Resolution of Generic Safety Issues: Issue 185: Control of Recriticality Following Small-Break LOCAs in PWRs ( NUREG-0933, Main Report with Supplements 1–34 )
This issue was identified1730 following an NRR request for reconsideration of the safety priority ranking (DROP) of GSI-22, "Inadvertent Boron Dilution Events," based on new information on high burn-up fuel and new calculations provided by the B&W Owners' Group (B&WOG). Reactivity insertion event tests indicated that high burn-up fuel may be more susceptible to reactivity events than previously expected, and fuel failure may occur at fuel enthalpy values that were previously judged acceptable. In addition, B&WOG calculations predicted prompt criticality with significant heat generation under conditions that may result from small-break (SB) LOCAs. NRR believed that there is no regulatory guidance applicable to this issue.
NRR had previously reviewed studies of deborated water formation during SBLOCAs in PWRs and concluded that: (1) recovery of natural circulation was unlikely to lead to core damage from reactivity transients; and (2) starting or "bumping" of RCPs could lead to a large reactivity transient. However, recent B&WOG calculations predict prompt criticality from natural circulation restart with an accompanying significant heat generation, which raised serious questions about potential reactivity events.
NRR was informed in June 1995 that, if a B&W-designed NSSS spends some time in a boiling/condensing mode following an SBLOCA, a substantial amount of deborated water may accumulate in the RCP suction piping.1728 Analysis showed that RCP restart would pump the deborated water into the core and might cause a criticality. In July 1995, the scope of the issue was expanded to include: (1) deborated water in the steam generators, cold legs, reactor vessel downcomer, and reactor vessel lower plenum; (2) restart of natural circulation as a mechanism for causing deborated water to flow into the core, and possibly result in criticality; and (3) the potential for prompt criticality.1728 In late 1996, Framatome Technologies, Inc. (FTI) developed guidance to restrict RCP restart to prevent potential fuel damage.1728
In June 1998, the B&WOG prepared a progress report which reiterated that, with conservative assumptions, displacement of deborated water had the potential to cause a prompt-critical condition due to insertion of several dollars of excess reactivity.1729 In this report the B&WOG concluded that this was an operational issue, not a safety concern, and that potential plant consequences under 10 CFR 50.46 assumptions need not be determined. The June 1998 report was not sufficient to assess the work that had been completed and NRR did not concur with the B&WOG conclusions.
On September 11, 1998, the B&WOG reported new calculation results, provided PRA values to clarify the significance of the safety concern, committed to provide an in-depth investigation to substantiate the September 11, 1998, results, and stated that three utilities had responded to the FTI recommendations regarding RCP restart and two others were in the process of responding.1728
Although the original request from NRR was for reopening Issue 22, "Inadvertent Boron Dilution Events," the scope of Issue 22 covered inadvertent boron dilution events when the reactor was in shutdown or refueling modes, a completely different scenario with different conditions, causes, and potential fixes. Thus, Issue 185 was initiated to address this new scenario.
Some SBLOCAs in PWRs involve steam generation in the core and condensation in the steam generators, causing deborated water to accumulate in part of the RCS. Restart of RCS circulation may cause a deboration event by moving this deborated water into the core. The problem is perceived to be greater in most NSSS designed by B&W than in the W and CE designs because the B&W lowered-loop geometry may favor the accumulation of more deborated water.
Although the B&WOG calculated that the restart of natural circulation following some SBLOCAs may result in prompt criticality with deposition of significant energy in the fuel, similar information has not been provided for operating W- and CE-designed NSSS, although W representatives have written that RCP restart with a large quantity of deborated water must be prevented.
Potential core damage associated with RCP restart was not addressed in the B&WOG PRA and ideally would be included, since operator error may lead to inappropriate RCP restart and there are uncertainties associated with the analysis underlying restart guidance. Consequently, NRR did not concur with the B&WOG conclusion that there is no regulatory concern associated with potential recriticality due to restart of natural circulation. Although this analysis focused on B&W reactors, the generic issue was applicable to all PWRs.
Because of the potential consequences of an inappropriate RCP start, the B&WOG advised licensees with B&W-designed NSSS to restrict RCP restart following SBLOCAs until the deborated water has been adequately mixed with borated water. This industry voluntary action could be included in regulatory guidance to be issued to all plants.
At the time of the evaluation of this issue, RES was supporting a test program at the University of Maryland thermal-hydraulic test facility that represented the B&W NSSS configuration. Test data had been obtained for restart of RCPs and of natural circulation, but applicability to the issue of deborated water had not been established. (When confronted with a similar problem with the CE System 80+, the planned boron concentration in the refueling water storage tank was increased to ensure non-criticality.)
In the request for prioritization of this issue,1730 NRR stated that "The fuel damage probability indicates that a significant safety problem is unlikely. Further, we judge that a backfit would not be cost-beneficial and would not be justified under 10 CFR 50.109. Nonetheless, modeling uncertainties are high and the potential consequences associated with prompt criticality are of sufficient concern that further assessment may be necessary."
