ML18011B124

Technical Evaluation Rept on Individual Plant Exam Front End Analysis

ML18011B124
Person / Time
Site:	Harris
Issue date:	06/16/1995
From:	Darby J, Jeffery Lynch, Thomas W SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	NRC
Shared Package
ML18011B119	List: ML18011B118 ML18011B120 ML18011B124 ML18011B125 ML18011B126
References
CON-NRC-04-91-066, CON-NRC-4-91-66 SEA-92-553-027, SEA-92-553-027-A:4, SEA-92-553-27, SEA-92-553-27-A:4, NUDOCS 9602020042
Download: ML18011B124 (48)

Text

{{#Wiki_filter:SEA 92-553-027-A:4 June 16, 1995 Shearon Harris Technical Evaluation Report on the individual Plant Examination Front End Analysis NRC-04-91-066, Task 27 John L. Darby James R. Lynch, Editor Willard Thomas, Editor Science and Engineering Associates, inc. Prepared for the Nuclear Regulatory Commission 9602020002 960126 PDR ADOCK 05000000 PDR

TABLE OF CONTENTS E. EXECUTIVE

SUMMARY

E.1 E.2 E.3 E.4 E.5 E.6 Plant Characterization............ Licensee's IPE Process Front-End Analysis.. ~........... Generic Issues................. Vulnerabilities and Plant Improvements Observations ~.. ~....... ~...... 1 I 2 3 5 6 72

1. INTRODUCTION 1.1 Review Process......................

1.2 Plant Characterization.................. ~ ~ ~ ~ ~ ~ 8 8 8

2. TECHNICAL REVIEW 2.1 2.2 2.3 2.4 2.5 2.6 2.7 Licensee's IPE Process,....................

2.1.1 Co leteness and Me hodolo 2.1.2 u '-Uni Eff s nd s-Bui -0 at d 2.1.3 Lice see Pa ici a'on n eer vi w... Accident Sequence Delineation and System Analysis

2. ~.1 2.2.2 RSUZSLs

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 2.2.2 ~2 I s ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 2 ~ ~ 2.2.4 S e D nc'uantitative Process....... ~.......... ~.. 2.3.1 u 'c io o cide S ue Fre 2.3.2 and c 'iv'.3.3 of a ci' 2.34 Us of G ne c Dat 2.3.5 m 'fi i Interface Issues........................ 241 Fro a Bc-Ed rf es...... 2.4.2 e Evaluation of Decay Heat Removal and Other Safety 2.5.1 in 'o f DH 2.5.2 Div a of DH 2.5.3 Un' F o D 2.5.4 S U I'sA dress di h bmi al Internal Flooding.... ~................. ~... 261 ne Flop n Me d lo 2.6.2 ternal Floodin esults Core Damage Sequence Results............ 271 Do inn Co Da a e e ue ces ta ~ ~ ~ ~ ~ ~ ies... Iss ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Issues..... ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 10 10 10 10 11 12 12 14 I9 22 23 23 23 23 24 25 26 27 27 28 28 29 29 29 30 30 30 30 31

2.7.2 ~VI I ill i................................... 35 2.7.3 Pro os d Im rovements and Modi ica 's.............. 35

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS............ "...

37 4. DATA

SUMMARY

SHEETS.................................... 39 REFERENCES.............. ~................. ~... 42

LIST OF TABLES Table 2-1. Table 2-2. Table 2-3. Table 2-4. Plant Specific Component Failure Data... ~...........,..... 24 Generic Component Failure Data.......................... 25 Comparis'on of Beta Factors for 2 of 2 Components............ 26 Top 6 Functional Dominant Core Damage Sequences........ ~. 34

LIST OF FIGURES Figure 2-1. Contribution of Initiating Events to Core Damage............ ~. 32 Figure 2-2. Contribution of Classes of Accidents to Core Damage........... 33

E. EXECUTIVE

SUMMARY

This report summarizes the results of our review of the front-end portion of tlute Individual Plant Examination (IPE) for the Shearon Harris plant. This review is based on information contained in the IPE submittal [IPE Submittal] along with the licensee's responses [IPE, Responses] to a request for additional information (RAI). E.1 Plant Characterization The Shearon Harris site contains one unit, a three loop pressurized water reactor (PWR). The unit is located near Raleigh, North Carolina. The unit has a steel lined, pre-stressed, post-tensioned concrete containment. Westinghouse provided the nuclear steam supply system (NSSS), and Ebasco was, the architect engineer (AE) and constructor. The unit achieved commercial operation in 1987. The rated power is 2775 megawatt thermal (MWt) and 860 net megawatt electric (MWe). Similar units in operation are: Beaver Valley 1 and 2, Farley 1 and 2, and HB Robinson 2. Design features at Shearon Harris that impact the core damage frequency (CDF) are as follows: R u'rem n o ansf rsou e f ff'w f omu 't x'tia r nsf rs ni a ra sor er f It wi Ian r' -v'al dc owe re uired o o e e br rs to ffec h rans e This feature raises the CDF due to increasing the probability that the supply of offsite power to the 1E buses is lost following any plant trip. ~ S i-au o wl c o e c c e poli s CS rom 'n e ion ecir ul 'his feature lowers the CDF because operator action following a large loss of coolant accident (LOCA) is not required to switch low pressure pumps from the refueling water storage tank (RWST) to the containment sump; this is accomplished automatically. ~ Te ih esur f "nection PSI E C msgr al h c rin ums e hie c be cml'sh 'e P I u si s fe v ve if o e -o er ed re'ef vav PO V s unav 'able This feature lowers the CDF since the plant can feed and bleed using a safety valve cycling open and closed at its setpoint. Many PWRs cannot feed and bleed without opening a PORV. ~ Thee ar r uire se i e w r for oo'n b o no re uire com onen c li w r CC fo co I'n This feature tends to lower the CDF from a reactor coolant pump (RCP) seal LOCA since loss of CCW by itself does not cause a loss of RCP seal cooling. At some P WRs, loss of CCW causes total loss of RCP seal cooling.

sac ra e emer enc service wa ers s e in addi ion to a normal s rvice Tli f t t th II OOFY th tih Ilk lych d losing all service water is reduced. ~ A lar cond nsa e tor e k for su I of auxili f edwa r This feature lowers the overall CDF by not requiring backup sources of water for AFW over the 24 hour mission time. E.2 Licensee's IPE Process The IPE is a level 2 probabilistic risk assessment (PRA). The licensee initiated work on a PRA for Shearon Harris prior to the issuance of the Generic Letter requiring IPEs to be completed. [IPE Submittal, Section 5.1.1] The initial PRA work was updated for the IPE. The freeze date for the IPE was January 1, 1992. The following changes to the plant made after the freeze data are credited in the IPE model, but these changes had little impact on the results of the IPE: modifications to HPSI minimum flow protection, designation of a rotary air compressor as permanent equipment and changing the power supply for this compressor from a temporary transformer to a non-safety related electrical bus, changing the normal positions of three isolation valves in the instrument air system, replacement of several relief valves in the CCW system with check valves, and completion of an analysis to verify that the residual heat removal (RHR) pumps do not require external CCW cooling prior to the recirculation phase of ECCS operations. Utilitypersonnel performed the majority of the update of an earlier PRA for the IPE. The major contractor for the earlier PRA was Science Applications International Corporation (SAIC). k Plant walkdowns were performed to verify that the PRA model represented the as-built condition. Walkdowns were performed to evaluate equipment manipulations. A plant walkdown specifically for the analysis of internal flooding was performed. Major documentation used in the IPE included: the updated final safety analysis report (UFSAR), Technical Specifications, system descriptions, procedures, design basis documents, plant modification packages, thermal hydraulic analyses, previous PRA documentation, and plant operating history information. Several PRA studies were reviewed, as listed in the main body of this report. The front-end portion of the IPE was subjected to an independent review consistent with the review methodology described in Nuclear Safety Analysis Center (NSAC) report NSAC-67. Personnel from the following organizations constituted the review team: Safety and Reliability Optimization Services (SAROS), Electric Power Research Institute (EPRI), ERIN Engineering and Research, Inc. (ERIN), NUS, Inc. (NUS), and

