ML20099A308
| ML20099A308 | |
| Person / Time | |
|---|---|
| Site: | 05200001 |
| Issue date: | 06/25/1992 |
| From: | Duncan J GENERAL ELECTRIC CO. |
| To: | Kelly G NRC |
| Shared Package | |
| ML20099A263 | List: |
| References | |
| NUDOCS 9207290092 | |
| Download: ML20099A308 (10) | |
Text
[..
o.u , :.
. . . :: a c a. a.: m ...-- .. .
l'. . , .
q
\ ,
GEAbciurEnergy
- i -
ABWR gcq Date ZS]0Ab
\ To t? ten 1.) /d W / .N rt C - Fax No.
This page plus _fpage(s)
From uW$ N uw code 175 Curtner Avenue i San Jose, CA 95125 Phone (408) 925- FAX (408) 925-1)93 or (408) 925-1687 I L Subjeft hk A W lWIAN $3L
-dau A7L 4A 7 Message 75,upd4 .
t% 7 Apd
>=4 y . .
AdWL an shan bs "
fh n%M. har.r in Yk insreiv ccv.lhk)< V
\ JWW l
.l A
' AH,25 c. . . am n fe..:M -t'r o.u . . i.. -
g )
b 7
/
, h I In addition to itA use as a measurement tool to assess the degree to which PRA related goals were satisfied as surnmarized in Section 19.6, the PRA was used to substantially influence the design. During the course of the review of this PRA, dic NRC
]
requested that the way in which operating experience was factored into the design and the ways in which the PRA influenced the de:Ign be described. This description is provided here.
19.7.1 ABWR Design and Operating Expeiience l
The design of the ABWR covered a period of about 12 years, from 1978 to 1990.-
d The world wide experience of several companies including ABB Atom, Hitachi,Toshiba, ANM and Gf, was used to establish the original design. The K6/K7 project which followed that cliort embraced in more detail the experience of TEPCO, General Electric, liitachi and Toshiba.
During the desigt process, methods were empisyed to ensure that operating e cperience was factored ihto the design. Rese are summa ited in Subseebon 1.8.3, particplarlyTable 1&22.
19.7.2kEarly PRA St dies PRAs were used extensively in the early design cifort for making design decisions.
This has resulted in millions of dollars of cost savings witl out compromising the plant safety. Several key stupies are summarized here.
( 1) Core Cooling Systems
]
1 t _ _ .. ..
A core cooling system optimization study was performed. This study enabled .
l the core cooling and heat removal functions to be combined and the total I number of CCS divisions to be reduced from 4 to 3, resulting in significant cost savmgs.
A RCIC reliability study was perfotmed. This study enabled the elimination of one high pressure core cooling system by upgnding the RCIC system
, i reliability, g A BWR risk comparison study was performed: his compared the core damage frequency for BWR/4: 5; and 6 plants with the ABWR and identified the importance of modifying the ADS logic to initiate on low water level.
This change improved the ABWR safety significantly for transient event
- r,equences.
L
\
' 1 ,
.) i i
_I . -
A. ,. . x: 2 .. 4 r . ,- .
. ', i ;
, 2) Reacti,vity Control l Two studies, namely, ABWR sc-am system reliability and scram system unavailability with alternate rod insertion enabled the incorporation of a less expensive ATWS mitigadon systern in place of alternate M system proposed for an earlier design. His change also results in significant cost savings, l
i 3) Instrurr entation Studies An ADWR instrument reduction study and reliability assessment enabled the
> climination of 60% of the sensor instrumentation in the reactor safety systerns without impacting plant safety. Other studies aerformed have identified signiReant cost reductions m the ABWR mu' tiplexing systems and I otherInstrumentation systems.
i
- 4) Control Rod Diive improvemente i
The early ABWR ATWS design was based on utilizing the capabilities of the 1
' ' new fine motion control rod drives (FMCRD) to meet the intent of USNRC ATWS Rule 10CFR50.62 for improvement of hydraulic scram reliability.