The essence of the issue, as defined by NRR, was the thermal-hydraulic modeling uncertainty and the uncertainty in the potential consequences associated with prompt criticality. This analysis will therefore assess the importance of the thermal-hydraulic phenomena and the consequences of prompt criticality, i.e., the "worst" will be assumed for these two effects, namely that the boron dilution phenomenon will occur and that a prompt criticality will result in significant fuel damage, and the risk importance of the two effects, assuming the worst, will be estimated. These assumptions were appropriate for this analysis. The actual evaluation of the thermal-hydraulic phenomena and the consequences of prompt criticality was reserved for the resolution of the issue.
Description of Sequence (B&W NSSS Design): The event sequence for a B&W design was explored first, since the thermal-hydraulic phenomena were somewhat simpler. (Other PWR designs were examined in a later section.) The plant chosen for analysis was Crystal River Unit 3, a fairly typical 177-fuel assembly lowered-loop design. This plant was chosen primarily because of the ready availability of a RELAP model and considerable design information.
The event of interest begins with an "S2" small LOCA. As reactor coolant escapes, ECCS and AFW start on low pressurizer pressure. (The emergency procedures instruct the operator to trip the RCPs once successful operation of high pressure injection is verified.) The high pressure injection pumps attempt to replace the lost coolant. However, the break size is too large and the primary system pressure too high for the HPI pumps to maintain inventory, and the coolant level in the pressurizer drops. Eventually, the pressurizer empties and steam spaces form at the tops of the hot leg pipes, just above the steam generators, because these locations are the highest points in the system (see Figure 1, taken from NUREG/CR-56401759). When the level drops to the point where there is no longer a liquid pathway to the top of the steam generators, natural circulation ceases and the coolant in the reactor core region heats up and begins to boil, keeping system pressure high. The coolant level continues to drop and the upper portion of the steam generator tubes fill with steam.
The AFW systems in B&W plants spray feedwater into the upper portion of the steam generators. As the primary level drops further, more and more cool steam generator tube surface is exposed to the steam in the primary system, condensing it back into liquid. Eventually, as more and more steam generator tube surface is exposed to the vapor phase, the heat removal from condensation matches the heat generation in the core.
An equilibrium condition would be achieved, with the coolant boiling in the core and condensing in the steam generators, if it were not for the continued loss of coolant through the "S2" break. As level drops further, and still more cool steam generator tube surface is exposed to the vapor phase, primary pressure drops. (The heat generation rate in the core is also slowly decreasing due to radioactive decay, which contributes to the pressure drop.) As the pressure decreases, the flow rate from the high pressure coolant injection trains increases, and eventually the injection rate will equal the loss through the break.
This scenario is actually a successful operation of the ECCS which would avoid severe core damage. However, this method of core cooling, which boils coolant in the core, condenses coolant in the steam generator, and returns coolant to the core through the cold leg, also removes the soluble boron from the coolant via distillation. The condensed coolant in the steam generator lower plena and cold leg piping will have a nearly zero boron concentration, while the boron concentration in the reactor vessel core volume will increase. (There will be some injection of borated coolant at the RCP seals, but the coolant return flow will carry this boron into the reactor vessel.)
The deborated coolant region will not be troublesome as long as the system remains in the "reflux boiling" state, since deborated coolant entering the reactor will mix with the more concentrated boron solution in the core region. However, if the system is refilled to the point where liquid natural circulation restarts, or if the RCPs are started, the deborated, relatively cool coolant which has accumulated in the cold legs and steam generators will be swept into the reactor core. In a typical 177-fuel assembly B&W NSSS (including Crystal River), the tube side free water volume of each steam generator is 2030 cubic feet,1759 while the water volume of the reactor vessel is 3910 cubic feet (from the Crystal River RELAP model). Thus, the two steam generators would contain a water volume slightly larger than that of the reactor vessel. It appeared plausible that, should natural circulation be reestablished, the deborated coolant could momentarily flush the borated coolant out of the core with relatively little mixing. As was stated above, it was assumed that this happens, consistent with the "worst-case" assumption. It should be noted that there was considerable uncertainty as to the reality of this phenomenon.
After shutdown, decay heat will drop rapidly to about 2% of rated thermal power and continue to decrease. At this power level, a simple hand calculation shows that, if natural circulation is lost, the core will boil enough coolant to fill the steam generators with condensed coolant in about 25 minutes. Thus, the scenario is credible. Since there is return flow of condensed coolant from the steam generators to the reactor through the cold legs, it is unlikely that any dissolved boric acid will diffuse back into the steam generator volumes. However, it is possible that deborated coolant will gradually fill the reactor vessel downcomer and lower plenum with soluble boron concentrating (and possibly precipitating) in the core region. How much mixing will occur in the lower plenum and downcomer is a source of uncertainty that will ultimately need to be resolved but, for this analysis, it was assumed that the deborated volume in the steam generators will be sufficient to (at least momentarily) flood the core region.
