Text

Regulatory Analysis for the Resolution of Unresolved Safety Issue A-44,STATION Blackout
	ML20205H860
Person / Time
Issue date:	01/31/1986
From:	Rubin A; Office of Nuclear Reactor Regulation
To:	;
References
	REF-GTECI-A-44, REF-GTECI-EL, TASK-A-44, TASK-OR AB38-1-064, AB38-1-64, NUREG-1109, NUREG-1109-DRFT, NUREG-1109-DRFT-FC, NUDOCS 8601290262
	Download: ML20205H860 (40)
	v • d • e

- -

.= .

NUREG-1109 I

i Regulatory Analysis for the !

i Resolution of Unresolved Safety Issue A-44, Station Blackout Draft Report for Comment U.S. Nuclear Regulatory l CO m MISSION Office of Nuclear Reactor Regulation A. M. Rubin l

l .

,p" coy, 1

i 1

2 RM22%8!M 86 2 1109 R PDR

NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in N RC publications will be available from one of the following sources:

1. The NRC Public Document Room,1717 H Street, N.W.

Washington, DC 20555

2. The Superintendent of Documents. U.S. Govemment Printing Qffice, Post Office Box 37082, Washington, DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents availaMe for inspection and copying for a fee from the NRC Public Docu-ment Room include NRC currespondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletir.s, circulars, information notices, inspection and investigation notices; Licensee Event Reports: vendor reports and correspondence; Commission papers;and applicant and licensee documents arvi correspondence.

The following docsments in the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents ava lable from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from tnese libraries.

Documents su:h as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Divisio1 of Technical Information and Document Control, U.S. Nuclear Regulatory Com-mission, Washi1gton, DC 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards institute,1430 Broadway, New York, NY 10018.

NUREG-1109 l

Regulatory Analysis for the Resolution of Unresolved Safety Issue A-44, Station Blackout Draft Report for Comment Manuscript Completed: November 1985 Date Published: January 1986 A. M. Rubin Division of Safety Review and Oversight Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555 l

,p"= =m,

\ .....

l l

l ABSTRACT

" Station Blackout" is the complete loss of alternating current (ac) electric power to the essential and nonessential buses in a nuclear power plant; it results when both offsite power and the onsite emergency ac power systems are unavailable. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on ac power, the consequences of a station blackout could be severe. Because of the concern about the frequency of loss of offsite power, the number of failures of emergency diesel generators, and the potentially severe consequences of a loss of all ac power, " Station Blackout" was designated as Unresolved Safety Issue (USI) A-44.

This report presents the regulatory analysis for USI A-44. It includes: (1) a summary of the issue, (2) the proposed technical resolution, (3) alternative resolutions considered by the Nuclear Regulatory Commission (NRC) staff, (4) an assessment of the benefits and costs of the recommended resolution, (5) the decision rationale, and (6) the relationship between USI A-44 and other NRC programs and requirements.

NUREG-1109 iii For Comment

TABLE OF CONTENTS P_ age A85 TRACT.............................................................,.. iii LIST OF TABLES.......................................................... vi PREFACE................................................................. vii EXECUTIVE

SUMMARY

....................................................... ix 1 STATEMENT OF THE PR0BLEM........................................... 1 2 OBJECTIVES......................................................... 2 3 ALTERNATIVE RESOLUTIONS............................................ 2 3.1 Alternative (i)............................................... 2 3.2 Alternative (ii).............................................. 7 3.3 Alternative (iii)............................................. 7 3.4 Alternative (iv).............................................. 7 4 CONSEQUENCES....................................................... 7 4.1 Costs and Benefits of Alternative Proposed Resolutions........ 7 4.1.1 Alternative (i)........................................ 7 4.1.2 Alternative (ii)....................................... 16 4.1.3 Alternative (iii)...................................... 17 4.1.4 Alternative (iv)....................................... 17 4.2 Impacts on Other Requirements................................. 17 4.2.1 Generic Issue 8-56, Proposed Actions for Enhancing Reliability of Diesel Generators at Operating Plants... 17 4.2.2 USI A-45, Shutdown Decay Heat Removal Requirements..... 18 4.2.3. Generic Issue B-23, Reactor Coolant Pump Seal Failures. 19 4.2.4 Generic Issue A-30, Adequacy of Safety-Related DC Power Supp1y........................................... 19 4.2.5 Regulatory Guide 1.108, Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power P1 ants................................ 20 4.2.6 Fire Protection Program for Nuclear Power Facilities... 20 4.2.7 Proposed Auxiliary System Reliability and Power Diversity Upgrade in Operating Plants.................. 20 4.2.8 Multiplant Action Items B-23 and B-48, Degraded Grid Voltage Adequacy of Station Electric Disribution Voltage................................................ 21 4.3 Constraints................................................... 21 5 DECISION RATIONALE................................................. 22 NUREG-1109 v For Comment

TABLE OF CONTENTS (Continued)

Page 5.1 NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants.......................................... 23 5.2 NUREG/CR-3226, Station Blackout Accident Analysis............. 25 5.3 NUREG/CR-2989, Reliability of Emergency AC Power Systems at Nuclear Power Plants.......................................... 26 5.4 NUREG/CR-3992, Collection and Evaluation of Complete and Partial Losses of Offsite Powe- at Nuclear Power Plants.......

. 26 6 IMPLEMENTATION..................................................... 27 6.1 Schedule for Implementation of the Proposed Rule.............. 27 6.2 Relationship to Other Existing or Proposed Requirements....... 28 7 REFERENCES......................................................... 29 LIST OF TABLES Table Page 1 Acceptable station blackout duration capability.................... 5 2 Emergency ac power configuration groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3 Offsite power design configuration groups.......................... 6 4 Estimated number of reactors having similar characteristics........ 10 5 Examples of reduction in frequency of core melt per reactor year... 10 6 Estimated costs for industry to comply with the proposed resolution of USI A-44............................................. 12 i Discounted present value of avoided onsite property damage for 67 reactors........................................................ 13 8 Value-impact summary for proposed station blackout resolution. . . . . . 15 9 Proposed implementation schedule................................... 29 NUREG-1109 vi For Comment

PREFACE This report presents the supporting value-impact analysis and decision ration-ale for the proposed resolution of USI A-44. The resolution itself consists of a proposed rule that would require nuclear power plants to be able to cope with a station blackout, and an associated draft regulatory guide that provides guidance on an acceptable means to comply with the proposed rule. The proposed rule and draft regulatory guide are being issued for public comment at about the same time as this draft NUREG. The NRC staff and the Commission are seek-

, ing comments-from the public on these three documents before a final resolution of USI A-44 is developed. The staff recognizes the benefits that can be achieved by public review and comment, especially when the comments are accom-panied by supporting data.

Alan M. Rubin I

NUREG-1109 vii For Comment

- __ 1

EXECUTIVE

SUMMARY

This report provides supporting information, including a cost-benefit analysis, for the Nuclear Regulatory Commission's (NRC) proposed resolution of Unresolved Safety Issue (USI) A-44, " Station Blackout." The term " station blackout" refers to the complete loss of alternating current (ac) electric power to the essential '

and nonessential switchgear buses in a nuclear power' plant. Station blackout involves the loss of offsite power concurrent with turbine trip and the unavail-ability of the onsite emergency ac power system. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on ac power, the consequences of station blackout could be severe.

The NRC's concern about station blackout arose because of the accumulated ex-perience regarding the reliability of ac power supplies. In numerous instances emergency diesel generators have failed to start and run during tests conducted at operating plants. In addition, a number of operating plant have experienced a total loss of offsite electric power, and more such occurrences are expected.

In almost every one of these loss-of-offsite power events, the onsite emergency ac power supplies were available immediately to supply the power needed by vital safety equipment. However, in some instances, one of the redundant emergency power supplies has been unavailable. In a few cases, there has been a complete loss of ac power, but during these events, ac power was restored in a short time without any serious consequences.

The issue of station blackout involves the likelihood and duration of the loss of offsite power, the redundancy and reliability of onsite emergency ac power systems, and the potential for severe accident sequences after a loss of all ac power. These topics were investigated under Unresolved Safety Issue (USI) Task Action Plan A-44.* In addition to identifying important factors and sequences that could lead to station blackout, the results indicated that actions could be taken to reduce the risk from station blackout events. The issue is of concern for both boiling water reactors (BWRs) and pressurized water reactors (PWRs).

The evaluation to resolve USI A-44 included deterministic and probabilistic analyses. Calculations to determine the timing and consequences of various accident sequences were performed, and the dominant factors affecting station blackout likelihood were identified. Using this information, simplified prob-abilistic accident sequence correlations were calculated to estimate the like-lihood of core melt accidents resulting from station blackout for different plant design, operational, and location factors. These quantitative estimates were used to give insights on the relative importance of various factors, and those insights, along with engineering judgment, were used to develop the pro-posed resolution. Thus, the effects of variations in design, operations, and plant location on risk from station blackout events were used to reach a rea-sonably consistent level of risk in the recommendations developed.

The technical findings of these investigations are detailed in NUREG/CR-2989, NUREG/CR-3226, NUREG/CR-3992, and NUREG-1032.

NUREG-1109 ix For Comment )

l l

l I

Although there are licensing requirements and guidance directed at providing reliable offsite and onsite ac power, experience has shown that there are practical limitations in ensuring the reliability of offsite and onsite emer-gency ac power systems. Analyses have shown that core melt frequency can be significantly reduced if a plant can withstand a total loss of ac power until either offsite or onsite emergency ac power can be restored.

Because there is no requirernent that plants be able to withstand a loss of both the offsite and onsite emergency ac power systems, the proposed resolu-tion calls for rulemaking to require all plants to be able to cope with a station blackout for a specified duration. A draft regulatory guide on sta-tion blackout

describes a method acceptable to the NRC staff for complying with the proposed rule, and specifies guidance on providing reliable ac elec-tric power supplies. Plants with an already low risk from station blackout would be required to withstand a station blackout for a relatively short period of time. These plants probably would need few, if any, modifications as a result of the proposed rule. Plants with a currently higher risk from station blackout would be required to withstand blackouts of a somewhat longer duration, and, depending on their existing capability, might require modifica-tions (such as increased station battery capacity or condensate storage tank capacity) to meet this requirement. The staff has determined that these modi-fications would be cost effective in terms of reducing risk to the public.

