ML17292A806
| ML17292A806 | |
| Person / Time | |
|---|---|
| Site: | Columbia  |
| Issue date: | 04/08/1997 |
| From: | NRC (Affiliation Not Assigned) |
| To: | |
| Shared Package | |
| ML17292A805 | List: |
| References | |
| GL-88-20, NUDOCS 9704210152 | |
| Download: ML17292A806 (10) | |
Text
~$ RE00
+~
po Cy P
L c0 O~
Y/
qO
+>>*++
SAFETY UNlTED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 205M-0001 EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO INDIVIDUALPLANT EXAMINATION WAS ING ON PUBLIC OWER SUPPLY S
S EN NUCLEAR PROJECT 0.
2 OCKET NO. 50-397 e
- 1. 0 INTRODUCTION On July 27,
- 1994, Washington Public Power Supply System (licensee) submitted the Nuclear Project No.
2 (WNP-2) individual plant examination (IPE) in response to Generic Letter (GL) 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities 10 CFR 50.54(f)," and associated supplements.
On August 7,
- 1995, and August 12, 1996, the staff sent the licensee a request for additional information (RAI).
The licensee responded by letters dated October 20,
- 1995, and August 12,'996, respectively; The licensee provided a limited scope update of its 1994 submittal in its August 12, 1996 response.
The staff performed a "Step 1" review of the WNP-2 IPE submittal.
As part of this review, Science 8 Engineering Associates, Inc., Scientech, Inc.,
and Concord Associates reviewed the front-end analysis, the back-end analysis, and the human reliability analysis (HRA), respectively.
The Step 1 review focused on whether the licensee's method was capable of identifying vulnerabilities.
Therefore, the review considered (1) the completeness of the information and (2) the reasonableness of the results given the WNP-2 design, operation, and history.
A more detailed review, a "Step 2" review, was not performed as part of this IPE submittal.
Details of the contractors'indings are given in the technical evaluation reports (Appendices A, B, and C) attached to this safety evaluation (SE).
In accordance with GL 88-20, the licensee proposed to resolve Unresolved Safety Issue (USI) A-45, "Shutdown Decay Heat Removal Requirements."
The licensee also proposed to resolve Generic Safety Issue (GSI) 105, "Interfacing System LOCA at LWRs," 'and USI A-17 "Systems Interactions in Nuclear Power Plants,"
as part of the WNP-2 IPE.
No other USIs or GSIs were proposed for resolution as part of the WNP-2 IPE.
2.0
~EVA UATIGN WNP-2 is a boiling water reactor (BWR) 5 with a Nark II containment.
In its 1994 submittal the licensee reported a core damage frequency (CDF) of about 2E-5/reactor-year, including a contribution from internal flooding of about 5E-6/reactor-year.
Station blackout (SBO) contributed about 62 percent, internal flooding about 14 percent, transients about )1'ercent, loss of standby service water (SSW) system about 5 percent, loss of other support systems about 5 percent, anticipated transient without scram (ATWS) about 4 percent, loss-.of-coolant accidents (LOCAs) about 1 percent.
97042iOi52 970408 POR ADOCK 05000397 P
1 The licensee reported a new CDF and new sequences in its August 1996 response to the staff's RAI.
The new CDF is 1.5E-5/reactor-year; the new relative accident contributions are as follows:
SBO, about 72 percent; transients, about 15 percent; internal flooding, about 6 percent; loss of support
Although the CDF in the update remained essentially the same, the accident percentage contributions to the total CDF changed.
The most significant changes were with respect to accidents initiated by internal flooding and loss of SSW.
The first resulted from a reduction of the initiating. event frequency for flooding in the reactor building (Category
- 7) by two orders of magnitude (from about 2E-. 5 to 3E-7) and the second'rom the elimination of the loss of SSW as a
potential initiator.
Loss of SSW was eliminated as an initiator because during the update the licensee determined that loss of SSW "does not cause a
reactor scram and, therefore, does not meet the definition of an initiating event."
The WNP-2 CDF results compare reasonably with the results of other BWR 5 plants.
The licensee's Level 1 analysis appears to have examined the significant initiating events and dominant accident sequences.
On the basis of the licensee's IPE process used to search for decay heat removal (DHR) vulnerabilities, and the review of WNP-2 plant-specific
- features, the staff finds the licensee's DHR evaluation consistent with the intent of the resolution of USI A-45.
Furthermore, the licensee did not
.'dentify any vulnerabilities with respect to GSI 105 and USI A-17.