If the accident should occur early in the fuel cycle, there may be sufficient excess reactivity in the core for the deborated coolant to bring the core to criticality even though all the control rods have been inserted. The possible power excursion may be sufficient to cause severe damage to the core, even though the ECCS has successfully kept the core covered with coolant. It is this power excursion that formed the basis for this issue.
Event Tree: An event tree was constructed to quantify this scenario (see Figure 2).
Small Break LOCA: The initiating event for this scenario is a LOCA of the proper size - large enough for the high pressure injection to not keep up with coolant loss at full primary system pressure, but small enough to not depressurize the system. This is an "S2" break as defined in NUREG-1150,1081 a break of ½ to 2 inches equivalent diameter, corresponding to a fluid loss rate of approximately 100 to 1500 gpm. The frequency of such breaks in NUREG-11501081 was 10-3/RY.
Number of HPI trains: Once the break occurs, high pressure injection will initiate. This particular plant has three HPI trains, two of which will start automatically, and one of which is kept "in reserve," and may be manually initiated by the operator. For this analysis, which was intended to be more generic, it was assumed that all three trains will be started shortly after the onset of coolant loss. Thus, four outcomes were possible corresponding to zero, one, two, or three trains operating. A full calculation of the probabilities of these four system states was beyond the scope of this analysis. Instead, it was assumed that the likelihood of a single train failure would be dominated by the unavailability of the pump (3.8 x 10-3 in the Crystal River SPAR-2QA model). The SPAR-2QA model was presented at the 1998 Probabilistic Safety Assessment and Management (PSAM IV) Conference in New York by S. M. Long, P. D. O'Reilly, E. G. Rodrick, and M. B. Sattison in their paper on the "Current Status of the SAPHIRE Models for ASP Evaluations." For the failure probability of the entire system, the SPAR-2QA figure for the entire system was used (1.019 x 10-4). If the unavailability of one pump is "p," the four probabilities, using the rare event approximation, are as follows:
P(0) = 1.019 x 10-4 (the SPAR-2QA number for the entire system1761)
P(1) = 3(1-p)p2 = 4.32 x 10-5
P(2) = 3(1-p)2p = 1.113 x 10-2
P(3) = 1 - [P(0) + P(1) + P(2)] = 0.9887
Two caveats should be noted. First, the number of significant figures was used for the convenience of forming differences between numbers and for the reader who wishes to reproduce the calculation, and not because the unavailabilities were known to such high accuracy; appropriate rounding will be performed at the end of the calculation. Second, the approximation used assumed that all common cause failures will fail all three trains, and also that failure other than pump failures will fail all three trains. For this reason, P(0), the probability of no trains operating, was higher than P(1).
It was assumed that the operator will shut down the RCPs with a probability of unity. This is a standard "no miracles" assumption in all PRA calculations - a failure to follow procedures is never credited as a positive outcome.
Maintain Natural Circulation: If the flow out the break is less than or equal to the injection flow from the HPI trains, the coolant level will not drop out of the pressurizer, and natural circulation will be maintained. If the HPI trains cannot keep up with the break flow, the level will drop and natural circulation will be lost. (Eventually, pressure will drop to the saturation pressure for the existing coolant temperature, and HPI flow will increase as pressure drops.)
The likelihood of a particular break size would decrease as the equivalent diameter increases, which is why large break "A" LOCAs are less likely than small break "S1" LOCAs, which in turn are less likely than very small break "S2" LOCAs. However, for this analysis, it was assumed that the likelihood of a particular break size will be constant over the S2 size interval, which was assumed to be equivalent to the "G3" coolant loss rate assessed in NUREG/CR-5750.1760 Comparing these coolant loss rates with the capability of the HPI pumps:
Loss of Natural
Thus, the likelihood of loss of natural circulation would depend on the number of HPI trains running. If all three trains of HPI fail, the probability of loss of natural circulation is unity.
Recover HPI: There is some likelihood that the operator will be able to recover a train of HPI. To estimate this probability, the operator's probability of recovery for the "SLOCA" sequences in the Crystal River SPAR-2QA model were used. This parameter, designated "SLOCA-XHE-NOREC" was 43% of non-recovery, implying a recovery probability of 57%.
Restart RCPs: For the usual small-break LOCA sequences, procedures call for the operator to trip the RCPs once it is verified that a train of HPI is operating. (The RCPs add a significant amount of energy to the primary system.) However, if the operator discovers that natural circulation has been lost and coolant is boiling in the core, the operator may elect to restart an RCP to ensure that the upper portion of the core does not rise above the liquid/vapor interface but instead is cooled by two-phase flow. There was essentially no precedent for this situation and, based purely on judgment, a probability of 10% was used for this parameter.
