ML20062F839

Atws:A Reappraisal.A Presentation to the Acrs. Concludes That Use of Addl Relief Valves in Pwr'S,Based on WASH-1400 Analysis,May Actually Increase Risk to Public

ML20062F839
Person / Time
Site:	Davis Besse
Issue date:	10/11/1978
From:	Lellouche G ELECTRIC POWER RESEARCH INSTITUTE
To:
Shared Package
ML20062F830	List: ML20062F826 ML20062F834 ML20062F839
References
FOIA-80-587 NUDOCS 7812210183
Download: ML20062F839 (30)

Text

a . -

T - . . . . .

5 Response to ACRS Request on Davis Besse RHR Pc-4 tion Dr. Kerr has requested an evaluation of the additional steam relief

./

~l capacity proposed for Davis Besse Units 2 and 3, comparable to that performed by Mr. Lellouche of EPRI which suggested that the addition of relief valves in PWR's may " increase the risk to the public."

The analysis performed by Mr. Lellcuche is inappropriate to this situation.

In his work Mr. Lellouche weighed the increased probabili y of a small LOCA due to additicnal relief valves against the decreased pretability of vessel

- C~D- it dealt with the primary system relief valves and discussed the possibil-ities of increased small LOCA risk. The valves proposed for Davis Besse

+ are in the secondary steam system. There is no increased small LOCA risk associated with these valves since event "P" discussed by Lellouche

] (opening with failure to close) of these valves will not result in loss of primary coolant. .

Any additional risk to the public from these additional steam relief valves ,

~~

on Davis Besse will be extremely minimal. It is difficult to quantify the actual amount of increased risk since the failure of one of these valves would only result in a mild excess steam flow transient. This event is not an accident, unlike the small LOCA discussed by Lellouche. Each of these steam relief valves is rated for 5 percent of full power steam flow.

~

If the valvewere opened accidentally, this condition would be noticed because of the loud noise caused by the steam relief and instrumentation readings of the primary system'since temperatures and power levels would change. If the reactor was at approximately 98 percent power or above, a

[

scram would occur. Otherwise, the reactor would continue to operate.

The only risk to the public from this incident would be the small radio-logical dose resulting from primary to secondary leakage which ,

results in slightly contaminated secondary steam. Under the assumption that these valves opened accidentally, it is possible ,

781221018 3 -

- *

• 4 mWhw g -eng- ..%,,. .,., ,. ,,,m, , ,

-- 1( ,

' ac= - a= ' ' ~ ~

w,w ' '

..& w^ 2 p-;

a . .

Q

^ ~

to calculate the dose to screene at the site boundary if cne of these valves were to remain cpen 'or C minutes. As discussed above, this is quite conservative since t%ir c:en state would be detected and corrective action taken. The staff has determined that the site boundary dose would be 270 mr, which is far belcw the limit of 10 CFR Part 20 for normal operation of 500 mr. This is a conservative dosage calculation done in a manner similar to accident analysis calculations.

If, for some reason, the valves cannot be reclosed, or they structurally fail, the resulting incider. wou'd te a small steam line break accident.

This is discussed in the Cavis Besse Safety Analysis Report and the resulting doses are well within the allowable limits since the incident is bounded by the large steam line break accident. No return to criticality is expected; therefore, no fuel damage is expected. Core integrity is not jeopardized and the incident is not a potential precursor to a core melt sequence.

Potential benefits from the RHR position have largely been discussed in a qualitative rather than a quantitative sense. The staff feels that good engineering practice dictates that nuclear power plants be able to cool down in a reasonable amount of time assuming partial failure of the

• normal cooldown system. Since only limited amounts of normal feedwater are l available for boiloff to the atmosphere, failure of the plant's cooldown f- 4 system to reach RHR operating pressures before water is depleted could L/ result in possible core melt scenarios unless the operator acts to introduce

j fouled water into the steam generators.

.i*

Since, a:; mentioned previously, the referenced study claiming increased ,

core melt risk from additional relief valves is not appropriate to this situation, the staff felt the benefits of the proposed system outweighs the small risk of increased site boundary exposures. It should also be i noted that relief from these atmospheric dump valves is a normal cool-down path for a reactor when the condenser is unavailable. Site exposures from this source have been reviewed by the staff and found acceptable. '

UmM -amoy- um y --

e,Q%mesemg -W+ - _-mg a . -e- nWw $m- -

w-gw,-.g*T'44me* *-456

c -

c , . ..

, w. n;g "cM" "% , .g.!!?ID ST ' ~ES

• • • • • October 16, 1973 MEMORAfiDUM FOR: Roger J. Mattsen, Director

! Division of Systems Safety FROM: L. P. Crocker Technical Assistant to the Director  !

j Division of Project Management

SUBJECT:

SAFETY IMPLICATI0iS OF ADDITI0iAL STEAM RELIEF VALVES FCR CAVIS SESSE 2 A!D 3 d

On September 13, 1978, we responded to an oral request by the ACRS

regarding the safety implications of added safety relief valves for Davis j Besse 2 and 3. A copy of that response is enclosed as Enclosure 1.

We now have received a memorandum from R. Fraley, dated October 11, 1978, i requesting a quantitative comparison of the advantages provided by the ,

additional relief capacity versus the disadvantages of the added valves.  ;

A copy of that memorandum is Enclosure 2. It includes an evaluation per-formed by Mr. Le11ouche of EPRI which indicates that added relief valves to relieve pressure surges associated with ATWS may actually increase the risk to the public.

It is requested that DSS perform the evaluation requested by Mr. Fraley,

.i and that you forward the results to me for transmittal to the ACRS. If

you anticipate that an extended period of time will be required, I would 1 appreciate being advised as to the expected completion date.

i O 4 7

L. P. Crocker Technical Assistant to the Director Division of Project Management

Enclosures:

3

1. Memo, Crocker to Fraley dated 9/13/78

2. Memo, Fraley to Crocker dated 10/11/78 cc: See next page -

I

7 5

e

'e. * , , G, ,

$ # e 4

a ,

G cc: E. Case R. Boyd D. Ross

• , r

.t i

l

-i 4

1 Ih i

4 li i

f i

e O

e

'l

'"'***"'-N' van - * .. wm _ ,. __ _ _

__ . .,a . . m - 5

- ._,. - , - ___ g t.

k.

f,..,rg i.a'i.: ., h =G U b TGn i CG......ih5 0..

g. ,

l ADVISORY OCMMITTEE ON REACTOR SAFEGUARDS g ., , [,f

. MSmNGTON, D. C. 20555 4

October 11, 1978 L. P. Crocker, Technical Assistant to Director, Division of Project Management SAFETY IMPLICATIC:iS OF ADDITIOiAL STEAM PELIEF VALVES FOR DAVIS-BESSE 2 and 3

. O

References:

(1) Memo from D. F. Ross to L. P. Crocker, dtd.

9/5/78, " Response to ACRS Question Concerning Steam Relief Valves for Davis-Besse Units 2 and 3" (2) Memo from L. P. Crocker to R. Fraley dtd.

9/13/78, " Safety Implications of Additional Steam Relief Valves for Davis-Besse ?. and 3" The information provided by Mr. Denton fails to provide a quantita-tive comparison of the advantages provided by the additional re-

] lief capacity versus the disadvantages of added relief valves.

The attached evaluation by Mr. Lellouche, EPRI, making use of WASH-1400 methodology, indicates that the addition of relief valves in PWRs to relieve pressure surges associated with ATds may actually " increase the risk to the public."

I Dr. Kerr has requested a comparable evaluation of the additional

=i relief capacity proposed for Davis-Besse Units 2 and 3 to pro-j vide for plant cooldown using only safety grade equipment.