Pickard, Lowe and Garrick, Inc. {PL&6). Internal reviews were also performed within the IPE project team. Systems engineers reviewed the IPE systems analyses. Operations and training personnel reviewed the results of the IPE. The submittal states that the PRA study, models, and results will be maintained. Therefore, the utilityintends to maintain a 'living'RA. E.3 Front-End Analysis The methodology chosen for the Shearon Harris IPE front-end analysis was a Level I PRA; the small event tree/large fault tree technique with fault tree linking was used and quantification was performed with the Cutset and Fault Tree Analysis (CAFTA) computer code. The IPE quantified 27 initiating events; six LOCAs, 13 plant specific support system failures, and eight generic transients. The IPE developed seven functional event trees for frontline systems to model the plant response to each class of initiating event. The following criteria were used for successful core cooling: coverage of the core with water, or peak cladding temperature less than 2,200 deg. F during accidents for which the core temporarily uncovers (such as a large LOCA). Success criteria were developed based on thermal hydraulic analyses, mostly with the Modular Accident Analysis Program {MAAP),the Updated Final Safety Analysis Report (UFSAR), and engineering judgment. Support system dependencies were modeled in the fault trees. A table of system inter-.dependencies was provided in the submittal. The IPE used plant specific data from 1986 through 1992. Generic data were used to either Bayesian update plant specific data, or in lieu of plant specific data, depending on the statistical significance of the plant specific data. The IPE used a combination of plant specific data and generic data for system unavailability for testing and maintenance. The multiple Greek letter (MGL) method was used to model common cause failures. The data for common cause failures were taken from standard sources, and the values used were consistent with other IPE/PRA studies. Common cause failures were modeled within systems. The internal flooding analysis was performed in the following manner. Areas without flood potential and areas not containing critical equipment were screened from consideration; this screening process also considered flood propagation among the areas. Fifteen areas survived initial screening and were analyzed further. After more

detailed analysis, four areas were retained for quantification. The total frequency for these four initiating events is 5E-6/yr, including failure of operator action to stop the flood, and all of these flooding events led to core damage. The submittal states that spray induced failures were considered with respect to loss of multiple components, but that a detailed treatment of spray effects was not included in the models for internal flooding. Initiating events that contribute the most to CDF, and their percent contribution, are as follows: small LOCA 3 to 5 inches 'oss of offsite power other internal flooding medium LOCA large LOCA loss of 1E Bus 1B-SB turbine trip . partial loss of feedwater Steam Generator Tube Rupture (SGTR) 34% 26% 13% 7% 4% 4 4% 3% 3% 3%. The CDF by functional sequence is as follows: station blackout small LOCA with injection failure small LOCA with recirculation failure transient with loss of decay heat removal (DHR) other internal flooding Anticipated Transient Without Scram (ATWS) early medium LOCA with recirculation failure large LOCA with recirculation failure 26% 17% 17% 11% 10% 7% in core life 6% 3% 3%. Failures in the following mitigating systems contribute the most to the overall CDF, listed in decreasing order of importance: HPSI RHR/Low Pressure Safety Injection (LPSI) Diesel Generators (DGs) Auxiliary Feedwater (AFW) Service Water [Normal Service Water (NSW) and Emergency Service Water (ESW)]

Heating, Ventilating and Air Conditioning (HVAC) for DGs and charging/HPSI pumps CCW DC Power Engineered Safety Features Actuation System (ESFAS) Instrument Power. Operator actions important for the front-end analysis are: failure of operators to establish feed and bleed cooling, and failure of operators to establish cooling for RHR heat exchangers The IPE binned core damage sequences into Plant Damage States (PDS) to facilitate the back-end analysis. The PDSs are a combination of core damage bins and containment status parameters. The binning into PDSs is consistent with the binning process typically used in IPE/PRAs. Based on our review, the following aspects of the modeling process have an impact on the overall CDF: ~ credit for secondary depressurization to use RHR to mitigate a small LOCA if HPSI is lost ~ the seal LOCA model used for station blackout seal LOCA analysis. The first aspect of the modeling process tends to lower the overall CDF since for a small LOCA with loss of HPSI, credit is taken for depressurization with the steam generators and use of RHR. Many PWR IPE/PRAs have not credited secondary depressurization as a means to mitigate a small LOCA with loss of high head injection. The second aspect of the modeling process directly affects the probability of an RCP seal LOCA occurring during all transient accident sequences. Almost all of the CDF from station blackout is associated with core uncovery due to a seal LOCA in the Shearon Harris IPE. E.4 Generic Issues The submittal discusses the general requirements for DHR for the two types of accidents: transients and LOCAs. The submittal states that loss of DHR was inherently considered in the overall PRA, and that loss of DHR following a transient initiating event contributes about 11% to overall CDF. These systems are those previously listed in Section E.3 of this report. No vulnerabilities or cost effective improvements were identified in conjunction with the DHR assessment. e The licensee proposes that the IPE resolves unresolved safety issue (USI) A-17 Systems Interactions. The submittal states that the flooding analysis performed for the

IPE using PRA techniques satisfies resolution of this USI. No other USls or generic safety issues (GSls) are addressed by the IPE.. E.5 Vulnerabilities and Plant Improvements The submittal states: "Rather than attempt to define vulnerabilities, the team used both qualitative and quantitative criteria in successive levels of screening to drive the assessment of possible enhancements." Thus, the IPE focuses on enhancements rather than vulnerabilities. The criteria for evaluating proposed enhancements are as follows: consider cost effectiveness and non-cost related impacts of proposed actions apply Nuclear Management and Resource Council (NUMARC) Report 91-04 guidelines to individual accident sequences if CDF for any accident class falls within NUMARC guidelines after criterion 2, consider additional actions if the total CDF exceeds 1E-4/yr after application of criteria 2 and 3, consider additional actions if a sequence is referred to Severe Accident Management Guidance (SAMG) for consideration, no further evaluation is necessary. No vulnerabilities were identified. During the performance of the IPE, failure to provide offsite power to 1E buses following plant trip was determined to be a significant contributor to CDF. After plant trip, transfer of power from the unit auxiliary transformers to the startup transformers must be accomplished or supply of offsite power to the 1E buses is lost. This transfer requires non-vital DC power for control power to circuit breakers. A procedure change has been implemented to provide for manual operation of circuit breakers if non-vital DC control power is lost. Also, it was verified that the testing and maintenance practices for the non-vital 125 V DC battery are equivalent to the practices for safety-related batteries. The plant is investigating the feasibility of installing improved instrumentation for battery monitoring. The submittal states that early in the IPE study, failure of non-vital DC power contributed about 50% to the overall CDF, and that the IPE as submitted with the total CDF calculated to be 7E-5/yr credits the procedural change that provides for local operation of breakers. No other plant changes as a result of the IPE are discussed in the submittal. Also, the submittal does not discuss enhancements that were recommended as a result of the IPE, other than the one involving the non-vital dc power.

E.6 Observations Strengths of tl>e IPE are as follows. The identification and analysis of planl-specific initiating events in the IPE is especially thorough compared to some other IPE/PRA studies. No weaknesses of the IPE were identified. Significant findings on the front-end portion of the IPE are as follows: Small LOCAs are a significant contributor to the total CDF; dominant post-LOCA failures involve (1) operator failure to transfer the charging/safety injection pump suction from the volume control tank to the RWST, and (2) operator failure to establish CCW cooling to the RHR heat exchangers during recirculation Station blackout leading to a seal LOCA is a significant contributor to the total CDF; the IPE used the NUREG 1150 model for RCP seal LOCAs.

'I. INTRODUCTION 1.1 Review Process This report summarizes the results of our review of the front-end portion of the IPE for Shearon Harris. This review is based on information contained in the IPE submittal [IPE Submittal] along with the licensee's responses [IPE, Responses] to a request for additional information {RAI). 1.2 Plant Characterization The Shearon Harris site contains one unit, a three loop PWR. The unit is located near Raleigh, North Carolina. The unit has a steel lined, pre-stressed, post-tensioned concrete containment. Westinghouse provided the NSSS, while Ebasco was the architect engineer and constructor. The unit achieved commercial operation in 1987. The rated power is 2775 MWt and 860 MWe {net). Similar units in operation are: Beaver Valley 1 and 2, Farley 1 and 2, and HB Robinson 2. Design features at Shearon Harris that impact the CDF are as follows: e ui em t sf r sou ce of o 'er fr m u 'li ransfor e o an for er oltowin a r'vi I d ower re uire o er b ak s ff c t e r sf This feature raisesthe CDF due to increasing the probability that the supply of offsite power to the 1E buses is lost following any plant trip. ~ S mi-auto a'ich ver of CC f o 'n' n re i ul This feature . lowers the CDF because operator action following a LOCA is not required to switch low pressure pumps from the RWST to the containment sump; this is accomplished automatically. he HPSI CCS um are als he har 'n um e a bleed a a co lish wit ne'S u sin a e v ve'O V's bt Thi f t I tt t'DF i h pl t f d dbt d using a safety valve cycling open and closed at its setpoint. Many PWRs cannot feed and bleed without opening a PORV. ~ The ar 'n m r 'res rvc w f o' o t e ui CCW ~~oiJJin. This feature tends to lower the CDF from a RCP seal LOCA since loss of CCW by itself does not cause a loss of RCP seal cooling. At some PWRs, loss of CCW causes total loss of RCP seal cooling.

af r de emer enc servi e.waer s 'in addon pa n r al ervi e i'l i i I ih iiGDFi ii iii liktii d losing all service water is reduced. ar e c n e a e st a tank f rsu l f auxiia e dwa er This feature lowers'the overall CDF by not requiring backup sources of water for AFW over the 24 hour mission time.

