Resolution of Generic Safety Issues: Issue 131: Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse-Designed Plants (Rev. 1) ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
Potential seismic interaction involving the movable in-core flux mapping systems was identified as a generic issue in August 1985.1167 This potential interaction exists because portions of the in-core flux mapping system, which have not been seismically analyzed, are located directly above the seal table. Failure of this equipment during a seismic event could cause multiple failures at the seal table and could produce an equivalent small-break LOCA. Staff discussions of the issue with W revealed that potential seismic interactions could exist at operating W plants.1168 The staff's concerns were outlined in IE Information Notice No. 85-451171 issued in June 1985.
Safety Significance
The in-core flux mapping system used in W plants has movable fission chambers. These chambers are mounted at the end of long drive cables and travel in long tubes called "thimbles" which run from a location outside the biological shield, enter the reactor at the bottom of the vessel, lead up through the core, and terminate near the top of the fuel. The thimbles are simply guide tubes for the detectors which are inserted into the core only when a flux map is being taken. The thimbles are sealed at the reactor end and are dry inside. They are also retractable and run within larger tubes called "conduits." These conduits are wet inside, sealed to the reactor vessel bottom at one end thus making them extensions of the RCPB, and terminate at the seal table. A mechanical compression-type seal attached to the seal table serves as the pressure boundary between the thimble tube and the fitting.
The seal table is at the same elevation as the reactor vessel upper head closure flange. The advantage of this arrangement is that, at the beginning and end of a refueling outage with the reactor at atmospheric pressure and the vessel water level at the flange, the seals in the seal table can be unlocked and thimbles can be withdrawn and inserted. Since the seals at the seal table are part of the RCPB, failing these seals will cause a small LOCA. Moreover, the escaping coolant would be drawn from the bottom of the reactor vessel. For such a break location, as the liquid level in the reactor coolant system drops, the steam space expands until saturation conditions are reached. After this, as the steam volume increases, the liquid boils and the pressure and temperature may remain high as liquid coolant exits from the bottom of the reactor vessel. Because virtually all of the reactor coolant system piping is connected directly or indirectly at the reactor vessel nozzles above the top of the core, most breaks are in effect above the core. For such breaks, once the liquid level has dropped to the point where the break is in the steam space, the pressure drops very rapidly because each pound of steam leaving the system carries with it the latent heat of vaporization. This more typical break therefore results in much greater energy loss with a corresponding rapid reduction in both temperature and pressure.
In contrast, seal leaks at the seal table will not draw from the steam space until after the core is completely uncovered. If the leak is greater than the capacity of the high pressure injection, the core may uncover. The low pressure injection pumps, which would normally be able to mitigate such a leak, may not be able to inject until after the entire liquid inventory is lost, by which time the core could be severely damaged. In addition, it should be noted that any loss of the RCPB integrity caused by seismically-induced failures in the flux mapping system would be outside the design basis of a plant. Therefore, such a condition should be unacceptable even if the consequences remain within those for LOCAs analyzed in an SAR.
This issue applies to all W plants. Some CE plants have movable in-core detectors (in addition to the fixed detectors installed in all CE reactors). The CE design has the tubes entering from the top rather than the bottom of the vessel. Thus, the issue does not apply to CE plants. B&W plants use only fixed in-core detectors; there is no seal table. Thus, this issue does not apply to B&W plants. GE plants use movable in-core detectors with bottom-entry tubes. The GE design has O-ring seals in the instrument guide tube housings located in the lower vessel head, instead of wet conduits leading to a remotely located seal table. Thus, this issue does not apply to GE plants.
Possible Solution
The non-seismically-qualified BOP equipment1167,1168 consists of the flux mapping transfer cart which apparently is suspended from a rail car mounted on tracks over the seal table. This particular design configuration is described as the "worst case found," but still other equipment may be involved at other plants. The obvious possible fix is to install restraints of some kind. However, simpler solutions may be possible in some situations. For example, it may be possible in some instances to simply move the transfer cart out from over the seal table when the equipment is not in use, if the tracks are long enough and the plant does not use an Axial Power Distribution Monitoring System (APDMS).
PRIORITY DETERMINATION
Frequency Estimate
The accident sequence is straightforward: a seismic event occurs that is severe enough to cause the transfer mechanism to fall on the seal table; a sufficient number of seals fail such that the leak exceeds the capacity of the high pressure injection system; the core then uncovers and melts with the vessel still at high pressure.
