ML20071A989
| ML20071A989 | |
| Person / Time | |
|---|---|
| Site: | Three Mile Island  |
| Issue date: | 02/23/1983 |
| From: | Weiss E HARMON & WEISS, UNION OF CONCERNED SCIENTISTS |
| To: | NRC ATOMIC SAFETY & LICENSING APPEAL PANEL (ASLAP) |
| References | |
| NUDOCS 8302250274 | |
| Download: ML20071A989 (29) | |
Text
____
A Ml?ETED l
UNITED STATES OF AMERICA
'83"'M'N'% 30 NUCLEAR REGULATORY COMMISSION -.
BEFORE THE ATOMIC SAFETY AND LICENSING APPEAL BOARD' In the Matter of )
)
) Docket No. 50-289 METROPOLITAN EDISON COMPANY (Restart)
)
(Three Mile Island Nuclear )
Station. Unit No. 1) )
Union of Concerned Scientists' REQUEST FOR SUBPOENAS Pursuant to 10 CFR Section 2.720(h)(2)(i), the Union of Concerned Scientists requests that the Board issue subpoenas requiring the attendance and testimony of C. J. Heltemes, Jr. and Frank H. Rowsome of the KRC Staff at the reopened hearing in the above-captioned proceeding, commencing March 7, 1983, in Bethesda, Maryland. Exceptional circumstances uarranting the issuance of these suopoenas are present, as discussed below.
In an April 29, 1982 memorandum entitled " Reliability and Effectiveness of ' Feed and Bleed' Core Cooling at THI-1", Harold Denton, Director, Office of Nuclear Reactor Regulation requested the Staff to explain the technical basis for its position on ' feed and bleed' in the THI-1 restart proceeding and to
" clarify" the difference between the " feed and bleed" and " boiler-condenser" modes of core cooling. A copy is attached. The final Staff report responding to Mr . Denton's request is entitled " Report on NRC Staff Position on Feed and Bleed Cooling." A copy of that report, with a cover memorandum dated July 1, 1982, is also attached.
8302250274 830223 PDR ADOCK 05000209 C" 3 s03
l In the course of preparing its response to Mr. Denton's request, various members of the Staff comented on a draft report. C. J. Heltemes, Jr., Deputy Director, Office for Analysis and Evaluation of Operational Data, is the author of a memorandum dated June 10, 1982, entitled "Dra ft Report on NRC Staff' Position on Feed and Bleed Cooling at TMI-1 Restart Hearing." A copy is attached. The Heltemes memo constitutes the comments of the Office for Analysis and Evaluation of Operational Data (OAEOD) on a draft of the Jtly 1, 1982 final report to Mr. Denton.
Mr. Heltemes' memo contains material which contradicts the NRC Staff Testimony of Brian W. Sheron and Walton L. Jensen, Jr. filed February 16, 1983 In particular, Sheron and Jensen state, at page 6:
The Staff has concluded that the heat transfer mechanisms in'rolved in the boiler-condenser process are adequate to remove decay heat from the reactor system and will prevent core un<.overy if at least one train of ECCS is operable. Thir conclusion is based on both the B&W CRAFT-2 calculations and the RELAP-4 audit calculations, as well'as our evaluations of the heat transfer mechanisms involved in the process and discussed in commonly available heat transfer texts.
Although detailed reactor coolant system behavior during the period of natural circulation interruption in the analysis of certain small break sizes is not well understood, the system must eventually drain dcun and a steam condensing surface in the steam generator would be exposed before t it core could begin to be uncovered. Once a steam condensing surface were uncovered, boiler-condenser natural circulation would commence and depressurize the system so that the decreased break flow, along with the increased HPI flow, would result in a net inventory increase in the primary system before the core could begin to uncover. The Staff has evaluated the mechanism involved in the boiler-condenser heat transfer process and has concluded that the condensing surface that would be available would be capable of removing all decay heat generated by the core if an adequate supply of feedwater were available.
-3 In contrast, Heltemes states on page 2:
We believe that the conclusion "If the feed and bleed process discussed above was insufficient to remove decay heat, natural circulation would be established in the boiler / condenser mode" is not a certainty, especially in the absence of experimental data for B&W plants. In the event that, for any reason, natural circulation cannot be established and t,he primary coolant pumps are not available, the " feed and bleed" mode of decay heat removal would have to be used.
In addition, Mr. Heltemes points out in paragraph 5 that the emergency procedures "are not presently in place" and believes "it is important to provide a sense of timing regarding what is in place and available now (in terms of equipment, procedures, and training) and what is likely to be available at some specified time in the future." As the Board knows, it is UCS's position that adequate emergency procedures must be in place before it can be fot.ad that either boiler-condenser or bleed and feed are sufficient means of decay heat removal. The Staff testimony deals not at all with the subject of emergency procedures; the cooling modes are treated in the abstract. It is apparent that- AEOD recognizes the significance of procedures to the question of decay heat removal reliability.
Finally, Mr. Heltemes states in paragraph 7:
We agree with the need for obtaining experimental verification of the analytical code predictions. We e believe that this section of the report should be expanded to clarify the items for which verification
< is considered appropriate or necessary. In this regard, consideration should be given to (a) natural circulation in B&W plants, including establishment of boiler / condenser operation, and elimination of steam formations in the hot legs; and (b) the ability of existing PORV and safety valves to perform reliably in a ' feed and bleed' mode. (emphasis added)
- - _n_
i there is a clear ' indication here that While the memo itself is terse, experimental verification of the code predictions is necessary.before they can be relied upon.
This should be . contrasted with the Staff's testimony which (or " confirmation," as the concludes th_t , despite the lack of verification Staff would have it), their conclusion that adequate core cooling will not be (NRC Staff Testimony of Brian W. Sheron and Walton jeopardized is unchanged.
L. Jensen, Jr. at 17.)
It appears that AEOD did not concur with the NRC Staff position on feed f J. Mattson and Hugh L.
In the cover memo from Roger and bleed for TMI-1.
Thompson to Harold Denton, enclosing the " Report on NRC Staff Position on Feed i
and Bleed Cooling," the authors note that the report was prepared by the Sheron and Division of Systems Integration (the Division to which witnesses in Division of Human Factors Safety " concurs" Jensen are attached) that the certain parts and that AEOD has " reviewed this response and their comments Denton UCS has reviewed the final report given to Mr.
have been considered."
. While the AEOD opinions may have been together with the Heltemes memo.
" considered", they were not incorporated. While we are-not able to tell the Board exactly what Mr. Heltemes will testify since we do not have access to
> AEOD has a different perspective and opinion on him, the memo confirms that the certainty of boiler-condenser.
M,has Frank H. Rowsome, Deputy Director, Division of Risk Analysis, RES previously appeared as a witness for the Staff in this proceeding and is the Issue for CE Applicants," January author of a report entitled " Feed and Bleed y We understand that Mr. Rowsome has been reassigned, but is still a member of the Staff.
f i
l l
29, 1982, a copy of which is attached. The material, which consists primarily of risk assessment, contains the following conclusions of greatest importance to this proceeding (at pages 7-8 of the report):
The value of an assured feed and bleed capability here is to nate the need for feedwater. This would eliminate the smaller eling/yr)
(10 path to core melt without affecting the more prominent path via HPI failure. Note that small LOCA with total HPI failure is predicted to result in a core melt frequency above the Commission goal for all core melts. The provision of feed and bleed capability cr of an improved AFW system will not help this.
It is a problem generic to PRWs and not unique to the CE designs.
It appears that the high frequency of very small LOCA revealed by historical experience and the marginai HPI system reliabilities revealed by many PWR PRAs are combining to yield unacceptable core melt frequencies through S,D-type sequences. We suggest that NRR tackle this problem in two" ways: First, a serious effort should be made to reduce the frequency of S LOCA's. Second, a broad-scale 2
attack on HPI reliability problems comparable to that instituted for AFW systems after THI should be initiated for all PWR's.
(emphasis added)
These conclusions, which are said by Mr. Rowsome to apply to all PWRs.
go to the heart of the issue in this proceeding: the adequacy of decay heat removal. Neither the existence of this report nor its conclusions have been brought to the Board's attention by the Staff.
10 CFR 2.720(h)(2)(1) provides that the attendance and testimony of named NRC employees may be ordered by the presiding office "upon a showing of l
exceptional circumstances, such as a case in which a particular named NRC employee has direct personal knowledge of a material fact not known to the witnesses made available" by the Staff.
l This has been held to authorize the subpoena of Staff personnel who hold differing opinions (as opposed simply to knowledge of particular " facts") on critical safety issues. Pacific Gas and Electric Co. (Diablo Canyon Nuclear Power Plant, Units 1 and 2), ALAB-519, 9 NRC 42 (1979). In that case, the Appeal Board stated:
l
The ability of nucl'e ar power plants to withstand earthquake damage is undeniably crucial in California, where seismic phenomena are not uncommon.