The general objective of the proposed resolution of USI A-44 is to reduce the risk of severe accidents associated with station blackout by making station blackout a relatively small contributor to total core melt frequency. Spe-cific actions called for in the proposed resolution include: (1) maintaining highly reliable ac electric power systems; (2) developing procedures and train-ing to restore offsite and onsite emergency ac power should either one or both become unavailable; and (3), as additional defense-in-depth, ensuring that plants can cope with a station blackout for come period of time, based on the probability of occurrence of a station blackout at the site, as well as on the ,

capability for restoring ac power for that site'.

The method to determine an acceptable station blackout duration capability is presented in the draft regulatory guide. Applications of this guide would re-sult in determinations that plants be able to withstand station blackouts of 4 or 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , depending on the plant's specific design and site-related charac-teristics. Licensees may propose durations different from those specified in the draft regulatory guide, based on plant-specific factors relating to the reliability of ac power systems.

The benefit from implementing the proposed rule and the guidance of the draft regulatory guide would be a reduction in the frequency of core melt per reactor year due to station blackout and the associated risk of offsite radio-active releases. The risk reduction for 67 operating reactors is estimated to be 80,000 person-rems.

Sind e copies of this draft regulatory guide may be obtained by writing to '

U.S. NRC, Washington, DC, 20555, Attn: Director, Division of Technical Information and Document Control.

NUREG-1109 x for Comment

The cost for licensees to comply with the proposed requirements would vary depending on the existing capability of each plant to cope with a station blackout, as well as the plant-specific station blackout duration determined.

The costs would be primarily to industry to develop procedures, to improve diesel generator reliability if the reliability falls below certain levels, and to retrofit plants with additional components or system, as necessary, to meet the proposed requirements.

The estimated total cost for 67 operating reactors to comply with the proposed resolution of USI A-44 is about $40 million. The average cost per reactor would be around $600,000, ranging from $200,000 if only a station blackout assessment and procedures and training are necessary, to a maximum of about

$4 million if substantial modifications are needed, including requalification of a diesel generator.

The overall value-impact ratio, not including accident avoidance costs, is about 2000 person-rems averted per million dollars. If cost savings to industry from accident avoidance (cleanup and repair of onsite damages and replacement power) were included, the overall value-impact ratio would improve significantly to about 8000 person-rems averted per million dollars.

Saveral NRC programs are related to USI A-44, including Diesel Generator Relia-bility (B-56), Reactor Coolant Pump Seals (Generic Issue 23), Safety-Related DC Power Supplies (A-30), and Shutdown Decay Heat Removal Requirements (USI A-45). These programs are closely coordinated within the same Division of NRC and are compatible with the proposed resolution of USI A-44.

t NUREG-1109 xi for Comment

REGULATORY ANALYSIS FOR THE RESOLUTION OF UNRESOLVED SAFETY ISSUE A-44, STATION BLACK 0UT 1 STATEMENT OF THE PROBLEM

" Station blackout" refers to the complete loss of alternating current (ac) electric power to the essential and nonessential switchgear buses in a nuclear power plant. Station blackout involves the loss of offsite power concurrent with turbine trip and the unavailability of the onsite emergency ac power sys-tem. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on ac power, the consequences of station blackout could be severe.

The concern of the Nuclear Regalatory Commission (NRC) about station blackout arose because of the accumulated experience regarding the reliability of ac power supplies. In numerous instances emergency diesel generators have failed to start and run during tests conducted at operating plants. In addition, a number of operating plants have experienced a total loss of offsite electric power, and more occurrences are expected. In almost every one of these loss-of-offsite power events, the onsite emergency ac power supplies were available immediately to supply the power needed by vital safety equipment. However, in some instances, one of the redundant emergency power supplies has been unavail-able. In a few cases, there has been a complete loss of ac power, but during these events, ac power was restored in a short time without any serious consequences.

The results of the Reactor Safety Study (NUREG-75/014) showed that for one of the two plants evaluated, a station blackout accident could be an important

~

contributor to the total risk from nuclear power plant accidents. Although '

this total risk was found to be small, the relative importance of the station blackout accident was established. This finding and the accumulated diesel generator failure experience increased the concern about station blackout.

The issue of station blackout involves the likelihood and duration of the loss l of offsite power, the redundancy and reliability of onsite emergency ac power systems, and the potential for severe accident sequences after a loss of all ac ;

power. These topics were investigated under Unresolved Safety Issue (USI) Task ,

Action Plan A-44, and the technical findings are reported in detail in NUREG/

CR-2989, NUREG/CR-3226, NUREG/CR-3992, and NUREG-1032. In addition to identi- ,

fying important factors and sequences that could lead to station blackout, the results indicated that estimated core melt

frequencies from station'olackout vary significantly for different plants but could be on the order of 10 4 per '

reactor year for some plants. To reduce this risk, action should be taken to

Analysis has shown that for postulated station blackout events, the difference between the estimated frequency of core damage and core melt is small because of the relatively low probability of recovering ac power and terminating an accident sequence at a time between initial core damage and full core melt ,

(NUREG-1032).

NUREG-1109 1 For Comment

resolve the safety concern stemming from station blackout. The issue is of concern for both pressurized water reactors (PWRs) and boiling water reactors (BWRs).

There is no requirement for plants to be able to cope with a station blackout.

Existing requirements for offsite and onsite ac power systems are in General Design Criterion (GDC) 17, " Electric Power Systems," of Appendix A to Part 50 of Title 10 of the Code of Federal Regulations (10 CFR 50). They are discussed in Sections 8.2, "Offsite Powe- Systems," and 8.3.1, "AC Power Systems (Onsite),"

of the NRC's " Standard Review Plan for the Safety Review of Nuclear Power Reac-tors" (NUREG-0800). Testing of emergency diesel generators is discussed in Regulatory Guide (RG) 1.108, " Periodic Testing of Diesel Generator Units Used as Orisite Electric Power Systems at Nuclear Power Plants." Separation and independence of electric power systems are discussed in RG 1.6, " Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems," and RG 1.75, " Physical Independence of Electric Systems." SRP Sec-tion 9.5 discusses design and maintenance provisions for the onsite emergency diesels. These licensing requirements and guidance are directed at providing reliable offsite and onsite ac power.

Experi~ence has shown that there are practicP limits in ensuring the reliability of offsite and onsite energency ac power systems. Analyses show that core melt frequency can be significantly reduced if a plant can withstand a total loss of ac power until either offsite or onsite emergency ac power can be restored.

2 OBJECTIVES The general objective of the proposed requirements is to reduce the risk of severe accidents associated with station blackout by making station blackout a relatively small contributor to total core melt frequency. Specific actions called for in the preposed resolution include: (1) maintaining highly reliable ac electric power systems; (2) developing procedures and training to restore offsite and onsite emergency ac power should 4ither one or both become unavail-able; and (3) as additional defense in depth, ensuring that plants can cope with a station blackout f:r some period of time, based on the probability of occur-rence of a station blackout at the site as well as on the capability for restor-ing power for that site.

3 ALTERNATIVE RESOLUTIONS In reaching its proposed resolution of USI A-44, the staff considered four specific alternative courses of action. These are discussed below.

-1.1. Altornative (i)

To achieve the objectives stated in Section 2 above, the staff's proposed resolution of USI A-44 calls for specific guidance relating to offsite and onsite emergency ac power systems, as well as a requirement that plants be able to cope with a station blackout. A summary of the proposed recommendations to resolve this issue is cs follows:

NUREG-1109 2 for Comment

(i) The reliability of the onsite emergency ac power sources should be main-tained at or above specified acceptable reliability levels.

(ii) Procedures and training should be developed to restore emergency ac power and offsite power using nearby power sources if the emergency ac power system and the normal offsite power systems are unavailable.

(iii)Each nuclear power plant should be evaluated to determine its capability to withstand and recover from a station blackout. This evaluation should include Verifying the adequacy of station battery power, condensate storage tank capacity, and plant / instrument air for the duration of a station blackout.

Verifying the adequacy of reactor coolant pump seal integrity for the duration of a station blackout. This should be done by demonstrating, via experiment and/or analysis, that seal leakage due to a lack of seal cooling will not reduce the primary system coolant inventory to the degree that the ability to cool the core during station blackout is lost.

Verifying that the equipment needed to operate during a station black-out will be able to operate under the environmental conditions associ-ated with a total loss of ac power (i.e., loss of heating, ventilation, and air conditioning).

(iv) Each nuclear power plant should be able to withstand and recover from a station blackout lasting a specified minimum duration. The draft regula-tory guide entitled " Station Blackout"* provides a method for determining an acceptable plant-specific station blackout duration based on a compari-son of a plant's characteristics to those factors that have been identi-fied as the main contributors to risk from station blackout. These factors include: (1) the redundancy of onsite emergency ac power sources (number of sources available for decay heat removal minus the number needed for decay heat removal), (2) the reliability of onsite emergency ac power sources (usually diesel generators), (3) the frequency of loss of offsite power, and (4) the probable time to restore offsite power. The frequency and duration of loss of offsite power are related to grid and switchyard reliability, historical weather data for severe storms, and the availabil-ity of nearby alternate power sources (e.g., gas turbines). The staff has concluded (NUREG-1032) that long-duration offsite power outages are caused primarily by severe storms (hurricanes, ice, snow, etc.).

(v) If the plant's station blackout capability (as determined in (iii)) is significantly less than the recommended plant-specific station blackout duration determined in (iv), modifications to the plant may be necessary

Single copies of this draft guide may be obtained by writing to the USNRC, Washington, DC 20555, Attn: Director, Division of Technical Information and l Document Control. '

NUREG-1109 3 For Comment

to increase the time the plant is able to cope with a station blackout.

The draft regulatory guide identifies specific factors to be considered if such modifications are necessary.

(vi) Each nuclear power plant should have procedures and training to cope with a station blackout and to restore normal long-term decay heat removal once ac power is restored.

