ML20044C290

Forwards Partial Response to NRC Request That Advanced BWR PRA Be Used to Identify Important Features Re Seismic Margins,Flooding & Fire,Including Important Insights from Advanced BWR Seismic Margins Analysis

ML20044C290
Person / Time
Site:	05200001
Issue date:	03/08/1993
From:	Duncan J GENERAL ELECTRIC CO.
To:	Kelly G NRC
Shared Package
ML20044C287	List: ML20044C286 ML20044C290
References
NUDOCS 9303220050
Download: ML20044C290 (10)

Text

.. l 1

March 8,1993 [

t To: Glenn Kelly, NRC .[

From: Jack Duncan, GE A9 i The following attachments are provided in partial response to the NRC request [

that the ABWR PRA be used to identify important ABWR features: '

l

1. Seismic Margins ,

2. Flooding

3. Fire v

in each case i believe the logic for selecting the most important features is clear.

Note that this material does not address the actions to be taken as a result of these studies. However, please recall that we have previously agreed that l seismic capacities will not be included in the tier 1 design description, but will be.

provided for the applicant to review against the capacities achieved. Achieving ,

these capacities is not considered to be a requirement on the COL applicant.

Please provide some feedback ASAP. Then, we will start work in the remaining areas. ,

i h

I i

9303220050 930308 PDR ADOCK 05200001 A PDR l

. /- /

477Acmne%7 I ,

IMPORTANT INSIGHTS FROM THE ABWR SEISMIC MARGINS ANALYSIS A seismic margins analysis has been conducted for the ABWR to calculate high confidence low probability of failure (HCLPF) accelerations for important accident sequences and classes of accidents. The measurement cr terion for these HCLPFs was twice the 0.30g SSE (0.60g). The results i

i of the analysis indicated that all hypothethized accident sequences and all accident classes met the criterion. All components in the analysis also had HCLPFs equal to or greater than 0.60g. Details and results of :

the seismic margins analysis are given in Appendix 19I of the SSAR.

There are several methods that could be used to identify important insights gained from the analysis. The two that have been used are the following:

1) Identification of the functions and equipment that would provide the shortest path to core melt in terms of the number of failures required, and comparison of the seismic capacities of the components involved.

2) Identification of the most sensitive functions and equipment in terms of the effect on accident sequence and accident class HCLPFs due to variation of component seismic capacities.

1 Shortest Paths to Core Damage:

1 Due to the relatively low seismic capacity of ceramic insulators, all J paths to core damage include loss of offsite power, i.e., if offsite power is not lost, the earthquake must be very mild and the plant is assumed to withstand the earthquake with no core damage.

Another basis for the seismic margins analysis is that failure of any category I structure directly results in core damage. All Category I ,

structures in the seismic margins analysis were treated as having large margins. The structures with the lowest HCLPFs are the containment  !

(HCLPF = 1.11g) and the reactor building (HCLPF = 1.12g).

Seismic failure of DC power also is assumed to lead directly to core 4

damage, whether or not emergency AC power survives. Without DC power, ,

the reactor cannot be depressurized, resulting in a high pressure melt.  !

The limiting components for DC power are the battery (HCLPF = 1.13g) and the battery charger (HCLPF =

0.75). In sequences where AC power'is available, both components must fail.

Failure to scram (ATWS) requires at least one additional failure to result in core damage, but there are three functions that could provide the additional failure. The limiting components that could cause failure to scram are the fuel assemblies (HCLPF = 0.62g) and the hydraulic

/L control units (HCLPF = 0.63g). The three functions that could provide 6 the second failure that would lead to core damage are failure to insert j boron, failure of level or pressure control, and failure to inhibit ADS.  ;

Seismic failure of the standby liquid control system to insert borated  :

solution into the reactor is controlled by the seismic capacity of the  !

SLC pump (HCLPF = 0.62g) and the SLC tank (HCLPF = 0.62g).

Seismic failure to inhibit ADS or failure of pressure control in an ATWS would lead directly to core damage. Failure of the same components

- the safety relief valves (HCLPF = 0.74g) - is the limiting failure for either of these functions.

Emergency AC power and plant service water were both treated as having the same effects in the seismic margins analysis. Failure of either function would require one additional failure to result in core damage.

In addition to failure of DC power, which by itself would lead to core damage, failure to scram could also provide the additional failure needed (in addition to failure of AC power or service water) to lead to core damage. Limiting components for seismic failure of AC power are the diesel generators (HCLPF = 0.62g), transformers (HCLPF = 0.62g), motor control centers (HCLPF = 0.62g), and circuit breakers (HCLPF = 0.63). i Limiting components for seismic failure of plant service water are the service water pumps (HCLPF = 0.62g), room air conditioners (HCLPF =

0.62g), and the service water pump house (HCLPF = 0.60g). ,

1 Most Sensitive Components The HCLPFs of the lowest-HCLPF accident sequences could be increased by increasing the HCLPFs individually of the firewater pump, the fuel, or +

the RHR heat exchangers The HCLPFs of the appropriate accident sequences would be increased by an amount equal to the increase in the HCLPF of any of these components.