1 H-9 R. F. Fraley Executive Director

Attachment:

AT45: A Reappraisal - A Presentation to the ACRS by G. S. Lellouche, EPRI cc: D. Ross, w/att.

t

,% , , , , _ e-- -me--i-e=m-,w m-= s-h-+ e***-a.=* *** ' -e--'

.4

- -- n

/: m

_ a .._:.c ,_ . : a. . --

AT4S: A REAPPRAISAL A

PRESENTATICN TO TriE ADVISORY CO.v.'4ITTEE Cri REACTOR SAFEGJAROS t ..

1 1

l -

by 4 . . .

t I ;

a G. 5. Le11ouche i !

EPRI 9

_ - - w-=< "* ~ ~"*" ~ ' ' ~ ~~ *

a_ ..__.m,._.  :-uc . - m- mq v , .

i 9 .

,~ .

ANTICIPATED TRANSIENT WITHOUT SCRAM (ATWS) d The presentation today has as its purpose a description of the tecnnical work done by EPRI personnel anc by EPRI contractors on the subject of ATWS.

r As needed this presentation will ciscuss in various degrees of depth tne staff publications WASHS.1270 and 1400, and NUREG 0460. It will indicate what EPRI has done, and how and wny it was done. It will demonstrate the close al relation between ::e s ram fatiure probability derived from historical scram

-( cata anc tnat derivea frca the use of component data in a system modeling (the i

so-called synthesis metnod), such as was done in WASH 1400. It will show the inherent conservatism of these moceling results by showing that they predict significantly more events than have in fact occurred and that such models still predict scram failure probacilities low enough to make ATWS an insignif-icant contributor to accident risk. It will show that the frequencies of I anticipated transients of potential significance are small,,approximately 1 or

, less per year. -

The discussion will arrive at the following conclusions:

1. Naval data is, as the staff states, appropriate and valid. We

, believe it snould be used.

2. The actual "tacting" rate of reactors is about 50/ year. I

. 3. The XAHL incident is demonstrably inappropriate to use, and recti-fication of KAHL is valid.

e

~

4.

The historical recore shows that the median LWR scram failure probability is < 3.2x10-6/ demand.

l:

l

=-- -

.3 . _ , . - "' v- -mm - ._

'~

& "' ~ ~

M la

p

'j~j

. ; . : .;, ;, r - :. . . .; ; .; : i ..e;;1.. ::r.- . ;; . u. : , . . . . .

k '

BWR 2.3x10-6/cemand PWR 4.2x10-6/cemana LWR 3.4x10-6/ demand

6. The expected numoers of transienti; of signficance are:

PWR < 0.6/ year (0.14/ year with 100% Bypass)

BWR < 3.5/ year ,(1.22/ year with > 25% Bypass)

LWR < l.7/ year (0.6/ year with appropriate Sypass)

7. Failure probabilities for the mechanical portion of tne system BWR << 10-7/ demand PWR << 10-6/ demand

.. 8. ATWS probabilities ,

(99% MTC)* PWR < 3.2x10-6/ year (7x10-7 w/ Bypass)

BWR < 1.8x10-5/ year (6x10-6 w/ Bypass)

LWR < 8.5x10-6/ year (3x10-6 w/ Bypass)

9. Correctly treating the Moderator Temperature Coefficient

.4 PWR < 7x10-7/ year (2x10-7 w/ Bypass)

10. ATWS comprises

< 6% of the BWR risk h:.

< 0.05% of the PWR risk Wstands for Moderator Temperature Coefficient.

l-r.

! i

- s-=

_e - . - - _-.%-.. * - . . .---.-.m... -.. - - . - --+-. g , - . . , . , se

Tl . . , -

.o .

JH .

1,1 -

. . ... . . ; ; . a i; .- ..

] - i pr:.:,..,.j increases tne total

,: risk by increasing the chance for a small LOCA.

l,.

The work was initiatec in late 1975 at the specific request r of a numbe Q of utilities who were upset about the antithetical positions taken by the staf f and by the NSSS vendors.

The utilities did not believe then, nor do they Delieve now, that ATWS was or is a real problem and they were f earful that their plants woulo be impacted for no gooo reason

} .

Because of the L'; generic nature of ATWS they turnec to EPRI to address the entire ATWS question.

p ta sks: Ine EPRI ATWS' project, as finally established, had three fundamental 4

1.

Critically review WASH 1270.

2.

Detennine guide. the relative importance of ATWS using WASH 1400 as a 3.

M Gather data on scrams, rod failures, test and maintenance m of scra s:

. systems, etc., to quantify from both a system and a component level the scram failure probability and the ATWS probability ,

A fourth task was to wrap up the project in a final ument; this last has not yet been done.

sumary doc of the following 6 documents: The results of this project to date consist j

1 i

4 EPRI NP-251 ATWS:

A REAPPRAISAL, PART I, An Examination and y Analysis of " WASH-1270, Technical Report on ATWS for Water-Cooled Power Reactors" Q ' EPRI NP-265 ATWS:

A REAPPR,AISAL, PART II, Evaluation of Societal Risks Due to Reactor Protection System Failure -

Volume I BWR Risk Analysis ,

Volume II BWR Fault Tree Evaluation Volume III PWR Risk Analysis t

_gI 3-m1 % b

_ ...e. **"*"*"

I ' '

_m .-m--.m_._____.___m -

a ._ w. -

w. .

.=. -

=. . . <

t; w - -

.. 1

[

u F

4 l

V 4 [

L -

Volume IV The Procability of Exceeding 10CFR100 f'; j Guidelines frcm ATWS Events in ,

~; -

3 Lignt Water Reactors .

s >

X r EPRI NP-801 ATWS: A REAPPRAISAL, PART III, Frequency of Anticipatec j i,0 Transients  !

3 r

[ lt was discovered early in the project that although many documents 6 existed on the subject few had sufficient infomation in them to allow another person skilled in the art to reprocuce the results claimed. This was not only true of staff documents but of ve.9aor documents as well. It was cecidea therefore to fully list all data, assumptions, methods, and even in some cases  ;

derivations. l Another decision made early was to restrict the study to the proba-

{

if milistic portion of the calculation and not to deal with the plant consequence  !

calculation. This decision, as it turned out, was extremely unfortunate since ,

it left us, in some cases for two years or more, with a lack'of comprehension j . of the real conditions for which the vendor calculated results were valta.

c y As the study was started it was quickly realized that classical statis-

/ tical methods had inherent difficulties in treating rare events. After much

• debate it was decided to include Bayesian estimation as the last stage of each f analysis and to take as priors the scram failure models established by the Reactor Safety Study. Since these models were not created by the EPRI study J, group their choice was felt to be less subjective than to try to establish a new prior within the study group. Although such Bayesian inferences were made, they will not be reported in this discussion. All results are classical unless specifically stated otherwise..  ;

The study group started a data collection effort which is still f operating. The various nuclear utility companies were requested to supply m ,

infomation on each and every scram that had occurred from the start of  !

commercial operation. This would ultimately lead to a comprehension of the l frequency of the various scram initiators (the anticipated transients). A *  !

second data collection effort was to query the Nuclear Safety Infomation Center (NSIC) which would lead quickly to a comprenension of which scrams had

@ safety implications vis a vis control rod and drive reliability. A third i effort was to query the NSIC for any infomation pertinent to failures in the

-4

n v ~. . .. -

2 .. - - - . w. . . , x. a

e . :e : =a. w -

.Le X3 :LauHe W w GauT%

d' , ., ..

L l -

otner parts of the reactor protection system (RPS) circuitry; for example, 9 sensor miscalibration, breaker failures, logic errors, etc. This last cata 3 base will soon permit a meaningful statistical statement concerning human 4 error during test and maintenance as well as installation errors, and has alreacy answered questions as to why the Reactor Safety Study m'dels of tne

, scram system for BWR and 'f-PWR yielded scram failure rates with an order of magnituce difference between them. A final effort was to question the Intrumentation and Control Supervisors of the various plants to determine the t; actual testing rates for the various portions of the RPS circuitry.

