSV SGTRs Delta Dose /CM Annual 30-Year
, Failures (CM/RY) (man-rem) Plant Risk Plant Risk I
- Reductions Reduction (man-rem /RY) (man-rem /R) 1 ial -
10 7 1.7 x 105 1.7 x 10 2 0.5 2a (1) 50 -
4.8 x 10 8 1.7 x 105 8.2 x 10 3 0. 3 2b(0) (M) 50 -
3.5 x 10 8 1.7 x 105 6 x 10 3 0j Subtotal: 1.8 x 10 7 3 x 10 2 1.0 2b(1) (M) 50 1 7 x 10 8 108 7 x 10 3 0.2 2b(2) (i') 50 2 to 10 1.2 x 10 8 10S 1.2 x 10 2 o,4 2b(10) (M) 50 > 10 9 x 10.s 10S 9 x 10 2 2_. 7 Subtotal: 1.1 x 10 7 1.1 x 10 1 3.3 TOTAL: 2.9 x 10 7 1.4 x 10 1 4.3
- (1) SO: One MSSV Stuck Open
- (M) SO: Multiple MSSVs Stuck Open The generic conditional release doses used in this analysis are based on the fission product inventory of a 1120 ffde PWR, meteorology typical of a midwest site, a surrounding uniform population density of 340 persons per square mile within a 50-mile radius of the plant, an exclusion radius of one-half mile f rom the plant, no ingestion pathways, and no evacuation. Therefore, the estimated change in risk is representative of the hypothetical generic PWR plant with a p large, dry containment structure a:id is not representative of any specific plant.
06/30/88 3.126-11 NUREG-0933
Cost Estimate No cost estimates are provided for this issue. The issue solutiontos4 involves plant-specific inspections to ensure compliance with the original licensing bases of the plants. Therefore , the costs (though probably sniall) will not affect the resolution of this issue.
CONCLUSION Based on the estimated reduction in core-melt frequency of 2.9 x 10 7/RY and the risk reduction of 4.3 man-rem / reactor, this issue could be ranked as a low priority safety issue. However, because improper MSSV ring-settings can result in inadequate MSSV relief capacities, this issue is a matter of possible non-compliance with the licensing basis of the plants and, therefore, is more appropriately classified as a Licensing Issue. Regional inspections to verify adequate flow capacity and proper ring adjustments of the MSSVs are necessary i to ensure licensee compliance with existing requirements; the request for i
Regional assistance in this regard was made by NRR.1054 Therefore, this Licensing Issue has been resolved.
REFERENCES
- 11. NUREG-0800, "Standard Review Plan,' U.S. Nuclear Regulatory Commission, (3rd Edition) July 1981.
1
- 16. WASH-1400 (NUREG-75/014), "Reactor Safety Study, An Asse:sment of Accident l
Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Commission, October 1975.
- 76. NUREG/CR-2497, "Precursors to Potential Severe Core Damage Accidents:
1969-1979, A Status Report," U.S. Nuclear Regulatory Commission, June 1982.
- 98. NUREG-0737, "Clarificatina of TMI Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980.
307. EPRI NP-2230, "ATWS: A Reappraisal, Part 3," Electric Power Research Institute, 1982.
681. NUREG-0844, "NRC Integrated Program for the Resolution of Unresolved Safety Issues A-3, A-4, A-5 Regarding Steam Generator Tube Integrity,"
U.S. Nuclear Regulatory Commission (Oraft), April 1985.
860. NUREG-0937, "Evaluation of PWR Responses to Main steamline Break with Concurre,1t Steam Generator Tube Rupture and Small Break LOCA," U.S.
I Nuclear Regulatory Commission, December 1982, 1
1047. Memorandum for K. Kniel f rom B. Sheron, "Request for Prioritization of a Generic issue on the Reliability of PWR Main Steam Safety Valves,"
liay 27, 1986.
1048. IE Information Notice No. 86-05, "Main Steam Safety Valve Test Failures ind Ring Setting Adjustments," U.S. Nuclear Regulatory Commission, January 31, 198f, (Supplement 1) October 16, 1986.
06/30/88 3.126-12 NUREG-0933
~
1049. Memorandum for F. Cherny from R. Baer, "50.55(e) Report on Crosby Main Steam Valu Ring Settings," February 5,1985.
1050. Memorandum for R. Bosnak from F. Cherny, "Trip Report - Meeting of ASME Section III Subgroup on Pressure Relief, February 11, 1987," March 13, 1987.
