ML17309A277

Repts Under Purchase Order DR-82-0961 Re Review of Two Draft SEP Integrated Assessments for Facilities.Ltr Comprises Rept on Ginna SEP (Draft NUREG-0821)

ML17309A277
Person / Time
Site:	Palisades, Ginna, 05000000
Issue date:	06/28/1982
From:	Budnitz R FUTURE RESOURCES ASSOCIATES, INC.
To:	Russell W NRC
References
RTR-NUREG-0820, RTR-NUREG-0821, RTR-NUREG-820, RTR-NUREG-821 NUDOCS 8206290270
Download: ML17309A277 (18)

Text

I REGULATOR NFORMATION DISTRIBUTION TEM (RIDS)

AOCESSION NBR :8206290270 DOC ~ DATE: 82/06/28 NOTARIZED! NO DOCKET FACIL!50 000 Generic Docket 05000000 50-244 Robert Emmet Ginna Nuclear Plant< Unit 1P Rochester G 0500024/

50-255 Palisades Nuclear PlantP Consumers -Power Co. 05000255 AUTH'AME AUTHOR AFFILIATION BUDKITZ,R,J ~ Future Resources Associatesi Ines RBCIP ~ NAME RECIPIENT AFF IL'IATION RUSS ELL g H ~ T' NRC No Detailed Affiliation Given A v ~ 'v

SUBJECT:

Repts under 'Purchase Order DR 82 0961 re rreviey of two draft 'SEP.integrated asessments for facilities.Ltr compr ises rept on Ginna SEP (draft NUREG"0821).

DISTRIBUTION CODE: AOSSS iCOPIES 'RECEIVED:LTR . ENCL ./ SI ZE:

TITLE: SEP Topics NOTES!NRR/DL/SEP icy. 05000244 NRR/DL/SEP icy 05000255 RECIPIENT COPIES RECIPIENT iCOPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL ORB P5 BC 01 7 7 INTERKAL: NRR/DE/ADMQE 13 1 1 NRR/DE/HGEB 10 2 2 NRR/DL/ORAB 11 1 1 NRR/DL/SEPB 12 3 3 DS /AEB 1 1 NRR/DS I/CSB 07 1 1 04 1 1 RGN1 1 RGN3 1 1 EXTE RKAL: ACRS 14 10 10 LPDR 03 '2 2 NRC PDR 02 1 1 NTIS 5 1 1 NOTtES: 1 1

'TOTAL NUMBER OF COPIES REQUIRED: LTTR 34 ENCL 34

I Mt M DPI 1 tD l r ti r, (1D y I y MM~

'l M

'p ID

~

'D I'I yItyl g CM 1, 'I 1

~ If lt I

et(

n tt g

'sefm e 2Cmemr ~A/meeuzfm, Inc.

2OOQCenterSfreet Berkeley, California 94704 416/62S-6111 Koom 415 28 June i 982 Mr. Wil liam T. Russel I U.S. Nuclear Regu'latory Commission Washington, DC 20555 RA:-

Dear Mr. ssel I:

This letter is a report to you under Purchase Order No., DR-82-0961, for which the scope of work ls a review of the two draft SEP Integrated Assessments for the Palisades and Ginna plants. This letter will comprise my report on the Ginna SEP assessment (Draft NUREG-0821, "Integrated Plant Safety Assessment, R.E. Ginna Nuclear Power Plant" ).

I understand that my report will be timely if delivered to you by 28 June, and I am pleased that I have made the deadline.

What I accomplished during this review was li m ited by a couple of constraints.

One of them was that I did not have access to enough detail about the actual Ginna plant design. I found seyeral issues where questions that I had could not be answered by the material at ha'nd .... of course, the character of the review that you asked me to do did not require such in-depth detail, but I found myself handicapped nonetheless, and probably could have provided better comments had I been in possession of, say, the FSAR. A second constraint was that sometimes found myself in need of the full documentation about the NRC I

regulatory position (Reg. Guides, Branch Technical Positions, etc.) in order to comprehend some issues.

il'I /)

Despite these limitations, I do noi think that the essential issues within have been significantly compromised. Indeed, it is probably more thes'e'omments

~

overview comments than detailed comments thai you want from me anyway.

One last introductory comment<>is that I did try to compare the Ginna SEP assessment with the Palisades assessment (NUREG-0820) thai I reviewed in April.

The comparison was useful, mainly because I attempted to see if any of the comments made by myself or others during the Palisades review had made their way into the Ginna report. I can report that some did and some did noi (see below).