Adoption of the FMCRDs provided im proved scram reliability by elimination of the scram discharge volume, which s a common mode failure point for cunent BWRs sing the locking piston type CRDs. ne scram rehability goals If were met with t usle of the Alternate Rod intertion (ARI) valves specified in j 10CFR50.62. owehr, subsequent PRA studies showed that adoption of the ARI vah'es in the design would provide a further substantial reduction in the probabil ty of ATWS Since the cost of adding the ARI valves to the design at l that time was minor,it was decided that their incorporation into the design was appropriate.
The FMCRD brake rnechanism is provided to prevent a rod ejection in the event ofa break of the scram insert line. As a result of PRA studies, the c{esign Aas changed from the centrifugal type brake used in the early design
' to the current electro-mechanical-type break. The PRA studies indicated that the brake design had to be fully testable on an annual basis to meet the goals for rod ejection freque . It was determined that the electro mechanical ign was easier test, and would not have any impact on the plant brake outage crdelitical path. ,
- 6) RIP Trip Study f The reliability of RIP power supply was evaluated. The robability of g siinultaneous trip of all RIPS was calculated, ne object ye of this studywas to g assure that the probability of an all RIP trip ennt is low enough to clauify such an event as an accident. The study resulted in a 4-bus configuration for the RIP power supply. In addition, motor generator wts were adopted to
, prevent an all RIP tnp event from occurring following a loss of AC power.
I
( i 6
2 4
, v.m i :. .m. nc . . v.r. w .... . . -
. g i - '
l 1
19.7.5 PRA Studies During the Certification Effort dengn.f Thn part (If first effort was thereported ABWR cerdfication in the 1991 Probabiliniceffort, the PRAandwas fut ther used to Safety Assessment
( Management Conference. An ACindependent water addition system and a combustion turbine generator were added to reduce the probability of core damage. A lower drywell flooder and a containtnent over preuurt protection system were added to mitigate the effecu of core damage in the unlikely event that such damage should occur. The studies which lead to these and other iraprovemenu are summarized here.
k (1) Initial Probabilistic Risk Anenment The initial PRA effort for ABWR Certification indicated that ABWR had abtmdant eans of preventing severe accidenu and mitigating their consequences and that the j oals could be satisfied. However, keyinsighu gained from this effort led to the selecdon
. )f additional features as described in the following paragraphs.
I The core damage frequency from internal evenu wu detennined to be about one went per million reactor years of eperation. Although this result wu very favorable, the bre damage frequency was dominated by station blackout. A simple, "ac-independent
{. yater addition syvem" was added to the design. The costimpactis quite small since only (1
a few smalllines and manually operated valves are added. A combustion turbine generator, required by the E'ectric Power Research Insdtute Advanced Light Water
' Reactor Regmrements Prograrn was also added to the design. These features virtually i i I eliminate station blackout as a contributor to core damage, decrening the frequency by un order of mpitude.
In other evaluations,it wu determined that if molten core material were present
) > I in the lower drywell,it would ablate the reactor venel pedestal in the region of tie j wetwell/drywell vents, allowing suppression pool water to enter the lower drywell. This would quench the corium and terminate core-conciete interaction, non<ondennble gas j generauon and drpell atmosphere heatup; all favorable effects which lessen the l
potential to fail the contamment function. However,it did not seem prudent to take favorable credit for a rather uncertain proccu. Earlier conceptual studies had idendfied the cor(cept of a " passive dr>well flooder" which could be relied on with much greater
') uncertAnty to produce the desired favorable efTects. Since this was a low cost system (several pipes and thepnally activated valves) it was added to the ABWR design.
