ML20217G595

Assessment of Spent Fuel Cooling, Presented at 961021-23, 24th Water Reactor Safety Info Meeting in Bethesda,Md

ML20217G595
Person / Time
Issue date:	10/21/1996
From:	Ibarra J, William Jones, Lanik H NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUDOCS 9804290172
Download: ML20217G595 (29)

Text

.

Assessment of Spent Fuel Cooling J.G. Ibarra, W.R. Jones, G.F. Lanik, H.L. Ornstein, S.V. Pullani U.S. Nuclear Regulatory Cornmission Office for Analysis and Evaluation of Operational Data 24th Water Reactor Safety Information Meeting Bethesda, Maryland, October 21-23,1996 i

i I

l

< 2/

. .. <, ,, j j 9804290172 961021 PDR ORG NEXD PDR j j

ABSTRACT The paper presents the methodology, the findings, and the conclusions of a study that was done by the Nuclear Regulatory Commission's Office for Analysis and Evaluation of Operational Data (AEOD) on loss of spent fuel pool cooling. The study involved

! kn examination of spent fuel pool designs, operating experience, operating practices, and procedures. AEOD's work was augmented in the area of statistics and probabilistic risk assessment by experts from the Idaho Nuclear Engineering Laboratory. Operating experience was integrated into a probabilistic risk assessment l to gain insight on the risks from spent fuel pools.

l EXECUTIVE

SUMMARY

i As directed by the Executive Director for Operations, the Office for Analysis and Evaluation of Operational Data (AEOD) has performed an independent assessment of the likelihood and consequences of an extended loss of spent fuel pool (SFP) cooling. The overall conclusions are that l the typical plant may need improvements in SFP instrumentation, operator procedures and training, and configuration control.

Six site visits were conductW 60 gain an understanding of the licensecs' SFP physical configuration, practices, and operating procedures. The assessment found great variation in the designs and capabilities of SFPs and systems at individual nuclear plants.

in November 1992, two contractors working at the Susquehanna Steam Electric Station submitted a defects and noncompliance report on the Susquehanna SFP to the U.S. Nuclear Regulatory ,

Commission. They were interviewed by AEOD to better understand their concerns. Their report, i which has potential generic implications, provided the impetus for the NRC and the nuclear industry to take a closer look at the SFPs.

AEOD reviewed the applicable SFP regulations and the NRC Standard Review Plan for the l acceptance criteria and the applicable Regulatory Guides. Because of the evolution of the criteria and  !

the different times that reactors were licensed, the criteria to evaluate the SFP designs varies among the operating facilities.

AEOD performed independent assessments of the electrical systems, instrumentation, heat loads, and radiation. These assessments were utilized to determine the typical SFP configurations and potential problems.

Utilizing a previous Susquehanna risk analysis, Idaho National Engineering Laboratory performed model refinements that resulted in better estimates of near boiling frequencies. No quantitative .

estimates of core damage were performed but the analysis provided qualitative insights for l identification of improvements in the SFPs to lessen the risks of events.

i j

~

I l

1 The conclusions are:

• Review of more than 12 years of operating experience determined that loss of SFP coolant inventory greater than I foot has occurred at a rate of about I per 100 reactor years. Loss of SFP cooling with a temperature increase greater than 20 *F has occurred at a rate of approximately 3 per 1000 reactor years. The consequences of these actual events have not been severe. However, events have resulted in loss of several feet of SFP coolant level and have gone on in excess of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The primary cause of these events has been human error. ]

\

• Review of existing SFP risk assessments found that after correction for several problems in the analyses, the relative risk due to loss of spent fuel cooling is low in comparison with the risk ,

of events not involving the SFP. The review determined that the likelihood and consequences {

of loss of SFP cooling events are highly dependent on human performance and individual plant 4 design features.

• The need for specific corrective actions should be evaluated for those plants where failures of ,

reactor cavity seal or gate seals, or ineffective antisiphon devices could potentially cause loss i of SFP coolant inventory sufficient to uncover the fuel or endanger makeup capability.

• The need for improvements to configuration controls related to the SFP to prevent and/or mitigate SFP loss of inventory events and loss of cooling events should be evaluated on a plant specific basis.

• The need for plant modifications at some multiunit sites to account for the potential effects of SFP boiling conditions on safe shutdown equipment for the operating unit, particularly during full core off-loads, should be evaluated on a plant specific basis.

l

• Efforts by utilities to reduce outage duration have resulted in full core offloads occurring earlier in outages. This increased fuel pool heat load reduces the time available to recover from a loss of SFP cooling event early in the outage.

• The need for improved procedures and training for control room operators to respond to SFP loss of inventory and SFP loss of cooling events consistent with the time frames over which events can proceed, recognizing the heat load and the possibility of loss of inventory, should be evaluated on a plant specific basis.

• The need for improvements to instrumentation and power supplies to the SFP equipment to aid correct operstor response to SFP events should be evaluated on a plant specific basis. i l

I l

l l

l l

1 INTRODUCTION i

In recent years there have been several instances in which the adequacy of spent fuel pool (SFP) cooling systems has been brought into question. For example, two contractors at Susquehanna Steam Electric Station plant, submitted a Title 10 of the Code of Federal Regulations (10 CFR)

(Ref.1) Part 21 report (Ref. 2) on the adequacy of SFP cooling at Susquehanna.

The "Susquehanna" 10 CFR 21 report postulated loss of SFP cooling resulting in boiling of the SFP, .

failure of emergency core cooling system (ECCS) and other equipment due to steam releases and  ;

condensation of SFP vapors, reactor core heatup and damage, spent fuel heatup and damage, and ,

large offsite radioactivity releases.

The AEOD study:

Developed generic configurations delineating SFP equipment for a boiling-water reactor (BWR) and a pressurized-water reactor (PWR) and utilized these generic configurations to assess the loss of SFP cooling and inventory.

l Reviewed and assessed 12 years of operational experience for both domestic reactors and foreign reactors with designs similar to that of the US.

Performed six site visits to gather information on SFP physical configuration, practices, and procedures; and conducted interviews with the authors of the 10 CFR 21 report to better understand their concerns.

• Reviewed applicable SFP regulations and the NRC Standard Review Plan (SRP) for the acceptance criteria and applicable Regulatory Guides.

• Performed independent assessments of electrical systems, instrumentation, heat loads, and radiation to better understand the role of these issues to loss of SFP cooling.

• . Contracted with Idaho National Engineering Laboratory (INEL) to review existing risk analyses l and use risk assessment techniques to evaluate the risk of losing SFP cooling and coolant inventory.

I 2 SPENT FUEL COOLING 1

A survey of SFPs indicates that a wide variety of configurations exists. Since most plants were built l l prior to issuance of specific NRC regulatory guidance, diverse designs would be expected. For i l purposes of this study, loss of spent fuel cooling is considered to include subcategories of loss of SFP coolant inventory and loss of SFP cooling; this convention will be used throughout. Potential problems with SFP coolant inventory and SFP cooling which can lead to loss of spent fuel cooling are discussed. The potential consequences of loss of spent fuel cooling are considered. Once the problems have been identified, possible approaches to prevention and response to loss of spent fuel cooling situations are described.

i Figure 2.1 shows a " generic" PWR SFP and Figure 2.2 shows a " generic" BWR SFP.

I l

l

~ '

l

',,"O' c-- ,.

e,m mm Cavny was

@ Gata(.)

g .2 -fa,  %

_ l_ _ _ ? _ _ e r4

• s

's

_. o.. =

e- - O ua n , h

_ ","~

_ c,qsv ' ' ,' _^g C V l

m_m; m/ i,' /n) /

a.e; i , i ,' / /w/ / ,'/ //.'

=-/

c~'

% ===

Figure 2.1 PWR Spent Fuel Cooling Systems l

LaLa- From RHR

, " " ' sym m g Ar*

~ "

/e-.cyci A o . . , .

summn -

(-% .e ge c7 s.

strainer FuelPool Re,tuelvg se tw Fuel Racks

-- r 7 (Link %%iV// j j

-e Punscaton f

HX Q f vo m

+ S  :

U H HX f Q ,,

X Figure 2.2 BWR Spent Fuel Cooling Systems 1

-h-

! The following discussion considers potential I

scenarios which can lead to loss of spent fuel cooling due to (1) loss of SFP coolant inventory W ,

sufficient to interrupt heat transfer to the cooling system or result in uncovery of the fuel and agar -

8 = d, ,

(2) failure of the SFP cooling system pumps and j heat exchangers to transfer heat from the pool to the  !

ultimate heat sink. Figure 2.3 is a schematic classification of the types of events which could sin.m um

" g 1 lead to loss of spent fuel cooling.