2. TECHNICALREVIEW 2.1 Ucensee's IPE Process We reviewed the process used by the licensee in the IPE with respect to the requests of Generic Letter 88-20. [GL 88-20]

2.1.1 Co le en ss a d Methodolo The Shearon Harris IpE is a level 2 pRA. The submittal is complete with respect to the type of information requested by Generic Letter 88-20 and NUREG 1335. The front-end portion of the IPE is a level 1 PRA. The specific technique used for the level 1 PRA was a small event tree/large fault tree technique with fault tree linking, and it was clearly described in the subrriittal. The submittal described the details of the technique. Internal initiating events and internal flooding were considered. Event trees were developed for all classes of initiating events. The development of.component level system fault trees was summarized, and system descriptions were provided. Support systems were modeled with fault trees and linked with the appropriate frontline system fault trees. Inter-system dependencies were discussed in the system descriptions and a table of system dependencies was provided. Data for quantification of the models were provided, including common cause and recovery data. The application of the technique for modeling internal flooding was described in the submittal. No importance or sensitivity analyses were described in the submittal. The methodology applied recovery to dominant core damage cut sets. The licensee initiated work on a PRA for Shearon Harris prior to the issuance of the Generic Letter requiring IPEs to be completed. [IPE Submittal, Section 5.1.1] The initial PRA work was updated for the IPE. 2.1.2 i-U 't e and -Bu It s-0 ra d Shearon Harris is a single unit site; multi-unit considerations do not apply to this unit. Plant walkdowns were performed to verify that the PRA model represented the as-built condition. [IPE Submittal, Section 1.2] Walkdowns were performed to evaluate equipment manipulations. A plant walkdown specifically for the analysis of internal flooding was performed. [IPE Submittal, page 3-24] Major documentation used in the IPE included: the UFSAR, Technical Specifications, system descriptions, procedures, design basis documents, plant modifications, thermal 10

hydraulic analyses, previous PRA documentation, and plant operating history information. [IPE Submittal, Section 2.4.1] Information from several PRA studies was reviewed. The specific PRAs and studies reviewed are as follows: Seabrook PSA Oconee PSA NUREG 1150 and NUREG/CR 4550 PRAs for Sequoyah and Surry Zion Probabllistic Safety Assessment (PSA) Millstone 3 PRA Sizewell B PRA TMI PRA Browns Ferry PRA Turkey Point PRA Indian Point PRA. The freeze date for the IPE model was January 1, 1992. [IPE Submittal, Section 1.2] The following changes to the plant made after the freeze data are credited in the IPE model, but that these changes had little impact on the results of the IPE: modifications to HPSI minimum flow protection, designation of a rotary air compressor as permanent equipment and changing the power supply for this compressor from a temporary transformer to a non-safety related electrical bus, changing the normal positions of three isolation valves in the instrument air system, replacement of several relief valves in the CCW system with check valves, and completion of an analysis to verify that the RHR pumps do not require external CCW cooling prior to the recirculation phase of ECCS operations. [IPE, Responses] The submittal states that the PRA study, models, and results will be maintained. Therefore, the utility intends to maintain a 'living'RA. [IPE Submittal, Section 7.2] 2.1.3 L'c e P ic' n a Pe r ev'. Utilitypersonnel performed most of the work in updating an earlier PRA for the IPE [IPE Submittal, Section 2.2] Utilitystaff performed over 50% of the effort in the earlier 1988 PRA. The major contractor for the earlier PRA was SAIC. The front-end portion of the IPE was subjected to an-independent review consistent with the review methodology described in NSAC-67. Personnel from the following organizations constituted the review team: SAROS, EPRI, ERIN, NUS, and PLB6. Internal reviews were also performed within the IPE project team. Systems engineers reviewed the IPE systems analyses. Operations and training personnel reviewed the results of the IPE.

2.2 Accident Sequence Delineation and System Analysis This section of the report documents our review of both the accident sequence delineation and the evaluation of system performance and system dependencies provided in the submittal. 2.2.1 ~i' E" The IPE describes the process used to identify initiating events. [IPE Submittal, Section 3.1.1] Generic lists of initiating events at PWRs were reviewed. Then lists of initiating events from.past PRAs of similar plants were reviewed. Support systems were examined to identify plant specific initiating events. Initiating events were quantified using both generic data, plant specific data, and evaluation of plant specific support system models. The discussion of initiating events is included in Section 3.1.1 of the submittal. Six categories of initiating events were developed: ~ Transients ~ LOCAs ~ Excessive LOCA (vessel rupture) ~ SGTR ~ Interfacing Systems LOCAs ~ Internal Flooding. The submittal provides a complete description of the process used to identify plant 'specific initiating events. The criteria for a plant specific event to be considered as an initiating event was that the event result in reactor trip or require immediate reactor shutdown, and adversely impact the use of mitigating systems. Numerous plant systems were evaluated for consideration of plant specific initiating events; the submittal provides a discussion of the reviews of these systems, and concludes that the following failures are plant specific initiating events: failure of normal charging (charging pumps also provide HPSI) failure of dc power components failure of normal service water total or partial loss of normal and emergency service water failures of valves in the normal or emergency service water systems loss of CCW loss of instrument air loss of a 1E safety bus. A room heatup analysis was performed and the results of this analysis indicate that the only HVAC systems required are those servicing the charging pumps and the 12

DGs. [)PE, Responses) Therefore, only failures in these particular HVAC systems are possible initiating events. For the OG rooms, toss of HVAC leads to controlled plant shutdown and is therefore not an initiating event. Loss of HYAC to the charging pump rooms was screened from consideration as an initiating event for a number of reasons, including: total loss of HVAC is unlikely, high temperatures in the pump room(s) is annunciated in the control room, during normal operation the charging pumps operate at less than rated flow so the heat input into the rooms is reduced and operation of the charging pumps is possible without HVAC based on plant operating experience, and pan proc lant procedures direct establishing alternative cooling on'loss of HVAC to the rooms. [IPE, Responses] Loss of HVAC to the main control room and to the electrical equipment rooms were also evaluated and screened from consideration as initiating events for a number of

reasons, including: total loss of HYAC is unlikely, these areas are continuously occupied and/or high temperature is annunciated so loss of HVAC would be observed, and significant time is available following loss of HVAC for repair of the HVAC systems or for establishment of alternate cooling methods. [IPE, Responses]

Table 3-4 of the submittal summarizes the transient initiating events modeled and provides the point estimate frequencies for these events. It is notable that containment isolation and loss of normal makeup are included as initiating events. The IPE distinguishes between total and partial loss of main feedwater as initiating events. The submittal states that feedwater is isolated on reactor trip due to primary average temperature reaching the isolation setpoint. [IPE Submittal, Page 3-34] Thus, t't clear that there is as much difference in the impact from these two initiating i is no cear events as in a plant where main feedwater does not isolate following a norma p I lant trip. Evidently, the major difference between the two events is associated with recovery of main feedwater; the submittal states that recovery of main feedwater was considered. [IPE Submittal, Table 3-9] At some PWRs, a break in the steam supply line to the turbine driven AFW pump could represent an initiating event by rendering the AFW system unavailable due to equip uipment qualification (EQ) failures from steam damage. However, this event would not represent an initiator at Shearon Harris as the steam supply lines to the turb'n-driven AFW pump are normally isolated during operations and the piping is not pressurized. The list of transient initiating events assigns a negligible probability to total loss of service water. For total loss of service water, both normal and emergency service water must be lost. The frequency for loss of normal service water is stated to be 0.11/yr. The IPE does consider loss of emergency service water subsequent to loss of normal service water in the mitigation portion of the model, which provides the basis for excluding 'simultaneous'oss of both service water systems as an initiating event.

ln general, the quantification of initiating events was comparable to other PWR IPE/PRA studies. However, it is noted that the frequency for loss of offsite power, 0.05/yr, is low compared to the frequency used for this event in other IPE/PRAs, but the submittal states that this frequency is based on a consideration of plant specific data. [IPE Submittal, Table 3-6] The frequency of an interfacing systems LOCA is 5E-7/yr including consideration of operator mitigative actions, and the model assumed that the LOCA leads to core damage without possibility of mitigation. [IPE Submittal, Pages 2-7 and 3-23] 'The quantification of interfacing system LOCAs credited relief with relief valves inside containment evidently credited the ability of piping/components to withstand pressure in excess of design. Initiating events affecting more than one unit are not applicable to the single unit Shearon Harris site. 2.2.2 ~T I he IPE used event trees with a combined functional and systemic structure to quantify accident sequences. Seven event trees were constructed, these being: [IPE Submittal, Section 3.1.2] transient event tree large LOCA tree medium event tree small LOCA event tree {small LOCA 2) small small LOCA event tree (small LOCA 1) SGTR event tree ATWS event tree. Consideration was given in the transient event trees for transients evolving into a small LOCA, due to either a stuck open pressurizer PORV or an RCP seal LOCA. The mission time used was 24 hours. For most sequences core damage was defined as uncovery of the top of the core. [IPE, Responses] For sequences involving temporary core uncovery, core damage was defined as peak cladding temperature in excess of 2200 F, as indicated by calculations performed with the MAAP code. The design of the ECCS is such that for long term core cooling, injection is to be manually switched from cold leg to hot leg injection to preverit boron precipitation in the core that could block flow of coolant through the core. Long term injection into the cold legs results in most of the water flowing out the break and the flow to the core is only that required to makeup for boiloff; hot leg injection forces all the water through the core prior to exiting the break. The submittal states that it is assumed that long term switchover from cold to hot leg injection is not required, due to the time available

