ML17164A743
| ML17164A743 | |
| Person / Time | |
|---|---|
| Site: | Susquehanna  |
| Issue date: | 07/15/1998 |
| From: | NRC (Affiliation Not Assigned) |
| To: | |
| Shared Package | |
| ML17164A742 | List: |
| References | |
| GL-88-20, NUDOCS 9808180283 | |
| Download: ML17164A743 (9) | |
Text
fi R RECu
~o 0 $
+~
qO
+w*w+
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON> D.C. 205554001 STAFF EVALUATIONREPORT SUPPLEMENT SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 AND 2 INDIVIDUALPLANT EXAMINATION INTERNALEVENTS ONL I.
INTRODUCTION On December 13, 1991, Pennsylvania Power & Light Company (PP&L) (the licensee) submitted the Susquehanna Steam Electric Station (SSES), Units 1 and 2, Individual Plant Examination (IPE) in response to Generic Letter (GL) 88-20 and associated supplements.
On November 4, 1992, and on December 17, 1996, the staff met with the licensee to discuss the Nuclear Regulatory Commission's (NRC) concerns regarding the SSES IPE. On January 11, 1993, the licensee submitted Volume 6 of the IPE and on June 23, 1997, the licensee provided additional information regarding issues raised by the staff.
The staff performed a "Step 1" review of the SSES IPE submittal and was supported by the Brookhaven National Laboratory.
On October 27, 1997, the staff sent its evaluation report to the licensee in which it was stated that the staff could not conclude that the SSES IPE met the intent of GL 88-20.
In response to this staff evaluation report (SER), the licensee revised its IPE. On February 27, 1998, the licensee briefed the staff on the revisions it had made and on April 1, 1998, the staff audited the SSES IPE at the licensee's headquarters in Allentown, Pennsylvania.
The staffs audit focused on whether the licensee addressed the concerns documented in the October 27, 1997, SER. This supplement, therefore, documents the staff's findings and conclusions regarding the licensee's resolution of its concerns.
In accordance with GL 88-20, PP&L had proposed in its original IPE to resolve Unresolved Safety Issue (USI) A-45, "Shutdown Decay Heat Removal Requirements."
The licensee had also proposed to resolve USI A-17, "System Interactions," as part of its IPE. No other specific USls or generic safety issues were proposed for resolution as part of the IPE.
II. EVALUATION In the revised IPE, the licensee calculated a core damage frequency (CDF) of about 7E-7/reactor-cycle, which is about a factor of seven larger than the CDF of 1E-7/reactor cycle of the original submittal. Anticipated transients without scram (ATWS) contribute about 63% to the CDF, loss of decay heat removal (DHR) contributes about 23%, internal flooding contributes about 10%, station blackout (SBO) contributes about 2%, transients contribute about 2%. The contribution from loss-of-coolant-accident (LOCA) and interfacing systems LOCA (ISLOCA) is less than 1%.
In the SER of October 27, 1997, the staff expressed concerns in several areas.
In particular, it was noted that the licensee did not provide sufficient evidence for the staff to conclude that the following areas were appropriately treated: common-cause failures (CCFs), human reliability analysis (HRA), plant-specific failures, and back-end (i.e., containment performance) analysis, including the lack of sensitivity analyses.
The licensee addressed these concerns by revising its CCF, HRA, and plant-specific data analysis, and performing a sensitivity study for the back-end analysis.
9808180283 980811 PDR ADOCK 05000387 P
Regarding the CCF analysis, the staff found that the original submittal treated CCFs inadequately for active components (e.g., diesels, valves, pumps, and batteries); did not examine single failures to identify those that have a potential for common coupling; did not treat cross-system CCFs, particularly between the high-.pressure'coolant injection (HPCI) and the reactor cor'e isolation cooling (RCIC) pumps; and did not consider CCFs due to test and maintenance.
ln response to these concerns, the licensee reviewed the SSES operational history and revised its approach to CCF by incorporating in the IPE model CCFs for active components of important systems (residual heat removal (RHR), emergency service water (ESW), RHR service water (RHRSW), and diesel generators); examining single failures for common coupling; and including CCFs for RCIC and HPCI and CCFs due to test and maintenance.
