AECM-87-0187, Comments on Draft NUREG-1150, Reactor Risk Ref Document. Review of Document Indicates That Ability of Facility to Cope W/Severe Accidents Underestimated Due to Conservative Assumptions
| ML20235U416 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 10/02/1987 |
| From: | Kingsley O SYSTEM ENERGY RESOURCES, INC. |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| FRN-52FR7950, RTR-NUREG-1150 52FR7950-00034, 52FR7950-34, AECM-87-0187, AECM-87-187, NUDOCS 8710140082 | |
| Download: ML20235U416 (12) | |
Text
{{#Wiki_filter:m 9
,. m- DS o 97 l
RdA: Cfy/, DOCKETED USNRC - ' NFETEMSWENEY RULES & PROCEDURES BR NEsatAKEN,iMr. !;pR- A.n l Chip D. KINGSLEY.JR g gsg' , October 2, 1987
.g r- r 4 gy
~
h ,I$ l ' s ne w o Chief, Rules and Procedures Branch Division of Rules.and Records i Office of Administration L U. S. Nuclear Regulatory Commission Washington, D. C. 20555
Dear Sir:
SUBJECT:
Grand Gulf Nuclear Station Unit 1 Docket No. 50-416 License No. NPF-29 Comments on Draft " Reactor Risk Reference Document" AECM-87/0187 l System Energy Resources, Inc. (SERI) appreciates.the opportunity to perform a review of the NRC draft " Reactor Risk Reference Document" (NUREG 1150) and its supporting documents. The overall NUREG.1150 effort is a sizable i undertaking and the NRC should be commended for.its attempt to. move risk assessment technologies forward as a basis for regulatory decision-making;' however, appropriate consideration should be given to industry comments during the revision of the NUREG 1150 documents. Due to the nature and extent of l industry comments on the documents, SERI strongly recommends that the application of NUREG 1150 insights or results be approached carefully. Due to limited resources and time, SERI's review of the NUREG 1150 documents has been limited to those portions pertaining to Grand Gulf. SERI's review indicates that the ability of the Grand Gulf. Nuclear Station.to cope with 3
~
severe accidents has been underestimated due to conservative assumptions used in the estimation of core damage frequency, containment analysis and offsite consequence analysis portions of the study. Specific comments are delineated in.the attachments to this letter. ; SERI has also actively participated in BWR Owner's Group and Hydrogen-Control Owner's Group activities regarding the review of NUREG 1150 documents. SERI has reviewed and endorses review comments provided-by these industry groups. ; SERI intends these comments to assist you in improving future revisions j of NUREG-1150.- SEk1 considers that a study with such diverse implications and which is anticipated to become a major industry and regulatory benchmark j B710140082 371002 ) PDR NUREG PDR
- j 11 P'6 BOX 23370 l #CKSON. M;SSiS$1 Pol 392253070 l kcO1)9eO9eOO A Mdche Souh U5tes Cccm j j l
J16AECM87092502 - 1 xI kre e ce d k M sgl
l AECM-87/0187 Page 2 l i should be finalized in a very deliberate manner. SERI recommends and is ready l to support interactive participation between the industry, the NRC, and NRC contractors in addressing and resolving major issues. You ruly,
\
/ . .