for operator action (many hours) and states that "boron precipitation is not likely to be sufficiently severe to significantly impair core cooling flow", based on analyses performed for similar plants. [IPE Submittal, Page 3-41] The success criteria for a large LOCA include the requirement for containment cooling with an RHR heat exchanger (HX) when ECCS is in the recirculation mode. The amount of containment cooling from 1 RHR HX is less than that provided by the minimum containment heat removal assumed in the UFSAR for analysis of design basis accidents. The minimum containment heat removal capability analyzed in the UFSAR is: 1 RHR train, 1 spray train, and 2 fan coolers, assuming failure of 1 diesel generator following loss of offsite power. The spray system does not remove energy from containment since it contains no heat exchangers; spray affects containment pressure and tends to drive the containment sump and containment atmosphere to thermal equilibrium. Thus, the long term heat removal credited in the UFSAR is 1 RHR HX and 2 fan coolers (1 train). The event tree for the large LOCA models containment heat removal as part of long term ECCS recirculation, and implicitly assumes that loss of cooling to an RHR HX results in total loss of ECCS core cooling; the event tree does not consider ECCS recirculation with RHR without cooling to the RHR heat exchangers but with the use of fan coolers as an option for cooling the containment. Therefore, the event tree does not take credit for the fan coolers for containment cooling even though the fan coolers might be available to perform this function. Also, the event tree does not credit containment spray for long term containment heat removal, which is correct, since as discussed, spray operation does not remove energy from containment. The IPE uses a best estimate containment failure pressure of 153 psig. [IPE Submittal, Pages 4-3 and 4-78] Both the RHR and containment spray (CS) pumps can operate with a saturated sump. [UFSAR, Sections 1.8 and 6.3.2.2.4] HPSI is piggybacked off RHR in recirculation, so HPSI will also function with a saturated sump. MAAP calculations for containment cooling following a large LOCA were performed by the licensee, and that these calculations indicate that no other conditions that adversely affect pump performance willoccur, specifically excessive sump water temperature or inadequate sump water level. [IPE, Responses] The IPE models two classes of small LOCAs: small LOCA 1 and small LOCA 2. Small LOCA 1 is a break of equivalent size between 3/8 and 3 inches. To mitigate a small LOCA 1 with HPSI, steam generator cooling or feed and bleed is required, and recirculation with high pressure recirculation (HPR) piggybacked on low pressure recirculation (LPR) is required. If HPSI is unavailabie, use of LPSI and LPR is credited if secondary depressurization with the steam generator atmospheric dump valves (ADVs) is used. The lower size of the small LOCA 1 is specified as an equivalent break diameter of 3/8 inches. This lower size limit is appropriate based on the normal makeup capacity. 15

A small LOCA 2 is a break of equivalent size from 3 to 5 inches. The model for small LOCA 2 requires HPSI for injection, but only requires LPR without HPR for recirculation. The success criteria for a small LOCA 1 credit depressurization with the secondary and use of RHR for core cooling if injection with HPSI fails. [IPE Submittal, Figure 3-6] Credit for this cooling option is based on MAAP analyses. [IPE Submittal, Page 3-48] Some PRAs/IPEs for PWRs do not credit this option for the mitigation of a small LOCA. The NUREG/CR 4550 PRA studies of Surry and of Sequoyah did not credit this option. [NUREG/CR 4550, Surry] [NUREG/CR 4550, Sequoyah] The event tree credits two options for cooling with RHR: (1) use of shutdown cooling, or (2) use of LPSI injection followed by recirculation from the sump. Although not explicitly discussed in the IPE, credit for shutdown cooling assumes that the rate of inventory loss from the primary is so low at low pressure that makeup to the primary while on shutdown cooling is not needed during the mission time. A medium LOG+ is of equivalent size 5 to 13 inches. A large LOCA is of size greater than 13 inches. The success criteria are equivalent for both medium and large break LOCAs. The ECCS switchover from injection from the RWST to recirculation from the containment sump is semi automatic at Shearon Harris. [UFSAR, Section 6.3.2.8] The RHR/LPSI pumps switchover automatically, but operator action is required to piggyback the HPSI pumps onto the discharge of the RHR heat exchangers for high pressure recirculation. Operator action is also required to provide CCW cooling to the RHR heat exchangers. Since switchover of the low pressure system is automatic, the difference in timing for required operator action in response to the LOCA, namely initiation of RHR heat exchanger cooling, should not be significantly different between the large and medium LOCA situations. The success criteria for all the different LOCAs correctly reflect the operator actions necessary for ECCS semi-automatic switchover from injection with the RWST to recirculation from the containment sump. The fact that operator action is not required to switchover low pressure injection is an important design feature, since IPEs for some other PWRs with~ manual ECCS switchover design have identified failure of operator action to initiate low pressure switchover in a timely manner following a large LOCA as an important contributor to core damage. Only one transient event tree was developed. The submittal states that the safety functions are the same for all transients. [IPE Submittal, Page, 3-28] This is not true; breaks in secondary system piping require isolation of the bad steam generator.

Also, steam line breaks are overcooling transients and the UFSAR analysis requires boration with HPSI to prevent excessive return to power as the primary cools below hot zero power. [UFSAR, Chapter 15] However, other IPEs that have treated overcooling transients in more detail have concluded that they do not contribute significantly to the overall CDF. Therefore, the failure of the Shearon Harris IPE to 16

consider overcooling transients in more detail should have little impact on the overall CDF. Failure to trip the reactor in response to a transient initiating event is modeled as a transfer to the ATWS event tree. The transient event tree credits feed and bleed with 1 HPSI pump and any one pressurizer PORV or safety valve; this is the same criteria as use in the small LOCA 1 success criteria. The submittal states that 1 HPSI pump can provide adequate makeup for feed and bleed using either manual opening of one of the PORVs or by steaming on one safety valve. [IPE Submittal, Page 3-31] Many PWRs cannot feed and bleed with steaming on the safeties since the high pressure pumps provide insufficient flow at the safety setpoint pressure. The use of feed and bleed typically requires operator action to maximize injection; however, the submittal states that manual action is not actually required at Shearon Harris, because auto-actuation of HPSI (based on phase A containment pressure) is sufficient. [IPE Submittal, Page, 3-36) On the other hand, credit for auto-actuation of HPSI makeup for feed and bleed was not credited in the IPE because MAAP runs indicate that there are long periods of core uncovery with sustained high fuel clad temperatures, although the temperatures never reach 2,200 deg. F. Although these results indicate that fuel damage will not occur, the margin was deeged insufficient to credit this option. Also, this option involves failure of operators to properly diagnose the accident and to manually initiate HPSI injection; in this case the operators would be more likely to terminate HPSI injection following automatic initiation of injection. ,The transient event tree considers a transient propagating to a small LOCA by either of the following failures: failure of a pressurizer PORV to reclose if it opened in response to the initiating event, and an RCP seal LOCA resulting from inadequate cooling to the RCP pump motors/seals. The model for failure of a PORV to reclose states that only. one PORV is required to open in response to a transient. [IPE Submittal, Page 3-33] The model for a PORV failing to reclose following a transient initiating event, leading to a small I OCA, modeled all three PORVs were as being challenged to open and that the IPE model considered the possibility that any of these three PORVs could fail to reclose. [IPE, Responses] The transient event tree also considers opening of a PORV if HPSI is initiated and operator action to control HPSI is not taken within 10 minutes. Since the HPSI pumps are the charging pumps, without operator action HPSI will pressurize the primary to relief and safety valves setpoints. As indicated in Table 3-8 of the submittal, credit is taken for isolating a failed-open PORV by operator action to close the PORV block valve. 17

The success criteria for AFW to mitigate a transient is 1 of 3 AFW pumps and one steam generator. [IPE Submittal, Page 3-35] The normal supply of water for AFW is the condensate storage tank {CST). The submittal states that the minimum amount of water available in the CST for AFW is 275,000 gal. but that the normal amount is 415,000 gal. [IPE Submittal, Page 3-119] The IPE assumes that 415,000 gal are available for AFW and states that this inventory is sufficient to provide for decay heat removal with AFWfor the 24 hour mission time. The model for mitigation of a steam generator tube rupture credits options for successful core cooling ifthe bad steam generator cannot be isolated. In particular, depressurization and initiation of RHR shutdown cooling is considered. If depressurization/shutdown cooling fails, the chemical and volume control system is credited for providing makeup to the RWST. A single operator action was included in the fault tree model to provide for failure to refill the RWST. [IPE, Responses] The licensee reviewed the sequence cut sets to confirm that equipment failures in each cutset containing this operator action do not in and of themselves result in loss o The ATWS event tree addresses early in life conditions in which the moderator temperature coefficient is insufficiently negative to allow mitigation of the ATWS. Also, the ATWS model requires turbine trip if the initiating event is loss of feedwater, to prevent core damage. The modeling of these two effects agrees with ATWS analyses The ATWS event tree addresses the possibility of operator action to trip or insert con ro ro s o e t I d t t rminate the fission process. If the rods are not inserted, the model a e. IPE Submittal, indicates that emergency boration is required to prevent core damage. [ Figure 3-8] The IPE used the NUREG 1150 model for RCP seal LOCAs. [IPE Submittal, Page 3-33] Specifically, the IPE assumed that the seals in a tripped RCP pump without any seal cooling, leak after 1.5 hours, and that recovery of seal cooling prior to 1.5 hours I LOCA. If seal cooling is not restored within 1.5 hours, there is about a I to 750 50% probability that the leakage rate from the RCS is greater than or equa o gpm. The submittal states that if the RCPs are not tripped within two.minutes following loss of seal cooling, then the seats fait. [IPE Submittal, Page 3-33] On the other hand, the licensee does not expect that an RCP seal LOCA to develop following a loss of CCW to the RCP ~odors. Some other PWR IPEs have assumed that loss of RCP motor cooling followed by failure to trip the RCP leads to a vibration-induced. seal LOCA from failure of non-cooled motor bearings. [IPE, Responses]