(The licensee identified a single failure with common-coupling potential, an ESW pump failure due to end bell erosion; it inspected the other pumps and indeed identified end bell erosion in those pumps as well, although they were in operable condition. The licensee accounted this failure as a CCF for ESW.) Overall, it appears that the licensee performed a reasonable search for CCFs.
In order to address the concern regarding low CCF values, the licensee used generic data (NUREG-1150) instead of plant-specific data (estimated on the basis of examining SSES's procedures and practices).
In a similar manner, in order to address the concern for the low plant-specific failure rates, the licensee substituted them with generic values.
The licensee did not provide a justification as to why these values are appropriate for SSES; therefore, although the licensee demonstrated the impact of the use of higher values on the IPE's results, they did not demonstrate their applicability to SSES, The staff believes that this is a weakness of the
'revised IPE approach.
The licensee, however, performed uncertainty analysis throughout the IPE. Therefore, the staff believes that it is unlikely that this weakness has affected the licensee's overall conclusion from its revised analysis or its capability for identifying vulnerabilities.
It may, however, have limited its ability to gain insights.
Regarding the IPE's HRA, the staff found that the revisions in the treatment of both routine human actions (pre-initiator human events) and actions in response to an initiating event (post-initiator human events) are appropriate.
Pre-initiator human events were explicitly modeled in the revised IPE and were segregated from random equipment failures to allow a better assessment of the contribution of human reliabilityto CDF and, therefore, the development of a better understanding of the role of human reliability on plant safety. According to licensee document EC-RISK-1063, "the maintenance records were re-examined to identify specific instances of undetected system unavailabilities caused by pre-initiator human errors" (PP &LCalculation, pg. 34) for the period from July 1987 to January 1990.
This search uncovered three instances of post-maintenance restoration errors. As a result, the licensee'revised its IPE model to include post-maintenance restoration human errors in specific components of the systems: HPCI, RCIC, low-pressure coolant injection (LPCI), diesel generators, alternate control rod drive pump, and standby liquid control system. A human error probability (HEP) mean value was estimated on the basis of plant-specific data.
The licensee treated miscalibration errors, which have a common-cause potential, using, as mentioned above, generic, NUREG-1150, data. The staff notes that even a generic treatment of miscalibration is better than no treatment at all because it allows the performance of sensitivity analyses for deriving insights regarding the importance of miscalibration.
But, as noted above, the generic treatment of miscalibration is a weakness in the licensee's HRA.
Regarding post-initiator human actions, the licensee revised its IPE model to explicitlyinclude them on the event trees.
The licensee's document, EC-RISK-1063, gives a detailed description of the process used to identify and quantify these actions.
Accordingly, the licensee identified post-initiator human actions through a review of emergency procedures and its defense-in-depth criteria that provide a reliable and updated source of actions performed in response to an initiating event. The licensee used two different approaches to quantify these actions.
For those actions that could be quantified using plant-'specific data documented in "Susquehanna Operator
Response
Data for Actual Events, or in "Susquehanna Opbrator Response Data From Simulated Events," an HEP was estimated on the bases of these data.
For the remaining actions, data from NUREG/CR-4835 were used "because the method generation and its. application are generally consistent with the approach being pursued at Susquehanna."
The staff finds the licensee's approach of using plant-specific data for estimating HEPs a
'trength of the licensee's HRA. In general, the staff found that the licensee appropriately considered critical factors, such as the layout and accessibility of manipulated components, operator training for a specific action, the potential for confusion and misinterpretation of an emergency operator procedure entry condition, and time needed versus time available to perform an action.
Furthermore, the dependencies between human actions and the influence of the accident progression on human performance appear to have been treated appropriately, On the basis of these findings, the staff concludes that the front-end analysis of the revised SSES IPE is reasonable.