I; These types of cata were used to establish two funcamentally different

pictures of reality. In industrial statistical terms these are referred to as systems reliaDility and ccmponent reliability. The latter was used in the v fault tree models to predict system response and the former was used to calcu-late historical behavior. The Bayesian approach combines the two to infer

, future behavior. Nonetheless, even neglecting Bayesian inference, it is

( trivial to show that the fault tree predictions ovorpredict the historical

,. failure record. That is to say, the EPRI fault tree model n'umerical

_ predictions are in fact quite conservative. This is not unimportant; the staff has claimed that such modeling is unbelievable because the models ao not

predict the actual events that have occurred. In fact, all of the synthesis models: those of Easterling, Vessely, ana EPRI significantly overpredict reality and are, if anything, overconserv'ative.

The 6 documents mentioned above contain nearly all the information necessary to create tne discussion that follows; where there is a lack of infomation in the EPRI documents the requisite data will be found in the handouts or will be developed in the presentation itself. Because the 6 documents are interrelated it is not easy to discuss them separately.

Instead, the fomat of the incomplete summary document will be used. That is to say, the rest of the presentation will consist of a discussion of:

1. The probability of scrarp failure

2. The frequency of anticipated transients of significance

3. The probability of an ATWS of consequence -

4. The fraction of accident risk due to ATWS L

4 I

[:

L H

-s-

= =w- i .= - . , .=_- a _ :m a .. . - wm y , ., ..

.I3 .

q I. THE PROBABILITY CF SCRAM FAILURE

~ There have been quite literally hundreds of numoers Danciec aceut in the last few years purporting to be definitive statements accut A~WS ar.c its various probabilities. Very few of tnem appear, however, to De derived from a valid statistical base. The EPRI study group quite early came to the if conclusion that data collection was nearly the most important aspect of its

- worn. Where is the data? There are basically three sources:

. 1. U.S. LWR's

2. U.S. Naval PWR's

3. Foreign LWR's

~

It is easy enough to count the numcer of reactors and reactor-years of operation. It is still simple to query NSIC and find out how many scrams have occurred, and when, for the ccamercial units. It is not difficult to extrap-9 olate that infonnation to foreign LWR's. It is not even too great a stretch to apply the PWR transient-induced scram rate to naval PWR's. BuL, what about 1 the surveillance rates? How of ten are these units tested, and what do the tesis comprise? -

.- . . ~ You will note that no question is raised as to whether the naval data is

~y ,

applicable. It is clearly applicable! WASH 1270 says so, EPRI says so, and interestingly enough, NUREG 0460 says so also. But, although the staff has clearly stated that the naval scram system is not sufficiently different from i- the LWR systems to exclude the naval data, it does reject use of the Naval

.. data anyway; not, mind you, because it is inappropriate to use Dut because it could be " subject to misapplication." Professionally, such a statement is

~

impossible to comprehend; who would misapply it? Again, statements by the staff imply that if indeed the naval data were used, the staff " conclusion would not change." By this statement it is immediately implied that 2 to 3 scram failures on demand have occurred in naval reactors. Since the EPRI

( review of naval reactor behavior covered the period up to 1976, and since no scram failures on demand had occurred in that time frame, the 2 or 3 failures

, must have taken place in the last'two-three years. This type of failure rate i is equally impossible to believe. If the data is valid, use it; if it shows the EPRI analysis mistaken, fine; if not, then let us get on with using l professionally defensible numoers. But let the data be analy dd by profes-

'f

. sionally competent systems and data people. We should be perfectly happy to l 1

4

• 7p... . .

._.._.a l

, ' Tg*,. ,- -

, --l

7 - ., rx

.u..c -

-m-_au <-cx .n - wcq

.1  :

T. .,

"a ,

MJ i 2

L.  !

l supply sucn people to work along witn tne staff and stand oy their conclusions.

m. .

I y

For the purpose of this preuntation tnen, we agree with NUREG 0460 that  ;

"; 559 years of camercial experience is valid and disagree that the 1510 years of the naval dati. is not appifcable; thus, we are lead to a median ccnstant  !

failure rate of 0 = 1.39/2 x 2169 = 3.2 x 104/ year A based on a chi-square model assuming no failures. Using the average numDer of tests per year of 50 we have {

Pr (WS) = 3.2 x 10-4/2 x 50 = 3.2 x 10-6/demanc  !

This results is cased on the rectification of the KAHL event wnich is the only t potentially credible failure that has occurred.

The KAHL Event The only event that could be construtid to relate to scram failure took

} place at KAHL, a 15 MWE BWR, in Germany in 1963. The event involved the elec- i

' trical portion of the scram system and the details of the event have been e discussed before this committee on a number of occasions.

Briefly, the scram  ;

1. ,

~} relays are required to be replaced under prespecified conditions. One full  ;

1. ' i

[ set of such relays was faulty with a protective coating undergoing a softering  !

and rehardening after they were installed. The reason why the relays were not .

[

good had to do with the relocation of the plant that manufactured them and the I

installation of a new process for making them in the new plant. In any case after the situation was discovered, during a regular testing procedure, modf-fications in the QA procedures were instituted by NRC (essentially the appli-cation of Apper. dix B 10CFR50) and this QA modification was applied to all plants. ,

The EPRI stuoy concluded that the QA modification changed the definition i of the statistical population sufficiently to validate rejecting all data up through XAHL (i.e., both the successes and the KAHL event), and tnus

{ rectifying the data base. Rectif'ication is a common industrial procedure {

(, {

Y which simply states that when the process is changed, events which are no -

longer considered possible are excluded from the data base. i However, because

[ any change, even a paper one, could potentially introduce new faults, al data y f

$ before the process change must be excluded thus voiding the entire data base i

~

m A

i

- - r --e ..,,.._....e.=ew--=- + . ~ '

.- p 8% .

.. -- -. , g w , _ _

I k . ,

W * *

, . , . , + .

g n

d .

m 4

b up to the time of rectification. Since KAHL occurred wnen only about 5% of

'y the data had been collected, it c:es r.ct seriously ' affect tne cata base used for calculations cone tocay. The staff rejected the concept of rectification" h

with a technically weak argument, hence we demonstrate quantitatively using standard statistical tools that <AHL is not a credible event today; that is to l say, tne rectificatior, of KAHL was successful. For this demonstration, tne I, , staff assumption of a constant failure rate macel is used; however, tne result does not depend on that assumption and a binary failure model could be used as

, well and would arrive at tne same result.

. The KAHL event o'ccurred when 5% of the total number of scrams haa occurred. During the next 19 such periods no common mode event of the KAHL

c. (or any other) type occurred. One asks new wnat is the chance that such a

~

situation should happen and what does it say about the question of whether the KAHL event should be included or excluded from the data base. If one assumes a constant failure rate Poisson model then the probability of the KAHL event

~

occurring in the first period is just:

A Te-N -

while the probability that such an event not occur during the next 19 periods is

_ g19 T hence, the probability of the actually observed event is just (on average)

Pr = S,Te-20 T l

, Now, since an event did occur, one can use the statistical tables to yield 0.10 < 'T with 95% confidence. Hence the probaoility of the event sequence discussed I above occurring is less than 0.014. Indeed, the maximum event sequence prora-bility is 0.018 (\T = .05) .and 98% confidence that l i > 0.05. In normal statistical terms one discards events which do not fit into the popu-lation at the St level. From this viewpoint the KAHL event is not credible I and would nonnally be considered to have Deen rectified. Here it is excludable at less than the 2% livel. Were the NUREG 0460 value for > of 1.1x10-4 accepted, then the KAHL event sequence probability would be < 10-5; if the alternate NUREG value of 3x10-5 was used, the sequence probability *

• Interestingly, the staff accepts rectification for pressure vessels (WASH 1238) and diesel generators (Reg. Guide 1.108).

4 0 . . - .

" ' ~ ' * * * ' - < ,%,~.4- ..

