ML17146B174

GL 96-06 Risk Assessment for Sses.

ML17146B174
Person / Time
Site:	Susquehanna
Issue date:	08/03/1999
From:	PENNSYLVANIA POWER & LIGHT CO.
To:
Shared Package
ML17146B173	List: ML17146B174
References
EC-RISK-1073, GL-96-06, NUDOCS 9908120059
Download: ML17146B174 (52)

Text

0TABLEOFCONTENTStEC-RISK-1073 PAGE2PAGE

2.0CONCLUSION

S

3.0 BACKGROUND

ANDISSUERESOLUTION 3.13.2Background IssueResolution 3.2.1Identification ofLicensing BasisIssue3.2.2Structures, Systems,Components (SSCs)andProcedures CoveredbytheLicensing BasisIssue3.2.3Supporting Information

4.0 ENGINEERING

ANALYSIS4.1Deterministic Analysis4.2OverviewofRiskAnalysisandConclusions 4.2.1Methodology forEvaluating theProbability ofContainment Penetrations 4.2.1.1Evaluation ofCurrentDesignstoOverpressure FailureofContainment Penetrations 4.2.2SpeciTicEvaluation ofPenetrations 4.2.2.1Evaluation ofRBCCW,RBCW,andtheHeadSprayLine4.2.2.2Evaluation ofDrywellSumpLine5.0IMPLEMENTATION ANDMONITORING PROGRAM

6.0REFERENCES

91213131414232627'I9908i20059 990803PDRADGCK05000387PPDR

EC-RISK-1073 PAGE

31.0INTRODUCTION

OnSeptember 30,1996,theNRCissuedGenericLetter96-06,"Assurance ofEquipment Operability andContainment Integrity DuringDesign-Basis AccidentConditions."

IntheGenericLetter,thepotential forthermally inducedoverpressurization ofsectionsofcontainment pipingwhichareisolatedduringdesignbasisaccidents wasidentified.

Withrespecttothispotential, licensees wererequested to:1)evaluatetheirplantdesignanddetermine ifcontainment pipingsystemsaresusceptible tothermally inducedpressurization;-

2)evaluatetheOperability ofaffectedpipingandsystems;3)identifylongtermcorrective actionsthatwillbetakeninordertoprovidecompliance withtheplant'sdesignbasis;and4)completetheseevaluations andsubmitareportwithin120days.InNovemberof1996,theNRCissuedsupplementary information tothegenericletterregarding specificregulatory expectations.

Atthattime,itwasclariTied thattheconcernsforpipingoverpressurization duringdesignbasisaccidents notonlyappliedtopipinginsidecontainment, but-alsotocontainment penetrations (i.e.,thepipingbetweenthetwoisolation valves).Aslicensees evaluated thepotential forthermally inducedoverpressurization fortheirspecificplantdesigns,itbecameapparentthattherisksignificance (andhencetheactualimpacttoplantsafety)ofthisphenomenon wasrelatively low.Thisp'erspective wasreflected withtheissuanceofSupplement 1totheGenericLetter,aswellasthroughthestaff'sinteraction withlicensees andindustrygroups,whichencouraged theuseofrisk-based insights.

Althoughthethermaloverpressurization concernsidentified inthegenericletterdidnotrepresent asafetyissue,compliance withaplant'slicensing basis,i.e.,coderequirements, was(andis)nonetheless stillrequired.

Therefore, fortheSSESunits,thefocusoftheoverpressurization issuewas(andis)oneofcompliance withtheASMEcode.PP8Lhasevaluated containment pipingandpenetrations pertheGenericLetterandhasidentified twelveinstances whereoverpressurization failureofpipingmayoccur.Likethestaff,PP8Lconcluded thatthepotential foroverpressurization ofthesespecific'enetrations isnotasafetyconcernduetotheconsiderable margininthedesign.Additionally, PP8Lconcluded thatallASMEcoderequirements weresatisfied bythecurrentdesign.However,theNRCstaffinterpretation oftheASMEcodediffersfromthatofPP8L.BasedupontheNRCstaffsinterpretation, thetwelvepenetrations identified asbeingsusceptible tooverpressurization failuredidnotmeettheASMEcoderequirements.

PP&Lhasevaluated plantmodifications thatresolvethestaffsopencompliance issues.Thesemodifications involvetheinstallation ofreliefvalvesonthesusceptible pipesandpenetrations.

Thepreliminary costforengineering andinstallation ofthese I

EC-RISK-1073 PAGE4modifications isestimated tobe$2,000,000.00.

Additionally, itisestimated thattheIn-,ServiceInspection (ISI)andMaintenance costisatleast$20,000.00/year.

Inadditiontothefinancial burdenassociated withthemodifications, aradiation exposureburdentoemployees wouldbeincurredduringinstallation, periodicISIandMaintenance.

Finally,whiletheproposedmodiTications resolvetheASMEcodeinterpretation issue,itis'expected thattheywillresultinforcedshutdowns duringtheplantlifeandmayincreasetheprobability ofpenetration failure.Therefore, PPBLcommitted toapproachresolution oftheASMEcodeinterpretation issuethrougharisk-informed submittal.

Theresolution ofthisisbeingpursuedas,"ARisk-Informed PlantSpecificChangetotheLicensing Basis."Therefore, theguidanceoutlinedinRegulatory Guide1.174isbeingappliedinthisassessment.

Specifically, theregulatory guideidentifies evaluation ofthefollowing elementsasanacceptable approachtorisk-informed decisionmaking.~Element1-Definition andPurposeofProposedChange~Element2-Engineering Analysis~Element3-Implementation andMonitoring ProgramThisassessment isstructured toaddresseachoftheseelementsaspresented intheRegulatory Guide.Thelevelofdetailprovidedinthisassessment isbasedupontheguidanceinOfficeLetter803.Thisissueisseenashavingalowrisksignificance, moderatecomplexity andsimilarity withthemodelinNUREG-0933.

2.0CONCLUSION

S PTheNRCevaluation ofthisissueisdocumented inNUREG-0933 alongwiththefollowing conclusions.

Theestimated publicriskassociated withoverpressurizafion ofcontainment penetrations wasnofsignificant.

Basedonthevaluefimpact assessment andfhestaf'ssimplified engineering

analysis, thisissuewasplacedintheDROPcategory.

PP8L'sworkconfirmsthattheNRCstaffsconclusion isvalidforSusquehanna.

Thisconfirmation isbaseduponthefollowing speciTicconclusions.

~Thepotential foroverpressurization failureofcontainment penetrations, ascurrently configured, isinsignificant pertheRegulatory Guide1.174criterion of10increaseinLargeEarlyReleaseFrequency (LERF).~Themodifications totheSusquehanna Emergency Operating Procedures provideadditional defenseindepthagainstlossofcontainment integrity duetopenetration failure.

EC-RISK-1073 PAGE5~Thehardwaremodifications toresolvethecompliance issuedonotreduceandmay,infact,increasethelikelihood ofpenetration failure.~Thehardwaremodifications toresolvethiscompliance issueresultinadditional radiation exposuretoemployees forinstallation, periodicISIandmaintenance.

~Thepotential forpenetration failurefromoverpressurization doesnotwarranttheexpenditure of$2,000,000.00 formodifications and$20,000.00 annuallyformaintenance.

~Thepotential forpenetration failurefromoverpressurization doesnotwarrantincreasing theadditional exposuretoforcedshutdowns associated withtheproposedhardwaremodifications.

~ChangestotheEmergency Operating Procedures areeffective atreducingthelikelihood ofpenetration failure.Baseduponthesespecificconclusions, theEmergency Operating Procedure changesimplemented byPP8Lresolvethecompliance issuesassociated withGL96-06.3.0BACKGROUND ANDISSUERESOLUTION

3.1Background

Asdiscussed intheIntroduction, GL96-06addressed overpressure failureofbothpipinginthedrywellandcontainment penetrations.

PP&Lhasevaluated theSusquehanna designforbothoftheseconcerns.

Theresultsoftheseevaluations aresummarized below.Containment PipingPressurization UnderDBAConditions InPP8L's120-dayresponsetotheGenericLetter,thepotential forthermally inducedoverpressurization ofseveralcontainment closedlooppipingsystemsduringdesignbasisaccidents wasidentified.

Theclosedlooppipingsystemsthataresusceptible tothismechanism are:1)non-safety-related ReactorBuildingClosedCoolingWater(RBCCW)pipingto/fromthereactorrecirculation pumps;2)non-safety-related ReactorBuildingChilledWater(RBCW)pipingto/fromthereactorrecirculation pumpmotors;3)non-safety-related RBCWpipingto/fromthedrywellcoolers;and4)non-safety-related drywellfloordrainsumppumpdischarge lines.Althoughsusceptible tothismechanism, thepotential forthesesystemstopressurize doesnotthreatenthefunctionofanysafety-related equipment requiredtomitigatetheconsequences ofadesignbasisaccident.