In the original submittal, the licensee presented an approach to resolve USI A-45, "Decay Heat Removal Reliability." Taking into consideration the changes in the licensee's front-end analysis and quantitative results, its review of SSES plant-specific features, and the strategy it developed and implemented regarding this issue, the staff concludes that the licensee's IPE process used to search for DHR vulnerabilities is reasonable.
The licensee also proposed to resolve USI A-17, "System Interactions," as part of the IPE. The licensee did not identify any vulnerabilities with respect to A-17. According to GL 88-20, ifa licensee concludes "that no vulnerability exists at its plant that is topically associated with any USI or generic safety issue (GSI), the staff willconsider the USI or GSI resolved for a plant upon review and acceptance of the results of the IPE." The staff concludes, therefore, that the licensee has resolved USls A-45 and A-17.
P Regarding the back-end analysis, the licensee conducted limited sensitivity studies to investigate the conditional probability of containment failure given conditions of vessel breach at high pressure.
With the combination of core damage and vessel failure not at high pressure, the licensee calculated a conditional probability of containment failure of 9 percent.
By contrast, the combination of core damage and vessel failure at high pressure resulted in a conditional probability of containment failure of 54 percent.
This result appears to be reasonable.
One specific aspect of the SSES IPE is the credit taken for preventing vessel failure with the core damaged under station blackout conditions through local operator actions focusing on providing alternate power (ac) or restoring ac power. According to EC-RISK-1063, the licensee relies on operators stationed locally for performing these actions and the actions are well proceduraiized and practiced.
In estimating pertinent HEPs, plant conditions and time needed versus time available to perform these actions were taken into consideration.
The staff notes that it was the intent of GL 88-20 for licensees to identify all potential means of accident mitigation. Therefore, the staff finds this aspect as a strength of the SSES IPE. It is noted however, that these actions contribute to a high probability of vessel failure prevention.
Therefore, the staff encourages the licensee to continually confirm the reliabilityof operator performance used in the IPE, ensuring that the IPE portrays SSES performance under severe accident conditions.
In general, the licensee indicated that core debris is 14 times more likelyto be quenched in-vessel ifcore damage progresses in a manner consistent with the core relocation model used in the BWRSAR code, which the licensee used in the IPE, compared to the core blockage model employed in the industry-developed MAAP code.
The staff believes that code input assumptions, such as success criteria, may play a role in the reduction of vessel breach likelihood at SSES compared to other Mark II plants.
Regarding the containment performance improvement (CPI) program recommendations, the SSES design includes a 30-day supply of compressed nitrogen for safety-relief valve actuation.
The licensee has also installed a mobile diesel generator to recharge the 125-volt dc batteries.
These plant capabilities provide enhanced depressurization system reliability.
The licensee has also provided threaded connections on the RHR service water system, which allow for alignment of the diesel-driven fire protection system pumps to the RHR system, thus
~
providing an alternate water source for injection.
The licensee examined the issue of venting using an existing soft vent (i.e., the heating, ventilation, and air conditioning (HVAC) ducts). The HVAC piping willfail at expected vent pressures, now estimated at approximately 60 psig (based on the revised venting procedure) instead of at the 15 psig vent pressure p'roposed in the original IPE. The licensee indicated that it has developed procedures to maintain core cooling in the event that most reactor building equipment is lost by aligning systems external to the reactor building. In addition, the licensee is evaluating a conceptual venting strategy that willprovide a framework, based upon input such as the estimated source term and combustible gas challenges, to help decide ifventing is a viable option. This appears reasonable.
On the basis of this review, the staff concludes that the licensee's response to the CPI program recommendations is reasonable and consistent with the intent of GL 88-20.
Some weaknesses exist, however, in the licensee's back-end analysis:
1.
In the licensee's analysis, the accident sequence progression was terminated ifthe containment failed prior to core damage; all sequences were then assumed to go to core damage in the reported CDF. Radionuclide releases were not calculated for these containment failures nor was a detailed understanding of plant response obtained.
