Resolution of Generic Safety Issues: Issue 189: Susceptibility of Ice Condenser And Mark III Containments to Early Failure From Hydrogen Combustion During a Severe Accident ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
This generic issue was proposed1791 in response to SECY-00-1981792 which explored means of risk informing 10 CFR 50.44. As a part of this effort, the paper recommended that safety enhancements that have the potential to pass the backfit test be assessed for mandatory application through the generic issue program.
Safety Significance
Since the last revision of 10 CFR 50.44, "Standards for Combustible Gas Control System in Light-Water-Cooled Power Reactors," in 1987, there have been significant advances in the understanding of the risk associated with the production and combustion of hydrogen (and other combustible gases) during reactor accidents. The work discussed in SECY-00-198 was actually an investigation of the relaxation of a number of requirements.
For the majority of PWRs with large dry or sub-atmospheric containments, direct containment heating (DCH) is the dominant mode of containment failure (a separate issue that was resolved by plant-specific comparison of DCH loads versus containment strengths), and the containment loads associated with hydrogen combustion are non-threatening.
However, it was discovered in the study associated with NUREG/CR-64271793 that, for ice condenser containments, the early containment failure probability is dominated by non-DCH hydrogen combustion events. This is not a surprising result, given the relatively low containment free volume and low containment strength in these designs. These containments rely on the pressure-suppression capability of their ice beds, and, for a design-basis accident, where the pressure is a result of the release of steam from blowdown of the primary (or secondary) system, an ability to withstand high internal pressures is not needed.
In a beyond-design-basis accident, where the core is severely damaged, significant quantities of hydrogen gas can be released. This hydrogen is generated by the exothermic chemical reaction of water and steam with metal (especially the Zircaloy cladding), and (to some extent) by radiolysis of water, where gamma rays actually split water molecules into hydrogen and oxygen.
To deal with large quantities of hydrogen, these containments are equipped with AC-powered igniters, which are intended to control hydrogen concentrations in the containment atmosphere by initiating limited "burns" before a large quantity accumulates. In essence, the igniters prevent the hydrogen (or any other combustible gas) from accumulating in large quantities and then suddenly burning (or detonating) all at once, which would pose a threat to containment integrity.
For most accident sequences, the hydrogen igniters can deal with the potential threat from combustible gas buildup. The situation of interest for this generic issue only occurs during accident sequences associated with station blackouts, where the igniter systems are not available because they are AC-powered.
Thus, this does not affect the frequency of severe accidents, but does affect the likelihood of a significant release of radioactive material to the environment should such an accident occur.
The issue also applies to BWR MARK III containments, because they also have a relatively low free volume and low strength, comparable to those of the PWR ice condenser designs. The MARK I and MARK II designs are also pressure-suppression designs, but are operated with the containment "inerted," i.e., the drywell and the air space above the suppression pool are flooded with nitrogen gas, and a nitrogen makeup system maintains oxygen level below a set limit by maintaining a slight positive nitrogen pressure within the primary containment. The low oxygen concentration is sufficient to accommodate the hydrogen threat (except possibly for long-term radiolysis). In contrast, the MARK III designs are equipped with hydrogen igniters just as are the PWR ice condenser designs, and are similarly potentially vulnerable in an accident sequence associated with station blackout.
Possible Solution
The solution is to provide an independent power supply for the igniter systems for the subject containments. The igniters are, essentially, diesel engine glow plugs. If necessary, they could be powered by storage batteries or by a portable generator.
PRIORITY DETERMINATION
The two containment types, ice condenser and MARK III, will be examined separately in the following sections. In each case, the objective is to calculate plausible estimates of risk parameters that represent the particular class of plants in question. These estimates are for prioritization purposes only, and are not intended to represent the best the state of the art can produce.
In addition to the generic estimate calculated here, an independent calculation has been performed1794 by Energy Research, Inc. (ERI). The ERI study arose out of an investigation of possible risk-informed alternative approaches to 10 CFR 50.44, the same project that generated this generic issue. The ERI study is based on the IPE and IPEEE studies for Catawba and Grand Gulf. Although the ERI study is more plant-specific, it also avoids some of the more debatable assumptions that were necessary in the generic analysis presented here.
PWR Ice Condenser
We will examine the ice condenser plants first. The strategy will be to start with the NUREG-11501081 Sequoyah Level II PRA, which should be reasonably representative and also has the advantage of being readily available, and modifying it in two ways. First, use plant damage state frequencies that are more generically representative, and second, change the probability of containment failure caused by hydrogen combustion to a value consistent with more modern investigations.
