ML18059A957
| ML18059A957 | |
| Person / Time | |
|---|---|
| Site: | Palisades  |
| Issue date: | 04/22/1994 |
| From: | Hsia A Office of Nuclear Reactor Regulation |
| To: | Fenech R CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.) |
| References | |
| TAC-M74444, NUDOCS 9404260333 | |
| Download: ML18059A957 (16) | |
Text
1.r;i
(/)
C~:;
c:.i U'".?
C\\t' Docket No. 50-255 Mr. Robert A. Fenech Vice President, Nuclear Operations Consumers Power Company Palisades Plant 27780 Blue Star Memorial Highway Covert, Michigan 49043
Dear Mr. Fenech:
April 22, 1994 e
SUBJECT:
REQUEST FOR ADDITIONAL INFORMATION ON PALISADES INDIVIDUAL PLANT EXAMINATION (IPE) SUBMITTAL (TAC NO. M74444)
As a result of our ongoing review of the Palisades IPE submittal dated January 29, 1993, and its associated documentation, the staff has generated the following request for additional information.
These questions are related to the internal event analysis in the IPE and the containment performance improvement program.
We request that you provide written responses to these questions within 90 days of receipt to be in conformance with our review schedule.
Please contact me should you have any questions regarding this request.
The reporting and/or recordkeeping requirements contained in this letter affect fewer than ten respondents; therefore, OMB clearance is not required under P.L.96-511.
Sincerely, Original signed by Anthony H. Hsia, Project Manager Project Directorate III-I 9404260333 946422 PDR ADOCK 05000255 P
-PDR Division of Reactor Projects - III/IV Office of Nuclear Reactor Regulation
Enclosure:
Information Request w/attachment cc w/enclosures:
See next page DISTRIBUTION Docket File NRC & Local PDRs PD3-l Rdg File J. Roe J. Zwolinski L. Marsh A. Hsi a C. Jamerson J. Murphy OFFICE LA:PD31 NAME M. Virgilio R. Hernan J. Johnson R. Barrett M. L. Slosson OGC ACRS (10)
W. Kropp, RII I DATE 4/11:\\:}94 OFFICIAL RECORD COPY 4/m94 G:\\WPDOCS\\PALISADE\\PAL74444.RAI j;)0\\ I I
Mr. Robert A. Fenech Consumers Power Company cc:
Mr. Thomas J. Palmisano Plant General Manager Palisades Plant 27780 Blue Star Memorial Highway Covert, MI 49043 Mr. David W. Rogers Plant Safety and Licensing Director Palisades Plant 27780 Blue Star Memorial Highway Covert, Michigan 49043 M. I. Miller, Esquire Sidley & Austin 54th Floor One First National Plaza Chicago, Illinois 60603 Mr. Thomas A. McNish, Secretary Consumers Power Company 212 West Michigan Avenue Jackson, Michigan 49201 Judd L. Bacon, Esquire Consumers Power Company 212 West Michigan Avenue Jackson, Michigan 49201 Regional Administrator, Region III U.S. Nuclear Regulatory Commission 801 Warrenville Road Lisle, Illinois 60532-4351 Jerry Sarno Township Supervisor Covert Township 36197 M-140 Highway Covert, Michigan 49043 Office of the Governor Room 1 - Capitol Building Lansing, Michigan 48913 U.S. Nuclear Regulatory Commission Resident Inspector Office Palisades Plant 27782 Blue Star. Memorial Highway Covert, Michigan 49043 Pali sades Pl ant Nuclear Facilities and Environmental Monitoring Section Office Division of Radiological Health Department of Public Health 3423 N. Logan Street P. 0. Box.30195 Lansing, Michigan 48909 Gerald Charnoff, Esquire Shaw, Pittman, Potts and Trowbridge 2300 N Street, N. W.
Washington DC 20037 Alora Davis Commitment Tracking System Coordinator Palisades Plant Consumers Power Company 27780 Blue Star Memorial Hwy.