1051. INPO 82-025, "Review of NRC Report: Precursors to Potential Severe Core Damage Accidents: 1969-1979 A Status Report, NUREG/CR-2497," Institute for Nuclear Power Operations, September 1982.
1052. NUREG/CR-2228, "Containment Response During Degraded Core Accidents Initiated by Transients and Small Break LOCA in the Zion / Indian Point Reactor Plants," U.S. Nuclear Regulatory Commission, July 1981.
1053. NUREG/CR-4752, "Coincident Steam Generator Tube Rupture and Stuck-Open
, Safety Relief Valve Carryover Tests," U.S. Nuclear Regulatory Commission, March 1987, 1054. Memorandum for W. Russell, et al., from R. Starostecki, "Request for
- Regional Inspection to Verify Adequate Flow Capacity of Main Steam Code j Safety Valves and Proper Ring Adjustments," November 8, 1987.
06/30/88 3.126-13 NUREG 0933
p ISSUE 136: STORAGE AND USE OF LARGE QUANTITIES OF CRYOGENIC COMBUSTIBLES ON SITE DESCRIPTION Historical Background This issue was identified by NRR/EIB in February 1986 when it was suggested that Issue 106, "Piping and the Use of Highly Combustible Gases in Vital Areas,"
I
' be expanded to include new safety concerns associated with the siting and use of large quantities of cryogenic combustibles on site.to24 The staff decided not to expand the scope of Issue 106 and evaluated the EIB concerns separately as Issue 136.
Two new systems which require storage on site of much greater amounts of hydro-gen, oxygen, and propane gases than have been previously reviewed and licensed for use are expected to be added at some operating plants. The long-term reso-lution of Issue 86, "Long Range Plan for Dealing with Strers Corrosion Cracking in BWR Piping," is expected to result in the installation of H2 water ch?mistry control systems at many of the operating BWRs. These systems will require the use of H2 and 02 in amounts far in excess of those currently consumed at opera-ting plants. In consideration of the logistics of supply and transport, storage of H2 and 02 on site in a cryogenic liquid state and vaporization for use appears to be a practical solution. Some nuclear plants, which might require smaller quantities of H2 are planning to use a compressed H 2 gas supply. Other plants may install electrolytic gas generators to generate H2 and 02 at the plants required rate. The BWR Owners Group (BWROG) for Intergranular Stress Corrosion Cracking (IGSCC) Research, in cooperation with EPRI and representatives of the industrial gases industry, has prepared a topical report o29 which pro- i vides guidance for design, operation, maintenance, surveillance, and testing of permanent hydrogen water chemistry control systems which may be located on site at operating BWRs. The staff reviewed the topical report, issued requests for additional information, and published a SER in July 1987. The SER endorses the BWROG guidelines for permanent BWR hydrogen water chenistry systems (with noted exceptions), thereby establishing acceptance criteria for staff use in plant-specific safety evaluations for individual plant licensing actions.
The second system is a portable incinerator called a Mobile Volume Reduction System (MVRS) for use as a waste volume reduction process for low level radio-active waste. Commonwealth Edison has applied to the NRC for installation and operation of an MVRS at their Dresden 2/3 site. The MVRS uses large quantities (up to 1000 gallons) of LPG (prepane) for incineration of radioactive waste.
The staff has completed its review of the Dresden application for modification to their operating license and has approved the siting and use of the MRVS at the Dresden 2/3 sites in a SER published on August 13, 1986.t 26 It is antic-Ipated that other licensees and/or nuclear plants may wish to utilize the MVRS (a standard design) at their facilities and will also submit license amendments to do so.
06/30/88 3.136-1 NUREG-0933
Issue 106 covers only the storage of relatively small amounts of combustible gas on site and the use and routing of those gases in safety-related areas. It does not cover the size, physical form or location of storage vessels used to provide liquid hydrogen, liquid oxygen, or (propane) on site. It does not cover the potential failure of the vessels used for these flammable / explosive materi-als and the effects of a resulting fire and/or explosion on reactor safety-related structures or equipment. We have, therefore, opened this new generic issue to encompass these concerns.