Frequency Estimate
The severe accident frequency of interest is the frequency of severe accidents associated with station blackout. Fortunately, this frequency is routinely calculated in PRAs, including the NUREG-1150 PRA and NUREG/CR-45511795 for the Sequoyah plant (the only NUREG-1150 PRA for a PWR with an ice condenser containment). However, internal-events PRAs such as the NUREG-1150 Sequoyah study do not give the complete picture. Although these studies include station blackouts initiated by both plant-centered and grid-initiated losses of offsite power, external events are not included. In most external event studies, the principal accident sequence leading to severe core damage comes from a station blackout. In seismically-initiated sequences, the seismic event damages the ceramic insulators in the transmission lines, effectively disconnecting the plant from offsite power, and also increases the likelihood of a failure of onsite power. Similarly, the fire-initiated sequences may involve a fire in the electrical switchgear, again causing a total loss of AC power.
The following table summarizes estimates of this parameter from several sources:
| Site | NUREG-1150 Slow SBO | NUREG-1150 Fast SBO | IPE CDF | IPE SBO CDF | IPEEE Fire CDF | IPEEE Seismic CDF | IPEEE External CDF | Total IPE/IPEEE CDF |
|---|---|---|---|---|---|---|---|---|
| Sequoyah | 4.58E-6 | 9.26E-6 | 1.70E-4 | 5.32E-6 | 1.6E-5 | [Margin] | [1.6E-5] | [1.86E-4] |
| Watts Bar | 8.00E-5 | 1.73E-5 | 7.0E-6 | [Margin] | [7.0E-6] | [8.70E-5] | ||
| Catawba | 5.80E-5 | 6.00E-7 | 4.7E-6 | 1.6E-5 | 2.1E-5 | 6.01E-5 | ||
| McGuire | 4.00E-5 | 9.32E-6 | 2.3E-7 | 1.1E-5 | 1.1E-5 | 5.1E-5 | ||
| DC Cook | 6.26E-5 | 1.13E-6 | 3.8E-6 | 3.2E-6 | 7.0E-6 | 7.0E-5 | ||
| "Average" | 6.73E-6 | 6.34E-6 | 1.01E-6 | |||||
| From CRIC-ET database 1796 | From IPE database | From NUREG/CR-6427 (Table 7.5) | ||||||
(The significant figures presented in this table are given for the convenience of the reader who wishes to duplicate the calculations, and are not intended to imply that these estimates are known to two or three significant figure accuracy.)
As can be seen from the IPE SBO column, the internal-events SBO-initiated CDF ranges over the decade from 10-6 to 10-5. The fire- and seismically-initiated CDFs, which generally involve loss of all AC power, are in the same range. The row labeled "average" is a simple arithmetic mean average over the five sites, and is intended to provide a point estimate representative of this class of plants, recognizing that individual plants vary.
Of course, the fire and seismic initiator CDFs do not consist exclusively of sequences involving loss of all AC power, and the specifics of this breakdown will be plant-specific. To get a generically-representative number, it will be necessary to make some assumptions, recognizing that the result will be, at best, a rough estimate. The NUREG-1150 PRA for Sequoyah did not address external events. Thus, we will base these assumptions on the fire and seismic analyses of the NUREG-1150 Surry PRA (NUREG/CR-4551, Vol. 3, Rev. 1, Parts 1 and 3), which have the advantage of readily-available and abundant documentation. (Surry is not an ice condenser plant, but containment design should not greatly affect the frequency and course of fire and seismically initiated sequences.) This "hybridization" or use of one PRAs results in another PRA, results in, at best, a very rough approximation. However, it will be shown later that the conclusion is not greatly affected by this approximation.
In the Surry fire analysis, the principal fire-initiated plant damage states were associated with four locations:
PDS for Surry Fire Initiators (NUREG/CR-4551, Table 2.2-4, pp. 2 to 14) | |
|---|---|
| Emergency Switchgear Room | 54.3% |
| Auxiliary Building | 20.0% |
| Cable Vault and Tunnel | 13.0% |
| Control Room | 12.7% |
Fires in the emergency switchgear room, control room or auxiliary building are not likely to disable the igniters. Even if such a fire disabled emergency power, normal power would be available. However, it will be assumed that fires in the cable vault and tunnel will also disable the igniters, and thus 13% of the fire frequency will be added to the internal SBO frequency.
