ML17146B174

GL 96-06 Risk Assessment for Sses.

ML17146B174
Person / Time
Site:	Susquehanna
Issue date:	08/03/1999
From:	PENNSYLVANIA POWER & LIGHT CO.
To:
Shared Package
ML17146B173	List: ML17146B174
References
EC-RISK-1073, GL-96-06, NUDOCS 9908120059
Download: ML17146B174 (52)

Text

0TABLEOFCONTENTStEC-RISK-1073PAGE2PAGE

2.0CONCLUSION

S3.0BACKGROUNDANDISSUERESOLUTION3.13.2BackgroundIssueResolution3.2.1IdentificationofLicensingBasisIssue3.2.2Structures,Systems,Components(SSCs)andProceduresCoveredbytheLicensingBasisIssue3.2.3SupportingInformation4.0ENGINEERINGANALYSIS4.1DeterministicAnalysis4.2OverviewofRiskAnalysisandConclusions4.2.1MethodologyforEvaluatingtheProbabilityofContainmentPenetrations4.2.1.1EvaluationofCurrentDesignstoOverpressureFailureofContainmentPenetrations4.2.2SpeciTicEvaluationofPenetrations4.2.2.1EvaluationofRBCCW,RBCW,andtheHeadSprayLine4.2.2.2EvaluationofDrywellSumpLine5.0IMPLEMENTATIONANDMONITORINGPROGRAM6.0REFERENCES91213131414232627'I9908i20059990803PDRADGCK05000387PPDR

EC-RISK-1073PAGE

31.0INTRODUCTION

OnSeptember30,1996,theNRCissuedGenericLetter96-06,"AssuranceofEquipmentOperabilityandContainmentIntegrityDuringDesign-BasisAccidentConditions."IntheGenericLetter,thepotentialforthermallyinducedoverpressurizationofsectionsofcontainmentpipingwhichareisolatedduringdesignbasisaccidentswasidentified.Withrespecttothispotential,licenseeswererequestedto:1)evaluatetheirplantdesignanddetermineifcontainmentpipingsystemsaresusceptibletothermallyinducedpressurization;-2)evaluatetheOperabilityofaffectedpipingandsystems;3)identifylongtermcorrectiveactionsthatwillbetakeninordertoprovidecompliancewiththeplant'sdesignbasis;and4)completetheseevaluationsandsubmitareportwithin120days.InNovemberof1996,theNRCissuedsupplementaryinformationtothegenericletterregardingspecificregulatoryexpectations.Atthattime,itwasclariTiedthattheconcernsforpipingoverpressurizationduringdesignbasisaccidentsnotonlyappliedtopipinginsidecontainment,but-alsotocontainmentpenetrations(i.e.,thepipingbetweenthetwoisolationvalves).Aslicenseesevaluatedthepotentialforthermallyinducedoverpressurizationfortheirspecificplantdesigns,itbecameapparentthattherisksignificance(andhencetheactualimpacttoplantsafety)ofthisphenomenonwasrelativelylow.Thisp'erspectivewasreflectedwiththeissuanceofSupplement1totheGenericLetter,aswellasthroughthestaff'sinteractionwithlicenseesandindustrygroups,whichencouragedtheuseofrisk-basedinsights.Althoughthethermaloverpressurizationconcernsidentifiedinthegenericletterdidnotrepresentasafetyissue,compliancewithaplant'slicensingbasis,i.e.,coderequirements,was(andis)nonethelessstillrequired.Therefore,fortheSSESunits,thefocusoftheoverpressurizationissuewas(andis)oneofcompliancewiththeASMEcode.PP8LhasevaluatedcontainmentpipingandpenetrationspertheGenericLetterandhasidentifiedtwelveinstanceswhereoverpressurizationfailureofpipingmayoccur.Likethestaff,PP8Lconcludedthatthepotentialforoverpressurizationofthesespecific'enetrationsisnotasafetyconcernduetotheconsiderablemargininthedesign.Additionally,PP8LconcludedthatallASMEcoderequirementsweresatisfiedbythecurrentdesign.However,theNRCstaffinterpretationoftheASMEcodediffersfromthatofPP8L.BasedupontheNRCstaffsinterpretation,thetwelvepenetrationsidentifiedasbeingsusceptibletooverpressurizationfailuredidnotmeettheASMEcoderequirements.PP&Lhasevaluatedplantmodificationsthatresolvethestaffsopencomplianceissues.Thesemodificationsinvolvetheinstallationofreliefvalvesonthesusceptiblepipesandpenetrations.Thepreliminarycostforengineeringandinstallationofthese I

EC-RISK-1073PAGE4modificationsisestimatedtobe$2,000,000.00.Additionally,itisestimatedthattheIn-,ServiceInspection(ISI)andMaintenancecostisatleast$20,000.00/year.Inadditiontothefinancialburdenassociatedwiththemodifications,aradiationexposureburdentoemployeeswouldbeincurredduringinstallation,periodicISIandMaintenance.Finally,whiletheproposedmodiTicationsresolvetheASMEcodeinterpretationissue,itis'expectedthattheywillresultinforcedshutdownsduringtheplantlifeandmayincreasetheprobabilityofpenetrationfailure.Therefore,PPBLcommittedtoapproachresolutionoftheASMEcodeinterpretationissuethrougharisk-informedsubmittal.Theresolutionofthisisbeingpursuedas,"ARisk-InformedPlantSpecificChangetotheLicensingBasis."Therefore,theguidanceoutlinedinRegulatoryGuide1.174isbeingappliedinthisassessment.Specifically,theregulatoryguideidentifiesevaluationofthefollowingelementsasanacceptableapproachtorisk-informeddecisionmaking.~Element1-DefinitionandPurposeofProposedChange~Element2-EngineeringAnalysis~Element3-ImplementationandMonitoringProgramThisassessmentisstructuredtoaddresseachoftheseelementsaspresentedintheRegulatoryGuide.ThelevelofdetailprovidedinthisassessmentisbasedupontheguidanceinOfficeLetter803.Thisissueisseenashavingalowrisksignificance,moderatecomplexityandsimilaritywiththemodelinNUREG-0933.

2.0CONCLUSION

SPTheNRCevaluationofthisissueisdocumentedinNUREG-0933alongwiththefollowingconclusions.Theestimatedpublicriskassociatedwithoverpressurizafionofcontainmentpenetrationswasnofsignificant.Basedonthevaluefimpactassessmentandfhestaf'ssimplifiedengineeringanalysis,thisissuewasplacedintheDROPcategory.PP8L'sworkconfirmsthattheNRCstaffsconclusionisvalidforSusquehanna.ThisconfirmationisbaseduponthefollowingspeciTicconclusions.~Thepotentialforoverpressurizationfailureofcontainmentpenetrations,ascurrentlyconfigured,isinsignificantpertheRegulatoryGuide1.174criterionof10increaseinLargeEarlyReleaseFrequency(LERF).~ThemodificationstotheSusquehannaEmergencyOperatingProceduresprovideadditionaldefenseindepthagainstlossofcontainmentintegrityduetopenetrationfailure.

EC-RISK-1073PAGE5~Thehardwaremodificationstoresolvethecomplianceissuedonotreduceandmay,infact,increasethelikelihoodofpenetrationfailure.~Thehardwaremodificationstoresolvethiscomplianceissueresultinadditionalradiationexposuretoemployeesforinstallation,periodicISIandmaintenance.~Thepotentialforpenetrationfailurefromoverpressurizationdoesnotwarranttheexpenditureof$2,000,000.00formodificationsand$20,000.00annuallyformaintenance.~Thepotentialforpenetrationfailurefromoverpressurizationdoesnotwarrantincreasingtheadditionalexposuretoforcedshutdownsassociatedwiththeproposedhardwaremodifications.~ChangestotheEmergencyOperatingProceduresareeffectiveatreducingthelikelihoodofpenetrationfailure.Baseduponthesespecificconclusions,theEmergencyOperatingProcedurechangesimplementedbyPP8LresolvethecomplianceissuesassociatedwithGL96-06.3.0BACKGROUNDANDISSUERESOLUTION3.1BackgroundAsdiscussedintheIntroduction,GL96-06addressedoverpressurefailureofbothpipinginthedrywellandcontainmentpenetrations.PP&LhasevaluatedtheSusquehannadesignforbothoftheseconcerns.Theresultsoftheseevaluationsaresummarizedbelow.ContainmentPipingPressurizationUnderDBAConditionsInPP8L's120-dayresponsetotheGenericLetter,thepotentialforthermallyinducedoverpressurizationofseveralcontainmentclosedlooppipingsystemsduringdesignbasisaccidentswasidentified.Theclosedlooppipingsystemsthataresusceptibletothismechanismare:1)non-safety-relatedReactorBuildingClosedCoolingWater(RBCCW)pipingto/fromthereactorrecirculationpumps;2)non-safety-relatedReactorBuildingChilledWater(RBCW)pipingto/fromthereactorrecirculationpumpmotors;3)non-safety-relatedRBCWpipingto/fromthedrywellcoolers;and4)non-safety-relateddrywellfloordrainsumppumpdischargelines.Althoughsusceptibletothismechanism,thepotentialforthesesystemstopressurizedoesnotthreatenthefunctionofanysafety-relatedequipmentrequiredtomitigatetheconsequencesofadesignbasisaccident.Further,itshouldbenotedthatthe