Safety Significance The on-site storage and use of large quantities of liquified combustible gases pose the potential of severely damaging reactor safety-related structures and/or equipment. Failure of the liquid storage vessels could endanger safety-related structures and equipment in many ways; i.e., by explosive blast overpressure, inclusion in the combustion fireball, excessive heat flux from the fireball, a vapor cloud drifting into safety-related air intake structures, etc. If guidance for safety review of new systems is not provided, the f ailure of these g systems could result in damage to or failure of safety-related structures and equipment, resulting in an increase in public risk.
However, the installation and operation of systems using largc quantities of cryogenic combustible materials on site, such as the MVR$ or BWR hydrogen water chemistry control systems, is beyond the scope of current plant licenses.
Therefore, the addition of such systems at an operating plant and the use of the systems would constitute an unreviewed safety concern (i.e., potential new and different accidents from those previously considered and evaluated as a part of the facility licensing process) and would necessitate a staff review of the adequatcy of protection of public health and safety before approval to install and operate the system may be granted by the NRC. This would be accom-plished through the review of a licensee request for a license modification to install and operate the system. In the resolution of this issue, it is assumed tnat adequate acceptance criteria for the on-site storage and use of these combustible gases can be developed which would involve very low or negli-gible additional public risk.
Resolution of this issue will result in a reduction in operational exposure (unquantified) because replacement of recirculation piping will not be re-quired and the possibility that the frequency of in-service inspections may be reduced.
l Possible Solution l
l SRP13 Sections 2.2.1-2.2.2, "Identification of Potential Hazards in Site l
Vicinity," and 2.2.3, "Evaluation of Potential Accidents," mention cryogenic fuels and flammable gases but ;ffer little guidance in the evaluation of the hazards of use of these materials on site. Regulatory Guide 1.91, "Evaluation of Explosions Postulated to Occur on Transportation Routes near Nuclear Power Plants," provides a method to convert the detonation energy of a vapor cloud to an equivalent mass of TNT, but of fers r.o further guidance other than stating that the actual gas, site topography, and meteorological conditions be considered in the hazards evaluation.
06/30/88 3.136-2 NUREG-0933
Acceptance criteria for the on-site use of large liquid propane systems have
[m been developed and documented through the staff review of the Dresden 2/3
\' license amendment for the on-site use of the MVRS. Acceptance criteria for the on-site use of large liquid H 2 and liquid 02 systems are currently being developed through the staff review cf the BWROG topical report for the design and on-site operation of BWR hydrogen water chemistry control systems. Thus, resolution of this issue is assumed to be the modification of SRP11 Sections 2.2.1, 2.2.2, and 2.2.3, and Regulatory Guide 1.91, as appropriate, to incor-porate the staf f acceptance criteria developed through the Dresden 2/3 MVRS review and the BWROG guidelines topical report review.
CONCLUSION Staff acceptance criteria for large propane systems have been developed and are stated in the Dresden 2/3 SER Supplement of August 13, 1986. Staff acceptance criteria were also developed for large LH2 and LOX systems through the staff's evaluation of the BWROG topical report for the design and operation of per-manent hydrogen water chemistry control systems at BWRs.
To assure consistent evaluation and approval of future license modifications for !he installation and use of MVRS and BWR hydrogen water chemistry control systems at operating reactors, this issue was classified as a Licensing Issue.
It was recommended that the appropriate SRP Sections and Regulatory Guides be amended to include the acceptance criteria developed through the Dresden MVRS review and the BWROG topical report review. However, with the publication in September 1987 of the staff's SER in EPRI NP-5283-SR-A, "Guidelines for Permanent BWR Hydrogen Water Chemistr
, consideredthisissuetoberesolved.y115 Installations - 1987 Revision," NRR REFERENCES
- 1. . NUREG 0800, "Standard Review Plan," U.S. Nuclear Regulatory Commission, (1st Edition) November 1975, (2nd Edition) March 1980, (3rd Edition) July 1981.
1024. Memorandum for K. Kniel from C. Ferrell, "Modification of Generic Issue No. 106 ' Highly Combustible Gases in Vital Areas,'" February 20, 1986, 1026. Letter to 0. Farrar (Common,iealth Edison Co.) from J. Zwolinski (NRC),
"Technical Specifications Relating to the Use of a Mobile Volume Reduc-tion System (MVRS) at Dresden Station (TAC 56373, 56374)," August 13, 1986.
