NUREG-1032, Draft Reg Guide,Task SI 501-4, Station Blackout. Draft NUREG-1109 & NUREG-1032 Re Regulatory/Backfit Analysis for Resolution of USI A-44 & Evaluation of Station Blackout Accidents at Nuclear Power Plants,Respectively,Encl
| ML20245A521 | |
| Person / Time | |
|---|---|
| Issue date: | 03/30/1987 |
| From: | NRC |
| To: | |
| Shared Package | |
| ML20245A520 | List:
|
| References | |
| REF-GTECI-A-44, REF-GTECI-EL, RTR-NUREG-1032, RTR-NUREG-1109, RTR-REGGD-1.155, TASK-A-44, TASK-OR, TASK-RE, TASK-SI-501-4 NUDOCS 8704140510 | |
| Download: ML20245A521 (315) | |
Text
{{#Wiki_filter:-- f. ~ sjs. js > 1
- ENCLOSURE 2 ;
REGULATORY GUIDE STATION BLACK 0UT c (TASK.SI 501-4) A. INTRODUCTION Criterion 17, " Electric Power Systems," of Appendix A. " General Des'ign Criteria for Nuclear Power Plants," to 10 CFR Part 50, " Domestic Licensing of Production and Utilization Facilities," includes a requirement that an onsite I electric power system and an offsite electric power system be provided'to per-mit functioning of structures, systems, and components important to safety. The Commission has amended its regulations in 10 CFR Part 50. Para-graph (a), " Requirements," of S 50.63, " Loss of All Alternating Current Power," requires that each light water-cooled nuclear power plant be able to withstand and recover from a station blackout (i.e., loss of the offsite electric power system concurrent with reactor trip and unavailability of the onsite emergency ac electric power system) of a specified duration. Paragraph (e) of General Design Criterion (GDC) 17 requires that, for the station blackout duration, the plant'be capable of maintaining core cooling and containment integrity. Paragraph (e) also identifies the factors that must be considered in specifying the station blackout duration. Criterion 18, " Inspection and Testing of Electric Power Systems," of Appendix A to 10 CFR Part 50 includes a requirement for appropriate periodic testing and inspection of electric power systems important to safety. This guide describes a method acceptable to the NRC staff for complying with the Commission regulation that requires nuclear power plants to be capable of coping with a station blackout for a specified duration. This guide applies to all light-water-cooled nuclet.e power plants. I f
. p a ll'l')r>
l Q b 15y O i
t Any information collection ' activities related to this regulatory guide are contained as requirements in the revision of 10 CFR Part 50 that provides the regulatory basis for this guide. 'The information collection requirements of the revised Part 50 were approved by the Office of Management and Budget approval number 3150-0011. This clearance applies to any information collection activities related to this guide. B. DISCUSSION The term " station blackout" refers to the complete loss of alternating current electric power to the essential and nonessential switchgear buses in a nuclear power plant. Station blackout therefore. involves the loss of off-site power concurrent with turbine trip and failure of the onsite emergency ac power system, but not the loss of available ac power to buses feed by station batteries through inverters. Because many safety systems required for reactor core decay heat removal and containment' heat removal are dependent on ac power, the consequences of station blackout could be severe. In the event of. a station blackout, the capability to cool the reactor core would be dependent on the availability of systems that do not require ac power from the essential and nonessential switchgear buses and on the ability to restore ac power in a timely manner. , The concern about station blackout arose because of the accumulated experience regarding the reliability of ac power supplies. Many operating l plants have experienced a total loss of offsite electric power, and more occurrences are expected in the future. In almost every one of these loss of-offsite power events, the onsite emergency ac power supplies have been [ available immediately to supply the power needed by vital safety equipment. ; However, in some instances, one of the redundant emergency ac poeer supplies I has been unavailable. In a few cases there has been a complete loss of ac power, but during these events, ac power was restored in a short time without any serious consequences. In addition, there have been numerous instances when emergency diesel generators have failed to start and run in response to tests conducted at operating plants. ; 2 l 1 1 E________________ .)
l \ l 1 The results of the Reactor Safety Study (Ref. 1) showed that, for one of the two plants evaluated, a station blackout event could be an important contrib-utor to the total risk from nuclear power plant accidents. Although this total risk was found to be small, the relative importance of station blackout events was established. This finding and the accumulated diesel generator failure experience increased the concern about station blackout. In a Commission proceeding addressing station blackout, it was determined that the issue should be analyzed to identify preventive or mitigative measures that can or should be taken. (See Florida Power & Light Company (St. Lucie-Nuclear Power Plant, Unit No. 2) ALAB-603, 12 NRC 30 (1980); modified CLI-81-12, 13 NRC 838 (1981).) The issue of station blackout involves the likelihood and duration of the loss of offsite power, the redundancy and reliability of onsite emergency ac power systems, and the potential for severe accident sequences after a loss of all ac power. References 2 through 6 provide detailed analyses of these topics. Based on risk studies performed to date, the results indicate that estimated core melt frequencies from station blackout vary considerably for different plants and could be a significant risk contributor for some plants. In order to reduce this risk, action should be taken to resolve the safety concern stemming from station blackout. The issue is of concern for both PWRs and BWRs. This guide primarily addresses the following three areas: (1) maintaining highly reliable ac electric power systems, (2) developing procedures and training to restore offsite and onsite emergency ac power should either one or both become unavailable, and (3) ensuring that plants can cope with a station black-out for some period of time based on the probability of occurrence of a station blackout at a site as well as the capability for restoring ac power in a timely fashion for that site. One factor that affects ac power system reliability is the vulnerability to common cause failures associated with design, operational, and environmental , factors. Existing standards and regulatory guides include specific design I criteria and guidance on the independence of preferred (offsite) power circuits (see General Design Criterion 17, " Electric Power Systems," and Section 5.1.3 of Reference 7) and the independence of and limiting interactions between diesel generator units at a nuclear station (see General Design Criterion 17, l Regulatory Guide 1.6, " Independence Between Redundant Standby (0nsite) Power 3 _ _ _ _ _ _ _ _ _ __ ___-)
o f Sources and Between Their Distribution Systems," Regulatory Guide 1.75,
" Physical Independence of Electric Systems," and Reference 8). In developing the recommendations in this guide, the staff has assumed that, by adhering to such standards, licensees have minimized, to the extent practical, single point vulnerabilities in design and operation that could result in a loss of all off-site power or all onsite emergency ac power.
Onsite emergency ac power system unavailability can be affected by outages resulting from testing and maintenance. Typically, this unavailability is about 0.007 (Reference 4) which is small compared to the maximum emergency diesel generator failure rate specified in Section C.I.2 of this Regulatory Guide (i.e., 0.05 or 0.025 failure per demand). However, in some cases outages due to maintenance can be a significant contributor to emergency diesel generator unavailability. This contribution can be kept low by having high quality test and maintenance procedures and by scheduling regular diesel generator mainte-nance at times when the reactor is shut down. Also, limiting conditions for operation in the technical specifications are designed to limit the diesel generator unavailability when the plant is operating. As long as the unavaila- j bility due to test and maintenance is not excessive, the maximum emergency diesel generator failure rates for each diesel generator specified in Section C.1.2 would result in acceptable overall reliability for the emergency ac power system. Based on S 50.63 and paragraph (e) of GDC 17, all licensees and applicants are required to assess the capability of their plants to maintain adequate core cooling and containment integrity during a station blackout and to have proce-dures to cope with such an event. This guide presents a method acceptable to the NRC staff for determining the specified duration for which a plant should be able to withstand a station blackout in accordance with these requirements. The application of this method results in selecting a minimum acceptable station blackout duration capability from 2 to 16 hours depending on a compari-son of the plant's characteristics with those factors that have been identified as significantly affecting the risk from station blackout. These factors include redundancy of the onsite emergency ac power system (i.e., the number of diesel generators available for decay heat removal minus the number needed for decay heat removal), the reliability of onsite emergency ac power sources (e.g. , diesel generators), the frequency of loss of offsite power, and the probable time to restore offsite power. 4
i a Licensees may propo0e durations different from those specified in this guide. The. basis' for alternative durations would be predicated on plant-specific factors relating to the reliability of ac power systems such as those discussed in Reference 2. C. REGULATORY POSITION
- 1. ONSITE EMERGENCY AC POWER SOURCES 1.1 Reliability Program The reliable operation of the onsite emergency ac power sources should be ensured by a reliability program designed to monitor and maintain the reliability of each power source over time at a specified acceptable level and to improve the reliability if that level is not achieved. The reliability program should include surveillance testing, target values for maximum failure rate, and a maintenance program. Surveillance testing should monitor performance so that if the actual failure rate exceeds the target level, corrective actions can be taken.
1.2 Maximum Failure Rate The maximum emergency diesel generator failure rato for each diesel generator should be maintained at or ta low 0.05 failure per demand. However, for plants having an emergency ac power system redundancy as specified in group D of Table 2, the maximum emergency diesel generator failure rate for each diesel generator should be 0.025 failure per demand or less. The emergency diesel generator failure rate should be based on the number of failures in the last 100 valid demands. For purposes of determining the failure rate for this guide, failure to start automatically on test or actual demand need not be counted as a failure if the diar 1 generator is capable of being started manually immediately after it does nc' start automatically. 5
.h
- 1. 3 Procedures for Restoring Emergency AC Power i
I Guidelines and procedures for actions to restore emergency ac power when I the emergency ac power system is unavailable should be integrated with plant-specific technical guidelines and emergency operating procedures developed using the emergency operating procedure upgrade program established in response to Supplement 1, " Requirements for Emergency Response Capability" (Generic Letter No. 82-33),1 to NUREG-0737, " Clarification of TMI Action Plan Requirements."
- 2. OFFSITE POWER Procedures should include all actions necessary to restore offsite power and use nearby power sources 2 when offsita power is unavailable.
As a minimum, the following potential causes for loss of offsite power should be considered: Grid undervoltage and collapse. Weather-induced power loss. Preferred power distribution system faults 3 that could result in the loss of normal power to essential switchgear buses. 1 Modifications or additions to generic technical guidelines that are necessary to deal with a station blackout for the specific plant design should be identified as deviations in the plant specific technical guidelines as required by Supplement 1 to NUREG-0737 and outlined in NUREG-0899, " Guidelines for the Preparation of Emergency Operating Procedures." 2 This includes such items cs nearby or onsite gas turbine generators, portable generators, hydro generators, and black-start fossil power plants. alncludes such failures as the distribution system hardware, switching and maintenance errors, and lightning-induced faults. 6
l 1 a 1
.3. ABILITY TO COPE WITH A STATION BLACK 0UT i
The ability to cope with a station blackout for a certain time provides ! additional defense-in-depth should both offsite and-onsite emergency ac power systems fail concurrently. Section C.3.1 provides a method to determine an acceptable minimum time that a plant should be able to cope with a station blackout based on the probability of a station blackout at the site as well as the capability for restoring ac power for that site. Each nuclear power plant has the capability to remove decay heat without ac power for a limited period of time. Section C.3.2 provides guidance for determining the length of time that a plant is actually able to cope with a station blackout. If the plant's actual station blackout capability is significantly less than the acceptable minimum duration, modifications may be necessary to extend the plant's ability to cope with a station blackout. Should plant modifications be necessary, Section C.3.3 provides guidance on making such modifications. Whether or not modifications are necessary, procedures and training for station blackout events should be provided according to the guidance in Section C.3.4. 3.1 Minimum Acceptable Station Blackout Duration Capability Each nuclear power plant should be able to withstand and recover from a
' station blackout lasting a specified minimum duration. The specified duration of station blackout should be based on the following factors:
- 1. The redundancy of the onsite emergency ac power system (i.e., the number of power sources available minus the number needed for decay heat removal),
- 2. The reliability of each of the onsite emergency ac power sources (e.g., diesel generator),
- 3. The expected frequency of loss of offsite power, and
- 4. The probable time needed to restore offsite power.
A method for determining an acceptable minimum station blackout duration capability as a function of the above site- and plant-related characteristics is given in Table 1. Tables 2 through 7 provide the necessary detailed 7
j .
?
descriptions and definitions of the various factors used in Table 1. Table 2 identifies different levels of redundancy of the onsite emergency ac power system used to define the emergency ac power configuration groups in Table 1.- Table 3 provides definitions of the three offsite power design characteristic groups used in Table 1. The groups are defined according to various combinations of the following factors: (1) independence of offsite power (I), (2) severe weather (SW), (3) severe weather recovery (SWR), and (4) extremely severe weather (ESW). The definitions of the factors I, SW, SWR, and ESW are l provided in Table 4 through 7, respectively. After identifying the appropriate groups from Tables 2 and 3 and the reliability level of the onsite emergency ac power sources (determined in accordance with Section C.1.1 of this regulatory guide), Table 1 can be used to determine the acceptable minimum station blackout duration capability for each plant.
- 3. 2 Evaluation of Plant-Specific Station Blackout Capability Each nuclear power plant should be evaluated to determine its capability to withstand and recover from a station blackout of the acceptable duration determined for that plant in Section C.3.1. The following considerations should be included when determining the the plant's capability to cope with a station blackout:
1. The evaluation should be performed assuming that the plant is operating at full power immediately before the postulated station blackout.
- 2. The capability of all systems and components necessary to provide core cooling and decay heat removal following a station blackout should be determined, including station battery capacity, condensate storage tank capacity, compressed air capacity, and instrumentation and control requirements.
- 3. The ability to maintain adequate reactor coolant system inventory to ensure that the core is cooled should be evaluated taking into consideration l
shrinkage, leakage from pump seals, and inventory loss from letdown or other normally open lines dependent on ac power for isolation.
- 4. The design adequacy and capability of equipment needed to function in environmental conditions associated with a station blackout should be evaluated.
All ac-independent decay heat removal systems and associated equipment needed 1 8
f to function during a station blackout, as well as equipment necessary to recover from a station blackout (e.g., auxiliary equipment to operate onsite breakers to connect the switchyard to onsite buses or to recover emergency diesel generators), should meet design and performance standards that ensure adequate reliability and operability in the environments that may be associated with a station blackout, including hazards due to severe weather. Work that has already been performed need not be duplicated. For example, if safety-related equipment needed during a total loss of ac power has been qualified to operate during environmental conditions associated with a station blackout (e.g., without heating, ventilating, and air conditioning systems operating), additional analyses need not be performed.
- 5. Consideration should be given to using available non-safety-related equipment, as well as safety related equipment, to cope with a station blackout provided such equipment meets the recommendations of item 4 in Section C.3.2 of this regulatory guide. Onsite or nearby power sources that are independent and diverse from the normal Class IE emergency ac power sources (e.g., gas turbine, separate diesel engine, steam supplies) may be used provided such equipment (1) meets the recommendations of item 4 (Section C.3.2), (2) is physically separate from the normal Class 1E emergency ac power sources, (3) has minimum potential for common mode failure with offsite power or the normal Class 1E emergency ac power sources, (4) has sufficient capacity to provide power necessary for all essential loads, and (5) is maintained and tested to ensure acceptable availability and reliability.
In general, equipment required to cope with a station blackout during the first 8 hours should be available on site. For equipment not located on site, consideration should be given to its availability and accessibility in the time required, including consideration of weather conditions likely to prevail during a loss of offsite power.
- 6. Consideration should be given to timely operator actions inside or outside the control room that would increase the length of time that the plant can cope with a station blackout provided it can be demonstrated that these actions can be carried out in a timely fashion. For example, if station battery capacity is a limiting factor in coping with a station blackout, shedding non-essential loads on the batteries could extend the time until the battery is depleted. If load shedding or other operatur aci. ions are considered, correspond-ing procedures should be incorporated into the plant specific technical guide-lines and emergency operating procedures.
9
.1 3.3 Modifications to Cope with Station Blackout 1 If the plant's station blackout capability, as determined according to the l guidance in Section C.3.2 of this regulatory guide, is significantly less than the minimum acceptable plant-specific station blackout duration as developed according to Section C.3.1 of this regulatory guide (or as justified by the licensee or applicant on some other basis and accepted by the staff), modifi -
cations to the plant may be necessary to extend the time the plant is able to cope with a station blackout. If modifications are needed, the following items should be considered: 1. If, after considering load shedding to extend the time until battery depletion, battery capacity must be extended further to meet the station blackout duration recommended in Section C.3.1 of this regulatory guide, it is considered acceptable either to add batteries or to add a charging system for the existing batteries that is independent of both the offsite and onsite emergency ac power systems such as a dedicated diesel generator.
- 2. If the capacity of the condensate storage tank is not sufficient to remove decay heat for the station blackout duration recommended in Section C.3.1 of this regulatory guide, a system to resupply the tank from an alternative water source is an acceptable means to increase its capacity provided any power source necessary to provide additional water is independent of both the offsite and the onsite emergency ac power systems.
3. If a system is required for primary coolant charging and makeup, reactor coolant pump seal cooling or injection, or decay heat removal specifically to meet the station blackout duration recommended in Section C.3.1 of this regulatory guide, the following criteria should be met:
- a. The system should be capable of being actuated and controlled from the control room, or if other means of control are required, it should be demonstrated that these steps can be carried out in a timely fashion; and
- b. If the system must operate within 10 minutes of a loss of all ac power, it should be capable of being actuated automatically.
10
i
- 4. If a system or component is added specifically to meet the recommen-dations on station blackout duration in Section C.3.1 of this regulatory guide, system walk downs and ' initial tests of new or modified systems or critical components should be performed to verify that the modifications were performed properly. Failures of added components that may be vulnerable to internal or external hazards within the design basis (e.g., seismic events) should not result in secondary failures causing a loss of emergency ac power systems or a loss.of other safety-related equipment.
- 5. A system or component added specifically to meet the recommendations on station blackout duration in Section C.3.1 of this regulatory guide should be inspected, maintained and tested periodically to demonstrate equipment operability and reliability.
3.4 Procedures and Training to Cope with Station Blackout ! Procedures 4 and training should include all operator actions necessary to cope with a station blackout for at least the duration determined according to Section C.3.1 of this regulatory guide, and to restore normal long-term core { cooling / decay heat removal once ac power is restored. D. IMPLEMENTATION j i The purpose of this section is to provide information to applicants ard licensees regarding the NRC staff's plans for using this regulatory guide. Except in those cases in which the applicant or licensee proposes an accept-able alternative method for complying with specified portions of the Commission's regulations, the method described in this guide will be used in the evaluation of submittals by applicants for construction permits and operating licenses and 1 by licensees who are required to comply with S 50.63, " Station Blackout," and paragraph (e) of General Design Criterion 17 of Appendix A to 10 CFR Part 50. 4 Procedures should be integrated with plant-specific technical guidelines and emergency operating procedures developed using the emergency operating proce-dure upgrade program established in response to Supplement 1 of NUREG-0737. The task analysis portion of the emergency operating procedure upgrade program should include an analysis of instrumentation adequacy during a station blackout. 11
l i
)
I Table 1 Acceptable Station Blackout Duration Capability (hours)a I ( Emergency AC Power Configuration Group b A B C D Offsite Power Design Maximum EDG Failure Rate Per Demand Characteristic Group c 0.025 0.05 0.025 y 0.05 0.025 0.05 0.025 P1 2 2 4 4 4 4 4 i P2 4 4 4 4 4 8 8 P3 4 8 4 8 8 16 8 a Variations from these times will be considered by the staff if justification, including a cost-benefit analysis, is provided by the licensee. The methodol-ogy and sensitivity for use studies presented in NUREG-1032 (Ref. 2) are acceptable in this justification. b See Table 2 to determine emergency ac power configuration group. c See Table 3 to determine groups P1, P2 and P3. 12
-j a
Table 2 Emergency AC Power Configuration Groups a Emergency AC (EAC) NumbergfEACPower Number of EAC Power Sources Power Configuration Sources Group RequiredtoOperateAC-Powgred Decay Heat Removal Systems i A d 3 1 4 1 1 B 4 2 5 2 C d y 2' 3 1 I D 2 1 3 2 4 3 5 3 a Special purpose dedicated diesel generators, such as those associated with high pressure core spray systems at some BWRs, are not counted in the determination of EAC power configuration groups. b If any of the EAC power sources are shared among units at a multi-unit site, this is the total number of shared and dedicated sources for those units at the site. , c This number is based on all the ac loads required to remove decay heat (including AC powered decay heat removal systems)-to achieve and maintain hot shutdown at all-units at the site with offsite power unavailable. d For EAC power sources not shared with other units.
'For EAC power sources shared with another unit at a multi-unit site. j I
For shared EAC power sources in which each diesel generator is capable of pro-viding ac power to more than one unit at a site concurrently. 13
L i Table 3
-Offsite Power Design. Characteristic Groups Group Offsite Power Design Characteristics Sites that have any combination of the following factors:
Ia gyb SWR c ESW d P1 1 or 2 1 or 2 1 or 2 1 or 2 1 or 2 1 1 or 2 3 1 or 2 3 1 1 or 2 P2 All other sites not in P1 or P3. Sites that have experienced, or could be expected to experience, a total loss of offsite power due to grid failures at a frequency equal to or greater than once in 20 site years; unless the site has procedures to recover ac power from reliable alternate (non emergency) ac power sources within approximately one-half hour 4 following a grid failure. p.r_ Sites that have any combination of the following factors: ;
, P3. I SW SWR ESW Any I 5 2 Any ESW Any 1 1,2,3, or 4 1 or 2 5 Any I 5 1 Any ESW !
Any I 4 2 1,2,3 or 4 1 or 2 3 2 4 3 3 2 3 or 4 a b See Table 4 for definitions of independence of offsite power groups (I) See Table 5 for definitions of severe weather groups (SW) c See Table 6 for definitions of severe weather recovery groups (SWR) ' d See Table 7 for definitions of extremely severe weather groups (ESW) i 14
)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ ]
e) mtt emaeE uda nd ft o eE r . f o a sa cI og h g h o gcs oumd .pI e otl n user ti so u u i e a rre eso er uar b h us Fi t o o yh s ru eaue et ose h u r coorcysat c nt Eh sacnt a rl t rn erl a a real 1t r l ri h t hl t at d u oenroaC ef ul l 3 e unma oo erC u f e cn n sroes p u e f r s or sot e stf wesc oeor t ti e a a nern sno . 3 n nrs l d rah ug o l i s a l d aoh ptd uv rew a at e a l l cr aenoemtigi mrat w s meuec tde C ee eoirl p pep re o ,oF e rrb rr t cff r s. af ecroor t e l e eer oh ssp)t d oe ru h eu edt sn h h nt rr O n nh reo t norrf enna t t e2 e eeeNsis
,fft(t i e t ef s f e f nseeeream
. o ff rrs r r h ss si i nh h ssrr ocrsspeetf o oae tl nnsncwt tl npe enn f r t t r i aaf ero .
i a w l ewaae epe r s u f arrf pihf f aroo l rorrn reh d o ddg Ifttoocso Iftt p A a pt t o prt e eri t t aF c cy e eh n o r n nci rs t e -) n nt r V o c ois cwd e w sl ei m r1 mk o-r e s r eo rp w cre. h e et pr sr ocl a e o r9 w ee a hi eu e e a pil uot f e nf6 ocft e T wrt r rey t anti sr g pi s i tt ( s a I a ahh caf a sl nu ire t ns ii c se
. s s t c t
amoe msf aagseh caaf nsi .Vif s e ef uri eft amrf uf tsk p edi l t cecontF ds ) ot o f ae 2n u c r cnw aurrr a - no . ft aomc8 g o 2 u ras mauouemon satl oul e or3 ei r u r omot ti i r a aat net u1 rs o o ,V oes saeu ht ru e ua it uo ue G s ssk nn r nh ae t en cenn a a s o gd r r rr8 d - e i osorrT ee( er fh c r ema m rnar uome sr eaertF s wi e e ea3 d h sh ewt h u ot o o t sph e i w w w y1 n
.t o o tit nol f e r ssol uet wenh o d. oh a opa o i na ,
sm s et sb P p r pcd bs ohi t f ef vpn l s rpt a t n orI ef reoV i ead aet re E oe sf e e y eia e boocrk t crl mruoc t t h t w sh rf - reb r Ittf oe o c axt u f ot c i s i is -) st . ysdu 9 t e- o oh du sd a r e I s t s 5 . o rareor6 n ow nt reo s e rru v f f i f e4 e l emerse eet ers at seeoi f f o w f r3 r ef f r f e s rue e ,f r l ceff s t 4 0 s oo u rcsesersh euac h sser C ecss a met ernrnf ent rt r tl nf e nrnnd t f l e l ha t uaearwa paeu l aew enuaar n e o l n l rT e f orh reoro eeh o f arro h oorra e l A o Ao(f A sttt pptt rft s Ift pp Tcstt y s b e a c T n
- et f d
n t a a e ome- ) e v f - oh e . p rt i r oeoert r e au eVt e ct cf p r d e h pb s h k a w o erur oe u r ge us ,i t 9 n pcro cuaurt oe r
- t t n a
_ I a o ssf6 e i usnsf rs e s rr eeo s ct o a sei f f o e t h onc irt nr) t e aasd m esear1 rnm n s c sl unep . f odrih ro g r td n oedee ot er ttf e i u nrnsdnrr ureeo sr s io o aao s ne u earf rnenu e t l yi c e p s t ph sapeia c eeeah agd r rnf rh T ri i cs ed e uaept o(tF s in e eti edn1f r o r ,t - i 1 w himh ni o ssps on h f o t wsti en i isr .ti t 2 p sn erg l ahl eru D o af yh ui ae tl f eae f e t erol T gs mro asw c o t rt l (i e retff InoV apk r u i do s emgnc ea Fd oh e f nt r rr - o v t noi .ns e e1 si f cri o eomtt r rsii e ,f .et w t6 t n os ceet h h ssroci1V tl n e pi s a k t l nocaeh n ownel tf f i aw tf e- n l f arof afh9 e A ctil eoI o Ift pomot6 s L ^ l r ( es we oc spr re u esco f uas sb n f p e aE ou rI k i t t ec s scal l srbl f f aau a ul oef o nCsh f a t r mel e o h anw s dt ee n meo rh p cc nr arowon e y eu cf dt d o i eni r ns t sh as o e aet f g pr mm sf e ee oenl o t d w th ei a no uch af C I p Aswf o O L
. l Table 5 Definitions of Severe Weather Groups (SW)
Estimated frequency of loss of offsite power due SW Group severe weather, fa (per site year) 1 f < 0.003 2 0.003 i f < 0.010 3
- 0. 010 i f < 0. 030 4
0.030 $ f < 0.10 5 0.10 1f a The estimated frequency of loss of offsite power due to severe weather, f, is determined by the following equation: f = (1.3 x 10~4)hy + (b)hp +.(0.012)h3 + (c)h4
, where hy = annual expectation of snowfall for the site, in inches, hp = annual expectation of tornadoes (with wind speeds greater than or equal to 113 miles per hour) per square mile at the site, i
b = 12.5 for sites with transmission lines on two or more rights-of-way spreading out in different directions from the switchyard, or b = 72.3 for sites with transmission lines on one right-of-way. h 3 = between 75 and 124 mph, andannual expectation of storms at the site w h4 = annual expectation of hurricanes at the site c = 0 if switchyard is not vulnerable to salt spray c = 0.78 if switchyard is_ vulnerable to salt spray The annual expectation of snowfall, tornadoes, and storms may be obtained from National Weather Service data from the weather station nearest to the plant or by interpolation, if appropriate, between nearby weather stations. The basis for the empirical equation for the frequency of loss of offsite power due to severe weather, f, is given in Reference 2, Appendix A. 16
1 Table 6 4 i a, 1 Definitions of Severe Weather Recovery Groups (SWR) i I l SWR Group Definition 1 Sites with enhanced recovery (i.e. , sites that have the capability and procedures for restoring offsite (non-emergency) ac power to the site within 2 hours following a loss of offsite power due to severe weather.) 2 Sites without enhanced recovery. 17
i
.l l
4 Table 7 1 Definitions'of Extremely Severe Weather Groups (ESW) Annual expectation of storms at a site with wind velocities equal to or greater than 125 miles ESW Group per hour (e)* 1 e < 3 x 10 -4 2 3 x 10 ~4 1 e < 1 x 10 -3 3 1 x 10 -3 1 e < 3 x 10 -3 4 3 x 10 -3 1 e < 1 x 10 -2 5 1 x 10 -2 i, The annual expectation of storms may be obtained from National Weather Service data from the weather station nearest to the plant, or by interpolation, if appropriate, between nearby weather stations. I', l 4 18
)
'gv i
.t.
il JL JL dL ji 69 kV 161 kV 345 kV t .
** v NVAm M%M MMMM MMMM NM MM AUT M 'C gg yg 7 PANS R MAIN -~
~ ~ - ~ ~
- GENERATOR If If y 3r AUTOMATIC y NC $7 NC NO NO TRANSFER-CLASS 1E NONSAFETY CLASS 1E NONSAFETY l [ AUTOMATIC TRANSFER h_f l I L _ AUTOMATIC TRANSFER _ j Figure 1. Schematic diagram of electrically independent transmission line i
l l I 1 4 19 b
i-
.. q i
a n a a h h a a h E E 345 kV 138 kV g E se mMA es me em AAAA AAAA 1r 1r 1r1r 1r 1r NC NC NONSAFETY NO NONSAFETY NO MAIN CLASS 1E CLASS 1E CLASS 1E CLASS 1E GENERATOR DIVISION 1 DIVISION 2 OlVISION 1 DIVISION 2 i I i i & 4
!_ _ _ fuJOMA,p{T,RApSf,ER, _ , ,,,,,,,__J l
L , _ , _ _AuTgMyte I,RA,NS,[ER , , ,, ,,j Figure 2. Schematic diagram Of two switchyardS electrically connected (One-unit Site) 20
i JL JL JL ll JL 500 kV ll 230 kV
, i.:
3::
.+*
MM I . l MMMM MM MM MM MM MMMM ' GENERATOR 2 If If If If If If If If NC NC NC TO NC TO NC TO NC TO NC NC GENERATOR 1 NONSAFETY SOME SOME SOME SOME NONSAFETY UNIT 2 UNIT 2 UNIT 2 UNIT 1 UNIT 1 UNIT 1 CLASS 1E CLASS 1E CLASS 1E CLASS 1E BUSES, BUSES, BUSES, BUSES, NO TO NO TO NO TO NO TO OTHERS OTHERS OTHERS OTHERS Figure 3. Schematic diagram of two SwitChyardS electrically Connected (two-unit Site) l 21 ; i _ _ _ _ _ _ _ _ _ _ _ _ _ _ - --- .- i
L REFERENCES 1. U.S. Nuclear Regulatory Commission, " Reactor Safety Study," WASH-1400, October 1975.
- 2. U.S. Nuclear Regulatory Commission, " Evaluation of Station Blackout Acci-dents at Nuclear Power Plants, Technical Findings Related to Unresolved Safety Issue A-44," NUREG-1032, Draft, May 1985.
3. U.S. Nuclear Regulatory Commission, " Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants," NUREG/CR-3992, February 1985.
- 4. U.S. Nuclear Regulatory Commission, " Reliability of Emergency ac Power Sources at Nuclear Power Plants," NUREG/CR-2989, July 1983.
- 5. U.S. Nuclear Regulatory Commission, " Emergency Diesel Generator Operating Experience, 1981-1983," NUREG/CR-4347, December 1985.
6. U.S. Nuclear Regulatory Commission, " Station Blackout Accident Analyses (Part of NRC Task Action Plan A-44)," NUREG/CR-3226, May 1983.
- 7. Institute of Electrical and Electronics Engineers, "IEEE Standard for Preferred Power Supply for Nuclear Power Generating Stations," IEEE Std 765-1983.*
- 8. Institute of Electrical and Electronics Engineers, "IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations," IEEE Std 387-1984.*
- Copies may be obtained from the Institute of Electrical and Electronics '
Engineers, 345 E. 47th Street, New York, NY 10017. l l 22 i
VALUE/ IMPACT STATEMENT l A separate value/ impact statement was not prepared for this regulatory guide. The regulatory analysis prepared for the station blackout rule (NUREG-1109). provides the regulatory basis for this guide and examines the costs and benefits of the rule as implemented by the guide. A copy of NUREG-1109 is available for inspection and copying for a fee at the NRC Public Document Room, 1717 H Street NW., Washington, DC 20555. Free single copies may be obtained upon written request to.the Distribution Section, Room 1 P-1304, Division of Information Support Services, U.S. Nuclear Regulatory Commission, Washington, DC 20555. 23
- , +.
g
?'.
_ . 3 ':l R ? . NUREG-1109 Ehict ocue s 3 Regulatory Resolution /Backfit Analysis of Unresolved Safety for Issue A-44, Station Blackout U.S. Nuclear Regulatory Commission 8lll:::l%"l:::R:as:PC:t"3" A. M. Rubin l
NUREG-1109 kegulatory Resolution of /Backfit Analysis Unresolved Safety for the issue A-44 Station Blackout i Manuscript Completed: A. M. Rubin Office of Nuclear Regulatory Research Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission W shington, DC 20566 I i e
-r e
)
ABSTRACT
" Station Blackout" is the complete loss of alternating current (ac) electric power to the essential and nonessential buses in a nuclear power plant; it results when both offsite power and the onsite emergency ac power systems are unavailable. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on ac power, the consequences of a station blackout could be severe. Because of the concern about the frequency of loss of offsite power, the number of failures of emergency diesel generators, and the potentially severe consequences of a loss of all ac power, " Station Blackout" was designated as Unresolved Safety Issue (USI) A-44.
This report presents the regulatory /backfit analysis for USI A-44. It includes: (1) a summary of the issue, (2) the recommended technical resolution, (3) alter-native resolutions considered by the Nuclear Regulatory Commission (NRC) staff, (4) an assessment of the benefits and costs of the recommended resolution, (5) the decision rationale, (6) the relationship between USI A-44 and other NRC programs and requirements, and (7) a backfit analysis demonstrating that the resolution of USI A-44 complies with the Backfit Rule (10 CFR 50.109). NUREG-1109 iii I
7 l" + o a. s
- TABLE OF CONTENTS
. Page ABSTRACT................................................................
l iii LIST OF TABLES.......................................................... vi PREFACE................................................................. vii ACKN0WLEDGEMENTS........................................................ viii EXECUTIVE
SUMMARY
....................................................... ix
~
1 ' STATEMENT OF THE PR0BLEM........................................... 1 0BJECTIVES......................................................... i 2 ' 3 3 ALTERNATIVE RESOLUTIONS............................................ 3 3.1 Alternative (1)............................................... 3
- 3. 2 Alternative (i1).............................................. 17
. 3. 3 A1ternative.(iii)............................................. 17 3.4 Alternative (iv).............................................. 17
- 3. 5 Alternative (v)............................................... 18 4 CONSEQUENCES....................................................... 18 4.1 Costs and Benefits of Alternative Proposed Resolutions........ 18 4.1.1 Alternative (1)........................................ 18 i 4.1.2 Alternative (11)....................................... 34 4.1.3 Alternative (111).................... ................. 34 4.1.4 Alternative (iv)....................................... 35 4.1.5 Al te rna ti ve ( v ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
)
l s NUREG-1109 v
l UL i 1 i k TABLE OF CONTENTS (Continued) ' Page l 4.2 Impacts on Other Requirements................................. 36 4.2.1 Generic Issue B-56, Diesel Generator Reliability. . . . . . . 36 ! 4.2.2 USI A-45, Shutdown Decay Heat Removal Requirements..... 37 4.2.3 Generic Issue B-23, Reactor Coolant Pump Seal Failures. 39 4.2.4 Generic Issue A-30, Adequacy of Safety-Related DC Power Supp1y........................................... 40 4.2.5 Regulatory Guide 1.108, Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power P1 ants................................ 40 4.2.6 Fire Protection Program for Nuclear Power Facilities... 41 4.2.7 Generic Issue 124, Auxiliary Feedwater System Reliability............................................ 41 4.2.8 Multiplant Action Items B-23 and B-48, Degraded Grid Voltage Adequacy of Station Electric Distribution Voltage................................................ 42 4.2.9 Severe Accident Program................................ 42 4.3 Constraints................................................... 42 5 DECISION RATIONALE................................................. 45 5.1 Commission's Safety Goa1s..................................... 45 5.2 Station Blackout Reports...................................... 47 5.2.1 NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power P1 ants................................ 47 5.2.2 NUREG/CR-3226, Station Blackout Accident Analysis...... 50 5.2.3 NUREG/CR-2989, Reliability of Emergency AC Power Systems at Nuclear Power Plants................. ...... 52 5.2.4 NUREG/CR-4347, Emergency Diesel Generator Operating i Experience, 1981-1983.................................. 53 i NUREG-1109 vi ! t i
t ~J r TABLE OF CONTENTS (Continued) i
- f. age 5.2.5 NUREG/CR-3992, Collection and Evaluation of Complete and Partial Losses of Offsite Power-at Nuclear Power P1 ants................................................. 53 6
IMPLEMENTATION..................................................... 55 6.1 Schedule for Implementation of the Station Blackout Rule...... 55 6.2 Relationship to Other Existing or Proposed Requirements....... 56 7 REFERENCES......................................................... 56
. APPENDICES APPENDIX A BACKFIT ANALYSIS APPENDIX B WORKSHEETS FOR COST ESTIMATES LIST OF TABLES Table Page 1 Acceptable station blackout duration capability.................... 7 2 Emergency ac power configuration groups............................ 8 3 Offsite power design configuration groups.......................... 9 4 Definitions of independence of offsite power sources (I). . . . . . . . . . . 10 j 5 Definitions of severe weather groups (SW) ......................... 11 6 Definitions of severe weather recovery groups (SWR) . . . . . . . . . . . . . . . 12 7 Definitions of extremely severe weather groups (ESW) .............. 13 8 Estimated number of reactors having similar characteristics........ 22 9 Examples of reduction in frequency of core melt per reactor year... 22 10 Estimated costs for industry to comply with the resolution of USI A-44........... ... ............................. 27 NUREG-1109 vii
w . 1.. I i 4
' LIST'0F TABLES (Continued)
Table ~ Page 11' Discounted present value of avoided onsite property damage for i: 100 L reactors......................................................... 29 12 Value-impact' summary for station blackout resolution. . . . . . . . . . . . . . 30 13 Implementation schedule.for final station blackout rule............ 55 LIST OF FIGURES Figure Page 1 Schematic diagram of electrically independent transmission line ... 14 2 Schematic diagram of two switchyards electrically connected 3 (one-unit site) ................................................... 15 Schematic diagram of two switchyards electrically connected (two-unit site) ................................................... 16 4 Comparison of estimated station blackout core damage frequency ., before and after rule .................................-............ 24 j I 1 NUREG-1109 viii l i
E 1 1 PREFACE This report presents the supporting value-impact analysis, backfit analysis and decision rationale for the resolution of USI A-44. The resolution itself con-sists of a rule that requires nuclear power plants to be able to cope with a station blackout for a specified period, and an associated regulatory guide that provides guidance on an acceptable means to comply with.the rule. The NRC staff report that provides data and technical analyses supporting the resolution of l this issue is published separately as NUREG-1032. Other NRC contractor NUREG reports published under this task are listed in the Reference section. The Comission published a proposed station blackout rule in the Federal Register i on March 21,1986 (51 FR 9829) for public coment. In April 1986, the NRC pub-lished a draft regulatory guide on station blackout for coment (Task SI-501-4). Previously, in January 1986, NRC published a draft version of this report (NUREG-1109) for coment. All public comments on this issue were reviewed and considered by the staff in formulating the final resolution of USI A-44 and this final version of NUREG-1109. Responses to the public coments are discussed in the supplementary information section of the Notice of Final Rulemaking for the Station Blackout Rule, which is to be published in the Federal Register. Alan M. Rubin l l NUREG-1109 ix
1 4 f 1 3 J ACKNOWLEDGEMENTS (to be added) NUREG-1109 x
EXECUTIVE
SUMMARY
This report provides supporting information, including a cost-benefit analysis and a backfit analysis, for the Nuclear Regulatory Commission's (NRC) resolution of Unresolved Safety Issue (USI) A-44, " Station Blackout." The term " station blackout" refers to the complete loss of alternating current (ac) electric power to the essential and nonessential switchgear buses in a nuclear power plant. Station blackout involves the loss of offsite power concurrent with turbine trip and the unavailability of the onsite emergency ac pcwer system. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on ac power, the consequences of station blackout could be severe. The NRC's concern about station blackout arose because of the accumulated ex-perience regarding the reliability of ac power supplies. In numerous instances e emergency diesel generators have failed to start and run during tests conducted at operating plants. In addition, a number of operating plants have experienced a tota? loss of offsite electric power, and more such occurrences are expected. In almost every one of these loss-of-offsite power events, the onsite emergency ac power supplies were available immediately to supply the power needed by vital safety equipment. However, in some instances, one of the redundant emergency power supplies has been unavailable. In a few cases, there has been a complete loss of ac power, but during these events, ac power was restored in a short time without any serious consequences. The issue of station blackout involves the likelihood and duration of the loss of offsite power, the redundancy and reliability of onsite emergency ac power systems, and the potential for severe accident sequences after a loss of all ac power. These topics were investigated under Unresolved Safety Issue (l'SI) Task Action Plan A-44.* In addition to identifying important factors and sequences
*The technical findings of these investigations are detailed in NUREG/CR-2989, NUREG/CR-3226, NUREG/CR-3992, NUREG/CR-4347 and NUREG-1032.
NUREG-1109 xi
that could lead to station blackout, the results indicated that actions could be taken to reduce the risk from station blackout events. The issue is of concern j for both boiling water reactors (BWRs) and pressurized water reactors (PWRs).
]
i The evaluation to resolve USI A-44 included deterministic and p'robabilistic 1 analyses. Calculations to determine the timing and consequences of various accident sequences were performed, and the dominant factors affecting station blackout likelihood were identified. Using this information, simplified prob-abilistic accident sequence correlations were calculated to estimate the like-lihood of core melt accidents resulting from station blackout for different plant design, operational, and location factors. These quantitative estimates were used to give insights on the relative importance of various factors, and those i'risights, along with engineering judgment, were used to develop the resolution. Thus, the effects of variations in design, operations, and . plant location on risk from station blackout events were used to reach a rea- ! sonably consistent level of risk in the recommendations developed. i Although there are licensing requirements and guidance directed at providing i reliable offsite and onsite ac power, experience has shown that there are l practical limitations in ensuring the reliability of offsite and onsite emer-gency ac power systems. Analyses have shown that core damage frequency can be significantly reduced if a plant can withstand a total loss of ac power until either offsite or onsite emergency ac power can be restored. 1 l l I Because there is no requirement that plants be able to withstand a loss of both the offsite and onsite emergency ac power syst' ems, the resolution calls for rulemaking to require all plants to be able to cope with a station blackout for a specified durstion. A regulatory guide on station blackout
- describes a metliod acceptable to the NRC staff for complying with the rule, and specifies guidance on providing reliable ac electric power supplies. Plants with an already low risk from station blackout are required to withstand a station
- Single copies of this regulatory guide may be obtained by writing to Distribution Services, Division of Information Support Services, U.S. NRC, Washington, DC, 20555.
NUREG-1109 xii
, i blackout for a relatively short period of time. These plants probably need few, if any, modifications as a result of the rule. Plants with a currently higher risk from station blackout are required to withstand blackouts of a some-what longer duration, and, depending on their existing capability, might require modifications (such as increased station battery capacity or condensate storage tank capacity) to meet this requirement. The staff has determined that these modifications are cost-effective in terms of reducing risk to the public. The general objective of the resolution of USI A-44 is to reduce the risk of severe accidents associated with station blackout by making station blackout a relatively small contributor to total core damage frequency. Specific actions called for in the resolution include: (1) maintaining highly reliable ac elec-tric power systems; (2) developing procedures and training to restore offsite and onsite emergency ac power should either one or both become unavailable; and (3), as additional defense-in-depth, ensuring that plants can cope with a station blackout for some period of time, based on the probability of occurrence of a station blackout at the site, as well as on the capability for restoring ac power for that site. The method to determine an acceptable station blackout duration capability is presented in the regulatory guide. Applications of this guide result in deter-minations that plants be able to withstand station blackouts of 2, 4 or 8 hours, depending on the plant's specific design and site-related characteristics. Licensees may propose durations different from those specified in the regulatory guide, based on plant-specific factors relating to the reliability of ac power systems. The benefit from implementing the rule and the regulatory guide is a reduction in the frequency of core damage per reactor year due to station blackout and the associated risk of offsite radioactive releases. The risk reduction for 100 operating reactors is estimated to be 145,000 person rems. The cost for licensees to comply with the requirements varies depending on the existing capability of each plant to cope with a station blackout, as well as the plant-specific station blackout duration determined. The costs are primarily to industry to assess the plant's capability to cope with a station blackout, i NUREG-1109 xiii
)
1 9 e l i to develop procedures, to improve diesel generator reliability if the reliability falls below certain levels, and to retrofit plants with additional components or { systems, as necessary, to meet the requirements. I 1 The estimated total cost for 100 operating reactors to comply with the resolu-tion of USI A-44 is about $60 million. The average cost per reactor is esti- { mated to be $600,000, ranging from $350,000, if only a station blackout assess- l ment and procedures and training are necessary, to a maximum of about $4 million if substantial modifications are needed, including requalification of a diesel < generator. The overall value-impact ratio, not including accident avoidance costs, is about { 2,400 person-rems averted per million dollars. If cost savings from accident ( avoidance (cleanup and repair of onsite damages and replacement power) were included, the overall value-impact ratio would improve significantly to about 6,100 person-rems averted per million dollars. Several NRC programs are related to USI A-44, including Diesel Generator Relia-bility (B-56), Reactor Coolant Pump Seal Failures (Generic Issue 23), Safety-Related DC Power Supplies (A-30), and Shutdown Decay Heat Removal Requirements (USI A-45). These programs are closely coordinated within NRC and are compatible with the resolution of USI A-44. i NUREG-1109 xiv
.r
e i REGULATORY /BACKFIT ANALYSIS FOR THE RESOLUTION OF UNRESOLVED SAFETY ISSUE A-44, STATION BLACK 0UT 1 STATEMENT OF THE PROBLEM
'" Station blackout" refers to the complete loss of alternating current (ac) electric power to the essential and nonesser,tial switchgear buses in a nuclear power plant. Station blackout involves the loss of offsite power concurrent with turbine trip and the unavailability of the onsite emergency ac power sys-tem.
Because many safety systems required for reactor core decay heat removal and containment heat removal depend on ac power, the consequences of station blackout could be severe. The concern of the Nuclear Regulatory Commission (NRC) about station blackout i arose because of the accumulated experience regarding the reliability of ac power supplies. In numerous instances emergency diesel generators have failed to start and run during tests conducted at operating plants. In addition, a number of operating plants have experienced a total loss of offsite electric ! power, and more occurrences are expected. In almost every one of these loss-of-offsite power events, the onsite emergency ac power supplies were available f immediately to supply the power needed by vital safety equipment. However, in some instances, one of the redundant emergency power supplies has been unavail-able. In a few cases, there has been a complete loss of ac power, but during ! these events, ac power was restored in a short time without any serious consequences. The results of the Reactor Safety Study (NUREG-75/014) showed that for one of the two plants evaluated, a station blackout accident could be an important contributor to the total risk from nuclear power plant accidents. Although i this total risk was found to be small, the relative importance of the station blackout accident was established. This finding and the accumulated diesel generator failure experience increased the concern about station blackout. NUREG-1109 1
I t The issue of station blackout involves the likelihood and duration of losse of offsite power, the redundancy and reliability of onsite emergency ac power systems, and the potential for severe accident sequences after a loss of all ac power. These topics were investigated under Unresolved Safety Issue (USI) Task Action Plan A-44, and the technical findings are reported in detail in NUREG/ CR-2989, NUREG/CR-3226, NUREG/CR-3992, NUREG/CR-4347, and NUREG-1032. In addi-tion to identifying important factors and sequences that could lead to station blackout, the results indicated that estimated core damage
- frequencies from station blackout vary significantly for different plants but could be on the arder of 10 4 per reactor year for some plants.
To reduce this risk, action should be taken to resolve the safety concern stemming from station blackout. The issue is of concern for both pressurized water reactors (PWRs) and boiling water reactors (BWRs). There is no requirement currently for plants to be able to cope with a station blackout. Existing requirements for offsite and onsite ac power systems are in General Design Criterion (GDC) 17, " Electric Power Systems," of Appendix A to Part 50 of Title 10 of the Code of Federal Regulations (10 CFR 50). They are discussed in Sections 8.2, "Offsite Power Systems," and 8.3.1, "AC Power Sys-tems (Onsite)," of the NRC's " Standard Review Plan for the Safety Review of Nuclear Power Reactors" (NUREG-0800).Testing of emergency diesel generators is discussed in Regulatory Guide (RG) 1.108, " Periodic Testing of Diesel Gen-erator Units Used as Onsite Electric Power Systems at Nuclear Power Plants." Separation and independence of electric power systems are discussed in RG 1.6,
" Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems," and RG 1.75, " Physical Independence of Electric Systems."
SRP Sections 8.3.1 and 9.5.4 through 9.5.8 discuss maintenance and design provisions for the onsite emergency diesels. These licensing requirements and guidance are directed at providing reliable offsite and onsite ac power.
- Analysis has shown that for postulated station blackout events, the difference between the estimated frequency of core damage and core melt is small because of the relatively low probability of recovering ac power and terminating an accident sequence after initial core damage, but before full core melt (NUREG-1032).
NUREG-1109 2 i
)
- ~ ~
Q.i. a -] s1 8 t 2 Experience has shown that there are practical limits in ensuring the reliability q L of offsite'and onsite emergency ac power systems. Analyses show that core damage frequency can be significantly reduced if a plant can withstand a total i loss-of ac power until either offsite or onsite emergency ac power can be restored. 2 OBJECTIVES E
'The general objective of the requirements to resolve USI A-44 is to reduce the risk of severe accidents associated with station blackout by making station blackout a relatively small contributor to the average frequency of core damage for the total population of plants. . Specific actions called for in the resolu- I tion include: (1) maintaining highly reliable ac electric power systems; (2) de-veloping procedures and training to restore offsite and onsite emergency ac power. ,
snould either one or both become unavailable; and (3) as additional defense-in-l
' depth, ensuring that plants can cope with a station blackout for some period of .l time based on the probability of occurrence of a station blackout at the site -
as well as on the capability for restoring power for that site. i 3 ALTERNATIVE RESOLUTIONS I In developing the resolution of USI A-44, the staff considered four specific alternative courses of action. These are discussed below. 3,1 Alternative (i) To achieve the objectives stated in Section 2 above, the resolution of USI A-44 calls for specific guidance relating to the reliability of offsite and onsite emergency ac power systems, as well as a requirement that plants be able to cope with a station blackout for a specific duration. A summary of the recommenda-tions to resolve this issue is as follows: (i) 'The reliability of the onsite emergency ac power sources should be main-tained at or above specified acceptable reliability levels. NUREG-1109 3
1 l
/
(ii) Procedures and training should be developed to restore emergency ac power and offsite power using nearby power sources if the emergency ac power system and the normal offsite power systems are unavailable. (iii) Each nuclear power plant should be able to withstand and recover from a station blackout lasting a specified minimum duration. A regulatory guide entitled " Station Blackout"* provides a method for determining an acceptable plant-specific station blackout duration based on a comparison of a plant's characteristics to those factors that have been identified as the main contributors to risk from station blackout. These factors include: (1) the redundancy of onsite emergency ac power sources (number of sources available for decay heat removal minus the number needed for decay heat removal), (2) the reliability of onsite emergency ac power sources (usually diesel generators), (3) the frequency of loss of offsite power, and (4) the probable time to restore offsite power. The frequency and duration of loss of offsite power are related to grid and switchyard reliability, historical weather data for severe storms, and the avail-ability of nearby alternate power sources (e.g., gas turbines). The staff has concluded (NUREG-1032) that long-duration offsite power outages are caused primarily by severe storms (e.g., hurricanes, ice). (iv) Each nuclear power plant should be evaluated to determine its capability to withstand and recover from a station blackout of a duration as deter-mined in (iii) above. This evaluation should include such considerations as: Verifying the adequacy of station battery power, condensate storage tank capacity, and plant / instrument air for the duration of a station blackout. Verifying the adequacy of reactor coolant pump seal integrity for the i duration of a station blackout.. This should be done by demonstrating, via experiment and/or analysis, that seal leakage due to a lack of
- Single copies of this guide may be obtained by writing to the Distribution Ser-vices, Division of Information Support Services, USNRC, Washington, DC 20555.
NUREG-1109 4
p
- 1. '
'n f i
seal cooling will not reduce the primary system coolant inventory to the degree that the ability to cool the core during station blackout is lost. Verifying that the equipment needed to operate during a station black-out and the recovery from the blackout will be able to operate under the environmental conditions associated with a total loss of ac power (i.e., loss of heating, ventilation, and air conditioning). (v) If the plant's station blackout capability (as determined in (iv)) is significantly less than the minimum acceptable plant-specific station blackout duration determined in (iii), modifications to the plant may be necessary to increase the time the plant is able to cope with a station blackout. The regulatory guide identifies specific factors to be consid-ered if such modifications are necessary. (v1) Each nuclear power plant should have procedures and training to cope with a station blackout and to restore normal long-term decay heat removal once ac power is restored. Because there is no requirement for plants to be able to withstand a loss of both the offsite and onsite emergency ac power systems, the resolution calls for rulemaking to require that all plants be able to cope with a station black-out for a specified duration. The regulatory guide describes a method acceptable to the NRC staff for complying with the rule, and specifies guidance on providing reliable ac electric power supplies. Plants with an already low risk from station blackout are required to withstand a station blackout for a relatively short period of time. These plants probably need few, if any, modifications as a result of the rule. Plants with currently higher risk from station blackout are required to withstand blackouts of somewhat lenger duration, and, depending on their existing capability, may require modifications (such as increasing station battery capacity or condensate storage tank capacity). The staff has determined that these modifications are cost-effective in terms of reducing risk to the public. NUREG-1109 5
E J . . The method to determine an acceptable station blackout duration capability, as presented in the regulatory guide, is summarized below. The guide specifies minimum acceptable blackout durations which a plant should be capable of surviv-ing.
- The minimum duration is from 2 to 16 hours (see Table 1) depending on a plant's design and site related characteristics. Most plants would fall in either the 4 or 8-hour group. Licensees may propose durations different from
! those specified in Table 1. Such proposals should be based on plant specific factors relating to the reliability of ac power systems, such as those discussed I in NUREG-1032, and would be reviewed by the NRC staff. 1 Tables 2 through 7 provide the necessary detailed descriptions and definitions of the various factors used in Table 1. Table 2 identifies different levels of redundancy of the onsite emergency ac power system used to define the emer-gency ac power configuration groups in Table 1. Table 3 provides definitions of the three offsite power design characteristic groups used in Table 1. The groups are defined according to various combinations of the following factors: (1) independence of offsite power (I), (2) severe weather (SW), (3) severe weather recovery (SWR), and (4) extremely severe weather (ESW). The definitions of the factors I, SW, SWR, and ESW are provided in Tables 4 through 7, respec-tively. After identifying the appropriate groups from Tables 2 and 3 and the reliability level of the onsite emergency ac power sources, Tabh.1 can be used to determine the minimum acceptable station blackout duration capability (e.g, 4 or 8 hours) for each plant. The reliable operation of the onsite emergency ac power sources should be ensured by a reliability program designed to monitor and maintain reliability over time at a specified acceptable level and to improve the reliability if that level is not achieved. One example of an application of this method considers a nuclear power plant that has (1) two diesel generators, one of which is required for ac power for decay heat removal systems; (2) one switchyard and one alternate offsite power circuit, in addition to the normally energized offsite circuit to the Class 1E ' buses; (3) an estimated frequency of loss of offsite power due to severe weather of .005 per site year; and (4) an annual expectation of storms at the site with winds greater than 125 miles per hour of 0.002 per year. On the basis of this information, this plant is in independence-of offsite power group I3 (see Table 4), severe-weather group SW2 (see Table 5), severe-weather-recovery group SWR 2 (no enhanced recovery for severe weather, Table 6), and extremely-severe-weather group ESW3 (see Table 7). This combination of factors places the plant NUREG-1109 6
Table 1 Acceptable Station Blackout Duration Capability (hours)a Emergency AC Power Configuration Group D A B C D Maximum EDG Failure Rate Per Demand Offsite Power Design Characteristic Group c 0.025 0.05 0.025 0.05 0.025 0.05 0.025 P1 2 2 4 4 4 4 4 o P2 4 4 4 4 4 8 8 P3 4 8 4 8 8 16 8 ' a Variations from these times will be considered by the staff if justification, including a cost-benefit analysis, is provided by the licensee. The methodol-ogy and sensitivity studies presented in NUREG-1032 (Ref. 2) are acceptable for use in this justification. b See Table 2 to determine emergency ac power configuration group. c See Table 3 to determine groups P1, P2 and P3. 7 i L_____----_-----
a Table'2 Emergency AC Power Configuration Groups a Emergency AC (EAC) NumbergfEACPower Power Configuration Number of EAC Power Sources Sources Group RequiredtoOperateAC-Powgred Decay Heat Removal Systems A d 3 y 4 1 B 4 2 5 2 C d y 2' 3 1 D I 2 1 3 2 4 3 ' 5 3 a Special purpose dedicated diesel generators, such as those associated with high pressure core spray systems at some BWRs, are not counted in the determination of EAC power configuration groups. b If any of the EAC power sources are shared among units at a multi-unit site, this site.is the total number of shared and dedicated sources for those units at the c This number is based on all the ac loads required to remove decay heat (including AC powered decay heat removal systems) to achieve and maintain hot shutdown at all units at the site with offsite power unavailable. d For EAC power sources not shared with other units.
'For EAC power sources shared with another unit at a multi-unit site.
I For shared EAC power sources in which each diesel generator is capable of pro- I viding ac power to more than one unit at a site concurrently. I 8
- 4 Table 3 Offsite Power Design Characteristic Groups Group Offsite Power Design Characteristics Sites that have any combination of the following factors:
I" SW b SWR c ESW d P1 1 or 2 1 or 2 1 or 2 1 or 2 1 or 2 1 1 or 2 3 1 or 2 3 1 1 or 2 P2 All other sites not in P1 or P3. Sites that have experienced, or could be expected to experience, a total loss of offsite power due to grid failures at a frequency equal to or greater than once in 20 site years; unless the site has procedures to recover ac power from reliable alternate (non-emergency) ac power sources within approximately one-half hour following a grid failure. 9.!' Sites that have any combination of the following factors: P3 I SW SWR ESW Any I 5 2 Any ESW Any I 1,2,3, or 4 1 or 2 5 Any I 5 1 Any ESW Any I 4 2 1,2,3 or 4 1 or 2 3 2 4 3 3 2 3 or 4 b
"See Table 4 for definitions of independence of offsite power groups (I) c See Table 5 for definitions of severe weather groups (SW) h
.d See-Table 6 for definitions of severe weather recovery groups (SWR)
See Table 7 for definitions of extremely severe weather groups (ESW) 9 l
t ne oro r e) mtt a emaeE uda nd ft o eEr f o sa cI og m h g h o gcs oumd . p1 e. otl n uar user ti so u s eso er eaue b h us Fit u i e rre sru c et os e h u o o yh coorcysat nt Eh sacnt a r rl t rn erl a a real 1t r l ri h hl u ef ul l 3 e unma oo erC u f e t t at d oenroaC f or sot e oeor cn n sroesup e E s stf wesc e t ti e a a nern O sno . s a aoh rew) 3 n nrs l d rah ug l i l d ptd uv a at e aenoemt igi a td e Cee eoirl l l cr mrat w s meuec t cff rst ea p pep re o ,oF e rrb rr oe ru ecroor h eu af u l e oh ssp)t d edt sn e eer nt rr O n nh reo t norrf enna h t h t e2 e eeeNsis
,fft(t i e t ef s f e f o nseeeream ff rrsr r h sssi i nh h ssrr ocrssp eetf o oae tl nnsncwt tl npe enn f r t t r i aaf ero i a w l ewaae epe r su f arrf pihf f aroo l rorrn reh d o ddg Iftt oocso Iftt p A a pt t o prt e eri t t aF c cy e eh n o r .
n nci rs t e - - ) n nt r ei V w h e . o ois e , m mk r s eo cre c cwd w sl r1 o- e r rp et pr sr ocl a e o r9 w ee a hi eu e e a pil uot f e nf6 ocft e T wrt r rey t anti s r g pi s i tt ( s a I a ahh caf a sl nui re t ns ii c se t c am msf aagseh caaf nsi .Vif s
. s s t oe ef uri eft amrf uf t sk e edi l t cecontFd s ) ot o f ae 2n p c cnw aurrr a- no ft aomc8 g u
e 2 r u ras u mauouemon r omot satl. tii r a oul e aat or3 ei net u1 rs r o o ,V oes saeu h t ru e ua it uo ue G s ssk nn r nh aet en cenn a a s o gd d - osorrT c ema rnar sr wi r e r rr8 e i ee( erfh rm uome o eaertF s e ea3 d h sh ewt h u ot o t s ph e n ih
.t o w w w y1 tit nol f e I ssol uet wen o od, oh a opa s etsb E i na . b s ohi t P pr a
pcd t n f ef sm v pn l aet re s E oe rpt e orI ef reoVi ead s f t e y eia e b oocrkt crl mruoc r Ittf oe o t h t w sh rf - axt u reb f ot c i i c i s- ) st . ysd u 9t e- o oh d u sda r e f s I f s t i s f e4 e 5 . lo ,rareor6 emerse n e et ow nt reo ers se at seeoi rru v f f w f r3 r ef f r f es rue e ,f r l ceff s t 4 O o s oo u rcsesersh e uac h sser tl nf e Cecss a met ernrnf ent r t r nrnnd t e o f l e n l h a t uaearwa paeu f arro l aew enuaar n l l rT e f orh reoroe eh o h oorra e l A o Ao(f Asttt pptt r ft s Ift pp T cstt y s b e a c T n e et f d n t a a e v f - ome-) oh e e p rt au eVt i r e oeoert ct cf re.pr d e ge h pb s h k a w erur oeu
- t o cuaurt rt n r u s ,i t 9 n pcro oe a I
a o ssf6 e i usnsf rse r reeo s ct o a seif f o s h onc t e aasd rnm e t irt nr) m esear1 n c sl unep f od rih ro g s n r t d u n rnsdnrr oed ee. ot er ureeo ttf ei srs o o a ao ne u earf rnenue it sl yi c e p s t c eeeah a gd ph sapeia rnf rh T ri i r cs ed e uaept o(tF s n e e ti edn1f r o r ,t - i i 1 w h i mh ni o ssps onh f a o t wsti en i i sr . tit p sn erg l ahl eru D o af yh ui ae tif eaef t e t erolT gs rt l(i e mro retff noV r asw co o i d mgnc ea Fd oh I apk ue s e nt r rr - ov f t noi . ns e e1 si f c o e omtt r ri rsii e ,f .et w t6 t h h ssroci1Va n osceet tl nepis kt l n ocaeh n iaw tf e- n l o wnel tif f arof af h9 e _. A c til eol o Ift pomot6s
~
[ r g 9 es we oc spr re u esco f uas sb n f p aE ou e r1 k t t ec i scal s l s rbi f f aau a ul oef o nC sh a t r f mel e o h anw s dt meo ee n rh p cc nr arow on e eu cf dt y d o i eni r ns t sh as o : aet f g rr mm sf e ee oenl o t d w th ei a C no uch af I S Aswf o j j
x . . s Table 5 Definitions of Severe Weather Groups (SW) Estimated frequency of loss of offsite power due SW, Group severe weather, fa (per site year) I f < 0.003 2 0. 003 1 f < 0. 010 3 0.010 i f < 0.030 4 0.030 $ f < 0.10 5 0.10 5f ? a The estimated frequency of loss of offsite power due to severe weather, f, is determined by the following equation: f = (1.3 x 10~4)h1 + (b)hp + (0.012)h3 + (c)h4 where hy = annual expectation of snowfall for the site, in inches, h annual expectation of tornadoes (with wind speeds greater than 2 = or equal to 113 miles per hour) per square mile at the site, b = 12.5 for sites with transmission lines on two or more rights of-way spreading out in different directions from the switchyard, or b = 72.3 for sites with transmission lines on one right-of-way.
, h annual expectation of storms at the site with wind velocities 3 = between 75 and 124 mph, and h4 = annual expectation of hurricanes at the site c = 0 if switchyard is not vulnerable to salt spray c = 0.78 if switchyard is vulnerable to salt spray The annual expectation of snowfall, tornadoes, and storms may be obtained from National Weather Service data from the weather station nearest to the plant or by interpolation, if appropriate, between nearby weather stations. The basis for the empirical equation for the frequency of loss of offsite power due to severe weather, f, is given in Reference 2, Appendix A.
I l Il I
~ .
Table 6_ Definitions of Severe Weather Recovery Groups (SWR) , 1 Definition SWR Group Sites with enhanced recovery (i.e., sites that have 1 the capability and procedures for restoring offsite (non-emergency) ac power to the site within 2 hours following a loss of offsite power due to severe weather.) Sites without enhanced recovery. 2 i iz { i i
-_--___-_---_---_________________J
Table 7 Definitions of Extremely Severe Weather Groups (ESW) Annual expectation of storms at a site with wind velocities equal to or greater than 125 miles ESW Group per hour (e)* 1 e < 3 x 10 -4 2 -3 3 x 10'4 5 e < 1 x 10 3 1 x 10 -3 5 e < 3 x 10 -3 4 3 x 10 ~3 5 e < 1 x 10 -2 5 1 x 10 -2 i, The annual expectation of storms may be obtained from National Weather Service data from the weather station nearest to the plant, or by interpolation, if appropriate, between nearby weather stations. I 13
. f.
I" d il JL d n 69 kV 161 kV 345 kV 5 MM%M v AA%AMA M%i%M MMAMA MMMM #% MM AUTOMATIC gg yg
. MAIN TRANSFER GENERATOR
~
-----+
~
1r 1r 57 37 NO AUTOMATIC } NC NC TRANSFER 7 y NO CLASS 1E NONSAFETY CLASS 1E NONSAFETY I h g_ AUTOMATIC TRANSFER h,f I I (, AUTOMATIC TRANSFER _ j i Figure 1. Schematic diagram of electrically independent transmission line i 14
. _ . .. n,_w .
1 l (1
)
. l 1
i l b Il L Il db JL ik JL ji E E F luskv 13a kv g E nw mm am na nw AAAA AAAA 1r 1r 1r 1r 1r 1r NC NC . NONSAFETY NO NONSAFETY NO MAIN CLASS 1E CLASS 1E CLASS 1E CLASS 1E GENERATOR . DIVISION 1 DIVISION 2 DIVISION 1 DIVISION 2 i I A 4 l l l i g _ _ _AU_TO_M A_TI_C T_R A_NS_F E R_ _ _ y _ _ _ _ _ _ _ _ _ J L _ _ _ _ _^2TSMSLc I,RA,NS,[ER , , j , , j Figure 2. Schematic diagram Of two SwitchyardS electrically connected (One-unit Site) (F
1 1 i I \ b h h h h j: 500 kV ll 230 kV
- +:
MM I MMMM MM MM MM MM MMMM If If If If If l' If If GENERATOR 2 NC NC NC TO NC TO NC TO NC TO NC NC GENERATOR 1 NONSAFETY SOME SOME SOME SOME NONSAFETY UNIT 2 UNIT 2 UNIT 2 UNIT 1 UNIT 1 UNIT 1 CLASS 1E CLASS 1E CLASS 1E CLASS 1E BUSES. BUSES. BUSES, BUSES, NO TO NO TO NO TO NO TO OTHERS OTHERS OTHERS OTHERS Figure 3. Schematic diagram of two Switchyards electrically connected (two-unit Site) l 16
in offsite power-design-characteristic group P2 (see Table 3). Based on the number of diesel generators, the plant is in emergency AC power configuration group C. As indicated on Table 1, if the failure rate of each emergency diesel generator is maintained at 0.025 failure per demand or less, this plant should have the capability to withstand and recover from a station blackout lasting 4 hours or more. If the failure rate of each emergency diesel generator were between 0.025 and 0.05, the acceptable station blackout duration would increase to 8 hours. If the emergency diesel generator ' failure rate were greater than 0.05, then steps should be taken to improve the diesel generator reliability.
- 3. 2 Alternative (ii)
Alternative (ii) would treat plants uniformly by requiring all plants to be able to cope with station blackout of the same duration. 3.3 Alternative (iii) Alternative (iii) would require plants with the highest potential risk from sta-tion blackout to add either an additional emergency diesel generator or another ac-independent decay heat removal system. 3.4 Alternative (iv) ' i The Nuclear Utility Management and Human Resources Committee (NUMARC) endorsed I the following industry initiatives to resolve the station blackout issue . (letter from J. Miller to N. Palladino, 1986): 1
- 1. Each utility will review their site (s) against the criteria specified in NUREG-1109, and if the site (s) fall into the l category of an eight-hour site after utilizing all power sources available, the utility will take actions to reduce the site (s) contribution to the overall risk of station blackout. Non-hardware changes will be made within one year. Hardware changes will be made within a reasonable i l
time thereafter.
- 2. Each utility will implement procedures at each of its site (s) for: {
NUREG-1109 17 l l (
e . I
- a. coping with a station blackout event,
- b. restoration of AC power following a station blackout event, and c.
' preparing the plant for severe weather conditions, such as hurricanes and tornados to reduce the likelihood and consequences of a loss of offsite power and to reduce the overall risk of a station blackout event.
3. Each utility will, if applicable, reduce or eliminate cold fast-starts of emergency diesel generators for testing through changes to technical specifications or other appropriate means. 4. Each utility will monitor emergency AC power unavailability utilizing data utilities provided to INP0 [ Institute of Nu-clear Power Operations] on a regular basis. These initiatives include some of the same elements that are included in the staff's resolution discussed in Section 3.1. However, the industry initiatives (1) do not include rulemaking, (2) do not require plants to be able to withstand a station blackout for a specified period of time, and (3) do not require any specific assessment of a plant's station blackout coping capability.
