ML20065T986
| ML20065T986 | |
| Person / Time | |
|---|---|
| Site: | Clinch River |
| Issue date: | 11/01/1982 |
| From: | Cochran T National Resources Defense Council |
| To: | |
| Shared Package | |
| ML20065T981 | List: |
| References | |
| NUDOCS 8211030316 | |
| Download: ML20065T986 (71) | |
Text
,.A y.-
00CKETED Ust4RO BEFORE THE UNITED STATES NUCLEAR REGULATORY CQgIyigQ4 PS:19 ATOMIC SAFETY AND LICENSING BNRD cr cr nF EECFET"7T i s LiiNG 1 SERV!C.
)
U N EU In the Matter of )
)
UNITED STATES DEPARTMENT OF ENERG.* )
PROJECT MANAGEMENT CORPORATION ) Docket No. 50-537 TENNESSEE VALLEY AUTHORITY )
)
(Clinch River Breeder Reactor Plant) )
)
TESTIMONY OF DR. THOMAS B. COCHRAN PART IV (Intervenors' Contentions 1, 2, and 3)
DATED: November 1, 1982 8211030316 821101 PDR ADOCK 05000537 T PDR
l
(
l O.1: Please identify yourself and state your qualifications to present this testimony.
A.2: My name is Thomas B. Cochran. I reside at 4836 North 30th Street, Arlington, Virginia 22207. I am a Senior Staff l
Scientist at Natural Resources Defense Council, Inc. My I background and qualifications to present this testimony are presented in previous testimony in this proceeding.
(Tr. 2870-71, Cochran.)
0.2: What is the subject matter of the present testimony?
l A.2: Part IV of my testimony deals with the potential for severe accidents at CRBR and the adequacy of Applicants' and Staff's analyses of those accidents. These are
' ~
matters that are raised in Intervenors' Contentions 1, 2, and 3. For purposes of this phase of the proceeding,
{ those Contentions read as follows:
l l
L a) Neither Applicants nor Staff have demonstrated through reliable data that the probability of anticipated transients without scram or other CDA initiators is sufficiently low to enable CDAs to be excluded from the envelope of DBAs.
b) [ deferred]
- 2. The analyses of CDAs and their consequences i
by Applicants and Staff are inadequate for i purposes of licensing the CRBR, performing l the NEPA cost / benefit analysis, or demonstrating that the radiological source term for CRBRP would result in potential hazards not exceeded by those from any l
i l
i
(
accident considered credible, as required by 10 CFR 100.11(a).
a) The radiological source term analysis used in CRBRP site suitability should be derived through a mechanistic analysis.
Neither Applicants nor Staff have based the radiological source term on such an analysis.
b) The radiological source term analysis should be based on the assumption that CDAs (failure to scram with substantial core disruption) are credible accidents within the DBA envelope, should place an upper bound on the explosive potential of a CDA, and should then derive a conservative estimate of the fission product release from such an accident.
Neither Applicants nor Staff have performed such an analysis.
c) The radiological source term analysis has not adequatel;. considered either the release of fission products and core materials, e.g., halogens, iodine, and plutonium, or the environmental conditions in the reactor. containment building created by the release of substantial quantities of sodium. Neither Applicants nor Staff have established the maximum credible sodium release following a CDA or included the environmental conditions caused by such a sodium release as part of the radiological source term pathway analysis, d) Neither Applicants nor Staff have demonstrated that the design of the containment is adequate to reduce
! calculated offsite doses to an acceptable level.
e) As set forth in Contention 8(d), neither Applicants nor Staff have adequately calculated the guideline values for radiation doses from postulated CRBhP releases.
l
== wm- - - - -- - e- .- -,,, -,w-,--%--.e., _, ,. _ . _ _ - , , - , . . . _ , , . _ . , - , ___,_,y.,.,,,,
lL
't
(
f) Applicants have not established that the computer models (including computer codes) referenced in Applicants' CDA safety analysis reports, including the PSAR, and referenced in the Staff CDA safety i
analyses are valid. The models and computer codes used in the PSAR and the Staff safety analyses of CDAs and their consequences have not been adequately documented, verified,,or validated by comparison with applicable experimental data. Applicants' and Staff's safety analyses do not establish that the models accurately represent the physical phenomena and principles that control the response of CRBR to CDAs.
g) Neither Applicants nor Staff have I
established that the input data and assumptions for the computer models and codes are adequately documented or verified.
h) Since neither Applicants nor Staff have established that the models, computer codes, input data, and assumptions are
( adequately documented, verified, and validated, theyrhave also been unable to establish the energetics of a CDA and thus have also not established the adequacy of the containment of the source term for post accident radiological analysis.
- 3. Neither Applicants nor Staff have given sufficient attention to CRBR accidents other than the DBAs for the following reasons:
a) [ deferred]
b) Neither Applicants' nor Staff's analyses of potential accident initiators, sequences, and events are sufficiently comprehensive to assure that analysis of the DBAs will envelop the entire spectrum of credible accident initiators, sequences, and events.
c) Accidents associated with core meltthrough following loss of core geometry and sodium-concrete interactions have not been adequately analyzed.
L
l
(
d) Neither Applicants nor Staff have adequately identified and analyzed the ways in which human error can initiate, exacerbate, or interfere with the mitigation of CRBR accidents.
The accident discussion at this phase focuses on Appendix J of the Draft Supplement to the FES, NUREG-0139 l
(henceforth "DSFES").
Q.3: Dr. Cochran, are you familiar with Staff's NEPA analysis of the risks of potential accidents associated with the CRBR?
A.3: Yes.
Q.4: Where is this analysis set forth?
A.4 Primarily in Chapter 7 and Appendix J of the DSFES, although some paragraphs from Chapter 7 of the 1977 FES 1
l have been retained, including the conclusions in $7.1.4.
Q.5: Do you have general criticisms of Appendix J7 A.5: Yes. The methodology in Appendix J is crude by today's
! standards, and the assumptions behind it (and the input data) are not supported by any substantive analysis.
While it presents estimates of the absolute probability of CRBR accidents, these estimates are backed up by no calculations and no event tree / fault tree analyses as one finds in risk assessment analyses such as the Reactor
9 Safety Study (WASH-1400) and CRBRP-1. No operating data are offered in support of its conclusions, and there are no quantified estimates of the uncertainty associated with the probability estimates. It must be remembered that WASH-1400, which contained an incomparably more detailed analysis of accident probabilities for two actual LWRs (and which is, incidentally, the direct progenitor of all nuclear risk assessment work) was severely criticized for making unsupported assumptions, for failing to properly assess uncertainty and for its factual inscrutability.
For these reasons, the NRC ultimately repudiated WASH-l 1400's absolute probability predictions. Yet, compared to Appendix J, WASH-1400 was a model of scientific analysis. Appendix J is not even supported by a plant-specific risk assessment. Its assumptions are not just unsupported; for the most part, they are not even presented for evaluation. If WASH-1400's probability estimates were unreliable, as the Commission correctly concluded, then the probability estimates in Appendix J are far more so. There is no reason to accept these on faith, and very little beyond faith is offered.
Moreover, there has been no attempt whatever by the l
Staff to quantitatively assess the uncertainty associated with the estimates for various quantitative accident probabilities and consequences presented in Appendix J.
9
(
l Probably the most serious criticism of WASH-1400 from the scientific community was its failure to assess or properly acknowledge the very large uncertainties attached to absolute probability predictions. Those uncertainties, which have been estimated to be as large as a factor of-100 in some cases, must be much greater for predicting CRBR accident probabilities, since the body of relevant operating data for LMFBRs is far less than for LWRs and since, for lack of a plant-specific assessment, the report is almost totally based on conclusory statements that can most charitably be characterized as " engineering judgment." Without some reasonable and scrutable assessment of the uncertainties inherent in these predictions, they are simply arbitrary and meaningless.
0.6: Do you know whether the NRC Staff performed any calculations, reviewed operating data for other facilities, or did any plant-specific assessment of the f
1 reliability of the CRBR systems to back up the probability estimates presented in Appendix J?
i l A.6: According to the NRC Staff, with only three exceptions 1
(WASH-1400 for PWR auxiliary feedwater reliability and the 1
l probability of loss ot offsite power, and NUREG-0460 for l
I the frequency of anticipated transients without scram for typical LWRs), they did not. NRDC asked the Staff in 1
discovery to identify the documents relied upon for each of the principal probability assessments in Appendix J.
(See Staff Response to NRDC's 27th Set of Interrogatories, Oct. 1, 1982, pp. 53-70.) In almost every case, the Staff responded under oath that it relied on nct " specific" documents for any of the conclusions presented, instead relying generally on the " cumulative knowledge" of the Staff and its consultants in general, or a similar response. While " engineering judgment" or " cumulative knowledge" is valuable for many purposes, it is not sufficient to support predictions of the probability of serious accidents in a plant as complex and untested as the CRBR.
Q.7: Have you been limited in your ability to independently assess the probability of accidents beyond the design l
basis for CRBR?
A.7: Yes, independent assessment has been greatly hindered.
The probability of a catastrophic accident in any plant is a function of the plant design, the potential for equipment malfunction and human error, and the reliability of its many complex systems and components. The CRBR is the first plant of its kind. The Applicants have done much work in assessing the reliability of the CRBR design, primarily as part of Applicants' Reliability Program (see
o PSAR, Appendix C). The document known as CRBRP-1 is another prominent example. The Applicants have underway a comprehensive probabilistic risk assessment (PRA) of the CRBR and preliminary results have been presented to the ACRS and the Staff (cf., Letter from John R. Longenecker,
. CRBR Project to Paul S. Check, USNRC, June 21, 1982, subj:
Probabilistic Risk' Assessment (PRA) Program Plan).
However, the scope of this LWA-1 proceeding has been limited to exclude inquiry into what are termed the
" details" of the CRBR design. CRBRP-1 has been expressly excluded from consideration. In my judgment, no reliable estimate of CRBR accident probabilities can be made within the present scope of the LWA-1 proceeding and without reviewing the CRbR design in some detail.
This has not been possible at this' stage.
Q.8: Do you believe that the analysis in Appendix J is
~
realistic and adequate to support the staff's conclusions regarding Consequences of Class 9 accidents, namely "that CRBR accident risks would not be significantly different from those of current LWRs..." and that "the accident risks at CRBR can be made acceptably low." (Appendix J at J-19)?
A.8: No.
i
O.9: Please proceed to discuss some of the specific probability estimates. To begin, what frequency of occurrence did the NRC staff assign to core degradation due to LOHS (loss of heat sink) events for CRBR and what rationale did the staff give for its estimate? -
A.9: The Staff assigned a frequency of core degradation due to LOHS events of less than 10-4 per reactor year (i.e., one chance in 10,000 per reactor year). The Staff cited three principal factors for this result:
- 1. A " general consideration of typical achievable PWR auxiliary feedwater system reliabilities;"
- 2. The " potential for common cause failures;"
- 3. The potential for achieving "high reliability in final design and operation through an effective reliability program." (DSFES, pp. J-3, -4.)
While the three above factars are all listed as the bases
[
for the estimated LOHS probability, only the first -- PWR auxiliary feedwater system reliability -- serves as the basis for the Staff's quantified estimate. The role the other two factors play in the choice of the 10-4/ year estimate is discussed only in the most general qualitative l terms, e.g., "... unavailability estimates for ... heat l
I removal systems have been set high enough to include allowance for potential common mode failures" (Appendix J.