1029. "Guidelines for Permanent BWR Hydrogen Water Chemistry Installations,"
BWR Owners Group for IGSCC Research, Hydrogen Installation Subcommittee, 1987 Revision.
1115. Memorandum for E. Beckjord from F. Gillespie, "Review of RES-Proposed Prioritization of Generic Issue No. 136, ' Storage and Use of Large Quantities of Cryogenic Combustibles on Site,'" March 25, 1988.
06/30/88 3.136-3 NUREG-0933
l Revision 2 1
0 ITEM HF8: MAINTENANCE AND SURVEILLANCE PROGRAM ,
t DESCRIPTION !
Historical Background i
The purpose of the Maintenance and Surveillance Program (MSP) effort is to provide direction for the NRC's efforts to assure effective nuclear power plant maintenance. The program will be based on the current NRC regulatory approach l to maintenance and an evaluation of the effectiveness of current industry efforts l in the ma'ntenance area. !
The NRC's current regulatory approach to nuclear power plant maintenance is concentrated on: (1) QA during design, construction, and operation for struc- i tures, systems and components important to safety (10 CFR 50, Appendix B); and .
j (2) surveillance requirements to assure that the necessary availability and l quality of such systems and components is maintained (10 CFR 50.36). Despite extensive surveillance testing requirements, the NRC's rules and regulations provide no clear programmatic treatment of maintenance. NRC additionally re- ;
quires reporting of significant events (10 CFR 50.72), including personnel '
errors and procedural inadequacies which could prevent fulfillment of safety !
i functions and exceeding of TS limits. The NRC does not stipulate maintenance !
1 requirements for systems which are not safety-related. Many challenges to safety systems originate from systems /co,ponents which are classified as not safety *related. The relationship between non-safety grade control systems and safety systems is being addressed in USI A-47.
The MSP is intended to integrate the NRC's efforts to assure effective nuclear power plant maintenance and to do so in a manner that is consistent with and l h
responsive to the Commission's 1984 Policy and Planning Guidance.745 The pro-gram addresses the problems and issues which exist and proposes development of i alternative NRC a>proaches to regulating nuclear utility maintenance activities consistent with tie Policy and Planning Guidance. The scope of the program L includes all aspects of maintenance required to carry not a systematic mainten- '
ance and surveillance program. It includes conventional maintenance and repair plus such things as surveillance and test activities, equipment isolation, ,
post-maintenance testing, independent verification, maintenance management. L
- administrative control, personnel selection and training, procedures, and tech- !
nical documentation.
Safety Significance !
Since the THI-2 accident in 1979, it has been evident that faulty maintenance practice is a principal contributing factor to operating abnormalities. Pre- '
, liminary estimates indicate that, aside from design deficiencies, more than 35% of the abnormal nuclear power plant occurrences reported to Congress since 1975 may be directly attributed to maintenance error, with the trend towards a worsening maintenance situation as plants age.740 Reviews of operating experi- i l ence show a high frequency of degraded system performance due to both the lack of maintenance (especially preventive maintenance) and improperly performed f maintenance, including human error during repair and surveillance testing 740 ,
- 06/30/88 4.HF8-1 NUREG-0933
Revision 2 Possible Solutions The proposed solution to this issue is to implement a systematic maintenance program as addressed in the NRC's preliminary MSP with the following five objectives:
(1) To assure that needed maintenance is being accomplished, especially in counteracting system and equipment aging effects, by taking appro-priate preventive and corrective action to minimize equipment failures.
(2) To reduce failures from improper maintenance to an acceptabie level and to assure safety through effective maintenance management, person-nel selection and training, avocedures, administrative control, and design for maintainability.
(3) To assure proper integration of maintenance operations and other organizational interfaces for maintenance activities which can affect plant safety.
(4) To improve the effectiveness of nuclear power plant maintenance pro-grams in reducing the number of challenges to safety systems (e.g.,
reactor scrams).
(5) To optimize surveillance requirements to assure equipment availability when required without excessive equipment out-of-service intervals for testing and to eliminate the unnecessary exposure for transient trips due to excessive test frequencies of logic and initiation systens.
PRIORITY DETERMINATION Assumptions Thi: issue affects all 134 BWRs and PWRs operating, under construction, or planned. For this analysis, Oconee 3 was selected as the representative PWR and Grand Gulf I was selected as the representative BWR.