Further,itshouldbenotedthatthe

EC-RISK-1073 PAGE6assumption thatthispipingisnotavailable duringdesignbasisaccidents isalreadyanjntegrqlpartoftheSSESdesignandlicensing bases.IftheRBCCWand/orRBCWweretoremainintactduringadesignbasisaccidentandundergoathermally inducedpressureincrease, theconditions requiredtocausetheoverpressurization donotcreateacredibleleakagepathforthetransmission offissionproductsfromtheprimarytosecondary containment.

Inboardisolation valvesareinthedrywell.Therefore, apipingfailureinthedrywellwillnotresultinarelease.Whilenocorrective actionsarerequiredtoresolvethepotential foroverpressurization ofRBCWandRBCCWclosedlooppipinginsidecontainment, thepotential foroverpressurization,of thedrywellfloordrainsumppumpdischarge pipingispossibleandisthesubjectofthisrisk-informed submittal becausebothcontainment isolation valvesarelocatedoutsidetheprimarycontainment.

Containment Penetration Pressurization UnderDBAConditions Inadditiontotheclosedloopsystemsreferenced above,PPBL's120-dayresponsealsoidentified thepotential forthermally inducedoverpressuriz'ation oftwelvecontainment penetrations (perunit)duringdesignbasisaccidents.

Thesepenetrations are:1)RBCCWsupplyandreturnlinestothereactorrecirculation pumps(2);2)RBCWsupplyandreturnlinestothereactorrecirculation pumpmotors(4);3)RBCWsupplyandreturnlinestothedrywellcoolers(4);.4)ResidualHeatRemoval(RHR)headsprayline(1);and5)1"Demineralized waterlinetothedrywell(1).Alloftheaffectedprimarycontainment penetrations, whicharepotentially susceptible tothismechanism duringdesignbasisaccidents, supportnon-safety-related systemfunctions.

Therefore, thispotential doesnotthreatentheavailability ofsafety-related equipment requiredfordesignbasisaccidentmitigation.

Inaddition, asdocumented inPPBL's120-dayresponseandsubsequent follow-up correspondence, thepotential foroverpressurization oftheaffectedpenetrations doesnotcreateacredibleleakagepathforthetransmission offissionproductsfromtheprimarytothesecondary containment.

Corrective actions,intheformofprocedural changes,havebeentakentoeliminate thesusceptibility ofthereferenced demineralized waterpenetration, whichisonlyusedforoutage-related maintenance activities.

However,thepotential foroverpressurization ofthereferenced RBCW,RBCCW,andRHRpenetrations isthesubjectofthisrisk-informedsubmittal.

3.2IssueResolution InPPBL's120-dayresponseandsubsequent correspondence, PPBLidentified theengineering positionthattheexistingSSEScontainment pipingBpenetration

,configurations areincompliance withtheapplicable existinglicensing anddesign

EC-RISK-1073 PAGE7bases.Thisconclusion isbasedonareviewofSSESdesign-related documents, which,included theSSESFSAR,GEandBechteldesignspecifications, aswellasourinterpretation oftheapplicable ASMECode.IITheeffective ASMECodefortheSusquehanna Unitsisthe1971EditionwithaddendathroughWinter1972.Sub-section NC/ND-3621.2 identifies theeffectsoffluidexpansion asageneraldesignconsideration, butinabroadandnondescript fashion.Forthe"faultedconditions,"

whichcorrespond tothoseincurredduringadesignbasisaccident, nospecificdesignguidanceoracceptance criteriaisprovidedforevaluating isolatedsectionsofASMEClass1,2,and3piping,whichareexposedtoanexternalheatsourcecausingthermalexpansion ofentrapped fluid.Althoughthedesignofthesubjectpenetrations andpipingisseentobeincompliance withexistinglicensing anddesignbasisrequirements, PP8Lsupported EPRIeffortsto:addressthepotential forpipingoverpressurization underdesignbasisaccidentconditions.

TheEPRIeffortsconsisted ofanalytical evaluations, aswellaslaboratory testing,whichwouldallowforananalytical disposition ofthestaffsconcernsasoriginally identified intheGenericLetter.Specifically, thisworkwasaimedatestablishing plasticstrainlimitsthatcouldbeusedintheevaluation ofthermally inducedpressurization ofisolatedsectionsofpipe.However,variousissuesregarding theuseofstrainbasedacceptance criteriaremainunresolved andthisapproachdoesnotappeartohaveuniversal acceptance.

Inaddition, furtherEPRItestingaimedatresolving theseissueshasbeenindefinitely postponed.

Therefore, theuseofstrainbasedanalytical methodologies doesnotappeartobeaviablepathtowardsPP8L'sultimateresolution toGenericLetter96-06.Inadditiontosupporting theEPRIwork,PP8Lhasconsidered theinstallation ofpressurereliefdevicesontheaffectedpenetrations tooffsettheeffectsofthermally inducedpressurization duringdesignbasisaccidents.

However,itisPP8L'spositionthattheinstallation ofsuchdevicesontheaffectedpenetrations complicates theexistingcontainment configuration, andnegatively impactsplantreliability andoperation, withoutresulting inanetimprovement innuclearsafety.Inaddition, preliminary estimates fortheengineering andimplementation ofthesemodifications wouldexceed$1,000,000 dollarsperunit,andISIandmaintenance costswouldbewellinexcessof$20,000peryear.\Inanindustry/staffworkshopheldinDecember1997inGaithersburg,

Maryland, NRCstaffandindustryrepresentatives bothidentified thatthepotential forthermally inducedoverpressurization duringdesignbasisaccidents wasnotofrisksignificance, norofsafetyconsequence, butwasrathera"licensing basisconcern."

3.2.1Identification OfLicensing BasisIssueAspreviously stated,PP8LbelievesthattheexistingSSEScontainment configuration isincompliance withallapplicable designandlicensing requirements, andthatitprovides 0I EC-RISK-1073 PAGE8anadequatemarginofnuclearsafety.Alteringthecurrentplantdesignviatheinstallation ofoverpressure reliefdeviceswouldnegatively impactplantreliability andimposeunnecessary cost,withoutresulting inanygaininnuclearsafety.Atthereferenced Gaithersburg meeting,theguidanceprovidedinCOMSAJ-97-008, whichillustrates thevinculumbetweencompliance andsafety,wasidentified asaconsideration inthestaffsintroductory remarks.Itistherefore deemedreasonable thattheuseofrisk-informed rationale beconsidered toresolvethestaffsconcernsregarding thepotential foroverpressurization ofcontainment pipingandpenetrations duringdesignbasisaccidents, asoriginally identified inGenericLetter96-06.Itistherefore theintentofthisrisk-informed assessment to:1)provideevidencethattheexistingcontainment configuration providesforanamplemarginofnuclearsafety;2)demonstrate thattheinstallation ofoverpressure reliefdeviceswillnotimprovenuclearsafety;and3)gainregulatory acceptance regarding PP&L'spositionthattheinstallation ofoverpressure reliefdevicesontheaffectedpenetrations isnotnecessary.

Theuseofarisk-informed approachmaintains theexistingnuclearsafetymargin,whileminimizing theimpactonplantoperations, testing,andreliability.

Furthermore, whilepreserving thecurrentmarginofsafety,theunnecessary burdenofman-remaccumulation duringtheinstallation andfuturemaintenance/testing ofoverpressure deviceswillbeavoided.Theregulatory acceptance ofthispositionwillallowfortheclosureofGenericLetter96-06fortheSSESUnits.3.2.2Structures, Systems,Components (SSCs)AndProcedures CoveredByTheLicensing BasisIssuePP8L'sengineering evaluation forGenericLetter96-06revealedthatatotaloftwelvepenetrations (perunit)weresusceptible tothermally inducedpressurization.

Thesusceptibility ofonepenetration, a1"demineralized waterline,hasbeeneliminated throughprocedural changes:Fortheremaining penetrations, PP8Loriginally electedtopursueresolution throughananalytical disposition.

However,thesuccessofthatapproachisquestionable withthetermination ofEPRIresearch.

Therefore, thefollowing penetrations remainpotentially susceptible tothermally inducedpressurization duringdesignbasisaccidents:

1)RBCCWsupplyandreturnlinestothereactorrecirculation pumps(penetrations X-238X-24);2)RBCWsupplyandreturnlinestothereactorrecirculation pumpmotors(penetrations X-85A,X-85B,X-86A,8X-86B);3)RBCWsupplyandreturnlinestothedrywellcoolers(penetrations X-53,X-54,X-55,&X-56);and4)RHRheadsprayline(penetration X-17).

'

EC-RISK-1073 PAGE9Inadditiontothesepenetrations, thepotential foroverpressurization ofthedrywellfloordrainqumppumpdischarge pipingduringdesignbasisaccidents couldpotentially affectitsassociated penetration (X-72B)becausebothisolation valvesarelocatedoutsideoftheprimarycontainment.