ODK:bms f Attachment cc: Mr. T. H. Cloninger (w/a) I Mr. R. B. McGehee (w/a) i Mr. N. S. Reynolds (w/a) ) Mr. H. L. Thomas (w/o) i Mr. R. C. Butcher (w/a) Dr. J. Nelson Grace, Regional Administrator (w/a) , l U. S. Nuclear Regulatory Commission ] l Region II 101 Marietta St., N. W., Suite 2900 Atlanta, Georgia 30323 4 l Mr. L. L. Kintner, Project Manager (w/a) Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission 1 7920 Norfolk Avenue j Bethesda, Maryland 20814 l l I Mr. A. L. Camp (w/a) Sandia National Laboratories Reactor Systems Safety Analysis ; Albuquerque, New Mexico 87187 ! i I l l l l l J16AECM87092502 - 2 ;
--- --------- _ ------ _ ------ _ _ ---- a
,. -{
.. J Attachment 1 to AECM-87/0187 COMMENTS ON NUREG-1150 NUREG-1150, Volume 1, " Main Report" j
)
( CHAPTER 2 METHODOLOGY i l In general, the NUREG-1150 core damage frequency methodology is consistent I with that of other full-plant Level-1 Probabilistic Risk Assessments ) (PRA). The objective of this analysis was to determine on a best estimate i basis the expected frequency of. core damage accidents at the reference l , plants and to identify the accidents and accident contributors most likely i I to lead to core damage. As with other PRA studies, shortcut analyses were ] performed where preliminary results and previous PRA analyses indicated that the use of shortcuts were appropriate. In general, the assumptions used in the core damage frequency analyses are typical of other PRAs and thus tend to be conservative. The need to make certain conservative j assumptions in order to perform analyses of this type is recognized; however, because of a few overly conservative assumptions made in support j of this analysis, the ability of the Grand Gulf Nuclear Station (GGNS) to cope with certain postulated core damage sequences is significantly underestimated. l The underestimation of the plant's coping capability should be reduced in i the updated version of NUREG-1150. It is recommended that additional I consideration be given pump seal, battery to actual and diesel plant equipment generator operability) failure rates, etc. nda(e.g., revisedHPCS plant operating procedures (e.g., emergency procedures, firewater, etc.). Unlike the core damage frequency analysis, the containment event tree, j source term and uncertainty analysis methods used in the NUREG-1150 { effort represents new approaches which were developed in the Severe Accident Research Program (SARP) effort. In performing these analyses many of the most risk-significant issues are treated in a statistical, parametric manner. As a result, there is a very heavy dependence on expert opinion rather than mechanistic analysis or experimental evidence to determine ranges of parametric values. It is recommended that in 1 updating the NUREG-1150 analyses that the most dominant risk-significant. j issues, where at all possible, be based on a mechanistic analysis or j experimental evidence to determine ranges of the parametric values. SECTION 2.2 CORE DAMAGE FREQUENCY ESTIMATIONS Page 2-4, Paragraph 3 l NUREG-1150, states that "if the operators depart from their written l procedures, the task under consideration will not be performed . satisfactorily, with no credit given for operator recovery". This I assumes that a single violation of procedures (even if minor) could i lead to failure regardless of the available recovery ~ time. In addition the above position allows no credit for Control Room oversight (i.e., Shift management and STA). J16AECM87092502 - 4 _ _-____----_a
a. 4 Attachment l'to e AECM-07/0187 Also, credit was given for operator actions "only, when written procedures. were available and if sufficient time'were available to perform the actions needed". It would appear to be-' conservative ~to assume that the
. plant . operator.'s understanding .of' the various system responses does not go beyond the level of predefined responses.
These assumptions may be reasonable for complex processes which must be performed in a short time frame. However,-the majority of-core damage. sequences are long term events in which core damage is not predicted to occur within the first 6 to 8 hours. Activation of the emergency organization within this timeframe is well defined by procedure ) consistent with severity of_. the event or its consequences. When activated the emergency organization provides significant additional operational and management expertise to-aid operators in assessment and corrective actions. 1 i It is suggested that this. approach be revised to allow credit fo'r the performance of simple tasks which could be completed quickly, and'for more complex tasks oversight and expertise provided by shift management and the emergency organization. ] CHAPTER ~3 CORE DAMAGE FREQUENCY ESTIMATIONS l 1 Much of the scope, methods and assumptions used in the NUREG-1150 core { damage frequency analysis appear to.be conservative. SERI accepts the i fact that certain conservative assumptions must be made in order to-perform analyses of this type. However,. based on a review of NUREG-1150 - I and its supporting documents, SERI believes- that many of.these assumptions-are overly conservative and as a result underestimate the ability of GGNS to cope with certain postulated sequences. Some examples are as follows: The assumption that the common cause-failure probability of three or more station batteries is unity, given that two-have failed due to a ' l common cause, is very conservative. This value does not appear to be basedonthereferencedDCpowerstudy-(NUREG-0666),Lwhichaddresses only single and' double battery failures. i The assumption that the ESF switchgear and batteries fail within four hours after loss 'of room cooling is considered to be overly conservative. ' The assumed HPCS seal failure temperature, the catastrophic nature of 1 the seal failure, its effect on the continued operation of the pump ; and the exclusion of potential operator actions to avert such failures - l are considered.to be overly conservative. The exclusion of multiple, simultaneous' recovery actions during long-term accident scenarios-(i.e., greater than 1 br.) is not only. j very conservative but also distorts the results of the analysis .and , artificially increases:the relative risk-significance of long-term ! accidents such as the station blackout event. 1 i l l J16AECM87092502 - 5
- - - - - _ _ _ _ _ l
Attachment I to AECM-87/0187
- The assumed diesel generator hardware failure probability is 6.9E-2.
