Resolution of Generic Safety Issues: Issue 22: Inadvertent Boron Dilution Events (Rev. 2) ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
Many PWRs have no positive means of detecting boron dilution during cold shutdown.25 Some operations carried out during outages (e.g., steam generator decontamination) reduce the RCS volume thereby speeding up dilution. Boron dilution has taken place during such operations although, at the time this issue was identified, criticality had not occurred.26 An independent study112 of boron dilution events was performed by LANL.
Safety Significance
At the time this issue was evaluated, there had been 25 reported instances of inadvertent boron dilution during maintenance and refueling.109 Although none of these 25 events resulted in an inadvertent criticality, the safety concern was the possibility of such an event. If the boron is sufficiently diluted and the reactor core is near beginning of cycle (BOC), it is possible to bring the reactor to criticality with all of the control rods inserted into the core. The only way to shut down the core again in such a circumstance would be to re-borate the moderator, an action that could take considerable time. The reported events had occurred with sufficient frequency to raise the question as to whether, considering their possible consequences, the degree of protection was appropriate.
Possible Solution
A possible solution was to install instrumentation to detect the event and stop the dilution either automatically or, if the detection was sufficiently early, by alerting the operators. The 43 operating PWRs were affected by this issue.
PRIORITY DETERMINATION
Frequency Estimate
Boron dilution events during a shutdown or refueling had usually been caused either by human error or by failures of special, non-process equipment such as inflatable seals. Therefore, event frequencies could not be easily calculated by fault tree analysis. Moreover, because no event had yet resulted in criticality, it was not possible to simply add up the number of operating events. The fact that no inadvertent criticality had occurred in 337 PWR-years allowed the staff to estimate an upper bound to the frequency. By assuming a Poisson distribution and using a 95% confidence level, the frequency of an inadvertent criticality was, at most, 9 x 10-3 event/PWR-year.
However, an upper limit was not sufficient to gauge the significance of boron dilution events; a "best estimate" was needed. The only information available was contained in the frequency of boron dilution events that had occurred, but which did not result in criticality. Most of these events were considered "precursor" events to an actual inadvertent criticality. The severity of a precursor event was defined here in terms of the shutdown margin remaining at the end of the event, i.e., an event that was halted with 2% shutdown remaining was considered more severe than an event that was halted with 10% remaining shutdown margin.
Using the information in NUREG/CR-2798,110 a histogram showed that the number of events decreased as the severity increased. To estimate an expectation value for the number of critical events, a two-parameter exponential distribution was fitted to the data. Extrapolation of this distribution to the point of zero shutdown margin gave a value of 0.67 event in a time interval of 337 PWR-years. Thus, the frequency of an inadvertent criticality was expected to be on the order of 2 x 10-3 event/PWR-year. This calculation, although rough, produced an answer that was reasonable: with 43 PWRs operating, an inadvertent criticality was expected roughly every 11 years, if no action was taken.
However, this estimate did not take into account the effect of the neutron monitoring instrumentation. As a reactor core approaches criticality, neutron flux does not rise linearly. Instead, the reciprocal of the flux drops linearly as shutdown margin decreases. The net effect is that neutron flux rises slowly as the reactor core goes from 10% to 9% shutdown, but rises very dramatically as the shutdown margin drops below 0.5%. None of the events tabulated in NUREG/CR-2798110 came close enough to criticality for the neutron monitoring channels to trigger alarms. Thus, to realistically estimate the frequency of an event that continues in dilution to criticality, credit was taken for the neutron flux channel alarms which are usually set one-half to one decade above background.
Since the control rods are already fully inserted into the core in this event, the only actions that would prevent criticality are stopping the dilution or re-borating the moderator; both are accomplished by an operator. Thus, the credit taken for neutron flux alarms was governed by the reliance placed on the operator. It was assumed (based purely on judgment) that the operator will be able to correctly diagnose the problem and successfully prevent criticality 90% of the time. This reduced the frequency of a criticality by one order of magnitude to 2 x 10-4 event/RY. It was assumed further that roughly one-sixth of all criticality events would take place with the reactor head removed. Thus, the frequency of a radioactivity-releasing criticality event was estimated to be 3 x 10-5/RY.
Consequence Estimate
In the PWR case under consideration here, all rods are either already in the core or are disconnected from their drives. Either way, there is no scram reactivity available. Shutdown by emergency boration will take much more time than shutdown via scram. The important parameter was the peak level achieved by the core.
