Resolution of Generic Safety Issues: Issue 82: Beyond Design Basis Accidents in Spent Fuel Pools (Rev. 3) ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
The risks of beyond design basis accidents in the spent fuel storage pool were examined in WASH-140016 (App. I, pp. I-96ff). It was concluded that these risks were orders of magnitude below those involving the reactor core. The basic reason for this was the simplicity of the spent fuel storage pool -- the coolant is at atmospheric pressure, the spent fuel is always subcritical and the heat source is low, there is no piping which can drain the pool, and there are no anticipated operational transients that could interrupt cooling or cause criticality.
The reasons for reexamination of spent fuel storage pool accidents were two-fold. First, spent fuel is being stored instead of reprocessed. This has led to the expansion of onsite fuel storage by means of high density storage racks, which results in a larger inventory of fission products in the pool, a greater heat load on the pool cooling system, and less distance between adjacent fuel assemblies. Second, some laboratory studies have provided evidence of the possibility of fire propagation between assemblies in an air-cooled environment.543,544 These two reasons, put together, provided the basis for an accident scenario which was not previously considered.
Safety Significance
A typical spent fuel storage pool with high density storage racks can hold roughly five times the fuel in the core. However, since reloads typically discharge one third of a core, much of the spent fuel stored in the pool will have had considerable decay time. This reduces the radioactive inventory somewhat. More importantly, after roughly three years of storage, spent fuel can be air-cooled, i.e., such fuel need not be submerged to prevent melting. (Submersion is still desirable for shielding and to reduce airborne activity, however.)
If the pool were to be drained of water, the discharged fuel from the previous two refuelings would still be "fresh" enough to melt under decay heat. However, the zircaloy cladding of this fuel could be ignited during the heatup.543 The resulting fire, in a pool equipped with high density storage racks, would probably spread to most or all of the fuel in the pool. The heat of combustion, in combination with decay heat, would certainly release considerable gap activity from the fuel and would probably drive "borderline aged" fuel into a molten condition. Moreover, if the fire becomes oxygen-starved (quite probable for a fire located in the bottom of a pit such as this), the hot zirconium would rob oxygen from the uranium dioxide fuel, forming a liquid mixture of metallic uranium, zirconium, oxidized zirconium, and dissolved uranium dioxide. This would cause a release of fission products from the fuel matrix quite comparable to that of molten fuel.545 In addition, although confined, spent fuel pools are almost always located outside of the primary containment. Thus, release to the atmosphere is more likely than for comparable accidents involving the reactor core.
Possible Solutions
At the time of the evaluation of this issue in December 1983, no generic solution to the potential problem had yet been identified. Several possibilities existed, however. The first possibility was to reprocess the spent fuel and thus reduce the inventory in the pool. Second, the pool could be compartmentalized by installing partitions (and individual coolant supply diffusers for each compartment) thus limiting the extent of an accident. Third, spray headers could be installed to provide cooling even when the pool is drained and not refloodable.
PRIORITY DETERMINATION
LWR spent fuel storage pools do not differ greatly. None are equipped with drains; a portable pump must be brought in when it is desired to empty the pool. The cooling systems are provided with anti-siphoning devices (check valves and/or anti-siphoning holes) so that pipe breaks in the cooling system will not drain the pool. All are seismic Category I. One difference does exist: PWR pools are generally below grade (often on bedrock) while BWR pools are considerably above grade. Thus, even a hole in the bottom of the pool will not rapidly drain a PWR pool. This priority determination, therefore, is concentrated on a BWR pool because of its (somewhat) greater vulnerability.
Frequency Estimate
BWR spent fuel can be uncovered either by extended loss of pool cooling, which results in boiloff, or by an accident which drains the pool. Both mechanisms were considered.
Typically, a BWR spent fuel storage pool has no drains. Instead, coolant is withdrawn at the surface by skimmers which conduct the water into two surge tanks. The cooling system consists of two pumps and two heat exchangers which reject heat to the RBCCW system. These are not independent trains. The suction on the surge tanks is common and flow from the heat exchangers is combined to go through one filter/demineralizer before it is returned to the spent fuel pool. Return is by means of a set of diffusers located near the bottom of the pool. The piping connected to the diffusers contains check valves or some other antisiphoning device.
Immediately after a refueling, both pumps and heat exchangers are usually needed. After a few months of decay, the heat load will diminish to the point where only one pump and heat exchanger are needed. Water makeup is normally via the condensate transfer system which is connected to one of the surge tanks.