Because there is no requirement for plants to be able to withstand a loss of both the offsite and onsite emergency ac power systems, the proposed resolution calls for rulemaking to require that all plants be able to cope with a station blackout for.a specified duration. The draft regulatory guide describes a method acceptable to the NRC staff for complying with the proposed rule, and specifies guidance on providing reliable ac electric power supplies. Plants with an already low risk from station blackout would be required to withstand a station blackout for a relatively short period of time. These plants probably would need few, if any, modifications as a result of the proposed rule. Plants with currently higher risk from station blackout would be required to withstand blackouts of somewhat longer duration, and, depending on their existing capa-bility, may require modifications (such as increasing station battery capacity or condensate storage tank capacity). The staff has determined that these modifications would be cost-effective in terms of reducing risk to the public.

The method to determine an acceptable station blackout duration capability, as presented in the draft regulatory guide, is summarized below. Applications of this guide would specify blackouts of 4 or 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (see Table 1) depending on a plant's design and site-related characteristics. Licensees may propose durations different from those specified in Table 1. Such proposals would be based on plant-specific factors relating to the reliability of ac power systems, such as those discussed in NUREG-1032, and would be reviewed by the NRC staff.

Tables 2 and 3, respectively, describe the emergency ac power configuration groups and offsite power design characteristic groups used in Table 1. Table 2 describes plants according to different levels of redundancy of the onsite emergency AC power system; Table 3 provides a method to determine character-istic loss-of-offsite power frequency and duration groups as a function of expected frequency of severe weather events, switchyard designs, number of offsite power circuits, and ability to restore offsite power. After identify-ing the appropriate groups from Tables 2 and 3, and the reliability level of the onsite emergency ac power sources, Table 1 can be used to determine the station blackout duration guidelines for each plant (4 or 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ). The reliable operation of the onsite emergency ac power sources should be ensured by a reliability program designed to monitor and maintain reliability over time at a specified acceptable level and to improve the reliability if that level is not achieved.

One example of an application of this method considers a nuclear power plant that has (1) two diesel generators, one of which is required for ac power for decay heat removal systems; (2) an estimated frequency of loss of offsite power due to extremely severe weather of less than 0.01 per year; (3) one switchyard; and (4) one alternate offsite power circuit, in addition to the normally energized offsite circuit to the Class 1E buses. On the basis of the data in Tables 2 and 3, this plant is in emergency ac power configuration group B, and in offsite power design characteristic group P2. As indicated on Table 1, if NUREG-1109 4 For Comment

Table 1 Acceptable station blackout duration capability (hours)1 Emergency ac power configuration group2 A B C Maximum EDG failure rate per demand 3 Offsite power design characteristics 4 0.05 0.025 0.05 0.025 P1 4 4 4 4 P2- 4 4 8 8 1 Variations from these times will be considered by the staff if justification, including a cost-benefit analysis, is provided by the licensee. The methodology and sensitivity studies presented in NUREG-1032 are acceptable for use in this justification.

2See Table 2.

3 Number of emergency diesel generator (EDG) failures in the last 100 valid demands divided by 100.

4See Table 3.

Table 2 Emergency ac (EAC) power configuration groups No. of EAC No. of EAC power sources EAC power con- power sources req'd to operate ac powered figuration group available1 decay heat removal systems 2 A 3 1 4 1 5 2 8 23 1 4 2 C 24 1 3 2 4 3 5 3 IIf any EAC power sources are shared between units at a multi-unit site, this is the total number of shared and dedicated sources for those units at the site.

2This number is based on all the ac loads required to remove decay heat (including ac powered decay heat removal systems) to achieve and maintain hot shutdown at all units at the site with offsite power unavailable.

3For EAC power sources not shared with other units.

4For shared EAC power sources in which each diesel generator is capable of providing ac power to more than one unit at a site concurrently.

NUREG-1109 5 For Comment

Table 3 Offsite pow 2r d2 sign characteristic groups Group Offsite power design characteristic E

A P1 1. Sites that have one of the following offsite power designs:

c)

a. all offsite power sources connected to the plant through two or more switchyards or separate incoming g transmission lines, with at least one of the ac sources electrically independent of the others, OR

b. all offsite power sources connected to the plant through one switchyard or through two or more switchyards that are electrically connected and, if the normal ac power source is lost, with an automatic transfer to an alternative offsite power source. If this source fails also, there is one or more automatic or manual transfers of power to another source of offsite power, AND

2. Sites with frequency of loss of offsite power due to extremely severe weather less than 1 per 350 site years,*

AND

3. Sites that have one or both of the following characteristics:

a. the capability and procedures to recover offsite (non-emergency) ac power to the site within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months fol-lowing a loss of offsite power due to severe weather, OR

b. an estimated frequency of loss of offsite power due to severe weather less than 1 per 100 site years.**

P2 Sites with an estimated frequency of loss of offsite power due to extremely severe weather greater than 1 per 100 site years,* OR Sites with an estimated frequency of loss of offsite power due to extremely severe weather less than 1 per

, 100 site years,* and any one or more of the following three characteristics:

1. An estimated frequency of loss of offsite power due to extremely severe weather greater than 1 per 350 site-years,* OR

2. All offsite power sources connected to the plant through one switchyard or through two or more switchyards that are electrically connected and, if the normal source of ac power is lost, with no automatic transfers and one or more manual transfers (or alternately, one automatic transfer but no manual transfers) to preferred or alternate offsite power sources, OR

3. An estimated frequency of loss of offsite power due to severe weather greater than 1 per 100 site years **

without the capability and procedures to recover offsite (nonemergency) ac power to the site within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after a loss of offsite power due to severe weather.

The estimated frequency of loss of offsite power due to extremely severe weather is determined by the annual expecta-tion of storms at the site with wind velocities greater than or equal to 125 mph.

k **The estimated frequency of loss of offsite power due to severe weather, f, is determined by the following equation:

9 f = (1.8 x 10 4) h + (27) h2 3

+ (2.6 x 10 2) h 3 s

ll where h = annual expectation of snowfall for the site, in inches i

5 h2 = annual expectation of tornadoes per square mile at the site h3= annual expectation of storms at the site with wind velocities between 75 and 124 mph.

The annual expectations of snowfall, tornadoes, and storms are obtained from National Weather Service data from the weather station nearest the plant or, if appropriate, an interpolation between nearby weather stations. The basis for the empirical equation for f is given in Appendix A to NUREG-1032.

the failure rate of each emergency diesel generator is maintained at 0.025 or less, this plant should have the capability to withstand and recover from a station blackout lasting 4 hcurs or more. If the failure rate of each emer-gency diesel generator were between 0.025 and 0.050, the acceptable station blackout duration would increase to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . If the emergency diesel generator failure rate were greater than 0.05, then steps should be taken to improve the diesel generator reliability in accordance with the reliability program dis-cussed above.

3.2 Alternative (ii)

Alternative (ii) would treat plants uniformly by requiring all plants to be able to cope with station blackout of the same duration.

3.3 Alternative (iiil Alternative (iii) would require plants with the highest potential risk from sta-tion blackout to add either an additional emergency diesel generator or another

! ac-independent decay heat removal system.

3.4 Alternative (iv)

Under this alternative no action would be taken.

-4 CONSEQUENCES 4.1 Costs and Benefits of Alternative Resolutions

4.1.1 Alternative (i)

The benefit from implementing the proposed rule and the guidance of the draft regulatory guide would be a reduction in the frequency of core melt per reactor-year due to station blackout and the associated risk of offsite radioactive releases. The costs would be primarily those incurred by industry to develop procedures, to improve diesel generator rei Mbility if the reliability falls below certain levels, and to retrofit pMati with additional components or system, as necessary, to meet the prP v1 aquirements. These are discussed

.in the following paragraphs.

(1) Value: Risk Reduction Estimates To estimate the change in expected risk that the proposed resolution could effect, both the postulated radioactive exposure (in person-rems) that would result in the event of an accident and the reduction in frequency of core melt must be estimated. A simplified method to estimate public dose for value-impact analysis would use an " average" plant to estimate the consequerites of station blackout and subsequent core melt for all plants. For example, the total ex-posure within a 50-mile radius of a " typical" site is about 5 million person-rems (NUREG-1032, Section 7). However, using a single value does not account for the differences in offsite consequences associated with differences in the sizes of reactors and with differences in the population densities around different sites.

NUREG-1109 7 For Comment

Because of the differences between sites and plant designs, it was not real-istic for the staff to select a " typical" plant for analysis (using the value and impacts for that plant and then multiplying them by the total number of plants) to cbtain an overall value-impact ratio. Instead, the staff grouped plants with similar design characteristics, which produced a more accurate reflection of total values and impacts, without the performance of a plant-specific value impact analysis for all plants. The method described below was used to estimate offsite consequences for use in this value-impact analysis.

Results indicate that consequences range from 0.5 to 7 million person-rems, with an average of about 2 million person-rems per plant.

NUREG/CR-2723 gives estimates of offsite consequences of potential accidents at nuclear power plants. That report includes results of calculations for 91 i sites in the United States that had reactors with operating licenses or con- I struction permits. The actual distributions of population around the sites were used in calculating estimated total population doses (in person-rems) for various fission product releases. The results include a scaling factor to account for different reactor power levels at the various sites.

The scaled results (from NUREG/CR-2723) for release category SSTl* (siting source term) were used to develop estimates of site-specific consequences for station blackout events. However, these results were not used directly in the value-impact analysis for several reasons. First, the consequences given in NUREG/CR-2723 include the entire population around the plant (i.e., an infinite radius), whereas Enclosure 1 of NRR Office Letter No. 16 (NRC, 1984) specifies that a 50-mile radius around the plant is to be used to calculate risk reduc-tion estimates. Second, SST1 overestimates the fission product release for station blackout events.

Scaling factors comparing offsite exposures within a 50-mile radius of a plant to that for an infinite radius are included in Table 3 of Sandia (1983). Depend-ing on the containment type, the total person-rem exposure within a 50-mile radius is between 1/3 and 1/5 the person-rem exposure for an infinite radius.

These factors were used to scale the site-specific results from NUREG/CR-2723.

In addition, comparing the fission product releases for station blackout from the " typical" plant in NUREG-1032 with SST1 releases for the equivalent plant in terms of size and population distribution in NUREG/CR-2723 indicates that the SSTl offsite person-rem consequences are about a factor of 3 greater than the consequences from station blackout events. The main reason for this is that SST1 is an estimated upper bound on risk assuming prompt containment fail-ure, whereas if a core melt resulted from station blackout, containment failure would be delayed for a number of hours. Therefore, the site-specific SST1 consequences from NUREG/CR-2723 were reduced by a factor of 3 to estimate the person-rem exposure per accident for use in this value-impact analysis.