The impact on conditional containment failure probability of some severe accident phenomena and resulting containment failure modes appear to have been understated.
As a result, all early and late containment failures, other than the containment failures resulting from loss of DHR discussed in item 1 above, are reported by the, licensee to occur in less than one percent of core damage events, including ATWS and station blackout.
Appendix 1 to GL 88-20 recommended that licensees consider a maximum eoolable debris bed to be 25 cm. For depths in excess of that (as proposed in the SSES IPE) both eoolable and noncoolable outcomes should be considered and documented, even in the presence of a water layer pr'ovide'd by the drywell sprays, because of the possibility of the formation of a noncoolable debris crust.
Noncoolable outcomes may lead to the occurrence of phenonema such as containment overpressure failure from noncondensible gas generation due to core-concrete interaction or containment failure from corium attack on the drywell liner/concrete containment boundary.
The licensee assumed, however, that core debris released from the vessel post-accident will always be quenched on the drywell floor and, consequently, core-concrete interactions with the drywell floor, steel liner, or concrete containment will be prevented, as long as the drywell sprays provide a water pool on the drywell floor. Similarly, core debris attack on other structures, such as the downcomer vents, resulting in suppression pool bypass or loss of pool scrubbing, would not be possible, according to the licensee, given spray operation.
Additionally, the licensee did not consider the possible negative effects of water on the drywell floor, such as containment pressurization due to ex-vessel steaming resulting from fuel-coolant interactions.
3.
The treatment of ISLOCA was characterized as limited in the staffs October 27, 1997, SER.
The licensee has not revised its ISLOCA analysis and, consequently, it remains a weakness.
On the basis of the information submitted by the licensee through either direct discussion with the staff or in writing, the staff concludes, that the licensee's IPE is complete with regard to the information requested by GL 88-20 (and associated NUREG-1335), and that the licensee's IPE process is adequate to meet the objectives of the IPE program as stated in GL 88-20:
1.
To understand the most likely severe accident sequences that could occur at the plant.
To develop an appreciation for severe accident behavior.
3.
To gain a more quantitative understanding of the overall probabilities of core damage and fission product releases.
Ifnecessary, to reduce the overall probabilities of core damage and fission product releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents.
Therefore, the staff now concludes that the SSES IPE submittal meets the intent of GL 88-20.
The staff notes PP8L's commitment to identify instances of plant improvements in order to maintain a low CDF or further decrease the CDF, at SSES.
The staff also notes PP8L's strong in-house PRA capability. The SSES IPE was performed almost entirely in-house; also, according to PPRL, its staff is continually using and updating the SSES PRA. Although the staff had several concerns about the original SSES IPE approach, because of the revisions performed in the front-end portion, the ongoing use of the PRA in conjunction with PPB L's defense-in-depth approach, and the ongoing identification and implementation of improvements, the staff believes that the'current front-end analysis of the SSES IPE presents an exemplary analysis.
The staff encourages the licensee to continually confirm the IPE's reliabilityof equipment and operator performance ensuring that it portrays SSES plant capability under severe accident conditions.
However, some weaknesses still remain in the IPE's back-end analysis.
The staff believes that it is unlikely that these remaining weaknesses have affected the licensee's overall conclusion from its revised analysis or its capability of identifying vulnerabilities; it may, however, limit its usefulness in other regulatory applications, especially in applications related to containment performance.
The staff believes that the licensee can enhance the usefulness of its IPE by addressing these issues, discussed in this document.
It should be noted, that the staff focused its review primarily on the licensee's ability to examine SSES Units 1 and 2 for severe accident vulnerabilities. Although certain aspects of the IPE were explored in more detail than others, the review is not intended to validate the accuracy of the licensee's detailed findings (or quantification estimates) that stemmed from the examination.
Therefore, this SER does not constitute NRC approval or endorsement of any IPE material for purposes other than those associated with meeting the intent of GL 88-20.
Principal Contributors:
E. Lois J. Lane Date: July 15, 1998
)'I 4
l ft p
ktr