- 3. 5 Alternative (v)
Under this alternative no action would be taken. t 4 CONSEQUENCES 4.1 Costs and Benefits of Alternative Resolutions 4.1.1 Alternative (i) The benefit from implementing the station blackout rule and regulatory guide is a reduction in the frequency of core damage due to station blackout and the associated risk of offsite radioactive releases. The costs are primarily those incurred by industry (1) to assess the plant's capability to cope with a station blackout, (2) to develop procedures, (3) to improve diesel generator reliability if the reliability falls below certain levels, and (4) to retrofit plants with additional components or system, as necessary, to meet the requirements. These are discussed in the following paragraphs. NUREG-1109 18
(1) Value: Risk Reduction Estimates To estimate the change in expected risk that the resolution of USI A-44 could effect, both the postulated radioactive exposure (in person-rems) that would result in the event of an accident and the reduction in frequency of core damage have been estimated. A simplified method to estimate public dose for value-impact analysis would use an " average" plant to estimate the consequences of station blackout and subsequent core damage for all plants. However, using a single value does not account for the differences in offsite consequences asso-ciated with differences in the sizes of reactors and with differences in the population densities around different sites. Because of the differences between sites and plant designs, it was not realistic l to select a " typical" plant for analysis (using the value and impacts for that plant and then multiplying them by the total number of plants) to obtain an overall value-impact ratio. Instead, the staff used the method described below to estimate offsite consequences for use in this value-impact analysis. Results indicate that consequences range from 0.5 to-9 million person-rems per plant, with an average of about 2 million person-rems per plant. NUREG/CR-2723 gives estimates of offsite consequences of potential accidents at > nuclear power plants. That report includes results of calculations for 91 sites in the United States that had reactors with operating licenses or construction permits. The actual distributions of population around the sites were used in calculating estimated total population doses (in person-rems) for various fission product releases. The results include a scaling factor to account for different reactor power levels at the various sites. The scaled results (from NUREG/CR-2723) for release category SST1* (siting source term) were used to develop estimates of site-specific consequences for station
*Five release categories, denoted as SST1-SSTS, have been defined by NRC to represent a spectrum of five accident groups. Each category represents a different degree of core degradation and failure of containment safety features.
Group 1, SST1, is the most severe and involves a loss of all installed safety 3 features and direct breach of containment. NUREG-1109 19 i
o e blackout events. However, these results were not used directly in the value-impact analysis for several reasons. First, SST1 overestimates the fission product release for station blackout events. Second, the consequences given in NUREG/CR-2723 include the entire population around the plant (i.e., an infinite j radius), whereas Enclosure 1 of NRR Office Letter No. 16 (NRC, 1986) specifies that a 50-mile radius around the plant is to be used to calculate risk reduction estimates for value-impact analyses. Extensive research efforts by NRC and industry have been under way since about 1981 to evaluate severe accident source terms and are reported in NUREG-0956, NUREG-1150, NUREG/CR-4624, and Industry Degraded Core Rulemaking (IDCOR) tech-nical reports. Based on NRC's source term research, it appears that, for sta-tion blackout events, the release fractions for most plants would be roughly 1/3 to 1/30 of the releases from the SST1 estimate. One reason for this reduc-tion is that SST1 is an estimated upper bound assuming prompt containment failure; whereas if a core melt resulted from station blackout, containment failure would ' be delayed for a number of hours. Results of a sensitivity study in which the consequences of a severe accident were estimated for reduced source terms indi-cate that if the SST1 release fraction were reduced by a factor of 3 (i.e. , 66 percent reduction in SST1 releases), the consequences in terms of person-rem would be reduced by about 50 percent (NUREG/CR-2723, Table 10). Likewise, if the SST1 releases were reduced by a factor of 30 (i.e., 97 percent reduction in SST1 releases), the estimated person-rem would be reduced by about 85 percent. Therefore, the high and low estimates for person-rem consequences for station blackout accidents used in this value-impact analysis are 0.5 and 0.15 of the person-rem associated with SST1 releases, respectively. (These values correspond to reductions in SST1 release fractions by factors of 3 and 30 respectively.) A value of 0.33 of the SST1 person-rem was used as a best estimate for purposes of this analysis. Scaling factors comparing offsite exposures within a 50-mile radius of a plant to that for an infinite radius are included in Table 3 of Sandia (1983). The total person-rem exposure within a 50-mile radius is approximately 1/4 the person-rem exposure for an infinite radius. This factor, in addition to the factor discussed above associated with reduced source terms, was used to scale the site-specific results from NUREG/CR-2723. t NUREG-1109 20
l
)
To clarify the discussion above, an example calculation is given for an 845-MWe PWR (Calvert Cliffs). From Appendix A of NUREG/CR-2723, the mean offsite effects conditional on release for the SST1 category is 3.61 x 107 person-rems. 1 This number is multiplied by 0.33 to account for the smaller releases for sta-tion blackout events compared to SST1 releases and by 0.25 to account for the ( 50-mile radius (Sandia, 1983). The resulting offsite exposure from a station i i blackout event and subsequent core melt within a 50 mile radius of the plant is estimated to be about 3 million person-rems. The reduction in frequency of core damage resulting from the resolution of USI A-44 was estimated for each plant. Plant- and site-specific characteristics for a total of 100 reactors (which represent almost all of the currently operat-ing nuclear power plants) were used to develop these estimates. Table 8 presents an estimate of the number of reactors having the emergency ac power configurations and offsite power design characteristics identified in Tables 2 and 3 respec-tively. The estimate of core damage frequency for each plant was based on a function of the plant's ability to cope with a station blackout (NUREG-1032). The staff assumed that all plants, as currently designed, can cope with a sta-tion blackout for 2 hours. The reductions in core damage frequency per reactor-year for each plant then was estimated based on plants meeting the acceptable 2 , 4 , or 8-hour station blackout duration depending on the plant's offsite power design group and its emergency ac power configuration (given in Table 1). Examples of the reduction in frequency of core damage per reactor year for three cases are presented in Table 9. Each of these examples is for a plant located in an area with average loss of offsite power duration and frequency. The first example is typical of a plant with one redundant emergency ac power system (e.g. , one out of two diesel generators required for emergency ac power), and a failure rate of 0.025 failure per demand for each diesel generator. The second case, which is typical of a plant with less desirable characteristics from a station blackout perspective (e.g., a minimum redundant emergency ac power system and below average diesel generator reliability), has a reduction in freauency of core damage that is significantly larger than the first example. The third case is for plants with more favorable characteristics than the first case and, therefore, a correspondingly lower reduction in core damage frequency. NUREG-1109 21 i
- - - _ _ _ _ _ _ - _ _ _ _ _ _ _ . - - _ - _ - - - - - - - - - - - -^
Table 8 Estimated number of' reactors having similar characteristics Emergency ac power configuration group
- Group A B C D Total Estimated number 12 25 47 16 100 of reactors Offsite power design characteristics **
Characteristic P1 P2 P3 Total Estimated number 30 60 10 100 of reactors
*See Table 2 for definition of emergency ac power con-figuration groups. _
**See Table 3 to determine offsite power design charac- i teristics.
Table 9 Examples of reduction in frequency of core damage per reactor year ( j Estimated core damage Estimated reduction in Plant frequency per characteristics core damage frequency reactor year per reactor year Plant with one of two 3.9 x 10 5 with 2-hour 2.1 x 10 s emergency diesel generators station blackout (EDGs); EDG failure rate of capability 0.025 failure per demand; i I and loss of offsite power 1.8 x 10 5 with 4-hour
- design characteristic station blackout group P2. capability Plant with two out of three 9.0 x 10 s with 2-hour 8.4 x 10 5 EDGs; EDG failure rate of station blackout 0.05 failure per demand; and capability loss of offsite power design characteristics group P2. 0.6 x 10 5 with 8-hour
- l station blackout capability :
l Plant with one out of three 1.0 x 10 5 with 2-hour 0.6 x 10 5 EDGs; EDG failure rate of station blackout l' O.025 failure per demand; capability and loss of offsite power design characteristics 0.4 x 10 5 with 4-hour
- group P2. station blackout capability
*These times are the acceptable station blackout durations from Table 1 for these example cases.
NUREG-1100 22
A summary of the results of the analysis for station blackout core damage fre-quency estimates is presented in Figure 4. This figure presents a comparison of the estimated number of reactors versus various levels of core damage frequency before and after implementation of the station blackout rule. The histogram that represents estimates before the rule is implented is based on the assump-tion that all plants have the capability to cope with station blackout for only 2 hours. The estimated mean core damage frequency for this case is 4.2 x 10 5 1 per reactor year, with a range of from about 0.4 x 10 5 to 30 x 10 5 per reactor-year. The mean core damage frequency for all plants after the rule is implemen- ! ted is estimated to be 1.6 x 10 5 per reactor year with a range of 0.3 x 10 6 to 7 x 10 5 per reactor year. Therefore, on an industry-wide basis, the estimated mean core damage frequency would be reduced by 2.6 x 10 5 per reactor year. For each plant the estimated risk reduction from the resolution of USI A-44 was cal-culated by multiplying the reduction in core damage frequency per reactor year by two factors: (1) the remaining life of the plant (assumed to be 25 years), and (2) the estimated public dose (in person-rems) that would result in the event of an accident. The reduction in person-rem for each plant was then summed to calculate the total estimated risk reduction. The high estimate of total i dose reduction (based on SSTI release fractions divided by three) is 215,000 person-rem; the low estimate (based on SST1 releases divided by 30) is 65,000 person rem, and the best estimate is 143,000 person-rems (based on SSTl releases divided by 10). (2) Impacts: Cost Estimates The cost for licensees to comply with the requirements to resolve USI A-44 will vary depending on (1) the existing capability of each plant to cope with a sta-tion blackout and (2) the plant-specific acceptable minimum station blackout coping duration as determined from Table 1. The staff anticipates that the ma-jority of plants would be able to meet a 4-hour duration guideline without major hardware modifications. In addition to being able to withstand a 4-hour black-out, some plants may be capable of coping for longer periods without major modi-fications. To meet an 8-hour guideline, licensees of some plants may have to increase the capacity of one or more of the following systems: station batteries, condensate storage tank, and instrument or compressed air. Shedding nonessential NUREG-1109 23
. m$3" CE 8
gm Wi z n0' g
,[x. [N fgz a " x ogs2<
S R MT _ O _ T = C _ A E ~ R - F ei O R '" = E $a B w M w - AmE=igz IECiO" U ot Eo mcn>hF3 N w - _ w "' w+ m~- w %w aI 3 e w-3 'ww e' M ' M E g E 3 M,E 3 3 3 3 x 3 3 3 3 e' e x o g w g e*M*E m- *-
< 9 9 9 9 9 9 9 9 9 9 5 90 4 9 4 9 4 9 4 9 4 9 9 4 9
9 9 9 9 4 0 2 5 3 0 1 1 2 2 3 3 4 4 5 5 6 6 7 1 - - 5 0 - - 0 5 0 5 0 5 0 5 0 5 0 5 0 5 0 1 3 0 1 1 2 2 3 3 4 4 5 0 5 6 6 7 1 gM2> Qm" o>E$m mfCgo<
- 3.m y2 2SQom <S2~ 3 4
- 2gE 8 _
g yzn"i a C x gic5* MI g h oO M= , {
- 5:?Q S
R 8I W = O h T C A E R h w N
==
F aI i " O R h N
- E A m =
B h M U N oI m W == w~ M w=x w aI i s w w h h - ~ w mHmma x o E i m xw e w w w a m mmw m m m x Mg - i g g g g M, -
<90 5
9 9 4.91 1 9 9 4 2 2 9 9 9 4 9 9 9 4.9 9 9 4 9 9 9 4 9 9 9 9 9 4 0 2 5 3 0 - 3 3 4 4 5 5 6 6 7 1 - - 5 0 5 0 5 0 0 5 0 5 0 5 0 5 0 5 0 1 3 0 1 1 2 2 3 3 4 4 5 0 5 6 6 7 1 gM K>f 8 m a>K$m mfCgoj
- 3.* y2 2k.om - <S2~
3eC *O N ago2 or m t
- m1>do2 m O
- Dg>c" g g)4$OO m20 tm3m o OX0CM(4a9 20 D mm zc m N4
loads from the station batteries could be considered as an option to extend the time until battery depletion. Corresponding procedures for load shedding would need to be incorporated in the plant-specific technical guidelines and emergency operating procedures for station blackout. If equipment needed to function during a station blackout or the recovery from a blackout would not be expected to be operable due to environmental conditions associated with the station blackout (i.e., without heating, ventilating and air conditioning estems operating), then some modifications may be necessary. These could be (1) opening room or cabinet doors to increase natural circulation, (2) installing fans that can operate with available power supplies to increase forced circulation, or (3) relocating or replacing equipment. If option 2 or 3 above were necessary, then corresponding procedures would need to be incorpo-rated in the plant-specific technical guidelines and emergency operating proce-dures for station blackout. Those plants that cannot verify adequate reactor coolant pump seal integrity for the station blackout duration may have to provide a method of reactor coolant pump seal cooling that is independent of the offsite and emergency onsite ac power supplies to maintain seal integrity and adequate reactor coolant inventory. For example, the addition of an ac-independent charging pump or a steam-driven generator to power an existing charging pump could provide seal cooling during a station blackout. Table 10 presents cost estimates of possible hardware modifications and procedures that could result from implementation of the station blackout rule. Because
. the duration guidelines in the station blackout regulatory guide are based on plant specific features, and the capability of systems and components needed during a station blackout varies from plant to plant, the modifications in Table 10 may be needed at some but not all nuclear power plants. For each modi-fication, the table identifies an estimated range cf u sts per plant, the esti-mated number of plants needing that modification, eM ne estimated total cost.
The estimated total cost for industry to comply with the resolution of USI A-44 is about $60 million. The estimated average cost per reactor is $600,000. Best estimates of costs could range from $350,000, if only a station blackout assessment, and procedures and training were necessary, to a maximum of about
$4 million if modifications 1 through 4 are needed (including requalification of a diesel generator).
NUREG-1109 25
+ ..
- 't
. Table 10 Estimated costs for industry to comply with the resolution of USI A441 Est. no. Est. cost per of reactors' reactor ($1000) t-Potential needing Best High Est. total cost ($1000)
Low Best High
' modifications modifications est. est.
Low 3. est. est, est. est. 1; Assess plant's capa- 100 250 400 200 bility to cope with 25,000 40,000 20,000 station blackout
- 2. Develap procedures 100 100 150 50 10,000 15,000 and training 5,000
- 3. (a) Improve diesel 10 250 400 150 generator 2,500 4,000 '1,500 reliability (b) Requalify a 2 2,800 5,500 1,250 diesel 5,600 11,000 2,500 generator
- 4. Increase capability
' to cope with sta-tion blackout 2 (a) 4-hour plants 10 500 650 add battery 400 5,000 6,500 4,000 capacity
'(b) 8-hour plants 17 (1) Add com- 40 60 30 pressed 680 1,020 510 air (2) Add con- 80 150 40 1,360 densate 2,550 680 storage tank capacity (3) Add 500 650 400 8,500 11,050 battery 6,800 capacity (4) Replace 80 140 equipment 30 1,360 2,380 510 or add fans Subtotal (8-hour plants) ' 755 1,000 500 11,900 17,000 8,500
- 5. Add an ac-independent --
1,500 charging pump (non-2,5004 1,200 -- -- -- seismic) capable of delivering 50 to 100 gpm to reactor coolant pump seals 8 TOTAL COSTS 60,000 93,500 41,500 NUREG-1109 26
Table 10 (continued) 1 Based on 100 reactors. See Appendix B for worksheets that provide the basis for the cost estimates on this table. 2 Detailed cost estimates for these modifications are presented in NUREG/CR-3840 and revised estimates to that report (Science and Engineering Associates, 1986). 3It is assumed that reactor coolant pump seal integrity is sufficient to ensure core cooling for 8 hours or more; therefore the charging pump would not be necessary. The results of Generic Issue 23 will provide detailed information on expected pump seal behavior without seal cooling. (See Section 4.2 for further discussion.) Estimated costs are provided here for perspective should such a system be considered necessary after GI 23 results are available. 4A seismically qualified and safety grade ac-independent charging pump would be much more exp:nsive and would not reduce the risk substantially more than a non-seismic pump. Including costs of averted plant damage can significantly affect the overall cost-benefit evaluation. To estimate the costs of averting plant damage and cleanup, the reduction in accident frequency was multiplied by the discounted onsite property costs. The following equations from NUREG/CR-3568 were used to make this calculation: gp = NAFU V U = C/m [(e-rti )/r2 3 [1 . e r(t f-t g)3(y_,-rm) where V,p = value of avoided onsite property damage N i
= number of affected facilities = 100 AF
= reduction in accident frequency = 2.6 x 10 5/ reactor year U = present value of onsite property damage C = cleanup and repair costs = $1.2 billion t
f = years remaining until end of plant life = 25 t 9
= years before reactor begins operation = 0 r = discount rate = 10%/5%
m
= period of time over which damage costs are paid out (recovery period in years) = 10 NUREG-1109 27 I
i
1 Using the above values, the present value of avoided onsite property damage is estimated to be $19 million. If avoided costs for replacement power are included , { (estimated in NUREG/CR-3568 to be $1.2 billion over 10 years), the estimated I present value is $38 million. Table 11 summarizes the discounted present value of avoided onsite property damage for 10% and 5% discount rates. I Table 11 Discounted present value of avoided onsite property damage for 100 reactors j Discounted present value Avoided damage 10% discount rate 5% discount rate Cleanup and repair only $19 x 108 $40 x 108 Cleanup, repair, and $38 x 108 $80 x 108 replacement power 4 (3) Value-Impact Ratio Table 12 summarizes the total benefits and costs associated with the resolution of USI A-44. These include (1) public risk reduction due to avoided offsite releases associated with reduced accident frequencies; (2) increased occupational dose from implementation, and operation and maintenance activities, as well as reduced occupational exposure from cleanup and repair because of lower accident frequency; (3) industry costs for implementation of modifications, operation and maintenance, and increased reporting requirements; and (4) NRC costs for review of industry submittals. The estimated total cost for industry to comply with the proposed rule is } $60 million. The total public risk reduction for 100 reactors over the remain-ing life of the plants is about 145,000 person rems. The overall value-impact ratio, nut including onsite accident avoidance costs, is about 2,400 person rem l averted per million dollars. If cost savings to industry from accident avoid-t ance (cleanup and repair of onsite damages and replacement power) were included, l the overall value-impact ratio would improve significantly. At a 10% discount rate, the present value of avoided cleanup, repair, and replacement power is NUREG-1109 28 i
?
{ , . Table 12 Value-impact summary for resolution of USI A-44 Dose reduction (person rems) Cost ($1,000) Best High Low Best High Low Parameter est. est. est, est. est. est. Public health 143,000 215,000 65,000 Occupational exposure (accidental)1 1,500 1,500 1,500 Occupational exposure (routine)2 NA Industry implementation 60,000 93,500 44,500 NRC implementation 3 1,500 1,500 1,500 Total 144,500 216,500 66,500 61,500 95,000 43,000 Value-impact ratio 4 2,400 5,000 700 (Public dose reduction divided by sum of NRC and industry costs (person rems /$106)) IBased on an estimated occupational radiation dose of 20,000 person-rems for post-accident cleanup and repair activities (NUREG/CR-3568). 2 Ho significant increase in occupational exposure is expected from operation and maintenance or implementing the recommendations proposed in this resolution. Equipment additions and modifications contemplated do not require significant work in and around the reactor coolant system and therefore would not be expected to result in significant radiation exposure. NA = not affected. 8 Based on an estimated 175 person-hours per reactor for NRC review (NUREG/CR-3568). 4This does not take into account the additional benefit associated with avoided plant damage costs or replacement power costs resulting from reduced frequency of core damage. The co~st for plant cleanup following a core damage accident is estirrated to be $1.2 billion, and replacement power is estimated to cost about
$_500,000 per day (NRC, 1986). The estimated discounted present value of these {j avoided onsite costs is given in Table 11.
l
}
l NUREG-1109 29 l I
approximately $38 m'illion. If this benefit were taken into account, the overall value-impact ratio would be about 6,100 person-rem averted per million dollars. For any particular plant, the value-impact ratio could vary significantly (either higher or lower) than the ratio given above. However, even for plants that will not require equipment modifications to comply with the station blackout rule, the assessment of plant capability to cope with a station blackout is almost certain to result in improvements in training and procedures to handle such an
)
event. At a ratio of $1,000 per person-rem, a decrease in core damage frequency j of only about 0.5 x 10 6 per reactor year is sufficient to justify a cost of )
$350,000 for the. station blackout assessment, procedures and training. Improve-ments to enhance the capability of a plant to cope with a station blackout from ;
2 to 4 hours would effect such a reduction in core damage frequency for virtually all plants. (4) Special Considerations
, The quantitative value-impact analysis discussed above used estimates for benefits (risk reduction) and costs associated with the resolution of USI A-44.
While this is a useful approach to evaluate the resolution, other factors can and should play a part in the decision-making process. Although they are not quantified, other considerations that bear on the overall conclusions and recom-mendations to resolve USI A-44 are discussed below. Overall, these considera-tions support the conclusion that additional defense in depth provided by the ability of a plant to cope with a station blackout for a specified duration is strongly recommended. Relative Importance of Potential Station Blackout Events l Probabilistic risk assessment (PRA) studies performed for this USI, as well as a number of plant specific PRAs, have shown that station blackout can be a sig-nificant contributor to core damage frequency, and, with the consideration of containment failure, station blackout events can represent an important contri-butor to reactor risk. In general, active containment systems required for NUREG-1109 30
8 heat removal, pressure suppression, and radioactivity removal-from the contain-
. ment atmosphere following an accident are unavailable during a station black-out.
Therefore, the offsite risk is higher from a core melt resulting from station blackout than it is from many other accident scenarios. a Source Term Re-Evaluation The consequence estimates for station blackout used in this value-impact analysis are consistent with the latest research by NRC on source term re evaluation. The release fractions used in this analysis are significantly lower than earlier estimates of source. terms. Nevertheless, there is still considerable uncer-tainty, and source term research is expected to continue in the future to improve our knowledge of major phenomena and refine analytical models. Given the range of release fractions used in this unalysis, it is unlikely that significantly better estimates agreed to by the staff and industry would be available for a number of years. In any event, the ability to cope with a station blackout for some period of time would make station blackout a small contributor to core damage frequency and would significantly reduce the risk associated with such events. Future Trends in Loss of Offsite Power Frequency The estimated frequency of core damage from station blackout events is directly proportional to the frequency of the initiating event. Estimates of station blackout frequencies for this USI were based on actual operating experience with credit given in the analysis for trends that show a reduction in the frequency of losses of offsite power resulting from plant-centered events (NUREG-1032). This is assumed to be a realistic indicator of future performance. An argument can be made that the future performance will be better than the past. For example, when problems with the offsite power grid arise, they are fixed, and therefore, grid reliability should improve. On the other hand, grid power failures may become more frequent because fewer plants are being built, and ' more power is being transmitted between regions, thus placing greater stress on transmission lines. NUREG-1109 31
Trends in Emergency Diesel Generator Performance Recent data indicate that average emergency diesel generator reliability on an industry-wide basis has been improving slightly since 1976 (NUREG/CR-4347, NSAC/108). These data are based on total valid failures and total valid starts including surveillance testing and unplanned demands (e.g., following a loss of : offsite power). There are an insufficient number of unplanned demands at any one nuclear plant to determine diesel generator reliability with high statistical confidence. Therefore, target diesel generator performance levels for USI A-44 are based primarily on surveillance tests. However, data show that the industry average diesel generator failure rate during unplanned demands was higher than that during surveillance tests (0.014 failure per demand for surveillance tests , compared to 0.022 failure per demand during unplanned demands (NSAC/108)). Using diesel generator reliability based only on unplanned demands would lead to slightly higher estimates of core damage frequency than was used in this regulatory analysis and, therefore, a correspondingly larger estimated benefit resulting from the resolution of USI A-44. Common Cause Failures One factor that affects ac power system reliability is the vulnerability to com-mon cause failures associated with design, operational, and environmental factors. Existing industry and NRC standards and regulatory guides include specific design criteria and guidance on the independence of offsite power circuits and the in-dependence of, and limiting interactions between, diesel generator units at a nuclear station. In developing the resolution of USI A-44, the NRC staff assumed that, by adhering to such standards, licensees have minimized, to the extent practical, single point vulnerabilities in design and operation that could result in a loss of all offsite power or all onsite emergency ac power. Results of sensitivity studies presented in NUREG-1032 indicate that if potential common cause failures of redundant emergency diesel generators exist (e.g., in service l water or dc power support systems), then estimated core damage frequencies can increase significantly. j l NUREG-1109 32 1
Sabotage There have not been any total losses of offsite power or diesel generator fail-ures attributed to sabotage. Therefore, sabotage was not considered explicitly in the risk analysis for USI A-44. However, there was a sabotage event in 1986 that caused three out of four 500-kV transmission lines at one site to be out of service for several hours. Thus sabotage could increase the probability of l loss of offsite power. If saboteurs managed to simultaneously take out all offsite power and/or emergency diesel generators, the resolution of USI A-44 would provide additional defense-in-depth for a period of time to cope with such an event. 4.1.2 Alternative (ii) The alternative of treating plants uniformly by requiring all plants to be able to cope with the same station blackout duration has been considered. This simplified approach has the advantage of being potentially easier to implement, but it also has two major drawbacks. First, operating nuclear power plants have significant differences in plant- and site-specific factors that contrib-ute to risk from station blackout. This alternative would not take these known factors into account. For example, plants that have a more redundant emergency ac power system than other plants would not be given any credit for such features. Second, requiring all plants co be able to cope with the same blackout duration would result in one of two undesirable alternatives: (1) If a uniform duration of 4 hours or less were recommended, station blackout could still be a signif-icant contributor to total core damage frequency for some plants and, therefore, the objective of the requirements would not be met; and (2) if a uniform 8-hour requirement were imposed, it would necessitate expenditures at some plants that would not be considered cost-effective in reducing the risk from station blackout events. Therefore, this alternative was not recommended. 4.1.3 Alternative (iii) Another possible alternative to the recommended action is to require plants to install either an additional emergency diesel generator or another ac-independent decay heat removal system. This alternative was not recommended NUREG-1109 33 1 L__---_----_ --
i for several reasons. First, the cost for either of these additions (from $10 to $30 million per plant) is much higher than the estimated cost for the recommended resolution. The recommended approach is more cost effective and meets the objective stated in Section 2. Second, the adequacy of present requirements for decay heat removal systems is being studied under USI A-45, and any major hardware changes or additions to these systems should await the technical resolution of USI A-45. Third, experience indicates that there are practical limits to diesel generator reliability, including common cause fail-ures of redundant divisions, and the recommended resolution provides greater diversity and additional defense-in-depth. I 4.1.4 Alternative (iv) l At the time this report was written, details of the NUMARC initiatives were not 1t available to the NRC staff. This made it difficult for the staff to evaluate the benefits of the industry program. For example, the industry initiatives do not include assessments to determine that plants can cope with a station black-out for any period"of time. Even so, an attempt was made to estimate the likely impact this initiative would have compared to the station blackout rule and regulatory guide. 1' The largest risk reduction associated with the industry program would probably result from N WARC's initiative numuer one. Assuming that implementing this initiative would result in licensees taking actions to reduce the risk from station blackout for those plants that fall into the category of needing an 8-hour coping capability, the staff estimated the value impact ratio for the remaining plants. ! The estimated total cos~t for these plants to comply with the resolution of USI~A-44 is $42 million; the estimated reduction in risk to the public for these plants is 61,000 person rem; and therefore, the overall value impact ratio is approximately 1,500 person-rem per million dollars. This rough analysis supports the conclusion that although the industry initiatives would provide benefits in terms of reducing risk from station blackout events, ! the recommended resolution provides greater benefits that are cost effective. NUREG-1109 34 i
, {
.____u
L ' } l 4.1. 5 Alternative (v) This alternative would be to take no actions beyond those resulting from the NUMARC initiatives endorsed by industry and the resolution of Generic Issue B-56 ! (see discussions in Sections 3.4, 4.1.4, and 4.2.1). Operating experience with diesel generator failures and losses of offsite power has raised a significant concern regarding the potential risk from a station blackout event. The use of this data base with relatively straightforward application of PRA techniques indicates that station blackout events could be a significant contributor to risk for many plants. The additional actions recommended for USI A-44 would significantly reduce the estimated frequency of core damage associated with severe accidents from station blackout. Because the value-impact analysis has shown that it would be beneficial to implement these recommendations, the no-action alternative is not recommended. 4.2 Impacts on Other Requirements Several ongoing NRC generic programs and requirements that are related to the resolution of USI A-44 are discussed below. 4.2.1 Generic Issue B-56, Diesel Generator Reliability The resolution of USI A-44 includes a regulatory guide on station blackout that specifies the following guidance on diesel generator reliability (Task SI 501-4, Sections C.1.1 and 2): The reliable operation of the onsite emergency AC power sources should be ensured by a reliability program designed to monitor and maintain the reliability of each power source over time at a specified acceptable level and to improve the reliability if that level is not achieved. The reliability program should include surveillance testing, target values for maximum failure rate, and a maintenance program. Surveil- - lance testing should monitor performance so that if the actual failure rate exceeds the target level, corrective actions can be taken. The maximum emergency diesel generator failure rate for each diesel generator should be maintained at or below 0.05 failure per demand. For plants having an emergency AC power system [ configuration requir-ing two-out of-three diesel generators or having a total of two diesel generators shared between two units at a site], the emergency diesel generator failure rate for each diesel generator should be maintained at 0.025 failure per demand or less. NUREG-1109 35
-In Generic Letter 84-15, dated July 2, 1984, the staff requested information from licensees regarding proposed actions to improve and maintain diesel gener-ator reliability. The letter requested specific information on three areas (1) reduction of cold fast start surveillance tests for diesel generators (2) diesel generator reliability 1
(3) the licensee's diesel generator reliability program, if any, and comments on the staff's example performance technical specifications for diesel generator reliability l A summary of the data and recommendations in response to Generic Letter 84-15 l was published in NUREG/CR-4557. This information, along with other input, ; will be used in the resolution of B-56 to provide specific guidance for diesel generator reliability programs consistent with the resolution of USI A-44. 4.2.2 USI A-45, Shutdown Decay Heat Removal Requirements The overall objective of USI A-45 is to evaluate the adequacy of current licens-ing requirements to ensure that nuclear power plants do not pose an unacceptable risk as a result of failere to remove shutdown decay heat following transients ( or small break loss-of coolant accidents. The study includes an assessment of alternative means of improving shutdown decay heat removal and of an additional
" dedicated" system for this purpose. Results will include proposeo recommenda-l tions regarding the desirability of, and possible design requirements for, improvements in existing systems or an additional dedicated decay heat removal system.
The USI A-44 concern for maintaining adequate core cooling under station black-out conditions can be considered a subset of the overall USI A-45 issue. How-
,over, there are significant differences in scope between these two issues.
j USI A-44 deals with the probability of loss of ac power, the capability to re- { move decay heat using systems that do not require ac power, and the ability to restore ac power in a timely manner. USI A-45 deals with the overall reliabil-ity of the decay heat removal function in terms of response to transients, small NUREG -1109 36
- r. _ _
break loss of-coolant accidents, and special emergencies such as fires, floods, seismic events, and sabotage.
)
l; Although the recommendations that might result from the resolution of USI A-45 j are not yet final, some could affect the station blackout capability, while i others would not. Recommendations that involve a new or improved decay heat removal system that is ac power dependent but that does not include its own ! dedicated ac power supply would have no effect on USI A-44. Recommendations that involve an additional ac-independent decay heat removal system would have a very modest effect on USI A-44. Recommendations that involve an additional decay heat removal system that include its own ac power supply would have a significant effect on USI A-44. Such a new additional system would receive the appropriate credit within the USI A-44 resolution by either changing the emergency ac power configuration group or providing the ability to cope with a station blackout for an extended period of time. The resolution of USI A-44 would necessitate average expenditures of about
$600,000 per plant, with a range estimated to be from about $350,000 to a naxi-mum of around $4 million. A resolution for USI A-45 involving the addition of a dedicated and independent system, such as an additional shutdown cooling system with its own dedicated diesel generator, would be much more expencive, with an expenditure on the order of $50 to $100 million. However, such expenditures would resolve other concerns with respect to the decay heat re-moval function which will be delineated in a future regulatory aaalysis for USI A-45.
i The resolution of these two issues is coordinated along two main lines. First, technical information resulting from both studies is shared among the major participants includir,g NRC staff and contractors. In this way, the resolution of USI A-45 will take into account any modifications resulting from the reso-lution of USI A-44 that are applicable to the decay heat removal function. Second, the schedules are coordinated so that by the time a final rule on USI A-44 is published--and well before plant modifications, if any, would be implemented--the proposed technical resolution of USI A-45 will be published for public comment. NUREG-1109 37
The technical summary findings report and the regulatory analysis for the pro-posed resolution of USI A-45 are targeted to be issued for public comment in late 1987. For plants needing hardware modifications to comply with the USI A-44 resolution, this schedule would permit a re-evaluation before any actual r modifications are made so that any contemplated design changes following from the resolution of USI A-45 can be considered at the same time. 1 4.2.3 Generic Issue (GI) 23, Reactor Coolant Pump Seal Failures The Task Action Plan for GI 23 includes three tasks, (1) a review of seal fail-ure operating experience, (2) an assessment of the effects of loss of seal i cooling on reactor coolant pump (RCP) seal behavior, and (3) an evaluation of other causes of RCP seal failure such as mechanical and maintenance-induced failures. Only Task 2 is closely related to USI A-44 because during a sta- . tion blackout, systems that normally provide RCP seal cooling are unavailable, and RCP seal integrity is necessary for maintaining primary system inventory under station blackout conditions. NRC and industry analyses of seal performance with loss of seal cooling are proceeding, but at the time this report is being published, the staff has not completed its recommendations to resolve GI 23. The estimates of core damage frequency for station blackout events in NUREG/CR-3226 assumed that the RCP seals would leak at a rate of 20 gallons per minute per pump. Results of the analysis for Gf 23 will provide the information necessary to determine seal 4 [ behavior and, likewise, a plant's ability to cope with a station blackout for a specified time. Should this analysis conclude that there is a significant pro-bability that RCP seals can leak et rates substantially higher than 20 gallons per minute, then reedifications such as an ac-independent RCP seal cooling sys-tem may be necessary to resolve GI 23. If there is high probability that the RCP seals would not leak excessively during a station blackout, then no modifi-cations would be required. A cost benefit analysis associated with the need for an ac-independent seal cooling system would be included in the regulatory analysis for GI 23. NUREG-1109 38 f
l ! 4.2.4 1 Generic Issue A-30, Adequacy of Safety-Related DC Power Supply
- The analysis performed for USI A-44 (NUREG-1032) assumed that a high level of dc power system reliability would be maintained so that (1) dc power system failures would not be a significant contributor to losses of all ac power and (2) should a station blackout occur, the probability of immediate dc power l system failure would be low.
Whereas Generic Issue A-30 focuses on enchancing battery reliability (e.g., restricting interconnections between redundant dc divisions, monitoring the readiness of the dc power system, specifying admin-istrative procedures and technical specifications for surveillance testing and maintenance activities), the resolution of USI A-44 is aimed at assuring adequate station battery capacity in the event of a station blackout of a specified dura-tion. l A-30 would provide additional assurance that station battery reliability is adequate and consistent with the assumptions on which USI A-44 is based. There-fore, these two issues are consistent and compatible. i 4.2.5 Regulatory Guide 1.108, Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants Regulatory Guide 1.108 describes the currently acceptable method for complying with the Commission's regulations with regard to periodic testing of diesel generators to ensure that they will meet ,their availability requirements. This guide may need to be modified to be consistent with the proposed actions de-scribed in Section 4.2.1 abovo (Gencric Issue B-56). If necessary, Regulatory Guide 1.108 will be revised to be consistent with the resolutions of B-56 and USI A-44. 4.2.6 Fire Protection Program for Nuclear Power Facilities 10 CFR 50.48 states that each operating nuclear power plant shall have a fire protection plan that satisfies GDC 3. The fire protection features required to satisfy GDC 3 are specified in Appendix R to 10 CFR 50 and in Branch Technical
- Generic Issue A-30 is being resolved as part of Generic Issue 128, Electrical {
Power Issues. A-30 is the only part of GI 128 that is closely related to ) 1 USI A-44. NUREG-1109 39 J
Position CHEB 9.5.1. They include certain provisions regarding alternative and i dedicated shutdown capability. To meet these provisions, some licensees have added, or plan to add, improved capability to restore power from offsite sources or onsite diesels for the shutdown system. A few plants have installed a safe shutdown facility for fire protection that includes a charging pump powered by its own independent ac power source. In the event of a station blackout, this system can provide makeup capability to the primary coolant system as well as reactor coolant pump seal cooling. This could be a significant benefit in terms of enhancing the ability of a plant to cope with a station blackout. Because the plant modifications required for fire protection have already been specified, it would not be feasible to consider these modifications together with the requirements of USI A-44. However, credit would be given for improve-ments made for the fire protection program in meeting the station blackout rule. For example, plants that have added equipment to achieve alternate safe shutdown 1 in order to meet Appendix R requirements, could take credit for the equipment (if available) for coping with a station blackout event. 4.2.7 Generic Issue 124, Auxiliary Feedwater System Reliability This issue has focused on the reliability of seven older PWRs that have two-train auxiliary feedwater systems. The staff has established a review team which will perform reviews (including plant audits and walkdowns) to assess each of these plants on a case-by-case basis. Other relevant information such as auxiliary feedwater system reliability analyses will be considered in the staff reviews, as available. The staff may allow credit for compensating factors, such as feed and bleed capability, to justify acceptance of the two punp AFW systems, or may decide that hardware, procedural and/or training modifications are necessary. If the proposed resolution of Generic Issue 124 requires the auxiliary feed-water system in several PWRs to be upgraded, this would most likely result in the addition of an auxiliary feedwater pump. The installation of a pump that is independent of ac power would be beneficial in handling station blackout NUREG-1109 40
i accident sequences by providing additional reliability in the ac-independent j decay heat removal system. Because all PWRs now have an auxiliary feedwater train that is independent of ac power, the requirement could be met by adding i a motor-driven pump. Consequently, the auxiliary feedwater system upgrades l could have no effect on the station blackout issue. i 4.2.8 Multiplant Action Items B-23 and B-48, Degraded Grid Voltage and Adequacy of Station Electric Distribution Voltage These two multiplant action items have been under consideration by both the staff and licensees for several years. They relate to: (1) sustained degraded voltage conditions at the offsite power sources, (2) interaction between the offsite and onsite emergency power systems, and (3) the acceptability of the voltage conditions on the station electric distribution systems with regard to potential overloading and starting transient problems. Licensees' responses to thes2 concerns have consisted of verifying the adequacy of existing power systems or of upgrading the power systems. The modifications are designed to ensure that the power systems can perform their intended function and consequently would enhance their dependability. If additional power sources have been added to address these concerns, the plant would be placed in an improved category and may be required to withstand a blackout of lesser duration. In the resolu-tion of USI A-44, the staff is not recommending that work that has been done on these two action items be repeated. 4.2.9 Severa Accident Program Brookhaven Natienal Lsbor0 tory has proposed a set of preliminary guidelines I and criteria that could lie used to assess the capability of nuclear power plants to cope with severe accidents (for example see BNL Technical Report A-3825R). This work was performed in support of the Implementation Plan for the Commission's Severe Accident Policy Statement. The proposed guidelines cover a large number of potentially severe accident sequences. For station blackout events, the guidelines assume that plants will comply with the requirements in the station blackout rule. Therefore, the severe accident NUREG-1109 41 i l
- n. ..
- program and the resolution of USI A-44 are consistent and compatible. Require-
- ments for operating plants ~ to comply with additional criteria beyond those in Lthe. st'ation blackout rule ~would need to be~ justified in accordance with the back-fit rule (10 CFR 50.109).
4.3 Constraints The staff has reviewed current Commission regulations to determine.if they provide a basis.for implementation of the USI A-44 requirements.- This review included (1) the Atomic _ Safety and Licensing Appeal Board Hearing (ALAB-603)'on station blackout for. St. Lucie Unit 2; (2) the Commission review of that hearing; (3) General Design Criterion (GDC) 17, Electric Power Systems; and (4) the backfit rule (10 CFR 50.109). St. Lucie Unit'2 Atomic Safety and Licensing Appeal Board Hearing In ALAB-603, the board took the position that station blackout should be consid-ered a design basis event for St. Lucie 2 because of the high frequency of'such an event _(10 4 to 10.s per year at that site). As a result, the Appeal Board required St. Lucie 2 to be capable of' withstanding a total loss of ac power and to implement training and procedures to recover from station blackout. The Appeal Board went as far as to say -- Our findings that station' blackout should be considered as a de-sign basis event for St. Lucie Unit 2 manifectly could be applied equally to Unit 1, already in operation at that site. By a parity. of reasoning, this result may well also obtain at other nuclaar plants on applicant's system, if not at most power reat. tors. Our jurisdiction, however, is limited to the matter before us, licens-ing construction of St. Lucie 2. Beyond that, we can only alert the Commission to our concerns. The Commission upheld the Board's action on St. Lucie 2. However, the Com- , mission determined that ALAB-603 did not establish station blackout generically as a " design basis event." NUREG-1109 42 L-_-________-__
General Design Criterion 17 GDC 17 states, in part -- Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies. The intent of GDC 17 is to require reliable offsite and onsite ac power sys-tems. The ability to cope with the coincident loss of both of these systems is not addressed explicitly. As a result of this review, the staff has concluded that there is a basis in the regulations for the recommendations to improve the reliability of the off-site and onsite ac power systems. However, because the coincident loss of both systems is not addressed explicity, a rule to require plants to be able to withstand a total loss of ac power for a specified duration will provide fur-ther assurance that station blackout will not adversely affect the public health and safety. Backfit Rule On September 20, 1985, the Commission published the backfit rule (10 CFR 50.109). This rule sets forth restrictions on imposing new requirements on currently licensed nuclear power plants and specifies standard procedures that must be applied to backfitting decisions. The backfit rule states -- The Commission shall require a systematic and documented analysis pursuant to paragraph (c) of this section for backfits which it seeks to impose. [S50,109(a)(2)] The Commission shall require the backfitting of a facility only when it determines, based upon the analysis described in paragraph (c) of [S50.109], that there is a substantial increase in the overall protection of the public health and safety or the common defense and security to be derived from the backfit and that the direct and indirect costs of implementation for that facility are justified in view of the increased protection. [SS0.109(a)(3)] In order to reach this determination, Paragraph S50.109(c) sets forth nine spe-cific factors which are to be considered in the analysis for the backfits it NUREG-1109 43
i seeks to impose. These nine factors are among those discussed in the main body } of this report. Appendix A provides a discussion summarizing each of these factors. The Commission also states in the backfit rule that "any other informa-tion relevant and material to the proposed backfit" will be considered. This report provides additional relevant information concerning the station blackout rulemaking. This analysis supports a determination that a substantial increase in the protection of the public health and safety will be derived from backfit- ! ting the requirements in the station blackout rule, and that the backfit is justified in view of the direct and indirect costs of implementing the rule. i No other constraints have been identified that affect the resolution of USI A-44. 5 DECISION RATIONALE The evaluation to resolve USI A-44 included deterministic and probabilistic analyses. Calculations to determine the timing and consequences of various accident sequences were performed, and the dominant facto "cting station blackout likelihood were identified (NUREG-1032, and NUREL ^ .389, -3992, -3226, and -4347). Using this information, simplified probabilistic accident sequence correlations were calculated to estimate the frequency of core damage resulting from station blackout events for different plant design, operational, and loca-tion factors. These quantitative estimates were used to give insights into the relative importance of various factors, and those insights, along with engineer-ing judgme.it, were ured to develop the resolution cf USI A-44. By analyzing the effect af variations in desigr, operations, and plant location on risk trom station blackout accidents, an attempt was made to approach a reasonably con-sistent level of risk in the recommendations developed. I A survey of probabilistic risk assessment studies showed that total core damage frequency from all dominant accident sequences ranged from 2 x 10 5 to 1 x 10 8 i per reactor year, with a typical frequency of about 6 to 8 x 10 5 per reactor-year (NUREG/CR-3226). For those plants currently in operation or under construc-1 i 1 tion, a value-impact analysis was performed to determine that the resolution of i 1 i I NUREG-1109 44
s s USI A-44 is cost-effective. Implementation of the resolution will result in station blackout being a relatively small contributor to total core damage frequency. (NUREG-1032 provides a more detailed discussion .,f the analysis of station blackout accident likelihood performed for this regulatory analysis.) j 5.1 Commission's Safety Goals l On August 4, 1986, the Commission published in the Federal Register a policy ' statement on " Safety Goals for the Operations of Nuclear Power Plants" (51 FR 28044). This policy statement focuses on the risks to the public from nuclear power plant operation and establishes goals that broadly define an acceptable level of radiological risk. The discussion below addresses the resolution of USI A-44 in light of these goals. The two qualitative safety goals are: Individual members of the public should be provided a level of protection from the consequences of nuclear power plant opera-tion such that individuals bear no significant additional risk ; to life and health. Societal risks in life and health from nuclear power plant opera-tion should be comparable to or less than the risks of generating electricity by viable competing technologies and should not be a significant addition to other societal risk. The following quantitative objectives are used in determining achievement I of the above safety goals: The risk to an average individual in the vicinity of a nuclear power plant of prompt fatalities that might result from reactor accidents should not exceed one-tenth of one percent (0.1%) of the sum of prompt fatality risks resulting from other accidents to which members of the U.S. population are generally exposed. The risk to the population in the area near a nuclear power plant of cancer fatalities that might result from nuclear power plant operation should not exceed one-tenth of one percent (0.1%) of the sum of cancer fatality risks resulting from all other causes. NUREG-1109 45 j
Results of analyses published in NUREG-1150 for five plants (Surry, Zion, Sequoyah, Peach Bottom and Grand Gulf) indicate that all five plants meet the risk criteria for prompt fatalities and latent cancer fatalities stated above, even considering the large uncertainties involved. Implementation of the i station blackout rule will result in the average core damage frequency from station blackout events being in approximately the range of frequencies esti-mated for station blackout for the five NUREG-1150 plants. Therefore, the station blackout rule meets both of the Commission's qualitative safety goals. The Commission also stated the following regulatory objective relating to the frequency of core damage accidents at nuclear power plants. Severe core damage accidents can lead to more serious accidents with the potential for life-threatening offsite releases of radiation, for evacuation of members of the public, and for contamination of public property. Apart from their health and safety consequences, such acci-dents can erode public confidence in the safety of nuclear power and can lead to further instability and unpredictability for the industry. In order to avoid these adverse consequences, the Commission intends to continue to pursue a regulatory program that has as its objective providing reasonable assurance, giving appropriate consideration to the uncertainties involved, that a severe core damage accident will not occur at a U.S. nuclear power plant. ' An estimate of the total probability of core damage for the nuclear industry is beyond the scope of this regulatory analysis, but some perspectives on station blackout are presented here. The mean core damage frequency from station black- { out events before implementation of the station blackout rule is estimated to I be 4.2 x 10 5 per reactor year. Thus, the probability of core damage from station blackout is about 0.12 (i.e., about one chance in 8 that station black-out would result in severe core damage at one of 125 ra ctors over an assumed remaining 25 year life expectancy of these plants). Implementation of the sta-tion blackout rule would reduce the estimated mean core damage frequency to 1.6 x 10 5 per reactor year, and therefore, the estimated probability of a severe core damage accident from station blackout would be 0.05 (i.e., about one chance in 20 of severe core damage). Therefore, implementing the resolution of USI A-44 provides reasonable assurance that a severe core damage accident from sta-tion blackout will not occur at a U.S. nuclear power plant. NUREG-1109 46
The Commission also proposed the following guideline for further staff evaluation: Consistent with the traditional defense-in-depth approach and the accident mitigation philosophy requiring reliable p;rformance of ! containment systems, the overall mean frequency of a large release of radioactive materials to the environment from a reactor accident should be less than 1 in 1,000,000 per year of reactor operation. Given the current state of knowledge regarding containment performance and the large uncertainties, with respect to the probability of containment failure fol- ; lowing severe accident sequences, it is not possible to conclude that the safety performance guideline on the frequency of a large release would be met. This conclusion is based on the estimated mean core damage frequency for station blackout events of 1.6 x 10 5 per reactor year coupled with the uncertainty band for the probability of early containment failure ranging from about 0.05 " to 0.90 as reported in NUREG-1150. Since the potential for a high likelihood of containment failure cannot be eliminated, the overall mean frequency of a large release of radioactivity of 10 6 per reactor year cannot be assured. Additional rationale for implementing the station blackout rule and the regula-tory guide over other alternatives is discussed in the value-impact analysis (Section 4.1). This action represents the staff's position based on a compre-hensive analysis of the station blackout issue. This position includes all the requirements and guidance to resolve the station blackout issue. I l
- 5. 2 Station Blackout Reports '
The studies and data on which this resolution it ba w d arc documented in j NUREG-1032 and NUPEG/CR-2989, -3226, -3992, and -4347. Summaries of these reports follow. 5.2.1 NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power ! Plants, Technical Findings Related to Unresolved Safety Issue A-44 l i Ihis report summarizes the results of technical studies performed in support j of USI A-44 and identifies the dominant factors affecting the likelihood of l l
?
NUREG-1109 47 s
p1 f station blackout accidents at nuclear power-plants. These results are based on operating experience. data; analysis of several plant-specific probabilistic safety studies; and reliability, accident sequence, and consequence analyses performed in support of this unresolved safety issue. In summary the results show the following important characteristics of station blackout accidents. (1) The likelihood of station blackout varies between plants with an estimated frequency ranging from approximately 10 s to 10 8 per reactor year. ' A.
" typical" estimated frequency is on the order of 10 4 per reactor year.
(2) The capability of restoring offsite power in a timely manner can have a
.significant effect on accident consequences.
(3)- Onsite ac power system redundancy and individual power supply reliability have the largest influence on station blackout accident frequency. (4) The capability of the decay heat removal system to cope with long duration k blackouts can be a dominant factor influencing the likelihood of core l damage or core melt. l (5) The estimated frequency of station blackout events resulting in core damage or core melt can range from approximately 10 8 to greater than 10 4 per reactor-year. A " typical" core damage frequency estimate is 2 to 4 x 10 5 per reactor year. (6) The best it formation available intiicates that containment failure by over-pressure may follow a station-blackout-induced core melt with smaller, low design pressure containments most susceptible to early failure. Some large, high design pressure containments may not fail by overpressure, or the failure time could be on the order of a day or more.
)
Losses of offsite power could be characterized as those resulting from plant-centered faults, utility grid blackout, or severe weather-induced failures of
. NUPEG-1109 48 l 4
- p i
offsite power sources. The industry average frequency of total losses of off-site power was determined to be about 1 in 10 site years. The median restora-tion time was about one-half hour, and 90 percent of the losses were restored in 3 hours or less. The factors that were identified as affecting the frequency and duration of offsite power Msses are -- (1) design of preferred power distribution system, particularly the number and independence of offsite power circuits from the point where they enter the site up to the safety buses (2) operations that can compromise redundancy or independence of multiple off-site power sources, including human error (3) grid stability and security, and the ability to restore power to a nuclear plant site with a grid blackout { (4)- the hazard from, and susceptibility to, severe weather conditions that + can cause loss of offsite power for extended periods A design and operating experience review, combined with a reliability analysis of the onsite, emergency ac power system, has shown that there are a variety of potentially important failure causes. The typical unavailability of a two-division emergency ac power system is about 10 3 per demand, and the typical individual emergency diesel generator failure rate is about 2 x 10 2 per decani The factors that wsre identified as affecting the emergency ac power system reliability during c loss of offsite power are -- (1) power supply cor. figuration redundancy (2) reliability of each power supply (3) dependence of the emergency ac power system on support of auxiliary cooling systems and control systems and the reliability of those support systems 4 NUREG-1109 49
(4) vulnerability to common cause failures associated with design, operational, and environmental factors The likelihood of a station blackout progressing to core damage or core melt is dependent on the reliability and capability of decay heat removal systems that are not dependent on AC power. If sufficient capability exists, additional time will be available to permit an adequate opportunity to restore ac power to the many systems normally used to cool the core and remove decay heat. The most i important factors involving decay heat removal during a station blackout are -- (1) the starting rellat>ility of systems required to remove decay heat and maintain reactar coolant inventory (2) the capacity and functionability of decay heat removal systems and auxiliary or support systems that must remain functional during a station blackout (e.g., dc power, condensate storage) (3) for PWRs, and PsWRs without reactor coolant makeup capability during a station blackout, the magnitude of reactor coolant pump seal leakage (4) for BWRs that remove decay heat to the suppression pool, the ability to maintain suppression pool integrity and operate heat removal systems at high pool temperatures during recirculation. It was determined by reviewing design, operational, and location factors, that the expected core damage frequency from station blackout could be maintained around 10 5 per reactor year or lower for almost all plants. The ability to cope with station blackout durations of 4 to 8 hours and eriergency diesel generator reliabilities of 0.95 per demand or better would L"e necessary to reach this core damage frequency level. 5.2.2 NUREG/CR-3226, Station Blackout Accident Analyses This report analyzes accident sequences following a postulated total loss of ac power to (1) determine the core damage frequencies from station blackout, NUREG-1109 50 l l
4 l 4 (2) provide insights through sensitivity studies of important factors to con-sider for lowering the core melt frequency, and (3) provide perspectives on the. risks from such an event. Probabilistic safety analyses were done on four , generic " base" plant configurations. Fault trees of different systems and event trees of possible station blackout accident sequences were constructed for these plants. These event trees modeled three time periods including an initial time period for sequences resulting from unavailabilities on demand and longer time intervals in which other failures can occur such as depletion of dc power, degradation of reactor coolant pump seals, or depletion of con-densate storage tank supply. Data from the offsite and onsite power studies > (NUREG/CR-2989 and -3992) as well as from licensee event reports and PRAs were used to quantify the accident sequences. Lastly, containment failure modes and timing were reviewed to calculate the risk to the public from station blackout. For the " base" cases, the total core damage frequencies from station blackout resulting from the dominant accident sequences were estimated to be in the range of 10 5 per reactor year. Plants with features different from the base case designs have different core damage frequencies, so sensitivity analyses were conducted. For example, the reliability and recovery of ac power from both the offsite and emergency onsite power systems have a direct impact on core damage frequencies. Depending on the expected frequency of station blackout at a plant and other factors, the frequency of core damage associated with loss of all ac power ranged from about 2 x 10 6 to greater than 10 4 per reactor year. In summary, results of the accident sequence analyses indicate that the follow-ing plant factors are important when considering station blackout: (1) the effectiveness of actions to restore offsite power once it is lost (2) the degree of redundancy and reliability of the emergency onsite ac pow v system 1 L (3) the reliability of decay heat removal systems following loss of ac power (4) dc power reliability and battery capacity including the availability of instrumentation and control for decay heat removal without ac power NUREG-1109 51
s .. (5) common service water dependencies between the emergency ac power source and the decay heat removal systems (6) the magnitude of reactor coolant pump seal leakage and the likelihood of ! a stuck-open relief valve during a station blackout (7) containment size.and design pressure (8) operator training and available procedures 5.2.3 NUREG/CR-2989, Reliability of Emergency AC Power Systems at Nuclear Power Plants The purpose of this study'was to estimate the reliabilities of representative onsite ac power systems and to estimate the costs of fixes to improve the re-liabilities of these systems. For this analysis, an initial design review of onsite ac power systems was done using Final Safety Analysis Reports (FSARs) for plants, plant schematics, and plant-spgific procedures. The study included examining the following areas: switchyards, distribution systems, dc power systems, diesel generators, support systems, and procedures. Historical data on diesel' generator operating exp6rience for the 5 year period from 1976 through 1980 were collected from licensee event reports and responses to questionnaires sent to licensees. Eighteen different configurations were identified, and representative plants were selected for a more detailed reliability analysis. This analysis involved constructing fault tree models for the onsite power systems and quantifying these fault trees with the data gathered on operating experience. The onsite l. system undependability (the probability that it will fail to start or fail to continue to run for the duration of an offsite power outage) was calculated for ac power outages up to 30 hours af ter a loss of offsite power. Results of a sensitivity study were used to identify potentially important contributors I to unreliability, and costs of improvements were estimated. Results showed that important contributors to onsite power undependability were independent diesel generator failure, common cause failure due to hardware NUREG-1109 52 Q-_-_______-___-_-_-_- - - - - - -
failure or human error, unavailability because of scheduled maintenance, and cooling subsystem undependability. Reliability of onsite ac power systems varies from plant to plant. Depending on diesel generator configuration, the system unavailability ranged from 1.4 x 10 4 to 4.8 x 10 2 per demand. Signif-icant variability exists so that any reliability improvements and the associ ' ated costs must be evaluated on a plant-specific basis. 5.2.4 NUREG/CR-4347, Emergency Diesel Generator Operating Experience, 1981-1983 This report is an update of operating experience of emergency diesel generators reported in NUREG/CR-2989. Estimates of diesel generator failure rate during surveillance testing and during actual demands (e.g., unplanned demands follow-ing losses of offsite power or safety injection actuation signals) are presented. The data indicate that overall diesel generator performance has improved since 1976 with an overall median failure rate estimated to be 0.019 failure per demand. However, for the 1981 to 1983 period, the diesel generator failure rate during actual demands was 0.025 failure per demand - a rate higher than that for all demands (i.e., including surveillance tests). Data from NUREG/CR-2989 and -4347, along with results of an industry survey conducted by the Electric Power Research Institute (NSAC/108), were used in the staff's evaluation of risk from station blackout events (NUREG-1032). 5.2.5 NUREG/CR-3992, Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants This report describes and categorizes events involving complete or significant partial losses of offsite power that have occurred at nuclear power plants through 1983. The purposes of this study were to provide an accurate data base to estimate frequencies and durations of losses of offsite power and to under-stand how offsite power design features may 6ffect these losses as well as the ] ability to restora offsite power. A parallel study documenting loss of offsite power experience through 1985 was published by the Nuclear Safety Analysis Cen- ! ter of the Electric Power Research Institute (NSAC/103). Data from both NUREG/ ! l CR-3992 and NSAC/103 were used in the loss of offsite power analysis in NUREG-1032. { l NUREG-1109 53 ! L- _ _ -- _- -_ _ l
.- '. j Based on industry-wide data for the years 1959 through 1983, the frequency of loss of offsite power is about once every 10 site years. A total of 46 com-plete loss of offsite power events were documented, ranging in duration from a few minutes up to a maximum of almost 9 hours. In approximately half of these events, offsite power was restored in one-half hour or less. Information for this study was collected from licensee event reports, responses to an NRC ques-tionnaire, and various reports prepared by the utilities. Most of the event descriptions in the licensee event reports and other documentation within the NRC files did not contain sufficiently detailed information for the purposes discussed above. For example, in one case a licensee reported offsite power restoration time to be 6 hours, but actually one offsite power source was restored in 8 minutes, and all offsite power was restored in 6 hours. Because restoration of one source of offsite power terminates a loss of offsite power, the documented description was not accurate enough. In some other cases, off-site power was available to be reconnected, but the plant operators did not reconnect it for some time after it was available. The time power was recon-nected was usually reported; however, the data that were actually needed were the times that power was available for reconnection. Because of the need for more accurate data, additional information was obtained by contacting utility engineers for better descriptions of the causes, sequences of events, and the times and methods of restoring offsite power.
Once these data were collected, the offsite power failures were identified as plant-centered or grid failures. In addition, the causes of the failures were attributed to weather, human error, design error, or hardware failure. The plant-centered failures were usually of shorter duration than the grid failures caused by severe weather. For this reason, the weather-related events were reviewed in detail. Offsite power design features were tabulated for most of the operating nuclear power plants to determine which ones significantly affect offsite power system reliability. The frequency and duration of losses of offsite power caused by severe weather are affected by the number of transmission lines and rights-of-way and the availability of alternate power sources (such as hydro, gas tur-bines, or fossil units near the nuclear plant). Design features that may be NUREG-1109 54
"o e u
-important for plant-centered losses of offsite power are the number of offsite power sources, the electrical independence of those sources, and the relay scheme for transferring power between offsite sources.
6 IMPLEMENTATION 6.1 Schedule for Implementing the Final Station Blackout Rule The steps and schedule listed in Table 13 summarize the implementation schedule in the station blackout rule (650.63(c) and (d)). Within 9 months after pro-mulgation of the rule, licensees will submit to NRC (1) the duration for which the plant should be able to cope with a station blackout, (2) a justification for the duration, (3) a description of the procedures to cope with a station blackout for that duration, and (4) a list of equipment modifications neces-sary, if any, to meet the specified station blackout duration. The staff will review the licensees' submittals, and, within 6 months after that review, li-censees will submit a schedule for implementing any necessary equipment modifi- ! cations to comply with the rule. ! Table 13 Implementation schedule for final station blackout rule Time after Commission decision Activity to issue final rule (months) Issuance of final rule 0 Licensees' submittal of acceptable station 9 blackout durations to NRC, including description of procedures and list of modifications Completion of NRC review of submittal 20 Licensee's submittal of schedule for 26 implementing hardware modifications Completion of licensees' hardware
- modifications
- Schedule to be agreed upon with NRC, but within 2 years of NRC review of sub-mittal, unless justification is submitted by the licensee for a later date and the staff agrees.
NUREG-1109 55
. .o The factors that must be considered to determine the minimum acceptable station blackout duration, as specified in the revision to Appendix A to GDC 17, are relatively straightforward. In fact, licensees have reviewed their plants against these factors as part of an industry initiative supported by NUMARC.
Thus, this acceptable duration can be determined in approximately 1 or 2 months. Licensees will be required to perform plant-specific analyses to determine if the plant, as designed, can cope with a station blackout for the acceptable duration, and to determine what modifications, if any, are needed to meet the acceptable duration. These analyses could require 6 to 9 months to perform. Thus, it seems reasonable to require that the information be submitted to the NRC within 9 months after the date the final rule is issued. The implementation of procedural changes to cope with a station blackout and diesel generator reliability improvements, if necessary, will be accomplished early in the schedule. Hardware backfits, if necessary, should be implemented as soon as practical, based on scheduled plant shutdown, but no later than 2 years after the staff reviews a licensee's station blackout duration submittal. A final schedule for implementation of design and associated procedural modifi-cations will be mutually agreed upon by the licensee and the NRC staff. Other schedules were considered; however, the staff believes the implementation schedule in Table 13 is achievable without unnecessary financial burden on licensees for plant shutdown. The schedule allows reasonable time for the im-plementation of necessary hardware items to achieve a reduction in the risk of severe accidents associated with station blackout, yet achieves significant benefits early on by requiring an assessment of a plant's station blackout capability and procedures and training to cope with such an event. Shorter or less flexible schedules would be unnecessarily burdensome; longer schedules would delay necessary plant improvements.
- 6. 2 Relationship to Other Existing or Proposed Requirements Several NRC programs are related to USI A-44; these are discussed in Section 4.2.
l These programs are compatible with the resolution of USI A-44. NUREG-1109 56 1 l I
. o.
7 REFERENCES Brookhaven National Laboratory, " Prevention and Mitigation of Severe Accidents In a BWR-4 With a Mark I Containment," Draft Technical Report A-3825R, October 1986. EG&G,." Cost Analysis for Enhancement of DC Systems Reliability and Adequacy of Safety-Related DC Power Systems," EG&G Report RE&ET-6151, January 1983. Sandia National Laboratory, "Value-Impact Calculation for Station Blackout Task Action Plan A-44," letter report to NRC, March 1983. Sandia National Laboratory, " Letter Report on Equipment Operability During Station Blackout Events," Draft, November 1986. Science and Engineering Associates, Inc. , " Response to Industry Comments on Station Blackout Cost Estimates (NUREG/CR-3840)," letter report to NRC, November 12, 1986. U.S. Atomic Energy Commission, WASH-1400, " Reactor Safety Study," October 1975 (also reissued as NUREG-75/014). U.S. Nuclear Regulatory Commission, " Regulatory Analysis Guidelines," NRR Office Letter No. 16, Revision 3, May 13, 1986.
-- , NUREG-0800, " Standard Review Plan for the Review of Safety Analyses for Nuclear Power Plants," July 1981.
-- , NUREG-0956, " Reassessment of the Technical Bases for Estimating Source Terms," July 1986.
-- , NUREG-1032, " Evaluation of Station Blackout Accidents at Nuclear Power Plants, Technical Findings Related to Unresolved Safety Issue A-44," draft, May 1985.
i NUREG-1109 57 i - - - - _ _ _ i
L
-- , NUREG-1150, " Reactor Risk Reference Document," Draft for Comment, February 1987.
-- , NUREG/CR-2723, " Estimates of the Financial Consequences of Nuclear Power Reactor Accidents," September 1982.
-- , NUREG/CR-2989, " Reliability of Emergency AC Power Systems at Nuclear Power Plants," July 1983.
-- , NUREG/CR-3226, " Station Blackout Accident Analyses (Part of NRC Task Action Plan A-44)," May 1983.
-- , NUREG/CR-3568, "A Handbook for Value-Impact Assessment," December 1983.
\
-- , NUREG/CR-3840, " Cost Analysis for Potential Modifications to Enhance the Ability of a Nuclear Power Plant to Endure Station Blackout," July 1984.
-- , NUREG/CR-3992, " Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants," February 1985.
-- , NUREG/CR-4347, " Emergency Diesel Generator Operating Experience,
'1981-1983," December 1985.
-- , NUREG/CR-4557, "A Review of Issues Related to Improving Nuclear Power i Plant Diesel Generator Reliability," April 1986.
-- , NUREG/CR-4568, "A Handbook for Quick Cost Estimates," April 1986.
-- , NUREG/CR-4624, Volumes 1-6, " Radionuclides Release Calculations for Selected Severe Accident Scenarios," July 1986. '
-- , NUREG/CR-4627, " Generic Cost Estimates," June 1986.
NSAC/103, " Losses of Offsite Power at U.S. Nuclear Power Plants - All Years Through 1985," May 1986. NUREG-1109 58
NSAC/108, "The Reliability of. Emergency Diesel Generators at U.S. Nuclear Power Plants," September 1986. Letter from J. H. Miller, Jr. , Nuclear Utility Management and Human Resources
. Committee, to Chairman N. J. Palladino, June 17, 1986.
1 i NUREG-1109 59
--w._ _ - - - , _ _, _ _ _ _ _ _
- e 1
i 1 l 1 Il l APPENDIX A - BACKFIT ANALYSIS
\
i I l l I
APPENDIX A -BACKFIT ANALYSIS
- Analysis and Determination That The Rulemaking to Amend 10 CFR 50 Concerning Station Blackout Complies With The Backfit Rule 10 CFR 50.109 The Commission's existing regulations establish requirements for the design and testing of onsite and offsite electrical power systems (10 CFR Part 50, Appendix A, General Design Criteria 17 and 18). However, as operating experi-ence has accumulated, the concern has arisen regarding the reliability of both i the offsite and onsite emergency ac power systems. These systems provide power for various safety systems including reactor core decay heat removal and con-tainment heat removal which are essential for preserving the integrity of the reactor core and the containment building, respectively. In numerous instances emergency diesel generators have failed to start and run during tests conducted at operating plants. In addition, a number of operating plants have experienced a total loss of offsite electric power, and more such occurrences are expected.
Existing regulations do not require explicitly that nuclear power plants be designed to withstand the loss of all ac power for any specified period. This issue has been studied by the staff as part of Unresolved Safety Issue (USI) A-44, " Station Blackout." Both deterministic and probabilistic analyses were performed to determine the timing and consequences of various accident sequences and to identify the dominant factors affecting the likelihood of core melt accidents from station blackout. These studies indicate that station blackout can be a significant contributor to the overall plant risk. Conse-quently, the Commission is amending its regulations to require that plants be capable of withstanding a total loss of ac power for a specified duration and to maintain reactor core cooling during that period. j The backfit analysis is included as an appendix to this report. It is intended to be a stand-alone document that minimizes the need to refer to additional documents by including sufficient detail to assess each consideration in the backfit rule (10 CFR 50.109). Therefore, the backfit analysis repeats much of what is already included in the main body of the report. l NUREG-1109 APP A 1
_ = _ _ _ _ _ _ __ _ - p I The estimated benefit from implementing the station blackout rule is a reduc-tion in the frequency of core damage per reactor year due to station blackout and the associated risk of offsite radioactive, releases. The risk reduction
. for 100 operating reactors is estimated to be 145,000 person-rems. '
The cost for licensees to comply with the rule would vary depending on the existing capability of each plant to cope with a station blackout, as well as the specified station blackout duration for that plant. The' costs would be primarily for licensees to assess the plant's capability to cope with a station blackout, (2) to develop procedures, (3) to improve diesel generator reliability if the reliability falls below certain levels, and (4) to retrofit plants with i additional components or systems, as necessary, to meet the requirement.s.
'The estimated total cost for 100 operating reactors to comply with the resolu-tion of USI A-44 is about $60 million. The average cost per reactor would be around $600,000, ranging from $350,000, if only a station blackout assessment and procedures and training are necessary, to a maximum of about $4 million if substantial modifications are needed, including requalification of a diesel generator.
The overall value-impact ratio, r,ot including accident avoidance costs, is about 2,400 person-rems averted per million dollars. If the net cost, which includes the cost savings from accident avoidance (i.e., cleanup and repair of onsite damages and replacement power following an accident) were used, the overall value-impact ratio would improve significantly to about 6,100 person-rems averted per million dollars. This analysis supports a determination that a substantial increase in the pro-tection of the public health and safety will be derived from backfitting the requirements in the station blackout rule, and the backfit is justified in view of the direct and indirect costs of implementing the rule. This does not imply that operating plants are unsafe. Rather, the rule will provide additional protection beyond that already provided to comply with currently existing re-quirements, and the benefit to public health and safety outweighs the cost of , the improvements. ! NUREG-1109 APP A 2 I 1
The preceding quantitative value-impact analysis was one of the factors considered in evaluating the rule, but other factors also played a part in the decision-making process. Probabilistic risk assessment (PRA) studies performed for this USI, as well as some plant-specific PRAs, have shown that station blackout can be a significant contributor to core melt frequency, and, with consideration of containment failure, station blackout events can represent an important contri-butor to reactor risk. In general, active systems required for containment heat removal are unavailable during station blackout. Therefore, the offsite risk is higher from a core melt resulting from a station blackout than it is from many other accident scenarios. Although there are licensing requirements and guidance directed at providing reliable offsite and onsite ac power, experience has shown that there are prac-tical limitations in ensuring the reliability of offsite and onsite emergency ac power systems. Potential vulnerabilities to common cause failures associated with design, operational, and environmental factors can affect ac power system reliability. For example, if potential common cause failures of emergency die-sel generators exist (e.g. , in service-water or dc power support systems), then the estimated core damage frequency from station blackout events can increase significantly. Also, even though recent data indicate that the average emergency diesel generator reliability has improved slightly since 1976, these data also show that diesel generator failure rates during unplanned demand (e.g., following a loss of offsite power) were higher than that during surveillance tests. The estimated frequency of core damage from station blackout events is directly proportional to the frequency of the initiating event. Estimates of station { blackout frequencies for this USI were based on actual operational experience i with credit given for trends showing a reduction in the frequency of losses of offsite power resulting from plant-centered events. This is assumed to be a realistic indicator of future performance. An argument can be made that the l future performance will be better than the past. For example, when problems with the offsite ^xter grP :3 rise, they are fixed and, therefore, grid reli-j ability should improve. On the other hand, grid power failures may become more frequent because fewer plants are being built, and more power is being trans-mitted among regions, thus placing greater stress on transmission lines. f l NUREG-1109 APP A 3 1
g .- I s I [ A number of foreign countries, including France, Britain, Sweden, Germany and Belgium, have taken steps to reduce the risk from station blackout events.