- p. J-18). The choice of auxiliary feedwater system
i failure as the controlling failure mode is not' justified. In other words, there is no reason to believe that failures in systems other than auxiliary feedwater may not contribute si'gnificantly to the LOHS probability. A fault tree analysis is necessary to justify limiting the discussion to auxiliary feedwater reliability.
In order to illustrate the complexity of this issue, consider the generalized fault model for the shutdown heat removal system for CRBR taken from CRBRP-1, Vol. 2, Appendix II, p. 2-14 to 2-22 (attached to my testimony as Exhibit 1). This fault tree, which is developed to the system (or subsystem) level rather than the more detailed component level as in the WASH-1400 case, can be considered applicable-to a reactor of the general size and type as CRBR. Clearly, it takes a leap of faith to conclude that the failure rate of the auxiliary feedwater l
system controls the overall frequency of core degradation due to LOHS events.
O.10: Setting aside your view that there is no basis for concluding that the failure rate of the auxiliary feedwater system is controlling, do you agree with the l
Staff's estimate of the feedwater system reliability?
! Explain your answer.
l
1 A.10: First, I should note that the Staff claims that its estimate of the probability of LOHS events was based on independent analyses, primarily by William Morris of the Staff and Staff consultant Edward Rumble of SAI, each using a different base of information (Deposition of William Morris, Oct. 12, 1982, pp. 24-25).
Mr. Morris claimed his estimate is based on the reliability of auxiliary feedwater systems in PWRs over the years as documented in the Standard Review Plan for LWR feedwater systems (Morris, Deposition of Oct. 12, 1982, pp. 23-24).
Mr. Rumble also claimed his estimate was based on reliability studies of PWR auxiliary heat removal systems, l
l the Accident Delineation Studies (Phases 1 and 2) (NUR5G-l CR-1407 is Phase 1) prepared by Sandia for NRC-NRR, and the study CRBRP-1 (which is beyond the scope of the LWA-1 proceeding). Mr. Rumble said these estimates were what he believed should be achievable, not necessarily what has been achieved to date (E.R. Rumble, private telephone communication, July 27, 1982, as noted in T.B. Cochran Memo to Files, July 27, 1982).
I do not agree with the Staff's estimate or the Staff's underlying analysis. First, LOHS fault trees for CRBR developed in CRBRP-1 differ from those of a PWR as developed in WASH-1400, and consequently there is no l
l
obvio2s correlation between PWR system reliabilities and the core degradation frequency due to LOHS accident scenarios in CRBR. This can be seen by comparing the generalized fault models for CRBR shutdown heat removal (see CRBRP-1, Vol. 2, Appendix II) with the fault models i
for a PWR (see WASH-1400, App. II).
The Staff claims that its estimate of 10-4/ year is based on " typical achievable PWR auxiliary feedwater system reliabilities" (Appendix J at J-13). If this is so, there must be wide variations in achievable feedwater system reliability. For example, the RSSMAP (Reactor Safety Study Methodology Applications Program) report for Calvert Cliffs (NUREG/CR-1569) concluded that the probability of core melt for Calvert Cliffs was 1 chance in 2400 per reactor year, largely due to unreliabilities in the auxiliary feedwater system and failure of backup heat removal methods. This result is a factor of 4 larger than the Staff's alleged " upper bound" result for CRBR.
No justification has been presented for concluding that he l CRBR auxiliary feedwater system will be more reliable than Calvert Cliffs by at least a factor of four. Furthermore, there is a serious question about the comparability of PWR l
operating data in this area to the CRBR. It should be noted in this connection that the authors of the Applicants' risk assessment work felt that the WASH-1400 I
data could not be applied to the question of unavailability of decay heat removal systems for CRBR.
Instead, a fault tree analysis was conducted to determine the system availability. (CRBRP-1, Vol. 2, at III-3.)
There is no basis for concluding that CRBR's auxiliary feedwater system will be " typical" in its reliability. The conservative assumption to make at this juncture might be to assume that CRBR's auxiliary feedwater system will be no better than Calvert Cliffs' system. Moreover, since CRBR's Decay Heat Removal System (DHRS) is dependent upon AC electrical power, it cannot be assumed to be significantly more reliable than PWR DHRSs; according to Staff (DSFES, p. J-4), a principal unreliability in PWR decay heat removal systems is not in system failures per se but in loss of offsite and onsite l AC power. Thus, if Staff is correct, the ability of the CRBR DHRS to operate at " normal" temperature and pressure (whereas PWR DHRSs can operate only at low pressure) should not have a major impact on overall risk.
Q.ll: Are there other CRBR heat removal systems that are important in terms of the comparability between the l
frequencies of core degradation in CRBR and PWRs due to loss of heat sink (LOHS)?
l l
l
1 A.ll: What I noted above was that one cannot tell the degree of contribution that various component failures have on the overall failure rate without a detailed fault tree analysis. However, it is evident that there are other CRBR heat removal components whose failure rates ete not necessarily comparable to PWR systems. The steam generators are an example. There.is no discussion whatever in Appendix J of the contribution of steam generator failure to the overall risk of LOHS, nor of the possible mechanisms or modes of failure considered.
Unlike an LWR, the steam generators in an LMFBR, such as CRBR, represent a location where significant amounts of sodium and water are in close proximity. CRBR event sequences can be postulated, e.g., propagation of steam -
generator tube failures, where sufficient water and sodium can be brought together in such a manner as to create a j sodium-water reaction coupled with a hydrogen reaction, resulting in loss of the shutdown heat removal function (see generally CRBRP-1, Appendix VIII).
The General Accounting Office in a recent letter to Congress was highly critical of DOE's failure to conduct complete and thorough tests of the steam generators to be used in the CRBR, in spite of the fact that steam -
l generators for LMFBRs have had a history of serious l .
technical problems and the fact that development and 9
i 6
e i
demonstration of reliable steam generators have been and still are one of the most significant technical problems facing the CRBR project. (Letter from Charles A. Bowsher, Comptroller General, to Congressman John D. Dingell, May 25, 1982, GAO/EMD-82-75, attached as Exhibit 2).
In sum, because of the inherent differences in the shutdown heat removal systems, e.g., steam generators, between PWRs and LMFBRs introduced by the use of sodium j coolant in an LMFBR, it does not directly follow that the j frequency of core degradation due to LOHS events in PWRs is directly transferrable to LMFBRs.
Q.12: How did the Staff treat the contribution of pipe rupture l
I failure as a contributor to the core disruptive frequency?
A.12: The frequency of large pipe breaks (loss-of-coolant accidents, or "LOCAs") is pivotal to an assessment of the risk of accidents at CRBR or a reactor of the general size and type. A large pipe break in the cold leg (and perhaps the hot leg, as well) would likely lead to core disruption and serious offsite consequences. It is an important determinant in whether the CRBR site is suitable. The Staff states:
Because of the high boiling point of sodium, I the CRBRP primary coolant system would operate at significantly lower pressures than l
LWR primary coolant systems. This reduces i the frequency of large ruptures in the primary coolant system. To further ensure
I l .
i l
- i that large breaks cannot occur and cause core
- damage, implementation of preservice and I
inservice inspection of the primary coolant boundary-and a leak detection system will be required. In addition, a guard vessel will be included to prevent unacceptable leakage from large portions of the primary coolant i system. For these reasons LOCAs are not
{ considered credible (i.e., design-basis) i , events at CRBRP. The frequency assumed for LOMS adequately bounds the LOCA contributions to core disruption frequency. -
i (DSFES, p. J.4, emphasis supplied.) When asked to.
4 identify every document relied upon by the Staff for its conclusion above that "LOCAs are not considered credible f ... events at CRBRP," the Staff stated:
The cumulative knowledge of the Staff and its consultants rather than a specific document were relied upon by the Staff for its conclusions in Appendix J regarding whether LOCAs are DBAs for CRBR. This issue was also discussed in the SSR and the Staff's prefiled testimony for the site suitability hearings.
l (Staff Response to Interrogatory 33, 27th Set, Oct. 1,
! 1982, p. 58.) I take this answer to mean that the Staff l has no documentation or written analysis demonstrating that a LOCA is a low probability event for the CRBR.
In the 1982 SSR, the Staff stated:
It is the staff's opinion, based on the following considerations, that the heat transport system can be designed for a high level of integrity and for continued assurance of this integrity throughout the operating history of the plant. The specifications include stringent nondestructive examination requirements. The material is characterized by high fracture toughness and corresponding large critical flaw size, a negligible growth rate of i
. . - _ _ _ _ _ _ . _ _ _ , . _ _ . - - _ _ _ _ _ _ , . _ _ _ _ _ , . . _ . _ _ . , , , _ _ . . _ , . _ _ _ . _ _ _ . ~ _ _ , . _ _ . _ , _ _ _ _ _ _ . . - .
postulated defects and the probability of throughwall growth rather than elongation of defects. The system has low stored energy and is monitored by sensitive leak detection instruments. The staff preliminary conclusion is that double ended rupture of the CRBRP primary cold leg piping (an event that could potentially lead to a CDA unless otherwise mitigated) need not be considered a design basis event. This conclusion is conditioned on an acceptable preservice and inservice inspection program, a material surveillance program, continued research and development verifying material degradation processes, and verification of leak detection system performance. The staff considers it feasible to implement programs to satisfy these requirements. The staff intends to continue its review of the sodium cold leg piping to insure that the issues are resolved properly.
Because of its higher operating temperature, the same conclusions have not yet been reached concerning the hot leg piping (995*
vs 730' F). The staff has studies underway to evaluate the potential for and consequences of hot leg piping ruptures.
Preliminary results obtained so far indicate that this event has more benign consequences with respect to core thermal conditions than the cold leg rupture. For example, a hot leg pipe rupture followed by a scram and a pump trip and normal flow coastdown does not appear to lead to boiling in the core.
Analyses of this event are continuing and the results will be factored into any future requirements to assure that hot leg pipe ruptures, like the cold leg case, need not be considered as events that would lead to a CDA.
(1982 SSR, pp. II-8 to II-9.)
Q.13: Do you agree with Staff's assessment, as stated above, of the pipe rupture probability, and, if not, what is the
a basis for your disagreement?
A.13: I disagree with the Staff assessment. In this regard, it is extremely instructive to compare the Staff's analysis with the analyses conducted by D. O. Harris of the Palo Alto office of Science Applications, Inc. (SAI), for the CRBR Project office in the 1977-78 period. SAI was a consultant to the CRBR Project in the development and application of the fault tree / event tree methodology for assessing the reliability of CRBR systems as published in CRBRP-1, March 1977, and continued work for DOE on a variety of CRBR risk assessment issues through early 1979 and perhaps beyond. Staff consultant Rumble is a Vice President of SAI at the same Palo Alto office and has stated to me that he relied in part on CRBRP-1 for hiJ assessment of the core degradation frequency which appears in Appendix J of the SSFES.
I have not been permitted to address that work in this hearing because, of course, it involves the " details" of the CRBR design. Only the most general conclusions have been presented in Appendix J.
In what appears to be a final risk assessment task report, obtained by NRDC under the Freedom of Information Act, D.O. Harris of the SAI Palo Alto office summarized the result of SAI's assessment of the CRBR pipe rupture probability (Harris, D.O., " Relative Pipe Ru' re
Probability for the Primary Heat Transport System of CRBRP," Nov. 13, 1978, attached as Exhibit 3 to this testimony).