..e ....-% , , y-..,m,. _ . . , , -,,,,,_%

~~-~A- - - - _ _ . - _ . _ _ _ _ - _ - _ . _

- ~ - . =.m e e

>f -

py *

• W S

(( ;ula ce 0.4.

sotn of tr.ese icply tne casic incorrectness of inclucing tne j KAHL event. That is to say, rectification of KAHL is statistically valid.

2 f The staff has implied that the fact that a few cad relays were found

$ many years later at Monticello " proves" rectification is incorrect. No one D

,. ever suggested that any manufacturing process is perfect; the trutn is, that there is a nonzero probability that any oatch of relays will contain a few bad actors. This is the nature of the manufacturing process. But, firstly, the

{ fact that 4 out of 200 relays at Monticello may be Dad does not impact on

{4 scram failure, which is not interested in 2 or 4 rods failing but in many or all failing. Secondly, the CA modification of making Appendix B ICCFR50 apply showed up even the random manafacturing failure. Tnere is tnus little question that tne process change works and the KAHL type of event was physically as well as statistically rectified.

O The Testing Rate While the annual scram failure rate derived above is a statistically L

valid statement it does not yield the scram unavailability / demand which is necessary to have in hand to calculate values for ATWS probabilities. To all intents and purposes, the following statement is valid: "If the constant failure rate (annualized) is divided by twice the number of annual demands

' then the result is the unavailability per demand; this number is also sometimes referred to as the 'without scram' probability."

3 The testing rate is important and the history of what numbers to use vary with publication. Thus, WASH 1270 assumed 12/ year excluding any accounting for the actual transients, NUREG 0460 does the same even though this effect gives a factor of 2 reduction in the scram unavailability / demand.*

$ In the first EPRI document NP-251 it was assumed that tests in commercial il ~

machines were two per month and the actual number of transient-induced tests of the scram system was added in. Further, the analysis of the naval data indicated weekly testing with about a dozen transients per year for a yearly

[i testing rate of 60 (accounting for out-of-service time). All of the testing L

rates used in WASH 1270, EPRI NP-251, and NUREG 0460 are incorrect because they do not correspond to actual plant practice. The study group discussed

'Tnis effect alone makes the "value" one-ah lf of the " impact".

4,

,+4

+ .g.

i 1

, gm mmen We*'P '" '

2 . A a." T

_. .- ... ,. - - _ u ,- - -_. __.

c .

q......

4 IS .

the matter with the instrumentation and control supervisors at 10 BWR's and 4

. PWR's. The results show the following conservative estimates of the actual b testing rues of the reactor protection system (RPS).

t-4 Table I RPS TESTING RATE

~!

Rate / Year Tyce PWR BWR Transients 10.6 9.4 Testing 12. 192.

~

22.6 201.4

.. O Table II shows the testing rate at various BWR's.

Table II Plant Testing Rate

~;

Dresden 20/ month Oyster Creek 3-5/ week 9 Mile Point 20/ month Quad Cities 16/ month ci Pilgrim 16/ month Cooper Station 4/ week

~!

.j O These tables show about 200 scram tests per year for BWR's and 23 per year for PWR. The great disparity is due to the fact the BWR's do double half scram tests on a distributed basis during the month at about 4 per week while the PWR testing schedule is quite different at different machines. Some i plants test on a fully distributed basis averaging 4/ month; other plants test -

all of the first half of the circuit (sensar to bistable) during a two-week -

period, then the second half (from the bistable to the actuator) during the next two weeks. It is not clear how to deal with this type of testing (which is felt to imply much more than monthly testing), hence the minimal rate of 4

• C " - * - * ' * * " " -.%.%%.% , _ , , , ,, ,, _. ,, , , _ _ _ . , ,

- -- ._A' __._-_.__m __m_A__'__ . . _ _ _ . - -

" OD

-m .+ ~w w - .a - 2:a m~" w a-.ma - - -

.c a,

one per montn is assumec. We now have 3 disparate testing rates and the

question of how to average tnem arises. It is possible to average them in ~

various ways:

r BWR pWR Naval Lincar: N = (25. x 200 + 39 x 24 + 131 x 60)/195

= 71 9

Inverse: N = 195/(25/200 x 39/24 + 131/60) i = 50 m

It was decided to use the inverse (parallel resistances) fann of averaging since it minimizes the high testing rates. Tne numerators are the number of plants in each category, using the U.S. inventory.' The world inventory of plants could also be used and t115 yields a value of N = 46; this is not significantly different. The historical data then supports a scram unavailabili ty of 3.2x10-6/ demand (3.5x10-6 based on tne world inventory).

The staff also claims maybe there are other known failure modes "out l ,

there" hence one should not remove KAHL. There is always a maybe attached to f,

everything, but rational analysis deals with what is known. Thus,1 f Jone asks

~

"what was the failure rate up to today," KAHL should be rejected since it has not been valid since soon after it occurred. If one wishes to project into the future then the chi-square tables introduce pseudo-failures to account for a lack of future experience. If one really wishes to understand internal operation of the mechanism then one should model the system (the synthesis method).

Systems Modeling

• The staff appears to have a problem with the reliability of the mechan-feal aspects of rod and drive. It seems that since no system failures have occurred due to rod and drive problems and they don't know what reliability to L,

apply. Further, Appendix B of NUREG 0460 makes states that tne EPRI modeling

[ is unbelievable because such modeling does not predict reality. On the contrary, the staff's perceptions in this area are not supported by the facts of the matter!

We shall discuss three models and show that all three models

=

,, 4 _m**"*" ~~~

___ '***Y" c

n gcy :...,- . :-  ; 3-n 7-34 ,

ll - . l l

~

F; are in agreement, ana all three mooels overprecict reality. Tne tnree models

~3 are those of EPRI (by SAI out of WASH 1400), Vesely, and Easterling. The models are basically different. The EPRI model coming from WASH 1400 is a l s true component reliability synthesis of the RPS system and attempts to account

< for common mode effects in rod and drive, human error during sensor test and g maintenance, and various other aspects. The fault trees are given in EPRI

_ NP-265, Vols. 2 anc 3 for BWR's and PWR's. These fault trees (from WASH 1400) were examined in great detail and were found to oe correct in the sense that p no additions or deletions were jucged necessary. The new NSIC data collection f of rod failures, however, led to ne following conclusions:

1. There were n_o roa inser-ion failures in SWR's cue to rod or roc drive problems. There was one triple nonadjacent rod event of less j than 96t insertion (but greater than 85f, insertion) cue to a problem j in the common scram dis:harge volume, f 2. There were two applicable single rod failures in PWR's.

4 fl n.

Since both fault tree models required an input of the single rod failure i j probability due to rod or rod drive mechanical defects, it was decided to 1

count the triple rod Dresden event as a mechanical defect event, even though U - - - -

it was not, so as to have a nonzero probability to enter the tree with. This j

~

was clearly a conservative action and, as s!!alf De shown, the resulting proba-

~

bility distribution predicted more than one triple event for the experience period during which the triple occurred. However, although it was

- conservative, it led to much emphasis from the staff that it was not conser-n -

vative because the rod failure model did not predict the triple event. -Of ccurse, the staff failed to realize that the rod failure model should not predict the triple event but that the Dresden triple was contained in another -

portion of the overall scram failure model dealing with scram discharge volume failures.

7 For the PWR, no such problem arose since there had been two single rod  !

s events. ,

The result of the quantification are to be found in NP-265, Vols.1, 2, and 3, and are shown in the following table:

• a f

%MW p *W og e -- ~me,, , , . p..,v r e y- + ++- y . . . . . _

a.,

a r!.uwamu X ^- x u'  ? '

. l. ...w ,

, I Q

• K -

t.

3 h

Taole III 4

UPD:.TED WASH 1400 SCRM FAILURE FAULT TREE RESULTS*

Unavailability Per Demand e Confidence Level a

y

{ Tyce 5 *. 50% Mean 9 5 *.