The drywell head was found to be the most arobable failure location should the contaimnent be preuurized to a point well above the design preuure. If such an unlikely failure were to occur, finion products could be released without the benefit of I
supprenion pool scrubbing. Fission product retention in BWR supprenion pools has b :en found to be very beneficialin reducing the amount of fission products released
> fl om the containment. Even before specific numerical calculations had been performed, I tJ e potential benefits of a device that would relieve containment preuure through the st ppression pool were apparent. Therefore, a containment overpreuure relief feature
- w; added to the design to accomplish this function, t
I I
a I 3 I l
. .. : I
.rp .i..e 4 . . . ,
i 6
Examination of dominant severe accident sequences indicated several areas in i which the Emergency Procedure Guidelines could be improved for '.he ABWR, 3 Prevention of accidents can be improved in seismic initiated loss of offsite power events by instructing the operator to manual I l oss hn made power operationeof thos{y valves operate imponible. Accident heat mitigation removalcan system be valves if transforme
! I improved for ABWR accident sequences in which corium has penetrated the reactor cessel b) filling the dnwell with water to the level of the bottom of the reactor vessel,
, , mther than to the top of the active fuel as donc for earlier BWRs.
i2) Feature Descriptions and Resulting Benefits I
As a result of the studies summarized above, four new features were added to ;he design to enhance the plant's performance under severc accident conditions. The added teatures are described in the following paragraphs.
(a) ACIndependent Water Addition i
1 wo fire protection systern pum are 3rovided on ABWR: one pump is powered
, iy ac p 'wer, the othenis driven direct) by a c iesci engir.c. A fire tnick can provide a ackup water source. One of the fire protection stand pes la croswonnected to the RllR in, cction line to the reactor venel through norma ly closed, manually operated i ( vglv-s. from this line, fire protection water can be directed to the reactor vessel after die r actor sessel has been depressurized. Fire protection water can also be directed to the well spray header to reduce upper drywell pressure and temperature. Should drywell e ad failure occur (an extremely unlikely event, especially given the containment erpressure protection feature discussed below), use of dr)well spray also reduces the r lease of volatile fission products from the containment.
I
( Co bustion Turbine Generator s
. combpstion turbine generator (CIG) starts automatically. It is automatically lo ided with selected investment protection loads. Safety grade loads can be added m ,nu 4
- y. This provides diverse power if none of the three safety-grade diesel generators ar ;ava able.
The CTG is a standby onsLtc nonsafety power source to feed permanent nonsafety lo Lds dtiring loss-of offsite power events, it is not seismically qualified. The unit also pi wide i an alternate AC power source in case of a station blackout event.
The CTG is designed to supply standby power to the three turbine building (non.
C1 as 116 6.9 kV buses which carry the plant investment protection loads. The CTG a ioma itally staru on detection of a voltage drop to about 70% on its downstream bus.
- yen t' e CTG is ready to 9mchronize it automatically usumes the 6.9 kV bus loads.
t ,
sa'fety but is provided to assist in mitigating the consequences of a station g IMweve ', the plant can cope with a station blackout without the CTG.
I I i i
r <
! 4 i
N . n .e 2: .n e n ; e: -
'h Ti e CTG can supply power to nuclear safety related equipment if there is com alete failure of the eme,rgency diesel generators and all ofIsite power. Under this conc idorf, the CTG can provide emergency backup power through manually-actuated ClaselE preakers in the same manner as the offsite power sources. This provides a
, diverse scurce of onsite AC power.
(c) Lower Drywe!! Flooder T$e lower drywell flooder floods the lower drywell with water from the suppression pool duripg severe accidents where core melting and stibsequent vessel failure occur.
beveral pipes run from the vertical pedestal vents into the lower drywell. Each pipe contsdnsh fusible plug valve connected by a flange to the end of the pipe that extends into the I awer dr)well. In the unlikely event that molten corium flows to the lower !
I dr) ' ell fl >or and is not covered with water, the lower dr)vell atmosp(here will rap hea p. The fusible plug valves open when the drywell atmosphere and subsequently 4
the Lusil e plug valve) temyerature reaches 2f>0'C. The fusible plug valve is mounted in the Mrti I position, with t1e fusible metal facing downward, to facilitate the opening of the valve hen ihe fusible metal r9elting ternperature is reached. When the fusible plug valv:s open, rupprenlon pool water will be supplied through the system to the lower drywell to quenth the corium, cospr the corium and remove corium decay heat. The restit wil be a rhduced drywell terhperature and pressure from noncondensable gas generati 'lhete will be less chance of overpressurizing the containment and inc3easin leakage. The lower drywell flooder is a passive injection system. No operator actan is required.
