Resolution of Generic Safety Issues: Issue 105: Interfacing Systems LOCA at LWRs (Rev. 4) ( NUREG-0933, Main Report with Supplements 1–35 )

DESCRIPTION

Historical Background

Issue B-63, which was resolved and implemented as MPA B-45, required leak-testing of the check valves that isolate those low pressure systems that are connected to the RCS outside the containment. However, except for Oyster Creek and Nine Mile Point, these low pressure systems in BWRs are isolated with check valves that have actuators that are used to test the operability of the valves. This operability test was considered sufficient to assure the integrity of the pressure isolation function and leak-testing of PIVs in BWRs was not required. However, beginning in 1980, the BWR STS Section 3.4.6.2 required the leak-testing of all RCS PIVs at least once every 18 months and after any work on a valve. This STS requirement was also applied to operating plants as they submitted their IST programs for review.

BWR operating experience indicated that the isolation valves between the RCS and low pressure interfacing systems (including related test and maintenance requirements) may not adequately protect against overpressurization of low pressure systems. There were three reported failures of the boundary between the RCS and low pressure injection systems in approximately 200 BWR-years of operation.⁷⁶² Two of the events (Vermont Yankee, 12/12/75, and Browns Ferry 1, 8/14/84) were the result of maintenance errors which left the testable isolation check valve in the open position. The third (Pilgrim, 9/29/83) was the result of personnel errors (improper combination of surveillance tests) and a stuck-open failure of an isolation check valve. In all three cases, there was a degradation of the PIVs due to personnel errors. None of these plants were required to leak test PIVs.

This issue, which is limited to PIVs in BWRs, is related to Issue 96 which addressed the failure of the PIVs between the RCS and the RHR system in PWRs.

Safety Significance

Overpressurization of low pressure piping systems due to RCS boundary isolation failure could result in rupture of the low pressure piping. This, if combined with failures in the ECI and/or the DHR systems, would result in a core-melt accident with an energetic release outside the containment building causing significant offsite radiation release. The STS require leak-testing of PIVs at least after every refueling and in some cases more frequently. Therefore, this issue applies to BWRs licensed before 1980.

Operating BWRs which have RCS/RHR system interface configurations similar to Hatch Unit 2 have been identified and include: Duane Arnold, Brunswick 1 and 2, Cooper, Dresden 2 and 3, Hatch 1, Fitzpatrick, Monticello, Peach Bottom 2 and 3, Pilgrim, and Quad Cities 1 and 2.⁷⁶¹ Browns Ferry 1 also experienced a similar isolation boundary problem. Therefore, the list of affected plants utilized in this analysis also includes BWR 3 and 4 operating plants (i.e., Millstone, Browns Ferry 1, 2 and 3, and Vermont Yankee). Therefore, the total number of potentially affected operating BWRs considered in this analysis is 20 with an average remaining life of 26 years.

Possible Solution

For the purpose of this evaluation, it was assumed that the frequency of low pressure system overpressurization events will be reduced by instigating a more rigorous revised inspection program (follow specific test and post-maintenance procedures, conduct surveillance tests one at a time, performing leak tests after operability demonstrations or flow tests) and making minor hardware modifications such as modifications to testable check valve air supply lines to precluding interchanging the lines (different threads, different size connectors, color coding, and labeling). Major system hardware changes were not anticipated.

Resolution of the issue was assumed to result in improved surveillance, maintenance, and test procedures, and minor modifications to make the air actuation system for testable check valves foolproof.

PRIORITY DETERMINATION

Frequency Estimate

Since this issue affected only BWRs, the Browns Ferry, Unit 1, IREP³⁶⁷ PRA was used in the estimation of public risk reduction.⁶⁴ The general approach was to use available historical data for failure of the high pressure/low pressure isolation boundary and a probability estimate for piping failure due to overpressurization to modify the appropriate LOCA sequences from the Browns Ferry PRA. These modified appropriate (affected) LOCA sequences are then assumed to represent the current (base case) level of plant risk associated with this issue. Specifically, the event L_s (large-break LOCA from 0.3 to 4.3 ft²) from the Browns Ferry PRA was redefined as the product of the probability of failure of the high pressure/low pressure isolation boundary and the probability of failure of the low pressure piping as a result of overpressurization.

