Resolution of Generic Safety Issues: Issue 197: Iodine Spiking Phenomena ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
This GI was proposed1860 in response to a concern raised by the ACRS in its May 21, 2004, report on the resolution of certain NUREG-17401861 items. The ACRS recommended that the staff develop a mechanistic understanding of iodine spiking phenomena so that analyses would reflect current plant operations and the capabilities of modern fuel rods to prevent coolant contamination.1862
To understand the safety (and possible burden reduction) significance of this GI, it is necessary to review the context within which it was raised. The ACRS and members of the staff had been discussing NUREG-1740.1861 One of the contentions raised in the differing professional opinion (DPO) was:
"The iodine spiking factor used for accident consequence analysis at plants with iodine coolant concentrations limited to less than 1.0 Ci/g and adopting the alternative repair criteria is too low."
The DPO author contended that the spiking factor used for the accident analyses would be too low if the TS limit on iodine concentrations in the coolant during normal operations were reduced. Some of the discussion at a preceding meeting of the ACRS Subcommittee on Materials & Metallurgy and Thermal-Hydraulic Phenomena centered on whether the existing approach to iodine spiking was sufficiently conservative to ensure that the 10 CFR Part 100 limits on dose to an individual at the exclusion area boundary would not be exceeded.
Discussion of the issue continued at the Full ACRS Committee meeting on May 23, 2004, during which time, the Committee members expressed dissatisfaction with the lack of a phenomenological understanding of iodine spiking, and the scatter in the existing data upon which empirical models are based. At this meeting, it was suggested that a risk-informed analysis might conclude that the potential risk would not justify expending further resources on this question, and perhaps the regulatory limits should be reexamined.
In its report,1862 the ACRS stated: "The staff continues to treat iodine spiking in a conservative, empirical fashion. We recommend that the staff develop a mechanistic understanding of iodine spiking so that analyses reflect current plant operations and the capabilities of modern fuel rods." The report went on to say, "The staff has not accepted our recommendation to develop a mechanistic understanding of the iodine spiking issue. The staff continues to use a conservative, empirical estimate of iodine spiking for accident consequence analyses. This estimate is based on historical data that may not reflect current practices in plant operations or the capabilities of modern fuels to prevent coolant contamination. We again encourage the staff to take advantage of iodine studies available in the literature and develop a mechanistic understanding of the phenomenon."
Thus, in this one ACRS meeting, two questions regarding iodine spiking were discussed. The first question was the DPO author's contention that the staff's current spiking criteria are not bounding. The second question was from some ACRS members, who expressed some concern that the current spiking criteria might be out of date and overly conservative.
The memo which proposed1860 this GI stated in its conclusion: "The ACRS recommendation for the development of a mechanistic understanding of iodine spiking phenomena is proposed by RES as a candidate GI. Consideration of the ACRS recommendation as a potential GI could result in studies of specific accident analysis scenarios and update of existing databases to improve safety or to reduce the burden on licensees."
Thus, this GI involves two questions: (1) Are the existing criteria sufficient to be bounding even for the DPO's proposed new accident scenario? and (2) Are the existing criteria overly conservative (and overly burdensome to a licensee) given the progress which has been made in fuel performance over the years? This GI was examined for both safety and burden reduction aspects.
1. SAFETY ASPECT
Safety Significance
This GI is related to GIs B-65, "Iodine Spiking," and 74, "Reactor Coolant Activity Limits for Operating Reactors." However, GI-197 differs in that it was proposed in the context of a different accident scenario.
The phenomenon of iodine spiking has long been observed in operating reactors. After a power or primary system pressure transient, the iodine concentration in the reactor coolant can rise to a value many times its equilibrium concentration level, followed by a gradual decay back down to a lower level. This is of concern in steam generator tube rupture (SGTR) events, where primary coolant leaks into the secondary system, and thereby escapes to the environment, either through the steam jet air ejectors on the main condenser, or via the atmospheric dump valves or secondary system safety valves.
To address this phenomenon, SRP11 Section 15.6.3 requires that the analysis of this accident assume an iodine spiking factor of 500. This spiking factor of 500 was chosen as a bounding factor for iodine spiking events. Specifically, the SRP11 requires the analysis of two cases of iodine spiking events. The first assumes that a reactor transient has occurred earlier, and an iodine spike is already underway when the SGTR occurs. Because the coolant iodine activity is monitored periodically, the analysis of this case is based on the maximum value of primary coolant iodine concentration allowed by the TS. The calculated whole-body and thyroid doses at the exclusion area and low population zone outer boundaries must not exceed the limits described in 10 CFR Part 100, Section 11.
The second case assumes that the reactor scram and primary system depressurization associated with the SGTR event itself cause an iodine spiking event. In this case, the analysis assumes that the release rate from the fuel rods to the primary coolant (i.e., Curies/second) increases to a value 500 times greater than the release rate corresponding to the iodine concentration at the equilibrium value in the TS. The calculated whole-body and thyroid doses at the exclusion area and low population zone outer boundaries for this case must not exceed 10% of the limits described in 10 CFR Part 100, Section 11.
The May 21, 2004 ACRS report1862 states: "The staff continues to treat iodine spiking in a conservative, empirical fashion. We recommend that the staff develop a mechanistic understanding of iodine spiking so that analyses reflect current plant operations and the capabilities of modern fuel rods." The safety significance of the phenomenon of iodine spiking has already been examined (in 1986) under GI B-65, "Iodine Spiking," which was given a low priority ranking based on very low safety significance. However, the GI B-65 analysis was based on a coincident small LOCA (for BWRs) or a coincident SGTR (for PWRs). An examination of the transcript for the 509th ACRS meeting, held on February 5, 2004, revealed that this new issue was raised in the context of a main steam line break accident (MSLB) that, in turn, causes one or more steam generator tubes to rupture. (See GIs 163, "Multiple Steam Generator Tube Rupture," and 188, "Steam Generator Tube Leaks/Ruptures Concurrent with Containment Bypass, From Breach of Main Steam or Feedwater Line.")
There have been a number of attempts to build mathematical models of iodine release, and fit them to empirically observed data. Some of these attempts are as follows:
- Onega, R. J., and Florian, R. J., "A Model of the Iodine Spiking Phenomenon Following a Power Change," Transactions of the American Nuclear Society, V. 44, pp 369-370, June, 1983.
- Ho, J. C., "Pressurized Water Reactor Iodine Spiking Behavior Under Power Transient Conditions," International Topical Meeting on Nuclear Thermal Hydraulics, Operations, and Safety, Taipei, Taiwan, 1984.
- Lin, C. C., "Radiochemistry in Nuclear Power Reactors," NAS-NS-3119, National Academy Press, Washington, D.C., 1996.
- Lewis, B. J., Iglesias, F. C., Postma, A. K., and Steininger, D. A., "Iodine Spiking Model for Pressurized Water Reactors," Journal of Nuclear Materials, V. 2444, pp 153-167, 1997.
- Lutz, R.J., and Chubb, W., "Iodine Spiking - Cause and Effect," Transactions of the American Nuclear Society - 1978 Annual Meeting," V. 28, pp 649-650, June 1978.
- Neeb, K.H., and Schuster, E., "Iodine Spiking in PWRs: Origin and General Behavior," Transactions of the American Nuclear Society - 1978 Annual Meeting," V. 28, pp 650-651, June 1978.
- Caruthers, G.F., and Gritz, R.W., "Radioiodine Behavior During a Steam Generator Tube Rupture Accident," Transactions of the American Nuclear Society - 1978 Annual Meeting," V. 28, pp 653-654, June 1978.
These models are all built on an assumed physical causative model of a fuel pin with a defect. During power operation, iodine collects on the surfaces of the fuel pellets and internal cladding surface, probably as cesium iodide or some other water-soluble salt. However, during operation, the internal free volume of the fuel pin is steam-blanketed, and relatively little iodine is transported out of the pin. If the reactor is shut down, or if power is significantly reduced in a power transient, liquid water will enter the gap volume, dissolving any soluble iodine compounds, which then can readily diffuse out of the cladding. Similarly, a pressure transient could force liquid water in or out of the defected fuel pin, thereby transporting iodine into the bulk primary coolant.
It should be noted that, if there were no cladding defects in the core, according to this model the specific activity of iodine in the cladding would drop to zero, under both equilibrium and non-equilibrium conditions. The presence of "tramp" uranium, i.e., traces of uranium on the outside of the cladding left over from manufacture of the fuel, complicates the model. Iodine produced from fissioning of tramp uranium would not be expected to contribute to spiking, since it is already outside of the cladding, but would contribute to the equilibrium specific activity in the coolant.
Unfortunately, there do not seem to be any readily-available experimental verifications of this causative model, i.e., controlled experiments on individual fuel pins in a laboratory setting. The models mentioned above involve comparisons with data from historical events. As the ACRS suggested, a better understanding of the actual physical processes could lead to new strategies to suppress iodine spiking, or more sophisticated TS to address this phenomenon.
In this context, there are two aspects to the safety significance of this issue. First, as stated above, this issue was raised in the context of a main steam line break which causes one or more steam generator tubes to rupture. Such an event would cause a reactor scram (which would allow liquid water ingress in any defected fuel pins) followed by a cooldown and depressurization (which would tend to assist the transport of dissolved iodine compounds out of the defected fuel pins and into the primary coolant). Moreover, the combination of tube rupture and main steam line break provides a means for release of the contaminated coolant to the atmosphere, bypassing the containment.