The Board, the Staff, the applicant, and amicus curiae have all allowed the procedural' undergrowth to obscure the substantive forest. This is more than a run-of-the-mill disagreement among experts. We have here a nuclear plant designed and - largely built on one set of seismic assumptions, an intervening discovery that those assumptions underestimated the
- magnitude of potential earthquakes, a reanalysis of-the plant to take the new estimates into account, and a post hoc conclusion that the plant is essentially satisfactory as is--but on theoretical bases partly untested and previously unused for these purposes.
We do not have to reach the merits of those findings t to conclude that the circumstances surrounding the need to make them are exceptional in every sense of
) that word. Subpoenas to compel the testimony of the two ACRS consultants whose views diverge from the consensus just described are therefore not only permissible under the Rules of Practice, but appropriate.
9 NRC at 46, emphasis added.
The situation here is markedly similar.- This Board is addressing complex technical issues of first impression and, after the discovery of the EG&G test results, is now being presented with new analyses and opinion from the Staff, largely unverified by experimental data, which have never been presented to any NRC Board, so far as we are aware. Harold Denton's request I
i that he be " informed" of the technical basis for Staff position on bleed and l
feed for TMI-1 is evidence of the ad hoc nature of the conclusions being i
i
~2/
Mr. Rowsome's case is even clearer. He is possessed of " facts", i.e. risk i
assessment calculations, which are not incorporated or alluded to in the Sheron or Jensen testimony, i
1 L,.-..---.--._-.-_..._ , . . - - . . - - - - . . , . . . . , - . . _ . . - _ - . - - . - . , _ , _ - - . - . . . . , . . . - , - , - - . - -
i
_7_ j l
offered to the Board here. It is incumbent upon the Board to consider the divergent views of qualified personnel. This is particularly so because the Staff is at this point in the position of defending its previous judgments.
1 Respectfully submitted,
' \
fI
- l I '
Ellyn4. Weiss General Counsel for Union of Concerned Scientists Harmon & Weiss Suite 506 1725 I St., NW Washington, D.C. 20006 Dated: February 23. 1983 i
i i
)
UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION In the Matter of )
)
METROPOLITAN EDISON COMPANY ) Docket No. 50-289
) (Restart)
(Three Mile Island Nuclear )
Station, Unit No. 1) )
CERTIFICATE OF SERVICE I hereby certify that copies of " UNION OF CONCERNED SCIENTISTS' REQUEST FOR SUBPOENAS" have been served on the . following persons by deposit in the United States mail, first class postage prepaid, this 23rd day of February 1983
- Nunzio Palladino, Chairman Dr. Linda W. Little U.S. Nuclear Regulatory Commission Atomic Safety and Licensing Washington, D.C. 20555 Board Panel 5000 Hermitage Drive
- J,an Ahearne, Commissioner Raleigh, North Carolina 27612 U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Professor Gary L. Hilhollin 4412 Greenwich Parkway
- James Asselstine, Commissioner Washington, D.C. 20007 U.S. Nuclear Regulatory Commission Washington, D.C. 20555 ** Judge Gary J. Edles, Chairman Atomic Safety and Licensing
- Victor Gilinsky, Commissioner Appeal Board U.S. Nuclear Regulatory Commissfon U.S. Nuclear Regulatory Commission
, Washington, D.C. 20555 Washington, D.C. 20555 l
- Thomas Roberts, Commissioner ** Judge John H. Buck U.S. Nuclear Regulatory Commission Atomic Safety and Licensing Washington, D.C. 20555 Appeal Board Panel U.S. Nuclear Regulatory Commission
- Ivan W. Smith, Chairman Washington D.C. 20555 Atomic Safety and Licensing Board Panel ** Judge Reginald L. Gotchy U.S. Nuclear Regulatory Commission Atomic Safety and Licensing 7
Washington, D.C. 20555 Appeal Board Panel U.S. Nuclear Regulatory Commission Dr. Walter H. Jordan Washington D.C. 20555 l
Atomic Safety and Licensing Board Panel ** Judge Christine N. Kohl 881 West Outer Drive Atomic Safety and Licensing
' Oak Ridge, Tennessee 37830 Appeal Board Panel U.S. Nuclear Regulatory Commission Washington, D.C. 20555 l
r Mrs. Marjorie Aamodt Ms. Gail B. Phelps R.D. #5 245 West Philadelphia Street Coatsville Pennsylvania 19320 York, Pennsylvania 17404 Robert Adler, Esq. *** Steven C. Sholly s, Assistant Attorney General Union of Concerned Scientists 505 Executive House 1346 Connecticut Ave., H.W.
P.O. Bo'x 2357 Suite 1101 Harrisburg, Pennsylvania 17120 Washington, D.C. 20036 Louise Bradford **** Joseph R. Gray Three Mile Island Alert Office of Executive Legal Director 325 Perfer Street U.S. Nuclear Regulatory Commission Harrisburg, Pennsylvania 17102 Washington, D.C. 20555 Jordan D. Cunningham, Esq. * *
- George F. Trowbridge, Esq.
Fox , Farr & Cunningham Shaw, Pittman, Potts & Trowbridge 2320 North Second Street 1800 M Street, N.W.
Harrisburg, Pennsylvania 17110 Washington, D.C. 20036 Dr. Judith H. Johnsrud
- Docketing and ' Service Section Dr. Chauncey Kepford Office of the Secretary Environmental Coalition on U.S. Nuclear Regulatory Commission Nuclear Power Washington, D.C. 20555 433 Orlando Avenue State College, PA 16801
- William S. Jordan, III Harmon & Weiss j g/I N I6 1725 I Street, N.W. < ,2f Suite 506 Washington, D.C. 20006 John A. Levin, Esq.
- Hand delivered to 1717 H Street, N.W.
Assistant Counsel Washington, D.C.
Pennsylvania Public Utility Commission ** Hand delivered to 4350 East-West Hwy.,
P.O. Box 3265 Bethesda, Maryland.
Harrisburg, Pennsylvania 17120
- Hand delivered to indicated address.
- Hand delivered to 7735 Old Georgetown Road, Bethesda, Maryland.
pp '***vq#
e 8, UNITED STATES
[ j NUCLEAR REGULATORY COMMISSION
, j wasmucrow, o. c.mosss
"~
- ... / + April 29,1982 .
MEMORANDUM FOR: Roger Mattson, Director DSI"'
Hugh Thompson, Director, DHFS FROM: Harold R. Denton, Director, ONRR l
SUBJECT:
' RELIABILITY AND EFFECTIVENESS OF " FEED AND BLEE0" CORE
- COOLING AT TMI-1 J
As we have discussed, questions have been raised retently which center around the staff's position on the reliability and effectiveness .of " feed and bleed" as a core cooling technique following a SBLOCA. Specificatly, the staff's.
technical basis for its position on " feed and bleed" at the TMI-1 restart hearing has been questioned. In order for me to be fully informed on this issue:, I would like a report which includes the following:
(1) A description of the staff position at the THI-l restart hearing on the role of " feed and bleed" during a SBLOCA.
(2) An interpretation of the TMI-l Licensing Board decision regarding the need for reliable and effective " feed and bleed" during SBLOCA.
(3) A detailed explanation of the staff's technical basis for its -
position on " feed and bleed" at TMI-1. Include an assessment of
, existing in'ormation and ongoing work, both within the staff and by-l the industry. Also, clarify the difference between the " feed and bleed" mode of cooling and the " boiler-condenser" mode of cooling.
(4) Recommendations .for future NRC and/or industry actions needed to move towards a better understanding of the reliability and effective-
' ness of the " feed and bleed" technique.
Since the results of your work should be coordinated with RES, AE00 and OELD, I suggest we hold a meeting as soon as you can compile preliminary information on this subject. I expect a report prior to the date for filing our response to exception in the TMI proceeding.
Harold R. Denton, Director Office of Nuclear Reactor Regulation cc: W. Dircks 6 '
G. Cunningham -
fe R. Minogue y C. Micht.lsonc D. EisGnhsG ! f . >/ A (/
/
- ~
'a ~
~'
, l:-
'Illd o ..
UNITED STATES
[. a arc 'o, NUCl. EAR REGULATORY COMMisslON f* k WASHINGTON. O. C. 20555
- j k' ***** / ,
'JUL 1 1982 e
MEMORANDUM FOR: Harold Denton, Director, Office of Nuclear Reactdr '
Regul,atic., ,
FROM: Roger Mattson, Director, Division of Systems -
Integration Hugh Thompson, Acting Director, Division of Human ,
Factors Safety .