To clarify the method discussed above, an example calculation is given for an 845-MWe PWR (Calvert Cliffs). From Appendix A of NUREG/CR-2723, the scaled

Five release categories, denoted as SST1-SST5, have been defined by NRC to represent a spectrum of five accident groups. Each category represents a different degree of core degradation and failure of containment safety features.

Group 1, SST1, is the most severe and involves a loss of all installed safety l

features and direct breach of containment.

l NUREG-1109 8 For Comment

result for offsite effects is 3.61 x 107 person-rems. This number is multi-plied by 1/5 to account for the 50 mile radius (Sandia, 1983) and by 1/3 to account for the smaller releases for station blackout events compared to SST1 releases. The resulting offsite exposure from a station blackout event and subsequent core melt within a 50-mile radius of the plant is estimated to be about 2 million person-rems.

The reduction in frequency of core melt resulting from the proposed resolution was estimated for groups of plants having similar characteristics rather than for each plant. Table 1 provides the framework for selecting the plant group-ings. Plant- and site-specific characteristics for a total of 67 reactors (which represent most of the currently operating nuclear power plants) were categorized according to the factors in Table 1. Table 4 presents an estimate of the number of reactors having these specific characteristics.

The estimated reductions in core melt frequency for each group were based on results of analyses of core melt frequency as a function of a plant's ability to cope with a station blackout (NUREG-1032). Reductions in core melt fre-quency per reactor year for each group of plants were based on plants meeting the acceptable 4- or 8-hour station blackout duration given in the proposed resolution. The mean reduction in core melt frequency for all plants is approximately 3 x 10 5 per reactor year. This was based on the assumption that 50% of the plants have diesel generators with failure rates of 0.025 failure per demand or less. It was also assumed that all plants, as currently designed, can cope with a station blackout for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and, with proper pro-cedures and training, plants could cope with a 4-hour station blackout without having to make major modifications.

Examples of the reduction in frequency of core melt per reactor year for three cases are presented in Table 5. The first example is typical of a plant with one redundant emergency ac power system (e.g., one out of two diesel generators required for emergency ac power), a failure rate of 0.025 failure per demand for each diesel generator, and a plant located in an area with average loss of offsite power duration and frequency. The second case, which is typical of a plant with less desirable characteristics from a station blackout perspective (e.g., a minimum redundant emergency ac power system, below average diesel generator reliability, and a history of relatively more frequent and longer duration losses of offsite power), has a reduction in frequency of core melt that is an order of magnitude larger. The third case is for plants with more favorable characteristics than the base case and, therefore, a correspondingly lower reduction in core melt frequency.

The estimated risk reduction for each group of plants was calculated by multi-plying the reduction in core melt frequency per reactor year for that group by three factors: (1) the number of reactors in the group, (2) the average remaining life of the plant, and (3) the estimated average public dose (in person-rems) that would result in the event of an accident. The person-rem reductions for each group of plants were then summed to calculate the total estimated risk reduction associated with the proposed resolution of USI A-44.

Assuming an average remaining plant life of 25 years, the estimated total dose reduction is 80,000 person-rem.

NUREG-1109 9 For Comment

Table 4 Estimated number of reactors having similar characteristics Emergency ac power configuration group

Group A B C Total Estimated number 11 42 14 67 of reactors Offsite power design characteristics **

Characteristic P1 P2 Total Es.timated number 24 43 67 of reactors

See Table 2 for definition of emergency ac power con-figuration groups.

- See Table 3 to determine offsite power design charac-teristics.

Table 5 Examples of reduction in frequency of core melt per reactor year Estimated core damage Estimated reduction in Plant frequency per core damage frequency characteristics reactor year per reactor year Plants with one of two 2.1 x 10 5 with 2-hour 1.3 x 10 5 emergency diesel generators station blackout (EDGs); EDG failure rate of capability 0.025 failure per demand; and loss of offsite power 0.8 x 10 5 with 4-hour

design characteristic station blackout group P2. capability Plants with two out of three 15 x 10 5 with 2-hour 14 x 10 5 EDGs; EDG failure rate of station blackout 0.05 failure per demand; and capability loss of offsite power design chracteristics group P2. 1 x 10 5 with 8-hour

station blackout capability Plants with one out of three 0.2 x 10 5 with 2-hour 0.1 x 10 5 EDGs; EDG failure rate of station blackout 0.025 failure per demand; capability and loss of offsite power design characteristics 0.1 x 10 5 with 4-hour

group Pl. station blackout capability

These times are the acceptable station blackout durations from Table 1 for these example cases.

NUREG-1109 10 For Comment

(2) Impacts: Cost Estimates The cost for licensees to comply with the proposed requirements will vary de-pending on (1) the existing capability of each plant to cope with a station blackout and (2) the plant-specific station blackout duration as determined from Table 1. The staff anticipates that almost all plants should be able to meet a 4-hour duration guideline without major plant modifications. In addi-tion to being able to withstand a 4-hour blackout, some plants may be capable of coping for longer periods without major modifications. To meet an 8-hour guideline, licensees of some plants may have to increase the capacity of one or more of the following systems: station batteries, condensate storage tank, and instrument or compressed air. Shedding nonessential loads from the station batteries could be considered as an option to extend the time until battery depletion. Corresponding procedures for load shedding would need to be incor-porated in the plant-specific technical guidelines and emergency operating procedures for station blackout.

Those plants that cannot verify adequate reactor coolant pump seal integrity for the station blackout duration may have to add an ac-independent charging pump for reactor coolant pump seal cooling to maintain seal integrity and adequate reactor coolant inventory.

Table 6 presents cost estimates of possible hardware modifications and proce-dures that could result from implementation of the recommendations proposed to resolve the station blackout issue. Because the duration guidelines are based.

on plant-specific features, and the capability of systems and components needed during a station blackout varies from plant to plant, the modifications in Table 6 may be needed at some but not all nuclear power plants. For each proposed modification, the table identifies an estimated range of costs per plant, the estimated number of plants needing that modification, and the estimated total cost.

The estimated total cost for industry to comply with the proposed resolution of USI A-44 is about $40 million. The average cost per reactor would be around

$600,000. Costs would range from $200,000, if only a station blackout assess-ment and procedures and training are necessary, to a maximum of about $4 mil-lion if modifications 1 through 4 are needed (including requalification of a diesel generator).

Including costs of averted plant damage can significantly affect the overall cost-benefit evaluation. To estimate the costs of averting plant damage and cleanup, the reduction in accident frequency was multiplied by the discounted onsite property costs. The following equations from NUREG/CR-3568 were used to make this calculation:

V = N.1FU gp and U = C/m [(e"I i)/r2] [1 - e -r(t f-t j)](1-e-rm)

NUREG-1109 11 For Comment

Table 6 Estimated costs for industry to comply with the proposed resulution of USI A441 Est. cost per Est. no. of reactor 2 ($1000) Est. total cost ($1000)

Potential reactors needing Best High Low Best High Low modifications modifications est. est. est. est. est. est.

1. Assess plant's capa- 67 150 200 100 10,000 13,000 7,000 bility to cope with-station blackout

2. Develop procedures 67 75 100 50 5,000 7,000 3,000 and training 3

3. Improve diesel gen- 15 250 2800 250 11,000 19,000 6,000 e'rator reliability 4

4. Increase capability 10 1000 2000 500 10,000 20,000 5,000 l

to cope with sta-tion blackout (in-crease capability of station batteries, condensate storage tank, and/or instru-ment air)

5. Add an ac-independent -- 3000 50008 2000 -- -- --

charging pump (non-seismic) capable of delivering 50 to 100 gpm to reactor coolant pump seals 5 TOTAL COSTS - 36,000 59,000 21,000 3 Based on 67 reactors. Value in terms of risk reduction is estimated in Section 4.1 for 67 reactors. Costs for increased reporting requirements for inaustry and for NRC review are small compared to other costs: about $10,000 and $7,000 per plant, respectively.

2 Preliminary estimates based on informal contacts with utility and architect / engineering firms. Firm estimates would require plant-specific designs. Detailed independent esti-mates in NUREG/CR-3840 indicate lower costs than shown for (5) and comparable costs for (4).

3 Based on EG&G (1983) for procedures and training for de power systems.

4The low estimate includes a reliability investigation (estimated $100,000) and hardware (estimated $150,000). The high estimate assumes, in addition, plant shutdown for 5 days to requalify a diesel generator at an estimated cost of $500,000 per day for replacement power. However, not'all plants with low diesel generator reliability would need to be shut down to recualify a diesel generator. The basis for the low, best, and high esti-mates was that 1, 3, or 6 plants, respectively, out of an estimated 15 plants that need to improve diesel generator reliability would shut down for 5 days to requalify a diesel generator.

sit is assumed that reactor coolant pump seal integrity is sufficient to ensure core cooling for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or more; therefore the charging pump would not be necessary. The results of Generic Issue B-23 will provide detailed information on expected pump seal behavior without seal cooling. (See Section 4.2 for further discussion.) Estimated costs are provided here for perspective should such a system be considered necessary after B-23 results are available.

6A seismically qualified and safety grade ac-independent charging pump would be much more expensive ($10 to 15 million) and would not reduce the risk substantially more than a non-seismic pump.

NUREG-1109 12 For Comment

_--_________j

I where t

V gp

= value of avoided onsite property damage N = number of affected facilities = 67 AF = reduction in accident frequency = 3 x 10 5 U = present value of onsite property damage C = cleanup and repair costs = $1.2 billion t

f

= years remaining until end of plant life = 25 tg = years before reactor begins operation = 0 r = discount rate = .10 (10%)

m = period of time over which damage costs are paid out (recovery period in years) = 10 Using the above values, the present value of avoided onsite property damage is estimated to be $15 million. If avoided costs for replacement power are included (estimated in NUREG/CR-3568 to be $1.2 billion over 10 years), the

estimated present value is $30 million. Table 7 summarizes the discounted present value of avoided onsite property damage for 10% and 5% discount rates.