Harris's analysis appears to be based on the assumption that the primary large pipe failure mechanism is fatigue crack growth due to cyclic stress imposed on defects introduced prior to service, hence other potential sources of failure were not considered. In this respect, Harris's analysis appears similar to that conducted in CRBRP-1 (Vol. 2, App. III, p. III-ll2). In the Harris analysis, calculated relative probability of pipe rupture in CRBR compared to that of PWRs was primarily a function of a) probability of having a defect, which in turn was a l
function of the number and characteris' tics of the weld joints, Because the appropriate normalization was not known, separate calculations were made using weld volume, weld area, and weld length as the basis of normalization.
b) the initial crack size and depth distribution. Because the appropriate crack distribution was not known, separate calculations were made using four crack distribution expressions.
The differences between the Staff's assertions and the SAI l
l anlysis are important. The Staff's conclusion that the
7 e
CRBR cold leg pipe break is incredible (i.e., beyond the '
design basis) is based in part on the fact that there will be preservice and inservice inspection programs. Such programs have been in place for light water reactors for some time. The SAI analysis assumed equivalent effectiveness for the inspection programs for both CRBR l
and PWR in each calculation of the relative probability of pipe break failure of the two. This is the approriate way to treat the subject. The Staff offers no evidence that any relative dif ference in the CRBR and PWR surveillance programs would have a significant effect on the crack distributions in CRBR piping relative to that in PWRs.
SAI found that "[w]ith the present state of knowledge, it is not possible to ascertain the controlling
- parameters" that govern the relative CRBR/PWR' pipe break 1
frequency. SAI found.-a wide range of values varying from 0.0186 to 11.62 (i.e., three orders of magnitude) in the
, ratio of CRBR pipe failure to PFP pipe failure depending i
on the assumptions made. In fully 13 out of 36 cases (36%) analyzed, the probability of CRBR pipe failure exceeded the probability of PWR pipe failure.
Furthermore, the probability of PWR failure was found to be strongly design dependent, varying by as much as a factor of 14 among the three PWRs analyzed.
In conclusion, the Staff analysis of the pipe break probability is nothing more than a series of unsupported assumptions that appear to be in conflict with a more rigorous CRBR-specific analysis. The SAI analysis does not support the conclusion that a LOCA is " incredible" for the CRBR. Moreover, as evidenced by the SAI analysis, i.e., the lack of understanding of the controlling factors, the fact that the CRBR pipe break frequency may be as much as 12 times higher than that in a PWR, and the fact that the frequency is a strong function of the number and characteristics of the pipe welds, which are design dependent, the Staff conclusion that a cold (or hot) leg pipe rupture is not credible in a reactor of the general size and type of CRBR is not substantiated by rigorous analysis. It should be rejected.
! Q.14: Do you agree with Staff's analysis of common mode failures?
A.14: The one sentence devoted to common cause failure hardly qualifies as "an analysis." LOHS failures due to common causes are but one manifestation of a larger class of failures that fall under the general category of systems interaction (SI). Systems interaction is presently the subject of two unresolved safety issues (USIs) -- namely A-17, " Systems Interaction in Nuclear Power Plants," and
A-47, " Safety Implications of Control Systems." The NRC has sponsored four separate evaluations of systems interaction in an attempt to develop an acceptable methodology for reviewing final designs for adverse systems interactions. These four studies are:
- 1. NUREG/CR-1321, " Final Report -- Phase I Systems Interaction Methodology Applications Program," -
G. Boyd, et al., Sandia National Laboratories, April 1980.
- 2. NUREG/CR-1896, " Review of Systems Interaction Methodologies," P. Cybulskis, et al., Battelle Columbus Laboratories, January 1981.
- 3. NUREG/CR-1859, " Systems Interaction: State-of-the-Art Review and Methods Evaluation," J.J. Lim, et al., Lawrence Livermore Laboratory, January 1981.
- 4. NUREG/CR-1901, " Review and Evaluation of System Interactions Methods," A.J. Busiik, et al.,
Brookhaven National Laboratory, April 1981.
The NRC Staff's evaluation of these four reports is summarized in the periodic "TMI Action Plan Tracking System Report" as foliows:
State-of-the-art review concluded that no single method presently exista in a form that can be used to perform an adequata review for
- adverse SI.
Thus, it can be fairly concluded that an adequate systems interaction review of CRBR could not have been conducted. Moreover, such a review requires a final l design, which is not yet available for CRBR. It should be noted that three of the SI reviews above attempted unsuccessfully to evaluate SI in actual past events l
involving SI, including the Browns Ferry fire in 1975, the TMI-2 accident in 1979, the Browns Ferry partial scram failure in 1980, the pressurizer relief valve failure at Beznau in 1974, the temporary loss of decay heat removal at Davis-Besse in 1980, the loss of DC control power and diesel generator fire at Zion in 1976, and the Crystal
. River LOCA in 1980.
In addition, common mode failures and other forms of systems interaction involve more than just hardware failures. Also involved are external events (such as seismic events and hurricanes), human error (including errors of omission and commission, and including not only operations but design, fabrication, installation, maintenance, and testing), and design flaws. The design of the control room and any auxiliary control panels or remote shutdown locations, and actual operating, emergency, maintenance, and test procedures can also impact on systems interactions.
In sum, the effect of potential common mode failures on CRBR accident probabilities involves complex issues that the technical community has been wrestling with for years, thus far without notable success. There is no substantive basis for Staff's broad-brush assertion that
"[t]he foregoing estimates of frequencies and risk associated with CRBR have included allowances for
uncertainties. For example, unavailability estimates for shutdown and heat removal systems have been set high enough to include allowances for potential common cause failures." (Appendix J at p. J-18.)
i Q.15: In estimating the quantitative probability of CRBR accidents, can credit be assigned for an " effective reliability program"?
A.15: In my opinion, it is not possible to assign any particular value to the level of " reliability" to be achieved. No CRBR-specific program has been presented by the Staff; no precedent is cited for an " effective reliability program" for any other plant and no criteria are presented.
! Finally, such assertions about the achievability of high reliability must be taken in the context of the most _
recent construction and design experience. This body of experience includes widespread problems at Diablo Canyon, Zimmer, and Midland. This experience is scarcely cause i
for confidence.
For all the reasons given above, I conclude that the NRC Staff's estimate of the frequency of core degradation due to LOHS events is optimistic, unsupported by rigorous analysis, and fails to properly account for uncertainties.
l
- - -- , _ . . . ~ . - . - __ _ . _ . . _ _ . . , . _ , -
. , _ , _ . _ _ _ _ . . . _ . _ , , _ _ _ _ _ , . . . _ ~ , _ , , _ _ _ _ _ - .
Q.16: Turning now to other contributors to the probability of core disruption, what assumption did the Staff make with regard to the probability of simultaneous failure of both reactor shutdown systems?
A.16: The Staff assured that "there are sufficient inherent redundancy, diversity, and independence in the overall shutdown system designs to expect an unavailability of less than 10-5 per demand," and concluded that "the combined frequency of degraded core accidents initiated by ULOF and UTOP events is less than 10-4 per *eactor" (DSFES, p. J-4).
O.17: What is the basis for the Staff estimate?
A.17: Beyond the explanation on page J-4 of the DSFES, the Staff claimed the value of 10-4 per year was a bounding value based primarily on LWR experience as published in NUREG- e 0460, " Anticipated Transients Without Scram for Light Water Reactors." In Vol. 1, Section 4.3 of NUREG-0460, an estimate of 2x10-4 per year for the frequency of ATWS for typical LWRs was given. The Staff also stated, "Because the [CRBR shutdown systems] design and the reliability program are not final they have not been definitive in making the reliability estimate." (Response to Interrogatories 36, 37, 38, 27th Set, Oct. 1, 1982,
- p. 60.)
i t
l t
o Staff witness Morris claimed that Mr. Rumble of SAI may have had a different basis for arriving at the value of 10-4 per year (Deposition of Staff witness Morris, Oct.
12, 1982, p. 43).
- Staff witness Rumble said the basis for his estimate of the scram reliability of 10-5/ demand at DSFES, p. J-4, was based primarily on UUREG-0460; however, several other studies were mentioned as well. Mr. Rumble stated he was
- not familiar with the Commission's ATWS Policy Statement. (Edward Rumble, private communication, July 27, 1982, as recorded in Memo to files of T.B. Cochran, July 27, 1982.)
, 0.18: Do you agree with the Staff conclusion that 10-4 per year is a conservative " upper bound" frequency of degraded core accidents initiated by ULOF and UTOP events in CRBR and, if not, what is the basis for your disagreement?
A.18: I do not agree. I believe 10-3 per year would be a conservative upper bound based on the Commission's LWR analysis in the Commission's Proposed ATWS rule for LWRs (46 Fed. Reg. 57521, Nov. 24, 1981)(see Tr. 2845, Cochran). While 10-4/ year might ultimately be shown to be appropriate, in light of the current absence of the t detailed CRBR failure mode and effects analysis for the shutdown systems and consideration of effects of common P
l I
l
O mode failure, includi'ng, for example, seismic induced
, scram failures, there is at this time no basis for
- selecting a value larger than 10-3 per year.
1 0.19: What assumptions did the Staff make with regard to the probability of core degradation as a consequence of fuel failure propagation?
i A.19: The Staff assumed that "the CRBR fuel design wi'll be required to have an inherent capability to prevent rapid propagation of fuel failure from local faults" (DSFES,
- p. J-4) and that the frequencies attributed to LOHS, UTOP, i and ULOF events adequately bound the contribution to core
! disruption frequency from fuel failure propagation (DSFES,
- p. J-5).
I i
l l Q.20: Has the Staff provided adequate justification for this assertion, and what is the basis for your conclusion.
A.20: I do not believe there is an adequate basis for this conclusion. The Staff has not developed the specific requirements or any associated criteria or confirmatory programs to prevent rapid propagation (details of the systems to prevent propagation of fuel failure are not final at this time), and the Staff could cite no documentation for the conclusion that the core disruption frequency due to fuel failure propagation is bounded by
e 10-4 per year (Response to Interrogatory 39, 27th Set, Oct. 1, 1982, pp. 62-63).
l l Q.21: What assumption did the Staff make with regard to the conditional frequency that a CDA once initiated would be energetic?
A.21: The Staff developed four categories of primary system l
I failure as a function of the energy associated with
, disruption (DSFES, p. J-5) and assigned a probability of i
primary system failure by excessive mechanical and/or thermal loads resulting in continuous open venting into the upper containment through failed seals (Category IV) i af approximately 0.1 per CDA (DSFES, p. J-6).
t 0.22: What basis did the Staff give for this assumption?
A.22: In response to interrogatories asking for all documents relied on to support this conclusion, the Staff claimed j that this estimate was based on "the Staff's general knowledge of and experience with the extensive research on the phenomena that may occur in a core disruptive accident
...", but refused to cite any documents. (Staff Response to Interrogatory 43, 27th Set, Oct. 1, 1982, pp. 66-67.)
0.23: Do you have any basis for disagreeing with the Staff estimate?
i
A.23: There is inadequate documentation to support the Staff's estimate, which may be correct, incorrect, conservative, or nonconservative.
Q.24: What assumptions did the NRC Staff make regarding containment integrity in its analysis of CDAs?
A.24: The Staff assumes that mitigating systems, principally the containment annulus cooling and vent / purge systems, will have an unavailability of less than or equal to 1 in 100 per demand. The Staff also assumes that the unavailability of containment isolation will be equal to or less than 1 in 100 per demand. (DSFES, pp. J-6, -7.)
, 0.25: Do you agree with these estimates and, if . Tot, why not?