Covert, Michigan 49043-9530 March 1994
REQUEST FOR ADDITIONAL INFORMATION PALISADES INDIVIDUAL PLANT EXAMINATION (IPE)
ENCLOSURE GEN.I The IPE submittal discussed how the utility devoted considerable effort in peer reviewing the IPE for accuracy and consistency.
However, deta i 1 s of the peer rev,i ew results or comments were not included in the submittal.
Please provide the results of that review, consistent with the section 2.4 of NUREG-1335, which states that as a minimum; import~nt conclusions of the review should be included in the submittal.
FE.I In Section 3.5.6.4.3.33.2, the probability of PORVs sticking open during cycling is assigned a value of 0.4 for water and two phase flow, and 0.1 for steam flow.
The discussion prior to the assignment of failure probabilities seems to indicate that the probability of a PORV being stuck open is high, but in the end of the evaluation a value of 0.4 is assigned to this event for water flow.
Please provide the basis for this quantification.
In addition, should the same value be used for transients with high pressure injection available (but recirculation unavailable}, ATWS sequences, and for transients with no ECCS available? Also, discuss the applicability of this data to the newly installed Palisades PORVs?
FE.2 It appears that some of the plant-specific initiators, such as loss of component cooling water and loss of HVAC,
~ere not included in the Palisades IPE.
Please discuss the basis and method used in screening for initiators, explicitly for loss of HVAC and component cooling.
In addition, please discuss how outage data is used in the I PE and the form of the pl ant-specific data used, i.e." point-est i mate, mean or medium.
FE.3 NUREG-1335 provided guidelines for grouping of initiating events. It states that only those initiators with similar success criteria and plant response should be grouped together. Although the grouping criteria were provided in the submittal, it is not clear how it was applied for general transient events.
For example, the main steam line break (MSLB) success criterion for negative reactivity insertion would appear to be different from other trans*i ents.
To clarify this ambiguity and to understand the grouping process, please provide the success criteria and plant response for MSLB, and LOOP (loss of offsite power).
FE.4 Discuss the basis for the IPE success criteria. Include in the description any deviation from the FSAR and the potential impact on CDF.
FE.5 The event tree description discusses the availability of the turbine-driven AF pump as a source of feedwater.
In case of MSLB this pump may not be available, depending on the break location and the train which is affected by the break.
Furthermore, the MSLB analysis should include breaks upstream of ADVs as well as the inadvertent opening of more than one ADV.
Does the IPE fault tree model account for this? Also, the success criteria modeling of the turbine-driven AF pumps is not clear.
Is the success logic for the pumps modeled as:
(SG/A is OK.OR. SG/B is OK).AND. (CV/A Open.OR. CV/B Open)?
If this simple logic is used, please clarify the success model when one of two SG is lost.
FE.6 Section 2.2.1.7 (page 2.2-9) of the IPE submittal states that reactor coolant pump seal failure is not considered a LOCA because Palisades' pumps are different from the Westinghouse pumps; therefore, the Westinghouse data are not applicable.
Please provide more detailed information regarding the test data involving the pump seal leakage versus pressure which would justify the deviation from the Westinghouse model.
FE.7 Please define core damage, both total and partial, as the term is used in the IPE.
FE.8 Generic data was used to estimate initiator frequency for low frequency initiating events, and the values used for generic data appear to be reasonable in comparison to other PRA studies.
However, the frequency assigned to loss of offsite power appears to be an exception. Table 2.2-2 indicates that the frequency assigned to loss of offsite power is 0.03.
This value is almost one order of magnitude lower than that used in other PRAs.
Please provide the basis for this value.
FE.9 The submittal considers common cause failures for numerous components, and lists those components for which common cause failures were considered.
However, the submittal does not explicitly discuss the process by which components were selected for common cause failure consideration. Discuss the basis for this selection process.
FE.10 BE. I The IPE submittal concludes that no vulnerability exists at Palisades.