The Surry seismic analysis can be used in a more straightforward manner, since the four seismic groups explicitly list station blackout.
Plant Damage States for Seismic Initiators (NUREG/CR-4551, Table 2.2-6, pp. 2.16 to 2.17) | |||
|---|---|---|---|
| EQ 1 | Loss of Station Power (no SBO) | 47.1% | 53.7% |
| EQ 2 | SBO | 41.1% | 33.7% |
| EQ 3 | LOCAs | 11.9% | 12.5% |
Here, we will use the EPRI-based estimate of 33.7%, as being more in line with modern analyses.
Large Early Release Frequency (LERF) Estimate
According to the studies presented in NUREG/CR-6427, the likelihood of early containment failure due to uncontrolled post-accident hydrogen combustion is significantly higher than the figure used in the NUREG-1150 PRA for Sequoyah. Table 7.3 of NUREG/CR-6427 gives a non-DCH failure probability for both fast and slow station blackout sequences of 0.9021, which is essentially all due to hydrogen combustion. The non-DCH failure probability is given as zero for all other core damage initiators, presumably due to the availability of AC power for the igniters. Therefore, it can be assumed that providing an alternative power supply for the igniters would lower the total containment failure probability by about 0.9. With this, it is possible to estimate the change in large early release frequency (∆LERF) associated with the issue:
| CDF | SBO Fraction | SBO CDF | Change in Containment Failure Probability | ∆LERF | |
| Internal | 6.73E-6 | 0.90 | 6.06E-6 | ||
| Fire | 6.34E-6 | 13% | 8.24E-7 | 0.90 | 7.42E-7 |
| Seismic | 1.01E-6 | 33.7% | 3.40E-7 | 0.90 | 3.06E-6 |
Again, the significant figures are given for convenience in following these calculations, and are not intended to imply a high accuracy in the estimates.
The screening threshold for LERF given in Management Directive 6.4 (Appendix C, Figure C4) is any change in LERF greater than 10-6/RY, regardless of the initial LERF. Thus, for ice condenser plants, this issue passes this screening criterion. It should be noted that the criterion is met even without the external events.
Recoverability: The analysis above does not distinguish between recoverable and non-recoverable station blackout. This leads to some conservatism in the result, since the existing igniter system will become available if AC power is recovered after core melt, but before hydrogen ignition. It should be noted, however, that the efficacy of the igniters in preventing large scale burns depends on their availability early, before combustible gases have time to accumulate in large quantities. Once this accumulation occurs, turning on the igniters may be counterproductive.
Hybridization: The various core damage frequencies and associated changes in LERF are based on a hybridization of several PRAs. Moreover, the estimates of the station blackout portion of the seismic and fire CDFs are, at best, educated guesses. Nevertheless, if the change in containment failure probability is 90%, most of the IPE SBO core damage frequencies are high enough for the ∆LERF to pass the screening criterion even without the hybridization or addition of external events. The conclusion that this issue passes the screening criterion is reasonably robust.
Consequence Estimate
Estimating the risk to the population from these accident sequences is not as straightforward as estimating LERF. In the integrated risk analysis for the NUREG-1150 PRAs, the accident frequency analysis ("front end" analysis) produces an overall CDF, and also a set of plant damage states, each with its own frequency. For the Sequoyah PRA, the plant damage states are:
| PDS Index | Plant Damage State (PDS) |
|---|---|
| 1 | Slow Station Blackout |
| 2 | Fast Station Blackout |
| 3 | LOCA |
| 4 | Event V (interfacing systems LOCA) |
| 5 | Transient |
| 6 | ATWS |
| 7 | Steam Generator Tube Rupture |
The sequences of interest here are in plant damage states 1 and 2. However, these plant damage states do not correlate one-to-one with a consequence analysis. A description of the integrated risk analysis can be found in Reference 6, from which the following figure is taken:
In the integrated risk analysis, the accident progression event tree analysis (a very extensive set of calculations) is used to calculate a set of accident progression bin frequencies from each PDS. The set of accident progression bins is then input into a partitioning analysis (also very extensive) to calculate source term groups and associated frequencies. Actual consequences (e.g., man-rem) are then calculated for each source term, and the total risk is calculated by multiplying each consequence by its source term frequency, and summing the products.