- um ee  ;

• • • "'"*" ****e 2.1 Loss of Spent Fuel Pool Coolant Inventory The primary pathways for loss of SFP coolant inventory can be broadly categorized as (1) loss ****  !

through connected systems, (2) leakage through movable gates or seals, and (3) leakage through or Figure 2.3 Loss of Spent Fuel Cooling I

failure of the fuel pool or the fuel pool liner.

2.1.1 Connected Systems Piping connected to the SFP may include the SFP cooling and purification system, the spent fuel I shipping cask pool and fuel transfer canal drains, and, when in communication with the reactor durmg  ;

refueling operations, reactor piping systems such as the residual heat removal (RHR) system and the ,

chemical and volume control system.

Losses through connected systems could include both pipe breaks or leaks and configuration control problems. Piping systems which extend down into the SFP have the potential to siphon For most designs, the loss of SFP coolant inventory via the SFP cooling system piping, whether initiated due to a pipe break or configuration control problem, would be limited due to antisiphon devices. However, siphoning can occur if the antisiphon devices are incorrectly designed, are plugged, or otherwise fail.

A recent survey of all power reactors conducted by the Office of Nuclear Reactor Regulation (NRR)

(Ref. 3) determined that some sites do not have antisiphon devices in potential siphon paths.

During refueling operations, when a flow path exists to the reactor vessel, inventory loss through the RHR, chemical and volume control system, or reactor cavity drains would not be limited by the antisiphon devices; the same applies when the SFP is open to the spent fuel shipping cask pool drains.

For these situations, for many designs, the extent of the inventory loss is limited by internal weirs or drain path elevations which maintain level above the top of the stored fuel in the SFP.

2.1.2 Gates and Seals A second classification of inventory loss is through movable gates or seals and, during refueling operations, the reactor cavity seal. As shown in Figures 2.1 and 2.2, both PWRs and BWRs have seals which keep water above the vessel in the refueling cavity during refueling. For BWRs, there l are usually two seals required to keep refueling water above the reactor vessel; in Figure 2.2 these l seals are referred to as the refueling seal and the cavity seal. Some plants use inflatable bladders to

)

l l

form a seal between the reactor vessel flange and the containment building (PWRs) or the drywell, )

and the reactor building (BWRs). In some BWRs, these cavity seals are permanent spring steel bellows which are expected to have little susceptibility to large leaks. There are several other types of seals used which do not rely on inflatable bladders. These include bolted cavity seal rings which use gaskets to seal between mating surfaces and permanent seals which are welded in place. These types of seals are not prone to rapidly developing large leaks.

The refueling cavity seal and movable gate seals at some plants are inflatable seals of many different designs. Depending on physical relationship of adjacent structures, catastrophic failure of an inflatable seal could result in rapid loss of inventory. However, the geometry of the relationship between the SFP, adjacent cavities, reactor vessel, and connecting structures must be considered in evaluating the vulnerability to loss of SFP coolant inventory due to inflatable seals. Many seal failures will result in only limited level loss because of the various physical configurations.

In BWRs, the bottom of the movable gate separating the reactor cavity from the SFP is generally above the top of the stored fuel so that for a loss of the cavity seal the level in the SFP will remain above the top of the fuel. Although the fuel would not immediately uncover, SFP cooling would be lost due to SFP pumps tripping on loss of suction; and the remaining SFP coolant inventory would  ;

heat up to near boiling within a few hours. Also, becaase of reduced water level above the fuel, high radiation fields would inhibit access to the refueling floor. Plants which have gate bottoms or internal weirs which limit the draindown from cavity seal or gate seal failures to a level that would continue to provide sufficient radiation shielding to not hinder operator actions would be more likely to be able to mitigate these events. When not in refueling, most BWRs have two gates in series at major openings.

Where PWRs do not have interposing structures between the fuel transfer tube and the SFP or where the gates between the SFP fuel transfer canal are left open, a vulnerability to loss of SFP coolant inventory through the fuel transfer tube is increased. The NRR survey assessment found that only five SFPs have fuel transfer tubes which are lower than the top of the stored fuel without interposing structures.

2.1.3 Pool Structure or Liner Tinally, inventory loss could occur directly due to SFP liner leakage or gross failure of the SFP structure. The impacts of drop of a heavy load or a seismic event are potential cat..u vi gius failure. SFPs are designed to survive seismic events. Radiological and structural response and makeup capability for drops of light loads (those weighing no more than a fuel assembly) are bounded  ;

by analyses of a fuel handling accident. On the other hand, drops of heavy loads have the potential to l exceed the design basis of the fuel pool structure and the make-up system. Thus, heavy load control l programs have been instituted to evaluate potential heavy load drops or implement special controls on l the design and operation of heavy load handling equipment. ]

2.1.4 Consequences of Loss of Spent Fuel Pool Coolant Inventory For a large loss of SFP inventory, the primary consequence is potential uncovery of the stored fuel.

Given the unlikely occurrence of a large leak at the bottom of the SFP structure, beyond the available l make-up capacity, the fuel could uncover and heat up to the point of clad damage and release of r

1 I

i fission products. The uncovery of the fuel would also result in extremely high radiation fields around the SFP area.

A more likely sequence would be a loss of inventory through a gate or seal which would terminate when the level reached the elevation of the leak. Then, due to the decreased inventory of water in the SFP and the loss of suction to the SFP cooling system, the remaining water in the pool would boil j j away until the fuel was uncovered. Unless corrective actions were taken, the final consequences l would be similar to loss of SFP coolant inventory described above.

Loss of SFP coolant inventory events for which corrective actions are taken prior to the severe consequences described above have the potential for other problems. Even a minor loss of SFP coolant inventory can lead to loss of SFP cooling because the lower SFP level causes loss of suction to the SFP cooling system. Losses of SFP coolant inventory may produce flooding or environmental problems in other areas of the plant. Ventilation and drain systems can transpon water and steam to l other parts of the plant and impact emergency equipment. A significant amount of water vapor may l be generated either by direct boiling or evaporation from the SFP. Various SFP equipment and ventilation configurations may allow the water vapor to accumulate dn and cause SFP cooling equipment to fail, further exacerbating the loss of inventory.

, Where the SFP area atmospheric water vapor can be transported to areas which house other

( equipment important to safety, that equipment may be affected. This potential problem is important i

in some multiunit sites during and immediately following full core off-loads, where the fuel pool j atmospheric water vapor from the unit refueling can be transported to areas housing safety equipment for the unit operating at or near full power. In this situation, this transport could cause equipment l required for a safe shutdown of the operating unit to be damaged or to fail. This issue is discussed in l Section 5.2 Most plants have sufficient flood protection, ventilation, and equipment separation so l that this scenario is not a problem. However, according to the NRR survey assessment, eight multiunit sites may be susceptible to this scenario.

l 2.2 Loss of Spent Fuel Pool Cooling l

Figure 2.3 also represents potential causes of loss of cooling to the SFP. Cooling can be lost by loss of SFP cooling flow or due to an ineffective SFP heat sink. Losses of SFP cooling system flow can occur due to several mechanisms including: loss of electrical power to the SFP cooling pumps, pump failure, loss of suction due to loss of level, flow blockage or diversion in the SFP cooling system.

Losses of heat sink can occur due to operation with less than the required SFP cooling system complement or with heat loads in the SFP in excess of the SFP cooling system design capability.

2.2.1 Loss of Spent Fuel Pool Cooling System Flow All SFP cooling pumps are electrically powered. Loss of electrical power to these pumps results in loss of SFP cooling system flow. Loss of electrical power can occur due to losses of offsite power or human error in electrical alignments. Most SFP cooling system pumps have the capability to be loaded on available on site power sources. The NRR survey assessment found that four SFPs did not have the capability to be cooled by systems which could be powered by on site power sources.

-h-

The likelihood of an extended loss of SFP cooling due to loss of electrical power to the pumps is fairly low due to the combination of available on site power, the existence of workable procedures for power restoration, the general knowledge of the plant operations staff of the need to restore power and the time available to restore power.

For other than loss of electrical power, failure of both SFP cooling pumps is unlikely. Except for situations where a full core has been transferred to the SFP relatively soon after plant shutdown, a single SFP cooling pump generally provides sufficient cooling.