From the historical data (3 isolation boundary failures in about 200 BWR plantyears), a probability of failure of the isolation barrier of 1.5 x 10^-2/RY was estimated. Analysis of the low pressure piping revealed that the hoop stress in the low pressure piping would not be expected to exceed the yield value for the piping. Thus, failure of the low pressure piping was assumed to be likely only in the presence of a significant crack in the piping. Using data available on IGSCC, estimates of the number of piping welds in the low pressure piping systems, and estimates of the distribution of depth of cracks (percent of wall) from existing pipe crack data, PNL estimated the conditional probability of an intersystem LOCA, via the pipe cracking scenario, of 10^-1/event given an overpressurization of the low pressure piping. This resulted in a new estimate of L_s of 1.5 x 10^-3/RY, as opposed to the value of L_s derived in the Browns Ferry PRA (3 x 10^-3/RY).

In NUREG-0677,⁷⁶³ a probability of BWR intersystem LOCA (ISLOCA) of 6.2 x 10^-4/RY was calculated; no contribution from maintenance and operator errors was included. The BWR ISLOCA frequency derived for this analysis (1.5 x 10^-3/RY), which was based on previous LERs, was dominated by operator and maintenance errors and appeared to be an expected value when compared to the value derived in NUREG-0677.⁷⁶³ When this new value of L_s (1.5 x 10^-3/RY) was inserted into the affected core-melt minimal cutsets in the Browns Ferry PRA, a base case core-melt frequency due to isolation boundary failures of 6.31 x 10^-6/RY was calculated.

Consequence Estimate

The effect of a core-melt accident resulting in direct releases outside containment was assumed to be equivalent to a BWR Release Category 2. When the dose conversion factor for BWR Category 2 events (7.1 x 10⁶ man-rem/event) was multiplied by the base case core-melt frequency, a public risk of 44.7 man-rem/ RY resulted.

Implementation of the possible solution to this issue was assumed to reduce the core-melt frequency and public risk due to overpressurization and failure of low pressure systems connecting to the RCS to those values calculated from the Browns Ferry PRA, i.e., 1.22 x 10^-10 event/RY and 8.66 x 10^-4 man-rem/RY, respectively. Therefore, implementation of the possible solution was estimated to result in a reduction in core-melt frequency of 6.3 x 10^-6/RY and a reduction of public risk of 44.7 man-rem/RY. The total public risk reduction for the 20 affected plants over their 26-year average remaining lifetime was calculated to be 2.3 x 10⁴ man-rem.

Cost Estimate

Industry Cost: Implementation of the possible solution was estimated to require about 4 man-weeks/plant for revision of surveillance, maintenance, and test procedures, and installation of foolproof features on the testable check valve actuation system, plus about $2,500/plant for materials (connectors, tags, etc.). Thus, an implementation cost of $220,000 was estimated. Increased surveillance testing, reduction of allowable concurrent testing and improved post-maintenance inspection procedures were estimated to increase plant maintenance and surveillance efforts by 40 man-hours/RY. Thus, the present worth of the increase in plant operation and maintenance costs for the 20 affected plants over their remaining lifetime was calculated to be about $650,000. Total industry cost for resolution (and implementation) of this issue was therefore estimated to be about $875,000.

NRC Cost: It was assumed that resolution of this issue will require 5 staff-months of technical effort and technical contract support for a more precise PRA, for a total resolution cost of about $100,000. It was assumed that NRC staff review of licensee implementation of the assumed solution would require 5 staff-weeks/plant for a cost of about $230,000. Resident inspector surveillance of site actions emanating from the resolution was estimated to require 0.5 staff-week/RY for a present worth of about $325,000 over the remaining lifetime of the 20 affected BWRs. The total present worth NRC cost for this issue was thus estimated to be about $650,000.

Total Cost: The total NRC and industry cost for resolution and implementation of the possible solution was estimated to be approximately $1.5M.