However, the term "vulnerability" was not defined. It is possible that a simple importance ranking might reveal vulnerabilities at the component level.
Please provide a more clear discussion of what you consider a vulnerability, discuss whether such an importance ranking was performed, and important results obtained.
CET end states 30, 31, and 32 (Table 3.6.1-3), taken together represent an important mode of containment failure, namely,...
relocation of debris to the auxiliary buildin~. It represents approximately 31% of the total CDF (1.57 x 10* perry), and contributes to more than half of the containment failure probability. Neither the section on insights (see Section 5.2.6),
nor the section on conclusions (Section 6.2) provides any discussion of worthwhile strategies which might address this important contributor to risk.
However, Section 1.4 discusses two possible corrective actions currently under consideration.
Please provide a complete discussion of the corrective modifications that have been examined to prevent or reduce the effect of this mode of containment bypass/failure.
Include:
cost estimates for the most promising modifications, summaries of relevant calculations and assumptions incorporated into the analyses, and mitigating features of the as-built plant which might tend to diminish the adverse effect of this unique feature.
Provid~ a listing of the potential improvements based on your cost/benefit considerations.
Please refer to NUREG-1335, Section 2.3, for additional guidance on reporting vulnerabilities and strategies. Although the staff recognizes the IPE's characterization of this unique containment feature, any information with respect to your consideration of worthwhile strategies would help expedite the review process.
BE.2 As a part of the recovery basic events (Table 3.5.6-3, page 3.5-27 of the submittal), why was AC power recovery not considered? Not taking credit for the positive impact of AC power recovery (i.e.,
in-vessel core coolability) is not necessarily conservative, since the ~egative impact (i.e., additional in-vessel hydrogen generation due to reflood and the possibility of in-vessel steam explosions) is not considered if recovery is not considered.
BE.3 The submittal estimates a conditional probability of 0.005 for containment isolation failure.
How was this value calculated, and have the analysts taken into account the multiple, normally open, drains to the ESF sump in calculating the containment isolation frequency?
In the past, a number of incidents of containment isolation failure have been reported in the Palisades plant.
For instance, two valves were left open in a 3-inch purge bypass line for between 12 and 18 months in 1979.
Similar incidents, but of shorter duration, were also reported in 1980 and 1981.
Did the submittal include these incidents in developing a database for isolation failure in the Palisades plant IPE?
What procedural steps have been implemented to prevent the recurrence of such inadvertent loss of containment isolation?
BE.4 It is stated in Section 3.5.6.4.3.2.3 (page 3.5-36) of the submittal that "the major factors that influence cavity pressurization at vessel breach are: PCS pressure at vessel failure, vessel failure size, and mode of debris dispersal".
Were other parameters, such as the mass of debris, the thermodynamic state of the debris (melt temperature, fraction of debris in a molten state, etc.}, and the composition of debris, considered, as well?
BE.5 Why was the largest possible vessel failure size (on page 3.5-40 of the submittal) used for the evaluation of cavity pressure at vessel breach taken to be 1 meter in diameter? Shouldn't it be a function of the melt volume in the lower plenum?
BE.6 In Section 3.5.6.4.3.43.2 (page 3.5-160) of the submittal, it is stated that "it is judged likely that the heat transfer model used to predict the survival of the lower head model is correct", and a probability of 0.9 for the success of the lower vessel head cooling is assigned in the submittal. Because of the importance of the lower vessel head coolability model in the termination of accident sequences (with sprays functional), discuss how this judgment was made.
Have the IPE analysts considered the uncertainty for this issue?
Why was coolability of the lower head not tre~ted as a function of mass of the relocated debris (which is dependent on the accident sequence) and melt thermodynamic conditions?
BE.7 In the evaluation of:
the probability of cavity floor failure by overpressure (page 3.5-46), the cavity wall failure (page 3.5-50, section 3.5.6.4.3.3.4), and OCH-induced containment failure (page 3.5-71), why were equal weights assigned to probabili.ty of dispersion in the film mode and in the fluidization mode when, physically, a fluidized mode of dispersion appears to be more plausible as confirmed in Table 3.5.6-13?
