ML17146B174

GL 96-06 Risk Assessment for Sses.

ML17146B174
Person / Time
Site:	Susquehanna
Issue date:	08/03/1999
From:	PENNSYLVANIA POWER & LIGHT CO.
To:
Shared Package
ML17146B173	List: ML17146B174
References
EC-RISK-1073, GL-96-06, NUDOCS 9908120059
Download: ML17146B174 (52)

Text

0 t EC-RISK-1073 PAGE 2 TABLE OF CONTENTS PAGE

2.0 CONCLUSION

S

3.0 BACKGROUND

AND ISSUE RESOLUTION 3.1 Background 3.2 Issue Resolution 3.2.1 Identification of Licensing Basis Issue 3.2.2 Structures, Systems, Components (SSCs) and Procedures Covered by the Licensing Basis Issue 3.2.3 Supporting Information 4.0 ENGINEERING ANALYSIS 4.1 Deterministic Analysis 9 4.2 Overview of Risk Analysis and Conclusions 12 4.2.1 Methodology for Evaluating the Probability of Containment Penetrations 13 4.2.1.1 Evaluation of Current Designs to Overpressure Failure of Containment Penetrations 13 4.2.2 SpeciTic Evaluation of Penetrations 14 4.2.2.1 Evaluation of RBCCW, RBCW, and the Head Spray Line 14 4.2.2.2 Evaluation of Drywell Sump Line 23 5.0 IMPLEMENTATIONAND MONITORING PROGRAM 26

6.0 REFERENCES

27

'I 9908i20059 990803 PDR ADGCK 05000387 P PDR

EC-RISK-1073 PAGE 3

1.0 INTRODUCTION

On September 30, 1996, the NRC issued Generic Letter 96-06, "Assurance of Equipment Operability and Containment Integrity During Design-Basis Accident Conditions." In the Generic Letter, the potential for thermally induced overpressurization of sections of containment piping which are isolated during design basis accidents was identified. With respect to this potential, licensees were requested to:

1) evaluate their plant design and determine if containment piping systems are susceptible to thermally induced pressurization;-

2) evaluate the Operability of affected piping and systems;

3) identify long term corrective actions that will be taken in order to provide compliance with the plant's design basis; and

4) complete these evaluations and submit a report within 120 days.

In November of 1996, the NRC issued supplementary information to the generic letter regarding specific regulatory expectations. At that time, it was clariTied that the concerns for piping overpressurization during design basis accidents not only applied to piping inside containment, but-also to containment penetrations (i.e., the piping between the two isolation valves).

As licensees evaluated the potential for thermally induced overpressurization for their specific plant designs, it became apparent that the risk significance (and hence the actual impact to plant safety) of this phenomenon was relatively low. This p'erspective was reflected with the issuance of Supplement 1 to the Generic Letter, as well as through the staff's interaction with licensees and industry groups, which encouraged the use of risk-based insights. Although the thermal overpressurization concerns identified in the generic letter did not represent a safety issue, compliance with a plant's licensing basis, i.e., code requirements, was (and is) nonetheless still required. Therefore, for the SSES units, the focus of the overpressurization issue was (and is) one of compliance with the ASME code.

PP8L has evaluated containment piping and penetrations per the Generic Letter and has identified twelve instances where overpressurization failure of piping may occur.

Like the staff, PP8L concluded that the potential for overpressurization of these specific

'enetrations is not a safety concern due to the considerable margin in the design.

Additionally, PP8L concluded that all ASME code requirements were satisfied by the current design. However, the NRC staff interpretation of the ASME code differs from that of PP8L. Based upon the NRC staffs interpretation, the twelve penetrations identified as being susceptible to overpressurization failure did not meet the ASME code requirements.

PP&L has evaluated plant modifications that resolve the staffs open compliance issues.

These modifications involve the installation of relief valves on the susceptible pipes and penetrations. The preliminary cost for engineering and installation of these

I EC-RISK-1073 PAGE 4 modifications is estimated to be $ 2,000,000.00. Additionally, it is estimated that the In-

,Service Inspection (ISI) and Maintenance cost is at least $ 20,000.00/year. In addition to the financial burden associated with the modifications, a radiation exposure burden to employees would be incurred during installation, periodic ISI and Maintenance. Finally, while the proposed modiTications resolve the ASME code interpretation issue, it is

'expected that they will result in forced shutdowns during the plant life and may increase the probability of penetration failure. Therefore, PPBL committed to approach resolution of the ASME code interpretation issue through a risk-informed submittal.

The resolution of this is being pursued as, "A Risk-Informed Plant Specific Change to the Licensing Basis." Therefore, the guidance outlined in Regulatory Guide 1.174 is being applied in this assessment. Specifically, the regulatory guide identifies evaluation of the following elements as an acceptable approach to risk-informed decision making.

~ Element 1 Definition and Purpose of Proposed Change

~ Element 2 Engineering Analysis

~ Element 3 Implementation and Monitoring Program This assessment is structured to address each of these elements as presented in the Regulatory Guide. The level of detail provided in this assessment is based upon the guidance in Office Letter 803. This issue is seen as having a low risk significance, moderate complexity and similarity with the model in NUREG-0933.

2.0 CONCLUSION

S P

The NRC evaluation of this issue is documented in NUREG-0933 along with the following conclusions.

The estimated public risk associated with overpressurizafion of containment penetrations was nof significant. Based on the valuefimpact assessment and fhe staf's simplified engineering analysis, this issue was placed in the DROP category.

PP8 L's work confirms that the NRC staffs conclusion is valid for Susquehanna. This confirmation is based upon the following speciTic conclusions.

~ The potential for overpressurization failure of containment penetrations, as currently configured, is insignificant per the Regulatory Guide 1.174 criterion of 10 increase in Large Early Release Frequency (LERF).

~ The modifications to the Susquehanna Emergency Operating Procedures provide additional defense in depth against loss of containment integrity due to penetration failure.

EC-RISK-1073 PAGE 5

~ The hardware modifications to resolve the compliance issue do not reduce and may, in fact, increase the likelihood of penetration failure.

~ The hardware modifications to resolve this compliance issue result in additional radiation exposure to employees for installation, periodic ISI and maintenance.

~ The potential for penetration failure from overpressurization does not warrant the expenditure of $ 2,000,000.00 for modifications and $ 20,000.00 annually for maintenance.

~ The potential for penetration failure from overpressurization does not warrant increasing the additional exposure to forced shutdowns associated with the proposed hardware modifications.

~ Changes to the Emergency Operating Procedures are effective at reducing the likelihood of penetration failure.

Based upon these specific conclusions, the Emergency Operating Procedure changes implemented by PP8L resolve the compliance issues associated with GL 96-06.

3.0 BACKGROUND

AND ISSUE RESOLUTION 3.1 Background As discussed in the Introduction, GL 96-06 addressed overpressure failure of both piping in the drywell and containment penetrations. PP&L has evaluated the Susquehanna design for both of these concerns. The results of these evaluations are summarized below.

Containment Piping Pressurization Under DBA Conditions In PP8L's 120-day response to the Generic Letter, the potential for thermally induced overpressurization of several containment closed loop piping systems during design basis accidents was identified. The closed loop piping systems that are susceptible to this mechanism are:

1) non-safety-related Reactor Building Closed Cooling Water (RBCCW) piping to/from the reactor recirculation pumps;

2) non-safety-related Reactor Building Chilled Water (RBCW) piping to/from the reactor recirculation pump motors;

3) non-safety-related RBCW piping to/from the drywell coolers; and

4) non-safety-related drywell floor drain sump pump discharge lines.