The first parameter is the frequency of seismic events of sufficient severity to cause the transfer mechanism to fall. Seismic event frequencies vary considerably from site to site, but the frequency of the SSE is generally in the range of 10-4 to 10-3 event/RY. We will assume a site with above average seismic activity and use 10-3/RY.
The next parameter is the number of seals which fail. Mathematically, this is a sequence of probabilities, i.e., there is a probability of one seal failing, a probability of two seals failing, etc. The mathematical formulation of such a sequence of probabilities is reasonably straightforward, but actual calculation is hampered by the fact that we have no readily available information regarding the size, shape, height, or mass of the falling object or objects. There is also the question of whether the falling object simply remains where it falls, implying that the initial impact causes seals to fail, or whether the seismic activity (including aftershocks) causes the object to vibrate or roll around on the seal table, causing seal failures.
A W Safety Review Committee conducted a structural evaluation of one representative plant design and concluded that the transfer cart could cause at most three seal failures. It is not clear from the W information what type of failure(s) was induced to the seals. The thimble tubes could perhaps be sheared off and ejected or, more likely, could be bent and distorted. In either case, the compression-type fitting at the seal table could fail and result in tube ejection similar to the thimble tube ejection event that occurred at Sequoyah.1169 However, in either of these cases, ejection of the thimble tube, as discussed below, would cause loss of integrity of the RCPB.
It is expected that the probability of at least one seal failure should be relatively high, but the probability of all seals failing should be much lower. In the absence of any other information, we will assume a Poisson distribution. If the probability of n failures is given by P(n), the Poisson formula becomes:
,where µ is the Poisson distribution.
For this distribution, the average number of failures (µ) is given by:
We will assume 95% confidence in the W Safety Review Committee's calculation that no more than three seals fail, i.e., we will adjust µ such that:
P(0) + P(1) + P(2) + P(3) = 0.95
Finding the appropriate value of µ involved development of a staff computer program to solve the transcendental equation with values of µ and the probabilities treated as variables.1170 The results are as follows:
µ = <n> = 1.37
The significance of this parameter is that the average number of seal failures from a falling transfer cart is 1.37. Substituting this value in the previous formula:
P(0) = 0.254
P(1) = 0.348
P(2) = 0.238
P(3) = 0.109
Total: 0.95
It is necessary to examine the capacity of the high pressure injection system to go with the number of seal failures. We will choose a class of plants similar to Surry for this evaluation. These plants are equipped with three high pressure centrifugal pumps (one normally in operation), each with an injection capacity of 150 gpm at normal operating pressure.
The ID of the conduits vary from 0.4 to 0.6 inches and is filled with a 0.3 inch OD thimble tube. However, the thimble tube is not expected to be very effective in throttling fluid flow if seal failure(s) result from a guillotine break of the thimble tube or failure of the compression fitting capability, given distorted or bent thimble tube(s), since they are likely to be ejected. The thimble is designed with sufficient stiffness to be inserted by being pushed at one end and thus is unlikely to jam in place. After a seal failure, the force that would tend to eject the thimble (due to differential pressure) is about 140 pounds, not including the effect of flowing fluid along the length of the thimble tube.
An actual seal failure at the compression fitting occurred at Sequoyah in 1984 during maintenance involving thimble cleaning.1169 The thimble was ejected from the conduit and the fluid loss was estimated by the licensee to be between 25 and 35 gpm. We will assume a 30 gpm break flow in our calculations, based on the Sequoyah experience. We will further assume (for lack of better information) that a 150 gpm pump will be able to mitigate five broken seal leaks of 30 gpm each. However, it must be remembered that, as pressure drops, the injection flow from the pump(s) will increase. A relatively extensive calculation would be necessary to determine the actual number of seal leaks a given configuration of pumps could handle.
