Text

Regulatory/Backfit Analysis for the Resolution of Unresolved Safety Issue A-44,STATION Blackout
	ML20155A652
Person / Time
Issue date:	06/30/1988
From:	Rubin A; Office of Nuclear Reactor Regulation, NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:	; Office of Nuclear Reactor Regulation
References
	REF-GTECI-A-44, REF-GTECI-EL, TASK-A-44, TASK-OR NUREG-1109, NUDOCS 8806100170
	Download: ML20155A652 (70)
	v • d • e

~ .

WUREG-1109 Regulatory /Backfit Analysis for the Reso.u: ion of Unresolved Safety ssue A-44, Station Blackout h.S. Nuclear Regulatory pommission

) office of Nuclear Regulatory Research Joffice of Nuclear Reactor Regulation

f. M. Rubin ska "'cw

% y 5 1

l l 610 800630 1109 R PDR

s -

NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the follc, wing sources:

1. The NRC Public Document Room,1717 H Street, N.W.

Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office, Post Office Box 37082, Washington, DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161 l

Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

l Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include NRC correspondence and internal NRC memoranda; N RC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices; )

! Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence, t

The following documents in the NUREG series are available for purchase from the GPO Sales l l Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and j NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federa! Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of N RC draf t reports are available free, to the extent of supply, upon written request to the Division of information Support Services, Distribution Section, U S. Nuclear Regulatory Commission, Washington, DC 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Mcryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the ,

American National Standards institute,1430 Broadway, New York, NY 10018.

l NUREG-1109 Regulatory /Backfit Analysis for the Resolution of Unresolved Safety Issue A-44, Station Blackout Manuscript Completed: March 1988 Date Published: June 1988 A. M. Rubin Office of Nuclear Regulatory Research Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555

,p >= "%,

s......-

ABSTRACT Station blackout is the complete loss of alternating current (ac) electric power to the essential and nonessential buses in a nuclear power plant; it results when both offsite power and the onsite emergency ac power systems are unavailable. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on ac power, the-consequences of a station blackout could be. severe. Because of the concern about the frequency of loss of offsite power, the number of failures of emergency diesel generators, and the potentia'1y severe consequences of a loss of all ac power, "Station Blackout" was designated as Unresolved Safety Issue (USI) A-44.

This report presents the regulatory /backfit analysis for USI A-44. It includes (1) a summary of the issue, (2) the recommended technical resolution, (3) alter-native resolutions considered by the Nuclear Regulatory Commission (NRC) staff, -

(4) an assessment of the benefits and costs of the recommended resolution, (5) the decision rationale, (6) the relationship between USI A-44 and other NRC programs and requirements, and (7) a backfit analysis demonstrating that the resolution of USI A-44 complies with the backfit rule (10 CFR 50.109).

NUREG-1109 iii

TABLE OF CONTENTS

.P_ag AB ST RAC T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii PREFACE............................................................. ... ix AC KNOW L E DG M E NT S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi EXECUTIVE

SUMMARY

....................................................... xiii 1 STATEMENT OF THE PR0BLEM........................................... 1 2 0BJECTIVES......................................................... 2 3 ALTERNATIVE RESOLUTIONS............................................ 2 3.1 Alternative (i)............................................... 2 3.2 Alternative (ii).............................................. 11 3.3 Alternative (1i1)............................................. 11 3.4 Alternative (iv).............................................. 11

3. 5 Alternative (v)............................................... 14 14 4 CONSEQUENCES.......................................................

4.1 Costs and Benefits of Alternative Resolutions................. 14 4.1.1 Alternative (1)........................................ 14 4.1.2 Alternative (11)....................................... 25 4.1.3 Alternative (111)...................................... 25 4.1.4 Alternative (iv)....................................... 26 4.1.5 Alternative (v)........................................ 26 4.2 Impacts on Other Requirements................................. 26 4.2.1 Generic Issue B-56, Diesel Generator Reliability....... 26 4.2.2 USI A-45, Shutdown Decay Heat Removal Requirements..... 27 4.2.3 Generic Issue B-23, Reactor Coolant Pump Seal Failures. 28 4.2.4 Generic Issue A-30, Adequacy of Safety-Related DC Power Supply........................................... 29 4.2.5 Regulatory Guide 1.108, Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems et Nuclear Power Plants................................ 29 4.2.6 Fire Protection Program for Nuclear Power Facilities... 29 4.2.7 Generic Issue B-124, Auxiliary Feedwater System Reliability............................................ 30 4.2.8 Multiplant Action Items B-23 and B-48, Degraded Grid Voltage and Adequacy of Station Electric Distribution Voltage................................................ 30 4.2.9 Severe Accident Program................................ 30 4.3 Constraints....................... ........................... 31 NUREG-1109 v

TABLE OF CONTENTS (Continued)

Page 5 DECISION RATIONALE................................................. 32 5.1 Commission's Safety Goals..................................... 33 5.2 Station Blackout Reports...................................... 35 5.2.1 NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants, Technical Findings Related to Unresolved Safety Issue A-44........................... 35 5.2.2 NUREG/CR-3226, Station Blackout Accident Analyses...... 37 5.2.3 NUREG/CR-2989, Reliability of Emergency AC Power Systems at Nuclear Power Plants........................ 38 5.2.4 NUREG/CR-4347, Emergency Diesel Generator Operating Experience, 1981-1983.................................. 38 5.2.5 NUREG/CR-3992, Collection and Evaluation of Complete and Partial Losses of Offsite Power at Huclear Power Plants........... ..................................... 39 6 IMPLEMENTATION................ .................. ................. 40 6.1 Schedule for Implementing the Final Station Blackout Rule..... 40 6.2 Relationship to Other Existing or Proposed Requirements....... 40 l

l 7 REFERENCES........ . . ............................................ 41 APPENDICES s

APPENDIX A BACKFIT ANALYSIS APPENDIX B WORKSHEETS FOR COST ESTIMATES FIGURES l

1 Schematic of electrically independent transmission line............ 9 2 Schem tic of two switchyards electrically connected (one-unit l site)... .................................... ..................... 10 l 3 Schematic of two switchyards electrically connected (two-unit l

site).................. . .... .. .... ........................ 10 4 Comparison of estimated station blackout core damage frequency before and after rule... .... ................ ............... ... 18 TABLES 1 Acceptable station blackout duration capability..... .............. 5 2 Emergency ac power configuration groups.......... .............. . 6 3 Offsite power design configuration groups...... ......... ... . ... 7 4 Definitions of independence of offsite power (I) groups....... .. . 8 5 Definitions of severe weather (SW) groups..... ....... ............ 12 NUREG-1109 vi

TABLE OF CONTENTS (Continued) t Page ,

1 TABLES (Continued) t 6 Definitions of severe weather recovery (SWR) groups. . . . . . . . . . . . . . . . 13 Definitions of extremely severe weather (ESW) groups. . . . . . . . . . . . . . . 13 7

8 Estimated number of reactors having similar characteristics........ 17 9 Examries of reduction in frequency of core melt per reactor-year... 17 10 Estimated costs for industry to comply with the resolution of USI A-44........................................................ 20 11 Discounted present value of avoided onsite property damage for 100 reactors....................................................... 21 12 Value-impact summary f or resolution of USI A-44. . . . . . . . . . . . . . . . . . . . 22 Implementation schedule for final station blackout rule. . . . . . . . . . . . 41 13 i

l l

i NUREG-1109 vii l

~

PRFFACE This report presents the supporting-value-impact analysis, backfit analysis, and decision rationale.for the resolution of USI A-44. The resolution itself con-sists of a _ rule that requires nuclear power plants to be able to cope with a station blackout for a specified period, and an associated regulatory guide that provides guidance on an acceptable means to comply with the rule. Thc NRC staff

'eport that provides data and technical analyses supporting the resolution of this issue is published separately as NUREG-1032. NRC contractor reports pub-lished under this task in the NUREG/CR series are listed and summarized in Section 5.2 of this report.

The Commission published a proposed station blackout rule in the Federal Register on March 21, 1986 (51 FR 9829) for public comment. In April.1986, the NRC published a regulatory guide on station blackout for comment (Regulatory Guide 1.155). Previously, in January 1986, NRC published a draft version of the present report (NUREG-1109) for comment. All public comments on this issue were reviewed and considered by the staff in formulating the final resolution of USI A-44 and this final version of NUREG-1109. Responses to the public com-ments are discussed in the supplementary information section of the Notice of Final Rulemaking for the Station R!ackout Rule, which is to be published in the Federal Register.

NUREG-1109 ix i

. ACKNOWLEDGMENTS The NRC staff members who provided the technical information anc'. analytical data necessary to prepare this report are gratefully acknowledged by the author.

Special thanks are due to Patrick Baranowsky, John Flack, and Erasmia Lois.

NUREG-1109 xi

EXECUTIVE

SUMMARY

This report provides supporting information, including a cost-benefit analysis and a backfit analysis, for the Nuclear Regulatory Commission's (NRC's) resolution of Unresolved Safety Issue (USI) A-44, "Station Blackout." The term "station blackout" refers to the complete loss of alternating current (ac) electric power to the essential and nonessential switchgear buses in a nuclear power plant.

Station blackout involves the loss of offsite power concurrent with turbine trip and the unavailability of the onsite emergency ac power system. Because many safety systems required fer reactor core decay heat removal and containtm t heat removal depend on ac power, the consequences of station blackout cou N be severe.

The NRC's concern about station blackout arose because of the accumulated ex-perience regarding the reliability of ac power supplies. In numerous instances emergency diesel generators have failed to start and run during tests conducted at operating plants. In addition, a number of operating plants have experienced a total loss of offsite electric power, and more such occurrences are expected.

In almost every one of these loss-of-offsite power events, the onsite emergency ac power supplies were available immediately to supply the power needed by vital safety equipment. However, in some instances, one of the redundant emergency power. supplies has been unavailable. In a few cases, there has been a complete loss of ac power, but during these events, ac power was restored in a short time without any serious consequences.

The issue of station blackout involves the likelihood and duration of the loss of offsite power, the redundancy and reliability of onsite emergency ac power systems, and the potential for severe accident sequences after a loss of all ac power. These topics were investigated under USI Task Action Plan A-44.* In addition to identifying important factors and Sequences that could lead to station blackout, the results indicated that actions could be taken to reduce the risk from station blackout events. The issue is of concern for both boil- ,

ing water reactors and pressurized water reactors.

The evaluation to resolve USI A-44 included deterministic and probabilistic analyses. Calculations to determine the timing and consequences of various accident sequences were performed, and the dominant factors affecting station blackout likelihood were identified. Using this information, simplified prob-abilistic accident sequence correlations were calculated to estimate the like-lihood of core melt accidents resulting from station blackout for different plant design, operational, and location factors. These quantitative estimates were used to give insights on the relative importance of various factors, and those insights, along with engineering judgment, were used to develop the resolution. Thus, the effects of variations in design, operations, and plant location on risk from station blackout events were used to reach a reasonably consistent level of risk in the recommendations developed.

The technical findings of these investigations are detailed in NUREG/CR-2989, NUREG/CR-3226, NUREG/CR-3992, NUREG/CR-4347, and NUREG-1032.

NUREG-1109 xiii

Although there are licensing requirements and guidance directed at providing reliable offsite and onsite ac power, experience has shown that there are practical limitations in ensuring the reliability of offsite and onsite emer-gency ac power systems. Analyses have shown that core damage frequency can be significantly reduced if a plant can withstand a total loss of ac power until either offsite or onsite emergency ac power ccn be restored.

Because there is no requirement that plants be able to withstand a loss of both the offsite and onsite emergency ac power systems, the resolution calls Gr rulemaking to require all plants to be able to cope with a station blackout for a specified duration. Regulatory Guide 1.155 on station blackout describes a method acceptable to the NRC staff for complying with the rule, and specifies guidance on providing reliable ac electric power supplies. Plants with an ali9ady low risk from station blackout are required to withstand a station blaciout for a relatively short period of time. These plants probably need few, if any, modifications as a result of the rule. Plants with a currently i higher risk from station blackout are required to withstand blackouts of a some-l what longer duration, and, depending on their existing capability, might require l modifications (such as increased station battery capacity or condensate storage tank capacity) to meet this requirement. The staff has determined that these l modifications are cost effective in terms of reducing risk to the public.

The general objectise of the resolution of USI A-44 is to reduce the risk of severe accidents associated with station blackout by making station blackout a relatively cmall contributor to total core damage frequency. Specific actions called for in the resolution include (1) maintaining highly reliable ac elec-tric power systems; (2) developing procedures and training to restore offsite and onsite emergency ac power should either one or both become unavailable; and (3) as additional defense in depth, ensuring that plants can cope with a station blackout for some period of time, based on the probability of occurrence of a station blackout at the site, as well as on the capability for restoring ac power for that site.

The method to determine an acceptable station blackout duration capability is presented in the regulatory guide. Applications of this guide result in deter-minations that plants be able to withstand station blackouts from 2 to 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months , depending on the plant's specific design and site related characteristics.

Licensees may propose durations different from those specified in the regulatory guide, based on plant-specific factors relating to the reliability of ac power systems.

The benefit from implementing the rule and the regulatory guide is a reduction in the frequency of core damage per reactor year due to station blackout and the associated risk of offsite radioactive releases. The risk reduction for 100 operating reactors is estimated to be 145,000 person rems.

The cost for licensees to comply with the requirements varies, dapending on the existing capability of each plant to c(pe with a station blackout, as well as the plant-specific station blackout duration determined. The costs accrue pri-n.arily to industry to assess the plant's capability to cope with a station l blackout, to develop procedures, to improve diesel generator reliability if the reliability falls below certain levels, and to retrofit plants with additional components or systems, as necessary, to meet the requirements.

NUREG-1109 xiv

The estimated total cost for 100 operating reactors to comply with the resolu-tion of USI A-44 is about $60 million. The average cost per reactor is esti-mated to be $600,000, ranging from $350,000 if only a station blackout assess-ment and procedures and training are necessary to a maximum of about $4 million if substantial modifications are needed, including requalification of a diesel generator.

The overall value-impact ratio, not including accident avoidance costs, is about 2,400 person-rems averted per million dollars. If cost savings from accident avoidance (cleanup and repair of onsite damages and replacement power) were included, the overall value-impact ratio would improve significantly to about 6,100 person-rems averted per million dollars.

Several NRC programs are related to USI A-44, including Diesel Generator Relia-bility (Generic Issue B-56), Reactor Coolant Pump Seal Failures (Generic Issue B-23), Safety-Related DC Power Supplies (Generic Issue A-30), and Shutdown Decay Heat Removal Requirements (USI A-45). These programs are closely co-ordinated within NRC and are compatible with the resolution of USI A-44.

NUREG-1109 xv

1

, REGULATORY /BACKFIT ANALYSIS FOR THE RESOLUTION OF UNRESOLVED SAFETY ISSUE A-44, STATION BLACK 0UT 1 STATEMENT OF THE PROBLEM "Station blackout" refers to the complete loss of alternating current (ac) electric power to the essential and nonessential switchgear buses in a nuclear power plant. Station blackout involves the loss of offsite power concurrent with turbine trip and the unavailability of the onsite emergency ac power sys-tem. Because many safety systems required for reactor core decay heat removal and containment heat removal depend on ac power, the consequences of station blackout could be severe.

, The concern of the Nuclear Regulatory Commission (NRC) about station blackout arose because of the accumulated experience regarding the reliability of a-power supplies. In numerous instances emergency diesel generators have 'aised to start and run during tests conducted at operating plants. In additiot number of operating plants have experienced a total loss of offsite elect power, and more occurrences are expected. In almost every one of these lo; of-offsite power events, the onsite emergency ac power supplies were availab.v immediately to supply the power needed by vital safety equipment. However, in some instances, one of the redundant emergency power supplies has been unavail-able. In a few cases, there has been a complete loss of ac power, but during these events, ac power was restored in a short time without any serious

consequences.

The results of the Reactor Safety Study (NUREG-75/014, formerly WASH-1400) showed that for one of the two plants evaluated, a station blackout accident could be an important contributor to the total risk from nuclear power plant 4 accidents. Although this total risk was found to be small, the relative impor-l tance of the station blackout accident was established. This finding and the accumulated diesel generator failure experience increased the concern about station blackout.