A.25: If the Staff is correct that loss of offsite and onsite AC
- power dominates the failure probability for LOHS events, such a failure could also cause the failure of the mitigating systems. The Staff has not accounted for this common failure mode.
Staff witness Rumble stated that the basis for the 10-2 per demand for containment failure was based on l estimates of LWR containment failure of 3x10-3 (Edward i
Rumble, private telephone communication, July 27, 1982, as summarized in Memo to Files of T.B. Cochran, July 27, i
1982). As noted in the Union of Concerned Scientists' i
k
comments on the DSFES (letter from Steven C. Sholly to Paul Check, 13 Sept. 1982), the operating history of PWRs and BWRs in the United States does not support the assumed unavailability result of 10-2 per demand. A review of actual experience through 1980 was reported in Nuclear Safety (Michael B. Weinstein, " Primary Containment Leakage Integrity: Availability and Review of Failure Experience," Nuclear Safety, Vol. 21, No. 5, September-October 1980) and concluded that the overall availability of containment integrity was about 0.85 (i.e., an unavailability of 15 in 100 per demand). This experience base would dramatically affect the Staff's risk analysis of CRBR. Using LWR experience would appear to increase the estimate for contaiment failure by a factor of 15.
Even if the value for-PWRs alone is used, the result is only 0.96 (i.e., 4 in 100 per demand unavailability i
! factor). Obviously, if a Category IV CDA (as discussed by the Staff) occurs with a breach in containment integrity, a very large release to the environment will occur. Use of actual experience is certainly to be preferred as contrasted with the very soft results obtained from the Staff's " analysis." It has not been shown that there are substantial differences between CRBR and the LWRs that form the present experience base.
l t
i _. . -. . -. - _ _ ._
O In addition, it should be noted that the assumption of the failure of the mitigating systems discussed above (the containment annulus cooling and vent / purge systems) will also dramatically affect source term assumptions for the CRBR plant. Such failures will also increase the failure probability of the primary containment since lack of annulus cooling will cause a more rapid pressure rise and an earlier failure of the primary containment. This allows less time for natural processes to operate to reduce the airborne source term in the containment, and the postulated failure of the vent / purge system will also increase the source term for containment release substantially, especially for particulates and aerosols.
Staff's analysis is inadequate in its failure to address the points noted above and the concomitant large uncertainties inherent in the Staff's assumptions.
O.26: Turning now to the estimates of the consequences in death and injury of CRBR accidents greater than the design basis, are the Staff's estimates presented in Appendix J likely to be accurate? Explain your answer.
A.26: No, and there are several reasons. First, the Staff's ,
assumed radioactivity source terms are not supported by I
analysis or documentation. When asked the basis for the Staff's estimate of the head release fractions selected in i l
l 1
l l
Table J.3 at p. J-9, including all analytical calculations and documentation, the Staff stated:
The head release fractions (Table J.3) were selected on the basis of judgement from consideration of general LMFBR research of energetic CDAs involving a bubble of vaporized fuel material rising against the reactor vessel head, giving consideration also to the relative volatilities of different types of fission products and other materials. The selections were therefore not based on a set of analytical calculations or on any specific documents.
(Staff Response to Interrogatory 53, 27th Set, Oct. 1, 1982, p. 77.)
The release fractions associated with CDAs are highly design dependent. The Staff "judgements," based on no analysis or documentation, represent speculations, and the uncertainties in some of the estimates, e.g., Pu release under Cateogory IV, could be at least a factor of 3.
Second, the CRAC model utilized by the Staff assumes the LD 50/60 (lethal dose to 50% of the exposed population within 60 days) is 510 rads. In my opinion, this assumption is unrealistic. This dose-response level is associated with a dose-response curve depicted graphically at page 9-4 of Appendix VI of WASH-1400. This dose-response curve, however, assumes that the victims receive
" supportive treatment," which includes barrier nursing, copious use of antibiotics, massive transfusions, reverse isolation, and other special sterile procedures. WASH-
1400 estimated that the entire medical capability of the United States could provide such treatment to no more than 2,500-5,000 persons. WASH-1400 failed to address, however, how the victims of the highest exposures would be
> identified when there will be many others who will be suffering symptoms of radiation sickness (such as prodromal vomiting) from lesser exposures.
There is considerable controversy over the use of the 510 rads LD 50/60 The Risk Assessment Review Group (NUREG/CR-0040, " Risk Assessment Review group Report to the U.S. Nuclear Regulatory Commission," Harold W. Lewis, Chairman, September 1978) concluded that scientific opinion supports a range from 400-600 rads. This range could cause a factor of two change either way in the number of early fatalities. Moreover, the Risk Assessment
, Review Group concluded with regard to supportive treatment that "the ability to carry out such intervention has not only not been demonstrated, but isn't even well planned at this time" (NUREG/CR-0040, p. 19). Changing the LD50/60 from 510 rads for " supportive treatment" to the level of l
" minimal treatment," i.e., 340 rads, could increase the l
number of fatalities by a factor of two to four (WASH-1400, Appendix VI, p. 13-50; NUREG-0340, pp. 26-28).
Other groups.have used more realistic dose-response relationships which are closer to the " minimal treatment" l
l I l
curve used in WASH-1400. The California underground siting study used an LD50/60 for minimal treatment of 286 rads and for supportive treatment of 429 rads (Subcommittee on Energy and the Environment, House Committee on Interior and Insular Affairs, " Reactor Safety Study Review," Serial No. 96-3, 1979, p. 366, attachment to letter dated 21 February 1979, from Bryce W. Johnson, Peter R. Davis, and Long Lee to Hon. Morris Udall, p. D-7). In addition, the " Accident Evaluation Code" (AEC) used to calculate health effects in CRBRP-1 utilizes an LD50/60 of 350 rems (SAI-078-78-PA, Z.T. Mendoza and R.L.
Ritzman, " Final Report on Comparative Calculations for the i AEC and CRAC Risk Assessment Codes," Science Applications, Inc., December 1978, p. 3-6 and 3-8).
Third, the CRAC c' ode contains several " hidden" assumptions regarding the cancer risk estimator for latent cancers, including an assumption that the cancer risk at low dose is a function of dose rate. The net effect of i these assumptions appears to be to reduce the estimate of l
i latent cancer fatalities (exclusive of thyroid cancers) by a factor of 2 to 2.5 compared to the estimate one would I obtain using 135 x 10-6 potential cancer deaths per person-rem, which Staff claims to use for estimating offsite health effects (DSFES, p. 5-13). Furthermore, a number of experts, including Radford, Morgan, Gofman, .
i
o .
Stewart, Mancuso, Kneale, and Tamplin, believe the Staff cancer risk estimator, 135/10 6 person-rem, is low, or probably low. Their own estimates of the cancer risk vary, but range from a factor of 4 or 5 (Radford, Edward, Science 213, 602 (7 August 1981)) to a factor of 28 ,
(Gofman, John W., Radiation and Human Health (Sierra Club Books, San Francisco, 1981), p. 305) greater than the Staff's estimate of 135/10 6 person-rem.
Fourth, the source terms used by the NRC Staff in the CRBR accident consequence calculations appear to ignore any possible common cause failure of the containment annulus cooling and/or filtered venting systems.
Certainly both of these systems are dependent upon offsite and onsite power supplies, and both will fail if all power is lost. On this basis, as noted previously, it makes little sense to largely ignore common cause failures involving these systems, as Staff has done. If the
~
containment annulus cooling system fails, this will shorten the time between initiation of a CDA and failure of the primary containment. This affects decay of radionuclides that make up the source term and reduces the time available for natural processes such as gravitational settling and aerosol agglomeration to reduce the source term. Failure of the filtered venting system shortens the time between primary containment failure and secondary l
I
O containment failure and also increases the source term when the containment fails. In particular, the source term for particulates and radioiodines will be greater if these systems fail. This scenario will result in a larger source term for release to the environment and will result
,in more serious consequences than predicted by the NRC Staff analysis.
Another consequence of assumption of the containment annulus cooling and filtered venting systems is a greater release of Lanthanide group radionuclides, including Pu-239. These long-lived radionuclides will certainly have an impact on cancer fatalities and on land contamination (and related interdiction criteria).
Q.27: What is your overall conclusion regarding the Staff analysis in Appendix J?
A.27: According to Staff witness Rumble, Appendix J was done hurriedly because of the severe time constraints (Edward Rumble, private telephone conversation, July 27, 1982, as summarized in T.B. Cochran Memo to Files dated July 27, 1982). This is apparent from the depth of the analysis presented.
The Staff's analysis of the CRBR accident probabilities and consequences is inadequate and unreliable. As noted previously, the uncertainties in the
probability estimates are larger than those of WASH-1400 and the Commission's previous conclusion -- that the numerical estimates of accident probabilities in WASH-1400 are unrealiable -- applies equally to the Staff Appendix J analysis. Furthermore, the consequences (i.e., health risks) of " Class 9" accidents at CRBR as estimated by the Staff are based on a series of assumptions with large associated uncertainties. When these uncertainties are considered together (compounded), they result in an uncertainty of some two or more orders of magnitude in Staff's estimate of the acute and delayed health effects. With these large uncertainties in the probabilEties and consequences, the Staff's analysis in Appendix J does not support Staff's conclusions in the DSFES, Section J.l.3,-at J-19.
L
O F j?
E Cot xMabe.i At-Mi ,, TEsnmCM YP A C CRBRP-1 l
l l
CRBRP RISK ASSESSMENT REPORT MARCH,1977 VOLUME . 2: TECHNICAL APPENDICES e
l 6
O 9
INSUFFICIENT SHRS AWAR ABLE Page 1 of 9 TO COOL CORE I I MSUFFICIENT SHAS mSuFFCENT WRS AvatA8tE DURWG ,
AVAILABLE DURWG LONG flRM QvtM SHORTTERM SHORI TERM WORKS I
A A GavEN SHORT IERM WORKS
[ -
I 1 I I WSUFF $004UM HE AT. INSUF FCIENT WSUFFCENT INSUFFCENT INSUFFICIENT UP & OHRS FOR 00R D. RECT HE Ai mSUFFICENT MAW CollDENSER MAIN CONDENSER VE NTING 0F SHORT IERM Giv!N SYSTEM [B0P)
MMAL SYSMM PACC s SYSTE M ISM (OHRS)
NO HE AI SINKS 7
PAGE 9 I I I I g 3 I E I INSUF FICIENT NO S001UM HE ATUP Mf INSUFFICIENT FAILURES WITH mSuFFICENT AND mSUFFICIFN1 INSUFFICIENT DIREC1 HE AT ANO CmCULAit0N g g W lsi MA N N a M MAL SYSMW ME FmSI '
- IIA
- FEt0 WATER FEEDWATER HE AT TRANSPORT ANo nit (DMRS) Half HOUR AN0 HTL LOOPS tHTL)
A A S A , ,
A S PAGE 2 - PAGE 3 _ PAGE 9 PAGE 3 - PAGE F .)