Although susceptible to this mechanism, the potential for these systems to pressurize does not threaten the function of any safety-related equipment required to mitigate the consequences of a design basis accident. Further, it should be noted that the

EC-RISK-1073 PAGE 6 assumption that this piping is not available during design basis accidents is already an jntegrql part of the SSES design and licensing bases.

If the RBCCW and/or RBCW were to remain intact during a design basis accident and undergo a thermally induced pressure increase, the conditions required to cause the overpressurization do not create a credible leakage path for the transmission of fission products from the primary to secondary containment. Inboard isolation valves are in the drywell. Therefore, a piping failure in the drywell will not result in a release.

While no corrective actions are required to resolve the potential for overpressurization of RBCW and RBCCW closed loop piping inside containment, the potential for overpressurization,of the drywell floor drain sump pump discharge piping is possible and is the subject of this risk-informed submittal because both containment isolation valves are located outside the primary containment.

Containment Penetration Pressurization Under DBA Conditions In addition to the closed loop systems referenced above, PPB L's 120-day response also identified the potential for thermally induced overpressuriz'ation of twelve containment penetrations (per unit) during design basis accidents. These penetrations are:

1) RBCCW supply and return lines to the reactor recirculation pumps (2);

2) RBCW supply and return lines to the reactor recirculation pump motors (4);

3) RBCW supply and return lines to the drywell coolers (4);.

4) Residual Heat Removal (RHR) head spray line (1); and

5) 1" Demineralized water line to the drywell (1).

All of the affected primary containment penetrations, which are potentially susceptible to this mechanism during design basis accidents, support non-safety-related system functions. Therefore, this potential does not threaten the availability of safety-related equipment required for design basis accident mitigation. In addition, as documented in PPB L's 120-day response and subsequent follow-up correspondence, the potential for overpressurization of the affected penetrations does not create a credible leakage path for the transmission of fission products from the primary to the secondary containment.

Corrective actions, in the form of procedural changes, have been taken to eliminate the susceptibility of the referenced demineralized water penetration, which is only used for outage-related maintenance activities. However, the potential for overpressurization of the referenced RBCW, RBCCW, and RHR penetrations is the subject of this risk-informed submittal.

3.2 Issue Resolution In PPB L's 120-day response and subsequent correspondence, PPB L identified the engineering position that the existing SSES containment piping B penetration

, configurations are in compliance with the applicable existing licensing and design

EC-RISK-1073 PAGE 7 bases. This conclusion is based on a review of SSES design-related documents, which

,included the SSES FSAR, GE and Bechtel design specifications, as well as our interpretation of the applicable ASME Code.

II The effective ASME Code for the Susquehanna Units is the 1971 Edition with addenda through Winter 1972. Sub-section NC/ND-3621.2 identifies the effects of fluid expansion as a general design consideration, but in a broad and nondescript fashion.

For the "faulted conditions," which correspond to those incurred during a design basis accident, no specific design guidance or acceptance criteria is provided for evaluating isolated sections of ASME Class 1, 2, and 3 piping, which are exposed to an external heat source causing thermal expansion of entrapped fluid.

Although the design of the subject penetrations and piping is seen to be in compliance with existing licensing and design basis requirements, PP8L supported EPRI efforts to address the potential for piping overpressurization under design basis accident conditions. The EPRI efforts consisted of analytical evaluations, as well as laboratory testing, which would allow for an analytical disposition of the staffs concerns as originally identified in the Generic Letter. Specifically, this work was aimed at establishing plastic strain limits that could be used in the evaluation of thermally induced pressurization of isolated sections of pipe.

However, various issues regarding the use of strain based acceptance criteria remain unresolved and this approach does not appear to have universal acceptance. In addition, further EPRI testing aimed at resolving these issues has been indefinitely postponed. Therefore, the use of strain based analytical methodologies does not appear to be a viable path towards PP8L's ultimate resolution to Generic Letter 96-06.

In addition to supporting the EPRI work, PP8L has considered the installation of pressure relief devices on the affected penetrations to offset the effects of thermally induced pressurization during design basis accidents. However, it is PP8L's position that the installation of such devices on the affected penetrations complicates the existing containment configuration, and negatively impacts plant reliability and operation, without resulting in a net improvement in nuclear safety. In addition, preliminary estimates for the engineering and implementation of these modifications would exceed $ 1,000,000 dollars per unit, and ISI and maintenance costs would be well in excess of $ 20,000 per year.

\

In an industry / staff workshop held in December 1997 in Gaithersburg, Maryland, NRC staff and industry representatives both identified that the potential for thermally induced overpressurization during design basis accidents was not of risk significance, nor of safety consequence, but was rather a "licensing basis concern."

3.2.1 Identification Of Licensing Basis Issue As previously stated, PP8L believes that the existing SSES containment configuration is in compliance with all applicable design and licensing requirements, and that it provides

0 I

EC-RISK-1073 PAGE 8 an adequate margin of nuclear safety. Altering the current plant design via the installation of overpressure relief devices would negatively impact plant reliability and impose unnecessary cost, without resulting in any gain in nuclear safety. At the referenced Gaithersburg meeting, the guidance provided in COMSAJ-97-008, which illustrates the vinculum between compliance and safety, was identified as a consideration in the staffs introductory remarks. It is therefore deemed reasonable that the use of risk-informed rationale be considered to resolve the staffs concerns regarding the potential for overpressurization of containment piping and penetrations during design basis accidents, as originally identified in Generic Letter 96-06.

It is therefore the intent of this risk-informed assessment to:

1) provide evidence that the existing containment configuration provides for an ample margin of nuclear safety;

2) demonstrate that the installation of overpressure relief devices will not improve nuclear safety; and

3) gain regulatory acceptance regarding PP&L's position that the installation of overpressure relief devices on the affected penetrations is not necessary.

The use of a risk-informed approach maintains the existing nuclear safety margin, while minimizing the impact on plant operations, testing, and reliability. Furthermore, while preserving the current margin of safety, the unnecessary burden of man-rem accumulation during the installation and future maintenance/testing of overpressure devices will be avoided. The regulatory acceptance of this position will allow for the closure of Generic Letter 96-06 for the SSES Units.

3.2.2 Structures, Systems, Components (SSCs) And Procedures Covered By The Licensing Basis Issue PP8 L's engineering evaluation for Generic Letter 96-06 revealed that a total of twelve penetrations (per unit) were susceptible to thermally induced pressurization. The susceptibility of one penetration, a 1" demineralized water line, has been eliminated through procedural changes: For the remaining penetrations, PP8L originally elected to pursue resolution through an analytical disposition. However, the success of that approach is questionable with the termination of EPRI research. Therefore, the following penetrations remain potentially susceptible to thermally induced pressurization during design basis accidents:

1) RBCCW supply and return lines to the reactor recirculation pumps (penetrations X-23 8 X-24);

2) RBCW supply and return lines to the reactor recirculation pump motors (penetrations X-85A, X-85B, X-86A, 8 X-86B);

3) RBCW supply and return lines to the drywell coolers (penetrations X-53, X-54, X-55, & X-56); and

4) RHR head spray line (penetration X-17).