System descriptions are included in Section 3.2 of the submittal. Our detailed comments on the system models are as follows. Table 3-16 of the submittal tabulates the type of model used for the systems modeled in the IPE. Fault trees were developed for the systems except as follows: RCP seal LOCA model based on NUREG 1150 model Loss of offsite power based on data Containment isolations that were screened from consideration were not modeled HVAC systems that were screened from consideration were not modeled. The charging pumps also serve as the HPSI pumps at Shearon Harris. There are 3 charging/HPSI pumps, one of which is a swing pump that can serve either of the two ECCS divisions. The system description states that use of the swing pump with ECCS division B can be accomplished within a few minutes, but that use of the swing pump with train A requires up to 8 hours. The success criteria for LOCAs do not credit use of the swing charging pump. [IPE Submittal, Table 3-5] Use of the swing charging pump was credited in the recovery model. [IPE Submittal, Table 3-34] The system description for HPSI does not discuss requirements for pump cooling. The table of system dependencies provided in the submittal indicates that Emergency Service Water (ESW) is required for HPSI, but no discussion of the dependence is given. [IPE Submittal, Table 3-19] The system description for ESW indicates that service water cools the charging pumps oil coolers, and that normally the supply of service water is from the Normal Service Water (NSW) system (a non-safety system) with backup from the ESW. [IPE Submittal, Figure 3-36] The dependence of HPSI on NSW/ESW is important, since this impacts the likelihood of core damage from an RCP seal LOCA, especially since the charging pumps and the HPSI pumps are one and the same. The system description for HPSI discusses the use of the charging pumps for RCP seal injection, and includes a schematic of the seal injection system. [IPE Submittal, Figure 3-11] The schematic is in error; it shows the RCPs as being located outside of containment which they are not. The system description states that seal return flow isolates on phase A of containment isolation, but that the seal. injection path is not affected. [IPE Submittal, Page 3-83] Evidently, credit is taken for flow out relief valve 1CS-467 to the pressurizer relief tank if seal return is isolated. The UFSAR indicates that seal injection is not isolated on phase B of Containment Isolation (Cl), but that CCW cooling to the RCPs is isolated on phase B of Cl. [UFSAR, Table 6.2.4-1] The system description in the submittal for Cl agrees with the UFSAR. Thus, the effect of containment isolation on the ability to cool the RCP seals is evidently as follows: 19

phase A isolation isolates seal return flow but seal injection continues with relic out valve 1CS-467, phase B isolation isolates CCW supply and return to/from the RCFs including CCW cooling of the thermal barrier cooler which provides for seal cooling if seal injection is lost, and phase B isolation does not isolate seal injection. The IPE considered inadvertent containment phase B isolation as an initiating event, with a frequency of 0.022/yr. [IPE Submittal, Table 3-4] Th ystem description for LPSI states that the RHR/LPSI pumps require cooling from CCW for the pumps seal water heat exchangers whenever the temperature of t es he pumped water exceeds 180 F, which is the case for both shutdown cooling operation or for ECCS recirculation from the containment sump with the RHR pumps. [IPE Submittal, page 3-85] The submittal states that RHR pump cooling during injection is not required. [IPE Submittal, Page 3-142] The system description for CS shows that in recirculation the CS pumps pull directly from the containment sump, and are not piggybacked onto the RHR/LPSI pumps. Switchover of CS from injection to recirculation is automatic. The system description does not indicate the source of cooling for the GS pumps. The system dependency table in the submittal does not indicate any cooling required for the CS pumps. The main feedwater pumps are motor driven. [UFSAR, Section 10.1] The system d sc iption for AFW in the submittal indicates that AFW flow is isolated from faulted steam generators by action of the ESFAS and AFW flow control systems. [IPE Submittal, Page 3-119] This isolation is important for. response to breaks in feedwater and steam lines. Evidently, the AFW pumps are self cooled. = The normal CST supply for AFW is backed up by supply from ESW. Two motor driven AFW pumps and turbine driven AFW pump are provided. The turbine driven AFW pump is supplied with steam from 2 of the 3 main steam lines. The turbine driven AFW pump has a normally closed electrohydraulic (EH) valve in the steam supply line to the drive turbine; also, DC motor operated valves are in both the steam supply line and the pump discharge lines to the steam generators. [IPE Submittal, Figure 3-29] Evidently, the EH valve in the steam supply line to the turbine for the turbine driven AFW pump uses either a DC powered pump or a pressurized accumulator for powering hydraulic fluid, but this is not clear from the submittal. Also, the control power for the valve is not discussed, but it is probably DC, since Table 3-19 of the submittal indicates that AFW depends on DC power. The system description for the steam generator ADVs states that these relief valves are EH valves, with a hydraulic pump backed up by an accumulator for powering the hydraulic fluid, and with control power from the vital AC system. [IPE Submittal, Page 3-125] The nitrogen supply for the accumulators is from an individual bottle 20

independent of the plant nitrogen system. There is one EH ADV on each steam generator, and the valves cannot be opened without AC solenoid control power. The system description states that two of the three ADVs cannot be opened in station blackout, but that one of the ADVs can be opened since its power is provided by a battery-backed inverter system. [IPE Submittal, Page 3-127] The submittal states that opening of one steam generator ADV is sufficient to match decay heat. The primary system pressurizer has 3 air operated, fail closed PORVs and three spring loaded code safety valves. Motor operated block valves are installed upstream of each PORV; the block valves are open during normal plant operation. The PORVs require DC power for solenoid control valves. The air for opening the PORVs is supplied by the plant nitrogen supply system with backup from the instrument air t The PORVs are equipped with accumulators. The system description for the sys em. e is taken in instrument air/nitrogen system states that no credit for the nitrogen system is a the model for the PORVs, and that only the PORV accumulators are credited. [IPE Submittal, Page 3-168] The PORVs on the pressurizer are nitrogen/air operated, fail closed valves. Certain air operated safety/relief valves in use at BWRs cannot be opened or maintained open if containment pressure reaches about 100 psig, due to insufficient differential pressure across the actuator. The pressurizer PORVs are typically non-safety grade components. Some PWR submittals have stated that at high containment temperatures resulting from long term operation of the PORV with feed and bleed, possible EQ effects lead to a high failure probability for the PORV, on the order of 0.5. [Maine Yankee IPE] EQ considerations and the effect of high pressure on the ability to maintain the PORVs open during feed and bleed were not addressed in the Shearon Harris IPE, since it is possible to feed and bleed on the pressurizer safety valves without the PORVs. [IPE, Responses] The system description-for NSW/ESW indicates that the DGs are cooled by service water.,[IPE Submittal, Figure 3-37] The ESW provides for cooling of the containment fan coolers through use of ESW booster pumps piggybacked onto the E W pumps. [IPE Submittal, Figure 3-38] The ESW system is the heat sink for the chilled water system that supplies HVAC for the charging pump rooms, [IPE Submiffal, Figure 3-39] 0 The system description for AC power does not discuss whether or not operator action is possible to crosstie power between the two 1E trains. Based on the information in the submittal, crosstie of power between the two 1E trains was not credited in the IPE model. The IPE did not credit supply of offsite power by backfeeding through the unit auxiliary transformers after plant trip. [IPE Submittal, Page, 3-155] This action would require removing the main generator disconnect links, a process that takes about 8 21

hours, to prevent motoring the main generator. This option for supply of offsite power was credited in the recovery analysis. [IPE Submittal, Page 3-155] The 1E buses are fed from the unit auxiliary transformers during power operation. After trip, the supply of offsite power must be switched to the unit startup transformers, and this requires non-vital DC control power. {Some plants provide offsite power to the 1E buses from the startup transformers during power operation; this design does not require switching the source of offsite power at plant trip.) As discussed in Section 3 of this report, this design feature is important in terms of the overall CDF for the plant. Each of the two DGs has a rating of 6500 KW. [UFSAR Chapter 8] The submittal states that the lifetime of the vital DC batteries is 4 hours, and the battery lifetime for the non-vital DC batteries is 2 hours. [IPE Submittal, pages 3-160 and 3-163] These battery lifetimes do not include operator action for DC load shedding. The IPE did not credit load shedding of the batteries. [IPE, Responses] The submittal includes a system description for HVAC. It is stated that room heatup analyses indicated that only two HVAC systems are required for mitigation, those being HVAC for the charging/HPSI pump rooms, and ventilation for the DG rooms. Room heatup evaluations indicated that loss of HVAC in other rooms was not a factor during the 24 hour mission time. [IPE, Responses] The HVAC system for the charging/HPSI pump rooms uses mechanical refrigeration with air handling units. The DG rooms are cooled by once through ventilation. 2.2.4 S De enc'. Important,asymmetries in train-level system dependencies were indicated. The following types of dependencies were considered: shared component, instrumentation and control, isolation, motive power, direct equipment cooling, area HVAC, operator actions, and environmental and phenomenological effects. Our specific comments on the dependency table follow. The dependency table indicates partial dependencies. The dependency table does not indicate a dependency of the pressurizer PORVs on DC control power; however, the PORVS require DC solenoid control power to open. The dependency table does not indicate a dependence of the steam generator ADVs on nitrogen/air. As explained in the system description for these valves, they require nitrogen to open, but a dedicated nitrogen tank is provided.'onetheless, the dependency table should indicate a dependency on nitrogen with an accompanying footnote explaining that dedicated nitrogen bottles are provided, since without this dependence noted, the table implies that the valves do not require motive power to open. 22

