ML18064A494

Forwards IPE Addl Info Re Internal Event Analysis & Containment Performance Improvement Program for Facility

ML18064A494
Person / Time
Site:	Palisades
Issue date:	12/05/1994
From:	Haas K CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
TAC-M74444, NUDOCS 9412120079
Download: ML18064A494 (10)

Text

, __ -- - .

consumers Power KurtM. Haas Plant Safety and Licensing Director POWERING MIUllGAN"S PROGRESS Palisades Nuclear Plant: 27780 Blue Star Memorial Highway, Covert, Ml 49043 December 5, 1994 Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555 DOCKET 50-255 - LICENSE DPR PALISADES PLANT - INDIVIDUAL PLANT EXAMINATION (IPE) - ADDITIONAL INFORMATION (TAC NO. 74444)

Consumers Power Company provided the Palisades Individual Plant Evaluation (IPE) results to the NRC in a submittal dated January 29, 1993. The NRC reviewed our submittal and, in a letter dated April 22, 1994, requested additional information related to the internal event analysis and the containment perfnrmance improvement program for the Palisades Plant. This information was provided in our July 22, 1994 letter to the NRC. As a result of the continuing NRC reviews, including the staff's diagnostic evaluation team (DET) report, the NRC's October 19, 1994 letter requested additional information be submitted concerning the Palisades IPE results. The Enclosure to this letter contains the reply to this NRC request for additional information.

SUMMARY

OF COMMITMENTS In summary, this letter contains three new commitments, as summarized below.

Our review of Information Notice 89-54,"Potential Overpressurization of the CCW System" is being re-evaluated. Once our reviews are complete approprtate actions to mitigate the event will be developed and the need for any modifications will be determined.