I I I I FAILUFtES WITH FAILORES WifMHs F AILURES MIN RUPTURE LOSS OF ANY F AILURES WlIHIN FAILURES WITHIN FAILURES WITH F ALLURES W4IHIN F ALLURES WITHIN MAIN FEEDWATER AUIlL&ARY OF ANV PfilMARY PONV MOTOR M MAIN FEEDWA*in AUX 1LIARV MAisl FEEDWATE R AUXu aARY MAIN FEEDWATER AUXILIARY FEEDW ATER SVS SYSTt u FEEDWATER $v5 LOOP PfhMARV LOOPS SYSTEM FEEDW ATER SVS SYSTEM FEEDWATER SVS SYSTEM 3
/3 , S . , , , ,
PAGE 2 PAGE 3 PAGE 2 PAGE 3 PAGE S PAGE 2 PAGE S PAGE 2 PAGE g
- THE stGiNNaNG OF LONG TE RM 15 D6F 6NLO AS WHE N A CLOSED SYbitM.SUCH AS PACC S IS CAPABL E OF RE MOvlNG ALL DECAV HE AT GENE RATED WITHtN INE CORE ANC a e3FS FIGURE II-1 GENERALIZED FAULT MODEL SHUTDOWN HEAT REMOVAL
e
' AGE 2 0F 9 E
7 AEURES WIIMIN N A
fyg g ENATER j2 g gA y p
(HTL) pg ,
PAGE 1 n
E I
F AULTS WITH F AULTS WITM VENilNG WHEN VENTING US91G FAULys LOSS OF F AUL TS ,i USING P00lv NATURAL COOLING WATER IN OFF-SITE les MAIN FEEDWATER M0' ORS CIRCt1Afl0N POWER SVSTEM SVSTEM M
a 1
FA URES FAEURES WITHH6 F AR UFLEA WITHNI [ Astugs wifHIN ARURE VENTING r0R VENTih3 FOR , ,RUPiURE g'" ,g{ENi,
=Sg,/
VE ;q THIN NORMAL 3,A=,R,n 9: 3p WITHIN SECONDAR>V N NTING,FOR S- N-S NS-S 2Nw v VE NTINO DURING NATURAL O RCUL AflON A '
A '
A '
If85UFFICIENT INSUFFICIENT INSUF FICIENT NO OF VENT FAEUIES FAEUflES NO OF VENT FAILURES WITHHs HIS NO 1 NO OF VENT \ WTHIP' HTS 810 2 Wi!HNI HTS NO 3 ONTROL & SAFETY CONTROL & SAFETY / 'Ollin & SAFE VALVES OPEN VAtVES OPEN/ VALVES OPtN FOR H NO 2 F0fl H $ NO 3 FOR $n101 19 20 21 PAGE 3 PAGE 3 PAGE 3 ANCS M3 FIGURE II-l (Con't.) GENERALIZED FAULT MODEL SHUTDOWN HEAT REMOVAL
9 lW II i, <!g!,D dh -
ly
/a, 3 .
$5.,01
'nI .g'.
di \/ 1 i,;. G-s.i.ia
~,
- a.
$8g f g a
a ..
5$ f,.1 a
g- =
, gs- .i
. .f
.ss 1. E s- ~
ff.j f.!. .
1-8 a E
- =8:
a:, {: ;
IE ;=
dh ..g, i ',p~
3
! ,i
!g i
1-
!"!G (i ~
4 ign g,
!!! 1ll,
, ~
I
!! ifl f f!! 45
- - - ens l- ,. .. s e 4.ji5 dj~!C: !!.
!ill (
f.1 "
f!!
Ei; 5:s g
~
ill, G !!i !!! .
n.3,?
?!
A 111
<!!!n!!> gi; ,
2!I f5 II-16
e 4
LOSS OF EITMA
\
MSEL Devin Aug FEEDWATER PuesP
'I i
PAGE 4 0F S h PAGE 3 s
\ \
N%
g POWERSSv3 F AULTS CAUSE POWERASTS 9AUL1S CAU5E LOSS OF POWER F AUL TS CAUSE LOSS OF eso e TO DESEL ORevth LOSS OF NO 2 DaESEL FED Aun Aux FE'EDWATER FED AUE FEADWATER PUteP putePS FEEDWATER Ptzessp
>a
, g 9 t
- {
t ,
7AutTS CAuSE LOSS OF OIEML F AutTS LtsSi LOSS OF LOSS OF C00LuuE Aut TS IN '
POWE A TO AUI FAutTS LOS5 U C00LauG AULTS LOSS
- 'f PP5 SERAL WATER TO Aux MSEL FE0 AFW #
FEEDWATER SYS HIGFF SITE WATER TO Aug CeESEL FE0 AFW OF PPS SEmAL TO START PutIP FEE 0 WATER mo 1 puesPiso 1 ,
PuesPS F0WEA FEEDWATER ho 2 PuesP NO 2 30 STAAT PuggP FSTEM
- SYSTEas e
., e
[ ' h P4 ,
/
1 A TDRS PAGE FAULTS CAUSE FAULTS CAUSE 4 7 FAUL TS CAUSE
/
's LOSS OF nones 4L 1955 0F EldE AE LOSS 405S FAULTS CAUSE LOSS 0F IIOnesAL 00 LEIS WATER .,-COOLMIG WATEA elESEL 0'g
-* OIE L LOSS OF ERIEns 4 COOLIIIE WATER COOLIIIG WATEA # '
> ' (~ ,
f i
', S *p e
- g
~\
n LOSS OF PWA TO M*
N .,
n ,
-h,} *y
" "" % z Faut 75 Faut TS PURIPS FOR EIAEllE 9 %
LOES OF PWA To i PutIPS FOR EtE#$ , FA ATS 1
\-
(g MTrusiis0AIAAL st 0FF SITE CrutLEO & 7 TANT %' # IM <
),
/ LED WATER fcatA SEIMCE WATERN01 g ",[gf i CHILLED & PLAN) ,
5E
/L'*2 5EnvlCE WATEAlte t ( g
-T I -=
PLAasT SEnvlCE V .T,0*ES A. ' '
V .h,g, LOSS CfMLLED WATER WATEA LOSS CHILLEs WATER h 0F DIESEL IiG 1 M1 p ' INE ML 110 2 nt t , ,
)
i' '.
s .
awa me r,
4%s ' ,,)
0 8 3
4
- x '
A
, 4 , , s.
'. i
- k. ,f d*
t '\ e . s rigore II-i (cy'E): %aeraltred raviE % del sTwedo '*at Aemoval g s I
y / \1 j o
g .k a
- k s
} \
i t
)
+
-f.
3 g , ,
% q w .
e
O e
e g e e I *b- SIg a
ih ie. e...
a d,i 158 s- va!
-8B .
m e.
a EE a
I .$!
Ek
!!! O ij!, 0 03 G _
~
e.
_- !al=
ses Wa!
-ng
?
. ll - $
98s :
a ,
s .$5
' ~
E$
(
- is ili e...
s I
lhS If fi! I-f,i. -
I s
! . il b O gij N l
i!'E 5l!
!!! g sda ,
i E
l* si-5 m C i
.q: !!. L' 4 s'!.
ill 3
er. '
l -
s!,!! 15=5 gs!
.e f
.EE "m-
.jst Er
- .5.g e $15 51 II-18 l
9 4
- c53-
' ${51 k 11E8 I$
~"
- jfk<3 k{sI a;;i,
~
s e
- a e.gi
.i;
%kka i
8.a* ia a m..41 lit 3 1 i
1
.s. 1 (g 3 .., $
5
,,"s,
-s 151 3.s g
. -5' 2 Ist {
I 5
ki isi ..
}.. C 3
?
i.n. s I*.*
. li.li i; 1
'l
!aiO I
5 e
b is .
SIh
. $.3 IEk illE a
b
' gh_
g l
.i.
A.e
==
115 c ,.
,,1 u
.p)i ,{k.
h" -i -
11
%i 11-19
6 4
e
. a .
I s
? "
WE 4 :: g
- ~
55 r-5 T EI jfg ij
=-
55
~
jr, h (ns s.
s .
av
=
iE:s 818 s Ei-
?
m fi
- 1 k
<3 T .
! i i.s
- x! 4i i r g!- ( -
g
.5
_r! x-
?
~
a .,
!! ME u.
5 gE.r* g gj k! 3 Iv.!a! r- c i*
E Ei ki X
i
!!i ir!g Q
-ji su g
e.s.
!?5
/E R
sii T l;!
" 83 s i
is a y E
!{E EE h' !.jj! Okki
! I
..s i~ji y- 4i E
T. s E g
1si
$hj k
..f.I- --
r T ii ii Esf a 1 iiig h E8 gj N-
!Pri !Ps II-20 i
9 9
4 e
em
%3 J i
ffs-a *
. ,l;'r ~ ~
- f.
sil g, G1' 8
?$ ..
'il Q >%
\~~i
'5 g
H.i n./ j e*
@* I E
fi Q:
!?j!
[,'
r c~E
' n. [ c.*~
/$~,'
s.
l v' li ng iri q, ;
s".9' e
a p
~
Ef-
' q.
~ js,~f
!!; C- ~
Lr?,
w
~
Ti *
..f fg 5~
- /[lli
\a i
/ b"'iQ
,]5'"i .'
Sa tri Q.
fi,
- 5 s
j 'SJ
4ro - ' .
4 h
i
/ !
d
$$$9 ag~
I "8
~
1
$*g
, d 111 c -
?
Gi.
s
=
lu se .
Es
'I' E T'
hf fhk ~
- ll* G .
!!! G I1
_g h ni s.E s92 S5$2 '
GE ~y ig'h.G Ekh '
~'
l$$ E~
E a g!8
. 15: ~
l a5-5
- ges
- G
~
1- '
5.
,E -
EEE SEs e E~ ,i y ! E: cl'~
'i,l 5
5e V 0
Elf g
5
~
- ?,,
G #
- E y:.
t g 5
-[j my as G ,, ll 1
Ils II-22
bX ik 1, TGGTIMotel ON@
Coc.Sta N , 96 er 3[ &
~[% cova: ROLLER GENERAL oF THE UNITED STATES
. ! ' "' I wasmucros o c. ame
- v. _ 4 .=;-
RESTRICTZD - Not to be released outsido the General Accounting Office exec;:t en the basis of sp:;.;fic appro.al by the Office of Congress *or.al Relations.
,. The Honorable John D. Dingell
- l Chairman, Subcommittee on Oversight and Investigations Committee on Energy and Commerce
- House.of Representatives
Dear Mr. Chairman:
l
Subject:
Revising the Clinch River Breeder Reactor Steam Generator Testing Program Can Reduce Risk (GAO/EMD-82-75) 1 Your September 2, 1981, letter asked that we review the
- technical outlook for several components of the Department of l Energy's (DOE's) Clinch River Breeder Reactor (CRBR)--the Nation's t
first liquid metal fast breeder reactor demonstration plant. In February 1982, your office requested that we issue an interim re-port on DOE's program for testing CRBR's steam generators. This report responds to that request.
Steam generators for liquid metal fast breeder reactors have had a history of serious technical problems. Small breeder re-actors in this country and demonstration breeder reactors in foreign countries have experienced steam generator failures. Steam generators for the CRBR have also experienced a number of problems during their development.
Despite that history, DOE does not plan to conduct complete and thorough tests of the steam generator design to be used in the CRBR. Instead, DOE plans to conduct (1) a series of limited i
tests on a steam generator which differs significantly from those l designed for use in the CRBR, (2) a vibration test on a one-third
-scale model steam generator, and (3) some inplant testing on a l CRBR steam generator after all CRBR steam generators have been fabricated. Without conducting more thorough tests of the CRBR steam generator design before building the CRBR units, DOE is assuming that the CRBR units will operate as predicted.
If DOE is correct, the CRBR will be able to proceed on its
. current schedule, and the cost will be lower than if more ccmplete and thorough testing were done. If DOE is wrong, the costs and -
delays associated with redesigning and modifying or rebuilding the CRBR steam generators would be substantial.