S'R 5.2x10-7 2.3x10-6 5.2x10-6 2x10-5 r;

PWR 1.9x10 5.1x10-5 6.4xlu-5 1.5x10-4 A major question arises at this point; why is the PWR system a factor to '

10-20 worse than the BWR system? Examination of the detailed design of the scram systems gave no indication of significantly different perceptions of g reliability; the engineers who had designed the systems were probably equally

^

competent. It was felt that the two systems should nave comparable (within a ,

L

' factor of 2-5) reliabilities. This question took se'veral years to resolve, v:n , . and finally the answers became clear when still another NSIC data survey was 1

made. An examination of the PWR fault tree quite early showed that failure to remove power from the trip bus dominated the unavailaoility, and breaker i failure rates and logic faults dominated the trip bus failure. The component failure infonnation entering the tree appeared to come from a Mil. Spec. data 7 4 base, and the question finally surfaced asking how did reactors compare with -

that data. The new data analysis indicates quite significant differences and  ;

when these were quantified the PWR scram unavailability was inceed found '

comparable to the BWR result, as is shown in the following table:

l Si- _

5 t

• Tnese trees were based on the WASH 1400 definition of scram failure:

, Any 3 or more adjacent rods for BWR's, any 3 or more rods for PWR's. '

These are recognized as being quite conservative definitions of failure.

o 13 3.

.,.z--

--;---- -~q,,, - - - - --~ --

n-

w.- . _ _ _ . - ~

.w.- .m. -m

+ '

4 .

. Tacle IV 2 UPDATED EPRI ANALYSIS OF SCRR4 UNAVAILABILITY PER DEMAND

. Confidence Type 5 ". 50" Mean 957.

O BWR (NP-265, Vols, 1, 2) '2.3x10-6 5.2x10-6 2x10-5 5.1x10-7 PWR (unpublished) 1.7x10-6 4.2x10~6 5.1x10-6 g,1,39-5 A copy of the analysis lea:ing to these results is part of the handout ,

that has been given you.

H Since NP-251 was published, two new scram failure models were cevisec by Mssrs. Vesely and Easterling. Mr. Vesely applied his to BWR's and Mr. Easterling to both PWR's and SWR's. Both made use of EPRI data. The Vesely model is a modification of the Marshall-Olkin model and may be considered simply as a generalized type of binomial model for failure behavior. The Easterling model is essentially a geometric model for failure

g. . . . behavior. Quite interestingly, both models predict about the same numerical results. Thus, the two models yield for the BWR -

Table V COMPARISON OF EASTERLING AND VESELY MULTIPLE RANDCM ROD FAILURE PROBABILITIES FOR BWR'S No of Rods VESELY EASTERLING 3 1.2x10-4 1.2x10-4 4 6.6x10-5 4.5x10-5 5 2.8x10-5 1.7x10-5 6 9.9x10-6 6x10-6 7 3x10-6 2x10-6 L 8 8x1'0-7 8x10-7 l 9 2x10-7 3x10-7 4

r,'

l '.

i l [: -

a k

-<- axma ,

.: . w w www . ~- mw ~ m-~

3 4

Vi i, 2 These results are essentially maximum likelihood estimates. If we pass to a 99% confidence level then we find the probability of 5 or more rods failing clustered is <10-7/demanc. Similarly, the Easterling result at 99%

confidence level yields the probability of 30 or more rods failing in a PWR as I less than 2x10-6/ demand.

The original WASH 1400 definition of scram failure was 3 or more connected rods for BWR, and any 3 or more rods for PWR. More recent analyses snow that at least 5 connected rods must fail for BWR's and at least 30 must U

fail for PWR's in oroer to constitute failure to scram. NUREG-0460 appears to f

arrive at a figure of 10 rods for Westinghouse plants, but this ccnstitutes failure to acnieve a permanent hot zero power state, not :ailure to mitigate I ATWS. A more careful reading of Appendix II, p.13-14, shows that at least 30  ;

rods need to fail to constitute failure to scram. C-E and B&W have informed l j tne study group that the 30-rod figure is also correct for their machines.

51 So far, we ha,e shown that the historical data and the various fault d tree mcdels yield numbers like 2-3x10-6/ demand and the Yesely and Easterling models yield smaller numbers yet. But, how can these numbers be judged as to ,

their correctness? That is to say, how conservative are tney? We take as a definition of conservativeness the prediction of more events than have

. . actually occurred. Only one BWR event has been consicered, the Dresden Triple, and only two single rod PWR failures have occurred. Yet, the models used to arrive at the small failure numbers above predict as follows:

PREDICTION OF ACTUAL EVENTS BWR - So.ESEN TRIPLE _

Vesely Model PredicO, ,1.86 Multiple Events at 99% S-C EPRI Model Predicts 2.25 Triple Events Expected Value PWR - 2 SINGLE R005 Easterling Model at 99% Level 6.4 Total Events 1.8 Events 5 roos or more ,

0.7 Eve.nts 10 rods or more  ;

f

.I oo w=*=-- --<

me . - . - - = - - . ,w.,,--, , - _ _ . . . __ . , , . , _ , _ _ , _ _ , _ _ .

$ .h 9_______

a - 1; . .m . --. _ w.au. _ _ c_ -.m = -

crmr m_w - a

.g .

1 N,  !

? .. . . i s, tney cvsrprs::: rea'.i tj ;a: te c;nsi: era;ij anc are ;.=refore conse rvati ve.

Two other points of interest are:

1. For PWR's tne new EPRI result indicates a mean numoer of scram

. failures, by any mechanism, of 0.01 for the historical data of ccmmercial PWR's, while the Easterling model at 99% confidence implies that of these, 0.004, at most, would be due to mechanical failures in the rods and drives.

2. The EPRI BWimodel indicates that tnere is some likelihood for a failure rate much larger than the mean or median; indeed, a 12%

procability for a failure rate greater than 10-5 Figure 1 shres that at that value of A the KAHL event sequence has a proDaoility of 1.8%,1/7 that predicted by the EPRI model . The EPRI model is even conservative relative to the actual KAHL event sequence

) probabili ties.

The following table summarizes the calculations to this point demon-

• strating the essential consistency of the historical recora ,and the EPRI and other modeling efforts.

"i Table VI SCRAM UNAVAILABILITY / DEMAND Method Value Historical Scram Record 3.2x10-6 @ 50% confidence Fault Tree BWR 2.3x10-6 9 50%

PWR 4.2x10-6 9 50%

Vesely BWR , < 10~7 9 99%

Easterling BWR < 10-7 9 99%

PWR < 2x10-6 9 gg; The study group sees no inconsistency between the historical record and the fault tree results, and sees the Vesely and Easterling failure models as -

providing further proof of the validity of the systems and synthesis analyses

,, done by EPRI.

~ -

-n.

p- .,m%.- , , . --v - . .

.6-NP--N-- * - ' * * * * * * ' *

• P""m*"b' **N"*

.. ._...? L& bwmar -

. Z 'EY ' . .ML:Tj! '

-3_

• k e

e ,

6 O e * .

,1 -

.3 i s .

s =.

h*

' I

. t i l*l l I l . 8 l 1 l 1 I - l "'

. i e i i i t i13 i , , 6 i , e .

. _ _ _ 4 gmm

-1 7_ _ .----...-._.-------,]m f ' l l l l f

f l l l i i ,

i , i . . . i i

3 l 1 l t I 'l l l l l l , l i j s -

2

, , i . , i i . 6 . I

i

, i 1 i i i 1

._.e. - . . . . -.-- --* 6 -p **p - -M

~

W '

n \ _.1

• q.J.:, . ' ;. !

-h&NEW M' W YE@ MCiTDMCvl'W '

hhk ' Cd e %

R% _

,6 E Q%$NL. .N.

N 1w-~- .- s,i i . .. . .

. .. , f . ,

i 4 _

a i i  ! i I f 3

.=

I, 4 _

. 3 -1.-_4q45 --

C-m .m e * -M-

~

, i l .0 X - a E a.

I' IN

~

E N M D -

_ i

~_g . .

M ~

x pa h m ~

> +

i s

I r I t

, x. , , , , .