This value is high with respect'to the value reported in huclear Safety Analysis Center Report NSAC/108 dated September 1986 (2.2E-2) and the GGNS value calculated in accordance with Regulatory Guide 1.108 (2E-2).
- The assumed diesel generator maintenance unavailability probability is 1.6E-2. This value is high with respect to the value reported in the Industry Degraded Core Rulemaking (IDCOR) Technical Report 86.3B1 (1.0E-3).
These assumptions are covered in additional detail in SERI's comments on NUREG/CR-4550, Volume 6 (Attachment 2_). It is recommended that each of these assumptions be reassessed in light of the additional information provided in Attachment 2. CHAPTER 4 CONTAINMENT ANALYSIS SERI believes that the containment analysis includes at least two overly l conservative assumptions which results in the capability of the containment systems to cope with severe accidents to be underestimated. It is suggested that additional consideration be given to the following assumptions prior to final publication of NUREG-1150. The assumption concerning the possibility of hydrogen detonation is in SERI's opinion far from certain. In order to establish a detonation, either a detonation source or a geometric configuration which will greatly enhance the flame front speed is needed. In SERI's work with the Hydrogen Control Owner's Group (HCOG), it has been determined for Grand Gulf that neither a detonation source nor the required geometric configuration exist. 1 l The possible mitigative effects of secondary containment and the j Standby Gas Treatment System were not credited in the analysis. This is very conservative especially in light of recent testing that supports the leak before break theory for containment failure. Page 4-43 The Grand Gulf containment performance issues are not all independent on each other. It is requested that future NUREG-1150 reports further explain how the statistical variation of these parameters account for these dependencies. Page 4-43, 45 In-vessel hydrogen production appears to have a significant impact on t.he containment response. It is suggested that this parameter be added to the containment performance issues list and that in-vessel hydrogen production be treated as an uncertainty. l a J16AECM87092502 - 6
l i Attachment 1 to AECM-87/0187 Page 4-44 i Based on the fact that reactor pedestal failure occurred in 40% of the statistical samples in the uncertainty analysis, it appears that too little credit has been given to recovery actions which are possible in a long-term accident situation. This is especially true in light of the fact that pedestal failure can occur only after a very long-term (greater than 24 hours) core-concrete interaction. It is recommended that the 'l NUREG-1150 analysis be revised to include credit for long-term recovery actions which would prevent or at the least arrest core-concrete interaction. i I I CHAPTER 5 SOURCE TERM ANALYSIS The non-mechanistic, parametric, and statistical treatment of important source j term issues in the NUREG-1150 source term analys1s produce several concerns: j 1 The source term results are known to be highly dependent on both l plant design and accident scenario. Thus, the risk results are very sensitive to the identification of a complete set of risk j significant parameters for each plant and scenario. The NUREG-1150 ! report does not appear to document the process used during its ! evaluation to assure that the most significant source term parameters were identified for each plant and accident scenario. Please provide a description of this process in the revised version of NUREG-1150. l - Since expert opinion was used to assign values (i.e., a range of values) for each of the identified risk significant parameters, the risk assessment results are highly' dependent on the process used to select these experts and to solicit their opinions. Although this concept is valid, the composition of the expert review group does not i appear to represent an appropriate cross-section of the current severe accident community. In addition, the methods used to sample the experts and to determine uncertainties are not clear and appear to lack the necessary controls to arrive at unbiased statistical results. It is recommended that industry experts, outside those in the national laboratories, be included in the " expert group" and 1 that this group then be re-polled with a rigorous effort to implement ! standardized consistent sampling methods. I Since the source term issues are not in all cases independent of each other, it is important that their dependencies on other issues be incorporated into the source term code package calculations. Please provide additional explanation as to how these dependencies 1 were accounted for in NUREG-1150. l CHAPTER 6 0FFSITE CONSEQUENCE ANALYSIS , Graphs of individual early and latent fatalities associated with each l plant are not provided. Since these graphs would be helpful in comparing reference plants' offsite consequence results with each other, it is recommended that they be included in the final publication. J16AECM87092502 - 7