Losses of SFP coolant can result in losses of cooling flow when the level drops below the suction intake of the SFP cooling pumps. Thus, such losses of inventory will be accompanied by a loss of SFP cooling.

Flow can also be lost due to blockage or diversion. For example, foreign material could clog a filter or strainer in the SFP cooling system. If flow blockage were to occur during a full core off-load, implementation of a backup cooling process might be required to prevent adverse conditions from developing in the SFP.

2.2.2 Ineffective Spent Fuel Pool Heat Sink SFP cooling system heat exchangers are usually cooled by the component cooling water system or the service water system. An ineffective SFP heat sink can occur due to: misalignment of cooling water sources, failure of the cooling water source, heat exchanger fouling, and insufficient heat exchanger capacity, among others.

Current practice of full core off-loads a short time after shutdown has greatly increased the heat load in the SFP. Any degradation in the heat removal of the cooling system at these times could result in heat up of the SFP. Errors in the calculated heat load or assumption of nonconservative ultimate heat sink temperatures could mislead operators.

2.2.3 Consequences of Loss of SFP Cooling An extended loss of SFP cooling would result in heat up and boil off of SFP coolant inventory and eventual uncovery of the stored fuel in the unlikely event that no corrective actions were taken. This would result in high levels of raatation in the SFP area and deny personnel access. Clad failure and radiation release could be the final outcome. However, losses of cooling pose less hazard than loss of inventory because loss of cooling does not pose the immediate threat of fuel uncovery. No fuel damage is likely until the fuel is uncovered.

During an extended loss of SFP cooling, water vapor may be generated either by direct boiling or l evaporation from the SFP. Various SFP equipment and ventilation configurations may allow the l

water vapor to condense and accumulate in locations which could affect other equipment. All the potential impacts that apply to the situation described above for loss of SFP coolant inventory leading to generation of steam and water vapor which is transported to other parts of the plant applies to the extended loss of SFP cooling.

-f-

2.3 Preventing and Responding to Spent Fuel Pool Events There are no systems available for automatic response to a loss of SFP coolant inventory or loss of SFP cooling. Consequently, operator actions form the basis for preventing and responding to a loss i l of spent fuel cooling.

Preventing a loss of SFP coolant inventory due to gate seal failures or cavity seal failures relies on correct installation and testing of the seals, and testing and control of the air supply for the inflatable seals. Better seal performance could be achieved by seal replacement at intervals consistent with manufacturers recommendations or when inspection of seals shows evidence of aging, cracking, or tearing.

l l The response to loss of inventory events depends, first of all, on timely discovery of the event by the j operator. The rate of loss of SFP coolant inventory can vary greatly depending on the cause; for

! example, water level drop from a reactor cavity seal failure can be quite rapid. The reduction in level during these events is usually discovered either by direct observation by operations staff in the spent fuel area or due to alarm actuation in the control room. Reliable and accurate instruments and annunciators can alert the operator to a SFP event. If the operators are aware of a SFP event in a timely manner, the large volume of water in the SFP will usually allow sufficient opportunity for operator response to diagnose and correct the problem.

l )

Response to loss of SFP cooling requires effective instrumentation, procedures and training. Most operating situations would allow a relatively long time to respond to such an event. However, following a full core off-load, the SFP could heat up to near boiling in a few hours. Operators would attempt to restore cooling either by correcting any problems with the SFP cooling system, or by initiating operation of backup cooling systems, if available.

As with prevention and response to SFP coolant inventory events, prevention and response to loss of SFP cooling is also largely dependent on configuration control and human performance. The primary l concern is to maintain electrical power to the equipment involved in SFP cooling.

3 OPERATING EXPERIENCE Operating experience with SFP loss of coolant inventory and loss of cooling was reviewed. The primary source of information was licensee event reports (LERs) from 1984 through early 1996, screened from the Sequence Coding and Search System. In some cases, events before 1984 were included due to sparse data for some types of events. Additional information sources included event notifications made in accordance with 10 CFR 50.72, NRC Inspection Reports, NRC regional l morning reports, NRC preliminary notifications, and industry communications. More than 700 separate sources of information were reviewed. This screening process resulted in about 260 events related to SFPs. Table 3.1 is a summary of these SFP events listing the number of events of each type under the two main categories (loss of SFP coolant inventory and loss of SFP cooling). That i table indicates that numerous precursor events were found during the study. These precursor conditions represent potential losses of SFP coolant inventory or loss of SFP cooling given the l condition which did occur plus other postulated failures. I 1

The operating events obtained in this study provide Table 3.1 Spent Fuel Pool Events l

a reasonable representation of experience with SFPs. However, during discussions with operations staff, a number of additional events were discovered Type of Event Actual Precursor which provide insights into problems with SFPs. SFP Inventory l 18 55 While these events have been meluded in this study, -

they were not initially captured by the study's event Connected Systems 20 12 review process, primarily because some relevant Gates and Seals 10 8 events are below the reporting threshold required by Structure or Liner 8 35 NRC regulations.

SFP Cooling 56 22 3.1 Loss of Spent Fuel Pool Coolant Inventory - -

1 l

i Flow 50 20 About 38 events involved actual loss of SFP coolant or refueling water. There were about 55 precursor events. Table 3.2 provides some details about loss of SFP coolant inventory events. Figures 3.1 and 3.2 provide an overview of the SFP loss of coolant inventory events for which level drops and duration times could be quantified. These figures show that SFP losses of coolant inventory have been infrequent. However, several events have lasted more than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and about 10 events have resulted in level decreases of more than I foot before the event was terminated. The low number of events found with smaller level changes may be due to a lack of reporting of such events. -

Using the number of events found during this study Table 3.2 Loss of Coolant Inventory Events over a period of about 12 years for which level drops could be quantified, the frequency of loss of Type of Event Actual Precursor inventory events m which loss of more than I foot occurred can be estimated to be on the order of less Connected Systems 20 12 than 1 per 100 reactor years.

Configuration Control 16 2 3.1.1 Connected Systems Siphoning 3 1 PWR Transfer Tube 1 1 The majority of losses of SFP coolant inventory Piping 0 1 through connected systems was due to configuration Piping Seismic Design 0 7 control problems. These connected systems I Gates and Seals 1Q R include: the SFP cooling and purification system, a spent fuel shipping cask pool, sources of make-up, Cavity Seals 0 6 the fuel transfer tube (s) (in PWRs), the fuel transfer l Gate Seals 10 2 canal (in BWRs), and, during refueling, the reactor. l Pool Structure or Liner ,1 21 Configuration Control Liner leaks 7 1 Sixteen loss of SFP coolant inventory events were Load Drops 1 32 due to configuration control errors. These events Pool Seismic Design 0 2 j are about equally distributed between BWRs and  ;

PWRs. Two recent configuration control events are l described here.

- 10 '

\ : .

l NUMBER OF OCCURRENCES NUMBER OF OCCURRENCES Br - - - -

10 7 7i - - - - - - -

I f i e V . ... . . . ..... .. .. . .. .

jl 5 -

---

-- - -- - -- - l l+

6 -- -- - ---- -- - J 4 -- -- - - -- -- -

3 - - -- --

-- - d- - - - - - -- - --

2 i

- -- 1 i .

2 i i j

2i ,  ! 2 2 2 1

l 2l ~

, . p,

, m .

. . s O'

<1

~

1 TO 4 4 TO 8 8 TO 24 > 24 o'f

<3 3 TO 12 12 To so'

> 60

-) l l

DURATION (HRS) LEVEL DECREASE (INCHES) i Figure 3.1 Loss ofInventory Duration Figure 3.2 Loss of Inventory Levels At Cooper Station on October 31,1995, about 10,000 gallons of refueling water were inadvertently i lost from the refueling cavity and transferred to the plant's low level waste system (Ref. 4).

At the time, the full core had been placed in the SFP, the reactor refueling cavity was filled with refueling water, and the refueling gates were open. A cable from a remote video camera came in l contact with and caused a submerged valve to open. The valve was part of the main steam line plug. .