.These steps include adding design features to enhance the capability of the plant to cope with a station blackout for a substantial period of time and/or adding redundant and diverse emergency ac power sources.
The factors discussed above support the determination that additional defense
'in-depth provided by the ability of a plant to cope with station blackout for a specific duration would provide substantial increase in the overall protection of the public health and safety, and the direct and indirect costs of implemen-tation are justified in view of this increased protection. The Commission has considered how this backfit should be prioritized and scheduled in light of other regulatory activities ongoing at operating nuclear power plants. Station black-out warrants a high priority ranking based on both its status as an " unresolved safety issue" and the results and conclusions reached in resolving this issue.
As noted in the implementation section of the rule (650.63(d)), the schedule for equipment modification (if needed to meet the requirements of the rule) shall be mutually agreed upon by the licensee and NRC. Modifications that cannot be scheduled for completion within two years after NRC accepts the licensee's speci-fied station blackout duration must be justified by the licensee. Analysis of 50.109(c) Factors 1. Statement of the specific objectives that the backfit is designed to achieve The NRC staff has completed a review and evaluation of information developed over the past six years on Unresolved Safety Issue (USI) A-44, Station Black-out. As a result of these efforts, the NRC is amending 10 CFR Part 50 by adding a new S 50.63, " Station Blackout," and adding a new paragraph (e) to General Design Criterion (GDC) 17, " Electric Power Systems," in Appendix A. I The objective of the station blackout rule is to reduce the risk of severe accidents associated with station blackout by making station blackout a relatively small contributor to total core damage frequency. Specifically, the rule requires all light-water-cooled nuclear power plants to be able to NUREG-1109 APP A 4 I
\
.S 3.
cope with a station blackout for a specified duration and to have procedures and training for such an event. A regulatory guide, to be issued along with the rule, provides an acceptable method to determine the station blackout duration for each' plant. The duration is to be determined for each plant based on a comparison of the individual' plant design with factors that have been identified as the main contributors to risk of core melt resulting from station blackout. These factors are (1) the redundancy of onsite emergency ac power sources, (2) the reliability of onsite emergency ac power sources, (3) the frequency of. loss of offsite power, and (4) the probable time needed to restore offsite power. 2. General description of the activity required by the licensee or applicant in order to complete the backfit In order to comply with the resolution of USI A-44, licensees will be required to -- Maintain the reliability of onsite emergency ac power sources at or above specified acceptable reliability levels. Develop procedures and training to restore ac power using nearby power sources if the emergency ac power system and the normal offsite power sources are unavailable. Determine the duration that the plant should be able to withstand a station blackout based on the factors specified in paragraph (e) of GOC 17. Evaluate the plant's actual capability to withstand and recover from a station blackout. This evaluation includes: I Verifying the adequacy of station battery power, condensate storage tank capacity, and plant / instrument air for the station blackout duration. l NUREG-1109 APP A 5
Verifying adequate reactor coolant pump seal integrity for the station blackout duration so that seal leakage due to lack of seal cooling would not result in a sufficient primary system coolant inventory reduction to lose the ability to cool the core. Verifying the operability of equipment needed to operate during a station blackout and the recovery from the blackout for environ-mental conditions associated with total loss of ac power'(i.e., loss of heating, ventilation and air conditioning). Depending on the plant's existing capability to cope with a station blackout, licensees may or may not need to backfit hardware modifica-tions (e.g. , adding battery capacity) to comply'with the rule. (See ! item 8 of this analysis for additional discussion.) Licensees will be required to have procedures and training to cope with and recover from a station blackout.
'3. Potential change in the risk to the public from the accidental offsite release of radioactive material Implementation of the station blackout rule will result in an estimated total risk reduction to the public ranging from 65,000 to 215,000 person-rems with a best estimate of about 145,000 person-rem.
4. Potential impact on radiological exposure of facility employees For 100 operating reactors, the estimated total reduction in occupational exposure resulting from reduced core damage frequencies and associated post-accident cleanup and repair. activities is 1,500 person rem. No in-crease in occupational exposure is expected from operation and maintenance activities associated with the rule. Equipment additions and modifica-tions contemplated do not require work in and around thereactor coolant system and therefore are not expected to result in significant radiation exposure. NUREG-1109 APP A 6
=
c . . 5. Installation and continuing costs associated with the backfit, including the cost of facility downtime or the cost of construction delay For 130 operating reactors, the total estimated cost associated with the station blackout rule ranges from $42 to $94 million with a best estimate of $60 million. This estimate breaks down as follows: Estimated number of Estimated total cost (million dollars) Activity reactors Best High Low Assess plant's capability to 100 25 40 20 cope with station blackout Develop procedures and 100 10 15 5 training Improve diesel generator 10 2. 5 4 1. 5 reliability Requalify diesel generator 2 5.5 11 2.5 Install hardware to increase 27 17 24 13 plantps capability to cope with station blackout Totals 60 94 42 l 6. The potential safety impact of changes in plant or operational complexity, including the relationship to proposed and existing regulatory requirements l 4 The rule requiring plants to be able to cope with a station blackout should not add to plant or operational complexity. The station blackout rule is closely related to several NRC generic programs and proposed and existing regulatory requirements as the following discussion indicates. Generic Issue B-56, Diesel Generator Reliability The resolutio9 of USI A-44 includes a regulatory guide on station blackout that specifies the following guidance on diesel generator reliability (Task SI 501-4 Sections C1.1. and 2): The reliable operation of the onsite emergency ac power sources should be e "r4 by a reliability program designed to monitor NUREG-1109 APP A 7
and maintain the reliability of each power source over time at a specified acceptable level and to improve the reliability'if that level is not achieved. The reliability' program should include surveillance testing, target values 'for maximum failure rate, and a maintenance program. Surveillance testing'should monitor perfor-mance so that if the actual failure rate exceeds the target level, corrective actions can be taken. The maximum emergency diesel generator failure rate for each diesel generator should be maintained at 0.05 failure per demand. However, for plants having an emergency ac power system [ configuration re-quiring two-out of-three diesel generators or having a total of two diesel generators shared between two units at a site], the emergency diesel generator failure rate for each diesel generator should be maintained at 0.025 failure per demand or less. s The resolution of B-56 will provide specific guidance for use by the staff l or industry to review the adequacy of diesel generator reliability programs 1 consistent with the resolution of USI A-44. i f Generic Issue 23, Reactor Coolant Pump Seal Failures Reactor coolant pump (RCP) seal integrity is necessary for maintaining pri-mary system inventory during station blackout conditions. The estimates of core damage frequency for station blackout events for USI A-44 assumed that RCP seals would leak at a rate of 20 gallons per minute. Results of analyses performed for GI 23 will provide the information necessary to determine RCP seal behavior during a station blackout. Should this analysis conclude that there is a high probability that the RCP seals would not leak excessively during a station blackout, then no modifications would be i required. j If there is a significant probability that RCP seals can leak { at rates substantially higher than 20 gallons per minute, then modifications t
]
such as an ac-independent RCP seal cooling system may be necessary to l resolve GI 23. Any proposed backfit resulting from the resolution of GI 23 would need to comply with the backfit rule. i USI A-45, Shutdown Decay Heat Removal Requirements I The overall objective of USI A-45 is to evaluate the adequacy of current licensing design requirements to ensure that the nuclear power plants do not pose an unacceptable risk as a result of failure to remove shutdown NUREG-1109 APP A 8 I i
I decay heat. The study includes an assessment of alternative means of shut-
\
j down decay heat removal and of diverse " dedicated" systems for this purpose. { Results will include proposed recommendations regarding the desirability of, and possible design requirements for, improvements in existing systems or an alternative dedicated decay heat removal method. The USI A-44 concern for maintaining adequate core cooling under station blackout conditions can be considered a subset of the overall A-45 issue. { However, there are significant differences in scope between these two issues. I USI A-44 deals with the probability of loss of ac power, the capability to remove decay heat using systems that do not require ac power, and the abil-ity to restore ac power in a timely manner. USI A-45 deals with the overall reliability of the decay heat removal function in terms of response to transients, small break loss-of-coolant accidents, and special emergencies i such as fires, floods, seismic events, and sabotage. Although the recommendations that might result from the resolution of ! USI A-45 are not yet final, some could affect the station blackout capa-bility, while others would not. Recommendations that involve a new or improved decay heat removal system that is ac power dependent but that does not include its own dedicated ac power supply would have no effect on USI A-44. Recommendations that involve an additional ac-independent decay heat removal system would have a very modest effect of USI A-44. Recommendations that involve an additional decay heat removal system with its own ac power supply would have a significant effect on USI A-44. Such a new additional system would receive the appropriate credit within the USI A-44 resolution by either changing the emergency ac power config-uration group or providing the ability to cope with a station blackout for an extended period of time. Well before plant modifications, if any, will be implemented to comply with the station blackout rule, the proposed tech-nical resolution of USI A-45 will be puolished for public comment. Those plants needing hardware modifications for station blackout could be reeval-uated before any actual modifications are made so that any contemplated design changes resulting from the resolution of USI A-45 can be considered at the same time. NUREG-1109 APP A 9
.~. ' . Generic Issue A-30, Adequacy of Safety-Related DC Power Supply i The analysis performed for USI A-44 assumed that a high level of dc power system reliability would be maintained so that (1) dc power system failures would not be a significant contributor to losses of all ac power and (2) should a station blackout occur, the probability of immediate de power system failure would be low. ^ Whereas Generic Issue A-30 focuses on enhanc-ing battery reliability, the resolution of USI A-44 is aimed at assuring adequate station battery capacity in the event of a station blackout of a specified duration. Therefore, these two issues are consistent and compatible. Fire Protection Program 10 CFR 50.48 states that each operating nuclear power plant shall have a fire protection plan that satisfies GDC 3. The fire protection features required to satisfy GDC 3 are specified in Appendix R to 10 CFR 50. They include certain provisions regarding alternative and dedicated shutdown capability. To meet these provisions, some licensees have added, or plan l to add, improved capability to restore power from offsite sources or onsite diesels for the shutdown system. A few plants have installed a safe shut- 1 down facility for fire protection that includes a charging pump powered by its own independent ac power source. In the event of a station blackout, this system can provide makeup capability to the primary coolant system as well as reactor coolant pump seal cooling. This could be a significant benefit in terms of enhancing the ability of a plant to cope with a station blackout. Plants that have added equipment to achieve alternate safe shut-down in order to meet Appendix R requirements could take credit for that equipment, if available, for coping with a station blackout event. 7. The estimated resource burden on the NRC associated with the backfit and the availability of such resources The estimated total cost for NRC review of industry submittals required ; by the station blackout rule is $1.5 million based on submittals for 100 reactors and an estimated average of 175 person-hours per reactor. ' NUREG-1109 APP A 10
- 8. The potential impact of differences in facility type, design, or age on i the relevancy and practicality of the backfit -
The station blackout rule applies to all pressurized water reactors and boiling water reactors. However, in determining an acceptable station blackout coping capability for each plant, differences in plant charac-teristics relating to ac power reliability (e.g., number of emergency diesel generators, the reliability of the offsite and onsite emergency ac power systems) could result in different acceptable coping capabilities. For example, plants with an already low risk from station blackout because of multiple, highly reliable ac power sources are required to withstand a station blackout for a relatively short period of time; and few, if any, hardware backfits would be required as a result of the rule. Plants with currently higher risk from station blackout are required to withstand somewhat longer duration blackouts; and, depending on their existing capability, may need some modifications to achieve the longer station blackout capability.
- 9. Whether the backfit is interim or final and, if interim, the justification
.for imposing the backfit on an interim basis The station blackout rule is the final resolution of USI A-44; it is not an interim measure.
NUREG-1109 APP A 11
e &
.j i
l l APPENDIX B - WORKSHEETS FOR COST ESTIMATES I r. l-1 l l C . _ _ _ _ _ _ _ _ _ _ _ _ .
l APPENDIX B - WORKSHEETS FOR COST ESTIMATES Section 4.1 of this report provides a summary of the estimated costs to industry and NRC associated with the resolution of USI A-44. This appendix provides supplementary information to support these cost estimates. The estimates in the following worksheets are based on information from the following references: EG&G (1983), NUREG/CR-3568, -3840, -4627, and -4568, U.S. NRC (1986), Sandia National Laboratory (1986), and Science and Engineering Associates (1986). The l personnel costs for utility personnel used in these estimates is $100,000 per person year, including overhead and general and administrative expenses. t t i l il. NUREG-1109 1
. . j Worksheet.1 Estimated cost to assess plant's capability to cope with station blackout (S80)
Activity Estimated person-months Determine system capabilities (e.g.,-batteries, 12 instrument air, condensate storage tank,'RCP seals) Evaluate equipment operability Determine equipment / components necessary 2 during SBO, Determine heat loads for rooms / compartments 6 Calculate environmental conditions during SB0 4 Compare equipment design / operational capability 2 to predicted environmental conditions Quality assurance 4 Total 30 Total costs $250,000 l l 1 L NUREG-1109 2
- s .i Worksheet 2 Estimated cost to develop procedures and training for station blackout Activity' Estimated resources Person-months Dollars Dev' e lop procedures (includes writing, 3 $25,000 review and approval)
Training Initial training 3 $25,000 ; Annual update training 0. 5/yr $5,000/yr f Total training costs are calculated by the following equation which sums the initial training costs and the present value of the annual training costs over the remaining plant lifetime.
- ~
L i CTL = CIT + C AT L
= $70,000 D (1 + D )
where CTL = total training costs CIT = initial training costs g CAT = annual training costs - i! f O = discount rate (10%) I L L = remaining plant lifetime (25 years) 1 Therefore, adding the cost to develop procedures, the total cost for procedures and training is estimated to be $100,000. [a 6 I NUREG-1109 3 '
e d l Worksheet 3 Estimated cost to improve diesel generator reliability l Activity Estimated cost Reliability investigation $100,000 Equipment modifications $150,000
$250,000 Worksheet 4 Estimated cost to requalify a diesel generator Assuming that a plant would shutdown for 5 days to requalify a diesel generator, the replacement energy cost (CR ) is the dominant cost associated with this activity. CR can be calculated using the following equation:
CR=ExPxR where E = net electrical output (kWe) P = shutdown period (hours) R = replacement energy cost ($/kWh) The table below presents the data used to calculate the best, high and low estimates to requalify a diesel generator. Value
, Paramater Best High Low Net plant electrical outpost (kWe) 900,000 1,150,000 500,000 Shutdown period (hours) 120 120 120 Replacement energy cost ($/kWe)* .026 .040 .020 Total cost (million dollars) 2.8 5.5 1. 2
- Costs from NUREG CR/4568 NUREG-1109 4
g ENCLOSURE 5 Significant Changes to the USI A-44 Package Federal Register Notice A discussion of public comments on'the proposed rule and responses were added to the supplementary information section. The backfit analysis was revised to be a stand-alone document without the need to refer to other references in the discussion of the nine factors in the backfit rule (10 CFR 50.109). Station Blackout Rule (550.2) The definition of station blackout was clarified to exclude the loss of ac power from station batteries through inverters. (650.63 (c)) The station blackout rule no longer requires licensees to determine the maximum duration for which the plant as currently designed can cope with a station blackout, but only a specified acceptable duration. (650.63 (c) (iv)) The implementation schedule was modified to require licensees to submit, within 9 months after the final rule, a proposed schedule for implementing hardware modifications. Station Blackout Regulatory Guide (Section C.1.2) This section was clarified to indicate that the maximum failure rate applies to each diesel generator (rather than to the average for all diesel generators at the nuclear plant). I l
-- _ . - - - i
l W (Section C.3.1) The guidance to determine an acceptable station blackout ! duration was modified to reflect updated analyses performed for NUREG-1032. Table 1 was modified to allow a duration of 2, as well as, 4 or 8 hours, where the 2-hour duration would be acceptable,only for the few plants having the most redundancy i'n the onsite emergency ac power system coincident with the best offsite power characteristics. Table 2 was modified to add a separate group for plants with 2-out-of-4 and 2-out-of-5 diesel generator configuration. Table 3 was revised to include a third offsite power group, and the definitions of the groups were modified. Tables 4 through 7 were added to provide clearer i definitions of the site and switchyard characteristics needed to specify the offsite power groups in Table 3. The equation to estimate the frequency of losses of offsite power due to severe weather in Table 5 was modified. Figures 1 through 3 were added for clarification of different switchyard designs specified in Table 4. (Section C.3.2) This section was revised to delete guidance related to determining the maximum duration that a plant could cope with a station blackout. Section C.3.1 contains guidance to determine an acceptable coping duration. (Section C.3.2.5) This paragraph was clarified to provide guidance on the use of separate onsite power sources for coping with a station blackout. NUREG-1109, Regulatory /Backfit Analysis (Section 3.1) The text and tables in this section were revised to correspond to the revisions to the station blackout rule and regulatory guide. (Section 3.4) A discussion of the NUMARC initiatives to resolve the station blackout issue was added. (Section 4.1.1, Risk Reduction Estimates) The risk reduction estimates were updated to include estimates for 100 operating reactors (the draft NUREG-1109 =.a,- - m. * * ' * '
estimates were done for 67 reactors) and to take into account the effect of revised source terms on consequences from severe accidents. A figure was added to show estimates of core damage frequencies for plants before and after the station blackout rule. (Section 4.1.1, Cost Estimates) The cost estimates were updated to include estimates for 100 reactors. Also, estimates per reactor for various modifications and activities were revised based on additional work done in response to public comments. (Sectio.n 4.1.1, Value-Impact Ratio) This section was revised to reflect the updated estimates for costs and benefits discussed previously. (Section 4.1.1, Special Considerations) This section was revised and expanded to include discussions on trends in diesel generator reliability and sabotage. (Section 4.1.4) This section was added to present an estimate of the effect the NUMARC initiatives could have on the value-impact analysis for the resolution of USI A-44. (Section 4.2) The discussion of impacts on other requirements and related
. generic issues was updated to reflect the current status of these issues.
(Section 4.3) This section was updated to include a discussion of the backfit rule. (Section 5) A discussion of the Commission's safety goals was added to this section. A summary of NUREG/CR-4347 was added to this section, and the summary of NUREG-1032 was revised to reflect the final version of that report. (Section 6) The implementation section was revised to reflect the schedule in the final rule. (Appendix A) This appendix was added to discuss the 9 items in the backfit rule. i _ - _ - _ _ _ _ _ _ _ _ _ . _ _ _ _ ._ i
- g. ,
1 (Appendix B) This appendix was added to provide worksheets and supplementary information for the co:t estimates in Section 4.1 of the report. NUREG-1032 The analyses in this report were revised to reflect recent data on losses of offsite power and to respond to public comments. Updated data on diesel generator reliability as well as losses of offsite power were included in the reanalysis. The re-clustering of plants into offsite power groups (Section 3 aad Appendix A) is reflected in revisions to the station blackout regulatory ] guide. Tables, figures and text throughout the report have been updated to - reflect the revised analyses, j e l 4 i 1 _______---z_-___-____ _ _ . _ _ _ . _ _ _ _ _ _ - . _ _ _ _ - - - - _ _ _ . _ __ _ _ _ _ _ _ _ . _ _ . - - _ _ _ _ _ _ _ _ _ __ __J
m ge.1
, . .. c.- , ,.. . - - .
[NCloSURE 9 NUREG-1032 q Evaluation of Station Blackout Accidents at Nuclear Power Plants ,,,, Technical Findings Related to t Unresolved Safety issue A-44 jp( Draft Report for Comment $1 Manuscript Completed: March 1985 ~T Date Published: May 1985 P. W. Baranowsky Office of Nuclear Regulatory Research Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555 , f ....,,, ,
%, [,-
=
T
ABSTRACT
" Station Blackout," which is the complete loss of alternating current (AC) elec-trical power in a nuclear power plant, has been designated as Unresolved Safety Issue A-44. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on AC power, the consequences of a station blackout could be severe. This report documents the findings of techni-cal studies performed as part of the program to resolve this issue. The impor-tant factors analyzed include: the frequency of loss of offsite power; the pro-bability that emergency or onsite AC power supplies would be unavailable; the capability and reliability of decay heat removal systems independent of AC power; and the likelihood that offsite power would be restored before systems that cannot operate for extended periods without AC power fail, thus resulting in core damage. This report also addresses effects of different designs, loca-tions, and operational features on the estimated frequency of core damage re-sulting from station blackout events.
1 NUREG-1032 iii
l-TABLE OF CONTENTS
- P_agg ABSTRACT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
iii-LIST OF FIGURES ............................ vi LIST OF-TABLES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii PREFACE ................................ ix ACKNOWLEDGMENTS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi 1 EXECUTIVE
SUMMARY
. . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 2 INTRODUCTION AND TECHNICAL APPROACH . . . . . . . . . . . . . . . . . 2-1 3 LOSS OF 0FFSITE POWER FREQUENCY AND DURATION. . . . . . . . . . . . . 3-1 4 RELIABILITY OF EMERGENCY AC POWER SUPPLIES. . . . . . . . . . . . . . 4-1 5 STATION BLACK 0UT FREQUENCY AND DURATION . . . . . . . . . . . . . . . 5-1 6 ABILITY TO COPE WITH A STATION BLACK 0UT . . . . . . . . . . . . . . . 6-1 7 ACCIDENT SEQUENCE ANALYSES ..................... 7-1 8 EVALUATION OF DOMINANT STATION BLACK 0UT ACCIDENT CHARACTERISTICS .. 8 9 RELATIONSHIP OF OTHER SAFETY ISSUES TO STATION BLACK 0UT ...... 9-1 9.1 Loss-of-Coolant Accidents ................... 9-1 9.2 Anticipated Transients Without Scram . . . . . . . . . . . . . . 9-2 9.3 Extreme Internal Environment . . . . . . . . . . . . . . . . . . 9-3 9.4 Extreme Hazards ........................ 9-4 10 REFERENCES ............................. 10-1 APPENDIX A DEVELOPMENT OF LOSS OF 0FFSITE POWER FREQUENCY AND DURATION RELATIONSHIPS APPENDIX B EMERGENCY AC POWER RELIABILITY AND STATION BLACK 0UT FRE@:ENCY:
MODELING AND ANALYSIS RESULTS APPENDIX C STATION BLACK 0UT CORE DAMAGE LIKELIHOOD AND RISK t NUREG-1032 v 4
LIST OF FIGURES Figure Page 3.1 Diagram of offsite power system used in nuclear power plants . 3-2 3.2 Frequency of loss-of-offsite power events exceeding specified durations . . . . . . . .. .. .......... 3-5 3.3 Estimated frequency of loss-of-offsite power events exceeding specified durations for representative clusters ....... 3-9 4.1 Simplified 1-of-2 onsite AC power distribution system. . ... 4-2 4.2 Onsite power system functional block diagram . . . ... ... 4-3 4.3 Histograms showing emergency diesel generator failure on demand for 1976 through 1982 ......... ... ... 4-7 4.4 Failure contribution by diesel generator subsystem . . . . . . 4-9 4.5 Onsite AC system unavailability for 18 plants studied in NUREG/CR-2989 . . . . . . . . . . . . . . . . . . . . . . . 4-11 l 4.6 Percentage of emergency diesel generator failures repaired vs. time since failure . . . . . . . . . . . . . . . . . . . . 4-14 4.7 Generic emergency AC power unavailability as a function of emergency diesel generator (EDG) reliability ....... 4-16 4.8 Emergency AC power unavailability as a function of individual diesel generator running reliability . . . . . . . . . . . . . 4-17 5.1 Estimated frequency of station blackout exceeding specified durations for several representative offsite power clusters . 5-2 5.2 Estimated frequency of station blackout exceeding specified durations for several EDG reliability levels . . . . . . . . . 5-3 5.3 Estimated frequency of station blackout exceeding specified durations for several emergency AC power configurations ... 5-4 1 7.1 Generic PWR event tree for station blackout ...... ... 7-2 7.2 Generic BWR event tree for station blackout (BWR-2 or 3) . . . 7-3 q 7.3 Generic BWR event tree for station blackout (BWR-4, 5, or 6) . 7-4 l 7.4 Time to core uncovery as a function of time at which ! turbine-driven auxiliary feedwater train fails . . . . . . . . 7-8 i
- 7. 5 'PWR station blackout accident sequence . . . . . . . . . . . . 7-10 {
7.6 BWR station blackout accident sequence . . .......... 7-12 ! l 8.1 Sensitivity of estimated station blackout-core damage fre- )
, quency to offsite power cluster, AC-independent decay heat removal reliability, and station blackout coping capability. . 8-3 ,
8.2 Sensitivity of estimated station blackout-core damage fre- ' quency to EDG reliability, AC-independent decay heat removai reliability, and station blackout coping capability ..... 8-4 ; 8.3 Sensitivity of estimated station blackout-core damage fre- ! quency to emergency AC power configurations, AC-independent decay heat removal reliability, and station blackout coping . capability . . . . . . . . . . . . . . . . . . . . . . . . . . 8-5 l I l \ l NUREG-1032 vi l
LIST OF FIGURES (Cont'd) Figure Page 8.4_ Sensitivity of estimated station blackout-core damage fre-quency to reducing the common cause failure susceptibility of emergency diesel generators, their reliability, and station blackout coping capability . . . . . . . . . . . . . ... . . . 8-6 8.5 Estimated core damage frequency showing uncertainty range for four reference plants .................. 8-9 LIST OF TABLES-Table Pm - 1.1 Summary of station blackout program technical results . . . . . 1-2 3.1 Total' losses of offsite power at U.S. nuclear power plant sites, 1968 through 1983 . . . . . . . . . . .. . . .'. . . . . 3-4 3.2 Characteristics of some loss-of-offsite power-event clusters that affect W ger duration outages . . . . . . . . . . . . . . 3-10 4.1 Diesel generator start attempts and failures for tests and actual demands ........................ 4 4.2 Results of onsite power system reliability analysis reported in NUREG/CR-2989 ....................... 4-12 6.1 Effects of station blackout on plant decay heat removal functions . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2 6.2 Possible factors limiting the ability to cope with a station blackout event ........................ 6-8 7.1 - Estimated time to uncover core for station blackout sequences with initial failure of AC-independent decay heat removal systems and/or reactor coolant leaks ............. 7-7 7, ?. Summary of potentially dominant core damage accident sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-13 7.3 Containment failure insights ................. 7-16 7.4 Containment fission product release categories and failure ., mode probabilities for station blackout sequences . . . . . . . 7-18 j 8.1 Sensitivity of estimated core damage frequency reduction for station blackout accidents with reactor coolant pump seal failure delay from 2 to 4 hours and 4 to 8 hours . . . . . 8-8 9.1 Coupling between external (and internal) events and potential plant failures ........................ 9-5 NUREG-1032 vii 1 - L L - c_ _ _ ,
PREFACE This report represents the culmination of several technical studies undertaken by Nuclear Regulatory Commiss. ion (NRC) staff and contractors to place a reli-ability and risk perspective on Unresolved Safety Issue A-44, Station Blackout. The technical findings published in this draft are intende'd to document the basis for future NRC regulatory activities that will be the resolution of this safety issue. The analyses, evaluations, and results presented are meant te provide a "best estimate" assessment of the major contributors to the frequency of station blackout and the probability of subsequent core damage. Most results are presented as point estimates and are intended for use in the quantitative regu-latory analyses that will be used to support a proposed resolution of this issue. The uncertainties in the quantitative analyses are large enough that rigorous application of these results should be madi with caution. However, the staff believes that the qualitative insights and conclusions are correct and usefu.1 as guidance in determining what constitutes resolution of this issue. The staff recognizes that any probabilistic,,s,afety analy. sis..can benefit from the broadest review-and comm~e~nt."~ This~ i 's especially important when such an analysiffstobethe.basisfo.r..r.e.s.o...lutio.nofanUnresolvedSafetyIssue. P.W. Baranowsky NUREG-1032 ix
4
}
ACKNOWLEDGMENTS l The preparation of this report involved the technical contribution, review, and comment of several individuals in addition to the principal author. The con-tributions of the following NRC staff members are hereby acknowledged and appreciation given: J. M. Assuncao S. A. J. w. aonnson g stein A. M. Kuritzky L. E. Lancaster
- h. W. hy#att D. M. Rasmuson A. M. Rubin l
NUREG-1032 xi
i i i 1 EXECUTIVE
SUMMARY
" Station blackout" is the complete loss of alternating current (AC) electrical power to the essential and nonessential switchgear buses in a nuclear power j plant. Because many safety systems required for reactor core cooling and containment heat removal depend on AC power, the consequences of a station blackout could be severe. Existing regulations do not require explicitly that nuclear power plants be capable of withstanding a station blackout.
In 1975, the Reactor Safety Study (NUREG-75/140) showed that station blackout could be an important contribut'or to the total risk from nuclear power plant accidents. In addition, as operating experience accumulated, the concern arose that the reliability of both the onsite and offsite emergency AC power systems might be less than originally anticipated. Thus, in 1979 the Commission desig-nated station blackout as an Unresolved Safety Issue (USI); a Task Action Plan for its resolution (TAP A-44) was issued in July 1980, and work was begun to determine whether additional safety requirements were needed. Technical studies performed to resolve this safety issue have identified the dominant factors affecting the likelihood of station blackout accidents at nuclear power plants. A summary of the principal probabilistic results is in Table 1.1. These'results are based on operating experience; the results of several plant-specific probabilistic safety studies; and reliability, accident sequence, and consequence analyses performed as part of TAP A-44. l The results show the following important characteristics of station blackout accidents: (1) The variability of estimated station blackout likelihood is potentially large, ranging from approximately 10 s to 10 3 per reactor year. A
" typical" estimated frequency is on the order of 10 4 per reactor year.
(2) The capability to restore offsite power in a timely manner (less than 8 hours) can have a significant effect on accident consequences. NUREG-1032 1-1
I l Table 1.1 Summary of station blackout program technical results i Parameter Value Operational Exparience Loss of offsite power (occurrence per year) Average 0.1 Range 0 to 0.4 Time to restore offsite power (hours) Median O . d' 90% restored 3.0 Emergency diesel generator reliability (per demand) Average 0.98 1 Range 0.9 to 1.0 Median emergency diesel generator repair 8 time (hours) Analytical Results Estimated range of unavailability of 10 4 to 10 2 emergency AC power systems (per demand) Estimated range of frequency of station blackout (per year) 10 5 - 10 3 Estimated range of frequency of core damage as a result of station blackout (per year) 10 6 - 10 4 N NUREG-1032 1-2
. _ _ _ _ = _ _ _ _ _ - _ _ _ _ _ _ - - _ _ - _
f (3) The redundancy of onsite AC power systems and the reliability of.indi-vidual power supplies have a large influence on the-likelihood of station blackout events. (4) The capability of the decay heat removal. system to cope with long duration blackouts (greater than hours)canbeadominantfactor. influencing 5he / likelihood of core damage or core melt for the accident sequence. (5) The estimated frequency of station blackout events that result in core damage or core melt can range from approximately 10 8 to greater than 10 4 per reactor year. A " typical" core damage frequency estimate is on the order of 10 5 per reactor year. f(6) . Information currently available indicates that contairaent failure as 'a ( result of overpressure may follow a station-blackout-induced core melt.
$ Smaller, low-design pressure containments'are most susceptible to early failure (possibly in less than 8 hours). Some large, high-design pressure yb ff) containments may not fail as a result of overpressure, or if they do fail, the failure time could be on the order of a day or more.
The losses of offsite power can be categorized as those resulting from (1) plant-centered faults, (2) utility grid blackouts, and (3) failures of of fsite power so'urces induced by severe weather. The industry average fre-quency of total' losses of offsite power was determined to be about 0.1 per ; site / year, and the median restoration time was about one-half hour. The fac-tors identified as affecting the frequency and duration of offsite power losses are (1) the design of preferred power distribution system, particularly the num-ber and independence of offsite power circuits from the point where they enter the site up to the safety buses ' I (2) operations that can compromise redundancy or independence of multiple off-site power sources, including human error l NUREG-1032 1-3 I-
)
(3)- the reliability and security of the power grid, and the ability to restore power to a nuclear plant site with a grid blackout (4) the hazard from, and susceptibility to, severe weather conditions that can cirtise loss of offsite power for extended periods A review of the design and operating experience, combined with a reliability analysis of the onsite emergency AC power system, has shown that there are a variety of potentially important causes of failure. The typical unavailability of a two-division en,ergency AC power system is about 10 3 per demand, and the typical failure rate of individual emergency diesel generators is about 2 x 10 2 per demand. The factors identified as affecting emergency AC power system reliability during a loss of offsite power are (1) power supply configuration redundancy (2) reliability of each power supply j (3) dependence of the emergency AC power system on support or auxiliary cooling y systems and control systems, am/ $ rdo6< d 0<e sufg / 9 6 *n s (4) vulnerability to common cause failures associated with design, operational, ^ and environmental factors The likelihood that a station blackout will progress to core damage or core melt is dependent on the reliability and capability of decay heat removal systems that are not dependent on AC power. If the capability is sufficient, additional time will be available to restore AC power to the many systems normally used to cool the core and remove decay heat. The most important factors relating to decay heat removal during a station blackout are (1) the starting reliability of systems required to remove decay heat and maintain reactor coolant inventory NUREG-1032 1-4 i _ _ _ _ _ _ _ _ _ _ _ _ _ h
(2) the capacity and ability to function of decay heat removal systems and auxiliary or support systems that must remain functional during a station blac eg , DC power, condensate storage) ircid. <[<ch I weeC kout (dew. h ) HVA C sy c ~ (3) for pressurized water reactors (PWRs) and for boiling water reactors (BWRs) without reactor coolant makeup capability during a station blackout, the magnitude of reactor coolant pump seal leakage I (4) for BWRs that remove decay heat to the suppression pool, the ability to maintain suppression pool integrity and operate heat removal systems at high pool temperatures during recirculation On the basis of reviews of design. operation, and location. factors, the staff determined that the expected core melt frequency from station blackout could be maintained around 10 5 per reactor year or lower for all . plants. To reach this auency level of coreon melt
/Ae fre&cor er , a plant would have to be able to cope with sta- /
tion blackouts :t h ::t 4 and A perhaps 8 hours long and have emergency diesel , generator reliabilities of 0.95 per demand or better, with relatively low sus-ceptibility to common cause failures. i NUREG-1032 1-5
d 2 INTRODUCTION AND TECHNICAL APPROACH
" Station blackout" refers to the complete loss of AC electrical power to the essential and nonessential buses in a nuclear power plant. Station blackout involves the loss of offsite power concurrent with the failure of the onsite emergency AC power system. Because many safety systems required for reactor core cooling, decay heat removal, and containment heat removal depend on AC power, the consequences of station blackout could be severe.
The concern about station blackout is based on accumulated operating experience regarding the reliability of AC power supplies. A number of operating plants , have experienced a total loss of offsite electrical power, and more such occur-rences are expected. During these loss-of-offsite power events, onsite emer-gency AC power sources were available to supply the power needed by vital safety equipment. However, in some instances one of the redundant emergency power supplies was unavailable, and in a few cases there was a complete loss of AC power. (During these events, AC power was restored in a short time without any serious consequences.) In addition, there have been numerous instances at operating plants in which emergency diesel generators failed to start and run during surveillance tests. For one of two plants evaluated, the Reactor Safety Study (NUREG-75/014) showed that station blackout could be an important contributor to the total risk from nuclear power plant accidents. Although this total risk was found to be small, the relative importance of the station blackout event was established. This finding, with the accumulated data on diesel generator failures, increased the concern about station blackout. An analysis of the risk from station blackout involves an assessment of (1) the i likelihood and duration of the loss of offsite power, (2) the reliability of onsite AC power systems, and (3) the potential for severe accident sequences j after a loss of all AC power. These topics were investigated under USI TAP A-44. This plan included the following major tasks: NUREG-1032 2-1 l
(1) Estimating the frequency of station blackout at operating U. S. nuclear power plants. This analysis consisted of two parts estimating the frequency of loss of offsite power for various plant locations estimating the probability that the onsite AC power system will fail to supply AC power for core cooling (2) Determining plant responses to station blackout and the risk associated with station-blackout-initiated accident sequences. The scope of this investigation included reviewing the shutdown cooling system design and assessing its capa-bility and reliability during a prolonged station blackout 1 reviewing the containment design and its ability to withstand tempera-ture and pressure buildup during a prolonged loss of AC power j i estimating the probability of station blackout accident sequences { The principal focus of TAP A-44 was the reliability of emergency AC power supplies. This approach was taken for several reasons. First, station black- 1 out was identified as a USI primarily on the basis of the questions raised j about the reliability of onsite emergency power supplies. Second, if safety improvements are required, it is easier to analyze, identify, and implement them for the onsite AC power system than for the offsite AC power supplies or for the AC-independent decay heat removal system. For example, offsite power reliability is dependent on a number of factors--such as regional electrical grid stability, weather phenomena, and repair and restoration capability--that I are difficult to analyze and to control. Also, the capability of a plant to withstand a station blackout depends on those decay heat removal systems, com-ponents, instruments, and controls that are independent of AC power. These features vary from plant to plant; thus considerable effort is required to NOREG-1032 2-2 '
analyze all of them or to ensure that the plants indeed have that capability. Third, significant progress has been made on improving operating PWRs by back-fitting the auxiliary feedwater system to make it independent of AC power. In addition, under the TAP for 051 A-45, " Shutdown Decay Heat Removal Require-ments," the adequacy of shutdown decay heat removal systems for nuclear power plants is being reviewed. Thus, the reliability of emergency AC power supplies is o.f principal importance.to USI A-44, A preliminary screening analysis was done to identify piants most likely to suffer core damage as a result of a loss of all AC power. The intent was to survey the frequency and implication of station blackout events in operating plants and identify any plants with especially high risk that might require further analysis or action on an urgent basis. The initial results showed no such plants. I Following this initial analysis, station blackout events were evaluated in more detail. Because the station blackout issue centers on concern about the relia-bility of AC power supplies, typical offsite and emergency AC power supplies were evaluated, and operating (failure) experience reviewed. This effort was limited to power supply availability and did not include an evaluation of the adequacy of power distribution adequacy or power capacity requirements. Information on loss of offsite power was collected from licenste event reports (LERs), responses to a Nuclear Regulatory Commission (NRC) questionnaire, and various reports prepared by utilities. Most of the event descriptions in the LERs and in other documentation in the NRC files did not contain sufficient information to provide an accurate data base for estimating frequencies and durations of losses of offsite power. For example, in one case a licensee reported that offsite power was restored in 6 hours; in fact og offsite power source was restored in 8 minutes, and all offsite power was restored in 6 hours. Because restoration of one source of offsite power tarminates a loss of offsite power, the licensee's description was not accurate enough. In some other cases, although offsite power was available to be reconnected, the plant operators did not reconnect it for some time after it was avaiiable because onsite power NUREG-1032 2-3
1 l was available. To obtain more accurate data, the NRC and Oak Ridge National Laboratory staff members worked closely with the Institute of Electrical and ) Electronics Engineers (IEEE) and the Electric Power Research Institute (EPRI). These groups contacted utility engineers to get better descriptions of the causes and sequences of events, and the times and methods of restoring offsite i power (Wycoff, 1984). 1 i To gain a perspective on consequences, station blackout event sequences and associated plant responses were analyzed. The Interim Reliability Evaluation Program (IREF) was one source of information for developing the shutdown I cooling reliability models and accident scenarios needed for this evaluation. j The following sections of this report summarize the results of the technical evaluations discussed above. Details of the technical assessments are reported in NUREG/CR-2989, -3226, and -3992. Technical evaluations in this report were derived from these referel.ces to coalesce that material and extend the analysis to obtain the broader insights and bases necessary to resolve the station black- i i out issue in an integral manner, considering plant differences. These supple-mental analyses are described in Appendicies A, B, and C of this report. NUREG-1032 2-4
l 3 LOSS OF 0FFSITE POWER FREQUENCY AND OURATION The offsite or preferred power system at nuclear power plants consists of the i following major components: two or more incoming power supplies from the grid one or more switchyards to allow routing and distribution of power within the plant d s n n- a s e the nt distribution systems from the transformers to the switchgear buses Figure 3.1 provides an example of an offsite power systen design used for i nuclear power plants. During normal operation, AC power is typically provided to the safety and non-safety buses from the main generator through the auxil-iary transformer; it may also be supplied directly through a startup trans- i former. A minimum of two preferred power supply circuits must be provided. ! Sources of o#fsit.e power other than the grid may also be provided as alternate j
- f. or backup soarces of power. These may inclucle nearby (or onsite) gas turbine l generators, fossil power plants, and hydroelectric power facilities. A loss of j offsite power is said to occur when all sources of offsite power become un-i available, causing safety buses to become deenergized and initiating an under-I voltage signal. Some loss-of-offsite power transients will be very short--just long enough to allow switching from one failed source to another available I source. Because of the short duration of this type of loss-of-offsite power transient, it is not of concern relative to station blackout. This type of I
loss-of-offsite power transient is better described as an interruption. How-ever, if switching errors or failures of alternate sources of power compound the situation and longer term repair, restoration, or actuation of alternate 1 l NUREG-1032 3-1 L____________
[ ___ _ _ l l: -
)
l. l i l l l
\
l ) 4 1 l l 1 1 l l 1 dk dL u JL di di dL 4L di E ! E 345 kV 133 ky 4 em I am we nm an i y AA$ AAAA NC v NC vy vv MAIN NONSAFETY NO NONSAFETY NO CL ASS 1E CLASS 1E GENERATOR CLASS 1E CLASS IE DIVI $lON I DIVISION 2 DIVISION 1 DIVISION 7 1 1 1 i f h !
! !. _ _ tu;OyA,pc tnA.NStEa, _ _ _l _ _ _ _ _ _ _ _ _ ;
L _ _ _ _ _^FE"dT!.c LRA,NSJEp, _ _ _ _ _ j 1 Figure 3.1 Diagram of Offsite power system used in nuclear power plants 1 i NUREG-1032 3-2
. )
power sources is required, the loss-of-offsite power transient can be signifi-cant. This type of loss-of-offsite power event is referred to as a total loss l of offsite power. l Although total loss of offsite power is relatively infrequent at nuclear power plants, it has happened a number of times, and a data base of information has been compiled (Wyckoff, 1984; NUREG/CR-3992). Historically, a loss of offsite i power occurs about once per 10 site years. The typical duration of these events is on the order of one-half hour. However, at some power plants the frequency of offsite power loss has been substantially greater than the average, and at , 1 other plants the duration of offsite power outages has greatly exceeded the norm. Table 3.1 provides a summary of the data on total-loss-of-offsite power i evsnts through 1983. Because design characteristics, operational features, and the location of nuclear power plants within different grids and meteorological areas can have a significant effect on the likelihood and duration of loss-of-offsite power events, it was necessary to analyze the generic data in more detail. The data l have been categorized into plant-centered events and area- or weather-related events. Plant-centered events are those in which the design and operational characteristics of the plant itself play a role in the likelihood of the loss of offsite power. Area- or weather-related events include those on which : the reliability of the grid or external influences on the grid have an effect on the likelihood and duration of the loss of offsite power. The data show that plant-centered events account for the majority of the loss-of-offsite-power events. The area- or weather-related station blackouts, although of lesser frequency, typically account for the longer duration outages with storms bei~ng the major factor. Figure 3.2 provides a plot of the frequency and dura-l tion of loss-of-offsite power events due to plant-centered faults, grid black-out, and severe weather based on past experience at nuclear plant sites. Appendix A to this report provides a more thorough discussion of the technical bases for the loss-of-offsite power frequency and duration characteristics discussed in the remainder of this section. l NUREG-1032 3-3 L_ ___--_ _. _ _ _-- _ -
%%\e. 3.\ l o hod \one t o e t,M poww ok V.S. wec\e u go uts g\u4 s tke s ; 19 e f W veugk te gr s V ,
g o y,,9 1 <c4 he-S ok oecuv vowe e., g yer defo%.i , cv A c.o.\ - s Ac bc yea.V *
- 7t fA tJf - Cn.Wt4FQ % 09 ~l 3' 6OD \L .o\4 . (,
i uJ E AT 4 e @ 6 ,oo7 3 , 5'! i Toto \ loi ,\o9 ./, 4 ~ToVo.k C f i k ' C O. -$ C V,e A'45 (Od% OC W i, w w 4 et.r = 52.1 geces
,yx ,
b* lS R CA pm h fiy o g r o w t & U $ lce ll l'e $' &l*& Ve(og Sc5d va(a 'i: 4 6 / suer.
.. . . . _ . ... 3_~1 . _ _ . _ .
l
\ \
0.05 " - Total t I Me " 0.04 E b U 5
. 5 s 0.03 - -
g Plant ~ . 0 Centered o o 0 b 0.02 -~~ - e Grid u. 0.01 """ severe Weathef 0.00 \ , t 0.1 1.0 10.0 ouRATIO W O \ \ Figure 3.2 Frequency of loss-of-offsite power events exceeding specified durations g' guREG-lo32 3-5 1
Plant-centered failures typically involve hardware failures, design deficien- l cies, human errors (maintenance and switching), and localized weather-induced faults (lightning and ice) or combinations of these types of failure. No strong correlation was found between the frequency of plant-centered loss-of-offsite power events and any particular design factor. However, a modest cor-relation was observed between the duration of plant-centered loss-of-offsite-power events and the independence and redundancy of offsite power circuits at I a site. In this regard, it has been observed that a site with several immediate l and delayed access circuits will generally recover offsite power more promptly I than a site with only the minimum requirements. However, recovery from the relatively high frequency plant-centered faults can be accomplished within a few hours. Plant location plays an important role in loss-of-offsite power events. Factors shown to be significant were (1) the reliability of the grid from which the nuclear power plant draws its preferred power supply and (2) the likelihood of severe weather that can cause damage to the grid distribution system and hence a loss of power to the plant. Traditionally, analyses have focused on grid reliability as a dominant factor in estimating loss of offsite power at a lant site. However, a review of the historical data shows that approximately of
/ 4 all loss-of-offsite power events have been caused by grid problems, and, in fact, a large percentage of grid-related loss-of-offsite power events can be traced to one utility's system. The grid reliability of that system dominates the data, distorting the perspective on the contribution of grid failure to j loss-of-offsite power frequency. This finding of overall grid reliability should not be unexpected when one recognizes that current distribution and dispatch systems are well coordinated. Utilities shed loads when possible and generally protect their grid from overloads and faults that could cause grid loss in the various day-to-day operations. Moreover, when there is a loss of power on the grid, the first activity that is usually undertaken is the resto-rati o ower to the electric generation plants so that the grid may be re- l rutn store th appropriate power supplies. In fact, during the Northeast blackout I of 1965, power was restored to a nuclear power plant in New England within i about one-half an hour of the grid collapse, while power was not restored to the entire grid for 24 hours or more.
NUREG-1032 3-6 ____ _- ____________-___ - _-__ a
i With the exception of a few utility systems, large grid disturbances are rela-tively infrequent, and, again with few exceptions, the duration of power outages at power plants as a result of grid disturbances is relatively short. An identified weakness in a system is usually corrected as soon as practical; it , is the unidentified weaknesses that result in grid failures. In the absence of a historical trend, operating experience related to grid reliability is not necessarily an indication of future problems unless a known weakness has not been corrected. Because grids in the U.S. are generally very stable and system planning is directed at maintaining and improving that stability, grid relia-bility is usually not the principal indicator of the likelihood of loss of offsite power. 1 Severe weather, such as local or area-wide storms, can disrupt incoming power j supplies to the plant. In fact, a number of loss-of-offsite power events at nuclear power plants were weather-related. These can be divided into two ' failure groups. 1 I I (1) those in which the weather caused the event but did not affect the time to
- ~
restore power (2) those in which the weather initiated the event and caused adverse condi-tions over a sufficiently broad area such that power was not or could not be restored for a long time The first group includes lightning and most other weather events that are not too severe. They can cause a loss of offsite power, but their severity gene- ] rally does not contribute in any significant way to long-duration losses of offsite power. These types of weather-related losses of offsite power have been treated as either plant-centered or grid-related losses of offsite power. The second group includes losses of offsite power as a result of severe weather such as hurricanes, high winds, snow and ice storms, and tornadoes. The expected loss-of-offsite power frequency of this group is relatively small. On the other hand, the likelihood of restoring offsite power quickly for this group is also relatively small. Although it is expected that the actions of dispatch and plant personnel can influence substantially the duration of NUREG-1032 3-7
l l l l l area-wide grid disturbances that cause a loss of offsite power, severe weather conditions--and the expected duration of the resulting loss-of-offsite power events--cannot be influenced in the same way. Therefore, one would expect severe weather to dominate the restoration characteristics for long duration outages. The redundancy, separation, and independence of the offsite power system may affect the likelihood of some weather-related losses such as those induced by tornado strikes.. The depth of this study has not been sufficient to show the effectiveness of these design considerations on reducing the likeli-hood of other types of weather-related outages. There is a potentially large variation in the annual expected frequency of loss-of-offsite power events at different nuclear power plants, depending on their design and location. A large variation also has been observed in the duration of loss-of-offsite power events at different nuclear power plants. The expec-tion of long-duration outages is dominated by the likelihood of severe storms and, to a lesser extent, by the likelihood of grid blackout and the ability to restore power to the site during grid loss. Grid-related losses are important only when the frequency of occurrence greatly exceeds the national average. Appendix A describes the modeling and analyses performed by NRC staff to deter-mine the relationship between design and location and the frequency of and dura-tion of loss-of-offsite power events representative of most U.S. nuclear power plant sites. Figure 3.3 provides a plot of the expected frequency and duration for loss of offsite power for site, design, grid, and weather characteristics that have been found to " cluster" reasonably well. The factor that most predomi-nantly affects the characteristic groupings is severe weather. Table 3.2 pro-vides a definition of the site characteristics that make up the loss-of-offsite-power clusters shown. Appendix A includes additional discussion of the charac-teristics of these clusters. NUREG-1032 3-8 l t l
g P *^ m M j I f8 ) M lq g L -
. 4 e
'6 i
- f. . r j'_,
1 1 _.>
- e. O C 4 -r J
O 1l
/
>, x , . e l,
(J w , ll l i Zg / !! !
\
w> v I ll l it D- ,f i : Oa3 ll l
) wo i l il j l /u -o l T .\-
l I i LL 1 i f l .; , ;
) ,
i a-<
! O- /-
f
/ /
i i.. 2 O_ Lt j , l I l l l _. 4 l OZ j t i j !
+ -
Du JO --
/ i
/ .
/ i Q H f I
[' : f T OF
.,f* l l : s~~
l] \ ,I *
/ 1 HY /
~
/
/ ! !
/ ji ,f i l e :c
<k D /
- j. l 1O / :
m -
/ ,I / /
s Ha ) e . ca m g... / /,....
,. /i tz
(/) wZ 4 so s .: .. . . *. .. ... .a g l h i g g i e
...',,ie eh g i Oe e ie 6 4 e
- I I I
g
~
b 6' C l'W[_,m-l._I{Q.V]u[,l,l[jlhb]Mdillfc.(%_IC_l g A _ . J_ -- --- h
i Table 3.2 Characteristics of some loss-of-offsite power-event clusters that affect longer duration outages Cluster Characteristics 2 Offsite Power Design Group II,'I2, or 13*; located in an area of very low severe weather hazards or susceptibility to severe weather hazards is very low 4 Moderate to high severe weather hazard area and susceptibility 5 Very high severe weather hazard area'and susceptibility 7 Average grid reliability and combinations of offsite power system design and severe weather hazard / susceptibility that most closely approximate the national average for nuclear plants
*See Appendix A for definiti.ons of Design Gro.ups II,12, and 13.
y g<f Mn (\l Osf NUREG-1032 3-10
F~~~D 1/tSerf Nhc 3.2 l Y LO t Oct O V1 A fYCL e he Y fCo & fa ! C 1 a.J ainnr cas 9 fe s es d
% pen /wwcs & bu d s< ve.;aA y An t
,a ,say sc<ecc
- . S2c< loca ce a nee <<.ri d dpf sevm w ,,f4 < \
L= sed w as w;M t k &J dis,p h a,r,tG:u ,p<< /s er bel $n r<cwm s.e pe ce 6:ccfaf02ck'caer s/lcr re 6 e. v b +, , ,
- - +
auf da d pucarde .wca weaf e ads or cbsef ksGres ( bynj , b.4 , ,/4Q far a< Aa5 meoven, $nv .rvef % /4<
.a16 4 SAs 44 odow.,7CE//4 /g ! ua<cresbn p,/ m&;/ 4 a u/
4>w,sev<<eweaflv,bys,ds uen(& As a&s wiVI dwpr> kascec d~ A ks d dst e fswv er dads n - al r:6c ns, Wea
- s. s n wit s a d a Lyf y u c a n/J ani ma6;s s_ -
.a ,,.- aus d
. / dog ( ufeuf nic >d0 ira.:fc ntL seuea unJhc 4 ~4 - oeryn Gaber tCt ;
k f fhm C-/ O ct d~ n p<o n y % n n /4 ,c A
4 RELIABILITY OF EMERGENCY AC POWER SUPPLIES The emergency AC power system provides an alternate or backup. power supply to the offsite power sources. Figure 4.1 is a simplified one line diagram of a typical emergency AC power system. If the offsite power system is lost, an undervoltage condition will exist on the safety buses, causing actuation of the emergency AC power system. The emergency AC power system provides sufficient functional capability and redundancy of the power requirements for the systems needed to mitigate the consequences of a design-basis accident. This typically includes a requirement to actuate emergency AC power supplies and make them available for loading within about 10 seconds after receiving an actuation signal. The emergency AC power system also meets the single-failure criterion when applied to design-basis accidents. i Emergency AC power is generally provided by diesel generator systems, although other sources such as gas turbine generators or hydroelectric power are used at some plants. Because of the preponderance of diesel generator usage, that power supply type will be the principal focus of emergency AC power system discussions in this report. Figure 4.2 identifies the typical subsystems and support systems that are needed for successful operation of the emergency diesel generator. Emergency AC power systems typically consist of two diesel generators, either one of which is sufficient to meet AC power load requirements for a design-basis accident. This configuration has been designated by its success criterion: one out of two or more simply 1/2. In some cases, three or four or more diesel generators are used at single-unit sites, and in others, diesel generators are shared at multi-unit sites. These systems also can be described by their success criteria, or number of diesel generators required per number provided. However, for evaluating the station blackout issue, the success criterion will be defined as the number of diesel generators required to maintain a stable core cooling and decay heat removal condition with all offsite power sources unavailable. NUREG-1032 4-1
F f i l l i MAIN O F F 511t MAIN OFf 5ff t Unit P0wtA UNif POwtA uw uw aw ww N EWtactmCY CJ E tutACENCY CJ susi SUS 2 d.l6 K V e 400f TYPICAL d40V ff ' L { 0 O StavlCE LOAD
- StavlCE waitA I DGI DG2 'AftA 2 (WC AGENCY- tutnGENCY DC l DC 2 LEGENO
@ . C LO510 s a t AKtm Q *OPlusalanta w a l Aat45Fomwt A 1
I j Figure 4.1 Simplified 1-of-2 onsite AC power distribution system i
~l s
NUREG-1032 4-2
}-
I l p_______________ -_q EMERGENCY
, - SEQUENCER- PREFEnnED
'l 1 e l OUTPUT j ! DC DnEAKER N I s
- I ESFAS DC g
( f DESEL GENEnATOR ) w i 1 ESFAS 6'\/\ /\ g FUEL Olt EXCITER COOLING - VOLTAGE l REGULATOR l
. I I START SYSTEM ,
1 SCAVENGING
..l.. I a'a kovndery l
I I 00VERNOR l l EXHAUST I I l
- SHUTDOWN l 1 1 I L _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _,J Figure 4.2 Onsite power system functional block diagram i
*ESFAS = engineered safety feature actuation system
'l s
5 6 NUREG-1032 4-3
The emergency AC power configurations that exist in the U. S. have been identified as follows: (1) Emergency AC power supplies dedicated to one unit 1/2 1/3 1/4 2/4 (2) Emergency AC power supplies shared between two units 1/2 2/3 2/4 2/5 3/5 (3) Emergency AC power supplies shared between three units 3/8 ( \lq a+ m v4 n,J m 4 zus,4s w,M e,a fn 1,dween Jo.J 1 ure nyd~sl . Although a closer review of emergency AC power supply requirements may produce some variations on these configurations, they represent a wide variety in system success criteria for reliability evaluations. The design variability of emergency AC power systems is further complicated by dependencies on certain support systems that, by themselves, have a multitude of designs. These support systems include cooling systems (air or water), DC power, and heating, ventilation, and air conditioning (HVAC) systems. Moreover, maintenance and testing activities vary considerably, which can affect the reli-ability of the emergency AC power system. Emergency AC power systems can be considered in two separate parts: power supplies and the power distribution system. In general it has been found that the individual components of the emergency AC power distribution system from NUREG-1032 4-4
the safety (switchgear) buses to the safety components are not significant con- l tributors to the unavailability of AC power in regard to the station blackout issue. This statement is true because many independent, separate, and diverse distribution system compor.ents must fail to cause loss of all AC power to the safety systems. Although fires and earthquakes have the potential to cause such distribution system failures, these hazards have been studied as separate safety issues, and were not systematically assessed as part of the station blackout issue. Substantial operating experience data were investigated to identify and esti-mate important reliability characteristics of emergency diesel generators (NUREG/CR-2989). Diesel generator reliability performance information was collected from 45 nuclear power plants with 86 diesel generators. A summary of the emergency diesel generator statistical data collected is provided in Table 4.1. In addition, information regarding diesel generator outages and downtime was obtained from responses to THI Action Plan (NUREG-0737) items from licensees of plants with 58 diesel generators, and more than 1500 licensee event reports (LERs) covering the 5 year period from 1976 through 1980 were reviewed for failure information. Analysis of this operating experience showed that, on l the average, diesel generators failed to start, load, or continue running approx-imately 2 times out of every 100 demands. It was also observed that during the actual loss-of-offsite power events through 1983 there were 19 instances in which one or more diesel generators failed, operated in a degraded condition, or were otherwise unavailable. During most of these events, the degraded diesel generators were able to meet minimum performance requirements, and failed units were promptly restored to an operable condition. And, from 1976 through 1982, there were 45 multiple diesel generator outages identified, of which 11 were lassifie as common cause failures. M## ForN Id MS Nhda'N# s $1 b4 he W y wr ifP3 MrviflS dhah /nors a more reced & E*P^} Figure 4.3 provides nistograms of emergency diesel generator failures on demand for 1976 through 1982. Although the average failure on demand observed is about 2 x 10 2, there is a significant spread from the highest to the lowest demand failure rate. The average failure rate and range have not changed substantially ) i during this period. A review of the data has not identified any particular type of failure as the most dominant. At least in part, the reasons for this are (1) there are several different types of diesel generators, with different sup-port and auxiliary system designs, operating at nuclear power plants, and NUREG-1032 4-5
I L i
. Table 4.1 Diesel generator start attempts and failures for tests and
) actual demands
- l CRem ANA eo /c a -1964 l
No. of Auto-auto start Start No. of Fail- start fail-attempt No. of fail- ures per fail- ures per Unavail- Unavail-category demands ures demand ures demand able ability Test 13,665 253 0.019 55 0.004 --- 0.006 l Loss of 100 5 0.05 3 0.03 3 0.03 offsite power ** All 539 14 0.026 5 0.009 3 0.006 emergency demands Failure to run: 2.4 x 10 3/hr***
- Summarizing the responses to diesel generator reliability questionnaires based on 45 nuclear power plants, with 86 diesel generators, for operating years 1976 through 1980.
** Updated from data reported in NUREG/CR-2989.
*** Based on 314 attempts at scheduled run time of 6 hours or more with 9 failures to run during these attempts.
5R0k1 M64C /CE
& '"* d ll* l Ak 64 auM(e m Qq Ads a -{w&xs ,xed&md AK 2/103 2 TO* .o/3 eugy 40s 2 . a, rf -
+'t ,ey j Lggi /
L u-fada 6 run : 3.280-
- ruid<s 53 fadues (M (rd /m l-ER, ad d ix/udd & NMc Iof p{us 14 evub cafyen'idas M & lures k NMc IOT.
H-(o
L
\
t i
.m . ,s . ,s .
s' m. m, e- 1976 m. m.
. 1977 1978 j
$ m' m, E m<
r a
; s'
, j m< g a.
t, m' - y m< g u. g m- e m. , g m.g
- m- ! m. a i m.
E r = g L m- m. m. Se te H E 1 J., i i i 4 e M. os
. a. e. as as e h.e.as. aM. .
se ,e e
] *,',' M. . . . . ,.
a a..a e a er a e =>e e, en m o. m os e a e m,m PAOBA8tuTV Of f Astual paosassury os saitung emosastuYv 08 FasLUAE 100 < Sm a
- m. m.
- m. 1979 m. 1980 2 m, 2 m.
g m- ; m. a m-1 $m. C 3 g m. g m. g E m- i m-r r ma 1 ,, m- g ,, ,, a'
. . . . e. .
d.-. ei e a a as se o a su === m a as a es a w e e = > >o PROSA81ufv Of falLUAE Paogaa#UTV QF SAstuRt is a 900 a
- m. m.
. m- 1981 . m- 1982 I
. e e
, a n. a n.
i m. i m. m.
.! m. .!
e m. e m. fm. f m.
- m. 1 m. 1
- m. . m.
, . . r. 1 .
r1
- 6. . .
I 81 e et es e e W e a se P ts 01 m a a e a p e e 10 > te PWOGAssuTV Of FAstunt ##0BattuTV 08 8AstuRE l l l l l Figure 4.3 Histograms showing emergency diesel generator failure on demand for 1976 through 1982 1 I NUREG-1032 4-7
(2) maintenance and-test activities are not standardized within the nuclear in-dustry. Figure 4.4 shows the percentage contribution of failure by subsystem. In general, sufficient information was not available to add high confidence to the correlation of root failure causes with specific design and operational factors. The data indicate that approximately 80% of the failures are the re-sult of-hardware-related problems and 20% are the result of human error. These statements are not meant to imply that any one particular diesel gene-rator is susceptible to all possible failure modes with equal importance. It is more likely that a few specific defects may exist, and if these are not discovered and corrected, failures may occur. The failures observed can be classified into three general types: (1) design and hardware failures related to mechanical integrity or various failure modes in the diesel generator subsystems, such as fuel, cooling, starting, and actuation (2) operation and maintenance errors related to the correctness and adequacy of procedures or training, and human factors including the potential for errors of commission and omission (3) failures that occur in support systems, or at interfaces with support ! systems and other systems, that can involve DC control power, service (or raw) water cooling, environmental control (air temperature and quality), and interface with the normal AC power system (vrowvelke tcloys') . Multiple diesel generator failures can occur when a fault or degradation exists involving a common factor or dependency for two or more diesel generators. Multiple failures may also occur as a result of design and operating deficien-cies similar to those previously mentioned, but in this case degradation or
}
failure occurs concurrently in multiple diesel units. For instance, a defec-tive crankshaft design may be such that mechanical failure is highly likely to occur after a certain amount of usage. If two or more diesel generators reach that usage level at nearly the same time, concurrent failures may result. As NUREG-1032 4-8 l { _ _ _ _ - - - _ - - - _ _ _ _ - . - -- - __ )
35 - f 1976-80 so - m
.... :.., 1981-82 m w
- 25 -
z . o P -
") .
g 20 - - x y W m . o - . a U 15 w x . y
"} ,
! ~ .
w 4 10 -
'#, ,1
;~-
j j.
'. m
'i
;iii!E
$y:-
5 - :, : :,' 4 -
.g,; '.
y,g , , y. yp , p, 0 I 4' 0/ M'Ol// 0 *
&o .
SUBSYSTEM Figare 4.4 Failure contribution by diesel generator subsystem 1 1 NUREG-1032 4-9 l l l
another example, defective maintenance procedures and training could result in human errors causing failure or simultaneous outages of two or more diesel units. Another type of common cause failure is related to the existence of single point vulnerabilities. Examples include a check valve in a header of a cooling water supply, the unrecognized dependence on an obscure single control circuit or element, and the use of common fuel supplies and containers. Finally, common cause failures can be related to commonality nf location with regard to environmental conditions for which adequate protection is not provided. These conditions can include fire, flood, dust, corrosive elements in the air, or temperature and humidity extremes. In assessing the reliability of emergency AC pcwer systems, consideration was given to the failure modes, causes, and failure rates derived from the opera-tional data. Reliability analyses performed by Oak Ridge National Laboratory (ORNL) for 18 nuclear power plant AC power configurations and the plant-specific failure data were applied to derive typical system unavailability estimates. Figure 4.5 shows a histogram of the onsite AC power results for the 18 plants studied. The results of this work, summarized in Table 4.2, show the diesel generator configuration studied, the calculated range of unavailability on demand, and the dominant failure causes for each group analyzed. Not surpris-ingly, for the least redundant system configuration, the independent diesel { genertto.' failure likelihood is the most dominant failure factor. As system { redunoaney is increased, common cause failures become more important. Common I cause failures involving hardware failure, human error, and dependent system ) failures were found to be important, i Although, for the most part, power supply outages resulting from testing and maintenance were not found to be large contributors to system unavailability, a few cases were identified in which extensive maintenance outages could cause significant system unavailability. The quality of test and maintenance pro- ' l cedures, however, can be an important factor affecting system reliability. Lower than average human-error-related diesel generater failures were observed when procedures were clearly written and had a sufficient level of detail, in- I cluding complete check lists so operations personnel could verify that normal values were properly indicated after maintenance. ( ! NUREG-1032 4-10
l ; i
.j 8-l 6-J l
$ l a l i 5 Q.
B 4-5
= ;
I E o z 2 q l i i
! i 1
0 4 4 1x10 2 3x10-2 1x10~ l 1x10 3x10 1x10'8 3x10'3 UNAVAILABILITY Figure 4.5 Onsite AC system unavailability for 18 plants studied in NUREG/CR-2989 NUREG-1032 4-11
-------- - _ - _ --- _ a
Table 4.2 Results of onsite power system reliability analysis reported in NUREG/CR-2989 Diesel generator Range of system unavail-configuration ability per demand Dominant failure causes 2 of 3 4.2 x 10 3 to 4.8 x 10 2 Independent diesel failure; human error CCF*. 1 of 2 1.1 x 10 3 to 6.8 x 10 3 Independent diesel failure; human error CCF*. T&M** outages. 2 of 4 3.7 x 10 4 to 1.7 x 10 3 Human error and hardware CCF*. 1 of 3 1.8 x 10 4 to 7.2 x 10 4 Human error, hardware, and service water CCF, independent diesel failure; DC power CCF*. 2 of 5 1.4 x 10 4 to 2.5 x 10 3 Human error, hardware, service water, and DC power CCF*. -
*CCF common cause failures
**T&M = test and maintenance 1
l NUREG-1032 4-12 _____________-_ - _ _ - __ - __ _ ~
m l l I l . The impact of dependent systems (such as service water cooling and direct cur-rent (DC) power) on the reliability of the emergency AC power system varies l from plant to plant. The ORNL analyses did not go into detail on the relia-bility of those support systems. However, failures of dependent systems that affect the emergency AC power system seem to be dominated by single point pas-sive failures or human error. Anhighly unreliable support system can cause an L' highly unreliable AC power system. Because these support and auxiliary systems also tend to be important for the operation of decay heat removal systems--and to some extent for the supply cf normal AC power from the offsite power sources-- single point vulnerabilities and human error failures in these systems have added importance. Another potentially important reliability parameter involves the likelihood of a failed power supply (diesel) being restored to an operable state during a loss-of-AC power transient. A b.istogram based on emergency diesel generator repair times following a failure is provided in Figure 4.6. The median repair time is approximately 8 hours. These data represent an aggragate for all types of failure modes, and, for the most part, they represent repair times during non-emergencies. Primarily these failures occurred during plant operation, but some occurred during plant shutdown. It is difficult to determine whether these data over-estimate or under estimate the diesel generator repair time anticipated during an emergency. There are reasons to believe that these data over-estimate the time required to repair a failed diesel generator during a station blackout. Because the typical limiting condition for operation (LCO) for a single diesel generator out of service is 72 hours or more, there is no urgency to restore a failed diesel generator as quickly as would be the case during a loss of all AC power. In addition, the LCO may not have been in force if the plant were shutdown when a test failure occurred, which would have lessened also the urgency for repair. Moreover, if a feilure did occur when alternate AC power sources were available, it might be seen as an opportune time to perform other routine maintenance on the failed diesel generator. Conversely, the repair time could be under-estimated by virtue of the confusion that could occur during a station blackout event. Under stress, human error is NUREG-1032 4-13
M l .s
)
i 20 <
}
to n
-i 5
- u. . ___
~
~~~~
o
. ,? _
. g -
1 l' e
~
4 { 1- _
, 2
- sse 3 3 I I 9 11 13 15 26 1600
. !. Time Since Diesel Generator Failure (hours)
-t Fig.re 4.6 Percentage of c:nergency diesel generator failures repaired vs. time since failure i
.j Source: NUREG/CR-2989
. i
' i f
4 NUREG-1032 4-14
-i j'.