EC-RISK-1073PAGE6assumptionthatthispipingisnotavailableduringdesignbasisaccidentsisalreadyanjntegrqlpartoftheSSESdesignandlicensingbases.IftheRBCCWand/orRBCWweretoremainintactduringadesignbasisaccidentandundergoathermallyinducedpressureincrease,theconditionsrequiredtocausetheoverpressurizationdonotcreateacredibleleakagepathforthetransmissionoffissionproductsfromtheprimarytosecondarycontainment.Inboardisolationvalvesareinthedrywell.Therefore,apipingfailureinthedrywellwillnotresultinarelease.WhilenocorrectiveactionsarerequiredtoresolvethepotentialforoverpressurizationofRBCWandRBCCWclosedlooppipinginsidecontainment,thepotentialforoverpressurization,ofthedrywellfloordrainsumppumpdischargepipingispossibleandisthesubjectofthisrisk-informedsubmittalbecausebothcontainmentisolationvalvesarelocatedoutsidetheprimarycontainment.ContainmentPenetrationPressurizationUnderDBAConditionsInadditiontotheclosedloopsystemsreferencedabove,PPBL's120-dayresponsealsoidentifiedthepotentialforthermallyinducedoverpressuriz'ationoftwelvecontainmentpenetrations(perunit)duringdesignbasisaccidents.Thesepenetrationsare:1)RBCCWsupplyandreturnlinestothereactorrecirculationpumps(2);2)RBCWsupplyandreturnlinestothereactorrecirculationpumpmotors(4);3)RBCWsupplyandreturnlinestothedrywellcoolers(4);.4)ResidualHeatRemoval(RHR)headsprayline(1);and5)1"Demineralizedwaterlinetothedrywell(1).Alloftheaffectedprimarycontainmentpenetrations,whicharepotentiallysusceptibletothismechanismduringdesignbasisaccidents,supportnon-safety-relatedsystemfunctions.Therefore,thispotentialdoesnotthreatentheavailabilityofsafety-relatedequipmentrequiredfordesignbasisaccidentmitigation.Inaddition,asdocumentedinPPBL's120-dayresponseandsubsequentfollow-upcorrespondence,thepotentialforoverpressurizationoftheaffectedpenetrationsdoesnotcreateacredibleleakagepathforthetransmissionoffissionproductsfromtheprimarytothesecondarycontainment.Correctiveactions,intheformofproceduralchanges,havebeentakentoeliminatethesusceptibilityofthereferenceddemineralizedwaterpenetration,whichisonlyusedforoutage-relatedmaintenanceactivities.However,thepotentialforoverpressurizationofthereferencedRBCW,RBCCW,andRHRpenetrationsisthesubjectofthisrisk-informedsubmittal.3.2IssueResolutionInPPBL's120-dayresponseandsubsequentcorrespondence,PPBLidentifiedtheengineeringpositionthattheexistingSSEScontainmentpipingBpenetration,configurationsareincompliancewiththeapplicableexistinglicensinganddesign

EC-RISK-1073PAGE7bases.ThisconclusionisbasedonareviewofSSESdesign-relateddocuments,which,includedtheSSESFSAR,GEandBechteldesignspecifications,aswellasourinterpretationoftheapplicableASMECode.IITheeffectiveASMECodefortheSusquehannaUnitsisthe1971EditionwithaddendathroughWinter1972.Sub-sectionNC/ND-3621.2identifiestheeffectsoffluidexpansionasageneraldesignconsideration,butinabroadandnondescriptfashion.Forthe"faultedconditions,"whichcorrespondtothoseincurredduringadesignbasisaccident,nospecificdesignguidanceoracceptancecriteriaisprovidedforevaluatingisolatedsectionsofASMEClass1,2,and3piping,whichareexposedtoanexternalheatsourcecausingthermalexpansionofentrappedfluid.Althoughthedesignofthesubjectpenetrationsandpipingisseentobeincompliancewithexistinglicensinganddesignbasisrequirements,PP8LsupportedEPRIeffortsto:addressthepotentialforpipingoverpressurizationunderdesignbasisaccidentconditions.TheEPRIeffortsconsistedofanalyticalevaluations,aswellaslaboratorytesting,whichwouldallowforananalyticaldispositionofthestaffsconcernsasoriginallyidentifiedintheGenericLetter.Specifically,thisworkwasaimedatestablishingplasticstrainlimitsthatcouldbeusedintheevaluationofthermallyinducedpressurizationofisolatedsectionsofpipe.However,variousissuesregardingtheuseofstrainbasedacceptancecriteriaremainunresolvedandthisapproachdoesnotappeartohaveuniversalacceptance.Inaddition,furtherEPRItestingaimedatresolvingtheseissueshasbeenindefinitelypostponed.Therefore,theuseofstrainbasedanalyticalmethodologiesdoesnotappeartobeaviablepathtowardsPP8L'sultimateresolutiontoGenericLetter96-06.InadditiontosupportingtheEPRIwork,PP8Lhasconsideredtheinstallationofpressurereliefdevicesontheaffectedpenetrationstooffsettheeffectsofthermallyinducedpressurizationduringdesignbasisaccidents.However,itisPP8L'spositionthattheinstallationofsuchdevicesontheaffectedpenetrationscomplicatestheexistingcontainmentconfiguration,andnegativelyimpactsplantreliabilityandoperation,withoutresultinginanetimprovementinnuclearsafety.Inaddition,preliminaryestimatesfortheengineeringandimplementationofthesemodificationswouldexceed$1,000,000dollarsperunit,andISIandmaintenancecostswouldbewellinexcessof$20,000peryear.\Inanindustry/staffworkshopheldinDecember1997inGaithersburg,Maryland,NRCstaffandindustryrepresentativesbothidentifiedthatthepotentialforthermallyinducedoverpressurizationduringdesignbasisaccidentswasnotofrisksignificance,norofsafetyconsequence,butwasrathera"licensingbasisconcern."3.2.1IdentificationOfLicensingBasisIssueAspreviouslystated,PP8LbelievesthattheexistingSSEScontainmentconfigurationisincompliancewithallapplicabledesignandlicensingrequirements,andthatitprovides 0I EC-RISK-1073PAGE8anadequatemarginofnuclearsafety.Alteringthecurrentplantdesignviatheinstallationofoverpressurereliefdeviceswouldnegativelyimpactplantreliabilityandimposeunnecessarycost,withoutresultinginanygaininnuclearsafety.AtthereferencedGaithersburgmeeting,theguidanceprovidedinCOMSAJ-97-008,whichillustratesthevinculumbetweencomplianceandsafety,wasidentifiedasaconsiderationinthestaffsintroductoryremarks.Itisthereforedeemedreasonablethattheuseofrisk-informedrationalebeconsideredtoresolvethestaffsconcernsregardingthepotentialforoverpressurizationofcontainmentpipingandpenetrationsduringdesignbasisaccidents,asoriginallyidentifiedinGenericLetter96-06.Itisthereforetheintentofthisrisk-informedassessmentto:1)provideevidencethattheexistingcontainmentconfigurationprovidesforanamplemarginofnuclearsafety;2)demonstratethattheinstallationofoverpressurereliefdeviceswillnotimprovenuclearsafety;and3)gainregulatoryacceptanceregardingPP&L'spositionthattheinstallationofoverpressurereliefdevicesontheaffectedpenetrationsisnotnecessary.Theuseofarisk-informedapproachmaintainstheexistingnuclearsafetymargin,whileminimizingtheimpactonplantoperations,testing,andreliability.Furthermore,whilepreservingthecurrentmarginofsafety,theunnecessaryburdenofman-remaccumulationduringtheinstallationandfuturemaintenance/testingofoverpressuredeviceswillbeavoided.TheregulatoryacceptanceofthispositionwillallowfortheclosureofGenericLetter96-06fortheSSESUnits.3.2.2Structures,Systems,Components(SSCs)AndProceduresCoveredByTheLicensingBasisIssuePP8L'sengineeringevaluationforGenericLetter96-06revealedthatatotaloftwelvepenetrations(perunit)weresusceptibletothermallyinducedpressurization.Thesusceptibilityofonepenetration,a1"demineralizedwaterline,hasbeeneliminatedthroughproceduralchanges:Fortheremainingpenetrations,PP8Loriginallyelectedtopursueresolutionthroughananalyticaldisposition.However,thesuccessofthatapproachisquestionablewiththeterminationofEPRIresearch.Therefore,thefollowingpenetrationsremainpotentiallysusceptibletothermallyinducedpressurizationduringdesignbasisaccidents:1)RBCCWsupplyandreturnlinestothereactorrecirculationpumps(penetrationsX-238X-24);2)RBCWsupplyandreturnlinestothereactorrecirculationpumpmotors(penetrationsX-85A,X-85B,X-86A,8X-86B);3)RBCWsupplyandreturnlinestothedrywellcoolers(penetrationsX-53,X-54,X-55,&X-56);and4)RHRheadsprayline(penetrationX-17).