1 l
(305178)
h-;041LI DCE's decisicn to foresc ncre thorough tests is based on (1) a belief that the tests that will be done can be extrapolated te
- predict steam generatcr performance in the CRER and (2) confidence that the steam generator design will be successful. Conversely, the history of problems with steam generators and with develop-ment of the CRBR steam generators argues for a more complete and thorough testing program.
The following sections present the objective, scope, and methodology of our review; a background or CRER steam generators; our findings in more detail; and our conclusions and recommenda-
~
tions.
GBJECTIVE, SCOPE, AND METHODOLOGY Our objective was to evaluate DOE's current program for test-ing the CRER's steam generators. To accomplish that objective,
' we reviewed the history of the development of the steam gener-ators, including the results of past tests and DCE's future plans for testing. We also compared the current ~CRBR steam generator design with the design of the steam generators tested in the past and currently being tested. Documents concerning the testing
__. progran were obtained from DOE headquarters in Washington, D.C.;
the CRER Project Office in Cak Ridge, Tennessee; the En.ergy Tech-nology Engineering Center in Santa Susana, California; Westing-house Advanced Reactors Division in Waltz Mill, Pennsylvania; and the Atomics International Division of Rockwell International Cor-poration at Canoga Park, California.
We also discussed DOE's testing program with the major con-l tractors involved in the steam generator program and with DOE l officials. Information concerning steam generator development in foreign countries was obtained from DOE subcontractors and technical publications. To assist us in the technical aspects of this assignment, we employed a consultant who has worked in the nuclear industry for over 30 years and who has an intimate knowledge of liquid metal fast breeder reactors and steam generators.
( The information contained in this report represents the best
- information available at the time of our review. It should be recognized, however, that the testing program changed during our review and, even at the time we issued this report, DOE was con-j sidering other options.
We performed our work in accordance with GAC's " Standards for Audit of Governmental Organizations, Programs, Activities, and Functions."
2
E-1.*..!
BACKGROUNC CN THE CRER ANC i
THE CRER QIEAM CENERATCRS i
~
In 1970, the Congress authorized the Atomic Energy Commission (AEC) 1/ to enter into cooperative arrangements with industry to build and operate the CRER. During the early and mid-1970s, great urgency was attached to the CRER program because predictions showed that current generation nuclear reactors would be running out of
' uranium fuel by the year 2000. The CRER was initially scheduled to be completed by 1980 to permit a decision in the mid-1980s on
( commercial deployment of breeder reactors. We are currently com-pleting work on a report which addresses the options available for the timing of the CRBR. That report includes information on a number of factors which have changed since the CRER was originally authorized. Speci'fically:
I --Current DOE data show sufficient natural uranium to fuel the light water nuclear industry well past the year
- 2020.
--Latest DOE data show breeders may not be economical until
! after the year 2025.
In commenting on a. draf t of
- hat report, DOE argued that it l
is imperative to proceed with the C_RBR schedule--current plans are to have the CRER operating by 1990--and that any slowing of the program could lead to industrial disruption, constrained economic growth, and increased reliance on foreign energy sup-plies. While recognizing COE's comments and concerns over possible delays in its current program, we concluded that the changes in the factors affecting the timing of when breeder reactors may be i needed show that slowing the program has become a viable option.
Developing and demonstrating reliable steam generators have been and still are one of the most significant technical problems facing the CRER project. Steam generators provide the transfer of heat from the reactor coolant to water, which is heated to steam to drive the plant's turbines. According to a Nuclear Regulatory Commission report, 33 of 45 operating nuclear plants with steam generators have experienced some form of steam generator problems.
During the 1970s, these problems caused about 21 percent of forced outages at those plants. Many of these problems are operational problems and are not related to design deficiencies or inadequate testing. It is obvious, however, that steam generators are the source of considerable problems in existing nuclear plants. In 1/The Atomic Energy Commission and the Energy Research and Cevel-opment Administration (EFCA) were predecessor agencies to DOE.
AEC was abolished on Jan.19, 1975, and many of its functions vere transferred to ERDA. ERDA's functions were transferred to DCE on Oct. 1, 1977.
3
~ - - =. .-. - - ..
E-2(41CE conparisen to commercial reactors, the steam generators needed for the CRBR represent a more difficult challenge because sodium is j
~
.used as the reactor coolant. Sodium steam generators impose severe Lmechanical stresses on the metal barrier between sodium and water within the steam generator. Even a small failure allowing contact between the two fluids raises the possibility of a fire or ex-
,plosion resulting from a sodium-water interaction.
~
Breeder reactor steam -
generator history
.According to Atomics International, the fabricator of the prototype steas generator for the CRER, many designs have been used for breeder reactor steam generators around the world. Atom-ics International maintains that problems have been experienced in all cases-where the steam generator design has not been thor-oughly tested.
Smaller breeder reactors in the United States have experi-
] enced steam generator problems. For example, a steam generator i in the Enrico Fermi reactor (near Detroit, Michigan) failed in 1962 L when vibrations and other problems created holes in the metal tubing, allowing contact between the sodium and the water. Other countries have also experienced steam generator problems in breeder reactor plants. Structural integrity problems in a demonstration breeder
' plant in Russia caused leaks in four of six steam generators.
Similar problems delayed full power operations at the British de-monstration breeder plant when four of nine stear generators leaked.
As recently as April 1982, the French demonstration breeder reactor was shutdown because two sodium leaks in a steam generator caused a fire.
l, i CRER steam generator program In 1974, AEC chose a steam generator design for use in the l
CRBR that was quite different from any previous domestic steam generator, and it was also different from the steam generators used in foreign breeder reactors. During 1974 and 1975, Atomics International was selected to design and fabricate (1) two model steam generators, (2) a prototype steam generator, (3) nine steam generators fcr use in the CRER, and (4) one backup unit. Until 1982, DCE's steam generator development program consisted of three major elements.
- 1. Testing the Model Steam Generators. The model steam gen-orators, tested in 1978, were full-length steam generators but contained only 7 water-carrying tubes instead of the 757 tubes in a plant unit. The purpose of testing the model steam generators was to obtain data en full power steam generator performance and endurance.
- 2. Testing a Prototyce Steam Generator. The prototype steam generator, to be tested in 1982 and 1983, was 4
, _ _ - _ _ _ _ - - _ . _ - ._ . - - - _ . ~
I
2 _ t ' a f. ;
originally to have been a tail-size, 757 tube prototype of th.e CRBP steam generators. However, changes to the CRBR design resulting from the testing of the model steam generators and subsequent design reviews could not be fully incorporated in the prototype steam generator and, as a result, the prototvoe differs sionificantly from the I CRBP steam cenerator desion. The original purpose or _
building the prototype was to verify the steam generator manufacturing process and to test the structural integ-rity of the prototype under simulated operating condi-tions. Prototype steam generator testing is proceeding on schedule.
- 3. Fabricating and Installing the CRBR Steam Generators.
Tne CRBR steam generators are the units which will ulti-mately be installed in the CRBR. As previously noted, the design of the CRBR steam generators has changed signifi-cantly over the past several years, and _ DOE does not olan to conduct complete and *hnrnoch testino of the current CRBR steam cenerator design prior to installation of the steam generators in the CRBR. -
CRBR officials are currently adding another element to the CRBR steam generator testing program--fabrication of a one-third scale model of the CRBR steam generator--to test the design's ability to withstand flow-induced vibration. --
) DOE terminated the s~t eam generator contract with Atomics In-l ternational in 1981 and is currently resoliciting proposals to fabricate the nine redesigned CRBR steam generators and one backup unit. DOE expects to announce award of a contract in the near future.
I DOE IS NOT MINIMIZING RISKS IN l ITS STEAM GENERATOR TESTING PROGRAM l J l DOE's program for testing CRBR's steam generators is deficient t in that
~
l J --model steam generator testing and prototype fabrication were conducted concurrently, thus deficiencies found in the models were not corrected in the prototype; l I --prototype testing involves testing a design which is
! significantly different from the design for the CRBR steam generators; I - prototype testing will not include simulating important operating conditions; and
--the steam generator design to be used in the CRBR will not be completely and thoroughly tested prior to f abrication and l
( installation of all CRBR steam generators.
1 5
t
. =- v 5 Problems noted during model steam generator testing were not corrected on the prototype
~
Because of the perceived urgency of building the CRBR, pro-gram officials began fabrication of the prototype steam generator before completing testing of two model steam generators. Under normal conditions, the models should have been tested before fabrication of the prototype began. Initial tests on the model steam generators began in May 1978, but they were prematurely concluded in December 1978 because of deficient performance.
Subsequent examination showed that the model steam generators could not withstand fluctuations in temperature because of fab-rication errors and inadequate tube spacing and tube support.
The contract for the design and fabrication of the prototype was awarded in September 1975, thus fabrication of the prototype steam generator was well underway when the test results from the
, model steam generators became available in 1979. As a consequence,
- the design and fabrication problems noted in tha mmaal =+=am gen-erators were not corrected in the prototvoe. Instead, major changes
- %Ere
~
e made to the CRBp sepam c an="a tor d es i on . Therefore, tne pro-totype steam generator scheduled for testing from May 1982 through March or April 1983 is not prototypic of the current CRBR design, l and it contains many of the same deficiencies as the model steam l generators. Thus, testing the prototype will not identify all the problems that could occur in the CRBR steam generators. In total, .the cost of the prototype steam generator tests is about j $8.2 million.
l Prototype testing inadeouate D_OE of ficials have concluded that the erototv,e micht fail l
i if tested to the limits originally specified to simulate antici-cated CPRR mperatino conditions. As a result, the test program for the prototype was changed to delete or reduce the severity of the-tests that were originally planned. The revised test plan ap-proved in July 1961 does not incluoe requirements to demonstrate the
( --structural integrity of the steam generator, a l -
major cause of failure in foreign breeder reactors, or i
1
--ability of the steam generator to withstand large temperature changes occurring over a short period of time, the major cause of the model steam generator failure.
1 tin addition, the prototype test never was planned to include the l ability of the steam generator to withstand flow induced vibra-tion, the major cause of the Fermi steam generator problems.
These tests are critical to predicting performance because they involve the areas most likely to cause failure.
l 6
1 l
- . l DOE will not fully test the CRER steam generator design As currently planned, DCE will not conduct complete and thorough tests of the steam generator design before they are I installed in the CRBR. The nine CFBR steam generators and one backup unit are scheduled for delivery between January 1985 and May 1986. DOE plans to test a one-third scale model for flow-induced vibration and at a later date, install various perfor-mance-measuring instruments in two CPBR steam generator units and,.after all units are installed, conduct pre-operational testing in the CRBR.
i The one-third scale model tests will not provide all needed data on the structural integrity of the steam generator design or
! its ability to withstand large temperature changes over short periods of time. As mentioned previously, problems in these areas have plagued other breeder reactor steam generators. The inplant tests would provide some information related to these issues, but it would be conducted only after the CRBR steam generators have been completed, resulting in the same situation as the concurrent model steam generator tests and prototype fabrication.
Tha t i s , by the time the inplant tests could occur, it would be too late to modify the CRBR steam generators to correct any major problems that may be discovered without incurring substantial j
costs and delays.
DOE previously considered complete and extensive testing of a full-scale CRBR steam generator at its Santa Susana, California test facility, in addition to the tests for flow induced vibrations.