. ~l l
l l l l l I 1 usually higher than it is under normal conditions. The diesel failure problem { would have to be diagnosed, needed equipment would have to be obtained, and cor-rect repair procedures would have to be followed; all this would have to be done under time constraints and pressure, without AC power available. Also, main-tenance and operations personnel resources would be divided between activities for restoring both offsite and emergency power supplies. In addition to coqducting the plant-specific analyses, ORNL constructed generic models for different emergency AC power configurations. These generic models were used to estimate system reliability as a function of the important char-acteristics identified in the plant-specific analyses. Typical system depend-encies and nominal values for common cause failures and procedural errors were assumed in the models, and sensitivity analyses were performed to determine the importance of all the factors considered. Overall, the most important factors tended to be system redundancy and the reliability of emergency diesel genera-tors on demand. Not surprisingly, it was found that common cause failure is most important in highly redundant system configurations with highly reliable (for independent failure causes) diesel generators. Based on these considerations, the NRC staff performed additional analyses of emergency AC power system reliability to extend the quantitative results and further explore the sensitivities. Figure 4.7 shows the effect of varying emergency diesel generator reliability on emergency AC power system reliability for several configurations both with and without common cause failure. The sensitivities of system reliability estimates on variations in diesel generator running reliability are shown in Figure 4.8. Additional results, parametric analyses, and details of the analytical model are provided in Appendix B. 1 Thus, on the basis of a review of operating experience and reliability analyses, the following factors have been identified as being the largest contributors to AC power system availability: (1) the configuration of the diesel generators in terms of the number avail-j able and the number required for shutdown cooling i i e NUREG-1032 4-15 i
- i. i r
1 s- ai I '1 1 k IA b O., O,, ,O, O
,., V V V-i O 'O .O O i i i I ?* (*) I'~j .)
(M ('*) W 7 l 'y ' Ns \ \s N N N \ 'N
'l' y
4 Bj~ bl - . , Dj Osj j en V i i g i 4 l t ! l 3 8 I : , : 1 I i I- ; i 1 e 0 ru j a % 9
) M~ >k-mu
- 7 N n v
- i
. o d~ - t i It :- / -
; ,m / '( ./ . i i t(/
F
, :f / Wj' h,' M /*/ /,o
/*.
A ./ ,<*'/,. ,. j' l .! j l
/ *>
/ l j / t &
!,fl/,
h l I '/ / $ s D 5
/ ./ /i ! /
5 C
/ .
!// l /-
!/ /
/ .?< -
/ ,./ / / . i .
/ .J k,
I l l } {.' o . i
- / /*l --mT2 I LL. / /
, e g e i ,e />/
g Ve
/
' ;l
/ -
l ,, , l ll' l l
- f 1
o D R l
/ l l* o
\
- ) - l / -
l l / / / , Oj LLJ l t l m Hl/>/ l
'l
~
/
l ,
,I / '
l ,
/
/ h, / / l /
/ .0 ll l l r m.
i a i i 4 6 s iiia i 6 s i 6 ii1 a e i i a i is I s r== r T""* , .
')
-. Q<
O- O O l-Vm n v O. 1 n
- s l1 * , , f .
I i. el-/6
.c e 9
s m',9
. ep .e. 5D 8, d a'me
=M I
, i ! i I' , ,
#. i
{ t l 1
' ^ ~ ~
.' l : . . t i, 1 g s e 3 j i a # .
i I I
'ggs
~
/ i ;
l , , 1 l - i i i . t
/ / / J ti i t /
- i l;* -
I j i 1 i "i . . ,, . J , r r l+
- I
/ i l
- l
/ . l ~s --
/- / 9 #
! ,/ .' >
/ / .
- f '
s
-l l
/ -/ l l s I
~~~
l ; l 1 ~., lI. :- / -m.
, 1 ,. ,
1 : -V* f
/. / *}/
g l j
/ /
,f i,
g m.- i j o l
,/ t ,1 i
/ / i
/
} l w 9 i -r I ; , , t
- , ,I ,
, en c ,
/ r i b _
( )' s
- r i
I
=
f_ '
, ;j j l s ! - a.-
p j .t ; o ; I <'. , I ( .'
>; i l n > <
f_
"l , s
) i I t J l
- q I
! r
~
'i j 5 I'
~ ),
, a
/ t i l
f 4 : ,[..~ ,[ f
, y
?
- J
! , j , ,
</.. 4 , ,
1 1 : , I I l : -. I .I ,i / j I i
- ,. i l !!l'
/ t i* i I
l k
; j i 0d
. i il 1 i ! ' - A Y i
cd j
,W i
me a,e 1
'a= ' we L ** - .-~.
4 v.
" , = . --
a 1 H-17 l _ _ _ - - ._
(2) the reliability of diesel generators or other power sources used in the emergency AC power system (3) the dependence of the AC power system on support or auxiliary systems used for actuation, control, or cooling (4) the vulnerability of the AC power system to common cause failure as a result of various design, human error, and internal or external environ-mental hazards In general, it has been observed that problems with onsite emergency AC power systems are very plant-specific, and improvement in system reliability would have to be developed on a plant-by plant basis. s NUREG-1032 4-18
5 STATION BLACKOUT FREQUENCY AND DURATION There have been several incidents at nuclear power plants that could be classi- ' fied as precursors to station blackout. In fact, there have been a few cases in which loss of offsite and emergency AC power supplies occurred simultaneously. However, none of these events progressed to be a significant safety concern. Many of these incidents occurred when plants were shutdown or during refueling, when station blackout concerns are much reduced and the LCOs--in terms of num-bers of offsite and emergency AC power supplies available--are reduced. The lack of a significant number of station blackout events is not surprising when one considers past frequency of loss-of-offsite power events and the re-liability record of emergency AC power systems. As a result, it has been necessary to estimate station blackout frequency by combining loss-of-offsite-power-event frequency and duration correlations with the emergency AC power reliability models. (Appendix 8 describes the methods used to derive station i blackout frequency and duration estimates.) j Figures 5.1 through 5.3 give the results of sensitivity analyses performed to determine the effect of design, location, and emergency AC power supplies relia-bility. Specifically, Figure 5.1 shows the effect of site location and offsite powersystemdesignasrepresentedbyoffsitepowerclusters2,Y,#4,andk. l (These clusters are defined in Section 3 and Appendix A.) These clusters were l combined with a typical, two-diesel generator, emergency AC power system with a diesel generator reliability of 0.975. Cluster #isacloserepresentation / I of the average of nuclear operating experience with regard to the frequency and duration of loss-of-offsite power events. Cluster2 g represents sites with re-latively high severe weather hazards and susceptibility to failure from those 3 hazards. Cluster /has slightly lower severe weather hazards than cluster 3. / c j Cluster ~f represents the combination of the more reliable offsite power design l features and sites with low severe weather hazards or low susceptibility to l severe weather hazards. The estimated frequency of longer duration station l blackouts is dependent on the likelihood of the more damaging and extensive NUREG-1032 5-1 1 1 L___ _ _ _ _ _ _ _ _ _ _ _ .
1 1 I i I
*d*~* mu +<.r.~ .e-. m...,n,.,,,-.-_,,,._ ,.__ _ _,,,__,_, _ _ , , _ , , _ , _ _ , _ , _ _ _ _
1 l Z I/{ l
.y .- 1 31 l
, 1
' l l3 ;
.2 e )
a , 4 4 i
\l / ).
'f g/ .,
E w >* - m , s c g
>ia==us h p / /
.f j
-- r 2 i .
==== f d
j / '
.- I m W / / // <
i s, _j $ 3 ,
.w, l 0
(~) ,
/ *
, , .4 Q w i i ,
s,
,, W / .
\ , l
- s' N.
w o Q .
.i
~,
%, f' f j ! - '
>f '
1)) g , f/ aD C1 i' I,Q ii l n1 f
/ ,//
/ /j /
-lI H. ,.,.
D' i , , a i
/ / / i ,- .- T. ,
/ \- l /
/
l l;t , r
? v' %'
6
} l l .
O (s (\ l
; / /
4 M
, ' / ls,o j 1 6
- ./
- .e
/ , ,
- s/ i *
,R ., ! t w.. .
/ / j l,.- ol.* s '
- ' ! / /
/ / .
*'.l J) 9 ':l /
/
/ ,. '/
/ *
..v z - i
- . l!I l M- i :
1 -
~ . . . .
M M F =
- e
; o. : :. c. :
=" N S Y P C 2 a
~ e ,'*' -
N O
- g. % t e%
<. ; , LW,s v . . L e.i . , - --- 7e.,
v , %
.l_. . __
5 l-i 1
'r'
- l
. . . b, 7__- @e . , .
h wW > + , p , LU l f "" A' , , a i i , y / .< O 7 /
,/
i
/ / i l f' /\ d / f 4.-
t i
/ './
> ,/ /
4 is / p . , a [ t qi }<' l l 1.J / / c/
~
3 / i _ - il; o '
-l c.-
s i , ! ,
-7 [ ,
[ ..
;, n. a -
m bl
/ / /
i - e N f 1 / , -
/ % .G / t/ /' - ::C .
u-- a , . r- a<
> L !
4 j p. _._ //,/ # 1 W lgL O ,
,/ / / .
mv
~, '
s I fe' i j l l' / & ; C)
~
~
~~~\
',, * ' ' ' /
*s
~' ~
.e~,-
, /, . '*/
Y a/ . ,/ , < . . */ *
=
, ,)
s
% .s /
s,,#/ ,,..*./.. ./
# e' /
f, g e f <,/ e
, * /
M M h N N M
.~
r m em .~, ~ p
.g %. '%g* .
4 %. s - - . r, I.s !.) V %+. v i A .q , <. 1
+ %. J w w w e* 4 p."5 is"A ]
- Nms' ' em ens
.#* f"*
Q .. ., . ...
- m 3 c .. ;
.}
)
O *. *(** F ** O)
~
Z , 2C. l 5-3 l 1 I
[.
.3 l ?! 7 ?)
ll'
.c =, ,
. s l: 4 ..[ ,_I '
J O l l LJ f' l : l
.. i i I
Wo 1WW
.; cy e
n i i
) ~
hf }_ J2 i W h- $29 J
/l', ,/ / -
>Z 3a / / ./
/
~
]. W (f) y j ,/j/ '
't
- % 0s 9 t-s e l l/
Z I , .-
! O g. n..s ;
g
/ ,
/
/ /.
- t'nx
, i- ,
/ tu ; ;
-- Q -
; 4 .
/ 4
/
U k5 }f ;* j. $q u
.D y lG a-wo j
j
../ ./ .. co au a
O j Q' O 3 o j
/
/
/
/
/
tz ov o 0.'.,. l /,. / Y u_ U_ Q u.- / /
/
o
' / j / ,
--
i H,Q! / / l W a <-.
/ ......- l.
/,.- /
O- #v/ . / : y F- . 4o O I T _D lll l l ! ,! ! l!'!! l ' l ' ll'!! ! l i U'll ! ' ' l 'Ml . !
- s s a : : s c o o o o o M O O O O O i
O O O O N* l
, q q.
v _ s. (JCGA-j040 CGS Jea ) h Lt.
>ev,n_
s pA7u vu i (,p_,rl wp i sG ! 5-4
losses of offsite power for which severe weather hazards have been identified I as a principal contributor. (Note: Seismically induced loss of offsite power has not been included but could be accounted for through a hazard evaluation and fragility analysis; this consideration is discussed in Section 9.) Figure 5.2 shows the effect of variations in emergency diesel generator reliabil- ; ity for the typical offsite system (clusterh) and emergency AC power system v ! (1/2 configuration). The largest change in frequency per percentile change in diesel generator reliability is obtained when reliability levels are lowest (0.9). This is somewhat of an artifact of the model in which common cause fail-ure rates are kept constant. If there were no common cause failure contribu-tions, or if common cause failure were correlated with the independent failure rate of diesel generators (and it may be), the frequency reduction could he pro-portional to the square of the percentile change in diesel reliability for the i configuration analyzed. l Figure 5.3 shows the effect of emergency AC power configuration and success criteria on station blackout frequency, using a diesel generator reliability of 0.975 and a generic common cause failure rate. Again the effect of common cause failures on system reliability is to reduce the difference between the timeefour " configurations that would be expected from simple redundancy considerations. serr,,$d$t The results of the station blackoutg analysfs show that there is a potential for # wide variation in frequency and duration, depending on location, design, and reliability. (Additional results are in Appendix B.)
)
NUREG-1032 5-5
6 ABILITY TO COPE WITH A STATION BLACK 0UT Station blackout is a serious concern because it has a large effect on the avail-ability of systems for removing decay heat. In both PWRs and BWRs, a substantial number of systems normally used to cool the reactor are lost when AC power is not available. A loss of offsite power will usually result in the unavailability of the power conversion system and, in particular, an inability to operate the main feedwater system. Power to reactor coolant system recirculation pumps will also be lost, requiring that natural circulation be used for cooling to shutdown con-ditions. When the loss of offsite power is compounded by a loss of the emer-gency AC power supplies, reactor core cooling and decay heat removal must be accomplished by a limited set of systems that are steam driven, passive, or have other dedicated (or alternate) sources of power. Unless special provisions are made, the plant will have to be maintained in a " hot" mode (hot shutdown or possibly hot standby) until AC power is restored. Table 6.1 lists which func-tions and systems for PWRs and BWRs would be lost and which would remain avail-able during a station blackout event. Decay heat can be removed successfully, using the AC-independent systems identified, for a limited time, depending on functional capabilities, capacities, and procedural adequacy. For PWRs, decay heat can be removed by use of a steam-driven or dedicated diesel-driven train of the auxiliary feedwater system (AFWS). Decay heat would be re-jected to the environment by the atmospheric dump valves (ADVs) or, if necessary, by the steam generator relief valves. Because residual heat removal systems, reactor coolant make-up systems, and systems to control reactivity through boration would be inoperable, the plant must be maintained in a hot condition. The plant's operating state (primary coolant pressure and temperature) would be maintained by manual operation of the AFWS and atmospheric steam dump valves. With primary coolant pumps unavailable, reactor core cooling would be achieved through natural circulation. If the AFWS can remain operable, and if primary coolant inventory can be maintained at a level adequate to maintain the core cooling / heat transport .I NUREG-1032 6-1
V Table 6.1 Effects of station blackout on plant decay heat removal functions Plant Functions (systems) Functions (systems) Type remaining lost PWR Shutdown heat removal Shutdown heat removal (motor-(steam-driven AFWS, ADVs) driven AFWS) Long-term heat removal (RHR) Instrumentation and control (DC power / converted AC Reactivity sontrol (chemical power, compressed air volume and control system reservoir) RCS makeup (high pressure injection system) Pressure and temperature control (pressurizer heaters / spray and pilot-operated relief valves) , Support systems (service / component cooling water systems, HVAC, station air compressors) BWR, Shutdown heat removal Long-term heat removal (RHR) 2/3 (isolation condenser, fire water system) Reactor coolant system makeup (low pressure core spray system, feedwater coolant injection system) Instrumentation and control Support systems (DC power / converted AC .(service / component cooling power, compressed air water syst6ms, HVAC, station reservoirs) air compressors) BWR, Shutdown heat removal and Long-term heat removal ' 4-6 reactor coolant system makeup (shutdown cooling system, (HPCI or HPCS/RCIC systems) low pressure coolant recirculation system, Instrumentation and control suppression pool cooling (DC power / converted AC system) power, compressed air reserviors) Support systems (service / component cooling water systems, HVAC, station air compressors) s NUREG-1032 6-2
i 1 loop to the steam generators, a PWR should be able to stay in this mode of decay heat removal for a substantial period of time. The amount of time that decay heat removal can be maintained in a PWR is generally limited by primary pressure boundary leakage and the capacity of certain support or auxiliary systems. The sources of potential leakage include reactor coolant pump seals, unisolated letdown lines, and a stuck-open pilot-operated relief valve 4 (PORV). With provisions for manual isolation of letdown lines and reduced j frequency of PORV demands, the reactor coolant pump seal leakage rate is considered to be a potentially limiting factor for some designs. If the l leakage rate is low (on the order of several gallons per minute) this concern is negligible. However, if seal leakage is on the order of 100 gpm or more, reactor coolant system inventory depletion will be a factor limiting decay heat removal for an extended period of time. Natural circulation cooldown in PWRs has been successfully demonstrated by ac-tual operating experience. The process becomes more difficult with AC power unavailable because reactor coolant makeup systems to accommodate system shrink-age and pressurizer heaters or sprays to help control primary system coolant conditions are inoperable. Nevertheless, analytical evaluations (Fletcher, 1981) and experimental observations (Adams, et al. 1983) show that decay heat removal can be achieved with the operational lisiitations associated with a station black-out. In fact, core cooling is expected to preclude core melting even with signifi-cant voiding in the primary coolant system if the steam generator is maintained as a heat sink. To assess station blackout, BWRs have been divided into two functionally differ-ent classes: (1) those that use an isolation condenser cooling system for decay heat removal and do not have a makeup capability independent of AC power (BWR-2 and -3 designs), and (2) those with a reactor core isolation cooling (RCIC) sys-tem and either a steam-turbine-driven high pressure coolant injection (HPCI) sys-tem or high pressure core spray (HPCS) system with a dedicated diesel, any of which is adequate to remove decay heat from the core and control water inventory conditions in the reactor vessel (BWR-4, -5, and -6 designs). Because BWRs are designed as natural circulation reactors, at least at reduced power levels, the loss of reactor coolant recirculation poses no special consideration. Moreover, NUREG-1032 6-3
i 1 reactivity control during cooldown is adequately maintaineo by control rod in-sertion, an action that would occur automatically on loss of all AC power. The isolation condenser BWR has functional characteristics somewhat like that of a PWR during a station blackout in that normal makeup to the reactor coolant system is lost along with the residual heat removal (RHR) system. The isolation condenser is essentially a passive system that is actuated by opening a conden-sate return valve; it transfers decay heat by natural circulation. The shell side of the condenser is supplied with water from a diesel-driven pump. However, replenishment of the existing reservoir of water in the isolation condenser is not required until 1 or 2 hours after actuation. It may also be possible to remove decay heat from this class of BWRs by depressurizing the primary system and using a special connection for a fire water pump to provide reactor coolant makeup. This alternative would require much greater operator involvement. Some BWR-3 designs have added an RCIC system, giving makeup capability to the AC power-independent decay heat removal capability of the isolation condenser cooling system. A large source of uncontrolled primary coolant leakage will limit the time the isolation condenser cooling system can be effective. If no source of makeup is provided, eventually enough inventory will be lost to uncover the core. A stuck-open relief valve or the reactor coolant recirculation pump seal are potential sources of such leakage. When isolation condenser cooling has been established, the need to maintain the operability of such auxiliary and support systems as I)C power and compressed air is less for this type of BWR than it is for the PWR. However, these systems would eventually be needed to recover from the transient. l BWRs with RCIC and HPCI or HPCS can establish decay heat removal by discharging i steam to the suppression pool through relief valves and by making up lost coolant , I to the reactor vessel. In these BWR designs, decay heat is not removed to the j environment, but is stored in the suppression pool. For this type of BWR design, I long-term heat removal in the form of suppression pool cooling or residual heat removal using low pressure coolant injection and recirculation heat transport , l loops is lost during a station blackout. The time that the plant can be main- j tained in a safe condition without AC power recovery is determined, in part, by sthe maximum suppression pool temperature for which successful operation of decay i NUREG-1032 6-4 l - - _ _ - _ _ _ _ _ - _ _ . _ . 1
1 i heat removal systems can be ensured both during a station blackout event and when AC power is recovered. At high suppression pool temperatures (around 200 F), unstable condensation loads may cause loss of containment suppression pool integ-rity. Another suppression pool temperature limitation to be considered is the qualification temperature on the RCIC or HPCI pumps to be used during recircula-tion. Suppression pool temperatures may also be limited by net positive suction
]
head (NPSH) requirements for pumps in systems required to effect recovery once AC power is restored. l i In general, all light-water reactor (LWR) designs include the ability to remove ! decay heat for some period of time. The time depends on the capabilities and capacities of support systems, such as the quantity and availability of water required for decay heat rejection, the capacity of DC power supplies and compressed air reservoirs, and the potential degradation of components as a result of environmental conditions that arise when heating, ventilation, and " air conditioning (HVAC) systems are not operating. System capabilities and capacities are normally set so the system can provide its safety function during the spectrum of design-basis accidonts and anticipated operational transients, which does not include station blackout. Perhaps the most important support system for both PWRs and BWRs is the DC power supply. Ouring a station blackout, unless special emergency systems are pro-vided, battery charging capability is lost. Therefore, the capability of the DC system to provide power needed for instrumentation and control can be a sig-nificant time constraint on the ability of a plant to cope with a station black-out. DC power systems are generally designed for a certain capacity in the event of a design-basis accident with battery charging unavailable. However, the sys-tem loads required for decay heat removal during a total loss of AC power are somewhat less than the expected design-basis accident loads on the DC power sys-tem. Therefore, most DC poser systems in operation today have the capacity to last longer during a station blackout than they would be expected to last dur-ing a design-basis accident. Another important factor in regard to decay heat removal during station blackout is the capacity of the condensate storage tank. Normally, this tank contains a sufficient amount of water to cool the reactor until the RHR system can be placed NUREG-1032 6-5
l 1 in operation. Because the RHR system is not available when all AC power is lost, the ability to cope with station blackout is a function of the condensate 1 storage tank capa a v. The ability to provide makeup to the condensate storage 1 i tank with systems and/or components that are independent of station AC power would extend this potentially limiting factor. Also, during a station blachout, there may be need to operate some pneumatic valves, such as the steam relief valve. Because AC power is not available, the station air compressors will be lost. For this reason, local air reservoirs are normally provided to permit the valves to be operated for a limited number of cycles. After the air supply is exhausted, these valves may have to be
)
{ operated manually by the operations staff, or additional portable air tanks would have to be connected. During a station blackout, normal plant HVAC would be unavailable. The equipment needed to operate during a station blackout and that required for recovery from 1 a station blackout would have to operate in environmental conditions (e.g., temperature, pressure, humidity) that could occur as a result of the blackout. Otherwise, failures of necessary equipment could lead to loss of core cooling and decay heat removal during the blackout or failure to recover from the event I when AC power is restored. The instrumentation and control elements of compo- l nents required during station blackout are the most likely to be impacted by adverse environments. However, only limited equipment in the control room would have to be operable, thus limiting equipment generated heat loads in that loca-tion. The same would be true for equipment in auxiliary ouildings and inside containment, although sensible heat from preexisting sources could be consider-able. For control rooms and auxiliary buildings, opening doors should allow j enough heat to escape to maintain equipment in an acceptable operating environ- ) ment. Temperature sensitive equipment located in normally enclosed cabinets that rely on HVAC systems to remove heat generated during normal operation could a be subject to failure or degradation unless ventilation is provided. Most equip-ment in containment is designed to function in the more limiting environment associated with a design-basis loss-of-coolant accident, and therefore, could be expected to function during a station blackout. NUREG-1032 6-6 l
- _ - _ - _ - - -__ -- l
Table 6.2 summarizes the design-related factors that have been identified as potentially limiting the capability of LWRs to cope with a station blackout. f Actions necessary to operate systems that are needed to establish and maintain decay heat removal and fully recover from a station blackout would not be routine. Tne operator would have somewhat less information and operational flexibility than is normally available during most other transients requiring reactor cooldown. On the other hand, the loss of all AC power is an easily diagnosed occurrence, although it is not always easily cor'rected. Operational staff activities would have to be directed at both reactor decay heat removal requirements and the restoration of AC power. These activities would include manual operations within the control, room to control the rate of core decay heat removal and special operations outside the control room. The ! latter would include repairing failed components, isolating sources of reactor coolant leakage, conserving DC power through load stripping, making available alternate makeup water supplies, hooking up compressed air bottles, and possibly starting local manual operation of some components. The success of these act.i-vities would require preplanning, training, and procedures. In addition, ade-quate lighting and communication would be required. Where local access is ntr ssary, security and working environment (pressure, temperature, humidity, I and radiation) could be limiting factors. In PWRs, operators must control the rate at which the AFWS removes heat from the steam generators to maintain the proper pressure and temperature balance within the primary coolant system. This balance then allows adequate natural circulation and the niaintainance of adequate water level in the pressurizer. Although analytical and experimental evidence suggests that natural circulation and adequate decay heat removal can be maintained when pressurizer level is lost (and, in fact, when a two phase flow mixture exists in the reactor coolant system up to the point the reactor core is uncovered), these conditions would complicate the recovery process and add to the difficulty of operator recovery actions. In BWRs, the isolation condenser appears to need less operator attention. However, operators would have to ensure that automatic depressurization does NUREG-1032 6-7
Table 6.2 Possible factors limiting the ability to cope with a station blackout event Type of plant Limiting factor PWR BWR 2/3 BWR 4/5/6 RCS pump seal leakage X X RCS letdown / makeup and water X X chemistry control lines Stuck open relief valve X X DC battery capacity (instruments- X X X tion and control) Compressed air (valve control) X X X Decay heat removal water supply X X X (condensate, firewater) Operating environment (temperature) Control room X X X (instrumentation and control) Containment X (suppression pool, wetwell, drywell) Auxiliary building X X (AFWS/ room) (HPCI/RCIC room) i NUREG-1032 6-8
not occur and that the makeup system to the isolation condenser is operating properly within approximately 2 hours of the loss of AC power. In BWRs with HPCI or HPCS and RCIC, the operator must control both pressure and the level of reactor coolant.in the vessel. This requires actuation.of both makeup and relief systems. In all LWRs, operators would have to be prepared to deal with the effects of the loss and restoration of AC power on plant control and safety system set points to limit additional transient complications and ensure operability of AC powered cooling systems. NUREG-1032 6-9
7 ACCIDENT SEQUENCE ANALYSES Accident sequence analyses have been performed to determine the accident pro-gression characteristics (Fletcher, 1981; NUREG/CR-1988, Schultz and Wagoner, 1982; and NUREG/CR-2182) and likelihood (NUREG/CR-3226) of a station blackout. Using fault trees and event trees, these analyses have identified functional and system failure characteristics of accident sequences. Reactor coolant sys-tem transient response analyses were used (1) to determine the capability of a plant to cope with station blackout and (2) for potentially important functional failures during a station blackout, to estimate how much time would be available i for AC power recovery before core damage and core melt. ' Considering the decay heat removal system capability requirements and the asso-ciated systems' reliability, failure modes, and failure causes, three phases of a station blackout transient were identified. The first phase includes the need for promptly actuating decay heat removal systems and the potential for a , station blackout induced loss-of-coolant accident (LOCA), either of which can l result in a loss of cora cooling within 115 to 2 hours. The second phase lasts up to approximately 8 to 12 hours and includes operational limitations in the f capability of continued decay heat removal considering limited capacities (such as DC power, condensate storage tank) or interactive failure (for example, i high temperature effects due to loss of HVAC), and the potential for reactor 1 i l coolant loss (such as, through pump seal leakage). During this period, the l running reliability of the system is less important than the successful initial ! actuation of the AC-independent decay heat removal systems. The third phase involves the need to eventually recover AC power and establish a stable, control-lable mode of decay heat removal. As discussed above, considering the systems and functions available for the dif-ferent PWR and BWR designs resulted in the development of three event trees for ; the identification of station blackout accident sequences. Figure 7.1 shows the event tree for PWRs; Figure 7.2 shows it for BWRs that use an isolation conden- 1 ser; and Figure 7.3 for BWRs that have AC-independent makeup systems (RCIC, HPCS, l l NUREG-1032 7-1 l i__________
i1 1li.{l'1l il ]1 iI lJ l t u _ o *'w 7 a* M*" ,.". i y>.u 4 w* v :; . _ k _ C D a L D DD L E/L l
. A N O .EO A RPA B C T I I CDI T EUV
. E I . DR ENR I VEO e E n TL T VSt TLEE TEE VS OKM C Cg o RA N RADP NTP M. CAE N Ng i V I OC VN IX EE OE EMR t u
Eo t .O TT .OEE TT R Uc a CM S S CMTM S M S S . o o7 t EE C CY EEXI CNI CY CCT t tg S SR R AS SRET RIT AS ARH S So 5 " ,,, ao, 2- ~r. ..
*"~ 8~ _ e " ,,,,
CgU ,. oa 9: 1: oa M: om
- Im $.ea M: no I;Eene m3a*.~ k> oa 92e
~
~ 92eu no
- j 9 E e .- oa l 1Eeu no _
gEI m3e .. 7g> 1Eo%. oa 1Eou eu no m3o=.. k y M2ea oa
- M2e- no oa 9reae 2Ee~ no aam.. . go9 1Eo.eo oa 1Ec e- . no i
roCg N.H
- t ae3es*n k:o m<e=e gsoo tt Os ,gmN"Q 3 mnwOC" moCs nt.
D- o o 2C:mONn::awNNcn 2Eb. hon nan lIl{ ,ll l
1 i l !. t u o Ou :r"* k c
"u7". y Y[* x e.
a > l t L D Ds L B N . A N O . E 'i E/L
. O C T .I I A RPA CD; T EUV n T I E I T DR ENR I VEO g E o HLT T VS HLEE TEE VS OKM g CE i AA) N M ADP NTP M CAE y NM t YVL . I OE YVN IX OE EMR g a AOOD TT AOEE EE EO t CMSN S S CMTM S TT R n UC C M S S . O QT S EEIO CY EEXI CNI CY CCT g DR(C R AS DRET EU RIT AS ARI I S SO 8- o~* g ,,,,
- g. .
8- gu-
^e=aov- 8-4.28 o*
e2 N om 4.2"u om I" nnea* I ; ll. 4. 2 O no en* ma*.~ > 4gu a e oa 4.gu eu no e2N o- om s e.2ao no I il
. 4. 20 eu mmE ~ > 4.2 5 ou ? om 4.2Eou ? nn m3E * > _
e2?
- 8 oa 4.2 S e- no
- 4. 2O oa om
- no 4.2Ee-m31*"b> e.2Oo S oa e.3Eo ? .
no t. vaoC tso t yg s oe3e *n mE:o l: m <$ +c l
+5$
- r. n+s o3
%o ,iro+r o
$ mn E % ntK:o8N n o5 6*3 mocsne - os ZC:omOh:eGNNm s
a zc:omc>eNolN 9E lllfIlll ;;t!
.m I
o-2 hrs. 212 hre >12->24 hrs. N o EO U b i g as i 8588 288 i =>$> c U 0 8EE OEE U OE "" o :$" 2 *E tus: ::: >= 82: x" V: i av se v: Es
- mean 5
van Es
- n v=
s
- s2
- s l gug (og tag) (U2) IO2) (82) (ejl
! (WBo) TMBo OK TM81 OK TMs2 OK
-Success TMB3 CD
?
-rallure Small LOCA TM0281 OK Sme11 TMO 822 OK LOCA TMQ2B3 CD j TMU B OK 21 TMUgB3 CD
, Small LOCA TMU2 028 1 OC j q ;
TMU 2 028 2 CD Small LOCA TMQg80 OK Smalt 14CA TMOgBg OK Small TMQg sj OK LOCA TMQgB) CD l l j Small LOCA TMogUjBg OK I TM03 U82 2 Co TMUgog oK 1 TMUgeg CD Smell LOCA TMUgC 830 OK TMUg0gsg CD Figure 7.3 Generic BWR event tree for station blackout (BWR-4, 5, or 6) I 1 Source: NUREG/CR-3226 l 4
' ~
i NUREG-1032 7-4 i l l
i HPCI). The event trees are characterized not only by the systemic and func-tional considerations important to station blackout accident sequences, but also by the phases of the transient that would affect the plant response and system operability for station blackouts of various durations. The event trees show the loss of all AC power as the initiating event and proceed through decay heat removal, reactor coolant inventory (integrity), and restoration of AC power to enable operation of the normal decay heat removal and makeup systems. The accident sequence logic is similar for PWRs and those isolation-condenser BWRs that do not have the capability to make up lost reactor coolant during a station blackout. These plants are susceptible to degraded core cooling as a result of relatively small losses of reactor coolant. The accident sequence logic is some-what different for BWRs with reactor coolant makeup available during a station blackout. Most losses of reactor coolant caused by station blackout can be accommodated by the available reactor coolant injection systems. Reactor cool-ant loss equivalent to that lost because of a stuck-open relief valve can be accommodated by the RCIC systems. The HPCI or HPCS system can provide adequate makeup to cope with larger leaks. All of the LWRs encompassed by the accident logic models are subject to the operational limitations for the longer duration blackouts as described previously in Section 6. The event trees end with a sequence outcome state designated as "0K," meaning that stable, long-term core cooling is achieved or achievable, or "CD," meaning that a'n inadequate core cooling state is reached and some reactor core damage can be expected. For the latter case, core damage can be expected to proceed to core melt if effective and timely measures to restore AC power and core cooling are not taken or available. The potential difference between an acci-dent sequence that ends in core damage and one that leads to core melt is deter-mined by evaluating the likelihood of restoring core cooling and the cooling effectiveness from the onset of core damage to the time when irrevocable core melting has begun. This latter time in the accident sequence progression is not well known because there are significant uncertainties in the modeling of core melt phenomena. It has been estimated that the time between the onset of core damage and time that a core melt would penetrate the reactor vessel is on the order of 1 to 3 hours (NUREG/CR-1988, -2128). Considering the low probability that AC power would be restored during this time period and the uncertainty in ! modeling this accident process, including the ability to terminate a core melt NUREG-1032 7-5
in progress, it has been assumed that core melt would be the likely final out-l come in accident sequences that progress to core damage. Detailed plant transient response analyses were performed to cover the spectrum l of sequences identified in the event trees (NUREG/CR-2181). The purposes of this work were (1) to better understand accident progression characteristics re-lated to the timing of events and physical parameter values during the transient, and (2) to determine success states for systems, trains, components, and opera- { tor actions during station blackout sequences. The sequences were divided into three groups: (1) failure of AC-independent decay heat removal'with reactor coolant leakage less than Technical Specification upper limits (2) failure of reactor coolant system integrity (liquid or steam leaks) with AC-independent decay heat removal systems operable (3) failure of AC-independent decay heat removal systems with loss of reactor coolant system integrity Variations in system failure and actuation time, reactor coolant leak rate, and operator actions were analyzed to determine both the potential for sequence j outcomes with adequate (or inadequate) core cooling and the time in which AC power must be recovered to avoid core damage. Table 7.1 shows the estimated time of core uncovery for station blackout se-quences with AC-independent decay heat removal systems not available. Plants with Babcock and Wilcox (B&W)-type nuclear steam supply systems (NSSS), which have a small steam generator secondary water inventory and, thus, the smallest heat capacity, would require the most prompt recovery to avoid core damage for this particular sequence. For these plants, core uncovery was estimated to occur within 1 hour. For plants with Westinghouse or Combustion-Engineering NSSS designs, core uncovery would take about 2 hours, as it would for a BWR-4 plant. Figure 7.4 shows how the core uncovery time is extended for sequences in which decay heat removal is initially successful but fails later during the accident. Estimates of the time core uncovery would take with a stuck-open NUREG-1032 7-6 i L__-________ ___. _
Table 7.1 Estimatea time to uncover core for station blackout sequences with initial failure of AC-independent decay heat removal systems and/or reactor coolant leaks Sequence r time (seconds) Core uncove'y PWRs B&W- CE W AFW failure 2715 6200 5800 Stuck-open PORV - 3190 - 5040 100-gpm total leak 21070 - 27950 rate from reactor coolant pump seals AFW failure and 2480 - 4800 stuck-open PORV BWRs GE HPCI/RCIC failure' 2300 HPCI/RCIC failure and 1680 stuck-open SRV Source: Fletcher, 1981 l , p < NUREG-1032 7-7 ~
- s-m_mmu.__--m__....--_-_.2u_- .a.ww.u.-
[ 6 , , ; j O 5-2 ' Westinghouse
]u
? -
/
o 4 - E 1
=
8 8 3 su-t 2
.; c Assuming loss of offsite power, failure of all
! diesel generators, technical specification leakage, turbine-driven auxiliary feedwater ,
ll (AFW) initially operates then fails at a later p time.
~;
i I I I q g l 20 0 5 10 15 25 Time of failure of turbine-driven AFW (Hours) I Figure 7.4 Time to core uncovery as a function of time at which ] i i turbine-driven auxiliary feedwater train fails l 4 l l Source: Fletcher, 1981 a
\
l t . l
- k. NUREG-1032 7-8 l i
l t !
i
. ~ . . - _ . . _ . -
1 i relief valve and other types or reactor coolant leakage are also provided in Table 7.1. For BWRs with RCIC available (or HPCI or HPCS), adequate reactor coolant makeup is provided to maintain core cooling even with a stuck-open relief valve. The core uncovery time for PWRs would not be significantly shortened if a relief valve sticks open coincident with the loss of the steam turbine-driven train of the AFWS. This is because loss of the AFWS for decay heat removal usually results in primary system pressure relief, which removes l decay heat almost equivalent to the energy loss of a stuck-open relief valve with AC-independent decay heat removal available. If a relief valve sticks open in a BWR without RCIC or in cases when the AC-independent decay heat removal systems are unavailable, the core uncovery time would be somewhat s horter.ed. Complete accident progression analyses have been performed for several key station blackout sequences starting with the loss of offsite power through to core melt and containment failure. A time line presentation of a PWR sequence in which AFWS operation is initially successful but fails several hours into the transient is provided in Figure 7.5. Station blackout occurs at zero hours (to). After the initial fluctuations in reactor coolant system pressure, core outlet temperature, pressurizer level, core flow, and steam generator level, a relatively stable period of decay heat removal with primary coolant natural cir-culation follows. When AFW makeup to the steam generator becomes unavailable in about 6 hours (t ), the steam generator level begins to drop, causing de-i creased heat transport from the primary coolant system. As the steam generator dries out and heat transfer to the secondary system ceases, reactor coolant pressure and core outlet temperature rise. The reactor coolant temperature in-crease combined with some voiding causes the pressurizer level to rise, and i there is relief to the containment. Continued voiding in the primary system affects natural circulation flow, but core cooling is aderm te to prevent melt-ing until the core is uncovered (tz) at about 9 hours. M chis point, the pres-surizer level has dropped because most of the primary sys em is voided. Within about 2 more hours (ta) the core has melted and penetrated the reactor vessel, causing a containment pressure and temperature spike because of the rapid in-flux of steam and noncondensable gases from the melt. If containment survives that spike, the continued release of decay heat and the generation of combustible and non-combustible gas will continue to load the containment. Containment fail-ure by overpressure in this sequence occurs about 19 hours into the accident. NUREG-1032 7-9
Delayed failure of AFWS (or DC power depletion) ' Reactor Coolant System Pressure
- L Pressurizer Level bm ;
( 1 Core Flow L - i Core Outlet Temperature N N
'l Steam Generator .[-
Level i l
! Conta.inment __
/
Pressure Containment __-
, Temperature 7 i e i Time (hrs) 0 4 8 .12 16 20 t
to ti t2 t3 t4 I Time Sequence Event to Loss of all AC power t3 AFWS fails (or DC power depleted) l t2 Core uncovery begins t 3 Reactor vessel penetration t4 Containment failure Figure 7.5 PWR station blackout accident sequence , 1 NUREG-1032 7-10 1 b l
)
Figure 7.6 shows a BWR station blackout accident sequence progression. In this scenario for a BWR with Mark I containment, station blackout occurs at time zero (to). The reactor coolant system pressure and level are maintained within limits by RCIC and/or HPCI and relief valve actuations, which also transfers decay heat to the suppression pool. Both the suppression pool and drywell tem-perature begin to rise slowly; the latter is more affected by natural convec-tion heat transport from the hot metal (vessel and piping) of the primary system. After 1 hour, when AC power restoration is not expected, the operator begins a controlled depressurization of the primary system to about 100 psi. This also causes a reduction in reactor coolant temperature from about 550 F to 350 F, I which will reduce the heat load to the drywell as primary system metal compo-l nents are also cooled. The suppression pool temperature increase is only slightly faster than it would have been without depressurization. Drywell pres-sure is also slowly increasing. At about 6 hours, DC power supplies are de-pleted, and HPCI and RCIC are no longer operable. Primary coolant heatup fol-lows, with increases in pressure and level until the safety-relief valve set t point is reached. Continued core heatup causes continued release of steam;
\ l this eventually depletes the primary coolant inventory to the point that the j , level falls and the core is uncovered, about 2 hours after loss of makeup (t2 ).
Core temperature then begins to rise rapidly, resulting in core melt and vessel penetration within another 2 or 3 hours (ts). During the core melt phase, containment pressure and temperature rise considerably so that--nearly coinci- ! dent with vessel penetration--containment failure occurs, either by loss of electrical penetration integrity (shown at t ) 4or by containment over prossure shortly thereafter, around 11 hours into the accident. i 1 Estimates of the likelihood of these accident sequences were made to identify 1 the potentially dominant contributors to the station blackout accident sequences (NUREG/CR-3226). Table 7.2 summarizes the results for the typical PWR and BWR. These results have been modified to account for better estimates of loss-of-l' offsite power frequency and duration derived since NUREG/CR-3226 was completed (see Appendix A). In addition to identifying the dominant accident sequences and their likelihoods, the table also shows the major factors affecting the accident sequence frequency. For PWRs, an important contributor to the estimate of the likelihood core damage is the ability to restore AC power before the DC power needed to run the auxiliary feedwater system is lost or the condensate - NUREG-1032 7-11 1
c L 1' l RCIC/HPCI available, controlled depressurization 1 J l Reactor Vessel l Pressure I k Reactor Vessel j Level l l Core Temperature
~~~~~ i Suppression Pool t Temperature Drywell Temperature -
[ Drywell Pressure 7 l l 1 Time (hrs) 0 4 8 12 16 t o t3 t2 t3 t4 Time Sequence Event to Loss of all AC power t i DC power (batteries) depleted t2 Core uncovery begins t 3 Reactor vessel penetration t 4 Containment failure Figure 7.6 BWR station blackout accident sequence "i NUREG-1032 7-12
y c
; n e
eu rq oe crf 8 5 s 8 8 5 8 5 7 8 l - - - - - - - - - - ae cg 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 ia pm x x x x x x x x x x s ya . e Td 5 1 1 2 3 2 2 2 5 1 c . n r e h u r q e , e w e g s o p a t dm n C ea e Ard d e i h ve c cor c ico a h ec e wr d g nei 6 6 6 6 6 a ib o 2 1 1 2 2 1 2 1 2 1 m v a eta o o o o o o o o o o d ms iuo t t t t t t t t t t e Tmt 1 4 4 1 1 4 1 4 1 4 r o c s , t r d d n o e e e t a t t k l k t n n u e s a b a s re i b l u e a e us on m i b a l l l at od o r a h - i hi rpe d t l x l a l xm emd n i e a v a ei woe y o a e a e e l oce l c v e s n v s e p c l a t u l e t y e ,x a t n a p a p l at) l Cde i n u s m r v m b sic b De t e n u e u a nl I a ,t s n n S e p s f p l eiC l st t e o p W F d n t n e i e t i a dbR na/ i a l eui am o m A o n d l n v orI v bhi p o c a n e a a cec a axl c n l o r l n pP n l e f / e r o c o u roH u i y o m v o o n o o ( aet e i c n e c C t C vti y t r r - o p I rnd I aal r s d e r i o r C eee C nsi a y w o t - o R wnd R unb) m s m o t a k t / ooe / eaC m a p c l c c I ppe S Sd rI u R e a o u a C mc C C neC S H t C e s t e P Cox P P o pR D S D R I S R H Dce H Hco( 2 7 e c e n 1 2 2 1 i 2 1 2 1 2 _ l e 8 B B B B B B B B B b u 1 2 2 i i 2 i 2 i 2 a q L L Q U Q Q U U u U T e M M M H H M M M M M S T T T T T T T T T T n o i r t e c as - - i l n I S rt ) oe C C en na Rl l Ri n sd RHI PC RHI PC el Wa W/o W/C W/C _ / Gp P( B wc B wR B wR s l S[; g> [u
]
l
)
i storage tank supplies are depleted. Another important contributor is the integ-
]
rity of the reactor coolant system considering potential leaks from the reactor I coolant pump seals following a station blackout. If reactor coolant pump seals leak and there is no way to supply makeup water to the reactor coolant system, the core will be uncovered. If reactor coolant pump seal leakage is large ! (more than 100 gpm per pump), the core could be uncovered within a few hours.
~
)
Smaller leak rates (a few gpm per pump) are not a limiting factor. Adequate coolant inventory would be available to allow continued core cooling for a day ' or more without the need fo" makeup if other limitations (e.g. , DC power) did not exist. The analyses performed for this pfogram (NUREG/CR-3226) showed the q reactor core was uncovered in approximately 8 hours, using the reactor coolant ! seal leakage information currently available (a leak rate of about 10 to 20 gpm per pump). For BWRs with isolation condensers, a similar dominant failure mode exists. The failure of the DC power system is less important because the isolation condenser system operates passively once it is activated; little operator action is neces-sary thereaf ter. However, reactor coolant pump seal failure could cause deple-tion of reactor coolant inventory and, because the isolation condenser BWR typically does not have an AC power-independent makeup system, the reactor core could be uncovered. This sequence was estimated to result in core damage in about 8 to 12 hours. BWRs with HPCI and RCIC are capable of coping with reac-tor coolant system leaks equivalent to that resulting from a stuck-open relief valve. However, they are subject to the effects of DC power depletion and other interactive failures associated with the lack of the ventilation system to main-tain HPCI and RCIC room temperature, and suppression pool heat up phenomena that can result in a loss of core cooling in about 8 to 12 hours. For this I type of plant, unattenuated suppression pool temperature increases during a station blackout transient can be a problem because of the potential for un-stable condensation phenomena. These phenomena could cause containment struc-tural failure, with the potential for subsequent loss of reactor coolant from the suppression pool resulting in loss of recirculation capability. Perhaps more important is the effect that high suppression pool temperature would have on HPCI pumps during recirculation. These pumps are not usually qualified for operation with fluid temperatures in excess of 160 F. In addition, NPSH re-quirements may not be satisfied if suppression pool temperatures exceed 200 F. NUREG-1032 7-14
.l
l l For BWRs with HPCS, which has its own AC and DC power systems, both the effects of depletion of the DC suppl 1 and reactor coolant leakage are minimal contri-butors to sequence core melt _ probability. However, suppression pool temperature limitations may causo some equipment operability problems during longer dura- ' tion station blackouts. l In all of the accident sequences evaluated for this program, the early failure j of decay heat removal because of the initial unreliability of these systems was ) a relatively small, but not insignificant, contributor to core melt frequency. This is not surprising, because, since the accident of Three Mile Island Unit 2 (TMI-2), most nuclear power plants have been required to have at least one AC-power-independent decay heat removal train available. However, very little has been done at nuclear power plants to determine the capability and reliabil-ity of systems during a sustained loss of AC power. Thus, it is not inconsis-tent that most of the dominant failure modes that have been identified are l associated with the inability to operate decay heat removal systems because of support system failures or capacity limits on support and auxiliary systems needed to maintain decay heat removal during station blackout. With the consideration of containment failure, station blackout events can re-present an important contributor to reactor risk. In general, active contain-ment systems are unavailable during a station blackout event. These systems are usually required for pressure suppression through steam condensation to maintain the containment pressure below the appropriate limits and for the re-moval of radioactivity from the containment atmosphere following an accident. The time to containment failure after the onset of core damage and the contain-ment failure mode is an important factor in determining fission product release and ultimately public risk. Table 7.3 summarizes containment failure insights derived from the analyses , performed for this program and from a survey of analyses performed for other { fprograms. It shows the different types of containment, the estimated time of i i containment failure following the onset of core damage, and the containment ' failure mode. The most recent estimates of containment performance derived from ongoing severe accident research by both NRC (NUREG-0900) and the Industry Degraded Core Rulemaking Program (IDCOR,1984) may be cause for revision of the l
& St .)
NUREG-1032 7-15 .g5 g [$O
)6M
Table 7.3 Containment failure insights Approximate time to containment failure i following onset of Most probable containment Containment type core damage failure modes Ice condenser 1 hour Hydrogen burn, steam spike 2 hours Overpressure At or following AC Hydrogen burn recovery
- 27.5 hours See IDCOR, 1984 Subatmospheric 2 hours Hydrogen burn, steam spike or small dry 6-12 hours Overpressure Following AC recovery
- Hydrogen burn Large dry 10 hours Overpressure Following!AC recovery
- Hydrogen burn
- 32 hours See IDCOR, 1984 Mark I, Mark II /2-4 hours Electrical penetration failure 4-8 hours Overpressure 18 hours See IDCOR, 1984 Mark III ,' 10-15 hours Overpressure
/
7
/
1 hour.following AC Hydrogen burn recovery
- 47 hours See IDCOR, 1984
- Depends on accident management strategy for hydrogen control.
t e+e/ NUREG-1032 7-16
- / D cl Y()C
\
containmentperformanceinsightsd}erivedjustafewyearsago. For the 1,arge, dry PWR containment, long-term overpressure is the most likely failure , mode. Yet some evidence exists that some very strong large dry containmentsjnay not fail as a result of overpressure in station blackout accidents, beca/use they can withstand the overpressure transient. The smaller PWR contai,dments--like the subatmospheric or the ice condenser designs with lower desic/n pressure and
/
smaller volume--are less capable of handling the pressure transient and poten-tial hydrogen burn associated with a station blackout core, melt accident. In NUREG/CR-3226, it was estimated that the containment would fail in about 1 or 2 hours for several possible reasons including hydrogen, burn, steam pressure spike, or containment overpressure as a result of noncondens' ables and noncondensed l steam. However, the' recent IDCOR results show cont'ainment failure times of more than 1 day. ,,
/
The BWR Mark I and II containments offer some pressure suppression capabi-lity duringastationblackoutaccident,butafheracoremelt,thevmayfailbyone of two modes. Either mechanical or electrical fixtures in the penetrations may failbecause(1)theyarenotdesigne!forthepressureandtemperaturethat
/
will follow, or (2) ultimately (in about 5 to 8 hours), overpressure of the con-tainment will occur. (IDCOR esti ates a Mark I containment will fail in about l 18 hours.) Because these conta nments are generally inerted, hydrogen burn is not considered a likely fail e mode. For Mark III containments, which are low pressure, large volume cont [inments, failure in 10 to 15 hours has been estimated inNUREG/CR-3226,principa'llybyoverpressure. The IDCOR estimate is 47 hours for this type of contaffiment. One item of inter 't should be noted for both the ice condenser containment and the Mark III co inment, where hydrogen ignitors must be installed to meet hy-drogen rule re. irements and the post-Construction Permit Manufacturing Licensee (CPML) rule. For these containments, there is the potential that an inactive ignitor cpdid be turned on following the restoration of AC power at a time when the hyd gen concentration is essentially at an explosive level. However, this poten,t al problem can be mitigated through proper procedures and by instructing the/ operators on how to control the hydrogen burning with ignitor systems follow-
/ing the restoration of AC power.
NUREG-1032 7-17
Table 7 4 correlates the fission product releas categories with the containment types and failure modes identified in Table .3. Table 7.4 also provides the doses estimated to result from station bladkout accidents for the various different. containment designs, includir)g recent IDCOR estimates. Substantial uncertainties exist r garding fission product transport in contain-ment during a core melt. Howe er, based on an understanding of the fission product transport process a known today, it can be seen that station blackout { accidents can potential 1 result in substantial fission product releases. Again, i the reader is caution that ongoing research could cause substantial revision of these fission pr duct release fractions shown in Table 7.4.
/' & s 9 f
yfc & I l NUREG-1032 7-18 !
1-j 1 ' l 1 Table 7.4 Containment fission product release categorief!and failure modeprobabilitiesforstationblackoutseqynces Release ' category Containment type, failure pro,bability, and mode
- BWR Mark I Ice Sub-atmos- L,arge dry- Large dry-1, 2/3 condenser pheric jset cavity dry cavity 1 10 4 10 4(a) 10 4(a) / 10 4(a) 10 4(a) 2 0.2(y') --
0.1(6,) 0.8(6,) 0.2(6,) 3 0.8(y) 0.99(60 ) 0.9(py) 0.2(61 ) 0.2(67 )
/
4 -- 10 2(p) 1043(p) 7.3 x 10 3(p) 7.3 x 10 3(p)
/
6 -- --
/-- --
0.6(c) Total 5.5 x 106/ 5.3 x 106 5.4 x 108 4.9 x 10e 2.1 x 108 person- 4.5 x 106 rems, j
/
to 50 mi /
/
IDCOR 1.3 x 107/ / 7.3 x 10s -- -- 8.2 x 105 results 2.4 x 104 j/
*ContainmentFailur! Modes a - steam explo y' - overpre ure, direct atmospheric release ressure, release through reactor building y - overp/
6 - ov pressure, late 7 6e- oilerpressure resulting from steam spike at the time of vessel melt through f 60/ overpressure with core debris bed fragmentation
/
[-containmentleakage c - base mat melt through 9 u NUREG-1032 7-19
I l l l l l 8 EVALUATION OF DOMINANT STATION BLACK 0UT ACCIDENT CHARACTERISTICS J The important factors that affect the probability of station blackout accidents have been identified, on the basis of the previous work presented on dominant station blackout accident sequences. The principal parts of the station blackout sequence include: the likelihood or frequency of loss of offsite power; the probability that the emergency or onsite AC power supplies will be unavailable; , the capability and reliability of decay heat removal systems that must function during a loss of AC power; and the likelihood that a source of offsite power ] I will be restored before the core is damaged as a result of the loss of core cooling and the failure of systems that cannot operate without AC power. Reactor type, by itself, has not been found to be a dominant factor in determining like-lihood of core damage as a result of station blackout because the capabilities of auxiliary and support systems needed for decay heat removal during station blackout can vary considerably (and still meet current safety requirements). The important factors in determining the likelihood of core damage as a result of station blackout are reliability of the AC power system (offsite and onsite) ' and the performance of these auxiliary systems (DC power, compressed air), as well as such plant characteristics as pump seal design, natural circulation ! capability, and suppression pool temperature effects. Because of these differences, core damage frequency estimates for station blackout accident sequences could vary considerably. Therefore, the NRC staff analyzed the sensitivity of core damage frequency estimates to design varia-tions different from the reference plant analyses performed by Sandia National l Laboratories (NUREG/CR-3226). The models used were based on insights obtained from previous studies; they are described in Appendix C. Station blackout sequences were divided into two groups. The first included sequences involving the failure of AC-independent decay heat removal and, for plants without AC-independent makeup, loss of reactor coolant integrity at the onset of or soon after a station blackout. For these early core cooling failure sequences, AC power must be restored in 1 or 2 hours to avoid core damage and ultimately core melt. The second group of sequences identified included failures during an extended station blackout of 4 to 8 hours or more. These failures include a l NUREG-1032 8-1
l l smaller rate of reactor coolant loss, support system capacity limitations (e.g., l batteries, make up water inventory, compressed air), and other station blackout ' capability limitations in decay heat removal systems (e.g., natural circulation and suppression pool temperature limitations). Several sensitivity analyses have been performed by NRC staff to evaluate varic-tions in LWR plant designs for both decay heat removal capability and system reliability, including offsite power. Because the ability to cope with a station blackout may vary considerably, results are provided to show the effect of limi-tations in maintaining decay heat removal during station blackouts of 2 to 16 hours. First, Figure 8.1 shows the sensitivity to offsite power system design and location as represented by different offsite power groups (clusters). The importance of higher frequency and.long duration losses of offsite power can be seen. It is also worthwhile to note that the highly reliable (redundant) AC-independent decay heat removal systems provide added value when ability to cope for long durations exists and very low core melt frequencies are estimated. Figure 8.2 shows the relationship between various emergency diesel generator reliability levels and estimated core damage frequency. A combination of reason-ably good diesel generator reliability and the ability to cope with a several hour station blackout results in estimated core damage frequencies on the order of 10.s per year or less. The effect of a plant's emergency AC power configura-tion is shown in Figure 8.3. A substantial difference in core damage frequency may exist between plants with three emergency diesel generators, depending on the minimum number (1 or 2) needed to maintain core cooling and decay heat removal during a loss of offsite power. Again, frequencies drop rapidly as station blackout coping capabilities extend to cover longer AC power outages. Figure 8.4 shows the variations in emergency diesel generator failure rate from both independent and common causes. In this figure, common cause failures in support systems (e.g., service water, DC power) are estimated on the basis of the industry experience (see Appendix B). These results show that estimated core damage frequency can be kept low by maintaining highly reliably etergency AC power systems. Estimated core damage frequencies as low as 10.e rer year may be possible if the emergency AC power system is maintained in & high state of operational reliability, and there .is some capability of copirag with an unlikely station blackout. NUREG-1032 8-2
R r r n ', Y 7 n. nt y yn H t t i l1 1 I { t I f I ca oi .. i l 1 '
? ' I ti ,
I 1 l l [ , ab n ra r i 5 l .? . 1_
? f_
} .
ui ' J - <# ' gl , tn. i e fR n e . n _ ul enl u . oG . CD E _ qR o c _ C. 51 29
/ e i_
10 r t _ FRa . Hru .. eD g D. N '~N
- _ .N %
h a _ N ,*-
~_N
}
mdt
- ~ .. _
n u_
~g
_ - ~ - NN g - aI o NN' -
- g,$__ ~
s D k ~ . '
~\'N' Cca N
s- gN N
- N - ,
eAl r B N
. N' -. N g, N' s'
s s' or . N' x N'% sN Cen. t y' , D. Y'g s g ,e A si o N \ g-h'N,[N'\h' \ f N out a l .
\s Ct
_ s\ b y S_. t . ie i vti o _. .. t t _ is sff j 1 j i n n- 0 nv o n eO 3-( 0 0
],
fs
',s
( o S o i
. )
e,' < I o . t 3
W
=.
W
.F T YN u .^ a' e- e ,,
. g; g - p .
*~
==
'~
a- . M o - ~
.~ *-' ~
~
me
,a &, , .
t, .
. .a .~. . .~
~
m fC M- i , - -_ ,[ { G, w - {-
~
UL - -- ua 0 0 F " " -
,"'.s
~~'
os e M y _ (;
.,,,s -
u
~
~~
= .
C .==
- g, ,
b ==== ' " " P '*
*4 ,,^, ,; ..
q, e- , p. , s < s. > > * . 4=8 O I'% 4, i{ , ') h
- i %
S
%# ~ .; ) 5 ~n .r C. :-. ,- .-- .%
%N ss s -, --
. ~.
a CD M e- .. 0
- 7-L 3 .e . l I
i i oEO~- l ' ' ' i i L E . i C) +> pA N . CDLLI O _ y: O i l ;
; i.
i i/ .f ./ f, t ,
. .g E
CO a O :
!!/ .
//./
/ ./:/ ,
6, a -
- , , i V lI/ft 3 ~
\ ~ ! l ..
l l k l/ /.l l ?
^) O T '
!/l /i p // acc
- a. rv C !.
- ,O././ ,
e. i - ) / - T" . - t i ,
,/,- -
1 IJ- i - O Q .u 9,
/.f? .../,s Rpl l yi U +> i l .1
' ! '+- V (M
// i ni I
i OCol - . I h u l g .t'. f v, r v ~ A r* s. f v"% e -. n - Q he %.) %l $.
.- t.s ~
u. fn V/ g Q , r l._. i ,- . v P .'*"" l
, v l i, (f) (,.n.,y , 7., 3. .a
~12 , , t. s 3
. .. s - - ~~ . On . e _ c~ : .. -
e-q
n ; i
)
1 L'- .,
- l L. 4J >, % b,.'
L .' 6o) U .- I +,> - , r e e e .- e e e r" - i g :- O. .: .: .: ,= . .: .: .:
,-n - -,
W.
; y ,e ,, - b. ~ . .
. s. , s' ',.
f E * " -
- N iE" h --
N N N o X cq
- a. - -
c< - 3,gm j m c,e e se se
,._ N v v l 1ms
- % cn C M.g -
c-
., s,N xs x s s, s s s ss !
9s s
!?r;d D *- e -
m co - - mm 3-0 t ,. l l ! O'_O u-
!,I .
D .o J < - l i ! i i
.s I
t -@ O I L')
}
L!- w(Y .u i i i
=
u rn/ M s. ' n OE I < ~ O
- i ,/ / ! / : '
ai o Iis l J/ ,' // 8 EO o i , t / !/ i! / i / r~= LIJ yQc CQ g +' ; l
/, / i Pt n ..
i j/
/ ;
m E
=
,' J. v. "
D @ g; i l /1/ l
/ / /.
,,/
"'~
l
\
OgDC L *O l. l l l , I' ilt' /' *//.
. .~
1
?
O@* .' '. oaSl /...cS ' l. > l } c b .'/ T'#i
! i
,9 ?V<-&'
O (/) . *7/ 1n -
%D
~
! l
, Oco, -
3 z
.a. .
. _=
.- U D - - - e - ,
. >._. <( c o o o o e i V r -
h- U %M 1 O w. v
. m. .-
s.> f
., v .
; - .- 4
,.~~'.
't %
c '". ~2
. I l
# ebF: . r, e,
- = . r. e e !$ -
i [ : P. ^ =,.~.-=c>=.-
. I r. j er,aT;
*^.:^reo i i
. s u = , w =. - =~,
F-5
V _ ie C ,.,
- -- E --
\ :- C C C C u
e e O s. .-
- # .2-
,2--
h . t- _ t..
- i a g . c ,- .... -
y
. c.
c '. u -
,. , 1 . - .
,n c., _
.g ;;,
i _ ,. _, ! ty-s co _
.. . ., . t.,. . .
~-
- a. o I
- c. *w .~. %, ~.
- a. .k. .. .., .~ . -
m
,i --
o D _ W sn 44= N v .*
; s> e 0 O x_
I I j !
; I
- I , . .
L'_ u_i O L i , 0 -D!
- mo V
- "C
.n
+
O .L y l: I
/ r
- i
' 1: ./ ,/ /
i h C ] j:f f / Z'
/ e/
0 E O CC) l ll// '/ LG6 " W T) Oo. //y // /,/ '
/,/
l
, .. /- i i f l O' Ch O i // /// l 5
! -) OD; L Q :,
// ,/ / /
/,., ,./gs/ i .
- [ .x Q . ,
Gm O
/'!.!// .i o C' l ~~m is~Q '/./p//, / -
~
n,.. a
/ /,./* .=
40** .m
> H-- L. p : .-
OOol 1 0g i ' " i
.)
h E ~[) (, ! (~ j.
+-[
.2 o O
; .u es a-
*~ V e-e.
em t-n e. i l Y a" N i G t._.- v G. U
. C .
N s 's.
~
i I
,l g h -'*6 I,#+ v = ,9 .
f Q v" c 3 v'u ~ v3 - =.a. l u
?-b
The results described above and additional sensitivity analyses can be used to assess the effectiveness of certain strategies in dealing with station blackout concerns. For instance, if PWR reactor coolant pump seals were known to fail early during station blackout, and the reactor coolant system leakage were the factor limiting the ability to cope with station blackout, core damage could occur 1 or 2 hours after the loss of AC power, even if the AC-independent decay heat removal system (the AFWS) were operating properly. Table 8.1 has been developed from the sensitivity analyses to show the effect of providing a "fix" to maintain reactor coolant pump seal integrity to allow successful core cooling for station blackouts of 4 and 8 hours. The results provided up to this time represent point estimates of probability or, more properly, frequency. NUREG/CR-3226 shows the effect of using log nor-mal distributions to represent basic event probabilities on mean probability estimates, calculated medians, and uncertainty ranges. When that work was com-pleted, the magnitude of the uncertainty in the loss of offsite power frequency and duration estimates was not known. Because the uncertainty bounds are now perceived to exceed those used in NUREG/CR-3226, the accident sequence uncer-tainty ranges derived using the most recent uncertainty estimates for loss of offsite power frequency may be larger than previously estimated. The loss of offsite power frequency and duration estimates are most uncertain for the very low frequency, long duration losses of offsite power. The uncertainty on the probability of accident sequences which result from the shorter duration losses of offsite power should not be significantly different from the previous estimates. Some typical station blackout core damage probabilities and uncertainty ranges representing a 90% confidence interval have been provided in Figure 8.5 for reference. The sequence mean is typically 3 to 8 times larger than the point estimate and the upper and lower bounds are typically within a factor of 5 to 20 of the median estimate. The large difference in point estimate and mean can be attributed to the use of a log-normal distribution. When sequences are ; combined into a single core damage probability, the proportional distance l between mean and point estimate tends to decrease somewhat. 1 I NUREG-1032 8-7 l 1
j Table 8.1 Sensitivity of estimated core damage frequency reduction-for station blackout accidents with reactor coolant pump seal failure delay from 2 to 4 hours and 4 to 8 hours Estimated core damage frequency (per reactor year) Cluster 1/2 configuration
-' / ' ',..EDGR* = 0.025 EDGE = 0.05
.. /
2 to 4 hn 4 to 8 hr 2 to 4 hr / ' Ito 8 hr l N /
; 2 2.8E-6 s 1.2E-6 672E-6 2.5E-6 l \
l## 1.3E-5 \ 6.0E-6 2.8E-5 1.3E-5 l5' 5 1.7E-5
./
1.5E-5 3.6E-5 3.0E-5 1/3 configuration gi 8.3E-7 3.4E-7 i 2 , 4 , l k (3 3.7E-6 1.7E-6 l
/
4.6E-6 4 DOE-6 1
-fr [ -~._ _ . _ _ _ ; *EDGR = emergency diesel generator unreliability (i.e., failure rate per demand)
E DG R * =0.0: S gD9[:e0S l
, =M ute ny gr a \ '
l jy/g -S g 2,g -S t.4xf Y 4 0 ~' * q4 X/o*S 3Y%'
- 7fWO d,3 WO ~ S 9,gyn~'S g pm'S 4 0pp C 2,?Rg 'S
\
q 2
, 2yo- S dvo'S Vs Cod /s trd'M
- 2. 2. t vo /,WO" '
3 2340 ~l0 W ' f I' 2xio'& Sx!O~b b Qvip*S lx/0~ ~ NUREG-1032 8-8
1
'/:
PWR with 1 steam BWR with 1 BWR with BWR with l 3 Driven AFW Train isolation Condenser HPCl/RCIC HPCS/RCIC - I 4 10 s 4.
)
S II
!)
? O ll o O g O [] O --
> o O ..
- U U "-
~~
$ 10'8
$ 0 0 i
e .. O o O l E U
- .. O O w -- O 0
4 4> I (> 0 0 4 10'g - i O
'l @
.. O ..