The spent fuel pool cooling system is cross-connected to one train of the RHR system at both inlet and outlet. The primary reasons for this is to allow use of RHR for supplementary fuel pool cooling during periods when an entire reactor core is off-loaded. However, this also provides a backup means of pool cooling. In addition, since the RHR suction can be lined up to the condensate storage tank or even to river water, RHR also provides a backup means of maintaining pool water inventory.
Control and operation of the spent fuel pool cooling system and RHR cross-ties are not performed from the control room; most of the valves involved are manually operated. However, if pool cooling is lost, it will take over two days for the pool temperature to rise to boiling and at least two days more for the level to drop to the top of the fuel assemblies, even under design heat load conditions. Moreover, there are level alarms on the surge tanks and the pool itself in the control room. Thus, even though the systems are not automatic, the long time intervals involved should be sufficient to prevent problems with human confusion, etc.
WASH-140016 estimated the frequency of loss of one spent fuel pool cooling "train" to be 0.1/RY. We will assume, based on experience with other systems, that the conditional probabilities of the second "train" also failing due to a common-mode problem is 5%, and due to a random failure, 1.5%. In addition to this, the second pump and heat exchanger are in use (i.e., are not a redundant backup) about 30% of the time. Thus, the combined frequency of a pool heatup event is 3.7 x 10-2/RY.
To go from a pool heatup event to an event that threatens the fuel, several other failures must occur. First, the RHR system must fail, both as a cooling system and as a supply of makeup water. For this, we assume a conditional probability of 1.5%, based on RHR reliability in the LPCI mode.16 Second, the condensate transfer system could be used as a makeup system, either by supply to the fuel pool cooling system suction or (if the pool cooling system is isolated) by overfilling the surge tanks and causing backflow into the fuel pool. Since the condensate system is not powered by emergency power buses, it may well be put out of service by any common mode failure of the spent fuel pool cooling system. Thus, we will assume a conditional failure probability of 5% for the condensate transfer system.
Ultimately, makeup to the pool could be supplied by bringing in a fire hose (60 gpm would suffice). Although one would expect that the failure probability associated with bringing in a hose (over a period of four or more days) would be very low, it must also be remembered that working next to 385,000 gallons of potentially contaminated boiling water on top of a 10-story building is not a trivial problem. We will assume, based purely on judgment, that the conditional failure probability for this method of makeup is on the order of 5%. When these probabilities are combined, the result is a frequency of 1.4 x 10-6/RY for an accident initiated by loss of spent fuel pool cooling.
Several events could cause an accident by draining the pool. We will first examine those events which are not likely to cause gross failure of the confinement system. First, there is the possibility of a break in the cooling system (beyond the condensate transfer makeup capacity) which we estimate to happen no more often than once per thousand reactor-years (the "S2" frequency). To drain the pool, the anti-siphoning check valves must fail (conditional probability of 8%, based on a German component failure study) and there must be a failure of the pool cooling system to isolate (conditional failure probability of 1%, based purely on judgment). RHR should provide sifficient makeup, since each RHR pump can supply 10,000 gpm and normal maximum fuel pool flow is 1200 gpm. However, RHR may be inoperable, for which we assume a conditional probability of 1.5% (based on WASH-1400).16 When these figures are combined, the siphoning scenario is estimated to occur with a frequency of 1.2 x 10-8/RY.
In addition, the pool could be drained by a cask drop accident (2.5 x 10-7/RY, from WASH-1400)16 or a turbine missile (4.1 x 10-7/RY, also from WASH-1400).16 Here, the RHR might not have sufficient capacity and the time frame is not as long as the previous scenarios. Based again on judgment, it was assumed that the combined RHR conditional failure probability is 10%. This gives an accident frequency of 6.6 x 10-8/RY. If the 1.2 x 10-8/RY from the siphoning scenario is added, the total frequency for this class of accidents is 7.8 x 10-8/RY.
Finally, we come to two scenarios which could open up the pool to the atmosphere as well as drain it. First, there is the tornado missile (<5 x 10-6/RY, from WASH-1400).16 This should not simultaneously cause failure of RHR. However, RHR may be otherwise inoperable (in this shorter time frame) or have insufficient capacity. It was assumed that the combined RHR conditional failure probability is 5%. This gives an accident frequency of 2.5 x 10-7/RY. Second, a seismic event could breach the pool. The WASH-140016 estimate for this is 10-5 to 10-7/RY, depending on the site. We will use the higher figure, recognizing that this will limit the number of sites to which the analysis will apply.