EC-RISK-1073 PAGE 9 In addition to these penetrations, the potential for overpressurization of the drywell floor drain qump pump discharge piping during design basis accidents could potentially affect its associated penetration (X-72B) because both isolation valves are located outside of the primary containment. Therefore, there are a total of twelve penetrations (per unit) that require resolution with respect to the staffs concerns regarding overpressurization, as identified in the generic letter.

3.2.3 Supporting Information A licable Codes And Standards As previously stated, the affected penetrations were designed and fabricated in accordance with the ASME Code,Section III, 1971 Edition with Addenda through Winter 1972. The sub-section of the Code which is applicable to overpressurization requirements during design basis accidents is NC/ND-3621.2.

En ineerin Studies And Evaluations US NRC NUREG-0933, Revision 1 (A Prioritization of Generic Safety Issues),

dispositions Generic Issue 150 (Overpressurization Of Containment Penetrations) based on the fact that the estimated risk to the public was not significant.

PPBL Study EC-059-1025, Revision 0 (Engineering Evaluation of Generic Letter 96-06) was developed in support of PPBL's 120-day response to the Generic Letter. In that study, SSES containment piping systems'were evaluated, and those that are potentially susceptible to thermally induced overpressurization were identified. In addition, the rationale that demonstrated the Operability of the affected penetrations, in light of the concerns identified in the generic letter, was also developed.

4.0 ENGINEERING ANALYSIS This Section presents a description of the Engineering Analysis performed to resolve the ASME code interpretation issue. Both traditional deterministic defense in depth analysis and a probabilistic assessment are presented. The ASME code issue concerns overpressure protection of containment piping and penetrations. Therefore, this analysis is focused on the failure of the containment penetrations to provide isolation during design basis events and the impact on the Large Early Release Frequency (LERF) for all events. The traditional deterministic evaluation is presented first, followed by a risk analysis.

4.1 Deterministic Analysis The following considerations regarding the potential for thermally induced overpressurization of piping systems were originally identified in PP&L study EC-059-1025, Rev. 0, and are reiterated here as supporting information.

EC-RISK-1073 PAGE 10 Factors which Miti ate Pressure Rise There are a number of mitigating factors which are likely to limit, or even completely offset, a thermally induced increase in pressure in isolated sections of pipe. These include, but may not necessarily be limited to the following:

~ Air Pockets / Voids/Compressibility The existence of air pockets is possible, if not likely, in vent lines, valve cavities, turbulent areas, and other non-uniform piping geometries. Although the presence of air pockets or voids is difficult to quantitatively demonstrate, the compressibility of air acts as a "buffer" and can signiTicantly inhibit the extent of a pressure increase, and hence piping stress. This "buffer" effect was actually demonstrated in the EPRI tests in that a water temperature increased about 20 'F before any pressure increase was observed (EPRI TR-108812).

~ Piping Expansion The piping itself will thermally expand as containment temperatures increase.

Although the extent of the thermal expansion is limited, the associated increase in piping volume will aid in reducing the extent of the overpressure condition. In addition, although no plant-specific strain based evaluations were performed for SSES, it is possible, and even likely, that plastic deformation of the affected piping would aid in relieving excess pressure.

~ Valve Leakage (i.e., Seat, Bonnet, Packing, Flange)

In demonstrating the Operability of affected piping sections, PP8L has not categorically credited actual isolation valve leakage as a mitigating factor. The reasons for this include: a) "as-found" and "as-left" valve leakage varies with each refueling outage; b) LLRTs typically measure leakage in the accident direction and, hence, do not always verify leakage in the direction of overpressurization; c) most of the affected penetrations are connected to closed loop piping systems, which are also susceptible to the effects of thermally induced pressurization; and d) most of the LLRTs for the affected penetrations are pneumatic tests (since the closed loop piping inside'containment is not credited as a containment barrier), and for these penetrations, the test leakage rates may not'be directly comparable to the "water filled" condition.

However, for most events, the thermally induced volumetric increase of the piping inventory is relatively small. In addition, as a result of the "incompressibility" of water, small amounts of leakage can act to limit, or even completely offset thermally induced pressurization. Hence, isolation valve leakage could nonetheless provide a significant effect in mitigating the extent of, pressurization for the affected sections of pipe.

EC-RISK-1073 PAGE 11 Barrier Evaluation (Applicable to RBCCW, RBCW, and RHR Penetrations)

While the mitigating factors discussed above may either partially or totally offset any thermally induced pressure rise, the extent of these effects is difficult to positively quantify. For this reason, the Operability of the affected penetrations was demonstrated by an alternate line of reasoning. This rationale consists of a simple appraisal regarding the actual threat, for thermally induced pressurization to create a release pathway (for the transmission of fission products) from the primary to the secondary containment.

This "barrier failure" approach is the most viable indicator of any credible degradation of safety, and the foremost means to demonstrate that the potential for overpressurization will not result in unacceptable off-site radiological consequences.

An evaluation to assess the impact of an overpressure induced failure of a penetration, coupled with an additional failure due to closed loop overpressurization, was therefore performed. In addition, the effects of a single active failure of either the inboard or the outboard isolation valve (to close) were considered. In this evaluation, the relief of an overpressure condition through the simultaneous rupture of valves or piping at more than one location of the affected volume was not deemed credible. The following summarizes the basic rationale and conclusions regarding the affected penetrations.

If an affected containment penetration exhibits a pressure increase during a design basis accident, it is indicative that its isolation valves are extremely leak tight. In the event that excessive pressurization resulted in a rupture, the pressure would be relieved on either the inboard or outboard side of the penetration. If the failure occurred inside primary, containment, excessive leakage into secondary containment would not result since the outboard isolation valve would remain as a barrier. Note that this is the more likely case since the subject penetrations have a greater length of piping (with a more complex geometry) inside containment, and this piping is subjected to more severe temperatures than the piping external to primary containment.

If a piping or valve packing failure occurred on the outboard side of the penetration, a release path to secondary containment could potentially be created after most of the water is pushed out of the penetration. However, in the event of such a failure, the worst case leakage through the affected penetration would equal the inboard valve leakage that would be at most, the penetration's "maximum path leakage" if no additional failures occur. Both the "minimum path leakage" and the "maximum path leakage" for SSES containment penetrations are quantified per the SSES LLRT program, and both are maintained within administrative and regulatory limits. Even if every susceptible penetration ruptured outside of containment, the total resulting containment leakage would still be within the cumulative allowable leakage rate for Type "8" and "C" local leak rate tests (0.6 L, or 190,744.7 SCCM). Therefore, under design basis conditions, the potential for thermally induced pressurization would not result in a loss of containment integrity. That is, total leakage would still be within Appendix J allowable limits.

EC-RISK-1073 PAGE 12 Finally, it should be noted that a longitudinal rupture along the length of the penetration,

,which,could result in communication between primary and secondary containment, is not considered credible. This is due to the fact that the containment wall is poured directly around the penetration piping (except RHR), thus preventing this type of failure.

The RHR penetration has a fluted head, which prevents longitudinal ruptures since it is massive compared to the pipe. Therefore, in all cases, it was concluded that the potential for thermally induced pressurization of isolated piping sections will not result in a pathway for the release of fission products to secondary containment.

Safet S stem 6 eration The RBCCW and RBCW systems and the drywell floor drain sump pump discharge lines are all non-safety systems and the overpressurization of associated piping does not threaten the function of any safety-related equipment required to mitigate the consequences of design basis accidents.