A. GENERAL OBSERVATIONS One general observation relates to ihe burdens imposed on all licesees in the period after the TMI accident. I believe that many important a'afety improvements were made in the aftermath of TMI, but that the huge burdens placed on engineering staffs of both ut< lities and thei r contractors were probably too great. Had the TMI-related activities been stretched out more, ihe whole activity could have been more orderly. In that light, the retrofits being imposed within the SEP~program will also be more effective if imposed in an orderly way. I am pleased to report my personal observation that this lesson seems to have been learned, and that the SEP-'mposed changes seem to be quite orderly. The re'gulaiory staff has noi always shown such constraint. Congratulations.

.- 820b2'70270 820b28

, PDR ]ADOCK.'05000244'",'q. -,, '.:",',"""~+~i'4I

0 I~

'l I 'I II I J II I

28 June l982 W.T. Russell page 2 Another comment worth repeating is one made by several reviewers (I among them) of the Palisades report: That is, the "list" of items under review is old and obsolete. Not only are many important issues omitted, but the way some of the issues are cast obviously reflects a pre-TMI approach to safety assurance.

This is unfortunate, and I would like to recommend thai some revisions be made ln the "SEP list" before it is used on the remaining plants. The most glaring examples are the only minor treatment in the SEP of human factors and control systems issues.

A further shortcoming, related to ihe comment just made, is that the "integrated, assessment" is not integrated, because a number of highly significnai items are simply left out, typically because they are being coped with in other regula-tory initiatives (TMI Action Plan, Unresolved Safety Issues, etc.). This is unfortunate. I only hope that not too many changes will be made to Ginna that would have been done differently had a fully integrated assessment been made at this time.

This then leads to a comment, that I must make here again, having made it earlier in my Palis'ades (SEP review. It is probably best simply..to quote my earlier words:

"The fact that NRC is systematically addressing these USI and TMI issues gives me comfort. In my view it is very likely that all of them will be resolved sooner or later, that all of our plants wil.l somehow be safer because of it, and that the safety improvements will be highly cost-effective. Nevertheless, I believe that the draft report I have in front of me is somehow inadequate or insufficient to the extent that it does not highlight this key point. I would feel better if the report had something like the following, up front somewhere, to guide the reader:

'The regulatory staff recognizes thai several of the most important safety issues have not been addressed or resolved in the course of

'his SEP effort, ln each case because they are being addressed through other regulatory efforts: in particular, the Unresolved Safety Issues list and the TMI Action Plan list contain some issues whose safety significance is probably far greater than a majority of the issues dealt with and resolved herein.'ertain aspects of this Ginna assessment are significantly improved over the Palisades assessment. One is the explicit discussion of Rochester Gas and Electric Company (RG+E) management. I am pleased to note this discussion, because It is an important issue to assess. I am even more pleased that the RG+E management seems to be of high competence. The nice language about this on pages I-6/1-7 is important.

A similar issue is the competence of the RG+E in-house engineering staff, whose competence should also be addressed: I note that this issue doesn't seem to have been touched on in ihe report, in contrast to the management issue.

I also found the general discussion (Appendix F) on operating experience to have been a good one. I found it to have been somewhat clearer than the sister analysisof Palisades. Perhaps my favorable response is a reaction to the contents',rather than to the analysis. I wiii discuss the'contents more below.

4 ~a II If II III ff, II I

If

! ft

'ff If

28 June l982 -- W.T. Russell page 3 My last general observation is one that I somehow omitted in the Palisades letter, but is equally true of reviews of all older plants. It concerns acCing. I note that the Ginna is reviewed as if al,l 3 its components are new, and there is little or no discussion of whether the age of Ginna has any effect on the assessment. I recognize that this is because NRC's regulations generally contain no recognition of this issue: except in a few special circum-stances, systems are considered as if new throughout their life. I am dis-and hereby recommend this approach.

(.'nalysis, (My personal pre-conception on this issue is that for plants of Ginna's vintage there will be only a very few places where ihe aging issue will have negative safety significance; for most issues aging is probably a neutral consideration; and for quite a large number the plant's age is an affirmative safety advantage, in my view. But this "feeling" is not supported by any analysis.)

B. APPENDIX D (THE PRA ANALYSIS I begin by noting with pleasure that insights from probabilistic risk assessment (PRA) methods have been partially incorporated into the Ginna assessment. I also recognize that there has been no PRA carried out on ihe Ginna plant itself, so that ihe approach to gaining insights from PRA had to be through analyses of other plants. The approach taken was to use the PRA studies previously com-pleted on The Westinghouse-three-loop Surry plant (the WASH-I400 PWR) and the B8W-two-loop Crystal River plant. The analysts concluded that sufficient in-sights into Ginna, a Westinghouse-iwo-loop plant, could be obtained by judiciously combining insights from the Surry and Crystal River studies.

