ML18038B241

Forwards Browns Ferry Nuclear Plant Multi-Unit Pra. No Addl Enhancements Required to Address Vulnerabilities

ML18038B241
Person / Time
Site:	Browns Ferry
Issue date:	04/14/1995
From:	Salas P TENNESSEE VALLEY AUTHORITY
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
Shared Package
ML18038B242	List: ML18038B241 ML18038B243
References
NUDOCS 9504180280
Download: ML18038B241 (29)

Text

P'JRj.MJKjl. JL Y 1 (ACCELERATED RIDS PROCESSING REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:9504180280 DOC.DATE: 95/04/14 NOTARIZED: NO DOCKET N FACIL:50-259 Browns Ferry Nuclear Power Station, Unit 1, Tennessee 05000259 50-260 Browns Ferry Nuclear Power Station, Unit 2, Tennessee 05000260 50-296 Browns Ferry Nuclear Power Station, Unit 3, Tennessee 05000296 P AUTH. NAME AUTHOR AFFILIATION SALAS,P. Tennessee Valley Authority R RECIP. NAME RECIPIENT AFFILIATION Document Control Branch (Document Control Desk)

I

SUBJECT:

Forwards "Browns Ferry Nuclear Plant Multi-Unit PRA." No addi enhancements required to address vulnerabilities.

DISTRIBUTION CODE: D030D TITLE: TVA Facilities COPIES RECEIVED:LTR Routine Correspondence ENCL SIZE $ SPY NOTES:

RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL '~

ID CODE/NAME LTTR ENCL PD2-4 1 1 PD2-4-PD 1 1 WILLIAMS,J. 1, 1 INTERNAL: ACRS 6 6 ILE CENTER 01 1 1 NRR/DSSA 1 .1 OGC HDS3 1 0 RES/DE/SSEB/SES 1 1 EXTERNAL: NOAC NRC PDR 0 ~c D C

u NOTE TO ALL"RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE iVASTE! CONTACTTHE DOCUMENT CONTROL DESK, ROOM PI-37 (EXT. 504-2083 ) TO ELIMINATEYOUR NAME FROM DISTRIBUTIONLISTS FOR DOCUMENTS YOU DON'T NEED!

TOTAL NUMBER OF COPIES REQUIRED: LTTR 15 ENCL 14

J ~

"1 I

Tennessee Valley Authority. Post Office Box 2000, Decatur, Alabama 35609 April 14, 1995 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555 Gentlemen:

In the Matter of Docket Nos. 50-259 Tennessee Valley Authority 50-260 50-296 BROWNS FERRY NUCLEAR PLANT (BFN) MULT1-UNIT PROBABILISTIC RISK ASSESSMENT (PRA)

This letter provides the BFN Multi-Unit PRA for NRC review.

The results of this multi-unit analysis indicate that the most limiting site configuration is with all three BFN units in operation. The resulting core damage frequency for Unit 2 with all three BFN units in operation is 2.8 x 10 , which is approximately a factor of 3.7 over the current single unit operation BFN PRA estimate of 7.6 x 106. These numbers still represents a very low risk from severe accidents. No single initiating event was found to dominate the total frequency of core damage. The top three categories of initiating events were scenarios involving loss of offsite power (39 percent),

internal floods (22 percent), and support system failures (21 percent). No plant vulnerabilities were identified for BFN when multiple units are in operation. Therefore, no additional enhancements are required to address vulnerabilities.

The NRC's September 28, 1994 Safety Evaluation Report for the single unit BFN PRA included a request for TVA to address the feasibility of evaluating the potential benefit of two containment performance improvement items in the multi-unit PRA. As requested, TVA has evaluated the feasibility of:

F'DR 9504180280 9504'l,'4 '?,

PDR ADQCK 05000259~i

. i

U.S. Nuclear Regulatory Commission Page 2 April 14, 1995

1. Using the diesel driven fire protection system pump to inject water into the reactor vessel upon loss of AC power, and 2 ~ Providing an alternate source of power to the automatic depressurization system solenoid valves, to permit depressurization of the reactor following loss of AC power and depletion of batteries.