Once the core becomes critical, it will heat up with a positive period governed by the rate of dilution and by moderator temperature and Doppler feedback. Eventually, the coolant may boil and the peak power level will be limited by void generation in the moderator. Preliminary calculations indicated that, assuming BOC parameters (worst case), a power level of about 3% of rated power would be reached.111 (These calculations were limited in their ability to model the multi-dimensional aspects of void feedback.)
A core power of 3% of rated power was not likely to fail fuel that must withstand decay heat rates of this same order. The only likely consequence was the release of gap activity from any leak already present. Using the GALE Codes standard assumption that 0.16% of the fuel will leak, the total activity released to the coolant would be roughly 69,000 Ci; this is not enough activity to be significant unless the vessel head is removed. If the vessel head were not in place, about 10% of this activity (6,900 Ci) would escape from containment, based on analyses of dropped fuel assembly events. The total whole-body man-rem dose was obtained by using the CRAC Code64 for the particular release category, assuming a uniform population density of 340 people/square-mile (average for U.S. domestic sites) and a typical (midwest plain) meteorology. Therefore, the dose associated with the event scenario described above would be 700 man-rem.
It was assumed that the possible solution would reduce the public risk entirely. Therefore, for the 43 operating PWRs with an average remaining life of 30 years, the total public risk reduction was estimated to be (43)(3 x 10-5)(700)(30) man-rem or 27.1 man-rem.
Cost Estimate
Industry Cost: Since the reported events had a wide spectrum of causes, it was not practical to reduce the frequency of boron dilution events other than by bringing the matter to the attention of plant operations personnel and having plants upgrade their procedures (if and where appropriate). One proposal called for the installation of a microprocessor-based monitor on the source range neutron flux instrumentation. Such a monitor, if connected to a display panel such as the SPDS, could give earlier warning of loss of shutdown margin than was possible with the existing instrumentation, and thus would reduce the probability of a boron dilution event leading to criticality. The costs of such a system were developed for the NRC by INEL under Contract FIN A6452 and were as follows:
| (1) Control-Grade Instrument (Alarm only) | $ 50,000 |
| (2) Safety-Grade Instrument (Alarm plus Automatic Initiation of Emergency Boration) | $ 300,000 |
It was conservatively assumed that the least expensive hardware fix would be implemented at a cost of $50,000/plant. Therefore, the total industry cost was estimated to be $(0.05)(43)M or $2.2M.
NRC Cost: It was estimated that 2 staff-months would be required to develop a solution and 1 staff-week/plant would be needed to review its implementation at the 43 operating PWRs. This corresponded to an NRC cost of $84,000 which was negligible in comparison to the industry cost.
Total Cost: The total industry and NRC cost associated with the possible solution was estimated to be $2.2M.
Value/Impact Assessment
Based on a potential public risk reduction of 27.1 man-rem and an estimated cost of $2.2M, the value/impact score was given by:
Uncertainties
(1) The upper limit (95% confidence) on inadvertent criticality frequency without credit for neutron flux alarms was a factor of 5 over the "best" estimate. Assuming a symmetrical distribution, a factor of 5 error in the credit for the neutron flux alarms, and a factor of 3 error in the chance of the head being off the vessel, the estimated error in the frequency of radioactive release was plus or minus a factor of 8.
(2) The release was expected to be on the order of 6,900 Ci, primarily noble gases. Based on judgment, an error of a factor of 5 was estimated.
(3) The uncertainty in the costs, which were dominated by the $50,000/plant for the control-grade instrumentation, was at most a factor of 2.
CONCLUSION
Based on the low value/impact score and low public risk reduction associated with an inadvertent criticality, DST/NRR concluded that boron dilution events did not constitute a significant risk to the public and recommended that the issue be dropped from further consideration.108 However, DSI/NRR disagreed with this evaluation and obtained permission from the NRR Director to pursue the issue further.
As a result of DSI's work, it was determined that the consequences of an unmitigated boron dilution event, although undesirable, were not severe enough to warrant backfit of additional protective features at operating plants. On the recommendation of DSI, Generic Letter 85-051573 was issued to OLs informing them of this result and pointing out that the event represented a breakdown in a licensee's ability to control its plant. DSI concluded that the criteria in SRP11 Section 15.4.6 were adequate for plants undergoing license review.693 Furthermore, because offsite consequences following the event were likely to be insignificant, DSI also recommended that SRP11 Section 15.4.6 be considered for deregulation694; this recommendation was covered in Issue 104. Thus, this issue was RESOLVED and no new requirements were established.
REFERENCES
|