Second, the current safety analyses are based on a limit in the TS on iodine concentration in the primary coolant, and a conservative fuel release rate multiplier (spiking factor), to calculate an upper bound to the maximum concentration after a transient. In the absence of a detailed understanding of the physical phenomena involved in iodine spiking, there is little basis to assume that the peak iodine concentration is a function of the equilibrium concentration. Therefore, reducing the "initial condition" iodine concentration by decreasing the limit in the TS may or may not proportionally reduce the peak concentration. Some experimental investigation of this has been reported. (Brutschy, F.J., Hills, C.R., Horton, N.R., and Levine, A.J., "Behavior of Iodine in Reactor Water During Plant Shutdown and Startup," NEDO-10585, August 1972.)
Possible Solution
There is no explicit solution identified for this issue. Instead, the ACRS discussions cited above recommended performing basic research to better understand the iodine spiking phenomenon, and the iodine transport processes which cause it. Once a better scientific understanding is achieved, it might be possible to devise a more sophisticated means to prevent, mitigate, or accommodate iodine spiking.
SCREENING ANALYSIS
Iodine Spiking Phenomena: As was discussed above, an iodine spike can be initiated by a power or pressure transient. Once the iodine is present in the bulk coolant, it's concentration will be a function of the release rate from any leaking fuel pins balanced against removal by radioactive decay (approximately an 8-day half life for I-131, less for the other excess-neutron iodine isotopes) and removal by the reactor water cleanup system.
Let A = total I-131 activity in the coolant (in Curies)
R = Iodine release rate from the reactor fuel pins to the coolant (Ci/hour, total for the whole core)
t = total removal rate (hour-1)
Then, during normal operation,
The removal rate consists of two terms:
The two terms in the removal rate (t) are d, the removal rate due to radioactive decay, and p, the removal rate due to purification (in the reactor water cleanup system).
The removal rate due to radioactive decay is just the disintegration constant, and can easily be calculated from the half life, which is 8.02 days for I-131. This works out to
d = 3.60E-3/hour. About 0.36% of the I-131 decays away every hour.
The removal rate due to the reactor water cleanup system is also readily calculated. It is given by:
where F = Flow through the reactor water cleanup system
M = RCS coolant inventory mass
DF = Decontamination factor in the cleanup system
These parameters can all be estimated from data given in the PWR training manual.
F = 75 gpm, the flow through the letdown orifice. At 550F, this is 28,097 lb/hour, which is 12,745 kg/hour, or 1.2745E7grams/hour. (At a temperature of 550F and pressure of 2000 psi, the specific volume of liquid water is 0.02141 ft3/lb.)
M = Total mass of RCS coolant, at operating conditions. The system liquid volume is 11,892 cubic feet (including the pressurizer). At 550F, this is 555441 lb, or 2.52E8 grams.
DF = The design decontamination factor is 10, i.e., 90% removal efficiency.
Then, p = 0.04552/hour. In other words, about 4.6% of the iodine is removed by the cleanup system every hour.
Note that, for I-131, the removal rate due to radioactive decay is less than one tenth of that due to coolant purification.
t = d + p = 0.04912 /hour.
Now consider equilibrium full-power conditions. The time derivative is zero:
Therefore, 
where A0 is the equilibrium activity in the coolant and R0 is the equilibrium release rate from the fuel. If the specific activity is at the 1.0 Ci/g TS limit, and the total mass of coolant is 2.52E8 grams, A0 is 252 Curies, and R0 is 12.38 Curies/hour.
The normal licensing assumption is to assume that, in the event of a transient, the release rate increases by a factor of 500 and the removal rate drops to zero. The activity then rises linearly from A0 to higher and higher values for the duration of the event (usually eight hours). Note that this licensing assumption does not lead to a "spike;" instead it assumes that the iodine released from the fuel is inexhaustible and all removal mechanisms stop, so the activity increases monotonically until the event is terminated. This is intended to bound any real iodine spike. Using the numbers developed above, the activity would rise to approximately 50,000 Ci, which in a coolant mass of 2.52E8 grams gives a specific activity of approximately 200 Ci/g for a bounding value.
To put this conservative model into perspective, it is worthwhile to examine some actual experience. The iodine spiking phenomenon has been the subject of several studies which have examined historical data:
- Lin, C. C., "Radiochemistry in Nuclear Power Reactors," NAS-NS-3119, National Academy Press, Washington, D.C., 1996.
- Lewis, B. J., Iglesias, F. C., Postma, A. K., and Steininger, D. A., "Iodine Spiking Model for Pressurized Water Reactors," Journal of Nuclear Materials, V. 2444, pp. 153-167, 1997.
- Brutschy, F.J., Hills, C.R., Horton, N.R., and Levine, A.J., "Behavior of Iodine in Reactor Water During Plant Shutdown and Startup," NEDO-10585, August 1972.
- Adams, J.P., "Iodine Spiking Data from Commercial PWR Operations," EG&G-NERD-8395, February 1989.
- Adams, J.P., and Atwood, C.L., "Probability of the Iodine Spike Release Rate During an SGTR," Transactions of the American Nuclear Society, V. 61, pp. 239-240, June 1990.
- Adams, J.P., and Sattison, M.B., "Frequency and Consequences Associated with a Steam Generator Tube Rupture Event," Nuclear Technology, V. 90, pp. 168-185, May 1990.
- Adams, J.P., and Atwood, C.L., "The Iodine Spike Release Rate During a Steam Generator Tube Rupture," Nuclear Technology, V. 94, pp. 361-371, June 1991.
- Pasedag, W.F., "Iodine Spiking in BWR and PWR Coolant Systems," Paper presented at the ANS Thermal Reactor Safety Meeting, Sun Valley, ID, CONF-770708, 1977.
The "spike" is not symmetrical. In general, the iodine activity in the coolant climbs rapidly after the initiating transient, reaching a maximum in four to five hours. By 10 hours, the activity is dropping, but it is still elevated at 30 hours. Most of the papers in the literature do not list much data at times greater than 30 hours, but there is some indication that the spike is not effectively "over" until 30 to 40 hours have elapsed (Lewis, B. J., Iglesias, F. C., Postma, A. K., and Steininger, D. A., "Iodine Spiking Model for Pressurized Water Reactors," Journal of Nuclear Materials, V. 2444, pp 153-167, 1997). This is consistent with the assumption that the rise is governed by the transport of iodine out of leaking fuel pins, but the fall is governed by removal of iodine via the reactor water cleanup system and radioactive decay. Individual events will vary from these general observations, since the size and number of cladding defects will vary, and the specific cleanup systems will vary. Moreover, since a real transient at a real plant may involve power reductions, subsequent scrams, and/or multiple primary pressure changes, there may be a secondary peak in iodine coolant activity.
The "height" of the spike, meaning the maximum iodine coolant specific activity achieved during the course of the event, can vary widely. In the papers cited above which report historical data, the maximum activities tabulated are all less than 20 Ci/gm.
In a 1990 paper (Adams, J.P., and Atwood, C.L., "Probability of the Iodine Spike Release Rate During an SGTR," Transactions of the American Nuclear Society, V. 61, pp. 239-240, June 1990), data from 168 actual events were tabulated. To obtain some perspective on the historical experience, the data was scanned and loaded into a spreadsheet for some statistical analysis. The results are given in Table 3.197-1:
Table 3.197-1
| Measured steady-state iodine concentration before trip (Ci/g) | Maximum measured iodine 2 to 6 hours after trip (Ci/g) | R, iodine release rate based on bounded max iodine concentration & assumed 2 hour time from trip to max concentration (Ci/hour) | |
| Mean | 4.90E-02 | 7.57E-01 | 2.61E+02 |
| Median | 1.39E-02 | 1.91E-01 | 6.80E+01 |
| 95th percentile | 1.81E-01 | 3.25E+00 | 1.18E+03 |
| Maximum | 5.64E-01 | 1.44E+01 | 5.53E+03 |
It should be noted that these data are on plants with different rated powers & therefore different core sizes. Moreover, these events were not initiated by steam line breaks combined with SGTRs; they were initiated by milder transients. Finally, the maximum measured post-accident concentrations are not necessarily the peak concentrations, since the peak may not have occurred at the time the sample was taken. (To allow for this, the maximum measured concentrations were conservatively multiplied by a factor of three to get a "bounded maximum value," and this bounded value was used to calculate the release rates in the rightmost column.) Regarding the maximum measured values, it should be noted that 95% of the events were below 3.25 Ci/g.
Again, the licensing basis model gave a peak specific activity of 200 Ci/g, based on a conservative release rate of 6190 Ci/hour for eight hours. Thus, the model does indeed appear to be conservative.
Assumed Coolant Activity: The maxima discussed above are not directly applicable to this GI, since these events generally resulted from operational transients. This GI postulates a higher spike, which is initiated by a more severe, combined power and pressure transient.