Table 7 Discounted present value of avoided onsite property damage for 67 reactors Discounted present value Avoided damage 10% discount rate 5% discc,unt rate Cleanup and repair only $15 x 106 $30 x 106 Cleanup, repair, and $30 x 106 $60 x 106 replacement power (3) Value-Impact Ratio Table 8 summarizes the total benefits and costs associated with the proposed resolution of USI A-44. These include (1) public risk reduction due to avoided

offsite releases associated with reduced accident frequencies; (2) increased occupational dose from implementation, and operation and maintenance activi-ties, as well as reduced occupational exposure from cleanup and repair because of lower accident frequency; (3) industry costs for implementation of modifica-tions, operation and maintenance, and increased reporting requirements; and (4)

NRC costs for review of industry reports.

The estimated total cost for industry to comply with the proposed rule is $40 million. The total public risk reduction for 67 reactors over the remaining life of the plants is about 80,000 person-rems. The overall value-impact ratio, not= including accident avoidance costs, is about 2,000 person-rem averted per NUREG-1109 13 For Comment

million dollars.* If cost savings to industry from accident avoidance (cleanup and repair of onsite damages and replacement power) were included, the overall value-impact ratio would improve significantly. At a 10% discount rate, the present value of avoided cleanup, repair, and replacement power is approximately

$30 million. If this benefit were taken into account, the overall value-impact ratio would be about 8,000 person-rem averted per million dollars.

1 (4) Special Considerations 1 The quantitative value-impact analysis discussed above used "best estimates" i for benefits (risk reduction) and costs associated with the proposed resolution of USI A-44. While this is a useful approach to evaluate the proposed resolu-tion, other factors can and should play a part in the decision-making process.

Although they are not quantified, other considerations that bear on the overall conclusions and proposed recommendations to resolve USI A-44 are discussed below. Some of these factors may indicate that the proposed resolution is con-servative (e.g., possible reduction in source term), while others may show that the resolution is non-conservative (e.g., median core melt frequencies were used instead of means). Overall, these considerations support the conclusion that additional defense in depth provided by the ability of a plant to cope with a station blackout for a specified duration is strongly recommended.

- Relative Importance of Potential Station Blackout Events Probabilistic risk assessment (PRA) studies performed for this USI, as well as some plant-specific PRAs, have shown that station blackout can be a significant contributor to core melt frequency, and, with the consideration of containment failure, station blackout events can represent an important contributor to reactor risk. In general, active containment systems required for heat removal, pressure suppression, and radioactivity removal from the containment atmosphere following an accident are unavailable during a station blackout.

Therefore, the offsite risk is higher from a core melt resulting from station blackout than it is from many other accident scenarios.

Source Term Re-Evaluation The consequence estimates for different containment types used in this value-impact analysis are consistent with the guidance given in NRC's value-impact handbook (NUREG/CR-3568). However, substantial uncertainties exist regarding fission product transport in containment during a core melt accident. For example, the time to containment failure following the onset of core damage and the containment failure mode represent important factors that influence fission product release and, ultimately, public risk. Ongoing research on severe acci-dents and source term re-evaluation may significantly alter estimated fission product releases and thereby reduce the estimated risk to the public. In any event, the ability to cope with a station blackout for some period of time would make station blackout a small contributor to core melt frequency and would significantly reduce the risk associated with such events.

The value-impact ratio is based on plant-specific information for 67 reactors.

Although there are currently about 90 operating reactors, including the additional plants in this analysis would not change the value-impact ratio significantly.

NUREG-1109 14 For Comment

l Table 8 Value-impact summary for proposed resolution of USI A-44 Dose reduction (person-rems) Cost ($1,000)

Best High Low Best High Low Parameter est. est. est. est. est. est.

Public health 80,000 Occupational exposure (accidental)1 2,000 Occupational exposure (routine)2 NA Industry implementation 36,000 59,000 21,000 Industry operation 3 2,000 3,000 1,000 NRC implementation 4 500 500 500 Total 82,000 38,500 62,500 22,500 Value-impact ratio 5 2,100 1,300 3,600 (Public dose reduction divided by sum of NRC and industry costs (person-rems /$108))

1 Based on an estimated occupational radiation dose of 40,000 person-rems for post-accident cleanup and repair activities (NRC, 1984).

2No significant increase in occupational exposure is expected from operation and maintenance or implementing the recommendations proposed in this resolution.

Equipment _ additions and modifications contemplated do not require significant work in and around the reactor coolant system and therefore would not be expected to result in significant radiation exposure. NA = not affected.

3 Assumes 5% of installation costs for operation and maintenance.

4 Based on an estimated 120 person-hours por reactor for NRC review.

sThis does not take into account the additional benefit associated with avoided plant damage costs or replacement power costs resulting from reduced frequency of core melt. The cost for plant cleanup following a core melt accident is estimated to be $1.2 billion, and replacement power is estimated to cost about

$500,000 per day (NRC, 1984). The estimated discounted present value of these avoided onsite costs is given in Table 7.

NUREG-1109 15 For Comment

_ - _ _ _ _ _ _ _ _ _ _ _ _ - _ l

Mean or Median Core Damage Frequencies The estimates of core damage frequencies for this value-impact analysis were calculated using " point estimates" of accident frequencies (NUREG-1032). This is intended to be a realistic analysis (e.g., tending to be neither conserva-tive nor non-conservative) in that there is approximately an equal probability of plant core damage frequencies being higher or lower than this value. Mean values of core damage frequencies, which are higher than the point estimates, could have been used. However, the calculation of mean values depends on the assumed distribution (e.g., log normal or other) for probabilities of event frequencies, which in itself leads to some uncertainty (NUREG/CR-3226).

Future Trends in Loss of Offsite Power Frequency The estimated frequency of core damage from station blackout events is directly proportional to the frequency of the initiating event. Estimates of station blackout frequencies for this USI were based on actual operating experience. d This is assumed to be a realistic indicator of future performance. An argument can be made that the future performance will be better than the past. For example, when problems with the offsite power grid arise, they are fixed, and

, therefore, grid reliability should improve. On the other hand, grid power failures may become more frequent because fewer plants are being built, and more power is being transmitted between regiont,, thus placing greater stress on transmission lines.

Common Cause Failures One factor that affects ac power system reliability is the vulnerability to common cause failures associated with design, operational, and environmental i factors. Common cause failure vulnerabilities are plant-specific; therefore, l the imposition of generic requirements to improve the reliability of AC power systems by eliminating specific single point vulnerabilities is not practical.

Existing industry and NRC standards and regulatory guides include specific design criteria and guidance on the independence of offsite power circuits and

^

the independence of, and limiting interactions between, diesel generator units at a nuclear station. In developing the proposed resolution of USI A-44, the NRC staff assumed that, by adhering to such standards, licensees have minimized, to the extent practical, single point vulnerabilities in design and operation i' that could result in a loss of all offsite power or all onsite emergency ac power. Results of sensitivity studies presented in NUREG-1032 indicate that if 4 potential common cause failures of redundant emergency diesel generators exist f

(e.g. , in-service water or dc power support systems), then estimated core damage frequencies can increase significantly.

4.1.2 Alternative (ii)

The alternative of treating plants uniformly by requiring all plants to be able to cope with the same station blackout duration has been considered. This simplified approach has the advantage of being potentially easier to implement, but it also has two major drawbacks. First, operating nuclear power plants 1

have significant differences in plant- and site-specific factors that contrib-ute to risk from station blackout. This alternative would not take these known i factors into account. For example, plants that have a more redundant emergency ac power system than other plants would not be given credit for such features.

NUREG-1109 16 For Comment

Second, requiring all plants to be able to cope with the same blackout duration would result in one of two undesirable alternatives: (1) If a uniform duration of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or less were recommended, station blackout could still be a signif-icant contributor to total core melt frequency for some plants and, therefore, the objective of the proposed requirements would not be met; and (2) if a uniform 8-hour requirement were imposed, it would necessitate expenditures at some plants that would not be considered cost-effective in reducing the risk from station blackout events. Therefore, this alternative is not recommended.

4.1.3 Alternative (iii)

Another possible alternative to the recommended action is to require plants to install either an additional emergency diesel generator or another ac-independent decay heat removal system. This alternative is not being rec-ommended for several reasons. First, the cost for either of these additions (from $10 to $30 million per plant) would be much higher than the estimated cost for the proposed resolution. The recommended approach is more cost effective and meets the objective stated in Section 2. Second, the adequacy of present requirements for decay heat removal systems is being studied under USI A-45, and any major hardware changes or additions to these systems should await the technical resolution of A-45. Third, experience indicates that there are practical limits to diesel generator reliability, including common cause failures of redundant divisions, and the recommended resolution provides greater diversity and additional defense in depth.

4.1.4 Alternative (iv)

This alternative would be to take no actions beyond those resulting from the proposed resolution of Generic Issue B-56 (see discussion in Section 4.2.1).

Operating experience with diesel generator failures and losses of offsite power has raised a significant concern regarding the potential risk from a station blackout event. The use of this data base with relatively straightforward application of PRA techniques indicates that station blackout events could be a significant contributor to risk for many plants. The additional actions rec-ommended for USI A-44 would significantly reduce the estimated frequency of core melt associated with severe accidents from station blackout. Because the

~

value-impact analysis has shown that it would be beneficial to implement the proposed recommendations, the no-action alternative is not recommended.

4.2 Impacts on Other Requirements Several ongoing NRC generic programs and requirements that are related to the USl A-44 activities and proposed regulatory positions are discussed below.

4.2.1 Generic Issue B-56, Proposed Actions for Enhancing Reliability of Diesel Generators at Operating Plants In Generic Letter 84-15, dated July 2, 1984, the staff requested information from licensees regarding proposed actions to improve and maintain diesel gener-ator reliability. The letter requested specific information on three areas (1) reduction of cold fast-start surveillance tests for diesel generators (2) diesel generator reliability NUREG-1109 17 For Comment

(3) the licensee's diesel generator reliability program, if any, and comments on the staff's example performance technical specifications for diesel generator reliability After the staff review of the licensees' responses to this request, those plants whose diesel generator reliability is below a minimum specified value are being considered on a case-by case basis to improve diesel generator performance.