BE.8 Why was containment failure due to cavity floor failure {by pressurization) not considered, even though containment failure due to cavity wall failure was assessed in the submittal? After this failure, would a direct path to the auxiliary building be available?
BE.9 On page 3.5-51 (Section 3.5.6.4.3.3.5) the probability of containment failure given the failure of cavity walls is assigned a value of 0.05.
Failure of the cavity wall can lead to failure of containment due to failure of the RCS loop piping, and hence the failure of penetrations such as letdown line piping, steam lines, etc.
Please provide justification for the estimate of 0.05.
BE.IO In calculating the ensuing cavity pressures after vessel breach, why is the effect of additional hydrogen generation due to zirconium oxidation in the cavity not considered?
BE.11 In the evaluation of the probability for the basic event "major core relocation occurs after vessel failure", (Section 3.5.6.4.3.8, page 3.5-54) the discussion seems to indicate that major core relocation is highly probable, but in the end of that section a relatively low probability of 0.05 is assigned to this event.
Please provide the basis for this value.
BE.12 Why is the same probability of 0.1 (Appendix 3.6.1) assigned to the
- failure of sprays {and fan coolers) due to s~vere accident conditions, for all accident sequences? It would appear that the
BE.13 BE.14 BE.15 BE.16 BE.17 different events that lead to equipment failure (beyond design basis conditions, detonations, etc.} will lead to different estimates of the probability of spray and fan failure, and in addition, the probabilities are dependent on the accident sequence.
Why was the recovery of sprays and fan coolers not considered in the submittal? It may not be conservative to neglect recovery, since recovery of sprays and fan coolers has both positive consequences (possible prevention of containment failure, and scrubbing of fission products}, and negative consequences (increased probability of hydrogen combustion}.
The evaluation of OCH-induced peak containment pressures (Section 3.5.6.4.3.13) is strongly dependent on the fraction of debris entrained as fine droplets that enter the upper compartment.
Table 3.5.6-14, page 3.5-71, shows that if approximately 20% of the core inventory enters the upper compartment, containment failure is assured.
However, by limiting the MAAP calculations to the default value of 10%, which is based on a Westinghouse PWR configuration, containment failure from this phenomenon may be largely precluded.
In addition, CE plant owners are conducting an experimental research program to evaluate dispersion in CE plant cavities (page 3.2-4).
If these results are available, discuss how consistent the experimental results are in comparison to the default value.
What is the basis for the probability of containment failure by ex-vessel steam explosions (Section 3.5.6.4.3.15, page 3.5-73) being assigned a value of 0.005?
Was it treated as a function of the failure location, mode of steam explosion (stratified or pour mode),
depth of the water pool, vessel pressure, and the availability of cavity water?
In the evaluation of the probability for the basic event "Debris configuration in the cavity is non coolable" (page 3.5-120), a value of 0.8 MW/m2 is assigned to the minimum possible heat flux sustained for heat transfer from debris to water.
How was uncertainty in this phenomena considered? The discussion for probability assignment in Section 3.5.5.4.3.27.2 of the submittal states that a value of 0.1 is assigned for sequences with a wet cavity, but the table that follows indicates that a value of 0.25 is used.
Please clarify.
How were the values of probability of debris bed coolability calculated for the wet cavity sequences?
What is the basis for the value of 0.75 assigned to the dry cavity sequences, when it appears that debris in a dry cavity will not be coolable?
In the evaluation of the basic event PCSDEPRESS (page 3.5-128) what was the basis of the weighting factors used (for instance, 0.5 for PZRVFTC, pressurizer surge valves.fail to close)? In addition, please provide the basis for the probability of the basic event
BE.18 BE.19 BE.20 BE.21 BE. 22 11 PRMTQUENCH 11 (Page 3.5-134), for a dry cavity and no HPME.