O U .. c w g .. 2 - 10'7
$ Upper 95% Confidence Limit Mean Median l
I> Point Valve j .a -- Lower 5% Confidence Limit i E s i i E i E d d I E
.T f 6 i f i i i i l E E E I E E E E E
, e e s e e s > s s s ACCIDENT SEQUENCES l Figure 8.5 Estimated core damage frequency showing uncertainty l range for four reference plants i
Source: NUREG/CR-3226 NUREG-1032 8-9
~
A measure of risk associated with station blackout accidents can be obtained i by multiplying the estimated core damage likelihood by the estimated dose due f to containment failure during a station blackout accident. The recovery of AC power during the accident would provide the potential for terminating core 1 l damage prior to core melt and the potential for reducing fission product re- l leases by delaying containment failure or actuation of containment sprays prior to containment failure. Some perspectives on estimated risk are provided in 1 Appendix C. l i I NUREG-1032 8-10
9 RELATIONSHIP 0F OTHER SAFETY ISSUES TO STATION BLACK 0UT The implications of station blackout on several other safety issues were re-viewed for significance. These include: loss-of-coolant-accident initiators; anticipated transients without scram; external hazards, such as seismic events and severe weather; and internal hazards associated with fire or extreme environ-ments, such as flooding or high steam temperature resulting from pipe breaks within the plant. In general, it was concluded that if the likelihood of sta-tion blackout were independent of any of these other safety considerations, the i
\
potential risk of a station blackout concurrent with one of those other safety j concerns is very small. However, if as a result of common cause failure or in- { teractive failure, the initiation of an accident by one of those other mechanisms ! described causes a station blackout, then the safety implications of those safety l I issues on station blackout are fairly large. Each of these safety issues is dis- j cussed separately below. 9.1 Loss-of-Coolant Accidents Loss-of-coolant accidents (LOCAs) induced by a station blackout transient have already been included in the accident sequence analyses described in Section 7 above; these will not be discussed further here. LOCAs concurrent with a loss of offsite power are usually included in the design basis of nuclear power plants in accordance with the general design criteria of Appendix A to 10 CFR 50. The likelihood of a LOCA followed by and concurrent with a station blackout has been considered and is discussed below. Although no strong coupling could be found between the initiation of a LOCA and j a subsequent failure of the offsite or onsite AC power system, one potential I mechanism has been identified. If a LOCA were to occur at a nuclear power plant, the reactor would trip; subsequently the turbine generator would be tripped and a grid instability could follow, or the site could be isolated by switching ac-tiivities in the switchyard to provide onsite safety-related or alternative sources of preferred power to the emergency power safety buses. Historical ex-perience collected about loss-of-offsite power events at nuclear power plants NUREG-1032 9-1
suggests that given a transient or an accident situation that would cause a trip of the turbine generator, the likelihood of a failure of the offsite power supply is on the order of 10 4 to 10 1, depending on the strength of the grid and the offsite power design at the site, Estimated LOCA frequencies range from 10 2 per reactor year for small loss-of-coolant accidents down to less than 10 4 per reactor year for large diameter pipe breaks. The frequency of small LOCAs is dominated by pump seal LOCAs on pressurized water reactors and stuck open safety-relief valves on boiling water reactors, situations that do not require rapid actuation of AC powered emergency safety feature equipment and that have been addressed previously. The most likely small LOCA that has not been incorporated in the station black- j out accident analysed is a small pipe break (less than 2 inches in diameter) ! with a frequency of about 10 3 per reactor year. The low LOCA frequency combined with the likelihood of losing offsite power on turbine generator trip results in an estimated frequency of occurrence ranging from 10 5 per reactor year to 10 7 per reactor year. When this frequency is combined with a conservative estimate of emergency AC power system uttreliability of 10 2 per demand, it is easily shown that accident sequences of this type re-present a small element of reactor risk (less than 10 7 per reactor year). The variability of the frequency of station blackout caused by a LOCA could be as l much as two orders of magnitude higher and still represent one of the smaller station blackout accident threats. Although, at this higher level, these acci-dents could represent a noticeable fraction of reactor risk. Large pipe break LOCAs with initiating frequencies on the order of 10 4 per reactor year combined with the probability of subsequent failure of all AC power do not appear to represent an appreciable fraction of accident likelihood or public risk, at least in comparison te other station blackout sequences. 9.2 Anticipated Transients Without Scram Another safety consideration that was investigated is anticipated transierats without scram. In this case, the anticipated transient is a loss of offsite power. If tne probability of a loss of offsite power is taken as the generic
~ average, 0.1 per year, and the probability of reactor scram failure is taken as i
NUREG-1032 9-2 j
\
I the historical average, about 10 4 per demand, then the probability of a loss of offsite power followed by a failure to scram is about 10.s. This is a level of accident sequence lik.elihood that might be considered important. However, . in order for station blackout to occur, the onsite emergency AC power system l i must also fail. In the worst case, one might find an unreliability of the emer- ; gency AC power system of about 10 2 per demand. Thus, the fr'equency of an anti- ! cipated transient without scram involving loss of offsite power and a failure of the onsite emergency AC power system is on the order of 10 7 per reactor year l or less. Even if the level of uncertainty were an order of magnitude higher, l 1 this accident sequence would not be of concern in comparison to the dominant ! l station blackout accident sequences that have been identified. i 4 9.3 Extreme Internal Environment A safety area in which there does appear to be a potential for station blackout type accident sequences being induced by other causes involves fire and other extreme environments internal to a nuclear power plant. The concern associated with internal environmental hazards is that their occurrence can represent a common cause accident initiator that also affects the ability to cope with the incident. Specifically of concern is the likelihood of a fire, flood, or other extreme environmental conditions generated by internal events that would cause a loss of all AC power. In general, for this to occur portions of AC power systems m'ust be in a common location where these hazards are present, or protection barriers and AC power system design requirements must be insufficient to control the spread or failure resulting from these hazards. Therefore, the likelihood I of internal hazards causing a station-blackout-type accident is heavily depen-dent on the plant's design and, in particular, on the location of equipment. If separation and internal environmental protection barriers are maintained, or adequate AC system design is provided, the likelihood of these internal environ-mental hazards causing a station-blackout-type accident would be very small, l probably less than 10 8 per reactor year. On the other hand, if commonality of l location or a lack of protection exists at a plant, then the safety signific-ance of these internal hazards would have to be evaluated for plant damage susceptibility and likelihood of occurrence. The frequency of occurrence of these hazards can be as high as once per one hundred to once per one thousand NUREG-1032 9-3 l
reactor years. Therefore, the vulnerability to station-blackout-type accidents due to these hazards can be of concern. l 9.4 External Hazards Another potentially significant safety consideration that could be related to station blackout involves external hazards to the' plant, particularly t'ase resulting from seismic and weather-induced failures. To date, a seismically induced loss of offsite power has not been observed at a nuclear power plant. Failure of offsite power because of severe weather has been observed at nuclear power plants; in fact, severe weather was included -as a major factor in deter-mining the likely duration of an extended offsite power outage at nuclear power plants, as described in Section 3. The greatest potential for safety signifi-cance exists where there is a direct coupling or common cause failure associated
]
between a transient-initiating external hazard causing loss of offsite power j and the reliability of the onsite and offsite power systems. It can be expected that significant seismic and severe weather events will cause a loss of the offsite power system. On the other hand, the plant, and in particular the emergency AC power system, is typically designed to withstand, or is protected from the effects of, these severe phenomena. Therefore, for severe external hazards that are within the design basis of the plant, the failure of the emergency AC power system can be considered as an independent failure event. For example, if the likelihood of a safe shutdown earthquake that could cause a loss of offsite power were approximately 10 3 per year or less, and one assumes that it would take approximately 8 to 24 hours to restore offsite power from such an incident, then a typical estimate of core damage or core melt frequency due to a safe shutdown earthquake and a station blackout would be about 10.s per reactor year or less. For severe weather, the likelihood of the weather-induced failure of the offsite power system could be as high as 10 2 per year, and the outage could be expected to be on the order of several hours. Again, if the severe weather event is within the design basis of the plant, the like-lihood of a weather-induced station blackout accident causing core damage or core melt would be on the order of 10 5 per reactor year. Table 9.1 provides a summary of the typical internal and external accident hazards of a nuclear power plant and identifies some potential points of failure l NUREG-1032 9-4 1
. I
i I 4 Table 9.1 Coupling between external (and internal) events and potential plant failures Event Potential plant " weakness" Seismic Switchyard, contrel, non-seismically i designed equipment l Fire, flood Areas with multiple divisions, inadequate protection barriers Severe weather Transmission lines and towers, switchyard, non-safety structures NUREG-1032 9-5
that could result in a coupling between these accident initiators and'a station blackout. 'If such' interactions or points of commonality do not exist, then it is concluded that the contribution of these accident initiators to station
' blackout accident sequences results in core melt frequencies that are no_ larger ~,
and probably much less, than those previously considered. i l l l t-NUREG-1032 9-6 l l l L
- a. . .
_ - - _ - _ . i
l 10 REFERENCES Adams, J. P., et al., " Natural CirculaL on Cooling Characteristics During PWR j Accident Simulations," Second National Topical Meeting on Nuclear Reactor Ther-mal Hydraulics, January 11 to 14, 1983. l Fletcher, C. D. , "A Revised Summary of PWR Loss of Offsite Power Calculations," { EGG-CAAD-5553, EG&G Idaho, Inc., September 1981. Industry Degraded Core Rulemaking Program (IOCOR), IDCOR. Technical Summary Report,
" Nuclear Power Plant Response to Severe Accidents," published by Technology for Energy Corp., Knoxville, Tennessee, November 1984.
l Schultz, R. R. , and S. R. Wagoner, "The Station Blackout Transient at the Browns Ferry Unit One Plant A Severe Accident Sequence Analysis," EGG-NTAP-6002, EG&G Inc., September 1982. ! U. S. Nuclear Regulatory Commission, NUREG-75/140 " Reactor Safety Study," Octo- { ber 1975 (formerly WASH-1400).
-- , NUREG-0737, " Clarification of TMI Action Plan Requirements," November 1980 1
-- , NUREG-0900, " Nuclear Power Plant Severe Acc.ident Research," January 1983.
-- , NUREG/CR-1988, F. E. Haskin, W. B. Murfin, J. B. Rivard, and J. L. Darby, i
" Analysis of a Hypothetical Core Meltdown Accident Initiated by Loss of Offsite i Power for the Zion 1 Pressurized Water Reactor," December 1981.
-- , NUREG/CR-2182, D. H. Cook S. R. Greene, R. M. Herrington, S. A. Hodge, and l D. D. Yue, " Station Blackout at Browns Ferry Unit One - Accident Sequence Analy-1 sis," November 1981. I J
-- , NUREG/CR-2989, R. E. Battle and D. J. Campbell, " Reliability of Emergency AC Power Systems at Nuclear Power Plants," July 1983. i l
NUREG-1032 10-1 l 1
N f' l
-- , NUREG/CR-3226, A. M. Kolaczkowski and A. C. Payne, Jr. , " Station Blackout Accident Analyses (Part of NRC Task Action Plan A-44)," May 1983. -- , NUREG/CR-3992, R. E. Battle, " Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants," February 1985.
Wyckoff, H., " Losses of Offsite Power at U. S. Nuclear Power Plants--All Years Through 1983," NSAC/80, Electric Power Research Institute, May 1984. D'esd C<aaatn a f v, s. u.'yckaK, H., ' Rekd${ s ( Emeg en c,- ivges, flu,er 1%t;" NSAc/toS, Elatret P~u Ressah DsM, 5:76 -k t9N. 1 i d l l 4 o I
}
10-2 NUREG-1032
1 1 l
;1 1 1 i
APPENDIX A DEVELOPMENT OF LOSS OF 0FFSITE j POWER FREQUENCY AND DURATION RELATIONSHIPS l I l
)
I 1 1 1 1 1 1
'l I
i 1 1 1 1 j l I NUREG-1032 Appendix A l
l I
. I TABLE OF CONTENTS Page q l
INTRODUCTION .......................................................... A-1 ! LOSS OF 0FFSITE POWER FRCM PLANT-CENTERED CAUSES ...................... A-5 , GRID-RELATED LOSS OF 0FFSITE POWER .................................... A-12 ( LOSS OF 0FFSITE POWER DUE TO SEVERE WEATHER ........................... A-19 1 GENERIC LOSS-OF-OFFSITE-POWER CORRELATIONS .............. ............. A-34 REFERENCES ............................................t............... A-41 i LIST OF FIGURES A- %. k la.Frequency A.1 L ocs.eSofo loss-of-offsite ffr& e.wr mapower l .freIw,n,hs eve . exceeding specified durations......................................................... A-4 A.2a Estimated frequency of occurrence of plant-centered losses of offsite power exceeding specified durations ...................... A-11 A.2b 90% confidence limits for two categories of-plant-centered losses of offsite power .......................................... A-13 f..O- Tr:r.d cf picnt ::nt:r:d 1;...; cf cf f;it; p _,. 'gr :t:r th;n-3& minuww= uurowiun; unv.w. .,-. . .. ............. .- n ., A.4 Restoration probability for grid-related losses of offsite power . A-18 A.5 Estimated frequency of occurrence of grid-related losses of offsite power exceeding specified durations ...................... A-21 A.6 Weather hazard expectation histograms ............................ A-26 A.7 Restoration probability for severe-weather-induced losses of offsite power .................................................... A-30 A.8 Estimated frequency of occurrence of Ievere-storm-induced losses of offsite power exceeding specified durations ............ ...... A-32 A.9 Estimated frequency of losses of offsite power exceeding specified durations for Indian Point......................................... A-36 A..t Estimated frequency of losses of offsite power exceeding specified durations for Zion ..................................... A-37 A.11 Estimated frequency of losses of offsite power exceeding specified durations for Shoreham ................................. A-38 A.12 Estimated frequency of losses of offsite power exceeding specified durations for Millstone 3 .............................. A-39 A.13 Estimated frequency of losses of offsite power exceeding speci fied durations for Limeric k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-40 ! A.14 Estimated frequency of occurrence of losses of offsite power exceeding specified. durations- for nine offsite power clusters . . . . A LIST OF TABLES A.1 Summary of loss-of-of f si te power experience . . . . . . . . . . . . . . . . . . . . . . A-3 A.2 Definitions of offsite power system design factors ............... A-6 A.3 Mean time to restore offsite power and statistical test values for plant design groupings .................. ............. ...... A-9 NUREG-1032 A-iii
TABLE OF CONTENTS (Continued) Page t. A.4 Data used for plant-centered loss-of-offsite power-duration curve fits ....................................................... A-10 A.5 Grid-related loss-of-offsite power frequency versus duration, through December 1983 .................................. A-16 A.6 Grid reliability / recovery ........................................ A-20 A.7 Severe-weather-induced losses of offsite power used in the analysis ......................................................... A-23 A.8 Severe-weather-induced loss-of-of fsite power frequency / recovery .. A-31 A.9 Extremely severe-weather-induced loss-of-offsite power frequency . A-33 A.10 Cluster correlation factors ...................................... A-43 All Identi'Matbr of grid, Of f;ite pc,= sye+= d e fgr., sevo. e weather, cr.d extre.T.ely-severe-weather fedvi s i .cled J ... ..i .; c l uste r-group s . . . . . . . . . . . . . . . . . . . . . . . . .T. . . . .w- : . . . . . . ........ A 1 I i 1 i l 3
)
I 1 l 1 1 NUREG-1032 A-iv i _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . . _ _ _ _ . . _ . _ _ _ _ _ _ . _ _ _ _ _ _ . _ _ _ _ . _ _ . _ _ . _ _ _ . ._.__._._m_.____ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _..__.._.___________.._________.______._____._.__._)
APPENDIX A DEVELOPMENT OF LOSS OF 0FFSITE - POWER FREQUENCY AND DURATION RELATIONSHIPS INTRODUCTION This appendix provides the details and results of analyses performed by NRC staff to develop the cause, frequency, and duration relationships for loss of offsite power at nuclear power plants. The purpose of this work was to develop generic loss of offsite power relationships that would allow differentiation of plant design, operational, and location factors that can significantly affect the expected frequency and duration of loss of offsite power events. Within this study, the loss of offsite power has been defined as the interruption of the preferred power supply to the essential and nonessential switchgear buses neces-sitating or resulting in the use of emergency AC power supplies. A total loss of offsite power is said to have occurred when non-emergency AC power sources i become unavailable requiring some diagnosis or special recovery actions includ-ing coirecting switching errors, fixing or bypassing faulted equipment, or other-wise making available an alternate standby source of non-emergency AC power. Although total loss of offsite power is a relatively infrequent occurrence at nuclear power plants, it has happened a number of times, and a data base of information has been compiled (Wyckoff, 1984; NUREG/CR-3992). From these data and a review of relevant design and operational characteristics, the frequency and duration relationships for loss-of-offsite power events at nuclear power plants have been developed. Historically, a loss of offsite power has occurred with a frequency of about once per 10 sita years. The typical duration of these events has been on the order of one-half hour. However, at some power plants ; the frequency of loss of offsite power has been substantially higher than the i average, and in other instances the duration of offsite power outages has been I l NUREG-1032 A-1 { l
l much longer than the norm. In some cases, licensees have and are taking correc- ) tive action to limit the recurrence of'these longer and more frequent losses of { offsite power. A summary of the data on the total loss-of-offsite power events is provided in Table A.I. Because design characteristics, operational features, and the loca-tion of nuclear power plants within different grids and meteorological areas l q can have a significant effect on the likelihood and duration of loss-of-offsite-power events, it was necessary to analyze the nuclear industry experience in more detail. The data have been categorized into plant-centered events and area- or weather-related events. Plant-centered events are those in which the design and operational characteristics of th'e plant itself play a role in the i likelihood or duration of the loss-of-offsite power event. Area or weather effects include the reliability of the grid and external influences on the grid or at the site (such as severe weather) that have an effect on the likelihood and duration of the loss of offsite power. The data show that plant-centered events account for the majority of the loss of offsite power events. Although ' the area-blackout- and weather-related events, are less frequent, they typically account for the longer duration outages, with storms the major contributor to long outages. Figure A.1 provides a plot of the frequency and duration of loss-of-offsite-power events resulting from plant-centered faults, grid blackout, and severe weather, based on past experience at nuclear plant sites. The curves were l developed by fitting data to a two parameter Weibull function of the following form: 0
-(aj t 1)
ALOPi (t) = ALOPi
- where ALOPi(t) is the frequency of losses of offsite power of type "i," which are equal to or greater than duration "t." That is, the recovery time equals or exceeds "t" hours. The term A LOPi is the frequency of occurrence of losses of offsite power of type "i," which have greater than zero duration. Parameters I
NUREG-1032 A-2 i I
8 l
\_ A A.\
i Cd c etcf 0 e. , e CN C M f' p. egg % e p (c. (1 'I2 kr ) c.ch Icu.\ - qe a.c (. rh. w ) , Y\CcM - CE /de<(::.b 9b- . O 2 ~1 k i5) (,, , O ~2 ? ) l l GAA \ P., .oa C. -Q (.coe ) VJeoMne< (o .co7
- (, b ) --
(..o o7 ) Tok o.\ c, + .ioe ( 2. P ) C.o43) , 00vnb e< oh c/A ccd <:.de. gen.eg decook.
,Dg.co. .b e< m f:r a s'a 1 ,
W e. ne <<.b c4 oy cAC qecu<4 ss (.or o A
$ o ~l's CC4 )
% M cd on Cf$kIc d - S eo f g Y-o C h -cu d e%W ; .9x F)eyem '
6 Mced ow sde geaa' 3c;A omcl wecaA-hex evem4s .p i l
.-*e..-<
em we
- p. .
, a4
== me.w.g. ..-,w 4 en s e'
.am-he9 .. A:3 _ _ . -
i
l-i- O I l Data O Totai 0.05 - _ Total d Plant-Centered f Grid 5
; O severe weatner
$ 0.04 - -
i 73 0 i l 5 v Plant - z g Centered b 0.03 - , u O O u. O o 5
$ 0.02 Grid 0.01 O severe Weather O
0.00 1 0.1 1.0 10.0 DURATION (Hours) Figure A.1 Frequency of loss-of-offsite power events exceeding
~
specified durations NUREG-1032 A-4
aj and $9 are curve-shaping constants that vary according to the data being curve fitted, p:g g
~
LOSS OF 0FFSITE POWER FROM PLANT-CENTERED CAUSES Plant-centered failures typically involve hardware failures, design deficiencies, human errors (in maintenance and switching), localized weather-induced faults (lightning), or combinations of these failure types. Plant-centered failures can be recovered by switching or repairing faulted equipment at the site. For the plant-centered losses, an attempt was made to determine any correlation between offsite power design characteristics and frequency and duration of los-ses of offsite power. Two offsite power design features were identified as potentially significant with regard to frequency and duration of loss of off-site power: (1) the independence of incoming offsite power sources and (2) the number of immediate and delayed access circuits and their transfer schemes to the Class 1E buses. Table A.2 defines the design differences associated with these features. The designs of offsite power sources were further subdivided into groups, and the number of shutdown sources were subdivided into different possible design combinations (NUREG/CR-3992). The relationship between the listed design features and the frequency of loss of offsite power was analyzed using the Failure Rate Analysis Code (FRAC) (NUREG/CR-2434) to correlate loss-of-offsite power frequency with various design features. These analyses showed no statistically significant correla-tions between frequency of plant-centered losses of offsite power and the design features analyzed. An analysis was also performed to determine if a statistically significant rela-tionship exists between offsite power design characteristics and the duration of losses of offsite power. An analysis of covariance was performed to deter-mine if there is a relationship between frequency and duration, using the gen-eralized linear model (GLM) procedure of the Statistical Analysis System (SAS) (SAS Institute, 1979)). The Type IV sum of squares was used for all calcula-tions. No statistically significant relationship between frequency and NUREG-1032 A-5
)
a ; 4
.TNSEAT(p
/?)al t n t.w:-c abo ,ve t(rinc/ $ s&bre c ifc
&ce/s M 4:: a{ skS$ puser h u er,c .
Gwre A. i a s6cs a dd& bil vuye hs / n/i4 ener $ pur&,,xv6A ikeks/ m 7AS/< d $ a<v ure elf. 7? Ice reu//s t:/ Iou) /d/ s u'< < a eral of 20 esrs fram /745 Mrv I?H/ //e orof haul Ace Ami haiu/redneGt a css Loncf g&& pwr # 7acc . /Awm it;tenm, a Au6,i[assd. x/ce~x aL L 6aVtpa,ca a<d d b , he - em Jup,e/en w we:s asa semp w4c/ caI,c cAa<ur<csn & aVS,~t c6/ /4 a<a&he esatte. Ar//M<>d af /W 74 as,A& scey Ac.cs / c&K& s&J ai a>&Ye /4 frew6 p&ani,f,eneaa &paarD.aos 1a idie,ri a wo.*, w& 1 aru VarIwGn re Ar k> ass O. 2 S d s.lo s w< /4 pried.y A-5 x
S D L N E L A ucn G _ AEw a M a E _ n3 L _ ~ R E , WY T 1 I OC l-P N / - E E
\
TU e' S Q I i
/
E \'
\
i-
\
R i' t ' F F I \ I
\
1 g 'I F f I l l \ g I I I OL f l
/ t I
A 1
\
' \
i \ FU
\
;i
\,t ON
\
\
i s
\
N S S A - t' l l I l ' s I s
'I I',l I
O \.
\ \
\
\
'g i
t, L I
. ' \
1
~. \
t
\
al
' I '
a i 8 ,' glg i I l y yI l I f. A - Fly - s 0 D - o, 3 a 2 i gi? x d5a85 E t$ "
! , l '
9
' Table A.2 Definitions of offsite power system design factors Major design factor Design features A. Independence of offsite power 1. All offsite power sources are sources to the nuclear power connected to the plant through plant one switchyard.
- 2. All offsite power sources are connected to the plant through two or more switchyards, and the switchyards are electrically connected.
- 3. All offsite power sources are connected to the plant through two or more switchyards or separate incoming transmission lines, but at least one of the AC sources is electrically independent of the others.
B. Automatic and manual transfer 1. If the normal source of AC power schemes for the Class 1E buses fails, there are no automatic when the normal source of AC transfers and one or more manual power fails and when the backup transfers to preferred or alter-sources of offsite power fail nate offsite power sources.
- 2. If the normal source of AC power fails, there is one automatic transfer but no manual transfers to prefer-red or alternate off-site power sources.
- a. All of the Class IE buses in a unit are connected to the same preferred power source after the automatic j transfer of power sources.
- b. The Class 1E buses in a unit are connected to l
separate offsite power sources after the auto-matic transfer of power sources. l 3. After loss of the normal AC i power source, there is one auto-matic transfer. If this source fails, there may be one or more manual transfers of power _ sources to preferred or alter-nate offsite power sources. NUREG-1032 A-6
l Table A.2 (continued) Major design factor Design features
- a. All of the Class 1E buses in a unit are connected to one preferred power source after the first automatic transfer.
- b. The Class IE buses in a unit are connected to sepa-rate offsite power sources after the first automatic transfer.
- 4. If the normal source of AC power fails, there is an automatic transfer to a preferred source of power. If this preferred source of power fails, there is an automatic transfer to another source of offsite power.
- a. All of the Class 1E buses in a unit are connected to the same preferred power source after the first automatic transfer.
- b. The Class IE buses in a unit are connected to sepa-rate offsite power sources after the first automatic transfer of power sources.
NUREG-1032 A-7 h__m.____ __ .--___m.m_ _ _ _ _ _ - _ _ _ .
duration was found. Thus, no additional covariance analyses were~ run. Subse-quently, the data for all of the different design factors were analyzed-to check for any statistical interactions using aralysis of variance. One data point--a 5.83-hour restoration time for an event at the Calvert Cliffs plant on April 13, 1978--was found to cause a strong interaction. Without that event, there was no significant interaction. The Calvert Cliffs event involved a latent design flaw that has since been corrected; it is not expecte-1 to typify future occurrences with regard to design feature, type of failure, or duration. With the data " corrected," the independence of offsite rower sotrces was found to be a statistically significant determinant of the restoration time associated with plant-centered losses of offsite power. The number and type of transfer schemes were found to be less significant. It was concluded that various com-binations of these design features could be used to define a set of design characteristics with a statistically different recovery time for plant-centered ! losses of offsite power. On the basis of this analysis and a review of the design features, the staff concluded (1) that' plants with switchyard designs that are normally operated as an interconnected system could be separated, as a group, from those with designs offering electrical independence, and (2) that sites with two or more alternate offsite power circuits (immediate or delayed access) in addition to the normally energized power circuit to the Class 1E buses (off-site or unit generator source) could be grouped. Table A.3 shows design combi-nations obtained with the mean time to repair (MTTR) values for each group and the statistical test values that were derived for this grouping. Other groupings can be derived that are both statistically significant and physi-cally valid. However, data limitations and small differences in MTTR that occur for more detailed breakdowns suggest that the design groups obtained represent a reasonable and valid compromise between completely generic and more design-specific breakdowns. A plant-centered loss-of-offsite power-frequency-vs.-duration curve was devel-Ahree oped for each of the -ftmr design groups by fitting the corresponding data to a / two parameter Weibull distribution. A list of the data used for each curve fit is given in Table A.4. The actual curves generated by this analysis are in Fig-ure A.2a. The curves show the probability and frequency of events that exceed a NUREG-1032 A-8
~TEb \c. A.3 C: < c sp h e s e, n ed .us gu we 4.
T e:.L ee. In A: er . E. o ( A \ e r A~2.) M ck . 3 A 12 (M e< A 7.') . ud . 3 cn (E2b er EE)
~I l (As or A s.) ud .19 CD oc *L2a) r es4 "Det%^ s F vake. 7c F IoL%<
Tesh yec A 3.7 f .oto4
\n k o.c. hun \ Q \ .~1 7 .\5s%
A*E , sat . T 17 2 - Tce A s.0 . eo% mak p<ych e E t.fo . i 3ci ; Feeq v u e . 5t %( _ e duc4 s o s.3 . - e Q_ M c< em% wo.s c.or.ct 1pcA ish geo.c . _
\
- m4' W - p+mr- .g w age..
O 9
- O -
+_.sglasmw =
or m. ag-
- + eF- e se w4W e. sag ee mee+ -e -i- uesp@- **se --
w i
l-l' l.
- l. Table A.4 Data used for plant-centered loss-of-offsite power-duration curve fits
- Group Site Date Duration (br)-
6 Fitzpatrick 10/04/78 0. 04 Oconee 01/04/74 0 013** Fitzpatrick 03/27/79 .05 Millstone 07/21/76 0.08 Indian Point 2,3 06/03/80 0.50*** 12 Nine Mile Point 11/17/73 0.003 Haddam Neck 07/19/7 0.017 Haddam Neck 07/15/ 9 0.15**
$ Haddam Neck 06/ /76 0.27 4 Haddam Neck 08 9/74 0.33 0 Haddam Neck 04/27/68 0.48 T / .
4 3 Davis Besse / 11/29/77 0.002** y i Oyster Creek / 09/08/73 0.003** T
, Point Beach Brunswick 2 ,/
!' 04/27/74 03/25/75 0.02**
0.07
% Monticello 04/27/81 0.25 4 Beaver Valley 07/28/78 0.28 Davis Besse 10/15/79 0.43 8 Ginna 03/14/71 0.50 h Quad Cit s 06/22/82 0.57 Ginna 10/21/73 0.67 l Prair' Island 07/15/80 1.03 Qua Cities 11/06/77 1.15 Ar ansas-1 09/16/78 1.48 I4 San Onofre 11/22/80 0.004 l Fort Calhoun 08/22/77 0.015 Palisades 09/24/77 0.50 Farley 09/16/77 0.90 Fort Calhoun 02/21/76 0.90 x JLisAdes .09/0247 F 0.93 Indian Point 06/03/80 1.75***
Farley 10/08/83 2.75 ] q
*Not included in the duration analysis were the Palisades events l of 11/25/77 and 12/11/77 (recurring failures), the Calvert Cliffs event of 04/13/78 (outlier), the Big Rock Point event of 11/25/72 (insufficient plant design information), and the Crystal River event of 06/16/81, the Vermont Yankee event of 12/17/72, and the Turkey Point event of 04/04/79 (incomplete reporting of duration).
**For events with unspecified durations Jf less than 1 minute, durations were assigned to facilitate the statistical analysis.
***The Indian Point event of 06/03/80 lasting 1.75 hours, included in Group I4, is also included as a 0.50 hour event in Group Il .
on the basis that had the available gas turbine been employed, offsite power would most likely have been recovered in approxi-mately 30 minutes. I
,NUREG-1032 A-10 l
ir# wh used p< 9s d - 4 T h\e. A,.4 cec,wdye., e.<cd PLANT
\OSS - o -ohsde gewee d o m .% g DATE DURATION p{4 DAVIS-BESSE 11/29/77 0.002 f NINE MILE POINT 11/17/73 0.003 , ]
OCONEE 01/04/74 0.013 i HADDAM NECK 07/19/72 0.017
- MILLSTONE 07/21/76 0.080 .
yl 07/15/69 0,150 HADDAM NECK HADDAM NECK 08/01/84 0.167 SUSOUEHANNA 07/26/84 0.183 l MONTICELLO 04/27/81 0.250 HADDAM NECK 06/26/76 0.270 HADDAM NECK. 01/19/74 0.330 DAVIS-BESSE 10/15/79 0.430 HADDAM NECK 04/27/68 0.480 INDIAN POINT 2,3 06/03/80 0.500 PLANT DATE DURATION . OYSTER CREEK 09/08/73 0.003 POINT BEACH 04/27/74 0.020 BRUNSWICK 03/26/75 0.070 ' DRESDEN 08/16/85 0.083 POINT BEACH 02/05/71 0.130 TURKEY POINT 02/12/84 0.250 TURKEY POINT 02/16/84 0.250 BEAVER VALLEY 07/28/78 0.280 MCGUIRE 08/21/84 0.334 ' GINNA 03/04/71 0.500 GIMMA 10/21/73 0.670 PRAIRIE ISLAND 0//15/80 1.v30 ARKANSAS NUCLEAR ONE 09/16/78 1.480 PLANT DATE DURATION SAN ONOFRE 11/22/80 0.004 FORT CALHOUN 08/22/77 0.015 - - SAN ONOFRE 11/21/95 0.067 PALO VERDE 10/07/85 0.200 y PALO VERDE 10/03/85 O.400, PALISADES 09/24/77 0.500 QUAD CITIES 06/22/82 0.570 FARLEY 09/16/77 0.900 FORT CALHOUN 02/21/76 0.900 PALISADES 09/02/71 0.930 OUAD CITIES 11/06/77 1.150 INDIAN POINT 06/03/80 1.750 FARLEY 10/08/83 2.750 g F
$wt o.L deo.4. O - tC ? 2.
- i i
hl0h
11 \ i1 l I Il 1 l-
.. e
. g 3 n i
8 % dA*n Y b40(4M >$gSE8 d 0 , 6 5 3 1 e f 0, 0 l A Y e t. e c
- p .# _ -
~
- 0 x e
. . 1 r
e Jh w 0 , t o p e s t) i3 s
. fA f _
a oel _ fb oa a . T s en si s on
- l w 9 0
o dh
. 1 es r
. \ I es s b I ta n
a I es cp t
)
s - u
' r to u nr o
t ag
- - h t l
\ \ N pr 1
s I }, O f w e i ? I T oop
\ A e R ce 5 !
U nt
- 1 !
D ei rs l rf I [ bf
,' 1 co e c 1
0 oro i I
- f ._
o( I I ys I cn no l ei ut qa r s I hufd - N a I dd ee ti x' ' af mi ic 4 te sp Es 1 0 a 0 2 8 1 8 5 4 3 2 _ 0 A 0 s. 0 0 0 0 0 1 9 0 0 e oa. u~ EB E mOg g rE g E'_m4mO r st u g i F f 2G@OO" >O -
specified duration. Figure A.2b shows the 90% confidence limits for two of the correlations (Il and I4) derived using the extreme value theory. , l f wasrecognizedthatsomeof't'heloss-of-offsitepowereventsrepresenteda{ 1ac(of experience and, as experience is gained and problems are solved,,the ! expect'ed, frequency could drop. Figure A.3 shows the actual and mediarpsmoothed plotofDimebetweenloss-of-offsite-powereventsasafunctionofth'eevent ! p number. The\first data point is the time in site years between the first recorded loss \of offsite power and the second occurrence. Thed'rendappears j
, ! to show an increase in time between failures, or decrease in/ requency. f Visual inspection of the plot of the median smoothed time betweed failures indicates a
{ reasonable break point'at about the 7th occurrence, which roughly corresponds to January 1978. An anal'ysis of variance showed that the mean loss-of-offsite N I power frequency as a result 'of plant-centered events from 1978 to 1983 was
, statistically different--showing a decrease of 30%--from the previous level
{ for events lasting one-half hour \or longe Itshouldbenoted,however,thatl
, with the removal of the occurrence f t one event in 1977, statistical support to this trend would drop sub ntially.
I The effect of experience was a o evaluate through an attempt to correlate plant age and frequency of loss o offsite power. sual examination of these data ' indicated a rather rando frequency of occurren sed on plant age.
;Thestaffhasconcpdedthatthereprobablyhasbeen me decrease of the loss-1 of-offsite power frequency for plant-centered events at\ clear power plants as total nuclear ower plant operating experience has increas ut that some addi
, tional tim and evaluation will be needed to definitively show the permanence i of such n observation. Nonetheless, the loss-of-offsite power fre ncy esti-I mates rovided later in this appendix are based on the reduced frequen f plant-cep ered events (0.04 per site year versus the actuali tserved frequency p.056 per site year) obtained as a current best estimate.
\;
1 GRID-RELATED LOSS OF 0FFSITE POWER I Grid reliability has traditionally been the most prominant factor associated j with a loss of offsite power at nuclear power plants. Yet, the historical data NUREG-1032 A-12 , i l
l l 4 3 $.
) ,tMre N t ecmeC( YCNEUQERF
" ~
h Y h I "o* o' {
) 4 i
0 I 1 I
\ T i i =
1 l a i ,- 2 -1,j : s-o o l / SH w ._
/ ,' E o
$ l l
%Y W
~
/
/
/
~ $s-
} / $
7 Oo$ . l
/
/ l S l
f' / / /.- ;; o- e, / :- = 2 /'
/ / -
/} / 1 R, {
/ , Vm 5 *(
~~f f* ,2
\ y /, / 4 "H .; - 5 7 C
/ \ l $
f ' / ~' ;' c o
- n Y. e $ ~Y , g
/
. / /* f n o
/ N j
o l ./
// _
/
/
/
[ - 2
/ -
8
/ -
n
.[ k.
- I: i
, u 3
i
' ~1 ' I I l l l l I ' I g
' o e ni 4 o ni h di b l *- o g a' o' e o o' o o e o o' REWOP ETISFFO GNIROTSER TON FO YTILIBABORP 2 f NAH30-I0EZ V-IE
show that losses g ffsite power as a result of grid-related problems account for no more than JO% of all losses of offsite power. Attempts to find charac- / l teristics to classify site, design, and location features that affect the expec-ted frequency of grid loss have not been successful. An investigation into the various utility transmission and distribution system reliability characteristics was beyond the scope of this study. Such a study is likely to involve an ex-tensive state-of-the-art analysis of grid stability, the results of which would be of questionable validity considering limitations on current methodology. In its-place a more pragmatic and experience-based approach to estimating nuclear plant site susceptibility to grid loss was taken. Both frequency of grid loss and time to restore power were considered. It was recognized that the Florida Power and Light (FPL) grid has represented the upper end of utility grid failure frequency during the past 10 to 15 years, although some recent improvements seem to have been effective. Very few other nuclear plant sites have experienced even one or two loss-of-offsite power events as a result of grid blackout. The great majority of nuclear power plants have not experienced grid failure. A systemic weakness identified after a grid fail-ure is usually corrected as soon as possible. Thus, it is usually a new and previously unidentified systemic weakness that results in future failures. Therefore, in the absence of known and uncorrected systemic weaknesses, the occa-sional, non-recurring type of grid failure may not be a good indicator of future trends within a utility system. With this in mind, the FPL experience was sepa-rated from the balance of the U.S. nuclear utility experience to estimate grid-failure frequency. Because a set of design or location factors could not be identified that could effectively differentiate the expected reliability of the various utility grids, grid reliability was categorized by failure frequency ranges characteristic of past experience. The FPL experience suggests an upper endtothegrid-failurefrequencyofonceper2tohsiteyears,althoughthere / have been recent improvements. In a few utility systems, the occasional grid failures have occurred at a frequency of about once per 10 to once per 20 site-years. The national average is about once per 100 site years, excluding FPL experience. Table A.5 lists grid-related losses of offsite power and site-specific frequencies calculated from the data. Two grid undervoltage events are discussed in a footnote to the table. Although these events were not counted as I 1 NUREG-1032 A-15 l
l L l Table A.5 Grid-related loss-of-offsite power frequency versus duration, through December 1983 Date of Duration Site frequency Site occurrence (hours) (per year) Turkey Point 04/03/73 0.30 0.446 (5 events lii 04/04/73 ' O.25 11.4 site years)
' ' 04/25/74 0.33 06/28/74 0.18 /
05/16/74* 05/16/77* 1.03 2.00
~
/
/ ,.- l u Indian Point 11/19/65 **
f' O.15 (3 events in q 07/20/72 07/13/77 0.92 20 site years) 4 ..e '6. 47
. St. Lucie 05/16/77*** 0.33 0.260 (2 events in 05/16/77*** 1.50 7.7 site years)
Ml , 05/14/78 0.13 N Yankee Rowe
~
11/19/65 0.65 0.044 (1 event in bi 22.5 site years) 4 / g 47 sites - nonet -- 0 (no events in i b ,/ 3.5 to 23.4 site--
,/ years)
/
Tota.Vfor 0.020 (11 events in 52 ' sites (539 site years)
! Total "~
0.008 (4 events in ___ excluding FPL _ ~ ~ (520 site years)
*The Turkey Point events of 05/16/77 were counted as one event for frequency calculations.
** Actual duration not reported.
***The St. Lucie events of 05/16/77 were counted as one event for frequency calculations.
tThe undervoltage event at Millstone on 07/21/76 was treated as a plant-centered design problem; the undervoltage event at Quad Cities on 02/13/78 was treated as a degradation with a useable offsite power source available throughout the incident. NUREG-1032 A-16
7-__ fnsn4 &r;, taw \e. hA 3ec '# PLANT DATE DURATION t TURKEY POINT 06/28/74 0.180 2 TURKEY POINT 04/04/73 0.250 0.444 (, b Cut M L 3 TURKEY POINT 04/03/73 O.300 ",g , 4 e , 9. g g ) 4 TURKEY POINT 04/25/74 0.330 % 5 . TURKEY POINT 05/16/77 # 1.030 6 TURKEY POINT 05/16/77 88 2.000 7 TURKEY POINT 05/17/85 2.083
. ;ecord# PLANT DATE DURATION TIME g
- gg g (3even%g 1 INDIAN POINT 07/20/72 0.920 2 INDIAN POINT 07/13/77 6.470 'g es,, 2. 3 . 9 E A C - %'#1 3 INDIAN POINT 11/09/65 2 O. W '.lN, ,;0 W N * ,
l I Rscord# PLANT DATE DURATION TIME 1 ST. LUCIE 05/14/78 O.130 0 2O k2 *** C-ST. LUCIE 05 /16 /77 * =
- O. 330 (1 OF 2)* s 3 ST. LUCIE 05/16/77 *As 1. 500 (2 OF 2)* t6 9.T t' A C .' u,cu t j I
{ 1 Record # PLANT DATE DURATION TIME 11/09/65 O.550 * ,OE9 ( s e o e-ak ss l 7- YANKEE ROWE
- 2. C . C :. de - g'eo.vt ) ,
i i 60 sAes none. o ( ce e ven4 c kI 3 S c, ze.3 s A-e - Heavt ) j Tohw\ Ic c O. o \ 2 k \?. E v eM ^ d ch i sua c A e w. e :. ) To ted e.xc.\Mir 3 o.cc 6 ( A ev wax FPL % g+.A cAe uge a<t )
grid failures, offsite power sources were momentarily unavailable during these events. Two factors which have been identified as significant in determining the dura-tion of grid-related losses of offsite power at nuclear power plant sites are: (1) the availability of adequate restoration procedures and (2) the availabil-ity of " black start" power sources that are able to supply power to a nuclear power plant in isolation of a grid disturbance. Both of these factors can contribute to a significant reduction in the expected duration of grid-related losses of offsite power, as reported in the Indian Point Safety Study (PASNY, 1982). In 1981 the NRC sent a generic letter (NRC, 1981) to all nuclear power plant licensees requesting them to develop and implement procedures to enhance restoration of offsite power. Responses to that generic letter have indicated that power could be preferentially restored to many nuclear power plant sites within 1 or 2 hours, even if the grid remained in a blackout condition. The time to restore offsite power following a grid-failure can be estimated by I past experience. However, if an appropriate set of procedures are provided and power sources are available and capable of supplying power during grid blackout, a more prompt recovery may be possible. Human reliability and the availability of alternate power sources may limit the recovery potential to as low as 60% recovery in about an hour. If multiple reliable sources of power that can be isolated from a blacked-out grid are available, the potential may be as high as 95% recovery in less than one-half hour. For this study, an offsite power-restoration likelihood of 80% within one-half hour of a grid failure was assumed for the analysis of plant sites with enhanced recovery capabilities (e.g., pro-cedures and at least one power source available for prompt recovery). The recovery probabilities for grid-related losses of offsite power were developed by fitting past operating data to a two parameter Weibull distribution. The data used in the curve fit are provided in Table A.S. Figure A.4 provides a curve showing the probability of not restoring offsite power versus the duration of losses of offsite power as a result of grid blackouts. It also shows the potential for improvement with enhanced recovery capability over past operating experience. s NUREG-1032 A-17
1 ! ! o t - A ' e la r cmr ' e n o . e w idNr \' o p f noyr - y of e r e e v Csv t o
\ '
t . o %me i c \ i s a c e 0i 9LR \ f t a R \ A ' f D l k o a \ f A m r \ 4 % o o \ N
- \ N s e
\ \ I 0
s k \ N' 1 s o g ' l
\ \ '
\
A \ \
\ \ '
)
s d t e r a
\ \
\
i
\s '
u o l e
\ g ' h - \ A k g\ g \ %g s s g S (
N O d r
\ A si I
T i r
\ I g
A g
\ R _
g \ i
\ I ' U D
r o
\ i f
\ \g y
- \ gs t
\ S i
l
\ g
% dy !
1 i b
\ ' er ce '
0 a s nv ' b ao o hc ne
' r p
ER ' n o i
' t -
a r o t s e R
- 4
. A e
. 1 r
- - - - - - - - - - 0 u _
O g 0 9 8 7 6 5 4 1 0 3 2 i 1 0 0 C 0 0 0 0 0 0 F 5h' &oo o$ g po i f eem m ' -
= :r onQ o
- TM l ll llij i!
l f l L l r , 1
.The correlations for grid reliability and offsite power restoration were developed by combining the occurrence frequencies representative of operating experience and the calculated recovery probabilities. Table A.6 provides the grid failure frequency and duration groups obtained. Figure A.5 shows the dis-crete loss-of-offsite power frequency and duration curves corresponding to the groups identified in Table A.6. l LOSS OF 0FFSITE POWER DUE TO SEVERE WEATHER Severe weather conditions, such as local or area-wide storms, have caused l losses of offsite power at nuclear power plants. Weather-related causes of offsite power failure have been divided into two groups 1
(1) those for which the weather caused the event but did not affect ) the time to restore power ) 1 (2) those for which the weather initiated the event and created conditions so that power was not or could not have been restored for a long time Group (1) includes lightning and most other weather events that do not cause severe or extensive physical damage at or near the site. They can cause a loss of offsite power, but their severity does not contribute in any significant way to long duration losses of offsite power. These types of weather-related off-site power outages are usually considered in the plant-centered or, possibly, the grid category. Group (2) includes losses of offsite power that result from major storms, hurricanes, high winds, accumulations of snow and ice, and torna-does. The expected frequency of loss of offsite power of this group is rela-tively small; on the other hand, for this group the likelihood of restoring offsite power in a short time is also relatively small. To estimate the likelihood and duration of loss of offsite power as a result of 3 severe weather, it is necessary to (1) identify the set of weather hazards to be considered, (2) determine the likelihood of failure for a given hazard inten-sity, and (3) determine the repair or restoration time for the various failure NUREG-1032 A-19
1 Table A.6 Grid reliability / recovery. Grid reliability (G). j i Grid reliability - group (G) Frequency of grid loss q l G1 - Less than 1 per 60 site years j (0.01/ site year) G2 > 1 per 60 site years and 2 1 per?30 site years ' 4 (0.03/ site year) l I G3 > 1 per 20 site years and
< 1 per 6 site years l T0.1/siteyear)
G4 Greater than or equal to 1 per 6 site years (0.3/ site year) 1 , Recovery (R) Recosery from grid blackout group (R) Recovery capability R1 Plant has capability and procedures to recover offsite (non-emergency) AC power to the site within 1/2 hour following a grid blackout. R2 All other plants not in R1. Grid reliability / recovery (GR) ! Grid reliability / Grid reliability Recovery from grid recovery group (GR) group (G) blackout group (R) GR1 G1 R1 GR2 G2 R1 GR3 G3 R1 GR4 G4 R1 GR5 G1 R2 GR6 G2 R2 : GR7 G3 R2 l { l I J 3 NUREG-1032 A-20
] l
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ .)
e i 1 i
\
l I
"' 8 I I l l l
l Note: Grid Reliability / 1 0.05 - Recovery Groups GR 1 - GR 7 - ) Are Defined in Table A.6 l l I G.R 4 j GR3 GR7 0.04 - ll 3 E 5
!b 0.03 -
o z w 3 o w a: 6 0.02 - GR6 _ 1 l GR2 l 0.01 - GR5 - 1 GR1 0.00 l l
; O.1 0.3 1.0 3.0 10.0 DURATION (Hours)
_,,g;,g -, ; . - _ - , -
. 37., - - - -:
e 4~
'?:
W. ll . ~~ '. ., l ., ~ . 's ;:g. . .
' Figure A.S . Estimated frequency.bf'accurrence b'f grid-related losses , - .le: s ~ *'f;%ffsitepowedfexc'eedingspeciftlsdidurations o
r - s a,
.n- .m- ~r 3..g g ysq, ,. p*- v
. I. y, r, f
~$ ?%,* . - N ..'- y?.:kjiY
'f'?*pf&I '
, .: . . r, .
' :x, :Tfjd;hA 21k h ,_ O '.
. - p ,.>.g - 'k'w!!..+
AU ?' " 03
" sith .cr A,. <
( v.~
,' p y NUREG-1.g,2./,
.8 o ';4:p
- - . u
. y.#.'c"f.%
. ,, .,5 ,
* ';' 4, :Je \.;?.*
q i l l _j
l l i l modes associated with severe weather-related power losses. Although utilities { and regional power pools normally keep extensive data on transmission line, l terminal, and customer outages from all causes, including weather, little infor- ! mation has been obtainable that can be used to derive the likelihood of loss of all offsite power at nuclear plants or for similarly designed incoming trans-i mission lines and switchyards at non-nuclear plants. In light of this limita- { l tion, the objective of this study was to derive some general frequency and duration characteristics that could be applied to the design and location of nuclear power plant offsite power systems generically or on a case-by-case basis, considering specific susceptibility to the various weather hazards. i The approach taken was to develop a range of loss-of-offsite power frequency j and duration relationships based on weather hazard rate and past operating l experience. First, data for all loss-of-offsite power events involving both ) partial or total failures were reviewed. Weather-related total loss-of- ! { offsite power events and significant partial loss-of-offsite power events, such as those causing the complete loss of power to or from a switchyard, were included. These data are provided in Table A.7. Here'again, as with grid l reliability experience, this data base is too small to be used to derive plant location and design-dependent conclusions regarding the expected frequency of loss of offsite power as a result of severe weather. Normally, regression analyses would be used to correlate failure rate, design factors, and weather hazards. However, the losses of offsite power are so rare i that the available data are too limited to take such an approach. The method taken to correlate loss-of-offsite power frequency to weather hazards is b E nd ci:.plified appr:2:5 ei ilar te that t2er t carrelate tran e!Sefen lia; and his. .el ugs ua i.a vu w ;ur; e t: '!:ri cu: type; ;f .;;;ther (L:2b :t 21. , la ,. It M: _;;r ;;;u :d that the frequency of loss of offsite power as a result of severe weather events is proportional to the weather hazard rates at a site. The weather hazard rate is a measure of the frequency of conditions that have the potential to cause loss of offsite power. The following weather hazard rate indicators were selected: NUREG-1032 A-22 I
r
. Tc .'d s., As . l Te+o.\ t_estes.e}cKee h e<
.Ae w c. wa.4 (.w,0 w o uo, _.9 Fovk th . 's/ f u m of /n l 91 \.77 ScM / T c.e. j W orlioI,, 2. c. i s -/ne vis v <- c e y, der o / sz / cc S.oo . n, y,A M s\\:\oc e or/1c,f i c s.co - hed q <w ,
M, \\ cb e em /2, [ tr r.ro o t/ oel, z ?.9 e w s~e q/ n e V\a<a 7c a M u te c.:. e 7eou i t4cc)o< oKtN wow- T t.: , ; 02/01) to s.nu /s cc. c.c. . to e<. e2.Ie4l,e s- / sce. Vi \ oy s . .v s o / n. l n. g gu. um
- A~c. d ~w N &
o /:' " l 6 *t ! bACmdo<e w a e o.o . ee/eIs+ u. jJee. e /u i,'d A%.co : Ca uc w u, om, eziu.j,r- To r,40
% k ou to 1. @r 'wra Ort e4/et/ro To < vsado T%, w., Fevvq os j oz /,4 Torrado i
e . .._ . I J eums,a e, -w e6 #
- e, _ e.ust ee y . .my.eem..s q . em.Jesh
.m,e enom m. egg..
"N6 9 4 _e eri a+mgh.e4 ea w gi w.a.m .
+we..,e .,em4 -O.,, - e aw p.ee. mh ,-h
=*Mean--<er .M e gmg e e we4e eemp.e-e.-
- 4 ens e m$
4**
(1) snow / ice: inches of snowfall per year (2) tornado: frequency of tornadoes per square mile per year (3) hurricane and wind: frequency of storms per year with wind speeds exceed-ing approximately 75 mph These factors are called indicators because no mechanistic cause and effect analysis has been performed. Rather, it has been observed that losses of off-site power have occurred when these types of weather conditions were present. Storms are classified as hurricanes when wind speeds reach 75 mph. The fre-quency of this wind speed was used as a correlation point to determine the variability of hurricanes and high wind hazards at various locations (sites). 2^NSEW (p By dividing the number of losses of offsite power which have occurred by the cumulative historical weather hazards for each weather type at nuclear power plant sites, an offsite power failure proportionality factor for each weather type was derived. This process can be represented as follows: N P i
$=E ji where P4 = the proportionality factor for weather type "i" N9 = the observed number of offsite power losses as a result of weather type "i" H
ji = the cumulative weather hazard factor for weather type "i" atsite"j" l H)$ = h3j at j where h34 = the weather hazard rate for type "i" weather at site "j" NUREG-1032 A-24 {
\
l t _ _ 1
i INSecr D . j 1 SfCcia0 Su for >p x)Q $ hh'e!l' 'kCcl! hv-af 6fcm,e abcto/ 8 aa,J wi<d &cs<s/6 sencoact s< phnh ; bge 4xt< <c d sa/t'sr. & =vyrovlc f)itYsf&c. er-d i in respu X .cyrt em.t Nt l b not A h rian d e s uk Ag/ ands assocMf w<Yd s/0 cms a: J Nrnwas i eaa s set A d s, s w;/d - J a ud s w hiili / h r resu f Vsrci,>ca,f/kNby el //a saW ud.
/ 4
- = * * - * - p.weg. -..m. m 4 i
A t e_ - - -
- e. .,w- --m - - . - - .
At j = the cumulative site years since commercial operation began at site "j"' The expectation frequency of loss of offsite power can then be computed by Sjj = P4 h), where S jj is the estimated frequency of loss of offsite power at site "j" for weather type "i", and Pj and h jj are defined as before. On the basis of data from Table A.7 and cumulative weather hazards for U.S. nuclear ' plant sites through 1983, the following weather-induced failure proportionality factors were derived: i P3f1 =. 4. 5x/(V/ inches of snowfall PH/W *' I' M # PT* f2* 6
% = 0. 713 pnd SS= sd where subscripts S/I = snow / ice, H/W = hurricanes / wind, W T = tornadoes. The weather hazard factors for each site were derived from National Weather Service data (NUREG/CR-2639, -2890; Vigansky, 1980; National Oceanic and Atmospheric Administration, 1980) where available. If data for a particular weather type )
at a site were not available, the operating experience for that site was not included in the estimates. Normally this type of correlation would be supported by a statistical validity l test. As pointed out previously, because there have only been a few weather-related losses of offsite power at nuclear plants, the statistical validity could not be ascertained. However, as a test of the reasonableness of this formulation, a plot of cumulative weather hazard factor for each site (Hj ) versus total cumulative weather hazard factor tabulated for all applicable nuclear plant sites (IH ) jwas made, and the severe weather-related operating experience for both total and major partial loss of offsite power events was identified. A comparison was also made of the number of sites falling within subdivisions of the range of cumulative weather hazard factors. This informa-tion is provided in Figure A.6, where the number of losses of offsite power NUREG-1032 A-25 .
SNOW / ICE
- ~
20 10,M 43 1P _ 15 - - 7,500 H e e 10 - - 5,000 y 0 5 1P 1 - E a Z 5 - 2,500
""]
--- 1 RM-0 -----
0 2 10' 10 10 8 Hs HURRICANE / WIND > 75 mph TORNADOES 20 20 20 0.100 1T 2P
- -a 1T
- 15 -
H 15 - 15 - - 0.075
-_a b
H N
""" : g g -
- e
- 10 -
10 y ,g 10 - - 0.050 7
- a W I
~
o o
~
w , ma mm am
.I $ -
E E a a 3 5 - 2 5 5 - - 0.025 l _ . . - - _ --g
- -m - s 0--- 0 0 L ---- _ .___ o,000 1
0.1 1.0 10 d 10 3 10 2 Hg HT
~
l Figure A.6 Weather'hazar d expectation histograms NUREG-1032 A-26 E___________--------- - - - J
followed by a "T" represent total losses of offsite power and those followed by a "P" represent major partial losses of offsite power. Because frequency of loss of offsite power as a result of weather has been assumed to be proportional to the magnitude of weather hazards, the occurrence of weather-related losses of offsite power should favor the sites with the highest cumulative weather hazard. In general it does. The events identified in Table A.7 are typified by durations of several hours. The failures are somewhat localized, able to be isolated, or repairable with modest effort. Design factors such as transmission line right-of-way separation, structural strength of transmission and switchyard components, insulation from effects of adverse environments, and operational factors related to repair capa-bility or use of alternate, available power sources will impact' the likelihood and duration of loss-of-offsite power events of this type. Events of this type will be referred to as severe weather events throughout this appendix. None of the events identified in Table A.7 involved tornado or hurricane /high wind conditions that severely damaged structural elements of a_11, transmission and/or switchyard components of sources of offsite power to the plant. Although such an occurrence is rarely expected, many hours or days could be required to repair and restore offsite power. The frequency of these more extreme weather-related power losses can be esti-mated by determining the frequency of weather conditions that are severe enough to damage all offsite power sources. The same design factors noted above for the more repairable loss of offsite power events will determine the suscepti-i bility, and thus frequency, or hazard rate, of weather conditions that could i result in area-wide transmission and/or switchyard failures. Based on the National Electric Safety Code, power plant transmission systems should be designed for wind speeds on the order of 125 mph. High wind speeds could cause extensive power transmission losses, although this will vary, depending on the specific design. Another potential hazard, tornado (es), must strike all rights- j of-way or switchyards with sufficient intensity to damage the minimum number of components required to supply offsite power in order to cause a long duration loss of offsite power. The probability of equipment failure given the occur-rence of these extreme weather conditions is assumed to be unity, or nearly so; NUREG-1032 A-27
i thus the likelihood of loss of offsite power can be approximated by the fre-quency of occurrence of the extreme weather condition. The fr'equencies of the extreme hurricane (known as great hurricanes) and high winds are available from National Weather Service data. To estimate the frequency of single or multiple tornado strikes damaging all transmission lines or switchyards requires modeling of the offsite power trans-mission line geometry (Anders, Dandeno, and Neudorf, 1984; Teles, Anderson and Landgren, 1980) and using site / area deta for tornado frequency, intensity, and direction. This type of mechanistic, probabilistic analysis was not performed as part of this work. A simpler i .-f ,; in : :f approach was used. z The j tornado-related loss of offsite power frequency for a single rignt of-way der,ived previously,was used. However, using this approach, for some sites, requency{ of tornado-caused losses of offsite power could be overestimated,by an order of ! magnitude or more e thetornadofrequencyislow,asit'Iatmostsites, f h this estimate will not make a "ceable differenc
'the computation of total loss-of-offsite power frequency. For relatively high tornado frequency locations, the results may be mor ropriatel ^
ated as a high, rather than a best, estimate. For pp po es of this work, the low es ' ted frequency of
/ tornado-caused offsite power was taken as " negligible mpared to the hi stimate. This lower estimate would be indicative of sites w1 ransf
. a ssion line rights-of-way spreadino out in directionLobtuse to each other. ,
Events of the types discussed in the preceding two paragraphs are referred to as extreme weather events throughout this appendix. Although the frequency of these extremely severe weather events could be as high as 0.01 per site year, it will more typically be less than 0.001 per site year. The time necessary to restore a source of offsite power for weather-related failures will depend on the severity of damage caused by the event. Major structural damage can typically require 8 to 24 hours or longer for repair. Data obtained from the Mid-America Interpool Network (MAIN) and the Mid-Continental Area Power Pool (MAPP) (MAIN, 1983; MAPP, 1983) indicate that it takes on the order of 8 to 12 hours to restore transmission or terminal point outages that resulted from severe weather. For this study, nuclear power plant outage time data for losses of offsite power that resulted from severe weather NUREG-1032 A-28 l
r,...- - - - . - . . ..-. . ,.
., . ... - .se o.e.=*=+ .. .. . . .. .. _.
g g3 6sh
*6 G segwS <>dsn w ssp L drky A . . aw M .
~m.._ odt .
. . amu-.Us_.sur was nhw.
_. .k '.Xa.. e Ww T }cu,.. 6 sni k .en.. odo
. . _ lae <- ach e./ .a at J A _.
is & L uz irY A cd s6 k s;h ;) J. 6 .....- of n6 c~2d_ ad d' /rsnt w & .... -
- Le4 -
Ah-
& z; % s s & E <-. o f d e add 4e~
ir < KGcd Ahe.. n]u.k ar h%~tAS&k
- suw i<dLesp/a,5s xsa A am n& Lu A<nc
&/>dKyan 1
n n =< > d !
~L_ XT9lns asL&uut pu ucz 6)La&u_T_ nn a q
-&nens.
p,- p&tJ> /4 ovaaf
.- ._ sfr&c lsa 4xn . -
' add-pr_ wad cp A dwadawL.
d~4 Sh...
. ,4dfg_ndea - ___
uT4hu o?' e651af l 4,s s4 us e enama&tasnaa_ &- t-
/n ( L d A s A y 64W .- wd y a,d -
md m L ass a r t e : d
~
. - . l
, ._. 4 . . . . .
were used to estimate restoration likelihood for the less-than-catastrophically-damaging weather events. Data for total loss-of-offsite power events were fitted to a two parameter Weibull distribution ar.d used to generate the restoration likelihood curve shown in Figure A.7. Also shown in Figure A.7 is an " enhanced" recovery curve that can be used to differentiate plants with practicable power restoration procedures for these weather types. The applicability of enhanced recovery would depend on the capability and procedures to restore power within about 2 hours for a given weather hazard. An estimate of the total severe weather-related frequency of loss of offsite power was derived by summing the values for each weather hazard type at all nuclear plant sites. Plant-specific design or procedural details can affect the estimated frequency of. weather-related losses of offsite power. Therefore, l an attempt was made to derive the range of possibilities rather than to provide site-specific estimates. It should be noted, however, that, because of a lack of data, not all weather hazards could be accounted for at every site. Moreover, some weather data extrapolations were necessary when data from weather stations near a site were not available. The frequency range' derived was large, and determining where a particular site / design combination would fall in that range requires evaluation of the site-specific details identified previously. For the purpose of this work, the range was subdivided into groups with approximately a factor of 3 difference in median frequency. The subranges so derived are provided in Table A.8. This partitioning allowed generic evaluation of the effects of severe weather hazard on loss-of-offsite power frequency while at the same time providing perspective on the potential for plant-specific differ-ences. Figure A.8 shows the severe weather frequency and duration combinations corresponding to the groups defined in Table A.8. For losses of offsite power caused by extremely severe weather such as great hurricanes, very high winds (greater than 125 mph), and major damage from tor-nadoes, restoration of offsite power was not assumed to occur before 24 hours after the start of the outage. The frequency breakdowns, derived in a manner similar to that for severe weather, are provided in Table A.9. Again it must be ! noted that a site-specific assessment of the susceptibility to these weather hazards must be performed to determine the site-specific expectation frequency. NUREG-1032 A-29 j
. l _ !l1l!j
?{!!! 1 ' [ '!!' j 'i ! , l :1I ,
'iil!
0 0 1 r _ e _
' w o
' p
' e t
i la s e f cm , f n ro ' o e dN \ f i f noyr k o of e Csv r x ' s t io \ e s y %mc 0i e \ s r 9LR \ o a e l t a v o g d D c 0 e _ e ' 1 R A ' c l
\ ' u a d m \ ' n r i o '
) -
N \ s r _
\ A ' r u e
\ A
\ s, h o h t
g s' g ( a N e
\ \ ,' ' O I
w
\ sN g N T A
e r _ R e
\ \ %
' U D
v e
\ k N s
\ \ r o
s \ \ f
\ y
\
\ k '
0 1 t
\ i
\ \ ' l i
\ \ '
b a
\ g
\ '
b o g
\ \
dy er ce r p
\ nv ao n
\ \g hc ne i o
\ \'
ER ' t a
\ %
r o
\ \ ' t s
e
\ g' s R A S s 7 1
- - '- - - - - - - - 0 A 0 9 8 7 6 5 4 3 2 1 0 e 1 O 0 0 0 0 0 0 0 0 r u
eyo rues gE oN3h8E g yI$ i F
._ En9EM y8 ll Ili' l(il
Table A.8 Severe-weather-induced loss-of offsite power frequency / recovery Severe-weather-induced loss of-offsite power frequency (S) Frequency of severe weather-induced Frequency group (S) loss of offsite power
----Less thari T7er 350 site years (0.002/ site year)
S2 r 350 site years and _< 1 per 120 site years h . ite year) . t Greater than or e to 1 per 120 {
.- -_. - site -yea @015/-sit - ._ . . . _ _ . -
Recovery (R) Recovery from severe-weather-induced loss-of-offsite power groups (R) Recovery capability R1 Plant has capability and procedures to recover offsite (non-emergency) AC power to the site within 2 hours following a severe-weather-induced loss of offsite power. R2 All other plants not in R1 Severe-weather-induced loss-of-offsite power frequency / recovery (SR) Severe-weather-induced loss-of-offsite power frequency / recovery group (SR) Frequency group (S) Recovery group (R) SR1 S1 R1 SR2 52 R1 SR3 S3 R1
' SR4 S% Rf SR5 ST6 R/
bb $ $ SAP S3 41 i sri S4 R1 SRoo sg gt i 6j lek inn I pr 3 b3 sits (m2T , XJ33 4 y/00 sik ews gews (,x> s) i
, st f S3 bo 4 Yn SMf## I'02) fg3 % Yto (<QA Sif SS y - ys sde f c. M sdeyes i..
I NUREG-1032 A-31 _____--m-_--__--_-_----------_-- - - _ _ _ - - - - - - - - - - _
_z_.____________.__ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ l
. /
r. I
. . l; 0.020 1 ,
- i 698 LRC I $p St.g ,
~
SE'O l 513 1 I ' - - - - - ) -m - O.015
\
! e I,
> \
6
. k $
E 0.010 b i\
. 5 p
1 J S , E
\ f 0.005 .
J SQ ' N. . S.h I 0.000 5
% 4
' =
10.0
\ -
0.3 1.0 3.0 4,0 0.1 DURATION (Hours! Figure A.8 Estimated frequency of occurrence of severe-storm-induced losses of offsite power exceeding specified durations i i i NUREG-1032 A-32 A
Table A.9 Extremely severe-weather-indaced loss-of-offsite power frequency Extremely severe-weather-induced Frequency groups (SS) loss-of-offsite power frequency S$1 Less than 1 per 3lp5 site years (0.0002/ site year) SS2 11per3hsiteyearsand
< 1 per 1800 site years (0.0005/ site year) 553 1 1 per 1800 site years and
< 1 per 35 site years ,
(0.0y/siteyear) 554 > 1 per 38 site years and
< 1 per let site years (0.005/ site year) 555 '
Greater than or equal to_1 per 180 siteyears(0.0g/siteyear) 1 l i
, 9 i
r NUREG-1032 A-33 l
GENERIC LOSS-OF-0FFSITE-POWER CORRELATIONS Combinations of design, grid, and weather factors derived in the previous sec-tions provide a wide spectrum of possibilities for loss-of-offsite power fre-quency and duration. Each of these factors was subdivided to account for known or hypothetical but reasonable differences in frequency and duration; typically, a factor of 2 to 5 difference was maintained for these subdivisions. The intent was to develop a discrete set of frequency and duration groups that could account for actual and potential differences in both design and location (grid and weath-er) for the spectrum of nuclear power plant sites. The frequency of losses of offsite power lasting duration "t" or longer can be estimated by appropriate l combination of the correlations that were developed in this appendix and can be represented by ,the following equation: LOP (t) = Ij (t) + GRj (t) + SRk(t) + SS) A l where I 9(t) = the plant-centered loss of offsite power frequency correlation defined in Table A.3 and Figure A.2, corrected to initial frequency of 0.04 per site year GR j (t) = the grid related loss-of-offsite power frequency correlation defined in Table A.6 and Figure A.5 l SRk (t) = the severe weather-related loss-of-offsite power frequency correlation defined in Table A.8 and Figure A 8 SS) = the extremely severe-weather-related loss-of-offsite power frequency defined in Table A.9 l The identification of the I factor g is the most straightforward because it is l based on configuration. As a first cut, the appropriate GR) factor can be identifie nuclear sites in the U.S. into two categories: (1) FPL g or otferoxi / : sites,3GR7,ab 1 other sites representing average frequency expection of NUREG-1032 A-34 l
a,tpecmiGN( 1
~
grid failure,4GR1orGf# The SR k and SS) factors are not so easily identified because both design specifics and hazard rate must be determined. It is possi-ble, however, to bracket these factors with a range that can be used to judge importance of station blackout considerations using hazard rates and proportion-ality factors for severe weather, and using the upper range of the estimated failure rate for extreme weather hazards. l A test of the loss-of-offsite power correlations that were developed was made by comparison with plant-specific results from published probabilistic risk assessments (PRAs). Figures A.9 through A.13 provide these comparisons. With f the exception of the Zion PRA and Indian Point PRAs, giving credit for nearby gas turbine generators, the results show reasonable agreement. The cross-hatched areas represent the high and low estimate for extreme-weather-related losses of offsite power, except for Indian Point where site historic grid fail-ure frequency and generic estimates were used to develop the ranges. The dif-ferences with the Zion PRA results could stem from one of several possibilities: design and procedural factors are more reliable than assumed in the comparison; the Zion PRA results are optimistic; or the models and correlations derived for generic analyses have limitations when applied to some plant-specific cases. The difference with the Indian Point PRA results can be attributed to the high availability associated with nearby gas turbine generators. The utility has placed special emphasis--including technical specifications--to maintain these alternate power supplies in a high reliability state. Because of these consider-ations, a generic analysis must be used with caution in plant-specific appli-cations. However, the generic models can usually provide good " ball park" results for generic applications and perspectives. Clearly the more details available and included in the models regarding design, procedures, alternate power sources, and protection provided from severe ueather conditions, the more likely that the generic results will closely equate to plant-specific results. The development of a more limited number of generic loss-of-offsite power fre-quency and duration relationships that could be used for regulatory analysis involved the clustering of the site / design factors to determine if combinations of these factor could be grouped into a more limited, but still representative, set. A set of cluster grc,ups was derived from the set of site / design / possibilities using the Fastclus procedure of the SAS package (SAS Institute, NUREG-1032 A-35 l _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ . _ . _ . _ . _ _ ._ _ ._.___)
1 1 1
\
4f 1 i i 0.10 l i 0.08 - Without use of nearby gas-turbine generators O m
$ Indian Point PRA (means) g 0.06 c.
5 k Indian Point PRA (medians) E \ Model Range E k O.04 -- N N N
\
s
'*n k
, s
~
With use of 't g nearby gas. turbine generators , , w**%,N g Indian (means) ii., ' ' Point PRA (medians) Model Range 0.00 - ' ' - 1.0 2.0 4.0 8.0 16.0 DUR ATION (Hours) Figure A.9 Estimated frequency of losses of offsite power exceeding specified durations for Indian Point 1 i NUREG-1032 A-36
'1 eA yvw d 10 <t .
i l 0.06 l 1 1 t 0.04 - b 5 3 **
' b Model Range f % %'*% I 0.02 - N g '%,
I yZion PRA
,'N,~..'N f Zion PRA (means) '%,'Ns%g*% .
(medians).. t l 0.5 1.0 2.0 4.0 8.0 16.0 i OURATION (Hoursi
! )
I i I i i I Figure A.10 Estimated frequency of losses of offsite power exceeding specified durations for Zion NUREG-1032 A-37
- - - - - - - - - _ - - - - " - - - - - - - - - - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ^ - - - - . . - . . - - . _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
i i
)
g[ t 0.06 ; e
- 0.04 -
f 5 i s
; Shoreham PRA ,
0.02 i;
, , Model Range t
0.00 i f f 1.0 2.0 4.0 8.0 16.0 l DURATION (Hours) f l 1 Figure A.11 Estimated frequency of losses of offsite po_wer exceeding specified durations for Shoreham l NUREG-1032 A-38 l- .
L l- [ 0.05 0.04 - O e
$ 0.03 -
E I z Millstone 3 E 0.02 - h
%g 4*s 0.01 -
*,'4,
\
g~,,
\
==,,, f',=, ,
, 0.00 ' ' '
' 1.0 2.0 4.0 8.0 16.0 g
DURATION (Hours)
, Figure A.12 Estimated frequency of losses of offsite power exceeding specified durations for Millstone 3 1
4 i i NUREG-1032 A-39
( \ . 1 l' i
.L l
0 {E ) l l 1 0.04 l 1 I i ( 0.03 - pLimerick PRA I S
$ g>>%
s
' I 4 i
5 0.02 3g n U 4 h b 4 ig h h 3 8 4 gl Model Range E % *n,',, i , i 0.01 - N*4,4,* I I l ,**=,*=,* I *=, t, t l b!l 5"=.,,,,,
\qI==,
I e i ,
'=)
t 0.00
- 1.0 2.0 4.0 8.0 16.0 f DURATION (Hours) l !
l Figure A.13 Estimated frequency of losses of offsite power exceeding specified durations for Limerick i s
- \
^ NUREG-1032 A-40 t --
~~~ --
1979). To limit the number of cluster group , the clustering had to be based j on loss of offsite power durations of # to air hours. Figure A.14 provides a plot of the cluster groups derived from this analysis, and Table A.10 identifies s the fact;rs thm. m e. . L ir, ;;;h ;1_:t:r 7 ap. Grid reliability groups were GRG limitedto{_,i 6 {* GR%2, ar.mfrg,to
,3 generate the clusters. TableA.ilidec..lfies[ombi-F nations of each of the four factors (GR, I, SR, and SS) included Titfie nine
. cluster groups. For example, a plant with GR1, 11, SR1 and SS2 would be in ~
1 clustergroupI[ Because design, grid, and weather all play a role in the frequency and duration relationship for each cluster, it is difficult to generalize about the dominant factors affecting loss of offsite power. It is possible to say that the higher frequency at longer duration groups (clusters) are most heavily influenced by weather hazard susceptibility. fit 3;ci;0 re c t c"21: te pecu!ste that pcrhaps' ino + v-n nuuiear pionciiis se uvmuiraticr of cite, lec h n i * - @ fc M g d hhia a d . i t if The highest frequency and duration correlation developed in this study (e h cluster 7).js dn h j dt acacche 6 OkaWd avd Sucayh4llif (akcif 7f go sfnu af Gusb(s s. REFERENCES Anders, G. J., P. L. Dandeno, and E. E. Neudorf, " Computation of Frequency of Right-of-Way Losses Due to Tornadoes," Paper 84WM0402, IEEE Winter Power Meeting, Dallas, Texas, January 1984. Lauby, M. G. , et al. , " Effects of Pooling Weather Associated MAPP Bulk Transmis-sion Outage Data on Calculated Forced Outage Rates," Paper 84WM0410, presented at IEEE Winter Power Meeting, Dallas, Texas, January 1984. ; 1 . MAIN Transmission Outage Task Force, " Summary of MAIN Transmission Line Perfor-mance for the Year 1982, 345 KV and 765 KV," September 1983. MAPP Transmission Reliability Task Force, "Mid-Continent Area Power Pool Bulk Transmission System Outage Report (January 1977 - December 1982)," July 1983. National Oceanic and Atmospheric Administration, Comparative Climatic Data for the United States through 1980, 1980. NUREG-1032 A-41 )
)
1
- - - - - - - - - - - - - - - - - - _ - - --- - J
y j
'a
" T N 01 t) to 1
e x o a 3 4 4 0 p.(/) D% y f .7 .