As will be shown later, the event of interest realistically will last about two hours. Assuming a steam line break with tube rupture occurs, the question becomes, how high will the specific activity climb in two hours? The reactor water cleanup system will isolate, so the only removal will be by radioactive decay (which will be very little in two hours time) and by dilution (i.e., coolant lost to the secondary side of the steam generators, and replaced by injection flow). Credit for dilution is not being given in this analysis, so it will be assumed that essentially all the iodine released to the coolant stays there, and builds up linearly at the rate given by the post-initiation release rate from the core.
If the current licensing assumption (that R is multiplied by a factor of 500) is used, the rate of release from the fuel to the coolant is assumed to instantaneously rise from the equilibrium value of 12.38 Curies/hour to 500 times this, or 6190 Curies/hour. In two hours, and with no iodine removal, the coolant inventory will then acquire an additional 12,380 Curies of iodine. For a coolant mass of 2.52E+8 grams, this is an addition of about 49 Ci for each gram of coolant. Added to the initial specific activity of one Ci/g, the total specific activity two hours after the initiating event would be about 50 Ci/g. If the event continues on past two hours to eight hours after the initiating event (as in the conservative licensing basis), the specfic activity in the coolant would continue to rise linearly to approximately 200 Ci/g.
However, this GI postulates that the licensing assumption is not sufficient in the case of a more severe, combined power and pressure transient. For this analysis, an iodine spike of 1000 Ci/gm, will be assumed. No credit was taken for lower concentrations as the spike builds up; it was assumed that the coolant specific activity is 1000 Ci/gm for the entire duration of the transient. This should bound any credible spiking from the more severe accident implicit in this GI.
SGTR: The design basis assumption for a "classic" SGTR event is the spontaneous double-ended rupture of a single tube. According to the analysis used in the NUREG-11501081 PRAs, such a double-ended rupture corresponds to a primary-to-secondary leak that requires an equivalent makeup of 600 gpm, i.e., is equivalent in mass flow to 600 gpm of liquid water at room temperature.
Although a number of SGTR events have occurred in actual operational experience, relatively few events have even approached a leakage equivalent to 600 gpm (Adams, J.P., and Sattison, M.B., "Frequency and Consequences Associated with a Steam Generator Tube Rupture Event," Nuclear Technology, V. 90, pp. 168-185, May 1990). However, the experience with these "spontaneous" SGTR events is of limited applicability to this GI, since the issue postulates that a steam line break causes cracks to open up in the steam generator tubes, causing one or more significant leaks.
For a single tube rupture, 600 gpm would be considered to be bounding. Because this GI assumes that an initiating event, the steam line break, causes tubes to break, the assumption that only one tube breaks may not be valid - the pressure transient might cause a large number of tubes to leak, and the total leakage would not necessarily be bounded by the flow through a single-tube guillotine rupture. What flow rate can then be used as a "representative" flow rate for this GI? To answer this question, the accident sequence will be explored in more detail.
Accident Sequences
The accident sequences of interest are initiated by a break in a main steam line, accompanied by a SGTR. The course taken by the accident sequence depends on whether the break is located within or outside of containment, and upstream or downstream of the main steam isolation valve (MSIV). If the break is located inside of containment, any contamination will be confined to the interior of the containment. Moreover, the course of the transient will be very similar to that of a successfully-mitigated small break loss of coolant accident. Iodine spiking is not expected to result in any significant offsite doses for this sequence. Thus, this analysis will assume that the steam line break occurs outside of the containment. This leaves two possibilities, depending on whether the break is upstream or downstream of the MSIV.
For most plant designs, each main steam line is provided with an isolation valve (the MSIV) and possibly a check valve just outside the containment. The main steam piping up to these valves, and the structure enclosing the valves, are Seismic Category 1. Since there is a much longer length of piping downstream of the MSIV, and this piping is not seismically qualified, a steam line break is more probable in the downstream piping than in the relatively short length of piping between the containment penetration and the MSIV. However, the secondary side code safety valves, relief valves, and steam line for the turbine-driven auxiliary feedwater pump are normally connected to this section of piping upstream of the MSIV. Although a spontaneous pipe break in this section is unlikely, there has been at least one event where, during hot functional testing, a safety valve broke off its flange, resulting in an energetic, uncontrolled blowdown (See GI-188). Thus, this analysis will postulate breaks both upstream and downstream of the MSIV. (A thermal-hydraulic analysis of both accident sequences can be found in NUREG-0937.860)
Break Downstream of MSIV
When a steam line ruptures, the steam generator associated with that steam line will begin to blow down through the break. Steam flow will be limited to approximately 200% of normal, full power flow by the flow restrictors which are located near the exit of each steam generator. In addition, unless the plant is equipped with non-return valves in the steam lines, the other steam generators will similarly blow down, with steam flowing down the intact steam lines to the turbine steam header, then backwards to the break in the faulted line. As pressure falls in the secondary side of the steam generators, temperature also drops, resulting in a rapid cooldown of the primary system. The reactor will scram, the pressurizer level and pressure will drop, the MSIVs will close, and safety injection and aux feedwater will initiate. (According to the analysis in the Surry FSAR, this will take approximately 20 seconds.) At this point, the plant is in a safe condition, with decay heat being removed by the power-operated relief valves on the steam lines upstream of the MSIVs, with secondary side inventory being maintained by the aux feedwater system. The operator can then take manual control, using these PORVs to cool the system down to the point where the residual heat removal system can take the plant to cold shutdown. (Alternatively, if the plant is equipped with non-return valves in the steam lines, the operator may be able to open one or more MSIVs and use the main condenser bypass to remove thermal energy. If a rapid response is desired, the pressurizer PORV can be opened to reduce primary pressure.)
The situation changes somewhat if, as this GI would assume, the steam line break is accompanied by a SGTR or ruptures in the affected steam generator. The primary-to-secondary leak will transport primary coolant activity to the secondary side of the affected steam generator, resulting in an initial "puff" of activity through the broken steam line, terminating when the MSIVs close. After MSIV closure, pressure will rise in the secondary side of all the steam generators as the water inventory continues to boil, but will rise more rapidly in the steam generator with the primary-to-secondary leak. It is this steam generator which will reach the pressure setpoints first, and contaminated steam will be discharged through the relief and/or safety valves. This release will continue intermittently until the plant operator takes control. Once the faulted steam generator is identified, the operator will isolate feedwater to that generator, and manually use the relief valves on the good steam generators to cool the plant down. This will terminate the release.
The duration of the release is governed by the time it takes for the operator to identify the faulted steam generator, and the time needed to cool and depressurize the primary system to the point where the pressure in the faulted steam generator drops below its lowest safety valve and relief valve settings. Estimates of this time interval vary. The NUREG-11501081 PRA for Surry assumes 45 minutes for successful depressurization of the primary system, after a spontaneous SGTR.1318 However, an analysis of a stuck-open main steam line safety valve1475 assumed approximately two hours to reduce pressure to the point where RHR initiation was possible.
Neither of these is directly applicable, since the accident sequence of interest is a main steam line break accompanied by a consequent rupture of steam generator tubes. As Reference q, which analyzed such a sequence, points out, the operator will be responding to the main steam line break, and may not be immediately aware of the SGTRs. Although the response to a main steam line break would still call for the same response - depressurization and cooldown - there might not be the same degree of urgency if the operator were not aware of the tube ruptures. Of course, the tube ruptures will become evident from the behavior of the water level in the faulted steam generator, coincident with low aux feedwater flow and high radiation in the steam generator blowdown line. It will be assumed, based on judgment, that up to one hour will be required for the operator to initiate cooldown.
The time to cool down to the point where the secondary safety and relief valves close also does not appear in the literature. A rough estimate can be made by noting that the average coolant temperature in the reactor vessel at full power is 578.2F (from the PWR systems manual), and the lowest main steam safety valve setpoint is 1064 psig, which corresponds to 548.2F for saturated water conditions. This is a temperature difference of 30F, which, at a typical cooldown rate of 50F/hour would require roughly 36 minutes. Of course, the PORVs would be set at a lower pressure, so either the block valves would have to be closed or the cooldown would have to be continued to stop all release of steam from the faulted steam generator to the environment. Based on this admittedly rough calculation, it will be assumed that up to one hour after the initiation of cooldown will be needed to cool down to the point where the release is stopped. Thus, it will be assumed that, after the initial "puff," contaminated steam will be released for another two hours.
Frequency Estimate
The initiating event for this scenario is a break in the main steam lines after the MSIVs. Steam lines downstream of these isolation valves were not held to the same stringent requirements as were the primary system pipes when the plants were licensed, e.g., these pipes were not held to the same standards for withstanding seismic events. Thus, previous GI screenings have assumed a higher break frequency for this piping (See GIs A-21 and A-22). The pipe break frequency was estimated to be 10-3 break/RY.32
Since this frequency estimate dates back to 1976, and considerable experience has been gained in the intervening years, it is appropriate to examine the reasonableness of this number. As of December of 2004, collective domestic reactor experience stands at approximately 1845 PWR-years and 1005 BWR-years, giving a total of 2850 RY. These are calendar years, so the years of actual full-power operation would be 10% to 20% less than this number. Nevertheless, if the true frequency of pipe breaks downstream of the MSIVs were 10-3/RY, one would expect to see some actual events by now. Thus, it is unlikely that the true value is greater than 10-3.