Since the RHR system would be in operation post-accident, the differing ways in which the RHR head spray penetration could fail were evaluated to assure that containment integrity is maintained, and system operation would not be affected. The first failure postulated was rupture of the penetration piping line between the inboard and outboard.

~

isolation valves. A failure of this type would only result in the leakage of fluid contained between the two isolation valves, and would not affect the post accident operation of the RHR system.

The second type of failure that was postulated for the RHR head spray line is a failure of or at the outboard isolation globe valve. In this case, the pressure would be relieved at the outboard isolation valve's pressure seal and/or packing. The concern then becomes that the valve failure could provide a leakage path to secondary containment for fluid being circulated by the RHR system, from primary containment to secondary containment. However, evaluations have determined that the seating capabilities for this valve will provide positive sealing at RHR system pressures for at least four times the maximum RHR system operating pressure at the head spray penetration. It is, therefore, concluded that the potential for thermally induced pressurization of the head

. spray penetration will not impact RHR system integrity during post accident operation.

4.2 Overview of Risk Analysis and Conclusions This section provides a discussion of the risk evaluation performed to determine the contribution of thermally induced overpressurization failure of piping penetrations on the probability of penetration failure. The increase in penetration failure probability is conservatively added to LERF for comparison to the criterion in Reg. Guide 1.174. The evaluation consists of three analyses. First, the probability of penetration failure given the current design is evaluated. Second, the probability of penetration failure given the proposed fix is evaluated. Finally, an estimate of the additional forced shutdowns from the proposed fix is evaluated. The conclusions from these analyses are that:

EC-RISK-1073 PAGE 13

~ the contribution from overpressurization failure on the overall penetration failure probability given the current design is insignificant;

~ the proposed fixes actually increase the probability of penetration failure over the current design; and

~ the proposed fixes increase the likelihood of a forced shutdown.

Therefore, additional expenditures associated with the proposed fixes are not warranted. Each analysis is discussed below.

4.2.1 Methodology for Evaluating the Probability of Containment Penetrations This Section discusses the methods used to assess the probability of containment penetration failure. The evaluation of current designs is presented first followed by a discussion the proposed solution to the problem.

4.2.1.1 Evaluation of Current Designs to Overpressure Failure of Containment Penetrations The evaluation of the current design's probability of failure follows the approach in NUREG-0933. The analysis in the NUREG is based upon the model that the following events are necessary for containment penetration failure:

1. Containment isolation is successful, P[0],

2. Water is trapped between the, inboard and outboard isolation valves, P[1],

3. The isolation valves are leak tight, P[2),

4. Containment heating causes heating and expansion of the water trapped between the isolation valves overpressurizing the pipe until rupture, P[3], and

5. Failure of the penetration provides a leak path from the primary containment to the reactor building, P[4].

The P[] associated with each event represents the probability of occurrence. The probability of containment penetration failure from thermally induced overpressurization becomes:

4 p =

Q p[i] Eq. 1 isO The risk analysis consists of assessing the probability of each of these events occurring for each of the penetrations in question. General considerations are addressed first followed by a specific evaluation of each penetiation.

EC-RISK-1073 PAGE 14 P[0], Success of Containment Isolation The penetrations in question all receive isolation signals from either High Drywell Pressure, or RPV level 2 (-38"). These signals occur in response to the following initiators:

~ Main Steam Isolation Valve (MSIV) closure,

~ Loss of Off Site Power (LOOP),

~ Loss of an AC/DC bus, Loss of either Containment Instrument Gas or Instrument Air (CIG/IA),

~ Loss of Service Water or Turbine Building Closed Cooling Water (SW/TBCCW), and

~ The full spectrum of LOCA events.

When summed together, these events occur about 0.5 times per year and contribute, about 62% of the core damage frequency (the frequency is varied as part of a sensitivity study). Either 2 MOVs or 2 AOVs in series are used to perform the isolation. Both valves must fail for failure of the isolation function. Overpressurization is only an issue if the isolation function is successful. Since the probability of success is near one, it is assumed that the isolation of the containment penetration is successful. An evaluation of each of the penetrations follows.

4.2.2 Specific Evaluation of Penetrations As discussed in Section 1.2, twelve penetrations are susceptible to overpressurization failure. Eleven of these twelve penetrations have a similar design. They include:

RBCCW, RBCW and the RHR head spray line and are discussed generically in Section 4.2.2.1. The drywell sump discharge piping is considerably different and, therefore, is discussed separately in Section 4.2.2.2.

4.2.2.1 Evaluation of RBCCW, RBCW and the RHR Head Spray Line This Section addresses the RBCCW, the RBCW and the RHR head spray line penetrations. These penetrations all have inboard containment isolation valves inside the drywell and the outboard containment isolation valves in the reactor building. All of the penetrations have the potential to be water solid at the time of isolation. A schematic is provided below along with a brief description of the piping arrangement.

EC-RISK-1073 PAGE 15 Containment Wall

>>6'utboard Isolation V e Inboard Isolation valve Figure 1 Typical Containment penetration The RBCW and RBCCW penetrations consist of a pipe with the containment wall poured directly around the pipe. The two RBCCW penetrations are 4 inches in diameter. There are two sets of RBCW penetrations. One set is used to provide cooling to the, reactor recirculation system pump motors and'are 3 inches in diameter. The other set is used to provide for drywell cooling and are 8 inches in diameter.

The RHR head spray pipe is designed with a fluted end. The pipe diameter is 6 inches.

This pipe is free to expand and is likely to fail either circumferntially at a weak weld, or longitudinally at a weak point in the pipe between the isolation valves. Therefore, failure could occur anywhere along the pipe.

P[1] Water is trapped Between the Inboard and Outboard Isolation Valves The probability that water is trapped between the isolation valves, P[1), is assumed to be one. RBCW and RBCCW are closed cooling water systems and are required for normal plant operation. Proper operation of the systems requires that they be filled and vented. Closing the isolation valves will not cause a reduction in the piping system inventory. Therefore, a probability of one is assigned to P[1] for both RBCW and RBCCW.

The RHR system is not a closed cooling water system. The RHR system piping is maintained pressurized by the condensate transfer system and is periodically filled and vented. Additionally, the RPV provides a significant back pressure to the RHR piping, albeit, through a check valve. The isolation valves are closed during normal operation.

Therefore, it is reasonable to expect the RHR penetration to have water trapped between the isolation valves.

P[2] Isolation Valves are Leak Tight The probability that the isolation valves are leak tight, P[2], is assumed to be one. As discussed above, both RBCW and RBCCW are closed systems. Leakage through the outboard isolation valve will not result in piping pressurization due to the capacitance of

I EC-RISK-1073 PAGE 16 the head tank. Leakage through the inboard isolation valve into piping in the drywell

,would. be subject to pressurization. However, this piping is subject to the same heating from the drywell environment. A LOCA will reduce the RPV back pressure, however, the isolation valves are tested for leak tightness. Therefore, it is assumed that the penetration valves do not leak and that the penetration remains leak tight.

P[3] Containment Heating Causes the Penetration to Rupture lit Estimating the probability that the containment will reach a sustained temperature sufficient to rupture requires an evaluation of the penetrations mechanical strength and the containment temperature for a spectrum of accidents. The rupture pressure of the penetration pipe is difficult to estimate since, as described in NUREG-0933, there are many physical processes that mitigate the potential pressurization from heating the fluid in the penetration. This fact is illustrated by an event that occurred at the Susquehanna plant.