I believe that this is a reasonable approach, given the circumstances. I('also believe that the emphasis on rankin the safet im ortance of s stems in the present analysis is proper: indeed, I believe that to go much further than such a ranking would not be defensible in the absence of more plant-specific analysis.

Thus I concur in the restraint shown by the analysts in extending their PRA conclusions only as far as a rough (high-medium-low) ranking as to safety signi-ficance.

I am on balance even a little skeptica I as to the validity of the Ginna system rankings. Study of significant differences between Surry and Crystal River in the importance of some systems reveals a lot about these two plants, but the very fact that they are so~/different makes me a little wary of our ability to "interpolate", even with good engineering judgment.

Thus I would be Issg i,ng a stern admonition about how even

~ this limited PRA application was going to far, except that in actual fact it hasn'. I have examined the few issues covered (9 (I'n number) and find that nowhere did the PRA analysts seem to ~overstep the bounds of reasonable use of the available information. Congratulations to Sandia !

Also, for some of the PRA applications the study team did plant-specific analysis anyway. The best example of this, in my view, is the analysis of the safety significance of containment penetrations.

'I ~

(

I P

~=

I J

I

28 June l982 W.T. Russell page 4 I believe that several of the issues that remain difficult within the integrated analysis before me could benefit from some limited PRA-type analysis, which offers a way to "crack" certain problems nicely. Among these are the following, all of which will be touched upon again later in this letter:

(a) The issue of flooding along Deer Creek. Here one could use some PRA-type insights into how important to safety are the several systems that might be compromised by the assumed standard project flood.

(b) The issue of vulnerability to high winds. Here there has been only a very little work done with PRA on ~an reactor, but insights are never-theless possible. For example, a very nice study of winds is incorpo-rated into the recent Indian Point PRA, and gives important vulnerability

.insights'even-though 'the"-quantitative conclustons. are, in my view,

.,highly Qncertain. What could be gained at Ginna is a more systematic understanding of which systems vulnerable to winds comprise which types of safety compromises in which combinations.

(c) The issue of the service water system (Issue ill-5-B, page 4-II). This be discussed further below. 'ill Despite my warning above thai it is dangerous to take PRA analysis too far, I believe that a little too much restraint is shown in Appendix D, specifically in the second long paragraph on page 0-8. Here the view seems to be set forth that PRA's applicability is limited, among other ways, to situations "for which the initiating event frequencies are relatively well-known....". I disagree.

are unknown, there is substantial insight to be gained by studying system dependencies and topologies using the type of thinking that characterizes PRA.

Indeed, it is just such analysi's thai I recommend for studying the vulnera-bility of Ginna from flooding on Deer Creek, and from high winds.

C. APPENDIX F "REVIEW OF OPERATING EXPERIENCE" I found this analysis to be a good one, despite the limitation that the analysis covers only the period through l979. (Irecognize that preliminary examinations were made of operating experience data since then, and that nothing striking pops up except the rather well-known steam generator problem in the, event of 25 January l982.) The discussion of ihe differentiation between "reportable events" and "forced shutdowns" is good, and important because the two categories include quite separate types of events.

The emphasis on trying to ferret out various human errors is appropriate. I myself believe that much more can be learned than has been about how human errors Interact with various hardware and control systems to compromise safety.

In this regard, the fact that such a large percentage (nearly one quarter) of reported events at Ginna can only be assigned an "indeterminate cause" (Page F-72) ls unfortunate. I believe that little effort should now be spent on digging back through Ginna's old log books to clarify these events, but I also think that careful thought should be given to how the large fraction can be reduced in the future by better reporting.

1 ~

',I

)

I

~

)

1 1

'fc I rt

28 June 1982 W.T. Russell page 5 In the context of the SEP mission, I am quite pleased with the overall message of this analysis. The most striking message is that many important systems have quite low failure rates. Examples include only one turbine trip over the plant lifetime; only one loss of offsite power (a very interesting event below); only three losses of feedwater, all in a short period in l97I;

.'ee zero fuel failures; and zero diesel failures on demand in service,'coupled with a very low diesel failure rate in tests. The observation that since l972 there have been no forced shutdowns associated with "operator error" is another example. All of this testifies to a well-'.run power station, because these low rates don't "just happen" .... they exist because of good practice.