Source Term
As was stated above, the release is expected to consist of two components - an initial release out the broken steam line as the steam generator blows down, and a longer term intermittent release out of the main steam relief valves. The initial release will be terminated when the MSIVs close (about 20 seconds, according to the Surry FSAR).
The design steam flow rate for a model F steam generator is 3.78 x 106 lbs/hour during normal operation. In the event of a steam line break, the steam flow would greatly increase as steam escaped to the atmosphere through the break, but the steam flow would be limited by the flow restrictors to approximately double this value. After about 20 seconds, the MSIV would be closed, terminating the release. This works out to a release of approximately 42,000 pounds of steam.
The specific activity (in Ci/g) in the escaping steam is problematic, since it depends on both the primary coolant specific activity, the primary to secondary leak rate, and the dilution in the secondary volume. Clearly, a low rate of primary to secondary leakage will result in a low release through the broken steam line. Conversely, if a large number of tubes were to rupture, the influx of primary coolant into the secondary volume, driven by a large differential pressure and at a somewhat higher temperature, would tend to increase secondary pressure (and thereby reduce boiling in the secondary water), and a large fraction of the escaping steam would result from flashing of the primary coolant. In the extreme case, if approximately 35 tubes were to rupture, each discharging 600 gpm of primary coolant, the mass influx would approximate the mass of steam being discharged out of the steam line.
For the purposes of this analysis, this extreme case will be assumed, that is, the steam escaping from the broken line will transport one millicurie of iodine per gram, the same specific activity as for the primary coolant, for 20 seconds. This works out to a release of approximately 19,000 Curies.
This initial release will be terminated by closure of the MSIVs. Primary coolant will continue to flow into the steam generator, but the flow rate will diminish as the pressure equalizes between the primary and secondary systems. The faulted steam generator will be at a higher pressure than the other steam generators, and, as decay heat continues to add thermal energy to the system, the secondary side safety valves associated with that steam generator will lift intermittently. Meanwhile, coolant will be supplied to the primary system by the high pressure ECCS. Depending on the coolant level and height of the tube breaks, there will either be boiling in the core, with steam escaping through the broken tubes, or, if there is sufficient coolant inventory in the primary system, heat will be transported by the coolant to the steam generator and cause boiling on the secondary side.
Although the secondary PORVs (or safety valves) will release steam intermittently as the valves cycle, the average steam flow out of these valves will be governed by the decay heat produced in the reactor core plus the energy added by the reactor coolant pumps, if they are still running. Ten minutes after the reactor scrams, decay heat is about 2.33% of full power, and will drop to about 1.15% by two hours after shutdown. For the purposes of this analysis, a constant core power of 2% will be assumed. It will also be assumed that the reactor coolant pumps remain running. These two assumptions, which will result in a slightly larger release, add a modest amount of conservatism. The various powers and flow rates can be estimated by a simple heat balance, as shown in Table 3.197-2.
The steam releases are well within the capacity of one safety valve (usually about 750,000 lbm/hr.). (The four PORVs generally can accommodate 10% of rated steam flow, i.e., 2.5% per PORV for a four-loop plant, which works out to 94,500 lbm/hr, so one PORV might not be quite sufficient to vent the steam at the beginning of the interval.) The matching injection flow requirement is within the capability of the high pressure ECCS, and the primary to secondary flow could be accommodated by just two completely ruptured tubes - more extensive tube ruptures will not increase the flow. This limiting, although somewhat artificial, situation has the primary-to-secondary leak acting as feedwater for the faulted steam generator. The primary-to-secondary flow is likely to overfill the secondary side of the steam generator, and the level control valves for the auxiliary feedwater system, if in automatic control, will close.860 Thus, there will be little or no dilution of the iodine activity in the water.
Table 3.197-2
| 2.33% (10 minutes after shutdown | 1.15% (2 hours after shutdown | 2% | |
| Decay heat (MWt) | 79.5 | 39 | 68 |
| Pump power (MW) | 14.94 | 14.94 | 14.94 |
| Total heat input (MWt) | 94.4 | 54 | 83 |
| Steam released (lbm/hour) | 280,000 | 161,000 | 247,000 |
| Primary to secondary flow, gpm of hot liquid | 768 | 440 | 675 |
| Required injection flow (gpm) | 563 | 322 | 495 |
It was assumed that the plant operator will identify the faulted steam line, shut off feedwater to the associated steam generator, and open the atmospheric dump valves in one or more of the other steam generators in order to reduce the temperature of the primary system and terminate the steam release out of the faulted steam generator. Once the primary system pressure drops below the setpoint of the secondary safety valves, the release of primary coolant activity will be terminated. Eventually, the primary system will be cooled down to the point where the residual heat removal system can be placed into service to bring the plant to cold shutdown.
Thus, the release during this two-hour "simmering" period would be approximately 247,000 lbs of contaminated steam. At the assumed specific activity of 1 millicurie/gram, this corresponds to a release of approximately 224,000 Curies.
Consequence Estimate
The consequences for the source term described above were estimated using the MACCS2 code and the standard site parameters for GI analysis. The analysis included Cs-134 and Cs-137 in addition to the iodine group (I-131, I-132, I-133, I-134, and I-135) because, if the iodine is deposited in the fuel in the form of a soluble salt, the cesium will "spike" along with the iodine. The results, for a 50-mile radius, were a mean population dose of approximately 4,600 person-rem, as shown in Table 3.197-3. (Results in this and in subsequent tables are given to three significant figures for the convenience of the reader who wishes to follow the calculations, and are not intended to imply that these parameters are known to this accuracy, as the percentile range given in the table itself clearly shows.)
Table 3.197-3
| Mean | Median | 95th percentile | |
| Total whole-body dose to 50 miles (person-rem) | 4580 | 4810 | 7380 |
| Thyroid dose to 50 miles (person-rem) | 78700 | 78700 | 143000 |
| Whole-body dose at site boundary (rem) | 3.89 | 0.372 | 12.8 |
| Thyroid dose at site boundary (rem) | 61.4 | 2.36 | 208 |
Break Upstream of MSIV
As in the previous sequence, the steam generator associated with the steam line will blow down. Steam flow will be limited to approximately 200% of that corresponding to normal, full power flow by the flow restrictors which are located near the exit of each steam generator. As before, unless the plant is equipped with non-return valves in the steam lines, the other steam generators will similarly blow down, with steam flowing down the intact steam lines to the turbine steam header, then backwards to the break in the faulted line. As pressure falls in the secondary side of the steam generators, temperature also drops, resulting in a rapid cooldown of the primary system. The reactor will scram, the pressurizer level and pressure will drop, the MSIVs will close, and safety injection and aux feedwater will initiate. This will terminate the flow from the good steam generators. However, unlike the previous scenario, in this sequence the steam generator associated with the faulted steam line will continue to blow down all the way to atmospheric pressure.
This time, the operator cannot immediately use the other steam generators to remove decay heat. The blowdown of the steam generator associated with the faulted steam line will cause a significant cooldown and pressure drop in the primary system. The other steam generators will actually be at a higher temperature than that of the primary system, and would have to be blown down to atmospheric pressure in order to "compete" with the faulted steam generator.
If there were no SGTR, the operator could take control by isolating all feedwater to the faulted generator. After boiloff of the remaining liquid water inventory ("dryout") in the faulted steam generator, heat removal via that steam generator would stop, and the primary system would heat up to the point where the other steam generators could remove heat. Eventually, the operator would cool the system down by means of the intact steam generators and depressurize to the point where the RHR system could be put in service.
However, the presence of a primary-to-secondary leak can complicate the matter. Because the steam line is open between the containment wall and the MSIV, the primary coolant escaping via the ruptured steam generator tube(s) cannot be isolated. The activity will be released to the environment via the broken steam line, and the release will not stop until the primary system is cooled to below 212F and depressurized. If the leak through the ruptured steam generator tube is large enough, sufficient mass and energy may be lost from the primary system to assist in the necessary cooldown and depressurization. However, the escaping primary coolant will be lost to the atmosphere, and not be recoverable to the containment sump. This is not of concern for the purposes of this GI, since it would lead to a core melt scenario where the question of iodine spiking would be moot. Instead, such a core-melt scenario would be within the scope of GI-188.
Frequency Estimate
As was discussed earlier, the steam lines upstream of the MSIVs, and the structure enclosing the valves, are Seismic Category 1. Historically, PRAs have used a break frequency of 10-4 pipe break/RY, total, for all of the large piping of this quality in the plant. In this case, the relevant piping is a relatively short length running from the containment wall to the MSIVs. Thus, the normal assumption would be that the frequency of a large break in this area would be a fairly small fraction (up to 10%) of the "total" large-break frequency of 10-4 break/RY.
However, as was discussed previously, there has been at least one event where, during hot functional testing (not power operation), a safety valve broke off its flange, resulting in an energetic, uncontrolled blowdown (See GI-188). The event was apparently caused by a design error, in that the valve mounting was designed adequately for the pressure loading, but was not sufficient to accommodate the reaction forces when the valve was discharging steam. Thus, the relevance of this event can be debated - presumably the design error has been corrected.