'

EC-RISK-1073PAGE9Inadditiontothesepenetrations,thepotentialforoverpressurizationofthedrywellfloordrainqumppumpdischargepipingduringdesignbasisaccidentscouldpotentiallyaffectitsassociatedpenetration(X-72B)becausebothisolationvalvesarelocatedoutsideoftheprimarycontainment.Therefore,thereareatotaloftwelvepenetrations(perunit)thatrequireresolutionwithrespecttothestaffsconcernsregardingoverpressurization,asidentifiedinthegenericletter.3.2.3SupportingInformationAlicableCodesAndStandardsAspreviouslystated,theaffectedpenetrationsweredesignedandfabricatedinaccordancewiththeASMECode,SectionIII,1971EditionwithAddendathroughWinter1972.Thesub-sectionoftheCodewhichisapplicabletooverpressurizationrequirementsduringdesignbasisaccidentsisNC/ND-3621.2.EnineerinStudiesAndEvaluationsUSNRCNUREG-0933,Revision1(APrioritizationofGenericSafetyIssues),dispositionsGenericIssue150(OverpressurizationOfContainmentPenetrations)basedonthefactthattheestimatedrisktothepublicwasnotsignificant.PPBLStudyEC-059-1025,Revision0(EngineeringEvaluationofGenericLetter96-06)wasdevelopedinsupportofPPBL's120-dayresponsetotheGenericLetter.Inthatstudy,SSEScontainmentpipingsystems'wereevaluated,andthosethatarepotentiallysusceptibletothermallyinducedoverpressurizationwereidentified.Inaddition,therationalethatdemonstratedtheOperabilityoftheaffectedpenetrations,inlightoftheconcernsidentifiedinthegenericletter,wasalsodeveloped.4.0ENGINEERINGANALYSISThisSectionpresentsadescriptionoftheEngineeringAnalysisperformedtoresolvetheASMEcodeinterpretationissue.Bothtraditionaldeterministicdefenseindepthanalysisandaprobabilisticassessmentarepresented.TheASMEcodeissueconcernsoverpressureprotectionofcontainmentpipingandpenetrations.Therefore,thisanalysisisfocusedonthefailureofthecontainmentpenetrationstoprovideisolationduringdesignbasiseventsandtheimpactontheLargeEarlyReleaseFrequency(LERF)forallevents.Thetraditionaldeterministicevaluationispresentedfirst,followedbyariskanalysis.4.1DeterministicAnalysisThefollowingconsiderationsregardingthepotentialforthermallyinducedoverpressurizationofpipingsystemswereoriginallyidentifiedinPP&LstudyEC-059-1025,Rev.0,andarereiteratedhereassupportinginformation.

EC-RISK-1073PAGE10FactorswhichMitiatePressureRiseThereareanumberofmitigatingfactorswhicharelikelytolimit,orevencompletelyoffset,athermallyinducedincreaseinpressureinisolatedsectionsofpipe.Theseinclude,butmaynotnecessarilybelimitedtothefollowing:~AirPockets/Voids/CompressibilityTheexistenceofairpocketsispossible,ifnotlikely,inventlines,valvecavities,turbulentareas,andothernon-uniformpipinggeometries.Althoughthepresenceofairpocketsorvoidsisdifficulttoquantitativelydemonstrate,thecompressibilityofairactsasa"buffer"andcansigniTicantlyinhibittheextentofapressureincrease,andhencepipingstress.This"buffer"effectwasactuallydemonstratedintheEPRItestsinthatawatertemperatureincreasedabout20'Fbeforeanypressureincreasewasobserved(EPRITR-108812).~PipingExpansionThepipingitselfwillthermallyexpandascontainmenttemperaturesincrease.Althoughtheextentofthethermalexpansionislimited,theassociatedincreaseinpipingvolumewillaidinreducingtheextentoftheoverpressurecondition.Inaddition,althoughnoplant-specificstrainbasedevaluationswereperformedforSSES,itispossible,andevenlikely,thatplasticdeformationoftheaffectedpipingwouldaidinrelievingexcesspressure.~ValveLeakage(i.e.,Seat,Bonnet,Packing,Flange)IndemonstratingtheOperabilityofaffectedpipingsections,PP8Lhasnotcategoricallycreditedactualisolationvalveleakageasamitigatingfactor.Thereasonsforthisinclude:a)"as-found"and"as-left"valveleakagevarieswitheachrefuelingoutage;b)LLRTstypicallymeasureleakageintheaccidentdirectionand,hence,donotalwaysverifyleakageinthedirectionofoverpressurization;c)mostoftheaffectedpenetrationsareconnectedtoclosedlooppipingsystems,whicharealsosusceptibletotheeffectsofthermallyinducedpressurization;andd)mostoftheLLRTsfortheaffectedpenetrationsarepneumatictests(sincetheclosedlooppipinginside'containmentisnotcreditedasacontainmentbarrier),andforthesepenetrations,thetestleakageratesmaynot'bedirectlycomparabletothe"waterfilled"condition.However,formostevents,thethermallyinducedvolumetricincreaseofthepipinginventoryisrelativelysmall.Inaddition,asaresultofthe"incompressibility"ofwater,smallamountsofleakagecanacttolimit,orevencompletelyoffsetthermallyinducedpressurization.Hence,isolationvalveleakagecouldnonethelessprovideasignificanteffectinmitigatingtheextentof,pressurizationfortheaffectedsectionsofpipe.

EC-RISK-1073PAGE11BarrierEvaluation(ApplicabletoRBCCW,RBCW,andRHRPenetrations)Whilethemitigatingfactorsdiscussedabovemayeitherpartiallyortotallyoffsetanythermallyinducedpressurerise,theextentoftheseeffectsisdifficulttopositivelyquantify.Forthisreason,theOperabilityoftheaffectedpenetrationswasdemonstratedbyanalternatelineofreasoning.Thisrationaleconsistsofasimpleappraisalregardingtheactualthreat,forthermallyinducedpressurizationtocreateareleasepathway(forthetransmissionoffissionproducts)fromtheprimarytothesecondarycontainment.This"barrierfailure"approachisthemostviableindicatorofanycredibledegradationofsafety,andtheforemostmeanstodemonstratethatthepotentialforoverpressurizationwillnotresultinunacceptableoff-siteradiologicalconsequences.Anevaluationtoassesstheimpactofanoverpressureinducedfailureofapenetration,coupledwithanadditionalfailureduetoclosedloopoverpressurization,wasthereforeperformed.Inaddition,theeffectsofasingleactivefailureofeithertheinboardortheoutboardisolationvalve(toclose)wereconsidered.Inthisevaluation,thereliefofanoverpressureconditionthroughthesimultaneousruptureofvalvesorpipingatmorethanonelocationoftheaffectedvolumewasnotdeemedcredible.Thefollowingsummarizesthebasicrationaleandconclusionsregardingtheaffectedpenetrations.Ifanaffectedcontainmentpenetrationexhibitsapressureincreaseduringadesignbasisaccident,itisindicativethatitsisolationvalvesareextremelyleaktight.Intheeventthatexcessivepressurizationresultedinarupture,thepressurewouldberelievedoneithertheinboardoroutboardsideofthepenetration.Ifthefailureoccurredinsideprimary,containment,excessiveleakageintosecondarycontainmentwouldnotresultsincetheoutboardisolationvalvewouldremainasabarrier.Notethatthisisthemorelikelycasesincethesubjectpenetrationshaveagreaterlengthofpiping(withamorecomplexgeometry)insidecontainment,andthispipingissubjectedtomoreseveretemperaturesthanthepipingexternaltoprimarycontainment.Ifapipingorvalvepackingfailureoccurredontheoutboardsideofthepenetration,areleasepathtosecondarycontainmentcouldpotentiallybecreatedaftermostofthewaterispushedoutofthepenetration.However,intheeventofsuchafailure,theworstcaseleakagethroughtheaffectedpenetrationwouldequaltheinboardvalveleakagethatwouldbeatmost,thepenetration's"maximumpathleakage"ifnoadditionalfailuresoccur.Boththe"minimumpathleakage"andthe"maximumpathleakage"forSSEScontainmentpenetrationsarequantifiedpertheSSESLLRTprogram,andbotharemaintainedwithinadministrativeandregulatorylimits.Evenifeverysusceptiblepenetrationrupturedoutsideofcontainment,thetotalresultingcontainmentleakagewouldstillbewithinthecumulativeallowableleakagerateforType"8"and"C"localleakratetests(0.6L,or190,744.7SCCM).Therefore,underdesignbasisconditions,thepotentialforthermallyinducedpressurizationwouldnotresultinalossofcontainmentintegrity.Thatis,totalleakagewouldstillbewithinAppendixJallowablelimits.