Therefore, thereareatotaloftwelvepenetrations (perunit)thatrequireresolution withrespecttothestaffsconcernsregarding overpressurization, asidentified inthegenericletter.3.2.3Supporting Information AlicableCodesAndStandards Aspreviously stated,theaffectedpenetrations weredesignedandfabricated inaccordance withtheASMECode,SectionIII,1971EditionwithAddendathroughWinter1972.Thesub-section oftheCodewhichisapplicable tooverpressurization requirements duringdesignbasisaccidents isNC/ND-3621.2.

EnineerinStudiesAndEvaluations USNRCNUREG-0933, Revision1(APrioritization ofGenericSafetyIssues),dispositions GenericIssue150(Overpressurization OfContainment Penetrations) basedonthefactthattheestimated risktothepublicwasnotsignificant.

PPBLStudyEC-059-1025, Revision0(Engineering Evaluation ofGenericLetter96-06)wasdeveloped insupportofPPBL's120-dayresponsetotheGenericLetter.Inthatstudy,SSEScontainment pipingsystems'were evaluated, andthosethatarepotentially susceptible tothermally inducedoverpressurization wereidentified.

Inaddition, therationale thatdemonstrated theOperability oftheaffectedpenetrations, inlightoftheconcernsidentified inthegenericletter,wasalsodeveloped.

4.0 ENGINEERING

ANALYSISThisSectionpresentsadescription oftheEngineering Analysisperformed toresolvetheASMEcodeinterpretation issue.Bothtraditional deterministic defenseindepthanalysisandaprobabilistic assessment arepresented.

TheASMEcodeissueconcernsoverpressure protection ofcontainment pipingandpenetrations.

Therefore, thisanalysisisfocusedonthefailureofthecontainment penetrations toprovideisolation duringdesignbasiseventsandtheimpactontheLargeEarlyReleaseFrequency (LERF)forallevents.Thetraditional deterministic evaluation ispresented first,followedbyariskanalysis.

4.1Deterministic AnalysisThefollowing considerations regarding thepotential forthermally inducedoverpressurization ofpipingsystemswereoriginally identified inPP&LstudyEC-059-1025, Rev.0,andarereiterated hereassupporting information.

EC-RISK-1073 PAGE10FactorswhichMitiatePressureRiseThereareanumberofmitigating factorswhicharelikelytolimit,orevencompletely offset,athermally inducedincreaseinpressureinisolatedsectionsofpipe.Theseinclude,butmaynotnecessarily belimitedtothefollowing:

~AirPockets/Voids/Compressibility Theexistence ofairpocketsispossible, ifnotlikely,inventlines,valvecavities, turbulent areas,andothernon-uniform pipinggeometries.

Althoughthepresenceofairpocketsorvoidsisdifficult toquantitatively demonstrate, thecompressibility ofairactsasa"buffer"andcansigniTicantly inhibittheextentofapressureincrease, andhencepipingstress.This"buffer"effectwasactuallydemonstrated intheEPRItestsinthatawatertemperature increased about20'Fbeforeanypressureincreasewasobserved(EPRITR-108812).

~PipingExpansion Thepipingitselfwillthermally expandascontainment temperatures increase.

Althoughtheextentofthethermalexpansion islimited,theassociated increaseinpipingvolumewillaidinreducingtheextentoftheoverpressure condition.

Inaddition, althoughnoplant-specific strainbasedevaluations wereperformed forSSES,itispossible, andevenlikely,thatplasticdeformation oftheaffectedpipingwouldaidinrelieving excesspressure.

~ValveLeakage(i.e.,Seat,Bonnet,Packing,Flange)Indemonstrating theOperability ofaffectedpipingsections, PP8Lhasnotcategorically creditedactualisolation valveleakageasamitigating factor.Thereasonsforthisinclude:a)"as-found" and"as-left" valveleakagevarieswitheachrefueling outage;b)LLRTstypically measureleakageintheaccidentdirection and,hence,donotalwaysverifyleakageinthedirection ofoverpressurization; c)mostoftheaffectedpenetrations areconnected toclosedlooppipingsystems,whicharealsosusceptible totheeffectsofthermally inducedpressurization; andd)mostoftheLLRTsfortheaffectedpenetrations arepneumatic tests(sincetheclosedlooppipinginside'containment isnotcreditedasacontainment barrier),

andforthesepenetrations, thetestleakageratesmaynot'bedirectlycomparable tothe"waterfilled"condition.

However,formostevents,thethermally inducedvolumetric increaseofthepipinginventory isrelatively small.Inaddition, asaresultofthe"incompressibility" ofwater,smallamountsofleakagecanacttolimit,orevencompletely offsetthermally inducedpressurization.

Hence,isolation valveleakagecouldnonetheless provideasignificant effectinmitigating theextentof,pressurization fortheaffectedsectionsofpipe.

EC-RISK-1073 PAGE11BarrierEvaluation (Applicable toRBCCW,RBCW,andRHRPenetrations)

Whilethemitigating factorsdiscussed abovemayeitherpartially ortotallyoffsetanythermally inducedpressurerise,theextentoftheseeffectsisdifficult topositively quantify.

Forthisreason,theOperability oftheaffectedpenetrations wasdemonstrated byanalternate lineofreasoning.

Thisrationale consistsofasimpleappraisal regarding theactualthreat,forthermally inducedpressurization tocreateareleasepathway(forthetransmission offissionproducts) fromtheprimarytothesecondary containment.

This"barrierfailure"approachisthemostviableindicator ofanycredibledegradation ofsafety,andtheforemostmeanstodemonstrate thatthepotential foroverpressurization willnotresultinunacceptable off-siteradiological consequences.

Anevaluation toassesstheimpactofanoverpressure inducedfailureofapenetration, coupledwithanadditional failureduetoclosedloopoverpressurization, wastherefore performed.

Inaddition, theeffectsofasingleactivefailureofeithertheinboardortheoutboardisolation valve(toclose)wereconsidered.

Inthisevaluation, thereliefofanoverpressure condition throughthesimultaneous ruptureofvalvesorpipingatmorethanonelocationoftheaffectedvolumewasnotdeemedcredible.

Thefollowing summarizes thebasicrationale andconclusions regarding theaffectedpenetrations.

Ifanaffectedcontainment penetration exhibitsapressureincreaseduringadesignbasisaccident, itisindicative thatitsisolation valvesareextremely leaktight.Intheeventthatexcessive pressurization resultedinarupture,thepressurewouldberelievedoneithertheinboardoroutboardsideofthepenetration.

Ifthefailureoccurredinsideprimary,containment, excessive leakageintosecondary containment wouldnotresultsincetheoutboardisolation valvewouldremainasabarrier.Notethatthisisthemorelikelycasesincethesubjectpenetrations haveagreaterlengthofpiping(withamorecomplexgeometry) insidecontainment, andthispipingissubjected tomoreseveretemperatures thanthepipingexternaltoprimarycontainment.

Ifapipingorvalvepackingfailureoccurredontheoutboardsideofthepenetration, areleasepathtosecondary containment couldpotentially becreatedaftermostofthewaterispushedoutofthepenetration.

However,intheeventofsuchafailure,theworstcaseleakagethroughtheaffectedpenetration wouldequaltheinboardvalveleakagethatwouldbeatmost,thepenetration's "maximumpathleakage"ifnoadditional failuresoccur.Boththe"minimumpathleakage"andthe"maximumpathleakage"forSSEScontainment penetrations arequantified pertheSSESLLRTprogram,andbotharemaintained withinadministrative andregulatory limits.Evenifeverysusceptible penetration rupturedoutsideofcontainment, thetotalresulting containment leakagewouldstillbewithinthecumulative allowable leakagerateforType"8"and"C"localleakratetests(0.6L,or190,744.7 SCCM).Therefore, underdesignbasisconditions, thepotential forthermally inducedpressurization wouldnotresultinalossofcontainment integrity.

Thatis,totalleakagewouldstillbewithinAppendixJallowable limits.

EC-RISK-1073 PAGE12Finally,itshouldbenotedthatalongitudinal rupturealongthelengthofthepenetration,

,which,couldresultincommunication betweenprimaryandsecondary containment, isnotconsidered credible.

Thisisduetothefactthatthecontainment wallispoureddirectlyaroundthepenetration piping(exceptRHR),thuspreventing thistypeoffailure.TheRHRpenetration hasaflutedhead,whichpreventslongitudinal rupturessinceitismassivecomparedtothepipe.Therefore, inallcases,itwasconcluded thatthepotential forthermally inducedpressurization ofisolatedpipingsectionswillnotresultinapathwayforthereleaseoffissionproductstosecondary containment.

SafetSstem6erationTheRBCCWandRBCWsystemsandthedrywellfloordrainsumppumpdischarge linesareallnon-safety systemsandtheoverpressurization ofassociated pipingdoesnotthreatenthefunctionofanysafety-related equipment requiredtomitigatetheconsequences ofdesignbasisaccidents.