On March 18, 1992, Susquehanna 2 experienced an electrical fault that caused all 8 RBCW penetrations to isolate for 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> (SOOR 2-92-024). Average Drywell temperature reached 165 'F. No penetration or piping problems occurred as a result of this event. Only one valve in each penetration closed. This fact is not important because all of the piping in containment increased in temperature and handled the pressure increase. The normal RBCW system inlet temperature is 50 'F. The discharge temperature is expected to be 15 'F to 20 'F higher than the inlet. The discharge temperature when the isolation occurred was 68 'F. When Drywell Cooling was started 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> later, the initial RBCW discharge temperature peaked at 139 'F.

This indicates that portions of the piping in the drywell reached that temperature or higher without causing any problems. The piping in containment is designed to Power Piping Code ANSI B31.1 while the penetration piping is designed as ASME Section III Class 2 piping. This event provides indication that thermally induced pressurization is not as severe as calculations with conservative assumptions suggest.

This event does not preclude penetration failure for higher temperatures. Therefore, it is assumed that penetration failure will occur if cooling to the drywell is not restored.

Drywell Cooling (ES-134-001) can be restored by either restoring drywell cooling or initiating drywell sprays. Restoration of drywell cooling is allowed if a LOCA is not the cause of the containment isolation. LOCA is interpreted as an unexplained high drywell pressure or low RPV water level (-129"). Drywell sprays are initiated after the suppression chamber pressure exceeds 13 psig.

J Penetration failure is a concern when a large radioactive source term is available for release in the drywell. This implies a core damage event. The production of hydrogen during the core damage process is sufficient to pressurize the containment well above 13 psig. Therefore, the operator is authorized to initiate the drywell sprays for containment cooling whenever the penetration failure is an issue. Additionally, PP8 L has modified the Generic Emergency Procedure Guidelines, to allow drywell sprays

EC-RISK-1073 PAGE 17 under all temperature and pressure conditions provided the flow is throttled for 30

,seconds before allowing spray flow.

There are two independent drywell spray flow paths. Each path can be fed by six pumps including two diesel fired pumps for application under Station Blackout conditions. Utilization of these pumps is proceduralized and practiced on the simulator.

Therefore, the dominant mode of drywell spray failure is failure of the drywell spray valves to open. Two valves must open in each path for success. Given two paths, there are 4 combinations of two valve failures that will result in failure of the drywell sprays. The point estimate for common cause failure of two valves is estimated to with lower and upper bounds of 1.2x10 and 1;1x10 . Since there are 4 be'.4x10 possible combinations, these estimates are multiplied by 4 for a point estimate of and lower and upper bound of 4.8x10 "and 4.4x10 . '.8x10 f

Pt'4t Penetration Failure Causes a Leak Path Given that the penetration fails, it must fail in a manner that provides a leak path from the primary containment to the reactor building. Three mechanisms are presented in

'UREG-0933:

, 1. A longitudinal rupture whose length exceeds the thickness of the containment building wall, or

2. A simultaneous rupture of the one penetration and failure of the other penetration's isolation valve to close, or

3. A simultaneous circumferential rupture of the inboard and outboard isolation valves, or penetrations. I In addition to these three mechanisms, the following two additional leak paths are evaluated:

4. The re-establishment of drywell or recirculation pump cooling with a penetration failure, and

5. A failure of a single isolation valve with subsequent rupture of a penetration.

The first mechanism, a longitudinal rupture whose length exceeds the thickness of the containment wall, results in a single rupture that provides a leak path from drywell to the reactor building. This particular mechanism is not credible for the Susquehanna penetration design. As show'n in Figure 1, the containment wall is about 6 feet or 72 inches thick. A longitudinal rupture would have to be at least 72 inches for this mechanism to cause a leak path. Branch Technical Position (BTP) MEB 3-1, states that the lengths of such ruptures are bounded by 2 inside pipe diameters. The criterion is corroborated by the General Electric Licensing Topical on Pipe Break criteria (NEDO-23649). The penetration diameters are 3, 4, 6 and 8 inches. Based upon this conservative design criterion, the longest longitudinal tear should not exceed 16 inches, a factor of 4.5 less than the thickness of the containment wall. Therefore, the probability

EC-RISK-1073 PAGE 18 of establishing a leak path from the drywell to the reactor building based upon

,mechanism 1 is negligible.

The second mechanism requires a simultaneous failure of an isolation valve and a rupture of the penetration. In this situation, the inboard containment isolation valve fails at the same time the penetration ruptures in the reactor building, or the outboard containment isolation valve fails and the penetration simultaneously fails in the drywell.

This particular mechanism is not credible for the Susquehanna penetration design. The penetrations are insulated, which retards the penetration heat up and associated pressurization. Bounding heat transfer calculations indicate that a minimum of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is required to heat the water in the penetration to a high enough temperature to pressurize the penetration to the material yield point. The stroke time of the isolation valves is less than 1 minute for RBCW and RBCCW. The isolation valves will either have closed or failed open by the time the penetration ruptures on overpressure. The RHR valves are closed during operation. Therefore, the probability of establishing a leak path from the drywell to the reactor building based upon mechanism 2 is negligible.

The third mechanism requires a simultaneous failure of the penetration in both the drywell and the reactor building. This mechanism requires two weak links in the penetration. It is incredible that two equivalent weak links exist in the same penetration, with one being in the containment and the other being outside the containment.

However, it is conceivable that two weak links, such as packing, both fail by leaking sufficient inventory to relieve pressure. In this case, neither packing leak is sUfficient to relieve the pressure rise, but the flow out both leaks is. Failure in this manner does not represent a significant pathway for radioactivity transport. The fluid leaking from the packing of these systems is uncontaminated water. Furthermore, the volume of water that must leak to elevate the overpressure condition is a percent or two of the penetration volume. While this mechanism represents a credible failure mode, it is insignificant from a risk perspective. Therefore, the probability of establishing a leak path from the drywell to the reactor building based upon mechanism 3 is negligible.

The fourth mechanism requires a rupture of the piping in the drywell, an operator action to re-establish drywell cooling after the failure, and a breach of the system in the reactor building. The breach in the reactor building could be the result of a spurious operation of a safety relief valve. Re-establishing drywell cooling is authorized by the generic Emergency Procedure Guidelines (EPG). However, PP8L's implementation of the generic EPG does not permit re-establishing drywell cooling, if drywell cooling isolated as the result of either a LOCA signal (high drywell pressure of low RPV water level) or containment rad levels in excess of 5 R/hr (NL-92-019). An operator action to override the isolation requires the shift supervisor's signature. Therefore, an operator error to override the isolation on either a LOCA signal or a source term in the primary containment would require the mis-diagnosis of two operators. Additionally, the results of this condition are similar to the fifth mechanism and therefore it is treated with the fifth mechanism.

EC-RISK-1073 PAGE 19 The fifth mechanism requires a failure of an isolation valve to close with subsequent

,failure, of the penetration many hours later. Two possible failure combinations are considered:

1. Failure of the outboard isolation valve to close and rupture of the penetration in the drywell, and

2. Fail'ure of the inboard isolation valve to close and rupture of the penetration in the reactor building.

These two failure combinations are not credible for the RHR system since both isolation valves are closed at the time of the isolation. Therefore, mechanism 4 only applies to RBCW and RBCCW.