EC-RISK-1073PAGE12Finally,itshouldbenotedthatalongitudinalrupturealongthelengthofthepenetration,,which,couldresultincommunicationbetweenprimaryandsecondarycontainment,isnotconsideredcredible.Thisisduetothefactthatthecontainmentwallispoureddirectlyaroundthepenetrationpiping(exceptRHR),thuspreventingthistypeoffailure.TheRHRpenetrationhasaflutedhead,whichpreventslongitudinalrupturessinceitismassivecomparedtothepipe.Therefore,inallcases,itwasconcludedthatthepotentialforthermallyinducedpressurizationofisolatedpipingsectionswillnotresultinapathwayforthereleaseoffissionproductstosecondarycontainment.SafetSstem6erationTheRBCCWandRBCWsystemsandthedrywellfloordrainsumppumpdischargelinesareallnon-safetysystemsandtheoverpressurizationofassociatedpipingdoesnotthreatenthefunctionofanysafety-relatedequipmentrequiredtomitigatetheconsequencesofdesignbasisaccidents.SincetheRHRsystemwouldbeinoperationpost-accident,thedifferingwaysinwhichtheRHRheadspraypenetrationcouldfailwereevaluatedtoassurethatcontainmentintegrityismaintained,andsystemoperationwouldnotbeaffected.Thefirstfailurepostulatedwasruptureofthepenetrationpipinglinebetweentheinboardandoutboard.~isolationvalves.Afailureofthistypewouldonlyresultintheleakageoffluidcontainedbetweenthetwoisolationvalves,andwouldnotaffectthepostaccidentoperationoftheRHRsystem.ThesecondtypeoffailurethatwaspostulatedfortheRHRheadspraylineisafailureoforattheoutboardisolationglobevalve.Inthiscase,thepressurewouldberelievedattheoutboardisolationvalve'spressuresealand/orpacking.TheconcernthenbecomesthatthevalvefailurecouldprovidealeakagepathtosecondarycontainmentforfluidbeingcirculatedbytheRHRsystem,fromprimarycontainmenttosecondarycontainment.However,evaluationshavedeterminedthattheseatingcapabilitiesforthisvalvewillprovidepositivesealingatRHRsystempressuresforatleastfourtimesthemaximumRHRsystemoperatingpressureattheheadspraypenetration.Itis,therefore,concludedthatthepotentialforthermallyinducedpressurizationofthehead.spraypenetrationwillnotimpactRHRsystemintegrityduringpostaccidentoperation.4.2OverviewofRiskAnalysisandConclusionsThissectionprovidesadiscussionoftheriskevaluationperformedtodeterminethecontributionofthermallyinducedoverpressurizationfailureofpipingpenetrationsontheprobabilityofpenetrationfailure.TheincreaseinpenetrationfailureprobabilityisconservativelyaddedtoLERFforcomparisontothecriterioninReg.Guide1.174.Theevaluationconsistsofthreeanalyses.First,theprobabilityofpenetrationfailuregiventhecurrentdesignisevaluated.Second,theprobabilityofpenetrationfailuregiventheproposedfixisevaluated.Finally,anestimateoftheadditionalforcedshutdownsfromtheproposedfixisevaluated.Theconclusionsfromtheseanalysesarethat:

EC-RISK-1073PAGE13~thecontributionfromoverpressurizationfailureontheoverallpenetrationfailureprobabilitygiventhecurrentdesignisinsignificant;~theproposedfixesactuallyincreasetheprobabilityofpenetrationfailureoverthecurrentdesign;and~theproposedfixesincreasethelikelihoodofaforcedshutdown.Therefore,additionalexpendituresassociatedwiththeproposedfixesarenotwarranted.Eachanalysisisdiscussedbelow.4.2.1MethodologyforEvaluatingtheProbabilityofContainmentPenetrationsThisSectiondiscussesthemethodsusedtoassesstheprobabilityofcontainmentpenetrationfailure.Theevaluationofcurrentdesignsispresentedfirstfollowedbyadiscussiontheproposedsolutiontotheproblem.4.2.1.1EvaluationofCurrentDesignstoOverpressureFailureofContainmentPenetrationsTheevaluationofthecurrentdesign'sprobabilityoffailurefollowstheapproachinNUREG-0933.TheanalysisintheNUREGisbaseduponthemodelthatthefollowingeventsarenecessaryforcontainmentpenetrationfailure:1.Containmentisolationissuccessful,P[0],2.Wateristrappedbetweenthe,inboardandoutboardisolationvalves,P[1],3.Theisolationvalvesareleaktight,P[2),4.Containmentheatingcausesheatingandexpansionofthewatertrappedbetweentheisolationvalvesoverpressurizingthepipeuntilrupture,P[3],and5.Failureofthepenetrationprovidesaleakpathfromtheprimarycontainmenttothereactorbuilding,P[4].TheP[]associatedwitheacheventrepresentstheprobabilityofoccurrence.Theprobabilityofcontainmentpenetrationfailurefromthermallyinducedoverpressurizationbecomes:4p=Qp[i]isOEq.1Theriskanalysisconsistsofassessingtheprobabilityofeachoftheseeventsoccurringforeachofthepenetrationsinquestion.Generalconsiderationsareaddressedfirstfollowedbyaspecificevaluationofeachpenetiation.

EC-RISK-1073PAGE14P[0],SuccessofContainmentIsolationThepenetrationsinquestionallreceiveisolationsignalsfromeitherHighDrywellPressure,orRPVlevel2(-38").Thesesignalsoccurinresponsetothefollowinginitiators:~MainSteamIsolationValve(MSIV)closure,~LossofOffSitePower(LOOP),~LossofanAC/DCbus,LossofeitherContainmentInstrumentGasorInstrumentAir(CIG/IA),~LossofServiceWaterorTurbineBuildingClosedCoolingWater(SW/TBCCW),and~ThefullspectrumofLOCAevents.Whensummedtogether,theseeventsoccurabout0.5timesperyearandcontribute,about62%ofthecoredamagefrequency(thefrequencyisvariedaspartofasensitivitystudy).Either2MOVsor2AOVsinseriesareusedtoperformtheisolation.Bothvalvesmustfailforfailureoftheisolationfunction.Overpressurizationisonlyanissueiftheisolationfunctionissuccessful.Sincetheprobabilityofsuccessisnearone,itisassumedthattheisolationofthecontainmentpenetrationissuccessful.Anevaluationofeachofthepenetrationsfollows.4.2.2SpecificEvaluationofPenetrationsAsdiscussedinSection1.2,twelvepenetrationsaresusceptibletooverpressurizationfailure.Elevenofthesetwelvepenetrationshaveasimilardesign.Theyinclude:RBCCW,RBCWandtheRHRheadspraylineandarediscussedgenericallyinSection4.2.2.1.Thedrywellsumpdischargepipingisconsiderablydifferentand,therefore,isdiscussedseparatelyinSection4.2.2.2.4.2.2.1EvaluationofRBCCW,RBCWandtheRHRHeadSprayLineThisSectionaddressestheRBCCW,theRBCWandtheRHRheadspraylinepenetrations.Thesepenetrationsallhaveinboardcontainmentisolationvalvesinsidethedrywellandtheoutboardcontainmentisolationvalvesinthereactorbuilding.Allofthepenetrationshavethepotentialtobewatersolidatthetimeofisolation.Aschematicisprovidedbelowalongwithabriefdescriptionofthepipingarrangement.

EC-RISK-1073PAGE15ContainmentWall>>6'utboardIsolationVeInboardIsolationvalveFigure1TypicalContainmentpenetrationTheRBCWandRBCCWpenetrationsconsistofapipewiththecontainmentwallpoureddirectlyaroundthepipe.ThetwoRBCCWpenetrationsare4inchesindiameter.TherearetwosetsofRBCWpenetrations.Onesetisusedtoprovidecoolingtothe,reactorrecirculationsystempumpmotorsand'are3inchesindiameter.Theothersetisusedtoprovidefordrywellcoolingandare8inchesindiameter.TheRHRheadspraypipeisdesignedwithaflutedend.Thepipediameteris6inches.Thispipeisfreetoexpandandislikelytofaileithercircumferntiallyataweakweld,orlongitudinallyataweakpointinthepipebetweentheisolationvalves.Therefore,failurecouldoccuranywherealongthepipe.P[1]WateristrappedBetweentheInboardandOutboardIsolationValvesTheprobabilitythatwateristrappedbetweentheisolationvalves,P[1),isassumedtobeone.RBCWandRBCCWareclosedcoolingwatersystemsandarerequiredfornormalplantoperation.Properoperationofthesystemsrequiresthattheybefilledandvented.Closingtheisolationvalveswillnotcauseareductioninthepipingsysteminventory.Therefore,aprobabilityofoneisassignedtoP[1]forbothRBCWandRBCCW.TheRHRsystemisnotaclosedcoolingwatersystem.TheRHRsystempipingismaintainedpressurizedbythecondensatetransfersystemandisperiodicallyfilledandvented.Additionally,theRPVprovidesasignificantbackpressuretotheRHRpiping,albeit,throughacheckvalve.Theisolationvalvesareclosedduringnormaloperation.Therefore,itisreasonabletoexpecttheRHRpenetrationtohavewatertrappedbetweentheisolationvalves.P[2]IsolationValvesareLeakTightTheprobabilitythattheisolationvalvesareleaktight,P[2],isassumedtobeone.Asdiscussedabove,bothRBCWandRBCCWareclosedsystems.Leakagethroughtheoutboardisolationvalvewillnotresultinpipingpressurizationduetothecapacitanceof I