SincetheRHRsystemwouldbeinoperation post-accident, thediffering waysinwhichtheRHRheadspraypenetration couldfailwereevaluated toassurethatcontainment integrity ismaintained, andsystemoperation wouldnotbeaffected.

Thefirstfailurepostulated wasruptureofthepenetration pipinglinebetweentheinboardandoutboard.

~isolation valves.Afailureofthistypewouldonlyresultintheleakageoffluidcontained betweenthetwoisolation valves,andwouldnotaffectthepostaccidentoperation oftheRHRsystem.Thesecondtypeoffailurethatwaspostulated fortheRHRheadspraylineisafailureoforattheoutboardisolation globevalve.Inthiscase,thepressurewouldberelievedattheoutboardisolation valve'spressuresealand/orpacking.Theconcernthenbecomesthatthevalvefailurecouldprovidealeakagepathtosecondary containment forfluidbeingcirculated bytheRHRsystem,fromprimarycontainment tosecondary containment.

However,evaluations havedetermined thattheseatingcapabilities forthisvalvewillprovidepositivesealingatRHRsystempressures foratleastfourtimesthemaximumRHRsystemoperating pressureattheheadspraypenetration.

Itis,therefore, concluded thatthepotential forthermally inducedpressurization ofthehead.spraypenetration willnotimpactRHRsystemintegrity duringpostaccidentoperation.

4.2OverviewofRiskAnalysisandConclusions Thissectionprovidesadiscussion oftheriskevaluation performed todetermine thecontribution ofthermally inducedoverpressurization failureofpipingpenetrations ontheprobability ofpenetration failure.Theincreaseinpenetration failureprobability isconservatively addedtoLERFforcomparison tothecriterion inReg.Guide1.174.Theevaluation consistsofthreeanalyses.

First,theprobability ofpenetration failuregiventhecurrentdesignisevaluated.

Second,theprobability ofpenetration failuregiventheproposedfixisevaluated.

Finally,anestimateoftheadditional forcedshutdowns fromtheproposedfixisevaluated.

Theconclusions fromtheseanalysesarethat:

EC-RISK-1073 PAGE13~thecontribution fromoverpressurization failureontheoverallpenetration failureprobability giventhecurrentdesignisinsignificant;

~theproposedfixesactuallyincreasetheprobability ofpenetration failureoverthecurrentdesign;and~theproposedfixesincreasethelikelihood ofaforcedshutdown.

Therefore, additional expenditures associated withtheproposedfixesarenotwarranted.

Eachanalysisisdiscussed below.4.2.1Methodology forEvaluating theProbability ofContainment Penetrations ThisSectiondiscusses themethodsusedtoassesstheprobability ofcontainment penetration failure.Theevaluation ofcurrentdesignsispresented firstfollowedbyadiscussion theproposedsolutiontotheproblem.4.2.1.1Evaluation ofCurrentDesignstoOverpressure FailureofContainment Penetrations Theevaluation ofthecurrentdesign'sprobability offailurefollowstheapproachinNUREG-0933.

TheanalysisintheNUREGisbaseduponthemodelthatthefollowing eventsarenecessary forcontainment penetration failure:1.Containment isolation issuccessful, P[0],2.Wateristrappedbetweenthe,inboardandoutboardisolation valves,P[1],3.Theisolation valvesareleaktight,P[2),4.Containment heatingcausesheatingandexpansion ofthewatertrappedbetweentheisolation valvesoverpressurizing thepipeuntilrupture,P[3],and5.Failureofthepenetration providesaleakpathfromtheprimarycontainment tothereactorbuilding, P[4].TheP[]associated witheacheventrepresents theprobability ofoccurrence.

Theprobability ofcontainment penetration failurefromthermally inducedoverpressurization becomes:4p=Qp[i]isOEq.1Theriskanalysisconsistsofassessing theprobability ofeachoftheseeventsoccurring foreachofthepenetrations inquestion.

Generalconsiderations areaddressed firstfollowedbyaspecificevaluation ofeachpenetiation.

EC-RISK-1073 PAGE14P[0],SuccessofContainment Isolation Thepenetrations inquestionallreceiveisolation signalsfromeitherHighDrywellPressure, orRPVlevel2(-38").Thesesignalsoccurinresponsetothefollowing initiators:

~MainSteamIsolation Valve(MSIV)closure,~LossofOffSitePower(LOOP),~LossofanAC/DCbus,LossofeitherContainment Instrument GasorInstrument Air(CIG/IA),

~LossofServiceWaterorTurbineBuildingClosedCoolingWater(SW/TBCCW),

and~ThefullspectrumofLOCAevents.Whensummedtogether, theseeventsoccurabout0.5timesperyearandcontribute, about62%ofthecoredamagefrequency (thefrequency isvariedaspartofasensitivity study).Either2MOVsor2AOVsinseriesareusedtoperformtheisolation.

Bothvalvesmustfailforfailureoftheisolation function.

Overpressurization isonlyanissueiftheisolation functionissuccessful.

Sincetheprobability ofsuccessisnearone,itisassumedthattheisolation ofthecontainment penetration issuccessful.

Anevaluation ofeachofthepenetrations follows.4.2.2SpecificEvaluation ofPenetrations Asdiscussed inSection1.2,twelvepenetrations aresusceptible tooverpressurization failure.Elevenofthesetwelvepenetrations haveasimilardesign.Theyinclude:RBCCW,RBCWandtheRHRheadspraylineandarediscussed generically inSection4.2.2.1.Thedrywellsumpdischarge pipingisconsiderably different and,therefore, isdiscussed separately inSection4.2.2.2.4.2.2.1Evaluation ofRBCCW,RBCWandtheRHRHeadSprayLineThisSectionaddresses theRBCCW,theRBCWandtheRHRheadspraylinepenetrations.

Thesepenetrations allhaveinboardcontainment isolation valvesinsidethedrywellandtheoutboardcontainment isolation valvesinthereactorbuilding.

Allofthepenetrations havethepotential tobewatersolidatthetimeofisolation.

Aschematic isprovidedbelowalongwithabriefdescription ofthepipingarrangement.

EC-RISK-1073 PAGE15Containment Wall>>6'utboard Isolation VeInboardIsolation valveFigure1TypicalContainment penetration TheRBCWandRBCCWpenetrations consistofapipewiththecontainment wallpoureddirectlyaroundthepipe.ThetwoRBCCWpenetrations are4inchesindiameter.

TherearetwosetsofRBCWpenetrations.

Onesetisusedtoprovidecoolingtothe,reactorrecirculation systempumpmotorsand'are3inchesindiameter.

Theothersetisusedtoprovidefordrywellcoolingandare8inchesindiameter.

TheRHRheadspraypipeisdesignedwithaflutedend.Thepipediameteris6inches.Thispipeisfreetoexpandandislikelytofaileithercircumferntially ataweakweld,orlongitudinally ataweakpointinthepipebetweentheisolation valves.Therefore, failurecouldoccuranywherealongthepipe.P[1]WateristrappedBetweentheInboardandOutboardIsolation ValvesTheprobability thatwateristrappedbetweentheisolation valves,P[1),isassumedtobeone.RBCWandRBCCWareclosedcoolingwatersystemsandarerequiredfornormalplantoperation.

Properoperation ofthesystemsrequiresthattheybefilledandvented.Closingtheisolation valveswillnotcauseareduction inthepipingsysteminventory.

Therefore, aprobability ofoneisassignedtoP[1]forbothRBCWandRBCCW.TheRHRsystemisnotaclosedcoolingwatersystem.TheRHRsystempipingismaintained pressurized bythecondensate transfersystemandisperiodically filledandvented.Additionally, theRPVprovidesasignificant backpressuretotheRHRpiping,albeit,throughacheckvalve.Theisolation valvesareclosedduringnormaloperation.

Therefore, itisreasonable toexpecttheRHRpenetration tohavewatertrappedbetweentheisolation valves.P[2]Isolation ValvesareLeakTightTheprobability thattheisolation valvesareleaktight,P[2],isassumedtobeone.Asdiscussed above,bothRBCWandRBCCWareclosedsystems.Leakagethroughtheoutboardisolation valvewillnotresultinpipingpressurization duetothecapacitance of I

EC-RISK-1073 PAGE16theheadtank.Leakagethroughtheinboardisolation valveintopipinginthedrywell,would.besubjecttopressurization.

However,thispipingissubjecttothesameheatingfromthedrywellenvironment.

ALOCAwillreducetheRPVbackpressure, however,theisolation valvesaretestedforleaktightness.

Therefore, itisassumedthatthepenetration valvesdonotleakandthatthepenetration remainsleaktight.P[3]Containment HeatingCausesthePenetration toRupturelitEstimating theprobability thatthecontainment willreachasustained temperature sufficient torupturerequiresanevaluation ofthepenetrations mechanical strengthandthecontainment temperature foraspectrumofaccidents.