SUBJECT:
NRC STAFF RELIANCE ON " FEED AND' BLEED" ,
.. . ;~ *. -
As requested in your memorandum of April 29, 1982, we have prepared the attached report addressing each of the four issues which yoy identified.
To summarize, the NRC staff did, not rely on " feed and bleed" cooling to ~
protect the core at IMI-1. This position was made clear to the board.
Babcock and Wi.lcox performed feed and bleed analyses for the development of inadequate core cooling procedures. Such procedures would be utilized as defense in depth for events beyond the design basis. These procWires instruct the operator to es~tablish ahd maiiTtain feed and bleed cooling following a complete loss of heat sink until feedwater can be restored.
~ ~ ~ ~ ~~ ~~ ~-
This response was prepared by the Divison of Systems Integration. 'The Division of Human Factors Safety concurs in the statement regarding the, ~
reliance that we place on operator actions for initiation of emergency -
feedwater and on feed and bleed cooling in emergency operating
, procedures for accidents beyond the design basis. The offices of ELD and AEOD have reviewed this response and their comments have been considered.
i We recommend you consider informing the TMI-l Appeal Board of this staff l
analysis of the Licensing Board's decision along with our conclusion that. cur areas of disagreement are not material.
Ff Roger J. M tson, irector, DSI W d l
l L hempson ing O d ector, DHFS
Enclosure:
As stated A
- cc: see next page L -
. _ . . . . . .. . _ . . . ... ... . .. . . . . . .._.. ....,....m...._..
2-1 OL .I 1300 .
cc: B. Sheron J. Cutchin .
O. Parr W. Jensen . .. ,
S. Byron T. Speis H. Thompson D. Eisenhut R. Jacobs T. Novak -
a___..._.- ..._ L._Stolz G. Lainas J. Wenniel R. Tedesco .
J. Mazetis S. Hanauer - '
---.. H.-Thompson R. Vollmer '
R. Mattson H. Ornstein . . .. .
~~
C. Heltemes . ... .
N. Lauben .. .
6
- w. . . .
2 f
l .
I I
i I
l, l
b
.mm.mmmmm
,-g, w ma. . . .--- --a,-m -,---n- --m---se ,~ ,--- - ---- w- ,~ .--.----- - - ~
_ n... ,. . 7. - - - . - ..._. . . - .
g:-
- g. '
-2. )'-- -
!. (i 3
hi .
~:~
~
T 3 REPORT ON NRC STAFF POSITION ON 4 .
)
Item 1 A description of the staff position at the THI i restart "
- " ' ~
hearing on the role of " feed and bleed" durino a SBLOCA RESPONSE ,
( ,,_______,_ .The staff's position at the hearing was that feed and bleed -
coolingisnotreliedonfo};beatremoval. ThiY pos'ition was made clear to the' ASLB in the TMI-1 restart hearing in (1)'
written testmony by NRC staff witness J. Wermiel and (2) oral testimony of W.'Jensen as follows.
h_. .. - _. . + - -
(1) Written Testimony of J. Wermiel in Response to Board Ouestion 6: Question 6i. Will the reliability of the g emergency feedwater system be greatly improved upon conversion - ',.
to safety-grade, and is'it the licensee's and staff's position that the improvement is enough such th'at the feed-and-bleed backup is not required.
(Witness Wermiel)
Response $ Based on. knowledge of the i.mprovement in reliability gained by eliminating first order failure sources, it is the staff's judgment that the reliability of the emergency feedwater sy-stem will be improved once the fully safety-grade system is installed. The single failure problem associated with integrated control system /non-nuclear
. . . . . . _ - - - . ~ ~ - . . . . . - . . , . . . . . ~ . . . . . . . - - . . . . . . .
. - . . . . . . ...o - . -
I.,, .' . -
.. m .
4 --9 . :
2 . -
instrumentation described in the response to 6a and b ab'ove will.be el,iminated. In,, addition, various other hardware, procedural and administrative improvements as identified in
~ '
the THI-1 Restart SER, NUREG-0680 under Order Item'la should enhance emergency feedwater system reliability. However, a quantitative reassessment of the reliability of the fully -
safety-grade EFW system has not been performed. The :... - -: ,
feed-and-bleed back-up is not required by the staff and,
' ~
therefore, need not meet alj re'quirements of a. safety system.
~ ~ '
However, it is recognized as additional defense in depth for providing core cooling in the very unlikely event that -
emergency feedwater is lost, and the HPI pumps and primary
, w.
safety valves which comprise the feed.and bleed mode are -~ -
required to be available by Technical Specifications. -
l 1 (2) Oral Testminony of W. Jensen Regarding UCS Contentions 1 y -
snd 2 '
'(Dr. Jordan) I would address the question then directly to Mr.
Jensen. Did I misstate what you said? Do you believe^that.
the high pressure injection system is important in that it not only suppiies emergency cooling inventory but it also removes
. heat in the feed and bleed mode? That that is an important l
safety feature? -
l -
,(Thd Witness) The high pressure injection system is an f
l important, safety feature for making up the coolant lost from a
_. , , . . _ _ . . .. . ..__. . . . . .... . _ __.._ -o_
),,. '
.~ -
.: x . -. a n. .=
3- -
small break LOCA. The NRC does not rely on this system for heat. removal in the fee,d and bleed mode by which core dec'ay
. heat would be forced through the safety valve or the PORV.
Instea'd, we rely on~ the heat removal from the emergency feedwater system. -
(Dr. Jordan) Okay. That's fine. -
(Ms. Weiss) If I can refer,.',0.r.'* Jordan, I thin,k.the exact question you are acting is answered on page 9 of the staff testimony in response to Board question number 6. I was going to read the sentence to you.- (Wermiel testimony .above)
.. .o - -
The feed and bleed back up is.not required by the staff and
\ -
l therefore need not meet all the requirements of the safety
- system. It's just simply a direct quote. ~
(Dr. Jordan). Yes. I remember that and thank you for pointing that out. I thick that clears up the matter."
Item 2 An interpretation of the THI-1 Licensino Board decision regarding the need for reliable and effective " feed and bleed" durino SBLOCA
._8ESPONSE h
l .
-s - - n -n- ^
7_. . ..
p.... .
~_. ..
7 . _
g .
There is an interest in whether the ASLB accepted the staff position ,on the relianc,e to be placed on feed and. bleed cooling. We believe.that the ASLB did not accept our -
' '~
position, regarding emergency feedwater reliability, as shown' in the following excerpts from its decision. We believe however that the board .did not err in declining to find ~that additional modifications to the emergency feedwater system are ,
necessary at TMI-l prior to restart.*
~
Page 224,of the TMI-l Licensing Board decision acknowledges the NRC Staff position (see Item 1 above) by noting that:
"The Staff's position is that the loss of emergency feedwater
, so-following a main feedwater transient is not an accident which must be protected against with safety-grade equipment."
~
? .
To us, this observation by the ASLB says that our position 1.n Item 1 above was understood by the Board.' t Page 242.of the, decision the Board goes on to point to a precedent ruling made by the St. Lucie-2 Appeal Board for requesting additional reliability numbers from the staff. The THI-1 Board noted that:
- f!P.C response to UCS' exceptions to the PID, filed with the Appeal Board in the TMI-1 Restart proceeding May 20, 1982. -
) -
6,
'~
~~
n 2' ?i
3
~
. 5 -
. "The (St. Lucie) Appeals Board decided that measures were required to mitigate su,ch an event
, should it occur. We
.. believe that similar measures are necessary at THI-1; that the reliability of the EFW system has not been demonstrated to be ..
adequate by itself. -However, the EFW system is backed up-by the high pressure injection system, so that in the event of failure of the EFW system the core can be cooled by feed and: ,
bleed while repairs are being made to the EFW system.": . .
We conclude from this statement that the THI-1 Board has relied upon the availability of feed and bleed in reaching its finding that the TMI-1 design is acceptable. The question
~
.c>
then is how the Board reached this conclusion in light of'the -
Staff position (Item 1 above). The answer is summarized on page 250 of the THI-1 Board decision where .the Board states:
~
"We have relied on the staff figures on reliability of the EFW system and our own estimates (emphasis added) of the adequacy
! of the feed-and-bleed backup to arrive at our conclusion that l .
the core is adequately protected from a-loss of main feedwater transient, the dominant challenge to the EFW system."
l ** Complete loss of all AC power including both diesel generators.
1 l
'.hg
. . . n , . . - . -,. -
~
i ^{: i -r -
E- -
5 .