As was discussed previously, collective domestic reactor experience stands at approximately 1845 PWR-years and 1005 BWR-years, giving a total of 2850 RY. If the safety valve event were a random, uncorrected failure, this would imply a frequency of about 3.5E-4 event/RY. Conversely, if the event were assumed to be completely corrected, the normal PRA assumption would be a random break frequency of 10-5 event/RY. Based purely on judgment, this analysis will assume a frequency of 10-4 break/RY.
Source Term
For this sequence, the initial "puff" will not be terminated by MSIV closure, but instead will continue until the steam generator approaches atmospheric pressure. The duration of this blowdown, and the activity released during this interval, will be governed by the degree of primary-to-secondary leakage. Because the underlying assumption of this GI is that the steam line break causes more extensive damage to the steam generator tubes, it is necessary to assume that more than one SGTRs. For this analysis, it will be assumed that five tubes completely rupture, for the pragmatic reason that NUREG-0937860 provides a thermal-hydraulic analysis for an event where this many tubes rupture. (It will be shown later that, under this assumption, this initial blowdown contributes roughly 20% of the total activity released. Thus, the final result will not be overly sensitive to this assumption.)
Following the analysis in NUREG-0937,860 the blowdown is largely over after about 180 seconds (three minutes). At 200% steam flow, this is about 378,000 pounds of steam. (This is somewhat conservative, since in reality the flow would taper off as the pressure dropped.) The secondary water volume is about 84,000 pounds, so most of this would be primary coolant plus whatever the aux feedwater system can add during this interval. At one millicurie/gram in the primary coolant, this would be a release of about 133,000 Curies of radioiodine.
Once the faulted steam generator reaches atmospheric pressure, steam will continue to be generated, either in the primary system or in the steam generator, with the steaming rate governed by the decay heat being generated in the reactor core. (It can be safely assumed that the reactor coolant pumps will not be running at these lower pressures.) As discussed above, it will be assumed that this situation will continue for the next eight hours.
The decay heat (assuming 18 months of full power operation) will drop significantly over this interval, as shown in Table 3.197-4. As the table shows, the heat generation will drop by about a factor of three over this interval. In order to model this more realistically, this eight-hour "simmering" period will be divided into two intervals, consisting of a two-hour interval at 2% power, and a six-hour interval at 1% power. During the two-hour interval, the steaming rate corresponding to 2% power (68 MWt) is about 210,000 lb/hr. At one millicurie/gram, this is a release of 191,000 Curies. During the six-hour interval, the steaming rate corresponding to 1% power (34 MWt) is about 105,000 lb/hr. This would release about 286,000 Curies.
Consequence Estimate
As before, the consequences for the source term described above were estimated using the MACCS2 code and the standard site parameters for GI analysis. The results are given in Table 3.197-5.
Table 3.197-4
| Time after shutdown | Percent of full power |
|---|---|
| 10 minutes | 2.33% |
| 30 minutes | 1.82% |
| 1 hour | 1.51% |
| 2 hours | 1.15% |
| 4 hours | 0.965% |
| 6 hours | 0.857% |
| 8 hours | 0.778% |
Table 3.197-5
| Mean | Median | 95th percentile | |
| Total whole-body dose to 50 miles (person-rem) | 10800 | 10000 | 19000 |
| Thyroid dose to 50 miles (person-rem) | 191000 | 163000 | 333000 |
| Whole-body dose at site boundary (rem) | 8.41 | 7.61 | 22.3 |
| Thyroid dose at site boundary (rem) | 260 | 255 | 709 |
(Again, the results in this table are given to three significant figures for the convenience of the reader who wishes to follow the calculations, and are not intended to imply that these parameters are known to this accuracy, as the percentile range given in the table itself clearly shows.)
Risk Assessment
The risk for each sequence is estimated simply by multiplying the frequency of the sequence by the consequences of that same sequence, to get a point estimate, as shown in Table 3.197-6. Again, the estimates are given to two significant figures to aid in following the calculations. It should be noted that the frequencies are uncertain to a factor of ten, but the consequences are uncertain to approximately a factor of two. Therefore, the uncertainty in the risk will be dominated by the uncertainty in the frequency.
Table 3.197-6
| Sequence | Frequency | Risk (person-rem/RY
whole-body) | Risk (person-rem/RY
thyroid) |
|---|---|---|---|
| Main steam line break, downstream from MSIV | 10-3 event/RY | 4.6 | 79 |
| Main steam line break, upstream from MSIV | 10-4 event/RY | 1.1 | 19 |
Nevertheless, the frequency and consequence estimates were combined to form a risk estimate using the SAPHIRE code package, to better estimate the uncertainties. The frequencies were assumed to be lognormal, uncertain to a factor of 10. The consequence figures used the results of the MACCS code. However, this analysis is bounding in the sense that the other parameters, e.g., the timing intervals and the iodine concentration in the primary coolant, were bounding values and not included in the uncertainty analysis. The results are shown in Table 3.197-7:
Table 3.197-7
| Sequence | Mean | Median | 5th percentile | 95th percentile | |
|---|---|---|---|---|---|
| Main steam line break downstream of MSIV | Total, whole-body person-rem/RY | 4.6 | 1.6 | 0.15 | 18 |
| Person-rem/RY, thyroid | 79 | 27 | 2.3 | 313 | |
| Main steam line break upstream of MSIV | Total, whole-body person-rem/RY | 1.1 | .37 | 0.032 | 4.4 |
| Person-rem/RY, thyroid | 20 | 6.6 | 0.57 | 77 | |
| Combined, both MSLB sequences | Total, whole-body person-rem/RY | 5.7 | 2.6 | 0.41 | 20 |
| Person-rem/RY, thyroid | 97 | 44 | 6.8 | 339 | |
In order to interpret these estimates, it should be noted that the screening criteria given in Management Directive (MD) 6.4 are based on total whole-body person-rem. However, the radiological doses calculated above are caused by radioactive iodine, which will be primarily a dose to the thyroid gland. A thyroid dose will not have the same health consequences as those of a whole-body dose, and therefore these calculated thyroid doses are not directly comparable to the screening criteria for GIs.
This problem was previously encountered in the screening of GI-III.A.1.3, "Maintain Supplies of Thyroid Blocking Agent (Potassium Iodide)," where PNL considered the differing health effects and the relatively high cure rate for thyroid dose, and recommended that the thyroid dose be reduced by a factor of 100 to be comparable to other risk analyses.
If the iodine dose is reduced by a factor of 100, in accordance with the method developed in GI-III.A.1.3, these risk estimates are well below the 100 person-rem per/RY threshold given in MD 6.4.
Cost Estimate
Because of the low risk, a cost estimate will not affect the conclusions of this analysis of this aspect. Therefore, no cost analysis was performed.
Other Considerations
Dilution of Coolant Activity in the Secondary System Liquid Inventory: Except for the initial blowdown in the non-isolatable break sequence (where the steam generator dries out), no credit was taken for dilution of the primary coolant by the liquid water in the secondary system. This was because the leaking primary coolant will be injected in the tube region, rather than through a feedwater sparger, and thus will emerge just below the steam separators. Moreover, the incoming primary coolant will likely be at a higher temperature than the surrounding secondary liquid, much of it will immediately flash to steam. Thus, dilution in the secondary liquid is not likely to be a significant mitigating factor.
Dilution of Coolant Activity in the Steam Space of the Secondary System: The secondary side steam volume is approximately 4030 cubic feet. Both accident sequences begin with a steam flow of approximately double the rated steam flow, which is 3.2E6 cubic feet/hour. At such flows, the time constant associated with the steam volume works out to about five seconds. This can make a modest difference for the 20-second "puff" in the first accident sequence, and thus is a source of some conservatism.
Hold-up Time in the Secondary System: The half life of I-131 is 8.02 days. Thus, hold-up time will not be a significant factor for this GI, which will last eight hours in the longest sequence.
Reduction in Specific Activity: Once the primary pressure drops and high pressure injection begins, the reactor water cleanup system will isolate, and removal of radioiodine by this system will stop. However, as the fuel pins equilibrate with the surrounding primary coolant, a point will come where no more iodine will be leached from the pins, and, as primary coolant escapes through the ruptured steam generator tubes and is replaced by ECCS water, the specific activity of the coolant in the primary system will diminish because of dilution.
The primary system liquid volume (according to the PWR training manual) is 11,892 cubic feet, including the pressurizer liquid volume and surge line. If the ECCS injection rate is 600 gpm (80.2 cubic feet/minute), the dilution time constant will be on the order of 150 minutes. This will be even longer if the operator throttles back the injection flow, as is likely to happen in the 8-hour sequence. Thus, neglecting this dilution does introduce modest amount of conservatism.
Time to Termination of the Event by Operator Action: An explicit analysis of the response of the operator, based on symptom-based procedures, has not been performed. Instead, the two-hour and eight-hour event durations were intended to envelope the total time needed.
Primary-to-secondary Leakage Rate: Except for the assumption of five ruptured tubes during the blowdown in the non-isolatable break sequence, the analysis assumes that the release rate to the atmosphere is limited by the safety and relief valve capacities and/or the steaming rate associated with decay heat. This is a conservative assumption, but it is also the postulated mechanism for this GI. Thus, the risk values given in this analysis should be understood as being contingent upon the reality of this assumption - that a steam line break will cause a major rupture of steam generator tubes.