These improvements were evaluated in conjunction with the hardened wetwell vent because of the synergistic interaction each improvement has on the other. Sensitivity studies were performed using the diesel-driven fire pump, in conjunction with functional safety relief valves and the hardened wetwell vent path, to provide an open loop mode of core cooling following loss of AC power. Based on the resulting small changes in core damage frequency, TVA has no plans to provide an alternate source of power to the automatic depressurization system solenoid valves. Use of the diesel driven fire pump and the hardened wetwell vent are already discussed in BFN Emergency Operating Instructions.

A summary of the background, including the previous correspondence of this issues, and a discussion of how this submittal addressed NRC expectations/open items and meets or exceeds TVA's commitments to address multi-unit operation is provided in Enclosure l. A separate binder containing the BFN Multi-Unit PRA is also enclosed. If you have any at (205) 729-2636.

questions, please contact me Sincerel , /

e Salas Manager of Site Licensing Enclosures cc: see page 3

1 U.S. Nuclear Regulatory Commission Page 3 April 14, 1995 Enclosures cc (Enclosures):

Regional Administrator U.S. Nuclear Regulatory Commission Region 101 II Marietta Street, NW, Suite 2900 Atlanta, Georgia 30323 Mr. Mark S. Lesser, Acting Branch Chief U.S. Nuclear Regulatory Commission Region 101 II Marietta Street, NW, Suite 2900 Atlanta, Georgia 30323 NRC Resident Inspector Browns Ferry Nuclear Plant Route 12, Box 637 Athens, Alabama 35611 Mr. J. F. Williams, Project Manager U. S. Nuclear Regulatory Commission One White Flint, North 11555 Rockville Pike Rockville, Maryland 20852

~ ~

ENCLOSURE 1 TENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT (BFN)

MULTI-UNIT PROBABILISTIC RISK ASSESSMENT (PRA)

I'ACKGROUND Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities (Reference 1), dated November 23, 1988, requested all licensees perform the following for each plant:

1. Perform a systematic examination to identify any plant specific vulnerabilities to severe accidents,

2. Identify and review proposed plant improvements (design changes and changes to operating procedures, maintenance, surveillance, training, or staffing)

3. Decide which of these improvements will be implemented and their schedule, and

4. Report the results to the Commission.

In response, by letter dated October 30, 1989 (Reference 2), TVA committed to complete a Level I PRA and containment analysis for Browns Ferry by September 1, 1992.

In August of 1990 (Reference 3), NRC noted that the three units at BFN share many important safety systems. NRC expressed a concern with the potential safety implications of shared systems in the various operating modes of the BFN units (e.g., All three units operating, Units 1 and 2 operating with Unit 3 shutdown, etc.). NRC requested TVA provide:

1. Dependency tables for Units 1 and 3 similar to that provided for Unit 2, and

2. Expanded PRAs for Units 1 and 3 that evaluate the entire site as a whole, taking into account the risk significant combinations of unit operational status.

TVA responded to this request on October 12, 1990 (Reference 4). TVA committed to submit dependency matrices prior to the restart of Unit 3, which assume

Units 2 and 3 are operational. TVA also committed to submit dependency matrices prior to the restart of Unit 1, which assume Units 1, 2, and 3 are operational. TVA declined to pursue the development of multi-unit PRAs at that time for the following reasons:

~ BFN does not significantly rely on safety systems which are specific to one unit to achieve and maintain safe shutdown of another unit.

~ The Unit 2 dependency matrices did not identify any instances of cross-train dependencies that would compromise the analyzed safety-related systems.

~ The subject of unit sharing and interactions was reviewed at the time of the original licensing of BFN.

As previously discussed, Generic Letter 88-20 requested licensees perform a single unit PRA. It did not

~

request licensees of multiple unit sites perform individual. PRAs for each plant at a multi-unit site or address the effect of shared systems between units. In response to Generic Letter 88-20, TVA committed to perform a Level 1 PRA and limited containment analysis, which assumed Unit 2 in operation and Units 1 and 3 shutdown.