, The issue of station blackout involves the likelihood and duration of losses

of offsite power, the redundancy and reliability of onsite emergency ac power

. systems, cnd the potential for severe accident sequences after a loss of all ac

power. These topics were investigated under Unresolved Safety Issue (USI) Task

Action Plan A-44, and the technical findings are reported in detail in NUREG/

i CR-2989, NUREG/CR-3226, NUREG/CR-3992, NUREG/CR-4347, and NUREG-1032. In addi-l tion to identifying important factors and sequences that could lead to station blackout, the results indicated that estimated core damage

frequencies from l

Analysis has shown that for postulated station blackout events, the difference i between the estimated frequency of core damage and core melt is small because l of the relatively low probability of recovering ac power and terminating an i

accident sequence after initial core damage, but before full core melt l (NUREG-1032).

NUREG-1109 1 F

N

station blackout vary significantly for different plants but could be on the order of 10 4 per reactor year for some plants. To reduce this risk, action should be taken to resolve the safety concern stemming from. station blackout.

The issue is of concern for both pressurized water reactors (PWRs) and boiling water reactors -(BWRs).

There is no requirement currently for plants to be able to cope with a station blackout. Existing requirements for offsite and onsite ac power systems are in General Design Criterion (GDC) 17, "Electric Power Systems," of Appendix A to Part 50 of Title 10 of the Code of Federal Regulations (10 CFR 50). They are discussed in Sections 8.2, "Offsite Power Systems," and 8.3.1, "AC Power Sys-tems (Onsite)," of the NRC's "Standard Review Plan for the Safety Review of Nuclear Power Reactors" (SRP, NUREG-0800). Testing of emergency diesel genera-tors is discussed in Regulatory Guide (RG) 1.108, "Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants."

Separation and independence of electric power systems are discussed in RG 1.6, "Independence Between Redundant Standby (0nsite) Power Sources and Between '

Their Distribution Systems," and RG 1.75, "Physical Independence of Electric Systems." SRP Sections 8.3.1 and 9.5.4 through 9.5.8 discuss maintenance and design provisions for the onsite emergency diesel generators. These licensing l requirements and guidance are directed at providing reliable offsite and onsite I aC power, j Experience has shown that there are practical limits in ensuring the reliability of offsite and onsite emergency ac power systems. Analyses show that core damage frequency can be significantly reduced if a plant can withstand a total loss of ac power until either offsite or onsite emergency ac power can be restored.

2 OBJECTIVES The general objective of the requirements to resolve USI A-44 is to reduce the risk of severe accidents associated with station blackout by making station blackout a relatively small contributor to the average frequency of core damage for the total population of plants. Specific actions called for in the resolu-tion include (1) maintaining highly reliable ac electric power systems; (2) de-veloping procedures and training to restore offsite and onsite emergency ac power should either one or both become unavailable; and (3) as additional defense-in-depth, ensuring that plants can cope with a station blackout for some period of time based on the probability of occurrence of a station blackout at the site as well as on the capability for restoring power for that site.

3 ALTERNATIVE RESOLUTIONS In developing the resolution of USI A-44, the staff considered four specific alternative courses of action. These are discussed below.

I 3.1 Alternative (i)

To achieve the objectives stated in Section 2 above, the resolution of USI A-44 calls for specific guidance relating to the reliability of offsite and onsite emergency ac power systems, as well as a requirement that plants be able to cope with a station blackout for a specific duration. The recommendations to resolve this issue are summarized as follows:

NUREG-1109 2

. . _ . _ - ._ = _ . ._ -.

(1) The reliability of the onsite emergency ac power sources should be main-tained at or above specified acceptable reliability levels.

(2) Procedures and training should be developed to restore emergency ac power and offsite power using nearby power sources if the emergency ac power system and the normal offsite power systems are unavailable.

1 (3) Each nuclear power plant should be able to withstand and recover from a station blackout lasting a specified minimum duration. Regulatory .

Guide 1.155 entitled "Station Blackout"* provides a method for determin- ,

ing an acceptable plant-specific station blackout duration based on a comparison of a plant's characteristics to those factors that have been identified as the main contributors to risk from station blackout. These '

factors include: (a) the redundancy of onsite emergency ac power sources (number of sources available for decay heat removal minus the number needed for decay heat removal), (b) the reliability of onsite emergency ac power sources (usually diesel generators), (c) the frequency of loss of offsite power, and (d) the probable time to restore offsite power.

The frequency and duration of loss of offsite power are related to grid and switchyard reliability, historical weather data for severe storms, and the availability of nearby alternate power sources (e.g., gas tur-bines). The staff has concluded (NUREG-1032) that long-duration offsite power outages are caused primarily by severe weather (e.g. , hurricanes, torr,cdecc, ice storms).

(4) Each nuclear power plant should be evaluated to determine its capability to withstand and recover from a station blackout of a duration as deter-

mined in (3) above. This evaluation should include such considerations ,

as: l Verifying the adequacy of station battery power, condensate storage h tank capacity, and plant / instrument air for the duration of a station blackout. ,

Verifying the adequacy of reactor coolant pump seal integrity for the duration of a station blackout. This should be done by demonstrating, via experiment and/or analysis, that seal leakage due to a lack of seal cooling will not reduce the primary system coolant inventory to the degree that the ability to cool the core during station blackout

is lost.

Verifying that the equipment needed to operate during a station black- i i out and the recovery from the blackout will be able to operate under F l the environmental conditions associated with a total loss of ac power (i.e., loss of heating, ventilation, and air conditioning). ,.

l

Single copies of this guide may be obtained by writing to the Distribution Ser-vices, Division of Information Support Services, U.S. Nuclear Regulatory Com- i mission, Washington, DC 20555. t NUREG-1109 3 o

i L

(5) If the plant's station blackout capability (as determined in (4)) is significantly less than the minimum acceptable plant-specific station blackout duration determined in (3), modifications to the plant may be necessary to increase the time the plant is able to cope with a station blackout. The regulatory guide identifies specific factors to be consid-ered if such modifications are necessary.

(6) Each nuclear .ower plant should have procedures and training to cope with a station blackout and to restore normal long-term decay heat removal once ac power is restored.

Because there is no requiremert for plants to be able to withstand a loss of both the offsite and onsite emergency ac power systems, the resolution calls for rulemaking to require that all plants be able to cope with a station black-out for a specified duration. The regulatory guide describes a method acceptable to the NRC staff for complying with the rule, and specifies guidance on providing reliable ac electric power supplies. Plants with an already low risk from station blackout are required to withstand a station blackout for a relatively ,

short period of time. These plants probably need few, if any, modifications as 1 a result of the rule. Plants with currently higher risk from station blackout I are required to withstand blackouts of somewhat longer duration, and, depending i on their existing capability, may require modifications (such as increasing i station battery capacity or condensate storage tank capacity). The staff has !

determined that these modifications are cost effective in terms of reducing risk to the public.

The method to determine an acceptable station blackout duration capability, as presented in the regulatory guide, is summarized below. The guide specifles minimum acceptable blackout durations that a plant should be capable of sarviv-ing. The minimum duration is from 2 to 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months (see Table 1) depending on a plant's design and site-related characteristics. Most plants would fall in either the 4- or 8-hour group. Licensees may propose durations different from those specified in Table 1. Such proposals should be based on plant-specific factors relating to the reliability of ac power systems, such as those discussed in NUREG-1032, and would be reviewed by the NRC staff.

Tables 2 through 7 provide the necessary detailed descriptions and definitions of the various factors used in Table 1. Table 2 identifies different levels of redundancy of the onsite emergency ac power system used to define the emer-gency ac power configuration groups in Table 1. Table 3 provides definitions of the three offsite power design characteristic groups used in Table 1. The groups are defined according to various combinations of the following factors:

(1) independence of offsite power (1), (2) severe weather (SW), (3) severe weather recovery (SWR), and (4) extremely severe weather (ESW). The factors I, SW, SWR, and ESW are defined in Tables 4 through 7, respectively. After iden-tifying the appropriate groups from Tables 2 and 3 and the reliability level of the onsite emergency ac power sources, Table 1 can be used to determine the minimum acceptable station blackout duration capability (e.g, 4 or 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) for '

each plant. The reliable operation of the onsite emergency ac power sources should be ensured by a reliability program designed to monitor and maintain j reliability over time at a specified acceptable level and to improve the reli-ability if that level is not achieved.

NUREG-1109 4

Table 1 Acceptable statio capability (hours)gblackoutduration Offsite power design b characteristic group Maximum emergency diesel generator failure rate per demand P1 P2 P3 Emergencyac(EAC)poper configuration group A 0.025 2 4 4 0.05 2 4 8 EAC power configuration group B 0.025 4 4 4 0.05 4 4 8 EAC power configuration group C 0.025 4 4 8 0.05 4 8 16 EAC power configuration group D 0.025 4 8 8 a

The staff will consider variations from these times if justification, including a cost-benefit analysis, is provided by the licensee. The methodology and sensitivity studies in NUREG-1032 are acceptable for this justification.

b See Table 3 to determine groups P1, P2, and P3.

c See Table 2 to determine emergency ac power config-uration group.

Note: Consistent with Table 2 of Regulatory Guide 1.155.

NUREG-1109 5

P .j Table 2 Emergency ac power configuration groupsa j No. of EAC power sources ,

Emergency ac (EAC) required to operate ac-power configuration No. of EAC powerede decay heat removal -

group power sources b systems d y A 3 ;

4 1 B 4 2 .

5 2 d

C 2 1 8

3 1 D 2 1 3 2 4 3 5 3 a

Special purpose dedicated diesel generators, such as those asso- '

ciated with high pressure core spray systems at some BWRs, are ,

not counted in the determination of EAC power configuration groups.

b If any of the EAC power sources are shared among units at a multi-unit site, this is the total number of shared and dedicated sources ,

for those units at the site. '

c This number is based on all the ac loads required to remove decay [

heat (including ac powered decay heat removal systems) to achieve ;

and maintain safe shutdown at all units at the site with offsite '

power unavailable.

l d

For EAC power sources not shared witn other units.

'For EAC power sources shared with another unit at a multiunit site.

I For shared EAC power sources in which each diesel generator is capable of providing ac power to more than one unit at a site i concurrently.

Source: Regulatory Guide 1.155, Table 3. l l

l l

NUREG-1109 6

\

i

,_ . _ . . . _ _ _ _ . _ _ , _ ~ ____.

Table 3 Offsite power design characteristic groups Group Offsite power design characteristics P1 Sites that have any combination of the following factors:

c d la ggb SWR ESW 1 or 2 1 or 2 1 or 2 1 or 2 1 or 2 1 1 or 2 3 1 or 2 3 1 1 or 2 P2 All other sites not in group P1 or P3.

P3 Sites that have experienced, or could be expected to experience, a total loss of offsite power resulting from grid failures at a frequency equal to or greater than once in 20 site years, unless the site has pro-cedures to recover ac power from reliable alternate (nonemergency) ac power sources within approximately 1/2 hour following a grid failure.

EI Sites that have any combination of tne following factors:

I SW SWR ESW Any I 5 2 Any ESW Any I 1,2,3, or 4 1 or 2 5 Any I 5 1 Any ESW Any I 4 2 1,2,3, or 4 1 or 2 3 2 4 3 3 2 3 or 4 a See Table 4 for definitions of independence of offsite power (I) groups.

bSee Table 5 for definitions of severe weather (SW) groups.

cSee Table 6 for definitions of severe weather recovery (SWR) groups.

dSee Table 7 for definitions of extremely severe weather (ESW) groups.

Source: Regulatory Guide 1.155, Table 4.

NUREG-1109 7

Table 4 Definitions of independence of offsite power (I) groups I

Category 1 2 3

1. Independenee of offsite 1. AU offsite power sources are i.a. AU off sste power sources are connected to the

. power sources connected to the plant plant through one switchyard.

through two or more switchyards or separate OR incomsng transmission lines, but at least one of 1.b. AU offsite power sources are connected to the the ac sources is electrze Uy plant through two or more switchyards.and tndependent of the others. the switchyards are electrically connected.

(The independent 69-LV iThe 345.and lJrs LV switehyards in Figures line in Figure I is 2 and 3 represent this design feature.)

representative of this design feature.)

OR AND AND

2. Automatic and manual 2.a. After loss of the normal ac 2.a. After loss of the normal 2.a. If the normal transfer schemes for the sou rce. ac power source, there 25 source of ac Class IE buses when the an automatic transfer of power fails. there normal source of ac power (1) There is an automatie au safe shutdown buses are no automatic fails and when the back. transfer of all safe- to one preferred alter- transfers and up sources of offsite shutdown bu es to nate power source. If one or more power fail, a separate preferred this source fails, there manual transfen alternate power source, may be one or more of au safe shut.

a. The normal source of manual trarafen of down buses ac power is assumed (2) There is an automatic power source to the to prefened or to be the urut main transfer of au safe. remaining preferred alternate off-generator, shutdown buses to one or alternate offsite site power preferred power source. power sources. sources.

If this preferred power source faals, there is OR another automatic transfer to the There is one auto-rem:2ntng matic transfer preferred power and no manual sources or to alter. transfer of au nate offsate power safe shutdeu n source. buses to one prefened or one alternate.

OR OR

b. If the Class IE buses 2.b. Each safe shutdown bus is 2.b. The safe shutdo*n buses are are normauy designed normauy connected to a normauy aligned to the same to be connected to the separate preferred alter- preferred power source with prefened alternate nate power source with either an automatic e' manual power sources. automatic or manual transfer to the terret tg transfer capability prefened alternate ac power between the preferred source.

alternate sources Source: Regulatory Guide 1.155 Table 5 NUREG-1109 8 l

iL di di h h 69 kV 161 kV 345 kV I

MM%% y NMM% MMNM M%MM NMMM^UTOgjiCggug N%MM 7pAu p MAIN

-- -----+

GENERATOR If II 1p if AUTOMATIC qp p NC NC NO NO TRANSFER CLASS 1E NONSAFETY CLASS 1 E NONSAFETY l [_ AUTOMATIC TRANSFER h,f I I

(, AUTOMATIC TRANSFER _ j Figure 1 Schematic of electrically independent transmission line NUREG-1109 9

a a n a o a n a a

E E

lH5kV iss kv g

E l

nn l we se sa as .

AAAA AAAA l o o u o u o !

NC NC NONSAFETY NO NONSAFETY NO I MAIN CLASS 1E CLASSlE CLASS 1E CLASS 1 E GENERATOR DIVISION 1 OlVISION 2 OlvlSION 1 DIVislON 2 I e

' 4 l 4 l i. - ^uyOuA_Tig T R ANSr.y R, _ _ q _ _ _ _ _ _ _ _ _ ;

L--_ _^T2*3 TLC La^NS,f E3 _ _ _ _ _ j j

l Figure 2 Schematic Of two Switchyards electrically connected (One-unit site)

I n h a h h l I:

500 kV ll 230 kV i:

.+-

MM i

f MMMM MM MM MM MM MMMM GENERATOR 2 0 0 if y if U if if NC NC NCTO NC TO NC TO NC TO NC NC GENERATOR 1 NONSAFETY SOME SOME SOME SOME NONSAFETY UNIT 2 UNIT 2 UNIT 2 UNIT 1 UNIT 1 UNIT 1 CLASS 1E CLASS 1E CLASS 1E CLASS 1E BUSES. BUSES, BUSES, SUSES, NO TO NOTO h0 TO NO TO OTHERS OTHERS OTHERS OTHERS Figure 3 Schematic of two switchyards electrically connected (two-unit site)

NUREG-1109 10

One example of an application of this method considers a nuclear power plant that has (1) two diesel generators, one of which is required for ac power for decay heat removal systems; (2) one switchyard and one alternate offsite power circuit, in addition to the normally energized offsite circuit to the Class 1E buses; (3) an estimated frequency of loss of offsite power due to severe weather of 0.005 per site year; and (4) an annual expectation of storms at the site with winds greater than 125 miles per hour of 0.002 per year. On the basis of this information, this plant is independent of offsite power group 13 (see Table 4),

severe weather group SW2 (see Table 5), severe weather recovery group SWR 2 (no enhanced recovery for severe weather, Table 6), and extremely severe weather

)up ESW3 (see Table 7). This combination of factors places the plant in off-site power design characteristic group P2 (see Table 3). Based on the number of diesel generators, the plant is in emergency ac power configuration group C, As indicated on Table 1, if the failure rate of each emergency diesel generator is maintained at 0.025 failure per demand or less, this plant should have the capability to withstand and recover from a station blackout lasting 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or more. If the failure rate of each emergency diesel generator were between 0.025 and 0.05, the acceptable station blackout duration would increase to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

If the emergency diesel generator failure rate were greater than 0.05, then steps should be taken to improve the diesel generator reliability.