A value of 0.25 is used which may not be conservative given that debris in a dry cavity cannot be quenched.
During the evaluation of volatile fission product retention in RCS (Section 3.5.5.4.3.30.2, page 3.5-131), transients are implicitly assigned a value of 1, although CPMAAP calculates a retention factor of about 0.95.
Please provide a basis for the difference.
What fraction of the fission products released to the containment in the small LOCA sequences and depressurized transients would be present in the cavity and available for release to the auxiliary building when a path becomes available?
To understand the discussions concerning vessel failure presented in Section 3.5.6.4.3.42, please provide the following information for each of the four accident sequence groupings, namely, small break LOCAs, transients, ATWS sequences, and SGTR sequences:
(a)
Probability of vessel failure at high pressure, (b)
Probability of vessel failure at low pressure.
Please provide a discussion of the IPE response to the recommendations of the CPI program.
One of the recommendations of the CPI program pertaining to PWRs with large dry containments was that the utility should evaluate the IPE results for containment and equipment vulnerabilities to hydrogen combustion (local and global),
and point out any need for procedural and/or hardware improvements.
The CE plant has considerably more zircalloy in the core than the Westinghouse plant, and hence a higher potential for hydrogen combustion.
Hence, please provide a discussion of the impact of hydrogen deflagration and detonation upon containment failure, including local detonation, and upon hardware performance.
Include in your discussion the results of any sensitivity calculations performed in support of your conclusions.
It is stated in the IPE submittal that "the consequences of ISLOCA sequences and SGTR sequences can be mitigated through SIRWT makeup".
It is also stated in the submittal that sources for SIRWT makeup were identified; however, these sources were not given.
Please identify the sources of water for SIRWT makeup, and discuss whether any procedures have been implemented in the Palisades plant for refill of the SIRWT using the identified sources.
In addition, have you performed any calculations to show the positive impact of SIRWT refill upon the core damage frequency or on the containment analyses? Please provide insights as appropriate.
No supporting fault trees were provided in the IPE submittal corresponding to the CET top events.
Please provide a copy of the
-supporting fault trees for the top event nodes in the CET, to assist in ~nderstanding the discussions in Section 3.5.6.3.
BE.23 BE.24 HRA. l HRA.2 HRA.3 Discuss the credit taken in the back end portion of the IPE for post-core-melt recovery for both high and low pressure sequences, allowing for both in-vessel and ex-vessel cooling.
Per NUREG-1335, discuss the treatment of elastomeric seal failure and resultant leakage caused by either high temperatures inside containment or standing flames from hydrogen combustion near the equipment hatch, personnel access openings, and penetrations which might employ them.
Sections 2.3.2.2 and 2.3.2.3.2 identify human errors as either pre-accident (i.e., pre-initiator) or post-accident (i.e., post-initiator). However, five categories of human errors are identified in Section 2.3.2.3.1: restoration errors, alignment errors, errors in response to a system malfunction, calibration errors, and post-accident errors that appear to be in contradiction to Sections 2.3.2.2 and 2.3.2.3.2.
Please (1) describe the differences in categorization, specifically clarifying the differences in the response to a system malfunction errors, alignment errors and the post-accident errors, and (2) identify all the human errors evaluated (including pre-screening) along with their categorization and a brief description of the human error.
The actions in Table 2.3-6 do not appear to be typical of the important human actions usually identified for PWRs (examples are provided in Attachment 1).
Further, it is not always easy to determine the context (e.g., accident sequence conditions) under which the human actions are performed.
Therefore, although the different categorizations are described, it is not clear how the different operator actions (whether pre-or post-initiator) were initially identified and selected for inclusion in the IPE for evaluation.
It is not clear that key operator actions were not overlooked, and therefore, potential vulnerabilities missed.
Please (1) provide a brief and concise discussion describing how the operator actions important to system and component availability or important to core damage prevention and mitigation were identified (including assumptions); and (2) for each of the fourteen actions, provide a cross reference to the important sequence(s) in which these actions take place along with a more detailed.description of the actual "task" that is being accomplished by the action.