The only single item that could, by itself, decrease the HCLPF of any accident sequence below 0.60g is a Category I structure having a HCLPF below 0.60g. This would also decrease the HCLPF of Class IE - ATWS with high-pressure melt due to loss of inventory. The Category I structures with the lowest HCLPFs have HCLPFs of 1.11 and 1.12g.

The only function that could, by itself, result in lowering an accident sequence HCLPF below 0.60g is DC power. DC power has two components that must both fail to fail the sequence - the battery (HCLPF = 1.13g) and the charger (HCLPF = 0.75g).

No single component could cause the HCLPF of any accident sequence to fall below 0.60g, even if its HCLPF were taken to be zero.

r l

/- 3

~ >

Summarv  ;

The important insights from this analysis are the following:

1) Seismic failure of Category I structures could result in core damage, and lowering of the HCLPF of any of the Category I ,

structures in the analysis would lower the HCLPF of one accident sequence accordingly. The structures having the lowest HCLPFs are the containment and the reactor building.

2) Seismic failure of all DC power could result in core damage, and lowering of the combined HCLPF of the batteries and chargers would lower the HCLPF of one accident sequence accordingly.  !

3) Because of the relatively low seismic capacity of offsite power due to the ceramic insulators, emergency AC power is important to the seismic analysis. The most important AC components seismically are those which provide power to ECCS i pumps:

diesel generators 480 volt transformers motor control centers circuit breakers

4) The results of the seismic margins analysis are most sensitive to the HCLPFs of the following additional components:

fuel ,

hydraulic control units SLC tank SLC pumps safety relief valves RHR heat exchangers firewater pump (including the structure '

housing the pumps).

i i

i t

f r

M77#N&7 2- 03/05/93 DIPORTANT ABWR FLOODING FEATURES The purpose of this report is to explain the basis used to select ABWR components as "important" based on the results of the probabilistic flooding analysis. The selected components along with the rationale for selection will also be described. ,

BASIS The ABWR flooding probabilistic risk analysis used simplified event and fault trees to 7 estimate the core damage frequency (CDF) due to postulated floods. This approach did not result in calculation of minimal cutsets which contdbute to the CDF. Therefore, there was no calculation ofimportance parameters such as Fussel-Vesely or Risk Achievement.

These parameters are typically used to determine the most important features from a dsk perspective.

Since importance parameters were not available, the selection basis used to determine the important features was the impact the component would have on the results of the specific flood in question. If, by completing its function, the component either fully mitigated or prevented the flood or was required to allow some other component to mitigate the flood, then it was selected. Features, such as sump pumps, that could mitigate some floods but could be backed up by other features like watertight doors were not selected.

FEATURES SELECTED Table I lists the features selected and the rationale for selection. Seven features met the criteria of either mitigating / preventing the flood or were required to allow some other feature to mitigate the flood. Proper operation of these features would prevent core damage for all postulated floods in the ABWR.

All of the features selected, except the water level sensors, are passive devices such as watertight doors, floor drains, and room volumes that are inherently highly reliable.

Therefore, flooding protection for the ABWR can be considered highly reliable. Also, no operator actions are required for flooding protection although timely operator actions can limit flood damage.

I

7 .

03/05/93 TABLE 1 - IMPORTANT FLOODING FEATURES FEATURE BASIS t

Normally closed and alarrred door between the Can limit the rate of turbine building flood turbine building and sersice building tunnel i water entering the service building tunnel (access to the control and reactor buildings). and ultimately the control and reactor buildings.

Water level sensors in RCW/RSW rooms in Will terminate control building flooding in control building to alert operator and trip RSW RCW rooms and limit damage to only one pumps and close valves in affected division. division.

This also includes the logic required to cetermine that a trip function was required.

Other features are also required for flood }

protection (e.g., electric power, pump and valve breakers, etc) but these have non-flood protection functions also so they were not selected. 4 Watertight doors on ECCS and RCW/RSW Prevents water from entering rooms rooms. This includes instrumentation to alert containing safety related equipment due to the operators that a watertight door is open. flooding on the first floors of the reactor and control buildings.

Floor drains in all upper floors of reactor and Direct flood waters to lower floors thereby control buildings.

protecting equipment from flood damage.

j Allow other features on lower floors to  ;

mitigate the flood (e.g., sump pumps, j watertight doors).

t Reactor building corridor on floor B3F is large i Terminates flood by containing the water enough to contain largest flood sources i volume and along with watertight doors  ;

(condensate storage tank and suppression prevents damage to safe shutdown '

pool).

. equipment.