=5

x ~

gr N l  !> i N v/

N --

. l 3

~

- m s s -

C

, x i o A l

l ' \

( i N I i N x .

I l I \ 0 t l l i lN % I i

i. i, T

l

'.N  ! i NkN\lt z . .

ei -

, \ s ,

.e l l SEku6Nc.dNE*Ysk, l '1 i l x

, i' o

~

l .  : i .l W ; e M_ -

IN: ,

3 I i 4  : I i i i  !

l  ! l  ! i I . I I 5

. ~ _ . e 3 ~=g -5

~ . . . ~=<gM ,

e e

h

www - wwsm-- x

• v+ws:x

-  :: c w . = .. - w o e

o. .

3.3 s$,i -

]J For the purposes of tne following discussion only, we conservatively H cound the aoove results and use:

~

A T

Pr (WS) < 5x10-6/demanc 3

A

. II. THE FREQUENCY OF ANTICIPATED TRANSIENTS

. Before an ATWS probability can be estimated a decision nas to be made on g wnat constitutes a transient in the sense of ATWS. The basic definitun appears to ce violation of 10 CFR 100 and this is interpreted by the staff to imp'y exceeding 320u psia for PWR's and 1500 psia or 160cF water temperature in the torus for BWR's. Although arguments can be raised concerning the over-conservatism of tnese criteria, the study group . accepted them as given. The study group also accepted the staff's assessment of which transient initiators could be considereo important, and the'y are the same as listed in Appendix IV i

f, to NUREG 0460. It is important, however, to remember the basis for deter-l' mining that a particular transient violates the criteria. This. basis is a i

d calculation using neutronic, mechanical, and thermal-hydraulic models which

[ are demonstrably conservative. Thus the various initiators can be ordered c;c using such a calculational model and the limiting ones determined, but the

[ specification of which of the limiting transients are significant depends in  ;

,} the very beginning on a series of conservative ass'umptions concerning  ;

r

'p moderator temperature coefficients, valve failures, discharge models, etc.

g -

With all of these it is still necessary to determine the actual numoer of transients.

There has been a fair amount of disagreement on the subject of what is l

[, or is not a transient of importance in the sense of ATWS. Indeed WASH 1270

$ stated that the transient rate was 0.1-0.5/ year but that 1/ year would be  ;

h conservative. WASH 1400 assumed 10 transients / year would be pertinent. NUREG

} 0460 assumes 5 for PWR's, 8 for BWR's and 6.for LWR's. All of these assump-

,7 ,

tions are incorrect for ATWS considerations. It is difficult to understand ,.

p how NUREG 0460 arrived at its numoers since they were given more detailed information over a year ago and were sent a draft of Part III of the EPRI ATVS .

Study entitled " Frequency of Anticipated Transients" last December. l i

d

- . - - - = - . . , ,e.. .. , . . _ , _ .

-m-_ . ~ , .; m_ - . .. .. . _ _ , m _

m.  %

. a In-cetermining or.at tne treder. Its are or.e .ws t r : r st ce r.er .t rm .:.a t

~

[ the transients are. For this the staff oefinitions enicn nave previously been lP presented to the ACRS are accepted. Tnese are snoon in Taole VII.

t ~ ~ ~ -

~

Table VII t

LIMITING TRANSIENTS FOR ATWS'

] ._ r - - - - - ~

g, Babcock & Wilcox

~ ~ ~ ~

A. Loss of offsite power (LCCP)

. B. Total loss of feecwater (LCF)

C. Transients leacing to LCF (LOL) n -

II. Combustion Engineering

.J _ _ .. ._ ._ . .

N A. 2560 MWt Core

1. Uncontrolled rod withdrawal (CEA)

2. Partial loss of feedwater (PLCF)

3. Loss of load (LOL)

4. Total loss of feedwater (i.0F) a

8. 3800 MWt Core

.]._c...____._________._.-

h _ - . _ _; _ _ __ _. _ ;_ ___ - 1. Uncontrolled rod withdrawal

- 2. Partial loss of primary coolant flow (PPCF) di~Z:ET-EE7T'_.._.~h

__L . . .._ __ _ - . r~ 3. Loss of load .

EhR 'br: ?P.1. . 2_ 4. Total loss of feedwater

d. . . .

I

~

'III. Westinghouse (No transient yields results of significance

. .__1 . . _ - but the most limiting transients are the

. following)

t. . Loss of load B. Total loss of feedwater

, IV. General Electric Any transient leading to excessive pool temperatures (GE)

• ~ "

4

( iThTdefinition of what constitutes a limiting transient is given in EPRI NP801; however, the determination of what constitutes a significant transient depends on the unacceptability limit (3200 psia, excessive pool temperatures) and a calculational model. The thermal-hydraulic models, particularly the valve discharge model, very strongly determines whether this unacceptability limit is reached. There is some reason to believe that the discharge model used is considerably conservative.

1A.

n +M -

-r s. -Arwe' ,,;e.,um.y _. .. ., .m . mm -. n ee m - . . _ . , . -_m.e..,-n- ,

. w .m

,, 1- - .n <; ,

~ . . . .

.a....

. .. an = ---._~ :.w . -- - ~ - m~ ww E'

y .

When the actual scram data from the utilities was collected it was necessary to breakdown the types of scram initiators into rather fine categories, 37 for SWR's, 41 for PWR's. Tnese categcries are described in EPRI NP-801 whicn you

[ were given some time ago. For our purposes the following table lists the

.' detailed plant transient applicab'; to ATWS.

3- , Table VIII V.'. .

CCRRESPONDENCE BETWEEN SIGFNICANT ATWS TRANSIENTS AND PLANT TRANSIENT DATA ATWS Transient Plant Transient

, PWR PPCF el Loss of RCS (1 Loop)

CEA 72 Uncontrolled Rod Withdrawal

PLOF #15 Loss or Reduction in Feedwater L Flow (1 Loop) l LOF #16 Total Loss of Feedwat'ar Flow

( All Loops)

LOL #18 Closure of All MSIV b d24 Loss of Condensate Pumps

( All Loops)

1. 25 Loss of Condenser Vacuum (LCV) i ,

1. 33 Turoine Trip (TT)

1. 34 Generator Trip (GT)

1. 35 Loss of Station Power BWR GE #1 Load Rejection r3 Turoine Trip

1. 5 MSIV (All Loops) Closure

1. 8 Loss of Condenser Vacuum 79 Pressure Regulator Fails Open

1. 10 Pressure Regulator Fails Closed

1. 20 Feedwater, Increasing Flow at Power

1. 24 Feedwater, Low Flow

. #31 Loss of Offsite Power f32 Loss of Auxuliary Power 4

• ~"" "N="' mc-w - are g e ,e-g- ww - -,m,,w, % , _%, c ue. .-. , . . . . .,_,.%m.

- a -

q

g_ _ , ,

.-_ _ _- m ,1- , ,

_ m .m r_ , _ , _.m L

n , g ,

f Finally, "when we quanti fy tnese transier.: frequencies we find tne results in g Table IX.

I i

! Tasle IX f

CACTCR VENDOR MEDIAN TRANSIENT INITIATOR

, FREQUEC IES RELEVANT FOR ATWS t

Events / Year I. Babcock & Wilcox

1) LOOP 0.27

2) LCF 0.07 -

! 3) LOL 1.11 Sum = 1.45 (0.5 w/100". Bypass)

II. Combustion Engineering a) 2560 MWt Core

1) CEA 0.02

2) PLOF 0.45 3). LOL 1.11 -

4) LOF 0.07 Sum = N (0.7 w/100% Bypass) b) 3800 MWt Core

1) CEA 0.02

2) PPCF 0.13

3) LOL 1.11

4) LOF 0.07 Sum = G (0.38 w/100% Bypass) 111. Westinghouse (none of significance, but those most limiting are)

~

1) LOL 1.11

2) LOF 0.07 Sun = G (0.23 w/100% Bypass)

IV. General Electric Sum = 3.52 (25% Bypass) 1.22 (25% Bypass)

L ,.