+ -
e Zp / ./l / Ww I I l* l l - DD I.l
~
OJ / // / WD ll ! .. o." T l l k2 / /l/ / :
;i i j c'
;l j 0O \.L.
I l
! r- -
(/) / / / : 0 .' OZ 1
? l -
K~ JO / / / '
/ :
oF y <C /
/
/
/
/
/
/
t Tc: ' pZ I/ / ! 4D /l ,1 l -c. y 2Q l I l .l
. ) ..e s . . . .. . . e -
c8
< l-(/)
-Q g
/
wZ #g' 4s....
... " ....-/./
]n <( . c, ,
G
- i: : : ini: : : : : :,:: .: : ; ::::: : : ; ;
' r, t e -
N 8- 8 q (8V3A-311S 83d) ADN30038J 021VNIS3 A-*
Table A.10 Identification of grid (GR), offsite power system design (I), severe weather (SR), nd extremely severe weather (SS) factors included in ' cluster groups Y GR SR SS
/. /, .7, 5 I, S, S,7 /0 /-G Z. 41,3 /;3, 5, 7 /-- 9 5 42 3 i / i3, Si 7 Sfj /-Y.
2 63,47 8 9 3 44 67 $ ^ h 9'
- 3. Sem< as 7 senic as % <. s :
Clos 4<q cluslee y e/usie r auf S not S wu/ 5 4'. /, .2. /, 3, S . G I,k3 61 lb S i 4 f. - V
$2 /< % 5 d37i/ BYi
/, 2 li !< S li G Y '
3 I, 3, S $2, /,, 7 /-1/ 3 /, 3< 5 Si f /, 2 3 l ),5 i 3 3, Y 3 /S //
/f 5 /-p'
- 6. /,1 /,3,5 I,2, 4, 7 ti 1.-
I
/,1 ./,9,5. /, f, 3
-,1 / - 1, h S - 3 $L 1
1 i A-43
l Power Authority of the State of New York and Consolidated Edison Company of New York (PASNY), " Indian Point Probabilistic Safety Study," 1982. SAS Institute, Inc., "SAS Users Guide 1979 Edition," 1979. Teles, J. E., S. W. Anderson, and G. L. Landgren, " Tornadoes and Transmission Reliability Planning," in Proc. American Power Conference, Vol. 42, 1980. U.S. Nuclear Regulatory Commission Generic Letter 81-04, " Emergency Procedures and Training for Station Blackout Events," February 25, 1981.
-- , NUREG/CR-2434, H. F. Monty, R. J. Beckman, C. R. McIntear, " FRAC (Failure Rate Analysis Code): A Computer Program for Analysis of Variance of Failure Rates," March 1982.
-- , NUREG/CR-2639, M. J. Changery, " Historical Extreme Winds of the United States - Atlantic and Gulf of Mexico Coastlines," May 1982.
-- , NUREG/CR-2890,' M. J. Changery, " Historical Extreme Winds of the United
. States - Great Lakes and Adjacent Regions," August 1982.
-- , NUREG/CR-3992, R. E. Battle, " Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants," February 1985.
Vigansky, H. W., " General Summary of Tornadoes, 1980," in Climatological Data, National Summary, National Oceanic and Atmospheric Administration, Vol. 31, No. 13, 1980. Wyckoff, H. , " Losses of Offsite Power at U.S. Nuclear Power Plants All Years Through 1983," NSAC/80, Electric Power Research Institute, May 1984. i Delcte A- n dev 4-47 NUREG-1032 A-48 ,
. z
-I
' APPENDIX B EMERGENCY AC POWER RELIABILITY AND
-1 STATION BLACK 0UT FREQUENCY:
MODELING AND ANALYSIS RESULTS
'l l
NUREG-1032 Appendix B l = - - - _ - - _ - _ - _ _ _ - _ _ _ _ _ _ - _ - _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ - - _ _ _ - _ _ _ _ _ - _ _ _ _
TABLE OF CONTENTS P_ age ELEMENTS OF EMERGENCY AC POWER RELIABILITY MODEL ....................... B-1 COMMON CAUSE FAILURE OF THE EMERGENCY AC POWER SYSTEM .................. B-6 EMERGENCY AC POWER RELIABILITY EVALUATION .............................. B-10 STATION BLACK 0UT FREQUENCY ............................................. B-19 REFERENCES ............. .. ............................................ B-27 i LIST OF FIGURES B.1 Emergency AC power unavailability as a function of individual EDG reliability and common cause failure to start for three emergency AC configurations ....................................... B-14 B.2 Emergency AC power unavailability as a function of loss-of-offsite power duration and four station blackout durations ........ B-15 B.3 Emergency AC power unavailability as a function of individual EDG reliability and comon cause failure to start .................. B-16 0.4 Emergency AC power unavailability as a function of individual diesel generator running reliability .............................. B-17 B.5 Emergency AC power unavailability as a function of repair time for independent diesel generator faults ........................... B-18 B.6 Estimated range of emergency AC power system reliability for different diesel generator configurations ......................... B-20 B.7 Estimated station blackout frequenc as a function of blackout duration .................y................................ B-23 f B.8 Estimated station blackout frequency as a function of blackout duration for clusters 2, 4, and 7 (for 1/2 EDG configuration) ..... B-24 l ; B.9 Estimated range of station blackout frequency as a function of ! blackout duration for four offsite power clusters ........_......... B-25 8.10 Sensitivity of estimated station blackout frequency to diesel 1 generator failure-to-start and failure-to-run values .............. B-26 LIST OF TABLES B.1 Areas of potential common cause failure . . . . . . . . . . . . . . B-7 B.2 Emergency diesel generator common cause failures ......... B-8 B.3 Common cause failure rate parameter estimates . . . . . . . . . . . B-11 NUREG-1032 B-iii !
I
'f 1
L l APPENDIX B-EMERGENCY AC POWER RELIABILITY AND : STATION BLACK 0UT FREQUENCY: MODELING AND ANLYSIS RESULTS l In this appendix, the details and results of emergency AC power system relia-bility analyses and station blackout frequency / duration estimates are provided. The models and analysis-results were developed to confirm and' extend the find-ings of a previous study (NUREG/CR-2989) and to be used in regulatory analyses. Modeling has been done a't a generic level, but it could be made plant-specific by adjusting failure rate parameters to reflect site location, system design, and operational factors. The term generic, as used here, is meant to imply that the insights derived are generally applicable to a large number of plants. Modeling and component failure rate variations are used to account for plant differences in design and operational features that are most important to'sys-tem reliability. Sensitivity analyses were used to explore the effect of design and operational differences on system reliability for a realistic spectrum of differences. ELEMENTS OF EMERGENCY AC POWER RELIABILITY MODEL The diesel generators--including all the subsystems and the auxiliary systems required to start, load, and run the diesels--are the components that have the highest impact on system reliability. Specifically the following have been identified as the largest contributors to AC power system availability: l (1) diesel generator configuration ' 4 (2) reliability of each diesel generator j
)
(3) vulnerability to common cause failure NUREG-1032 B-1 i i l
(4) support / auxiliary system dependence i In general, the details of the emergency AC power distribution system design from the Class 1E engineered safety feature buses to the safety system compo-nents using emergency AC power have not been found to be important contributors to system unreliability. With this in mind, emergency diesel generators, DC power supplies, and service water cooling systems were the. principal system elements included in the emergency AC power reliability models. A relatively high level (super component) modeling approach was used that could account for major differences in equipment configuration and support system dependencies while using support system reliability estimates developed in other studies. Three generic emergency AC power system designs were selected as roughly repre- l senting the spectrum of operating nuclear plant systems. These systems are de-scribed by the number of diesel generators in the system and the number required to maintain core cooling during a loss of offsite power. These generic systems have been designated 2/3, 1/2, and 1/3, indicating the number of diesel genera- < tors required per number available. Some other configurations do exist, but, emergency AC power system reliability is generally encompassed and well charac-terized by the three systems modeled especially if the variability of failure rates of the major components and auxiliary systems is accounted for. Configur-ations with a higher degree of redundancy and/or diversity are the exception, not the rule, in current U.S. designs. The simplified reliability logic models for the generic configurations were developed from fault trees and insights on what factors are important contributors to AC system reliability. The simplified logic models are provided below: SEAC1/2 = 1 - PEAC1/2
= 1 - (PEDG + PCCF2/2)
REAC1/3 = 1 - PEAC1/3 P
= 1 - (PEDG + 3PEDG CCF2/3 + PCCF3/3)
REAC2/3 = 1 - PEAC2/3
= 1 -(3PEDG + 3PCCF2/3 + PCCF3/3 NUREG-1032 B-2 l
Where R EACi/j is the AC power reliability of an "i" out of "j" diesel generator system, and P EACi/j is the probability that "i" out of "j" diesels will fail or be unavailable when required, P is the probability that a single diesel gen-EDG erator will fail or be unavailable when required, and P CCFi/j is the probability that "i" out of "j" diesel generators will fail and be unavailable as a result of common causes when required. A more complete logic model can be developed using Markov modeling techniques (Husseing, 1982) when failure and repair rates are exponentially distributed in time. However, the simplifications inherent to the models used are in keeping with the approach of accounting for dominant factors affecting system reliability. Both random independent component failures and common cause or dependent fail-ures are included in the model. Failure mode considerations included hardware faults and human errors for start and run failures, component repair, and com-ponent out-of-se.vice time for maintenance. The least detailed level of model-ing was at the support systems, which vary considerably in design. These sys-tems have been modeled in detail in several probabilistic risk assessments (PRAs). The reliabilities of the support systems were treated as a super com-ponent or undeveloped event in the logic models with a failure rate indicative of results from other studies (NUREG/CR-3226). Failure to run was treated as a constant failure rate process, and emergency diesel generator repair was treated as a constant repair rate process. With these approximations, the probability that a diesel generator will be unavail-able for I SB hours during a loss of offsite power lasting T LOP is given by PEDG = PgTS e R[ISB
. ro" 'SB% -xg1R e w t+1 g /t R et t -
S / 0 i NUREG-1032 B-3 i (
where TR is the mean repair time and A FTR is the failure-to-run rate. The failure to start probability, PFTS, includes the standby demand failure like-lihood of the emergency diesel generator to start and load, plus the unavail-ability because of scheduled and unscheduled maintenance, and the probability that auxiliary systems will fail or be unavailable (out of service) at the time of the demand. Although the second term of the equation can be integrated easily, the integral is maintained for applications relating to estimating sta- ! tion blackout frequency and duration to follow. The probability of failure to start, load, and run for a time I SB because of common cause failures is developed similarly to that for independent failures. It is given by:
~I PEDGCCF = PCCFTS e
SBfICCFR I ~I
+ r LOP SB A
CCFTR e A CCFTR t ,- (t + I SB I CCFR dt l Jo Here, P CCFTS represents the common cause failure-to-start probability, A CCFTR represents the common cause failure-to-run rate, and T CCFR is the associated repair time constant. For simplicity, the repair rate for auxiliary systems that are required for successful diesel operation has been assumed to be approximately equal to that of the emergency diesel generator. Double component out-of-service conditions limited by technical specification were eliminated from the final expression through inspection. However, the possibility of such outages occurring as a result of human errors or simultaneous failures was treated as a common cause unavailability contributor. Recall that the unreliability of a two diesel generator system was approximated by l PEAC1/2 PEDG + PCCF2/2 NUREG-1032 B-4
_ . . ~ . . _ _ . . . . - _ _ . _ - - where PEDG = F1+F2+F3
.This approximation can be expanded by setting l V Fy=PjTS e SV R I ~I
( LOP SB
'F2=PFTS e S R A FTR e
A FTR t,-(t+I SB I R dt-J0 t r LOP ISB/1 A t I t F3* A FTR e FTR 2 e (t2+ISB R dt2 eAFTR 1.dt y
'O JO with PCCF2/2 = PCCFTS2/2 e
SBf*CCFR FILOP ISB
+ A e
~A CCFTR2/2 t ,-(t + T 33 t CCFR dt CCFTR2/2 J0 and PFTS
- SEDG1 + UEDG1 + PDC 1 + PSW1 PCCFT5
- OCCF2/2 + UCCF 2/2 + PDCCCF + PSWCCF 1
where Q EDG1 is the probability of a diesel generator failing on demand, U FAG 1 is the maintenance unavailability of the diesel generator, P DC1 is the prota-bility of DC power supply failure causing a diesel to fail on demand, and P 391 is the probability of a service water system failure causing a diesel generator i failure on demand. Terms with subscript CCF represent common cause failure I contributions. The term (UEDG1) is not allowed. It is accounted for in the term U CCF2/2 In a similar manner, the correlations for three diesel generator systems requiring l one or two diesels for success can be derived. ~ l l NUREG-1032 B-5 1 I
o COMMON CAUSE FAILURE OF THE EMERGENCY AC POWER SYSTEM There has been a concern for years that the reliability of redundant systems may be limited by single point and common causes of failure resulting in simul-taneous unavailability of two or more trains. Several techniques for modeling l and quantifying the major contributors and their likelihood have been, and con-tinue to be, developed. Some of these techniques are aimed at a qualitative l evaluation of common cause failure potential (Rasmuson, 1982), while others are primarily used to estimate common cause failure likelihood (Fleming and Raabe, 1978). Existing techniques have been used in this study to model and quantify common cause failures on a generic level, with sensitivity analyses used to evaluate realistic variations in common cause failure likelihood and the effect on emergency.AC power reliability. j Emergency diesel generator operating experience for the years 1976 through 1980 was reviewed and documented in NUREG/CR-2989. Other reviews (EPRI, 1982, and Steverson and Atwood, 1981) also show relevant operating experience and analysis of common cause failures of emergency diesel generators. Based on information from these sources and a limited re-review of common cause candidate licensee event reports (LERs), an updated list and classification of multiple emergency diesel generator failures and outages has been prepared. When enough informa-tion exists, the common cause failures can usually be identified as falling into one of four groups: (1) design / hardware, (2) operations / maintenance,' (3) sup-port systems / dependencies, and (4) external environment. A further breakdown of this classification scheme is provided in Table B.1. The list of common cause failure candidates taken from LERs is in Table B.2. In NUREG/CR-2989 these were classified somewhat more generally in two broad categories of hard- , ware and human-error-related failures. These two categories were then classi-fied more specifically into generic and plant-specific design groups and into generic human error or plant procedure-specific human error. Common cause failure rates were estimated in NUREG/CR-2989 using the binomial failure rate (BFR) computer code (Atwood and Smith, 1982). The estimated common cause failure r.ates varied by about an order of magnitude depending on plant design and procedural dependencies. If individual emergency diesel generator NUREG-1032 B-6 ( l
p Table B.1 -Areas of potential common cause failure Common cause Types of-failure group potential failures DESIGN / HARDWARE 4 Mechanical / structural design inadequacy .
~i Subsystems (fuel, cooling, start, actuation)
Environment (normal) OPERATIONS / MAINTENANCE Inadequate procedures-Errors of ommission/ commission Wrong procedure
. DEPENDENCE / SUPPORT SYSTEMS DC control power Service water cooling EDG room HVAC Electrical interface EXTERNAL Fire Flood Severe weather Seismic Other internal environmental extremes 4
NUREG-1032 8-7
~ Table B.2 Emergency' diesel generator (EDG) common cause failures Plant Da t'e 'of LER Description (number event number of-event of.EDGs)
ANO 08/27/79 79-016 Water in lube oil-- 09/11/79 79-017 failed two EDGs two weeks apart. Arnold 05/10/77 77-037 Maintenance caused 05/12/77 77-043 control system failures.on both EDGs within two days. Browns Ferry 05/06/81 81-019 Left bank air start 1, 2 05/06/81 81-020 motors failed to start
-three EDGs.
Browns Ferry 01/03/84 84-001 Clam shell movement 3 on'overchlorination failed ESW coolers and three of four EDGs. Brunswick 01/04/77 77-001 Low lube oil pressure 1, 2 tripped two of four EDGs after starting. Crystal-River 01/04/79 --- Low ambient room 3 temperature (28-F1 failed both EDGs. Dresden 3 10/23/81 81-033 ESW check valve failures caused two of the three EDGs to trip on high temp.
'Farley 1 '09/13/77 77-026 Dirty air start 09/16/77 77-027 circuit failed two EDGs within three days.
Farley 1, 2 09/18/81 81-043 Scored cylinder 09/27/81 81-067 linings failed two EDGs nine days apart. Fitzpatrick 02/07/85 85-003 ESW pump trip failed two EDGs. b 94 !
- --- -__ J
Millstone 2 05/15/77 77-020 Both EDG fuel supply valves found closed. - North Anna 2' 02/18/81 81-020 Batt'eries failed surveillance test, caused both EDGs to be inoperable. North Anna 2 12/09/84 84-013 ~ Damaged cylinders
.and high crankcase.
pressure failed both EDGs, caused unit shut down. Peach Bottom. 06/13/77 77-026 Air-start compressor trip caused'two EDGs to fail while another unavailable. Quad Cities 05/O'1/77
- Improper ESW valve lineup degraded three EDGs, Salem 1 07/30/77 77-059 Fuel rack lubrication leak.and subsequent linkage binding caused failure of two EDG.
I Salem i 10/08/80 80-060 All three EDGs failed to start because of a misaligned service water valve. Operator disabled service water from train 2 while train 1 was down for maintenance. Sequoyah 1. 2 08/09/80 80-140 Operator error caused relay coils to fail on all EDGs. Susquehanna 01/21/85 85-002 Low ambient room temperature failed two EDGs. I l Vermont Yankee 10/22/84 84-022 Failed Zener diodes ! caused all EEGs i to lock out. l HPN-2 07/09/84 84-008 Slip ring and ! bearing design j weakness caused l failure of two EDGs. i 6 ib l
Yankee Rowe 08/02/77 77-042 Sludge plugged cooling water raditor tubes, failed two EDGs,
- Rer>orted in PLG-400.
i
)
1 1 i, l I l , l i 1 l l 6 9c 1 U____-_________-____-.._--___-___.________-____-_________________.__.______. . ..
1 l- . i reliability is maintained at or above industry average levels, common cause failure contributed on the order of one-half the system unavailability for the , less redundant configurations and most of the unavailability for the more redun-dant designs, especially when demand failure rates are low (<0.03). At lower reliability levels, independent diesel generator failures are the major contri-butor to the unavailability of the onsite AC power system. { A technique that has been used to estimate the likelihood of emergency diesel generator common cause failure is the beta factor method (Fleming, 1975) and f its extension known as the multiple Greek letter (MGL) method (Fleming and Kalinows ki,1983). This method was used to estimate common cause failure rates from the updated LER review. Table B.3 provides the MGL parameter estimates and common cause failure rate estimates that were derived by the MGL method. It also compares these estimates with " generic" rates derived in NUREG/CR-2989 using the BFR method. Differences result more from data classification than from analytical method. EMERGENCY AC POWER RELIABILITY EVALVATION The reliability estimates for the generic emergency AC power systems were derived for instantaneous availability on demand and mission reliability. (The latter is the likelihood that emergency AC power will be available for a speci-fied mission length, such as the duration of a loss-of-offsite power event or for the duration of a test.) System reliability analysis parameters were selected to represent the average of the operating reactor population as well as the variations within that population. The population average and ranges l for the system reliability analysis parameters are described below. ! (1) Emergency Diesel Generator Failure To Start , J Based on data reported in NUREG/CR-2989, the failure rate can vary con-siderably from plant to plant. The following failure rates have been identified: 4 NUREG-1032 B-10
Tc.\.3 \ e 1.E Ceuwen cuc. yy\ge
-, cake. 9arowge_\es e_Moskes hcu\W o 3 r;R Ros#5
%L acu\y Sr,m Muggp/cie pg 9sts 2., - ED 6 co0E s'. = .O43
-+ 7///o~ y CCFTg (.7./ 2.') = 8.0 x sO 9ccv ra.(2 /z) =
\. \ x \ o * ~
/ 4R, N/A 3 E D Co c ok3 E Q
=
.OCl3
, T = .Sfl Pcc.v r4 t a.l s) = r.6 x xo ~* 5,4 v/o-V Pcc s-rg ( g/ 3.') = (e.o x so~ * /, Pro-V PccwTa. ( 2l a ) = T.fx so # -
/ A R. N/A Pccn-a. cg 3) = e . c x so-r /Aa 44 ,
4 e.a c, coav p= . \ S '7
'f = .3\3
$= .Too w' s 3- 11 a. -
~ _ - _-
I; TrA3\c 3.5 ( c_m,s60e.O A E D L- ) l' l Pccrv8 (a./4) = G.1y sO'* Pcev r;:' (3/4) = \. 5 x \o * ~ i su c4 m = 4.1 so + 4
.{
~
9cc re y a. (2./+) * % 3 x \o 7cc, r a. (3143 = 2..I x s o ~ # 9ccw ra. (.9 /4) = L,,4~xso # -
,, E CCF (2/2) "
pQ Pccv(2133 = (\- Y) (S Q '
.L Pccv (313') =
TpQ w e a ,43 = (s-n so ' l 3
'Pccv (3/4) = O - 5 ) T (3 '
Q 3
?ccv (4/A)
- b'6pQ B-n h
Tob\e. 1.3 (cew60c1) EDL, % t_o R c x. (sR% -\%2C) EDG Co O F FT5 FTR E E9S 76 3 \3\ 4\ 9 soo \A e h4-B-lle
)
i-J Probability of failure / demand 1 i i Average 0.02 i High= 0.08 Low 0.005 (2) Emeroency Diesel Generator Failure To Run l constant f e rate o .0024 er hour was e timated i REG /CR-2989.-
~
ort receat* toron b j!!; snows is eng - < moo 2K . . range of 0.001 0.0.01 i asona y represen tive.of er published '
~
estimates-'(EPRI,1982). t (3) Emergency Diesel Generator Repair Time .{' Approximately 50% of all diesel generator failures reported in NUREG/ CR-2989 were repaired within 8 hours. If two diesel generators failed as. a result-of independent causes, and operators could diagnose the problems to select the quickest possible repair, in 50% of these cases one of two diesel generators would be repaired in approximately 4 hours. These two cases have been used as representative of the repair rate. (4) Common Cause Failure Common cause failure rates were obtained from.NUREG/CR-2989 for diesel generator hardware and human-error-related causes; however only failure-to-start estimates were made in that study. Subsequently, the MGL method has been used to estimate generic common cause failure rates for both failure to start and failure to run. Human errors causing a simultaneous out-of-service state for two or more diesel generators were included in estimates of failure to start. The MGL estimates are consistent with the generic estimates made in NUREG/CR-2989. The common cause failure rates, for support systems--such as DC power, service water and component cooling water--were obtained from NUREG/CR-3226. NUREG-1032 B-12 . ~-- - . .. .- . - .. _ ______ _ _ _ _ _ _ _ __ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ __ __ f
i (5) Common Cause Failure Repair Rates for Components and Subsystems When the inadvertent removal from service of more than two diesel gener-ators is excluded, the failure mode and repair rates aopear similar to those for independent failure causes. In this case, however, the same repair time could be expected for both units. For inadvertent removal 1 l from service, repair (or restoration) can be accomplished usually in less than 1 hour and many times even more promptly (within minutes). Repair l rates for hardware failure and maintenance outages have been based on median repair times of 2 to 8 hours. The effect of system reliability parameter variations covering the realistic range was analyzed to determine the sensitivity within the generic models and the variability that is possible in plant-specific cases. (Thefollowingfactors wereanalyzedtodeterminethesensitivityofemergencyACpowerreliabili.ty[ , q
\
/
(1) emergency AC power system configuration
$J
,# 4 (2) diesel generator failure to start and to run
[f (3) diesel generator repair time f (4) common cause failure rate to start and to pdf
/
(5) common cause failure repair rate !
/
(6) duration of emergency AC powe V failure and mission (loss of offsite
/
power) length
/
/ l The results of the sensitivity analyses are provided in Figures B.1 through 8.5. The sensitivit esults are generally comparable to those obtained in 1
NUREG/CR-2989 and everal PRAs. Figure B.1 , ows that the starting reliability of emergency diesel generators is most imporf. ant when lower than average diesel generator performance exists or whensy[temconfigurationsrepresentnominalredundancy(e.g.,2/3and1/2).
/
\
NUREG-1032 B-13 1
- =2______-________-__-
16' l l l I I
~ Common Cause Failure to Start
~
~
--- 3x Base Value Base ValueA6.6 x 10 1
--- 1/3x Base Value
~
sg / DURATION OF LOSS OF OFFSITE POWER IS 0 HOURS DURATION OF STATION BLACKOUT IS 0 HOURS
\\
- h \\x[s s s s ,<=
i _ ssNN NN Ns N N 5 _ . N,N
\ N.\ N a
N E
=
z
~
, '\ \ CONFl ATION N
$ -\ \ # \ 2of3
> % \
u N \
' s e
W s.% %
,/
/ N s
\
3 \ % -
\ %
% 1 of 2 DN N
N N N
/'
N,\ \
\ l of 3
/
\
,/ -
/
t 10 0.90 0.82 0.M 0.96 0.98 1.00 INDIVIDUAL EDG RELIABILITY I' Figure B.1 Emergency AC power unavailability as a function of individual EDG reliability and common cause failure to start for three emergency AC configurations NUREG-1032 B-14
' I I I I I I I l l l l 1 of 2 EDG CONFIGURATION
- - - = 1 of 3 EDG CONFIGURATION O hrs
~ -
2 hr 1 i j
- 4 hrs ., I i
C 2 m 5 E
! 10 8 hrs-1 5
5 - _ i i 2 t o - _ l
~ ~
2 hrs E. 5
#p,*'- -
)
p# 4 hrs -
/
/ ***' /
/ ***"" !
- / _
# # )
/
/
/
/
j/ 8 hrs
.s***
/
/ ****
/
1 jo d i I l [/ l l 14 l 16 l 18 l 20 l 22 1 24 0 2 4 6 8 10 12 LOSS OFFSITE POWER DURATION (hrs) i
- l. Figure B.2 Emergency AC power unavailability as a function of loss-of- .
offsite power duration for four station blackout durations l NUREG-1032 B-15 I
1
.Y
'O
.. _ l l l l Comm ause i Failur Start -
- - - 3x ase Value ase Value (6.6 x 10^)
~
~ ~w 1/3x Base Value '
DURATION OF LOSS OFFSI POWER IS 8 HOURS
'% DURATION OF STATION CKOUT IS 4 HOURS I NN g i
N 10'* -
\\s\s.N ~
E e sN Ns a sN N N sN s
\sN\ \ <
\ N N
N N
\
l p cc -
~
' N N
\
N \g% EDG CONFIGURATION I e o l - \ s. \ s.s\,N.\ O 2of3
\
i \ \ 10'*
-/N \s N N
-/ %= ,,'s \ 1 of 2
~'~ N s\\ .,,,4 N.N.NN I
\
N 1 of 3
- \ N.
a l l l l l 0 i 0.90 0.92 0.M 0.96 0.98 1.00 INDIVIDUAL EDG RELIABILITY j l Figure 8.3 Emergency AC power unavailability as a function of individual - EDG reliability and common cause failure to start NUREG-1032 B 16
1 ? I I I I l 1 I g I I I Common Cause/ Failure to Run /
"""-- 3x Base V [e N Base V ue (2.4 x 10'3 per hour)
--- 1/3 Pase Value DURATION OF LOSS OFFSITE POWER IS 8 HOURS DURATION OF STATION BLACKOOT IS 4 HOURS
( -2 10
*s, N
s %N iii N% % CONFIGURATION EDG E % % N N z N g N
\sN \
l l $ w % N N N
\ 2 of s il: N N o N N
\\
N N t; N N z E 10
~ N ~
! E
\ 1 of 2 i
g
/ %
/ N % %
%*%~
% 1 of 3 I
! I I I I I I I I I 10'd O.900 0.984 0.988 0.992 0.996 1.000 INDIVIDUAL DIESEL GENERATOR RUNNING RELIABILITY
^
Figure B.4 Emergency AC power unavailability as a function of individual diesel generator running reliability NUREG-1032 B-17
l J l l 1 I I i
~2 -
i 1 m DURATION OF LOSS OFFSITE POWER IS 8 HOURS ~ DURATION OF STATION BLACKOUT IS 4 HOURS
, 1 of 2 EDG CONFIGURATION N
E - cn
$ Repair Time for q Common Cause Faults I > -
y p -- 8 hrs
, p -
- 4 hrs
) $ p 2 hrs 5 /p /
p k 10 -
/ / ~
o
/
/
U _ / y _ E w
! W l
1 4 I I I I l 10 j 0 2 4 6 8 ' 10 12 REPAIR TIME FOR INDEPENDENT DIESEL GENERATOR FAULTS (hrs) l Figure B.5 Emergency AC power unavailability as a function of repair time for independent diesel generator faults - l NUREG-1032 B-18 , l
?
~
/s Commoncausefailuresdominatesystemfailureprobabifitywhenindividualdiesel{ ~
reliability levels are above average or when a higher level of redundancy (e.g.,1, 1/3) is introduced. Also note that for the 1/3 configuration, common cause ; failure of support systems (e.g., service water, DC power) that are held con- ; stant in these analyses constrain the potential unavailability levels that can l I be achieved through improved diesel generator performance. Figure B.2 shows the i effect of mission duration and mission success. For a longer mission time (longer duration of loss of offsite power), the chance of mission success (operation without failure) decreases. , But, as the success criterion is eased (the duration of unavailability is less than 2, 4, or 8 hours), the mission reliability improves. There is,a' factor of four difference in unreliability as system success criteria change from an unavailability of 2 to 8 hours for an 8-hour loss of offsite power. The cases analyzed in Figure B.1 have been re-
, analyzed in Figure B.3. The latter analyses includes a mission time of 8 hours and an unavailability success criterion of not greater than 4 hours. A similar I analysis was performed to evaluate the sensitivity of running reliabi'lity f(failure-to-runrate),theresultsofwhichareshowninFigureB.4. Common cause failure'to run is seen as a lesser but not insignificant contributor to system unreliability than the failure-to-start common cause failure. The results are
, 'not overly sensitive to repair rates within the ranges identified, as evidenced by results provided in Figure B.5. Within the reliability performance ranges identified, there is potential for significant disparity of emergency AC_ power --
\ '~s ystem reliability
-. - for any of the configurations
- - -- analyzed. / Figure B.6 shows the
. _ ~
estimated Va_nge of emergency AC power unavailability obtained by using combina-tions of above and below average reliability performance parameters. STATION BLACK 0UT FREQUENCY 1 Station blackout has been defined as the loss of all ac power supplies from both offsite and safety-related sources. Also, a station blackout must exist for sufficient time to incur core damage and resultant potential risk. There- )
~
fore, station blackout models incorporate duration as a parameter in frequency estimates. Although in some instances it is possible to have a station black-out initiated by failure of, or operational errors associated with, DC control power, this type of event is more rare than the station blackout sequence beginning with loss of offsite power and followed by failure of the safety- 1 related AC power supplies. DC power reliability is the subject of another j NUREG-1032 B-19
- P s W D
*e P A O N g l.
?
1: L l w C x , o E
=
L s. e
~ = =
w w R E E -
. u
- WG ON e
6 PA B C R , c o E AY T R YIL , a w U CI , GNB e F EIA I p w GL - ' w RE ' ER M E M = - . ~ 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 . 0 m 0_ l 3 . wfQa'1 < =$$=_ :n roL 1.$ a_ . ' '- MM j 3cda}lc c k' a. a
- ]< t g,p0 l ! ilI - ;i
l
)
l 1 I generic safety issue, designated A-30, " Adequacy of Safety-Related DC Power Supplies." Station blackout frequency estimates can be made by combining the loss-of-offsite power models developed in Appendix A with the emergency AC power relia . bility models of this appendix. Recall that the loss-of-offsite power frequency and duraticn correlation derived in Appendix A was a two parameter Weibull function of the form ALOP (t) = ALOP
- where ALOP, a, and S are constants that can be derived for a specific combina-tion of site location and design features. Subscripts have been dropped for convenience. The frequency of a station blackout is derived by combining the loss-of-offsite power duration (repair) frequency with the rate of emergency AC power system failures of duration I gg over the time period of interest for which a loss of offsite and emergency AC power can occur. This is the same general approach that has been taken in other studies (Evans and Parry, 1983; PASNY, 1982) to estimate the frequency of total losses of offsite and emergency AC power for risk analysis. For the 1/2 emergency diesel generator configura-tion, the equation for the frequency of a station blackout lasting I SB r longer can be written as 581/2 (ISB)
- ALOP(ISB)PhTS*~
+ALOP (ISB) PCCFTS2/2 e SB[T CCFR ILOP ISB e
~A FTR t,-(t+ISB)/ *R f
+2P A g FTS LOP (t+ISB)A FTR
! 0 NUREG-1032 B-21
A -t
+2 f LOP ISB I
LOP ISBAFTR ,- t FTR 2 e -(t 2 y+ISBf*R 2
]O t 1
A t ALOP (tl) AFTR e FTR 1 dt y i I I (ILOP SB
+JO A
LOP (t+ISB)A CCFTR e A CCFTR e -(t+I SB I CCFR dt In a similar manner, the station blackout frequency equations for three diesel generator systems requiring one or two diesels for success can be derived. j l Analyses have been performed to estimate station blackout frequencies and dura-- I f tions to study the sensitivity of these estimates to uncertainty in ertain _ dominant factors. As a starting point, each loss of offsite powIr cluster cor- . ,
, relation from Appendix A was combined with the emergency AC' power system reli- I l
ability modeh using nominal parameter values for emer,gency diesel failure to l f' start and run, repair, and common cause failure ratesI. Then the estimated fre l quency of a station blackout lasting from 0 to 16' hours or longer was calcula-
/
ted. The results for the 2/3,1/2, and 1/3ffesel generator configurations are
! shown in Figure B.7. This figure shows that wide variations in station blackout I frequency are possible depending on dJes/el generator configuration and relia-bility, plant offsite power system,ds' sign, grid reliability, and susceptibility '
- to severe weather hazards. Asadensitivity,twomodifiedclustercorrelations were developed with higher tijd nominal grid unreliability; they were combined with the 1/2 emergency AC power co guration odel and produce the results in Figure B.8.
get[#VI s Si e s (, re Severalanalyseswe/ re performed to demonstrate the sensitivity of station
~
j blackout frequericy estimates to variations in emergency diesel generator fail- j ure rate foy both independent and common cause failures. Figure B.9 shows the effect of/above average and below average failure rate estimates for the 1/2 configuration and several representative loss-of-offsite power frequency cor- j
)
relations. The 1/3 configuration has been similarly analyzed, and the results [areprovidedinFigureB.10. - 1 NUREG-1032 B-22 _______.____m._ ___ .
10-3 _
~
* /
/
/
Cluster 8 / 10-4 .
\
Nw Cluster 9
/
/
N > % N
/
N /
\ s\ N l N s
> \ N
'\ \ \ \
$ ( \ \ \ \
%,N Offsite d \ \ N Power w3 10-5_g1 A \ N Cluster Es H 4.
~
\ 's* \ \
\ N N
N5 mo L
\ \
OE .1
\
3 _g S N,'sNNg'N \ N \
$[g m
t
's ' -,- N, s,g N
ss 5 z \ $s s4 O H 10-6 s j N
- N,N N N H : \'s / N, \
/ - -
4
/\ ,g'h \-57
_ < s N
\-
s, s, \=%'q ,,
/ s 's N ' ,' 6 10-7
-j ' \g ' g 7 f
~
/- ,
\,s 'N, -
N2
/
-1 of 2 I 's 'N s 3
- ---2 of 3 DG Configuration s'N N,
------1 of 3 Ns 'N,2
%s 7 s
, , , , , , , , , , , , % 2, , , ,1 i 10-8 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 STATION BLACKOUT DURATION (hrs) .
~ - Figure B.7 Estimated station blackout frequency as a function of l blackout duration NUREG-1032 8-23
. i
3 16 ~
/
/
,/
1 10
# /
1
/
e' 1 /
*% \ !
. '% t.
g t l $',% N / i N ' j 4 %, \ N
> \ %% %
I %% % k 10 -- g \g % N
- - \ s %
> - % s W
s s\\ N gg g
%s\ \ 1 j
c - % \ W %gg %
\ .
%% i f -
% *\
% s% %
3 sg% < N
'%'s\ N S % s% %
u N 4 j 5 %%
%% N OFFSITE POWER l e # "" 'Ng N i
' z 10 N CLUSTER l O -
N Q N 4 m . ,
. g
'% g g
# %'% 7 10
/
~
. GR7 %,%
1
- / g*g
. GR3 %
%g' i
.GR1,
%' 2 t
1 - g/ I I I I 4 I I I I 8 I I I I 12 I I 14 I I 16 0 2 6 10 DUR ATION (hrs) t Figure B.8 Estimated station blackout frequency as a function of blackout duration for clusters 2, 4, and 7 (for 1/2 EDG configuration) NUREG-1032 B-24 1 ---_._.n_- - -__ ._
10'I
~
=
= 3x Base i
. - Diesel Generator Reliability 4 > Base Value Parameters
- > for Failure to Start and aHure to Run 3 .. %x Base ,
~
~ .
/
2
~
7 e Cluster 8 j
> f I e /
10 .. / : o x . .. U ~
$ <l ..
m 2 -5 - 9 3 \ - i i Q
~
5 ,. 1 en
- u. - / Offsite j o
,N ""
Power
=
Cluster i o ,, / ..
'. o / ..
, :::> 10. -
O :: ,
~ '
E , 4
- u. ,
1
~
j < 10 [ ? f
~
I, i 10
.s
,' 1 of 2 Diesel Generator Configuration
~
I
~
1
~
t /
\ / i i 6
/ 8 e I, I t i j 0 2 4 6 8 10 12 14 16 18 20 DURATION OF STATION BLACKOUT (hours) l l-l Figure B.9 Estimated range of station blackout frequency as a function l of blackout duration for four offsite power clusters -
NUREG-1032 B-25
s 10-3 Offsite Power 2_ Cluster
/ g= =
g 7 10-4 b o \,\ N 2 N y N g
$2
(%'s,\
\
, N (Offsite Power Cluster,
' Multiplier for DG Values)
E 5 N
@I F 6 'g?* ,' \
N " 83 wE 'N
,' s N (5.3)
( N 1 Og i
', ~
s
/
N ,,- . 5m in E 10-6 2-
\ , \g5' 'g, , N N g ,N s'* (4,3)
F *
, g,,ks, N (5,1/3)
\, \'N, (7,3) !
10 7 N
' s' ,,'- (4,1/3) l
' ' ' 7, j ' ' ' ' ' ' 3) 10-8 0 2 4 6 8 10 12 14 16
STATION BLACKOUT DURATION (hrs) l Figure B.10 Sensitivity of estimated station blackout frequency to diesel generator failure-to-start and failure-to-run values NUREG-1032 B-26 .
REFERENCES Atwood, C. L. , and W. J. Smith, " User's Guide to BFR, a Computer Code Based on the Binomial Failure Rate Common-Cause Model," EG&G Idaho Inc., EGG-FA-5502, July 1982. j Electric Power Research Institute (EPRI), " Diesel Generator Reliability at - Nuclear Power Plants: Data and Preliminary Analysis," EPRI NP-2433, June 1982. Evans, M. G. K. , and G. W. Parry, "Quantification of the Contribution to Light Water Reactor Core Melt Frequency of Loss of Offsite Power," in Reliability Engineering, 6:43-45, 1983. Fleming, K. N., "A Reliability Model for Redundant Safety Systems," in Procedings on the Sixth Annual Pittsburg Conference on Modeling and Simulation, April 24, 1975. Fleming, K. N. and A. M. Kalinowski, "An Extension of the Beta Factor Method to Systems with High Levels of Redundancy," Pickard, Lowe and Garrick, Inc., PLG-0289, June 1983. Fleming, K. N. and P. H. Raabe, "A Comparison of Three Methods for Quantitative Analysis of Common Cause Failures," U.S. Department of Energy Report GA-A-14568, General Atomic Company, National Technical Information Service, May 1978. Husseing, A. A., et al., " Unavailability of Redundant Diesel Generators in Nuclear Power Plants," in Reliability Engineering, 3:109-169, 1982. Power Authority of the State of New York and Consolidated Edison Company of New York (PASNY), " Indian Point Probabilistic Safety Study," 1982. Rasmuson, D. M., et al., "Use of COMCAN III in System Design and Reliability Analysis," EG&G Idaho, Inc., EGG-2187, October 1982. NUREG-1032 B-27
.a
/
~p.
..s Steverson, J. A., and C. L. Atwood, " Common Cause Failure Rate Estimates for Diesel Generators in Nuclear Power Plants," EG&G Idaho, Inc. EGG-M-00681,
,}; National Technical Information Service, September 1981.
U.S. Nuclear Regulatory Commission, NUREG/CR-2989, R. E. Battle and l
- 0. J. Campbell, " Reliability of Emergency AC Power Systems at Nuclear Power Plants," July 1983. l i
-- , NUREG/CR-3226, A. M. Kolaczkowski and A. C. Payne, Jr. , " Station Blackout Accident Analyses (Part of NRC Task Action Plan A-44)," May 1983. ;
1 I i
-_ j l
l l < i NUREG-1032 B-28 1 l m a ' amb amin 6 E na s mea nsua 'ai. . I e u imm .
1 l l APPENDIX C STATION BLACK 0UT CORE DAMAGE LIKELIHOOD AND RISK l e NUREG-1032 Appendix C
TABLE OF CONTENTS i Page STATION B LACK 0UT CORE DAMAGE LIKELIH000. . . . . . . . . . . . . . . . . . . . . . . . . . C-1 STATION BLACK 0UT RISK............................................ C-15 REFERENCES................................................ ...... C-17 LIST OF FIGURES Figure C.1 Station blackout risk perspective for different containments................................................ C-18 LIST OF TABLES Table C.1 Summary of potentially dominant core damage accident sequences.......................................... C-2 C.2 Decay heat removal failure probability for loss of core cooling early during station blackout. . . . . . . . . . . . . . . . . . C-6 C.3 Estimated frequency of early core cooling failure during station blackout, per reactor year. . . . . . . . . . . . . . . . . . . C-7 C.4 Tabulated estimated values of total core damage frequency for station blackout accidents as a function of emergency diesel generator configuration, EDG unreliability, offsite power cluster, and ability to cope with station blackout.... C-9 C.5 Comparison of results with NUREG/CR-3226.................... C-16 i 1 1 i NUREG-1032 C-iii ) l l
- _ _ _ . . . 2
l I Y Y APPENDIX C STATION BLACK 0UT CORE DAMAGE LIKELIHOOD AND RISK This appendix provides a description of the simplified method used to estimate i station blackout core damage likelihood, and risks from station blackout tran- ' sients. The models and results are generic in nature and intended for use in regulatory analyses. The station blackout frequency estimation models described in Appendix B of this report were integrated into sequences involving failure of decay heat removal systems with AC power unavailable, thus allowing the esti-mation of the frequency of core damage as a result of station blackout events. When core damage proceeds to core melt and containment failure, fission products may be released to the environs, causing risk to public health and safety. The likelihood of station blackout transients involving core damage and the dominant accident sequences have been identified by Kolaczkowski and Payne in NUREG/CR-3226, using event tree and fault tree analyses of several typical plant designs. However, the variability of station blackout frequency and dura-tion was not evaluated systematically as part of that work. In this appendix,
. the station blackout models have been combined with the decay heat removal and
]
core cooling failure sequences to obtain a more complete evaluation of the sen-
- sitivity of station blackout core damage likelihood and risk estimates to varia-tions in plant design.
STATION BLACK 0UT CORE DAMAGE LIKELIHOOD The dominant station blackout sequences are provided in Table C.1. Both pres-surized water reactors (PWRs) and boiling water reactors (BWRs) have sequences that involve early core cooling failure (essentially on demand) and time-dependent failures related to capacity, capability, and transient phenom- l enological conditions associated with a loss of all AC power. For the dominant . NUREG-1032 C-1 o _ ___ .. .
i Table C.1 Summary of potentially dominant core damage accident sequences AC recovery h DHR system / component time to avoid Generic plant type Sequence contributors core damage, hr PWR TMLiB2 Steam-driven AFWS unavailable 1 to 2 (all) TML B22 DC power or condensate exhausted 4 to 16 TMQ2B2 RCS pump seal leak 4 to 16 BWR TMU1Bi Isolation condenser unavailable 1 to 2 w/ isolation condenser TMQ18 1 Stuck open relief valve 1 to 2 TMQ282 RCS pump seal leak 4 to 16 BWR TMuiB2 HPCS/RCIC unavailable 1 to 2 w/HPCS-RCIC TMU B22 DC power or condensate exhausted, 4 to 16 component operability limits . exceeded (HPCI/RCIC) { BWR TMU1 82 HPCS/RCIC unavailable, 1 to 2 w/HPCS- { RCIC TMU B22 HPCS unavailable, DC power or 4 to 16 l condensate exhausted, component i l operability limits exceeded (RCIC) Notes: DHR = decay heat removal HPCI = high pressure coolant inspection AFWS = auxiliary feedwater system RCIC = reactor core isolation cooling RCS = reactor coolant system HPCS = high pressure core spray
~
~
NUREG-1032 C-2 ji
BM i accident sequences, the core damage times have been characterized as falling j into two groups: (1) a core damage time of 1 to 2 hours for the early core cooling failure types of sequences, or (2) core damage in the 2 to 16 hour range for the sequences involving capability and capacity limitations causing j loss of core cooling during extended blackouts. Sequences involving longer duration blackouts than these have not bien found to be nearly as important. Thermal hydraulic analyses have been performed to determine event timing for both types of sequences (Fletcher,1982; Schultz and Wagoner,1981). In gen-eral, it has been estimated that it will take between 1 and 2 hours to uncover the reactor core following a station blackout and loss of all core cooling, and perhaps another 1 to 2 hours for the reactor core to melt and penetrate the reactor vessel after the core is uncovered. If decay heat removal is initially successful during station blackout and then is lost several hours into the transient because of design limitations, the time to core uncovery and melt will be somewhat extended as a result of lower primary coolant temperatures and reduced decay heat levels. The dominant accident sequences were modeled as either an early core cooling failure or as a subsequent loss of core cooling. In the former case, the like-lihood of the accident sequence is given by the probability of a station black-out combined with the probability of failure to maintain adequate core cooling or decay heat removal by AC-independent means long enough to cause core damage. For PWRs and most BWR-2 and -3 plants that do not have a makeup capability inde-pendent of AC power, there are two paths to inadequate core cooling early during station blackout. The first involves failure of the turbine-driven train of the auxiliary feedwater system in PWRs or failure of the isolation condenser in the BWR-2 and -3 plants. Because neither of these reactor types has a makeup capability independent of AC power, the core will be uncovered early by a major loss of reactor coolant system (RCS) integrity such as a stuck open relief value or gross failure of reactor coolant pump seals, either of which could result in leak rates upwards of several hundred gpm. BWRs with reactor core isolation cooling (RCIC) systems, steam turbine-driven high pressure coolant injection (HPCI) systems, or high pressure core spray (HPCS) systems with a dedicated diesel generator can cool the reactor core and have the potential to make up NUREG-1032 C-3
m
. p; b
losses of coolant equal to or greater than those identified above. The latter j type of sequence was modeled as the likelihood of a station blackout of a dura-tion sufficient to exceed core cooling systems capabilities and allow core damage to occur. If decay heat removal is initially successful, if reactor coolant leakage rates do not exceed makeup capability, and if primary coolant inventory requirements are met, operators should be able to establish a rela-tively stable decay heat removal mode. However, decay heat removal capability during longer blackouts may be limited by the capacity of support systems such as DC power or compressed air, by reactor coolant leakage when makeup is unavail-able or insufficient, or by thermal limitations on component operability as a result of the loss of heating, ventilation, and air conditioning systems. In light of the above discussion, the general form of the core damage accident likelihood equation considering both early phase and longer term decay heat
+ removal failure is as follows:
PSBCD = P SB(ty) (PDHR/SB + PLOCA/SB) + PSB(t2 ) (1) where P is the probability of core damage due to station blackout, PSB(t ) SBCD t is the probability of a station blackout of duration ti , and ti is a time sufficient for core damage to occur if all decay heat removal capability is lost at the onset of a station blackout. P DHR/SB is the probability of decay l heat removal failure on demand given station blackout. P LOCA/SB is the probability of a station-blackout-induced loss of reactor coolant integrity that would cause an early core cooling loss. P SB(t2 ) is the probability of a station blackout of duration t 2, where t2 is a time sufficient for core damage to occur because decay heat removal capability limits are exceeded during an extended duration station blackout. l l In terms of the notation used to describe the dominant accident sequences for the various type of light water reactors (LWRs) identified in Table C.1, the equation can be written as follows: fyj NUREG-1032 C-4 e i
l for PWRs: PSBCD = B (L1+Q2)+MB2 t (2) for SWR 2/3s: PSBCD " 0 (Ut + Q1) + 1 B2 (3) for BWR 4/5/6s: PSBCD = BU 1 1 + BB 2 (4) i The probabilities for (L2 + Q2), (U2 + Q2), and U2 have been set equal to 1.0, because the time of 82 was selected to represent loss of decay heat removal capability as a result of design limitations. The probability contribution to Q1 from reactor coolant pump seals degradation during station blackout is not well known. Based on material reviewed in NUREG/CR-3226, the impact of reactor coolant pump seal leakage was assumed to represent a potential limit on the TMB 2 type of sequences. The TMB2 portion of equations 2, 3 and 4 above can be estimated from the first term failure-to-start portion of the station blackout equations in Appendix B. The TMB 2 term of these equations can be estimated from the completc station blackout equations in Appendix B. Probability estimates for Li,'U1 and Qt were
~
derived from NUREG/CR-3226 and are summarized in Table C.2. Estimated values of the early loss of core cooling term of equations 2, 3, and 4 are provided in Table C.3. This table shows the sensitivity of the estimated frequency of early core cooling failure during station blackout on loss of-of.fsite power characteristics (clusters 1 through5), emergency AC power unre- # liability (EDGR) (i.e., failures per demand) and decay heat removal unreliability (DHR). The second term estimates of equations 2, 3, and 4 are the same as the station blackout frequency and duration assessments provided previously, given that t2 is defined. Because the capability limitations vary from plant to plant, so will t 2. Some example estimates for the total core damage frequencies given capacity limitations which equate to station blackout durations of 2, 4, 8, and 16 hours are provided in Table C.4. These estimates include the early core cool-ing failure frequencies from Table C.3. The results in Tables C.3 and C.4 show that the frequency and duration probabil-ities of offsite power failures, emergency AC power configuration, and NUREG-1032 C-5
l e n. Table C.2 Decay heat removal failure probability for loss of core cooling early during g station blackout Probability of System / train / component failure Auxiliary feedwater systems 1 steam turbine-driven train 0.04 2 steam turbine-driven trains 0.002 Isolation condenser 0.01 I 0.025 Stuck-open SRV (BWR) HPCI/RCIC 0.005 HPCS/RCIC 0.001 i 1
~. )
k !
- n .
f.1 by - f
- p qJ .' NUREG-1032 C-6 w
a p_ 0l.E {~ b ' LLUS TE E . l pup spa E i 8 3 4 G~ 4 I/G cone oGu e n t Iou D.j Q f E-f l.( 2 -V l.3 E- V 7.0 E - 5 5.S E - 5
- p. o S o. o 5 10 E-4 f.as 4 4.2 E- 5 . 3. 0 E - 5 t.2 E - 5 0.025 5 5 E-5 30E-5 .9.4E-5 1. 3 E - 5 $.5c-6
- 0. ol S.8 E ~5 20E-5 15s-5 20E-4 C.0 E - 4
- 0. J '5.1 E -5 5. I E - 5 9.f E -5 j. 4 E - 5 f.l E -5
- 2. 0 E - 5 f. A. E - 5 65E-6
' ~
O.05 5. 0 E - d 4.q E- G
- 0. 0 I p. o 25 I.1 E - 5 d. O C - C 4.YE-S 2. 5 e- C i.s e - 4
- p. o / 7. S E- d 4.0 E -6 5. 0 G -b 1. f E- $ I R*E 6
- 0. I Q. 6 E-6 I,4 C - 6 l. S E - 5 rf.0E-d 5. 5 E- d !
605 10E-5 f. o E - d 9.g E - f 3. 0 E - 6 2. Q E - ( 0 005 8. 0 25 5 52-$ B.OE-d 2. 4 E- G j.3 E - G . 9,5 g - 5 O. o I S.8 E - G !). O B - S j.SE-b {.0 E- $ (.o E - 7
// S ConFIG(t E m oN 0./ 4 3.E-5 9. 5 E - 5 9.1E-5 1. s G - 5 $.0 E-C
- o. o5 2. 2 E -5 /.9E-5 1 0 E -6 g. o c - C q.) E - f 0-06 0. o25 122-5 9.5E-C g.oS-S 4.) E - C 3.3 E - (,
O. o i 16t-5 6.0E-6h 70E-6 3.g g - G 3. 0 2 - f
- 0. I 2 4 E-4 6.0e-C 4.sE-G t.s E-d I.s e -6 0 05 4. S E -C 2-4 E-6 9.0 E - d l. 0 6 - f 2 22- %
- 0. 0) 9 095 S.SE-d l.9 2-5 1. f E - C 8- 2 E -7 f.GE-7
- 8. ol 3. 2 E - 6 12E-f J. It E- S 76E-T f.0&~7
- o. ] 43E-6 9.52-l 9dE-f 1,SE-6 0.08-7 1 0 05 22E~S 1.2s,-f I.Q E- d 5 0E- 9 9.]g-S 0005 0 02s I. t e - G s.se-4 e. o e -
- 4.12- 7 g.aE-9 l O. o / l. 6 E- 6 3 0E-P 7 0E-T 3.8 f - F 3 0 3 - :jr ;
L l . _-_ PL , l
7/lBze c.s ~ ~~~ __ c L uST E) E 4 2.
-1. 2 3 4 5 D B R.
2/3 (A N Fl.c,a E A T10 h)
.I 75E-4 4.6 E 4 3.p E- 9 9.02-4 l. t E- f
.os 05 24 2-4 16 E -9 l.3 E - Y 7.0E-5 56E-5 025 ).4 E- f -f . 5 E - 5 ' (.0 2 - 5 3.3E-5 16 E-5
.01 2.52-5 4 2 E-5 ' 3 8 E-5 9.0 E- 5 l.5 E- 5 i
~l 152-f 8.b5~6 7 7 E-5 '40E~5 3.8 E -5
.6l 05 5 6'E -5 S.I & -5 2. f E -3 I.4E-6 f. ) E ~5
.o es 3. '+ E - 5 15 z ~ 5 . \. % E- 5 66E~$ 5_jg-f
.o I I.7e-5 s.4a-G 74E-6 S.sE-G S.0E-S l
.I q.5E-6'4.6E-5 3.s E - 5 020E-5 l.8 E-5 06 29 2-5 l. ( E- 5 ). 3 E - 5 7 0 E-b 5.6'-E-l 005 .o25 14E- 5 j.5E-C f.8E-( 3. 8 E-l 265-6 0/ 8 5 E. b 42E-d 3. 2 5 - G 9.OE-( l).6 E - G I
- 2. } 4 fo N F16U R n-Tlo n/
-I l.? E-9 6.0E-5 7 5 E-5 4. 0 & -5 8.3 E ~ 5 ;
05 05 5 5E-5 3.2E'-5 9 7 E-5 ).4 E-5 j. ) E- 5 1 095 S.82-5 9.9 &-5 ).8 E - 5 9 0 E - (,
.ol S.S E- 5 ).8E- 5 f.5 E -5 $.5 2 - G j 7 0 2 I
i i i
*l 5.3E-5 1.t 5 -5 l1.5 E-3 9bE-$ hh.6'E-b 05 ].IE-5 C .4 E - G ' 5. B E-d ,9 2 E-6 I9 .R E-f 0I 025 7. (> E -G $. 8 E - S . B. 5 E - 4 ). 8 E- G it.tjE-d
.ol 6.5 E- f 3. f E - 6 l 2. s E- 6 ll.5E-G l1.R E-C ~
l ! 1 J. 7 E-5 s,o e-c \15 e -f 40E-f ' 3. 3 E - f-l 05 5 5 E-f S.2 E-G j 9 7 t -G l. 4 E - G l 1 E-d 00 5 03 S 3 8 E-C 2.2 E-G 'j.g5-G 3 0 5 - y . 7 0 E-f 1 0/ 3.3 E-4 /. g E- 6 1.s a - 6 jy.6 E-9 , 6 0 E-6
! C-8 l
TEE EEE - EE E 1 L eL 0b tt3 Jl - t f I 35 4 +5 f. f- L E S-E
- - fS4 fl 51 i fE - - -
Eb- - - l Elg 34
) - $E- - -
' 14 5C{- f.bdC4
). $. 6 b 1 b gfE.6bZE
. - - - - - I I -
l 1EE251 4f.EEE E E t E l _0s 3 t. D 233 _%.S . . - 29$ 3 9 5l 6 3 I 5 . 5S S5 Sf - 5 -
- - c G EE E- E F t E n D 3 5- 516C. 88 9 5E 5 o. 62 yu E f-5S- S n
45 3 t2 8
- cf
' l 1 - I n
EE? - - -
- E E- E>
l hf- - - g p4,7 - l ea ni u
$03.Sf
. E 1 2.
1
- 5. % 5 2 G- 6 E . d 4 t. Ef f L
I 3 4 -
.e-r qs ii ea tb l
93 t 9
- s. 1 3 c 2ttf7 o 1 f f r f s r 38 s.
- 2 5 1 II 1 t en gn ge ia I
ad f il
!C mi s- ac o 9 f_
S5 3-2 5 - E d c ce a Eg E S 9 E 5. 4E 2 e ) _ 399 - 4 9 . 5E E f'5 3 4 5 _ rt G E.3 ~ R
- - ou Dl f
- 3. A - -
E l_
- - 1 1 co E f-C-' 51 ] -
E E
- ,' " 4 - 2 E&- _
EE8Y9 E- _ k ( l c E
' 10 6 . C 0. 6 t aa 6-3 3, y. g f 4% s$ 5-E 9 t9- f.6.L 1 tl W -= - E ob t y o sE E9 5 E
r sG 4 t n c l g $.
. l. l C s_ 9 7
. f o f
a 1 R. QG $ I oi t 4 ? sa c Lr t et
.t L s us l o L u
, l ar 6 L vo aF I C S-r S- d e) f i N / i 55 4~ ? .
t r DR - '-
- -, aa
( ? - E2 2 e d..0 9
? 5E me 3 9 9. E 1: 50 s
w 0 5 / 8 iy a w
. o 9 P 1
u EE E 9. l.
- 1. R 3, 416.S. 8 1S- 9 9.
= 2 -
_ A ES - E/ E-t - sr eo n a V
- h S 5- l R
2 - E r 5 mE - E E;E E d> G /9,f .T E E Lg- d c t ea s o E TI a 5 , Ci. 2 5 $6 - G D 92 9E . t t 4 o (c
.f 9, S E E 4lK
- 5-E t e ar C g f 9fe j l
urn F 2P G r b eorp F 1. /
/
- 1. R 46
. U 2 a pi n- O 9. f T(t u o
t
. 4 C
e t
~
1 55- .) l b a N T E2 - 4E
- 3
- 9E-E L
; 3 E
24 $9- 9-9952 33 3 0 9.S 3
- ~
2EE - SE9-5E 0P5 I2 E2 E-34
- E 3
J. -- 3 E' > 5 2E- s h.
,5 5
'.i [
.5 i 5
- '.L.
l, 3-R.9sC J 42 . 56 s- - f I
- - 13J E r E 9 Es S o.
9
- 3. 3 , S.5G .
1 e 9 f
\ )u _
1% f l t [fo t A0;' O4 4 e."t I I 0 ), 9 9 y ; 94.48 j L
\. t5 ;' i
S. -+I 1P. 9.S E E359 - 9 - 0 3 D. 95 eg K. Q 2 E 3.9 2 1. f l.
/
E L s. 4% 9
., O ?E- ~ - p%~ - 0]- - - 9 E" -
3'l 3 5' ! 6
/. 5s46 .
535 'f- - f .
!.s G- 7 3 2. - 22 9
E f7E EE - - E g9 EE 3R- sE- E
- 5. O 5 2. s. t.t
- C. 1 C.
l 93 R3 2 1 rAJ i l' I 4E +- c 5E 5 5.5 E f 5 $ E- g.
- e. 5 V f 5 5- f. g
- - S9
; 3f
- 0. EE 4 f-9,0-1, '75 - - - 39 y S Q. 2 f .
E6Nl- - EeE- - -
- yu
)J E55- 5i 4 0 f 5f D E e (..f cf n
o E. S -C 9g
- 9. l. 9EEl_
_ 052(5 . E - l 2 % Es $. ea 3 s. 3 lE g-f _ 4 9 t 3 l 3 u qs 5 I 34 Fe t. (- l. ea
. r f s en Q
= _ h_
- ge f y- v-g D E-S '
d 3S ad mi
- E- g $E E-E ac
-33 ~-
f E p 6 . S. 4 4 2. f . 5 .5l f. 94S 49 d E E e3 3 - - 1
=3 9 - A E- - - 3 2 eE e 3
- - EEf~~ - EEfi - 5 - rt ou
}r L lQ3, 5 f I
/
l
. =Q s5 5 - A 1. 6 S- 7
? s. 6 '6 s.
co (4 4iS-t E - t. 9 1 G E I 0 4 E} E 5ZE- l c F. 6 aa
- f. f t. 7 l f
. ._ S f
. tl ob f QS l t
-(
L_ 3_ f o y g _ oi c er sa V g et I i. t us e c t l a u lp : k '
'1 v
t ht 3-E-E 2S
- d O - -
7-
$ e E x EE # E t R
F s w o l 33- -
- 9. f SA L -
3E E
- 2_23 1
/
0 34-4 2 Ef
- 1 RO 4 4 + 5. $.
---- . i a
m EeEE- 3fl t r , u EEe- n.,6 ) E96-y: - = EEE /C- : s e E __1 t 2. 4 , 63 - - 5 5. $! -d jR !
- 9. n. .! 4 r i 8 3 3-
= = 3 13f
. d 5 z-L L
E fK4 Ec 6
- 1. q 5-ED 6 39f t
e G s t D D 5 a 4 f f E t 9 R. t. B D S g. E E.E l
- y. l u
M t o E 51 b a O @ . T( 4 e C R L O Y e 4 - 't l 3- - E - 4S b a E c. 2 E 4 9- - sE T QS3.o E EE- -
- -l6
/
339+R EEeE- 3S- ~ 44l "l-
' 321 2
i g5- - 1
- 4 1
FJ- EE - I
~
53415.- D. 0.b h. - i ; 5354 T.0265 1 - 52a3g - I 52EE I 1 5 o. s - 89 2 f. n. E2 55 9 ? + q. p _ kd
't ,
09 NE[l ,k $p(f
> b _
' l fl l fT(jbb . o ,% % tt p lll i5l ; :
9l 8l8i _ _ ,i !l
g 4 g . 6G6 mg. E G f C. n 6-6C -- - - eE2 o E- E E EE E f.2. $f. 3. f. 9 t r 7 B S ;/ 5 S. 5 5 - 5- G. 529 y u 4 %s$ - - - - f SVi.L ?-
- - 95
~
3
- 6- ).. 7. y-
- - =E - -
fy3
- c n
e 2 gE y Eef 9 ' 41 g 3ygq 1. 6 - - - u
- u. $. l g7t- s -
fqlEgE g yg .. 6 3 eE E g q s e se l 9 g3l g . o. 3 r y c.2 f p31 3g f g gg3 3l e g (p P a 1 _ 6C E m 55 6_. d EE f. M V d a
* ' - * - E% 06 3(, 3
.l e
3' fS40 EE1 2 f3 -S- .0S99 - S SS f 3 I 5-
- E E$5
~3- r o
/ --
- EE - - co 9
E fs $ :- 1 I C E I
.E-h
; f1
/ 0
- 9. t. gG 4 11 j S. E E~
t
- 9. 1 l cEE 1
s 2 . 8F il l a t I C 9 1 Et
- t. t
- c. 't 4. $.
l - g2 E Qf o 09e.c.t s . tl l9 t 8 f o y I c o l L&( 6 j- s 5C6 - - - e y r 3 * -
.C EE
- - S E E E- EE l u
d a a
+ S5 j1 E E 5 93d 2$ - 3 4 S 3 0. Q.
L7f /0 45C - - S dS S. a v
- - ~ . - - -
81 0 E E .- EE E' - u r EEE - - t I 0 EEI .
- - d O s ) b - - - 9 1 J. 9 e 2
t e a ? 1
. n. T3f? 0 . . < 6 67 6
A G9
=
52 A '. 3- -E 6 t a 2 c + b2 - - 29 -E -E - = l 9E E E 1 E m F EE g1 = 3 3. E E S1 g E 9. J i t s
- e. L . -
[ . I. bl 5 3J t e Q2 1 f ' (r w o G - D d S bF C D d E 5- b_ _ _ t
& e K 55 - E E - -
+ 5f EE 5 5-SEE t
o l
- r. - -
k o EE EE 1 l$ 3 SoE ts r e . . 13 33 R L
- 2-5 E I- T-
- - 4 E E E-
/1
- - b T
O e o . .eE5 x_++5?0 - - t22 -
- - E EeS1 9 Of 1 -
D d - - ! g 1-
- 5 r_ 3- - ~ . 6i - .. - -
. 03.S6 %4!
E l
. - - . . 6] EE /3 FEE F 5I gE E %E9- EE - 33 o t. 3- 6.2 3+
t tt 5. S. 36 t4 0 55 5-S 5 5s - - - - - EE CE LE et f- +- 5. f 1 I 4
- .0 3
+f4 . s. + -15'I t
4+5_2I .
- - O E eE2I
- - - s3 EEe- - 3IF- -
EEE - - eEe- - W l 7 l C 812 sC 6t!C1 - - t
. . . - - 4d.ff 5I 5E Eg
- 3l 9s- se
%2g es 1jcEE 2 Vl $. 4-
- s. t. . .
]g E
g9 9l r le
)
f
- t %r9 ;l' f
.F'
'ig ;,
,I
,4$N il tbQ gL i
t 5js .e6$ 15 .R4. g D- 1 - 9 G .d g, Q_ s99 B} Tt_ e g-f_ $- -8 - 6s' +. 24 a. {- 7 5 l. R-s f . C l_ 4g i"2 2.G. . .- l
)
_I "6 9.3gf} 3sf - 3( 3. 4 6- .g 9t
. e g c- t 65
/4 egg j s.
5 T gy 9g 4 s3
, o. 9 2 *. 9 1q j,
. 3 $q S3 l
f li 93 i!' ili ? 3l I 5 SC tS- 566 S ES 6k 5 EE SE EEE - O yu
. 9S5 33
. . 95 D. 81 2I 953-I /
E 1 9 s l.9.f C-l E cf n ea EEE- - E- E l EE- l6 U. E- e f7 u qs
$ E 8 o06 AfN
.(tl. B. t i3
- 5. s. H E E f- ea 9 s- EE
- 2 9 s E- E l p3t 9 r TG 4. I. tE 4s f s
_ f 1 93 u 9f t. 0 f 53 sl-J- en 1 ge l .' lll' ad mi ac _ d c
. e
) IA , rt ou co 0 . 4 T - _ l c 4 aa 9-5 5 55 d . 55 tl 5 - - 5- - - ob w - _5 - - Ee 2 eE t E8 6 E 2 ps w _5+}3 - 2 4 5 5 2'. 0 4- 55 53L. 150.a ! 1 L - f o oi p - -
/. C S_ E e- g9
- - 2 - - I
- J
~'. sa
- l _ eE - . l
- E E, E - E e-et 46S 96 .C 6? us 1 -
4 l 4.66 q . 50 - f - - G 1- --
/
f (,
. t
_ t a e f 7-E 5 e E. 519E e 00 S 3 . fI EsE l f 3 s Ee l ar vo _ s u t 7 Q. S. g R S 3f 9
!. L.
n, !. 31 S.l d Y uI o o l s t e a Ces = =: m A a u.
-4 K dc I A
se. o i t s e o
- e h o D o e e d -w a E G d F o p _ e t
a
- s. _ 5 5- _5 - b S 5 a
5 5_- - - l u 6 . a r _ 4s E E - _8 E E1 9 5 8a EE b 45 S-i M A s e _ _3 4
- - $. & t+5 . 39
- S. I 4 s- - T a
O F o - - E, 4 i.sG 1 e ail - _E e2t r 9- - L ' Es-Q 3 S 3S 6 e9 - i
.d . S 13l. s4.
C
,S 5EE 1
<tL 3 g. s 4- -
4 8 4, u l e2 S. 3
- l 1 S.