J- ? --
.- 6-
. We conclude that the Licensing Board reached the same conclusion,as the, staff (the TMI-1 design satisfies the Connission's regulations), although the board's basis for the
, ,. conclusion is different. The basis for the staff position is' summarized in Question 3 below. We have studied the Licensing ,
Board decision to . understand the basis for its conclusion. At paragraph 1056 we find the following: ,
"Since the EFW System is bac;ked"u'p by a safetygrade HPI,
' ~
designed to protect the core in the event of a small break -
LOCA, we believe we can conservatively assume an additional 4
safety factor of 100, or an overall probability of failure to protect the core of about 10-6/yr. Lacking any demonstration that the above failure probabilities are grossly in error, we) conclude that the EFW system, as modified, will, with the HPI backup, adequately protect the health and safety of t!ie ,
public." -
j .
During the TMI-1 hearing, the NRC Staff did not provide any detailed discussion, for or against, the above Licensing Board assessment. We do not have sufficient information regarding the uncertainties associated with of feed and bleed cooling to
. credit it with a 100 fold reduction in the probability of core melt.
Item 3a A detailed exolanation of the staff's technical basis for its position o_n " feed and bleed" at THI-1.
- - - - - . . - . . , ..,- .._ . .- _, , .-- *--,ym.< - - , 7 ..,.
4-- -- ,. y
).,. '. -
s,. . -
c.
.y . . .. . - .- x 7 .
RESPONSE
(
It ,was the Staff's position during the TMI-1 hearing that the emergency feedwater (E N) system is required to be avafl'able "
for decay heat removal in feedwater transients and certain small break loss-of-coolant accidents without feedwater. We also noted.that should EFW be initially unavailable,'there is ,
at least R0 minutes time available to take action to establish.
EN flow prior to uncoverin)_.of*~the core following a loss of main feedwater or certain small break loss of coolant accidents. The THI-1 EFW system will, at the ti$e of restart, meet the Commission's requirements for safety related --
equipment, in the event of small break LOCA and/or loss of main feedwater if credit for operator action is given (to initiate the system) within 20 minutes. The TMI-1 EFW system will be fully automatic for these events by the first ,
o refueling outage after Testart.
The staff recognizes that a i
feed and bleed capability exists at TMI-1 to provide l
additional defense in depth fcr decay heat removal should E N j fail. The inadequate core cooling procedures at THI incorporate the feed and bleed process. Operators are trained l
in the use of these procedures at THI ,1 and feed and bleed is l covered in the scope of OLS examinations of the TMI' operators.
It is usually covered in the simulator portion of the l examination. Safety. grade equipment to accomplish feed and 1
bleed backup to EFW in the event of a complete loss of all feedwater is not required to be included within the design l
-.9_ _ - - , . - -, -
, ,.. . . - . . . . . . - . . . . . . , . . . . . . . . .......,-.~...a............... ;
l . ...p
... . .c . .e m -
- r. . . . .. .
8 basis since the EFW system at the time of restart is'
suff.iciently reliable to make a postulated loss of'EFW system acceptably low. ,
Item 3b. Clarify the difference between the " feed and bleed" mode of coolina and the " boiler / condenser" mode of coolino RESPONSE - -
~ '
.=
For small, breaks below a certain size, th,e break area is not .
large enough to relieve all the energy generated 'by decay heat. For this condition, heat transfer through the steam w.. generator 'is the preferred method of,providing additional
(
, required energy removal capability. To accomplish'this, I
emergency or auxiliary feedwater sysi. ems must be operating.
l h -
Since the reactor coolant pumps are tripped for most'small l
breaks, coolant flow through the core is by natural .
circulation. Feed & Bleed is a' method by which decay heat is removed from the primary system if no feedwater were available so that natural circulation did not occur. The l
" boiler / condenser" mode of cooling is one of three modes of 1 .
~
natural circulation cooling discussed below. Each mode
. represents a progressively degraded condition of th'e primary system in terms of system inventory. Thus it is possible for l
some small break scenarios to experience all three modes of natural circulation heat removal. In small break LOCA O
o .
........m .
. .. . . . . ..... . . . . .. ..- _..o . . _..
. : ..-- .~..
i
.9 l
. calculations by B&[. temporary interruption of all modes of
- natural circulation was_ predicted however, inventory loss' in -
- hese three modes is not sufficient to cause extended core uncovery and fuel damage. 'It is not necessary that the primary system t. refilled folllowing a LOCA in' order .to adequately cool the core. Analyses by S&W indicate that -
adequate decay heat can be removed under any of ~ the.following , ,
three natural circulation modes. .
- 1. Single phase - In this mode the , entire primary system remains in a subcooled liquid state. Core flow is maintained solely by density differences.between hot and cold liquid.
- 2. Two phase continuous - This mode is similar to mode 1
. except that the hot side is at saturation and at low steam , ,
quality. Bubbles are formed in the upper portion of the core j and are swept, as part of a continuous' two phase mixture, into
- i
" the steam genera. tor and condensed. During this time, some of the steam generated in the core will rise into the upper head j and accumulate there as a single large bubble. For'B&W plants this heat removal mode will persist un,til the liquid level drops below the hot leg U-bend.
- 8&W report " Evaluation of Trans,ient Behavior and Small Reactor Coolant System Breaks in the 177-FA Plants" May 7, 1979.
. . , - - -,,-_,_,--,,,-.y. - . , -
-_---__r-.-,- - _ . _ , - , . - . . - _ ,
.r- - - - - - . - - ,-. . . . - , . - - , - , , , -
.,. .. ...... ... .-....---- .. .. . ..........- -. . _ ~ . . . ..~... .... -.. ,
. 2" ***- '
10 .
- 3. Boiler / Condenser - Nhen the hot leg U-bend is voided, .
liquid wt11 not be carried into the steam generator. . However, when sufficient steam has accumulated from boiling in the. core i- such that a condensing surface is exposed within the steam generator tubes, heat will .be removed by steam condensation on the tube walls. This me.thod of heat removal is referred to as
~
boiler / condenser. Thus a period will exist between. formation .
of a "subble in the. hot leg U-bends when mode 2 natural ,.
circulation is lost, and th6 und6vering of the, steam generator condensing surface, during' which no natural circulation would
~
~
exist in'8&W plants. The condensing surface is at a higher elevation than the core so that boiler / condenser natural, .
circulation will be established in the event of a small break - -
on. .
LOCA before the core could be uncovered. Boiler condenser natural, circulation was demonstrated to be effective in LOFT *
- and Semiscale-* experiments for U-tube steam generators.
- NUREG CR-1570 "Exper i mental Oati Report for LOFT Nuclear Small Break Experiment L-3-7", August 1980.
- EGG-SEMI-5507 " Quick took Report for Semiscale Mod-2A Test S-NC-2,"
July 1981.
N
- w. . - -
.. .. ..... ..... .. .. . . . . ... .. . - ... ... .. w.....-.
+.... . . .. . . .. .. ... . .
1 . -
.=. ..&
. = . , . 4 4 k - -
11 .
If heat. removal through the steam generator cannot be achieved
- due to los,s of al,1 feedwater (an event not required to.be.
. considered as a part of the design basis), " feed and bleed" can be used as an alternate heat removal method. The procedure involves energy removal by venting hot water. and/or steam through the primary system PORVs and/or safety valves
.- (bleeding), and replacing the vented coolant with cold HP1 - ,
. water (feeding). -
.3 . .
.. .n :
Item 3c Assessment of Current Status and Existino Information on a
" Feed and Bleed" .
RESPONSE -
n -
As you recall, in a recent communication to.Ur. Henry Nyers we
. noted that for a small break LOCA which is subsequently I isolated, a phenomenon s-imilar to " feed and bleed" might
- ultimately occur as the means of decay heat renoval if steam bubbles were trapped at the top of hot legs and did not rapidly condense even if emergency feedwater were availabTe.
This method of heat removal from the primary system might
~
occur if the core were sufficiently cooled so that decay heat j no longer boiled the incoming HPI water but forced it through t
'The term "similar" is used, since in this case feedwater to the secondary side of the steam generator is assumed available, and no operator actions are assumed to initiate decay heat removal via the safety valves. 4
- a
- . .. < .c ,. .- m -
- r. --
. 12
. the safety valves as liquid. If boiling occurred in the core, the steam production wou.ld act to inc,rease _the bubble size in the hot-leg.U-bends.
, If ,the hot leg bubble size increased sufficiently, a condensing surface
.on the iteam generator tubes would be exposed. This would establish natural circulation in the boiler / condenser mode.