L These numbers include the effects of two considerations:

1. A first year learning effect

2. A power level effect.

T ie***'% y4 m ..,,-w= ,, ,p,,,, w .,. g,,5... u,% , , , , ,

. . w. - -

.am-r.w v -- z- w= yms Y .

• c' 4

.. 4 d

v

.f <

i t.

ine 5enrens-Fisner statistical test was used to determine whetner tne ur first year of the cata collection was from the same statistical populltion 33 a

the subsequent years. In tne cases of Turbine and Generator trip in ::th

/f.

B;R's and LWR's we found at the 95t level that the populations were different.

fl7' Only for these two transients was the extrapolation approach of extending tne year 2-N data average to year 40 and then adding in the first year cata and I,

dividing by 40 used. In all other cases, a straight average of all tr.e years data was used.

N o

NUREG claims (p.12 main report) that failures may occur more often later in life; that.the older reactors are safer, and that designs are still evolving. It is hoped that designs are still evolving, it is not found in fact that failures in heavily maintained electric power plants significantly increase with age (indeed maintenance replacement policies are used to obviate h?' s- a such situations), and the data shCws that while sCme differences exist Detween

( plants older than 5 years and those younger the differences are not signif-icant. This can be found in the following table.

4 ,

Table X s

EFFECT OF PLANT GENERATION ON TRANSIENT EVENT RATES 71 Plant Type s

Year of Operation L 2 3

.n PWR's Greater than 6 years 19.7 19.7 12.7 Less than 6 years old 16.9 10.3 7.8

[ I BWR's Greater than 6 years old 20.3 5.5 5 Iqt Less than 6 years old 23.4 7 5 These rates are for all transients at all power levels; they show the newer PWR's are somewhat less susceptible to transient events than the oloer 4 (the opposite of what NUREG 0460 states) and that no significant differences appear for BWR's.

• C This makes the point that all the data is applicable.

i-r

4 4

t

% gr, w-- e ** _ . . . . -- --

p, . - - . . - ..w a > . a. . : -m "2 r -- ' c - y 51 '

!=

Table XI LWR APPL *;;3LE AhTICIPATED TRANSIENT FRE0uENCIES PWR 0.64 (0.14 w/100% bypass)

SWR 3.52 (1.22 w/>255 bypass)

. LnR 1.68 (0.60 w/ appropriate bypass)

III. THE PRCBASILITY CF ATWS This is better cescribed as a frequency and is a ccmuination of the numoers al ready calcu? atac.

(]) Table XII -

ANNUAL ."REQUENCY OF ATWS (Pr( ATWS))

PWR 3.2x10-6 (7x10-7 w/ bypass)

BWR 1.8x10-5 (6.1x10-6 w/ bypass)

LWR 8.4x10-6 (3x10-6 w/ bypass)

• h These ATWS event frequencies for PWR's assume 99t MTC values. At some lower MTC value the numeer of events becomes zero for all PWR vendors. The

_ critical MTC value (MTC*) varies with transient type and the fraction of the 1

J:. cycle during which the MTC is greater than MTC* also varies witn the transient type. PMTC* is the fraction of the equilibrium cycle that MTC is greater than MTC* hence for which an ATWS might exceed some criterion (3200 psia).

Table XIII shows the values of PMTC* for those transients important to B&W and y

C.E. machines for which data is available.

s 9

• =

i

,% ,w e ,w-

_ eyeye +< - - _ www* ee n w e = %-.m & v **De**" " * * * - * * * - ' " ' * ' " ~ ' * * ~ ~ ' ~ "

_ _ _ _ . u- -

~ _ . . - w .-

a- - m, I

. .s .

J ,

s

s. .

Table XIII FRACTION OF THE FUEL CYCLE DLRING WHICH MTC > MTC*

Vendor Transient PMTC*

B&W LOOP 0.15 LOF 0.22

.:q LOL (leading to LOF) 0.22

.Ai C-E (2560) CEA  ?

Part Feed 0.16 (mayce)

LOF 0.18 LOL 0.18 (=aybe)

C-E (3800) CEA  ?

Part Primary Cool  ?

LOL 0.18 LOF 0.27 D -

Properly speaking, the value of PMTC* is used as a multiplier to Pr (ATWS); the product yields the probability of a PWR ATWS occurring and c;

yielding a situation where the pressure exceeds the critical pressure y - . .

(3200 psia). Using Table IV, taking Pr (WS) as 5x10-6/ demand and using the numbers in Table XII above, one obtains -

Table XIV ANNUAL FREQUENCY OF AN ATWS LEAD..;G TO PRESSURES GREATER THAN 3200 PSIA 7-l B&W 1.5 x 10-6 C-E (2560) , 1.5 x 10-6 C-E (3800) 2 x 10-6 PWR (Total) 6.5 x 10-7 .

._ ., . . . . - . ~~.- - - - -~+--- ~ ~~ ' ~ " ~ - ~ ~ ~ ~ ~ ~ ~ ~ ' ~ ~ ~ ' - ' ~ ~ ~ ~ "

, m_ _ _ _ .: -

. m_. _z= m y

. + . I, . . . '

Using the clearly conservative BWR syntnesis result wnicn is fully

.- consistent with the Dresden plant data, the median BWR unavailacility of 2.3x1076/ demand x 3.5 demands / year yields an upper bound ATWS rate of 8x10-6/ year. This value would reduce to less than 3x10-6/ year for plants with J greater than 25*, bypass.

0 Decisions should not be made in a vacuum. Since tnere is no absolute level of risk that has been decided is acceptable, a relative risk comparison I must be made to place a risk into perspective. How important is ATWS7 This question can be answered in part by saying "it is responsible for such and such a percentage of the total calculated risk." When such statements are made a perception is cetained of wnat eliminating ATWS as a potential risk means (from the viewpoint of healtn and welfare of the public). That is to say, the standard viewpoint of value/ impact which states that "the value of a fix is greater than tne impact of doing the fix" is insufficient. This i s 4-

,3 particularly true of events so rare tnat not only have none occured but they

] are only a small part of a population of events most of them more likely to I occur and none of which has occurred either. That is, we ar,e in the Scholasticism mode of behavior of asking not how many angels can dance on the head of a pin but asking if one is removed, how many are left.

I Still, one can use WASH 1400 to quantify not only total risk but fractional risk as well. That was done in NP-265 where the following results were found:

, Table XV ATWS FRACTIONAL RISK Fraction of Total Risk WASH 1400 BWR 0.23

< PWR 0.003 EPRI (NP265) BWR- 0.05 J PWR 0.005 EPRI.(unpublished) PWR 0.0005 (estimated) h w ev4 ,w, .-e , + . - m._ w.. , , . . , , , , , , . . , , . , _ _ . ,

+ y -

- -- a .. - x~. -.~..w- ^

= -

- :.=>.

t .

b.

. .... .cn entry accoun s for tne ne.er estimate of PWR scram unavail-aoility per demand just oiscussed.

A The difference between tne risk impacts (a factor of 100) is accounted for by tne basic difference in tne plant types .

The staff has recently statec in NUREG 0460 that the WASH 1400 risk calcu-

/ lation for failure to scram is not accurate because of the use of standby boration as an acceptable shutdown system.

If this is accounted for (factor of 10) and the reduction in initiators per year (from 10 to 1.22 for 8WR's and 0.6 for PWR's) as well, then the risk estimates would change as follows:

L.

. Table XVI LaR RISX ACCOUNTING FOR STAFF ARGUMENTS AND LATEST Fraction of Total Risk BWR 0.061 PWR 0.0003 i'

One sees clearly that the the PWR ATVS risk is a truly insignificant fraction of the total PWR risk, and that the BWR ATWS risk is only 6% of the O total SWR risk.

It appears that from a rational point of view one does not 1 '

start spending large amounts of money to fix things that will not impact on the total risk.