Recover Natural Circulation: The operator may be able to recover natural circulation, possibly by using the charging pumps (for which no credit has been given up to this point - the Crystal River plant does not have separate charging pumps, but other plants may be so equipped), by isolating the break (which might be a stuck-open valve for a LOCA in this size range), by manually starting a reserve train of HPI (in plants so equipped, such as Crystal River), or by blowing down the secondary side of a steam generator, thereby reducing the temperature and pressure in the primary, reducing flow out the break in the system, and permitting more injection flow from the HPI trains. Eventually, as decay heat slowly drops, the coolant level will rise. Again, there was no available estimate for this situation. Based on judgment, 50% was used for this parameter.
Core State: PWR cores must be designed with sufficient excess reactivity to be able to remain at power throughout the fuel cycle. At the end of the cycle, there is no soluble boron in the coolant. Conversely, a high boron concentration is present at the beginning of the cycle to compensate for the excess reactivity designed into the core. The longer the cycle, the more excess reactivity must be designed into the core, and the higher the beginning-of-cycle boron concentration. However, there is a limit to how high a boron concentration can be used, since the presence of soluble boron causes the moderator temperature coefficient (MTC) to be less negative. At the beginning of the cycle, the MTC is usually close to zero. The core designer may (and usually does) use burnable poison to further extend the cycle. The burnable poison holds reactivity "down" at the beginning of the cycle without causing the MTC to become excessively positive.
Boron concentration thus drops during the course of the cycle, very rapidly at first as xenon and samarium build up to equilibrium levels. Boron concentration as a function of burnup (commonly called "boron letdown curves") for the reactor under study is shown in Figure 3 (from the Crystal River updated FSAR). (It should be noted that the full equilibrium cycle for this plant is 310 effective full power days, even though the curve reaches zero boron concentration slightly before 300 days. It is at this point that the transient rod bank is moved out of the core, which extends core life by approximately 30 days.)
The significance for this analysis is that, at the beginning of the cycle, the reactivity worth of the soluble boron is greater than the worth of the control rods, Thus, if the soluble boron is swept out of the core and replaced with deborated coolant, the control rods do not have sufficient worth to keep the core in a subcritical state.
The boron letdown and reactivity characteristics can vary considerably from plant to plant or even from cycle to cycle, since the core designer may be aiming for a longer cycle, a flatter power distribution, maximum burnup on older fuel assemblies, or any number of other factors. Thus, although this calculation must of necessity be based on one set of core parameters, these numbers must not be taken as being universally applicable to all plants and all cycles.
This particular cycle (the equilibrium cycle described in the Crystal River updated FSAR) has a soluble boron worth of 0.01 %k/k per ppm of boron, a total rod worth of 7% (not including a stuck rod allowance of 1.6 %), and moderator and Doppler deficits of 0.2% and 1.7%, respectively. The excess reactivity was estimated and is shown in Figure 4.
As can be seen from Figure 4, there is an interval of approximately 24 days at the beginning of the cycle during which the control rod worth is insufficient to render the core subcritical. The probability of occurrence of such a criticality is just the number of days where this is possible (24) divided by the total number of days in the cycle (310), giving a probability of approximately 7.7%.
However, criticality does not automatically equate to severe core damage. In this scenario, AFW is operating, and both steam generators are capable of removing heat from the primary system. This plant is equipped with two AFW pumps, each capable of supplying 740 gpm of feedwater,1761 which would accommodate approximately 7% of the reactor's rated thermal power. With both AFW pumps operating, and subtracting 2% for the decay heat being produced in the reactor core, the steam generators should be able to accommodate fission heat up to approximately 12% of rated power. However, the fission heat will not be continuous, but will "chug" as the deborated coolant sweeps in and out of the core. Therefore, it was assumed that the steam generators can accommodate power pulses of up to double the continuous power, or approximately 25% of rated thermal power. Any power pulse above 25% was assumed to result in core damage.
If the net reactivity is greater than approximately 0.5% k/k, the core will be in a state of prompt criticality and will experience a power excursion. This was also assumed to result in severe core damage consistent with the "worst-case" assumption discussed previously.
If the deborated coolant fills the core area relatively slowly, as would be expected in the case of a refill of the system and a restart of natural circulation, there will be time for the moderator temperature coefficient to limit core power. The situation is different if the RCPs are restarted. The design forced coolant flow rate (131.3 x 106 lb/hr) corresponds to a core transit time of approximately 0.6 seconds. All four coolant pumps will not be switched on simultaneously, so the deborated coolant may take two or three seconds to flood the core. This is still significantly less than the thermal time constant of the fuel rods (roughly 6 seconds for most designs), and there will be little negative feedback provided by the moderator temperature coefficient. Moreover, there is a fairly strong tendency for the incremental axial reactivity worth to concentrate near the top in any core with significant burnup, which will accelerate the incremental reactivity insertion rate. Therefore, only Doppler feedback was assumed for event sequences involving restart of the RCPs. (The moderator temperature coefficient is only slightly negative at the beginning of the cycle, and thus the two situations are not vastly different.)