2.3 Quantitative Process This section of the report summarizes our review of the process by which the IPE quantified core damage accident sequences. It also summarizes our review of the data base, including consideration given to plant specific data, in the IPE. The uncertainty and/or sensitivity analyses that were performed, if any, were also reviewed. 2.3.1 ua ifi ation of cciden Se uen u ncies. The Shearon Harris IPE used the small event tree/large fault tree technique with fault tree linking for quantifying core damage. Support systems were modeled with support system fault trees, linked as necessary to frontline system fault trees. The event trees were functional, with top logic used in the event fault trees to consider initiator-specific effects on the availability of mitigating systems. [IPE Submittal, Page 2-7] The CAFTA computer code was used to quantify the fault trees and the event sequences. [IPE Submittal, Page 3-233] The cut set truncation limit used was 1E-8/yr. [IPE Submittal, Page 3-234] Recovery actions were applied to dominant sequence cut sets. [IPE Submittal, Page 3-235] 2.3.2 oi Es im nd nc ai Sensi ivi n se Mean values were used for point estimate failure frequencies and probabilities. A 24 hour mission time for mitigation of an accident was used. The submittal does not contain an uncertainty or a sensitivity analysis. 2.3,3. Use of P Da The plant had about 5 years of plant operating experience applicable to the IPE freeze date. [IPE Submittal, Section 2.3.2] Plant specific data were collected only for a limited set of components. It was decided to use plant specific data for individual pumps and for the DGs. The submittal states that plant specific data from January 1986 through December 1992 were gathered for the following components: [IPE Submittal, Page 3-213] DGs AFW pumps NSW pumps ESW pumps HPSI pumps RHR pumps CCW pumps CS pumps. 23

A Bayesian technique was used to update generic data with the plant specific data for these selected components. Table 3-26 of the submittal summarizes the plant specific data used in the IPE. Table 2-1 of this report compares the plant specific data for selected components from Table 3-26 of the submittal to values typically used in IPE/PRA studies, using the NUREG/CR 4550 data for comparison. [NUREG/CR 4550, Methodology] A combination of plant specific and generic data was used to quantify unavailabilities due to testing and maintenance. [IPE Submittal, Page 2-9] Based on the data in Table 2-1, the plant specific failure data are generally comparable to other IPE/PRA studies, although the DG failure values are lower than typical DG failure values. 2.3.4 U e of G ner'c D Numerous sources of generic data were used as listed in Table 3-23 of the submittal These sources include: NUREG/CR 4550 reports, IEEE Std. 500, and numerous PRAs. Table 3-24 of the submittal provides the generic data used in the IPE. The data consists of a mean and a range factor for each component; the range factors are based on fitting the probability distributions for the failure values with lognormal distributions. Table 2-1. Plant Specific Component Failure Data 'omponent Turbine driven AFW pump HPSI pump RHR pump ESW pump Diesel Generator Point Estimate From Submittal Table 3-26 3E-2 Fail to Start 5E-3 Fail to, Run 1E-3 Fail to Start 1E-5 Fail to Run 2E-3 Fail to Start 2E-5 Fail to Run 2E-3 Fail to Start 5E-5 Fail to Run 5E-3 Fail to Start 4E-4 Fail to Run NUREG/CR 4550 Point Estimate 3E-2 Fail to Start 5E-3 Fail to Run 3E-3 Fail to Start 3E-5 Fail to Run 3E-3 Fail to Start 3E-5 Fail to Run 3E-3 Fail to Start 3E-5 Fail to Run 3E-2 Fail to Start 2E-3 Fail to Run Failures to start or open are probabilities of failure on demand. Failures to run are frequencies in 1/hr.

We performed a comparison of the data for selected components from Table 3-24, to generic values use in the NUREG/CR-4550 studies; [NUREG/CR 4550, Methodology] the comparison is summarized in Table 2-2. Table 2-2. Generic Component Failure Data 'OV Component Point Estimate From Submittal Table 3-24 3E-3 Fail to Open NUREG/CR 4550 Point Estimate 2E-3 Fail to Operate EH Valve AC Bus Circuit Breaker Pressurizer PORV 1E-3 Fail to Open 2E-7 1E-3 Fails to Open 1E-2 Fail to Open 2E-2 Fail to Close 2E-3 Fail to Operate 3E-3 Fail to Operate 2E-3 Fail to Open 2E-3 Fail to Close Failures to start, open, or operate are probabilities of failure on demand. Failure of the ac bus is a frequency in 1/hr. Based on the data in Table 2-2, the generic data used in the IPE are consistent with generic data used in typical PRA studies. The IPE applied recovery actions to cut sets of dominant core damage sequences. [IPE Submittal, Page 3-229] All the recovery actions credited in the IPE are proceduralized. Data from NSAC-166 were used to estimate the likelihood of recovering offsite.power. [IPE, Responses] Based on this source, the probability of not recovering offsite power within 30 minutes is 0.70 and the probability of not recovering power within 1 hour is 0.51. These values agree with typical non-recovery data used in many IPE/PRAs. 2.3.5 Co The submittal states that information from EPRI NP-5613 and from NUREG/CR-4780 was used to model common cause failure. [IPE Submittal, Pages 3-70 and-3-217] The MGL technique was used to quantify common cause failure. The submittal summarizes the screening criteria used for identifying common cause failures to be modeled, and lists the components retained for common cause failure analysis. [IPE Submittal, Tables 3-28 and 3-29] Evidently, common cause failures across systems were screened from consideration; this is the typical practice used in PRA. The list of components retained for common cause analysis includes the usual

components-pumps, valves, DGs, batteries, and so forth-and it also includes circuit breakers and instrumentation components. Tables 3-30 and 3-31 of the submittal lists the common cause failure data MGL factors used. We compared selected beta factors from this table in the submittal to those used in the NUREG/CR 4550 PRAs for 2 of 2 components. [NUREG/CR 4550, Methodology] Table 2-3 of this report summarizes the comparison. The data in Table 2-3 of this report indicate that the common cause failure factors used in the IPE are comparable with those used in typical PRAs. 2A Interface Issues This section of the report summarizes our review of the interfaces between the front-end and back-end analyses, and the interfaces between the front-end and human factors analyses. The focus of the review was on significant interfaces that affect the ability to prevent core damage. Table 2-3. Comparison of Beta Factors for 2 of 2 Components Component AFW Pump (Motor Driven) ESW Pump CCW Pump RHR Pump HPSl Pump Containment Spray Pump MOV Diesel Generator Beta Factor from IPE 0.21 Fail to Start 0.028 Fail to Run 0.064 Fail to Start 0.068 Fail to Run 0.16 Fail to Start 0.067 Fail to Run 0.1 Fail to Start 0.041 Fail to Run 0.12 Fail to Start 0.047 Fail to Run 0.45 Fail to Start 0.1 Fail to Run 0.03 0.016 Fail to Start 0.028 Faii to Run Beta Factor from NUREG/CR 4550 0.056 Fail to Start 0.026 Fail to Start 0.026 Fail to Start 0.15 Fail to Start 0.21 Fail to Start 0.11 Fail to Start 0.088 Fail to Open 0.038 Fail to Start Pressurizer PORVs 0.1 Fail to Open (3 of 3) 0.07 Fail to Open {2 of 2)

2.4.1 ron -En and Back-End Interface Tne IPE required minimal containment cooling for accidents in which energy and mass are released into containment; specifically, 1 RHR heat exchanger cooled by CCW was required. The IPE did not consider containment cooling with fan coolers in the front-end analysis. This aspect of the model was previously discussed in Section 2,2.2 of this report. The IPE implicitlyassumes that loss of containment cooling leads to core damage before containment failure, because the success criteria assume that failure to cool the RHR heat exchangers leads to loss of cooling to the core in recirculation from the sump. The submittal indicates that containment Isolation phase A isolates seal return flow, but seal injection flow is not lost due to relief out a relief valve to the pressurizer quench tank. Containment isolation phase 8 causes isolation of all CCW cooling to the RCPs, specifically motor bearing cooling and thermal barrier cooling, but seal injection from the charging pumps is not isolated. The IPE binned core damage sequences into Plant Damage States (PDS) to facilitate the back-end analysis. [IPE Submittal, Section 4.3] The PDSs are a combination of core damage bins and containment status parameters. The core damage bins coalesce core damage sequences based on the following parameters: [IPE Submittal, Table 4-4] RCS pressure at vessel breach RCS leakage prior to vessel failure presence of water in reactor cavity and lower compartment at vessel breach availability of heat removal using the steam generators timing of vessel failure. A Containment Safeguards Event Tree (CSET) was developed to specify the combinations of states of containment after core damage. [IPE Submittal, Figure 4-16] There are a total of 306 possible PDSs from combining all possible core damage bins with all possible CSET end states. Using a truncation value if 1E-7, the number of PDSs was reduced to 17. [IPE Submittal, Section 4.3.3] Table 4-18 of the submittal lists the PDSs above this screening value. The PDS binning process is comparable to the process used in other IPE/PRAs. 2.4.2 u F c r e c s. Based on our front-end review, we noted the following operator actions for possible consideration in the review of the human factors aspects of the IPE: 27