The following paragraphs describe the background and approach to quantifying the base and adjusted cases for this issue. The background description relates to the subjects of aging and maintenance in an ovsrall sense. The approach makes assumptions based on the background information. The subjects of aging and of overall effect of maintenance are considered below.
Aing:
J The effects of system and equipment aging is considered as part of the M f because adequate maintenance and surveillance can counteract aging effects.
NUREG/CR-2497" (p. 5-4) discusses the variation of significant precursors with plant age. This can be assumed to reflect general equipment deterioration and the subsequent impact on plant safety in general. Trends for a number of initiating events or demand failures were presented for data up through 1979.
For PWRs, failure rate trends for long-term core cooling were given as constant and perhaps increasing. For BWRs, only the ADS demand failure showed an in-creasing failure trend, based on a small number of observed events. The emer-gency power system failure trend was given as constant, perhaps increasing.
The general conclusion was that no clear variation in the number of significant events with plant age has been demonstrated.
06/30/88 4.Hf8-2 NUREG-0933
Revision 2 Q(3 It is further suggested that the operating time on the majority of the plant safety systems i', very small. In many cases, the operating time is only that experienced dur'ng testing intervals. While aging effects cannot be ruled out at this time, tne likelihood of their showing any significant role in safety systems is sma'l. As a result, it is proposed that aging effects, if any, would best be aodeled by failure rates increasing in the balance-of plant.
This would manifest itself as an increase in plant transients requiring shut-down.
Maintenance: A central aspect of the maintenance and surveillance program is the increased efficiency of maintenance operations and the assumed resultant reduction in errors committed during maintenance. It is believed that, if an integrated maintenance program were implemented, increases in preventive maintenance would reduce the need for corrective maintenance during plant operation. The MSP would provide a decrease in improper maintenance due to better training, procedures, human factors engineering, etc. The maintenance program is also seen as improving maintenance such that fewer transients will occur because of better maintained equipment.
In order to evaluate this issue, it is necessary to estimate and bound the likely magnitude of these effects and the degree to which current maintenance and surveillance approaches can deal with the program. Existing information is reviewed below.
Utility Maintenance Experience: The idea of this program is to increase the role of preventive maintenance and thus decrease corrective maintenance required for failures during operation. An examination of current experience indicates
\ that corrective actions now represent the smaller fraction of recorded main-l tenance actions.
To characterize existing utility maintenance programs, NUREG/CR-3543741 (p. 20) indicates that between 64% and 80% of the age-related LER failures examined were detected by routine testing and surveillance performed in accordance with the plant 'S or maintenance program. Detection after failure during plant operation :ould then be assumed to occur in 20% to 36% of the failures.
This indicates that the present unsystematic preventive maintenance programs at the majerity of nuclear power plants is still detecting a substantial number of the events related to equipment degradation before actual failure in opera-tion occurs. The 36% figure could be assumed to bound the category of failures during operaticq.
Tt.is result could also be expected to follow for a large part of the safety-related systems since the operating time on these systems is only during per-iodic test. Some examples of exceptions are the AFW systems in some designs and instrumentation channels for systems such as the reactor protection system and the electrical power systems.
An examination of transients in an EPRI study 307 indicates that almost every transient category can also be considered as involving equipment failures, although these would be in the 80P. Although one could argue that preventive maintenance may not be as strict in this portion of the plant as opposed to safety systems, the utilities obviously have an economic incentive to maintain 06/30/88 4.HF8-3 NUREG-0933
Revision 2 this portion of the plant as well. As a result, it is assumed that BOP failures and hence transients are subject to the same detection percentages mentioned above.
Base Case: The base case is the same as for the original Oconee and Grand Gulf risk assessments with the following exception. To model the effects of plant aging, it is proposed that the BOP transient frequencies be increased by 10%.
This would reflect increased failures due to plant aging. This 10% value is felt to be an appropriate "trip level" beyond which the present surveillance programs would detect the increased failures. Thus T2 , T3 , and Tra frequencies of 3/RY, 4/RY, and 7/RY, respectively, are increased by 10% for the base case.
The base case parameters are T2 and Ta for Oconee and 2T a for Grand Gulf.
