Resolution of Generic Safety Issues: Issue 58: Containment Flooding ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
The containment flooding issue stems from a flooding event that occurred at the Indian Point 2 reactor in October 1980.424 A large quantity of water leaked from fan coolers onto the containment building floor and subsequently filled the sumps and the cavity beneath the reactor vessel. The cavity accumulated enough water to wet the bottom of the reactor vessel to a height of about nine feet. The water was supplied to the fan coolers by an open-loop system (i.e., a system that receives and discharges water without recycling or accountability; in this case the water was drawn directly from the Hudson River and discharged back into the river.
There were multiple causes of the event, but the main cause was probably a lack of knowledge by the operators that the sump pumps were inoperable. There was no way to accurately monitor the sump flow rate, which had stopped.
Safety Significance
The main concern at the time of the Indian Point Unit 2 (IP-2) event was the possibility of damage to the reactor pressure vessel from thermal stresses.423 Subsequent analyses423,426 indicated that cracking of the vessel should not occur. Another concern was that, due to the brackish water, chloride-induced cracking might occur in stainless steel conduits and instrument thimbles at the reactor vessel base. Detailed inspection showed that no damage occurred and residual chlorides were washed off to prevent future damage. There was also some concern about flooding safety-related electrical equipment, but no damaged equipment was found in the flooded region.
Other concerns recorded the following:
(1) Leak opening in an open water supply system might cause a post-LOCA release path from containment,
(2) Flood water could cause boron dilution in the core cooling water following a LOCA and contribute to a recriticality event,
(3) Leakage from fan cooler systems could reduce the post-LOCA ability to cool the containment.
Of the several concerns raised, only the following are directly related to flood effects:
(1) Thermal-induced cracking of the pressure vessel
(2) Chloride-induced cracking of the pressure vessel
(3) Failure of electrical equipment
(4) Boron dilution following a LOCA.
The other two concerns, leak openings providing a post-LOCA release path from containment and leakage-induced inoperability of the containment fan coolers after a LOCA, do not require concurrent flooding to be potentially detrimental. Thus, for the purposes of this issue analysis, only the first four concerns, those directly related to flooding, are addressed.
Possible Solution
As a result of the containment flooding incident, short- and long-term steps were established to resolve the issue. IE Bulletin 80-24 was issued on November 21, 1980, in response to the IP-2 incident. The bulletin required that all plants with open cooling water systems take a number of short-term actions to preclude IP-2 type events in the interim, before longer term generic actions could be applied. These actions are still in place pending long-term resolution of the flooding issue. Both the short- and long-term resolutions are complex because of the many different designs involved and may need to be handled on a plant-by-plant basis. Long-term solutions would be aimed at improving the systems to detect, alarm, and prevent containment flooding.
There are potential flooding problems with closed water systems within containment that are supplied with automatic makeup water (e.g., pump seal, pump cooling, control rod injection). Also, open systems that are normally closed (e.g., fire protection, cleanup, post-LOCA) are potential flooding sources.
The long-term solution is likely to be plant specific. Some of the potential solutions that have been mentioned include:
(1) Improved sump level indicators
(2) Continuous sump(s) inventory system for control room monitoring
(3) Pump totalizer indicators for control room
(4) Improved alarm systems
(5) Periodic physical surveillance by operators where practical
(6) Television surveillance systems
(7) Capacitance water alarms
(8) Periodic hydrostatic test checks for leaks to reduce flooding.
Some plants already have a variety of these systems.
The proposed solution used as a basis of analysis here consists of installing a sump flow rate monitoring system with control room readout for surveillance of the flow volume and rate out of the sump. The system is assumed to be comprised of a continuous recorder which indicates the time in which the primary sump pumps are on and off. The reactor operator would check the recorder at least once per shift to assure the pump flow cycle is repetitive. (Normally, the pumps start after the sump water level rises to a certain point, then shut off when the sump is nearly empty.) Limit controls would be established for normal minimum and maximum pump cycle times. When the time limits are exceeded in either direction, this would be indicated by a blinking light to gain an operator's attention. The operator would be able to take appropriate action based upon whether the sump flow was decreasing or increasing.
The resolution described would apply to plants with open water systems in containment and to plants whose closed water systems in containment are provided with automatic feed water makeup, except plants that already have these or better systems installed. The installation work would take place during a scheduled outage.
PRIORITY DETERMINATION
Frequency Estimate
An analysis of accident frequency by PNL64 (taking into consideration the PRAs for Indian Point and Zion),425 indicates accident frequencies that are very low because accident occurrence depends on prolonged massive service water leakage, without detection and corrective action, in combination with other events of low probability. The qualitative arguments in support of a judgment that containment flooding "is an insignificant contribution to plant risk" are stated in the Indian Point PRA389 as follows:
1. The service water pipe rupture must either occur as a result of the LOCA or occur randomly after the start of the LOCA.
2. If the service water pipe were to rupture, the individual service water lines to the containment fan cooler units can be readily isolated from outside the containment building (two MOVs in series in each of the inlet lines and two MOVs in series in each of the fan cooler outlet and fan cooler motor outlet service water lines for Unit 2, and similar manual valves for Unit 3).