It is not practical to calculate the risk associated with this issue with a hand calculation. Instead, a sensitivity analysis computer code, the Computational Risk Integration and Conditional Evaluation Tool (CRIC-ET), was used.1796
In order to use this code, it was necessary to "split" the generic station blackout frequency estimated above into "slow SBO" and "fast SBO." The IPE and IPEEE averages do not make this distinction, and thus some approximations must again be made. The three components, internal, seismic, and fire, were handled separately:
Internal - The internal SBO frequency contribution, based on the IPE average, was subdivided into slow and fast based on the proportions in the Sequoyah NUREG-1150 PRA:
| NUREG-1150 SBO CDF | Fractional Contribution | IPE-based SBO CDF | Proportioned SBO CDF | |
|---|---|---|---|---|
| Slow | 4.58E-6 | 33.1% | 6.73E-6 | 2.23E-6 |
| Fast | 9.26E-6 | 66.9% | 4.50E-6 | |
| Total | 1.38E-5 | 100% | 6.73E-6 | 6.73E-6 |
Seismic - The seismic SBO contribution (33.7% of the total seismically-initiated CDF, as discussed under LERF above) was assumed to be entirely in the slow category. (Generally, the seismic event causes the station blackout and destroys the condensate storage tank, and eventually the steam generators dry out.)
Fire - The fire SBO contribution (13.0%of the fire-initiated CDF) was assumed to be entirely in the fast category. (Fires in the cable vault are likely to fail everything at once.)
Several other assumptions were necessary:
The other PDS frequencies were set to zero so that the analysis would only include the SBO plant damage states.
The sequences ending in no containment failure were re-directed to the early containment failure accident progression bin, to account for the high susceptibility of the containment to failure due to hydrogen combustion, as estimated in NUREG/CR-6427. This is a slight overestimate, in that the containment failure probability due to hydrogen combustion is 90% rather than 100%, but the CRIC-ET code does not have this flexibility.
A corrected consequence file for Sequoyah was used to correct a known error.1797 The results of the calculation of population dose within 50 miles of a reactor, using 200 samples and the usual limited Latin Hypercube technique, were:
5th percentile - 3.86 x 10-3 man-rem 95th percentile - 20.3 man-rem Median - 2.24 man-rem Mean - 6.43 man-rem
Again, as is obvious from the distribution, the two decimal places are not significant and are given only for purposes of reproducing the calculation. The error bounds reflect only the uncertainty associated with the Level II analysis, and do not include the uncertainty associated with the generic station blackout frequency or split of this frequency into the fast and slow SBO plant damage states.
Generic Population Distribution: The man-rem/RY figure above is based on the NUREG-1150 model which is specific to the Sequoyah site. For generic issue calculations, such figures are generally based on a uniform population density of 340 persons/square-mile and a typical central Midwest plains meteorology. It is not practical to re-run the consequence analysis for the generic site but, as a first approximation, the risk figures can be re-normalized to the generic population. Interpolating between the 30- and 100-mile radius population figures given in NUREG/CR-4551 (Volume 5, Rev. 1, Part 1, Page 4.2), the Sequoyah population density for a 50-mile radius is approximately 159 persons/square-mile. Thus, to get a generic risk figure, the 6.43 man-rem/RY (mean) figure should be multiplied by 340/159. This gives a generic estimate of 13.73 man-rem/RY.
Aggregated Risk Figure: There are nine reactors with an ice condenser containment. Thus, the aggregated risk figure is 13.73 man-rem/RY times 9 reactors or 124 man-rem/year.
The screening threshold for averted offsite risk given in Management Directive 6.4 (Appendix C, Figure C6) is an averted offsite man-rem/year greater than 100, if the cost/benefit ratio is favorable (i.e., less than $2,000/man-rem).
Cost Estimate
A separate cost investigation will not be performed here. The ERI study concluded that the proposed fix is cost-beneficial. Therefore, it will be assumed here that the cost/benefit ratio is less than $2,000/man-rem, and the issue passes the screening threshold for risk.