The example performance specifications (item (3) above), would establish a set of action statements based on the reliability actually exhibited by diesel generators, with 0.05 failure per demand as the maximum desired failure rate and 0.10 failure per demand as the maximum acceptable failure rate. Licensees with a diesel generator failure rate above the desired level would have to increase testing frequency from once every 31 days to once every 7 days. This test frequency would be maintained until there have been seven consecutive failure-free demands and the number of failures in the last 20 demands has been reduced to one or less. Licensees with diesel generator failure rate above the maximum acceptable level would be required to disqualify their diesel generators.

The licensee would initiate a requalification program to demonstrate that the causes of the failure have been corrected. The diesel generator would be re-qualified only if the failure rate has been reduced to 0.05 failure per demand or less. The testing frequency and the allowable out-of-service period would also be relaxed somewhat from that currently recommended by Regulatory Guide 1.108.

The example performance specifications are compatible with the proposed require-ments to resolve USI A-44. In fact, the proposed resolution of A-44 assumes that responses to the generic letter, including licensees' comments on the example performance technical specifications, will establish a basis for main-taining and determining the reliability of emergency diesel generators. The example program is based on a maximum desired failure rate of 0.05 failure per demand for all plants; the resolution of USI A-44 proposes maintaining failure rates at or below 0.05 or 0.025 failure per demand, depending on the plants' characteristics, as discussed in Section 3 above.

4.2.2 USI A-45, Shutdown Decay Heat Removal Requirements

'p The overall objective of USI A-45 is to evaluate the adequacy of current licens-ing design requirements to ensure that nuclear power plants do not pose an unac-i ceptable risk as a result of failure to remove shutdown decay heat. The study

, includes an assessment of alternative means of shutdown decay heat removal and i of diverse " dedicated" systems for this purpose. Results will include proposed recommendations regarding the desirability of, and possible design requirements for, improvements in existing systems or an alternative decay heat removal method.

j The USI A-44 concern for maintaining adequate core cooling under station black-j out conditions can be considered a subset of the overall A-45 issue. However, 3 there are significant differences in scope between these two issues. USI A-44 l deals with the probability of loss of ac power, the capability to remove decay

heat using systems that do not require ac power, and the ability to restore ac

power in a timely manner. USI A-45 deals with the overall reliability of the decay heat removal function in terms of response to transients, small break loss-of-coolant accidents, and special emergencies such as fires, floods, seis-mic events, and sabotage.

NUREG-1109 18 For Comment

Although the recommendations that might result from the resolution of USI A-45 are not yet known, some could affect the station blackout capability, while l others would not. Recommendations that involve new or improved decay heat removal systems that are ac power dependent but that do not include a separate independent ac power supply would have no effect on USI A-44. Recommendations that involve an additional ac-independent decay heat removal system would have a very modest effect on USI A-44. Recommendations that involve a new decay heat removal system that would include an independent ac power ~ supply wculd have a significant effect on USI A-44. Such a new additional system would receive the appropriate credit within the present structure of the proposed USI A-44 resolution by changing the emergency ac power configuration group.

The proposed resolution of USI A-44 would necessitate expenditures--typically around $600,000 per plant, with a range estimated to be from about $200,000 to a maximum of around $4 million. A resolution for USI A-45 involving a new additional comprehensive system, such as an additional shutdown cooling system with its own dedicated diesel generator, would be much more expensive, with an expenditure on the order of tens of millions of dollars.

The resolution of these two issues is coordinated along two main lines. First, technical information resulting from both studies is shared among the major participants including NRC staff and contractors. In this way the resolution of USI A-45 will take into account any modifications resulting from the reso-lution of USI A-44 that are applicable to the decay heat removal function.

Second, the schedules are coordinated so that by the time a final rule on USI j A-44 is published--and well before plant modifications, if any, would be 1 implemented--the proposed technical resolution of USI A-45 will be published for public comment.

1 The draft contractor technical summary report for USI A-45 should be completed

! by mid-1986, and completion of the draft regulatory position for the proposed i resolution of USI A-45 is targeted for late 1986. If the rule on USI A-44 were issued, it would not be final until early 1987. For plants needing hardware modifications to comply with the proposed USI A-44 resolution, this schedule would permit a re-evaluation before any actual modifcations are made so that any contemplated design changes following from the resolution of USI A-45 can be considered at the same time.

4.2.3 Generic Issue B-23, Reactor Coolant Pump (RCP) Seal Failures The Task Action Plan for B-23 identifies several tasks to resolve this issue, including a review of seal failure operating experience, an assessment of the effects of loss of seal cooling on reactor coolant pump (RCP) seal behavior, and an evaluation of other causes of RCP seal failure such as mechanical and maintenance-induced failures. NRC and industry analyses of seal performance i with loss of seal cooling are proceeding. Because RCP seal integrity is necessary for maintaining primary system inventory under station blackout con-ditions, the results of this analysis will provide information to determine seal behavior and, likewise, a plant's ability to cope with a station blackout for a specified time.

4.2.4 Generic Issue A-30, Adequacy of Safety-Related DC Power Supply 1

The staff's proposed resolution of this issue specifies guidance for enhancing i the reliability of de power supply systems. This guidance includes items such NUREG-1109 19 For Comment j

~ _ _ - __, _ _ _ _ _ - . , _ _ _ , _ . _ _ _ _ . . _ _ _ _ . _ _ __ _ ____ _ ___ _ _ _ _ __. _ _ _ _ _ _

restricting interconnections between redundant dc divisions, monitoring the readiness of the dc power system, and specifying administrative procedures and technical specifications for surveillance testing and maintenance activities.

The analysis performed for USI A-44 (NUREG-1032) assumed that a high level of dc power system reliability would be maintained so that (1) dc power system failures would not be a significant contributor to losses of all ac power and (2) should a station blackout occur, the probabi.lity of immediate dc power system failure would be low. Whereas the proposed resolution of Generic Issue A-30 focuses on enchancing battery reliability, the proposed resolution of USI A-44 is aimed at assuring adequate station battery capacity in the event of a station blackout of a specified duration. Therefore, the proposed resolutions

of these two issues are consistant and compatible. )

I 4.2.5 Regulatory Guide 1.108, Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants Regulatory Guide 1.108 describes the currently acceptable methad for complying with the Commission's regulations with regard to periodic testing of diesel generators to ensure that they will meet their availability requirements. This guide may need to be modified to be consistent with the proposed actions de-scribed in Section 4.2.1 above (Generic Issue B-56). If necessary, Regulatory Guide 1.108 will be revised after comments have been received from licensees on the B-56 example diesel generator reliability program.

4.2.6 Fire Protection Program for Nuclear Power Facilities 10 CFR 50.48 states that each operating nuclear power plant shall have a fire protection plan that satisfies GDC 3. The fire protection features required to satisfy GDC 3 are specified in Appendix R to 10 CFR 50 and in Branch Technical Position CMEB 9.5.1. They include certain provisions regarding alternative and dedicated shutdown capability. To meet these provisions, some licensees have added, or plan to add, improved capability to restore power from offsite sources

, or onsite diesels for the shutdown system. A few plants have installed a safe shutdown facility for fire protection that includes a charging pump powered by its own independent ac power source. In the event of a station blackout, this system can provide makeup capability to the primary coolant system as well as reactor coolant pump seal cooling. This could be a significant benefit in terms of enhancing the ability of a plant to cope with a station blackout.

Because the plant modifications required for fire protection have already been specified, it would not be feasible to consider these modifications together

with the proposed requirements of USI A-44. However, credit is given for improvements made for the fire protection program in the USI A-44 resolution.

4.2.7 Proposed Auxiliary System Reliability and Power Diversity Upgrade in Operating Plants The staff is considering a proposal that the reliability and diversity require-ments for auxiliary feedwater systems specified in Standard Review Plan (SRP)

Section 10.4.9, " Auxiliary Feedwater System" (NUREG-0800), be applied to all PWRs. This proposal would be submitted to the Committee to Review Generic Requirements (CRGR) for review. If adopted, this proposed requirement would NUREG-1109 20 For Comment i

require an upgrading of the auxiliary feedwater pump train in several PWRs. '

This upgrading would most likely result in the addition of an auxiliary feed-water pump. Because all PWRs now have an auxiliary feedwater system that is ac power independent, the criteria specified in SRP 10.4.9 could be met by adding a motor-driven pump. Consequently, the auxiliary feedwater system l upgrade could have no effect on the station blackout issue. The installation of a system that is independent of ac power would be beneficial in handling station blackout accident sequences. Because this issue is so closely related to USI A-45 (Shutdown Decay Heat Removal Requirements), its resolution may await the recommendations of USI A-45, 4.2.8 Multiplant Action Items B-23 and B-48, Degraded Grid Voltage and Adequacy of Station Electric Distribution Voltage These two multiplant action items have been under consideration by both the staff and licensees for several years. They relate to: (1) sustained degraded voltage conditions at the offsite power sources, (2) interaction between the offsite and onsite emergency power systems, and (3) the acceptability of the voltage conditions on the station electric distribution systems with regard to potential overloading and starting transient problems. Licensees' responses to these concerns have consisted of verifying the adequacy of existing power sys-1 tems or of upgrading the power systems. The modifications are designed to i ensure that the power systems can perform their intended function and conse-quently would enhance their dependability. If additional power sources have i been added to address these concerns, the plant would be placed in an improved category and may be required to withstand a blackout of lesser duration. In the proposed resolution of USI A-44, the staff is not recommending that work that has been done on these two action items be repeated.

4.3 Constraints The staff has reviewed current Commission regulations to determine if they provide a basis for implementation of the proposed USI A-44 requirements. This review included (1) the Atomic Safety and Licensing Appeal Board Hearing (ALAB-603) on station blackout for St. Lucie Unit 2; (2) the Commission review of that hearing; and (3) GDC 17, Electric Power Systems.

ALAB-603 took the position that station blackout should be considered a design basis event for St. Lucie 2 because of the unacceptably high frequency of such l an event (10 4 to 10 5 per year at that site). As a result, the Appeal Board required St. Lucie 2 to be capable of withstanding a total loss of ac power and to implement training and procedures to recover from station blackout. The Appeal Board went as far as to say Our findings that station blackout should be considered as a de-sign basis event for St. Lucie Unit 2 manifestly could be applied equally to Unit 1, already in operation at that site. By a parity of reasoning, this result may well also obtain at other nuclear plants on applicant's system, if not at most power reactors. Our jurisdiction, however, is limited to the matter before us, licens-ing construction of St. Lucie 2. Beyond that, we can only alert the Commission to our concerns.