3l 4f3 er- R eB T. B . C e g4 5. o. s 4t l b a T d 5-
$ 55
- S 9-E G E E- s-39Ye9 V* E 9 /
94 S t o_ t4 5e6E
- - s s. -
EG6l yl . 3E en2G9 - - E Ge m_ a 3T
- a. :_f Y I 9
733 4e 55
~
c, $g.5 tgb - l
)
. 3fS -
C - flFs- c S 3 eE
'-e E 2 e- -
sl gL D. 6 . 9. I L s o. A.I 5C . 9 t. l j se e (L Q24 t@ - f)9 4 fi ;j f Q7l'fM
\ . '
,'l.
reliability of the diesels are the most important factors in limiting the likeli-l hood of core damage. These results also show that the likelihood of significant l l core damage may exist at some plants if the capability to cope with station black-out of modest durations (2 to 8 hours) does not exist. Moreover, the results show that the demand reliability of AC-independent decay heat removal systems is important, but it is not the most dominant factor in limiting the like li-
., hood of core damage for staticn blackout.
[ The point estimates obtained from NUREG/CR-3226 and a comparable plant design analyzed in this study are shown in Table C.5. The differences in results pri- {
} marily result from lower loss of offsite power frequencies supported by most T-recent evaluations of the data (see Appendix A).
b l ! t The results provided up to this time represent point estimates of probability
, per year or, more properly, frequency. The effect on the mean probability i
estimates of using log-normal distributions to represent basic event probabil-
, ities, calculated medians, and uncertainty ranges was shown in NUREG/CR-3226.
3 The sequence mean estimates derived in that document were typically 3 to 8 times { larger than the point estimates, and the upper and lower bounds were typically x within a factor of 5 to 20 of the median estimates. The large difference bet-ween point estimates and means can be attributed to the use of a log-normal distribution. The potential effect of operator error causing loss of decay heat removal has not been found to be a large contributor, if adequate training and procedures exist. Another consideration that has not been found to be a significant factor i is the difference in time to core uncovery on loss of all decay heat removal.
)
STATION BLACK 0UT RISK - n
;)
Iobe prw A. l bet" - MVRE6-IISO mshs . 2 The potential risk associated with station blackout acciden carrbferrtimated d by extending the core damage probabilistic resul rough to accident conse-I l i- quence estimates. The potential for t ating core damage before core melt ! a i and coping with core melt pri containment failure is currently a matter of I
. n.
extensive research a aluation. In most probabilistic risk assessments (PRAs),
] , the pro of core damage has been equated with core melt. Acknowledging h
~
~
f NUREG-1032 C-15
'a
Table C.5 Comparison of results with NUREG/CR-3226 Core damage frequency (per reactor year) Plant type and sequence NUREG/CR-3226 NUREG-1032
. PWR with one steam-driven T hy ugaYd-AFW train ,
/, ter
*f TML181 5 x 10 8 '3-x-10 8
[ TMB 2 (L2 + Q2) 2 x 10 5 4 x 10 8 h BWR with isolation cooling TM(U1 + Q1)B1 5 x 10 8 3 x 10 8 4; TMQ2B2 2 x 10.s 4 x 10 8 3 t BWR with HPCI/RCIC TMU181 2 x 10 8 6 x 10 7 2 x 10 5 4 x 10 8 TMU22B 1 BWR with HPCS/RCIC TMU181 5 x 10 7 3 x 10 7
' .g
} TMU22B 1 x 10 8 2 x 10 8 Note: All B2 sequences except the BWR with HPCS/RCIC are assumed to result in loss of core cooling and decay heat removal in 6 hours from the start of station blackout for the NUREG-1032 results. Core damage
; frequencies in this table (NUREG-1032 column) are based on offsite power cluster 1/2 diesel generator configuration and 0.975 diesel generator rel ability.
.i k 4 a
i i IK C q O p - NUREG-1032 C-16 _h
- j
)
I i
, that this is a possible conservative assumption, to estimate risk in .these PRAs, l containment failure modes and probabilities are applied as if the core has melted.
This type of approach was taken to develop a risk perspectiv station black-out. However, the potential for accident management and evised consequence
~
estimates emanating from current research are also sidered.
~
4 t . f i j The risk of a station blackout accident can eestimatedbytheproductofthel 3 l core damage frequency and consequence o the accident. Figure C.1 shows the l
}t sensitivity of station blackout acc ent risks to containment type and effective-l ness. Risks are highest in seq ces in which core damage occurs after a j).
l station blackout and then pr. eeds to core melt and containment failure without! f j actuation of containment prays (PWR, BWR Mark III) or when suppression pool f scrubbing is ineffect' e (BWR Mark I, II, III). With the actuation of contain-ment sprays befor containment failure (if AC power is restored after core melt),
; risks are red d noticeably for pidnts with limited capability of coping with station b kout (less than 8 hours). With effective fission product scrubbing by BW suppression pools, risks are even further reduced. However, suppression
- pool bypass or less effective scrubbing could cause less apparent risk reduction than indicated here.
REFERENCES Fletcher, C. D. , "A Revised Summary of PWR Loss-of-Offsite-Power Calculations," l
', EG&G Idaho, Inc., EGG-CAAD-5553, September 1981.
- 1 '
Schultz, R. R. and S. R. Wagoner, "The Station Blackout Transient at Browns Ferry Unit One plant, A Severe Accident Sequence Analysis," EG&G Idaho, Inc., i EGG-NTAP-6002, September 1982. 7j v U. S. Nuclear Regulatory Commission, NUREG/CR-3226, A. M. Kolaczkowski and A. C. Payne, Jr. , " Station Blackout Accident Analyses (Part of NRC Task Action Plan A-44)," May 1983. 1 NUREG-1032 C-17 ;
\
/
\T - No sprays with/
k AC recovery f
\ Sprays actyated on AC recp9ery
-\ \\ \ \ : Suppression pool scrubbing x Scrubpfngandsprays
\ %\ s N %N N N N %N N %N s'
\ % --
_ Large Dry (wet cavityl s h \/ / e*%. %% Substmospheric er,eMark o,, i,leet co.it , 1
^
%% *% ll
{.
/\ ice Condenser Subetmospheric t
- b. s/ N
' N ';;e *,",""'
c) Mark lli 5 % N s s% Large Dry (dry cavity) to E , urge Dry (dry cavityl m
-f10 1 -
/
E
/
- Mark i tr it
! i l
1
- Mark til
" % " ;" Mark til I I I I I 0
0 8 12 16 20 24 O 4 Capability of Coping with Station Blackout 1 (hrs) 1 Figure C.1 Station blackout risk perspective for different containments NUREG-1032 C-18
.._.-._...----.?-:--.. .
1
wtS f, 4 APR 151987 MEMORANDUM FOR: Victor Stello, Jr. Executive Director for Operations FROM: Eric S. Beckjord, Director Office of Nuclear Regulatory Research
SUBJECT:
FINAL RULE AMENDMENTS TO 10 CFR PARTS 30, 40, 50, 51, 70, AND 72: REQUIREMENTS FOR DECOMMISSIONING NUCLEAR FACILITIES Enclosed for your consideration is a Commission paper concerning final rule amendments to 10 CFR Parts 30, 40, 50, 51, 70, and 72 containing general re-quirements for decommissioning nuclear facilities. The amendments cover all NRC licensed facilities except waste disposal facilities and uranium mill tail-ings which have been covered separately in Parts 60 and 61 and in Appendix A of Part 40. The amendments contain criteria in the following areas: ) acceptable decommissioning alternatives; planning for decommissioning; assurance of the availability of funds for decommissioning; and environmental review requirements related to decommissioning. The purpose of these amend-ments is to' assure that decomissionings will be carried out with minimal impact to public and occupational health and safety and to the environment, and in addition, to provide a regulatory framework for more efficient and con-sistent licensing actions related to decommissioning. A proposed rule on decommissioning criteria for nucle 6r facilities was pub-lished (50 FR 5600) and a total of 143 different organizations and persons submitted comments on the proposed rule. The topics addressed by the com-menters included a range of issues, covered all parts of the proposed rule, and presented a wide diversity of viewpoints. The staff has reviewed the public comments and obtained input from NRC contractors where necessary. Modifications have been made to the rule as a result of some of the comments, however for most of the coments only clarification and reinforcement of statements made in the Supplementary Information portion of the proposed rule are required. The paper recomends that the Comission approve publication of the final rule amendments (Enclosure A) in the Federal Register to be effective 30 days after publication. 1 i
~
E . l 1
4 ,> Victor Stello, Jr. 2 APR 1519E7 The Offices of Nuclear Reactor Regulation, Nuclear Material Safety and Safeguards, Inspection and Enforcement, State Programs and Administration con-cur in the enclosed paper. .The Office of the General Counsel has reviewed the enclosed paper. PA has prepared the draft public announcement. I ! Eric S. Beckjord, Director Office of Nuclear Regulatory Research
Enclosure:
Comission Paper wfencls. DISTRIBUTION: Res Files MB r/f MB s/f ESBeckjord DFRoss GAArlotto CZSerpan KGSteyer PErickson, NRR RWood, SP' MLesar, ADM LRouse, NMSS MKearney, NMSS WBelke, IE JMapes, OGC CFeldman FCardile TSpeis 1
. f RES:MB' RES:MB RS/MB R : / DES R : RES:DD RES:DI Cardi :h KSteyer CSerpan LCShac r otto DFRefs ESBeckjord 4/6/8 4/ b/87 4/ 7 /87 4/[/87 /l}/87 4/)/87 4//E/87 t__________________________ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _
j
e- )
/
l l' For: The Commissioners From: Victor Stello, Jr., Executive Director for Operations
Subject:
FINAL RULE AMENDPENTS TO 10 CFR PARTS 30, 40, 50, 51, 70, ; AND 72: GENERAL REQUIREMENTS FOR DECOMMISSIONING NUCLEAR FACILITIES
Purpose:
To obtain' Commission approval to publish a final rule that amends 10 CFR Parts 30, 40, 50, 51, 70, and 72 by setting forth technical and financial requirements for decommis-sioning nuclear facilities. Summary: The amendments contain general requirements for decommis-sioning and cover all NRC licenseo facilities except waste disposal facilities and uranium mill tailings which have been covered in separate rulemakings. A proposed rule on decommissioning criteria was published (50 FR 5600) for public comment. The public comments have been reviewed and, in response, clarifications to statements in the Supplementary Information of the proposed rule and some modifications of the rule text, as appropriate, have been made. Category: This paper covers a minor policy question requiring Commission approval. Resource estimates: Category 1, preliminary. Issue: Should financial assurance for decommissioning be required and should more specific technical requirements for decom-missioning be codified. Discussion: Background. In March 1978, the Commission announced in the Federal Register (43 FR 10370) its intention to reevaluate its decommissioning policy and to consider amending its regulations in this regard. The policy reevaluation included the development of an information base, a series of studies by Battelle Pacific Northwest Laboratories on the technology, safety and costs of decommissioning various types of nuclear i facilities, and the preparation of a draft generic environmental 1 impact statement (January 1981). Contacts: K. R. Steyer, RES, 443-7739 l j
* )
j The Commissioners 3 l With regard ta decommissioning alternatives, a number of commenters indicated that the rule does not contain sufficient criteria for use in choosing and evaluating the decommission-ing alternative to be used. The staff response indicates i that major changes to the amendments are not necessary, however, for clarification, the amenaments have been modified to provide some additional detail on the factors affecting the accept-ability of alternatives. A number of commenters expressed differing opinions as to the advantages and disadvantages of the alternatives (DECON, SAFSTOR, ENTOMB) and different opinions as to which should be acceptable. The staff response indicates that the NRC has considered the advantages and disadvantages of the different alternatives, and that the studies done for NRC by Battelle Pacific Northwest Laboratory indicate that the alternatives considered to be reasonable options by the rule : satisfy the definition of decommissioning and can be performed safely and at reasonable cost. Within these general parameters, the NRC's review of a licensee's decommissioning plan vill consider site specific factors which may affect use of an alternative. With regard to planning for decommissioning, a number of commenters were concerned that there shotid be more specific requirements in the regulations applic 61e to the actual conduct of decommissioning activities. The scaff response indicates that major changes to the amendmcits are not necessary because they contain the requirements necessary to assure that decommissioning is carried out safely by requiring submittal of a decommissioning plan. The required plan would contain the licensee's means for complying with applicable existing regulations (for example,10 CFR Part 20), which, although they may not all specifically mention decommissioning, can be used as appropriate, to evaluate the conduct of decommissioning activities at reactors and other facilities. For clarification, the amendments have been modified to provide some additional detail on the content of the decommissioning plan. With regard to financial assurance, comments on decommission- ! ing costs and funding methods were received. The accuracy of ' the estimates of decommissioning costs made by Eattelle Pacific Northwest Laboratory for the NRC was disputed by commenters. PNL has reviewed the comments and updated its estimates. The staff response contains a discussion of each of the commenters concerns and indicates why the pNL estimates provide a basis for reasonable assurance of funds for decommissioning. l 1
OI \ l f 1 [ The Commissioners 5 l 1 Having considered all public comments received, the staff continues to believe that the rule's approach presents the best available method for assuring that licensees develop plans sufficient to carry out decommissioning in a manner which protects public health and safety. Therefore, the staff recommends that a final rule, as modified, be pro-mulgated containing general requirements for decommissioning i nuclear facilities, Reso'Jrce Requirements The resource requirements were discussed in the Commission paper for the proposed rule and have not changed appreciably for the final rule. The final rule will have some impact on manpower needs in NRR, NMSS, the Regions, and RES. Because the rule would provide for more efficient and effective licensing action at the time of decommissioning and reduces some requirements for environmental reviews, the overall net change in manpower needs as a result of this rule if made effective is estimated to be insignificant over the long term. The most significant impact on resource requirements is the review of decommissioning funding plans for existing licensees. This is estimated to involve approximately 4 man-years effort per year over a 2-7 year period following the effective date of the finL1 rule (24 man-years total), these responsibilities being in NRR, HMSS and the Regions. These resource require-ments need to be figured into manpower allocations over that time period. In addition, in connection with this rule, implementing regulatory guides are planned for issuance. Updating of the information base which aids in the imple-mentation of the final rule is also planned. This would reouire manpower in RES, NRR, and NPSS, a continuation of the present level for these activities of 5 man-years per year over the next few years. Even if no additional rules or regulatory guides were to be published, resource requirements related to decommissioning would increase in the future as more major facilities reach the end of operating life. 1
_. t
.The Commissioners 7 (f) The Federal _ Register notice of final rulemaking-will be distributed to affected licensees and other interested parties.
(g) A public announcement, such as Enclosure D, will be issued at the same time the notice of final rulemaking is published in the Federal Register. (h) A Regulatory Analysis has been performed (Enclosure B). l (i) In accordance with 10 CFR 50.109, a backfit analysis has been performed which indicates that costs of implementation of this rule are minimal and are considered justifiable and warranted compared to the substantial potential increase in public health and safety. Information relevant to the backfit factors specified in 10 CFR 50.109(c) is set out as part of the Supplementary Information to the Final Rule (Enclosure A) and in the Regulatory Analysis (Enclosure B). Scheduling: If scheduled on the Commission agenda, recommend this paper be considered at an open meeting. No specific circumstance is known to staff which would require Comission action by any particular date in the near term.
-Victor Stello, Jr.
Executive Director for Operations
Enclosures:
As stated SEE ATTACPED FOR PREVIOUS CONCURRENCES NRR IE RES:DD SP ADM OPA EDO OGC HDenton JMTaylor DFRoss GWKerr PGNorry JFouchard VStello v'CParler 3/12/87 3/16/87 / /87 3/11/87 , 3/12/87 3/2/87 / /87 / /87 RES:MB RES:MB RES:MB RES:DD/ DES RES: DES NMSS RES:DIR GAArlotto HThompson EBeckjord "Ro
/1 FCardile:h KSteyer CSerpan LShao 2/24/87 2/24/87 2/25/87 2/26/87 2/26/87 4/2/87 t/. / r M87 l
The Commissioners 6
-(f) The Federal Register notice of final rulemaking will be distributed to affected licensees and other interested parties. l (g) A public announcement, such as Enclosure D, will be issued at the same time the notice of final rulemaking is published in the Federal Pegister.
(h) A Regulatory) (Enclosure B . Analysis has been perfomed (i) In accordance with 10 CFR 50.109, a backfit analysis has been perfomed which indicates that costs of implementation of this rule are minimal and are considered justifiable and warranted compared to the substantial potential increase in public health and safety. Infomation relevant to the backfit factors specified in 10 CFR 50.109(c) is set out as part of the Supplementary Infomation to the Final Rule (Enclosure A) and in the Regulatory Analysis (Enclosure B). Scheduling: If scheduled on the Comission agenda, recomend this paper be considered at an open meeting. No specific circumstance is known to staff which would require Comission action by any particular date in the near term. I l Victor Stello, Jr. Executive Director for Operations
Enclosures:
As stated
\ IE RES:DD SP ADM OPA EDO OGL tbn JMTaylor DFRoss GWKerr PGNorry JFouchard VStello WCParler
.1 87 / /87 / 7 / 87 / /87 / /87 / /87 / /87 m _ JJ// 1 CST @[9d)
RES:MVV RES:PBW RESJ': RES- ? ES RES3&S NMSS RES:DIR FCardfJ e:h KSteyer g GAAfletTo HThompson EBeckjord
>Pf/87 f f 'f/87 0 f.7T787 % bc/ 3 1 fag /87 / /87 / /87
s e The Commissioners 6 (f) The Federal Register notice of final rulemaking will be distributed to affected licensees and other interested parties. (g) A public announcement, such'as Enclosure D, will , be issued at the same time the notice of final ) rulemaking is published in the Federal Pegister. l (h) A Regulatory) (Enclosure B . Analysis has been perfomed ! (1) In accordance with 10 CFR 50.109, a backfit analysis has been perfomed which indicates I that costs of implementation of this rule are minimal and are considered justifiable and i warranted compared to the substantial potential increase in public health and safety. Information relevant to the backfit factors specified in , 10CFR50.109(c)issetoutaspartofthe Supplementary Infomation to the Final Rule (Enclosure A) and in the Regulatory Analysis (Enclosure B). Scheduling: If scheduled on the Comission agenda, recommend this paper be considered at an open meeting. No specific circumstance is known to staff which would require Comission action by any particular date in the near term. Victor Stello, Jr. Executive Director for Operations i
Enclosures:
As stated i NRR HDenton fhrMr DFRoss JMT aj RES:DD SP GWKerr ADM OPA EDO OGC PGNorry JFouchard VStello WCParler
/ /87 y/g / 7 / 87 / /87 / /87 / /87 / /87 RES:MVV RES:PBP RES'J-FCardN e:h KSteyer L RES-d Ed RES3@5 NMSS RES:DIR HThompson EBeckjord CSfrtiti GAAfle1To A F//87 ##T87 Q /2f787 R bc/ y 3 gz & /87 / /87 / /87 i
4 l l j
b e 3 EEGO UNITED STATES 8[A n NUCLEAR REGULATORY COMMISSION t -p WASHINGTON, D. C. 20655
%n..../ m n na MEMORANDUM FOR: Eric S. Beckjord, Director Office of Nuclear Regulatory Research FROM: Hugh L. Thompson, Ji., Director Office of Nuclear Material Safety and Safeguards i
SUBJECT:
OFFICE CONCURRENCE REQUEST: FINAL RULE AMENDMENT TO 10 CFR PARTS 30, 40, 50, 51, 70, AND 72 ON GENERAL REQUIREMENTS FOR DECOMMISSIONING NUCLEAR 7ACILITIES As requested in your memorandum dated February 27, 1987, we have reviewed the subject final rule. We concur with the rulemaking package, subject to the j following: ;
- 1. The Commission Paper should include an expanded explanation of the implementation process involved. This should include the estimate that 21 staff-years will be required over 5 years, and a statement that this resource requirement is not presently budgeted.
- 2. The effective date for material licensees should be two years after publication rather than one year, in order to provide opportunity to obtain the required resources through the budget cycle, and to allow time to prepare guides and standard review plans for acceptance of l decommissioning proposals. The two-year effective date is already specified for reactors.
- 3. The Commission Paper should include a statement that the staff will prepare appropriate guides and review plans during the two-year period.
4 Incorporation of editorial text changes. The editorial text changes in Item 4 have already been agreed to by your staff. The NMSS staff will be pleased to assist in drafting the Commission Paper to accommodate the other matters.
.- ).Ol-
/
T. s - ,jo I I du L JP\ Hugh . Thompson, r. rector Offic of Nuclear M er al Safety l and Safeguards CONTACT: l John Hickey, NMSS 74093 l N ______ _ _____
0 Mo oq h ,[ Ls, 4
,p t V
.,bg UNITED STATES I
[d 'O 2, NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20535 l
'f
%.....+ MAR 121987
)
PEMORANDUM FOR: Eric S. Beckjord, Director Office of Nuclear Regulatory Research FROM: Patricia G. Norry, Director Office of Administration
SUBJECT:
GENERAL REQUIREMENTS FOR DECOMMISSIONING NUCLEAR FACILITIES The Office of Administration concurs in the final rule that would amend 10 CFR q Parts 30, 40, 50, 51, 70, and 72 concerning technical and financial requirements i and licensing procedures for the decommissioning of nuclear facilities. We have enclosed marked pages indicating a number of minor editorial corrections that should be made before the document is submitted for signature and publication. The authority citations for Parts 50 and 72 have been revised in a recently published final rule. We have enclosed the correct authority citations for those parts. These citations should be presented as revised citations in this document to correct minor format and content errors. In order to assist your staff in preparing the list of documents centraily relevant to the final rule required by NRC's regulatory history procedures, the designator "AA-40" should be placed in the upper right hand corner of each document concerning this final rule that is forwarded to the Document Control System. If you have any questions, please have a member of your staff contact Michael T. Lesar, Rules and Procedures Branch, Division of Rules and Records,on extension 27758. d Patricia G. Norry, Dire tor O'fice of Administrate n
Enclosures:
As stated
)i
. i-p t"* " C% UNITED STATES fi t NUCLEAR REGULATORY COMMisslON f*
'T '
e WASHINGTON, D. C. 20555
\*****/ MAR 111987 MEMORANDUM FOR: Eric S. Beckjord, Director Office of Nuclear Regulatory Research ,
FROM: G. Wayne Kerr, Director Office of State Programs
SUBJECT:
OSP CONCURRENCE IN FINAL DECOMMISSIONING RULE OSP concurs in the final decommissioning rule as transmitted by your memorandum dated February 27, 1987. However, we have two minor coments and a few editorial coments (see attached copies of relevant pages) that we ask you to - consider for the next version. These are: '
- 1. On page 2 of the rule, the last part of the 2nd paragraph discusses reuse of facilities for nuclear purposes. At some point, although not necessarily in this rule, the NRC will have to decide whether to allow licensees to use funds accumulated for decommissioning for refitting facilities.
- 2. On page 8, second to last line of the regulatory analysis, the parenthetical statement is confusing. Our understanding is that' power reactor licensees would also be allowed to submit a funding !
estimate that was lower than the prescribed amount, if based on a ! site-specific study. Any questions on these coments should be directed to Robert Wood of my staff.
.V G. Wayne K r, Director Office of State Programs
Enclosure:
As stated 6 1 .
)
., ,s
'o,, UNITED STATES
[ p, NUCLEAR REGULATORY COMMISSION
$ E WASHINGTON, D. C. 20555 e !
%...../
March 3, 1987 NOTE FOR Chuck Serpan, Jr. , , RES: DES:MD Enclosed is the " decommissioning package" which you sent for OPA concurrence. I have concurred with the stipulation that some changes be made in the draft i public announcement (Enclosure D). Accordingly, a marked up copy of the public announcement together with a clean-typed version also are enclosed. If you have any problems, let me know before the package moves forward to the Commission. Frank L. Ingram Assistant to the Director Office of Public Affairs Enclosures g e'
, /> 07 t/0 7 7 2 p 1
- s. .
7 [7590-01'] I: NUCLEAR REGULATORY COMMISSION
'10 CFR Parts 30, 40, 50, 51, 70, and 72 l, General Requirements for Decommissioning Nuclear Facilities AGENCY: Nuclear Regulatory Commission.
ACTION: Final rule. a.
SUMMARY
- The Nuclear Regulatory Commission is amending its regulations to set forth technical and financial criteria for deccamissioning licensed nuclear facilities. The amended regulations address decommissioning plan-ning needs, timing, funding methods, and environmental review requirements. -l
-The intent of the amendments is to assure that decommissioning of all i
licensed facilities will be accomplished in a safe and timely manner and that adequate licensee funds will be available for this purpose. The final rule also contains a response to a petition for rulemaking (PRM 22), concerning decommissioning financial assurance, initially filed by l the Public Interest Research Group (PIRG), et al. on July 5, 1977. I EFFECTIVE DATE: [ Insert a date to allow 30 days following publication in the Federal Register]. FOR FURTHER INFORMATION CONTACT: Keith G. Steyer or Frank Cardile, Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission, Washington, DC 20555, telephone (301)443-7739. I 1 Enclosure A
. .~
[7590-01] L l- SUPPLEMENTARY INFORMATION: 1 l Introduction The NRC is amending its regulations to provide specific requirements 1 for the decommissioning'of nuclear facilities. Specifically the regula-i tions establish criteria in the following areas: acceptable decommission-l ing alternatives; planning for decommissioning; assurance of the avail-ability'of funds for decommissioning; and environmental review require- _. ments'related to decommissioning. Decommissioning as defined in the rule means to remove' nuclear facilities safely from service and to reduce residual radioactivity to a level that permits release of the property for unrestricted use and termi-nation of the license. Decommissioning activities are initiated when a licensee decides to terminate licensed activities. Decommissioning activi-ties do not include the removal and disposal of spent fuel which is con-sidered to be an operational activity or the removal and disposal of non-radioactive structures and materials beyond that necessary to terminate the NRC license. Disposal of nonradioactive hazardous waste not necessary i for NRC license termination is not covered by these regulations but would be treated by other appropriate agencies having responsibility over the nonradiological portion of decommissioning. If nuclear facilities are to be reused for nuclear purposes, applications for license renewal or amend-ment or for a new license are submitted according to the appropriate i existing regulation. Reuse of a nuclear facility for other nuclear purposes is not considered decommissioning because the facility remains under license. i These amendments apply to the decommissioning of power reactors, nonpower reactors, fuel reprocessing plants, fuel fabrication plants, 2 Enclosure A
'a 9
[7590-01] uranium hexafluoride production plants, independent spent fuel storage installations, and nonfuel-cycle nuclear facilities. The decommission-ing of uranium mills and mill tailings, low-level waste burial facilities, and high-level waste repositories, has been treated in' separate regula-tory actions. These amendments apply to nuclear facilities that operate l I through their normal lifetime, as well as to those that may be shut down prematurely. The purpose of these amendments is to assure that decommissioning will be carried out with minimal impact on public and occupational health and safety and the environment. In addition, the amendments provide a regulatory framework for more efficient and consistent licensing actions related to decommissioning. Although decommissioning is not an imminent health and safety problem, the nuclear industry is maturing, in that nuclear facilities have been operating for a number of years, and the
- number and complexity of facilities that will require decommissioning is expected to increase in the near future. Inadequate or untimely consid-eration of decommissioning, specifically in the areas of planning and financial assurance, could result in significant adverse health, safety and environmental impacts. These impacts could lead to increased occupa-tional and public doses, increased amounts of radioactive waste to be disposed of, and an increase in the number of contaminated sites. The regulations make clear that the licensee is responsible for the funding and completion of decommissioning in a manner which protects public health and safety. Current regu'lations cover the requirements and criteria for decommissioning in a limited way and are not fully adequate to deal with licensee decommissioning requirements effectively. Many licensing activities concerning decommissioning have had to be determined 1
I 3 Enclosure A
[7590-01] J on a case-by-case basis'. This procedure results in inconsistency in dealing with licensees and in-inefficient and unnecessary administrative effort.' With the increased number of decommissioning expected, case-by-case procedures would make licensing difficult and increase NRC and licensee staff resources needed for these activities. Background - 1 J On March 13, 1978, the Commission published an Advance Notice of ) Proposed Rulemaking in the Tederal Register ~ [43 FR 10370] stating that i the Commission was reevaluating its decommissioning policy and consider- l I ing amendments to its regulations to provide more specific requirements
-]
l relating to the decommissioning of nuclear facilities. The plan for the j reevaluation included the development of an information base, the pre-paration of a generic environmental impact statement (GEIS), and based on these, the development of amendments to the regulations. The infor- I mation base .for preparation of the final rule is complete and consists primarily.of a series of NUREG/CR reports on studies of the technology, safety, and costs.of decommissioning various kinds of nuclear facilities. These reports were prepared by Battelle Pacific Northwest Laboratories (PNL).1 In addition, preliminary staff positions on the major decommis-sioning issues have been presented in staff (NUREG) reports. On February 10, 1981, the Commission announced the availability of the draft GEIS for public comment [46 FR 11666]. Section 15 of the draft GEIS 2A bibliography of the PNL and NRC staff reports and other background documents is included at the end of the supplementary information. These documents are available for inspection and copying for a fee in the Commission's Public Document Room at 1717 H Street NW., Washington, DC 20555. 4 Enclosure A
t .. [7590-01] contains certain policy recommendations. These recommendations, as modi-fied by comments received.on the draft GEIS and other sources, provided the. basis for the proposed amendments to the Commission's regulations. On February 11, 1985, the Commission published a Notice of Proposed-Rulemaking on Decommissioning. Criteria for Nuclear Facilities (50 FR 5600). The proposed amendments: covered a number of topics related to decommission-ing that would be applicable to 10 CFR Parts 30, 40, 50, 61, 70, and 72 applicants and licensees. The original comment period was due to expire May 13, 1985, but was extended to July 13, 1985 to accommodate requests from interested parties for an extended comment period in order to fully evaluate the issues raised and develop comments on the proposed rule. Public comments. received on the proposed rule were docketed and may be examined at the Commission's Public Document Room located at 1717 H Street NW., Washington, DC. Acceptable levels of residual radioactivity for release of property for unrestricted use were not proposed as part of this rulemaking. A separate rulemaking action is under consideration to address this issue. Commission staff is participating in an interagency working group, organ- J
)
ized by the Environmental Protection Agency (EPA), developing Federal j l guidance on this subject. In conjunction with this activity, EPA has ' issued an advance notice of proposed rulemaking (51 FR 22264, June 18, 1986). Overview of Comments on Proposed Rule A total of 143 different organizations and persons submitted comments on the proposed rule. The commenters represented a variety of interests. Comments were received from Federal government agencies, State agencies 5 Enclosure A
[7590-01] (including State public utility commissions), local governments, univer-sities, individuals, electric utilities, material licensees, public groups, utility and industry groups, and financial, legal, and engineering firms. The commenters offered from one to over 50 comments each and presented a diversity of views. The topics addressed by the commenters addressed a wide range of issues and all parts of the rule. The general response to the rule was varied. A number of commenters specifically expressed support for the rule as a whole (or that no comment was needed), although some of these made suggestions for improvements. One commenter indica.ed that "the proposed amendments will provide a foundation from which acceptable decommissioning planning and implementa-tion programs can be developed," and another stated that "the Commission's assumptions underlying the proposed rule are reasonable and fair." Many specifically commented on the need for rulemaking. For example, one commenter stated that although some states have begun developing regula-tions, their efforts are hampered by the lack of Federal guidelines and another commenter urged the Commission to " promulgate a comprehensive set of regulations governing the planning, safety, and financing of decommis-sioning with speed." Others implied the need for rulemaking but felt that the proposed rule was inadequate to satisfy its intent and generally recommended stricter, more detailed regulations. A few of these suggested the rule be redrafted and republished for comment. In contrast, some commenters argued that existing rules were adequate and that this rule was unnecessary, overly prescriptive, and burdensome. For example, one commenter indicated that there is no evidence from experience with power reactors that there would be any adverse impacts in the absence of 6 Enclosure A
. 4 [7590-01]- 8 this rule and that this rule represented an unfair burden to nuclear power facilities compared to other public risks; and another pointed out that decommissioning methods are regulated by public utility commissions and that NRC should only step in to ensure safety. The detailed rationale supporting these general comments is presented in the succeeding sections of this Supplementary Information. Modifica- I tions have been made to the rule as a result of some of these more specific comments. Based on its consideration of the comments, the Commission continues to believe that the rule's approach presents the best available method for assuring that licensees develop plans sufficient to carry out decommissioning in a manner which protects public health and safety. Major issues contained in the public comments and resulting changes in the rule are discussed below. The detailed responses to individual comments are documented in NUREG-1221 entitled " Summary, Analysis and Response to Public Comments on Proposed Rule Amendments on Decommission - ing Criteria for Nuclear Facilities" (Ref. 26). Copies of NUREG-1221 may be purchased through the U.S. Government Printing Office, P.O. Box 37082, t Washington, DC 20013-7082. Copies may also be purchased from the National Technical Information Service, U.S. Department of Commerce, 5285 Port Royal Road, Springfield, Va 22161. A copy is available for inspection or copying for a fee in the NRC Public Document Room, 1717 H Street NW., Washington, DC 20555. The discussion of comments in this Supplementary Information is structured according to the general subjects treated by the rule and discussed in the Supplementary Information to the Proposed Rule. These subjects include, in order of discussion, decommissioning alter-natives and timing, planning, financial assurance, residual radioactivity limits, environmental review requirements, and other general comments. 7 Enclosure A
l . ..
.[7590-01]
Summary'and Discussion of Comment's on Proposed Rule
'A. Decommissioning Alternatives and Timing. Comments received on the subject of decommissioning alternatives covered several areas. These included clarification of the definition of decommissioning, criteria used'for the choice of.the alternative in particular. cases, and general questions as to acceptability of the decommissioning-alternatives.
- 1. Definition of decommissioning. Three commenters felt.that requiring unrestricted use as part of the definition of decommissioning
.is too restrictive. Reasons given for.this comment include the fact that it would inhibit future use of the site and would preclude alternative' decommissioning methods which provide reasonable assurance of public health and safety without releasing the site for unrestricted use. In contrast three commenters stated that decommissioning should clearly result in safe unrestricted use of the site.
In response, it is the Commission's belief that there is nothing in the definition which would inhibit future use of the site once the license is terminated. According to amended 6 50.2 (and related sections in the other parts) decommissioning is defined as resulting in release of the property for unrestricted use and termination of the license. Unre-stricted use refers to the fact that from a radiological standpoint, no hazard exist at the site, the license can be terminated, and the site can be considered an unrestricted area. This definition is consistent with the definition of an unrestricted area as it exists in 10 CFR 20.3 as being "any area access to which is not controlled by the licensee for purposes of protection of individuals from exposure to radiation and radioactive materials and any area used for residential quarters." The 8 Enclosure A
[7590-01]
' specific future use of the site after the license is terminated is out-side the scope of this rule. With regard to reuse of the site for nuclear purposes, there is nothing in the rule preventing such reuse. As indi-cated above, reuse of the nuclear facility for other nuclear purposes is
.not considered decommissioning. Therefore, a licensee would not be required to submit a decommissioning plan or apply for termination of license. The rule also does not limit the use of alternative decom-missioning methods which delay the completion of decommissioning thereby not releasing the site for unrestricted use during a period of radio-logical decay as long as the methods provide reasonable assurance of protection of public health and safety and there is a benefit in the use of the' delay. (See Sections A.2 through A.4 of this Supplementary Information.) The definition of decommissioning as well as the defini-tions of the alternatives contained in the Supplementary Information to the proposed rule indicate that, if permanent cessation of nuclear activity occurs at the facility, the licensee is to propose to NRC the method that it intends to use in decommissioning the facility in a manner ultimately leading to the return of the site to an " unrestricted area" according to the definition of 10 CFR 20.3 and the termination of the facility license.
Six commenters indicated that the rule needed to provide clarifica-tion as to what facilities are covered by the decommissioning rule. These commenters indicated that there appeared to be a discrepancy between the proposed S 50.2 which defined de' commissioning as removing a facility
" safely from service and reducing residual radioactivity to a level that permits release of the property for unrestricted use and termination of license" and the Supplementary Information which indicates that decom-missioning means to remove " nuclear facilities" from service including 9 Enclosure A
(- --_ -.- --- --_- _-- _ -- _ _. -- _ - _ _- - _ -- --____ _
[7590-01] e "tha site, buildings and contents, and equipment associated with any licensed NRC activity." Two commenters indicated that the rule should clarify that it does not apply to the nonradioactive portion of the facility. In response to this comment, the definition of decommissioning in S 50.2 clearly defines what is intended by this rulemaking, namely that decommissioning involves those activities necessary to remove a facility safely from service and to reduce residual radioactivity to a . level that permits release of the property for unrestricted use and termination of license. Section 50.82 indicates that a licensee must provide NRC with a plan indicating how these activities will be carried out and that this' plan will be approved if it demonstrates that the decommissioning will be performed in a safe manner. Section 50.82(f) indicates that the NRC will terminate the facility license if the terminal radiation survey demonstrates that residual radioactivity has been reduced such that the facility and site are suitable for release for unrestricted use. The definition of decommissioning in S 50.2 is general and its application in any given case will depend on specific circumstances. The decommissioning rule applies to the site, buildings and contents, and equipment associated with a nuclear facility that are or become contaminated during the time the facility is licensed, and to activities related to the definition of " decommission" in the amended regulations. The decommissioning rule will not apply to the disposal of nonradioactive i structures and materials beyond that necessary to terminate the NRC license. Disposal of nonradioactive hazardous waste not necessary for NRC license j termination is not covered by these regulations but would be treated by l 10 Enclosure A
[7590-01] other appropriate agencies having responsibility over the nonradiological portion of decommissioning.
- 2. Criteria used for choice of alternative. A number of commenters indicated that the rule does not contain sufficient criteria that a util-ity can use in choosing which decommissioning alternative should be used and that can be used in the review and evaluation of that choice. Some of these commenters pointed out that these criteria should factor in impor-tant considerations to be made in the choice, including clarifying what is sufficient benefit for delaying decommissioning, and that the choice of alternative be based on a detailed assessment demonstrating that the health and safety of the public is protected. These commenters indicated that better criteria on sufficient benefits should be included in the rule, specifically the degree of reduction in occupational radiation expo-sure, generation and disposal of waste, assurance that decommissioning will take place, radiation doses to the public, and quality of decommis-sioning operations. Other commenters mentioned that economic or other factors should also be included as Seing sufficient benefit including comparative cost of alternatives, presence of other facilities at the site, development of new decommissioning techniques, and need to store wastes or spent fuel at the site. Some commenters indicated that it was not satisfactory to include criteria on acceptable alternatives in regu-latory guides as is proposed in the statement of considerations while other commenters indicate that it is.
In response, it should be noted that the intent of the rule is to provide the necessary guidelines with regard to use of decommissioning alternatives in a manner which protects the public health and safety. 11 Enclosure A 1
f~ . . \ [7590-01]- L ( l Specifically, the rule includes requirements that, at the time of termi-j nation of operations, licensees submit a decommissioning plan to the NRC l l which contains an indication of the decommissioning alternative to be used and a description of the activities involved and the controls and l limits on procedures to protect occupational and public health and safety for that alternative. Discussion of how the decommissioning plan and the chosen alternative are evaluated in terms of protecting health and safety is contained below in Section B.2. The rule also stipulates that alter-natives which significantly delay completion of decommissioning, such as use of a storage period, will be acceptable if sufficient benefit results. The proposed rule has been modified to provide additional detail on the factors affecting acceptability (see S 50.82(b)(1)). These factors include the reduction of occupational and public radiation exposures associated with the different alternatives, considerations affecting waste disposal for the different alternatives, or other factors not related to protec-tion of health and safety, and other site-specific factors such as presence of other facilities at the site and capability to carry out decommission-l ing operations safely. Certain other factors, such as comparative costs j of the alternatives, or other factors not related to protection of , health and safety, are outside the scope of this rulemaking and are not included in the rule as forming part of the licensee's determination of sufficient benefit resulting from the chosen alternative. In addition, Regulatory Guide 1.86 will be revised to provide additional guidance on ; the decommissioning alternatives, specifically guidance on the factors ] affecting delay in completion of decommissioning. Use of the modified l I rule in conjunction with the regulatory guidance will provide for an i expeditious licensing procedure because the use of a specific alternative 12 Enclosure A
[7590-01] may involve case-by-case considerations. A licensee's proposed decom-missioning alternative will be reviewed based on the criteria and guidance discussed here and in Section.B.2 for acceptability in terms of completing decommissioning and protecting public health and safety. One commenter noted that neither the NRC nor the licensees can properly assess costs and benefits attributable to different alternatives due to the lack'of sufficient information on occupational exposure. The commenter noted that NRC had no experience with decommissioning large, aged reactors and that, for example, the experience at the cleanup at TMI-2 had shown the-workers were being exposed to levels six times higher than expected. l Thus, it is likely the decommissioning estimates of exposure are gross underestimates. In addition the commenter stated that there is much uncertainty with regard to radiation effects on human health. Further-more the commenter indicates that the Generic Environmental Impact State-ment on Decommissioning (NUREG-0586), which provides a basis for this ! rulemaking, does not adequately' address health and genetic effects. Hence , the commenter notes it is difficult to assess the proper alternative and that, in any event, in making assessments NRC should use conservative estimates. In responding to this comment it should be noted that NRC has had Battelle Pacific Northwest Laboratory (PNL) prepare detailed analyses of the technology, safety, and costs of decommissioning. These reports were ; prepared for a number of nuclear facilities and are listed in the Refer-ence section. The PNL reports contain estimates of expected occupational ! radiation exposures based on an analysis of work activities involved in decommissioning and radiation levels expected at the end of reactor life. j 13 Enclosure A l .. .. _ - _ _ _ _ _ - _ - _ . _ . _ _ - __ a
[7590-01] While it is true that no large, aged reactors have 'been decommis-
.sioned, the PNL reports represent a reasonable analysis of the occupa-tional dose which would be incurred at decommissioning. They provide sufficient information on which assessment of the costs and benefits 1
attributable to different alternatives can be made, specifically that ' DECON can be carried out while maintaining occupational exposures at reasonable levels while SAFSTOR and ENTOMB can result in reduction in occupational exposures. Thus, choice of the alternative can be made. 1 L It should be noted that for any of the alternatives, occupational exposures will be limited by the requirements of 10 CFR Part 20 and that, in particular, licensees should maintain exposures to workers to as low as reasonably achievable levels. Thus radiation exposure to workers will be kept at acceptable levels for any of the alternatives used. The health impacts of radiation and concerns over whether limits on exposure should be raised or lowered are outside the scope of this rulemaking and are the type of issues being addressed currently in a separate rulemaking that proposes to amend 10 CFR Part 20. The allowed occupational exposures during the decommissioning period will conform to the requirements of 10 CFR Part 20. The draft Generic Environmental Impact Statement (NUREG-0586) analyzed the occupational exposures which would be received during decommissioning and found that over a 4 year decommissioning period they would be similar to that which would be experienced at an operating facii-ity on a yearly basis. Thus, NRC determined that the health impact of decommissioning did not add significantly to the operating plant impact. In summary, the information currently available provides NRC with a reasonable understanding of the safety aspects involved in decommission-ing and also provides sufficient information to evaluate alternatives. 14 Enclosure A
[7590-01]' As more information becomes available, NRC will factor it into the decision-making process. It is not feasible to compare the increases in the estimates at TMI-2 to decommissioning since the TMI-2 estimates were 'for a post-accident situation where there was significant contamina-tion and the situation was initially uncertain with regard to contamination levels and cleanup procedures. When licensees prepare their decommission-ing plans for submittal to the NRC for approval under the requirements of 10 CFR 50.82, they will have more information about the conditions in the reactor and will provide more up to date information about occupational exposures during decommissioning. At that time NRC will be able to evaluate the choice of decommissioning alternative for the specific facility.
- 3. DECON.and SAFSTOR Decommissioning Alternatives. DECON'and SAFSTOR are defined in the Supplementary Information of the proposed rule as follows: DECON is the alternative in which the equipment, structures, and portions of a facility and site containing radioactive contaminants are removed or decontaminated to a level that permits the property to be released for unrestricted use shortly after cessation of operations; SAFSTOR is the alternative in which the nuclear facility is placed and maintained in a condition that allows the nuclear facility to be safely stored and subsequently decontaminated (deferred decontamination) to levels that permit release for unrestricted use.
A number of commenters expressed opinions on the rule with regard to allowing use of DECON and SAFST0h. Some commenters favored the use of l DECON, one in particular noting that it should be used at a site of high potential for a seismic event. Other commenters noted the problems asso-ciated with DECON including the higher occupational exposure involved and 15 Enclosure A
_ - - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ - _ - _ _ _ _ - - _ _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ - = _ _ - _ - _ _ _ _ -_-_ s . [7590-01] problems associated with inability to dispose of wastes.- Some commenters noted that site specific factors should come into play and that either DECON or SAFSTOR should be possible. Some commenters noted that because of problems associated with DECON, that SAFSTOR was the best option. Two commenters expressed the opinion that the rule seems to favor use of DECON for reactors. The NRC is aware of and has considered the issues related to the advantages and disadvantages of the DECON and SAFSTOR options. The studies done for NRC by Battelle Pacific Northwest Laboratory (PNL) con-sidered factors such as cost of the alternative and occupational exposure and waste volumes associated with each alternative. The PNL studies also considered the effects on decommissioning of interim inability to dispose of wastes offsite. The draft Generic Environmental Impact Statement on Decommissioning Nuclear Facilities (NUREG-0586) prepared by NRC also ! addressed the advantages and disadvantages of DECON versus SAFSTOR includ-ing the fact that DECON releases the site for unrestricted use in a much 1 shorter time period than SAFSTOR, whereas use of SAFSTOR would reduce i l occupational exposures and waste volumes. Both of these alternatives j satisfy the definition of decommissioning in S 50.2. Based on the docu-ments indicated above and on the discussion in the Supplementary Informa-tion to the proposed rule, the conclusion of the Supplementary Informa-tion regarding these two alternatives is that DECON or 30- to 50 year SAFSTOR are reasonable options for decommissioning light water power reac- i tors. Within these general parameters, a licensee will indicate the alternative chosen for decommissioning as required by S 50.82(b)(1) and the NRC will evaluate it considering any specific site factors which 16 Enclosure A
k 7 . [7590-01]- might c'ause an effect. This site-specific evaluation could include such a factor as the seismic potential at a specific facility. The rule does not contain a preference for DECON for reactors. With regard to SAFSTOR, six commenters stated that the rule should contain requirements that if the SAFSTOR alternative is chosen, reactor decommissioning.be completed following storage periods of a maximum.of 30-50 years because after this time period there will be little benefit in dose or waste volume reduction. In contrast, four commenters argued that even a 100 year period was too restrictive because periods of over 100 years are allowed in waste disposal facilities. Three commenters indicated that the rule should provide criteria by which the appropriate length of time for the storage period of SAFSTOR can be determined, balancing site-specific costs and benefits. The Commission does not believe it necessary for the rule to contain a specific time limit on how long SAFSTOR can last. Instead, S 50.82(b) indicates that a licensee's decommissioning plan must indicate a choice of decommissioning alternative and that alternative methods for decom-missioning which significantly delay completion of decommissioning will be acceptable if sufficient benefit.results. As discussed in Section A.2, the rule has been modified to provide additional detail in this area. Delay in the completion of decommissioning will be acceptable primarily for reasons of occupational health and safety because it is recognized that with delay there will be reduction in occupational exposure. Hence, i 1 in the Commission's evaluation of a licensee's decommissioning plan, the benefit of an alternative, in terms of health and safety and common defense and security, will be considered. 17 Enclosure A L________-_-
[7590-01) As noted by the commenters, the Supplementary Information to the proposed rule states that, based on these considerations, 30- to 50 year SAFSTOR is a reasonable option for power reactors. In evaluating decom-missioning plans, it is likely that NRC will approve periods of these lengths of time. Nevertheless the rule does not contain a specific.limita-tion on the length of time for SAFSTOR. There may be additional case-by-case-considerations such as shortage of radioactive waste disposal space offsite or presence of an adjacent reactor whose safety might be affected by dismantlement procedures. .These, or other similar site specific con-siderations, mean that the appropriate delay for a specific facility must be based on factors unique to that facility and could extend beyond 50 years. Based on this, the NRC considers the setting of a specific 50 year time limit on SAFSTOR to be imprc,ctical. It is also unnecessary to have this requirement, because the combination of the provisions of the amendments which require that there be a benefit in any delay in completion of decommissioning and the expected revisions to Regulatory Guide 1.86 setting out guidance on these benefits will provide the NRC the flexibility to consider specific cases while still providing assur-ance that the health and safety of the public is protected. Although the final rule does not contain specific restrictions on the time period involved for delay in completion of decommissioning, the Supplementary Information to the proposed rule does indicate that this period should not be greater than about 100 years because this is con-sidered a reasonable time period for reliance on institutional control. Although commenters refer to longer periods of storage for waste dispo-sal facilities there are some differences between these two situations which must be considered, including the fact that in the case of the i 18 Enclosure A _ . , _ _ _ , _ _ _ _ - - _ - - _ _ ----------------a- - - - - -
(_ L [7590-01]- I. waste disposal facility the NRC transfers the license for the facility to the State or Federal government agency that owns the disposal site following satisfactory site closure whereas the reactor facility would remain licensed by a private organization, and that there are only a small number of disposal facilities compared to possibly over 100 reactor facilities.
- 4. The ENTOMB Alternative. ENTOMB was defined in the Supplementary Information to the proposed rule as the alternative in which radioactive contaminants are encased in a structurally long-lived material, such as concrete; the entombed structure is appropriately maintained and continued surveillance is carried out until the radioactivity decays to a level permitting unrestricted release of the property.
A number of commenters indicated that the rule should expressly pro-hibit the use of ENT0MB as a decommissioning alternative for reactors. Several reasons were advanced for this statement including the fcilowing: the ENTOMB alternative could cause environmental damage due to the pre-sence of long-lived radionuclides which would be radioactive beyond the life of any concrete structure; the Supplementary Information to the pro-posed rule indicates ENT0MB is not viable yet the rule does not explicitly prohibit it; ENTOMB is inconsistent with the definition of decommission-ing requiring release for unrestricted use; and some reactors are located in highly populous areas. In contrast several commenters argued that the ENTOMB alternative should be left as a possible option and that in addi-tion the 100 year period discussed in the Supplementary Information as the time period in which ENTOMB should be completed was too restrictive. Some commenters indicated that ENT0MB had certain advantages including 19 Enclosure A
[7590-01] reduced occupational exposure and waste volumes while some noted that no options should be precluded at this time due to the developing nature of decommissioning technology. It is the Commission's belief that the ENTOMB alternative for decom-missioning should not be prohibited because there may be instances in which it would be a'n allowable alternative in protecting public health and safety and common defense and security. By not prohibiting ENT0MB, the rule.is more flexible in enabling NRC to dea? with these instances. These instances might include smaller reactor facilities, reactors which do not run to the end of their lifetime, or other situations where long-lived isotopes do not build up to significant levels. Analysis of the ENT0M8' alternative in the PNL reports (Refs. 2, 3) and in the draft GEIS (Ref. 20) indicates that it can be carried out safely and that it can have some benefit in the reduction of occupational exposure and waste requiring disposal. As the commenters note, the Supplementary Information to the pro-posed rule indicated that in general that there may be difficulties with the use of ENTOMB, in particular in demonstrating that the radioactivity in the entombed structure had decayed to levels permitting unrestricted release of the property within about 100 years. Nevertheless, because of the instances indicated in the previous paragraph and because of the potential for variations on the ENTOMB option where, for example, some decontamination was performed, thereby making it more viable, use of ENTOMB'has not been specifically prohibited in the rule. The require-ments contained in the rule, namely that a licensee must submit an alter-native for decommissioning to the NRC for approval and that if the alter-native significantly delays completion of decommissioning it will be 20 Enclosure A
- _ _ _ _ _ _ - _ _ _ _ _ _ _ _ - _ _ . i
[7590-01] acceptable only'if sufficient benefit results, provide the Commission with both sufficient leverage and. flexibility to ensure that if the ENTOMB option is chosen it will only be used in situations where it is reasonable and that use of the ENTOMB option will in no case be incon-sistent with the definition of decommissioning requiring that decom-missioning lead to unrestricted release. Regulatory guides currently
, in preparation will provide more guidance in this area. The response to
-the question of whether the 100 year time period for ENTOMB is too restrictive is the same as that for.SAFSTOR in Section A.3 above.
As noted above, concerns were expressed by the commenters that the ENT0MB. option would cause environmental damage due to the presence of
, long-lived radionuclides which would be radioactive beyond the life of any concrete structure, that it is inconsistent with the definition of
. decommissioning requiring unrestricted release, and that some reactors l are located in highly populous areas. In response, the definition of l
decommissioning makes it clear that ENTOMB will only be acceptable in situations when -it will lead to unrestricted use. As indicated above, analysis of ENTOMB indicates that it can be carried out safely and with minimal environmental effect for the time periods contemplated by the amendments and the guidance under preparation. However, as is the case for SAFSTOR as noted in Section A.3, within these general parameters use of ENTOMB by a licensee would be evaluated by NRC considering any site specific factors, such as facility location, which might cause an effect. 1 l- B. Planning for Decommissioning. Comments received on the subject of decommissioning planning covered several areas. These included the 21 Enclosure A
[7590-01] licensing scheme for the decommissioning process; the criteria for con-ducting and evaluating decommissioning plans and activities and license termination; occupational exposure, safeguards,.and quality assurance during decommissioning; recordkeeping and facilitation; and the effect of the. rule on shutdown reactors.
- 1. Licensing scheme for decommissioning. Several commenters found the proposed rule vague in the areas of what type of license is'in effect during reactor decommissioning, how Part 70 applies to reactors during decommissioning, when the license terminates, procedural criteria for the termination process, and the restrictions and requirements that apply to a " possession-only license." One commenter was concerned that there might be loopholes which would be exploited by the industry resulting in adverse impacts to the public and the environment and another commenter indicated that explicit procedural criteria would remove a needless burden'on appli-cants and result in a more cost and time effective licensing process.
In response, it should be noted that application for termination of license occurs at the time of initiation of decommissioning which may be many years before actual termination of license is granted, that decom-missioning is carried out under a decommissioning order, and that the license is terminated only after the Commission is satisfied that decom-missioning has been properly completed. In the past, the period of safe storage or that following entombment has been covered by a " possession-only" license with the term " order" used only in the case of a dismantl-ing order, due to the more active nature of this stage of decommission-ing. In both cases, the facility continues to be licensed under an l l 22 Enclosure A
[7590-01] amended Part 50 license but with no authority to operate. The. authority tu possess radioactive materials under Parts 30, .40, and/or 70, as appro-priate, continues to be incorporated in the modified Part 50 license, as it is during operation. This. represents no change from past practice except for the use of the term " decommissioning order." This terminology is used because, according to the' amendments, the overall approach to decommissioning must now be approved shortly after the end of operation rather than a " possession-only" license being. issued without plans for ultimate disposition. A possession-only license may still be' issued prior to the decommissioning order so as to reduce some requirements which are important only.for operation prior to finalization of decommis-sioning plans. As.with any license, the authority to operate or to carry on licensed activities ceases at the expiration date unless the license is being renewed. However, the license and the responsibility to protect health and safety and promote the common defense and security continues until the Commission terminates the license. Section 50.82(f) clearly indicates the license is terminated by a determination of the Commission after the decommissioning has been performed and it has been adequately demonstrated that the facility and site are suitable for release for unrestricted use. Because decommissioning, including any change from the original operat-ing license, requires Commission approval, there are no " loopholes" which would allow adverse impacts to the public or environment. For clarification, it is noted that the term " decommissioning plan" refers to the plan submitted at the time the licensee decides to terminate the license, while the term " decommissioning funding plan" refers to plan submitted early in facility life which indicates the licensee's financial assurance provisions. { ( l j 23 Enclosure A ! I l 1 _ _ _ _ _ _ _ - - _ - _ - _ - - _ - - _ _ _ -- - J
[7590-01]
- 2. Criteria for decommissioning activities and license termination.
Many commenters were concerned with the lack of specific requirements applicable to the process of decommissioning, particularly in the case of reactors, and suggested that strong guidelines on requirements for conducting and evaluating decommissioning plans and activities and termi-nating licenses are necessary to protect public, occupational, and environmental safety. Some suggest that the rule establish certain safety criteria and the ways in which the utility will meet these crite-ria. A few commenters were specifically concerned with clarifying requirements during the " safe storage" period, such as those for secu-rity, inspection, reporting, and monitoring. Many were not clear as to whetner the suggested " guidance" should be in the rule or if Regulatory Guides would be considered appropriate. Two commenters indicated that without more specific criteria for acceptability of decommissioning plans, the Commission would exercise little authority over licensee actions during decommissioning and one commenter expressed a concern that the licensees could conduct decommissioning with " virtually complete independence." Two commenters believed that the rule " assumed" that utilities would follow basic safety criteria. In response, it should be noted that, as discussed earlier, it is the intent of the rule to provide the necessary guidelines to assure that decommissioning is carried out in a manner which protects the public health and safety. To this end, the rule contains requirements that a decommissioning plan contain a description of the following: the choice of the alternative for decommissioning and the activities involved; the controls and limits on procedures and equipment to protect occupational 24 Enclosure A
[7590-01] and public health and safety; a description of the planned final radia-tion survey; quality assurance and safeguards provisions,.if appropriate; and a plan for assuring the availability of. funds for decommissioning. ] Based on this requirement the licensee submits the necessary information to the NRC in the decommissioning plan. The NRC's evaluation of the information contained in this plan and the licensee's subsequent conduct of decommissioning activities is based on existing regulations applicable l to reactors and other facilities undergoing decommissioning. These 1 regulations include 10 CFR Parts 20, 50, 61, 70, 71, and 73. Part 20 contains the basic standards for protection against radiation ' and is applicable _to all licensees during operation as well as decommis-E sioning, including the storage period. Part 20 contains requirements for n limits on both occupational and public exposure, including limits .on radiation exposure and concentrations of radioactive material in both restricted and unrestricted areas. In addition to the general limita-tions on exposure contained in Part 20, 10 CFR 20.1(c) indicates that radiation exposures, and releases of radioactive materials in effluents to unrestricted areas, should be as low as reasonably achievable. Part 20 also contains, among other things, requirements on radiation monitor-ing, personnel monitoring, precautionary procedures, and reporting. Part 50, Appendix B contains broad requirements on quality assurance provi-l sions which can be used as appropriate. Part 50 also contains guidelines l on effluent control. Part 61 contains requirements on land disposal of radioactive waste including criteria for classification and character-istics of waste acceptable for disposal. Part 71 contains requirements for the packaging and transportation of radioactive material. Parts 70 25 Enclosure A
[7590-01] and 73 contain requirements for physical protection of plants and mate-rials. Although all of these parts do not specifically mention decommis- j sioning activities, the criteria of these parts would apply, as appro-priate, to decommissioning. In addition, regulatory guides, many of which already exist and some of which are under consideration, can pro-vide additional guidance for planning and conducting decommissioning in accordance with the applicable regulations. For example, Regulatory Guide 8.8 provides guidance on ensuring that occupational exposures are ALARA and Regulatory Guide 1.143 provides guidance on radioactive waste treatment systems. Also, as noted below in Sections B.4 and B.5, guid-ance is being considered on safeguards and on quality assurance provi-sions during decommissioning and on procedures to be considered for facilitating decommissioning by reducing radiation dose based on NUREG/ CR-3587 (Ref. 25). The primary means of protecting the public and workers during decom-missioning is through implementation of the decommissioning plan. The decommissioning plan would contain the licensee's means for complying with parts of the regulations discussed above which are applicable to non operating facilities. All changes to the requirements of the operating license which the licensee holds at the time the decommissioning plan is submitted are subject to Commission approval. Changes to the license would be made because many of the prescriptive requirements of an operating license are for the purpose of assuring safe operation and are no longer needed dur-ing decommissioning. The decommissioning plan and the associated approval process provide an adequate legal framework for the regulation of facil-ities undergoing decommissioning. Therefore, the licensee would not have 26 Enclosure A
[7590-01] independence in conducting decommissioning. The Commission does not merely assume the utilities will follow basic safety criteria. The licensing i offices will review decommissioning plans based on the. applicable criteria and guidance and the inspection and enforcement staff will monitor the carrying out of the plans. This approach should provide enough flexibil- q l ity to accommodate the varied nature of activities which are possible. l The proposed rule has been modified to provide some additional detail on the scope of decommissioning plans in the final rule. A pro-posed regulatory guide on contents of decommissioning plans for materials facilities has been published; a similar Regulatory Guide for reactors is being developed to provide guidance on the information which should be submitted to conform to the rule. In addition, Regulatory Guide 1.86 provides guidance on conducting decommissioning activities, including
. storage periods, in a manner tol meet applicable requirements. This e Regulatory Guide is currently being revised to be fully consistent with the regulations. Regulatory Guides have been used successfully to provide uniform application of requirements while affording Commission staff flexibility to consider unique factors in any situation. In addi-tion, the staff would use standard review plans (SRPs) which contain review procedures and the acceptance criteria used in evaluating licensee applications, including decommissioning plans. These SRPs would be available and contain the bases for the acceptance criteria.
One commenter noted that it was unclear what activities should not be started prior to approval of decommissioning plans. Other commenters requested that the regulations be clarified in order to delineate those l l l 27 Enclosure A i
[7590-01] activities related to decommissioning that could proceed without approval of the decommissioning plan if those activities are' allowed by the oper-ating license and S 50.59. In response it should be noted that S 50.59 permits a holder of an operating license to carry out certain activities without prior Commission approval unless these activities involve a change in the technical specifications or an unreviewed safety question. However, when there is a change in the technical specifications or an unreviewed safety ques-i. tion, S 50.59 requires the holder of an operating license to submit an
. application for amendment to the license pursuant to S 50.90. Section 50.59(a)(2) contains criteria as to what is deemed to be an unreviewed safety issue. The-amendments contained in this rulemaking do not alter a licensee's capability to conduct activities under S 50.59. Although the Commission must approve the-decommissioning alternative and major structural changes to radioactive' components of the facility or other major changes, the licensee may proceed with some activities such as decontamination, minor component disassembly, and shipment and storage of spent fuel if they are allowed by the operating license and S 50.59. The licensee could not undertake activities under the operating license or S 50.59 which would cause an impact on the safe conduct of decommission-ing. These matters will be further discussed in a revision to !
Regulatory Guide 1.86 under consideration.
- 3. Occupational exposure during decommissioning. Many commenters emphasized the importance of worker protection. Many of these suggested !
more specific criteria to minimize worker exposure. A number were con-cerned that the rule did not specifically address radiation monitoring. One felt that reporting of all phases to NRC should be required. One 28 Enclosure A
[7590-01]
)
felt that strict enforcement of safety standards should be required, and also indicated that experience at TMI and Shippingport would indicate that total occupational exposures are apt to be substantially higher than estimated. Another believed that exposures during decommissioning will be substantially higher than from operations. One commenter suggested specific requirements such as training of workers prior to work in highly radioactive areas. In response, minimizing worker exposure during decommissioning is one of the main goals of this rulemaking and of the guidance being devel-oped in connection with this rulemaking. Detailed plans for decommission-ing are the primary means of minimizing worker exposure. Procedures for carrying out decommissioning will be evaluated by NRC staff for adequacy of occupational exposure control; plans for appropriate training are an area of review. Basic radiation protection, monitoring, and reporting requirements need not be developed specifically for decommissioning because generally applicable criteria are already contained in 10 CFR Part 20. The radiation levels to which workers will be exposed will be similar to that of major maintenance activities conducted during opera-tions. If total exposures prove to be higher than estimated, this could be factored into decisions concerning alternatives and approaches in the future. Also contributing to the minimization of worker exposure are the recordkeeping requirements of this rule. Other aspects of facilitation of decommissioning will be considered in the review of license applications.
- 4. Safeguards during decommissioning. A commenter pointed out that the applicability of safeguards requirements to decommissioning is unclear.
In response, as noted above in Section B.2, the existing regulations on 29 Enclosure A
'[7590-01]
safeguards for nuclear facilities are considered to contain criteria appli-cable to the decommissioning process. Therefore it.is not considered necessary to amend those regulations. However, the Commission agrees l with the comment that clarification is needed and appropriate guidance ' documents will be issued identifying which of the current operating requirements are to apply during decommissioning.
- 5. Quality assurance during decommissioning. Many commenters were ,
concerned that the proposed regulation did not include mention of quality assurance and/or quality control for decommissioning. Some of these indicated that QA/QC requirements need to be clearly specified. A few comments specifically indicated the need for a separate or independent QA/QC staff. Two commenters suggested some specific procedures which should be subject to Q/A and two others refer to problems with decontami-nation activities at Saxton because of lack of QA. The Commission agrees that quality assurance is important for decom-missioning. The intent to include QA in decommissioning plans was men-tioned in the statement of considerations of the proposed rule, but the , 1 scope of plans in the regulation itself was very general. The final rule indicates that QA provisions during decommissioning are to be described, as appropriate, in the decommissioning plan. A large part of the QA program for operating reactors pertains to equipment and procedures necessary for the safe' operation of the plant; the equipment and proce-dures requiring QA procedures during decommissioning is much more limited. It is not considered necessary to detail these requirements in the regula-tions because of the limited nature of the QA requirements. Guidance is being considered to assist in the development and review of the quality assurance provisions of decommissioning plans. 30 Enclosure A
[7590-01]
- 6. Recordkeeping and facilitation. Commenter opinions concerning the recordkeeping requirements proposed was mixed. Several thought it was important enough to include specific support for the requirements as proposed indicating why such records were important. Other commenters indicated that existing recordkeeping requirements are sufficient. One commenter suggested that records might be limited to those events result-ing in the spread of contamination outside of radiologically controlled areas identified in the updated FSAR.
The Commission is making no change to the proposed recordkeeping requirements. Experience has shown that incomplete knowledge of facility design and history can result in significant difficulties and greatly underestimated costs at the time of decommissioning. Although many of the records, particularly in the case of reactors, would be kept for other purposes, it is expected that an improvement in assurance of avail-y ability of the records will result from the amendments. The amendments have been written to minimize the additional effort required, that is, requiring only centralized reference to pertinent records and their loca-tion rather than duplication of the records and, if drawings are refer-
.enced, not requiring that each relevant document document be indexed individually.
Some comments were submitted concerning facilitation of decommission-ing. The commenters favored consideration of facilitation except for one who indicated that additional plant design requirements and operating procedures to facilitate decommissioning are not necessary. One commenter discussed how design facilitation and improvements in the technology of decommissioning (such as robots and remote devices) can reduce the costs, time, and exposures of decommissioning. Other commenters recommended , 1 31 Enclosure A _- - _ - _ _ - _ _ - - _ l
[7590-01] that specific requirements for facilitation of decommissioning in design and operating procedures be included in the regulations. In preparing the proposed rule, the Commission did not conclude that additional plant design requirements and operating procedures to facilitate decommissioning are unnecessary but rather that, other than recordkeeping, no specific design feature nor operating procedure need be required specifically for all licensees at this time. To the extent that design features or operational techniques are of known value in facilitat-ing decommissioning, the Commission staff may consider these factors in reviewing applications for construction permits or operating licenses under the more general criteria contained in the regulations. The Commission has done some preliminary studies to identify possible benefi-cial features and techniques (NUREG/CR-3587, Reference 25).
- 7. Shutdown reactors. A number of commenters were concerned about the exemption of reactors permanently shut down prior to issuance of the rule from the requirement to submit decommissioning plans. Some thought that this would mean a lower level of protection for the public living near such a plant. One commenter specifically suggested that those licensees be required to review their plans within a set time after the effective date of the rule and submit any revisions necessary to make their plans consistent with the new regulations and two commenters suggested an exemption procedure in the regulations would be better than j a blanket exemption.
In response to this comment, it should be noted that reactors which are permanently shut down prior to the effective date of this rule, have had their status reviewed by applying for a possession-only license (a l 32 Enclosure A 4 1
l [7590-01] few had obtained a materials license only). These plants are.being ade-quately controlled under their modified license and license conditions to protect the health and safety of.the public while in this decommis-sioning mode. Any further delay in completion of decommissioning would have to be considered formally if an extension is requested beyond the expiration of the possession-only license. Detailed plans for ultimate dismantlement of reactors currently.in safe storage'would be deferred i under the provisions of this rule. Requiring a decommissioning plan for i these reactors at this time, or an application for exemption, would involve administrative costs on the part of these licensees with no significant impact on health and safety. Funding and recordkeeping requirements in the amendments apply to these reactors since they possess
. an " operating license," albeit modified (or a Parts 30, 40, and 70 license). Details concerning financial assurance, primarily the time j period for accumulating funds not set aside during operation, would be decided on a case-by-case basis.