This is even more important as a decision criterion when one I '" considers that the value/ impact calculation in NUREG 0460 appears incom

---

O.

a risk Finally, viewpoint. it is possible to place the suggested "fix" in perspective from The suggested fix for PWR's comprises two classes of items; the one of interest here is the installation of additional valves.

Relief valves open. have two basic failure modes, one is to fail closed, the other to fail In the first failure mode (la'beled as Q in WASH 1400) a presscre buildup occurs as in the classic ATRS; irt the second (labeled P) the pressur p buildup does not occur but a small LOCA* does occur.

If T cenotes transient r and K scram failure one must exadine the relative magnitudes of TKP and TKQ U To all intents and purposes one need only examine P and Q. valve Single -

failure to close after opening is taken in WASH 1400 as 3.3x10-3, hence for 7 'TEis small-small considered small pipeLOCAbreak. has a much lower probability than the usually g, .

y

, a

_ - - . . , _, g.w =w-'* * " ' " ~

D n '.L u..a . a- w .zw uxa nwwaag

, ,a- , .

. . . . . .e.,

h y

f the tnret valves P = 10-2/ demand M For tne failure to open a sufficient number of valves to cause a damaging i pressure surge f Q = 3x10-5/ demand J

There is also- a probability that the ccre is at a portion of the life ,

O cycle where even if all the valves open the value of the MTC is too positive d to turn the pressure around soon enough; this probability, PMTC*, is very nearly zerc for Surry. , Hence, the TK sequence should oe reple:ed by the TKPMTC* sequence ano one snould c=;are PMTC* with P and Q. For surry, C and l PMTC* are negligible compared to P. The NRC staff has sugges.ed, in tneir L 4' May 26, 1978 presentation, that if the risk goal was to oe recuced to j 10-7/ year that Westinghouse would have to add one or two additional valves.

1 What this would do is drive Q and PMTC* to essentially zero and increase P by l 30% for each valve added. That is, based on WASH 1400 analysis the proposed staff fix actually would increase Qe, risk ta the public. Because WASH 1400 is in place one can arrive at the above conclusion; for C-E and B&W it is more difficult since neither the probabilitistic study nor a sufficient number of l' ,

sensitivity studies have been perfomed. Nonetheless two things are clear.

ni The event trees leading to ATWS will not change. The TKPMTC*, TXP and TKQ N

^

seq'uences will still be the pertinent sequences. The TKPMTC* will generally

~"

dominate TXQ. The values of T entering these sequences will, however, generally be different with a larger number of transients leading to a form of

._ . small LOCA scenario (TKP) than for ATWS. However, reasonable assumptions can be made for a very rough calculation which shows that it might be admissible from an accident risk viewpoint to add one valve but probably not two and this L conclusion is valid under conditions. applicable to Table XIII above where the

[ ATWS frequencies are less than 2x10-6/ year. If one were to be restricted to a

,,. 99 percentile MTC for all calculations then a single valve addition would increase the risk. .

4 -

I~

k t ,

. -~.- . - . . _ _ . . _ _ . . . , _ _ _ _ . __, . _ _ _ _ . ___

m o

14: e" = :=

9. , o .o I

u f .

I e;  :

y ,1 , -

September 13, 1978

• Docket flos. 50-500/501 ,

MEMORANDUM FOR: Raymond F. Fraley, Executive Director

. Advisory Cocnittee on Reactor Safeguards " -

a i

'4 FR0ti: L. P. Crocker Technical Assistant to the Director j ,

Division of Project Management

SUBJECT:

SAFETY IMPLICATIONS OF ADDITIONAL STEAM RELIEF VALVES FOR DAVIS BESSE 2 & 3 y -" During the 220th ACRS meeting, in connection with a discussion regarding the staff requirement for additional stcan relief valves for Davis Besse Units 2 and 3 (Transcript pages 39 - 43), Dr. Kerr questioned whether the staff had donc an analysis to determine whether the addition of an added safety relief valve has any negative implications ,for safety.

The attached memorandum to me from D. F. Ross, dated September 5,1978, subject: Response to ACRS Question Concerning Steam Relief Valves for

~ Davis Besse Units 2 and 3, discusses this matter. The only negative

.* . . safety aspects of the staff position are considered to be the increased gj .. .

probability of blowdown of the secondary system due to inadvertent valve l opening or to pipe rupture. Both aspects are considered to have minimal effect on plant safety. He would be picased to discuss this matter f ,

further with the Cocnittee if you desire.

,i L. P. Crocker

, ',.,- Technical Assistant to the Director

, . Division of Project Management

' Enc 1'osard: -

Memo. D. F. Ross to L. P. Crocker

'D dated 9/15/78 l cc: See Next Page

-  ?

e DPM

, LCrocker:mec 9/ /73

- - = - - - . - . . _ _ _ . . _ _ _ _ . _ _ _ . _ . . . _ _ _ . _ _

_y_

- _ y g ~ Ge.e. , , -

e ...s of '

h aayrtond F. Fraie/ - 2- 3cptc bar 13, 1976

, cc: li. Dentan

- E. Case

', R. Boyd .

D. Yassallo R. !!attson D. Ross .

a T. Novak -

?k 5. Israel

<f, C. Graves Docket File l' . POR ,

a O

I e

<J

'0 e y

e

. s

-h.

J @

0 t

1. 1

• 6 o

S e

- e e

' - 4 .

7 l

4

• a l

l-Es t

I L

~ ' ~ " * * * * - e e rww w +# ~,-_ ., ,. . , , . _ _ . ,_, . . ,,

.p , ._, . . - - . - - a .

g

~

e o."s ** *e

• . c ~ :u.*-

~

6 "N

. .. . s

• *4** . .

7. ,,

.. p

5 78 - -

e.9 0 s j{ Cocket flos. 50-500/501

&": f Ef'ORAtl0UM FOR: L. P. Crccker, Technical Assistant to the Director Division of Project Itanagement

? >

f FROM: D. F. Ross, Jr., Assistant Director for Reactor Saf.ety Division of Systems Safety f

jr .

f SUCJECT: RESP 0f!SE TO ACRS QUEST!0ti CO CER:litiG STEAM RELIEF VALVES ,

C . FOR DAVIS BESSE U:llTS 2 A!!D 3 T .

. The response to the question from Professor Kerr concerning added steam relief for Davis Besse Units 2 and 3 is enclosed.

0.11' Ross , Jr Q. , Assi'stant Director for Reactor Safety-

" Division of Systems Safety

. Enciosure:

Response -

~'

i '.

cc: T. flovak .

S. Israel C. Graves .

.,. e

.q -

L; ,

4 .

~

Contact:

Chuck Graves, fiRR-49-27591 N ' . g

• Etn a e e

n l ,

--~r,-~:---,.- - _ . . , -

o , t . p. p '

. + = 9 i +m

- - _ _ _ m __~_ -s Y

/

j (

c 1g.

. ',g76 \o'..*. --

g.-,--

t

~

1 . . .

~.

At the 220th ACRS meeting, Professor Kerr asked if the staff requirement for the addition of relief valves to the steam generators of Davis Besse

. Units 2 and 3 has any negative safety implications. The only r.egative safety aspects of the staff position are considered to be the increased probability of blowdown of the secondary system due to (a) inadvertent valve opening or (b) pipe rupture. Both aspects are considered to have a ,

minimal effect on plant safety. Dump valves can be sized such that an inadvertent opening, which is considered to be an event of moderate 3

frequency, does not result in a plant cooldown rate in excess of that specified in the technical specifications. The probebility of rupture in nuclear plants is small, as discussed in WASH-1400 sad the survey article by Bush (reference 1). The increase in probability of ruptdre resulting from the staff position would be small in view of the small increase in piping length and welds for the two additional valves relative to that already required in the plant. -

Reference 1: S. Bush, Reliability of' Piping in Light Water Reactors, .

. Nuclear Safety, vol.17, no. 5, OP.ober 1976.

e e

j- .

/

1 _ O