The bubbles could.not expand sufficiently to uncover the core or to: t ,
exhaust steam out of the pressurizer since the secondary. system water level in the steam generators would b',e_.a6'o've the core anjt,.the .: -
pressurizer surge line entry elevation. Although our study of this
. scenario is recent and was not discussed during the THI-1 hearing,,no additional staff reliance on._ feed .and bleed should be implied since if the feed and bleed process discussed above were insufficient to remove decay heat, suffi,cient coolant loss through the safety and. relief valves would e'ventually reestablish natural circulation in the boiler / condenser mode. The letter to Dr. Myers is attached for further -
infomation on these recent developments.
l All three PWR suppliers are developing emergency procedure guidance to licensees on how to use equipment to perfonn " feed and bleed" operations as a backup method of heat removal if all measures 'or feedinc) steam generators are lost. It is important to stress that at this time " feed and bleed" is not a preferred method of decay heat removal. 'he T
l equipment used for feed and bleed operation was not designed for that
- purpose. Feed and bleed 'is only_ one possible emergency alternative for primary system heat removal for events beyond the design basis. All FWRs have in 'their proposed emergency guidelines, methods for use of
, - - , , , , m --
?- .-
13 decay heat removal schemes other than the design basis equipment.' In particular, guidance is given to, provide alternate sources of sec6hdary cooling if main and auxiliary feedwater are unavailable (e.g., by depressurizing the secondary system and activating the co'ndensate pumps). Operators would resort to feed and b1eed only if no source of water is available to feed the steam generators. The NRC has no design requirements for these other. alternate schemes, just as we have none for .
the " feed and bleed" capability. What is required for the design basis .
L is a reliable auxiliary feedwater sys', tem"E remove decay. heat until .the RHR system can be activated to ultimately achieve cold shutdown. ~~
However, to provide defense in. depth, feed and bleed procedural instructions should be available to operators because the capability to feed and bleed exists. .
As to .the technical perfonnance of " feed and bleed," we know it depends ~
on the HPI pump-performance characteristics, the PORY relieving capacity, and the plant power to volume ratio. Analyses have been conducted by all three PWR suppliers to examine " feed and bleed"'
capability for their designs. Also, NRC contractors at..LANL.And_INEL -
have analyzed " feed and bleed" with the computer codes TRAC and RELAP. ,
As noted previously, a B&W calculation for a TMI class plant showed that
" feed and bleed" was an effective heat removal method even if'no credit is taken for PORY actuation. This is because most B&W plants have HPI pumps with a very high shutoff b.eac, and enough energy can be relieved
-at high pressure through the safety valves. It is important to note that the assessment of " feed and bleed" rests almost exclusively on 3.nAly.sj.s..
,. y.
1 . . . = .-
14 Analytical uncertainties related to such phenomena as non-equilibrium thermodynamics, bubble formation and repressurization caution against taking too much credit for analytical predictions of system behavior.
One LOFT experiment (L9-1/L3-3) explored " feed and bleed" in a limited way. After a simulated loss of feedwater, the PORY was latched open to allow depressurization. The results showed that depressurization to the ,
e
,HPI actuation point did indeed occur. However, HPI actuation ~ was '
purposely not allowed to occur so tha',t,..oth'er accident miyjgation sc,hemes could be explored. ,
Item 4 Recommendations for Future Action w.
It is desirable to improve the experimental basis for understanding system behavior during " feed and bleed." This should improve the guidance in emergency procedures and training that is being developed under Task I.C.1 of NUREG-0737. To accomplish this, we are exploring ways to expand the current Semiscale test series to include " feed and bleed" experimental data. We expect shortly to issue a request to RES which will include these proposals.
The current Semiscale configuraticn cannot simulate the unique features of the B&W NSSS. You know from previous discussions that we have been. try_i,ng to resolve the problem of uncertainties for the B&W analytical methods in predicting long term,LOCA recovery unoer Task II.K.3.30 NUREG-0737. We
) .
- - ~
_.; .._- __,. ._.;: .= .: m =.-,_. -
._ a n 15
! are investigating the unique features of the B&W des [gn and
. . the lack of integral systems data (see attached letter to B&W
, owners). We will shortly transmit to all B&W own.ers our.
conclusion that such data are required. Thebasisforibis }'
conclusion is the need for additiona'l verification of some aspects of the thermal-hydraulic behavior during natural circulation cooling of the B&W design with feedwater ava'.irable -
~
during small break LOCAs, as welI as uncertainty in the ' feed .~
and bleed process. You will'.al _.
W recall that the . -ACRS letter -
of June,1982 highlighted this problem for resolution p'rior to its concurrence on full power operation of Midland, a B&W reactor.
3
.e
?
t I
1 9
,P e
m
v ..
e '
gbO Ukg
[o, UNITED STATES
[{#T c, [ j r
NUCLEAR REGULATORY COMMISSION wAsmNGTON. D. C. 20555
- *-] =
.c /,/.,/
~ ~ -
JUN 101982 MEMORANDUM FOR: Gerry liazetis, Section Leader Section C , . .
Reactor Systems Branch, HRR FROM: C. J. Heltemes, Jr. , Deputy Director .
Office for Analysis and Evaluation of Operational Data
SUBJECT:
ORAFT REPORT ON NRC STAFF POSITION ON FEED AND BLEED COOLING AT TMI-1 RESTART HEARING In accordance with your June 2,1982 request, AE00 has reviewed the subject draft report. Enclosed is a copy of AE00's comnents on the report (which have been provided to you informally during June 7,1982 telecons between Hal Ornstein, Walt Jensen, and yourself). If you have any questions concerning this matter, please contact Hal Ornstein on extension 24439.
6' Nd_b.~, L C. J.T,He'l temes , -J,r. , Depu ty Di rector Office for Analysis and Evaluation of
- Operational Data l
l
Enclosure:
As Stated cc w/ enclosure:
l R. Mattson
! H. Thompson T. Speis B. Sheron W. Jensen r_ - , - . .
" ~
e l
4 AE00 Comments on the draf t " Report on NRC Staff Position on Feed and Bleed Cooling at TMI-l Restart Hearing" l l
- 1. It is our understanding that the report is in response to Harold Denton's April 29, 1982 memorandum, " Reliability and Effectiveness of Feed and Bleed Core Cooling at TMI-1." In this regard, AE0D believes that the clarity of the report would be enhanced if the scope were limited to B&W plants (if possible.).
However, if it is deemed necessary to discuss other_ vendor designs, it is suggest~ed that such discussions be placed in separate sections (or appendices) of the report, rather than having such discussions intenningled with the discussions of B&W plants.
- 2. Some of the scenarios discussed in the report assume multiple f ailure events of safety grade systems. Usually the staff considers multiple active failures of safety grade systems not to be sufficiently credible that such failures need to be considered in the plants' design bases. Consequently, the reason for cons'.idering complete f ailure of the auxiliary feedwater system (if safety grade) or,the high pressure injection system should be presented in the report:
i .e. , some discussion is warranted on NUREG-0737, item 1.C.1 -
Guidance for the Evaluation and Development of Procedures .for -
Transients and Accidents, which requires guideline and procedure development to consider occurrences of multiple and consequential f ailures.
! 3. To improve the reader's understanding of several technical issues, it is suggested that some additional information be included on the l following items:
(a) Page 8 - The discussion on the different modes of natural circulation should include what assumptions are made regarding secondary side conditions and details of what conditions lead up to entering each mode, and what may be involved or necessary to recover.
(b) Page 10 - The report should note that the scenario discussed assumes that emergency feedwater is available.
E
- 4. Page 10, item 3c - Assessment of Current Status and Existing Information on Feed. and Bleed Response:
We believe that the conclusion "If the feed and bleed process discussed above was insufficient to remove decay heat, natural circulation would be established - -
in the boiler / condenser mode" is not a certainty, especially in the absence of experimental data for B&W plants. In the event that, for any reason, natural circ'ulation cannot be established and the primary coolant pumps are not available, the " feed and bleed" mode of decay heat removal would have to be used.
- 5. Page 11 - It is our understanding that the emergency guidelines (or emergency procedures) discussed-in this section are nov' presently in place. Thus, it is important to provide a sense of timing regarding what is in place and available now (in terms of equipment, procedures, and training) and what is' likely to be available at some specified time in the future. .
, 6. Page 11, lines 16 It is our understanding that the RHR system would be activated before achieving cold shutdown. The AFW system does not usually bring the plant to cold shutdown (6 2000F).
- 7. Page 13, item 4 - Recocmendation for the Future: We agree with the need for obtaining experimental verification of the analytical code predictions.
We believe that this section of the report should be expanded to clarify the items for which verification is considered appropriate or necessary..
In this regard, consideration should be given to (a) natural circulation in 5&W plants, including establishment of boiler / condenser operation, and elimination of steam formations in the hot legs; and (b) the ability of existing PORV and safety valves to perform reliably in a " feed and b leed" mode.
I
= . . . - . .
( .