In June 1991 (Reference 5), NRC acknowledged that the performance of these expanded PRAs was not required to fulfil Generic'Letter 88-20. However, the staff continued to encourage TVA to perform the expanded PRAs for BFN Units 1 and 3. TVA and NRC met on September 6, 1991 to discuss the NRC's concern (Reference 6). During this meeting, the staff expressed concerns regarding the number of shared systems at BFN and the control of these systems to ensure availability.

In February 1992 (Reference 7), TVA provided a list of the systems shared between the BFN units and a description of their shared functions. TVA reviewed the systems, which are shared between the BFN units, and identified ten systems whose ability to reliably perform their safety function could be challenged due to the impact of system sharing. The most limiting configuration for the ten shared systems occurs when all three units are in operation. Loss of offsite power and loss of plant air are the two initiating events that directly result in the shutdown of all three units. Therefore, TVA committed to perform an expanded PRA, which addresses all three units in operation, that would address the impact of the ten critical shared systems during a loss of offsite power and loss of plant air transients. TVA stated that it intended to submit a summary report to NRC prior to the restart of Unit 3. However, TVA did not consider completion of this work to be a restart prerequisite. NRC's review of the

t TVA approach for addressing multi-unit dependencies was provided in July 1992 (Reference 8). The Staff agreed that this report was not a prerequisite for the restart of Unit 3. However, the Staff requested TVA to provide formal notification beyond the end of 1993.

if the completion date should slip In response to Generic Letter 88-20, TVA completed and submitted the single unit BFN PRA on September 1, 1992 (Reference 9). When TVA was in'.tially responding to the hardened vent issue, NRC requested TVA in an April 1990 teleconference to incorporate the hardened vent"into the PRA. During development of the initial BFN PRA frontline event trees, it was recognized that the hardened wetwell vent would be implemented for BFN Unit 2 during the Unit 2 Cycle 6 refueling outage. Since this outage would occur following submittal of the BFN single unit PRA (September 1992), TVA decided not to model this feature in the initial version of the BFN PRA model. As discussed in Reference 10, TVA committed to incorporate the hardened vent into the next update of the BFN PRA. As discussed in Reference 11, TVA committed to summarize the impact of the hardened vent as part of the* multi-unit PRA submittal.

On December 2, 1993 (Reference 12), TVA provided the Staff with an updated schedule for the submittal of the multi-unit PRA. At the time of this letter, the Unit 3 design effort had progressed to the point where the multi-'nit PRA work could be supported. Based on the forecasted progression of the Unit 3 design work, TVA provided a January 18, 1995 scheduled submittal date for the multi-unit PRA.

The NRC Safety Evaluation Report (Reference 13) was issued on the single unit BFN PRA on September 28, 1994. In the Safety Evaluation, the Staff requested TVA to address the feasibility of evaluating the potential benefit of two containment performance improvement items as part of the multi-unit PRA. Due, in part, to this request from NRC to expand the scope of the multi-unit PRA, on January 19, 1995 (Reference 14), TVA rescheduled the submittal date for the multi-unit PRA to April 14, 1995.

II'VA COMMITMENTS AND NRC EXPECTATIONS/OPEN ITEMS Listed below are TVA's commitments with regards to the multi-unit PRA and NRC's expectations or open items. A comparison of these items to the content of the multi-unit PRA submittal is provided.

E1-3

TVA COMMITMENTS MULTI-UNIT PRA SUBMITTAL

1. TVA committed to The BFN Multi-Unit PRA is enclosed.

perform a The analysis considered more than multi-unit PRA to the ten shared systems considered in evaluate the effect the original commitment. The shared of the operation of systems included in the model were a the ten critical result of a systematic examination shared systems on of all shared systems. A basis was the Unit 2 core provided for those shared systems damage frequency. that were not included in the model.

The basis for identifying the multi-unit interacting systems is discussed in Section 2.2 of the main report. The shared systems modeled in the report are discussed in Section 2.3.