B&W Plants: The numbers used above (system volumes and flow capacities) are reasonably typical for Westinghouse and Combustion Engineering systems. In contrast, the Babcock and Wilcox designs have a far lower secondary side volume in their steam generators. This is not likely to affect any conclusions, since no credit has been taken for dilution or holdup in this volume.
Should GI B-65 be Reexamined?: GI B-65, "Iodine Spiking," was concerned with the effects of iodine spiking after a spontaneous SGTR event in a PWR, or a steam line break in a BWR. It was given a "drop" priority based on a very low risk significance as estimated by an analysis performed in 1986. Should this issue be reexamined, at least for PWRs, assuming a larger spike?
The older analysis used a SGTR event frequency of 1.3E-3/RY and a spiking factor of 500, but based the spike on a "realistic" coolant specific activity, rather than on the TS limit of 1.0 Ci/g, which resulted in a peak specific activity of 60 Ci/g. More SGTR data has been accumulated since 1986. Regarding the frequency, several sources exist, as shown in Table 3.197-8:
Table 3.197-8
| Original B-65 analysis (1986) | 1.3E-3/RY | |
| Adams, J.P., and Sattison, M.B., "Frequency and Consequences Associated with a Steam Generator Tube Rupture Event," Nuclear Technology, V. 90, pp. 168-185 (May 1990) | 8E-3/RY | |
| NUREG-17401861 (2001) | 9 domestic events in 1615 domestic PWR-years | 5.6E-3/RY |
This analysis will use the Adams and Sattison frequency from the table above, which is based on an extensive data base.
The source term (for a primary coolant specific activity of one millicurie/gram, which is much higher than would be used in a standard SGTR analysis) is just the source term for the main steam line break downstream of the MSIV, but without the initial "puff" before the MSIV closes. The consequences for this sequence were estimated using the MACCS2 code. The results are shown in Table 3.197-9:
Table 3.197-9
| Mean | Median | 95th percentile | |
| Total whole-body dose to 50 miles (person-rem) | 4,940 | 5,220 | 8650 |
| Thyroid dose to 50 miles (person-rem) | 85,400 | 86,900 | 154,000 |
| Whole-body dose at site boundary (rem) | 4.26 | 0.365 | 13.1 |
| Thyroid dose at site boundary (rem) | 68.2 | 2.33 | 217 |
(Results in this and in subsequent tables are given to three significant figures for the convenience of the reader who wishes to follow the calculations, and are not intended to imply that these parameters are known to this accuracy, as the percentile range given in the table itself clearly shows.) Thus, the point estimate risk associated with this spontaneous SGTR sequence is approximately as shown in Table 3.197-10:
Table 3.197-10
| Sequence | Frequency | Risk (person-rem/RY
whole-body) | Risk (person-rem/RY
thyroid) |
|---|---|---|---|
| Spontaneous SGTR | 8 x 10-3event/RY | 40 | 683 |
Again, an error analysis was performed to better quantify the uncertainties, as with the earlier sequences. The results are shown in Table 3.197-11.
This is significantly greater than the risk associated with the MSLB-initiated sequences evaluated earlier. However, these estimates assume a primary coolant activity of one millicurie per gram, and a major primary-to-secondary leak. Although it may be plausible for a SGTR caused by a main steam line break to cause a more severe iodine spike, actual SGTR events have never caused such a severe spike. Thus, these numbers are highly conservative, and should be viewed with appropriate caution. Nevertheless, if the iodine dose is reduced by a factor of 100, in accordance with the method developed in GI-III.A.1.3, these risk estimates are still below the 100 person-rem/RY threshold given in MD 6.4. Therefore, reopening GI B-65 does not appear to be warranted.
Table 3.197-11
| Spontaneous SGTR Sequence | Mean | Median | 5th percentile | 95th percentile |
|---|---|---|---|---|
| Total, whole-body person-rem | 40 | 14 | 1.2 | 156 |
| Person-rem/RY, thyroid | 680 | 230 | 20 | 2600 |
Consequential Fuel Failures: The analysis above is based entirely on iodine spiking caused by cladding defects already existing in the core. It does not include iodine released from fuel which may have experienced DNB-induced cladding failure in the course of the accident sequence, which involves rapid depressurization and possibly the interruption of forced circulation. This extra iodine was not included because the iodine released from fuel because of DNB failures will not be affected by TS limits on existing iodine concentration, nor will it be affected by a better phenomenological understanding of iodine spiking. Moreover, the radiological analysis of transients involving DNB is based on release of gap activity with no spiking model. DNB-induced releases are outside of the scope of this issue. Nevertheless, the possibility was explored. For the sequence initiated by a main steam line break downstream of the MSIV, DNB failures do not appear to be credible. The MSIVs will close (and cause the reactor to scram) well before pressure drops to saturation. Ultimately, pressure cannot drop below the pressure in the secondary system, which will be near the secondary safety valve setpoints.
DNB is more credible for the sequence where main steam line breaks upstream of its MSIV. However, unless a very large number of steam generator tubes fail, the primary system pressure will be very close to that of a standard MSLB event. A number of licensing basis MSLB analyses were examined, covering a spectrum of Westinghouse, Combustion Engineering, and Babcock and Wilcox designs. None of these analyses predicted DNB-induced fuel failure.
Thyroid Dose vs. Total Whole-Body Dose: In converting the thyroid dose into an equivalent total whole-body dose to compare to the screening criteria, a method developed by PNL in the analysis of GI-III.A.1.3, "Maintain Supplies of Thyroid Blocking Agent (Potassium Iodide)," was used. The PNL method considered both the differing health effects and the relatively high cure rate for thyroid disease, and recommended that the thyroid dose be reduced by a factor of 100 to be comparable to other risk analyses.
In contrast to this, the organ dose weighting factor for the thyroid in 10 CFR 20.1004 is 0.03, rather than the factor of 0.01 that is implied by the PNL rationale. Use of this weighting factor would increase the risk estimates developed above, but the results would still be below the screening criteria, and thus there would be no change in any conclusions.
CONCLUSION
Because of the low risk significance of this aspect of the issue, this issue should not be continued as a safety issue. There is no evidence that the current regulatory approach is not bounding, even in the event of a combined main steam line break and SGTR. The current regulatory approach to iodine spiking, in spite of its empirical nature, is adequate.
2. BURDEN REDUCTION ASPECT
As was brought out in the ACRS members' discussion, the current regulatory treatment of iodine spiking appears to be quite conservative when viewed from the aspect of public risk. It follows very naturally to ask if perhaps the current treatment could be relaxed if there were a better understanding of the actual physical and chemical phenomena involved in iodine spiking.
The current criteria are based on standard licensing practice: a conservative, bounding calculation, with the results evaluated against acceptance criteria. In this case, the acceptance criteria are given by 10 CFR 100, "Reactor Site Criteria," Section 11, "Determination of Exclusion Area, Low Population Zone, and Population Center Distance." This regulation requires that the exclusion area size be large enough that "an individual located at any point on its boundary for two hours immediately following the onset of the postulated fission product release would not receive a total radiation dose to the whole body in excess of 25 rem or a total radiation dose of 300 rem to the thyroid from iodine exposure." A footnote to this section goes on to explain that these doses correspond to allowable once-in-a-lifetime accidental exposures for radiation workers, but that these limits are not intended to imply that such doses are permissible for members of the public, but instead are to be used for evaluation "with respect to potential reactor accidents of exceedingly low probability of occurrence, and low risk of public exposure to radiation." SGTRs and even steam line breaks are not "exceedingly low" probability events, and this is presumably the reason the SRP11 requires these events to result in a "small fraction of the 10 CFR Part 100 Guidelines." (The SGTR SRP11 explicitly uses 10% for "small fraction.") The exception is the case of the pre-existing iodine spike, which is a lower-probability situation, and is held not to a small fraction, but the full limit.
In contrast to this, the GI screening criteria in MD 6.4 are based on CDF and LERF, neither of which are applicable to this GI, and public risk. This risk measure is not risk to the most-exposed individual, but instead is total public risk, summing the person-rem over the entire population from the exclusion area boundary out to a radius of 50 miles, and multiplying it by the event frequency to get person-rem/year. For burden reduction issue such as this, where no severe core damage accidents are involved, the only screening criterion is cost-effectiveness.
For any given accident scenario, a low public risk (per year, integrated out to a radius of 50 miles) usually implies a low individual exposure (i.e., per event, and to the most exposed individual, generally located at the exclusion area boundary). However, it should be noted that these are two separate criteria. Although a low public risk may justify investigation into the possibility of burden reduction, the limits on dose to the most exposed individual must still be met.
The licensing model, as was discussed previously, does not yield a "spike," where the iodine activity rises to a peak and then falls off. Instead, the model assumes that the removal processes stop, and iodine activity builds up linearly for the assumed 8-hour duration of the event. This is not as conservative as it might first appear. The dominant removal mechanism is likely to be via the primary coolant cleanup system, which might well isolate during the course of the accident, leaving only radioactive decay as a removal mechanism. Other assumptions in the SRP11 (e.g., on iodine transport, primary-to-secondary leak rates, etc.) do not appear to be excessively conservative.