Therupturepressureofthepenetration pipeisdifficult toestimatesince,asdescribed inNUREG-0933, therearemanyphysicalprocesses thatmitigatethepotential pressurization fromheatingthefluidinthepenetration.

Thisfactisillustrated byaneventthatoccurredattheSusquehanna plant.OnMarch18,1992,Susquehanna 2experienced anelectrical faultthatcausedall8RBCWpenetrations toisolatefor9hours(SOOR2-92-024).

AverageDrywelltemperature reached165'F.Nopenetration orpipingproblemsoccurredasaresultofthisevent.Onlyonevalveineachpenetration closed.Thisfactisnotimportant becauseallofthepipingincontainment increased intemperature andhandledthepressureincrease.

ThenormalRBCWsysteminlettemperature is50'F.Thedischarge temperature isexpectedtobe15'Fto20'Fhigherthantheinlet.Thedischarge temperature whentheisolation occurredwas68'F.WhenDrywellCoolingwasstarted9hourslater,theinitialRBCWdischarge temperature peakedat139'F.Thisindicates thatportionsofthepipinginthedrywellreachedthattemperature orhigherwithoutcausinganyproblems.

Thepipingincontainment isdesignedtoPowerPipingCodeANSIB31.1whilethepenetration pipingisdesignedasASMESectionIIIClass2piping.Thiseventprovidesindication thatthermally inducedpressurization isnotassevereascalculations withconservative assumptions suggest.Thiseventdoesnotprecludepenetration failureforhighertemperatures.

Therefore, itisassumedthatpenetration failurewilloccurifcoolingtothedrywellisnotrestored.

DrywellCooling(ES-134-001) canberestoredbyeitherrestoring drywellcoolingorinitiating drywellsprays.Restoration ofdrywellcoolingisallowedifaLOCAisnotthecauseofthecontainment isolation.

LOCAisinterpreted asanunexplained highdrywellpressureorlowRPVwaterlevel(-129").Drywellspraysareinitiated afterthesuppression chamberpressureexceeds13psig.JPenetration failureisaconcernwhenalargeradioactive sourcetermisavailable forreleaseinthedrywell.Thisimpliesacoredamageevent.Theproduction ofhydrogenduringthecoredamageprocessissufficient topressurize thecontainment wellabove13psig.Therefore, theoperatorisauthorized toinitiatethedrywellspraysforcontainment coolingwheneverthepenetration failureisanissue.Additionally, PP8LhasmodifiedtheGenericEmergency Procedure Guidelines, toallowdrywellsprays

EC-RISK-1073 PAGE17underalltemperature andpressureconditions providedtheflowisthrottled for30,secondsbeforeallowingsprayflow.Therearetwoindependent drywellsprayflowpaths.Eachpathcanbefedbysixpumpsincluding twodieselfiredpumpsforapplication underStationBlackoutconditions.

Utilization ofthesepumpsisproceduralized andpracticed onthesimulator.

Therefore, thedominantmodeofdrywellsprayfailureisfailureofthedrywellsprayvalvestoopen.Twovalvesmustopenineachpathforsuccess.Giventwopaths,thereare4combinations oftwovalvefailuresthatwillresultinfailureofthedrywellsprays.Thepointestimateforcommoncausefailureoftwovalvesisestimated tobe'.4x10withlowerandupperboundsof1.2x10and1;1x10.Sincethereare4possiblecombinations, theseestimates aremultiplied by4forapointestimateof'.8x10andlowerandupperboundof4.8x10"and4.4x10.fPt'4t-Penetration FailureCausesaLeakPathGiventhatthepenetration fails,itmustfailinamannerthatprovidesaleakpathfromtheprimarycontainment tothereactorbuilding.

Threemechanisms arepresented in'UREG-0933:

,1.Alongitudinal rupturewhoselengthexceedsthethickness ofthecontainment buildingwall,or2.Asimultaneous ruptureoftheonepenetration andfailureoftheotherpenetration's isolation valvetoclose,or3.Asimultaneous circumferential ruptureoftheinboardandoutboardisolation valves,orpenetrations.

IInadditiontothesethreemechanisms, thefollowing twoadditional leakpathsareevaluated:

4.There-establishment ofdrywellorrecirculation pumpcoolingwithapenetration failure,and5.Afailureofasingleisolation valvewithsubsequent ruptureofapenetration.

Thefirstmechanism, alongitudinal rupturewhoselengthexceedsthethickness ofthecontainment wall,resultsinasinglerupturethatprovidesaleakpathfromdrywelltothereactorbuilding.

Thisparticular mechanism isnotcrediblefortheSusquehanna penetration design.Asshow'ninFigure1,thecontainment wallisabout6feetor72inchesthick.Alongitudinal rupturewouldhavetobeatleast72inchesforthismechanism tocausealeakpath.BranchTechnical Position(BTP)MEB3-1,statesthatthelengthsofsuchrupturesareboundedby2insidepipediameters.

Thecriterion iscorroborated bytheGeneralElectricLicensing TopicalonPipeBreakcriteria(NEDO-23649).

Thepenetration diameters are3,4,6and8inches.Baseduponthisconservative designcriterion, thelongestlongitudinal tearshouldnotexceed16inches,afactorof4.5lessthanthethickness ofthecontainment wall.Therefore, theprobability

EC-RISK-1073 PAGE18ofestablishing aleakpathfromthedrywelltothereactorbuildingbasedupon,mechanism 1isnegligible.

Thesecondmechanism requiresasimultaneous failureofanisolation valveandaruptureofthepenetration.

Inthissituation, theinboardcontainment isolation valvefailsatthesametimethepenetration rupturesinthereactorbuilding, ortheoutboardcontainment isolation valvefailsandthepenetration simultaneously failsinthedrywell.Thisparticular mechanism isnotcrediblefortheSusquehanna penetration design.Thepenetrations areinsulated, whichretardsthepenetration heatupandassociated pressurization.

Boundingheattransfercalculations indicatethataminimumof6hoursisrequiredtoheatthewaterinthepenetration toahighenoughtemperature topressurize thepenetration tothematerialyieldpoint.Thestroketimeoftheisolation valvesislessthan1minuteforRBCWandRBCCW.Theisolation valveswilleitherhaveclosedorfailedopenbythetimethepenetration rupturesonoverpressure.

TheRHRvalvesareclosedduringoperation.

Therefore, theprobability ofestablishing aleakpathfromthedrywelltothereactorbuildingbaseduponmechanism 2isnegligible.

Thethirdmechanism requiresasimultaneous failureofthepenetration inboththedrywellandthereactorbuilding.

Thismechanism requirestwoweaklinksinthepenetration.

Itisincredible thattwoequivalent weaklinksexistinthesamepenetration, withonebeinginthecontainment andtheotherbeingoutsidethecontainment.

However,itisconceivable thattwoweaklinks,suchaspacking,bothfailbyleakingsufficient inventory torelievepressure.

Inthiscase,neitherpackingleakissUfficient torelievethepressurerise,buttheflowoutbothleaksis.Failureinthismannerdoesnotrepresent asignificant pathwayforradioactivity transport.

Thefluidleakingfromthepackingofthesesystemsisuncontaminated water.Furthermore, thevolumeofwaterthatmustleaktoelevatetheoverpressure condition isapercentortwoofthepenetration volume.Whilethismechanism represents acrediblefailuremode,itisinsignificant fromariskperspective.

Therefore, theprobability ofestablishing aleakpathfromthedrywelltothereactorbuildingbaseduponmechanism 3isnegligible.

Thefourthmechanism requiresaruptureofthepipinginthedrywell,anoperatoractiontore-establish drywellcoolingafterthefailure,andabreachofthesysteminthereactorbuilding.

Thebreachinthereactorbuildingcouldbetheresultofaspuriousoperation ofasafetyreliefvalve.Re-establishing drywellcoolingisauthorized bythegenericEmergency Procedure Guidelines (EPG).However,PP8L'simplementation ofthegenericEPGdoesnotpermitre-establishing drywellcooling,ifdrywellcoolingisolatedastheresultofeitheraLOCAsignal(highdrywellpressureoflowRPVwaterlevel)orcontainment radlevelsinexcessof5R/hr(NL-92-019).

Anoperatoractiontooverridetheisolation requirestheshiftsupervisor's signature.

Therefore, anoperatorerrortooverridetheisolation oneitheraLOCAsignalorasourcetermintheprimarycontainment wouldrequirethemis-diagnosis oftwooperators.

Additionally, theresultsofthiscondition aresimilartothefifthmechanism andtherefore itistreatedwiththefifthmechanism.

