Resolution of Generic Safety Issues: Issue 105: Interfacing Systems LOCA at LWRs (Rev. 4) ( NUREG-0933, Main Report with Supplements 1–34 )
Issue B-63, which was resolved and implemented as MPA B-45, required leak-testing of the check valves that isolate those low pressure systems that are connected to the RCS outside the containment. However, except for Oyster Creek and Nine Mile Point, these low pressure systems in BWRs are isolated with check valves that have actuators that are used to test the operability of the valves. This operability test was considered sufficient to assure the integrity of the pressure isolation function and leak-testing of PIVs in BWRs was not required. However, beginning in 1980, the BWR STS Section 126.96.36.199 required the leak-testing of all RCS PIVs at least once every 18 months and after any work on a valve. This STS requirement was also applied to operating plants as they submitted their IST programs for review.
BWR operating experience indicated that the isolation valves between the RCS and low pressure interfacing systems (including related test and maintenance requirements) may not adequately protect against overpressurization of low pressure systems. There were three reported failures of the boundary between the RCS and low pressure injection systems in approximately 200 BWR-years of operation.762 Two of the events (Vermont Yankee, 12/12/75, and Browns Ferry 1, 8/14/84) were the result of maintenance errors which left the testable isolation check valve in the open position. The third (Pilgrim, 9/29/83) was the result of personnel errors (improper combination of surveillance tests) and a stuck-open failure of an isolation check valve. In all three cases, there was a degradation of the PIVs due to personnel errors. None of these plants were required to leak test PIVs.
This issue, which is limited to PIVs in BWRs, is related to Issue 96 which addressed the failure of the PIVs between the RCS and the RHR system in PWRs.
Overpressurization of low pressure piping systems due to RCS boundary isolation failure could result in rupture of the low pressure piping. This, if combined with failures in the ECI and/or the DHR systems, would result in a core-melt accident with an energetic release outside the containment building causing significant offsite radiation release. The STS require leak-testing of PIVs at least after every refueling and in some cases more frequently. Therefore, this issue applies to BWRs licensed before 1980.
Operating BWRs which have RCS/RHR system interface configurations similar to Hatch Unit 2 have been identified and include: Duane Arnold, Brunswick 1 and 2, Cooper, Dresden 2 and 3, Hatch 1, Fitzpatrick, Monticello, Peach Bottom 2 and 3, Pilgrim, and Quad Cities 1 and 2.761 Browns Ferry 1 also experienced a similar isolation boundary problem. Therefore, the list of affected plants utilized in this analysis also includes BWR 3 and 4 operating plants (i.e., Millstone, Browns Ferry 1, 2 and 3, and Vermont Yankee). Therefore, the total number of potentially affected operating BWRs considered in this analysis is 20 with an average remaining life of 26 years.
For the purpose of this evaluation, it was assumed that the frequency of low pressure system overpressurization events will be reduced by instigating a more rigorous revised inspection program (follow specific test and post-maintenance procedures, conduct surveillance tests one at a time, performing leak tests after operability demonstrations or flow tests) and making minor hardware modifications such as modifications to testable check valve air supply lines to precluding interchanging the lines (different threads, different size connectors, color coding, and labeling). Major system hardware changes were not anticipated.
Resolution of the issue was assumed to result in improved surveillance, maintenance, and test procedures, and minor modifications to make the air actuation system for testable check valves foolproof.
Since this issue affected only BWRs, the Browns Ferry, Unit 1, IREP367 PRA was used in the estimation of public risk reduction.64 The general approach was to use available historical data for failure of the high pressure/low pressure isolation boundary and a probability estimate for piping failure due to overpressurization to modify the appropriate LOCA sequences from the Browns Ferry PRA. These modified appropriate (affected) LOCA sequences are then assumed to represent the current (base case) level of plant risk associated with this issue. Specifically, the event Ls (large-break LOCA from 0.3 to 4.3 ft2) from the Browns Ferry PRA was redefined as the product of the probability of failure of the high pressure/low pressure isolation boundary and the probability of failure of the low pressure piping as a result of overpressurization.