Rupture of the penetration is not credible for the first failure combination. Failure of the outboard isolation valve to close allows the entire RBCW or RBCCW system in the reactor building to mitigate the heat up and pressurization of the fluid in the system.

However, failure of the RBCW or RBCCW inboard isolation valve and rupture of the penetration in the reactor building does represent a credible scenario. Failure of the inboard isolation valve allows the entire system in the drywell to communicate with. the penetration. Instead of acting to reduce the effect of the heat:up, this failure actually intensifies the loading. The mean probability of a valve failing at the Susquehanna plant was assessed (EC-RISK-1065) to be 1.6 x 10 with lower and upper bounds of 9.4x10 and 2.5x10 . This combination of failures represents a credible mechanism of creating a leak path from the drywell into the reactor building.

A leak path will only occur if the penetration ruptures in the reactor building. The probability that the penetration fails in the reactor building is estimated by assuming that the probability of rupture is proportional to the fraction of piping in the reactor building.

This is based upon the fact that similar piping is used within each system and that no potential weak links, such as relief valves, are in the system. The length of pipe in the reactor building between the outboard isolation valve and the containment wall ranges from a few inches to less than 6 feet. The length of system piping in the drywell is on the order of 100 feet or more. Therefore, the probability that the pipe rupture occurs in the reactor building is between 0.001 and 0.1.

Finally, all the systems considered are closed cooling water systems (note: both RHR valves are closed and not subject to this failure mechanism). Therefore, even if the inboard isolation valve fails and the penetration ruptures in the reactor building, the leakage path will be insignificant, unless an additional breach occurs in the drywell segment of the system piping. The probability of this occurrence is considered slight since the rupture in the reactor building reduces the shock causing the failure. As discussed in the previous paragraph, there are no apparent weak points in the system such as relief valves that could open after the pipe rupture in the reactor building. For this reason, two probabilities are reported: the probability of a small leak that is assessed as 1.0, and the probability of a large leak path that is assessed to be between 10 and 10 . A discussion of these values is provided below.

0 fA

EC-RISK-1073 PAGE 20

,The probability of a small leak accounts for the flow of drywell gases through equipment connections such as valve packing into the voided system piping and then into the reactor building.. Given that the system pipe will drain as a result of the pipe rupture, any small leak in the system will provide a path from the drywell to the reactor building.

However, these possible leak paths must be so small that they do not prevent system pressurization and pipe rupture. Therefore, these leak paths must be very small.

The probability of an additional large rupture of system piping in the drywell given the rupture in the reactor building is difficult to estimate since this additional rupture is attributed to no mechanism. Even if a rupture occurs, the leak path will be no greater

,than the smallest opehing. Based upon the mechanisms discussed above, the leak path should be no greater than two pipe diameters. The probability is estimated by assuming a passive pipe failure occurs after the penetration failure. A mission time of 1000 hours0.0116 days <br />0.278 hours <br />0.00165 weeks <br />3.805e-4 months <br /> is arbitrarily chosen when calculating the probabilities. Given these assumptions, the probability of a large rupture in the drywell is estimated to be between 10 and 10 with 3 x 10'eing the point estimate. Therefore, the probability that the penetration fails in a manner that will result in a leak path from the drywell to the reactor building becomes:

P[4] = P x P,b x Pd~

where; P= the probability that the inboard isolation valve fails, P,b = the probability that the penetration fails in the reactor buildin'g, Pd= the probability that a leak path occurs in the piping system in the drywell.

P Probability of Penetration Failure The probability of a penetration failure is estimated by combining the above probabilities. The point estimates and bounds were propagated using a Monte Carlo procedure assuming the uncertainty is lognormal. The results of this calculation are presented below. They represent the probability of a penetration failing as the result of overpressurization. The total probability is obtained by increasing the per penetration value by a factor of 10 since there are 11 penetrations being evaluated. The results are rounded to the nearest order of magnitude given the precision of the input data.

Probability Insignificant Leak Gross Leak Per Total Per Total Penetration Penetrations Penetration penetrations Lower Bound 10 10 10 10 Median 10 10 10 10 Mean 10 10 10 10 Upper Bound 10 10 10 10

0 i

These numbers are very small when compared to the probability of failure due to h

EC-RISK-1073 PAGE 21

,commpn cause failure of both isolation valves to close, which is assessed at between.

1.2x10 and 1.1x10 .

These results are robust to large changes in the inputs. As an example, each of the probabilities that contribute to the penetration failure could be increased by a factor of 50 and still be less than the probability of penetration failure due to failure of the isolation valves to close.

Evaluation of the Proposed Resolution to the Overpressurization Issue As discussed in the Introduction, the installation of safety relief valves is being proposed as a method of resolving any outstanding ASME code compliance issues. The valves are to be installed between the inboard and outboard isolation valves and discharged to the primary containment. The installation of safety relief valves may reduce the likelihood of penetration failure from overpressure, however, they also introduce additional failure modes that must be addressed.

Breach of the containment penetration from the installation of safety relief valves will occur if either:

The safety valve opens for pressure relief during a pressurization event and fails to reseat, or The safety valve inadvertently opens, and A failure occurs which causes the outboard isolation valve to be open.

Failure could also occur if the safety valve fails to open resulting in overpressurization failure. This failure is in addition to the events that cause the overpressurization failure without the fix. The probability that the safety valve fails to open is typically between 3 x 10 and 3 x 10 per demand (NUREG/CR-2728). The safety relief valve reduces the overpressurization failure by many orders of magnitude. Therefore, failure of the safety relief valve to open is not considered.

Safety relief valves are generally set at 1.25 to 1.5 times the design pressure of the system. The system pressure for RBCW and RBCCW is on the order of 100 psi.

Therefore, the relief valves will be set at 150 psig or less. This pressure is an order of magnitude less than the pressure that will cause the pipe to reach its yield stress. The probability that a valve fails to reset after opening is estimated (NUREG/CR-4550) to be 0.096 with a lower bound of 0.0036 and an upper bound of 0.36.

The failure of the isolation valve to close was assessed above and is 1.6 x 10 with lower and upper bounds of 9.4x10 and 2.5x10 . This information is used to estimate the probability of penetration failure given the installation of relief valves. This particular failure will only result in leaks through packing, etc., and is therefore considered an

EC-RISK-1073 PAGE 22 insignificant leak. A gross leak would occur if a breach of the piping in the reactor building were to occur in addition to the failures discussed above. A number of safety relief valves were identified during reviews of the PSIDs. The diameters of these valves range from 1 to 3 inches. These valves could spuriously open allowing a direct path from the drywell to the reactor building. The median probability that a safety relief valve spuriously opens is assessed at 10 /hr with an error factor of 3. As previously discussed, a mission time of 1000 hours0.0116 days <br />0.278 hours <br />0.00165 weeks <br />3.805e-4 months <br /> is assumed. The probability that the penetration fails is computed as the product of the independent probabilities that the safety relief valve fails to close and the outboard isolation valve fails to close. These computations were performed for both an insignificant and gross leak using a Monte Carlo procedure and assuming that the uncertainty is lognormally distributed. The results are presented below.