2. This will be The multi-unit PRA model used to accomplished by calculate the Unit 2 Core Damage recalculating the Frequency (CDF) was derived from the core damage current Unit 2 PRA model. The frequency after changes included modifying the modifying the electrical and mechanical support electric and event trees, as well the high and mechanical support low pressure event trees, to reflect trees to reflect the revised unavailability of shared the revised systems.

unavailability of the shared systems.

E1-4

TVA COMMITMENTS MULTI-UNIT PRA SUBMITTAL

3. The expanded PRA Initiating events were evaluated will include the using a failure modes and effects loss of offsite analysis (FMEA). Initiating events power and loss of for multi-unit operation were plant air as identified using the FMEA initiating events. (Table 2-6), system review (Section 2.2) and multi-unit interaction identification (Section 2.3). The multi-unit PRA includes the following initiating events that impact all units in service: loss of offsite power, loss of 500-kV grid to the plant, loss of plant air, flood in the turbine building, flood in the pumping station, and loss of raw cooling water. A new initiator category, loss of control bay ventilation, was also included.

4. The impact of Although severe accident scenarios severe accident occurring in Units 1 and 3 .do not scenarios occurring result in automatic shutdown of the in Units 1 and 3 other units, the likelihood that 'a will not be Unit 1/2 common accident signal is specifically present and the likelihood that a addressed since unit (other than Unit 2) is they do not result experiencing a severe core damage in the automatic event were both modeled. The common shutdown of the accident signal potentially impacts other units. the availability of residual heat removal and core spray. A severe accident on another unit has the potential to restrict the ability of operators to perform remote actions in the Unit 2 reactor zone. Further discussion is provided in Section 3.2.3.

E1-5

TVA COMMITMENTS MULTI-UNIT PRA SUBMITTAL

5. Units 1 and 3 The cut-off date for the use of design'nformation Unit 3 design information for the will be used if is available.

it Multi-Unit PRA was May 31, 1993. At this time, the design effort for Otherwise, Units 1 Unit 3 recovery had made significant and 3 will be progress. Xt should also be noted assumed to be that the BFN Design Criteria have designed similar to generally been established for all Unit 2 at the time three units and TVA's July 10, 1991 of their restart. submittal of the overall regulatory framework for the restart of Units 1 and 3 states that any deviations to the criteria or implementation of the recovery programs will be identified to NRC. Therefore, TVA considers the multi-unit PRA to adequately reflects multi-unit operation of the BFN facility.

6. The expanded PRA No additional clarification is will be performed required.

on a one time basis and TVA is not committed to maintain it as living document.

a E1-6

TVA COMMITMENTS MULTI-UNIT PRA SUBMITTAL

7. TVA committed to The hardened wetwell vent (HWWV) summarize the provides suppression pool cooling impact of the for those cases in which loss of hardened vent as decay heat removal was failed (TW part of the sequence). For this class of multi-unit PRA sequences, the actuation of the HWWV submittal. results in the prevention of core damage if a long-term injection source is available such as the Condensate and/or the Control Rod Drive Hydraulic (CRDH) systems.

These systems can be used for low pressure injection if the vessel remains depressurized through the use of the safety relief valves.

The actuation and long-term operation of the safety relief valves for manual depressurization requires DC power supplies and limited drywell back pressure. The suppression pool was'not credited as a suction source for injection following actuation due to uncertainties in the net positive suction head limitations. Credit for the HWWV was only taken for remote-manual operation from the control room.

The availability of the HWWV resulted in reducing the overall CDF) by approximately a factor of two. In terms of absolute release category group frequencies, this resulted in a reduction of Release Category Group III (Late containment failures) by approximately 80 percent, Group II (Small, early containment failures and small bypasses) by approximately 75 percent, Group I (Large, early containment failures and large bypasses) by approximately 10 percent, and an increase of Groups IVA (No release, no vessel breach) and IVB (No release, no containment failure) by 19 percent and one percent, respectively.