The experience with what are called "recurring failures" is mixed. While RG+E seems to have fixed the earlier troubles with control rod drive mechanisms, the problems with emergency bus breakers are not yei solved, apparently. Again, the report affirmatively shows RG+E's diligence, which should be commended. But there is some intersting irony in the report (page F-77) that in the steam gene-rators, "tube thinning and corrosion problems have not yei been solved" ! The utility's multi-million-dollar problem at present with this issue attests to that The loss-of-offsite-power event of October l973 is interesting on two counts.

Fi,ist, apparently there was no definitive pinning down of the cause to operator error, yet one is suspected. This is a good example of why defense-In-depth engineering is so important: such events with no firmly established "cause" obviously cannot be remedied by changes, and obviously cannot be totally avoided either. Second, the rapid cooldown is clearly an event in the "thermal shock" category, probably at some decently high pressure as well. Has this event been analyzed in the pressurized thermal shock context '?

A final comment about Ginna's overall operating experience concerns the finding that over one quarter of all forced shutdowns were instrumantation and control anomalies (page F-5I). Again, as with human errors, this category deserves ihe most careful attention.

To summarize the analysis of operating experience at Ginna is pleasantly easy.

Not much in the way of failures has occurred until the steam-generator problem of recent vintage, and a well-managed plant emerges from the picture.

D. COMMENTS ON SPECIFIC TECHNICAL ISSUES I offer the following comments on specific technical issues within ihe Ginna SEP report. The order of these comments is not lndicati've of their relative importance.

i) Section 3.3.4.I Containment Isolation S stem (Electrical). I note with puzzlement the comment that "the safety injection reset pushbutton was inade-quately physically protected. The licensee has installed a protective tube to provide further protection against Inadvertent actuation." I have two possible explanation for this item's presence in the SEP report: either the staff happened to find this issue, quite unanticipated, in the course of reviewing other things, or the staff was specifical iy JooktncO for this. if the former, fine (it is obviously useful to make any improvements that one notices if they are easy and significant), but in this case what's the comment doing in the SEP

0 f

II ll, I I

11 a 1 II j

ll I

II lf 1 I

IL

~, IL 1 1 I

11 I

II I I I r f$

II I

I I

II I 1I I

1,

'I 1 I I Jl J

~ 'I A

28 June l982 -- W.T. Russell page 6 report  ? If the latter, I am disturbed by the level of detail of staff review.

Does the sjtaff actually review stuff like that, specifically ? .... I mean, is it in the SRP or some other staff review guidance ? If so, I think we should get stuff at that level of detail out of the review.

This comment does not imply In any way that the improvement made is not useful.

ii) Section 4.24 Batter Monitorin and Annunciation. The issue is whether Ginna should install indications of battery current, charger output current, battery high discharge rate, and perhaps otI)er indications and annunciations in the control room. This should help to increase the likelihood that battery faults will be detected between battery service tests. RG+E has apparently agreed to ihe NRC staff position. However, ihe PRA discussion(page D-78 of Appendix D) contains some very interesting information.

Quoting directly: ."The industry-wide battery failure rate is 8.7 x IO /year based on study of Licensee'Event -Report". Approximately half of these failures were not detected until test or surveillance even though the minimum requirements include instrumentation such as is being proposed as backfii to Ginna .... The change in unavailability of a DC bus is only about a factor of 0.5 due to resolution of this issue. This is because a large fraction of battery degra-dations will remain undetected even with increased instrumentation."

My personal conclusion Is thai the licensee's agreeing to conform to the NRC's requirements on this issue, while obviously in the direction of "improved safety", is also obviously either overkill or underkill. Either the DC bus availability is a safety problem, in which case the gain in unavailibility of only a factor of 2 is insufficient (underkill); or the DC bus issue is not a safety problem, in which case the backfit is noi very important (overkill).

My opinion is that DC bus availability ls probably a general safety concern, although whether it is true at Ginna isn't (known to me. If this is the case, ihe staff's imposition of this change is inadequate: the issue may be "resolved" in the context of the SEP program but a different approach is needed to knock on this  ?

This is a good example of an issue where satisfying "the letter of the regu-lations" makes people "feel good" but probably has little to do with actual safety improvement. I say "probably" because I don't know for sure what' going on (or by whom) to study this issue more. If further study is underway, I can only apologize for carrying on in this way.

iii) Section 4.I8 Loose Parts Monitorin . Although Ginna does not have a loose parts monitoring program that meets Regulatory Guide I.I33, backfit is not recommended by the staff. The reasons cited include the observation that no safety-related accidents occurred within a 3I-Incident sample studied recently. The no-backfit decision shows admirable restraint on the part of the staff . Congratulations.