Attachment 1 to AECM-87/0187 CHAPTER 7 RISK ESTIMATION Previous PRAs have used the Complementary Cumulative Distribution Functions (CCDF) or " Risk Curve" as a principal means of displaying risk results. Very little emphasis is placed on CCDF in the NUREG-1150 report. For consistency and comparability with previous results, it is recommended that greater emphasis be placed on the use of CCDF graphs in the final version of NUREG-1150. Figure 7.21, Page 7-33 No explanation is provided in the report for the significant difference in the behavior of Grand Gulf's latent cancer fatality CCDF curve and that of other reference plants consequences /high probability curves. It is recommended that additional explanation of this difference be provided in the final NUREG-1150 text. Table 7.1, Page 7-36 The results listed on Table 7.1 indicate the significance of the iodine re-evolution from the suppression pool modeling assumption. Bin 145 was I determined to be one of the largest contributors to Grand Gulf's early fatality risk. Iodine was noted as one of the dominant contributors to early fatalities (pgs. 6-28 and 6-29). Since no RPV failure occurs in this bin, nearly all the iodine released from the fuel in this case is absorbed by the suppression pool. Since re-evolution is the only mechanism for iodine release from the suppression pool water, this process appears to be a very significant contributor to the NUREG-1150 assessed early fatality risk for Grand Gulf. This is in contrast to IDCOR's mechanistic n.odeling of iodine in the form of Csl which, unlike iodine gas, does not re-evolve from the suppression pool after containment failure. It is recommended that this issue be investigated further before the NUREG-1150 results are finalized. 1 I l J16AECM87092502 - 8
. i
' Attachment 2 to l AECM-87/0187 COMMENTS ON NUREG/CR-4550, VOLUME 6 Table IV. 3-4, Pages IV-13 to IV-20 ;
The following comments concern the Grand Gulf success criteria presented in Table IV. 3-4:
- Please explain why for all initiators, recirculation pump trip (RPT) is required for successful reactor subcriticality given successful manual control rod insertion.
- For small LOCAs, the Suppression Pool Makeup System [shd) was .
J' required for successful emerpacy core cooling and for sbccessful early and late containment over pressure protection. Please explain this requirement in light of the fact that during'a small break LOCA, l there exist a large amount or time for alternate operator action to
/,
maintain suppression pool inventory. ,
//
Please explain why for non-LOCA initiators, no credit was taken for ' the use of Reactor Water Cleanup (RWCU) system as a means of removing residual decay heat from the reactor vessel. Figures IV. 4-1 through IV. 4-12 j' l Itisrecommendedthatthefollewinsfiguresberevisedtoaddressthe ' following comments: In Figure IV. 4-1, page IV 26, " Low Pressure Coolant Injection" is mistyped " Low Pressure Coolent Detection". ; In Figure IV. 4-2, page IV-31, the event tree branches are slightly displaced from the top event names making it difficult'to follow. In Figure IV. 4-2, page IV-31, sequences 21 and 22 are labeled "0K" but appear to be containment failure ("CtF") and containment vented , ("CtVt") events,respectively. In addition, these two sequences are not described in the text associated with this figure. 7 1 Page IV-106 HPCS assumption number 16 states that the operator will throttle HPCS flow after initiation. The HPCS injection valve cannot be used to throttle flow since this valve is either full open or full closed. s Section IV.5.6.1, Page IV - 122 The text incorrectly states that there is no inhibit switch for the ADS system at Grand Gulf. An ADS inhibit switch was incorporated Ahto the Grand Gulf design during the first refueling outage. . r
$ ;/
J16AECM87092502 - 9 ,
~
v + d
Attachment 2 to AECM-87/0187 Page IV - 163 SERI believestP,e following NUREG/CR-4550 are overly conservative:
- the assumed failure of the ESF switchgear and batteries within four hours after a loss of room cooling; s
- the assumed failure of low pressure ECCS pumps within four hours af ter a loss of associated room cooling;
- the assumed failure of the RCIC pump within twelve hours after a loss of associated room cooling; and 3
- the assumed failure of diesel generators within fifteen minutes after a loss of associated room cooling.