There is also a timing window effect due to the xenon transient, as is shown in Figure 5 (from the NRC training manual for PWR plants). If the core is operating at full power and has achieved an equilibrium xenon concentration, the xenon concentration will increase and insert still more negative reactivity after the reactor shuts down. For a shutdown from full power, the negative reactivity peaks about eight hours after shutdown, returns to the equilibrium value after approximately one day, and then continues to decrease, which implies that still more shutdown reactivity is needed to keep the core in a subcritical condition. It was assumed that the operators will have the plant stabilized by the time a full day has gone by, and thus the effects of the xenon "tail" were not considered here.
It should be noted that, for the first few hours after reactor trip, if natural circulation or pump restart occurs later in time, the likelihood of a recriticality is less, because of the xenon transient. The excess reactivity at the very beginning of the cycle is sufficient to overcome the xenon overshoot even at its peak, but the xenon effect might prevent a criticality if the boron dilution event occurred after an hour or so and if the event occurred a little later in the fuel cycle.
The boron curve was digitized and the excess reactivity compared with the various deficits. Of the 310 days in the fuel cycle, criticality is possible with all rods in for approximately the first 20 days. The probabilities of the various branches were as follows:
|Probability of Prompt Criticality||Probability of Overpower||Probability of Criticality, Low Power||Probability of No Criticality|
|Slow reactivity insertion||2/310
|Fast reactivity insertion||4/310
In summary, after the first four days of the fuel cycle, a reactivity excursion is no longer possible and, after 15 days, significant core damage is no longer possible. These figures can vary somewhat from plant to plant and cycle to cycle, however.
Results: The results of the event tree calculation for this B&W design were a CDF of 5.7 x 10-6 event/RY, of which 9 x 10-7 event/RY involved a reactivity excursion.
The highest frequency scenario corresponded to Sequences 8 and 9 on the event tree. The scenario is initiated by a small-break LOCA, all three HPI trains operate, but flow is not sufficient to maintain natural circulation. The RCPs are not restarted, but natural circulation re-starts after the steam generators fill with deborated coolant. The frequency of a reactivity excursion is 2 x 10-7 /RY and the frequency of severe core damage is an additional 4 x 10-6/RY.
The second highest frequency scenario, corresponding to Sequences 4 and 5, is similar, but instead of recovering natural circulation, the RCPs are restarted. The total frequency is 10-6/RY, which includes a frequency of excursion of 3 x 10-7/RY.
The third highest frequency scenario, Sequences 14 and 15, starts with a small-break LOCA, but one train of HPI fails. Natural circulation is lost, the steam generators fill with deborated coolant, and then the inoperable HPI train is recovered. The frequency of this scenario is 10-7/RY which includes a frequency of excursion of 2 x 10-8/RY.
Description of Sequence (W design): The W design differs significantly from the B&W design and the thermal-hydraulic effects can be affected. The design is shown in Figures 6 and 7 of NUREG/CR-5640.1759
First, the steam generators are of the U-tube design and these tubes are completely submerged in liquid water on the secondary side. After a small LOCA, as coolant is lost out of the break, the pressurizer will empty, pressure will drop, and voids will form in the core area.
Unlike the situation in the B&W design where the voids will naturally collect and form a vapor space at the top of the hot leg, voids will be carried into the ascending half of the U-tubes and condense back into the liquid phase. As pressure and coolant inventory continue to drop, a greater fraction of the volume above the core and in the hot legs will be in the vapor phase. It is likely that re-condensed (and deborated) coolant will first flow back down the ascending half of the U-tubes and run down on the lower surfaces of the pipes back down to the upper plenum of the reactor, where it will mix rapidly with the more concentrated, turbulently boiling coolant just above the core. As more inventory is lost, eventually a state will be reached where the primary system is at saturation pressure, coolant in the vapor phase condenses in the steam generators, and at least some of the condensed, deborated coolant collects in the descending half of the U-tubes, and the outlet plena, cold legs, pump volume, and, eventually, the lower plenum of the reactor vessel.
Second, unlike the B&W "lowered loop" design, the steam generators are located at a higher elevation than the top of the reactor core. In this design, as the coolant level in the primary system drops, it will be more difficult for deborated coolant to remain in the steam generators. In contrast to this, in the B&W lowered loop design, the coolant level can drop to the top of the active core, and there will still be some deborated coolant in the steam generators.
Third, the available volume in the steam generators is somewhat less. The total volume of coolant in the reactor vessel is 4333 cubic feet (from the RELAP model for this plant), while the primary side of a "Model F" steam generator is 962 cubic feet.1759 The total primary volume of the four steam generators is thus about 90% of the reactor volume. However, because of the U-tube design of the steam generators, it was not clear that the entire primary volume of the steam generators will fill with deborated coolant. If only the descending portion of the tubes are filled, the total liquid inventory in the steam generators will be only 45% of the reactor volume. It was not clear that, should natural circulation be restored, the core area will be flooded temporarily with deborated coolant. Conversely, the reactor downcomer and lower plenum volumes may slowly fill with unmixed, deborated coolant, as was discussed earlier, and this would be a sufficient volume to sweep the dissolved boron out of the core region. Thus, for this design, there was even more uncertainty regarding the credibility of this scenario than in the B&W example discussed previously. However, some experimental work at a test facility at the University of Maryland strongly suggested that the deborated coolant will sweep through the primary system as a "slug" with relatively little mixing. Again, assuming the "worst case" scenario, it was assumed that the accumulation of deborated coolant will occur.