Depending on the total leakage flow, mitigation may require one, two, or all three pumps. Calculation of the unavailability of the 1/3, 2/3, and 3/3 configurations is somewhat complex, since there are several permutations and combinations in what is basically a three-train system. In addition, one of the three pumps is normally kept in operation, which eliminates the fail-to-start failure mode for one pump. Unavailability for the 1/3 and 2/3 configurations were calculated in WASH-1400.16 These results are 8.6 x 10-3/demand for 1/3 and 1.2 x 10-2/demand for 2/3. Results for 3/3 were not presented in WASH-1400.16 However, we note that the 3/3 configuration is not single failure proof. Thus, the 3/3 unavailability can be approximated as follows:
| Qsingles + Q maint | = (1.1 x 10-3)/demand + (5.7 x 10-2)/demand |
| = (5.8 x 10-2)/demand. |
We will consider four ranges of seal failures.
| Range | Probability | Result |
|---|---|---|
| 1 to 5 failures | P(1) + P(2) + ...+ P(5) | 7.40 x 10-1 |
| 6 to 10 failures | P(6) + ... + P(10) | 2.88 x 10-3 |
| 11 to 15 failures | P(11) + ... + P(15) | 2.29 x 10-7 |
| 16 or more failures | P(16) + ... + P(58) | Negligible |
Each range corresponds to a pump configuration as shown below:
| Range | Probability of Range | Number of Pumps Needed for Mitigation | Pump Configuration Unavailability | Event Core-Melt Frequency (per RY)* |
|---|---|---|---|---|
| 1 to 5 | 7.43 x 10-1 | 1 of 3 | 8.6 x 10-3 | 6.39 x 10-6 |
| 6 to 10 | 2.88 x 10-3 | 2 of 3 | 1.2 x 10-2 | 3.46 x 10-8 |
| 11 to 15 | 2.29 x 10-7 | 3 of 3 | 5.8 x 10-2 | 1.33 x 10-11 |
| Total: | 6.42 x 10-6 |
*This column is the SSE frequency (10-3/RY) multiplied by the range probability (second column) and the pump configuration unavailability (fourth column).
Consequence Estimate
The core-melt sequences under consideration involve a core-melt with no large breaks initially in the RCPB and containment heat removal systems successful or partially successful. The reactor is likely to be at high pressure (until the core melts through the lower vessel head) with a steady discharge of steam and gases through the broken seals and (possibly) the PORVs. These are conditions likely to produce significant hydrogen generation and combustion.
The Zion and Indian Point PRA studies used a 0.03 probability of containment failure due to hydrogen burn (the "gamma" failure). (See References 1052, 1151, and 1152.) We will follow this example and use 0.03, bearing in mind that specific containment designs may differ significantly from this figure. In addition, the containment can fail to isolate (the "beta" failure). Here, the Oconee PRA54 figure of 0.0053 will be used. If the containment does not fail by isolation failure or hydrogen burn, it will be assumed to fail by base mat melt-through (the "epsilon" failure).
Assuming a central midwest plain meteorology, a uniform population density of 340 persons per square mile, a 50-mile radius, and no ingestion pathways, the consequence parameters are:
| Failure Mode | Cont. Failure Probability | Release Category | Cond. Release (man-rem) |
|---|---|---|---|
| gamma | 0.030 | PWR-3 | 5.4 x 106 |
| beta | 0.005 | PWR-5 | 1.0 x 106 |
| epsilon | 0.965 | PWR-7 | 2.3 x 103 |
The "weighted-average" core-melt results in a public dose of 1.7 x 105 man-rem/event. Therefore, based on a core-melt frequency of 6.42 x 10-6/RY, a remaining plant lifetime of 30 years, and a weighted dose of 1.7 x 105 man-rem/event, the public risk is estimated to be 32.7 man-rem/reactor.
These results should cover all PWRs with large, dry containments. They do not apply to ice condenser containments. Because of the low free volume in such containments, failures due to overpressure are more likely and the average consequences may be significantly greater.
Cost Estimate
Industry Cost: Because the exact hardware modifications to the transfer cart and associated equipment are not known and will probably vary from plant to plant, a generic cost estimate is difficult to estimate. However, such modifications are likely to be dominated by labor costs which are unlikely to exceed one staff-year/reactor ($100,000). Licensee administrative costs are likely to be on the order of another $100,000, giving a total licensee cost of $200,000/plant.
NRC Cost: NRC costs are likely to be on the order of one staff-year of generic work. In addition, because plant designs vary, roughly two staff-months of effort on each plant will be used. Thus, NRC costs are estimated to be on the order of $100,000 for the generic effort which is distributed over 34 reactors ($3,000/plant) plus $16,700/plant for those plants that modify the design.