3. Flow and temperature indication is available to allow rapid detection of a failed service water line.
The Zion PRA425 indicated a frequency of less than 10-8/RY for an undetected flood lasting long enough to endanger safety-related electrical equipment (i.e., over 8 hours). Taken together with a 10-2 contingent probability that the electrical equipment would fail in such a way as to induce a LOCA, this points to an accident frequency of less than 10-10/RY by this mechanism.64
For direct flood-induced breach of the primary-system pressure boundary the Zion PRA also indicates a less than l0-10/RY frequency. This is based on calculations indicating a frequency of the order of 10-8 to 10-7/RY for flood water contacting the reactor vessel and a less than 10-3 contingent probability of severe crack growth as a result.64
For a boron dilution-induced PWR accident, the PNL analysis indicates an approximately 10-11/RY frequency.64 The basis of this frequency estimate includes a 10-7 /RY frequency for a large enough flood, a 10-4 contingent probability of an independent LOCA while the containment is flooded, and an assumed contingent probability of 1 for destructive boron-dilution-induced recriticality, given flood and LOCA. Thus, the overall accident frequency may be taken as 2 x 10-10/RY.
Consequence Estimate
A 4 x 106 man-rem public dose may be taken as representative of BWR-3 and PWR release categories (see Introduction and Appendix A), in which fuel melts due to loss of core cooling and containment fails to isolate properly or fails due to overpressure. The risk reduction per reactor based on a 30-year operating life is (2 x 10-10)(4 x 106)(30) = 0.02 man-rem/reactor. This corresponds to 2 man-rem for 99 affected reactors.
Cost Estimate
PNL64 estimated the principal cost elements as follows:
| Equipment | $10,000/plant |
| Labor (engineering, installation,etc.; 14 man-weeks) | $30,000/plant |
| Operation and maintenance(3 man-weeks/plant year) | $7,000/plant-year |
These rough approximation cost elements yield an estimate of roughly $20M total industry cost for the 99 affected plants. Associated NRC costs are low in comparison (estimated at about $4M total for 99 plants).64
Value/Impact Assessment
Based on a total risk reduction of 2 man-rem, the value/impact score is given by:
Uncertainty Bounds
Analysis based on evaluation of the Indian Point containment flooding incident426 can provide an approach to estimating the accident frequency that is quite different from PNL's Zion-PRA-based approach described above. This different estimate is developed below.
The fact that the Indian Point flooding incident has occurred, after less than 1000 reactor-years of operating experience, suggests, on the face of it, a frequency of the order of 10-3/RY for a major in-containment flood. Information dissemination and other measures already taken since the Indian Point incident can reasonably be credited with reduction of that frequency by a factor of 10, to about 10-4/RY. The PNL Zion estimate of 10-8 to 10-7/RY is likely to overstate the learning benefit. On the other hand, the PNL assumption of 10-3 to 10-2 for the contingent probabilities of reactor vessel failure or LOCA induced by flooding of electrical equipment does not reflect any identified specific mechanisms for such events to be induced by the flood. The Indian Point evaluation,426 taking into account the presence of insulation and other factors, indicated the absence of jeopardy to the primary system pressure boundary due to thermal stress or chloride. Accordingly, we may reasonably assume a contingent probability for primary-system failure due to thermal stress or chloride or LOCA due to electrical equipment flooding that is less than 10-5, representing allowance for only not-specifically-identified failure mechanisms.
As for boron dilution,426 a contingent probability of 10-5 for LOCA occurring during a major in-containment flood may well be a better estimate than PNL's 8 x 10-5, which assumed a one-month susceptibility to the two concurrent failures.
Applying the above-developed factors to estimation of accident frequency yields the following results:
| For primary pressure boundary failure: | |
| Frequency 10-4 x 10-5, i.e., 10-9/RY | |
| For LOCA induced by flooding of electical equipment: | |
| Frequency 10-4 x 10-5, i.e., 10-9/RY | |
| For boron-dilution recriticality accident in PWRs: | |
| Frequency = 10-4 x 10-5 = 10-9/RY | |
Thus, the overall accident frequency as estimated by this alternative approach may be taken as of the order of 3 x 10-9/RY. This is 15 times higher than the PNL estimate. Consequently, the risk reduction and value/impact score derived from this alternative frequency estimate are also 15 times higher than the corresponding figures derived from the PNL work. This results in a risk reduction of 0.4 man-rem/reactor or 40 man-rem for 99 reactors. Therefore, consideration of this risk reduction produces a value/impact score of approximately 2 man-rem/$M.
With respect to costs, PNL has indicated uncertainty bands of about 1.5 in each direction for cost estimates on the estimating basis used.64 Absence of detailed estimates and plant-to-plant variability suggest overall uncertainty bands that are substantially wider.
Additional Considerations
Occupational exposure would be involved in backfit of plants that have operated. The backfit occupational exposure was estimated by PNL at about 4.5 man-rem/plant, or 230 man-rem for 52 backfit plants. All plants would involve increased occupational exposure for maintenance and operation. The increase was estimated by PNL64 at about 0.5 man-rem/RY. RAB estimated it at "less than 1% of the average, annual cumulative occupational exposure experienced at most BWR and PWR plants."475 The overall total occupational exposure on the basis of the PNL estimates would be about 1600 man-rem for 99 reactors.
Occupational exposure would also occur in connection with containment cleanup after a flooding event. The expected infrequency of such events limits the preventive-measures occupational exposure that could be justified by this consideration.
Licensees have economic incentives, apart from any safety considerations, to avoid containment flooding and consequent plant down time.
CONCLUSION
The low risk reduction potential and low value/impact score calculated, together with consideration of occupational exposure that would be involved and allowance for the uncertainties discussed, indicate that this issue should be DROPPED. This conclusion is pointed to by the more conservative analysis presented under "Uncertainty Bounds" as well as by the less conservative analysis based on PNL's work, summarized in the "Priority Determination" above.
The conclusion that it would be appropriate to drop further efforts on this issue is not intended to undo the cautionary actions already in place as a result of IE Bulletin 80-24.
REFERENCES
|