The submittal states that preliminary HEP estimates were obtained using THERP models, and refined HEP estimates were obtained using ASEP.
Please discuss why THERP was used for screening and ASEP was used for the more detailed analysis rather than in the reverse order since the ASEP is a simplified THERP and can yield more conservative values.
As a result of the screening process, the human errors will result in a certain ranking with relative differences in their values.
Please indicate whether this order and the relative differences where similar after the detailed analysis.
HRA.4 HRA.5 Section 2.3.2.2.2 of the IPE states that screening human error probabilities of l.OE-02 or l.OE-03 are commonly used, and that these failure probabilities are conservative with respect to the values that would be expected if a detailed evaluation were performed.
This statement is not justified when examining the values in Table 2.3-6 versus the values in Table 2.3-7.
- Further, Section 2.3.2.4.1 states that preliminary human error probability estimates were obtained by using simplified THERP models for certain errors that included test, maintenance, calibration and alarm response.
Screening values of either IE-2 or IE-3 were used for remaining errors (i.e., "post-accident" errors). However, the screening values do not appear to be conservative for pre-initiator or for post-initiator errors.
Please (I) provide the individual screening values that were used for each human error, differentiating between pre-and post-accident errors, (2) clarify whether the values listed in Table 2.3-7 were screening values (which do not appear to be conservative (e.g.,
1.6E-5 for AISOTABC) and are lower in value than the "detailed" values for pre-initiator errors listed in Table 2.3-6), (3) briefly discuss your rationale for the "post-accident" screening value~,
(4) provide examples illustrating how the screening values were derived for those based on THERP for each of the following:
restoration errors, calibration errors, errors in response t~ a control room alarm, and system alignment errors, and (5) provide a discussion justifying how the relatively low screening values did not result in elimination of important human errors.
It is unclear in the submittal how potential pre-initiator human errors (i.e., errors associated with failure to restore or miscalibration) were evaluated.
It is not clear how such items as 11 dependencies 11 and "recovery factors" were actually incorporated into the quantification such that potential plant weaknesses were identified in the pre-initiator analysis. A few examples illustrating this lack of clarity are as follows:
Section 2.3.2.3.l of the IPE states that: "Many tests and maintenance procedures require performance of a system or component test following completion of work to verify operability.
In some instances, even if a component such as a motor operated valve was left in the wrong position, it would automatically be returned to the proper position when the system was actuated.
If either of these means of detecting or correcting an error are available, a restoration error need not be modeled." This statement infers that failure of restoration is negligible. There are, however, circumstances when a pump, for example, may be aligned to two parallel valves (A and 8) that are taken out of service with the pump.
The procedure for pump post-maintenan~e verificati-on only checks restoration or operability of valve B (i.e., valve on test return line) and does not verify operability of valve A.
In*
HRA.6 9 -
addition, there can be situations when an operated valve may not necessarily automatically return to the proper position when the system is actuated.
This situation may occur if the breaker for the valve is pulled.
Section 2.3.2.3.2 of the IPE states:
"a mistake committed by a technician during calibration of an instrument can be reasonably expected to be repeated if other instruments are calibrated immediately after using the same procedure." This "dependency" can also be true if, for example, calibration is being performed on similar instrumentation whose procedures are also similar and when performed at the same time.
Section 2.3.2.4.2 states that recovery factors that are considered in the pre-accident requantification procedure are "compelling signals" (i.e., a control room annunciator that would alert operators to an abnormal event).
"Compelling signal" was, however, defined in the discussion on post-accident requantification procedure and as the "earliest or most informative" signal. The earliest or most informative signal does not necessarily mean that the operator will notice or respond to this signal (i.e., if many annunciators are alarming at once) and therefore, restore the component.
The above are a few examples to illustrate the lack of clarity in the IPE explaining how potential human errors associated with failure to restore or miscalibration were evaluated. Please provide a brief and concise discussion addressing the above concerns.