Other Considerations
Hybrid Models: The split of the generic station blackout frequency into the fast and slow station blackout plant damage states, as described above, is questionable at best, since it is based on a hybridization of several PRAs. Because of this, a sensitivity analysis was done to investigate how big an effect this was. First, the entire station blackout frequency was assigned to the slow SBO PDS and a mean man-rem/RY was calculated. Then, the entire frequency was assigned to the fast SBO PDS, and the calculation repeated. The results were:
| Split | Mean Risk (man-rem/RY) |
|---|---|
| All in the slow SBO PDS | 5.38 |
| All in the fast SBO PDS | 6.94 |
| "Best guess" proportioned | 6.43 |
Based on these results, it seems safe to conclude that the results are not very sensitive to how the frequency is split between the two plant damage states.
Recoverable Station Blackout: The Sequoyah analysis, as modeled in CRIC-ET, does not distinguish between recoverable and non-recoverable station blackout. As was the case in the estimate of LERF, this leads to some conservatism in the result, since the existing igniter system will become available if AC power is recovered after core melt, but before hydrogen ignition. Once again, however, the efficacy of the igniters in preventing large scale burns depends on their availability early, before combustible gases have time to accumulate in large quantities. Once this accumulation occurs, a late initiation of the igniter systems may not have the desired result.
ERI study: The ERI study1794 estimated a risk of 3 man-rem/RY using the Catawba site and a more sophisticated methodology, which is about a factor of two less than the estimate presented here. In the context of PRA studies, a factor of two is very good agreement.
BWR MARK III Containments
The strategy for MARK III BWR containments is similar to that for ice condensers. The NUREG-1150 Level II model for the Grand Gulf plant will be used, but will be modified to be more generic and to include a higher probability for containment failure due to hydrogen combustion.
The NUREG-1150 Level II model for Grand Gulf is described in detail in NUREG/CR-45511795 (Vol. 6, Rev. 1, Part 1). The general approach, using plant damage states, accident progression bins, and source term groups, is similar to that discussed above for the Sequoyah model. However, the individual plant damage states are defined differently.
The Grand Gulf model consists of twelve plant damage states. PDS 1 through 8 are associated with station blackout, PDS 9 and 10 are associated with ATWS, and PDS 11 and 12 are associated with non-ATWS transient-initiated sequences. Although the total CDF (as estimated in NUREG-1150) is rather low (about 4 x 10-6/RY), about 97% of this CDF comes from the station blackout sequences NUREG/CR-4551 (Vol. 6, Rev. 1, Part 1, Table 2.2-3).
Of the eight station blackout plant damage states, the first six are recoverable station blackouts, in which severe core damage occurs, but AC power is recovered in time for the "miscellaneous systems" - containment venting, standby gas treatment, containment isolation, and the hydrogen igniters - to be effective. (This explicit modeling avoids the problems with treating recoverable station blackouts in the ice condenser plants, discussed earlier.) Adding backup power to the hydrogen igniters will not affect the sequences in these plant damage states.
Thus, the plant damage states of interest are PDS 7, non-recoverable fast SBO, and PDS 8, non-recoverable slow SBO. These two plant damage states represent 11% and 2% of the total station blackout frequency, respectively (NUREG/CR-4551, Vol. 6, Rev. 1, Part 1).
Frequency Estimate
The NUREG-1150 estimate of CDF for Grand Gulf is 4 x 10-6/RY, which is somewhat lower than the Grand Gulf IPE estimate of 1.72 x 10-5/RY. Again, it is necessary to find a more generic number. For the IPEs’ CDFs and, specifically, the IPE SBO CDFs, these figures are tabulated in the IPE Database.
As in the analysis of ice condenser plants, the fire-induced accident sequences are also significant. These are available from the IPEEE program, in NUREG-17421798 (Volume 2, Table 3.2).
Seismically-induced sequences are also a concern. However, there are no PRAs available for any plant with a MARK III containment. All four MARK III plants were analyzed with a seismic margins approach in the IPEEE program. Thus, once again it will be necessary to use a bit of improvisation.