El-7

TVA COMMITMENTS MULTI-UNIT PRA SUBMITTAL (Continued) The relative percentage of the total CDF for scenarios binned into the HWWV release category (VSCRUB) was approximately 4 percent. The Release Category Group III decreased from approximately 72 percent for Case 2 to approximately 33 percent for Case 1. This indicates that the scenario contributions for Case 2 (no vent) are reduced by a factor of approximately two. This reduction is primarily due to a decrease in scenarios in which late containment failure occurs including a significant reduction in the TW contribution. The availability of the vent resulted in the transfer of previous scenarios from Group III to scenarios in which containment failure did not occur since the vent provided the means by which other injection sources (e.g. Condensate, CRDH) could successfully mitigate the scenarios. For Case 2, no vent available, the percentage of scenarios in which no containment failure occurs or the release is scrubbed is approximately 60 percent. For Case 1, vent available, the percentage of scenarios in which no containment failure occurs or the release is scrubbed is approximately 82 percent. With respect to containment failure characteristics, the CDF probability decreased by approximately 26 percent for Case 1 as compared to Case 2. Therefore, the availability of the HWWV results in both a reduction in the overall CDF, reduction of containment failure scenarios,'nd a relative increase of approximately 20 percent in scrubbed releases.

E1-8

NRC EXPECTATIONS MULTI-UNIT PRA SUBMITTAL

1. TVA assumes that Please refer to the discussion of BFN Units 1 and 3 .the design similarities between the are sufficiently units under TVA Commitment 5, above.

similar to Unit 2, so that a Level I PRA and limited containment analysis of Unit 2 will be applicable to Units 1 and 3.

BFN should justify this assumption.

2. It is assumed that analyses of the The shared systems model are a included in the result of a systematic shared ten'elected examination of all shared systems.

systems are A basis was provided for those sufficient to cover shared systems which are not all significant included in the model. The basis vulnerabilities for identifying the multi-unit associated with BFN interacting systems is discussed in systems. It is important to look Section 2.2 of the main report. The shared systems modeled in the report systematically at are discussed in Section 2.3. Shared all shared systems, systems were reviewed for potential and to provide a to impact success criteria, to basis for those change the freguency of an that are initiating event or introduce a new eliminated. initiating event, to alter or introduce new dependencies among systems, 'or to otherwise effect the response to an initiating event.

3. Similarly, all Initiating events were evaluated initiators need to using a FMEA. Initiating events for be evaluated and multi-unit operation were identified the basis for using the FMEA (Table 2-6), system eliminating any of review (Section 2.2) and multi-unit them should be interaction identification explained. (Section 2.3). The effect of Furthermore, the operations and conditions in shut effect of down units on Unit 2, through the operations and shared systems, is evaluated in conditions in shut Section 2.4 and summarized in Table down units on 2-5.

operating units, through the shared systems, needs to be evaluated.

E1-9

NRC EXPECTATIONS MULTI-UNIT PRA SUBMITTAL

4. The assumption is Refer to the response to the item made that the directly above.

analysis can be limited to the two selected initiating events on the basis that they lead directly to the automatic shutdown of all three units.

This assumption needs to be justified.

5. The identification - The effect of operations and and assessment of conditions in shut down units on plant Unit 2, through the shared systems, vulnerabilities is is evaluated in Section 2.4 and to be made assuming summarized in Table 2-5.

all three units are in operation, this presumes that three units operating is a bounding configuration and no significant vulnerabilities exist associated with other site operating mode

~

configurations (e.g., two units at power). The effect of operations and conditions in shut down" units on operating units, through the shared systems, needs to be evaluated.

E1-10

NRC OPEN ITEMS MULTI-UNIT PRA SUBMITTAL

1. The feasibility of These improvements were evaluated in the use of the conjunction with the hardened diesel driven fire wetwell vent because of the protection system synergistic interaction each pump to inject improvement has on the other.

water into the During the preparation of the PRA reactor vessel upon Revision 0 (issued September 1992),

loss of AC power. TVA recognized the potential of utilizing the diesel-driven fire