The resolution of USI A-47 (which is expected to be resolved prior to this issue) may reduce the base and adjusted case transient frequencies and also result in a decrease in the predicted reduction ir. transient frequency for parameters T2 and T3 . However, it is anticipated that the resulting changes will not significantly impact the results and conclusion contained herein.
Adjusted Case: The adjusted case involves transients affected in the base case by reducing them because of the implementation of a systematic maintenance program. A comparison of U.S. and Japanese data on automatic scrams for 1981 and 1982 provide the basis for an adjusted case reduction in frequency of tran-sients. U.S. data for 1981 and 1982 automatic scrams indicate a frequency of 5.3/RY whereas the comparable Japanese data indicate a frequency of 0.4/RY.
After discussions with PNL researchers in the human factors maintenance area, it is assumed for this analysis that, if an integrated maintenance program were implemented in the U.S., the U.S. automatic scram frequency could be reduced to 2/RY. This factor of 2.65 reduction from the 1981 and 1982 U.S. average of 5.3/RY is assumed to be applied to the base case transient frequencies T2 and Ta for Oconec and T2 a for Grand Gulf. Thus, applying the factor of 2.65 related to improved maintenance results in the adjusted case transient frequencies.
Also, for the adjusted case, it is proposed here that integrated maintenance and avoidance of errors can impact unscheduled maintenance outages during power operation, reducing the duration (t) and the outage frequency (f). The model that is used in this analysis to represent maintenance outages is expressed as the following equation for unavailability Q(TM) of systems due to test and maintenance where H1 and H2 are contribu' ions from human performance, 01 and 02 are contributions for design, t is expressed in hours /act, and f is expressed in acts / month.
Q(TM) = [(H1 + 01)i.)] [(H2 + O2)f/720]
Factors H1 and 01 initially add to one as do factors H2 and 02. The model initially assumes H1 and 01 as 50% each and H2 and 02 as 25%/75% split, respectively. It is assumed (Or this analysis that improved maintenance from an implemented maintenance program results in a 10% improvement in human perfor-mance related to outage dur ation (t) and a 25% improvement in human performance related to outage frequency (f). Thus, a test and maintenance term of 0.0021 in the base case become 0.0019 in the adjusted case.
O 06/30/88 4.HF8-4 NUREG-0933 l
l
Revision 2 1
V Frequency / Consequence Estimate l
The improvement affects all categories of PWR and BWR releases as defined in WASH-1400. M The total whole body man-rem dose is obtained by using the CRAC Code" assuming an average population density of 340 persons per square mile (which is the mean for U.S. domestic sites) from an exclusion area of a half-mile radius about the reactor out to a 50-mile radius about the reactor. A typical midwest plain meteorology is also assumed. Based upon these assumptions and the proceeding discussions, the base case core-melt frequencies are 4.95 x 10 5/RY and 3.81 x 10 5/RY for PWRs and BWRs, respectively. With the mainte-nance improvements as described, the adjusted case core-melt frequencies become 3.08 x 10 5/RY and 2.08 x 10 5/RY for PWRs and BV % , respectively.
The base case and adjusted case core-melt frequencies are distributed over the following release categories:
Base Case (RY) 1 Adjusted Case (RY) 1 PWR-1 = 2.7 x 10 8 PWR-1 = 2.6 x 10 8 PWR-2 = 3.1 x 10 8 PWR-2 = 1.2 x 10 6 PWR-3 = 2.3 x 10 5 PWR-3 = 1.3 x 10 5 PWR-4 = 5.0 x 10 8 PWR-4 = 1.9 x 10 8 PWR-5 = 3.3 x 10 7 PWR 3 = 2.2 x 10 7 PWR-6 = 3.4 x 10 8 PWR-6 = 3.1 x 10 6 PWR-7 = 2.3 x 10 5 PWR-7 = 1.5 x 10 5 i
BWR-1 = 1.1 x 10 7 BWR-1 = 8.4 x 10 8
\ BWR-2 = 3.5 x 10 5 BWR-2 = 1.8 x 10 5 BWR- 3 = 1. 4 x 10 6 BWR-3 = 1.0 x 10 6 BWR-4 = 1.6 x 10 6 BWR-4 = 1.2 x 10 8 The reduction in core-melt frequency per releas, category results in a per plant reduction in public risk of 64 man-rem /RY and 123 man-rem /RY for PWRs and BWRs, respectively. Based upon an average remaining life of 28.8 years for the 90 PWRs and 27.4 years for 44 BWRs, the total best estimate public risk is reduced by 3.1 x 105 man rem.