From the historical data (3 isolation boundary failures in about 200 BWR plantyears), a probability of failure of the isolation barrier of 1.5 x 10-2/RY was estimated. Analysis of the low pressure piping revealed that the hoop stress in the low pressure piping would not be expected to exceed the yield value for the piping. Thus, failure of the low pressure piping was assumed to be likely only in the presence of a significant crack in the piping. Using data available on IGSCC, estimates of the number of piping welds in the low pressure piping systems, and estimates of the distribution of depth of cracks (percent of wall) from existing pipe crack data, PNL estimated the conditional probability of an intersystem LOCA, via the pipe cracking scenario, of 10-1/event given an overpressurization of the low pressure piping. This resulted in a new estimate of Ls of 1.5 x 10-3/RY, as opposed to the value of Ls derived in the Browns Ferry PRA (3 x 10-3/RY).
In NUREG-0677,763 a probability of BWR intersystem LOCA (ISLOCA) of 6.2 x 10-4/RY was calculated; no contribution from maintenance and operator errors was included. The BWR ISLOCA frequency derived for this analysis (1.5 x 10-3/RY), which was based on previous LERs, was dominated by operator and maintenance errors and appeared to be an expected value when compared to the value derived in NUREG-0677.763 When this new value of Ls (1.5 x 10-3/RY) was inserted into the affected core-melt minimal cutsets in the Browns Ferry PRA, a base case core-melt frequency due to isolation boundary failures of 6.31 x 10-6/RY was calculated.
The effect of a core-melt accident resulting in direct releases outside containment was assumed to be equivalent to a BWR Release Category 2. When the dose conversion factor for BWR Category 2 events (7.1 x 106 man-rem/event) was multiplied by the base case core-melt frequency, a public risk of 44.7 man-rem/ RY resulted.
Implementation of the possible solution to this issue was assumed to reduce the core-melt frequency and public risk due to overpressurization and failure of low pressure systems connecting to the RCS to those values calculated from the Browns Ferry PRA, i.e., 1.22 x 10-10 event/RY and 8.66 x 10-4 man-rem/RY, respectively. Therefore, implementation of the possible solution was estimated to result in a reduction in core-melt frequency of 6.3 x 10-6/RY and a reduction of public risk of 44.7 man-rem/RY. The total public risk reduction for the 20 affected plants over their 26-year average remaining lifetime was calculated to be 2.3 x 104 man-rem.
Industry Cost: Implementation of the possible solution was estimated to require about 4 man-weeks/plant for revision of surveillance, maintenance, and test procedures, and installation of foolproof features on the testable check valve actuation system, plus about $2,500/plant for materials (connectors, tags, etc.). Thus, an implementation cost of $220,000 was estimated. Increased surveillance testing, reduction of allowable concurrent testing and improved post-maintenance inspection procedures were estimated to increase plant maintenance and surveillance efforts by 40 man-hours/RY. Thus, the present worth of the increase in plant operation and maintenance costs for the 20 affected plants over their remaining lifetime was calculated to be about $650,000. Total industry cost for resolution (and implementation) of this issue was therefore estimated to be about $875,000.
NRC Cost: It was assumed that resolution of this issue will require 5 staff-months of technical effort and technical contract support for a more precise PRA, for a total resolution cost of about $100,000. It was assumed that NRC staff review of licensee implementation of the assumed solution would require 5 staff-weeks/plant for a cost of about $230,000. Resident inspector surveillance of site actions emanating from the resolution was estimated to require 0.5 staff-week/RY for a present worth of about $325,000 over the remaining lifetime of the 20 affected BWRs. The total present worth NRC cost for this issue was thus estimated to be about $650,000.
Total Cost: The total NRC and industry cost for resolution and implementation of the possible solution was estimated to be approximately $1.5M.