Event Tree: The event tree structure is essentially unchanged, but the values of certain split fractions must be changed because of the differences in the various systems. The Seabrook plant was chosen for analysis, again because of the ready availability of design information and the existence of a RELAP model.
Small Break LOCA: As before, the NUREG-11501081 S2 frequency of 10-3/RY was used.
Probability of Maintaining Natural Circulation: Seabrook is equipped with three charging pumps, two of which are centrifugal, and one of which is a positive displacement pump.1759 In addition, the plant is equipped with a two-train high-pressure safety injection (HPSI) system. The two HPSI pumps are centrifugal pumps, but have a shutoff head close to the saturation pressure of the primary system; they cannot inject at operating pressure. Pump capacities are given in the following table:
|Pump Type||Flow at 1750 psi1759||Flow at PORV Setpoint1759|
|Charging, Centrifugal (2)||(unknown)||150 gpm (each)|
|Charging, Positive Displacement||98 gpm||98 gpm|
|HPSI, Centrifugal (2)||425 gpm (each)||zero|
The positive displacement pump was neglected because of its low capacity. The flow near saturation pressure for the two centrifugal charging pumps was not given in NUREG/CR-5640.1759 However, the SPAR-2QA model event tree for small-break LOCA has, as success criteria, either of the two HPSI pumps, or both of the two centrifugal charging pumps. Thus, the two charging pumps were treated together as if they were a third HPSI train with a combined flow of 425 gpm. Split fractions were calculated using the same assumptions as before and the results were as follows:
|Fraction of 100 to
1500 gpm "G3"
Loss of Natural
Number of HPSI "Trains:" The SPAR-2QA model's HPSI fault tree for this plant was much more tractable than that of the B&W plant. From the SPAR-2QA model for this plant, calculations of the three total system and the individual trains gave the following results:
|Probability of Failure of:||Parameters in SPAR-2QA Model1761M||Value|
|Entire HPSI System, including Charging Pumps||HPI||1.096E-5|
|Two Centrifugal Charging Pump Trains||CHV-SYS-F||8.77E-3|
|Both HPSI Trains (including Common Cause Failures)||HPI-TRAINS-F||1.624E-5|
|One HPSI Train||HPI-TRAINA-F
Again, the numbers above did not have four significant figure accuracy. The extra digits were given for the convenience of the reader who wishes to repeat the calculation. The probability of a certain number of trains operating, P(n), was then calculated as follows:
|Probability of n
|Parameters in SPAR-2QA Model1761||Value|
|P(3)||1 - P(0) - P(1) - P(2)||0.983|
Recover HPSI: Using the Seabrook SPAR-2QA model, the parameter designated "SLOCA-XHE-NOREC" indicated a 43% probability of non-recovery which implied a recovery probability of 57%.
Restart RCPs: As in the B&W case, a probability of 10% was used, based purely on judgment.
Recover Natural Circulation: As in the B&W case, the operator may be able to recover natural circulation by isolating the break, using the positive displacement charging pump, or blowing down a steam generator. Based on judgment, 50% was again used for this parameter.
Core State: The boron letdown curve for the Seabrook core (fairly typical of a W "low leakage" design, and plotted versus burnup in megawatt-days per metric ton of uranium instead of days in the cycle) is shown in Figure 8 (from the Seabrook updated FSAR). As can be seen by comparing this curve with the B&W curve shown earlier, there are some marked differences. First, it should be noted that the licensee did not include the xenon and samarium build-in at the very beginning of the cycle, and thus the curve does not begin at zero burnup. Second, the full power boron concentration actually increases slightly at the beginning of the cycle, then decreases slowly, eventually becoming linear for the latter portion of the cycle until it becomes zero at the end of the cycle (17 GWD/MTU). This is due to the burnable poison loading, which is typically higher in W cores.
This curve was digitized and combined with other information in the Seabrook FSAR to produce a plot of boron worth and control rod worth over the cycle (with the xenon buildup added at the beginning of the cycle. For this core design, it is possible to achieve criticality for about 36% of the cycle, almost five times the 7.7% figure for the B&W core.