EC-RISK-1073 PAGE19Thefifthmechanism requiresafailureofanisolation valvetoclosewithsubsequent

,failure, ofthepenetration manyhourslater.Twopossiblefailurecombinations areconsidered:

1.Failureoftheoutboardisolation valvetocloseandruptureofthepenetration inthedrywell,and2.Fail'ureoftheinboardisolation valvetocloseandruptureofthepenetration inthereactorbuilding.

Thesetwofailurecombinations arenotcrediblefortheRHRsystemsincebothisolation valvesareclosedatthetimeoftheisolation.

Therefore, mechanism 4onlyappliestoRBCWandRBCCW.Ruptureofthepenetration isnotcredibleforthefirstfailurecombination.

Failureoftheoutboardisolation valvetocloseallowstheentireRBCWorRBCCWsysteminthereactorbuildingtomitigatetheheatupandpressurization ofthefluidinthesystem.However,failureoftheRBCWorRBCCWinboardisolation valveandruptureofthepenetration inthereactorbuildingdoesrepresent acrediblescenario.

Failureoftheinboardisolation valveallowstheentiresysteminthedrywelltocommunicate with.thepenetration.

Insteadofactingtoreducetheeffectoftheheat:up,thisfailureactuallyintensifies theloading.Themeanprobability ofavalvefailingattheSusquehanna plantwasassessed(EC-RISK-1065) tobe1.6x10withlowerandupperboundsof9.4x10and2.5x10.Thiscombination offailuresrepresents acrediblemechanism ofcreatingaleakpathfromthedrywellintothereactorbuilding.

Aleakpathwillonlyoccurifthepenetration rupturesinthereactorbuilding.

Theprobability thatthepenetration failsinthereactorbuildingisestimated byassumingthattheprobability ofruptureisproportional tothefractionofpipinginthereactorbuilding.

Thisisbaseduponthefactthatsimilarpipingisusedwithineachsystemandthatnopotential weaklinks,suchasreliefvalves,areinthesystem.Thelengthofpipeinthereactorbuildingbetweentheoutboardisolation valveandthecontainment wallrangesfromafewinchestolessthan6feet.Thelengthofsystempipinginthedrywellisontheorderof100feetormore.Therefore, theprobability thatthepiperuptureoccursinthereactorbuildingisbetween0.001and0.1.Finally,allthesystemsconsidered areclosedcoolingwatersystems(note:bothRHRvalvesareclosedandnotsubjecttothisfailuremechanism).

Therefore, eveniftheinboardisolation valvefailsandthepenetration rupturesinthereactorbuilding, theleakagepathwillbeinsignificant, unlessanadditional breachoccursinthedrywellsegmentofthesystempiping.Theprobability ofthisoccurrence isconsidered slightsincetheruptureinthereactorbuildingreducestheshockcausingthefailure.Asdiscussed inthepreviousparagraph, therearenoapparentweakpointsinthesystemsuchasreliefvalvesthatcouldopenafterthepiperuptureinthereactorbuilding.

Forthisreason,twoprobabilities arereported:

theprobability ofasmallleakthatisassessedas1.0,andtheprobability ofalargeleakpaththatisassessedtobebetween10and10.Adiscussion ofthesevaluesisprovidedbelow.

0fA EC-RISK-1073 PAGE20,Theprobability ofasmallleakaccountsfortheflowofdrywellgasesthroughequipment connections suchasvalvepackingintothevoidedsystempipingandthenintothereactorbuilding..

Giventhatthesystempipewilldrainasaresultofthepiperupture,anysmallleakinthesystemwillprovideapathfromthedrywelltothereactorbuilding.

However,thesepossibleleakpathsmustbesosmallthattheydonotpreventsystempressurization andpiperupture.Therefore, theseleakpathsmustbeverysmall.Theprobability ofanadditional largeruptureofsystempipinginthedrywellgiventheruptureinthereactorbuildingisdifficult toestimatesincethisadditional ruptureisattributed tonomechanism.

Evenifaruptureoccurs,theleakpathwillbenogreater,thanthesmallestopehing.Baseduponthemechanisms discussed above,theleakpathshouldbenogreaterthantwopipediameters.

Theprobability isestimated byassumingapassivepipefailureoccursafterthepenetration failure.Amissiontimeof1000hoursisarbitrarily chosenwhencalculating theprobabilities.

Giventheseassumptions, theprobability ofalargeruptureinthedrywellisestimated tobebetween10and10with3x10'eingthepointestimate.

Therefore, theprobability thatthepenetration failsinamannerthatwillresultinaleakpathfromthedrywelltothereactorbuildingbecomes:P[4]=PxP,bxPd~where;P=theprobability thattheinboardisolation valvefails,P,b=theprobability thatthepenetration failsinthereactorbuildin'g, Pd=theprobability thataleakpathoccursinthepipingsysteminthedrywell.P-Probability ofPenetration FailureTheprobability ofapenetration failureisestimated bycombining theaboveprobabilities.

Thepointestimates andboundswerepropagated usingaMonteCarloprocedure assumingtheuncertainty islognormal.

Theresultsofthiscalculation arepresented below.Theyrepresent theprobability ofapenetration failingastheresultofoverpressurization.

Thetotalprobability isobtainedbyincreasing theperpenetration valuebyafactorof10sincethereare11penetrations beingevaluated.

Theresultsare"roundedtothenearestorderofmagnitude giventheprecision oftheinputdata.Probability Insignificant LeakGrossLeakLowerBoundMedianMeanUpperBoundPerPenetration 10101010TotalPenetrations 10101010PerPenetration 10101010Totalpenetrations 10101010 0

iEC-RISK-1073 PAGE21hThesenumbersareverysmallwhencomparedtotheprobability offailuredueto,commpncausefailureofbothisolation valvestoclose,whichisassessedatbetween.1.2x10and1.1x10.Theseresultsarerobusttolargechangesintheinputs.Asanexample,eachoftheprobabilities thatcontribute tothepenetration failurecouldbeincreased byafactorof50andstillbelessthantheprobability ofpenetration failureduetofailureoftheisolation valvestoclose.Evaluation oftheProposedResolution totheOverpressurization IssueAsdiscussed intheIntroduction, theinstallation ofsafetyreliefvalvesisbeingproposedasamethodofresolving anyoutstanding ASMEcodecompliance issues.Thevalvesaretobeinstalled betweentheinboardandoutboardisolation valvesanddischarged totheprimarycontainment.

Theinstallation ofsafetyreliefvalvesmayreducethelikelihood ofpenetration failurefromoverpressure, however,theyalsointroduce additional failuremodesthatmustbeaddressed.

Breachofthecontainment penetration fromtheinstallation ofsafetyreliefvalveswilloccurifeither:Thesafetyvalveopensforpressurereliefduringapressurization eventandfailstoreseat,orThesafetyvalveinadvertently opens,andAfailureoccurswhichcausestheoutboardisolation valvetobeopen.Failurecouldalsooccurifthesafetyvalvefailstoopenresulting inoverpressurization failure.Thisfailureisinadditiontotheeventsthatcausetheoverpressurization failurewithoutthefix.Theprobability thatthesafetyvalvefailstoopenistypically between3x10and3x10perdemand(NUREG/CR-2728).

Thesafetyreliefvalvereducestheoverpressurization failurebymanyordersofmagnitude.

Therefore, failureofthesafetyreliefvalvetoopenisnotconsidered.

Safetyreliefvalvesaregenerally setat1.25to1.5timesthedesignpressureofthesystem.ThesystempressureforRBCWandRBCCWisontheorderof100psi.Therefore, thereliefvalveswillbesetat150psigorless.Thispressureisanorderofmagnitude lessthanthepressurethatwillcausethepipetoreachitsyieldstress.Theprobability thatavalvefailstoresetafteropeningisestimated (NUREG/CR-4550) tobe0.096withalowerboundof0.0036andanupperboundof0.36.Thefailureoftheisolation valvetoclosewasassessedaboveandis1.6x10withlowerandupperboundsof9.4x10and2.5x10.Thisinformation isusedtoestimatetheprobability ofpenetration failuregiventheinstallation ofreliefvalves.Thisparticular failurewillonlyresultinleaksthroughpacking,etc.,andistherefore considered an

EC-RISK-1073 PAGE22insignificant leak.Agrossleakwouldoccurifabreachofthepipinginthereactorbuildingweretooccurinadditiontothefailuresdiscussed above.Anumberofsafetyreliefvalveswereidentified duringreviewsofthePSIDs.Thediameters ofthesevalvesrangefrom1to3inches.Thesevalvescouldspuriously openallowingadirectpathfromthedrywelltothereactorbuilding.

Themedianprobability thatasafetyreliefvalvespuriously opensisassessedat10/hrwithanerrorfactorof3.Aspreviously discussed, amissiontimeof1000hoursisassumed.Theprobability thatthepenetration failsiscomputedastheproductoftheindependent probabilities thatthesafetyreliefvalvefailstocloseandtheoutboardisolation valvefailstoclose.Thesecomputations wereperformed forbothaninsignificant andgrossleakusingaMonteCarloprocedure andassumingthattheuncertainty islognormally distributed.