The Grand Gulf and River Bend sites are in areas of low seismicity, and thus it is not anticipated that seismic sequences would be a significant contributor. The Clinton and Perry plants are located in areas of moderate seismicity, and thus may be of more concern. Given that there are no appropriate PRAs, the only recourse is to find a similar plant. The LaSalle plant is a reasonable choice, although it is a BWR/5 model with a Mark II containment, because the reactor systems (not containment systems) are similar, and the site is in the same general area (Great Lakes). The LaSalle seismic CDF, based on an existing simplified seismic PRA, is 7.6 x 10-7/RY, as reported in NUREG-1742 (Volume 2, Table 2.1). Although the use of this number is highly questionable at best, the seismic contribution is expected to be relatively minor compared to the other contributors, and thus more uncertainty can be tolerated. The CDF figures are as follows:
| Site | NUREG-1150 Non-recoverable Fast SBO CDF | NUREG-1150 Non-recoverable Slow SBO CDF | IPE CDF | IPE SBO CDF | IPEEE Fire CDF | IPEEE Seismic CDF |
|---|---|---|---|---|---|---|
| Clinton | 2.66E-5 | 9.80E-6 | 3.64E-6 | SMA | ||
| Grand Gulf | 4.3E-7 (11%) | 6.6E-8 (2%) | 1.72E-5 | 7.46E-6 | 8.89E-6 | SMA |
| Perry | 1.30E-5 | 2.25E-6 | 3.27E-5 | SMA | ||
| River Bend | 1.55E-5 | 1.35E-5 | 2.25E-5 | SMA | ||
| LaSalle | 7.6E-7 | |||||
| "Average" | 8.25E-6 | 1.69E-5 | 7.6E-7 | |||
| From CRIC-ET database 1796 | From IPE database | From NUREG/CR-17421798 (Vol. 2, Table 3.2) | ||||
Large Early Release Frequency (LERF) Estimate
To get non-recoverable station blackout frequencies, it will be assumed that the same percentage of the total station blackout frequency is non-recoverable as was the case in the NUREG-1150 model, which is 13% (11% fast SBO plus 2% slow SBO). The generic estimate for the total non-recoverable SBO CDF is then:
[(8.25 x 10-6 + 1.69 x 10-5 + 7.6 x 10-7) x 13%] event/RY = 3.37 x 10-6 event/RY
The response of the MARK III containments to an uncontrolled hydrogen containment is expected to be similar to that of an ice condenser containment. Thus, the change in large early release frequency (∆LERF) will be approximately 90% of the CDF associated with unrecoverable station blackout:
∆LERF = 3.37 x 10-6 x 90% = 3 x 10-6 event/RY
This is above the screening threshold given in Management Directive 6.4 (Appendix C, Figure C4), regardless of the initial LERF.
Other Considerations
As was the case with ice condenser containments, this generic estimate, the various CDFs and associated changes in LERF are based on a hybridization of several PRAs. Moreover, the estimates of the station blackout portion of the seismic and fire CDFs are, at best, educated guesses, and the fire contribution is the largest contributor. However, if the fire and seismic portions were not included, the ∆LERF would still be about 9.7 x 10-7 event/RY, very close to the cutoff of 10-6 event/RY.
If it is postulated that hydrogen combustion without igniters will result in containment failure 90% of the time, the robustness of the conclusion depends primarily on the SBO CDFs taken from the IPE submittals for the four plants, the assumption that about 13% will be non-recoverable blackouts, and an assumption that there will be at least a small contribution from external events. Even though there are many approximations in the estimates calculated above, these points seem reasonable.
Consequence Estimate
The MARK III containment has two air spaces, the drywell free volume and the wetwell airspace above the suppression pool. Combustible gases generated in the vessel prior to vessel breach may be vented by the safety/relief valves and tailpipes through the suppression pool to the wetwell airspace. After vessel breach, combustible gases may accumulate in the drywell airspace, and may be forced through the weir wall to the wetwell airspace. Combustion may occur in either airspace. Both airspaces are equipped with igniters.
In the NUREG-1150 Grand Gulf analysis, the automatic depressurization system is not operable in a station blackout, and the vessel remains at high pressure. Moreover, depressurization of the vessel would have allowed the operators to use the firewater system to inject coolant. Thus, in the sequences of interest here, the vessel is likely to remain at high pressure until failure occurs at the bottom head.
The drywell is generally stronger than the wetwell. In most, but not all, cases, overpressurization will fail the containment in the wetwell airspace, which will cause radioactive releases to pass through (and be scrubbed by) the suppression pool. The accident progression event trees and source term analyses must account for all of this. A complete description can be found in NUREG/CR-4551 (Volume 6, Rev. 1, Part 1).
To use the Grand Gulf model in the CRIC-ET code, the following assumptions were made:
11% of the generic internal SBO CDF frequency will be placed into PDS7 (non-recoverable fast blackout), and 2% will be placed into PDS8 (non-recoverable slow blackout), the proportions used in the Grand Gulf model.