ATTACitt.!ENT T '
~~
I f
,, . UNIf&O mIAI4.5 , ,
D
[ s, P :!IJCCE AR HCGU.'A10ltY Cor.1t.11."lON l' { ' ,q ,7 2 jij g.
[ 3* 'e . tTASHINGTDN. D. C. 20$G5 I - - -
. : V: JF THE SECRE.iAny gq .,Y.h,',',
.- 1^ -
7., ,
C.c .
\
No. [. . ',
JAN 2 91M2
. . t l'TEf10RANDUll FOR: Bob Tedesco, Assistant D' rector'for ;
Licensing Division of Licensing, NRR ~
j t
Themis Speis, Assistant Director fo.r Reactor Safety - -
- Division of Syste:ns Integration, NRR
~
FROM: Frank H. Rowsome, Deputy Director ,
Division of Risk Analysis, RES Joseph A. Murphy Reactor Risk Branch Division of Risk Analysis, RES
SUBJECT:
FEED AND BLEED ISSUE FOR CE APPLICANTS. .
I t!e have perfonned a quick and dirty analysis of the risk implications of CE. '
designs that lack a capability for core cooling via HPI injection and deliberate ventihg of' the. reactor coolant system, in the absence of feedwater replenishnent.
- l. We conclude that three classes of accidents may each be more frequent, than
. the Commission's safety goal of 10'4 core melts per reactor year or less, and that the total core melt frequency for such plants could be of the order of 10 per yea'r .or more. The three . sequences are:
l
- 2. Loss of offsite power, one diesel failure disabling the rotor driven AFW train, and failure of the turbine-driven AFW train.
YS - - . -
9e reccewend 'the following upgrades to these designs-
- 1. Provide an assured " feed and biced" capability.
. 2. Provide that either diesel generator 'can energize a motor driven AFW train. .
\
- 3. Examine carefully and perhaps upgrade HPI reliability and/or reduce the frequency of very saall LOCA's.
The economic incentives to make these improvonents, derived f, nam reduced risk of economic losses associated with core melts, are roughly:
Base Case.
Value $22.3M Value $13.4M y ,
Base Case with
- Base Case with Both.
Assured DG's Aligned to Both Feed and Bleed lAFV lbtor Driven Pumps Value $660,000 Value $10.7M o I 4 .
l Assu' red Feed and Bleed 2 DG's + 2 AFW Trains .
Value, $15M
\f Assured Feed and Bleed 2 DG's + 2 AFW Trains High-Reliability HPI l -
l l -
- The base case plant is assumed to be incapable of feed and bleed' cooling, only one diesel generator is assume / capable of energizing the safety related untor driven AFW train. The turbine driven AFW train 'is AC-independent, but the non-safety grade motor-driven' AFW train requires offsite power. Industry ,
sverage HPI. reliability and 5 -1.0CA. 2 frequency is assumed. The analysis that shows that S D m'ay be too frequent appl.ies to other PWRs as well.
~
2 The attached paper describes the analysis. .
. .'.,.:- J- ()nL-,__ _
Frank H. Rowsome, Deouty Director
- Division of Risk Anaijsis Office of Nucleap,. Regulatory Research
/
Joseph A. Hurphy Reactor Risk Branch Division of Risk Analysis
.0ffice of Nuclear Regulatory Rescarch
Attachment:
As Stated ,
cc: R. Bernero G. Burdick . .
R. Mattson t S. Hanauer, ,
M. Ernst .
A. Thadani -
RRB Staff ,
RAB Staff l
1 h
(
" -= .. - mm . _ _ * - , - . _ . . . .
...c-. u -
-- m _
- Feed and Ulced Issue for CE Applicants We understand that the current crop of CE license applicants are pmposing that no pressurizer PORY's be installed, that the HPI shutoff head is to be well below the pressurizer safety valve setpoint (around 1400 psi), that .
high point vents provide no more than two 1" diameter r~ note-manual vents, '
and that the auxilia'ry feedwater systens will be composed of one AC-independent turbine driven pump, one AC-power train, and a third non-safety grade motor
- i driven pump, .
We have at;enpted a back-of-the-envelope PRA in order :::
to evaluate the risk implications if these plants are incapable of " feed and bleed" cooling.
The results suggest that they may* fail to meet the Commission's safety goal of a core melt frequency less than 10-4/ year and the present worth of a fix to enable assured feed and bleed cooling is of the order of $10 million or We considered five more per plent, based upon reduced financial risk alone.
loss of main feedwater, loss.of offsite power,
.- groups of accident sequi,nces:
very small LOCA, transie'nt-induced small LOCA.(late start of auxiliary feed Is' water allows a lift of a pressurizer code safety valve which may stick open),
l and station blackout with restoration of AC power just before the point-of-no-
- return. We did not consider main s1!eam line breaks or ATWS, although in these
- seqJences'an assured feed and bleed capa'bility could also enhance safe well as in the sequences considered.
- - - m e :. - . ...- . .. - - .. - _ _ _.. ._c-:
. _ n_ _ _ - - - - - - - _
1
' ~
For The simple loss of main feedwater appears to be the dominant egncern.
this sequence in a plant incapable of feed and bleed cooling, the frequency .
V of core melt, Ac 'm " arA P(L), where Ag is. the frequency of critical (sustained) '
i failures of main feedwater, and P(L) is the probability of a critical failure of the auxiliary feedwater syste.a. .
WASH-1400 took the frequency of feedwater transients to be 3 per year, with 99 out of one hundred such occurrences recoverable. There is reason to doubt both numbers. Com'plete interruptions of main feedwat.er are more frequent than 3 per year during the life of the' first core, while the plant is still
- being debugged, although many take place at startup or at low power when the A mature plant has complete decay heat level is too low to pose much risk.
The non-recovery interruptions of main feedwater about once a year or less.
factor of 10~2 applies to plants with simple feedwater controls, motor driven main feedwater pumps, and rio major obstacles to feedwater restart after a
, trip. In large,' modern plants with turbine-driven main'feedwater pumps problems with feedwater resta-t are comon,'so a non-recovery factor cf .3 to .1 is more reasonable.
I judge that the frequency of non-restorable failures.
of main feedwater occurring from substantial (risky) initial power levels is roughly:
I 3 ,
[0.3x10h,firstcore
, at maturity m y 0.1 x 10
. . . ~ .' ..- . ..
~
Auxiliary feedwater reliability is also uncertain. Data from the. precursor program suggests that the PWR average experience has been a fai,1ure probability
.' of IQ.3~ / demand. This average includes early-in-life experience as well as mature plant experience and two train as well as three train experience. .
System reliability analyses have suggested that the best of the three train systems can approach - at maturity 5 per demand. However, these analyses failed to consider some common mode failure mechanisms so they, can be regarded ,
as having an optimistic bias. It is,not uncommon early in plant life to find instances of repeated, consistent, auxiliary feedwater pump failures while the system is being debuggrJ in service. The record suggests that the failure probability of the AFWS is substantially hiij.her during the first core than in
! maturity. A system with two diverse safety grade AFW trains and a third full capacity non-safety grade train will probably achieve failure probabilities of:
3 x 10-39, first core 1 x 10~40, at maturity
- These estimates result in loss-of- ll'-feedwater frequencies of:
,.9 0 x 10-3+1.4/yr, fir'st core 3",
C 1 x 10-5+1.4/yr, at' maturity The uncertainty range is thus:
2.3 x 10-2 ? A'" E 3.5 x 10-5 , first core 2.6 x 10-4 ? A , R 3.9 x 10~7, at maturity i
, ,. k . . . , , . - . _. . . _ _ ,.a,_m, .. .,%...,,,,,.,..._-,,,,m. , _.,, _ - . _,-- ,_._r.,
[
) . ", a '.. ,
vi
-A.
~
Note that even at maturity this core melt sequence frequency may be higher than the Commission's criterion for all core melt frequencies combined:
A,k10'4/yr, and that the best estimate is that it will excee[i the .
C6mmission's criterion during the first core. I that common ,
Note a'so .
causation of main and auxiliary feedwater failure due toL fires, floods, earthquakes, or sabotage has not been considered and might increase this sequence frequency. The Commission's guidellnes on acceptable risk do not indicate how' to treat uncertainties or higher-than-average estimates
) '
. for the first core.. Nonetheless, I think it unwise to atlow a single core melt accident sequence to be this probable. ,
The provision of an assured
. feed and bleed capabili-ty would enable HPI to cool the qore in these scenarios. Even with common mode and external hazards, this should be worth at least one decade, more likely two decades reduction. We recommend it.
s Next let us consider loss of ' ffsite o power. The failure frequencies or l probabilities are taken to be: . ,
l l .