Total Cost: As indicated above, this equipment is BOP equipment and may vary considerably from plant to plant. Therefore, the estimates of both consequences and costs are expected to represent an upper bound for those plants that approximate the worst case design configuration in their flux mapping systems. Based on the above considerations, the cost for plants that have similar design flux mapping systems is approximately $220,000/plant.
Value/Impact Assessment
The maximum value/impact score for those plants that may be affected by this issue is given by:
This maximum value/impact score corresponds to a site with a high SSE frequency.
Other Considerations
(1) The fix for this issue involves work within an area where significant radiation fields may be present. Thus, protection to reduce ORE should be considered in planning the fix.
(2) If a seal should fail, the post-accident cleanup in the seal table area will involve ORE even if the event is successfully mitigated. After the Sequoyah event,1169 the licensee was able to remove the ejected thimble tube and decontaminate the area with only one man-rem of ORE. Under the assumption of 30 remaining years of actual operation, a seismic event frequency of 10-3/year, and an average of 1.37 failed seals per event, the actuarial averted ORE is only 0.04 man-rem/plant. However, if one or more of the fission chambers is in use and inserted into the thimbles when the event occurs, the cleanup exposure will be far greater.
(3) Averting a core-melt also averts the ORE associated with core-melt cleanup. Using a value of 20,000 man-rem to clean up after a core-melt, the averted ORE is 3.85 man-man over the remaining life of a plant. The ORE from potential core-melt for this issue is approximately 10 percent of the potential public risk.
(4) The proposed fix reduces core-melt frequency and therefore averts cleanup costs and replacement power costs. The potential plant value (savings) for averted core-melt cleanup and replacement power costs is determined by the expression:970
| |
| where: | D = discounted time value of money |
| f = 6.42 x 10-6/RY (core-melt frequency) | |
| C = $1.65 billion (current core-melt cost) | |
| r = 5% (discount rate) | |
| t = 30 years (assumed remaining plant life) | |
| m = 10 years (assumed 10-year replacement power cost) |
The accident avoidance costs, if included, would reduce the impact cost by approximately 10 percent.
(5) In this analysis, it was assumed that the three seal failure limit calculated by the W Safety Review Committee corresponds to a 95 percent confidence limit. This is a pragmatic rather than a rigorous assumption. To test the sensitivity of the core-melt frequency to this assumption, additional calculations at 90 percent and 80 percent were performed. The results were as follows:
| 3-Pin Probability Sum | µ | Core-Melt Frequency |
|---|---|---|
| 95% | 1.370 | 6.4 x 10-6 |
| 90% | 1.745 | 7.1 x 10-6 |
| 80% | 2.295 | 7.9 x 10-6 |
The core-melt frequency does increase, but not dramatically, as the percent figure is lowered. This is because most of the core-melt frequency comes from the accident sequence where 1 to 5 seals fail and all three high pressure injection trains fail. The sequence where a large number of seals fail, and fewer HPI trains need to fail for core-melt to result, does not contribute greatly to the core-melt frequency. Therefore, the assumption may not be rigorous, but the final result should be reasonable.
(6) The calculations assumed a Surry class of plants which has three centrifugal charging pumps. The situation is rather different for the Sequoyah class of plants, which has one lower-capacity reciprocating charging pump, two centrifugal charging pumps, and two intermediate head safety injection pumps. Such plants have slightly less injection capability at full pressure. However, the intermediate head SI pumps have a shutoff head of 1520 psig and seal failure calculations1167 show RCS pressure stabilizing around 1200 to 1250 psig, low enough for the SI pumps to inject some coolant. Therefore, these plants have more mitigation capability than the Surry class of plants and this issue would be less significant for them in terms of core-melt frequency. However, some of the Sequoyah class of plants have ice condenser containments which may make this issue more significant in terms of man-rem.
(7) The assumed seismic event frequency of 10-3/RY is a maximum value. The nationwide site average would be a factor of 3 or 4 lower than this, but use of the average rather than the maximum value would not change the core-melt frequency enough to alter the conclusion.
CONCLUSION
As stated earlier, any loss of RCPB integrity caused by seismically-induced failures in the flux mapping system would be outside the design basis of a plant. Based upon the above calculations, particularly the core-melt frequency estimate, a medium priority ranking was recommended for this issue. However, upon further RES management review, it was decided that the safety concern could be more efficiently addressed as part of the External Events IPE Program.1302
REFERENCES
|