This allowed refueling water to flow to the main steam line drains. About 30 minutes after the valve I was opened, the SFP surge tank low level alarm alerted the operations staff to an ongoing loss of water. While the operations staff started to add water, the make-up was not sufficient to avoid  ;

tripping both SFP cooling pumps on low suction pressure. One SFP cooling pump was restarted in l about 3 minutes with no observed increase in SFP temperature. About 40 minutes later, the source of the inventory loss was identified and the valve was closed. This event resulted in reduction of about 1 inch in the refueling cavity and SFP. There was still more that 23 feet of water above fuel in the ,

SFP. This was a fairly slow drainage rate. l l

l At Millstone Unit 2 on July 6,1992, about 10,000 gallons of SFP water was drained to the reactor l

coolant system (RCS). At the time of the event, the unit had been shut down about 37 days and the full core had been placed in the SFP. A loss of normal power resulted in loss of SFP cooling.

During the response to the event, the operations staff decided to align the shutdown cooling system to provide cooling to the SFP. However, during the alignment process, a flow path was created wmen permitted flow via a gravity drain from the SFP to the RCS. SFP level dropped about 14 inches.

Based on available reported information, there was at least 23 feet of water above the fuel because no Technical Specification violation was reported. A 4 *F temperature rise occurred before SFP cooling was restored (Ref. 5).

Siphoning Although reported operating experience with siphons (both actual events and precursor conditions) is very sparse (three actual events), losses of SFP coolant inventory have occurred because of siphoning problems. One event at River Bend on September 20,1987, (Ref. 6) involved plugging of a single (nonredundant) vertical vent pipe acting as an antisiphon device. In this event, the SFP coolant loss due to siphoning was masked by the SFP low level annunciator being in the alarm condition due

- // -

I to other ongoing plant work. The event lasted about one-half hour. This event was terminated when a radiation alarm occurred coincident with a high level in the tank receiving the SFP water. This event resulted in loss of SFP level of between 5 and 10 feet, one of the largest level decreases found ,

in the study. Further, it is not clear how far the level would have fallen had no operator action occurred.

l In another event at San Onofre Unit 2 on June 22,1988, (Ref. 7) about 9000 gallons of SFP coolant drained from the SFP to the reactor cavity through the SFP purification system due to lack of siphon protection in that system. This event lasted about 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The licensee stated that this l condition would be corrected by providing siphon protection. The licensee determined that the i

minimum amount of water above top of active fuel in the SFP would be about 13 feet if the operations staff failed to respond to two alarms.

Another event at Davis Besse on February 1,1982, (Ref. 8) involved a temporary pump used i

to fill the SFP which created a siphon path when the pump was secured. In this event, about 21 feet 9 inches remained above the fuel.

One precursor event was reported in which antisiphon holes in the two SFP cooling return lines were not present even though 0.5-inch holes were previously thought to exist. Also, further investigation l indicated that the 0.5-inch holes would not have been adequate to stop a siphon given postulated i failures.

Pressurized-Water Reactor Transfer Tube Only one actual event was found in which the transfer tube actually leaked while closed. In this event, the SFP end of the transfer tube was open and the flange on the containment end of the transfer tube leaked. AEOD was informed during some site visits that minor leakage through transfer tubes has occurred.

One site (Oconee Units 1 and 2) has a fuel transfer tube which has piping penetrations at a level 6 feet below the top of the spent fuel in the SFP. This penetration is used during operation of the Oconee Standby Shutdown Facility. This facility has a mission time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Water is taken j from the SFP through the transfer tube via the penetration and injected into the reactor coolant pump i seals for cooling. In this design, continued use of SFP coolant inventory for reactor coolant pump seals could have caused radiation uoses in the SFP to reach high levels such that make-up to the SFP would be impossible. This problem has been corrected by adding remote make-up capability to the i SFPs.

Piping and Piping Seismic Design No actual events were found where SFP system piping actually leaked, causing a loss of SFP coolant inventory. However, there have been a variety of seismic piping design problems reported. The most prevalent type of problem involves use of the nonseismic SFP purification system for purification of the large sources of refueling water in both BWRs and in PWRs. Failure of the nonseismic SFP purification system while connected to the refueling water source could cause loss of this source as make-up to the SFP as well as compromise these sources as ECCS sources. In addition, other minor piping seismic design problems were discovered and reported.

i I

- /

i .

3.1.2 Gates and Seals Large losses of SFP coolant inventory have occurred through SFP gate seals. Also, there is a potential for large losses of SFP coolant inventory through reactor cavity seals.

Refuding Cavity Seals There have been at least two rapidly developing leaks due to inflatable reactor cavity seals. In both these cases, the SFP was isolated from the reactor cavity by the closed fuel transfer tube prior to the event. At Haddam Neck on August 21,1984, the seal failed and about 200,000 gallons of water were drained to the containment building in about 20 minutes. At Surry Unit 1 on May 17,1988, l with all the fuel in the SFP, the seal failed and about 25,800 gallons were drained to the containment in about one-half hour. In the case of Surry, the instrument air supply to the containment was

, isolated and a backup nitrogen supply was used to reinflate the seal. Problems resulted in the inflatable seal deflating enough to cause leakage. While in both these cases, the SFP was not connected to the reactor cavity, these events and an additional four events discussed below are precursors which indicate the possibility of failure of the cavity seals and consequent loss of inventory. Review of individual plant specific geometry is required to evaluate each plant's vulnerability to this type event.

This study found four additic .:.1 events in which cavity seals failed tests prior to flooding the refueling cavity or where leaks developed in the seals following refueling. These events indicate that testing of inflatable seals is important in ensuring their operability. The events further emphasize the l- need to be aware of potential failures. Most of these events involved design problems. Only one was l due to failure to maintain an adequate air supply to the inflatable seal. One event involved a gasket I type (noninflatable) seal which leaked during the draining operation following the refueling.

L Gates The second most prevalent type of loss of SFP coolant inventory (10 events) was leaking fuel pool gates. The majority of these leaks were due to failure to maintain the air supply to the gate seals. 'In '

l one case, there was a failure to completely inflate the seal. The majority of the air supply events was due to human error. Three of these events involved failed or disconnected level instrumentation.

l Most of these events occurred at PWRs. Leaks were generally large, involving tens of thousands of gallons of water, and 2 or more feet of SFP level decrease. Level drop rates ranged from fractions of a foot per hour up to several feet per hour. These rates seem a reasonable pace to deal with and, in fact, in these events, the operations staffs responded and restored level effectively.

l One event, at Hatch on December 2,1986, resulted in the fuel pool level dropping about 5.5 feet ,

(Ref. 9). This event resulted from isolating the single air supply to the transfer canal's six i gate seals. The seals panially deflated. This deflation resulted in a path for SFP water to go to the gap between the two unit reactor buildings and into areas of both units' reactor buildings. When the source of the leak was discovered, the air source was restored and the leak was stopped. However, the event lasted about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. During this time, the SFP level was noted to be low and make-up was performed several times without attempts to determine the cause. The leak detection alarm was miscalibrated and a drain valve was left open which defeated or impaired the ability to detect a leak from the transfer canal gates. Subsequent corrective action included alternate supplies for alternate

)

- /S -

l i

gate seals such that inner seals were supplied from one unit and outer seals were supplied from the other unit so that a degree of redundancy was established.

l 3.1.3 Pool Structure or Liner No events involving major SFP leakage have been reported. However, some events involved small leaks or potential leaks.

Liner There were seven events involving leaking from the fuel pool liner. These events generally involved relatively small leak rates (less than about 50 gallons per day). One event, involving small tears in a PWR refueling cavity seal, was also reported. The events appear evenly spread out over the review period. Thus, operating experience suggests that occurrence of SFP liner leakage is relatively low.

However, Salem reported (Ref.10) a PWR design problem in which the SFP liner could buckle and leak at temperatures above 180 *F. This site is one of the sites which apparently does not have liner drainage isolation capability. Subsequent licensee analysis determined that the liner would not fail. The NRC is currently evaluating the licensee's analysis.

Load Drops  !

I Only one event was found during the operating experience review in which the fuel pool imer was )

punctured by dropping a load into the SFP. This event at Hatch Unit 1 on December 28,1994, involved a core shroud bolt which was dropped. An approximate 0.7 gallons per minute leak resulted which was contained between the fuel pool liner and the concrete structure. The fuel pool level was restored and maintained with normal make-up (Ref.11). l There were no other examples of loads actually being dropped and damaging the SFP. However, there were many situations (more than 30) involving loads heavier than allowable being moved or potentially moved over the SFP. Less than about 20 percent of these events involved actual downward motion or drops of objects (usually fuel assemblies) into the SFP. Although not judged safety significant by themselves, these events represent continuing precursors to potential SFP puncture events. They indicate that movement of loads heavier than allowed over the SFP is continuing even though the NRC has taken steps to reduce the problem.