3. 2 Alternative (ii)

Alternative (ii) would treat plants uniformly by requiring all plants to be able to cope with station blackout of the same duration.

3.3 Alternative (iii)

Alternative (iii) would require plants with the highest potent'.31 risk f rom sta-tion blackout to add either an additional emergency diesel generator or another ac-independent decay heat removal system.

3.4 Alternative (iv)

The Nuclear Utility Management and Resources Committee (NUMARC) endorsed the following industry initiatives to resolve the station blackout issue (letter from J. H. Miller, Jr. , to N. J. Palladino, June 17, 1986):

1. Each utility will review its site (s) against the criteria speci-fied in NUREG-11C9, and if the :.ite(s) fall into the category of an eight-hour site after utilizing all power sources available, the utility will take actions to reduce the site (s) contribution to the overall risk of station blackout. Non-hardware changes will be made within one year. Hardware changes will be made within a reasonable time thereafter.

2. Each utility will implement procedures at each of its site (s) for:

a. coping with a station blackout event,

b. restoring ac power following a station blackout event, and I

NUREG-1109 11

Table:S Definitions of severe weather (SW) groups Estimated frequency of loss of offsite power due SW group. to severe weather, f* (per site year) 1 ~f < 3 x 10'

.4 .3 2 3 x 10 $ f < 1 x 10

.3 .3 3 1 x 10 $ f < 3 x 10

.3 .2 4 3 x 10 5 f < 1 x 10

.2 5

1 x 10- 5f

The estimated frequency of loss of offsite power due to severe weather, f, is determined by the following equation:

f = (1.3 x 10 4)h + (b)h2 + (0.012)h3 + (c)h 4 3

where h3 = annual expectation of snowfall for the site, in inches h2 = annual expectation of tornadoes (with wind speeds greater than or equal to 113 miles per hour (mph)) per square mile at the site b = 12.5 for sites with transmission lines on two or more rights-of-way spreading out in dif ferent

directions from the switchyard, or b = 72.3 for sites with transmission lines on one right-of-way h3 = annual expectation of storms at the site with wind velocities between 75 and 124 mph h4 = annual expectation of hurricanes at the site c = 0 if switchyard is not vulnerable to the effects of salt spray c = 0./8 if switchyard is vulnerable to the effects of salt spray i

The annual expectation of snowfall, tornadoes, and storm 3 may be.obtained from National Weather Service data from the weather station nearest the plant or by interpolation, if appropriate, between nearby weather stations. The basis for the empirical equation for the. frequency of loss of offsite power due to severe weather, f, is given in NUREG-1032, Appendix A.

Source: Regulatory Guide 1.155, Table 6.

NUREG-1109 12

p E

, Table 6 -Definitions of severe weather recovery (SWR) groups SWR _ group Definition 1 Sites with enhanced recovery (i.e., sites that have.the capability and procedures for restor-ing offsite (nonemergency) ac power to the site within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following a loss of offsite power due to severe weather).

2. Sites without enhanced recovery.

Source: Regulatory Guide 1.155, Table 7.

Table 7 Definitions of extremely severe weather (ESW) groups Annual expectation of storms at a site with wind velocities equal to or greater than 125 miles ESW group per hour (e)*

1 e < 3 x 10 4 2 3 x 10 4 5 e < 1 x 10 3 3 1 x 10 3 5 e < 3 x 10 3 4 3 x 10 3 5 e < 1 x 10 2 5 1 x 10 2 3e

The annual expectation of storms may be obtained from Na-tional Weather Service data from the weather station nearest the plant or by interpolation, if appropriate, between nearby weather stations.

Source: Regulatory Guide 1.155, Table 8.

c. preparing the plant for severe weather conditions, such as hurricanes and tornados to reduce the likelihood and consequences of a loss of offsite power and to reduce the overall risk of a station blackout event.

3. Each utility will, if applicable, reduce or eliminate cold fast-starts of emergency diesel generators for testing through

' changes to technical specifications or other appropriate means.

4. Each utility will monitor emergency ac power unavailability utilizing data utilities provided to INP0 (Institute of Nu-clear Power Operations) on a regular basis.

These initiatives include some of the same elements that are included in the staff's resolution discussed in Section 3.1. However, the industry initiatives NUREG-1109 13

. . , - . . _ , . . _ _ . _ ._ ~

(1) do not include rulemaking, (2) do-not require plants to be able to withstand a station blackout for a specified period of time, and (3) do not require any specific assessment of a plant's station blackout coping capability.

3. 5 Alternative (v)

Under this alternative no action would be taken.

4 CONSEQUENCES 4.1 Costs and Benefits of Alternative Resolutions 4.1.1 Alternative (i)

The benefit from implementing the station blackout rule and regulatory guide is a reduction in the frequency of core damage due to station blackout and the associated risk of offsite radioactive releases. The costs are primarily those incurred by industry (1) to assess the plant's capability to cope with a station blackout, (2) to develop procedures, (3) to improve diesel generator reliability if the reliability falls below certain levels, and (4) to retrofit plants with additional components or system, as necessary, to meet the requirements. These are discussed in the following paragraphs.

(1) Value: Risk Reduction Estimates To estimate the chang in expected risk that the resolution of USI A-44 could effect, both the postulated radioactive exposure (in person-rems) that would result in the event of an accident and the reduction in frequency of core damage have been estimated. A simplified method to estimate public dose for value-impact analysis would use an "average" plant to estimate the consequences of station blackout and subsequent core damage for all plants. However, using a single value does not account for the differences in offsite consequences asso-ciated with differences in the sizes of reactors and with differences in the population densities around different sites.

Because of the differences between sites and plant designs, it wa., not realistic to select a "typical" plant for analysis (using the value and imnacts for that plant and then multiplying them by the total number of plants) to obtain an overall value-impact ratio. Instead, the staff used the method described below to estimate offsite consequences for use in this value-impact analysis. Results indicate that consequences range from 0.5 to 9 million person-rems per plant, ,

with an average of about 2 million person-rems per plant. l NUREG/CR-2723 gives estimates-of offsite consequercas of potential accidents at nuclear power plants. That report includes resul a of calculations for 91 sites in the United States that had reactors with operating licenses or construction permits. The actual distributions of population around the sites were used in calculating estimated total population doses (in person-rems) for various fission product releases. The results include a scaling factor to account for different reactor power levels at the various sites.

NUREG-1109 14

l The scaled results (from NUREG/CR-2723) for release category SST1* (siting source term) were used to develop estimites of site-specific consequences for station blackout events. However, these results were not used directly in the value-impact analysis for several reasons. First, SST1 overestimates the fission product release for station blackout events. Second, the consequences given in NUREG/CR-2723 include the entire population around the plant (i.e., an infinite radius), whereas Enclosure 1 of NRR Office Letter No. 16 (NRC, May 13, 1986) specifies that a 50-mile radius around the plant is to be used to calculate risk reduction estimates for value-impact analyses, j Extensive research efforts by NRC and industry have been under way since about-1981 to evaluate severe accident source terms and are reported in NUREG-0956, NUREG-1150, NUREG/CR-4624, and Industry Degraded Core Rulemaking (10COR) tech-nical reports. Based on NRC's source term research, it appears that, for sta-tion blackout events, the release fractions for most plants would be roughly 1/3 to 1/30 of the releases from the SST1 estimate. One reason for this reduc-tion is that SST1 is an estimated upper bound assuming prompt containment failure; whereas if a core melt resulted from station blackout, containment failure would ,

be delayed for a number of hours. Results of a sensitivity study in which the consequences of a severe accident were estimated for reduced source terms indi-cate that if the SST1 release fraction were reduced by a factor of 3 (i.e.,

66 percent reduction in SST1 releases), the consequences in terms of person-rem would be reduced by about 50 percent (NUREG/CR-2723, Table 10). Likewise, if the SST1 releases were reduced by a factor of 30 (i.e., 97 percent reduction in SST1 releases), the estimated person-rem would be reduced t7 about 85 percent.

Therefort, the high and low estimates for person-rem consequences for station blackout accidents used in this value-impact analysis are 0.5 and 0.15 of the person-rem associated with SST1 releases, respectively. (These values correspond to reductions in SST1 release fractions by factors of 3 and 30, respectively.)

A value of 0.33 of the SST1 person-rem was used as a best estimate for purposes of this analysis.

Scaling factors comparing offsite exposures within a 50-mile radius of a plant to that for an infinite radius are included in Table 3 of a Sandia letter report (1983). The total person-rem exposure within a 50-mile radius is approx-imately 1/4 the person-rem exposure for an infinite radius. This factor, in addition to the factor discussed above associated with reduced source terms, was used to scale the site-specific results from NUREG/CR-2723.

To clarify the discussion above, an example calculation is given for an 845-MWe PWR (Calvert Cliffs). From Appendix A of NUREG/CR-2i23, the mean offsite effect conditional on release for the SST1 category is 3.61 x 10 7person-rems. This number is multiplied by 0.33 to account for the smaller releases for station blackout events compared to SST1 releases and by 0.25 to account for the 50-mile

l. radius (Sandia, 1983). The resulting offsite exposure from a station blackout event and subsequent core melt within a 50-mile radius of the plant is estimated to be about 3 million person-rems.

t *Five release categories, denoted as SST1-SSTS, have been defined by NRC to represent a spectrum of five accident groups. Each category represents a different degree of core degradation and failure of containment safety features.

! Group 1, SST1, is the most severe and involves a loss of all installed safety features and direct breach of containment.

NUREG-1109 15 i

1 L

- . - - ~ * - , , , ~ . . .-. _ _ _ . . , _ . . . _ . -- . _ _ _ , _ _ .-. .__c -__m.___ . _ , . m.__ - . _ _. _ ~.-

I The reduction in frequency of core damage resulting from the resolution of USI A-44 was estimated for each plant. Plant- and site-specific characteristics for a total of 100 reactors (which represent almost all of the currently operat-ing nuclear power plants) were used to develop these estimates. Table 8 presents an estimate of the number of reactors having the emergency ac power configurations and_offsite power design characteristics identified in Tables 2 and 3, respec-tively. The estimate of core damage frequency for each plant was based on a function of the plant's ability to cope with a station blackout (NUREG-1032).

The staff assumed that all plants, as currently desi,ned, can cope with a sta-tion blackout for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The reduction in core damage frequency per reactor-year for~each plant then was estimated based on the plant meeting the accept-able 2 , 4 , or 8-hour station blackout duration depending on the plant's offsite power design group and its emergency ac power configuration (given in Table 1).

Examples of the reduction in frequency of core damage per reactor year for three cases are presented in Table 9. Each of these examples is for a plant located in an area with average ?oss of offsite power duration and frequency. The first example is typical of a plant with one redundant emergency ac power system (e.g.,

one out of two diesel generators required for emergency ac power), and a failure rate of 0.025 failure per demand for each diesel generator. The second case, which is typical of a plant with less desirable characteristics from a station blackout perspective (e.g., a minimum redundant emergency ac power system and below-average diesel generator reliability), has a reduction in frequency of l core damage that is significantly larger than the first example. The third case is for plants with more favorable characteristics than in the first case and. therefore, a correspondingly lower reduction in core damage frequency.

A summary of the results of the analysis for station blackout core damage fre-quency astimates is presented in Figure 4. This figure cresents a comparison of the estimated number of reactors versus various levels of core damage frequency before and after implementation of the station blackout rule. The histogram that represents estimates before the rule is impiemented is based on the assunip-tion that all plants have the capability to cope with station blackout for only 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The estimated mean core damage frequency for this case is 4.2 x 10 5 per reactor year, with a range of from about 0.4 x 10 5 to 30 x 10 5 per reactor-year. The mean core damage frequency for all plants after the rule is implemen-ted is estimated to be 1.6 x 10 5 per reactor year with a range of 0.3 x 10 6 to 7 x 10 5 per reactor year. Therefore, on an industry-wide basis, the estimated mean core damage frequency would be reduced by 2.6 x 10 5 per reactor year.

For each plant, the estimated risk reduction from the resolution of USI A-44 was calculated by multiplying the reduction in core damage frequency per reactor-year by two factors: (1) the remaining life of the plant (assumed to be 25 years) and (2) the estimated public dose (in person-rems) that would result in the event of an accident. The reduction in person-rems for each plant was then summed to calculate the total estimated risk reduction. The high estimate of total dose reduction (on SST1 releases divided by 3) is 215,000 person rems, the low estimate (based on SST1 releases divided by 30) is 65,000 person-rems, and the best estimate is 143,000 person-rems (based on SST1 releases divided by 10).

NUREG-1109 16

Table 8 Estimated number of reactors having similar characteristics Emergency ac power configuration group

Group A B C D Total Estimated number 12 25 47 16 100 of reactors Offsite power design characteristics **

Characteristic P1 P2 P3 Total Estimated number 30 60 10 100 of reactors

See Table 2 for definition of emergency ac power con-figuration groups.

- See Table 3 to determine offsite power design charac-teristics.

Table 9 Examples of reduction in frequency of core damage per reactor year Estimated core damage Estimated reduction in Plant frequency per core damage frequency characteristics reactor year per reactor year Plant with one of two 3.9 x 10 5 with 2-hour 2.1 x 10 5 emergency diesel generators station blackout (EDGs); EDG failure rate of capability 0.025 failure per demand; 1.8 x 10 5 with 4-hour

and loss of offsite, power station blackout design characteristic c.apability group P2.

Plant with two out of three 9.0 x 10 5 with 2-hour 8.4 x 10 5 EOGs; EDG failure rate of station blackout 0.05 failure per demand; and capability loss of offsite power design 0.6 x 10.s with 8-hour

characteristic group P2. station blackout capability Plant with one out of three 1.0 x 10 5 with 2-hour 0.6 x 10 5 EDGs; EDG failure rate of station blackout 0.025 failure per demand; capability and, loss of offsite power 0.4 x 10 5 with 4-hour

design characteristic station u'ackout group P2. capability

These times are the acceptable station blackout durations from Table 1 for these example cases.

NUREG-1109 17 I

i _ _ ____ - _ _ _ _ _ _ _ _ _ _ . l

Z C

o rvi .

in a

w H

O to NUMBER OF REACTORS NUMBER OF REACTORS m

D i f $ $

0.5 <-lSi"sis"' ' " " ' 555555'9 si555555999"esssisssi 0.5 <-:iss' sist el

, g_

g 0.5 - 0.99-E cs g 0.5 - 0.99 - : M+ '~ 1 [9 mn y --

-4 x 2 1.0 -1.49 -:i'isississxssswssssss,4ss 'isi 7 1.0 -1.49 - ' '

'il g

y g 1.5 - 1.99- - -

, g a g g 1.5 - 1.99 -M 't'M e l S ,7 0 o 2,0 2.49 -M-Wiw1 - - - - - - - - - - ' -

P>

mz L9y 0 O 2.0 -2.49 -ississMiiMisissi ' ism

@o r "

x z 2 O 3

o 2.5 - 2.99 - o 2.5 -2.99 -E

" "' < i l -n e

o > .Om o o n >

%% I 3.0 -3.49 -sii "es ] o, e I 3.0 -3 49 -N iisss' ';ws' m;]

s s > m , >

C c+

0 n

3 .5- 3.99 - J "' i' i h 4

0 3.5 -3.99 - ' .]

y *y h 4.0 - 4.49 -9 h'" 4.0 - 4.49 1.m.. -1 - - - - - - - - - - ]g

~

g O c+ b z 4 .5 - 4.99 - 3, h 4.5 - 4.99 -E $

m u ,

b OM 5.0 - 5 49 -g ~

g 5.0 - 5 49 -] {o x r- x o C C$c+ g 5.5 - 5.99 -

1 3 5.5- 5.99 -Q I N s m t7 s.

to o ,

m 6.0 6.49 -

mm 6.0 - 6.49 -3 y

%3 M

>2 o 2 6.5 6.99 - " 6.5 - 6.99 -O =wo 1 c- 2 , - " ,- EM

[ S n 7 .0-7.99 -3 7.0- 7.99 -E wn --e -4 x 3 w o o 07

c. o m n>

C k N" Y %6 m&

m

> g >@

?I eC

-1 cn 10.0-14.9 - 10014.9-

%s%sEsp1 3 =

o 15 15 - 20 x TU O C '

m N 30 3

(2) Impacts: Cost Estimates The cost for licensees to comply with the requirements to resolve USI A-44 will vary depending on (1) the existing capability of each plant to cope with a sta-tion blackout and (2) the plant-specific acceptable minimum station blackout coping duration as determined from Table 1. The staff anticipates that the ma-jority of plants would be able to meet a 4-hour duration guideline without major hardware modifications. In addition to being able to withstand a 4-hour black-out, some plants may be capable of coping for longer periods without major modi-fications. To meet an 8-hour guideline. licensees of some plantsstation may have to batteries, increase the capacity of one or more of the following systems:

condensate storage tank, and instrument or compressed air. Shedding nonessential loads from the station batteries could be considered a:, an option to extend the time until battery depletion. Corresponding procedures for load shedding would need to be incorporated in the plant-specific technical guidelines and emergency operating procedures for station blackout.