SERI has performed room heat-up calculations for the ECCS pump rooms and the ESF switchgear rooms. These calculations were based upon LOCA conditions and the assumed loss of safety related cooling in the room under consideration only. For each room, a steady state temperature was determined. Using the steady state temperature, the equipment within each room was evaluated for equipment qualification limitations and the continued operation of the equipment at the steady state temperature for
. 24 hours.
The results of this evaluation indicated that all equipment located in Divisions I & II ESF switchgear room and in RHR A, B and C pump rooms were found capable of operating for greater then 24 hours. For the equipment located in the HPCS and LPCS pump rooms, the evaluation indicated that the continuous operation for 24 hours at the calculated steady state temperature could not be ensured. No attempt was made to calculate specific operatit;g durations prior to failure. In the qualification of the GGNS batteries, the batteries were subjected to thermal aging at temperatures of up to 160 F. The effects of elevated temperatures is not the immedia% , failure of batteries but rather the shortening of the batteries qualified life. Room heat up calculations performed for the operation of RCIC during a station blackout with no roam cooling verify that the room temperature will n N exceed equipment qualification limits. For the diesel generator rooms no room heat-up calculations exist at this time. SERI recognizes ; the necessity of room cooling in order to ensure continuous operation of i the diesels; however, the assumed failure of the diesel generators within i fifteen minutes after a loss of room cooling is questioned. In light of the above information, it is recommended that the failure assumptions resulting from loss of room cooling be re-evaluated prior.to updating NUREG-1150. J J16AECM87092502 - 10 1
,' Attachment'2 to AECM-87/0187-Section IV.5.15.6, Page IV - 169 ,
Tha Emergency Ventilation System (EVS) assumption number three states that "the ECCS pump, the RCIC puinp and diesel generator room ventilation systems were assumed to be out for maintenance during plant operation". This statement appears to imply that these systems are normally out for maintenance. This is not the case and in fact appears inconsistent with the assumptions in the actual NUREG/CR-4550 system models. Please provide additional clarificadon as to what was assumed in the system models and its impact on the results. 1 Section IV 5.16, Page IV - 170 J The Instrument Air System 1s stated as a backup to the nitrogen system for l the MSIVs and ADS /SRVs. This is not correct. In fact, the Instrument Air ! System is the Bottled air primary) (nitrogen source could of pressurized serve as a backupair to these source components. of air for these systems if r? quired, , Page IV - 192 and IV - 302 0 l The assumption that the common cause failure probability of three or more i station batteries is unity given that two have already failed due to common cause is very conservative. This beta factor of one does not appear to be based on the referenced DC power study (NUREG-0666). A l review of this reports fn61 cates that it addresses only single and double battery failures. Given tilat common cause battery failure contributes appro.Hmately 16% of ,the total core damage risk at Grand Gulf, please provide a basis for the assumed common cause battery failure , probabilities. '
)
Table IV.8-1, Page IV-217 The diesel generator hardware failure probabilities (ACP-DGN-HW-DG11/12/13) of 6.9E-B are high in comparison to Grand Gulf diesel generator data and to other reported failure rates. I Grand Gulf reliability maintains awith in accordance data base in support Regulatory of determining Guide 1.108. As of July, diesel 1987, generator ,',i the combined reliability of divisions I, II and III diesel generators was ' 98% or a failure rate of 2E-2. In additien, the Nuclear Safety Analysis i Center (NSAC)/ Report, NSAC/108 dated September,. 1986, reports an overall
- l. industry diesel generator reliability of 98.6% for test and unplanned i demands and 9 1% for unplanned demands only.