EC-RISK-1073PAGE16theheadtank.Leakagethroughtheinboardisolationvalveintopipinginthedrywell,would.besubjecttopressurization.However,thispipingissubjecttothesameheatingfromthedrywellenvironment.ALOCAwillreducetheRPVbackpressure,however,theisolationvalvesaretestedforleaktightness.Therefore,itisassumedthatthepenetrationvalvesdonotleakandthatthepenetrationremainsleaktight.P[3]ContainmentHeatingCausesthePenetrationtoRupturelitEstimatingtheprobabilitythatthecontainmentwillreachasustainedtemperaturesufficienttorupturerequiresanevaluationofthepenetrationsmechanicalstrengthandthecontainmenttemperatureforaspectrumofaccidents.Therupturepressureofthepenetrationpipeisdifficulttoestimatesince,asdescribedinNUREG-0933,therearemanyphysicalprocessesthatmitigatethepotentialpressurizationfromheatingthefluidinthepenetration.ThisfactisillustratedbyaneventthatoccurredattheSusquehannaplant.OnMarch18,1992,Susquehanna2experiencedanelectricalfaultthatcausedall8RBCWpenetrationstoisolatefor9hours(SOOR2-92-024).AverageDrywelltemperaturereached165'F.Nopenetrationorpipingproblemsoccurredasaresultofthisevent.Onlyonevalveineachpenetrationclosed.Thisfactisnotimportantbecauseallofthepipingincontainmentincreasedintemperatureandhandledthepressureincrease.ThenormalRBCWsysteminlettemperatureis50'F.Thedischargetemperatureisexpectedtobe15'Fto20'Fhigherthantheinlet.Thedischargetemperaturewhentheisolationoccurredwas68'F.WhenDrywellCoolingwasstarted9hourslater,theinitialRBCWdischargetemperaturepeakedat139'F.Thisindicatesthatportionsofthepipinginthedrywellreachedthattemperatureorhigherwithoutcausinganyproblems.ThepipingincontainmentisdesignedtoPowerPipingCodeANSIB31.1whilethepenetrationpipingisdesignedasASMESectionIIIClass2piping.Thiseventprovidesindicationthatthermallyinducedpressurizationisnotassevereascalculationswithconservativeassumptionssuggest.Thiseventdoesnotprecludepenetrationfailureforhighertemperatures.Therefore,itisassumedthatpenetrationfailurewilloccurifcoolingtothedrywellisnotrestored.DrywellCooling(ES-134-001)canberestoredbyeitherrestoringdrywellcoolingorinitiatingdrywellsprays.RestorationofdrywellcoolingisallowedifaLOCAisnotthecauseofthecontainmentisolation.LOCAisinterpretedasanunexplainedhighdrywellpressureorlowRPVwaterlevel(-129").Drywellspraysareinitiatedafterthesuppressionchamberpressureexceeds13psig.JPenetrationfailureisaconcernwhenalargeradioactivesourcetermisavailableforreleaseinthedrywell.Thisimpliesacoredamageevent.Theproductionofhydrogenduringthecoredamageprocessissufficienttopressurizethecontainmentwellabove13psig.Therefore,theoperatorisauthorizedtoinitiatethedrywellspraysforcontainmentcoolingwheneverthepenetrationfailureisanissue.Additionally,PP8LhasmodifiedtheGenericEmergencyProcedureGuidelines,toallowdrywellsprays

EC-RISK-1073PAGE17underalltemperatureandpressureconditionsprovidedtheflowisthrottledfor30,secondsbeforeallowingsprayflow.Therearetwoindependentdrywellsprayflowpaths.EachpathcanbefedbysixpumpsincludingtwodieselfiredpumpsforapplicationunderStationBlackoutconditions.Utilizationofthesepumpsisproceduralizedandpracticedonthesimulator.Therefore,thedominantmodeofdrywellsprayfailureisfailureofthedrywellsprayvalvestoopen.Twovalvesmustopenineachpathforsuccess.Giventwopaths,thereare4combinationsoftwovalvefailuresthatwillresultinfailureofthedrywellsprays.Thepointestimateforcommoncausefailureoftwovalvesisestimatedtobe'.4x10withlowerandupperboundsof1.2x10and1;1x10.Sincethereare4possiblecombinations,theseestimatesaremultipliedby4forapointestimateof'.8x10andlowerandupperboundof4.8x10"and4.4x10.fPt'4t-PenetrationFailureCausesaLeakPathGiventhatthepenetrationfails,itmustfailinamannerthatprovidesaleakpathfromtheprimarycontainmenttothereactorbuilding.Threemechanismsarepresentedin'UREG-0933:,1.Alongitudinalrupturewhoselengthexceedsthethicknessofthecontainmentbuildingwall,or2.Asimultaneousruptureoftheonepenetrationandfailureoftheotherpenetration'sisolationvalvetoclose,or3.Asimultaneouscircumferentialruptureoftheinboardandoutboardisolationvalves,orpenetrations.IInadditiontothesethreemechanisms,thefollowingtwoadditionalleakpathsareevaluated:4.There-establishmentofdrywellorrecirculationpumpcoolingwithapenetrationfailure,and5.Afailureofasingleisolationvalvewithsubsequentruptureofapenetration.Thefirstmechanism,alongitudinalrupturewhoselengthexceedsthethicknessofthecontainmentwall,resultsinasinglerupturethatprovidesaleakpathfromdrywelltothereactorbuilding.ThisparticularmechanismisnotcrediblefortheSusquehannapenetrationdesign.Asshow'ninFigure1,thecontainmentwallisabout6feetor72inchesthick.Alongitudinalrupturewouldhavetobeatleast72inchesforthismechanismtocausealeakpath.BranchTechnicalPosition(BTP)MEB3-1,statesthatthelengthsofsuchrupturesareboundedby2insidepipediameters.ThecriterioniscorroboratedbytheGeneralElectricLicensingTopicalonPipeBreakcriteria(NEDO-23649).Thepenetrationdiametersare3,4,6and8inches.Baseduponthisconservativedesigncriterion,thelongestlongitudinaltearshouldnotexceed16inches,afactorof4.5lessthanthethicknessofthecontainmentwall.Therefore,theprobability

EC-RISK-1073PAGE18ofestablishingaleakpathfromthedrywelltothereactorbuildingbasedupon,mechanism1isnegligible.Thesecondmechanismrequiresasimultaneousfailureofanisolationvalveandaruptureofthepenetration.Inthissituation,theinboardcontainmentisolationvalvefailsatthesametimethepenetrationrupturesinthereactorbuilding,ortheoutboardcontainmentisolationvalvefailsandthepenetrationsimultaneouslyfailsinthedrywell.ThisparticularmechanismisnotcrediblefortheSusquehannapenetrationdesign.Thepenetrationsareinsulated,whichretardsthepenetrationheatupandassociatedpressurization.Boundingheattransfercalculationsindicatethataminimumof6hoursisrequiredtoheatthewaterinthepenetrationtoahighenoughtemperaturetopressurizethepenetrationtothematerialyieldpoint.Thestroketimeoftheisolationvalvesislessthan1minuteforRBCWandRBCCW.Theisolationvalveswilleitherhaveclosedorfailedopenbythetimethepenetrationrupturesonoverpressure.TheRHRvalvesareclosedduringoperation.Therefore,theprobabilityofestablishingaleakpathfromthedrywelltothereactorbuildingbaseduponmechanism2isnegligible.Thethirdmechanismrequiresasimultaneousfailureofthepenetrationinboththedrywellandthereactorbuilding.Thismechanismrequirestwoweaklinksinthepenetration.Itisincrediblethattwoequivalentweaklinksexistinthesamepenetration,withonebeinginthecontainmentandtheotherbeingoutsidethecontainment.However,itisconceivablethattwoweaklinks,suchaspacking,bothfailbyleakingsufficientinventorytorelievepressure.Inthiscase,neitherpackingleakissUfficienttorelievethepressurerise,buttheflowoutbothleaksis.Failureinthismannerdoesnotrepresentasignificantpathwayforradioactivitytransport.Thefluidleakingfromthepackingofthesesystemsisuncontaminatedwater.Furthermore,thevolumeofwaterthatmustleaktoelevatetheoverpressureconditionisapercentortwoofthepenetrationvolume.Whilethismechanismrepresentsacrediblefailuremode,itisinsignificantfromariskperspective.Therefore,theprobabilityofestablishingaleakpathfromthedrywelltothereactorbuildingbaseduponmechanism3isnegligible.Thefourthmechanismrequiresaruptureofthepipinginthedrywell,anoperatoractiontore-establishdrywellcoolingafterthefailure,andabreachofthesysteminthereactorbuilding.Thebreachinthereactorbuildingcouldbetheresultofaspuriousoperationofasafetyreliefvalve.Re-establishingdrywellcoolingisauthorizedbythegenericEmergencyProcedureGuidelines(EPG).However,PP8L'simplementationofthegenericEPGdoesnotpermitre-establishingdrywellcooling,ifdrywellcoolingisolatedastheresultofeitheraLOCAsignal(highdrywellpressureoflowRPVwaterlevel)orcontainmentradlevelsinexcessof5R/hr(NL-92-019).Anoperatoractiontooverridetheisolationrequirestheshiftsupervisor'ssignature.Therefore,anoperatorerrortooverridetheisolationoneitheraLOCAsignalorasourcetermintheprimarycontainmentwouldrequirethemis-diagnosisoftwooperators.Additionally,theresultsofthisconditionaresimilartothefifthmechanismandthereforeitistreatedwiththefifthmechanism.