W I

p li

28 June l982 -- W.T. Russell page 7 iv) Section 4.I4 Pi e Break Outside Containment. The issue is in part that pipe breaks in the service water system (SWS) would trip the plant because several key components depend on service water. As the text states (page 4-II),

"In accordance with current criteria, a pipe break thai results in a reactor or turbine trip causes, in turn, a loss of offsite power." This is a arentl an assum tion for re ulator anal sis ur oses. The loss of SWS would bring down the emergency diesels too, however, because at Ginna these depend on SWS.

Loss of diesels would in turn bring down all electrically-driven auxiliary feedwaier pumps, leaving only the single steam-driven auxiliary feedwater pump, "which is susceptible to a postulated single active failure" (quoting the text).

Based on this analysis, the staff has assigned high priority to upgrading the SWS. This seems reasonable on general grounds, but I believe that this is a good example of the possible inadequacy of the "single failure criterion".

Specifically, I think an Imp'roved regulatory position might result from careful analysis of overall system vulnerability. Such an analysis, on a plant-specific basis, would ~indicate whether the scenario just sketched out is at all likely in ihe context of other safety issues. What is the actual likelihood of losing off-site power together with a pipe break in the SWS ? And what is the expected frequency of SWS pipe breaks '?

While I am not proposing the abandonment of the conservative regulatory approach in favor of probabilisiically-based decision-making, I do firmly believe that we could 'learn at two levels from such analysis: the lower level is insight into how urgent the Ginna backfit is; the higher level is how sensible I's the regulatory approach being applied.

v) Section 4.25.4 Pressure Sensor on Com onent Coolin Water Pum s. While Ginna does not satisfy current regulatory policy on this issue, ihe staff has concluded that backfitting is not required because other means 'exist to detect low flow if there is a failure of ihe single pressure sensor.. Insights from the PRA analysis were used to indicate that 'this issue has low safety significance.

I applaud the staff's restraint.

vi) Section 4.5 et al. Flood Protection from Deer Creek. In my discussion on PRA above, I mentioned my feeling that a good systems vulnerability analysis would be of significant value in resolving this issue. Even without much quantification, such an analysis could reveal the interdependencies and correlations among failed systems. The topologies themselves would reveal a lot, and,in fact the exercise of thinking through the topologies would produce the main insights. I repeat here my recommendation that this could be one way to resolve the difference between RG+E and the NRC staff on Deer Creek flooding.

I would also like to comment that the write-up in the Ginna report has insuffi-cient detail to explain what the real issues are.

n A p t

28 June l982 W.T. Russell page 8 vli) Section 4.22 Containment Penetrations. The discussion in the text, though quite long, is,'.impenetrable to the uninitiated. I have read it several times, have tried to compare it with the lengthy discussion and figures in the PRA appendix, and have failed miserably to come up with any feeling about what is right or wrong here. (Hal Lewis'mmortal word "inscruiibleu comes to mind.)

I generally accept the conclusion<of> the PRA analysis that the suggested backflts will make only a modest change in overall containment integrity.

Containment leakage was not found to be an important risk contributor in either the Surry (WASH-l400) or Crystal River analyses. However, I also respect the underlying rationale behind the containment isolation requirements in the General Design Criteria of Part 50. I therefore concur with the staff that the backfits ought to be required unless other considerations (such as very high cost) put a different light on ihe issue.

viii) Section. 4.8 Wind and Tornado Loadin s. The issue here is the apparent vulnerability of several Ginna structures to winds of only modest speeds (and hence of very high expected frequencies of occurrence). The windspeeds are shown in Table 4.2 of the text. Within the SEP, The entire issue is put aside for a later date. Specifically, it has been consolidated with several other issues and will be analyzed on an agreed-upon schedule, with structural upgrading decisions 'de'ferred for now. I concur with this reasonable approach.

On more general gro'unds, however, I would like to state my view that insights gained from a PRA-type vulnerability analysis from winds might be quite valuable. I mentioned this above in my general remarks about PRA, but think it is worth repeating here. A good i'recent example of how PRA thinking gives insights into structural vulnerabilities and their overall role in risk is the wind analysis in the recent Indian Point PRA, which broke new ground in both conclusions from such analyses are highly uncertain with the present state of the art.

E.

SUMMARY

AND CONCLUSIONS My summary and conclusions about the Ginna SEP integrated assessment have been hinted at above in the text. In a nutshell, I believe that the endeavor has been highly successful, has been carried out with admirable restraint vis-a-vis backfitting, and is well balanced. Various reservations about ihe underiakl;ng, stated above, in no way undermine this overall conclusion.

Sincerely yours, h

Robert J. Budnitz

'h h

~'

h e

'1 I I

~ ~

f I h '

II ll ~,

1 ~ I h I; 1 1

f I Ikk>

h