According to GL.88-20 if a licensee "concludes that no vulnerability exists at its plant that is topically associated with any USI or GSI, the staff will consider the USI or GSI resolved for a plant upon review and acceptance of the results of the IPE."
Therefore, the staff concludes that WNP-2 resolved USIs A-45 and A-17 and GSI 105.
4 The licensee performed an'RA to document and quantify potential failures in human-system interactions and to quantify human-initiated recovery of failure events.
The licensee identified the following operator actions as important in the estimate of the CDF:
failure to vent the containment, failure to open reactor core isolation cooling (RCIC) pump room door, failure to initiate automatic depressurization, failure to initiate suppression pool cooling
'pray, and failure to inhibit automatic depressurization or to control reactor coolant level.
It is noted that opening the RCIC pump room door is no longer considered important because an analysis performed after the submittal showed that with the doors closed the room temperature will not increase to levels causing equipment failures.
Regarding pre-initiator event analysis, the licensee did perform a more thorough search than typically done to identify pre-initiator events.
For
- example, the licensee modeled actions associated with preventive maintenance and the provision of resources for systems like the containment air.system as well as those associated with test, maintenance, and calibration activities.,
However, it does not appear that the licensee carefully evaluated the plant-specific and event-specific factors that influence human performance during normal operations.
In quantifying all pre-initiator human events, the licensee assigned,a single-failure probability of 3.0E-04 regardless of the complexity of the action.
Although values of the order of magnitude of lE-4 are frequently used in a pre-initiator event analysis, they should be based on an examination of plant procedures and practices of each individual action modeled.
In the WNP-2 IPE, the licensee stated that this value was based on the assumptions that each pre-initiator action would be (I) independently checked by a second operator, and (2) subjected to a functional test.
However, the licensee did not demonstrate that these assumptions were scrutinized for their applicability to all pre-initiators modeled in the IPE
'nd their implementation during plant practices.
Insufficient examination of plant practices and procedures to validate these assumptions could lead to an underestimation of the impact of pre-initiators on plant safety.
For example, human error probabilities associated with'iscalibration (which can induce common-cause failures) can be significantly underestimated with this approach.
Also, it appears that the modeling of pre-initiator human actions has not been uniformly applied to systems.
For'xample, the licensee modeled errors associated with preventive maintenance,
- repair, and testing of the residual heat removal system model but did not model any preventive or corrective
- maintenance errors in the RCIC system model.
The licensee did not justify this apparent lack of consistency..
Although it is unlikely that these weaknesses of the licensee's pre-initiator event analysis would have critically impacted the licensee's overall conclusions from the IPE, the licensee may have missed the opportunity to gain.
insights regarding contributors to plant safety.
However, the licensee stated that it intends to perform a sensitivity analysis, of pre-initiator.human actions.
Regarding post-initiator event analysis, although the licensee considered some factors influencing human performance under accident conditions (for example, the need to diagnose an event, time available versus time needed'or an action, plant-specific factors, and the influence of the accident progression on human performance) it does not appear that they were evaluated systematically and comprehensively to ensure that important aspects of human performance under severe accidents were not missed.
. For example, the human error probability estimates depend on the time available to the operator to perform an action.
In determining the time available, one should carefully determine the time needed to access and operate controls; action walkdowns and simulator drills are frequently used for this purpose.
It does not appear that the licensee performed such a
plant-specific/event-specific examination.
Another example is the limited consideration of the dependencies induced by the accident progression and/or from previous human failures.
The staff was not able to confirm that the licensee adequately addressed post-initiator human error dependencies.
As part of its response to the staff's RAI, the licensee reviewed the potential effects of dependencies between actions in single sequences and concluded that, for all combinations identified, the actions could be considered independent.
However, the licensee did not provide any evidence supporting this conclusion and did not appear to recognize that lack of appropriate treatment of dependencies can lead to a significant underestimation of the combined human error probability.
However, the licensee did model post-initiating events typically seen in IPEs and "PRAs for BWR-5s, and the human error probabilities used for those events appear to be reasonable.
In addition, the WNP-2 IPE results are in line with those for similar BWR-5 plants in both the most dominant initiators and the most dominant accident sequences.
Therefore, the staff believes it is unlikely that these weaknesses of the licensee's post-initiator event analysis have missed a vulnerability and have impacted the licensee's overall conclusions from the IPE.
- Rather, the staff believes that these weaknesses might limit the licensee's capability to gain insights regarding human performance under severe accident conditions and to identify improvements.