It is recommenhd that the diesel generator hardware failure probabilit.es be reassessed giving consideration to the Grand Gulf data and the NSAC/108 data prior to final publication of the report. ,- i l l l \ J16AECM87092502 - 11 w_______-_____-
~ ; '= '
Attachment 2 to g 'AECM-87/0187 4 4 , J Table IV.8-1, Page IV-218
'a The diesel generator maintenance unavailability probabilities
+ ( ACP-DGN-MA-DG11/12/13) 'of 1.6E-2 are high in comparison with other -
unavailability estimates. The Industry Degraded Core'Rulemaking (IDCOR) 4(
- . Technical Report 86.3B1 assessed the diesel generator maintenance unavailability to be 1.0E-3.
3 It is suggested that.the diesel generator maintenance unavailability be i reassessed prior to final publication of NUREG-1150. y TABLE IV.8-7, Page IV-227 The station battery mean unavailability estimates (DCP-BAT-LP-1A3/183/1C3) of 1.4E-3 'are high compared to previous estimates of this parameter. The' WASH-1400 estimate of this mean unavailability is 3.75E-6/hr., or 9.0E-5 for a similar 24-hr. mission time. In light of the fact that the single battery failure, estimate is used to calculate the common cause failure estimate v'a the use'of a beta factor, and since the. common cause failure - was' calculated to contribute 16% of the' total Grand Gulf core damage frequency, it is important that the single battery failure. estimate be as realistic as possible. It is recommended that battery failure rates be investigated further~ prior to final publication. Section IV.9.2.2, Page IV - 301 The possibility of multiple, simultaneous recovery actions during long-term accident scenarios (i.e., greater than'l hr.) was not allowed in all cases. Failure to model simultaneous recovery actions is.not' only. conservative (since there are multiple maintenance crews available and ample time for repairs), but also could distort the results of the analysis so as to artificially increase the relative risk-significance of long-term accidents. Please comment as to why multiple simultaneous recovery acticns was not allowed. ! I l Page IV - 310 The Grand' Gulf turbine bypass capacity is stated as '25% of full power - ' capacity. The Grand Gulf turbine bypass capacity in fact has a design rating of 35%. l Table IV.10.1-5,-Page IV - 327- j 0 The following comments apply to the unavailability data used in the ATWS analysis:
)
Event RPSM, mechanical ' failure of all control rods to' insert into the d core, was' assigned a mean probability value'of 1.0E-5. This estimate- "
.'J16AECM87092502 '12. !
-_a____ _ _ _ - _ _ - _ - _ _ _ _ _ - . _ _ _ _ - _ _ _
a o. Attachment 2 to-AECM-87/0187 i is several orders of magnitude larger than General Electric (GE) l estimates for this parameter of 1.0E-8 reported in the General 1 Electric Standard Safety Analysis Report (GESSAR II). !
)
In light of the importance of this event as a contributor to the ATWS i accident, please explain the 'large differences between the l NUREG/CR-4550 and GE unavailabilities.
- Operator failure to depressurize the RPV, i.e., Event DEP, was assessed by.NUREG/CR-4550 as a dominant contributor to the ATWS core-damage i frequency. This event was assigned a probability of 0.125 in all ATWS situations independent of whether high pressure injection systems had failed to start or run. This failure probability value appears to be high considering that the emergency procedures would have directed !
the operator to depressurize the reactor in at least two separate J steps. Thus the failure to depressurize would involve at least two j operator errors. Please provide a basis for this assessed operator failure. ; Page V-15 Plant damage state TB in NUREG/CR-4550 assumes that the HPCS pump seal failure results in the immediate failure of the HPCS pump. This failure of the HPCS pump seal was subject to large uncertainties, primarily because of inconclusive data associated with this failure mode. SERI has reviewed the potential effects of a HPCS pump seal failure and concluded that this failure would not prevent operation of the pump, but could have the potential to cause increases in room temperature due to increased leakage. However, a HPCS room heat up calculation determined that the temperature of the HPCS room would not exceed the technical specifications limit of 150 FUduring a long term SB0 accident sequences such as those encompassed by the TB plant damage state in NUREG/CR-4450. Based on these finds, it is recommended that the assumed failure of the HPCS pump due strictly to the failure of the pump seals be reconsidered. Table V.3-7, Page V-83 1 The failure probability of Event ESW-CCF-VF-ESW is reported as 1.7E-1 but should have a value of 1.7E-4 consistent with the value given in Table IV.8-10, Page IV-242. l l i J16AECM87092502 - 13 1
- _ - - - -- _ - - - - - - - - - - 1}}