4 Integrity of cable penetration seals on all cables Prevent water from entering ECCS rooms entering ECCS rooms from the corridor of due to flooding in the corridor for flood '

floor B3F.

, levels above the cable penetrations.

Reactor building sumps on floor B lF have an Prevents flooding of electrical safe overfillline to the B3F corridor. shutdown equipment on BlFifsump pumps fail or flood rate exceeds sump pump capacity.

)

I 2  !

1

. f7ffffye.pT]

IMPORTANT ABWR FEATURES IDENTIFIED BY TIIE FIRE PROTECTION PRA introduction An ABWR fire risk screening analysis was performed to assess vulnerability to fires within the plant. Details and results of this study are documented in Appendix 19M of the ABWR SSAR. Following appraisal of ABWR fire risk, the study was systematically reviewed to identify important safety insights. Those documented here include assumptions, features and observations shown to be important by the fire protection risk assessment. Those identified to be important by examination of other portions of the PRA, such as the Level 1 internal event assessment, are not repeated. ,

Locic for Insicht Development The screening criterion for EPRI's Fire Induced Vulnerability Evaluation (FIVE) methodology provided a basis for systematically developing safety significant insights.

The FIVE methodology provides procedures for identifying fire compartments for evaluation purposes, defining fire ignition frequencies, and performing quantitative screening analyses of fire risk. The criterion for screening acceptability an3 dismissal from any more detailed consideration is that the probability of core damage from any postulated fire be less than 1.0E-06 per year.

Five bounding fire scenarios and corresponding ignition frequencies were developed on the basis of the FIVE methodology. Each scenario was calculated to have a core damage frequency less than 1.0E-06 and hence screened from further consideration. Validity of these outcomes is cor.tingent upon specific assumptions regarding the design features and performance capabilities of stmetures and equipment. ,

Consequently, the study was systematically reviewed to identify those assumptions and i

features which are necessary in the fire risk assessment to achieve core damage frequencies less than 1.0E-06 and thus pass the FIVE methodology screen. They are listed and discussed in the paragraphs which follow. As stated previously, those identified to be important by examination of other portions of the PRA, such as the Level 1 internal event assessment, are not repeated here.

Safety Significant insights .

On the above basis, three specific capabilities and features important to safety were i

identified. These are the only capabilities for which credit was taken in the fire analysis but not in the Level 1 analysis. They are the following:

o The capability to operate RCIC from outside the control room.  :

I

J- L o The capability to operate four safety relief valves (SRVs) from the remote shutdown panel.

o Divisional separation of engineered safety features (ESF) and their support systems, i. e., electrical power and cooling water. This assures that a fire in one division will not cause equipment in another division to fail because of fire propagation between divisions.

The reasons that each of these items are important are discussed in the following paragraphs.

RCIC and SRV Operation from Outside the Control Room The dominant contributor to fire risk was found to be the potential for a control room fire leading to abandonment of the area and requiring control of the plant from outside the i

control room. Core damage frequency initially calculated for control room fires was over two orders of magnitude greater than that predicted for a divisional electrical fire, and did not pass the FIVE methodology screening criterion. This was due to the provision of capability at the remote shutdown panel to control a single loop for high pressure injection 1 (HPCFB) as well as initially only three safety relief valves for depressurization. With respect to the latter, successful operation of all three valves would be required to prevent core damage in the event of a need to depressurize.

Potential courses of action included providing control for a fourth SRV at the remote shutdown panel and taking credit for operating the RCIC system from outside the control room if practical. Examination of the latter possibility showed this option to be viable, and i core damage frequency (CDF) impact of each of these two options was assessed. Neither  ;

option by itself provided sufficient reduction in CDF. In combination, however, the fire risk screening critedon was met, and with the incorporation of both options, acceptably low fire risk was demonstrated for the ABWR.

Divisional Sensration of ESF and Support Systems Acceptable ABWR fire risk was demonstrated based upon the assumption that safety divisions, including necessary support systems, are isolated from each other by three hour rated fire barriers. This includes fire barriers formed by concrete fire barrier floors, ceilings, and walls; partitions; rated fire doors; penetration seals for process pipes and cable trays; special assemblies and constructions; and fire dampers. Without the integdty ,

of this divisional fire barrier separation, fire dsk would be much higher than that estimated ,

in Appendix 19M.

The EPRI FIVE methodology does not directly address the migration of smoke, and its impact is not explicitly estimated in the ABWR fire risk assessment. It is implicit in the l analysis, however, that the smoke control system will limit the spread of smoke and hot  !

gases between safety divisions to the extent that damage is limited to equipment in the  ;

2

. .7 3 division in which the fire staned. Smoke control isjudged to be much less significant than ;

preventing the spread of fire. Smoke which could migrate from one division to another is very unlikely to cause equipment damage resulting from fires several hours in duration.

For this reason, smoke control was not judged to be "imponant" in the context of this analysis.  !

l i

t i

I I

I l

3 l