Theresultsarepresented below.Probability Insignificant LeakGrossLeakPerPenetration LowerBound6x10Totalpenetrations 6x10PerPenetration 3x10Totalpenetrations 3x10MedianMean7x102x107x102x107x102x107x102x10UpperBound6x106x105x105x10Theprobability ofpenetration failureismanyordersofmagnitude greaterthanthepresentdesign.Thisisareasonable expectation because:~Thesafetyreliefvalveisfarmorelikelytoliftduringaneventsincethereliefpressureissetwellbelowthematerialyieldstrength.

~,'ipeorpenetration failureisnotexpectedtofailattheyieldbutonlyexperience plasticdeformation.

~Failureofreliefvalvestoresetafterliftingisareasonable expectation.

Therefore, themodification proposedtoresolvetheASMEcodecompliance issueisfarmorelikelytoresultinlossofpenetration integrity thantheexistingdesign.Additional ForcedShutdowns Installation ofsafetyreliefvalveswilllikelyresultinadditional forcedshutdowns.

Safetyreliefvalvesareknowntospuriously open.Aforcedshutdownisexpectedifthereliefvalvedoesspuriously open.OpeningofareliefvalveontheRBCWsystemwillresultineitherlossofatrainofdrywellorrecirculation pumpmotorcooling.LossofRBCCWwillresultinlossofrecirculation pumpsealandmotorcooling.Eitherofthesesituations willresultinaforcedshutdowntoallowforthedrywellentryandrepair.Atypicalmediansafetyreliefvalvespuriously opening/rate is10/hrwithanerrorfactor-of3.Usingthisdata,theprobability ofaforcedshutdownpersafetyreliefvalve,overthenext20yearsoftwounitoperation, isestimated tobetween66%and99.99%'with themeanvalue 4I EC-RISK-1073 PAGE23being90%.Therefore, installation ofthesafetyreliefvalvesislikelytocauseaforced,shutdqwn.

Conclusion fortheRBCW,RBCCWandRHRCasesTheriskevaluation performed abovehasdemonstrated thatthecontribution tocontainment penetration failurefromtemperature inducedoverpressurization isverysmallwhencomparedtootherfailuremodes.Additionally, theupperboundcontribution ismuchlessthattheNRCcriterion forverysmallincremental increaseinLERF(lessthan107/yr).TheproposedfixdesignedtoresolveASMEcodecompliance issueisfarmorelikelytoresultinapenetration failurethanthecurrentdesign.Additionally, theproposedfixislikelytoresultinforcedshutdowns duringthenext20years.Baseduponthesefindings, modifications toreducethelikelihood penetration failureduetotemperature inducedoverpressurization isnotwarranted.

4.2.2.2Evaluation ofDrywellSumpLineThisSectiondealswiththedrywellsumppiping.Thispipingarrangement isdifferent fromtheother11configurations beingevaluated inthatitisnotaclosedsysteminthedrywell.Aschematic isprovidedbelowalongwithabriefdescription ofthepipingarrangement.

Containment WallDrywell3h3hHV-16108A2 HV-16108A1 LiquidRadwasteSumpPumpsFigure2-Schematic oftheDrywellSumpPipingSystemAsdepictedintheabovediagram,thepipingsystemcommunicates directlywiththedrywellatmosphere.

Therearetwosumps.Eachsumphastwopumps.Apumpinitiates whenthesumpvolumereaches75gallonsandstopswhenthesumpreachesthelowleveltrip.Thesumppumpseachdischarge throughadischarge checkvalve

~~Iil'I EC-RISK-1073 PAGE24intoa2"line.Theflowratefromeachpumpis30gpm.Theselinesfeedintoa3inchheadeywhichpenetrates theprimarycontainment wall.Containment isolation isprovidedbyHV-16108A18A2.

Thehighpointofthepipingsystemisinthethreeinchsegmentofthepipenearthepumpsandis2'-3~/4"higherthanthepipeattheoutboardisolation valve.Thepenetration isapproximately 40feetofpipeawayfromthehighpoint.Beyondtheoutboardisolation valve,thepipedropsvertically about30feettotheLiquidRadwastesystem.Evaluation oftheCurrentDesignTheconcernwiththisparticular penetration isthatwatercouldbetrappedbetweentheclosedisolation valvesandthepumpdischarge checkvalves.Ifthepenetration pipingweretofailbetweentheisolation valvesandthecontainment wallinthereactorbuilding, adirectpathfromthedrywelltothereactorbuildingwouldbeestablished.

However,theparticular designconfiguration ofthissystemmakesitdifficult tocreateanoverpressurization failureofthisparticular penetration.

First,bothisolation valvesareinthereactorbuildingandarenotsubjecttoheatingfromthedrywellatmosphere.

Second,theisolation valvescloseatleast2secondsafterapumptripallowingwatertodrainfromthehighpointinthedrywelltoliquidradwaste.

Third,watertrappedbetweentheisolation valvesiswarmerthanthereactorbuilding, sincethedrywellisnormally40to50degreeswarmerthanthereactorbuilding.

Therefore, penetration failureisnotexpectediftheequipment worksasdesigned.

Overpressurization failureofthepenetration couldoccurifthepipewerefilledfromthepumpdischarge checkvalvetoeitheroftheisolation valves.Thiscanonlyoccurifthepumpisrunningatthetimeofanisolation signaI,andfailstotripwhentheisolation valvesclose.Theoperating pumpwillfillthepipewithwaterfromthepumpdischarge checkvalvetotheisolation valve.Iftheoverpressure failureofthepipeoccursinthereactorbuilding, itwillprovideadirectpathwayfromthedrywellatmosphere tothereactorbuilding.

Therefore, thiseventisbeinganalyzedfromarisk-informed perspective.

P[1]WaterIsTrappedBetweentheInboardandOutboardIsolation ValvesAsdiscussed above,trappingwaterinamannerthatcouldresultinacontainment penetration failurerequiresfailureofthepumptotrip.Sinceeitheroftheisolation valvesmustsuccessfully closegiventheisolation signal,acommonlogicfaultcannotcausethepumpfailure.Therefore, theprobability oftrappingwaterbecomestheproductoftheprobabilities oftwoindependent events,or:P[1]=P(Pumpisoperating whenisolation signaloccurs)xP(Failure ofpumptotrip)Eachtypeofinitiator mayhaveaspecificvalueofP[1].Therefore, P[1]isevaluated fordifferent typesofinitiators.

ThesevaluesofP[1]arethensummedtogetanoverallvalueofP[1].

h EC-RISK-1073 PAGE25Theprobability thatthepumpisoperating atthetimeoftheisolation signaldepends,upontheinitiator.

Iftheinitiator isaLOCA,andassumingleakbeforebreak,itisreasonable toexpectthepumptobeoperating.

Therefore, theprobability thatthepumpisoperating atthetimeoftheinitiation signalbecomestheLOCAfrequency or0.005.Iftheinitiator isotherthanaLOCA,thenoperation ofthepumpisindependent oftheinitiating event.Theprobability thatthepumpisoperating atthetimeoftheinitiating eventisthefrequency oftheinitiating eventtimestheprobability thatthepumpisrunning.Asdiscussed intheIntroduction, thenon-LOCAisolation eventsoccurabout0.5timesperyear.Theprobability thatthepumpisoperating atthetimeoftheinitiating eventisthefractionoftimeduringtheyearthatthepumpisoperating.

Thisfractionisestimated tobeabout0.01baseduponareviewofplantdata.Theprobability thatthepumpisoperating whentheisolation occursistheproductofthesetwonumbersor0.005.Theprobability thatthepumpisoperating whentheisolation signaloccursisthesumoftheLOCAandnon-LOCAprobabilities or0.01.Thepumpcontrolelectrical schematic wasreviewedtodetermine thefailuresthatwillcausethepumptocontinuetooperategivenatripsignal.Baseduponthisreview,thepumpwillfailtotripifeitheroftwosetsofcontactsonalimitswitchfailtoopen.Failureofalimitswitchtochangestateisestimated tobe3.8x10"/demand(WASH-1400).

Therefore, thefailureofthepumptotripisassessedtobe2x(3.8x10

)=7.6x10/demand.Usingtheseprobabilities thevalueofP[1]iscomputed.

P[1]=(0.01)x(7.6x10)=7.6x10P[2]Probability thattheIsolation isLeakTightInthescenariothattrapswater,thewateristrappedbetweenacontainment boundaryvalve,andthepumpdischarge checkvalves.Thecontainment boundaryvalves,areleakratetestedandareassumedleaktight.Thecheckvalvesarenotacontainment

boundary, andareinstalled topreventbackflowthroughthepump.Furthermore, allfourcheckvalvesmustbeleaktightforoverpressurization tooccur.Thecheckvalveswereinstalled topreventbackflowthroughtheidlepumpandarenotdesignedaspressureboundaries.