~
Pnon-recoveryofoffs}tepowerwithin30 min-Ihr=0.2/ occurrence Thus A LOSP without recovery = 0.04/yr POG = 0.03/ demand P20G = 0.003/ demand, including common mode i * *
- PAFW-turbine train = 0.1/ demand P
AFkf-motortrain=0.01/ demand
-S- ,
AssumeforconveniencethatdieselgeneratorAisconfiguredtoeneIrgizethe safety grade AFW motor driven train. ' As we shall see, the core melt frIquency predictions are sensitive to whether or not diesel generator 8 .
- can energize the non-safety grade AFW train or not. The event tree for loss 'of offsite power can'be drawn: .
,-4 okay
)
no failtres' 10~4
- " ) melt at 4 x 10-0/yr.
'I
. B fails
.03 10 i melt at 1.2 x10-0/yr .
LOSP '
.04 - 4 0kay ,
'A~ fails .1 or .001* .
.03 i melt at 1.2 x 10-4/yr or -
) 1.2 x 10-6/yr*
e --t okay ..
both fail
. .003 imelt at 1.2 x 10-5/yr
.1
?
- The higher failure rate applies if.one of the diesel generators (we' have called it B),cannot power 4 motor driven AFW train; the lower failure. rate applies if both di.esel, generators can power a motor driven AFW train.
Note that the Comission safety goal of 10-4/yr for all core melt sequences may be violated by loss of offsite power and a single diesel generator failure if there is one diesel generator that cannot be aligned to energize a motor-driven AFW train. .This high core melt frequency could be reduced to marginally
. acceptable value in either of two ways:
_ - _ : =- -
- 1. Insure that eithe,r diesel generator can be aligned to energize .
a .
Mtor-driven AFW train by (1) providing a ' swing bus for the safety
' grade AFW pump, or (ii) providing an essential (diesel-litcked). power supply to the "non safety grade" AFW pump, or
- 2. Provide an assured feed and bleed capability so that the one operable ,
diesel generator and its associated HPI train can cool the core.
I The value of the The case of full 'st,ation blackout is considered later.
feed-and-bleedfixcanbeinferredfromtheeventtreeforLd5Pwiththis design:
- N 10-4 4 3 no failures 5 x 10htlt at 2 x l'0-8/yr
.96 8 fails 4 10-3 5 x 10-2i melt at 6 x 10-8/yr
.03 LOSP q
-+ ~
04 A fails .1 or'.001
.03 . .
5 x 10-2i6 melt x 10-3/yr at 6 xor 10 Both fail
> melt at 1.2 x 10-6/Y
. .1 Instrument line breaks, steem generator Next let us consider very small (5 )2LOCA.
tube. ruptures, charging pump line breaks, and gross reactor coolant pump s failures h&vh happened a dozen or so times in 500 LWR-years,' suggesting a l They l
challenge frequency of 3 x 10-215/yr for 5 LOCA 2 excluding'PORY LOCAs.
are less probable in the first year of service, so I will not single out first I core numbers. .
~ -
,, _y In the CE plants, both feedwater and ECCS (HPI) are required for s"uccessful core cooli.ig. Main f,eedwater may remain operable or be restartable in some of these. ,The probability of HPI failure on demand was found to be 8.6 x ,
10-31.5 in Surry (WASH-1400). Most PWR PRAs are finding a failure probability for the whole multi-train HPI between 10-2 and 10-3/ demand. We.shall assume that the probability of HPI failure on demand is 5 x 10-311/ demand for the CE plants. A rough cut at frequency estimation suggests:
- HPI AFW
- ~ '
l - > success
~
5"*E***
f .
l - - i melyi9tg/yr 10- .
3 x 10-255 5 x 1~0-3d i melt at 1.5 x 10~41I I/yr The value of an assured' feed and bleed capability here is to eliminate the need I . for feedwater. Thiswouldeliminatethesmaller(10-6/yr) path to core melt without affecting the more prominent path via HPI failure. Note that small LOCA w;th total HPI failure is predigted to result in a core melt frequency above the Commission goal for all core melts. The provision of feed and bleed capabi-lity or of an improved AFW system wi11 no,t help this. It is a problem generic to PWRs and not unique to the CE designs. It appears that the high frequency of very small LOCA revealed by historical experience and the marginal HPI system reliabilities revealed by many PWR PRAs are combining to yield unacceptable core melc frequencies through S 2D-type sequences. We suggest that NRR tackle this
'c . -
\ '
x
. l probTem in two ways: First, a serious effort should be made to reduce the Second, a broad-scale attack on HPI reliability frequency of S2 LOCA's.
problems comparable to that instituted for AFW systems after THI sh.ould be initiated for all PWR's. .
Next let us consider the transient-induced small LOCA's, with and without a PORV.
A feedwater transient with a prompt autostart of auxiliary feedwater However, a delayed start is assumed not to, lift a pressurizer relief valve.
of AFW, which may be roughly one hundred times as likelyg s a sustained AFW failure, may lift a pressurizer valve (PORY or code safety) and the valve may stick open.
LER data suggest'that'PORV's stick open roughly once in one hundred challenges Neither type of and code safety valves once in a thousand challenges.
valve have failed open spontaneously, to my knowledge, although there was one instance (Crystal River NNI bus fault) of a comand fault leading to an open PORV.
Since TMI I think it safq to assume that operators would successfully clos,e the PORY block valve in at least 99 out of 100 instances of a PORV-L Without a P0R V we have (at maturity): .
Safety Valve Late AFW Closed Prompt AFW
>okay 7 okay FW transient 10-3 y3 LOCA at 10-6/yr
- UY" 10-2 2 (safety valve 10-2 7 melt at 10-5/yr I
challenge) ,
b o
-g- -
a The core melt, outcome from loss of all feedwater has already been considered.
The .incremen't in the likelihood of 25 LOCA is negligible at 10 /yr. It can
-still be mitigated by HPI, if HP! works, as it will do in the vast majority of cases. .
With a PORV we will get transient-induced,LOCA ten times as often, (10-5/yr) but the block valve can be expected to termin' ate'all but 1 percent of these for a frervency of transient-induced and unisolated LOCA of.:1.0~7/yr. .
If anything, the.PORV helps rather than aggravates what is a negligible c'on.tributor to the overall 5 frequeni:y 2 via transient-induced LOCA.
i We should also consider the command fault LOCA's due to spurious "open" commands to a PORV. The frequency of occurrence is a sensitive function of th'e valve control logic design. It could be made as small as we wish by
( -
i suitable reliability engineering. If we consider the Crystal River experience
,l >
j l
as one failure in 300 PWR-years, we get an industry average of 3x10-3/yr for PORV command fault LOCA. Clearly, B&W did not do so well, but the combined e'xperience of the three PWR vendors suggests tha't this frequency can easily frequency of 3x10-21 5/yr. I conclude be*made much less than the overall 52 that' having a PORV or not having a PORV has a negligible effect on the likelihood LOCA may lead to core melt, provided of S2LOCA or of the likelihood that 52 It that system or coinponent functional reliability is the only consideration.
goes without saying that this analysis is predicated upon a design with antici-patory ' trips so that routine transients 'do not lift pressurizer relief valves,
. and that the operators are trained to close the PORY block valve when appropriate.
_= . .- . = _- .. -
l.
~ .
.-10. ,
There may also be a design adequacy issue. I feel u' comfortable n with 1400 psi HP! pumps in plants without PORV's, even if the HP!'and the AF)r systems ,
are hi.ghly reliable. Careful thermal hydraulic analyses together with ,
thoroughstudiesofplausibleoperatorresponsesarenecessarytoveriff .
that some 5 LOCA's will not lead to degraded steam generator heat transfer 2
and RCS pressures over 1400 psi while the core uncovers, even with. operable HPI and AFW trains. The high point vents and reactor coolant pumps may telp here even though these plants do not have full ' feed and bleed capabi-lity. However, th'ese design adequacy issues are beyond th ocapability of this simplistic system reliability analysis.
4 Last, consider station blackout with AC recovery near the point of no return.
The event tree may be drawn as follows:
EDG's (TDP) Within 1 hr? Within 2-6 hr?
LOSP 1 okay success?