The primary candidate for any excessive conservatism is then in the factor of 500 multiplier on the iodine release rate from the fuel. According to the historical data compiled by Adams and Atwood (see table in previous section), the maximum observed release rate was 5.53E3 Ci/hour, and the 95th percentile was 1.18E3 Ci/hour. (Both of these figures have already been increased by a factor of three to allow for the fact that the activity may not have been measured at the peak of the spike.) If these two figures are divided by the "typical" equilibrium release rate of 12.38 Ci/hour (corresponding to a specific activity at the 1 Ci/gram limit), the results are multipliers of 447 (maximum ever) and 95 (95th percentile), respectively. Thus, the factor of 500 does appear to be more than bounding. Moreover, in reality the release rate is not likely to remain constant, but would be expected to fall off with time as the inventory of available soluble iodine compounds in the fuel decreases.
It should be noted that the Regulatory Guide 1.183,1865 which provides guidance on acceptable applications of alternative source terms, uses a multiplier of 335 rather than 500. Another approach1866 suggested that, instead of using bounding assumptions, an integrated probabilistic analysis be used for the SGTR and MSLB evaluations, and that the acceptance criterion be that the probability of exceeding the 300 rem thyroid dose be small (e.g., 1%).
Burden Reduction Significance
As was stated above, the accident and transient analyses upon which a plant's TS are based must assume both a pre-existing iodine spike and an iodine spike induced by the accident or transient being analyzed. The calculated radiological consequences must be less than the 10 CFR Part 100 guidelines, (for the pre-existing spike), or 10% of the 10 CFR Part 100 guidelines (for the induced spike). The 10 CFR Part 100 guidelines, in effect, limit the dose to a hypothetical individual located just outside the exclusion area boundary to 300 rem to the thyroid from iodine exposure for two hours immediately following onset of the release. This translates into a TS limiting the specific activity of dose-equivalent I-131 in the primary coolant (usually one microcurie per gram). The standard TS call for the specific activity to be monitored at least every 14 days during steady-state operation, but measured between two to six hours after a significant power change. If the specific activity rises above this limit, the reactor must be shut down if the specific activity is not brought back down to the limit within a specified completion time (48 hours), or if the specific activity rises above a higher, power-dependent operating limit.
The actual specific activity in the coolant is governed by the release rate from leaking fuel, which is independent of the existing specific activity in the coolant, and by the removal rate by radioactive decay and by the cleanup system, both of which are proportional to the existing specific activity in the coolant. For any given release rate, the specific activity will climb until the removal rate matches the release rate. Thus, it is desirable to have a low incidence of leaking fuel, few power or pressure transients, and cleanup systems in good working order. Overly strict limits on iodine specific activity could lead to excessive monitoring and surveillance, or even limit operational flexibility.
Burden Estimate
The next question is, how great is the burden on a licensee? There is not sufficient information available to perform a formal analysis with uncertainties. However, a simple point-estimate analysis was performed to provide some perspective on the regulatory burden.
It is illustrative to note that, in the 168 events documented by Adams and Atwood (Adams, J.P., and Atwood, C.L., "Probability of the Iodine Spike Release Rate During an SGTR," Transactions of the American Nuclear Society, V. 61, pp. 239-240, June 1990), the mean pre-trip measured iodine specific activity in the coolant was 0.049 Ci/gm, which is about a factor of 20 below the 1 Ci/gm TS limit. The 95th percentile was 0.181 Ci/gram, and the maximum recorded in this database was 0.564 Ci/gram. Although 168 events do not constitute a large sample, it does not appear that plant operators are having too much difficulty keeping this specific activity within the limit during normal operation.
To supplement this information, a search of the NRC LER database was made for any report with the word "iodine" in the title. The search produced 32 events, all in the interval from February 1984 to September 1988. This rather confined interval is partially explained by the fact that the searchable database begins with January 1984. Moreover, one report mentioned that, on June 25, 1986, "the NRC approved a TS amendment which deleted the reporting requirement of TS 3.4.7.A." Thus, the lack of events in later years may be due to the lack of reporting requirements.
Of the 32 events in the database, 22 appear to be spiking caused by either a planned shutdown or a shutdown necessitated by a need for repair or to address an external event (e.g., an impending hurricane). Moreover, many of the spiking events were clustered at the same plant and during the same fuel cycle. The LERs themselves acknowledged that there was some failed fuel in the core, and that the spiking events kept occurring at that plant until the fuel was replaced. Thus, maintaining the iodine specific activity below the limit during steady-state operations does not appear to be problematic. Difficulties are not likely to arise unless there are a significant number of cladding defects in the core, or problems develop in the primary coolant cleanup system.
Personnel exposure does not appear to be a problem. After cooldown, detensioning of the studs, removal of the vessel head, and all the other activities likely to occur before plant personnel is exposed to primary coolant, the spike will have largely decayed away. Residual activity in the coolant under such circumstances is probably best addressed by reducing cladding defects, not by studying the iodine spiking phenomenon.
Generation of extra radwaste in the cleanup system is also not likely to be a major problem, since the relatively short half-life of the iodine isotopes will reduce the activity to negligible amounts long before disposal of the ion exchange resins becomes a problem.
However, a post-trip iodine spike may delay recovery and return to power operation, since it will take some time for the cleanup system to restore the coolant specific activity to within limits. This could cause an economic burden. However, the situation is not likely in the absence of defected fuel cladding, and fuel performance has been improving over the years. Also, if the spiking occurs because of a planned shutdown, where there is no intention of an immediate return to power operation, the spike in iodine activity has little economic consequence.
According to NUREG/CR-5750,1760 the frequency of general transients (involving a plant trip) at domestic PWRs is 1.2 events/PWR per year of criticality. The same reference used a 75% criticality figure, so this translates to 1.6 events/PWR per calendar-year. However, not every plant trip results in an iodine spike. According to data presented at the Commission meeting of February 24, 2005, about 80% of the plants are reporting zero defects in recent years. This implies that only 20% of the plant trips will result in an iodine spike, which gives a spiking frequency of about 0.32 spike/PWR-year.
Not every spike is severe enough to cause a problem. The next question is to determine how severe a spike would have to be to cause a delay in return to power. A literature search produced no information on the time normally needed to recover from a scram and return to power. However, conversations with some former operating personnel indicated that, although technically it is possible to return a plant to full power within 12 hours or so, in reality it takes 18 to 24 hours. Besides the time required to pull the rods, etc., the plant personnel must first diagnose the reason for the scram and make sure that the plant is in a state where restart is allowable, all of which must be documented on paper.
However, the Standard TS allow operation to continue provided that the iodine activity is brought back within the 1 Ci/gram limit within 48 hours after the last measurement. (The specification explicitly exempts this LCO from the usual requirement that the iodine activity be within the limit prior to entering Modes 1, 2, or 3.) Thus, although the plant could probably be returned to power operation, a problem would be encountered if the iodine activity were too high to be brought back to within limits in 48 hours. In theory, the plant would have to be shut down again. In practice, the plant operators would probably delay restart until they were reasonably sure that the iodine activity was dropping sufficiently to avoid a problem later.
If the spike is at maximum before four hours after the scram, which is usually the earliest point where the activity is measured, then the activity as a function of time can be approximated by:
for times after the measurement at four hours. If t = 0.04552/hour, t = 48 hours, and A(48 hours) is to be 1 Ci/gram, then it is straightforward to estimate that the activity at the time of measurement (four hours after the scram) would be about 8.89 Ci/gram. (Results are given to three significant figures for the convenience of the reader who wishes to follow the calculations, and are not intended to imply that these parameters are known to this accuracy.)
Examination of the Adams/Atwood database shows that 2 of the 168 observed spikes (about 1.2% of the total) have exceeded this value. Thus, it is estimated that about 1.2% of the 0.32 anticipated spike/PWR-year will result in a delay in return to power, which gives a frequency of delayed restart of 0.0038 delay/PWR-year.
The delays in scram recovery associated with such spiking events will vary in length. To estimate the average extra delay, the time to reach the TS limit of 1 Ci/gram was calculated for the 2 events in the database where the max activity exceeded 8.89 Ci/gram. The result was an average time of 53.4 hours to decay from the time of measurement down to the permissible 1 Ci/gram. If operation is restricted after 48 hours, the average delay is about 5.4 hours.
According to NUREG/BR-0184,1864 the cost of replacement power is $480,000/day. At this rate, the cost of a 5.4 hour delay in restart is $108,000. (These and subsequent dollar estimates are cast in 1993 dollars, which was current for NUREG/BR-0184,1864 and also current for the regulatory policy placing a value of $2,000 on a person-rem.) Thus, the annualized burden is 0.0038 delay/PWR-year times $108,000/delay, which is $410/PWR-year.
There are currently 69 operating PWRs, with a remaining licensed lifetime of approximately 1020 PWR-years. Thus, $410/PWR-year implies a national burden of about $28,000/year, with a future lifetime burden of about $420,000 with no license renewal. A 20-year license renewal for these plants would extend this burden to about a $1M.