Noneofthecheckvalvesareleakratetested.Therefore, theprobability thatnoneofthefourcheckvalvesleakisassessedtobenegligible.

NUREG-0933 corroborates thisassessment byspecifically excluding containment penetrations thatrelyoncheckvalvesforisolation fromGL96-06evaluation.

Therefore, thevalueofP[2]isassessedtobenegligible.

~rf EC-RISK-1073 PAGE26UsingthevalueofP[1]andP[2]inEquation1,theprobability thatthepenetration fails.asare,suitofoverpressurization isassessedtobenegligible evenifthevaluesofP[3]andP[4]areassumedtobeone.Therefore, thevaluesofP[3]&P[4]willnotbeassessed.

Evaluation oftheProposedFixTheproposedfixistoinstallareliefvalveonthethreeinchpipebetweentheinboardisolation valve,HV-16108A2, andthepumpdischarge checkvalves.Thisreliefvalvewouldbelocatedintheprimarycontainment anddischarge backtothedrywellsump.Failureofthereliefvalvetoopenwouldnotcreateanynewpathwaysbetweenthedrywellandthereactorbuilding, sincethepenetration ofinterestisopeninthedrywell.Therefore, theproposedfixdoesnotimpacttheprobability ofisolation failure.Evaluation ofAdditional ForcedShutdowns Failureofthereliefvalveopenwillresultinsomeofthewaterbeingrecirculated backtothesump.Whilethisrepresents anoperational

nuisance, additional forcedshutdowns arenotanticipated.

Conclusion ontheDrywellSumpPipingThedrywellsumppipinghasbeenidentified asacandidate foroverpressurization failure.Ariskevaluation ofthepipingsystemhasdemonstrated thatthelikelihood ofthisfailuremodeisnegligible duetosystemdesign.Therefore, modifications toreducethelikelihood ofthisfailurearenotwarranted.

6.0 IMPLEMENTATION

ANDMONITORING PROGRAMThisanalysishasdemonstrated thattheperformance ofthecurrentdesignissuperiortothedesignproposedtoresolvetheASMEcodecompliance issues.Therefore, nohardwareinstallation andmonitoring isproposedinresponsetoGL96-06.PP8Lhastakenactiontoreducethelikelihood ofpenetration failureasdiscussed intheAnalysisSectionofthissubmittal.

Theseactionsprovideimprovement forothercontainment failuremodesaswell.Specifically, PPBLhasmodifiedthegenericEmergency Procedure Guidelines to:1.Prohibitbypassing drywellcoolingisolation, iftheisolation wascausedbyhighdrywellpressureorlowRPVwaterlevel.2.Allowinitiation ofthedrywellspraysunderalltemperature andpressureconditions providedflowisthrottled for30secondspriortoallowingfullflow.Adiscussion ofeachofthesemitigating measuresfollows.

0h EC-RISK-1 073PAGE27GL96-06wasanoverriding reasonforthefirstmodification tothegenericguideline.

.TheEPGdirectstheoperatortore-establish drywellcoolingifanisolation hasoccurredasatemperature controlmeasure.Onecontainment bypassmodeidentiTied byPPBLislossofclosedcoolingwatersystemintegrity inthedrywellandtheoperatorimplementing procedures tore-establish drywellcooling.Theoperatorhasnostatusofthedrywellcoolingsystempriortore-establishing drywellcooling.Ifabreachintheclosedcoolingwaterpipinghadoccurred, thentheoperatoractiontore-establish drywellcoolingwillresultinacontainment bypass.Susqueha'nna procedures onlyallowtheoperatortore-establish drywellcoolingifaLOCAwasnotthecauseoftheisolation.

ALOCAisinterpreted tomeananunexplained highdrywellpressureorlowRPVwaterlevel.Itishighlyunlikelythatcoredamagewilloccurwithoutatleastoneoftheseconditions occurring.

Therefore, thecontainment bypassmodeassociated with.deliberately bypassing containment isolation, following aLOCAisolation, hasbeenremovedfromtheSusquehanna procedures.

Thereareanumberofissuesassociated withtheseconddeviation.

TheDrywellSprayInitiation LimitisimposedbytheEPGtopreventcontainment failurefromimplosion.

TheSusquehanna MarkIIcontainment isasteellinedconcretecontainment.

PP8Lplantspecificcalculations demonstrate thatunderthemostsevereconditions, damageislimitedtoexceeding thediaphragm liner'sdesigncriteria.

Thiscanbeavoidediftheoperatorthrottles drywellsprayflowfor30secondspriortoestablishing fullflow.The30secondsofthrottled flowallowsforasubstantial amountofvaportobeaddedtothedrywellatmosphere, thuseliminating theconcernforimplosion.

Thedrywellspraysprovideconsiderable containment coolingandremovethepotential foroverpressurization failureofthepenetrations.

Therefore, penetration failureisunlikelygivensuccessful operation ofthedrywellsprays.Thesetwomitigating measuresprovidesubstantial protection toprimarycontainment integrity forboththeoverpressurization failuremodeandotherthreatsaswell.Theseimprovements havebeenimplemented intheEOPsviaSafetyEvaluations per10CFR50.59 andaremonitored throughtheLicensedOperatorRe-qualification Program.

76.0REFERENCES

1)USNRCGenericLetter96-06,"Assurance ofEquipment Operability andContainment Integrity DuringDesign-Basis AccidentConditions,"

9/30/96.2)USNRCGenericLetter96-06,Supplement 1,11/13/97.

3)USNRCLetter,"MeetingWithNEIAndLicensees ToDiscussGenericLetter(GL)96-06,'Assurance OfEquipment Operability AndContainment Integrity DuringDesign-Basis AccidentConditions,'"

Marsh,LedyardB.,toNEI,11/22/96(Reference November1996Dallas,TXMeetingWithNEI).

SRr 4)45)EC-RISK-1073 PAGE28USNRCLetter,"Industry WorkshopOnGenericLetter(GL)96-06,'Assurance OfFquipment Operability AndContainment Integrity DuringDesign-Basis AccidentConditions,'"

Wetzel,BethA.,toNEIMeetingSponsors, 1/28/98.(Reference December1997Gaithersburg, MDMeetingwithNEI).PLA-4521, R.G;-ByramtoUSNRC,"30DayResponsetoGenericLetter96-06,"10/28/96.

6)PLA-4551, R.G.ByramtoUSNRC,"120DayResponsetoGenericLetter96-06,"1/29/97.7)8)9)10)PLA-4618, R.G.ByramtoUSNRC,"Additional Information RelatedToThe120DayGenericLetter96-06Response,"

5/9/97.PLA-4636, G.T.JonestoUSNRC,"Follow-Up Responsetothe120DayGenericLetter96-06Response,"

6/30/97.PLA-4999, R.G.ByramtoUSNRC,"'Response ForAdditional Information RelatedToGenericLetter96-06,"datedNovember9,1998.ASMECode,SectionIII,1971EditionwithAddendathruWinter1972,Subsection NC/ND-3621.2.

12)13)14)15)16)17)EPRITechnical ReportTR-108812, "Response ofIsolatedPipingtoThermally InducedOverpressurization DuringaLossofCoolantAccident(GL96-06)."NEILetter,"Response ToNRCStaffQuestions onEPRIReportTR-108812 inSupportofLicenseeResponses ToGenericLetter96-06,"Modeen,DavidJ.toWessman,RichardH.,4/30/99.USNRCMemorandum, COMSAJ-97-008;"Discussion OfSafetyAndCompliance,"

Hoyle,JohnC.toCallan,L.Joseph,8/25/97.USNRCNUREG-0933, Revision1,"APrioritization OfGenericSafetyIssues,"NewGenericIssue150,6/30/95.EC-059-1025, Rev.0,"Engineering Evaluation OfGenericLetter(GL)96-06,Equipment Operability andContainment Integrity D.B.A.Conditions,"

1/30/97.USNRCRegulatory Guide1.174,Rev.July1998,"AnApproachForUsingProbabilistic RiskAssessment InRisk-Informed Decisions OnPlant-Specific ChangesToTheLicensing Basis."NEDO-23649 Class1,8/77,Application ofPipeBreakCriteriaforMajorPipingSystemsInsideContainment fortheBWR/6218,238,8251MarkIIIProductLinePlants,GeneralElectricTopicalReport.

AJ EC-RISK-1073 PAGE29,18FC-RISK-1065, Assessment ofCommonCausefailureProbabilities usedintheSusquehanna IPE.19NUREG/CR-2728, InterimReliability Evaluation ProgramProcedures Guide,1983.20NUGER/CR-4550 page4.9-76.21WASH-1400 Tablelll-4.2.22NL-92-019 Rev.250.59SafetyEvaluation forPrimaryContainment Control-EO-000-103.

g:Qoadmin'haniiwalshUcukielkalrisk1073.doc 08/02/9910:38AM