Cost , Estimate Industry Cost: The implementation of all tasks, identified in the Draft Main-tenance Program Plan,"O involve principally costs associated with labor. Some of the labor intensive costs for each plant are:
Task 2.2.4 Evaluation of Regulatory Alternative = 10 man years (Principally the establishment of the preventive maintenance program by the licensee)
Task 2.3 Assess role of Safety System Monitoring = 1 man year (Principally to code and label piping, valves, etc.)
Task 2.5.2 Plant Maintainability = 2 man years (Job performance aids and task analysis) 0 06/30/88 4.HF8-5 NUREG-0933
Revision 2 Task 2.5.3.d Upgrade Maintenance Procedures = 5 man years (3.5 man years for rewriting maintenance procedures and 1.5 man years for improv-ing document control)
Task 2.5.4 Maintenance Personnel Qualifications = 1.25 man years and Training (Qualification and Training Program)
Equipment and other labor costs are expected to cost $0.2M/ plant. Thus, the total industry cost for implementation is given by: l (134 plants)[(19. h man years / plant)($100,000/ man year)] + $0.2M = $280M Labor and engineering costs are estimated to be 3.7 man years /RY. In addition, 16 days will be added to the annual plant outage time to permit additional maintenance. At an estimated cost of $300,000/ day for replacement power costs, the additional maintenance costs will be $4.8M/RY. However, the added mainten-ance is expected to reduce the automatic scram frequency by 3.3 events /RY.
Based on 1981 data, each scram results on the average in a two-day outage time. I Hence, about 7 days replacement power costs are saved each piant year, or I (7 x $300,000) = $2.1M saved per plant year. ThJs, the annual cost for operation i and maintenance is $(4.8 - 2.1)M/RY + (3.7 man yrs /RY)($0.1M/ man yr) a $3.1M/RY.
Total industry cost for mainter:ance and operation I l
=[(90 PWRs)(28.8 years) + (44 BWRs)(27.4 years)]($3.1M/RY) l =$12,000M l l i Total industry cost for the implementation and maintenance and operation is
$(12,000 + 280)M = $12,280M.
NRC Cost: Estimated NRC costs for implementation are $1.2M and $10,000/RY l for operation and maintenance review. Thus, total NRC costs are estimated to i be $1.2M * ($10,000)[(90 x 28.8) + (44 x 27.4)] = $38M.
Value/ Impact Assessment l
' Based on a risk reduction of 3.1 x 105 man-rem, the value/ impact score is given by:
5 = 3.1 x 105 man-rem 5(12,280 + 38)M
= 26 man-rem /$M Other Considerations The total industry cost benefit resulting from accident avoidance costs is calculated to be $100M. Occupational dose calculations predict a total indus-try implementation dose of 2.7 x 104 man-rem. This dose results principally from a 1% increate in occupational dose to provide better identifi.ation (labels, etc.) for piping, valves, and other control devices. The operation and mainten-ante dose is believed to be nil. it is felt that the increase in preventive maintenance requirements will be more than offset by improved maintenance train-ing, rnaintainability, and less f requent unplanned maintenance. Some have esti- 1 i
mated as much as a 50% dose reduction to maintenance personnel.
l 06/30/88 4.HF8-6 NUREG-0933
v Revision 2 CONCLUSION Although the value/ impact score was low, the total potential risk reduction justified a high priority ranking. It was recomended that a value/ impact i analysis be accomplished before individual requirements were finalized to ensure that the most cost-beneficial solutions were implemented. The objective of this issue was to initiate the NRC's efforts to assure effective I nuclear power plant maintenance in accordance with the 1984 Policy and !
Planning Guidance which included a description of the problems and issues to I be addressed and an evaluation of the alternative HRC approaches to regulate
- nuclear utility maintenance activities.