As before, criticality does not automatically equate to severe core damage. The Seabrook plant is equipped with two AFW trains, one motor-driven and one turbine-driven, each capable of supplying 710 gpm at a secondary side pressure of 1322 psi.1759 This is somewhat less than the capacity of the Crystal River plant's AFW, and the rated thermal power of the Seabrook reactor core is actually greater than that of Crystal River. A rough calculation similar to the one done for the B&W design indicates that the AFW supply is capable of removing about 4.8% of rated thermal power per AFW train. If both trains are operating, allowing 2% of rated power for decay heat removal, and assuming the fission heat pulses with a 50% duty cycle, the AFW system can accommodate fission power of about 15% of rated - significantly less than that of the B&W design. However, unlike the B&W design, the W steam generators are likely to contain a significant inventory of secondary coolant, completely submerging the tubes on the secondary side, and are far less likely to dry out before the power pulses in the primary side die out due to boron mixing in the primary. There was no easy way to estimate this effect quantitatively. However, the probability of damage was not a very strong function of the power level assumed to be the threshold of severe fuel damage. Using the digitized curves, the following estimates were made:
|Fuel Damage Assumption||Percentage of Fuel Cycle|
|Fuel melts at criticality||36%|
|Fuel melts at AFW limit (15% power)||33%|
|Fuel melts at 50% power||25%|
|Fuel melts at 100% power||15%|
It was difficult to believe that a 100% power pulse would not result in damage. It was even more difficult to believe that a subcritical core would sustain any damage. The extreme range in damage threshold only leads to a range of 15% to 36% in the probability of severe core damage, given a boron dilution event. It was assumed, based purely on judgment, that severe core damage will result at 50% of rated power.
Regarding prompt criticality, a calculation indicated this to be possible only during the time of xenon buildup - about 1% of the fuel cycle. Once equilibrium is achieved, the burnable poison loading is such that the excess reactivity curve is relatively flat and does not rise sufficiently above the shutdown rod worth to permit a prompt criticality event. The digitized boron curve was used to calculate the probabilities of the various branches:
|Sequence||Probability of Prompt Criticality||Probability of Overpower||Probability of Criticality, Low Power||Probability of No Criticality|
|Slow reactivity insertion||1%||24%||11%||64%|
|Fast reactivity insertion||1%||24%||11%||64%|
Results: The results of the event tree calculation for this W design were a CDF of 2.2 x 10-5 event/RY, of which 10-6 event/RY involved a reactivity excursion.
As in the B&W case, the highest frequency scenario corresponded to Sequences 8 and 9 on the event tree. This scenario is initiated by a small break LOCA, all HPSI trains operate, but flow is not sufficient to maintain natural circulation. The RCPs are not restarted, but natural circulation restarts after the steam generators fill with deborated coolant. The frequency of a reactivity excursion was 7 x 10-7/RY and the frequency of severe core damage was an additional 2 x 10-5/RY.
The second highest frequency scenario, which corresponds to Sequences 4 and 5, is similar but instead of recovering natural circulation, the RCPs are restarted. The total frequency was 4 x 10-6 /RY which includes a frequency of excursion of 2 x 10-7/RY.
The third highest frequency scenario, corresponding to Sequences 14 and 15, starts with a small-break LOCA but one train of HPSI fails. Natural circulation is lost, the steam generators fill with deborated coolant and then the inoperable HPSI train is recovered. The frequency of this scenario was 10-6/RY, which included a frequency of excursion of 4 x 10-8/RY.
Discussion: The CDF results were quite similar for both designs. This was not too surprising as the same event tree was used for both, and many of the split fractions were the same. Results for 2-loop or 3-loop W designs, or a CE design, were not likely to be greatly different. The W CDFs were about a factor of four higher than that estimated for the B&W design. This appeared to be primarily due to the higher burnable poison loading in the W core which causes the core to have a potential for criticality for almost five times as long a fraction of the fuel cycle. There was, however, somewhat less uncertainty in the thermal-hydraulic effects in the B&W design.
The nature of the highest frequency scenarios suggest that a procedural fix may be appropriate for this issue. All three scenarios involve natural circulation restarting due to actions taken by the operators, restarting the RCPs, or recovering a train of high pressure injection.
To estimate consequences and risk, the standard analysis described in the Introduction to NUREG-0933 was used, i.e, the WASH-140016 Release Categories and a generic site. For the portion of the CDF associated with overpower damage to the fuel, the spectrum of consequences across the seven PWR Release Categories for the S2 LOCA in WASH-140016 was re-normalized to this issue's CDF. For the reactivity excursions, the entire event frequency was put into the PWR-1 release category, consistent with the worst case assumption discussed earlier. The results are shown in Table 3.185-1 below.
WASH-1400 Spectrum of Release Categories16
|Frequencies, Overpower Sequences||8.1e-08||9.3e-10||9.3e-09||9.3e-10||9.3e-10||6.2e-09||6.2e-08||1.6e-07|
|Excursion Event Frequency||1.0e-06||1.0e-06|
|Release Category Consequences
|Frequencies, Overpower Sequences||1.8e-08||2.1e-10||2.1e-09||2.1e-10||2.1e-10||1.4e-09||1.4e-08||3.6e-08|
|Excursion Event Frequency||??||0.0e+00|
|Release Category Consequences
The net risk associated with this issue was thus estimated to be 8.5 man-rem/RY for the B&W design, and 21 man-rem/RY for the W and CE designs. In January 2000, the net benefit of this issue was estimated as follows:
Aggregate Life (RY)
The total risk benefit was estimated to be 31,000 man-rem, excluding the effect of license renewal which would increase the number significantly.