If equipment needed to function during a station blackout or the recovery from a blackout would not be expected to be operable because of environmental con-ditions associated with the station blackout (i.e., without heating, ventilat-ing, and air conditioning systems operating), then some modifications might be necessary. These could be (1) opening room or cabinet doors to increase natu-ral circulation, (2) installing fans that can operate with available power sup-plies to increase forced circulation, or (3) relocating or replacing equipment.

If modification 2 or 3 (above) were necessary, then corresponding procedures would need to be incorporated in the plant-specific technical guidelines and emergency operating procedures for station blackout.

Those plants that cannot verify adequate reactor coolant pump seal integrity for the station blackout duration may have to provide a method of reactor coolant pump seal cooling that is independent of the offsite and emergency onsite ac power supplies to maintain seal integrity and adequate reactor coolant inventory.

For example, the addition of an ac-independent charging pump or a steam-driven generator to power an existing charging pump could provide seal cooling during a station blackout.

Table 10 presents cost estimates of possible hardware modifications and pro-cedures that could result from implementation of the station blackout rule.

Because the duration guidelines in the station blackout regulatory guide are based on plant-specific features, and the capability of systerrs and components needed during a station blackout varies from plant to plant, the modifications in Table 10 may be needed at some but not all nuclear power olants. For each modification, the table identifies an estimated range of costs per plant, the estimated number of plants needing that modification, and the estimated total cost.

The estimated total cost for industry to comply with the resolution of USI A-44 is about $60 million. The estimated average cost per reactor is $600,000.

Best estimates of costs could range from $350,000, if only a station blackout assessment and procedures and training were necessary, to a maximum of about

$4 million, if modifications 1 through 4 were needed (including requalification of a diesel generator).

NUREG-1109 19

E

=

9 Table 10 Estimated costs for industry to comply with the resolution of USI A-441 U

8 Est. cost per Est. no. reactor ($1000) Est. total cost ($1000) of reactors Potential needing Best High Low Best High Low modifications modifications est. est. est. est. est. est.

1. Assess plant's capability to cope with 100 250 400 290' 25,000 40,000 20,000 station blackout

2. Develop procedures and training 100 100 150 50 10,000 15,000 5,000

3. (a) Improve diesel generator reliability 10 250 400 150 2,500 4,000 1,500 (b) Requalify a diesel generator 2 2,800 5,500 1,250 5,600 11,000 2,500 4 Increase capability to cope with station blackout 2 (a) 4-hour plants add battery capacity 10 500 650 400 5,000 6,500. 4,000 l

(b) 8-hour plants 17 l N (1) Add compressed air 40 60 30 680 1,020 510 (2) Add condensate storage tank 80 150 40 1,360 2,550 680 capacity (3) Add battery capacity 500 650 400 8,500 11,050 6,800 (4) Replace equipment or add fans 80 140 30 1,360 2,180 510 Subtotal (8-hour plants) 700 1,000 500 11,900 17,000' 8,500 .

5. Add an ac-independent chat ging pump --

1,500 2,5004 1,200 -- -- --

(non-seismic) capable of delivering 50 to l 100 gpm to reactor coolant pump seals 3 TOTAL COSTS 60,000 93,500 41,500 I 2

Based on 100 reactors. See Appendix B for worksheets that provide the basis for the cost estimates on this table.

2 Detailed cost estimates for these modifications are presented in NUREG/CR-3840 and revised estimates to that report (Science and Engineering Associates, 1986).

3 It is assumed that reactor coolant pump seal integrity is sufficielt to ensure core cooling for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or more; therefore, the charging pump would not be necessary. The results of Generic Issue ".-23 will provide detailed information on expected pump seal behavior without seal cooling. (See Section 4.2 for further discussion.)

Estimated costs are provided here for perspective should such a system be considered necessary af ter Generic Issue B-23 results are available.

4A seismically qualified and safety grade ac-independent charging pump would be much more expensive and would not reduce the risk substar.tially more than a non-seismic pump.

l Including costs of averted plant damage can significantly affect the overall cost-benefit evaluation. To estimate the costs of averting plant damage and cleanup, the reduction in accident frequency was multiplied by the discounted onsite property costs. The following equations from NUREG/CR-3568 were used to make this calculation:

V = NAFU gp U = C/m [(e -rt i)/r4 [1 - e -r(t -tf )K g 1-e-rm) where V = value of avoided onsite property damage gp N = number of affected facilities = 100 AF = reduction in accident frequency = 2.6 x 10 5/ reactor year U = present value of onsite property damage C = cleanup and repair costs = $1.2 billion m = period of time over which damage costs are paid out (recovery period in years) = 10 t = years remaining until end of plant life = 25 f

t = years before reactor begins cperation = 0 r = discount rate = 5% and 10%

Using the above values, the present value of avoided onsite property damage is estimated to be $19 million. If avoided costs for replacement power are included (estimated in NUREG/CR-3568 to be $1.2 billion over 10 years), the estimated present value is $38 million. Table 11 summarizes the discounted present value of avoided onsite property damage for 10% and 5% discount rates.

Table 11 Discounted present value of avoided onsite property damage for 100 reactors Discounted present value Avoided damage 10% discount rate 5% discount rate Cleanup and repair only $19 x 10 8 $40 x 10 6 Cleanup, repair, and $38 x 106 $80 x 106 replacement power

}

(3) Value-Impact Ratio Table 12 summarizes the total benefits and costs associated with the resolution of USI A-44. These include (1) public risk reduction due to avoided offsite releases associated with reduced accident frequencies; (2) increased occupational dose from implementation, and operation and maintenance activities, as well as reduced occupational exposure from cleanup and repair because of lower accident frequency; (3) industry costs for implementation of modifications, operation NUREG-1109 21

Table 12 Value-impact summary for resolution of USI A-44 Dose reduction (person-rems) Cost ($1,000 Best High Low Best High Low Parameter est. est. est. est. est. est.

Public health 143,000 215,000 65,000 Occupational, exposure (accidental) 1,500 1,500 1,500 Occupational exposure (routine)b NA Industry implementation 60,000 93, tM0 44,500 HRC implementation c 1.500 1,500 1.500 f

Total 144,500 216,500 66,500 61,500 95,000 0 ,000

]

d Value-impact ratio 2,400 5,000 70C (Public dose reduction divided by sum of NRC and industry costs (person-rems /$106))

a Based on an estimated occupational radiation dose of 20,000 person-rems for post-accident cleanup and repair activities (NUREG/CR-3568).

No significant increase in occupational exposure is expected from operation and maintenance or implementing the recommendations proposed in this resolution.

Equipment additions and modifications contemplated do not require significant work in and around the reactor coolant system and therefore would not be expected to result in significant radiation exposure. NA = not affected, c

Based on an estimated 175 person-hours per reactor for NRC review (NUREG/CR-3568).

d This does not take into account the additional benefit associated with avoided plant damage costs or replacement power costs resulting from reduced frequency of core damage. The cost for plant cleanup following a core damage accident is !

estimated to be $1.2 billion, and replacement power is estimated to cost about

$500,000 per day (NRC, May 13, 1986). The estimated discounted present value of these avoided onsite costs is given in Table 11.

1 1

NUREG-1109 22

and maintenance, and increased reporting requirements; and (4) HRC costs for review of industry submittals.

The estimated total cost for industry to comply with the proposed rule is

$60 million. The total public risk reduction for 100 reactors over the remain-ing life of the plants is about 145,000 person-rems. The overall value-impact ratio, not including onsite accident avoidance costs, is about 2,400 person-rems averted per million dollars. If cost savings to industry from accident avoid-ance (cleanup and :epair of onsite damages and replacement power) were included, the overall value-impact ratio would improve significantly. At a 10% discount rate, the present value of avoided cleanup, repair, and replacement power is approximately $38 million. If this benefit were taken into account, the overall value-impact ratio would be about 6,100 person-rems averted per million dollars.

For any particular plant, the value-impact ratio could vary significantly (either higher or icwer) than the ratio given above. However, even for plants that will not require equipment modifications to comply with the station blackout rule, the assessment of plant capability to cope with a station blackout is almost certain to result in imprvvements in training and procedures to handle such an event. At a ratio of $1,000 per person-rem, a decrease in core damage frequency of only about 0.5 x 10 6 per reactor-year is sufficient to justify a cost of

$350,000 for the station blackout assessment and procedures and training.

Improvements to enhance the capability of a plant to cope with a station black-out from 2 to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months would effect such a reduction in core damage frequency for virtually all plants.

(4) Special Considerations The quantitative value-impact analysis discussed above used estimates for benefits (risk reduction) and costs associated with the resolution of USI A-44.

Although this is a useful approach to evaluate the resolution, other factors can and should play a part in the decision-making process. Although they are not quantified, other considerations that bear on the overall conclusions and recommendations to resolve USI A-44 are discussed below. Overall, these con-siderations support the conclusion that additional defense in depth provided by the ability of a plant to cope with a station blackout for a specified duration is mtrongly recommended.

- Relative Importance of Potential Station Blackout Events Probabilistic risk assessment (PRA) studies performed for this USI, as well as a number of plant-specific PRAs, have shown that station blackout can be a sig-nificant contributor to core damage frequency, and, with the consideration of containment failure, station blackout events can represent an important contri-butor to reactor risk. In general, active containment systems required for heat removal, pressure suppression, and radioactivity removal from the containment atmosphere following an accident are unavailable during a station blackout.

Therefore, the offsite risk is higher from a core melt resulting from station blackout than it is from many other accident scenarios.

Source Term Re-Evaluation The consequence estimates for station blackout used in this value-impact analysis are consistent with the latest research by NRC on source term re-evaluation.

NUREG-1109 23

The release fractions used in this analysis are significantly lower than earlier estimates of source terms. Nevertheless, there is still considerable uncer-tainty, and source term research is expected to continue in the future to improve our knowledge of major phenomena and refine analytical models. Given the range of release fractions used in this analysis, it is unlikely that significantly i better estimates agreed to by the staff and industry would be available for a number of years. In any event, the ability to cope with a station blackout for some period of time would make station blackout a small contributor to core damage frequency and would significantly reduce the risk associated with such I events.

Future Trends in Loss of Offsite Power Frequency The estimated frequency of core damage from station blackout events is directly proportional to the frequency of the initiating event. Estimaes of station blackout frequencies for this USI were based on actual operating experience with credit given in the analysis for trends that show a reduction in the frequency of losses of offsite power resulting from plant-centered events (NUREG-1032).

This is assumed to be a realistic indicator of future performance. An argument can be made that the future performance will be better than the past. For example, when problems with the offsite power grid arise, they are fixed, and therefore, grid reliability should improve. On the other hand, grid power failures may become more frequent because fewer plants are being built, and more power is being transmitted between regions, thus placing greater stress on transmission lines.

Trends in Emergency Diesel Generator Performance Recent data indicate that average emergency diesel generator reliability on an industry-wide basis has been improving slightly since 3976 (NUREG/CR-4347, NSAC/108). These data are based on total valid failures and total valid starts including surveillance testing and unplanned demands (e.g., following a loss of offsite power). There are an insufficient number of unplanned demands at any one nuclear plant to determine diesel generator reliability with high statistical confidence. Therefore, target diesel generator performance levels for USI A-44 are based primarily on surveillance tests. However, data show that the industry average diesel generator failure rate during unplanned demands was higher than that during surveillance tests (0.014 failure per demand for surveillance tests compared to 0.022 failure per demand during unplanned demands (NSAC/108)).

Using diesel generator reliability based only on unplanned demands would lead to slightly higher estimates of core damage frequency than was used in this regulatory analysis and, therefore, a correspondingly larger estimated benefit resulting from the resolution of USI A-44.

Common Cause Failures One factor that affects ac power system reliability is the vulnerability to com-mon cause failures associated with design, operational, and environmental f actors.

Existing industry and NRC standards and regulatory guides include specific design criteria and guidance on the independence of offsite power circuits and the in-dependence of, and limiting interactions between, diesel generator units at a nuclear station. In developing the resolution of USI A-44, the NRC staff assumed that, by adhering to such standards, licensees have minimized, to the extent practical, single point vulnerabilities in design and operation that could result HUREG-1109 24

in a loss of all offsite power or all onsite emergency ac power. Results of sensitivity studies presented in NUREG-1032 indicate that if potential common cause failures of redundant emergency diesel generators exist (e.g., in service water or de power support systems), then estimated core damage frequencies can increase significantly.

Sabotage No total losses of offsite power or diesel generator failures have been attri-buted to sabotage. Therefore, sabotage was not considered explicitly in the risk analysis for USI A-44. However, a sabotage event in 1986 caused three out of four 500-kV transmission lines at one site to be out of service for several hours. Thus sabotage could increase the probability of loss of offsite power.

If saboteurs managed to simultaneously take out all offsite power and/or emer-gency diesel generators, the resolution of USI A-44 would provide additional defense in depth for a period of time to cope with such an event.

4.1.2 Alternative (ii)

The alternative of treating plants uniformly by requiring all plants to be able to cope with the same station blackout duration has been considered. This simplified approach has the advantage of being potentially easier to implement, but it also has two major drawbacks. First, operating nuclear power plants have significant differences in plant- and site-specific factors that contribute to risk from station blackout. This alternative would not take these known factors into account. For example, plants that have a more redundant emergency ac power system than other plants would not be given any credit for such features.

Second, requiring all plants to be able to cope with the same blackout duration would result in one of two undesirable alternatives: (1) If a uniform duration of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or less were recommended, station blackout could still be a signif-icant contributor to total core damage frequency for some plants and, therefore, the objective of the requirements would not be met; and (2) if a uniform 8-hour requirement were imposed, it would necessitate expenditures at some plants that would not be considered cost effective in reducing the risk from station blackout events. Therefore, this alternative was not recommended.

4.1.3 Alternative (iii)

Another possible alternative to the recommended action is to require plants to install either an additional emergency diesel generator or another ac-independent decay heat removal system. This alternative was not recommended for several reasons. First, the cost for either of these additions (from $10 to $30 million per plant) is much higher than the estimated cost for the recommended resolution. The recommended approach is more cost effective and meets the objective stated in Section 2. Second, the adequacy of present requirements for decay heat removal systems is being studied under USI A-45, and any major hardware changes or additions to these systems should await the technical resolution of USI A-45. Third, experience indicates that there are practical limits to diesel generator reliability, including common cause fail-ures of redundant divisions, and the recommended resolution provides greater i diversity and additional defense in depth.

l l

NUREG-1109 , 25 i

+%' +y--m+- y. 7 ---- -r -

m em,u -e--e =

4.1.4 Alternative (iv)

At the time this report was written, details of the NUMARC initiatives were not available to the NRC staff. This made it difficult for the staff to evaluate the benefits of the industry program. For example, the industry initiatives do not include assessments to determine that plants can cope with a station black-out for any period of time. Even so, an attempt was made to estimate the likely impact this initiative would have compared to the station blackout rule and regulatory guide.