EC-RISK-1073PAGE19Thefifthmechanismrequiresafailureofanisolationvalvetoclosewithsubsequent,failure,ofthepenetrationmanyhourslater.Twopossiblefailurecombinationsareconsidered:1.Failureoftheoutboardisolationvalvetocloseandruptureofthepenetrationinthedrywell,and2.Fail'ureoftheinboardisolationvalvetocloseandruptureofthepenetrationinthereactorbuilding.ThesetwofailurecombinationsarenotcrediblefortheRHRsystemsincebothisolationvalvesareclosedatthetimeoftheisolation.Therefore,mechanism4onlyappliestoRBCWandRBCCW.Ruptureofthepenetrationisnotcredibleforthefirstfailurecombination.FailureoftheoutboardisolationvalvetocloseallowstheentireRBCWorRBCCWsysteminthereactorbuildingtomitigatetheheatupandpressurizationofthefluidinthesystem.However,failureoftheRBCWorRBCCWinboardisolationvalveandruptureofthepenetrationinthereactorbuildingdoesrepresentacrediblescenario.Failureoftheinboardisolationvalveallowstheentiresysteminthedrywelltocommunicatewith.thepenetration.Insteadofactingtoreducetheeffectoftheheat:up,thisfailureactuallyintensifiestheloading.ThemeanprobabilityofavalvefailingattheSusquehannaplantwasassessed(EC-RISK-1065)tobe1.6x10withlowerandupperboundsof9.4x10and2.5x10.Thiscombinationoffailuresrepresentsacrediblemechanismofcreatingaleakpathfromthedrywellintothereactorbuilding.Aleakpathwillonlyoccurifthepenetrationrupturesinthereactorbuilding.Theprobabilitythatthepenetrationfailsinthereactorbuildingisestimatedbyassumingthattheprobabilityofruptureisproportionaltothefractionofpipinginthereactorbuilding.Thisisbaseduponthefactthatsimilarpipingisusedwithineachsystemandthatnopotentialweaklinks,suchasreliefvalves,areinthesystem.Thelengthofpipeinthereactorbuildingbetweentheoutboardisolationvalveandthecontainmentwallrangesfromafewinchestolessthan6feet.Thelengthofsystempipinginthedrywellisontheorderof100feetormore.Therefore,theprobabilitythatthepiperuptureoccursinthereactorbuildingisbetween0.001and0.1.Finally,allthesystemsconsideredareclosedcoolingwatersystems(note:bothRHRvalvesareclosedandnotsubjecttothisfailuremechanism).Therefore,eveniftheinboardisolationvalvefailsandthepenetrationrupturesinthereactorbuilding,theleakagepathwillbeinsignificant,unlessanadditionalbreachoccursinthedrywellsegmentofthesystempiping.Theprobabilityofthisoccurrenceisconsideredslightsincetheruptureinthereactorbuildingreducestheshockcausingthefailure.Asdiscussedinthepreviousparagraph,therearenoapparentweakpointsinthesystemsuchasreliefvalvesthatcouldopenafterthepiperuptureinthereactorbuilding.Forthisreason,twoprobabilitiesarereported:theprobabilityofasmallleakthatisassessedas1.0,andtheprobabilityofalargeleakpaththatisassessedtobebetween10and10.Adiscussionofthesevaluesisprovidedbelow.

0fA EC-RISK-1073PAGE20,Theprobabilityofasmallleakaccountsfortheflowofdrywellgasesthroughequipmentconnectionssuchasvalvepackingintothevoidedsystempipingandthenintothereactorbuilding..Giventhatthesystempipewilldrainasaresultofthepiperupture,anysmallleakinthesystemwillprovideapathfromthedrywelltothereactorbuilding.However,thesepossibleleakpathsmustbesosmallthattheydonotpreventsystempressurizationandpiperupture.Therefore,theseleakpathsmustbeverysmall.Theprobabilityofanadditionallargeruptureofsystempipinginthedrywellgiventheruptureinthereactorbuildingisdifficulttoestimatesincethisadditionalruptureisattributedtonomechanism.Evenifaruptureoccurs,theleakpathwillbenogreater,thanthesmallestopehing.Baseduponthemechanismsdiscussedabove,theleakpathshouldbenogreaterthantwopipediameters.Theprobabilityisestimatedbyassumingapassivepipefailureoccursafterthepenetrationfailure.Amissiontimeof1000hoursisarbitrarilychosenwhencalculatingtheprobabilities.Giventheseassumptions,theprobabilityofalargeruptureinthedrywellisestimatedtobebetween10and10with3x10'eingthepointestimate.Therefore,theprobabilitythatthepenetrationfailsinamannerthatwillresultinaleakpathfromthedrywelltothereactorbuildingbecomes:P[4]=PxP,bxPd~where;P=theprobabilitythattheinboardisolationvalvefails,P,b=theprobabilitythatthepenetrationfailsinthereactorbuildin'g,Pd=theprobabilitythataleakpathoccursinthepipingsysteminthedrywell.P-ProbabilityofPenetrationFailureTheprobabilityofapenetrationfailureisestimatedbycombiningtheaboveprobabilities.ThepointestimatesandboundswerepropagatedusingaMonteCarloprocedureassumingtheuncertaintyislognormal.Theresultsofthiscalculationarepresentedbelow.Theyrepresenttheprobabilityofapenetrationfailingastheresultofoverpressurization.Thetotalprobabilityisobtainedbyincreasingtheperpenetrationvaluebyafactorof10sincethereare11penetrationsbeingevaluated.Theresultsare"roundedtothenearestorderofmagnitudegiventheprecisionoftheinputdata.ProbabilityInsignificantLeakGrossLeakLowerBoundMedianMeanUpperBoundPerPenetration10101010TotalPenetrations10101010PerPenetration10101010Totalpenetrations10101010 0

iEC-RISK-1073PAGE21hThesenumbersareverysmallwhencomparedtotheprobabilityoffailuredueto,commpncausefailureofbothisolationvalvestoclose,whichisassessedatbetween.1.2x10and1.1x10.Theseresultsarerobusttolargechangesintheinputs.Asanexample,eachoftheprobabilitiesthatcontributetothepenetrationfailurecouldbeincreasedbyafactorof50andstillbelessthantheprobabilityofpenetrationfailureduetofailureoftheisolationvalvestoclose.EvaluationoftheProposedResolutiontotheOverpressurizationIssueAsdiscussedintheIntroduction,theinstallationofsafetyreliefvalvesisbeingproposedasamethodofresolvinganyoutstandingASMEcodecomplianceissues.Thevalvesaretobeinstalledbetweentheinboardandoutboardisolationvalvesanddischargedtotheprimarycontainment.Theinstallationofsafetyreliefvalvesmayreducethelikelihoodofpenetrationfailurefromoverpressure,however,theyalsointroduceadditionalfailuremodesthatmustbeaddressed.Breachofthecontainmentpenetrationfromtheinstallationofsafetyreliefvalveswilloccurifeither:Thesafetyvalveopensforpressurereliefduringapressurizationeventandfailstoreseat,orThesafetyvalveinadvertentlyopens,andAfailureoccurswhichcausestheoutboardisolationvalvetobeopen.Failurecouldalsooccurifthesafetyvalvefailstoopenresultinginoverpressurizationfailure.Thisfailureisinadditiontotheeventsthatcausetheoverpressurizationfailurewithoutthefix.Theprobabilitythatthesafetyvalvefailstoopenistypicallybetween3x10and3x10perdemand(NUREG/CR-2728).Thesafetyreliefvalvereducestheoverpressurizationfailurebymanyordersofmagnitude.Therefore,failureofthesafetyreliefvalvetoopenisnotconsidered.Safetyreliefvalvesaregenerallysetat1.25to1.5timesthedesignpressureofthesystem.ThesystempressureforRBCWandRBCCWisontheorderof100psi.Therefore,thereliefvalveswillbesetat150psigorless.Thispressureisanorderofmagnitudelessthanthepressurethatwillcausethepipetoreachitsyieldstress.Theprobabilitythatavalvefailstoresetafteropeningisestimated(NUREG/CR-4550)tobe0.096withalowerboundof0.0036andanupperboundof0.36.Thefailureoftheisolationvalvetoclosewasassessedaboveandis1.6x10withlowerandupperboundsof9.4x10and2.5x10.Thisinformationisusedtoestimatetheprobabilityofpenetrationfailuregiventheinstallationofreliefvalves.Thisparticularfailurewillonlyresultinleaksthroughpacking,etc.,andisthereforeconsideredan