Pool Seismic Design Only two conditions were found related to seismic design problems with SFPs. One condition was related to block walls in the fuel handling building which could collapse during a seismic event. The walls were replaced. The other condition involved only the fuel racks.

3.1.4 Spent Fuel Pool Make-up Capability Only two events found during the operating experience review involved potential loss of SFP inventory make-up capability. No actual losses of make-up capability were found. One event involved a small accumulation of marine life in the service water pipe used for make-up to the SFP.

Had the accumulation of clams gone undetected, it may have blocked the pipe. Another Seismic l

1 I

Class I source was available. One event involved a 2 minute loss of an electrical bus needed to supply make-up water to the SFP. Operating experience indicates that losses of all make-up capability are not very likely.

3.1.5 Impact on Safety Equipment There were several reported events involving flooding due to SFP overflow. These events had the ,

potential to affect equipment in other portions of the plant. In some of the events, actual flooding took place when the SFP overflowed into the ventilation system or the reactor building. None of these flooding events was seri3us. They were all caused by human error. There were two reports of conditions in which problems within the SFP could potentially lead to failure of important safety i

equipment. One report of a poter.tial effect on safety equipment due to boiling of the SFP was submitted by Susquehanna on Nr vember 17,1992 (Ref.12). It describes a condition in which a loss of SFP cooling is postulated to occur subsequent to a design basis accident such as a loss-of-coolant accident (LOCA) or a loss-of-offsite power (LOOP). The design basis accident is postulated to prevent makeup to the SFP. Subsequent boiling of the SFP is postulated to create an environment which could be transported to safety-related equipment in'the reactor building. The LER stated that the postulated events were beyond the plant's design basis. These conditions were postulated in the "Susquehanna" 10 CFR 21 report and were addressed in a June 1995 letter from the NRC to Pennsylvania Power and Light Company (Ref.13).

The second report was an LER from WNP 2, issued May 28,1993 (Ref.14), which describes a circumstance where, under operating conditions at the time of discovery (local manual service water valve closed), a postulated LOCA would render emergency SFP make-up capability inoperable. Subsequent evaporation of SFP inventory and tripping of SFP cooling pumps were postulated to result in SFP boiling. The evaporated and boiled water is postulated to condense and flood the ECCS pump rooms, causing failure of ECCS equipment needed to mitigate the ongoing LOCA. The LOCA is postulated to make the local manual SFP make-up valve inaccessible. In this postulated scenario, the normal nonsafety make-up source is also assumed to be unavailable.

Subsequent licensee investigation indicated Table 3.3 Loss of Cooling Events that the local manual valves in the service water lines for make-up to the SFP could be Type of Event Actual Precursor opened when required after LOCA.

3.2 Spent Fuel Pool Cooling SFP Pumps 39 8 Fifty-six events found during the operating Configuration Control 1 0 experience review involved actual losses of Loss of Pump Suction 4 0 SFP cooling. There were 22 precursor Flow Blockage 1 0 events which when coupled with additional Single SFP Pump Failure 5 12 failures or postulated events could result in losses of SFP cooling. Table 3.3 provides a ficat Sink 6 2 summary of the numbers and types ofloss of SFP cooling events. Figures 3.3 and 3.4 provide an overview of the loss of SFP cooling events for which temperature increase and duration could be quantified. These figures indicate that the losses of SFP cooling are infrequent. liowever,

-/P

I some events have lasted for significant time periods and four events have resulted in temperature l increases of more that 20 *F. The low number of events found with small temperature increases may l be due to a lack of reporting of such events.

l NUMBER OF OCCURRENCES NUMBER OF OCCURRENCES 25[ 22 20 '- '

20

---

- - - --- gNS 15 --- -- - - -

1@ 30 HRS  ;

l 15[ --- --- ----- - 1@ 24 HRS - i j ,

! 10F - - - - - -

q 10I l 6 5 5 \ -- ----- - - -

Slj g - -4 5l 3 l j  ; 1

~

0 <

O' ~

<1 1-4 4-8 8 - 24 > 24 0 O TO 20 20 TO 40 40 TO 60 DURATION (HRS) TEMPERATURE INCREASE (DEG F) .

i Figure 3.3 Loss of Cooling Duration Figure 3.4 Loss of Cooling Temperatures

]

l Using the number of events found during this study over a period of about 12 years for which l temperature and duration could be quantified, the frequency of loss of SFP cooling events in which a j temperature increase of more than 20 *F occurred can be estimated to be on the order of about 2 to 3 per 1000 reactor years.

3.2.1 Loss of Spent Fuel Pool Cooling The dominant cause of the actual loss of SFP cooling events was loss of electrical power to the SFP cooling pumps. Thirty-nine of the loss of cooling events were due to loss of power to the SFP cooling pumps. For these losses of electrical power, the time for which cooling was not available ranged from a few minutes with no accompanying temperature increase to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> with an associated temperature rise of 20 *F. Most plants have alternate sources of SFP cooling pump power available.

No attempt was made during the event review to determine if alternate power was available in each I event. The primary causes appear to be human error and administra*.ive problems (22 of the 39 l events). The events appear eveniy uistributed between BWRs and PWRs. l I

There were five events involving failure of one SFP cooling pump while the second pump remained operable. During these events, the second SFP cooling pump was adequate to cool the SFP. Because these events did not result in an actual locs of SFP cooling, they are not counted in the overall total for this category. While events with the potential for common cause-common mode failure have been reported, none have occurred.

There were four events found in the study in which SFP cooling was lost due to loss of SFP coolant inventory and consequent tripping of the SFP cooling pumps on loss of suction. There was one flow l blockage event in which a rubber boot blocked a SFP cooling pump strainer. The time required to remove the blockage was about 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Engineered safety features actuations have resulted in losses

/h '

l of SFP cooling. Ilowever, these resulted in almost no temperature increase and generally lasted for only short periods. They did not appear to have presented a threat to long-term cooling.

No actual events involving insufficient cooling have occurred. However, several conditions were reported in which full core off-loads were performed with insufficient evaluation of the heat loads or SFP cooling system during the off-load. Errors in the calculated heat load and nonconservative ultimate heat sink temperature assumptions have also occurred. This issue surfaced due to a situation at Millstone Unit 1 (Ref.15). For Millstone Unit 1, licensee analysis determined that during prior refueling outages the SFP cooling system would not have been capable, by itself, of maintaining pool temperature below the 150 *F design limit under certain postulated conditions including a single active equipment failure.

3.2.2 Ineffective Heat Sink The second leading cause of loss of SFP cooling, although there were significantly fewer events, was loss of SFP heat exchanger cooling. Of the 6 events, almost all were caused by human error. These events lasted from some very short periods of time to about 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> with temperature increases ranging from zero to 40 *F.

3.3 Spent Fuel Pool Instrumentation Experience There have been several events involving losses of SFP coolant inventory or SFP cooling, where associated instrumentation was inoperable or failed prior to or during the events. In one event, a shared annunciator window was illuminated due to an instrumentation problem when the loss of inventory occurred. Since the window was already illuminated, the operations staff was not alerted to the loss of coolant inventory event when it began. While there have been relatively few of these instrumentation problems, they raise concerns about how SFP instrumentation is treated and regarded.

3.4 Effect of Shortening Refueling Outage Times Review of operating experience has shown that in an effort to minimize refueling outage times, many plants perform full core offloads early in their outages. The effect of such practices is to reduce the time available to recover from a loss of SFP cooling event. AEOD discussions with the engineering manager of Nine Nile Point Unit 2 provided good insight to the effect this practice has upon reducing the time available until boiling begins.

Figure 3.5 shows the history of full core offloading times at Nine Mile Point Unit 2. Figure 3.6 shows the ranges of calculated times available to initiate boiling at Nine Mile Point Unit 2. For operation with the SFP gates out, the licensee's conservative calculations estimated the time to initiate boiling reduced from 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br /> during the first refueling outage to 24.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the fourth refueling outage. For operation with the SFP gates installed, the licensee's conservative calculations estimated the time to initiate boiling reduced from 17.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 8.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Similarly, during a visit to the South Texas plant, AEOD learned that calculations performed for the most recent refueling outage estimated that the initiation of boiling could begin approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after SFP cooling is lost. A recent survey assessment performed by NRC's Office of Nuclear Reactor Regulation (NRR) indicated that, if a full core had to be offloaded during midcycle, boiling could begin about 2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after losing SFP cooling.