The same 11%/2% split applies to the fire CDF frequency. Most dominant fire scenarios result in a plant transient, generally involving loss of electrical buses due to the fire (See NUREG/CR-4551, Volume 4, Rev. 1, Part 1, §3.3.2.3). There is no easy way to estimate the fraction of these which involve non-recoverable station blackouts, so the fractions used in the internal events analysis will be used.
All of the seismic sequences are slow, non-recoverable blackouts.
As in the calculation for the ice condenser containments, several other assumptions were necessary:
The other PDS frequencies were set to zero, so that the analysis would only include the non-recoverable station blackout plant damage states.
The sequences ending in no containment failure ("characteristic 6" in the Grand Gulf model - see NUREG/CR-4551 (Volume 6, Rev. 1, Part 1, Table 2.4-1) were re-directed to the "rupture before vessel breach" accident progression bin, to account for the assumed high susceptibility of the containment to fail due to hydrogen combustion. This is a slight overestimate, since the model presumed that the igniters were not available in PDS 7 and 8 in any case.
The results of the calculation of population dose within 50 miles per reactor, using 250 samples and the usual limited Latin Hypercube technique, were:
5th percentile 1.23 x 10-2 man-rem 95th percentile 1.35 man-rem Median 0.136 man-rem Mean 0.363 man-rem
Again, as is obvious from the distribution, the two decimal places are not significant and are given only for purposes of reproducing the calculation. The error bounds reflect only the uncertainty associated with the Level II analysis, and do not include the uncertainty associated with the generic station blackout frequency or split of this frequency into the non-recoverable fast and slow SBO plant damage states.
Generic Population Distribution: The man-rem/RY figure is based on the NUREG-1150 model which is specific to the Grand Gulf site. For generic issue calculations, such figures are generally based on a uniform population density of 340 persons/square-mile and a typical central Midwest plains meteorology. It is not currently practical to re-run the consequence analysis for the generic site, but as a first approximation, the risk figures can be re-normalized to the generic population. Interpolating between the 30- and 100-mile radius population figures given in NUREG/CR-4551 (Volume 6, Rev. 1, Part 1, Page 4.3) the Grand Gulf population density for a 50-mile radius is approximately 39.3 persons/square-mile, much less than the generic figure. Thus, to get a generic risk figure, the 0.363 man-rem/RY figure should be multiplied by 340/39.3, which gives a generic estimate of 3.14 man-rem/RY.
Aggregated Risk Figure: There are only four reactors with a MARK III containment. Thus, the aggregated risk figure is 3.14 man-rem/RY times 4 reactors or 12.6 man-rem/RY.
Screening Threshold: The screening threshold for averted offsite risk given in Management Directive 6.4 (Appendix C, Figure C6) is an averted offsite man-rem/year greater than 100, if the cost/benefit ratio is less than $2,000/man-rem. Thus, this criterion is not met for MARK III plants, regardless of cost.
Other Considerations
Hybrid Models: The split of the generic station blackout frequency into the fast and slow station blackout plant damage states, as described above, is questionable at best, since it is based on a hybridization of several PRAs. Because of this, a sensitivity analysis was done to investigate how big an effect this was. First, the entire station blackout frequency was assigned to the slow SBO PDS and a mean man-rem/RY was calculated. Then, the entire frequency was assigned to the fast SBO PDS, and the calculation repeated. The results were:
| Split | Mean Risk (man-rem/RY) |
|---|---|
| All in the slow SBO PDS | 0.386 |
| All in the fast SBO PDS | 0.341 |
| "Best guess" proportioned | 0.363 |
Based on these results, it seems safe to conclude that the results are not very sensitive to how the frequency is split between the two plant damage states.
Re-Direction of Sequences Ending in No Containment Failure: A sensitivity analysis was performed to test the re-direction of the sequences that did not result in containment failure in the original model into failure before vessel breach. As was stated previously, the original model should have already accounted for the unavailability of the hydrogen igniters, so this was expected to be a minor effect. The sensitivity analysis calculated a population risk of 0.360 man-rem instead of 0.363 man-rem, which confirms the expectation.
ERI Study: The ERI study estimated a risk of 1.3 man-rem/RY for Grand Gulf. This is roughly a factor of four larger than the estimate calculated here. In the context of PRA calculations, this is reasonable agreement. It should be noted that quadrupling the generic risk estimates would not change the conclusion.