.2/yr '
3x10-3 success? melt
,)
-- mel t Blackout with su'ccessful auxiliary feedwater (turbine driven pump) can be The turbine driven AF pump has expected at a frequency of roughly 6x1,0~4/yr.
a finite success window, however. One of several factors will lead to core melt. if AC power is not ultimately restored. These factors include:- (a) loss of reactor coolant inventory (blown RCP seals, etc'.); (b) dead batteries
(
(discharge or ovdrheat); (c) high pump room temperatures (np HVAC)i or (d) deplettort of condensate.
e 4
l v
. ETacRout without auxtttery- feedwater 1eads to 4 shorter time window to save the cdre by AC recovery. This can be expected at a frequency of ro.ughly 45 6x10 /yr. In either scenario, as the time to the point-of-no-return for . ' ,
core cooling approaches, the reactor coolant system pressure will be high, (around the pressurizer safety valve set point), and..the level will be falling toward the top of the active core. Refilling the steam generators will be necessary but may not be sufficient, depending upon the effectiveness of reflux condensation' and the extent of reactor coolant system leakage. A
~
feed and bleed capability to enable HPI to refill the reactor coolant system fairly quickly might extend the w' indow for AC recovery witIfoiit core damage or melt by tens of minutes, perhaps more. A quantitative evalua' tion of the fraction of melt sequences.that could be saved by feed and bleed would require extensive thermal hydraulic analysis and analysis of the likelihood of AC restoration vs time. However, it is clear that the most likely AC restoration times are before any point'of no return. "hus, an upper bound on the improvement in the blackout melt sequence frequency attributable to feed and bleed is of the order of 10-6/yr or less. ,
. To sunnarize, the principal concerris regarding the CE designs with low HPI shutoff head and no PORV's appear to be:
- 1. Risk of core melt via loss of all feedwater may be unacceptably high.
~
- 2. The adequacy of the design for very small LOCA mitigation is questionable. '
This may be coupled with operator behavior issues.
j
.r *'
- z ', -
l*
i 1
- 3. '
The reliability of the high pressure injection system may be' unacceptably ~
low, but the mere fact of an AFW requirement'to mitigate very small LOCA's - given. des.ign adequacy - does not significantly degrade the reliability with which very small L6CA's may be mitigated. *
- 4.
It is important that either diesel generator be capable of energizing a motor driven AFW train given loss of offsite power.
Two questions remain to be answered: (1) what is it worth to equip these plants.with feed'and bleed capability? and (2) what are the 'ittendant risks of the optional ffxes? .
As assessment of the value of the fix follows. Those core melt accident sequences for which a feed and bleed capability could save the co're are likely to be well-contained; they do not entail common' mode failure mechanisms which would
~
defeat containment isolation, sprays., or fan coolers. Thus the utility's economic risk dominates.
Let us take the cost of such a core melt event to be around $10 billion (low:
$2 billion.for TMI's; high:
$10'O billion for extensive shutdown orders). The value in $ is essentially:
V($') = aA (events per year) x C($ per event) x T(exposure time in years)
We can calculate a variety of al, differences from the following table:
i 8 .
t x Without' Feed With feed cm ... . . . .. . . and Bleedi,. , ' ' ' " ~l
".'. ' and 81eed
'TML(firstcore) 9 x 10~4 9 x 10-6 TML (mature) 1 x 10-5 1 x 10-7 LOSP Case 1* 1.4 x 10~4 1.8 x 10-5 LOSP Case 2* 1.8 x 10-5 . 1.2 x 10-5 502 , ,,
1.509 x 10-4 1.5 x 10-4 ,
- Case 1 - one of the diesel generators cannot energize a motor driven- '
AFW train case 2 - both diesel generators can energize a motor driven AFW train
.The economic incentives can be calculated by taking the exposure time for the first core as one year and for mature . operation as ten years. The economic l incentive is essentially the reduction in the present worth (at startup) of projected monitary losses due to accidents. They are shown on the following diagram:. '
Case 1 $13.4M- s Case 2 no F&B ' no F&B.
$23.3M $10.7M l se sr l '
l Case 1 $660,000' s Casa 2 $15M Improve HPI F&B '
F&B ~ ~ ~ - ~} . Reliability
=,- - , - , , - ,,---,n, a,,---, , n-.,-. - - - - - - , , . _ _ - - , , , ,
. ,,,--.-.c-- - - , , - , - . .
w- - ----
t
. - 14-
- l
. l i l This diagram can be understood as follows. Start wi'th a CE plant that~ has ;
i no feed and bleed capability and only one diesel generator that can support a motor-driven auxiliary feedwater pump. It would be worth up to
$13.4M to enable the second diesel generator to power what is now the non-safety grade AFW pump. It would be worth up to S22.3M to add feed and bleed capability, and so forth. The final "fix" has yet to be discussed. The .
value was arrived at by postulating design or operational changes such that the likelihood of an S 0 core melt is reduced from 1.5x10 /yr to 1.0x10-5/yr.
2 ,
This might be achieved by-either improving the reliability of HPI substantially, reducing the frequency of very small LOCA substantially, or some of each.
Now a feed and bleed capability could be achieved by installing suitably sized
~
PORV's or by installing HPI pumps of very high head ,(ovar the pressurizer safety valve setpoint) or some of each. We have already examined the-attendant risks of PORV addition. Care must be taken to design the control logic so that spurious "open" commands are rare, but it is safe to expect that this will be done well enough that the frequency of S2 LOCA is not significantly increased. The effect on transient-induced LOCA is not.important (this frequency is negligble with or without 'a PORV) and is compensated by the possibility of isolating PORV-LOCA's wi.th the block valve.
If the HPI can force open a pressure relief valve (code safety or PORY in the pressurizer), then a spurious HPI actuation can cause a temporary, recoverable LOCA. Shoul'd the valve stick, we may have (without a block valve) a sustained 4
LOCA. I assume that the, operators will shut off HPI though not before a
_.._ .. _ _ .. .. - _ _ ._..-..._. _ ._ - ~.. - . - _ -.- _ -
~
' . . l
1 -
- e pressurizer valve opent,the pressurizer quench tank rupture disk, blows, and
- a small spill occurs. If,the valve sticks open (and cannot be isolated), .
\-
the operators must restart HPI. Spurious HPI actuations are quite common. ,
We assume here that the frequency of spurious HPI actuations which. reinain on long enough to challenge a pressurizer valve is one' per year. .
Borrowing from the prior analyses we can draw the following event trees for the ' ,
high head HPI design: .
Without PORY (or PORY left biccked)
. Safety Valve Closes HPI Restart -
Upon HPI Shutoff l small spill at 1./yr
~
Spurious HPI Actuation -
- large spill at 10_3/yr 1./yr 4 10 d
10 i core melt at 10~0/yr With PORV installed and unblocked .
PORY Closes Upon Block Valve HPI Shutoff Closes HPI Restart .
- small spill at 1/yr -
Spurious HPI ,
. . Actuation i small spill at 10-2/yr 1./yr 10-7 i large sp.ill at 10-4/yr 10-2 l
10 core melt at 10-7/yr 1 -
['
j.
, 1 Note that if a PWR has a PORY and high head HPI, it is better to run with the b'iock valve open, so the isolatable PORV can take the brunt of " spurious HPI actuations as well as feedwater transient-induced LOCA's. Note also that the core melt sequences caused by spurious HPI actuation in plants with high head HPI is acceptably small.and can be made smaller still if the PORY only lifts (block valve left open). It is roughly balanced by comparable risk reductions in that for these designs, the PORY ne.ed not open to accommodate
'~
feed and bleed.
Howeve'r, we should note that there is a real economic incentive to avcid the blown pressurizer quench tarn rupture disk and the attendant small spills. If we assume a five day, outage at one million dollars a day for small spills and a 100 day outage for a large spill, then 'the present worth of expected losses due to spurious HPI actuation in these designs is:
1 event /yr x 5x106 $/ event x 10 year exposure = $50 million from the small, frequent spills with either design variant. For the large spills (unisolated LOCA) we have:
6 Without PORV: 10-3/yr $10 x 108 $/ event x 10 yr = 5 With PORV: 10-4/yr q $10 Thus utilities are subject to a significant incentive (present worth of projected losses of $50 million) either to employ HPI pumps that cannot lift a pressurizer relief valve or t.o go after improved prevention of spurious HPI actuations or both.
t
\ ,
l w . .
. (.
~
There appears to be no economia penalty (other than first cost) in providing HPI pumps whose shutoff head is at normal RCS pressure, i.e., around 2250 psi.
\
In summary, then, this limited risk analysis cannot distinguish a difference in safety among the several ways to achieve feed and bleed capability: ' instali one or more large PORV's, raise the HPI head above the pressurizer safety valve setpoint, or install a smaller. PORV and raise the HPI head to near normal operating pressures. These choices must be made on the basis of design adequacy or thermal hydraulic considerations, preferably considering ATWS as well as the design to assure that very. small LOCA's can be mitigated even
~
thodgh.HPI or AFW may be late in starting or might be throttled temporarily by the operators. We have, however, found a plant availability incentive to avoid an HPI head so high that it can lift a pressurizer relief valve. No such penalty accrues to HPI designs with a shutoff head at the normal RCS pressure.
0 e
O 9
e e
- - -