Based on a potential public risk reduction of 2.3 x 104 man-rem and a total cost of $1.5M, the value/impact score was given by:
(1) The probability of ISLOCA may well be greater than that calculated above based on piping failure. Other components in low pressure systems, such as pump seals, heat exchanger tubes, thermocouple wells, etc., would also be subject to overpressure failures. Also, while not explicitly considered in calculating the estimated core-melt frequency and risk, the failure of all low pressure systems due to overpressure resulting from failure of PIVs contributes further to the risk. Although the risk from other interfaces was not calculated, the evaluation of Issue 96 showed that the risk from failures of the valves isolating the RHR system in a PWR was at least an order of magnitude less than the risk calculated for this issue. The failure of PIVs in a BWR RHR system would affect only part of the ECCS system, rather than all as in a PWR. Therefore, the risk in a BWR would be even less than in a PWR.
(2) ISLOCA releases in the auxiliary building would also be expected to present an additional common mode failure mechanism for failure of redundant safety systems located in the auxiliary building. These considerations were not included in this analysis. However, had they been included, the estimates of frequency for ISLOCA and resultant core-melt would have been greater. For this reason, the priority reached on the basis of the simplified analysis performed for this issue was conservative.
(3) A relatively small total increase in ORE (530 man-rem) was calculated due to assumed increases in surveillance and post-maintenance inspections. This calculation assumed 40 man-hours/RY for increased maintenance in a 25 millirem/hr field at the 20 affected BWRs for their remaining lifetime. Reduction in the estimated frequency of core-melt and non-core-melt intersystem LOCA which might be attained was calculated to result in a total averted ORE of 215 man-rem: 65 man-rem due to cleanup of a core-melt event and 150 man-rem due to cleanup of non-core-melt ISLOCAs. Both the increased ORE and the averted operator exposure were insignificant in comparison to the calculated public risk reduction of 2.3 x 104 man-rem and did not alter the priority indicated by the value/impact assessment.
(4) At an estimated industry cleanup and replacement power cost of $1.65 Billion for a core-melt accident and $720M for a successfully-mitigated LOCA, the frequency reduction of core-melt and non-core-melt ISLOCA estimated for resolution of this issue would result in an averted accident cost savings with a present worth of about $2.7M. This exceeded the total expected NRC and industry cost and supported resolution of the issue.
This issue was given a high priority ranking (See Appendix C) and resolution was pursued. In resolving the issue, the staff conducted analyses of units representative of all NSSS vendors and considered: (1) human errors, both as initiators and during recovery operations; (2) component fragilities, to determine likely low pressure system break locations; and (3) the post-ISLOCA auxiliary building environment, to determine the survivability of recovery equipment. These analyses were documented in NUREG/CR-5604,1494 NUREG/CR-5744,1495 NUREG/CR-5745,1496 NUREG/CR-5603,1497 NUREG/CR-5862,1498 and NUREG/CR-5928.1499 It was concluded that the units studied posed little risk from ISLOCA.
In addition to the above analyses, previous PWR ISLOCA studies1500 were reexamined with data updated to include the seven years of operating experience that had accrued since the initial analyses were undertaken. None of the studies supported generic requirements for PWRs, whether on absolute risk reduction or cost-beneficial bases.1501 The study1499 of ISLOCA at a BWR confirmed past PRA studies which generally indicated little risk contribution from ISLOCA sequences.
The staff found that ISLOCAs at PWRs were plant-specific in nature; however, the ongoing IPE program1222 includes licensee analysis of ISLOCA sequences. With respect to future applicants, a draft SRP11 Section covering design review of systems interfacing with the RCS in ALWRs was provided1503 to NRR for information and use as appropriate. Supplement 1 to Information Notice 92-361502 was issued to share insights from the ISLOCA program and to inform licensees of the availability of material useful for IPE ISLOCA analyses not yet completed, or as a check on analyses already completed. Thus, this issue was RESOLVED and no new requirements were established.1504 Consideration of a license renewal period of 20 years for the affected plants would not change the resolution.1501,1564