EC-RISK-1073PAGE22insignificantleak.Agrossleakwouldoccurifabreachofthepipinginthereactorbuildingweretooccurinadditiontothefailuresdiscussedabove.AnumberofsafetyreliefvalveswereidentifiedduringreviewsofthePSIDs.Thediametersofthesevalvesrangefrom1to3inches.Thesevalvescouldspuriouslyopenallowingadirectpathfromthedrywelltothereactorbuilding.Themedianprobabilitythatasafetyreliefvalvespuriouslyopensisassessedat10/hrwithanerrorfactorof3.Aspreviouslydiscussed,amissiontimeof1000hoursisassumed.Theprobabilitythatthepenetrationfailsiscomputedastheproductoftheindependentprobabilitiesthatthesafetyreliefvalvefailstocloseandtheoutboardisolationvalvefailstoclose.ThesecomputationswereperformedforbothaninsignificantandgrossleakusingaMonteCarloprocedureandassumingthattheuncertaintyislognormallydistributed.Theresultsarepresentedbelow.ProbabilityInsignificantLeakGrossLeakPerPenetrationLowerBound6x10Totalpenetrations6x10PerPenetration3x10Totalpenetrations3x10MedianMean7x102x107x102x107x102x107x102x10UpperBound6x106x105x105x10Theprobabilityofpenetrationfailureismanyordersofmagnitudegreaterthanthepresentdesign.Thisisareasonableexpectationbecause:~Thesafetyreliefvalveisfarmorelikelytoliftduringaneventsincethereliefpressureissetwellbelowthematerialyieldstrength.~,'ipeorpenetrationfailureisnotexpectedtofailattheyieldbutonlyexperienceplasticdeformation.~Failureofreliefvalvestoresetafterliftingisareasonableexpectation.Therefore,themodificationproposedtoresolvetheASMEcodecomplianceissueisfarmorelikelytoresultinlossofpenetrationintegritythantheexistingdesign.AdditionalForcedShutdownsInstallationofsafetyreliefvalveswilllikelyresultinadditionalforcedshutdowns.Safetyreliefvalvesareknowntospuriouslyopen.Aforcedshutdownisexpectedifthereliefvalvedoesspuriouslyopen.OpeningofareliefvalveontheRBCWsystemwillresultineitherlossofatrainofdrywellorrecirculationpumpmotorcooling.LossofRBCCWwillresultinlossofrecirculationpumpsealandmotorcooling.Eitherofthesesituationswillresultinaforcedshutdowntoallowforthedrywellentryandrepair.Atypicalmediansafetyreliefvalvespuriouslyopening/rateis10/hrwithanerrorfactor-of3.Usingthisdata,theprobabilityofaforcedshutdownpersafetyreliefvalve,overthenext20yearsoftwounitoperation,isestimatedtobetween66%and99.99%'withthemeanvalue 4I EC-RISK-1073PAGE23being90%.Therefore,installationofthesafetyreliefvalvesislikelytocauseaforced,shutdqwn.ConclusionfortheRBCW,RBCCWandRHRCasesTheriskevaluationperformedabovehasdemonstratedthatthecontributiontocontainmentpenetrationfailurefromtemperatureinducedoverpressurizationisverysmallwhencomparedtootherfailuremodes.Additionally,theupperboundcontributionismuchlessthattheNRCcriterionforverysmallincrementalincreaseinLERF(lessthan107/yr).TheproposedfixdesignedtoresolveASMEcodecomplianceissueisfarmorelikelytoresultinapenetrationfailurethanthecurrentdesign.Additionally,theproposedfixislikelytoresultinforcedshutdownsduringthenext20years.Baseduponthesefindings,modificationstoreducethelikelihoodpenetrationfailureduetotemperatureinducedoverpressurizationisnotwarranted.4.2.2.2EvaluationofDrywellSumpLineThisSectiondealswiththedrywellsumppiping.Thispipingarrangementisdifferentfromtheother11configurationsbeingevaluatedinthatitisnotaclosedsysteminthedrywell.Aschematicisprovidedbelowalongwithabriefdescriptionofthepipingarrangement.ContainmentWallDrywell3h3hHV-16108A2HV-16108A1LiquidRadwasteSumpPumpsFigure2-SchematicoftheDrywellSumpPipingSystemAsdepictedintheabovediagram,thepipingsystemcommunicatesdirectlywiththedrywellatmosphere.Therearetwosumps.Eachsumphastwopumps.Apumpinitiateswhenthesumpvolumereaches75gallonsandstopswhenthesumpreachesthelowleveltrip.Thesumppumpseachdischargethroughadischargecheckvalve

~~Iil'I EC-RISK-1073PAGE24intoa2"line.Theflowratefromeachpumpis30gpm.Theselinesfeedintoa3inchheadeywhichpenetratestheprimarycontainmentwall.ContainmentisolationisprovidedbyHV-16108A18A2.Thehighpointofthepipingsystemisinthethreeinchsegmentofthepipenearthepumpsandis2'-3~/4"higherthanthepipeattheoutboardisolationvalve.Thepenetrationisapproximately40feetofpipeawayfromthehighpoint.Beyondtheoutboardisolationvalve,thepipedropsverticallyabout30feettotheLiquidRadwastesystem.EvaluationoftheCurrentDesignTheconcernwiththisparticularpenetrationisthatwatercouldbetrappedbetweentheclosedisolationvalvesandthepumpdischargecheckvalves.Ifthepenetrationpipingweretofailbetweentheisolationvalvesandthecontainmentwallinthereactorbuilding,adirectpathfromthedrywelltothereactorbuildingwouldbeestablished.However,theparticulardesignconfigurationofthissystemmakesitdifficulttocreateanoverpressurizationfailureofthisparticularpenetration.First,bothisolationvalvesareinthereactorbuildingandarenotsubjecttoheatingfromthedrywellatmosphere.Second,theisolationvalvescloseatleast2secondsafterapumptripallowingwatertodrainfromthehighpointinthedrywelltoliquidradwaste.Third,watertrappedbetweentheisolationvalvesiswarmerthanthereactorbuilding,sincethedrywellisnormally40to50degreeswarmerthanthereactorbuilding.Therefore,penetrationfailureisnotexpectediftheequipmentworksasdesigned.Overpressurizationfailureofthepenetrationcouldoccurifthepipewerefilledfromthepumpdischargecheckvalvetoeitheroftheisolationvalves.ThiscanonlyoccurifthepumpisrunningatthetimeofanisolationsignaI,andfailstotripwhentheisolationvalvesclose.Theoperatingpumpwillfillthepipewithwaterfromthepumpdischargecheckvalvetotheisolationvalve.Iftheoverpressurefailureofthepipeoccursinthereactorbuilding,itwillprovideadirectpathwayfromthedrywellatmospheretothereactorbuilding.Therefore,thiseventisbeinganalyzedfromarisk-informedperspective.P[1]WaterIsTrappedBetweentheInboardandOutboardIsolationValvesAsdiscussedabove,trappingwaterinamannerthatcouldresultinacontainmentpenetrationfailurerequiresfailureofthepumptotrip.Sinceeitheroftheisolationvalvesmustsuccessfullyclosegiventheisolationsignal,acommonlogicfaultcannotcausethepumpfailure.Therefore,theprobabilityoftrappingwaterbecomestheproductoftheprobabilitiesoftwoindependentevents,or:P[1]=P(Pumpisoperatingwhenisolationsignaloccurs)xP(Failureofpumptotrip)EachtypeofinitiatormayhaveaspecificvalueofP[1].Therefore,P[1]isevaluatedfordifferenttypesofinitiators.ThesevaluesofP[1]arethensummedtogetanoverallvalueofP[1].

h EC-RISK-1073PAGE25Theprobabilitythatthepumpisoperatingatthetimeoftheisolationsignaldepends,upontheinitiator.IftheinitiatorisaLOCA,andassumingleakbeforebreak,itisreasonabletoexpectthepumptobeoperating.Therefore,theprobabilitythatthepumpisoperatingatthetimeoftheinitiationsignalbecomestheLOCAfrequencyor0.005.IftheinitiatorisotherthanaLOCA,thenoperationofthepumpisindependentoftheinitiatingevent.Theprobabilitythatthepumpisoperatingatthetimeoftheinitiatingeventisthefrequencyoftheinitiatingeventtimestheprobabilitythatthepumpisrunning.AsdiscussedintheIntroduction,thenon-LOCAisolationeventsoccurabout0.5timesperyear.Theprobabilitythatthepumpisoperatingatthetimeoftheinitiatingeventisthefractionoftimeduringtheyearthatthepumpisoperating.Thisfractionisestimatedtobeabout0.01baseduponareviewofplantdata.Theprobabilitythatthepumpisoperatingwhentheisolationoccursistheproductofthesetwonumbersor0.005.TheprobabilitythatthepumpisoperatingwhentheisolationsignaloccursisthesumoftheLOCAandnon-LOCAprobabilitiesor0.01.Thepumpcontrolelectricalschematicwasreviewedtodeterminethefailuresthatwillcausethepumptocontinuetooperategivenatripsignal.Baseduponthisreview,thepumpwillfailtotripifeitheroftwosetsofcontactsonalimitswitchfailtoopen.Failureofalimitswitchtochangestateisestimatedtobe3.8x10"/demand(WASH-1400).Therefore,thefailureofthepumptotripisassessedtobe2x(3.8x10)=7.6x10/demand.UsingtheseprobabilitiesthevalueofP[1]iscomputed.P[1]=(0.01)x(7.6x10)=7.6x10P[2]ProbabilitythattheIsolationisLeakTightInthescenariothattrapswater,thewateristrappedbetweenacontainmentboundaryvalve,andthepumpdischargecheckvalves.Thecontainmentboundaryvalves,areleakratetestedandareassumedleaktight.Thecheckvalvesarenotacontainmentboundary,andareinstalledtopreventbackflowthroughthepump.Furthermore,allfourcheckvalvesmustbeleaktightforoverpressurizationtooccur.Thecheckvalveswereinstalledtopreventbackflowthroughtheidlepumpandarenotdesignedaspressureboundaries.Noneofthecheckvalvesareleakratetested.Therefore,theprobabilitythatnoneofthefourcheckvalvesleakisassessedtobenegligible.NUREG-0933corroboratesthisassessmentbyspecificallyexcludingcontainmentpenetrationsthatrelyoncheckvalvesforisolationfromGL96-06evaluation.Therefore,thevalueofP[2]isassessedtobenegligible.