Probability Insignificant Leak Gross Leak Per Total Per Total Penetration pen etrations Penetration penetrations Lower Bound 6 x 10 6x10 3x10 3x10 Median 7x10 7x10 7x10 7x10 Mean 2x10 2x10 2x10 2x10 Upper Bound 6 x 10 6x10 5x10 5x10 The probability of penetration failure is many orders of magnitude greater than the present design. This is a reasonable expectation because:

~ The safety relief valve is far more likely to lift during an event since the relief pressure is set well below the material yield strength.

~,'ipe or penetration failure is not expected to fail at the yield but only experience plastic deformation.

~ Failure of relief valves to reset after lifting is a reasonable expectation.

Therefore, the modification proposed to resolve the ASME code compliance issue is far more likely to result in loss of penetration integrity than the existing design.

Additional Forced Shutdowns Installation of safety relief valves will likely result in additional forced shutdowns. Safety relief valves are known to spuriously open. A forced shutdown is expected if the relief valve does spuriously open. Opening of a relief valve on the RBCW system will result in either loss of a train of drywell or recirculation pump motor cooling. Loss of RBCCW will result in loss of recirculation pump seal and motor cooling. Either of these situations will result in a forced shutdown to allow for the drywell entry and repair. A typical median safety relief valve spuriously opening/rate is 10 /hr with an error factor- of 3. Using this data, the probability of a forced shutdown per safety relief valve, over the next 20 years of two unit operation, is estimated to between 66% and 99.99%'with the mean value

4 I EC-RISK-1073 PAGE 23 being 90%. Therefore, installation of the safety relief valves is likely to cause a forced

,shutdqwn.

Conclusion for the RBCW, RBCCW and RHR Cases The risk evaluation performed above has demonstrated that the contribution to containment penetration failure from temperature induced overpressurization is very small when compared to other failure modes. Additionally, the upper bound contribution is much less that the NRC criterion for very small incremental increase in LERF (less than 107/yr). The proposed fix designed to resolve ASME code compliance issue is far more likely to result in a penetration failure than the current design. Additionally, the proposed fix is likely to result in forced shutdowns during the next 20 years. Based upon these findings, modifications to reduce the likelihood penetration failure due to temperature induced overpressurization is not warranted.

4.2.2.2 Evaluation of Drywell Sump Line This Section deals with the drywell sump piping. This piping arrangement is different from the other 11 configurations being evaluated in that it is not a closed system in the drywell. A schematic is provided below along with a brief description of the piping arrangement.

Containment Wall Drywell 3h 3h HV-16108A2 HV-16108A1 Liquid Radwaste Sump Pumps Figure 2- Schematic of the Drywell Sump Piping System As depicted in the above diagram, the piping system communicates directly with the drywell atmosphere. There are two sumps. Each sump has two pumps. A pump initiates when the sump volume reaches 75 gallons and stops when the sump reaches the low level trip. The sump pumps each discharge through a discharge check valve

~

~

I il

'I

EC-RISK-1073 PAGE 24 into a 2" line. The flow rate from each pump is 30 gpm. These lines feed into a 3 inch headey which penetrates the primary containment wall. Containment isolation is provided by HV-16108A18A2. The high point of the piping system is in the three inch segment of the pipe near the pumps and is 2'-3 ~/4" higher than the pipe at the outboard isolation valve. The penetration is approximately 40 feet of pipe away from the high point. Beyond the outboard isolation valve, the pipe drops vertically about 30 feet to the Liquid Radwaste system.

Evaluation of the Current Design The concern with this particular penetration is that water could be trapped between the closed isolation valves and the pump discharge check valves. If the penetration piping were to fail between the isolation valves and the containment wall in the reactor building, a direct path from the drywell to the reactor building would be established.

However, the particular design configuration of this system makes it difficult to create an overpressurization failure of this particular penetration. First, both isolation valves are in the reactor building and are not subject to heating from the drywell atmosphere.

Second, the isolation valves close at least 2 seconds after a pump trip allowing water to drain from the high point in the drywell to liquid radwaste. Third, water trapped between the isolation valves is warmer than the reactor building, since the drywell is normally 40 to 50 degrees warmer than the reactor building. Therefore, penetration failure is not expected if the equipment works as designed.

Overpressurization failure of the penetration could occur if the pipe were filled from the pump discharge check valve to either of the isolation valves. This can only occur if the pump is running at the time of an isolation signaI, and fails to trip when the isolation valves close. The operating pump will fill the pipe with water from the pump discharge check valve to the isolation valve. If the overpressure failure of the pipe occurs in the reactor building, it will provide a direct pathway from the drywell atmosphere to the reactor building. Therefore, this event is being analyzed from a risk-informed perspective.

P[1] Water Is Trapped Between the Inboard and Outboard Isolation Valves As discussed above, trapping water in a manner that could result in a containment penetration failure requires failure of the pump to trip. Since either of the isolation valves must successfully close given the isolation signal, a common logic fault cannot cause the pump failure. Therefore, the probability of trapping water becomes the product of the probabilities of two independent events, or:

P[1] = P(Pump is operating when isolation signal occurs) x P(Failure of pump to trip)

Each type of initiator may have a specific value of P[1]. Therefore, P[1] is evaluated for different types of initiators. These values of P[1] are then summed to get an overall value of P[1].

h EC-RISK-1073 PAGE 25 The probability that the pump is operating at the time of the isolation signal depends

,upon the initiator. If the initiator is a LOCA, and assuming leak before break, it is reasonable to expect the pump to be operating. Therefore, the probability that the pump is operating at the time of the initiation signal becomes the LOCA frequency or 0.005.

If the initiator is other than a LOCA, then operation of the pump is independent of the initiating event. The probability that the pump is operating at the time of the initiating event is the frequency of the initiating event times the probability that the pump is running. As discussed in the Introduction, the non-LOCA isolation events occur about 0.5 times per year. The probability that the pump is operating at the time of the initiating event is the fraction of time during the year that the pump is operating. This fraction is estimated to be about 0.01 based upon a review of plant data. The probability that the pump is operating when the isolation occurs is the product of these two numbers or 0.005.

The probability that the pump is operating when the isolation signal occurs is the sum of the LOCA and non-LOCA probabilities or 0.01.

The pump control electrical schematic was reviewed to determine the failures that will cause the pump to continue to operate given a trip signal. Based upon this review, the pump will fail to trip if either of two sets of contacts on a limit switch fail to open. Failure of a limit switch to change state is estimated to be 3.8x10 "/demand (WASH-1400).

Therefore, the failure of the pump to trip is assessed to be 2x(3.8x10 ) =

7.6x10 /demand.

Using these probabilities the value of P[1] is computed.

P[1] = (0.01) x (7.6x10 ) = 7.6 x 10 P[2] Probability that the Isolation is Leak Tight In the scenario that traps water, the water is trapped between a containment boundary valve, and the pump discharge check valves. The containment boundary valves, are leak rate tested and are assumed leak tight. The check valves are not a containment boundary, and are installed to prevent back flow through the pump. Furthermore, all four check valves must be leak tight for overpressurization to occur. The check valves were installed to prevent back flow through the idle pump and are not designed as pressure boundaries. None of the check valves are leak rate tested. Therefore, the probability that none of the four check valves leak is assessed to be negligible.

NUREG-0933 corroborates this assessment by specifically excluding containment penetrations that rely on check valves for isolation from GL 96-06 evaluation.

Therefore, the value of P[2] is assessed to be negligible.