(d) Containment Overpressure Protecuon System j If an accident occurs which increases containment pressure to a point where cordainment integrity is threa't ened, this pressure will he relieved through a line ,
conhected to the wqtwell atmosphere, by relieving the wetwell atmosphere to the plant stack. Providin!; a rtlief path frorn the wetwell airspace precludes an uncontrolled containment fallurea Directing the flow to the stacL provides a monitored, elevated release. Tne relieflipe, designed for 150 psig, contams two rupture disks,in series, which opgn at a pressure albvc the design pressure but below the Service Level C capability of i
the(containme relieved in aanner m$t.that If forces overpressure occurs, the rupture disks will open; and escaping fission producu to pass through the pressu suppression pool. Relieving pressure from the wetwell, as opposed to the dr well, takes advantage of tize decontamination factor provided by the suppression pool.)After the containment pressurp has 6een reduced and normal containment heat removal capability has been regained, tAe operator can close two normally open air operated valves in the reliefpatb to reestablish containment integrity.-Initiation of the pressure relief system is totally passive. No ower is required for initiation.or operation of the pressure relief funcuon for an ind fmite period. ,
i I (e)lSeismic Ca) ability of Added Features k After the above added design features were further developed, additional PRA studies were performed focusin ; on seismically initiated events. The combustion turbine generator is not seismically qua'ified so no credit wu taken for operation in the analysis.
The other three features have reladvely high seismic capacities. Most of the l 5
, % l25 . . LH' : ,.y m:- % .: ,
ac4ndependent water addition system b seismic Category 1 and has three pumping sodrces. ac driren pump, direct diencl driven pump and a fire truck. 'lhe balance of the system ccmsistsof pipes and manually operated vahts which have relathcly high seismic capacity compared to many components in conventional safety sptems. The ,ower drfwell flooder is virtually invulnerable to a seismically induced failure (pipes and valves whose likely (41ure mode would probably introduce water to the lower d rywell). The overpressure pYotecdon systdm is selimic Category 1, and its failure should not prevent the relief function provided by the rupture disks. '
/
/
(3) Emergency Proce lure Guideline improvements i
- edure Guidelines (EPGs) were irnproved in several areas. Two i exampl(mergency Prd s are describe ihere. l (a) Accident Prevend 'n ,
in a hig'h fractic n of seismically inidated station bh ckout sequences, diesel enerators are available to sppply power to pumps in the heat removal system but lower i oltage power for necessary yalves operation is not available hectuse of transformer l allure. The transformer selsmic capacity is less than that of the diesels. However, the ecessary vilves can be ope ated manually under many of these conditions, and this capability will be reflected i the detailed procedures to be developed from the EPGs.
l /
! (b) Accident Mitigation
! d q
' F.PGs developed for earlier BWRs call for the operator to fill the containment to l
the 1 el of the active fuelif the reactor veuel water level cannot be determined or i ican t be maintained above the top of the active fuel, F r an ABWR plant which has und gone a setere accident, this strategy can be improv(ed. Filling the co .
l lower level is appropriate for two rc.asons. First, noncondensible gases in the i contLinment arf comarened to a lener degree and containtnent pressure is reduced
! comared to the earlier strategy. Second, filling the containment to a lower level avoids 4 Dooding the cor tainment overpreuure protecdon system and the potential for subsequent damage to system piping if the rupture db k setpoint prepure is reached. Therefore, the o aerator is (irected to fill the containment to the level of the bottom of l the reactor vesse' in the very long term, for post accident recovery and clean up operations,it would probably be necenary to increase containment water level to an levation above the top of tbc active fuel, ) l i l ( ) llumah Actbn Overview
' 1 l
l 1. ate in the process of preparing the PRA, human actions were summartred and sdhsitivity studies were prefonned. An overview of this process is provided in j \ Section 19.'11. 1 I 4) Furthee Imp /ovements Subsenuent to the a ove described improvements identified earlyin the
,I 7 ertification effort, several)bther imgrovements were identified esign.