operator actions to manually operate circuit breakers in non-vital dc system to effect transfer of offsite power supply to startup transformers after plant trip operator action to initiate feed and bleed operator action to depressurize with the steam generator ADYs operator action to trip or insert control rods following ATWS operator action to go to shutdown cooling after a SGTR that cannot be isolated operator action to refill the RWST after a SGTR that cannot be isolated and with failure to go to shutdown cooling operator action to use the swing charging/HPSl pump operator action to provide main feedwater after a transient (main feedwater isolates) operator action to recover service water to prevent RCP seal LOCA operator action to crosstie power between the two 1E trains (if possible) operator action to trip RCPs within 2 minutes after loss of RCP cooling to prevent RCP seal LOCA operator action to piggyback HPSl pumps onto RHR pumps for high pressure recirculation following small LOCA operator action to initiate cooling of RHR heat exchangers operator actions to supply offsite power via backfeed through unit auxiliary transformers as a recovery action operator actions to stop flooding in service water tunnel and in level 236 of reactor auxiliary building. 2.5 Evaluation of Dec'ay Heat Removal and Other Safety issues This section of the report summarizes our review of the evaluation of Decay Heat Removal (DHR) provided in the submittal. Other GSI/USl's, if they were addressed in the submittal, were also reviewed. 2.5.1 amina ' DHR is addressed throughout. the IPE model, and Section 3.4.3 of the submittal specifically discusses DHR. This section of the submittal discusses the general requirements for DHR for the two types of accidents: transients and LOCAs. The submittal states that loss of DHR was inherently considered in the overall PRA, and that loss of DHR following a transient initiating event contributes about 11% to overall CDF. No vulnerabilities or cost effective improvements were identified in conjunction with the DHR assessment. The following mitigating systems contribute the most to the loss of DHR, listed in decreasing order of importance: [lPE, Responses]

HPS) RHR/LPSI DGs AFW Service Water (NSW and ESW) HVAC for DGs and charging/HPSI pumps CCW DC Power ESFAS Instrument Power. 2.5.2 Dive Me f D R. The IPE evaluated the diverse means for DHR, including: use of the power conversion system, feed and bleed, auxiliary feedwater, and ECCS. Depressurization using the secondary was considered for small LOCA 1 accidents when HPSI was unavailable. Cooling for RCP seals was considered. Containment cooling to support operation of core cooling equipment was addressed. 253 Un'F a esofDH Unique features at Shearon Harris related to DHR that impact the core damage frequency (CDF) are as follows: semi-automatic switchover of ECCS from injection to recirculation the HPSI ECCS pumps are the charging pumps, feed and bleed can be accomplished with one HPSI pump using a safety valve if a PORV is unavailable a safety grade emergency service water system in addition to a normal service water system a large condensate storage tank for supply of auxiliary feedwater The impact of these design features on CDF is discussed in Section 1.2 of this report. 2.5.4 0 GSI I're e in Sub '. The IPE proposes to resolve USI A-17 with respect to internal plant flooding. [IPE Submittal, Section 3.4.4J The submittal states that the detailed treatment of internal flooding in the PRA resolves USI A-17. No other USI/GSls are addressed in the IPE. [IPE Submittal, Section 3.4.5]

2.6 internal Flooding We reviewed the process by which ihe IPE modeled core damage from internal flooding, and we reviewed the results of the internal flooding analysis. 2.6.1 er al Ff od' h dolo The following process was used to address internal flooding. [IPE Submittal, Page 3-

24) Areas without flood potential and areas not containing critical equipment were screened from consideration; this screening process also considered flood propagation among the areas.

Fifteen areas survived initial screening and were analyzed further. After more detailed analysis, four areas were retained for quantification. The total frequency for these four initiating events is 5E-6/yr. These events were quantified for core damage using the transient event tree accounting for the pre-existing unavailabilities due to the initiating event, that being the flood. The submittal states that spray induced failures were considered with respect to loss of multiple components, but that a detailed treatment of spray effects was not included in the models for internal flooding. The assessment of spray-induced failures focused on failures of multiple components and that due to the separation distances or intervening structures between the multiple components, no important spray scenarios were identified which could affect redundant components. 2.6.2 l ternal Flo i esul s. Four flooding events were retained for quantification for contribution to CDF. Two of these floods are in the service water tunnel, and involve breaks in large service water pipes. Without operator action, these floods fail RCP.seal cooling systems, ECCS systems, and AFW, and lead to core damage from a seal LOCA that cannot be mitigated. The other two floods are due to pipe breaks in level 236 of the reactor auxiliary building. Without operator actions, these two floods fail the same equipment do the floods in the service water tunnel, and lead to core damage from a seal LOCA that cannot be mitigated. The overall CDF from internal flooding is about 5.0E-6/yr. 2.7 Core Damage Sequence Results This section of the report summarizes our review of the dominant core damage sequences reported in the submittal. The reporting of core damage sequences-whether systemic or functional-was reviewed for consistency with the screening criteria of NUREG-1335. The definition of vulnerability provided in the submittal was reviewed. Vulnerabilities and enhancements to plant hardware and procedural modifications, as reported in the submittal, were reviewed. 30

2.7.1 Do inant Core D ma e Se uences. The IPE utilized functional event trees, and reported results using the screening criteria from NUREG 1335 for functional sequences. [IPE Submittal, Section 3.4.1] Figure 2-1 of this report summarizes the contribution to core damage by internal initiating event based on Figure 1-1 of the submittal. There appears to be an error in this data; internal flooding is stated to contribute 5% to total CDF, but the CDF from internal flooding given in the submittal is 5E-6/yr and the overall CDF is 7E-5/yr, implying that internal flooding contributes 7%. Figure 2-2 of this report summarizes the contribution to core damage by class of accident sequence based on Figure 1-1 of the submittal; note that internal flooding contributes 7% as expected. The submittal discusses the highest frequency functional core damage sequences, per the screening criteria of NUREG 1335. [IPE Submittal, pp. 3-243 through 3-249) The total CDF from internal initiating events and internal flooding is 7E-5/yr. The CDF from internal flooding is 5E-6/yr. The CDF from each functional sequence in the event trees is listed in Table 3-36 of the submittal.. The top six sequences are summarized in Table 2-4 of this report. As discussed in Section 2.2.2 of this report, the fourth sequence in Table 2-4 leads to core damage because the model did not credit automatic actuation of HPSI and the use of the safety valves for successful feed and bleed, even though analyses indicate that this may be a viable option. The IPE screened out sequences involving total loss of service water. Total loss of service water without recovery might lead to a seal LOCA, since loss of service water causes loss of CCW which causes loss of thermal barrier cooling, and HPSI/charging pump cooling is lost since service water has failed. However, under these circumstances, the plant would be able to depressurize with the steam generators and provide primary makeup with the RHR/LPSI pumps. Per plant procedures, the operators would inhibit automatic switchover to sump recirculation and instead remain in the injection mode. Several means would be available to provide makeup to the RWST, including use of the demineralized water system. The unavailability of service water would not prevent the long-term use of this cooling method, as the RHR/LPSI pumps can operate indefinitely in the injection mode without external cooling. In addition, the condensate storage tank inventory is sufficient to provide secondary cooling for the 24 hour front-end mission time. The licensee estimated that sequences involving total loss of service water would have a CDF contribution of approximately 1 E-07/yr. 31

Contribution of Initiating Events to Core Damage for Shearon Harris Small LOCA, 3 to 5 inch Loss Offsite Power Other cI ill U) C ~~ lU SGTR Internal Flood. Medium LOCA Large LOCA Loss Bus 1B-SB Turbine Trip Partial Loss Feedwater 10 15 20 25 % Contribution to CDF 30 35 Figure 2-1. Contribution of initiating Events to Core Damage 32

Contribution of Classes of Accidents to Core Damage at Shearon Harris Station Blackout Small LOCA, No Injection Small LOCA, No Recirculation Transient, Loss DHR Other Internal Flood ATWS early in Life Medium LOCA, No Recirculation Large LOCA, No Recirculation 0 10 i5 20 % Contribution to CDF 25 30 Figure 2-2. Contribution of Classes of Accidents to Core Damage. 33

Table 2-4. Top 6 Functional Core Damage Sequences lnNating Event Subsequent Failures Sequence Frequency 1/yr % of Total CDF Transient (dominated by loss of offsite power) Station Blackout without 1.8E-5, 26% recovery of offsite power leading to RCP seal LOCA that cannot be mitigated Small LOCA, Class 2 Small LOCA, Class 2 Failure of HPSl Failure of low pressure recirculation from containment sump 1.2E-5, 17% 1.1E-5; 17% Transient Failure of SG cooling, Failure of 7.8E-6, 11% operator action to establish feed and bleed Internal Flooding with failure of operator action to stop the flood Flood fails RCP seal cooling, 5.0E-6, 7% ECCS, and SG Cooling leading directly to core melt Transient early in core life Failure to trip reactor, core damage due to moderator temperature coefficient insufficiently negative for adequate pressure relief 4.2E-6, 6% The contribution to overall CDF from a large LOCA is small; low pressure ECCS switchover is automatic at Shearon Harris and thus operator action is not required for ECCS switchover following a targe LOCA. (Operator action is required later to initiate RHR heat exchanger cooling with CCW.) ln IPEs for some other PWRs with manual ECCS switchover, failure of the operators to initiate switchover following a large LOCA is a significant contributor to overall CDF. The submittal does not provide a separate discussion of component failures in mitigating systems that dominant CDF. Some information on dominant component failures can be found in the discussion of the top 6 sequences, but no quantitative measure of the importance of component failures is provided in the submittal. Based on the descriptions of the top 6 core damage sequences-those listed in Table 2-4 of this report-the following component failures and human errors are important:

failure of operators to establish feed and bleed cooling failure of both DGs failure of reactor trip breakers failure of HPSI pumps failure of operators to establish cooling for RHR heat exchangers. Failures in the following mitigating systems contribute the most to the overall CDF, listed in decreasing order of importance: [IPE, Responses] ~ HPSI ~ RHR/LPSI ~ DGs ~ AFW ~ Service Water {NSW and ESW) ~ HVAC for DGs and charging/HPSI pumps ~ CCW ~ DC Power ~ ESFAS ~ Instrument Power.. 2.22 ~II 2'll 'ection 3.4.2 of the submittal addresses vulnerabilities. The submittal states: "Rather than attempt to define vulnerabilities, the team used both qualitative and quantitative criteria in successive levels of screening to drive the assessment of possible enhancements." Thus, the IPE focuses on enhancements rather than vulnerabilities. The criteria for evaluating proposed enhancements are as follows: [IPE Submittal, page 3-250] consider cost effectiveness and non-cost related impacts of proposed actions apply NUMARC Report 91-04 guidelines to individual accident sequences if CDF for any accident class falls within NUMARC guidelines after criterion 2, consider additional actions ifthe total CDF exceeds 1E-4/yr after application of criteria 2 and 3, consider additional actions if a sequence is referred to Severe Accident Management Guidance {SAMG)for consideration, no further evaluation is necessary The IPE does not specifically identify any vulnerabilities. 2.7.3 r 0 d v n n M i'aio s. The IPE identified one enhancement that has been implemented. [IPE Submittal, Page 3-253 and Section 6-1] The plant non-vital'DC power system was noted to have a 35

significant contribution to CDF. The importance of this system is due to its use for transferring offsite power from the unit auxiliary transformers to the unit startup transformers following plant trip, to provide offsite power to 1E buses. The non-vital DC power system is required for control power to circuit breakers. A o edure change has been implemented to provide for manual operation of circuit breakers if non-vital DC control power is lost. Also, it was verified that the testing an d maintenance practices for the non-vital 125 V DC battery are equivalent to the practices for safety-related batteries. The plant is investigating the feasibility of installing improved instrumentation for battery monitoring. The submittal states that early in the IPE study, failure of non-vital DC power contributed about 50% to the overall CDF, and that the lPE as submitted with the total CDF calculated to be 7E-5/yr credits the procedural change that provides for local operation of breakers [IPE Submittal, Cover Letter] 36

3. CONTRACTOR OBSERVATIONS AND CONCLUSIONS This section of the report provides our overall evaluation of the quality of the front-end portion of the IPE based on this review. Strengths and weaknesses of the IPE are summarized.

Important assumptions of the model are summarized. Major insights from the IPE are presented. Strengths of the IPE are as follows. The identification and analysis of plant-specific initiating events in the IPE is especially thorough compared to some other IPE/PRA studies. No weaknesses of the IPE were identified. The submittal states that early in the IPE study, failure of non-vital DC power contributed about 50% to the overall CDF, and that the IPE as submitted with the total CDF calculated to be 7E-5/yr credits the procedural change that provides for local operation of breakers. Based on our review, the following aspects of the modeling process have an impact on the overall CDF: ~ credit for secondary depressurization to use RHR to mitigate a small LGCA if HPSI is lost ~ the seal LOCA model used for station blackout seal LOCA analysis. The first aspect of the modeling process tends to lower the overall CDF since for a small LOCA with loss of HPSI, credit is taken for depressurization with the steam generators and use of RHR. Many PWR IPE/PRAs have not'credited secondary depressurization as a means to mitigate a small LOCA with loss of high head injection. The second aspect of the modeling process directly affects the probability of an RCP seal LOCA occurring during all transient accident sequences. Almost all of the CDF from station blackout is associated with core uncovery due to a seal LOCA in the Shearon Harris IPE. Significant findings on the front-end portion of the IPE are as follows: Small LOCAs are a significant contributor to the total CDF; dominant post-LOCA failures involve (1) operator failure to transfer the charging/safety injection pump suction from the volume control tank to the RWST, and (2) operator failure to establish CCW cooling to the RHR heat exchangers during recirculation. 37

Station blackout leading to a seal LOCA is a significant contributor to the total CDF; the IPE used the NUREG 1150 model for RCP seal LOCAs.

4. DATA

SUMMARY

SHEETS This section of the report provides a summary of information from our review. O~ll OO The total CDF from internal initiating events and internal flooding is 7E-5/yr. The CDF from internal flooding is 5E-6/yr. l Do i an i iatin Event Con rib 'o DF small LOCA 3 to 5 inches loss of offsite power other internal flooding medium LOCA large LOCA loss of 1E Bus 1B-SB turbine trip partial loss of feedwater SGTR 34% 26% 13% 7% 4 4% 4% 3% 3% 3%0 D inan ardware Fail r an 0 era or Err r Con rib tin t CDF Failures in the following mitigating systems contribute the most to the overall CDF, listed in decreasing order of importance: HPSI RHR/LPSI DGs AFW Service Water (NSW and ESW) HVAC for DGs and charging/HPSI pumps CCW DC Power ESFAS Instrument Power. Operator actions important for the front-end analysis are: failure of operators to establish feed and bleed cooling, and failure of operators to establish cooling for RHR heat exchangers. 39

Domi a Ac ident Classes Contribu in o CDF The CDF by sequence is as follows: station blackout small LOCA with injection failure small LOCA with recirculation failure transient with loss of DHR other internal flooding ATWS early in core life medium LOCA with recirculation failure large LOCA with recirculation failure 26% 17% 17% 11% 10% 7% 6% 3% 3%. Desi n Charac eris i s lm rt nt for CDF Design features at Shearon Harris that impact the core damage frequency (CDF) are as follows: 2. 3. 4. 5. requirement to transfer source of offsite power from unit auxiliary transformers to unit startup transformers following plant trip; non-vital dc power required to operate breakers to effect the transfer semi-automatic switchover of ECCS from injection to recirculation the HPSI ECCS pumps are the charging pumps, feed and bleed can be accomplished with one HPSI pump using a safety valve if a PORV is unavailable the charging pumps require service water for cooling but do not require CCW for cooling a safety grade emergency service water system in addition to a normal service water system a large condensate storage tank for supply of auxiliary feedwater. odifica io s A procedure change has been implemented to provide for manual operation of circuit breakers if non-vital DC control power is lost. Aiso, it was verified that the testing and maintenance practices for the non-vital 125 V DC battery are equivalent to the practices for safety-related batteries. The plant is investigating the feasibility of installing improved instrumentation for battery monitoring. The submittal states that early in the IPE study, failure of non-vital DC power contributed about 50% to the overall CDF, and that the IPE as submitted with the total CDF calculated to be 7E-5/yr credits the procedural change that provides for local operation of breakers. [IPE Submittal, Cover Letter] 40

No other plant changes as a result of the. IPE are discussed in the submittal. Also, the submittal does not discuss enhancements that were recommended as a result of the IPE, other than the one involving the non-vital DC power. Oh rU I/ SsAddre d The licensee proposes that the IPE resolves USI A-17 Systems Interactions. The submittal states that the flooding analysis performed for the IPE using PRA techniques satisfies resolution of this USI. No other USI/GSI's are addressed by the IPE. Si nif'n RA Fi din Significant findings on the front-end portion of the IPE are as follows: Small LOCAs are a significant contributor to the total CDF; dominant post-LOCA failures involve (1) operator failure to transfer the charging/safety injection pump suction from the volume control tank to the RWST, and {2) operator failure to establish CCW cooling to the RHR heat exchangers during recirculation. Station blackout leading to a seal LOCA is a significant contributor to the total CDF; the IPE used the NUREG 1150 model for RCP seal LOCAs. 41

REFERENCES [GL 88-20] [NUREG-1 335] [IPE Submittal] "individual Plant Examination For Severe Accident Vulnerabilities - 10 CFR 50.54 (f)", Generic Letter 88.20, U.S. Nuclear Regulatory Commission, November 23, 1988. "Individual Plant Examination Submittal Guidance", NUREG-1335, U. S. Nuclear Regulatory Commission, August, 1989. Shearon Harris IPE submittal, August 20, 1993 [UFSAR] [Tech Specs] [IPE, Responses] [NUREG/CR-5102] [NUREG/CR 4550, Sequoyah] (NUREG/CR 4550, Surry] Updated Final Safety Analysis Report for Shearon Harris Technical Specifications for Shearon Harris Letter from W.R. Robinson, CP&L, to NRC, File Number HO-950069 Serial: HNP-94-006, no date "Interfacing Systems LOCA, Pressurized Water Reactors', NUREG/CR-51 02, Feb 89. NUREG/CR-4550, Vol 5, Rev 1,'art 1, Analysis of Core Damage Frequency from internal Events: Sequoyah, Unit 1 NUREG/CR-4550, Vol 3, Rev 1, Part 1, Analysis of Core Damage Frequency: Surry, Unit 1 Internal 'Events [NUREG/CR 4550, Methodology] [Maine Yankee IPE] NUREG/CR-4550, Vol 1 Rev 1, Analysis of Core Damage Frequency: Internal Events Methodology IPE Submittal for Maine Yankee 42

ENCLOSURE ~ =APPENDIX B SHEARON HARRIS NUCLEAR PLANT INDIVIDUALPLANT EXAMINATION TECHNICAL EVALUATION REPORT (BACK-END)}}