The largest risk reduction associated with the industry program would probably result from NUMARC's initiative number one. Assuming that implementing this initiative would result in licensees taking actions to reduce the risk from station blackout for those plants that fall into the category of needing an 8-hour coping capability, the staff estimated the value-impact ratio for the remaining plants. The estimated total cost for these plants to comply with the resolution of USI A-44 is $42 million; the estimated reduction in risk to the public for these plants is 61,000 person-rems; and therefore, the overall value-impact ratio is approximately 1,500 person-rems per million dollars. This rough analysis supports the conclusion that although the industry initiatives :

would provide benefits in terms of reducing risk from station blackout events, the recommended resolution provides greater benefits that are cost effective.

4.1.5 Alternative (v) ;

This alternative would be to take no actions beyond those resulting from the l NUMARC initiatives endorsed by industry and the resolution of Generic Issue B-56 (see discussions in Sections 3.4, 4.1.4, and 4.2.1). Operating experience with diesel generator failures and losses of offsite power has raised a significant concern regarding the potential risk from a station blackout event. The use of this data base with relatively straightforward application of probabilistic risk assessment (PRA) techniques indicates that station blackout events could be a significant contributor to risk for many plants. The additional actions recommended for USI A-44 would significantly reduce the estimated frequency of core damage associated with severe accidents from station blackout. Because the value-impact analysis has shown that it would L,e beneficial to implement these recommendations, the no-action alternative is not recommended.

4.2 Impacts on Other Requirements Several ongoing NRC generic programs and requirements that are related to the resolution of USI A-44 are discussed below.

4.2.1 Generic Issue B-56, Diesel Generator Reliability The resolution of USI A-44 includes a regulatory guide on station blackout that specifies the following guidance on diesel generator reliability (Regulatory Guide 1.155, Sections C.1.1 and C.1.2):

The reliable operation of the onsite emergency ac power sources should i be ensured by a reliability program designed to monitor and maintain the I reliability of each power source over time at a specified acceptable I level and to improve the reliability if that level is not achieved.

The reliability program should include surveillance testing, target NUREG-1109 26

i values for maximum failure rate, and a maintenance program. Surveil-lance testing should monitor performance so that if the actual failure rate exceeds the target level, corrective actions can be taken.

The maximum emergency diesel generator failure rate for each diesel generator should be maintained at or below 0.05 failure per. demand.

For plants having an emergency ac power system [ configuration requir-ing two-out-of-three diesel generators or having a total of two diesel generators shared between two units at a site], the emergency diesel generator failure rate for each diesel generator should be maintained at 0.025 failure per demand or less.

In Generic Letter 84-15, dated July 2, 1984, the staff requested information from licensees regarding proposed actions to improve and maintain diesel gener-ator reliability. The letter requested specific information on three areas (1) reduction of cold fast-start surveillance tests for diesel generators (2) diesel generator reliability (3) the licensee's diesel generator reliability program, if any, and comments on the staff's example performance technical specifications for diesel generator reliability A summary of the data and recommendations in response to Generic Letter 84-15 was published in NUREG/CR-4557. This information, along with other input, will be used in the resolution of Generic Issue B-56 to provide specific guid-ance for diesel generator reliability programs consistent with the resolution of USI A-44.

4.2.2 USI A-45, Shutdown Decay Heat Removal Requirements The overall objective of USI A-45 is to evaluate the adequacy of current licens-ing requirements to ensure that nuclear power plants do not pose an unacceptable risk as a result of failure to remove shutdown decay heat following transients or small-break loss-cf-coolant accidents. The study includes an assessment of alternative means of lmproeing shutdown decay heat removal and of an additional "dedicated" system for this purpose. Results will include proposed recommenda-tions regarding the desirability of, and possible design requirements for, improvements in existing systems or an additional dedicated decay heat removal system.

The USI A-44 concern for maintaining adequate core cooling under station black-out conditions can be considered a subset of the overall USI A-45 issue. How-ever, there are significant differences in scope between these two issues.

USI A-44 deals with the probability of loss of ac power, the capability to remove decay heat usina systems that do not require ac power, and the ability to restore ac power in a timely manner. USI A-45 deals with the overall reliability of the decay heat removal function in +.erms of response to transients, small-break loss-of-coolant accidents, and special emergencies such as fires, floods, seismic events, and sabotage.

Although the recommendations that might result from the resolution of USI A-45 are not yet final, some could affect the station blackout capability, others would not. Recommendations that involve a new or improved decay heat removal system that is ac power dependent but that does not include its own dedicated ac power supply would have no effect on USI A-44. Recommendations that involve NUREG-1109 27

i an additional ac-independent decay heat removal system would have a very modest effect on USI A-44. Recommendations that involve an additional decay heat re- l moval system that include its own ac power supply would have a significant I effect on USI A-44. Such a new additional system would receive the appropriate credit within the USI A-44 resolution by either changing the emergency ac power configuration group or providing the ability to cope with a station blackout for an extended period of time.

j The resolution of USI A-44 would necessitate average expenditures of about l

$600,000 per plant, with a range estimated to be from about $350,000 to a maxi- !

mum of around $4 million. A resolution for USI A-45 involving the addition of I a dedicated and independent system, such as an additional shutdown cooling l system with its own dedicated diesel generator, would be much more expensive, !

with an expenditure on the order of $50 to $100 million. However, such expen- ,

ditures would resolve other concerns with respect to the decay heat removal l function which will be delineated in a future regulatory analysis for USI A-45.

The resolution of these two issues is coordinated along two main lines. First, technical information resulting from both studies is shared among the major participants, including NRC staff and contractors. In this way, the resolution of USI A-45 will take into account any modifications resulting from the reso-lution of USI A-44 that are applicable to the decay heat removal function.

l Second, the schedules are coordinated so that by the time a final rule on USI

A-44 is published--and well before plant modifications, if any, would be imple-l mented--the proposed technical resolution of USI A-45 will be published for

! public comment.

The technical summary findings report and the regulatory analysis for the pro-posed resolution of USI A-45 are targeted to be issued for public comment in late 1987. For plants needing hardware modifications to comply with the USI A-44 resolution, this schedule would permit a re-evaluation before any actual l

modifications are made o that any contemplated design changes following from the resolution of USI A 15 can be considered at the same time.

4.2.3 Generic Issue B-23, Reactor Coolant Pump Seal Failures I

lhe Task Action Plan for Generic Issue B-23 includes three tasks: (1) a review l of seal failure operating experience, (2) an assessment of the effects of loss of seal cooling on reactor coolant pump (RCP) seal behavior, and (3) an evalua-tion of other causes of RCP seal failure such as mechanical and maintenance-l induced failures. Only task 2 is closely related to USI A-44 because during a l station blac';out, systems that normally provide RCP seal cooling are unavail-able, and RCP seal integrity is necessary for maintaining primary system inventory under station blackout conditions.

! NRC and industry analyses of seal performance with loss of saal cooling are proceeding, but at this time the staff has not completed its recommendations to resolve Generic Issue B-23. The estimates of core damage frequency for station blackout events in NUREG/CR-3226 assumed that tne RCP seals would leak at a rate of 20 gallons per minute (gpm) per pump. Results of the analysis for

! Generic Issue B-23 will provide the information necessary to determine seal I behavior and, likewise, a plant's ability to cope with a station blackout for a

specified time. Should this analysis conclude that there is a significant prob-i ability that RCP seals can leak at rates substantially higher than 20 gpm, J

NUREG-1109 28

then modifications such as an ac-independent RCP seal cooling system may be necessary to resolve Generic Issue B-23. If there is high probability that the RCP seals would not leak excessively during a station blackout, then no modifi-cations would be required. A cost-benefit analysis associated with the need for an ac-independent seal cooling system would be included in the regulatory analysis for Generic Issue B-23.

4.2.4 Generic Issue A-30, Adequacy of Safety-Related DC Power Supply

The analysis performed for USI A-44 (NUREG-1032) assumed that a high level of de power system reliability would be maintained so that (1) dc power system failures would not be a significant contributor to losses of all ac power and (2) should a station blackout occur, the probability of immediate dc power system failure would be low. Whereas Generic Issue A-30 focuses on enhancing battery reliability (e.g. , restricting interconnections between redundant de J 'sions, monitoring the readiness of the dc power system, specifying admin-is.rative procedures and technical specifications for surveillance testing and maintenance activities), the resolution of USI A-44 is aimed at ensuring ade-quate station battery capacity in the event of a station blackout of a specified duration. Generic Issue A-30 would provide additional assurance that station battery reliability is adequate and consistent with the assumptions on which USI A-44 is based. Therefore, these two issues are consistent and compatible.

4.2.5 Regulatory Guide 1.108, Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants Regulatory Guide 1.108 describes the currently acceptable method for complying with the Commission's regulations with regard to periodic testing of diesel generators to ensure that they will meet their availability requirements. This guide may need to be modified to be consistent with the proposed actions de-scribed in Section 4.2.1 above (Generic Issue B-56). Regulatory Guide 1.108 will be revised to be consistent with the resolutions of USI A-44 and Generic Issue B-56.

4.2.6 Fire Protection Program for Nuclear Power Facilities 10 CFR 50.48 states that each operating nuclear power plant shall have a fire protection plan that satisfies GDC 3. The fire protection features required to satisfy GDC 3 are specified in Appendix R to 10 CFR 50 and in Branch Technical Position CMEB 9.5.1 (NUREG-0800). They include certain provisions regarding alternative and dedicated shutdown capability. To meet these provisions, some i

licensees have added, or plan to add, improved capability to restore power from I offsite sources or onsite diesels for the shutdown system A few plants have installed a safe shutdown facility for fire protection that includes a charging pump powered by its cwn independent ac power source. In the event of a station blackout, this system can provide makeup capability to the primary coolant system as well as reactor coolant pump seal cooling. This could be a signifi-cant benefit in terms of enhancing the ability of a plant to cope with a station blackout.

Generic Issue A-30 is being resolved as part of Generic Issue B-128, Electrical Power Issues. Generic Issue A-30 is the only part of Generic Issue B-128 that is closely related to USI A-44.

NUREG-1109 29

1 l

Because the plant modifications required for fire protection have already been specified, it would not be feasible to consider these modifications together with the requirements of USI A-44. However, credit would be given for improve-i.

ments made for the fire protection program in meeting the station blackout rule.

For example, plants that have added equipment to achieve alternate safe shutdown in order to meet Appendix R requirements could take credit for the equipment (if available) for coping with a station blackout event.

4.2.7 Generic Issue B-124, Auxiliary Feedwater System Reliability This issue has focused on the r liability of seven older PWRs that have two-i train auxiliary feedwater (AFW) systems. The staff has established a review team that will perform reviews (including plant audits and walkdowns) to assess ,

each of these plants on a case-by-case basis. Other relevant information such as AFW system reliability analyses will be considered in the staff reviews, as available. The staff may allow credit for compensating factors, such as feed-and-bleed capability, to justify acceptance of the two pump AFW systems, or may decide that hardware, procedural, and/or training modifications are necessary.

If the proposed resolution of Generic Issue B-124 requires the AFW system in several PWRs to be upgraded, this would most likely result in the addition of an AFW pump. The installation of a pump that is independent of ac power would be beneficial in handling station blackout accident sequences by providing addi-tional reliability in the ac-independent decay heat removal system. Because all PWRs now have an AFW train that is independent of ac power, the requirement could be met by adding a motor-driven pump. Consequently, the AFW system up-grades could have no effect on the station blackout issue.

4.2.8 Multiplant Action Items B-23 and B-48, Degraded Grid Voltage and Adequacy of Station Electric Distribution Voltage These two multiplant action items have been under consideration by both the staff and licensees fcr several years. They relate to (1) sustained degraded voltage conditions at .he offsite power sources, (2) interaction between the 2

offsite and onsite emergency power syhems, and (3) the acceptability of the voltage conditions on the station electric distribution systems with regard to potential overloading and starting transient problems. Licensees' responses to ,

these concerns have consisted of verifying the adequacy of existing power systems or of upgrading the power systems. The modifications are designed to ensure that the power systems can perform their intended function and consequently would enhance their dependability. If additional power sources have been added to address these concerns, the plant would be placed in an improved category ,

and may be required to withstand a blackout of lesser duration. In the resolu-tion of USI A-44, the staff is not recommending that work that has been done on these two action items be repeated.

4.2.9 Severe Accident Program 1

Brookhaven National Laboratory (BNL) has proposed a set of preliminary guide- l lines and criteria that could be used to assess the capability of nuclear power i plants to cope with severe accidents (for example, see BNL Technical Report '

A-3825R). This work was performed in support of the Implementation Plan for NUREG-1109 30 ,

i

i l

l l

the Commission's Severe Accident Policy Statement. The proposed guidelines cover a large number of potentially severe accident sequences. For station blackout events, the guidelines assume that plants will comply with the l requirements in the station blackout rule. Therefore, the severe accident !

program and the resalution of USI A-44 are consistent and compatible. Require-ments for operating plants to comply with additional criteria beyond those in -

the station blackout rule would need to be justified in accordance with the

.backfit rule (10 CFR 50.109).

4.3 Constraints The staff has reviewed current Commission regulations to determine if they provide a basis for implementation of the USI A-44 requirements. This review included (1) the Atomic Safety and Licensing Appeal Board Hearing (ALAB-603) on station blackout for St. Lucie Unit 2; (2) the Commission review of that hearing;

.(3) GDC 17, "Electric Power Systems"; and (4) the backfit rule (10 CFR 50.109).

St. Lucie Unit 2 Atomic Safety and Licensing Appeal Board Hearing In ALAB-603, the board took the position that station blackout should be con-sidered a design-basis event for St. Lucie Unit 2 because of the high frequency of such an event (10 4 to 10 5 per year at that site). As a result, the Appeal Board required St. Lucie Unit 2 to be capable of withstanding a total loss of ac power and to implement training and procedures to recover from station blackout. The Appeal Board went as far as to say, Our findings that station blackout should be considered as a design basis event for St. Lucie Unit 2 manifestly could be applied equally to Unit 1, already in operation at that site.

By a parity of reasoning, this result may well also obtain at other nuclear plants on applicent's system, if not at most power reactors. Our jurisdiction, however, is limited to the matter before us licensing construction of St. Lucie 2.

Beyond that, we an only alert the Commission to our concerns.

The Commission upheld the Board's action on St. Lucie Unit 2. However, the Commission determined that ALAB-603 did not establish station blackout generically as a design-basis event.

- General Design Criterion 17 GDC 17 states, in part, Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or <

the loss of power from the onsite electric power supplies.

The intent of GDC 17 is to require reliable offsite and onsite ac power systems.

The ability to cope with the coincident loss of both of these systems is not addressed explicitly.

t NUREG-1109 31

l As a result of this review, the staff has concluded that there is a basis in the regulations for the recommendations to improve the reliability of the off-site and onsite ac power systems. However, because the coincident loss of both systems is not addressed explicity, a rule to require plants to be able to with-stand a total loss of ac power for a specified duration will provide further assurance that station blackout will not adversely affect the public health and safety.

Backfit Rule On September 20, 1985, the Commission published the backfit rule (10 CFR 50.109).

This rule restricts the imposition of new requirements on currently licensed auclear power plants and specifies standard procedures that must be applied to backfitting decisions. The backfit rule states, The Commission shall require a systematic and documented analysis pursuant to paragraph (c) of this section for backfits which it seeks to impose....(10 CFR 50.109(a)(2))

The Commission shall require the backfitting of a facility only when it determines, based on the analysis described in paragraph (c) of this section, that there is a substantial increase in the overall protection of the public health and safety or the common defense and security to be de ived from the backfit and that the direct and indirect costs of imp.ementation for that facility are justified in view of this increased protection. (10 CFR 50.109(a)(3))

In order to reach this determination, 10 CFR 50.109(c) offers nine specific factors which are to be considered in the analysis for the backfits it seeks to impose. These nine factors are among those discussed in the main body of this report. Appendix A provides a discussion summarizing each of these factors.