-/7 '

I 40 - - --

60 l35 si E GATESouT O carts =

l M- **

l, 25 24 20 30-h 2

~ ~

2

[

1 s 4 1 3 4 REFUEL OUTAGE NUMBER REFUEL OUTAGE NUMBER Figure 3.5 History of Full Core Offloading Figure 3.6 Reduced Time to Boil 3.5 Operating Experience Review Findings Losses of SFP or refueling water inventory are dominated by events involving system or SFP configuration control problems due to human error. The second tnost prevalent cause of loss of SFP  !

inventory is lea?ing inflatable gate seals generally due to loss of air to the seals because of human error. Losses of inventory from SFP gates due to leaking inflatable gate seals have generally been of greater magnitude than those due to configuration control problems. Loss of inventory due to configuration control problems is more easily controlled by the operations staff than leaks from gates.

However, configuration control problems seem to have taken longer to diagnose.

Pool leakage events do not appear to have caused problems with long-term losses of spent fuel cooling. Inadvertent movement of heavier than allowed loads over SFPs is continuing even though the NRC has taken steps to reduce this problem.

The most prevalent type of loss of cooling events involved loss of electrical power to the SFP cooling pumps, generally due to human error. The few losses of SFP cooling due to loss of SFP heat achanger cooling were also generally due to human error. Both types of events resulted in losses of about the same time frame and associated temperature rises. The events were evenly distributed between BWRs and PWRs.

While conditions have been reported suggesting the possibility of SFP boiling affecting other plant equipment important to safety, operating experience does not provide insights into what is apparently a very complex issue.

Operating experience provides only limited insight into instrumentation problems. Several loss of level events have taken place while level instrumentation was inoperable or level annunciators were already actuated for other reasons. There have been relatively few of these instrumentation problems captured by this study. They represent concerns about how SFP instrumentation is treated and regarded.

l

-I V

Some ventilation events (damper problems, heater problems) could be potential areas of concern when coupled with postulated SFP events which could lead to radiation release.

Foreign operating experience appears to be consistent with that from U.S. plants. Operating experience suggests that losses of make-up capability are not very likely.

4 OBSERVATIONS FROM THE SITE VISITS AND INTERVIEWS Six site visits were conducted to gain understanding of the licensees' SFP physical configurations, practices, and operating procedures. Site selection was a cross sampling of the industry that included BWRs and PWRs, large and small architect-engineer designs, shared and single pools, old and new J designs and all four nuclear steam supply system vendor designs. The sites visited were: North  !

Anna, South Texas Project, Susquehanna, Three Mile Island, River Bend, and Calvert Cliffs. In addition to the site visits, one trip was made to Pennsylvania Power and Light headquarters. The following observations are from the site visits and the interviews. These observations are a cross- i sampling and representative of the nuclear power industry.

In general, utilities are doing a good job of analyzing the SFP heat loads and heat up rates.

However, control room operators are not always being made aware of the analysis and results. This information could prove to be critical in worst case refueling outage conditions (e.g., full core off- j load and a very short outage schedule). Some of the utilities are performing risk analysis as part of the outage planning.

Some utilities have used lessons from operating experience and have done a very good job in  !

correcting problems through better analysis, good operator aids, training, and procedure revisions.

Some utilities have a good system to evaluate industry experience.

The site visits identified events where connected systems could have caused loss of SFP coolant inventory. Many events such as draindowns are not being reported through the standard mechanisms that would allow for the standard analysis of the events. Therefore, the actual frequency of draindowns is higher than is typically assigned in the risk analysis. The site visits also identified that little attention is paid to the antisiphon devices. Very few sites performed testing or had analysis on the efficacy of the antisiphon devices.

There is a large variation in utility practice regarding full core off-loads versus fuel shuffles. One plant visited that had been performing full core off-loads now plans to do fuel shuffles instead.

Another plant that had intended to do fuel shuffles now routinely does full core off-loads.

The newer designs have more of the better features such as safety-related power, analog control room meters, more parameter indicators in the control room, more sources of water, and generally better qualified equipment. However, some older plants have made improvements by adding indicators or annunciators in the control room, and supplying safety-related power to the SFP equipment. All of the sites visited are including the SFP system in the equipment covered by the Maintenance Rule.

All the plants visited had examples of good practices. Some of the good practices observed in our visits, but not all in one plant, include:

-/h  !

1

I

\

Using licensed reactor operators and training them for the refueling outages.

• Including SFP risk in the outage planning.

Having SFP system power restored in the top level emergency operating procedures.

• Forming a refueling team with formal structure.

Providing classroom and simulator training ia preparation for the outage.

Producing user friendly graphs of pool heat up rates from the analysis, for use in the control room.

Doing analysis beyond heat loads and heat rates, such as SFP risks in outage planning.

1

• Having strong command and control of SFP activities.

• Providing a second source of por/er for the SFP system.

Having a mimic on the control board for the SFP system lineup.

Utilizing a system diagram prior to making SFP system alignment changes.

• Having an effective program to learn from internal and industry operating experience.

Refining the SFP risk model used in the outage planning down to the component level.

1 1

Three good design modification examples were found:  !

l

• Adding additional SFP indication to the control room.

• Adding safety-related power to the SFP instrumentation.

• Providing a dedicated heating, ventilation, and air conditioning system for refueling.

The interviews with the authors of the Susquehanna 10 CFR part 21 report were very informative.

They provided the details of their concern that the as-found Susquehanna SFP configuration did not meet the licensing basis. The report that they filed does have potential generic implications, including:

mechanisms to transport vapor to and create high temperatures in other parts of the plant electrical and instrumentation weaknesses in SFPs potential for multiunit sites with shared pools to have an increased SFP risk a lack of awareness for SFP issues The 10 CFR 21 report provided an impetus for the NRC and the nuclear industry to take a closer look at SFPs, which historically have not received much attention. In the efforts to address the I

l l

l t

l 10 CFR 21 report concerns, Pennsylvania Power and Light has improved the Susquehanna SFP design, modified its operation, improved emergency procedures, and improved operator training. A l limited probabilistic risk assessment (PRA) found that the net effect of these actions at Susquehanna l was to diminish the risk from SFP events.

l \

5 RISK ASSESSMENT Over the years, the SFP has not received the risk assessment attention that the reactor had because early analysis put the risk of a SFP accident an order of magnitude below a reactor event. Therefore, the analyses done for the SFP were limited. Ifowever, in recent years several issues have required that certain aspects of the SFP be studied further. INEL was contracted to review the previous SFP risk assessments and to utilize the useful insights to assess the current risk of SFP accidents. In addition to those risk insights, INEL utilized the AEOD operating experience review, engineering analyses, site visits, and site interviews in assessing the likelihood of SFP events. ,

1 5.1 ' Risk Analysis for Spent Fuel Pool Cooling at Susquehanna Electric Power Station" l

In October 1994, Battelle Pacific Northwest Laboratoiy (PNL) prepared a draft report, " Risk Analysis for Spent Fuel Pool Cooling at Susquehanna Electric Power Station," (Ref.16) for NRC's Risk Applications Bmch of NRR. The report presented the results of PNL's analysis of loss of SFP cooling events at the Susquehanna nuclear power plant, including estimates of the likelihood for loss of SFP cooling, the near-boiling frequency (NBF), and order of magnitude estimates of core damage frequency (CDF) attributed to SFP heat-up events.

The PNL analyses addressed design basis accidents which would cause mechanistic failure of the nonsafety-related SFP cooling system. The accident scenario postulated in the Susquehanna 10 CFR 21 report, an RCS LOCA, would result in de-energizing SFP power and could also induce hydrodynamic loading of systems and equipment associated with SFP cooling. In addition to addressing RCS LOCA, NRR had PNL analyze other initiating events; earthquakes, LOOP, and flooding. The PNL analysis did not consider major SFP coolant inventory losses from configuration control, gates, and seals to be credible events.

The results of the analyses indicated that the risk from SFP events was low compared to reactor events which did not account for any risk contribution from the SFP. The PNL study showed that for the Susquehanna plant, the largest contributors to SFP risk emanated from extended LOOP and LOCA events. The analyses also showed that the improvements that were made at the Susquehanna station in response to the issues raised by the 10 CFR 21 report resulted in a NBF reduction of about a factar of four with a commensurate reduction of risk of about a factor of four.  !