As part of the discussion, please also provide specific examples of the quantification process to illustrate how these pre-initiator human errors were identified and evaluated.
In Section 2.3.2.5, several pre-initiator human errors were identified as either low probability or not credible, and therefore, should not have been included in the fault tree models.
Adequate justification is not provided to substantiate this conclusion.
For example:
AISOHTABC and AISOHAB: It is stated that "This procedure consists of a separate calibration procedure for each flow instrumentation train; therefore, the probability that an error in the calibration of one instrument would be repeated is considered to be negligible."
Further, Section 2.3.2.3.2 states "a mistake committed by a technician during calibration of an instrument can be reasonably expected to be repeated if other instruments are calibrated immediately afterward using the same procedure."
(Also see Question 5 above.)
However, even though a different procedure is used; errors may still occur if the same technician or calibration instrument is used for subsequent calibrations.
HRA. 7 HRA.8 HRA.9 HLSOH0440, IPSOH1201 and IPSOH1203: It is stated that calibration failures associated with these instrumentation in not credible mainly because the associated equipment is normally running or would not be able to start. However, miscalibration could allow the equipment to operate, but could erroneously trip the equipment when needed.
SLSOHSIRW and SLSOISIRW: Although calibration is not possible, the operator could mis-measure the length of cable, fail to verify, incorrectly place, etc. The HRA would indicate, given the procedure and the type of verification (e.g., independent, written), the likelihood of failure. Adequate justification of non-inclusion has not been provided.
Please provide the rationale (i.e., justification) for not including the above human errors given the above concerns.
Section 2.3.2.3.3 states that information gathered for refining the quantification of human error was augmented, if necessary, by analyses to determine accident scenario timing.
It is not clear if timing was considered in the initial analysis (e.g., for post-initiator operator actions that were screened); please clarify and provide the time needed and the maximum time available for each action.
In addition, page 2.3-21 states that an estimate of the time necessary to complete the desired action(s) was obtained by averaging estimates obtained from operators and the sim~lator training staff.
Please clarify whether any actual time measurements were made to confirm the staff estimates to ensure that time was properly addressed.
Section 2.3.2.3.4 states that "The only recovery actions considered in the Palisades PRA were those that could be performed over a short time frame (e.g., manually starting a pump when the automatic start fails).
These types of recovery actions were assumed to occur since most of them are.directed by procedure.
No operator actions for these types of recovery events were modeled.
Recovery actions that could not be performed over a short period of time or for which detailed operator actions are necessary, were not modeled within the current Palisades IPE." These statements are confusing and appear to be contradictory. It appears, from these statements, that no operator recovery actions were modeled.
Please clarify this issue and provide a list of the specific operator recovery actions analyzed along with their HEPs.
Section 2.3.2.4.2 discusses the post-accident requantification procedure, and states that if a procedure offers precise and unambiguous guidance, then a basis exists for using a lower error probabiltty.
Further, the submittal states that actions-that are emphasized in training are more likely to be successful, therefore, human error rates can be decreased.
However, values given in the
ASEP procedure are for the "average" plant. Therefore, the above statements imply that Palisades is "better than average" in quality of procedures and training.
Please (1) indicate which operator actions were impacted, by what factor the value was lowered, and whether these factors were used globally or individually; and (2) if factors were used to increase human error probabilities (e.g., for "ambiguous" procedures or for actions that were not emphasized in training), discuss whether these issues are potential vulnerabilities.
It is not clear from the submittal (for post-initiator actions) what specific performance shaping factors (PSFs) were used, and specifically how they were addressed when considering dependencies and conditionalities of the operator actions.
For example, certain conditions could affect all the human events simultaneously while certain dependencies may only affect a set of human events (e.g, complete dependence may be assumed for manual actuation of all injection systems).
Please (1) indicate what PSFs were modeled, the bases for these PSFs and their values, and (2) provide a brief and concise discussion addressing the following two points:
(a)
Post~accident human events can be modeled in the fault trees as basic events such as failure to manually actuate a system.