The Commission also states in the backfit rule that "any other information relevant and material to the proposed backfit" will be considered. This report provides additional relevant information concerning the station blackout rule-making. This analysis supports a determination that a substantial increase in the protection of the public health and safety will be derived from backfitting the requirements in the station b'ackout rule, and that the backfit is justified in view of toe direct and indirec; costs of implementing the rule.

No other constraints have been identified that affect the resolution of USI A-44.

! 5 DECISION RATIONALE l

l The evaluation to resolve USI A-44 included deterministic and probabilistic analyses. The timing and consequences of various accident sequences were cal-culated, and the dominant factors affecting station blackout likelibcod were identified (NUREG-1032 and NUREG/CR-2989, -3992, -3226, and -4347). Using this information, simplified probabilistic accident sequence correlations were cal-culated to estimate the frequency of core damage resulting from station black-out events for different plant design, operational, and location factors. These quantitative estimates were used to give insights into the relative importance of various factors, and those insights, along with engineering judgment, were used to develop the resolution of USI A-44. By analyzing the effect of varia-tions in design, operations, and plant location on risk from station blackout NUREG-1109 32

1 accidents, an attempt was made to approach a reasonably consistent level of risk in the recommendations developed.

A survey of probabilistic risk assessment studies showed that total core damage frequency from all dominant accident sequences ranged from 2 x 10 5 to 1 x 10 3 per reactor year, with a typical frequency being about 6 to 8 x 10 5 per reactor-year (NUREG/CR-3226). For those plants currently in operation or under construc-tion, a value-impact analysis was performed to determine that the resolution of USI A-44 is cost effective. Implementation of the resolution will result in station blackout being a relatively small contributer to total core damage fre-quency. (NUREG-1032 provides a more detailed discussion of the analysis of station blackout accident likelihood performed for this regulatory analysis.)

5.1 Commission's Safety Goals On August 4, 1986, the Commission published in the Federal Register a policy statement on "Safety Goals for the Operations of Nuclear Power Plants" (51 FR 28044). This policy statement focuses on the risks to the public from nuclear power plant operation and establishes goals that broadly define an acceptable level of radiological risk. The discussion below addresses the resolution of USI A-44 in light of these goals.

- The two qualitative safety goals are:

Individual members of the public should be provided such a level of protection from the consequences of nuclear power plant operation that individuals bear no significant additional risk to life and health.

Societal risks in life and health from nuclear power plant opera-tion should be comparable to or less than the risks of generating electricity by viable competing technologies and should not add significantly to other societal risk.

The following quantitative objectives are used in determining achievement of the above safety goals:

The risk to an average individual in the vicinity of a nuclear power plant of prompt fatalities that might result from reactor accidents should not exceed one-tenth of one percent (0.1%) of the sum of prompt fatality risks resulting from other accidents to which members of the U.S. population are generally exposed.

The risk to the population in the area near a nuclear power plant of cancer fatalities that might result from nuclear power plant operation should not exceed one-tenth of one percent (0.1%) of the sum of cancer fatality risks resulting from all other causes.

Results of analyses published in NUREG-1150 for five plants (Surry, Zion, Sequoyah, Peach Bottom, and Grand Gulf) indicate that all five plants meet the risk criteria for prompt fatalities and latent cancer fatalities stated above, even considering the large uncertainties involved. Implementation of the station blackout rule will result in the average core damage frequency from station NUREG-1109 33

l l

l i

l black'out events being in approximately the range of frequencies estimated for l station blackout for the five NUREG-1150 plants. Therefore, the station black- ,

out rule meets both of the Commission's qualitative safety goals.

The Commission also stated the following regulatory objective relating to the frequency of core damage accidents at nuclear power plants.

Severe core damage accidents can lead to more serious accidents with the potential for life-threatening offsite releases of radiation, for evacuation of members of the public, and for contamination of public property. Apart from their health and safety consequences, such acci-dents can erode public confidence in the safety of nuclear power and can lead to further instability and unpredictability for the industry.

In order to avoid these adverse consequences, the Commission intends to continue to pursue a regulatory program that has as its objective providing reasonable assurance, giving appropriate consideration to the uncertai, ies involved, that a severe core damage accident will not occur at u U.S. nuclear power plant.

An estimate of the total probability of core damage for the nuclear industry is beyond the scope of this regulatory analysis, but some perspectives on station blackout are presented here. The mean core damage frequency from station black-out events before implementation of the station blackout rule is estimated to be 4.2 x 10 5 per reactor year. Thus, the probability of core damage from station blackout is about 0.12 (i.e., about 1 chance in 8 that station black-out would result in severe core damage at one of 125 reactors over an assumed remaining 25 year life expectancy of these plants). Implementation of the station blackout rule would reduce the estimated mean core damage frequency to 1.6 x 10 5 per reactor year, and therefore, the estimated probability of a severe core damage accident from station blackout would be 0.05 (i.e., about I chance in 20 of severe core damage). Therefore, implementing the resolution of USI A-44 provides reasonable assurance that a severe core damage accident from station blackout will not occur at a U.S. nuclear power plant.

The Cvicission also proposed the following guideline for further staff evaluation:

Consistent with the traditional defense-in depth approach and the accident mitigation philosophy requiring reliable performance of containment systems, the overall mean /requency of a large release of radioactive materials to the environment from a reactor accident should be less than 1 in 1,000,000 por year of reactor operation.

Given the current state of knowledge regarding containment performance and the large uncertainties with respect to the probability of containment failure fol-lowing severe accident sequences, ii. is not possible to conclude that the safety performance guideline on the fregi.ency of a large release would be met. This !

conclusion is based on the estin ted mean core damage frequency for station l blackout events of 1.6 x 10 5 per reactor year coupled with the uncertainty band for the probability of early containment failure rariging from about 0.05 to 0.90 as reported in .*iUREG-1150. Since the potential for a high likelihood of containment failure cannot be eliminated, the overall mean frequency of a large release of radioactivity of 10 6 per reactor year cannct be ensured.

NUREG-1109 34

' Additional rationale for implementing the station blackout rule and the regula-tory guide over other alternatives is discussed in the value-impact analysis (Section 4.1). This action represents the staff's position based on a compre-1,:.nsive analysis of the station blackout issue. This position includes all the requirements and guidance to resolve the station blackout issue.

5.2 Station Blackout Reports The studies and data on which this resolution is based are documented in NUREG-1032 and NUREG/CR-2989, -3226, -3992, and -4347. Summaries of these reports follow.

5.2.1 NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants, Technical Findings Related to Unresolved Safety Issue A-44 This report summarizes the results of technical studies performed in support of USI A-44 and identifies the dominant factors affecting the likelihood that station blackout accidents will occur at nuclear power plants. These results are based on operating experience data; analysis of several plant-specific probabilistic safety studies; and reliability, accident sequence, and conse-quence analyses performed in support of this unresolved safety issue.

In summary the results show the following important characteristics of station blackout accidents.

(1) The likelihood of station blackout varies between plants with an estimated frequency ranging from approximately 10 5 to 10 3 per reactor year. A "typical" estimated frequency is on the order of 10 4 per reactor year.

(2) The capability of restoring offsite power in a timely manner can have a significant effect on accident consequences.

(3) Onsite ac power system redundancy and individual power supply reliability have the largest influence on station blackout accident frequency.

(4) The capability of the decay heat removal system to cope with long-duration

, blackouts can be a dominant factor influencing the likelihood of core ;

1 damage or core melt.

(5) The estimated frequency of station blackout events resulting in core

. damage or core melt can range from approximately 10 6 to greater than 10 4 per reactor year. A "typical" core damage frequency estimate is 2 to 4 x 10 5 per reactor year.

(6) The best information available indicates that containment failure by over-pressure may follow a core melt induced by station blackout with smaller, low-design pressure containments most susceptible to early failure. Some large, high-design pressure containments may not fail by overpressure, or the failure time could be on the order of a day or more.

Losses of offsite power could be characterized as those resulting from plant-centered faults, utility grid blackout, or severe weather-induced failures of I offsite power sources. The industry average frequency of total losses of off-

, ite power was determined to be about 1 in 10 site years. The median restora-l tion time was about 1/2 hour, and 90 percent of the losses were restored in NUREG-1109 35 I

t 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months or less. The factors that were identified as affecting the frequency and duration of offsite power losses are (1) design of preferred power distribution system, particularly the number I and independence of offsite power circuits from the point at which they l enter the site up to the safety buses i 1

(2) operations that can compromise redundancy or independence of multiple off-site power sources, including human error )

(3) grid stability and security, and the ability to restore power to a nuclear plant site with a grid blackout (4) the hazard from, and susceptibility to, severe weather conditions that can cause loss of offsite power for extended periods A design and operating experience review, combined with a reliability analysis of the onsite, emergency, ac power system, has shown that there are various potentially important causes of failure. The t l divisionemergencyacpowersystemisabout10gpicalunavailabilityofatwo-per demand, and the typical i individual emergency diesel generator failure rate is about 2 x 10 2 per demand.

The factors that were identified as affecting the emergency ac power system reliability during a loss of offsite power are (1) power supply configuration redundancy (2) reliability of each power supply (3) depen 9 ace of the emergency ac power system on support of auxiliary cool-ing systems and control systems and the reliability of those support systems (4) vulnerability to common cause failures associated with design, operational, )

and environmental factors The likelihood of a station blackout progressing to core damage or core melt is dependent on the reliai>ility and capability of decay heat removal systems that are not dependent on ac power. If sufficient capability exists, additional time will be available to permit an adequate opportunity to restore ac power to the many systems normally used to cool the core and remose decay heat. The most important factors involving decay heat removal during a station blackout are (1) the starting reliability of systems required to remove decay heat and maintain reactor coolant inventory (2) the capacity and functionability of decay heat removal systems and aux-iliary or support systems that must remain functional during a station blackout (e.g., dc power, condensate storage)

(3) for PWRs, and BWRs without reactor coolant makeup capability during a station blackout, the magnitude of reactor coolant pump seal leakage NUREG-1109 36

(4) for BWRs that remove decay heat to the suppression pool, the ability to maintain suppression pool integrity and operate heat removal systems at high pool temperatures during recirculation It was determined by reviewing design, operational, and location factors, that the expected core damage frequency from station blackout could be maintained around 10 5 per reactor year or lower for almost all plants. The ability to cope with station blackout durations of 4 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and emergency diesel generator reliabilities of 0.95 per demand or better would be necessary to reach this core damage frequency level.

5.2.2 NUREG/CR-3226, Station Blackout Accident Analyses This report analyzes accident sequences following a postulated total loss of ac power to (1) determine the core damage frequencies from station blackout, (2) provide insights through sensitivity studies of important factors to consider for lowering the core melt frequency, and (3) provide perspectives on the risks from such an event. Probabilistic safety analyses were done on four generic "base" plant configurations. Fault trees of different systems and event trees of possible station blackout accident sequences were constructed for these plants. These event trees modeled three time periods, including an initial time period for sequences resulting from unavailabilities on demand and longer time intervals in which other failures can occur such as depletion of de power, degradation of reactor coolant oump seals, or depletion of condensate storage tank supply. Data from the offsite and onsite power studies (NUREG/CR-2989 and

-3992) as well as from licensee event reports and PRAs were used to quantify the accident sequences. Lastly, containment failure modes and timing were reviewed to calculate the risk to the public from station blackout.

For the "base" cases, the total core damage frequencies from station blackout resulting from the dominant accident sequences were estimated to be in the range of 10 5 per reactor year. Plants with features different from the base case designs have different core damage frequencies, so sensitivity analyses were conducted. For example, the reliability and recovery of ac power from both the offsite and emergency onsite power systems have a direct impact on core damage frequencies. Depending on tia expected frequency of station blackout at a plant and other factors, the frequency of core damage associated with loss of all ac power ranged from about 2 x 10 6 to greater than 10 4 per reactor year.

In summary, results of the accident sequence analyses indicate that the follow-ing plant factors are important when considering station blackout:

(1) the effectiveness of actions to restore offsite power once it is lost (2) the degree of redundancy and reliability of the emergency onsite ac power system (3) the reliability of decay heat removal systems following loss of ac power (4) de power reliability and battery capacity including the availability of instrumentation and control for decay heat removal without ac power (5) common service water dependencies between the emergency ac power source and the decay heat removal systems NUREG-1109 37

L (6) the magnitude of reactor coolant pump seal leakage and the likelihood of a stuck-open relief valve occurring during a station blackout (7) containment size and design pressure (8) operctor training and available procedures 5.2.3 NUREG/CR-2989, Reliability of Emergency AC Power Systems at Nuclear l Power Plants This study estimated the reliabilities of representative onsite ac power sys-tems and the costs of improving the reliabilities of these systems. For this analysis, the initial design of onsite ac power systems was reviewed, using Final Safety Analysis Reports (FSARs) for plants, plant schematics, and plant-specific procedures. The study included examining the following areas: switch-yards, distribution systems, dc power systems, diesel generators, support systems, I and procedures. Historical data on diesel generator operating experience for i the 5 year period from 1976 through 1980 were collected from licensee event I reports and responses to questionnaires sent to licensees. )

Eighteen different configurations were identified, and representative plants ;

were selected for a more detailed reliability analysis. This analysis involved i constructing fault tree models for the onsite power systems and quantifying these fault trees with the data gathered on operating experience. The onsite system undependability (the probability that it will fail to start or fail to

' continue to run for the duration of an offsite power outage) was calculated for ac power outages up to 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months after a loss of offsite power. Results of a sensitivity study were used to identify potentially important contributors to unreliability, and costs of improvements were estimated.

Results showed that important contributors to onsite power undependability were j independent diesel generator failure, common cause failure due to hardware failure or human error, unavailability because of scheduled maintenance, and cooling subsystem undependability. Reliability of onsite ac power systems varies from plant to plant. Depending on diesel generator configuration, the system unavailability ranged from 1.4 x 10 4 to 4.8 x 10 2 per demand. Significant variabilit, exists so that any reliability improvements and the associated costs l must be avaluated on a plant-specific oasis.

5.2.4 NUREG/CR-4347, Emergency Diesel Generator Operating Experience, 1981-1983 This report updates operating experience of emergency diesel generators reported in NUREG/CR-2989. Diesel generator failure rates during surveillance testing and during actual 4mands (e.g., unplanned demands following losses of offsite power or safety it .ction actuation signals) are estimated. The data indicate that overall diesel generator performance has improved since 1976; the overall median failure rate is estimated at 0.019 failure per demand. However, for the 1981 to 1983 period, the diesel generator failure rate during actual demands was 0.025 failure per demand--a rate higher than that for all demands (i.e.,

including surveillance tests). Data from NUREG/CR-2989 and -4347, along with results of an industry survey conducted by the Electric Power Research Institute (NSAC/108), were used in the staff's evaluation of risk from station blackout events (NUREG-1032).

NUREG-1109 38

5.2.5 NUREG/CR-3992, Collection and Evaluation of Complete and Partial losses of Offsite Power at Nuclear Power Plants This report describes and categorizes events involving complete or significant partial losses of offsite power that have occurred at nuclear power plants through 1983. This study provides an accurate data base to ertimate frequen-cies and durations of losses of offsite power and details how offsite power design features may affect these losses as well as the ability to restore off-site power. A parallel study documenting loss of offsite power experience through 1985 was published by the Nuclear Safety Analysis Center of the Electric Power Research Institute (NSAC/103). Data from both NUREG/CR-3992 and NSAC/103 were used in NUREG-1032 for analyzing the loss of offsite power.

Based on industry-wide data for the years 1959 through 1983, loss of offsite power occurs per plant about once every 10 site years. A total of 46 complete loss-of-offsite power events were documented, ranging in duration from a few minutes up to a maximum of almost 9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months . In approximately half of these events, offsite power was restored in 1/2 hour or less. Information for this study was collected from licensee event reports, responses to an NRC questionnaire, and various reports prepared by the utilities. Most of the event descriptions in the licensee event reports and other documentation within the NRC files did not contain sufficiently detailed information for the purposes discussed above.