Value/Impact Assessment

Based on a potential public risk reduction of 2.3 x 10⁴ man-rem and a total cost of $1.5M, the value/impact score was given by:

Other Considerations

(1) The probability of ISLOCA may well be greater than that calculated above based on piping failure. Other components in low pressure systems, such as pump seals, heat exchanger tubes, thermocouple wells, etc., would also be subject to overpressure failures. Also, while not explicitly considered in calculating the estimated core-melt frequency and risk, the failure of all low pressure systems due to overpressure resulting from failure of PIVs contributes further to the risk. Although the risk from other interfaces was not calculated, the evaluation of Issue 96 showed that the risk from failures of the valves isolating the RHR system in a PWR was at least an order of magnitude less than the risk calculated for this issue. The failure of PIVs in a BWR RHR system would affect only part of the ECCS system, rather than all as in a PWR. Therefore, the risk in a BWR would be even less than in a PWR.

(2) ISLOCA releases in the auxiliary building would also be expected to present an additional common mode failure mechanism for failure of redundant safety systems located in the auxiliary building. These considerations were not included in this analysis. However, had they been included, the estimates of frequency for ISLOCA and resultant core-melt would have been greater. For this reason, the priority reached on the basis of the simplified analysis performed for this issue was conservative.

(3) A relatively small total increase in ORE (530 man-rem) was calculated due to assumed increases in surveillance and post-maintenance inspections. This calculation assumed 40 man-hours/RY for increased maintenance in a 25 millirem/hr field at the 20 affected BWRs for their remaining lifetime. Reduction in the estimated frequency of core-melt and non-core-melt intersystem LOCA which might be attained was calculated to result in a total averted ORE of 215 man-rem: 65 man-rem due to cleanup of a core-melt event and 150 man-rem due to cleanup of non-core-melt ISLOCAs. Both the increased ORE and the averted operator exposure were insignificant in comparison to the calculated public risk reduction of 2.3 x 10⁴ man-rem and did not alter the priority indicated by the value/impact assessment.

(4) At an estimated industry cleanup and replacement power cost of $1.65 Billion for a core-melt accident and $720M for a successfully-mitigated LOCA, the frequency reduction of core-melt and non-core-melt ISLOCA estimated for resolution of this issue would result in an averted accident cost savings with a present worth of about $2.7M. This exceeded the total expected NRC and industry cost and supported resolution of the issue.

CONCLUSION

This issue was given a high priority ranking (See Appendix C) and resolution was pursued. In resolving the issue, the staff conducted analyses of units representative of all NSSS vendors and considered: (1) human errors, both as initiators and during recovery operations; (2) component fragilities, to determine likely low pressure system break locations; and (3) the post-ISLOCA auxiliary building environment, to determine the survivability of recovery equipment. These analyses were documented in NUREG/CR-5604,¹⁴⁹⁴ NUREG/CR-5744,¹⁴⁹⁵ NUREG/CR-5745,¹⁴⁹⁶ NUREG/CR-5603,¹⁴⁹⁷ NUREG/CR-5862,¹⁴⁹⁸ and NUREG/CR-5928.¹⁴⁹⁹ It was concluded that the units studied posed little risk from ISLOCA.

In addition to the above analyses, previous PWR ISLOCA studies¹⁵⁰⁰ were reexamined with data updated to include the seven years of operating experience that had accrued since the initial analyses were undertaken. None of the studies supported generic requirements for PWRs, whether on absolute risk reduction or cost-beneficial bases.¹⁵⁰¹ The study¹⁴⁹⁹ of ISLOCA at a BWR confirmed past PRA studies which generally indicated little risk contribution from ISLOCA sequences.

The staff found that ISLOCAs at PWRs were plant-specific in nature; however, the ongoing IPE program¹²²² includes licensee analysis of ISLOCA sequences. With respect to future applicants, a draft SRP¹¹ Section covering design review of systems interfacing with the RCS in ALWRs was provided¹⁵⁰³ to NRR for information and use as appropriate. Supplement 1 to Information Notice 92-36¹⁵⁰² was issued to share insights from the ISLOCA program and to inform licensees of the availability of material useful for IPE ISLOCA analyses not yet completed, or as a check on analyses already completed. Thus, this issue was RESOLVED and no new requirements were established.¹⁵⁰⁴ Consideration of a license renewal period of 20 years for the affected plants would not change the resolution.^1501,1564