The probability that the operator performs this function is dependent on the accident in progression (e.g., what symptoms are occurring, what other activities were previously successfully and unsuccessfully performed).
When this basic event (i.e., failure to manually actuate system) is modeled in the fault tree and the sequences are quantified, this basic event can appear, not only in different sequences, but in different combinations with different systems failures.
In add1tion, the basic event can potentially be multiplied by other human events when the sequences are quantified, resulting in artificially low calculated human error contributions if dependencies are not taken into account.
If fault trees were used, please briefly discuss how the Palisades HRA accounted for dependencies and ensured.that the contribution of human error was not artificially reduced during the quantification.
(b)
Post-accident human events can also be modeled jn the event trees as top events.
The probability that the operator performs this function will depend on the accident progression.
The quantification of the human events needs to consider the PSFs associated with each initiator and the dependencies between other human events involved in the sequence.
If event trees were used, please discuss how dependencies between events and PSFs associated with each initiator were considered.
In Table 2.3-6, human error event.RPORVOA {operator fails to open PORVs and their associated motor operated isolation valves) appears to be an important operator action and is listed as having the third highest risk achievement wo~th of all operator actions. However,
HRA.12 e
e the HEP value is listed as "N/A".
Please (1) explain the meaning of "N/A" and (2) explain what value was used in the IPE model and how it was determined.
The submittal states that there were no "vulnerabilities" identified per the Palisades definition of vulnerabilities. Although none were identified, please discuss any significant findings or insights related to either unique safety features or potential improvements that pertain to human reliability that resulted from the IPE effort.
Examples of Important Human Actions Human Actions Relevant to Majority of Accidents
- 1.
Alignment of' all equipment for usage of PORV in Feed-and-Bleed mode.
This includes opening normally closed block valves that are plant-specific for Palisades.
2 Alignment of backup nitrogen systems to open PORVs if other systems fail.
- 3.
Operator providing adequate HVAC to switchgear rooms and other critical areas.
4 Operator monitoring flow to RCS Pump Seals to provide adequate cooling.
- 5.
Alignment of LPCI or HPCI suction switchover from Refueling Tank to the Sump Alignment of alternate-external water sources in case of failure during switchover.
Small LOCA
- 1.
Rapid depressurization of RCS upon HPCI failure during injection phase or recirculation phase.
Also manual switching on of the LPCI/LPCR.
- 2.
Alignment of Alternate Feedwater if AFW fails.
- 3.
Alignment of LPCI or HPCI suction switchover from Refueling Tank to the Sump.
Alignment of alternate/external water sources in case of failure during switchover.
- 4.
Throttling HPCI/LPCI and adjusting SG steaming rates.
Medium and Large LOCAs
- 1.
Alignment of Alternate Feedwater if AFW fails.
- 2.
Alignment of LPCI or HPCI suction switchover from Refueling Tank to the Sump.
Alignment of alternate/external water sources in case of failure during switchover.
- 3.
Throttling HPCI/LPCI and adjusting SG steaming rates.
Steam Generator Tube Rupture
- 1.
The operator will successfully isolate the faulted Steam Generator.
- 2.
Credit for makeup to RWST to continue ECCS injection if operator cannot isolate faulted SG.
- 3.
If AFW is unavailable, the intact SG must be depressurized to allow condensate pumps to inject into the intact SG.
- 4.
Override Main Steam Isolation Signal to allow AFW entry to SG.
- 5.
Align AltFW if AuxFW is failed.
A-1
- 1.
Open ADVs in case fail to open for secondary cooling.
- 2.
Align AltFW in the case AFW fails.
- 3.
Alignment of LPCI or HPCI suction switchover from Refueling Tank to the Sump.
Alignment of alternate/external water sources in case of failure during switchover.
- 1.
Operator recovery of offsite and onsite power.
- 2.
Operator alignment of DGs and relevant buses.
A-2