DOE currently, however, does not plan any additional tests of a full-size steam generator. DOE's Chief of the CRBR plant com-l'ponent branch said that the current steam generator test program is adeguate to confirm the design, and that DOE does not wish to unnecessarily delay the CRBP project. According to DOE officials , '
l i testing a full-scale CRBR-design steam generator could delay the f'programbyasmuchas45 months if fabrica tion _ olth_e___CRB.R_s. team g,en-i _erators is halted. If fabrication of these units is not halted,
~
eightCRB) steam generator units would Ee delivered by the fiE6
~
~
the test results are available in April 1986. The remaining CRBR steam generators and the backup unit would be substantially complete by that time and would be too far completed for major modifications without incurring large cost and schedule slippages.
Clinch River project officials contend that despite the prob-lems that have been experienced with steam generators, more extensive CRBR steam generator tests are not required, and the tests being conducted are adequate and can be extrapolated to provide the in-formation necessary to predict inplant performance. A Clinch River project of ficial believes additional testing prior to fab-rication of the remaining CFBR steam generators would unnecessarily delay the project. Our consultant recognizes the potential problems in the areas of structural integrity and ability of the CRER steam generators to withstand temperature changes. He also acknowledges 1 that the planned tests will not provide adequate data in these 7
L.4.
1 areas. However, he agrees with DOE that any steam generator tests that would result in a delay in the construction of the CRBR are knot appropriate.
DOE's prime contractor for the CRBR--Westinghouse Electric--
stated that the information gained from the prototype tests will be inadequate for resolving concerns about vibrations and recom-mended the one-third scale model tests. Westinghouse, however, also recognized that neither test would provide data concerning 3
structural integrity or the CRBR steam generator's ability to I withstand temperature changes.
.In a February 26, 1982, letter to us, officials of Atomics International--the original designer and fabricator of the proto-type steam generator--expressed disagreement with DOE's CRBR steam generator testing program. Atomics International officials recognized that it is highly desirable to minimize development cost, but that it is also highly desirable to minimize the risk of (1) forced outages from failure of untested features and (2) delays in licensing due to a lack of data from component testing under simulated reactor conditions. They.noted that the CRBR steam generator design incorporates features which substantially differ from the prototype and are unsupported by tests. According to Atcmics International officials, even after completino the orn+m-tv3e'Yks , CRBn steam cenerator desian and performance" uncertainties _
Iwill ramain. Atomics International officials concluded that exten-sive testing of a full-scale CRBR steam generator and a scale model steam generator would eliminate the uncertainties.
In addition to delaying the program for up to 45 months, DOE officials estimate that installation and testing of a full-scale CRBR steam generator would cost about S7 million. This would however, eliminate the need for testing the prototype steam genera-tor. Cancellation of the prototype test would save about S3.2 million, which would reduce the additional cost of testing a full-l i scale CRBR steam generator to less than $4 million. The resulting program delay and any accompanying inflationary increases would also, of course, impact on the overall CRBR cost and schedule.
t We note that DOE's position on testing steam generators is inconsistent with its programs to develop other, perhaps less criti-cal CRBR components. For example, DOE is testing the sodium pumps i extensively. These tests have already proved worthwhile because a l deficiency, which may result in a change in the plant unit design, has been discovered. It is exactly this type of situation which
> causes our concern over not testing the CRBR steam generators.
In lieu of tests to provide assurance that CRBR's steam gen-l
! erators will operate as required, DOE could obtain operability guarantees from the steam generator designer or fabricator. How-ever, the contractor, which is selected to fabricate the CFBR steam generator, will have to guarantee only that the steam gen-erators will be built in accordance with the design provided by Westinghouse. DOE officials stated that they will not recuest an operability guarantee for the fabricator because no company
! 8
E ..4.
would provide such without first reviewing in detail the steam generator design. DOE officials stated that such a review would delay the program and increase program costs.
If the steam generators were to be built in accordance with the stated technical requirements, but failed because of design deficiencies, the Government would have to assume the additional costs of amending the design and reworking the steam generators because the design has not been guaranteed by Westinghouse--the lead reactor manufacturer.
DOE officials explained that Westing-house officials would not likely guarantee the steam generator design because it is developmental and a guarantee.cf that nature would be too risky.
CONCLUSIONS In essence, DOE's steam generator testing program is based on the urgency of proceeding with the CRBR. This has been pointed out most recently in a DOE letter containing comments on a draft GAO report on options for the timing ofWhile the liquid metalDOE's recognizing fast breeder reactor program. (See p. 3.)
concerns and its desire to move forward as expeditiously a_
possible, our work shows that changes in the factors affecting the timing of when breeder reactors may be needed make slowing the breeder program and the CRER a viable option.
I The highly critical nature of the steam generator to overall CRBR success makes a strong argument for taking a cautious, conser-vative, and prudent approach to developing, fabricating and testing
~
the CBBR steam generators. DOE--as well as our consultant--dis-agree and are confident that the steamThey generator, base as position this currentlyon designed, will operate as predicted.
their confidence in the technical design and testing program, and because they do not believe the CRBR program should be delayed by steam generator testing. This position, however, is not(2) sup-the I ported by (1) the history of steam generator development, test results to date, (3) DOE's program to test other CBBR compo-and (4) the DOE contractor who designed and fabricated the
/nents, prototype steam generator.
l l We recognize that all steam generator problems are not re-lated to design deficiencies and that testing cannot eliminate all elements of risk. The ultimate test Amust cood come when the steam gen-testinc nrocram can, erators are operated in the CRBR. In this regard, DOE's cur-however, minimize the risk involved. will l
_ rent test program does not minimize the risk involved as.it rust orovide complete anc cnoroucn 2nrormation In two crat1cq1 areas where problems have been experienced i_n otner breeder reactor structural steam cenerators, both in this country and tnelrabroac--tne ac111ty t6' withstand
~
integrity of the steam generaters and Witn-larce tempa-ature enances over ~shu t u perices or time. in out testing the CRBR steam generator design to obtain data these two areas prior to fabricating the CRBR steam generators, j
DOE is assuming that the steam generators will work. If DOE is i
i 9 L
-;{ .u' right, CRER will be ccapleted sooner at a lower overall cost.
If wrong, it will prove a note costly and time-consuming risk to take.
In our view, DOE has several fundamental options to obtain the required data. More complete and chorough tests of the one-third scale model would provide much of the required data, but would be limited in that it would not provide full-scale data. Testing a full size CRBR steam generator could theoretically provide more complete data, but may not provide full vibration data. A third option would involve a combination of the scale model and full-scale tests and would provide data in all critical areas. Al-though conducting any additional testing would increase program costs and delay the program, we believe that minimizine the risks
' throuch a more enwplora and thorouch testinc procram is far -054-attractive than the risk associated with purchasing steam cenera-tors which may not ocerate as recurred. Should tne steam generators prove inadequate for optimal operation in CRBR, DCE would have to finance modification of the 10 completed steam generators or scrap the completed units and build 10 new steam generators.
We recognize that because of the complexity of the CRBR and because it is a research and development effort, some element of risk will always be involved. However, we believe a cautious, conservative, and prudent approach to developing, fabricating and testing this highly critical component should be taken to minimize that risk. For this reason, the information developed in our review is most supportive of the following courses of action, y/ --Stopping the CRBR prototype steam generator test program because of the limited value of testing a' steam generstor which differs significantly from the current CRBR design.
- --Canceling the current solicitation for the fabrication of 10 CRBR steam generators.
--Developing a program for more complete and thorough testing of the CRER steam generator design in as expeditious a j timeframe as possible.
--Withholding a decision on procuring the CRER steam generators until test results are received and evaluated and any necessary design modifications made.
RECOMMENDATION We recommend that the Secretary of Energy evaluate the in-formation presented in this report, as well as the risk assumed in not conducting more complete and thorough tests of the steam generator design, in deciding on how to proceed with the pro-curement of the CRER steam generators.
10
B-164105 .
As arranged with your office, unless you release or publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of the report. At that time, we will send copies of this report to the Director, Office of Management and Budget, the Secretary of Energy; and to other interested parties and make copies available to others upon request. At your request, in order to provide this report in time for use during the appropriation process, we'did not sol'icit DOE's comments on this report. The information pre-sented in this report was, however, discussed with responsible DOE officials to ensure accuracy.
Sincerely yours, Comptroller General of the United States l
e 11 i
EubE t 3, TcsTmicuy cp45 'M c.
. ..- CCcnRAU , P A QT 3 17 November 1978 g Mr. ii.B. Piper U.S. Department of Energy Clinch River Breeder Reactor Plant Project Office Oak Ridge, Tennessee 37830
Dear Henry:
Attached are the results of SAI work on two FY-78 risk assessment tasks:
- Accident initiating event completeness and methodology review
- Resolution of project coments
(
As noted in my October 4,1978 memo to you, the one outstanding project comment concerned pipe rupture probability. Accordingly, the enclosed report on our pipe rupture work completes the task l on coment resolution.
I Also enclosed are two of the references (based on earlier SAI work) which are referred to in the pipe rupture report. Please make these references available to LRM people as necessary. We will provide information on the references to EG&G as required.
l Please feel free to contact me should you have any questions on the enclosed reports.
Sincerely, 04-e M David Leaver OL/ imp cc: P.J. Wood, SAI/Pittsburgh T.A. Zordan, W-LRM R.J. Crump, EG&G Enc /4 Science Applications, Inc. s n4. Aito sou.r., a.. 200. hio Alto CA 94304 (415) 493 4326 7
. _ _ = - .- .-.
RELATIVE PIPE RUPTURE PROBABILITY ,
FOR THE PRIMARY HEAT TRANSPORT i
SYSTEM OF CRBRP By D. O. Harris SCIENCE APPLICATIONS, INC. ;
Palo Alto, California ~
November 13, 1978 INTRODUCTION This note is intended to summarize the results of work performed within the Inst year in estimating the probability of a pipe rupture within the primary heat transport system of the Clinch River Breeder Reactor Plant. An earlier note dcted Octo-ber 7, 1977, and included as Reference 1, discussed a possible means of tying the probability of pipe rupture in CRBR to values 1
used for LWR's. LWR values have been suggested in the past, and are generally estimated with greater confidence than correspond-ing vhlues for CRBR. A meet'ing between SAI, WARD and Westinghouse LWR personnel was held at WARD on December 15, 1977 in an attempt to obtain stress histories for LWR's that were calculated in the same manner as employed in the CRBR analysis. The use of stress histories for the two types of plants that were calculated by comparable means would allow the comparative rupture analysis to be performed with greater confidence. However, it was not possi-ble to obtain such results for a LWR, and it was therefore neces-sary to fall back on stress analyses of LWR piping that were gen-l erated by vendors other than Westinghouse - using analytical techniques that may or may not be comparable to those employed for CRBR. This " fall-back" position had been employed earlier, with Reference 1 providing results obtained prior to October 1977.
l L
Various questions regarding certain aspects of the ana-lytical techniques for calculating pipe rupture. probabilities were raised in discussions with Westinghouse personnel. These included the following items:
- Calculated results will depend strongly on the initial crack size distribution. What is the influence of us-
- ing distributions other than the one originally employed?
- Why use weld volume to normalize the probability of having a defect? Wouldn't weld length or area provide a better basis for normalization.
- What criterion for a rupture is used? Is it merely a leak, or a guillotine failure?
The purpose of this note is to summarize results obtained using the results of stress analyses on LWR piping that were pro-vided by vendors other than Westinghouse, and incorporating various initial crack size distributions and means of normaliza-tion of results. The end result to be included here is the ratio of overall time averaged failure rate of the primary piping of
, CRBR vs. various LWR's. The question of break size has not been addressed.