C. Financial Assurance. Comments received on the issue of assur-ing the availability of funds for decommissioning included questions l regarding costs of decommissioning, use of certification of a specified amount and funding plans for reactors, acceptable funding methods, sub-mittal of funding plans, specific comments on funding for material licensees, funding for Federal licensees, and general questions concern-ing need for funding requirement *s and relationship of the rule to the functions of other regulatory agencies. ( 33 Enclosure A I-
[7590-01]
- 1. Cost of decommissioning. A number of commenters disputed the accuracy of the Battelle Pacific Northwest Laboratory (PNL) estimate of the cost of decommissioning as discussed in the Supplementary Informa-tion to the proposed rule. A variety of alternative estimates and reasons for disputing the accuracy were given. A summary of these are as follows:
(a)' Commenters indicated that other estimates have been made which make the PNL studies appear to be too low. Commenters from the nuclear industry indicated costs are more likely in the range of $126 to $178 million. Other commenters cited estimates which range from $600 million to as high as $3 billion. The variety of estimates are cited by some commenters as being indicative of the uncertainty of estimates. One commenter indicated that the estimates in the PNL studies were high. (b)- The data base of the PNL reports is limited because the reports are based on small research reactors and on the Elk River reactor. In particular, Elk River and Saxton operated at low power loads and for only a very short time, not long enough for long-lived radionuclides to build up. Thus,-necessary experience to make accurate cost estimates does not exist and commenters quote the PNL reports as stating that " extrapolations from these experiences to large commercial reactors are considered to be generally unreasonable," Moreover commenters stated that the PNL studies are outdated. Some commenters point out that certain necessary data for estimating costs does not exist. These data include information on con-crete contamination, activated vessel components and biological shield and soil contamination and uncertain status of requirements regarding occupational dose, waste disposal, and residual radioactivity. 34 Enclosure A
L . L L , [7590-01] (c) Shippingport, a'65 MWe reactor, has been estimated to cost $98 million to decommission. Larger reactors would likely cost significantly more than this, perhaps more than three times as much. In addition, Shippingport cost estimates are probably lower than typical because the reactor vessel will be removed intact and the wastes will be disposed of in a Federal Repository. Other estimates at Saxton and Humboldt Bay (which the commenter indicated as being $600 million in 2015 dollars) indicate PNL estimates are too low. (d) Estimates of costs of other activities such as reactor construc-tion, TMI-2 cleanup, and Saxton decommissioning have been greatly under-estimated. Costs of' decommissioning will likely escalate much higher than estimated today. (e) The cost of decommissioning a reactor will likely equal the cost of construction of the plant. The following is a discussion of the response to these concerns. NRC, as part of its efforts on rulemaking for decommissioning, con-tracted with Battelle Pacific Northwest Labs (PNL) to develop an analysis of estimated costs of decommissioning various nuclear facilities, includ-ing PWRs and BWRs, on a generic basis, based on an engineering evaluation of activities involved in decommissioning. As indicated above, certain of the commenters disputed the accuracy of the PNL studies to varying degrees. The PNL reports on decommissioning a reference PWR and reference BWR are detailed engineering studies of the conceptual decommissioning of a large PWR (the 1175 MWe Trojan Nuclear Plant is used as the reference plant) and a large BWR (the 1150 MWe WNP-2 plant is used as reference). The PNL reports consider: (1) the detailed plant design and layout of 35 Enclosure A
l' . . [7590-01] the reference plant; (2) estimated conditions in the plant at the time of shutdown (just prior to decommissioning) including estimates of radio-
.nuclide inventory and radiation dose rates; (3) techniques for decontam-ination and dismantling which are current and proven; and (4) radiation l protection requirements for workers and the public. Based on these con-siderations, the PNL reports present detailed work plans and time schedules to accomplish decommissioning, including those for planning and preparation,. decontamination, and component disassembly and. transport.
In making cost estimates of decommissioning, the PNL reports include work scheduling estimates, staffing requirements, specialty contractors, essen-tial systems, radioactive materials disposal, supplies,.etc. The PNL reactor decommissioning studies were performed during the i period 1976-1979 and PNL has since prepared updates of the original PWR and BWR studies (NUREG/CR-0130 (Ref. 2) and NUREG/CR-0672 (Ref. 3), respectively) in which the earlier estimates were adjusted for inflation due to increases in labor costs, waste disposal charges, and other general cost increases since the original studies. In addition to inflation, several aspects not considered in the original studies were examined: the use of a general decommissioning contractor in place of the utility acting as its own contractor; the use of an external engineering firm to 1 develop the detailed plans and procedures for accomplishing decommission-ing; and the addition of sufficient staff to assure that radiation doses to decommissioning workers do not exceed 5 rem per year. Based on the above factors and adjustments, PNL estimates of power ! reactor decommissioning in January 1986 dollars are in the range of i 1
$105 - $135 million. A breakdown of these costs will be contained in the 4 Final Generic Environmental Impact Statement on Decommissioning Nuclear 36 Enclosure A
[7590-01] i I l l Facilities. The PNL costs do not include the cost of demolition and 1
)
removal of noncontaminated structures, storage and shipment of spent fuel, or restoration of the site. Although it may be difficult to make simple comparisons between different cost estimates for different plants because of site-specific considerations, it can be said that the PNL estimates represent a reason-able approximation of the range of decommissioning costs, in particular because they use engineering assumptions and are based on decommissioning experience. Other estimates made independently from PNL and made using engineering assumptions are in the same general cost range as PNL. Estimates in the range of $600 million to $3 billion appear to be unreasonably high. The $600 million figure is for decommissioning Humboldt Bay and is in year 2015 dollars and hence includes the assumed effects of price escalation between 1984 and 2015 which could be sub-stantial. No specific bases or data are presented by the commenter to justify the $3 billion figure. It may be based on comparisons of construction and decommissioning costs. However, this is not necessarily a valid comparison as discussed below. Explanation of differences between the PNL cost estimate range and that cited by the nuclear industry of $126 to $176 million rests partly with site-specific differences and partly with differing assumptions regarding labor necessary to complete certain decommissioning tasks and differing assumptions regarding waste disposal volumes and charges. These different assumptions come about based partially on the uncertainty inherent in making these cost estimates at this time. Further analysis in revisions to the estimates to account for recent technical information obtained since the original PNL studies were prepared may well reduce the 37 Enclosure A
[7590-01] differences in the assun.ptions and estimates. For example, the NRC has research programs underway to obtain data from the decommissioning of the Shippingport reactor. The rule amendments provide for these differences L by allowing the use of site-specific cost estimates in financial assurance provisions. The commenters in (b) above questioned the PNL data base because it i As discussed below, the prima' used small reactors as a basis, ase of information from earlier decommissioning of small reactors like Elk River was to gain a perspective on the types of operations necessary and the types of tooling appropriate to accomplish dismantlement. The fact that the activation levels experienced in Elk River were lower than those anticipated in a reactor after a full lifetime of opera-tion has little effect on the PNL analyses, because components that are i highly acti ned are generally disassembled under water. With water shielding, still higher activation levels will not influence the approach and methods of disassembly and packaging in any significant way. With respect to the lack of drf on contamination and activation levels throughout the plants at the end of life, the activation levels were calculated using well proven methods and the contamination levels were based on data from actual operating plants after 3 to 6 years of operation. These values are not unreasonable estimates of end-of-life conditions because current operating practice is to perform system and surface decontamination periodically as requi sd to keep occupational radiation doses to operations personnel withir; c asonable bounds. l The quotation from the PNL report to the effect that " extrapolations of these experiences to large commercial reactors are considered to be unreasonable" needs to consider the remainder of the discussion contained 38 Enclosure A 4
_ _ _ _ _ - _ - _ - - _ _ _ - _ _ _ - _ - _ _ = _ . _ - - _ _ - - _ . _ _ - - _ - _ _ - - . _ t , . . , [7590-01] h i in the Pt'! eport for the proper context. The statement in the PNL report was not intended to imply that reasonable analyses could not be made for l- the large reactors. The statement was intended instead to discourage persons from performing linear extrapolations of the Elk River decommis-sioning costs to a large power reactor by using the ratio of their power 1 levels. In fact, the PNL studies go on to state in Section 4.3 of NUREG/CR-0672 that "the primary value of past decommissioning experience is in identification of the methods and technologies of decommissioning." In Section 4.3.3, NUREG/CR-0672 describes some of the lessons learned from past decommissioning, including th: fact that "Past decommissioning have demonstrated some of the aspects of the practicality and acceptabil-ity of the various decommissioning approaches. The necessary technology not only exists, but has been safely and successfully applied numerous times to a wide variety of nuclear installations." As can be seen in
- Appendix G of NUREG/CR-0672, information on techniques and methods from earlier decommissioning, gathered from various sources, is used in considering which techniques are applicable to larger facilities. Some examples are decontamination, physical cleaning, removal of structural material, and equipment disassembly. Thus, as discussed in NUREG/CR-0672, direct extrapolation or comparison of decommissioning the small facilities is not used by PNL in evab ating costs of decommissioning for the larger reference facilities, but rather the usefulness of the earlier decommis-sionings is in their demonstration of available and successful decommis-sioning methods and techniques t*o accomplish specific tasks.
PNL utilizes this information, where applicable to large reactors, and also considers the design and plant layout of the large reactors, and the estimated conditions in the reactor at the time of shutdown, including 39 Enclosure A
[7590-01] estimates of radionuclides inventory and radiation dose rates, as well as decontamination techniques and radiation protection measures more appro-priate for large reactors. Based on these considerations, the PNL studies developed detailed work plans and time schedules to accomplish decommis-- L sioning which are described in more detail in Sections 4.2 and 9 and l Appendices F and G of NUREG/CR-0130 and Sections 3 and 9 and Appendices G, H, and I of NUREG/CR-0672. The commenters in (c) questioned the PNL estimates due to the costs of the Shippingport decommissioning. In response, first, it should be noted that the Shippingport reactor has all of the components of a large commercial reactor and, in addition, the physical size of components at Shippingport compared to a large commercial reactor is much larger than the ratio of power levels. Thus, the kinds and numbers of operations required to accomplish dismantlement are very similar. The cost of assembling and paying of a crew for the decommissioning is high and makes up a large fraction of the cost of decommissioning. Even for smaller facilities, a crew must still be assembled and must perform a number of tasks.similar to those in large reactors such as decontamination of pip-ing loops, decontamination of concrete surfaces, vessel and pipe cutting, etc. The costs of staff labor for these activities is significant in each case. Second, the specific situation at Shippingport must be considered. In particular, the Shippingport dismantlement is being conducted as a learning exercise and an information/ technology transfer opportunity for the nuclear industry. More time and effort are being devoted to planning, executing, and documenting each task than would o'herwise be necessary during a commercial reactor decommissioning project. Thus, the costs 40 Enclosure A
-{7590-01];
i should be greater than expected for a plant of that size. In addition, the Shippingport cost estimate is escalated to real dollars spent during the active decommissioning period up to-1990 which is a reasonable estima-tion method because DOE needs.to project actual year dollar costs for budget purposes. However, this is different from the method used in the PNL estimates which was to use constant 1984 dollars in the proposed rule. To make a valid comparison, both estimates would have to be in the same year dollars. Inflation over this period may be an important factor. Another factor in the difference in cost is that the Shippingport esti-mates include cost of demolition of certain facility structures and site restoration, which are not included in the PNL estimates. In addition to these factors, DOE indicated the existence of certain unique items in the Shippingport decommissioning including: the testing of certain decommissioning methods to determine if they fit particular applications;
?
efforts involved to share technology with utilities; and efforts involved in considering the presence of the nearby operating Beaver Valley plants during decommissioning. The commenters in (d) questioned the cost estimates due to earlier underestimates of construction costs at nuclear plants and cleanup costs at TMI-2. In response, while there is no doubt that decommissioning costs will continue to escalate in step with general price increases, it does not follow that because reactor construction costs exceeded original estimates, decommissioning cost estimates will also be greatly exceeded. Cost overruns in the construction of nuclear plants reflected the regulatory requirements necessary to license a reactor for construction and operation, the cost of interest to borrow money during protracted delays, and other site-specific problems rather than a basic inability to 41 Enclosure A
[7590-01] project the technological costs. Decommissioning cost estimates do not include a number of the factors involved in obtaining an operating license and should not necessarily be subject to sbch increases. The cleanup at TMI-2 is a first-of-a-kind endeavor with potential f ar increased costs. The initial cost estimates were based on very limited knowledge of the actual conditions to be overcome, and in addition, there were delays in the program caused by technical and regulatory problems. The cost estimate for cleanup at TMI-2 has not increased appreciably since 1981 due in part to a better understanding of the work scope. The cleanup following an accident is not comparable to a normal decommissioning in terms of either technology or cost and the conditions for a reactor decommissioning can be much more sharply defined than could the condi-tions for TMI-2 cleanup. Also, the activities needed to decommission are not first-of-a-kind, but reflect direct applications of developed tech-niques and equipment. Thus, cost increases of the magnitude experienced by the TMI-2 cleanup effort are unlikely to occur for a normal decom-missioning effort. The commenters in (e) indicated that the cost of decommissioning would likely equal the cost of construction of the plant, i.e., with costs of construction running at $3 billion, the cost of decommissioning would be $3 billion. First, there have been no detailed analyses pre-sented to indicate that decommissioning costs will equal construction costs and, in fact, there is not a specifically defined or fixed rela-tionship between these two costs. The PNL studies on decommissioning (NUREG/CR-0672 and NUREG/CR-0130) have not identified a specific rela-tionship between construction costs and decommissioning costs. As can 42 Enclosure A I
[7590-01] [ l be seen in Section 10 of NUREG/CR-0672, decommissioning costs depend on various specific factors such as costs of staff labor to accomplish decommissioning tasks, costs of disposal of waste, special tools and equipment, miscellaneous supplies, etc. Cost of construction includes several items which have little or no effect on decommissioning costs such as licensing, extensive quality assurance procedures during construc-tion, site preparations, installation and testing of instrumentation, control and electrical systems, the cost of interest on the money used during construction, etc. This discussion does not attempt to define or provide costs of these and other items, but to point out the differing nature of many of the construction costs versus decommissioning cost items, and why there was no identification of a defined relationship between them in the Battelle-PNL reports. Secondly, in any comparison of costs it is necessary to place the costs in the same year's dollars in order to have a meaningful basis for comparison. Certainly in about 30-40 years when the reactors are decom-missioned, inflation may well drive the decommissioning costs towards the l current cost of construction. However, the decommissioning rule amend-ments, which will require maintenance of funds by methods which keep pace with inflation and periodic adjustment of funds to account for effects of inflation, will provide assurance that funds are available to pay for decommissioning when needed.
- 2. Use of certification of a specified amount and funding plans for ,
i reactors. The proposed rule contains provisions that a utility applicant ! or licensee may submit a certification that financial assurance for decom-missioning will be provided in a prescribed amount stipulated in the regula-tions as $100 million (in 1984 dollars). The proposed rule also indicated 43 Enclosure A
[7590-01] l 1
)
that this value is to be adjusted annually using an inflation rate twice that indicated by the change in the Consumer Price Index. The following were comments received on this issue: (a) A number of commenters objected to the use of certification for ! the following general reasons: (1) The use of site specific estimates is preferable to a prescribed amount becaute they will be more realistic and accurate and able.to account for site-specific factors. (2) Commenters generally felt that because of the wide range of site specific cost estimates, any one value would not be accurate and not be representative of most plants and therefore the number of licensees using certification would be low. Most commenters argued that $100 million was too low while a few argued that it was too high. (3) The use of a prescribed amount will not decrease utility efforts because they will still have to prepare site specific cost studies for the rate regulators regardless of the certification procedure. Commenters noted that the use of the $100 million figure or other similar prescribed amount will be viewed by state'and Federal rate regulators as a limiting value, thus placing a burden on utilities to justify to the rate regula-tors an alternative funding level even if site specific studies show the prescribed amount to be inappropriate for that plant. Some commenters noted that this situation had already occurred in specific situations. (4) The use of a specific prescribed amount as stated in the certi-fication was seen by some commenters as setting a revenue requirement which is a function for state and Federal rate regulators. 44 Enclosure A
[7590-01] (5) The inflation factor contained in the proposed rule was con-
.sidered to be inaccurate because there was no basis to expect the decom-missioning cost to increase at twice the CPI in the future, and the factor could be subject to misuse.as noted above in (c).
(b) Some commenters indicated that if certification is retained that. it should be revised and clarified. The following suggestions were made as to what should be done if certification is kept: (1) The certification requirement should be clarified to indicate that it is not intended to and does not represent the actual cost of decom-missioning, that it is not fixed but is for reference purposes only, that it is only intended to insure minimum financial responsibility and that it is not intended to bind regulatory ratemaking bodies to that figure either as a minimum or maximum. (2) The amount should be increased to the $120 to $170 millien range so that it is sufficiently high to include realistic decommissivaing costs. (3) Indicate that, despite the allowance of certificate o n, use of-a site specific study is preferable and should be used if available. Only allow use of certification in certain cases when it can be shown that costs are less than $100 million. (4) There should be consideration given to including means to adjust the certification numbers to account for such things as plant size, design, other site specific factors, BWR vs PWR, pre- or post-TMI units, decommis-sioning alternative, two-unit site savings, etc. (5) Clarification should b'e included as to what the $100 million incluaes, namely whether it covers both radioactive and nonradioactive structures, whether it includes contingencies, whether it is per unit. 45 Enclosure A
1 [7590-01] (6) The use of the inflation factor should be clarified, in partic-ular that it is not intended to reflect the actual rate of increase of decommissioning costs, and the inflation factor should be modified using other escalators, for example, Handy-Whitman indexes for labor and materials and separate data sources for waste disposal. (c) With regard to funding plans, several commenters indicated that there needed to be more specific or quantitative description of NRC's criteria for approval of cost estimates in power reactor funding plans and that lack of criteria could result in confusion. In responding to these comments it should be noted that, as discussed in the Supplementary Information to the proposed rule, the intent of the I use of certification is to minimize the administrative effort of licensees and the Commission while still providing reasonable assurance that funds will be available to carry out decommissioning in a manner which protects. public health and safety. The certification amount was based on the significant data base on decommissioning developed as part of the policy evaluation. The intent expressed in the proposed rule remains valid, however, it appears from the comments that the intent and proposed use of certification has been misunderstood. Thus, the retention of certifi-cation requires clarification and adjustment for it to be useful in the manner it was intended. These points are discussed in the following paragraphs. First, it is still expected that a proper certification method would provide clear criteria and would minimize the amount of administrative effort that the NRC and licensees must expend in establishing reasonable financial assurance for decommissioning. The certification is also in-j tended to minimize NRC involvement in the rate regulatory process, which 4 46 Enclosure A l
- u. .. q
[7590-01) !
..is an area outside of NRC's jurisdiction. The fact that site specific v cost estimates may still have to be prepared for rate regulators is out-side.the scope of this rulemaking.
Second, the. comments that a site specific cost estimate is preferable
~
;l l
as noted in (a)(1) above, that the prescribed amount in the certification- ' is not representative of most plants as noted in.(a)(2) above, and that-the use.of the prescribed amount will be viewed as a limiting upper value by rate regulators as noted in (a)(3) above, indicates the certification method in the proposed rule has been misunderstood. The proposed rule stated that a utility could submit a certification that financial assur-ance for decommissioning will be provided in an amount at least equal to
$100,000,000 (Emphasis added). Accordingly, the proposed rule did not intend to prevent site specific cost estimates from being done and amounts greater than the prescribed amount being estimated and used for financial assurance planning as long as the estimate exceeded the' prescribed amount.
Under the provisions of the proposed rule, licensees could prepare a site specific cost estimate and if it exceeded the prescribed amount, which would be acting as a threshold review level, the estimate would not be a matter subject to review by the NRC. The amount listed as the prescribed amount does not represent the actual cost of decommissioning for specific reactors but rather is a reference level defined to assure that licensees demonstrate adequate financial responsibility that the bulk of the funds necessary for a safe decommissioning are being considered and planned for early in facility life, thus providing adequate assurance at that time that the facility would not become a risk to public health and safety L when it is decommissioned. It is not intended to bind ratemaking bodies to that specific figure. The text of the final rule states that, if a 47 Enclosure A l
[7590-01] site specific cost evaluation is prepared, it can form the basis.for the certification'and the licensee may indicate that provisions are being made for an amount greater than the prescribed amount. Use of the certification approach is a first step in providing reasonable assurance of funds for decommissioning.from the Commission's l' perspective. The second step is that the amendments require the licensee, five years prior to the expected end of operations, to submit a cost estimate for decommissioning based on an up-to-date assessment of the actions necessary for decommissioning and plans for adjusting levels of funds assured for decommissioning. As noted in the Supplementary Informa-tion to the proposed rule, this estimate would be based on a then current assessment of major factors that could affect decommissioning costs and would include relevant, up-to-date information. These could include site specific factors as well as then current information on such issues as disposal of waste, residual radioactivity criteria, etc. , and would present a realistic appraisal of the decommissioning of the specific reactor, taking into account actual factors and details specific to the reactor and the time period. Combination of these steps, first establishing a general level of adequate financial responsibility for decommissioning early in life, followed by periodic adjustment, and then evaluation of specific provisions close to the time of decommissioning, will provide reasonable assurance that the Commission's objective is met, namely that at the time of permanent end of operations sufficient funds are available to decommis-sion the facility in a manner which protects public health and safety. More detailed review by NRC early in life beyond the certification is not 48 Enclosure A
[7590-01] l l considered necessary because of the steps discussed above and because of i the regulated nature of utilities. As noted in the rulemaking which proposed elimination of financial qualifications for electric utilities (49 FR 13044; April 2, 1984--final rule published 49 FR 35747; September 12, 1984), "public utility commissions are to set a utility's rates such that all reasonable costs of serving the public may be recovered." Because NRC requirements concerning termination of a license are part of the reasonable cost of having operated a reactor, it is reasonable to assume that added costs beyond those in the prescribed amount could be obtained if the latter were too low as suggested by the commenters. Based on the above discussion, the level of review contained in this decommissioning rule provides reasonable assurance for funding. In response to those commenters who were concerned that the criteria for y evaluation of power reactor funding plans were not sufficiently specific or quantitative, the certification process provides' clear requirements and will achieve the objective of reasonable assurance of funding while minimizing associated administrative effort.- Therefore, the amendments do'not contain requirements for a cost estimate early in reactor life. The more detailed review 5 years prior to end of life is consistent with the requirements for non-reactor facilities who are required to submit updated plans at the time of license renewal (which occurs every five years). As discussed above, the intent of the amendments is that there be reasonable assurance of funds for decommissioning. Other issues normally outside NRC's jurisdiction such as rate of collection and whether a funding method is equitable should be considered by utilities and their i 49 Enclosure A
e . .- [7590-01] ratemaking bodies. For example,-to be more equitable to ratepayers,.the r utilities and ratemaking bodies may want to consider whether amounts-should be collected based on a site specific cost estimate which exceeds the prescribed amount rather than the stepwise approach discussed above. The final rule contains text recognizing that funding for decommissioning; of electric utilities is also subject to the regulation of agencies having jurisdiction over rates, and that the NRC requirements'are in addition to, and not substitution for, other requirements, and are not' intended to be used, by themselves, by other agencies to establish rates. Hence, NRC does not intend to become involved as part of the decommissioning rate regulation process. Based on these considerations, the certification requirement has been retained. However, it has been modified in several ways to incor-porate public comments to clarify its purpose and use as follows: (1) As noted above, the text of the rule has been revised to indicate clearly that a licensee may use a site specific decommissioning cost estimate to indicate that provisions are being made for'an amount greater than the prescribed amount and'to delineate the correct usage of the certification. (2) As indicated in S 50.74(c), the amount has been increased. The revised amount is based on recent evaluations done for NRC by its con-tractor Battelle Pacific Northwest Laboratory. As discussed in Section C.1, these estimates are considered to represent a reasonable engineering estimate of the range of decommissioning costs. In preparation of the final rule, the original PNL estimates were reevaluated and compared with other estimates and updated estimates were developed based on recent information. 50 Enclosure A I
[7590-01] (3) In response to the public comments, the rule text has been ) i revised to clarify what would be covered by.the prescribed amount and provisions have been included in the rule to adjust the amount for such factors as plant. size and reactor type. This adjustment for plant size-is based on PNL's generic evaluation of the effect of plant size on decommissioning cost and overall review of a number of plant cost-estimates. An. indication of the bases for the prescribed amounts and for the adjustment is contained in addenda to NUREG/CR-0130 and NUREG/CR-0672. (4) The final rule ~ text also indicates that amounts are based on l activities related to the definition of " decommission" in 10 CFR 50.2 and do not include the cost of removal and disposal of spent fuel or of non-
. radioactive structures and materials beyond that necessary to terminate
. the NRC license. Costs of disposal of nonradioactive hazardous wastes not necessary for NRC license termination are not included in the prescribed amounts.
(5) In' response to a number of comments, the escalation factor . 1 contained in the proposed rule has been revised to better account for. l factors affecting increases in decommissioning cost. The factors for labor, energy, and waste burial are indicated separately and are based on i the addenda to NUREG/CR-0130 and NUREG/CR-0672.
- 3. Acceptable funding methods. The proposed rule listed internal reserve as one of the funding methods considered acceptable in providing assurance of funds for decommissioning. In internal reserve, funds are l placed into an account or reserv'e which is not segregated from licensee assets and is within the licensee's administrative control. A large number of commenters either disagreed with or favored the inclusion of l
51 Enclosure A . _ _ _ - _ - _ _ _ _ - - _ - - ___ -_ _ - __ - _ _ _ _ _ __ _ ______ - _ - _ . . - - _ _ _ _ _ _ - _ _ _ - - - - _ _ - _ _ _ - _ a
[7590-01] internal reserve as an acceptable method. The following were comments received on this issue: (a) Those that disagreed with inclusion of internal reserve did so for-the following principal reasons: (1) There may be problems with -liquidity of the internal reserve if the acquired assets and investments do not preserve value over time and there may be problems in issuing bonds against these assets to pay for decommissioning. -In particular, funds could be used for new nuclear construction or other uses such as TMI cleanup. With this method one cannot insure that money taken from customers will be available in the future for decommissioning. This could cause serious cash flow problems at the time of decommissioning, especially if. utilities ace replacing old plants with new ones at the same time decommissioning takes place. (2) The future financial viability of utilities cannot be assured and the potential exists for utility instability and insolvency. The commenters expressed concern that the utilities could not raise funds for decommissioning if they were having severe financia'l problems or were facing insolvency. Commenters cited examples of potential situations. (3) The level of assurance provided is inadequate and the genera- [ tion of insufficient funds could compromise safety, cause delays, and cause rate boosts. Nuclear power should pay its way fairly. In addition, by not requiring external funds NRC has not responded to the petition for rulemaking made by the Public Interest Research Group (PIRG) in 1977 or to GA0's concern that decommissioning costs be paid by current benefici-aries not future generations. One commenter's analysis indicated that internal reserve costs exceed external reserve costs when they are 52 Enclosure A
- _ ____ __ ___ -____=__ - - . _ _ _ _ - - _ - _ - _ _ - . _ _ -_ . __ ---
[7590-01] adjusted,to. equalize relative risk with respect to the availability of
~
funds. (b) The commenters who agreed with the inclusion of-internal reserve as an acceptable funding method 'did so for the following principal reasons: (1) The use of internal reserve would enhance utilities financial. position by reducing external financing needs. In addition, utilities j 1 have investments, cash flow, and annual earnings which are large compared i to decommissioning costs. i (2)' -The likelihood of instability and insolvency is remote and utilities!are. good investments and have large assets. Commenters noted that utilities whose rates are regulated are essentially guaranteed a
, minimum return on investment and have an obligation under the ratemaking e system to pay for decommissioning. Commenters also noted that in times '
of financial difficulty, an internal reserve is sufficient because it >
.y -is unlikely that electric generation service would not be provided and, even in the case of insolvency, there will be a successor to the insolvent
, utility who would retain the obligation to decommission.
-(3) Several commenters supported internal reserve because it can earn a higher rate of return, reduces revenue requirements, and provides a reasonable balance between cost and assurance. Also, commenters noted that there are financial risks associated with external reserve and that external funding may be no more " bankruptcy proof" than internal reserve.
The Commission has considered the question of the use of internal reserve in several documents. These include NUREG-0584, Revs. 1-3,
" Assuring the Availability of Funds for Decommissioning Nuclear Facilities," (Ref. 14), NUREG/CR-1481, " Financing Strategies for Nuclear Power Plant Decommissioning," (Ref. 15) and NUREG/CR-3899, " Utility 53 Enclosure A
1 [7590-01] Financial Stability and the Availability of Funds for Decommissioning" (Ref. 18). In addition, the Commission held a meeting soliciting public and industry views on decommissioning on September 19, 1984 and the NRC staff has reviewed comments in the area of financial assurance submitted on NUREG-0586 " Draft Generic Environmental Impact Statement on Decommissioning Nuclear Facilities" (Ref. 20). Based on the information developed through these actions, require-ments regarding allowable funding methods contained in the proposed rule allowed the use of an internal reserve, among other methods, for most electric utilities based on the criteria that an allowed funding method provide a reasonable level of assurance that funds will be available for decommissioning. The rationale for this is based on several factors including the fact that the situation of most public utilities in the United States is unique in the sense that the utilities are large, very heavily capitalized enterprises whcse rates are comprehensively regulated by the State Public Utility Commissions (PUC) and the Federal Energy Regulatory Commission (FERC). The PUCs and FERC permit the utilities to charge reasonable rates and render service subject to reasonable regula-tion and rules. Under this arrangement, an electric utility bankruptcy has not occurred in nearly 60 years. In addition, the Commission has ; taken action recently in the promulgation of 10 CFR 50.54(w) to set requirements to establish and increase the amount of onsite property 1 damage insurance. The proceeds from this insurance would be used by a i utility to decontaminate its reactor after an accident. Although these insurance proceeds would not be used directly for decommissioning, they I would go a long way toward reducing the risk of a utility being hit by a tremendous demand for funds after an accident. Because most utilities 54 Enclosure A i
..-_.--_-_-_-__--____----__-_-_-___.______---------_--.---_Q
[7590-01] are.now carrying insurance in excess of $1 billion and the Commission is considering'. implementing its proposed requirement for insurance at this level, a major threat to long term utility solvency will have been substantially reduced. Before publication of the proposed rule, the NRC evaluated the adequacy of various funding methods in light of financial. problems encoun-tered by some utilities which, faced with lower growth in electricity demand than they projected and rapidly increasing costs of construction, had been forced to cancel nuclear plants in advanced stages of construc-tion and the ramifications these conditions could have'on a utility's ultimate ability to pay for decommissioning. Details of this evaluation are contained in NUREG/CR-3899, (Ref. 18) prepared by an NRC consultant, Dr. J. Siegel of the Wharton School, University of Pennsylvania. Dr. Siegel evaluated one publicly owned and four investor owned utilities y then experiencing severe financial stress and also addressed the issue of what would occur if these or future utilities were to face bankruptcy. In considering utility bankruptcy, NUREG/CR-3899 indicated that bank- i ruptcy is generally caused when the utility is unable to pay interest on its fixed income obligations. For convenience, NUREG/CR-3899 termed these fixed income obligations " bonds", although they include all short-term debt, including bank loans. Based on this, NUREG/CR-3899 stated that:
" Bankruptcy does not arise when utilities cannot pay the dividends on either their common or their preferred stock. Holders of stock, or equity holders, are considered the residual recipients of the profits of the firm. Preferred stockholders obtain first claim on such profits, and a utility cannot cut its preferred dividend without first eliminating the dividend on its common stock. Most preferred stock is referred to as
" cumulative." This means that before resumption of dividends on the common equity, all past and current dividends (often with interest) must be paid to the preferred stockholders.
55 Enclosure A _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _. _. i
[7590-01]
)
"This decision to pay dividends to either the common or preferred stockholder is a management decision. The management is not obligated to pay dividends, even if the utility is earning a profit. However, most stockholders of public utilities desire a substantial dividend yield as part of their return. Therefore, payment of dividends is necessary to attract equity capital.
"If the management of the utility cannot pay the interest on its bonds after conserving as much cash as possible by eliminating dividends on common and preferred stock,-then the utility.is subject to bankruptcy, and the creditors, in this case the bondholders (or the banks) may take possession of the assets of the utility.
" Frequently, when the management of the utility sees that it will j have difficulty meeting its fixed obligations, it enters into negotiations with the bondholders. Since the value of the assets of a firm which is operating.is frequently greater than the value of one which is not, it is i rarely in the interest of the bondholders to "close down" the firm and j auction the assets. This is particularly true if the financial difficul- l ties of the firm cannot be totally attributed to the faults of current 1 management or are thought to be temporary. Bondholders discuss methods I of funding the utility under these circumstances in an attempt to restore financial health to the firm and enable it to recover the value of its assets.
"The above point is important, since, contrary to much public opinion, bankruptcy does not mean that the assets of the firm are worthless, and it may not even mean that such assets are impaired in value. It means that current cash revenues are insufficient to cover fixed interest obli-gations and the financial climate is such that borrowing to cover these obligations is not deemed financially feasible cr desirable."
NUREG/CR-3899 went on to analyze the market value of several financially troubled utilities. In examining the five most troubled utilities, he found that their current market values in 1983, although l significantly below their book value, were at least $665 million and l I averaged $2.32 billion. This is true because, despite all their i I financial problems, these firms "still have the distribution network, 4 capital base, and official public sanction and charter to carry on as the provider of energy resources in their area. If the PUC removes all these , 1 current rights of the utility, it will literally expropriate the entire net worth not only of the shareholders but also the bondholders. Unless ; there occurs extreme malfeasance involving literally criminal activities ; I 56 Enclosure A 1 l t_______--.__-- -_-_-_
[7590-01] by the management,-directors and bondholders, this outcome is-considered to be virtually inconceivable." This analysis indicated that the market value' of the utilities, even those involved in the most extreme financial crisis is still far in excess of decommissioning costs. Therefore, NUREG/ CR-3899 concluded.that even i:n the most severe instances, the value of remaining assets, both tangible and intangible, are more than adequate to cover future projected decommissioning costs. Based on this analysis, NUREG/CR-3899 concluded that from an economic and financial standpoint, any method of funding decommissioning, i.e. , external reserves or internal reserves, is acceptable and provides excellent assurance of the avail-ability of funds.
. Based on.the above considerations, the conclusion reached in the proposed rulemaking was that, using a standard of'providing reasonable assurance that sufficient funds are available for decommissioning, inter-o nal reserve is an acceptable method for an electric utility owning more than one generating facility.
As' indicated above, although commenters did not generally refer specifically to the separate request for comment by Commissioners Asselstine and Bernthal, a number of comments were received in this area. Those who disagreed with the conclusion of the proposed rule cited problems with liquidity of the internal reserve and with the future financial viability of utilities, and stated that the level of assurance is inadequate. In contrast, other commenters agreed with the use of internal reserve citing the fact'that the likelihood of instability and insolvency is remote, that utilities have investments, cash flow, and l 57 Enclosure A L_____ ___ _ _ _________ _ _ _ ______ _ __ ___ _ _ ________ _ ___ _________ _ ________ _ _ o
[7590-01] annual earnings which'are large in comparison to decommissioning cost, and that internal reserve provides a reasonable balance between cost and assurance.
~
In response to the comments, NRC has.had NUREG/CR-3899 updated to consider the curreat situation in the utility industry. This analysis is contained in NUREG/CR-3899, Supplement 1, which indicates that, since NUREG/CR-3899 was published,-there has been improvement in the outlook of the nuclear utility industry and that the conclusion of the earlier report that use of internal reserve'provides reasonable assurance of funds for decommissioning has been not only confirmed but. strengthened. The same financially troubled utilities analyzed in the earlier report were reviewed again and it was found that.there has been a large increase in the total market value of the securities of these utilities to an aggregate amount of almost $24 billion, far in excess of decommissioning The importance of considering the market value is that-the higher
~
costs. the market value, the greater the ability to obtain outside funding and the greater the potential for future profits that generate the value to pay for decommissioning. Based on its analysis, NUREG-3899, Supp. 1, concludes that,-even with the threat of non recoverable or cancelled plants, investors believe that the ongoing value of the utility industry based on future prospects is sub-stantial and increasing, that these utilities can, if necessary, attract outside funds, and that because of the substantial margin between the value of the securities of the utilities and the cost of decommissioning, owners l and investors in the utility cannot walk away from the financial responsi-bility of decommissioning without forfeiting the values of their securities, 58 Enclosure A _ -_ - _ __- _-- - _- . )
[7590-01] NUREG/CR-3899, Supp. 1, further concludes that the likelihood of future crises similar to those recently seen is extremely remote because the confluence of events which caused the fiscal crises is unlikely to be repeated. Thus with respect to considerations of utility financial viability, NUREG/CR-3899, Supp. 1, (Ref. 18). indicates that utilities are regaining a substantial degree of the stability formerly accorded them which enables them to tap capital markets for any approved costs, such as decommissioning, with ease. With regard to concerns regarding insolvency, and liquidity of assets, NUREG/CR-3899 and Supplement 1 indicate that it is not necessarily true that bankruptcy of a utility is tantamount to default on decommissioning obligations. Supplement 1 discussed the presence of these assets by l 1 indicating that:
" Decommissioning, whether funded by an internal or external reserve, is a liability and obligation which according to traditional financial practice comes prior to any commitment to pay interest and dividends to any security holder. In other words, in the case of financial difficulties, utilities would be obligated to develop funds to pay for decommissioning, and such funds would come from the withheld interest to the bondholders and dividends normally paid to stockholders.
"When these obligations are recognized without question by all parties, funds could virtually always be generated by the utility in a timely manner without resorting to new security issues in the outside credit markets. These funds would be generated by withholding all interest and dividend payments to current creditors.
}
"Another way of determining whether security holders would be willing to forego receipt of interest and dividends to pay for decommissioning is by comparing the market value of these securities with the estimated decommissioning costs. As long as the market value is higher than the decommissioning cost, then it is clearly in the interest of the security l holders to forego interest and dividends in order to clear their legal obligations to provide for deconimissioning. Failure to do so may result in the court nullifying all rights and hence all value associated with l the outstanding financial claims on the firm.
l 59 Enclosure A _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - - _ _ _ _ _ _ _ _ _ _ _ _ 'J
[7590-01]
"The above action could result in severe financial loss to the security holders. The value of a utility does not. reside solely in the working plant and equipment, but also with the rights granted it by the public utility commission to be the sole or principal provider of energy for a well' defined area. Even in the extreme case where a utility builds a nuclear plant that is never used and not recoverable in the rate base, there is still value perceived by investors in the rights and franchise of the utility. As long as these rights exceed decommissioning costs, security holders would pay these costs rather than forfeiting valuable intangible. assets."
l This discussion is dependent on the recognition of decommissioning as an obligation by all parties. In a bankruptcy. involving liquidation of assets, there may be some question as to the priority of carrying out.- decommissioning under current bankruptcy law. However the more likely situation with regard to a utility facing bankruptcy would be some form of reorganization of the company. Because electric service is considered an essential service, there will, of necessity, be a successor to an insolvent utility. A successor will retain the obligation to decommis-sion. The market value of the utility apportioned to its successor would be greater than the cost to complete the decommissioning. Based on the analysis, NUREG/CR-3899, Supp. 1 reaches the following conclusions:
- 1. The financial health of utilities, especially those involved in substantial nuclear construction, has substantially improved over the i past eighteen months. Recent rulings of the public utility commissions indicate that even after substantial write-offs of nuclear plants are made, investors perceive substantial value in the remaining assets of the utility and can obtain funds without difficulty for decommissioning.
- 2. Therefore, from a financial standpoint, internal reserves currently provide sufficient assurance of the availability of funds for ,
decommissioning'and should be permitted, as proposed by the NRC on ! February 11, 1985. I 60 Enclosure A
[7590-01] A separate item to note is that under current law surety bonds would have greater immunity from the bankruptcy courts jurisdiction than any of the other funding methods; however, as discussed in NUREG-0584, (Ref. 14) surety bonds are not generally available in an amount and for the length of time necessary for large power reactors. Despite its conclusions regarding acceptability of internal reserve, NUREG/CR-3899, Supp. 1, did indicate certain concerns regarding decom-missioning funding. One is that the future revenue potential and customer base of utilities may decline based on recent decisions by PUCs allowing increased competition for the distribution and production of energy thus eroding the monopoly position of many utilities. Although Supplement 1 indicates that it appears unlikely that PUCs will allow the erosion of the customer base to such an extent that the financial viability of the utility is threatened, it recommends that NRC conduct periodic reviews of the overall financial health of utilities with ongoing and prospective nuclear facilities. If such a review indicates the financial condition of utilities is such that internal (or external) reserve does not provide reasonable assurance of funds for decommissioning, then appropriate steps could be taken. In response to this recommendation, NRC intends to ! periodically review the overall financial status of the nuclear utility industry for the factors addressed in NUREG/CR-3899, Supp.1, to assure that its decommissioning funding requirements are adequate. The second area of concern expressed in NUREG/CR-3899, Supp. 1, is that NRC should strengthen the language of provisions which specify the firm legal obligation of the utility to undertake decommissioning because i it is imperative that, in the case of the disposition of utility assets, 61 Enclosure A
[7590-01]
. monies are not distributed to any security holders'until a fund is estab-
- l. lished to assure payment for decommissioning. Based on this, Supplement I n
states that a potential means of doing this would be recommending' changes in bankruptcy law relating to utilities. As discussed in Section C.7-below, provisions contained in existing regulations and in these amend-ments make it clear that the licensee has the legal responsibility to plan for and accomplish decommissioning of the facility, including preparing the property for release for unrestricted use. In summary, NRC has considered the analysis of NUREG/CR-3899, Supp.1, as well as the documents discussed above. NRC has also considered perti-nent factors affecting funding of decommissioning by electric utilities such as the fact that they are regulated entities providing a basic necessity of modern life, their long history of stability and the improved picture for the future and the situation which may occur in an actual bankruptcy, and the requirements that utilities maintain over one billion dollars of property insurance which reduces one of the major threats to
; utility solvency. In response to the recommendation of NUREG/CR-3899, Supp. 1, NRC intends to reevaluate periodically the overall financial status of the nuclear utility industry and to consider recommending changes in the bankruptcy laws to accord a priority for decommissioning.
Based on these considerations, it is the Commission's conclusion that the methods currently allowed by the proposed rule provide a reasonable level of assurance of the availability of funds and that even in the unlikely event of utility bankruptcy, there is reasonable assurance that a reactor will not become a risk to public health and safety. Hence the provisions of the proposed rule allowing a number of funding methods, 62 Enclosure A i
[7590-01] including internal reserve for electric utilities owning more than one generating facility, have not been changed. In a related comment, several commenters discussed the funding methods they preferred over internal reserve. These included principally the use of prepayment of the funds or the use of an external fund which is either coupled with premature decommissioning insurance or is set up to build up at an accelerated rate. These commenters would only permit these funding methods and, as discussed above, would delete internal reserve as an acceptable funding method. Principal reasons for f avoring these methods include the fact that there may be shutdown of a reactor before the date of its expected end of life due to either an accident or problems with reactor aging or obsolescence and sufficient funds for decommissioning would not have been collected by a method which accumu-lates funds over reactor life. One commenter noted that insurance for accidents which is currently required in 10 CFR 50.54(w) is not sufficient as additional assurance when internal reserve is used because it would not cover non-accidental premature shutdown and decommissioning or be sufficient to cover the increased costs of the decommissioning following an accident. Conversely, two commenters stated that in using the internal reserve funding method, the size of the reserve can be larger than that which would be in a fund if a prepayment or external sinking fund method were used. Hence they indicate that internal reserves can provide sufficient funding to accomplish decommissioning prior to the normal end of plant life. In addition, several commenters indicated that the proposed rule-making is correct in relying on the property damage insurance requirements of 10 CFR 50.54(w) to supplement the internal reserve funding method. 63 Enclosure A
. o
[7590-01] They argue that with the substantial. amount of property insurance required that even in the highly improbable event of.an accident-related, premature l decommissioning, the utility will still have sufficient resources avail- i able after the decontamination process to carry out decommissioning. Some .i l of the commenters recognized the possible difficulties in obtaining non- ; accident premature decommissioning insurance. One commenter stated that surety bonds or insurance are not viable alternatives for normal-decommis-sioning or premature decommissioning not associated with an accident. The commenter noted that nuclear property insurance would be available only if an insured event necessitated premature decommissioning and only in the amount necessary to repair the plant for damages caused by the accident. Premature decommissioning due to regulatory mandate would not be covered. The commenter also noted that surety bonds in the amount of $100 million are not generally available. The Commission in its consideration of acceptable funding methods has used the criteria that a method provide reasonable assurance of the availability of funds for decommissioning. Studies done by NRC staff in NUREG-0584 and by NRC consultants in NUREG/CR-1481, NUREG/CR-3899, and NUREG/CR-3899, Supplement 1, indicate that any of the four methods permitted by the proposed rule, including prepayment, external sinking funds, internal reserve, or sureties, provide reasonable assurance. A number of factors must be considered regarding funding methods. These are discussed in the Supplementary Information to the proposed rule and in NUREG-0584, NUREG/CR-1481, NUREG/CR-3899, and NUREG/CR-3899, Supplement 1. These documents address the question of assurance provided by the various funding methods. In particular, as discussed in response to the previous comments, NUREG/CR-3899 notes that the market value of I 64 Enclosure A
[7590-01] utilities, even those involved in the most extreme financial crises,=is still far in excess of decommissioning costs and the value' of- the assets of a utility both tangible and intangible are more than adequate to cover future. projected decommissioning costs. These considerations must also be viewed within the context of Commission requirements for onsite property damage insurance, the proceeds from which a utility could use to decontaminate its reactor after an accident. Although these insurance prceeeds would not be used directly for decommissioning, they would go a long way toward reducing the risk of a' utility being subject to a tremen-dous demand for funds after an accident. Because most utilities are now carrying insurance in excess of $1 billion and the Commission is consider-ing implementing its proposed requirement in 10 CFR 50.54(w) for insurance at this level, a major threat to long term utility solvency will have been substantially reduced. In addition to the factors discussed in the response to the previous comments, the. considerations in NUREG/CR-3899, and the presence of the accident insurance provided by 10 CFR 50.54(w) one needs to balance the benefit of the reasonable assurance criteria against the cost or practi-cality of assurance. Methods cited for handling the problem include prepayment of funds, external sinking funds, and sureties. However prepayment of funds has been recognized by several studies as being significantly more costly than the other methods. Furthermore, in view of the unlikely nature of the events and the potential problems being considered, prepayment has a cost too high for the benefit that would be realized. External funding would not by itself provide additional assur-ance for premature shutdown. Earlier studies in NUREG-0584 found that surety bonds were not generally available in the amounts necessary for 65 Enclosure A
U i [7590-01]' H t.
?
I decommissioning power reactors. Use of insurance for non-accident related i decommissioningLwas found in an earlier study performed for the NRC, NUREG/CR-2370 (Ref.16), to have potentially serious problems of insur-ability and ;noral hazard and is not currently available. (Moral hazard l I is a. term'used in the insurance industry to indicate a situation of lack of loss prevention or loss control because those insured have access to risk prevention.) In light of.the factors considered, including the assurance provided ; l by the various methods, the unlikely nature of the various events and the cost and practicality of providing more absolute assurance by certain methods, it is concluded that the funding methods provided in the proposed'
. rule are adequate'.
Two commenters stated that well capitalized, firmly established private organizations operating research and test reactors should be allowed to guarantee compliance with financial assurance. requirements by. use of che certification process which is permitted for government entities- . In response to this comment, it is noted that government licensees are permitted in the amendments to meet the funding require-ments of the rule by submitting a statement of intent that the appro-priate government entity will be guarantor of decommissioning funds. Private organizations were not afforded that option in the proposed rule. The different treatment arises because there is reasonable assurance that ) the appropriate government entity, which has the power of taxation, will provide adequate funding in the future to decommission the facility in a manner which protects public health whereas this is not necessarily the case with private organizations even if they are currently adequately 66 Enclosure A
[7590-01] capitalized. If they have no funds for decommissioning there can be problems with completion of decommissioning. As noted in Section C.5 below, use of financial tests will be permitted for private organiza-tions, and these organizations can meet the financial assurance require-ments by satisfying the test. Four commenters indicated agreement with proposed S 50.82(c)(1) which would require a licensee planning to delay completion of decommissioning by including a period of safe storage or long-term surveillance to place funds into an external fund or use a surety or certification method, while four commenters disagreed with the proposal indicating that utilities should not be required to shift to external funding. The Commission's rationale for the provisions of proposed 10 CFR 50.82(c)(1) requiring a licensee to use a external fund, surety, or fund certification is that there is a need for assurance of funding over the
. extended timeframe involved with a facility in SAFSTOR and that the facility is no longer a revenue producing asset. This requirement pro-vides that funds would be available for decommissioning irrespective of the licensee's financial stability over the-time period of SAFSTOR. This provision should not prove to be a significant burden because according to the requirements of thc rule, sufficient funds or reserve for decom-missioning should be available at the time of permanent end of operations and the provision would require these funds to be transferred to an external fund. This rationale has not changed, therefore, the provisions of SAFSTOR funding remain the same in the final rule.
- 4. Funding plans. A number of commenters indicated that it was important for the funding plan to be updated over the operating life of the facility because there would be increases in costs over the facility 67 Enclosure A
_ _ _ _ _ _ - - _ _ _ _ _ _ _ i
[7590-01]. life. Some commenters indicated that there should be periodic adjustments . of the funding level, and most said there sh'ould be a specific frequency-
. j indicated in the regulations with most saying frequencies of 5 years and I some indicating it should be more frequent.
-In response, the Commission agrees with the importance of updating l the funding plan over the operating life of the plant. This was recognized I in the proposed rule which requires that a funding plan include "means of-adjusting cost estimates and associated funding levels over the life of the facility" and which also requires each reactor licensee to update his cost. estimate "at or about 5 years prior to the projected end of opera-tions." In order to clarify that the updates should take place over the course of the facility lifetime, the proposed rule has been modified to indicate that a. funding plan include means of adjusting cost estimates and associated funding levels periodically over the life of the facility.
The frequency for these updates is not included in the rule but is being. considered for inclusion in regulatory guidance and will be reviewed by the Commission in its review of funding plans. This will provide more flexibility in dealing with different types of licensees and financial considerations. It is expected that regulatory guidance will indicate the frequency of adjustment for cost estimate and funding levels. A number of commenters objected to the requirement in the rule that submittals of reactor funding plans be a condition of license. The com-menters indicated that by doing so any change in the funding plan could be interpreted as a license amendment. The commenters arguea that this was unnecessary since the funding requirements do not have a direct impact on the safe operation of the plant. This could have a negative effect on continued plant operations even though there was no safety concern. Most 68 Enclosure A
[7590-01] commenters agreed that the requirements would be better promulgated as regulations which would not decrease NRC's enforcement authority. In response, the Commission has considered these comments in the light of the need to provide reasonable assurance of the availability of funds for decommissioning and agrees that the funding requirements do not have a direct impact on the safe operation of the plant. Hence the proposed rule has been modified to include the reactor funding requirements as a specific requirement in S 50.74. The obligation to provide financial assurance is retained as a regulatory requirement in the amendments.
- 5. Funding requirement for material licensees. For material licensees, the proposed rule contained provisions that an applicant or licensee may subir.it a certification that financial assurance for decom-missioning will be provided in a prescribed amount stipulated in proposed 10 CFR Parts 30, 40, and 70. The amount is dependent on the quantity of licensed material which the licensee possesses. Two commenters indicated that the cost amounts prescribed in the regulations for 10 CFR Parts 30, 40, and 70 licensees are too high for the quantities of material listed and that the prescribed cost amounts should be set more realistically or the prescribed radioactivity levels should be increased. One of the two commenters who felt the estimates were too high noted that the multiples of Appendix C quantities prescribed in the rule for some isotopes amount to absolute quantities of less than a curie and the commenter did not think that the decommissioning costs for such a license would amount to the sums prescribed in the proposed rule. The other commenter indicated as an example that the amount of Am-241 in unsealed form requiring a decommissioning cost of $500,000 is 10 millicuries. Three other commenters felt that the prescribed amounts appeared to be too low and 69 Enclosure A
[7590-01]. 1 L cited specific examples to support their claim. These included the I following: cleanup of a U.S. Army building which had burned cost over
$300,000; cleanup of the extensive contamination at a USAEC contractor facility at Weldon Spring cost $200,000,000; cleanup of four igloos at the Seneca Army Depot by the U.S. Army cost $300,000 to $1,000,000; l cleanup and storage of contaminated soil by DOE in the vicinity.of the W.
R. Grace and Stepan Chemical facilities cost $2-4 million. In addition, one of the commenters pointed out that use of contractors to perform the work could increase costs. In response to the commenters who felt the estimates were too high, it is the opinion of the Commission that based on the data base cited in the Supplementary Information to the proposed rule that the prescribed amounts are reannable estimates and that it is not the rule's intent that the indicated costs be used in every situation. The purpose of setting the amounts is to provide an approach which minimizes the burden on the majority of licensees and on the NRC while providing assurance of funds for decommission;ing. If, in a particular case, the costs are too high, the licensee has the option of submitting a funding plan with a facility specific cost estimate. In response to the commenters who felt the estimates were too low, certain points must be considered in assessing the comments and the examples cited. Some of the examples appear to be cases where there was accidental spread of contamination beyond that normally encountered. The funding assurance provisions of the proposed rule are not intended to address the costs of cleanup resulting from an accident. Provisions for funding of cleanup of accidental releases of radioactive material are 70 Enclosure A
l: ;. .,. [7590-01] currently under consideration in a separate rulemaking (see Advanced Notice of Proposed Rulemaking published June 7, 1985, 50 FR 23960). Anotner point to consider is that certain facilities contain larger quantities of radioactive material than are specified in the sections of the rule amendments (i.e., SS 30.35, 40.36, and 70.25) permitting use of a prescribed funding amount. Licensees of these facilities would be required to submit a decommissioning funding plan containing a cost estimate specific to those larger facilities. Under the provisions of the appropriate sections, licensees of these larger facilities would be permitted to initially use a prescribed amount of $750,000 in their financial assurance planning. However, use of this prescribed amount is only a temporary action which is intended to reduce the administrative effort associated with implementation of the rule amendments and these licensees are required by the indicated section of the rule to eventually submit a funding plan (with the facility decommissioning cost estimate) at the time of application for license renewal. PNL has provided updated decommissioning cost estimates to NRC for use in the Final Generic Environmental Impact Statement. Appropriate information has been taken from those updates for use in the final rule to account for factors such as inflation. The cost estimates for mate-rial licensees do not specifically include the assumed use of contractor costs because, based on the PNL studies, the prescribed amounts listed in the rule are considered reasonable in providing adequate funds so that a facility does not become a concern to public health and safety. The additional expense associated with requiring all material licensees to set aside in their funding method the added costs of assuming use of a 71 Enclosure A i _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ J
[7590-01] I contractor is not justified compared to the small number'of licensees:
)
expected.to have to use' contractors. ' The estimated cost of decommissioning is based on activities related to the definition of " decommission".in 10 CFR 30.2 (and similar. sections in other parts) and does not include the cost of removal and disposal of
. nonradioactive structures and materials beyond that necessary to terminate l
the NRC license. Costs of disposal of nonradioactive hazardous waste not L necessary for NRC license termination are not included in the decommis-sioning costs. Several comments were received on the proposed rule sections which 1ist funding methods that 10.CFR Parts 30, 40, and 70 applicants and licensees'may use and that are considered to provide reasonable assurance of the availability of funds for decommissioning. Five commenters indi-cated that this. list was too restrictive and that financial tests of licensees should be utilized in determining acceptable-funding methods for materials licensees. These commenters argued that use of financial tests on a case-by-case basis would improve the degree of financial assurance and eliminate unnecessary cost burdens for many non-utility, non government entities. As precedents and examples of tests which could be used by NRC, the commenters generally referred to the financial tests contained in 40 CFR Parts 264 and 265 for hazardous waste facilities regulated by EPA. The commenters indicated that these tests could be ; used alone or combined witn licensee guarantees of funds, with self-insurance or with internal reserve as acceptable methods for assuring funds for decommissioning. One commenter indicated that letters of credit provided a cost-effective method for his operations. 72 Enclosure A
[7590-01] The Commission did'not include the financial test as an acceptable funding method for materials facilities in the proposed rule. It was felt that because of the potential for changing licensee financial conditions and the fairly lengthy time period involved before decommis-sioning would take place that the financial test would not provide sufficient assurance of the availability of funds for decommissioning. Also, additional staff time could be necessary to monitor the financial status of a number of licensees. This position and the funding methods listed in the proposed decommissioning rule were consistent with the funding methods listed in earlier NRC promulgated rules in 10 CFR Part 40,. Appendix A, regarding requirements for funding the decontamina-tion and decommissioning of uranium mills and tailings, and in 10 CFR 2 Part 61 regarding funding for closure of low-level-waste burial grounds. The commenters point out that the Environmental Protection Agency
, permits the use of financial tests when accompanied by corporate guarantees for its haza Rous waste facilities and recommended that the NRC use similar financial tests for meeting financial assurance require-ments. The staff recognizes that financial tests may be useful in certain situations and can minimize impacts on licensees. Hence, the regulation has been modified in the final rule to specifically permit licensees to use parent company guarantees with accompanying financial tests to meet I
the financial assurance requirements of the regulation. The use of the i parent company guarantee and financial test is taken from the U.S. Environmental Protection Agency's regulations 40 CFR Parts 264 and 265. Use of the parent company guarantee and financial test provides assurance in that the company will provide an independent commitment beyond that l of the licensee to expend funds. This requirement is consistent with 73 Enclosure A _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __._. .1
[7590-01] the NRC's recently promulgated Policy Guidance Regarding Parent Company and Licensee Guarantees for Uranium Recovery Licensees issued in December 1985. A parent company guarantee may not be used in combina-l tion with the other financial methods listed in the rule to satisfy l the requirements of this section. 1 Other funding methods, including letters of credit, will continue to be acceptable for providing assurance of funding. Use of prepayment or other external trust fund is different in approach from use of a surety bond, insurance or other guarantee method. With prepayment, the licensee is actually using the instrument to pay for decommissioning of the facility, while with the second approach, a financial instrument is used as backup to pay for decommissioning in the event that the licensee is unable to complete these activities. If a surety, insurance, or other guarantee method is used to actually pay for decommissioning, the licensee is still fully responsible for all of its decommissioning requirements. As is the case for the nuclear utility industry, NRC intends to periodically review the overall financial status of licensees involved in fuel cycle and materials operations to assess the effectiveness of its regulations. One commenter was concerned that, in the case of licensees having materials licensed under more than one part of 10 CFR and used within common facilities, the rule would require a separate decommissioning plan for each license and recommended that a consolidated plan be allowed. In j response to this comment, in some cases where byproduct, source, and/or special nuclear material are used in the same facilities, it would be very I 74 Enclosure A j
.g n [7590-01] difficult to develop separate decommissioning or funding plans for termin-ating each license, in particular where there is interdependence of facili-ties, operations, or projected decommissic,ning activities. ' Consolidated plans based on a combined analysis of the facility' decommissioning would be permitted. If a licensee operates multiple independent facilities and/or sites under a single license, a consolidated decommissioning or funding plan would have to delineate procedures and cost estimates for each facility / site. The regulatory guides currently under consideration would include further details concerning these situations. The rule is broad enough to encompass these situations. Two commenters expressed concern regarding licensee's responsibility for decommissioning. 0ne commenter indicated that it was not clear in the-proposed rule whether financial assurance' requirements apply to each. license, each licensee, or each facility and recommended that the licensee be specified as the responsible unit. The other commenter expressed the concern that there exists the potential for reducing companies' liability l for decontamination activities should the NRC approved funding plan be inadequate. In response to these comments, it should be noted that amended 10 CFR Parts 30, 40, and 70 require that each holder of a specific license provide financial assurance for decommissioning thus specifically indicating that the licensee is the responsible party for financial assurance. Funding and decommissioning plans submitted where there are multiple materials licensees may be consolidated. It is expected that the requirements contained in amended 10 CFR Parts 30, 40, and 70 will provide reasonable assurance that funds are available for decommissioning nuclear facilities. Specifically, S 30.35 (and related sections in other 1 l l 1 75 Enclosure A _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ - - . _ - - - i
o , [7590-01] parts) requires submittal of a funding plan containing an estimate of the cost of decommissioning or use of a certification of an amount prescribed in the regulations. The cost estimate contained in the funding plan will be based on site conditions and can use, as a base, information developed by Battelle Pacific Northwest Laboratory (PNL) in a series of reports on technology, safety, and costs of decommissioning nuclear facilities. NRC's review and evaluation of the estimate can use not only the PNL reports but experience gained at other materials facility decommissioning. l 1 Section 30.35 also provides that the licensee include provisions in the funding plan for adjusting decommissioning cost estimates and associated funding levels over the life of the facility to take into account changing economic and technical conditions. Even in the event that these efforts result in a shortfall of funds at decommissioning, a matter which concerns the commenter, the regulations specifically state that it is the licensee's responsibility to fund and carry out decommissioning in a manner which protects public health and safety. Accordingly, the licensee would be under a continuing obligation to find the means for completing decommis-sioning.
- 6. Funding requirements for Federal licensees. One commenter, the Department of the Army, indicated that the proposed requirements for Federal agencies, specifically proposed sections in Parts 30, 40, 50, 70, and 72, requiring a certification that the appropriate government entity will be guarantor of decommissioning funds, appear inconsistent with Federal statute. The commenter suggested either NRC should spearhead statutory relief or establish a federal agency funding strategy in order to satisfy the intent of the NRC proposed rule.
76 Enclosure A
. o
[7590-01] The Commission, in responding to this comment, notes that it is based on the provision of the Anti-Deficiency Act, 31 U.S.C. 1341. The Anti-Deficiency Act prohibits the creation of an obligation or the expenditure of funds in excess of appropriations unless the contract or obligation is authorized by law. The purpose of the Act is to " keep all departments of the Government, in the matter of incurring obligations for expenditures, within the limits and purposes of appropriations annually provided for conducting their lawful functions." 42 Comp. Gen. 272, 275 (1962). The Act applies to transactions among government agencies as well transac-l tions between the government and the private sector. See 59 Comp. Gen. 386, 389 (1980). While the Anti-Deficiency Act might prohibit the expenditure of funds for decommissioning in the absence of an appropriation, nothing in the Anti-Deficiency Act prevents a government agency from seeking appro-priations for future obligations. Nor is there anything in the Act that bars a government agency from obligating appropriated funds for the purpose of complying with rules imposed by other government agencies at the time those rules require an expenditure of funds. Thus, in practice, use could be made of other funding methods besides the certification option such as external funding. As discussed in the Supplementary Information to the proposed rule, the purpose of the proposed sections with which the commenter is concerned is to permit licensees to obtain a guarantee that a government agency will q
]
assume financial responsibility for decommissioning the facility. This I would most likely be possible when the licensee is a State or Federal agency or a State-affiliated organization such as a university or hospital. This provision of the rule recognizes that these licensees should be 77 Enclosure A
- _ _ - _ _ _ _ _ - - l
O Q [7590-01] capable of providing funds for decommissioning. The intention of the proposed r'ule is that these State and Federal licensees should, early in their facilities' lifetime, be aware of the eventual decommissioning of i the facility, specifically its cost,'and make their funding bodies aware of those eventual costs. The provisions of the rule requiring naming a guarantor of funds may be subject to misinterpretation. Accordingly, the proposed rule is being modified to indicate that Federal and State licen-sees should provide a statement of intent that they have an estimate of the cost to. decommission their facilities and that they will obtain funds when necessary for decommissioning. This modification should satisfy the need for assurance from these facilities within the constraints of govern-mental budgetary policies.
- 7. General comments on financial assurance. A number of commenters l disagreed specifically with the need for the funding provisions contained in the proposed rule for electric utilities. The primary reasons cited by the commenters for the disagreement were the following: utilities are regulated by State and Federal rate regulators who are bound to set a utility's rates such that reasonable costs of serving the public are recovered; NRC has recently eliminated financial qualifications require-ments for reactors and this is a similar situation; most utilities already recover decommissioning costs in rates; utilities recognize that those who benefit from the plant should pay for decommissioning; and that the proposed rule will impose a financial penalty on utilities, will compli-cate the existing process, and has no benefit.
In contrast, a number of other commenters indicated that there was a need for rules in this area because they had several concerns over whether adequate funds will be available for decommissioning. Several commenters 78 Enclosure A
s.. . [7590-01] l l expressed concern that there mur.t be a clear statement with regard to the
- responsibility for decommissioning and that' utilities should not be able to evade liability for funding of decommissioning costs. In particular one commenter indicated that a utility could avoid liability for decom-missioning by forming " holding companies" which would protect assets from the liability of a shutdown reactor. The commenter indicated that these holding companies could diversify into new ventures outside the scope of Federal and State regulation, could take funds from the power company, and thus leave the electric utility portion of the company in a finan-cially weak condition. This financially weak utility might find it very difficult to fund decommissioning and therefore become a threat to public health and safety. The commenter indicated that the rule should provide guidelines to address these issues otherwise ratepayers would be stuck with this problem and radiological hazards may exist.
In response to these comments it should be noted that the Commission's statutory mandate to protect the radiological health and safety of the public and promote the common defense and security stems principally from the Atomic Energy Act and the Energy Reorganization Act. In carrying out its licensing and related regulatory responsibilities under these acts, the NRC has determined that there is a significant radiation hazard associ-ated with nondecommissioned nuclear facilities and that the public health and safety can best be protected by promulgating a rule requiring reason-able assurance that at the time of termination of operations adequate funds are available so that decommissioning can be carried out in a safe and timely manner and that lack of funds does not result in delays that may cause potential health and safety problems. Although these acts do not permit the NRC to regulate rates or to interfere with the decisions of 79 Enclosure A
O O [7590-01] State or Federal agencies respecting the economics of nuclear power, they do authorize the NRC to take whatever regulatory actions may be necessary to protect the public health and safety, including the promulgation of rules prescribing allowable funding methods for meeting decommissioning costs. (See Pacific Gas & Electric v. State Energy Resources Conservation & Development Commission, 461 U.S. 190, 212-13, 217-19 (1983); see also United Nuclear Corporation v. Cannon, 553 F. Supp. 1220, 1230-32 (D.R.I. 1982) and cases cited therein.) There is a need for such rulemaking because the decommissioning-planning horizon of at least 35 to 40 years for a newly licensed reactor diminishes the assurance that a utility, even a stable highly regulated one, will necessarily have sufficient funds to decommission. This is coupled with the fact that once a plant is shut down it_is no longer a revenue producing asset and, thus, there is little economic incentive to decommission other than to recapture the site for alternative use. In a recent analysis, NUREG/CR-3899, Supplement 1, identified certain concerns regarding the future status of utility decommissioning funds. These are detailed in Section C.4 above. Based on the concerns indicated in the previous paragraph, the Commission approved publication of the proposed rule. Commissioner Bernthal included separate comments (discussed in more detail below) stating that there is a difference between the elimination of financial qualifications requirements for construction and operation and the decom-missioning funding requirements, and expressing the specific need for this rule. In addition, Commissioners Asselstine and Bernthal expressed concerns regarding utility financial assurance and protection of public health and safety, and Chairman Zech indicated that although many 80 Enclosure A i
[7590-01] utilities collect.for decommissioning in rates currently that even if one utility or PUC is not as solid as NRC feels is necessary in terms of planning or execution, that is sufficient reason for the rule. Some of the commenters indicated that there is no need for the rule because there is rate regulation by Federal and State agencies. The NRC i staff recognizes the important role which these agencies have in this area. The NRC staff has had contact with staff of the Federal Energy Regulatory Commission ana with state agencies. These agencies indicated that they recognize the NRC's role in setting standards with respect to health and safety, and, in particular, that they support the rule as it was promulgated with certain modifications as long as it is understood that states may choose among the funding alternatives based on their specific responsibilities and considerations. As discussed in response to a later. comment, the decommissioning amendments are such that these ; agencies are able to do this. FERC and the state PUCs do not have respon-sibility for assuring that decommissioning is carried out in a manner which protects public health and safety. As rate regulators their concern is to protect consumer interest by developing reasonable rates for the provision of public services. Lack of specific guidelines from the NRC may adversely affect the collection of adequate funds for decommissioning. The Supplementary Information to the proposed rule recognized that the funding methods which are considered acceptable in providing reason-able levels of assurance may be different for the various types of nuclear facilities because their situations may be different. For example, as noted above for power reactors, state PUCs regulate retail rates and power reactor licensees are required by 10 CFR 50.54(w) to carry insurance for post accident cleanup. Accordingly, the proposed rule permits electric 81 Enclosure A )
[7590-01] utilities with more than one generating facility to use the internal reserve method of funding which is not permitted for other licensees. 3 In response to comments that there should not be funding requirements for decommissioning because financial qualification requirements for I construction have been eliminated, it is NRC's view that the elimination of financial qualification requirements does not eliminate the need for providing assurance of funds for decommissioning. When the rule on elim-ination of financial qualifications was proposed, the Commission stated that decommissioning.was more properly dealt with in the separate rule-making then underway. In promulgating the proposed rule on decommission-ing, Commissioner Bernthal drew a distinction between decommissioning assurance and the rule on eliminating the financial qualification review at the licensing stage. Factors cited by the commenters, such as the presence of rate regulators or recognition that those who benefit from plants should pay all costs, do not provide reasonable assurance in and of themselves that health and safety will be protected. Some commenters stated that the proposed rule would impose a finan-cial penalty on utilities and complicate the existing regulatory process. The NRC staff does not believe that this will occur. The proposed rule has the narrow focus of protecting public health and safety by having in place basic minimum standards for funding methods which provide reasonable assurance of funding for decommissioning in a safe and timely manner. The methods allowed include a variety of methods currently available to licen-sees and as noted in Section C.2 the certification of funding levels j l which may be more than but not less than amounts prescribed in the rule ] 1 is included as a means for minimizing licensee burden in complying with
)
the amended regulations. The rule, and the NRC's implementation of it, Y l 82 Enclosure A i
)
_ _ -- /
[7590-01] does not deal with financial ratemaking issues such as rates and proce-dures for fund collection, cost to ratepayers, taxation effects, equity, and other concerns. These matters are outside NRC's jurisdiction and are the responsibility of the state PUC's and FERC. NRC proposed rules would not prevent a state from choosing a more stringent alternative for specific cases which they are considering within the content of the general standards. This is discussed in more detail in response to a later comment. Based on the above discussion, the Commission believes that the rule is an equitable means of requiring reasonable assurance of funding for ! decommissioning without imposing an undue burden on licensees. With regard to the specific concern regarding formation of holding ! companies, the concern of the commenter can be alleviated by appropriate action of the Securities and Exchange Commission (SEC) and the NRC.
- Public utility holding companies are regulated by the SEC pursuant to the Public Utility Holding Company Act, 15 U.S.C. 79-792 (1982). The purpose of the Act is to protect investors and customers by prohibiting abuses of public utilities by their holding companies. Some of the features of the Act are important in alleviating the concerns raised by the commenters.
Section 4 of the Act prohibits an unregistered holding company from operating an electric utility. The prohibition also extends to the issuance of stock. Thus, any electric utility that operates as a holding company must register with the SEC. Sections 9, 10, and 12 of the Act prohibit certain types of transactions unless the SEC approves the trans-action. Approval of the transaction requires submission of a plan to the SEC which the SEC must approve unless it finds that the proposed transaction 83 Enclosure A \... .
[7590-01] will, among other things, be detrimental to the public interest. Thus, a reorganization of a utility's assets in a manner that may affect its abil-ity to decommission the facility may not be approved by the SEC or may be subject to substantial restrictions with respect to the redeployment of assets. Compare Municipal Electric Association v. SEC, 413 F.2d 1052,}}