The licensee evaluated'and quantified the results of the severe accident progression through the use of a containment event tree and considered
- uncertainties in containment response through the use of sensitivity analyses.
'The licensee's back-end analysis appeared to have considered important severe accident phenomena.
According.to the licensee, the back-end analysis results are as follows:
early containment failure will occur 31 percent of the time, and late containment failures will occur 30 percent of the time.
The containment remains intact 39 percent of the time.
There is no containment bypass contribution because all sequences associated with containment bypass Pad been truncated in the front-end analysis.
The staff notes that these results are in line with the results of other BWR Nark II plants.
The licensee's response to containment performance improvement'rogram recommendations is consistent with the intent of GL 88-20 and its Supplement 3.
Following are some insights and unique plant safety features identified by the licensee at WNP-2:
Fire water cross-connection was credited only for t)ose scenarios (for
- example, short-term station blackout) in which th'e operators will recognize its need early enough'o prevent core damage.
2.
Cross-tie of the high-pressure core spray diesel generator to power lE loads in division I or 2 was not credited.
3.
WNP-2 has a relatively short battery lifetime, four hours with credit for load shedding, which restricts the time available to recover offsite power during a station blackout.
1
To identify vulnerabilities, the licensee examined (1) whether the total COF is in excess of lE-4/reactor-year, (2) whether there are sequence groupings with CDF 'greater than 1E-6/reactor-year'that require modifications based on NUHARC 91-04 guidelines, and (3) whether there are sequences that indicate a
plant-specific feature that is an outlier compared to other BWR PRAs.
The licensee's examination did not lead to the identification of any vulnerabilities; However, several plant improvements were identified.
Some were discarded as not cost effective; some were implemented; and some were under consideration at the time of the submittal..
The following are improvements that were implemented or were under evaluation:
1.
Automatic depressurization inhibit switch.
This enhancement allows the operators to use the automatic depressurization system (AOS).inhibit switch (used for ATWS sequences to override the automatic ADS signal) for non-ATWS scenarios.
This modification (estimated as reducing the CDF, by about 1.5 percent) was implemented after the IPE analysis.
2.
Haintenance improvements.
Maintenance practices were evaluated, and were revised to decrease common-cause failures.
The changes were implemented and should be part of the licensee's current maintenance practices.
3.
'tation blackout depressurization.
This procedural change allows the operators to depr essurize the reactor vessel prior to battery depletion, extending the time for power recovery.
This modification was estimated to reduce 'the CDF by 34 percent and was implemented after the IPE
'analysis.
4.
5.
500 kilovolt (kV) backfeed.
Offsite power can be supplied by backfeed of 500 kV power if the main generator is disconnected.
Currently, disconnecting the main generator requires '8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to accomplish.
A plant modification that would allow backfeed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and could reduce the total CDF by up to 58 percent was under evaluation.
4 Drywell/wetwell bypass.
The design of the Omega seal separating the drywell and wetwe11 air spaces was found to be a passive design with very low failure 'rate;
- however, Omega seal failure was found to have significant consequences.
The IPE team recommended a cost-benefit analysis of periodic inspection and maintenance of the Omega seal.
3.0 CONCLUSION
On the basis of these findings, the staff notes that (1) the licensee's IPE is complete with,regard to the information requested by GL 88-20 (and associated guidance in NUREG-1335),
and (2) the IPE results are reasonable, given WNP-2's
- design, operation, and history.
As a,result, the staff concludes that the licensee's IPE process is capable of identifying the most likely severe accidents and severe accident vulnerabilities and that the WNP-2 IPE has met the intent of, GL 88-20.
However, the staff noted that weaknesses in the licensee's evaluation of human errors during severe accidents will limit the use of the IPE for purposes other than GL 88-20 that are sensitive to human error analysis.
The staff also concludes that the licensee resolved USIs A-45 and A-17, and GSI 105.
It should be noted that the staff's review focused primarily on the licensee's ability to determine whether severe accident vulnerabilities exist at WNP-Z.
The review was not intended to validate the accuracy of the licensee's detailed findings (or quantification estimates) that stemmed from the examination.
Therefore, this SE does not constitute NRC approval or endorsement of any IPE material for purposes other than meeting the intent of GL 88-20.
Attachments:
I.
Appendix A (Front-End Analysis) 2.
Appendix B (Back-End Analysis) 3.
Appendix C (Human Reliability Analysis)
\\
Date:
April 8, 1997