REFERENCES

0011. NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (1st Ed.) November 1975, (2nd Ed.) March 1980, (3rd Ed.) July 1981. 0064. NUREG/CR-2800, "Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," U.S. Nuclear Regulatory Commission, February 1983, (Supplement 1) May 1983, (Supplement 2) December 1983, (Supplement 3) September 1985, (Supplement 4) July 1986, (Supplement 5) July 1996. 0367. NUREG/CR-2802, "Interim Reliability Evaluation Program: Analysis of the Browns Ferry Unit 1 Nuclear Plant," U.S. Nuclear Regulatory Commission, August 1982, (Appendix A) August 1982, (Appendix B) August 1982, (Appendix C) August 1982. 0761. AEOD/E414, "Stuck Open Isolation Check Valve on the Residual Heat Removal System at Hatch Unit 2," Office for Analysis and Evaluation of Operational Data, U.S. Nuclear Regulatory Commission, May 31, 1984. [8406190101] 0762. Memorandum for W. Minners from G. Holahan, "Prioritization of Interfacing System LOCA at Boiling Water Reactors," October 25, 1984. [8411050292] 0763. NUREG-0677, "The Probability of Intersystem LOCA: Impact Due to Leak Testing and Operational Changes," U.S. Nuclear Regulatory Commission, May 1980. 1222. Letter to All Licensees Holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities from U.S. Nuclear Regulatory Commission, "Individual Plant Examination for Severe Accident Vulnerabilities—10 CFR § 50.54(f), (Generic Letter No. 88-20)," November 23, 1988 [ML031150465], (Supplement 1) August 29, 1989 [8908300001], (Supplement 2) April 4, 1990 [ML031200551], (Supplement 3) July 6, 1990 [ML031210418], (Supplement 4) June 28, 1991 [ML031150485], (Supplement 5) September 8, 1995. 1494. NUREG/CR-5604, "Assessment of ISLOCA Risk"Methodology and Application to a Babcock and Wilcox Nuclear Power Plant," U.S. Nuclear Regulatory Commission, (Vol. 1) April 1992, (Vol. 2) April 1992, (Vol. 3) April 1992. 1495. NUREG/CR-5744, "Assessment of ISLOCA Risk"Methodology and Application to a Westinghouse Four-Loop Ice Condenser Plant," U.S. Nuclear Regulatory Commission, April 1992. 1496. NUREG/CR-5745, "Assessment of ISLOCA Risk"Methodology and Application to a Combustion Engineering Plant," U.S. Nuclear Regulatory Commission, April 1992. 1497. NUREG/CR-5603, "Pressure-Dependent Fragilities for Piping Components," U.S. Nuclear Regulatory Commission, October 1990. 1498. NUREG/CR-5862, "Screening Methods for Developing Internal Pressure Capacities for Components in Systems Interfacing with Nuclear Power Plant Reactor Coolant Systems," U.S. Nuclear Regulatory Commission, May 1992. 1499. NUREG/CR-5928, "ISLOCA Research Program Final Report," U.S. Nuclear Regulatory Commission, July 1993. 1500. NUREG/CR-5102, "Interfacing System LOCA: Pressurized Water Reactors," U.S. Nuclear Regulatory Commission, February 1989. 1501. NUREG-1463, "Regulatory Analysis for the Resolution of Generic Safety Issue 105: Interfacing System Loss-of-Coolant Accident in Light-Water Reactors," U.S. Nuclear Regulatory Commission, July 1993. 1503. Memorandum for F. Gillespie from W. Minners, "Proposed Resolution of Generic Issue 105, `Interfacing Systems LOCA in LWRs," April 2, 1993. [9312220208] 1504. Memorandum for J. Taylor from E. Beckjord, "Technical Resolution of Generic Issue 105 (GI-105) 'Interfacing Systems Loss of Coolant Accident (ISLOCA) in LWRs,'" June 3, 1993. [9312220210] 1564. Memorandum for W. Russell from E. Beckjord, "License Renewal Implications of Generic Safety Issues (GSIs) Prioritized and/or Resolved Between October 1990 and March 1994," May 5, 1994. [9406170365]