Risk Worth
The burden estimate needs to be balanced against the averted risk associated with the current limits on iodine activity in the primary coolant. Although both the SGTR accident and the main steam line break accident are based on the maximum permissible coolant activity, generally the SGTR analysis is the limiting analysis. As was discussed above in the section on GI B-65, the source term (for a primary coolant specific activity of one millicurie per gram and a full double-ended break of a steam generator tube) is just the source term for the main steam line break downstream of the MSIV, but without the initial "puff" before the MSIV closes. The consequences for this sequence were estimated using the MACCS2 code. The results are given in Table 3.197-12. (Results in this and subsequent tables are given to three significant figures for the convenience of the reader who wishes to follow the calculations, and are not intended to imply that these parameters are known to this accuracy, as the percentile range given in the table itself clearly shows.) This is a highly conservative, bounding result. In order to make a more realistic estimate, this estimate must be scaled down, specifically to account for the coolant activity and the primary-to-secondary leak rate. Regarding coolant activity, the data from the Adams/Atwood data in Table 3.197-1 was considered.
Table 3.197-12
| Mean | Median | 95th percentile | |
| Total whole-body dose to 50 miles (person-rem) | 4,940 | 5,220 | 8,650 |
| Thyroid dose to 50 miles (person-rem) | 85,400 | 86,900 | 15,4000 |
| Whole-body dose at site boundary (rem) | 4.26 | 0.365 | 13.1 |
| Thyroid dose at site boundary (rem) | 68.2 | 2.33 | 217 |
Based on the 168 events in this database, the mean iodine release rate from the fuel to the coolant was 2.61E2 Ci/hour. In 8 hours, and assuming cleanup system isolation and a primary coolant mass of 2.52E8 grams, this would result in a primary coolant specific iodine activity of about 8.3 Ci/g. The MACCS2 results, which were based on 1 Ci/g, should then be reduced by a factor of 8.3/1000, or 0.0083. Using this scaling factor, the mean thyroid dose drops from 85400 person-rem to about 710 person-rem. The frequency of SGTR events can be estimated from several studies, as shown in Table 3.197-13.
Table 3.197-13
| Original B-65 analysis (1986) | 1.3E-3/RY | |
| Adams, J.P., and Sattison, M.B., "Frequency and Consequences Associated with a Steam Generator Tube Rupture Event," Nuclear Technology, V. 90, pp. 168-185, May 1990. | 8E-3/RY | |
| NUREG-11501081 PRAs:
NUREG/CR-4551 (1992) | 1E-2/RY | |
| NUREG/CR-5750 1760(1999) | 7E-3/RY (critical) | |
| NUREG-1740 1861 (2001) | 9 domestic events in 1615 domestic PWR-years | 5.6E-3/RY |
As can be seen, these sources do not vary greatly. The NUREG-11501081 PRA value will be used, recognizing that this introduces a small conservatism. Thus, the point estimate risk associated with this spontaneous SGTR sequence is approximately 7.1 person-rem thyroid/RY.
As before, this risk can be divided by 100 to get an equivalent whole-body dose, then multiplied by $2,000/person-rem to get an equivalent cost. The result is $140/RY, which is about 1/3 of the estimated industry burden of $410/PWR-year. The net industry burden is then approximately $270/PWR-year.
Implementation Cost
According to NUREG/BR-01841864 and the material referenced therein, a non-controversial amendment to an existing rule or regulation implementation would incur NRC costs of approximately $122,000. A model TS amendment would incur approximately $18,000 in licensee costs. Both of these costs are one-time, up-front expenditures, with no continuing operating costs.
Overall Net Burden
Currently, there are 69 PWRs operating, with a remaining lifetime of approximately 1020 PWR-years. Thus, an "average" plant has 15 years of remaining license lifetime. The annualized potential savings for such a plant would be $410 due to averted delays in restarts, less $140 due to the risk worth of the SGTR scenario, giving a net annualized savings of $270/year. Over 15 remaining years of operation, discounted at 7% (as recommended in NUREG/BR-0184,1864 the cumulative savings would be $2,560. (Without the discounting, this would be just 15 years times $270/year, to give $4,050.) This is not enough to cover the administrative cost ($18,000) of a TS amendment, even without discounting.
Discussion
It should be noted that the low risk worth does not imply that the current TS on iodine spiking are unnecessary. The current limits are based on limiting the risk to the most-exposed individual in the vicinity of the plant, not the societal risk to the surrounding population. The only purpose of the risk worth estimate is for the cost/benefit calculation.
The regulatory burden for any plant for one year is quite small. This is at least partly due to the diligence on the part of the industry in reducing the number of inadvertent plant trips, and to continued improvements in fuel fabrication which have reduced the incidence of cladding defects. Nevertheless, this residual burden does rise to more significant levels when added over 69 operating PWRs. Even so, the administrative costs of a TS amendment are greater than the potential burden reduction. Even if there were no discounting, with an annualized net potential savings of $270/year, it would take 66 years of operation to pay for the TS amendment.
The recommendation1862 made by the ACRS was "to take advantage of iodine studies available in the literature and develop a mechanistic understanding of the phenomenon." Developing a better understanding of the phenomenon would unquestionably provide a more satisfactory basis for iodine activity limits than that provided by the current empirical approach. However, as stated in Part II of the MD 6.4 Handbook , "Only GIs that potentially involve adequate protection, substantial safety enhancement, or reduction in unnecessary regulatory burden are included in the Generic Issues Program." Although pursuit of a better understanding of the iodine spiking phenomenon would undoubtedly be good science, such a program must be linked to one of the three GI aspects, adequate protection, substantial safety enhancement, or reduction in unnecessary regulatory burden, to be part of the Generic Issues program. Because of its low risk significance, and because there is no evidence that the existing regulatory approach results in inadequate safety, the only aspect relevant to the Generic Issues program is that of unnecessary regulatory burden. Even for this aspect, the burden appears to be relatively modest. Moreover, a better understanding of the spiking phenomenon would not necessarily result in any change in the regulatory burden.
Other Considerations
Other Benefits: As was stated above, a better understanding of the phenomenon of iodine spiking, particularly regarding the rate of release from the fuel, how this rate might diminish with time, and the relationship to activity currently in the coolant at equilibrium conditions, would provide a more satisfactory basis for iodine activity limits than that provided by the current empirical approach. In particular, a better scientific understanding would have the effect of increasing public confidence in the regulatory approach to iodine spiking. Although the Generic Issues Program screening criteria do not address such a benefit, this does not mean that such a benefit is not a legitimate basis for research. Thus, if it is decided that this GI should not be pursued as part of the Generic Issues Program, it may still be a legitimate candidate for another research program.
Thyroid Dose vs. Total Whole-Body Dose: Again, in converting the thyroid dose into an equivalent total whole-body dose to compare to the screening criteria, a method developed by PNL in the analysis of GI-III.A.1.3, "Maintain Supplies of Thyroid Blocking Agent (Potassium Iodide)," was used. The PNL method considered both the differing health effects and the relatively high cure rate for thyroid disease, and recommended that the thyroid dose be reduced by a factor of 100 to be comparable to other risk analyses.
In contrast to this, the organ dose weighting factor for the thyroid in 10 CFR 20.1004 is 0.03, rather than the factor of 0.01 that is implied by the PNL rationale. Use of this weighting factor would triple the risk worth to be subtracted from the potential burden reduction. Ironically, this would make the burden reduction and the risk worth almost equal, making the burden cost-effective, and the screening comparison moot. Regardless, there would be no change in any conclusions.
Iodine Spiking in BWRs: Obviously, SGTR events are not applicable to BWRs. Nevertheless, BWR fuel can release iodine to the primary coolant after a transient, which can cause a spike in primary coolant activity in a manner similar to that of a PWR. This iodine could be carried via the steam lines to the turbine and main condenser, and be discharged from the plant stack. However, iodine input into the offgas system is small because of its retention in reactor water (in the reactor vessel) and in condensate (in the hotwell). What iodine does enter the offgas system will be treated, e.g., the RECHAR system most commonly used in BWRs contains a charcoal bed which will effectively remove the iodine by adsorption. Iodine which re-dissolves in the condensate will be largely removed by the condensate demineralizers before returning to the reactor via the feedwater system. Moreover, in a BWR, once the MSIVs close, decay heat is accommodated by S/RVs discharging steam to the suppression pool within primary containment. There is no periodic release of steam to the environment.
For this reason, iodine control in BWRs is effected not only by restrictions on activity in the primary coolant, but also by TS limits on the release rates from the main stack and the building exhaust vents. The BWR standard TS do not explicitly address spiking as is the case for a PWR. Thus, this GI does not apply to BWRs.
Conclusion
Because of the low potential burden reduction associated with this aspect of the issue, this issue should not be continued as a burden reduction issue.
DISCUSSION
An investigation of iodine deposition and transport, resulting in a better mechanistic understanding of the iodine spiking phenomenon, would unquestionably be valid and valuable basic science, and should be encouraged. However, the low risk significance associated with this issue implies that the issue is not a good candidate for the expenditure of resources that are specifically targeted for improving safety. Moreover, the regulatory burden associated with this issue is smaller than the administrative costs required for any alleviation. Thus, it is recommended that this subject be considered for university grants or other basic science programs, rather than being pursued in the Generic Issues Program.
CONCLUSION
Based on the risk estimates and other considerations discussed above for both the safety and burden reduction aspects of GI-197, the issue was dropped from further consideration.1867
REFERENCES
|