2. The feasibility of pump for vessel injection or debris the installation of bed cooling and subsequently an alternate source prepared a system notebook for the of power to the high pressure fire protection automatic system. However, the results have depressurization not been incorporated into the PRA system solenoid model at this time. However, the valves to permit results were used to perform a depressurization of sensitivity study using the the reactor multi-unit PRA model'n which the following loss of diesel-driven fire pump, in AC power and conjunction with functional safety depletion of relief valves (implicitly using a batteries. supplemental power DC supply) and the hardened wetwell vent path, were used to provide an open loop mode of core cooling following loss of AC power. The study showed a decrease in CDF for the loss of AC power initiator from 1.2 x 105 to 2.6 x 10~, which decreases the overall CDF from 2.8 x 105 to 1.9 x 10~. A second case was evaluated in which, in lieu of the safety relief valve supplemental power supply, the open loop path was credited only when off site power was recovered within six hours.

This second case provided a similar CDF for the loss of AC initiator of 2.7 x 10~ (versus 2.6 x 10~ for the supplemental DC case). These results indicate that the use of the diesel driven fire pump in an open loop mode of core cooling reflect a reduction in the computed CDF due to loss of AC power, with no significant change in the associated CDF.

NRC OPEN ITEMS MULTI-UNIT PRA SUBMITTAL (Continued) Providing an alternate source of power to the safety relief valves is not warranted. This is especially so once consideration is given to the fact that the four hour battery depletion time is based on a conservative calculation and that relatively low current is required to maintain a solenoid open to allow a safety relief valve to function Based on this, TVA has no plans to provide an alternate source of power to the automatic depressurization system solenoid valves. Use of the diesel driven fire pump to provide make-up to the reactor vessel and the hardened wetwell vent are already discussed in Emergency Operating Instructions.

II1. REFERENCES

1. NRC letter to All Licensees Holding Operating Licenses and Construction Permits, dated November 23, 1988, Individual Plant Examination for Severe Accident Vulnerabilities 10 CFR $ 50.54(f)

(Generic Letter 88-20)

2. TVA letter to NRC, dated October 30, 1989, Proposed Program in Response to Generic Letter 88-20 Individual Plant Examination (IPE) for Severe Accident Vulnerabilities

3. NRC letter to TVA, dated August 13, 1990, PRA Concerns Regarding Operation of Browns Ferry, Units 1 and 3

4. TVA letter to NRC, dated October 12, 1990, PRA Concerns Regarding Operation of Browns Ferry, Units 1 and 3

5. NRC letter to TVA, dated June 28, 1991, Individual Plant Examination for Severe Accident Vulnerabilities (Generic Letter 88-20), Browns Ferry Nuclear Plant, Units 1, 2, and 3

6. NRC letter to TVA, dated November 1, 1991, Summary of the September 6, 1991 Meeting with TVA Regarding the Appropriate Methodology for Conduction Individual Plant Examinations (IPE) at Multi-Unit Sites

~ y

7. TVA letter to NRC, dated February 7, 1992, Expanded Probabilistic Risk Assessment (PRA) Considering Operation of Browns Ferry, Units 1 and 3

8. NRC letter to TVA, dated July 22, 1992, TVA Approach for Addressing Inter-Unit Dependencies as part of the Individual Plant Examination for the Browns Ferry Nuclear Plant

9. TVA letter to NRC, dated September 1, 1992, Response to Generic Letter (GL) 88-20 "Individual Plant Examination for Severe Accident Vulnerabilities 10 CFR 50.54 (f)"

10. TVA letter to NRC, dated May 1, 1990, Probabilistic Risk Assessment (PRA) and Emergency Operating Procedure (EOP)

11. TVA letter to NRC, dated December 23, 1993, Response to Request for Additional Information Regarding the Individual Plant Examination (IPE)

12. TVA letter to NRC, dated December 2, 1993, Expanded Probabilistic Risk Assessment (PRA)

13. NRC letter to TVA, dated September 28, 1994, Individual Plant Examination Submittal for Internal Events

14. TVA letter to NRC, dated January 19, 1995, Schedule for Submittal of the Expanded (Multi-Unit)

Probabilistic Risk Assessment (PRA) and Portions of the Individual Plant Examination of External Events El-13

r ~ ~ I. )