NUREG-1109 21 For Comment

l The Commission upheld the Board's action on St. Lucie 2. However, the Com- ,

mission determined that ALAB-603 did not establish station blackout generically as a " design basis event."

The last paragraph of GDC 17 states Provisions shall be included to minimize the probability of losing j electric power from any of the remaining supplies as a result of, )

or coincident with, the loss of power generated by the nuclear 1 power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.

The intent of GDC 17 is to require reliable offsite and onsite ac power sys-tems. The ability to cope with the coincident loss of both of these systems is not addressed explicitly.

As a result of this review, the staff has concluded that there is a basis in the regulation for the proposed recommendations to improve the reliability of the offsite and onsite ac power systems. However, because the coincident loss of both systems is not addressed explicity, the staff is proposing a rule to require plants to be able to withstand a total loss of ac power for a specified duration to provide further assurance that station blackout will not adversely affect the public health and safety.

No other constraints have been identified that affect the proposed resolution of USI A-44.

5 DECISION RATIONALE The evaluation to resolve USI A-44 included deterministic and probabilistic analyses. Calculations to determine the timing and consequences of various accident sequences were performed, and the dominant factors affecting station blackout likelihood were identified (NUREG-1032, and NUREG/CR-2989, -3992, and

-3226). Using this information, simplified probabilistic accident sequence correlations were calculated to estimate the likelihood of core melt accidents resulting from station blackout for different plant design, operational, and location factors. These quantitative estimates were used to give insights into the relative importance of various factors, and those insights, along with engineering judgment, were used to develop the proposed resolution. By analyz-ing the effect of variations in design, operations, and plant location on risk from station blackout accidents, an attempt was made to approach a reasonably consistent level of risk in the recommendations developed.

A survey of probabilistic risk assessment studies showed that total core damage frequency from all dominant accident sequences ranged from 2 x 10 5 to 1 x 10 3 per reactor year, with a typical frequency of about 6 to 8 x 10 5 per reactor-year (NUREG/CR-3226). For plants in operation or under construction, a value-impact analysis was performed to determine that the proposed recommendations to resolve USI A-44 were cost effective. The proposed resolution would result in station blackout being a relatively small contributor to core damage frequency.

(NUREG-1032 provides a more detailed discussion of the analysis of station blackout accident likelihood performed for this regulatory analysis.)

NUREG-1109 22 For Comment

Additional rationale for recommending implementation of the proposed rule and the draft regulatory guide over other alternatives is in the value-impact analysis discussed in Section 4.1 above. This proposed action represents the staff's position based on a comprehensive analysis of the station blackout issue. This position includes all the requirements and guidance to resolve the station blackout issue.

The studies and data on which these recommendations are based are documented in NUREG-1032 and NUREG/CR-2989, -3992, and -3226. Summaries of these reports follow.

5.1 NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants, Technical Findings Related to Unresolved Safety Issue A-44 This report " summarizes the results of technical studies performed in support of USI A-44 and identifies the dominant factors affecting the likelihood of station blackout accidents at nuclear power plants. These results are based on operating experience data; analysis of several plant-specific probabilistic safety studies; and reliability, accident sequence, and consequence analyses performed in support of this unresolved safety issue.

In summary the results show the following important characteristics of station blackout accidents.

(1) The likelihood of station blackout varies between plants with an estimated frequency ranging from approximately 10 5 to 10 3 per reactor year. A

" typical" estimated frequency is on the order of 10 4 per reactor year.

(2) The capability of restoring offsite power in a timely manner can have a significant effect on accident consequences.

(3) Onsite ac power system redundancy and individual power supply reliability have the largest influence on station blackout accident frequency.

(4) The capability of the decay heat removal system to cope with long duration blackouts can be a dominant factor influencing the likelihood of core damage or core melt.

(5) The estimated frequency of station blackout events resulting in core damage or core melt can range from approximately 10 6 to greater than 10 4 per reactor year. A " typical" core damage frequency estimate is on the order of 10 5 per reactor year.

(6) The best information available indicates that containment failure by over-pressure may follow a station-blackout-induced core melt with smaller, low design pressure containments most susceptible to early failure. Some large, high design pressure containments may not fail by overpressure, or the failure time could be on the order of a day or more.

Losses of offsite power could be characterized as those resulting from plant-centered faults, utility grid blackout, or severe weather-induced failures of offsite power sources. The industry average frequency of total losses of off-site power was determined to be about 1 in 10 site years. The median restora-tion time was about one-half hour, and 90% of the losses were restored in NOREG-1109 23 For Comment

l l

3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months or less. The factors that were identified as affecting the frequency and duration of offsite power losses are (1) design of preferred power distribution system, particularly the number and independence of offsite power circuits from the point where they enter the site up to the safety buses (2) operations that can compromise redundancy or independence of multiple off-site power sources, including human error (3) grid stability and security, and the ability to restore power to a nuclear plant site with a grid blackout (4) the hazard from, and susceptibility to, severe weather conditions that can cause loss of offsite power for extended periods A design and operating experience review, combined with a reliability analysis of the onsite, emergency ac power system, has shown that there are a variety of potentially important failure causes. The typical unavailability of a two-division emergency ac power system is about 10 3 per demand, and the typical individual emergency diesel generator failure rate is about 2 x 10 2 per demand.

The factors that were identified as affecting the emergency ac power system reliability during a loss of offsite power are '

(1) power supply configuration redundancy (2) reliability of each power supply (3) dependence of the emergency ac power system on support of auxiliary cooling systems, control systems (4) vulnerability to common cause failures associated with design, operational, and environmental factors The likelihood of a station blackout progressing to core damage or core melt is dependent on the reliability and capability of decay heat removal systems that are not dependent on AC power. If sufficient capability exists, additional time will be available to permit an adequate opportunity to restore ac power to the many systems normally used to cool the core and remove decay heat. The most important factors involving decay heat removal during a station blackout are (1) the starting reliability of systems required to remove decay heat and maintain reactor coolant inventory (2) the capacity and functionability of decay heat removal systems and auxiliary or support systems that must remain functional during a station blackout (e.g., de power, condensate storage)

(3) for PWRs, and BWRs without reactor coolant makeup capability during a station blackout, the magnitude of reactor coolant pump seal leakage (4) for BWRs that remove decay heat to the suppression pool, the ability to maintain suppression pool integrity and operate heat removal systems at high pool temperatures during recirculation.

NUREG-1109 24 For Comment

I I

4

It was determined by reviewing design, operational, and location factors, that the expected core damage frequency from station blackout could be maintained i around 10 5 per reactor year or lower for all plants. The ability to cope

, with station blackout durations of 4 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and emergency diesel generator reliabilities of 0.95 per demand or better would be necessary to reach this core melt frequency level.

5.2 NUREG/CR-3226, Station Blackout Accident Analyses This report analyzes accident sequences following a postulated total loss of ac power to (1) determine the core damage frequencies from station blackout, (2) provide insights through sensitivity studies of important factors to con-sider for lowering the core melt frequency, and (3) provide perspectives on the risks from such an event. Probabilistic safety analyses were done on four generic " base" plant configurations. Fault trees of different systems and event trees of possible station blackout accident sequences were constructed for these plants. These event trees modeled three time periods including an initial time period for sequences resulting from unavailabilities on demand and longer time intervals in which other failures can occur such as depletion of dc power, degradation of RCS pump seals, or depletion of condensate storage tank supply. Data from the offsite and onsite power studies (NUREG/CR-2989 and -3992) as well as from licensee event reports and PRAs were used to quantify the accident sequences. Lastly, containment failure modes and timing were reviewed to calculate the risk to the public from station blackout.

For the " base" cases, the total core melt frequencies from station blackout resulting from the dominant accident sequences were estimated to be in the range of 10 5 per reactor year. Plants with features different from the base case designs have different core melt frequencies, so sensitivity analyses were conducted. For example, the reliability and recovery of ac power from both the offsite and emergency onsite power systems have a direct impact on core melt frequencies. Depending on the expected frequency of station blackout at a plant and other factors, the frequency of core melt associated with loss of all ac power ranged from about 2 x 10 6 to greater than 10 4 per reactor year.

In summary, results of the accident sequence analyses indicate that the follow-ing plant factors are important when considering station blackout:

(1) the effectiveness of actions to restore offsite power once it is lost (2) the degree of redundancy and reliability of the emergency onsite ac power system (3) the reliability of decay heat removal systems following loss of ac power (4) dc power reliability and battery capacity including the availability of instrumentation and control for decay heat removal without ac power (5) common service water dependencies between the emergency ac power source and the decay heat removal systems (6) the magnitude of reactor coolant pump seal leakage and the likelihood of a stuck-open relief valve during a station blackout NUREG-1109 25 For Comment

(7) containment size and design pressure (8) operator training and available procedures 5.3 NUREG/CR-2989, Reliability of Emergency AC Power Systems at Nuclear Power Plants The purpose of this study was to estimate the reliabilities of representative onsite ac power systems and to estimate the costs of fixes to improve the re-liabilities of these systems. For this analysis, an initial design review of onsite ac power systems was done using Final Safety Analysis Reports (FSARs) for plants, plant schematics, and plant-specific procedures. The study included examining the following areas: switchyards, distribution systems, dc power systems, diesel generators, support systems, and procedures. Historical data on diesel generator operating experience for the 5 year period from 1976 through 1980 were collected from licensee event reports and responses to questionnaires sent to licensees.

Eighteen different configurations were identified, and representative plants were selected for a more detailed reliability analysis. This analysis involved constructing fault tree models for the onsite power systems and quantifying these fault trees with the data gathered on operating experience. The onsite system undependability (the probability that it will fail to start or fail to continue to run for the duration of an offsite power outage) was calculated for ac power outages up to 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months after a loss of offsite power. Results of a sensitivity study were used to identify potentially important contributors to unreliability, and costs of improvements were estimated.

Results showed that important contributors to onsite power undependability were independent diesel generator failure, common cause failure due to hardware failure or human error, unavailability because of scheduled maintenance, and cooling subsystem undependability. Reliability of onsite ac power systems varies from plant to plant. Depending on diesel generator configuration, the system unavailability ranged from 1.4 x 10 4 to 4.8 x 10 2 per demand. Signif-icant variability exists so that any reliability improvements and the associ-ated costs must be evaluated on a plant-specific basis.