After a seismic event severe enough to breach a seismic Category I spent fuel pool, the probability of RHR failure is higher than that of our previous scenarios. Moreover, the RHR might not be able to supply enough makeup. Finally, the time frame is very short, considering that manual valves must be opened and other earthquake-induced problems may be distracting plant personnel. We will assume that 90% of the time the draining rate will be slow enough to both be within the capacity of RHR makeup and also allow operator diagnosis and the necessary manual lineup of RHR to the pool. We will further assume a 90% probability of RHR remaining operable after the earthquake. This gives a total failure conditional probability of 19%.
Thus, for a site with a high seismic probability, the frequency of earthquake-induced accidents is estimated to be 1.9 x 10-6/RY. Adding the tornado-induced accident frequency to this, we get a frequency for this class of accidents of 2.2 x 10-6/RY.
Consequence Estimate
A BWR spent fuel storage pool with high density racks may contain almost 3500 fuel bundles, which is about 4½ times the inventory of the reactor core. Thus, an accident in the spent fuel pool can threaten much more fuel than a reactor accident. Compensating for this is the fact that much of the stored spent fuel has had considerable time for decay of hazardous radioactive fission products. To estimate the hazard to the public from melting of the spent fuel pool inventory, special CRAC2 runs were performed for the NRC by PNL, using a uniform population density of 340 persons per square mile, a central midwest plain meteorology, and no ingestion pathways. The calculations were performed for a spent fuel pool with a series of 1/3-core reload modules. The first module had one week decay time, the second, 18 months, the third, 3 years, and so on for a total of 13 modules. Cases were run using release fractions from the BWR-2, BWR-3 and BWR-4 release categories. This corresponds to release direct to atmosphere, release through a hole in the secondary containment, and release with the containment at design leakage and SGTS operable.
The results of the calculations and their corresponding frequencies from the previous section are given in the Table below:
| Analagous Release Category | Frequency (/RY) | Consequences (man-rem) | Product (man-rem/RY) |
|---|---|---|---|
| BWR-2 | 2.2 x 10-8 | 7.4 x 106 | 16.3 |
| BWR-3 | 7.8 x 10-8 | 6.5 x 106 | 0.5 |
| BWR-4 | 1.4 x 10-6 | 1.1 x 106 | 1.5 |
| TOTAL: | 18.3 |
It should be noted that this analysis is predicated on the assumption that the exposed elements will burn and that the fire will propagate throughout the pool. Additional research is necessary to substantiate this hypothesis. Assuming a 40-year plant life, the total risk reduction is approximately 700 man-rem/reactor.
Cost Estimate
As was discussed previously, no specific solution to the potential problem had yet been settled upon as of December 1983. However, any hardware addition probably would have had to be Seismic Category I and, thus, costs were unlikely to be less than $1M/reactor. NRC costs were estimated to be negligible compared to licensee costs.
Value/Impact Assessment
Based on an estimated risk reduction of 700 man-rem/reactor and a cost of $1M/reactor for a possible solution, the value/impact score was given by:
Other Considerations
It should be noted that a low seismic probability would drop the above estimates to about 200 man-rem/reactor and 200 man-rem/$M. This would not change the final conclusion. In any case, this analysis was based on a specific pool design which was selected in an attempt to represent both generic and worst-case situations. The number of plants actually at risk may be limited.
CONCLUSION
Based on the available information and the above calculations, this item was given a medium priority ranking. Studies performed by the staff in resolving the issue showed that, although most of the spent fuel pool risk comes from beyond design basis earthquakes, this risk is no greater than the risk from core damage accidents due to seismic events beyond the safe shutdown earthquake. The staff's technical findings were published in NUREG/CR-4982, 1157 NUREG/CR-5176, 1196 and NUREG/CR-5281. 1197 The regulatory analysis published in NUREG-1353 1198 showed that there was no cost-effective alternative which, if implemented, would result in a substantial safety improvement.
The staff concluded that reducing the risk from spent fuel pools due to events beyond the SSE would still leave a comparable risk due to core damage accidents. Because of the large inherent safety margins in the design and construction of spent fuel pools, this issue was RESOLVED and no new requirements were established.1199
REFERENCES
|