~rf EC-RISK-1073PAGE26UsingthevalueofP[1]andP[2]inEquation1,theprobabilitythatthepenetrationfails.asare,suitofoverpressurizationisassessedtobenegligibleevenifthevaluesofP[3]andP[4]areassumedtobeone.Therefore,thevaluesofP[3]&P[4]willnotbeassessed.EvaluationoftheProposedFixTheproposedfixistoinstallareliefvalveonthethreeinchpipebetweentheinboardisolationvalve,HV-16108A2,andthepumpdischargecheckvalves.Thisreliefvalvewouldbelocatedintheprimarycontainmentanddischargebacktothedrywellsump.Failureofthereliefvalvetoopenwouldnotcreateanynewpathwaysbetweenthedrywellandthereactorbuilding,sincethepenetrationofinterestisopeninthedrywell.Therefore,theproposedfixdoesnotimpacttheprobabilityofisolationfailure.EvaluationofAdditionalForcedShutdownsFailureofthereliefvalveopenwillresultinsomeofthewaterbeingrecirculatedbacktothesump.Whilethisrepresentsanoperationalnuisance,additionalforcedshutdownsarenotanticipated.ConclusionontheDrywellSumpPipingThedrywellsumppipinghasbeenidentifiedasacandidateforoverpressurizationfailure.Ariskevaluationofthepipingsystemhasdemonstratedthatthelikelihoodofthisfailuremodeisnegligibleduetosystemdesign.Therefore,modificationstoreducethelikelihoodofthisfailurearenotwarranted.6.0IMPLEMENTATIONANDMONITORINGPROGRAMThisanalysishasdemonstratedthattheperformanceofthecurrentdesignissuperiortothedesignproposedtoresolvetheASMEcodecomplianceissues.Therefore,nohardwareinstallationandmonitoringisproposedinresponsetoGL96-06.PP8LhastakenactiontoreducethelikelihoodofpenetrationfailureasdiscussedintheAnalysisSectionofthissubmittal.Theseactionsprovideimprovementforothercontainmentfailuremodesaswell.Specifically,PPBLhasmodifiedthegenericEmergencyProcedureGuidelinesto:1.Prohibitbypassingdrywellcoolingisolation,iftheisolationwascausedbyhighdrywellpressureorlowRPVwaterlevel.2.Allowinitiationofthedrywellspraysunderalltemperatureandpressureconditionsprovidedflowisthrottledfor30secondspriortoallowingfullflow.Adiscussionofeachofthesemitigatingmeasuresfollows.

0h EC-RISK-1073PAGE27GL96-06wasanoverridingreasonforthefirstmodificationtothegenericguideline..TheEPGdirectstheoperatortore-establishdrywellcoolingifanisolationhasoccurredasatemperaturecontrolmeasure.OnecontainmentbypassmodeidentiTiedbyPPBLislossofclosedcoolingwatersystemintegrityinthedrywellandtheoperatorimplementingprocedurestore-establishdrywellcooling.Theoperatorhasnostatusofthedrywellcoolingsystempriortore-establishingdrywellcooling.Ifabreachintheclosedcoolingwaterpipinghadoccurred,thentheoperatoractiontore-establishdrywellcoolingwillresultinacontainmentbypass.Susqueha'nnaproceduresonlyallowtheoperatortore-establishdrywellcoolingifaLOCAwasnotthecauseoftheisolation.ALOCAisinterpretedtomeananunexplainedhighdrywellpressureorlowRPVwaterlevel.Itishighlyunlikelythatcoredamagewilloccurwithoutatleastoneoftheseconditionsoccurring.Therefore,thecontainmentbypassmodeassociatedwith.deliberatelybypassingcontainmentisolation,followingaLOCAisolation,hasbeenremovedfromtheSusquehannaprocedures.Thereareanumberofissuesassociatedwiththeseconddeviation.TheDrywellSprayInitiationLimitisimposedbytheEPGtopreventcontainmentfailurefromimplosion.TheSusquehannaMarkIIcontainmentisasteellinedconcretecontainment.PP8Lplantspecificcalculationsdemonstratethatunderthemostsevereconditions,damageislimitedtoexceedingthediaphragmliner'sdesigncriteria.Thiscanbeavoidediftheoperatorthrottlesdrywellsprayflowfor30secondspriortoestablishingfullflow.The30secondsofthrottledflowallowsforasubstantialamountofvaportobeaddedtothedrywellatmosphere,thuseliminatingtheconcernforimplosion.Thedrywellspraysprovideconsiderablecontainmentcoolingandremovethepotentialforoverpressurizationfailureofthepenetrations.Therefore,penetrationfailureisunlikelygivensuccessfuloperationofthedrywellsprays.Thesetwomitigatingmeasuresprovidesubstantialprotectiontoprimarycontainmentintegrityforboththeoverpressurizationfailuremodeandotherthreatsaswell.TheseimprovementshavebeenimplementedintheEOPsviaSafetyEvaluationsper10CFR50.59andaremonitoredthroughtheLicensedOperatorRe-qualificationProgram.76.0REFERENCES1)USNRCGenericLetter96-06,"AssuranceofEquipmentOperabilityandContainmentIntegrityDuringDesign-BasisAccidentConditions,"9/30/96.2)USNRCGenericLetter96-06,Supplement1,11/13/97.3)USNRCLetter,"MeetingWithNEIAndLicenseesToDiscussGenericLetter(GL)96-06,'AssuranceOfEquipmentOperabilityAndContainmentIntegrityDuringDesign-BasisAccidentConditions,'"Marsh,LedyardB.,toNEI,11/22/96(ReferenceNovember1996Dallas,TXMeetingWithNEI).

SRr 4)45)EC-RISK-1073PAGE28USNRCLetter,"IndustryWorkshopOnGenericLetter(GL)96-06,'AssuranceOfFquipmentOperabilityAndContainmentIntegrityDuringDesign-BasisAccidentConditions,'"Wetzel,BethA.,toNEIMeetingSponsors,1/28/98.(ReferenceDecember1997Gaithersburg,MDMeetingwithNEI).PLA-4521,R.G;-ByramtoUSNRC,"30DayResponsetoGenericLetter96-06,"10/28/96.6)PLA-4551,R.G.ByramtoUSNRC,"120DayResponsetoGenericLetter96-06,"1/29/97.7)8)9)10)PLA-4618,R.G.ByramtoUSNRC,"AdditionalInformationRelatedToThe120DayGenericLetter96-06Response,"5/9/97.PLA-4636,G.T.JonestoUSNRC,"Follow-UpResponsetothe120DayGenericLetter96-06Response,"6/30/97.PLA-4999,R.G.ByramtoUSNRC,"'ResponseForAdditionalInformationRelatedToGenericLetter96-06,"datedNovember9,1998.ASMECode,SectionIII,1971EditionwithAddendathruWinter1972,SubsectionNC/ND-3621.2.12)13)14)15)16)17)EPRITechnicalReportTR-108812,"ResponseofIsolatedPipingtoThermallyInducedOverpressurizationDuringaLossofCoolantAccident(GL96-06)."NEILetter,"ResponseToNRCStaffQuestionsonEPRIReportTR-108812inSupportofLicenseeResponsesToGenericLetter96-06,"Modeen,DavidJ.toWessman,RichardH.,4/30/99.USNRCMemorandum,COMSAJ-97-008;"DiscussionOfSafetyAndCompliance,"Hoyle,JohnC.toCallan,L.Joseph,8/25/97.USNRCNUREG-0933,Revision1,"APrioritizationOfGenericSafetyIssues,"NewGenericIssue150,6/30/95.EC-059-1025,Rev.0,"EngineeringEvaluationOfGenericLetter(GL)96-06,EquipmentOperabilityandContainmentIntegrityD.B.A.Conditions,"1/30/97.USNRCRegulatoryGuide1.174,Rev.July1998,"AnApproachForUsingProbabilisticRiskAssessmentInRisk-InformedDecisionsOnPlant-SpecificChangesToTheLicensingBasis."NEDO-23649Class1,8/77,ApplicationofPipeBreakCriteriaforMajorPipingSystemsInsideContainmentfortheBWR/6218,238,8251MarkIIIProductLinePlants,GeneralElectricTopicalReport.

AJ EC-RISK-1073PAGE29,18FC-RISK-1065,AssessmentofCommonCausefailureProbabilitiesusedintheSusquehannaIPE.19NUREG/CR-2728,InterimReliabilityEvaluationProgramProceduresGuide,1983.20NUGER/CR-4550page4.9-76.21WASH-1400Tablelll-4.2.22NL-92-019Rev.250.59SafetyEvaluationforPrimaryContainmentControl-EO-000-103.g:Qoadmin'haniiwalshUcukielkalrisk1073.doc08/02/9910:38AM