The results of the PNL study were integrated into NRR's Safety Evaluation, "Susquehanna Steam Electric Station, Units I and 2, Safety Evaluation Regarding Spent Fuel Pool Cooling issues." The PNL analysis was used to augment the deterministic analysis of the Susquehanna plant. From their deterministic analysis NRR found that " systems used to cool the spent fuel storage pool are adequate l to prevent unacceptable challenges to safety-related systems needed to protect the health and safety of the public during design basis accidents." Based upon the PNL analysis NRR indicated that loss of l

SFP cooling events represented a low safety significance challenge to the plant [Susquehanna] at the l

time the issue (Part 21 report) was brought to the staff's attention."

Although there may be large uncertainties associated with the absolute values and specific numerical I results of the PNL analyses, much insight can be gained from the PNL analyses of the Susquehanna  !

station. For example, the PNL analysis shows that the most significant risk reduction could be  !

achieved from three strategies:

1 (1) installing SFP level and temperature instrumentation in the control room (2) enhancing SFP normal and off-normal procedures and training staff to be proficient (3) cross-ticing SFPs l

5.2 Risk Assessment AEOD obtained technical assistance in the area of risk assessment from INEL. INEL reviewed the l PNL Susquehanna PRA, assessed the adequacy of the risk analysis, and addressed the adequacy and )

reasonableness of the assumptions made. INEL extracted insights from the PNL Susquehanna PRA and the other relevant PRAs in industry to assist in generically assessing the likelihood of loss of SFP cooling. Information from the AEOD reviews of operating experience, interviews, site visits, and independent SFP analyses was used to refine the developed PRA model. This study provided quantitative estimates of the NBF and qualitative discussions about the risk of losses of SFP cooling.

The following sections provide the results and the insights obtained from these INEL efforts (Ref.17).

5.2.1 Risk Assessment - Quantitative Results INEL corrected modeling problems identified in the PNL study. The event and fault trees were refined to more accurately describe current Susquehanna plant operations. To refme the event trees, INEL staff visited PP&L engineering offices and the Susquehanna station. The event and fault trees were quantified using recent operating experience data supplied by AEOD. In performing the  !

analyses, INEL also refined and updated the data and models that PNL had used to account for human performance.

In some cases the modifications and improvements resulted in increases in the NBF in the SFP, which in turn would result in increased estimates of risk. Correcting the initiating event fr%,mm., for station blackout, LOCA, seismic events, configuration control errors, and seal failures would tend to increase the NBF. Counterbalancing this, the study identified possible sources of conservatism in the PNL study. Chief among them were the estimates of human performance associated with recovery and mitigation.

INEL performed the aforementioned refinements, including modifications of the initiating event frequencies using AEOD's operational event database, to cover a full spectrum of loss of SFP inventory events, including catastrophic seal failure. The results of their analysis are shown in Table 5.1. The analysis found the NBF for the Susquehanna plant after implementing the 10 CFR 21 improvements was SE-5/ year, which is approximately twice that found by PNL.

l

- c9 A -

I i

l The dominant event initiators were LOOP Table 5.1 Near-Boiling Frequencies and SFP inventory losses including configuration control errors and seal INEL PNL failures. Due to the limited time and resources available, INEL did not extend Total NBF 5 E-5 2 E-5 the analysis to include a quantitative estimate of the CDF. Also, given the LOOP 3 E-5 1 E-5 limited data available for development of I estimates of event frequencies and the inventory Losses 2 E-5 1 E-6 limited resources available for model development, more refinement is required I before these estimates can be used as a basis I for regulatory actions.

l 5.2.2 Risk Assessment - Qualitative Results The SFP PRAs which were done by PNL and INEL were specifically for the Susquehanna plant, j Many features of the design and operation of Susquehanna are unique, consequently the results of the PNL and INEL analyses cannot be applied directly to other plants. Nonetheless, there are certain qualitative insights that have been learned from those studies which may have generic applications.

For example:

(1) Effect of defueled unit upon operating unit The analyses showed that for a dual unit BWR, it is possible for a problem with SFP cooling at a shutdown unit to affect the adjacent operating unit. The accident scenario postulated in the Susquehanna 10 CFR 21 report was found to be a credible event, but less likely than other events.

(2) Uncertainties of core damage frequency estimates The task of estimating the NBF appears to be amenable to the use of PRA tecnniques. However the task of estimating CDF is subject to very large uncertainties. PNL and INEL both acknowledged that the methodology used for this task provided only " order of magnitude estimates."

(3) Effect of the Susquehanna 10 CFR 21 Report Comparison of the analyses that were done for the Susquehanna plant as it existed at the time of the 10 CFR 21 report and after corrective actions were taken revealed that the improvements that were made in the areas of instrumentation, accident response procedures, operator training, and shutdown operations reduced the estimated NBF.

Improvements in instrumentation consisted of providing reliable SFP level and temperature monitoring instruments in the control room.

l Improvements in operations and accident response procedures involved:

l l

l

-9S-l

f

• ventilation system isolation installation of drains in the standby gas treatment system

• utilization of the RHR system of the operating unit to cool the SFP

• verification that removal of cask storage pit gates results in effective heat transfer between the SFPs (4) Dominant accident sequences l

For the Susquehanna plant, the PNL analysis found that the accident sequences which were the largest contributors to NBF were extended LOOP, and LOCA. The extended LOOP is a dominant contributor because at the Susquehanna station the SFP cooling system pumps are not on the emergency busses. The original accident scenario raised in the 10 CFR 21 report did not appear to be a significant contributor to NBF. The INEL study found the dominant contributors to NBF were LOOP and SFP inventory loss.

(5) Deviation from the modeled plant design Risk estimates from the SFP for the Susquehanna plant may be affected by changes planned for future refueling outages, which may represent major deviations from the models used by PNL and INEL.

Some of those anticipated changes are:

• operation without the SFP cross-tied for the future dry cask storage operations

• reduction of refueling outage from 55 days to 35 days

• partial core off-loads taking place earlier in the outage (6) Operating experience INEL found that SFP inventory losses such as draindowns or pneumatic seal failures may be important contributors to NBF at the Susquehanna plant, in previous PRAs such events were either not modeled or their occurrence frequency was assumed to be very low; once every 10,000 reactor years.

6 FINDINGS AND CONCLUSIONS The findings and conclusions presented below are based on review of operating events and interpretations of the available risk analyses. The conclusions are stated, followed by indented paragraphs which are the findings on which those conclusions are based. These findings and conclusions are grouped under the headings of: (1) likelihood and consequences of SFP events, (2) prevention of SFP events, and (3) response to SFP events.

6.1 Likelihood and Consequences of Spent Fuel Pool Events 6.1.1 Review of more than 12 years of operating experience determined that loss of SFP coolant inventory greater than I foot has occurred at a rate of about 1 per 100 reactor years. Loss of SFP cooling with a temperature increase greater than 20 *F has occurred at a rate of approximately 3 per 1000 reactor years. The consequences of these actual events have not been severe. However, events

have resulted in loss of several feet of SFP coolant level and have gone on in excess of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The primary cause of these events has been human error.

There have been two loss of SFP coolant inventory events with SFP level decreases in excess of 5 feet. These events were terminated by operator action with approximately 20 feet of coolant remaining above the stored fuel. Without operator actions, the inventory loss could have continued until the SFP level had dropped to near the top of the stored fuel resulting in radiation fields which could have prevented access to the SFP area. The events with the largest level decrease involved unavailable or inaccurate instrument readings. Ten other loss ofinventory events resulted in level decreases between 1 and 5 feet. Operator response to one of the largest losses of SFP coolant inventory events (loss of 5.5 feet level in SFP) was deficient because several opportunities to diagnose and correct the problem were missed when make-up coolant was added to the system without evaluating the cause of the need for make-up. There were two precursor events involving cavity seals which involved rapidly developing leaks. In one case, about 200,000 gallons of water was lost in about 20 minutes.

In the second case, about 25,800 gallons were lost in about 30 minutes.

Several losses of SFP cooling have lasted in excess of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />; one had a maximum temperature increase of 50 *F to a final temperature of 140 *F. There were no reported approaches to boiling found during the experience review period.

While the operating experience review results are believed to be reasonably representative, discussions with operations staff revealed a number of additional events that did not reach the reporting threshold required by NRC regulations, and therefore were not initially captured by the study's event review process.