For example, in one case a licensee reported offsite power restoration time to be 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , but actually one offsite power source was restored in 8 minutes, and all offsite power was restored in 6 nours. Because restoration of one source of offsite power terminates a loss of offsite power, the documented description was not accurate enough. In other cases, offsite power was avail-able to be reconnected, but the plant operators did not reconnect it for some time af ter it was available. The time power was reconnected was usually reported; however, the data that were actually needed were the times that power was available for reconnection. Because of the need for more accurate data, additional information was-obtained by contacting utility engineers for better descriptions of the cat.ses, sequences of events, and the times and methods of restoring offsite power. ,

Once these data were collected, the offsite power failures were identified as plant-centered or grid failures. In addition, the causes of the failures were attributed to weather, human error, design error, or hardware failure. The plant-centered failures were usually of shorter duration than the grid failures caused by severe weather. For this reason, the weather-related events were j reviewed in detail.

Offsite power design features were tabulated for most of the operating nuclear power plants to determine which features significantly affect the reliability of offsite power systems. The frequency and duration of losses of offsite power caused by severe weather are affected by the number of transmission lines and rights-of-way and the availability of alternate power sources (such as hydro, gas turbines, or fossil units near the nuclear plant). Design features that may be important for plant-centered losses of offsite power are the number of offsite power sources, the electrical independence of those sources, and the relay scheme for transferring power between offsite sources.

NUREG-1109 39

~

6 IMPLEMENTATION 1 1

6.1 Schedule for Implementing the Final Station Blackout Rul,e The ster; and schedule listed in Table 13 summarize the implementation schedule in the station blackout rule (10 CFR 50.63(c) and (d)). Within 9 months after promulgation of the rule, licensees will submit to NRC (1) the length of time the plant should be able to cope with a station blackout (coping duration),

(2) a justification for the coping duration, (3) a description of the procedures to cope with a station blackout for that duration, and (4) a list of equipment modifications necescary, if any, to meet the specified duration of station blackout. The staff will review the licensees' submittals, and, within 6 months af ter that review, licensees will submit a schedule for modifying any necessary equipment to comply with the rule. !

\s The factors that must be considered to determine the minimum acceptable station j blackout duration, as specified in the revision to Appendiv :,o CDC 17, are relatively straightforward. In fact, licensees have revi. a tL ,r plants against these factors as part of an industry initiative su,.jorted by NUMARC.

Inus, this acceptable duration can be determined in approximately 1 or 2 months.

Licensees will be required to perform plant-specific analyses to determine if the plant, as designed, can cope with a station blackout for the acceptable duration, and to determine what modifications, if any, are needed to meet the l acceptable duration. These analyses could take 6 to 9 months. Thus, it seems l reasonable to require that the information be submitted to the NRC within 9 l months after the date the final rule is issued. 1 Procedural changes to cope with a station blackout and diesel generator reli-ability improvements, if necessary, will be implemented early in the schedule.

Hardware backfits, if necessary, should be implemented as soon as practical, based on scheduled plant shutdown, but no later than 2 years after the staff reviews a licensee's station blackout duration submittal. A final schedule for implementation of design and associated procedural modifications will be mutually !

agreed upon by the licensee and the NRC staff.

)

Other schedules were considered; however, the staff believes the implementation schedule in Table 13 can be achieved without placing unnecessary financial bur-den on licensees for plant shutdown. The schedule allows reasonable time for implementing necessary hardware items to reduce the risk of severe accidents associated with station blackout, yet achieves significant early benefits by requiring an assessment of a plant's station blackout capability and procedures and training to cope with such an event. Shorter or less flexible schedules would be unnecessarily burdensome; longer schedules would delay necessary plant improvements.

- 6.2 Relationship to Other Existing or Proposed Requirements Several NRC programs are related to USI A-44; these are discussed in Section 4.2.

These programs are compatible with the resolution of USI A-44.

NUREG-1109 40

Table 13 Implementation schedule for final station blackout rule Moaths after Commission Activity decision to issue final rule Issuance of final rule 0 Licensees' submittal of acceptable station 9 ,

blackout durations to NRC, including description of procedures and list of r modifications Completion of NRC review of submittal 20 Licensee's submittal of schedule for 26 implementing hardware modifications Completion of licensees' hardware

modifications

Schedule to be agreed upon with NRC, but within 2 years of NRC review of sub-mittal, unless the licensee submits justification for a later date and the staff accepts the later date.

7 REFERENCES Brookhaven National Laboratory, "Prevention and Mitigation of Severe Acci-dents in a BWR-4 With a Mark I Containment," Draft Technical Report A-3825R, Occober 1986.

Letter from J. H. Miller, Jr. , Nuclear Utility Management and Human Resources Committee, to Chairman N. J. Palladino, NRC, June 17, 1986.

NSAC/103, "Losses of Offsite Power at U.S. Nuclear Power Plants - All Years Through 1985," Nuclear Safety Analysis Center, Electric Power Research Insti-tute, May 1986.

NSAC/108, "The Reliability of Emergency Diesel Generators at U.S. Nuclear Power Plaa+s," Nuclear Safety Analysis Center, Electric Power Research Institute, September 1986.

Sandia National Laboratory, "Value-Impact Calculation for Station Blackout Task Action Plan A-44," letter report to NRC, March 1983.

Sc#ance and Engineering Associates, Inc. , "Response to Industry Comments on Sta ion Blackout Cost Estimates (NUREG/CR-3840)," letter report to NRC, November 12, 1986.

U.S. Atomic Energy Commission, WASH-1400, "Reactor Safety Study," October 1975 (also reissued as NUREG-75/014).

, U.S. Nuclear Regulatory Commission, 51 FR 9829, "Station Blackout," March 21, 1986.

NUREG-1109 41

-- , 51 FR 28044, "Safety Goals for the Operetion of Nuclear Power Plants,"

August 14, 1986.

-- , Generic Letter 84-15, "Proposed Staff Actions To Improve and Maintain Diesel Generator Reliability," July 2, 1984.

-- , "Regulatory Analysis Guidelines," NRR Office Letter No. 16, Revision 3, i May 13, 1986.

-- , NUREG-75/014, "Reactor Safety Study," October 1975 (formerly WASH-1400).

-- , NUREG-0800, "Standard Review Plan for the Review of Safety Analyses for i Nuclear Power Plants," July 1981. 1

-- , NUREG-0956, "Reassessment of the Technical Bases for Estimating Source Terms," July 1986.

-- , NUREG-1032, "Evaluatior, of Station Blackout Accidents at Nuclear Power Plants, Technical Findings Related to Unresolved Safety Issue A-44," draft.

May 1985.

-- , NUREG-1150, "Reactor Risk Reference Document," Draft for Comment, February 1987.

-- , NUREG/CR-2723, "Estimates of the Financial Consequences of Nuclear Power Reactor Accidents," September 1982.

-- , NUREG/CR-2989, "Reliability of Emergency AC Power Systems at Nuclear '

Power Plants," July 1983.

-- , NUREG/CR-3226, "Station Blackout Accident Analyses (Part of NRC Task Action Plan A-44)," May 1983.

-- , NUREG/CR-3568, "A Handbook for Value-Impact Assessment," December 1983.

-- , NUREG/CR-3840, "Cost Analysis for Potential Modifications To Enhance the :

Ability of a Nuclear Power Plant Tn Endure Station Blackout," July 1984. )

- -- , NUREG/CR-3992, "Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants," February 1985.

-- , NUREG/CR-4347, "Emergency Diesel Generator Operating Experience,1981-1983," December 1985.

-- , NUREG/CR-4557, "A Review of Issues Related to improving Nuclear Power Plant Diesel Generator Reliability," April 1986.

4 -- , NUREG/CR-4624, Volumes 1-6, "Radionuclide Release Calculations for Selected Severe Accident Scenarios," July 1986.

NUREG-1109 42

APPElvDIX A BACKFIT ANALYSIS P

f f

l l

I l

l NUREG-1109 Appendix A

r APPENDIX A BACKFIT ANALYSIS

Analysis and Determination That the Rulemaking To Amend 10 CFR 50 Concerning Station Blackout Complies With the Backfit Rule 10 CFR 50.109 The Commission's existing regulations establish reqsirements for the design and testing of onsite and offsite electrical power systems (10 CFR 50, Appendix A, General Design Criteria 17 and 18). However, as operating experience has accumulated, the concern has arisen regarding the reliability of both the offsite and onsite emergency ac power systems. These systems provide power for various safety systems including reactor core decay heat removal and containment heat removal which are essential for preserving the integrity of the reactor core and the containment building, respectively. In numerous instances, emer-gency diesel generators have failed to start and run during tests cor; ducted at operating plants. In addition, a number of operating plants have experienced a total loss of offsite electric power, and more such occurrences are expected.

Existing regulations do not require explicitly that nuclear power plants be designed to withstand the loss of all ac power for any specified period.

This issue has been studied by the staff as part of Unresolved Safety Issue (USI) A-44, "Station Blackout." Both deterministic and probabilistic analyses were performed to determine the timing and consequences of varicus accident sequences and to identify the dominant factors affecting the likelihood of core-melt accidents from station blackout. Although operational experience shows that the risk to public health and safety is not undue, these studies, which have evaluated plant design features and site-dependent factors in detail, show that station blackout can contribute significantly to the overall plant risk. Consequently, the Commission is amending its regulations to require that plants be capable of withstariding a total loss of ac power for a specified duration and to maintain reactor core cooling during that period.

The estimated benefit from implementing the station blackout rule is a reduction in the frequency of core damage per reactor year due to station blackout and the associated risk of offsite radioactive releases. The risk redu: tion for 100 operating reactors is estimated to be 145,000 person-rems and suoports the Commission's conclusion thac 10 CFR 50.63 provides a substantial improvement in the level of protection of public health and safety.

The cost for licensees to comply with the rule would vary, depending on the exist-ing capability of each plant to cope with a station blackout as well as the specified duration of station blackout for that plant. The costs would be

This backfit analysis is intended to be a stand-alone document that minimizes the need tu refer to additional documents by including sui Scient detail to assess each consideration in the backfit rule (10 CFR 50.109). Therefore, the backfit analysis repeats much of what is already included ir. the main body of the report.

NUREG-1109 1 Appendix A ,

l l

primarily for licensees (1) to assess the plant's capability to cope with a station blackout, (2) to develop procedures, (3) to improve diesel generator reliability if the reliability falls below certain levels, and (4) to retrofit plants with additional components or systems, as necessary, to meet the requirements.

The estimated total cost for 100 operating reactors to comply with the resolu-tion of USI A-44 is about $60 million. The average cost per reactor would be around $600,000, ranging from $350,000 if only a station blackout assessment and procedures and training are necessary, to a maximum of about $4 million if substantial modifications are needed, including requalification of a diesel generater.

The overall value-impact ratio, not including accident avoidance costs, is about 2,400 person-rems averted per million dollars. If the net cost, which includes the cost savings from avoiding &n accident (i.e., cleanup and repair of onsite damages and replacement power following an accident) were used, the overall value-impact ratio would improve significantly to about 6,100 person-rems averted per million dollars. These values, which exceed the $1,000/ person-rem guidance provided by the Commission, support proceeding with the implementation of 10 CFR 50.63.

The preceding quantitative value-impact analysis was one of the factors considered in evaluating the rule, but other factors also played a part in the decision-making process. Probabilistic risk assessment (PRA) studies performed for this USI, as well as some plant-specific PRAs, have shown that station blackout can contribute significantly to core-melt frequency, and, with consideration of containment failure, station blackout events can represent an important contrib-utor to reactor risk. In general, active systems required for containment heat removal are unavailable during station blackout. Therefore, the offsite risk is higher from a core melt resulting from a station blackout that it is from many other accident scenarios.

Although there are licensing requirements and guidance directed at providing reliable offsite and onsite ac power, experience has shown that there are prac-l tical limitations in ensuring the reliability of offsite and onsite emergency ac power systems, Potential vulnerabilities to common cause failures associated with design, operational, and environmental factors can affect the reliability of ac power systems. For example, if potential common cause failures of emer-gency diesel generators exist (e.g., in service-water or de power support sys-tems), then the estimated frequency of core damage from station blackout events can increase significantly. Also, even though recent data indicate that the average reliability of emergency diesel generators has improved slightly since 1976, these data also show that failure rates in diesel generators during un-planned demand (e.g., following a loss of offsite power) were higher than failure rates during s eveillance tests, i

l The estimated frequency of core damage from station blackout events is directly proportional to the frequency of the initiating event. Estimates of the fre-quency of station blackouts for this USI were based on actual operational exper-ience with credit given for trends showing a reduction in the frequency of losses of offsite power resulting from plant-centered events. This is assumed NUREG-1109 2 Appendix A

I to be a realistic indicator of future performance. An argument can be made that the future performance will be better than the past. For example, when problems with the offsite power grid arise, they are fixed and, therefore, grid reli- I ability should improve. On the other hand, grid power failurcs may become more frequent because fewer plants are being built, and more power is being trans-mitted among regions, thus placing greater stress on transmission lines.

A number of other nations, including France, Britain, Sweden, Germany, and Belgium, have taken steps to reduce the risk from station blackout events.

These steps include adding design features to increase the ability of the plant to cope with a station blackout for a substantial period of time and/or adding redundant and diverse emergency ac power sources.

The factors discussed above support the determination that additional defense in depth provided by the ability of a plant to cope with station blackout for a specific duration would provide a substantial increase in the overall protec-tion of the public health and safety, and the direct and indirect costs of imple-mentation are justified in view of this increased protection. The Commission has considered how this backfit should be prioritized and scheduled in light of other regulatory activities taking place at operating nuclear power plants.

Station blackout warrants a high priority ranking based on both its status as an "unresolved safety issue" and the results and conclusions reached in resolving this issue. As noted in the implementation section of the rule (10 CFR 50.63(c)(4)), the schedule for equipment modification (if needed to meet the requirements of the rule) shall be mutually agreed upon by the licensee and NRC. Modifications that cannot be scheduled for completion within 2 years after NRC accepts the licensee's specified station blackcut duration must be justified by the licensee.

Analysis of 50.109(c) Factors (1) Statement of the specific objectives that the backfit is designed to achieve The NRC staff has completed a review and evaluation of information developed since 1980 on USI A-44, "Station Blackout." As a result of these efforts, the NRC is amending 10 CFR 50 by adding a new paragraph, 10 CFR 650.63, "Station Blackout."

l l The objective of the station blackout rule is to reduce the risk of severe l accidents associated with station blackout by making station blackout a relatively small contributor to total core-damage frequency. Specifically, the rule requires all light-water-cooled nuclear power plants to be able to cope with a station blackout for a specified duration (coping duration) and to have procedures and training for such an event. A regulatory guide (Regulatory Guide 1.155), to be issued along with the rule, provides an acceptable method to determine the coping duration for each plant. The duration is to be determined for each plant based on a comparison of the individual plant design with factors that have been identified as the main contributors to risk of core melt resulting from station blackout. These factors are (1) the redundancy of onsite emergency &c power sources, (2) the reliability of onsite emergency ac power sources, (3) the frequency of loss of offsite power, and (4) the probable time needed to restore offsite power.

NUREG-1109 3 Appendix A

i (2) General description of the activity required by the licensee or applicant in order to complete the backfit In order to comply with the resolution of USI A-44, licensees will be !

required to l Maintain the reliabilicy of onsite emergency ac power sources at or above specified acceptable reliability levels.

Develop procedures and training to restore ac power using nearby power sources if the emergency ac power system and the normal offsite power sources are unavailable.

Determine the duration that the plant should be able to withstand a station blackout based on the factors specified in 10 CFR 50.63, l "Station Blackout," and Regulatory Guide 1.155, "Station Blackout."

Use (if available) an alternate ac power source, which meets specific criteria for independence and capacity, to cope with a station blackout.

Evaluate the plant's actual capability to withstand and recover from a station blackout. This evaluation will include verifying the adequacy of station battery power, condensate storage tank capacity, and plant / instrument air for the station blackout duration verifying adequate reactor coolant pump seal integrity for the station blackout duration so that seal leakage due to lack of seal cooling would not result in a sufficient primary system coolant inventory reduction to lose the ability to cool the core.

verifying the operability of equipment needed to operate during a station blackout for environmental conditions associated with total loss of ac power (i.e., loss of heating, ventilation, and air conditioning). l l

Depending on the plant's existing capability to cope with a station black-out, licensees may or may not need to backfit hardware modifications (e.g., adding battery capacity) to comply with the rule. (See item 8 of this analysis for additional discussion.) Licensees will be required to develop procedures and training to cope with and recover from a station blackout.