ASSESSMENT
Based on the change in large early containment failure frequency (LERF) for both PWR ice condenser and BWR Mark III containment designs and on the change in risk (as measured by man-rem/ year) for the ice condenser designs, this issue passed the screening criteria and went on to the technical assessment stage.
The staff conducted studies to determine whether providing an independent power supply for the igniter systems provides a substantial increase in the overall protection of the public health and safety with implementation costs that are justified in view of the increased protection. 1791
The staff briefed the ACRS on June 6, 2002, and again on November 13, 2002. The ACRS recommended that the form of regulatory action should be through the plant-specific severe accident management guidelines.1902 RES provided its technical assessment for resolving GI-189 to NRR in a memorandum dated December 17, 2002.1903 RES concluded that further action to provide back-up to one train of igniters is warranted for both ice condenser and MARK III plants.
On January 30, 2003, NRR prepared a reply memorandum that outlined the next steps in the resolution of this GI. NRR prepared a Task Action Plan to complete MD 6.4, Stage 4, Regulation and Guidance Development, based on a preliminary decision to issue an Order. The staff reviewed the proposed regulatory actions and associated draft documents with senior management and OGC, and senior management decided to pursue Rulemaking rather than an Order. The staff held a public meeting on June 18, 2003,1904 to receive feedback from licensees and other stakeholders regarding the need to provide a backup power supply to the hydrogen igniters and NRR's consideration of rulemaking for the resolution of GI-189. NRR staff briefed the ACRS on November 6, 2003, and recommended providing a backup power supply to the hydrogen igniters. On November 17, 2003, the ACRS Chairman wrote the NRC Chairman recommending the NRC proceed with rulemaking to require a backup power supply to the hydrogen igniters for PWR ice-condenser and BWR MARK III plants.1905 The ACRS recommended that rulemaking include a small pre-staged generator with installed cables, conduit, panels, and breakers, or an equivalent diverse power supply. The ACRS also recommended that the rulemaking be accompanied by guidance that specifies the design requirements.
NRR developed design criteria for the backup power supply, and administered a contract to merge and enhance the existing technical assessment into a regulatory analysis.1906 NRR held a public meeting with the public and industry on September 21, 2004, 1907, 1908 to get external stakeholders' input on the draft design criteria. In November 2004, the staff reached a consensus to evaluate the proposed voluntary initiatives from stakeholders and pursue that path as a preferential solution. The NRR staff met with representatives of RES, NSIR, and OEDO to develop an understanding of newly identified safety/security interface issues and actions initiated in the security arena that could impact the solution of the issue. On March 30, 2005, the staff met with senior representatives of the six affected utilities to present security-related insights.
On June 14, 2005, the EDO issued a memorandum to the Commissioners to inform the Commission of the regulatory analysis results and recent staff activities on GSI-189.1909 The regulatory analysis indicated that the backup power modification may provide a substantial safety benefit at a justifiable cost for the PWRs with an ice-condenser containment, and the proposed voluntary actions provide the majority of the benefit. The costs exceed the benefits for all BWR regulatory options, and none of the options for the BWRs provides a substantial increase in the overall protection of public health and safety. However, external events and security insights were not fully evaluated in the regulatory analysis, and defense-in-depth considerations in improving the balance among accident prevention and mitigation provide an additional un-quantified benefit for both containment types.
STATUS:
Based on an understanding that many of the voluntary physical modifications had been completed, the staff elected to delay seeking specific commitments while security-related reviews of the facilities were ongoing. On March 1, 2006, the EDO issued a memo2125 informing the Commission of the staffs’ intent to delay the request for commitments until after the security-related reviews were completed in September 2006. Because this issue was not incorporated in the scope of security-related modifications, the staff has held closed meetings in December 2006 and January 2007 to further explore the proper consideration of security insights in the design of the modifications. The staff received industry proposals for modifications that incorporate security insights in late February and early March 2007. The staff reviewed the industry proposals and concluded that the proposed modifications would resolve GSI-189 and provide benefit for some security scenarios. On April 23, 2007, the EDO issued a memo2126 informing the Commission of the staff’s intent to accept the commitments and perform verification inspections at the affected sites. On June 15, 2007, the NRC staff issued letters 2127 2128 2129 2130 2131 2132 2133 to affected licensees accepting the commitments. The NRC staff also notified licensees of the intent to perform verification inspections at the affected sites and clarified the scope of the inspection relative to the commitments.
REFERENCES
|