STRESS ANALYSIS AND CRACK GROWTH CALCULATIONS As ment'ioned above, it was not possible to obtain the results of a LWR piping stress analysis that was performed in the same manner as used for CRBR. Therefore, it was necessary to employ results that are available to SAI from vendors other than Westinghouse. For instance, the cyclic peak stresses at various locations in the primary piping of a Babcock and Wilcox
__ . _ _ . ~ __ _ _
PWR are summarized in Table 3, page 29 of Reference 2. A copy of
- this reference is enclosed. A fatigue crack growth analysis for various locations in the piping was performed. This analysis
, employed various conservative assumptions, as discussed in Ref-erence 1, and the initial defect size in the hot-leg to pressure vessel joint that would just grow to the critical depth within the plant lifetime was used in comparison with CRBR results pre-sented earlier. Such results from various reactors are presented below. These values are directly from Table 1 of Reference 1.
' CRBR CRBR PWR PWR PWR #3 hot-leg cold-leg #1 #2 from Ref. 2 a
most most hot-leg hot-leg hot-leg joint considered highly highly -PV -PV -PV stressed stressed
, a tolerable initial tol, defect depth at 0.096 0.20 0.090 0.17 0.165 l end of life, in, n . of weld joints in 57
~
primary piping 96 37 36 33 l
joint thickness, in. 0.5 0.5 3.75 3.00 3.31:'S pipe OD, in. 24 24 50 40 42.75 The cumulative probability of failure of the joint within the plant lifetime is simply the probability of having a defect in the joint of a size deeper than the tolerable depth given in the above table. This is a function of the as-fabricated crack depth distribution, the probability of having a defect to begin with, and the inspection procedure employed. Various initial defect l
l l 1
distributions will be considered here, and a pre-service ultra-sonic (UT) or radiographic (RT) inspection will be considered.
Normalization of the probability of having a defect based on weld volume, weld area, and weld length will be employed - with
, the following notation used.
prob, per unit type of' norm'alization of normalization parameter for a given joint of having a defect 2
volume 2nDh p.
area 2nDh p{
1ength wD pg The weld volume and area include the heat affected zone. The para-metersp(,pj,andpyaretheleastwellknownoftheinputsto the analysis. Fortunately, these parameters cancel out in taking the ratio of CRBR to LWR ruptrue probabilities (assuming that they
, are about the same for the welds employed in the two types of plants).--
\
AS FABRICATED CRACK DEPTH DISTRIBUTIONS The as-fabricated crack depth distribution employed in References 1 and 2 was obtained from Wilson (Ref. 3), and was the .
following P
cond(>a)=herfc(1 in */A) p2 p= 1.53 A = 1.36x10 -3 in. (Wilson)
This corresponds to a log-normal distribution of crack depth.
Becher and Hansen(4) provide information on experimental measurements of crack size distributions in welds. A log-normal -
distribution provides a good fit to their data with
p= 1 A = 0.04 in. (Becher 6 Hansen)
The Marshall report (5) provides another estimate of crack depth distribution which is more applicable to nuclear pressure vessels. However, it will be assumed to also be appli-cable to piping. Reference 5 provides the following distribution
-a/a' a' = 0.25 in.
Pcond (>a) = e This distribution provides an appreciable probability of having a defect deeper than the pipe thickness--which is meaningless.
To correct this deficiency, this exponential distribution will be truncated at a = h (h = thickness). This provides the foll-owing result
-a/a' -h/a' Pcond (#8) " (truncated Marshall) 1-e -h/a, (The term in the denominato,r is required so that Pcond (>0) = 1.)
DETECTION PROBABILITIES Various pre-service inspections will be considered for the plants under consideration. PWR#3 will be taken to have a UT pre-service inspection, with the following probability of not detecting a defect of depth a being given by the following expression PND(a) = h erfc(v in a/a ) (UT).
v = 1.33 a = k in.
This relation is given in Reference 2, and was estimated from experimental data. PWR's# 1 and 2 will be considered to have had an RT pre-service inspection, in which case the following l
expression from Reference 2 is applicable PND(a) = erfc (v in a/0.6h) (RT) h = thickness v = 2.3 Which of these inspection procedures is employed for pre-service inspection does not have a large influence on the failure prob-abilities.
The non-detection probability for use in conjunction with the Marshall distribution was fitted to an exponential relation in order to simplify the analysis. The data summarized in Figure 15, page 62 of Reference 1 shows a great deal of scatter in P ND -a for a RT inspection. Hence, it is not possible to tell if the data is better fit by a log normal or exponential distribution. The following relation was found for a radiographic inspection.
f h1 fora =a/h<a0 = 0.76 D" ,-S(a-a0 ) for a > a 0 (S = 9.5)
POST-INSPECTION DISTRIBUTIONS AND FAILURE PROBABILITIES The crack depth distribution following pre-service in-j spection can be found from the as-fabricated distribution and non-detection probabilities as follows a
upper P
cond(post-insp) (>a) = p (x) PND(x)dx
where a u er is some upper limit on crack depth, such as the wallthi! ness. The function p g (a) is obtainable from the above results for Pcond(>a), because Po (a) = gh7 Pcond (a)
The conditional probability of failure of a given joint within the plant lifetime is then given by Pf (cond) = Pcond(post-insp) (>atol)
The average failure rate (per plant-year) for the given joint will then be Ef (joint) = Pf(cond) X(prob. of having a defect)/(lifetime)
The probability of having a defect in the joint depends on the basis of normalization (area, vol, etc.) as discussed above.
For instance, using weld area as the basis of__ normalization, and assumingpjisverysmall -
[
Ef (joint) = P f(cond) PJ A/(lifetime)
The plant liftime is taken as 30 years for CRBR and 40 years for the LWR's. The overall average failure rate for the plant will be pf(joint) x(n . f j ints) . Taking ratios of CRBR to LWR valuesresultsinthefactorssuchaspycancellingout (as was discussed above).
j The ratios pf(CRBR) /Ef (LWR) f r various bases of normal-ization and various cracE size distribution are summarized in Table 1.
e
TABLE 1 pf (CRBR) O f(LWR) For Various Bases of Nonnalization and Initial Crack Depth Distributions (pre-service RT inspections, unless otherwise noted) l Basis of l Nonnalization Crack Dist. PWR #1 -
PWR #2 PWR #3 weld volume Wilson .0186 .0618 .264*
Becher & Hansen .0174 .0493 .156*
Marshall (no insp.).0309 .0423 .0697 Marshall (RT) .0276 .0378 .1298 weld area Wilson .139 .744 1.75*
Becher & Hansen .130 .592 1.04*
Marshall no insp.).232 .512 .463 Marshall RT) .207 .457 .859 weld length Wilson 1.04 4.45 11.62*
Becher & Hansen .974 3.54 6.89*
Marshall (no-insp.)1.74 3.06 3.08 Marshall (RT) 1.55 2.73 5.72
I DISCUSSION The results of Table 1 show a wide range of values, varying from 0.0186 to 11.62 (i.e., three orders of magnitude).
However, for a given plant and basis of normalization, the num-bers vary by much less--typically half an order of magnitude.
Thus, it can be concluded that the crack size distribution and detection probabilities of the pre-seismic inspection do not have a large influence. In fact, the plant-to-plant variation from PWR to PWR are larger than the variations due to different initial crack depth distributions and inspections.
The variable having the largest influence on the results of Table 1 is the basis of normalization. This is because of the large differences in the pipe diameter and thickness of PWR piping as constrasted to the CRBR piping, as well as the large differences of the number of weld joints employed in the two types of plants. Normalization with respect to weld length does not seem to make as much sense as using volume or area, because the region affected by a weld includes the heat affected zone--which is generally about 2 wall thicknesses wide. Hence, it appears likely that 1 ft. long weld in a 4 in. thick plate would be much more likely to have a crack than a 1 ft. long weld in a 4 inch thick plate. However, whether the volume or surface area should be used is not clear. Fatigue cracks, such as are l considered in this analysis, generally originate at surfaces, and their growth is accelerated by the environment at the sur-face. This would suggest that weld surface area is the contro11-l l
ing parameter. However, it would seem that constraint resulting
! from thicker weld section would result in a larger number of defects, so that vclume may play a role. With the present state of knowledge, it is not possible to ascertain the controlling l
l l
l t
parameters. Discarding weld length as the basis, it would be conservative to assume that weld area is the controlling factor, , ,
in which case the ratio of average failure rates of CRBR to PWR's' falls within the range of about 0.1 -1.
CONCLUSIONS
- The above discussions lead to the conclusion that the -
failure rate of pt*1 mary piping in CRBR is 0.1 -1 times the .
corresponding value for a PWR. The largest source of variation in this number is plant-to-plant variations in the three PWR's considered. The ratio of failure rates is not strongly isflh-enced by pre-service inspections or the use of various candidate ,
initial defect depth distributions. /
m em 4
M e
,,A N D
i .
4 REFERENCES -
- 1. D. O. Harris, "A Note on the Pipe Rupture Prdbability Calculations for the Primary Heat Transport System of-CRBRP,"
Science Applications , Inc. , Palo Alto, California, ' October 7, 1977. _
i r
- 2. D. O. Harris, "An Analysis of~the P[obability of Pipe Rupture at Various Locations in the Primary.C6oling Loop of a Babcock and Wilcox 177 Fuel Assembly' Pressurized Water Reactor -
' Including the Effects of a Periodic' Inspection," Science Appli-cations, Inc., Report No. SAI-050-77-PA, Palo Alto, California, September 1977. - '
- 3. S. A. Wilson, Estimatifig the Relative Probability o'i Pipe Severance by Fault Cause, General _ Electric Company Report GEAP-20615, Boiling Water Reactor System Department, San Jose,
. California, September 1974. ,
- 4. P. E. Becher and B. Hansen, "Statistbal Evaluation of Defects in Welds and Design Simplications," Danish Welding Institute, Danish Atomic Energy Commission, Research*Establisment Riso.
- 5. "An Assessment of the Integrity of PWR Pressure Vessels,'"
_ Report of a Study Group Chaired by W. Marshall, available from H. M. Stationary Office, London, Oct. 1976.
l ,, ::
- t. .
- *q , .
N
. s 4 e
- . /
s 's -
,, A ~ *
,/
4 Y
i
, fs g
/ %
~
. /,
i e
, /'
Y
, -11 ~ # '
/ .
A s s
,. _ - . # .. t. "
_7..__ _
/.'*,.-
s' BEFORE THE UNITED STATES NUCLEAR REGULATORY COMMISSION ATOMIC SAFETY AND LICENSING BOARD
~
)
In the Matter of ) -
)
UNITED STATES DEPARTMENT OF ENERGY )
PROJECT MANAGEMENT CORPORATION ) Docket No. 50-537 TENNESSEE VALLEY AUTHORITY )
)
(Clinch River Breeder Reactor Plant) )
)
AFFIDAVIT OF DR. THOMAS B. COCHRAN City of Washington )
) ss:
District of Columbia )
DR. THOMAS B. COCHRAN hereby deposes and says:
The foregoing testimony prepared by me and dated November 1, 1982, is true and correct to the best of my knowledge and belief.
Dr. Thomas B. Cochran Signed and sworn to before me this 1st day of November 1982.
m0hd EeYuy" Notary Public I C***b'In Expires Jufy 31,19g7 l
l l
I I
l