(3) Potential change in the risk to the public from the accidental offsite release of radioactive material Implementation of the station blackout rule will result in an estimated total risk reduction to the public from 65,000 to 215,000 person-rems, with a best estimate of about 145,000 person-rems.

NUREG-1109 4 Appendix A

1 i

l 1

(4) Potential impact on radiological exposure of facility employees For 100 operating reactors, the estimated total reduction in occupational exposure resulting from reduced core-damage frequencies and associated post-accident cleanup and repair activities is 1,500 person-rem. No in-crease in occupational exposure is expected from operation and maintenance activities associated with the rule. Equipment additions and modifications contemplated do not require work in and around the reactor coolant system and therefore are not expected to result in significant radiation exposure. ,

(5) Installation and continuing costs associated with the backfit, including the cost of facility downtime or the cost of construction delay For 100 operating reactors, the total estimated cost associated with the station blackout rule ranges from $42 to $94 million, with a best estimate ,

of $60 million. This estimate breaks down as follows:

Estimated total cost Estimated ($1 million) number of Activity reactors Best est. High est. Low est.

Assess plant's capability to 100 25 40 20 cope with station blackout Develop procedures and 100 10 15 5 training ,

Improve diesel generator 10 2.5 4 1.5 reliability Requalify diesel generator 2 5. 5 11 2.5 Install hardware to increase 27 17 24 13 plant's capability to cope with station blackout __ __

l Totals 60 94 42 l

l (6) The potential safety im)act of changes in plant or operational complexity, including the relations 1ip to proposed and existing regulatory requirements The rule requiring plants to be able to cope with a station blackout should '

not add to plant or operational complexity. The station blackout rule is closely related to several NRC generic programs and proposed and existing regulatory requirements, as the following discussion indicates.

Generic Issue B-56, Diesel Generator Reliability The resolution of USI A-44 includes issuing a regulatory guide on station blackout that specifies the following guidance on diesel generator reli-ability (Regulatory Guide 1.155, Sections C.1.1 and C.1.2):

NUREG-1109 5 Appendix A 1

The reliable operation of the onsite emergency ac power sources should be ensured by a reliability program designed to monitor and maintain the reliability of each power source over tiise at a specified acceptable level and to improve the reliability if that level is not achieved. The reliability program should include sur-veillance testing, target values for maximum failure rate, and a maintenance program. Surveillance testing should monitor performance so that if the actual fail-ure rate exceeds the target levei, corrective actions can be taken.

The maximum emergency diesel generator failure rate for each diesel generator should be maintained at 0.05 failure per demand. However, for plants having an emergency ac power system [ configuration requiring two-out-of-three diesel generators or having a total of two diesel generators shared between two units at a site], the emergency diesel generator failure rate for each diesel generator should be maintained at 0.025 failure per demand or less.

The resolution of B-56 will provide specific guidance for use by the staff or industry to review the adequacy of diesel generator reliability programs consistent with the resolution of USI A-44.

Generic Issue B-23, Reactor Coolant Pump Seal Failures Reactor coolant pump (RCP) seal integrity is necessary for maintaining primary system inventory during station blackout conditions. The esti-mates of core-damage frequency for station blackout events for USI A-44 assumed that RCP seals would leak at a rate of 20 gallons per minute.

Results of analyses performed for Generic Issue B-23 will provide the information necessary to determine RCP seal behavior during a station blackout. Should this analysis conclude that there is a high probability that the RCP seals would not leak excessively during a station blackout, then no modifications would be required. If there is a significant prob- !

ability that RCP seals can leak at rates substantially higher than !

20 gallons per minute, then modifications such as an ac-independent RCP seal cooling system may be necessary to resolve Generic Issue B-23. Any proposed backfit resulting from the resolution of Generic Issue B-23 would need to comply with the backfit rule.

USI A-45, Shutdown Decay Heat Removal Requirements The overall objective of USI A-45 is to evaluate the adequacy of current licensing design requirements to ensure that the nuclear power plants do not pose an unacceptable risk as a result of failure to remove shutdown decay heat. The study includes an assessment of alternative means of removing shutdown decay heat and of diverse "dedicated" systems for this i purpose. Results will include proposed recommendations regarding the

desirability of, and. possible design requirements for, improvements in l existing systems or an alternative dedicated method for removing decay heat.

l NUREG-1109 6 Appendix A l

l f

The USI A-44 concern for maintaining adequate core cooling under station blackout conditions can be considered a subset of the overall USI A-45 issue. However, there are significant differences in scope between these two issues. USI A-44 deals with the probability of loss of ac power, the capability to remove decay heat using systems that do not require ac power, and the ability to restore ac power in a timely manner. USI A-45 deals with the overall reliability of the decay heat removal function in terms of response to transients, small-break, loss-of-coolant accidents, and special emergencies such as fires, floods, seismic events, and sabotage.

Although the recommendations that might result from the resolution of USI A-45 are not yet final, some could affect the station blackout capability; others would not. Recommendations that involve a new or improved system to remove decay heat that is ac power dependent but that does not include its own dedicated ac power supply would have no effect on USI A-44. Recommendations that involve an additional ac-independent decay heat removal system would have a very modest effect of USI A-44.

Recommendations that involve an additional decay heat removal system with its own ac power supply would have a significant effect on USI A-44.

Such a new additional system would receive the appropriate credit within the USI A-44 resolution by either changing the emergency ac power config-uration group or providing the ability to cope with a station blackout for an extended period of time. Well before plant modifications, if any, will be implemented to comply with the station blackout rule, it is anticipated that the proposed technical resolution of USI A-45 will be published for public comment. Those plants needing hardware modifications for station blackout could be re-evaluated before any actual modifications are made, so that any contemplated design changes resulting from the resolution of USI A-45 can be considered at the same time.

Generic Issue A-30, Adequacy of Safety-Related DC Power Supply The analysis performed for USI A-44 assumed that a high level of dc power system reliability would be maintained so that (1) dc power system failures would not be a significant contributor to losses of all ac power and (2) should a station blackout cccur, the probability of immediate de power system failure would be low. Whereas Generic Issue A-30 focuses on improving battery relaibility, the resolution of USI A-44 is aimed at ensuring adequate station battery capacity in the event of a station blackout of a specified duration. Therefore, these two issues are consistent and compatible.

Fire Protection Program 10 CFR 50.48 states that each operating nuclear power plant shall have a fire protection plan that satisfies GDC 3. The fire protection features required to satisfy GDC 3 are specified in Appendix R to 10 CFR 50. They include certain provisions regarding alternative and dedicated shutdown capability. To meet these provisions, some licensens have added, or plan to add, improved capability to restore power from offsite sources or onsite diesel generators for the shutdown system. A few plants have installed a safe-shutdown facility for fire protection that includes a charging pump powered by its own independent ac power source. In the event of a station NUREG-1109 7 Appendix A

l i

i blackout, this system can provide makeup capability to the primary coolant system as well as reactor coolant pump seal cooling. This could be a significant benefit in terms of enhancing the ability of a plant to cope with a station blackout. Plants that have added equipment to achieve alter-nate safe shutdown in order to meet Appendix R requirements could take credit for that equipment, if available, for coping with a station blackout event.

(7) The estimated resource burden on the NRC associated with the backfit and the availability of such resources The estimated total cost for NRC review of industry submittals required by the station blackout rule is $1.5 million based on submittals for 100 reactors and an estimated average of 175 person-hours per reactor.

(8) The potential impact of differences in facility type, design, or age on the relevancy and practicality of the backfit The station blackout rule applies to all pressurized-water reactors and boiling-water reactors. However, in determining an acceptable station blackout coping capability for each plant, differences in plant charac-teristics relating to ac power reliability (e.g. , number of emergency diesel generators, the reliability 61 the offsite and onsite emergency ac power systems) could result in different acceptable coping capabilities.

For example, plants with an already low risk from station blackout because of multiple, highly reliable ac power sources are required to withstand a station blackout for a relatively short period of time; and few, if any, hardware backfits would be required as a result of the rule. Plants with currently higher risk from station blackout are requir9d to withstand somewhat longer duration blackouts; and, depending on their existing capability, may need some modifications to achieve the longer station blackout capability.

9. Whether the backfit is interim or final and, if interim, the justification for imposing the backfit on an interim basis The station blackout rule is the final resolution of USI A-44; it is not an interim measure.

I l

l l NUREG-1109 8 Appendix A

APPENDIX B WORKSHEETS FOR COST ESTIMATES l

l i

I I

NUREG-1109 Appendix B

APPENDIX B WORKSHEETS FOR COST ESTIMATES Section 4.1 of this report provides a summary of the estimated costs to industry and NRC associated with the resolution of USI A-44. This appendix provides 4 supplementary information to support these cost estimates. The estimates in j the following worksheets are based on information from the following references: l EG&G (1983), Science and Engineering Associates (1986), NRC (1986), and NUREG/ l CR-3568,'-3840, -4568, -4627, and -4932. The utility personnel cost used in I these estimates is $100,000 per person year, including overhead and general and I administrative expenses. l References ;

EG&G, "Cost Analysis for Enhancement of DC Systems Reliability and Adequacy of Safety-Related DC Power Systems," EG&G Report RE&ET-6151, January 1983.

Science and Engineering Associates, Inc., "Response to Industry Comments on Station Blackout Cost Estimates (NUREG/CR-3840)," letter report to NRC, November 12, 1986.

U.S. Nuclear Regulatory Commission, "Repulatory Analysis Guidelines," NRR Office Letter No. 16, Revision 3, May 13, 1986

, NUREG/CR-3568, "A Handbook for Value-Impact Assessment," December 1983.

, NUREG/CR-3840, "Cost Analysis for Potential Modifications To Enhance the A5Tlity of a Nuclear Power Plant To Endure Station Blackout," July 1984.

, NUREG/CR-4568, "A Handbook for Quick Cost Estimates," April 1986.

l , NUREG/CR-4627, "Generic Cost Estimates," June 1986.

1

, NUREG/CR-4942, "Equipment Operability During Station Blackout Events,"

SAND 87-0750, Sandia National Laboratory, to be published.

NUREG-1109 1 Appendix B

l l

Worksheet 1- Estimated cost to assess plant's capability to cope with station blackout (SBO)

Estimated resources-Activity Person-months Dollars

-- Determine system capabilities (e.g., 12 -

batteries, instrument air, condensate storage tank, reactor coolant pump seals)

Evaluate equipment operability Determine equipment / components 2 _

necessary during SB0 Determine heat loads for 6 -

rooms / compartments

. Calculate environmental conditions 4 -

during SB0 3

Compare equipment design / operational 2 -

capability with predicted environ- .

mental conditions I

Quality assurance 4 -

Total 30 $250,000 NUREG-1109 2 Appendix B

Worksheet 2 . Estimated cost to develop procedures and training for station blackout Estimated resources Activity Person-months- Dollars Develoo procedures-(includes writing 3 25,000 review,-and approval)

Training Initial training 3 25,000 Annual update training 0.5/yr 5,000/yr s Total _ training costs are calcul' .;ed by adding the initial training costs and the present value of the annual training costs over the remaining plant lifetime.

CTL = CIT + C AT '

(1 + D')

where CTL = total training costs CIT = initial training costs CRT = annual training costs D = discount rate (.10)

L = remaining plant lifetime (25 years)

Therefore, adding the cost to develop procedures, the total cost for procedures and training is estimated to be $100,000.

i NUREG-1109 3 Appendix 8

k l

Worksheet 3 Estimated costLto improve diesel generator reliability Activity Estimated Cost Reliability investigatior. $100,000 Equipment modifications 150,000 Total $250,000 Worksheet 4 Estimated cost to requalify a diesel generator Assuming that a plant would shut'down for 5 days to requalify a diesel generator. The replacement energy cost (C R

) is the dominant cost associated :

4 with this activity. C can be calculated using the following equation: I R

CR=ExPxR where E = net electrical output (kWe)

P = shutdown period (hours)

R = replacement energy charge rate ($/kWh) ,

The table below presents the data used to calculate the best, high, and low estimates to requalify a diesel generator. )

i l

Value i )

Parameter Best High low !

Net plant electrical outpost (kWe) 900,000 1,150,000 500,000

! Shutdown period (hours) 120 120 120 Replacement energy cost ($/Kwe)* 0.026 0.040 0.020 Total cost ($1 million) 2.8 5.5 1. 2 Y

Costs from NUREG/CR-4568 i

4 f

NUREG-1109 4 Appendix B

ga,c,,oa=m v. vetua niovmoav eo u o= . a+r wwu aw- ., r,oc - u . .. .,, .

$ "3$ BIBUO2RAPHIC DATA SHEET h

sin iwst auct s 2 vasLE.NO.vtf t=< aivaan NUREG-1109 3 Li .v. S t.gg f

Regulatory / kfit Analysis for the Resolution of Unresolved ty Issue A-44, Station Blackout ,, ' " "' ' ", ' 'Y' "j ,,

<-v i ~a 's . March 1988

. . , . ,,1, . .. , ,oa,... so wo.,, a . . ..

g June,- 1988 e n _, oa . o oa o +, u .o~ ~.. . .,u~o .ooa us um. <, c , . ,ao. c u . .v+,%.ua Of fice of Nuclear R , latory Research UST A-44 Office of Nuclear Re r Regulation

**f***""

U.S. Regulatory Commis. n Washington, DC 20555 io s,o=soamo oac.+1.r.o .wi . o u.,u~o ausu,$,.e c , r ii. 1 n o, a n oar Office of Nuclear Regulator' esearch Regulatory Analysis Office U.S. Nuclear of Nuclear Reactor Regulatory Re, d'onplation Commi * " * ' ' ' ' ' ' " ~ ' " " '

Washington, DC 20555 >

i,. _ e.., .a .o,s.

s

~

Mone is .e s s-.c s ax .eu. >

f.

Station blackout is the complete lo. of a ernating current (ac) electric power to the essential and nonessential buses a uclear power plant; it results when both offsite power and the onsite emergene power systems are unavailable. Because many safety systems required for react re decay heat removal and containment heat removal depend on ac power, the.' n quences of a station blackout could be severe. Because of the concern abo the ]equencyoflossofoffsitepower,the n.cnber of failures of emergency di el gent tors, and the potentially severe con-sequences of a loss of all ac po' r, "Stati Blackout" was designated as Unresolved Safety Issue (USI) A-44.

This report presents the reg atory/backfit ana. sis for USI A-44. It includes (1) a sunnary of the issue, 2) the recommended g chnical resolution, (3) alternative resolutions considered by e Nuclear Regulatory ission (NRC) staff, (4) an assessment of the benefi and costs of the rec ded resolution, (5) the decision rationale, (6) the rel onship between USI A-44 andActher NRC program and require-ments, and (7) a back t analysis denenstrating thatphe resolution of USI A-44 complies with the fit rule (10 CFR 50.lc,9). 3 i

.._,.N._... _ .o.oi ca.,o..

,..=,.

(k !

Unlimited Stati 81ackout Y . u cua ,, u .u.. ,c cio USI 44

< = is:so 5 e aws

% a..-

. .ci %i .. .,sa 4 gggg

a. ws, Unclassified

. , wo n a o, . :,is

/

\ 6 .. .c a eu,5.Cc ds.sggr pazgfth; crrJcciigsg.;;2-?9?s9 M97

(

l UNITED STATES 5,icin . u v ciass=*ti 1 NUCLEAR REGULATORY COMMISSION *ts* Q'S '"

WASHINGTON, D.C. 20555 ,,,,,, ,, o g OFFICIAL BUSINESS PEN ALTY FOR PRIVATE USE,4300 120555078877 US NRC-0AR9-AD.U l ? NlAlIIS jIV 0F 993 gy;3 ,

w-kjjY & PUB MGT 99.p0R NUREG W4SHINGTON DC 20559 h

C-m k

d o

Z to a

X O

C H

. . . . .

ML20155A652

Text

SUMMARY

SUMMARY

Navigation menu

Search