6.1.2 Review of existing SFP risk assessments found that after correction for several problems in the analyses, the relative risk due to loss of spent fuel cooling is low in comparison with the risk of events not involving SFP. The review determined that the likelihood and consequences of loss of SFP cooling events are highly dependent on human performance and individual plant design features.

• i The risk assessment identified loss of offsite power and loss of SFP coolant inventory as major contributors to near boiling frequency. LOOP was a major contributor largely because the analysis was based on the Susquehanna plant where the SFP cooling system is not connected to emergency power.

Human performance is the most important factor for both loss of spent fuel cooling event initiators and recovery actions. Problems with configuration control caused most of the SFP events. Lack of automatic functions for detection and recovery from SFP events places full reliance on operator actions. The results of risk assessments involving operator actions are sensitive to the level of administrative controls, instrumentation, procedures, and training

, provided to aid operator performance.

I l

• The impact of instrumentation, procedures, and training is dependent upon plant specific design features. The NRR survey of SFPs identified a wide range of plant design features and specific limitations at existing plants. Plants which have identified limitations relating to g{ -

i configuration control, instrumentation, procedures, and training could reduce the risk of SFP events by relatively modest improvements in these areas. Modest improvements to instrumentation and operations made by Susquehanna resulted in reduced risk.

6.1.3 The need for specific corrective actions should be evaluated for those plants where failures of reactor cavity seal or gate seals, or ineffective antisiphon devices could potentially cause loss of SFP coolant inventory sufficient to uncover the fuel or endanger makeup capability.

• Review of the SFP risk assessment identified Loss of SFP coolant inventory as a major contributor to near boiling frequency and review of operating experience and the site visits identified that problems with configuration control, seals, and antisiphon devices were contributors to large losses of inventory.

• The risk assessment identified that the near boiling frequency is sensitive to individual plant specific design features and human performance. Plant specific design features which impact the near boiling frequency include pneumatic reactor cavity seals and gate seals and SFP geometry which might result in draindown to near or below the top of the stored fuel.

6.2 Prevention of Spent Fuel Pool Events 6.2.1 The need for improvements to configuration controls related to the SFP to prevent and/or mitigate SFP loss of inventory events and loss of cooling events should be evaluated on a plant specific basis.

• Operating experience shows that the most frequent cause of loss of inventory and loss of cooling is ineffective configuration control. Mistaken valve alignments have diverted water from the SFP and have isolated the air supply to pneumatic seals. Mistaken electrical alignments have resulted in loss of power to SFP system pumps and other equipment.

6.2.2 The need for plant modifications at some multiunit sites to account for the potential effects of SFP boiling conditions on safe shutdown equipment for the operating unit, particularly during full core off-loads, should be evaluated on a plant specific basis.

I

• The Susquehanna 10 CFR 21 report brought to light the potential problem that, when two j units have a common pool, the refueling of one unit when SFP cooling is le: - ,J onpact the operating unit. A specific need is the assessment of the potential mechanisms to transport j vapor to create high temperature in other parts of the plant that have critical plant equipment. ;

The NRR survey assessment identified seven sites besides Susquehanna that have shared pools.

Since the scenario involves many things going wrong and each configuration is different, more assessment and evaluations need to be performed on these seven units.

6.3 Response to Spent Fuel Pool Events 6.3.1 The need for improved procedures and training for control room operators to respond to SFP loss of inventory and SFP loss of cooling events consistent with the time frames over which events can proceed, recognizing the heat load and the possibility of loss of inventory, should be evaluated on a plant specific basis.

0b? "

a .

i i

Refueling outages are getting shorter. Control room operators at some plants are not aware j that early transfer of the entire core from the reactor to the SFP during a refueling outage results in significant heat loads in the SFP and potential for near boiling conditions within 5 to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> if cooling to the SFP is lost. Current operator training and procedures do not )

typically include this information, or if the information is provided it is not easy to interpret. I All licensees have to some degree, work scheduling, training, and procedures that deal with ,

the SFP activities during a refueling outage and during normal plant operations. However, the {

effectiveness of these efforts was not apparent at all the plants visited. Of the licensees that I had: (1) a formal training structure consisting of classroom lectures for the workers involved in the refueling activities, (2) a schedule program that incorporated the SFP risks, and (3) detailed procedures for all the activities, there was knowledge and awareness on the part of the engineers and operators of relevant SFP issues. Regarding backup sources for SFP coolant inventory and SFP cooling, discussions with the licensees during the site visits revealed many ways that water could be provided to the pool which had not been formerly described and for

.which procedures did not exist.

6.3.2 The need for improvements to instrumentation and power sopplies to the SFP equipment to aid correct operator response to SFP events should be evaluated on a plant specific basis.

Instrumentation available to the operators regarding the SFP parameters can be very limited.

A single annunciator may be the only indication of SFP trouble. Some plants have SFP level j or temperature indication readouts on control room back panels. All indications of the SFP '

parameters could easily be lost in a reactor accident since not all of these instruments have safety-related power. Plant operators make rounds to the SFP location but the time between successive visits may be too long to adequately trend data and stop a developing problem before it becomes a serious event. The operating experience review found several events where SFP cooling was lost due to loss of power to the SFP pumps. Most power supplies to I the SFP pumps are safety related, but for the units that do not have this capability, an l assessment to provide power during accident conditions would assist them in reacting faster to I a SFP event.

l 7 REFERENCES l

1. U.S. Code of Federal Regulations, Title 10, " Energy," U.S. Government Printing Office, Washington, D.C., revised periodically.

2. Lochbaum, D.A., and Prevatte, D.C., Letter to Martin, T., U.S. Nuclear Regulatory Commission, "Susquehanna Steam Electric Station, Docket No. 50-387, License No. NPF-14, 10 CFR Part 21 Report of Substantial Safety Hazard," November 27,1992.

3. Taylor, J.M., U.S. Nuclear Regulatory Commission, Memorandum to the Commission,

" Resolution of Spent Fuel Pool Action Plan issues," July 26,19%.

4. U.S. Nuclear Regulatory Commission, Inspection Report 50-298/95-014, December 18, 1995.

-Mk

l 1

= \

5. Northeast Nuclear Energy Company, Millstone Unit 2. Licensee Event Report 50-336/92-012,

" Partial Loss of Normal Power (LNP)," January 17, 1993.

6. U.S. Nuclear Regulatory Commission, Information Notice 88-065, " Inadvertent Drainages of Spent Fuel Pools," August 18, 1989. 1

7. Southern California Edison Co., San Onofre Unit 2, Licensee Event Report 50-361/88-017-01, i " Spent Fuel Pool Drainage Due to the Failure to implement Updated Safety Analysis (FSAR) l Commitments," January 2,1990.

8. Toledo Edison Co., Davis Besse, Licensee Event Report 50-346/82-007, March 3,1982.

9. U.S. Nuclear Regulatory Commission, Augmented Inspection Team Report 50-321/86-41 and 50-366/86-41, January 8,1987.

10. Salem Unit I and Unit 2. Event Notification 30528 May 22,1996.

I1. U.S. Nuclear Regulatory Commission, Morning Report 11-94-0112, December 29, 1994.

12. Pennsylvania Power & Light Co., Susquehanna Unit 1, Licensee Event Report 50-387/92-016

" Voluntary Report-Spent Fuel Pools," November 17,1992. l l

13. Stolz, J.F., U.S. Nuclear Regulatory Commission. Letter to Byram, R.G., Pennsylvania Power l and Light Company, "Susquehanna Steun Electric Station, Units 1 and 2, Safety Evaluation  ;

Regarding Loss of Spent Fuel Pool Cooling issues (TAC No M85337)," June 19,1995. I

14. Washington Public Power Supply System, Washington Nuclear Plant Unit 2, Licensee Event Report 50-397/93-018. " Spent Fuel Pool Makeup Not Adequate to Mitigate Accident Conditions," May 28,1993.

15. Northeast Nuclear Energy Company, Millstone Unit 1, Licensee Event Report 50-245/93-011-02, " Spent Fuel Pool Cooling Capacity," July 25,1996.

16. Ba telle Pacific Northwest Laboratory, Draft Report under NRC Contract DE-AC%-76RLO 1830, " Risk Analysis for Spent Fuel Pool Cooling at Susquehanna Electric Power Station," Octoba 16.

17. Idaho National Engineering Laboratory, " Loss of Spent Fuel Pool Cooling PRA: Model and Results," INEL-96/0334, September 1996.

l t

w