5,4 NUREG/CR-3992, Collection and Evaluation of Complete and Partial losses of Offsite Power at Nuclear Power Plants This report describes and categorizes events involving complete or significant partial losses of offsite power that have occurred at nuclear power plants through 1983. The purposes of this study were to provide an accurate data base to estimate frequencies and durations of losses of offsite power and to under-stand how offsite power design features may affect these losses as well as the ability to restore offsite power.

Based on industry-wide data for the years 1959 through 1983, the frequency of loss of offsite power is about once every 10 site years. A total of 46 com-plete loss of offsite power events were documented, ranging in duration from a few minutes up to a maximum of almost 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months . In approximately half of these events, offsite power was restored in one-half hour or less. Information for this study was collected from licensee event reports, responses to an NRC ques-tionnaire, and various reports prepared by the utilities. Most of the event NUREG-1109 25 For Comment

descriptions in the licensee event reports and other documentation within the NRC files did not contain sufficiently detailed information for the purposes discussed above. For example, in one case a licensee reported offsite power restoration time to be 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , but actually one offsite power source was restored in 8 minutes, and all offsite power was restored in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Because restoration of one source of offsite power terminates a loss of offsite power, the documented description was not accurate enough. In some other cases, off-site power was available to be reconnected, but the plant operators did not reconnect it for some time after it was available. The time power was recon-nected was usually reported; however, the data that were actually needed were the times that power was available-for reconnection. Because of the need for more accurate data, the staff obtained additional information by contacting utility engineers for better descriptions of the causes, sequences of events, and the times and methods of restoring offsite power.

Once these data were collected, the offsite power failures were identified as plant-centered or grid failures. In addition, the causes of the failures were attributed to weather, human error, design error, or hardware failure. The plant-centered failures were usually of shorter duration than the grid failures caused by revere weather. For this reason, the weather-related events were reviewed in detail.

Offsite power design features were tabulated for most of the operating nuclear power plants to determine which ones significantly affect offsite power system reliability. The frequency and duration of losses of offsite power caused by severe weather are affected by the number of transmission lines and rights-of-way and the availability of alternate power sources (such as hydro, gas tur-bines, or fossil units near the nuclear plant). Design features that may be important for plant-centered losses of of fsite power are the number of offsite power cources, the electrical independence of those sources, and the relay scheme for transferring power between offsite sources.

6 IMPLEMENTATION 6.1 Schedule for Implementing the Proposed Rule The steps and schedule listed in Table 9 are suggested for implementing the proposed rule. Within 9 months after final promulgation of the rule, licensees will submit to NRC the duration for which the plant should be able to cope with a station blackout, a justification for the duration, and a description of the procedures to cope with a station blackout for that duration. The staff will review the licensees' submittals, and within 6 months after that review licen-sees will submit a schedule for implementing any necessary equipment modifica-tions to comply with the proposed rule. The factors that must be considered to determine the minimum acceptable station blackout duration, as specified in the proposed revision to Appendix A to GDC 17, are relatively simple. Thus, this duration can be determined in approximately 1 or 2 months. Licensees will be required to perform plant-specific analyses to determine how long the plant, as designed, can cope with a station blackout, and to determine what modifica-tions, if any, are needed to meet the acceptable duration. These analyses could require 6 to 9 months to perform. Thus, it does not seem unreasonable to request that the information be submitted to the NRC within 9 months after the date of the proposed rule. A final schedule for implementation of design and/or procedural modifications will be mutually agreed upon by the licensee NUREG-1109 27 for Comment l

I Table 9 Proposed implementation schedule To be done after Commission Activity decision to issue rule (months) l Commission decision on rule 0 Issuance of proposed rule and regulatory 1 guide for public comment Submittal of final rule to Commission 12 Issuance of final rule 16 Licensees' submittal of station blackout 25 durations to NRC, including description of procedures Completion of NRC review of submittal 36 Completion of licensees' hardware

modifications

Schedule to be agreed upon with NRC, but within 2 years of NRC review of submittal, unless justification is submitted by the licensee for a later date and the staff agrees, and the NRC staff. The implementation of procedural changes to cope with a station blackout and diesel generator reliability improvements, if necessary, should be accomplished early in the schedule. Hardware backfits, if necessary, should be implemented as soon as practical, based on scheduled plant shutdown, '

but no later than 2 years af ter the staff reviews a licensee's station blackout duration submittal.

Other schedules were considered; however, the staff believes the schedule pro-posed in Table 9 is achievable without unnecessary financial burden on licen-sees for plant shutdown. The proposed schedule allows reasonable time for the implementation of necessary hardware items to achieve a reduction in the risk of severe accidents associated with station blackout, yet achieves significant benefits early on by requiring an assessment of a plant's station blackout capability and procedures and training to cope with such an event. Shorter or less flexible schedules would be unnecessarily burdensome; longer schedules would delay necessary plant improvements. ,

6.2 Relationship to Other Existing or Proposed Requirements !

Several NRC programs are related to USI A-44; these are discussed in Section 4.2. ;

These programs are compatible with the proposed resolution of USI A-44 I RE N 109 28 N Mnt

L 7 REFERENCES EG&G, " Cost Analysis for Enhancement of DC Systems Reliability and Adequacy of Safety-Related DC Power Systems," EG&G Report RE&ET-6151, January 1983.

Sandia National Laboratory, "Value-Impact Calculation for Station Blackout Task Action Plan A-44," letter report to NRC, March 1983.

U.S. Atomic Energy Commission, WASH-1400, " Reactor Safety Study," October 1975 (also reissued as NUREG-75/014).

U.S. Nuclear Regulatory Commission, " Regulatory Analysis Guidelines," NRR Office Letter No. 16, Revision 2, October 3, 1984.

-- , NUREG-0800, " Standard Review Plan for the Review of Safety Analyses for Nuclear Power Plants," July 1981.

-- , NUREG-1032, " Evaluation of Station Blackout Accidents at Nuclear Power Plants, Technical Findings Related to Unresolved Safety Issue A-44," issued for comment, May 1985.

-- , NUREG/CR-2723, " Estimates of the Financial Consequences of Nuclear Power Reactor Accidents," September 1982.

-- , NUREG/CR-2989, " Reliability of Emergency AC Power Systems at Nuclear Power Plants," July 1983.

-- , NUREG/CR-3226, " Station Blackout Accident Analyses (Part of NRC Task Action Plan A-44)," May 1983.

-- , NUREG/CR-3568, "A Handbook for Value-Impact Assessment," December 1983.

-- , NUREG/CR-3840, " Cost Analysis for Potential Modifications to Enhance the Ability of a Nuclear Power Plant to Endure Station Blackout," July 1984.

-- , NUREG/CR-3992, " Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants," February 1985.

NUREG-1109 29 For Comment

esRC Fomu 335 U S NUCLE AR REQuL ATOR 7 COMMt15 TOM i ht*ou f NowSE A t4w s**d #P f TOC. eda Ve' ife. af saFi u sa, Lf3j,'- Bl8UOGRAPHIC DATA SHEET u s srycrioNs oN r . aivi=* NUREG-y 09 Draft

,ura. > ie. i i r u atewi. u Regu tory Analysis for the Resolution of Unresolved Safet Issue A.44, Station Blackout , o. ,, ,,, , co ,a r o f

Dea f t ort for Comment f 0%,.

j ....

. A ,,.o. ,,, pvember 1985

. omie ainoar .ssueo Alan M. Rub J

/ Anuary l 1986 7 PE AF Oph*eNG Oni ANila t EON WE AND M AILING 4 DOA t 35 f fare w e l# Com/ 0 PROJtCTs f ASF WQHE UNif NVUSER Division of Saf y Review and Oversight , f,,3[, A-44 ,, _ , , ,

Office of Nuclea eactor Regulation U.S. Nuclear Regal ory Commission Washington, D.C. 20 5 to SPON50Ri 8eG U#GANel Af SON Newt ANO h*A'L i ADDMtb5 tractue lp Caper

. lla Tvrg OF REPum f (came as Performing Orga zation) Draft for Comment e PE M,00 Cov t R&D f #acewe,ve erent 12 SUPPat Ut NT AR v NOTt 5 13 1957R AC1 (20d weres or esst

" Station Blackout" is the complete 1 s f alternating current (AC) electric power to the essential and nonessential buse in a nuclear power plant; it results when both offsite power and the onsite emer cy AC power systems are unavailable.

Because many safety systems required r actor core decay heat removal and containment heat removal depend on A powe the consequences of a station blackout could be severe. Because the c ern about the frequency of loss of offsite power, the number of failur s of emer ncy diesel generators, and the potentially M ire consequences of 1 loss of a AC power, " Station Blackout" was desQnated as ynresolved Safety I 'ue (USI) A-44 This report presents the regulat y analysis for 05 A-44 It includes: (1) a summary of the issue, (2) the proposed chnical resolution, '3) alternative resolutions con-sidered by the Nuclear Regulat y Commission (NRC) sti f. (4) an assessment of the benefits and costs of the reco , ended resolution, (5) t decision rationale, and (6) the relationship between I A-44 and other flRC prog ms and requirements.

.. ocau Nr u ,... s . . . ..u o oi s#,, cm

.. p,.g.gr .

Station Blackout Unresolved Safety Issue A-44. Unlimited Regulatcry Analysis .. i cu. r.ct. .,,,c. r.oN Value-Impact Analysis , , . . .

. ,o.Nr,. as o,iN .No.o riavs Unclassifled Unclassified

. , e. . . o. . . a .

\

l

UNITED STATES ,cc, cass ura NUCLEAR REZULATORY COMMISSION eosra:: :a riss e:o WASHINGTON, D.C. 20555 wflIo*c PERMIT No G 47 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE. $300 .

12055507&A77 1 1ANIAlllf US f.R f ADF-DIV Or TIDC POLI CY & PUP MGT ER-PDR NUREG L'- 5 0 1 WASHIFGTON DC 20555 a

s m

-i d.

O*

Z to n

X O

C

-i -

Y O

e 4

C m

4 A

C

ML20205H860

Text

SUMMARY

SUMMARY

Navigation menu

Search