~

r f

EC-RISK-1073 PAGE 26 Using the value of P[1] and P[2] in Equation 1, the probability that the penetration fails

.as a re,suit of overpressurization is assessed to be negligible even if the values of P[3]

and P[4] are assumed to be one. Therefore, the values of P[3] & P[4] will not be assessed.

Evaluation of the Proposed Fix The proposed fix is to install a relief valve on the three inch pipe between the inboard isolation valve, HV-16108A2, and the pump discharge check valves. This relief valve would be located in the primary containment and discharge back to the drywell sump.

Failure of the relief valve to open would not create any new pathways between the drywell and the reactor building, since the penetration of interest is open in the drywell.

Therefore, the proposed fix does not impact the probability of isolation failure.

Evaluation of Additional Forced Shutdowns Failure of the relief valve open will result in some of the water being recirculated back to the sump. While this represents an operational nuisance, additional forced shutdowns are not anticipated.

Conclusion on the Drywell Sump Piping The drywell sump piping has been identified as a candidate for overpressurization failure. A risk evaluation of the piping system has demonstrated that the likelihood of this failure mode is negligible due to system design. Therefore, modifications to reduce the likelihood of this failure are not warranted.

6.0 IMPLEMENTATIONAND MONITORING PROGRAM This analysis has demonstrated that the performance of the current design is superior to the design proposed to resolve the ASME code compliance issues. Therefore, no hardware installation and monitoring is proposed in response to GL 96-06. PP8L has taken action to reduce the likelihood of penetration failure as discussed in the Analysis Section of this submittal. These actions provide improvement for other containment failure modes as well. Specifically, PPBL has modified the generic Emergency Procedure Guidelines to:

1. Prohibit bypassing drywell cooling isolation, if the isolation was caused by high drywell pressure or low RPV water level.

2. Allow initiation of the drywell sprays under all temperature and pressure conditions provided flow is throttled for 30 seconds prior to allowing full flow.

A discussion of each of these mitigating measures follows.

0 h

EC-RISK-1 073 PAGE 27 GL 96-06 was an overriding reason for the first modification to the generic guideline.

.The EPG directs the operator to re-establish drywell cooling if an isolation has occurred as a temperature control measure. One containment bypass mode identiTied by PPBL is loss of closed cooling water system integrity in the drywell and the operator implementing procedures to re-establish drywell cooling. The operator has no status of the drywell cooling system prior to re-establishing drywell cooling. If a breach in the closed cooling water piping had occurred, then the operator action to re-establish drywell cooling will result in a containment bypass. Susqueha'nna procedures only allow the operator to re-establish drywell cooling if a LOCA was not the cause of the isolation.

A LOCA is interpreted to mean an unexplained high drywell pressure or low RPV water level. It is highly unlikely that core damage will occur without at least one of these conditions occurring. Therefore, the containment bypass mode associated with .

deliberately bypassing containment isolation, following a LOCA isolation, has been removed from the Susquehanna procedures.

There are a number of issues associated with the second deviation. The Drywell Spray Initiation Limit is imposed by the EPG to prevent containment failure from implosion.

The Susquehanna Mark II containment is a steel lined concrete containment. PP8L plant specific calculations demonstrate that under the most severe conditions, damage is limited to exceeding the diaphragm liner's design criteria. This can be avoided if the operator throttles drywell spray flow for 30 seconds prior to establishing full flow. The 30 seconds of throttled flow allows for a substantial amount of vapor to be added to the drywell atmosphere, thus eliminating the concern for implosion. The drywell sprays provide considerable containment cooling and remove the potential for overpressurization failure of the penetrations. Therefore, penetration failure is unlikely given successful operation of the drywell sprays.

These two mitigating measures provide substantial protection to primary containment integrity for both the overpressurization failure mode and other threats as well. These improvements have been implemented in the EOPs via Safety Evaluations per 10CFR50.59 and are monitored through the Licensed Operator Re-qualification Program. 7

6.0 REFERENCES

1) US NRC Generic Letter 96-06, "Assurance of Equipment Operability and Containment Integrity During Design-Basis Accident Conditions," 9/30/96.

2) US NRC Generic Letter 96-06, Supplement 1, 11/13/97.

3) US NRC Letter, "Meeting With NEI And Licensees To Discuss Generic Letter (GL) 96-06, 'Assurance Of Equipment Operability And Containment Integrity During Design-Basis Accident Conditions,'" Marsh, Ledyard B., to NEI, 11/22/96 (Reference November 1996 Dallas, TX Meeting With NEI).

S R

r

EC-RISK-1073 PAGE 28

4) US NRC Letter, "Industry Workshop On Generic Letter (GL) 96-06, 'Assurance Of 4 Fquipment Operability And Containment Integrity During Design-Basis Accident Conditions,'" Wetzel, Beth A., to NEI Meeting Sponsors, 1/28/98. (Reference December 1997 Gaithersburg, MD Meeting with NEI).

5) PLA-4521, R. G;- Byram to USNRC, "30 Day Response to Generic Letter 96-06,"

10/28/96.

6) PLA-4551, R. G. Byram to USNRC, "120 Day Response to Generic Letter 96-06,"

1/29/97.

7) PLA-4618, R. G. Byram to USNRC, "Additional Information Related To The 120 Day Generic Letter 96-06 Response," 5/9/97.

8) PLA-4636, G. T. Jones to USNRC, "Follow-Up Response to the 120 Day Generic Letter 96-06 Response," 6/30/97.

9) PLA-4999, R. G. Byram to USNRC, "'Response For Additional Information Related To Generic Letter 96-06," dated November 9, 1998.

10) ASME Code,Section III, 1971 Edition with Addenda thru Winter 1972, Subsection NC/ND-3621.2.

EPRI Technical Report TR-108812, "Response of Isolated Piping to Thermally Induced Overpressurization During a Loss of Coolant Accident (GL 96-06)."

12) NEI Letter, "Response To NRC Staff Questions on EPRI Report TR-108812 in Support of Licensee Responses To Generic Letter 96-06," Modeen, David J. to Wessman, Richard H., 4/30/99.

13) US NRC Memorandum, COMSAJ-97-008;"Discussion Of Safety And Compliance," Hoyle, John C. to Callan, L. Joseph, 8/25/97.

14) US NRC NUREG-0933, Revision 1, "A Prioritization Of Generic Safety Issues,"

New Generic Issue 150, 6/30/95.

15) EC-059-1025, Rev. 0, "Engineering Evaluation Of Generic Letter (GL) 96-06, Equipment Operability and Containment Integrity D.B.A. Conditions," 1/30/97.

16) US NRC Regulatory Guide 1.174, Rev. July 1998, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes To The Licensing Basis."

17) NEDO-23649 Class 1, 8/77, Application of Pipe Break Criteria for Major Piping Systems Inside Containment for the BWR/6 218, 238, 8 251 Mark III Product Line Plants, General Electric Topical Report.

A J EC-RISK-1073 PAGE 29

,18 FC-RISK-1065, Assessment of Common Cause failure Probabilities used in the Susquehanna IPE.

19 NUREG/CR-2728, Interim Reliability Evaluation Program Procedures Guide, 1983.

20 NUGER/CR-4550 page 4.9-76.

21 WASH-1400 Table lll-4.2.

22 NL-92-019 Rev. 2 50.59 Safety Evaluation for Primary Containment Control-EO-000-103.

g:Qoadmin'haniiwalshUcukielkalrisk1073.doc 08/02/99 10:38 AM