In 1985, a NRC Maintenance and Surveillance Program Plan was developed. ;
Activities included a survey of ongoing maintenance practices and an evaluation of their effectiveness. These activities were completed in 1986 and documented in NUREG-1212.2023 Subsequently, the Commission approved a Policy Statement 118 in March 1988 and directed the staff to develop a proposed notice of rulemaking for Commission review in 1988. Thus, this i issue was RESOLVE 0 with the issuance of the Policy Statement and no new '
requirements were established.1117 REFERENCES .
r
- 16. WASH-1490 (NUREG-75/014), "Reactur Safety Study, An Assessment of r Accident Risks in U.S. Commercial Nuclear Power Plants," U.S. Nuclear Regulatory Comission October 1975. ;
- 64. NUREG/CR-2800, "Guidelines for Nuclear Power Plant Safety Issue l Prioritization Information Development," U.S. Nuclear Regulatory t Commission, February 1983. ;
- 76. NUREG/CR-2497, "Precursors to Potential Severe Core Damage Accidents:
1969-1979, A Status Report," U.S. Nuclear Regulatory Commission, June j 1982. ;
307. EPRI NP-2230, "ATWS: A Reappraisal Part 3," Electric Power Research !
Institute, January 1982.
740. "Draf t Maintenance Program Plan," U.S. Nuclear Regulatory Comission, !
May 8, 1984. [
741. NUREG/CR-3543, "Survey of Operating Experience from LERs to Identify Aging Trend," U.S. Nuclear Regulatory Commission January 1984. [
i NUREG-0885, Issue 3. "U.S. Nuclear Regulatory Comission Policy and 745.
Planning Guidance," U.S. Nuclear Regulatory Commission, January 1984. ;
1013. NUREG-1212. "Status of Maintenance in the U.S. Nuclear Power Industry l 1985." U.S. Nuclear Regulatory Comission, (Volumes 1 and 2) June 1986. :
l I 1116. Federal Register Notice 53 FR 9430, "Final Comission Policy Statement l on Maintenance of Nuclear Power Plants," March 21, 1988. [
1117. Memorandum for V. Stello from T. Murley, "Closecut of Generic Issue [
l HF-08, ' Maintenance and Surveillance Program,'" May 4, 1988. L i
06/30/88 4.HF8 7 NUREG-0933 ;
I, ;
v i .m s .. . ovs.,o., co ...- ..........,,,,,r.oc...,
.e roa.
',"2 Bl8LIOGRAPHIC DATA SHEET
- ; 7-0933, Supp. No. G
(,m s
iii .ii ve, es o ,. .. ...si
, , ,, a . o .. . . , a
, 73 , , , . .,,
A Prioritization of Generic Safety Issues .o.... .:.,co..avio I
. . , . . . Jbne 1988
. o ,e .g.o., elleio P. Eerit, R. Riggs, W. Milstead, and J. Pittman .,. ....
November l1988 l
..o,.s,.... .o.. ..... ....
, . . . .. . . ,3 c. 3. . . , . , ,o. . . . . o . . . s . oo. . . ,,,,,, ,, c , . ,
Division of Regulatory Applications Office of Nuclear Regulatory Research o. c.. . i -i .
U.S. Nuclear Regulatcry Commission Washington D.C. 20555
. . . 0 i o. . a. c. . , , . . . , . . . , o . . s . , a . c o. . . . ,,,,, ,, ,,,. . .
Division of Regulatory Applications Technical Office of Nuclear Regulatory Research C ' ' "
- o ' ' " o -- - -
U.S. Nuclear Regulatory Commission Washington, D.C, 20555 '
,, . a .. 4....e,..
L
~,s...,..n n -. .
g The report presents the priority rankings for generic safety issues related '.; nuclear power plants. The purpose of these rankings is to assist in the timely and efficient allocation of NRC resources for the resolution of those safety issues that have a significant potential for reducing risk. The safety priority rankings are HIGH, MEDIUM i LOW, and DROP and have been assigned on the basis of risk significan.e estimates, the
' ratio of risk to costs and other impacts estimated to result if resolutions of the ,
'afety issues were implemnted, and the consideration of uncerta.inties and other quantitative or qualitative factors. To the extent r,ractical, estimates 3re ,
quantitative, i
I i
}
l
~
,. m . ,.s..... .....:.a ..x..,;.. .,.,,., g ,.
generic safety issues risk Unlimited l e se c . ,, , e. . . .c .
Unclassified -
I
, . ,ci.,1, c m . ein's. $ a .. .,. ,
I i 1
1 .'nc
- o. la ca s..s..a si f i ed
. . .. s e t
i . ;
i