Industry Cost: The cost to a licensee would be the cost of writing and putting in place a complex change in emergency procedures. According to Table 4.1 of NUREG/CR-4627,961 such a change would cost $3,420 to $4,350, with a point estimate of $3,900. This complex procedure may well be an above-average cost and, therefore, the upper limit of $4,350 was used. For approximately 80 PWRs, the total licensee cost was $348,000.
NRC Cost: The cost to the NRC would be significant, since considerable work would need to be done to resolve the thermal-hydraulic uncertainties, plus all of the administrative effort involved in any type of regulatory action. Based purely on judgment, a cost of $2M was assumed.
Total Cost: The total industry and NRC cost for the possible solution was estimated to be approximately $2.4M and was dominated by the cost of confirmatory thermal-hydraulic research.
Based on a potential public risk reduction of 31,000 man-rem and cost of $2.4M for a possible solution, the impact/value score was estimated to be $80/man-rem.
- Because the contemplated fix would be procedural in nature, there were no implications for increased ORE to plant workers.
- Because the issue was well into the cost-beneficial range, avoided offsite costs of a potential accident were not estimated; inclusion of these costs would not change the conclusion.
- License Renewal: Assuming a license renewal period for 79 plants, the public risk reduction would be approximately doubled, to 60,000 man-rem.
The calculations presented above were point estimates only. The Rev. 2 QA SPAR models from which many of the parameters were taken did not include uncertainty distributions. Moreover, some of the parameters were based only on judgment. Thus, a standard PRA uncertainty analysis was not feasible. Nevertheless, there were several limitations in the analysis:
- The estimates of the fraction of the fuel cycle during which the core can be brought to a critical state with all control rods inserted were based on calculations performed on FSAR data. These calculations were very primitive, core nuclear design parameters may differ for each fuel cycle, and the two estimates of this fraction, 7.7% for the B&W core and 36% for the W core, can vary. However, it is doubtful that these fractions will vary by orders of magnitude, which would be necessary to change the conclusion.
- The xenon reactivity transient was included only as a window effect. In reality, the xenon transient will become steadily more important as core burnup increases, and the "window" of time after shutdown during which it is possible to achieve criticality will steadily decrease.
- Conversely, the fact that the xenon will eventually decay away has not been included. The assumption was made that, by the time the xenon transient turned around, the operators would have taken appropriate corrective action. This "delayed criticality" effect is, in reality, still another accident scenario which should be incorporated into the resolution of this issue.
- The options available to the operator to refill the primary system (and thereby recover natural circulation) are plant-specific. In the particular case of Crystal River, it was assumed that all three HPI trains will be started to mitigate the loss of coolant. However, only two trains start automatically on an SI signal. If the operator manually starts the third train at the beginning of the accident sequence, this will be a good approximation. However, if the operator delays starting the manual train, and then starts the third train after observing that the automatically-initiated trains have either failed or are not sufficient to maintain primary coolant inventory, this late start will actually increase the likelihood of a return to criticality.
- The core power level associated with the onset of severe fuel damage was, at best, an educated guess. If there is any high burnup fuel in the core, severe damage might occur as a result of even a relatively mild reactivity excursion. Conversely, the steam generators are sized to accommodate full power operation and should be able to remove the integrated energy of a significant power pulse, limited primarily by the capacity of the AFW system and the capacity of the secondary side safety valves and ADVs.
- The actions of the operators were worthy of much more study, given the time windows involved in these scenarios and the lack of information on core reactivity. The plant operators would be faced with some confusing decisions about whether to restore failed trains, initiate forced circulation, etc.
- The thermal-hydraulic phenomena needed further investigation. Although the estimate for this study was $2M (roughly 10 staff-years), the investigation would be cost-effective even if this expense were much higher.
It should also be noted that, in its evaluation of the B&WOG PRA, NRR believed that the deborated water accumulation modeling, transport modeling, and reactivity analyses were highly approximate, incompletely understood, and subject to large uncertainties. Although the staff recognized these shortcomings, it expanded the B&WOG PRA to include approximations of additional variables and concluded that the fuel damage probability for natural circulation restart was probably between approximately 10-7/RY and 10-5/RY.1730 This was completely independent of the analysis presented here, but nevertheless yielded similar results.
The CDF change associated with the issue was estimated to be 2.2 x 10-5 event/RY and the cost/benefit ratio was approximately $80/man-rem for W and CE plants. This class of PWRs dominated primarily because of a higher burnable poison loading and, consequently, a longer fraction of the fuel cycle in which recriticality is possible. The cost/benefit ratio was particularly favorable because the cost was low and was likely to be dominated by NRC research costs. Based on the cost/benefit criteria (shown in Figure 1 of the Introduction to NUREG-0933), the issue was assigned a high priority ranking. A technical assessment was performed, and the issue was closed with no changes to existing regulations or guidance.1869