b l
\
6 i l
,5 n n. . r. .g .a .;- .
am. . i ; I The preuure capability to the drywell head was increased to increue the A coitainment prenure capability. Basaltic concrete was added to the lower .Itywell to re luce the potential for non condensible gas generation which could resultif core ddmage ocepts. ha ~esult of the fire PRA stuyes (Appendix 19M) the capability to control automatic deprenurization valves from the remote shutdown panel was improved. As a esult of the internal flood PRA studies, several improvements or additional design detad were developed to reduce the potential for internal flooding to pose a signiBeant t arcat.\ These additional features, which are shown in Tabic 19R.6-1 include the fc110wir, g: co6 denser bay water level sensors to terminate serious flooding in the l turbii e bui ding, control building Door water level sensors to terminate major potential \ 000 g so Arces; limitation on the circulating water pipe length to the ultimate heat sink limii the water volume which could be drained into the control building; and additional f our drains, sills and doors in the reactor building to prevent Goods from havmg sign ficant impact. Seve al of the key safety functions, previously performed manually were autd ated. I (5) ummary Probabilistic Risk Anessment studies conducted for the Advanced Bolling Water j Reactor during the certification effort provided valuable insights to plant performance d accident conditions. Although the studies indicated that the ufi der tranlient e ablished;goa ould be satisfiep, an ac independent water addidon system and a q 3mbustich turb e generator wqre adoed to the design to substantially reduce the probability of a s quence of events which leads to core damage. To reduce the potential ct psequences of a core damage event, should one occur, a panive means of Gooding the drywell with water and a passive containment over pressure relief system were added to th,e design. EPGs were alsoimproved to further enhance the capability to prevent i accidents fjom q ccuning and to mitigate subsequent consequences. The studi :s discuued abov: were conducted by examining the plant design and operation from uany different perspectives and thus arejudged to constitute a thorough search for designbnd procedure " vulnerabilities." No prescriptive attempt was made to denne the term vulnerabilides in this context,it being, judged the better approach to give engineers experienced in many disciplines a wide latitude in identifying weaknenes and then dealing with each issue as it was raised case by cue. potential 19.7.4 Conduct of the PRA Evaluations . I l e In addition the PRA was conducted in accor: lance with the Key Anumption and Groundrul)s developed under the Advanced LightWater Reactor Program This document was developed with input from many individuals experienced in PRA. 4
) 6 I
7
i m, - . s.ri; ,: e ..: At " O.u . . r,.' i ' ( i I, PRA nodels consisted of fauh trees and event trces as desenbed in the "PRA Procedures Guide" NUREG/CR.23(W). Detailed plant models included plant system and
) quipment and dependencies arising from common cause failure, human e: Tor and i uppdrt system failure, thus enabling potential vulnerabilities to be identlSed, p 9.7.5 Evaluation of Potential Design Improvements j I PRA techniques were itsed in the evahtation of whether there are additional i
p >tential design modincitions which would be cost beneficial to irnplement (Appendix { 19P; and in the technical support of the evaluadon of Severe Accident Mitigation Design ternatives (SAMDA) for compliance with the National Emironmental Protection Act NEPA). Evaluatic ns used the PRA event trees as a guide for estimating conservative { nc{ts frorb a varlety of potential modifications. I I I l l l
\
. : t i k l l \ i t, , k ( 1, i c i \ \ n i f i > l i
l.. i J. .. s \ l T ANSACTION REPORT > __,,,,,y, ,,,,, l RECEIVE 3
' O. DATE TINC .tBTiteTIOJ STATICr4 PO. DURATION HODE ftEtRLT l353l '
6C 16:53 4039d1193 9 0 05'10-
~
NORM.E OK 3 s o es to-i {l i
. 1
( f
\
j i - 1
. i
. I '
; o i'
i 1 ,
\
- t. l ,
I k f "
,}}