(

~~~;9_4_1_2_1_2o~;~c~ ~

~DR 4 205 ADOCK 05000255

P~R I ' A!>CMS ENERGY COMPANY

2 The risk models will be updated to include the probability of failure to transfer fuel oil from the storage tanks to the day tanks combined with the failure to recover off-site power within the coping time. The models will be modified during revision three of the PRA.

The update the the 1990 analysis concerning steam generator overfill is currently being reviewed and will be submitted to the NRC by January 31, 1995.

I Kurt MHaas Plant Safety and Licensing Director CC Administrator, Region III, USNRC NRC Resident Inspector - Palisades Enclosure

ENCLOSURE Consumers Power Company Palisades Plant Docket 50-255 INDIVIDUAL PLANT EXAMINATION ( IPE)

ADDITIONAL INFORMATION (TAC NO. 74444) 7 Pages

Supplemental Request for Additional Information for the Palisades Nuclear Power Plant NRC Question 1:

Information Notice 89-54 Potential Overpressurization of the CCW System, " discussed a postulated accident scenario in which leakage of reactor coolant could occur into the.

CCW system via failure of the RCP heat exchanger. This scenario dominated the risk profile at another Combustion Engineering plant. No mention of this accident scenario was made, however, in the Palisades !PE submittal. Please discuss the risk significance of this accident scenario and its disposition with respect to the Palisades plant.

CPCo Response:

The previous evaluation of IN 89-54 has been reopened. A review of the previous work determined that two conflicting analyses were not resolved. In the original evaluation it was determined that under certain conditions 10CFRlOO limits would be exceeded.

This evaluation assumed that operators would immediately attempt to isolate the CCW ..

flow to containment. Given isolation, the CCW piping between the isolation valves would fail. A portion of the piping is outside containment. The analysis determined that if break flow into CCW were not terminated within an acceptable time frame then 10CFRlOO limits would be exceeded. Subsequently a PRA analysis was conducted.

The preliminary analysis indicated that as long as the operators did not immediately isolate containment the CCW system was not lil<;ely to overpressurize. Under these

• conditions it was shown that a controlled cooldown and depressurization of the primary system could be 3:ccomplished without uncovering the core. It was assumed that once . *.

the cooldown had occurred and the primary system depressurized to shutdown cooling entry conditions the leak into the CCW system could be isolated without jeopardizing system integrity.* However, this *analysis did* not consider the impact of any releases due to flow from the PCS into CCW during the cooldown period. The current evaluation is attempting to gain better insights into several aspects of the scenario. -First, a better understanding of the operator diagnosis and response is being pursued. Second, sensitivity .studies of the original release characterization are being performed to establish available coping time. Third, an evaluation of the capability of the isolation valves will be conducted to determine their ability to close and hold against the expected pressure. Once the identified information is obtained appropriate actions to mitigate the event will be developed and the need for modification will be determined: At present

• we believe that the risk significance of this event is greatest from the potential for early isolation which causes either failure of the CCW system piping somewhere between the isolation valves or significant leakage through the isolation valves. Our re-evaluation to resolve the conflicts identified in previous analysis is scheduled for October 1995. An evaluation. of potential modifications would be performed subsequent' to the re-evaluation.

1

. NRC Question 2:

NUREG-1424, "Safety Evaluation Repon Related to the Full-Term Operating License for Palisades Nuclear Plant, " dated November 1990, indicated that the results of Generic Letter 89-19, which relates to steam generator overfill, would be addressed in the Palisades !PE. No mention of this issue, however, was made in the licensee's !PE submittal. Please address the safety significance of the issues related to this Generic Letter, as discussed in NUREG-1424.

CPCo Response:

At the time of the SER a submittal regarding Generic Letter 89-19 had been made to the NRC by the Combustion Engineering Owners Group. This submittal took exception to several values used in the regulatory analysis to establish the cost/benefit developed to support the regulatory position. It was anticipated that the NRC response to the owners group submittal would be received in a time frame that would allow incorporation of the results into the IPE. However, the final response was not received until September, 1994. The response provides general concurrence with the overall position of the owners group that steam generator overfill protection is not required for Combustion Engineering plants provided that the conditions in the SER provided to the owners group can be demonstrated. The conditions are: 1) demonstrate that the plant specific analysis is consistent with and bounded by the owners group generic analysis; and 2) that training and procedure requirements related to small break LOCAs as discussed in the generic letter have been met. As members of the owners group plant specific analysis of the events were completed as part of the development of the generic position. The results of the plant specific analysis indicate that a modification is not cost-beneficial. The update of the 1990 analysis is currently being reviewed and will be submitted to the NRC by Jan\lary 31, 1995.

NRC Question 3:

Section 2.3.2.3.3, Reduction of Reliance on Human Errors, of Rev. 1 of the /PE (July 22, 1994) (retitled, Determination of Imponant Recovery Actions of Rev, 2 (October 6, 1994)) states that to reduce the reliance on operator actions following an initiating event, post-accident human errors that are performed outside the control room, and are either a backup to an automatic action or a bypass for a failed component, were not included in the preliminary quantification. These actions (backup to an automatic action or bypass for a failed component) are generally classified as .recovery actions. It is not clear from the original !PE or Revision 1 to the !PE how non-recovery, proceduralized and non-proceduralized operator actions that are performed outside of the control room, and are needed for accident mitigation and safe shutdown of the plant, were identified and quantified. Please provide: (1) A list of all credited operator actions (including proceduralized non-proceduralized, and recovery) performed outside of the control room which are needed for accident mitigation and for safe shutdown of the plant, and; (2) A 2

. qiscussion on how these operator actions were identified and quantified. Include sample task analyses for the more significant operator actions.

CPCo Response:

Non-recovery operator actions are those actions that are necessary to accomplish a required task for accident mitigation or safe shutdown. For example, initiation of low pressure feed of the steam generators requires manual operation of atmospheric dump

• valves, manual alignment of feedwater valves and restart of condensate pumps; alignment of makeup to the condensate storage tank requires alignment of pumps anq_ yalves from

_alternate water supplies; -and opening PORVs for once through cooling of the PCS, are all considered non-recovery actions. Recovery actions are those that are performed as a backup to an automatic action or are an alternate to a non-recovery operator action (locally closing a breaker, manually opening a valve for which the automatic open signal failed, manually starting an AFW pump, etc.). At no time were the non-recovery actions (required to place success paths into service to mitigate an accident or safely shutdown the plant) removed from the model as part of the actions discussed in section 2.3.2.3.3. The process discussed in section 2.3.2.3.3 only involved recovery actions.

Palisades identified proceduralized, non-proceduralized and recovery actions to include in the PRA model. A human reliability analysis methodology was developed to assist the analysts. in identifying the types of operator actions to include (i.e., miscalibration, failure to align a valve upon automatic failure, etc.). The list of all operator actions jn the PRA model is included in the IPE Revision 1 submittal as Table 2. 3-7.

During the preliminary quantification of the PRA for the IPE submittal, s~me of the recovery actions were not included in the quantification. These recovery actions were not included in order to determine the importance of non-recovery operator actions and recovery actions that could be accomplished from the control room. All non-recovery operator actions, along with recovery operator actions performed from the control room, were quantified for the IPE.

There is only one non-recovery operator action performed outside the control room:

XOOOTCST - operator fails to align makeup to the CST. This operator action was included in the quantification of the PRA for the IPE. All other non-recovery operator action are performed in the control room and were also included in- the quantification for the IPE. All operator actions that were not credited during the quanti(lcation were recovery actions performed outside the .control room.

In response to the second part of the question, all operator actions, including non-recovery, were identified by examination of procedures, operator training, system analysis review of the systems for means of accomplishing important functions, and discussions with operations personnel. Also, during the quantification process an individual with a current SRO license was part of the risk assessment organization. The 3

probabilities assigned to operator actions were either screening values or THERP values.

Values derived from the THERP process would be based on whether the actions relied on written guidance (procedures), knowledged based or verbal instructions.

The operator action XOOOTCST was the only non-recovery operator action performed outside the control room. It was identified as required based on procedure reviews and fault tree analysis. This operator action was identified as a significant insight in the IPE submittal. A THERP analysis was performed to identify the human error probability for quantification. Failure of the operator to makeup to the CST leads to a failure of auxiliary feedwater and low pressure feed.

NRC Question 4:

The original !PE .submittal states that if a procedure offers precise and unambiguous guidance, then a basis exists for using a lower error probability~ Funher, the submittal states thaJ actions that are emphasized in training are more likely to be successful, therefore, human error rates can be decreased. In contrast, however, poor procedures and training may result in increased human error rates. In the request for additional infonnation (April 14, 1994) the staff asked the licensee io indicate which operator actions were beneficially impacted by training and procedures, by what factor, and whether these factors were used globally or individually (HRA question 9). The licensee's response stated that no operator actions were affected and no factors were used.

However, a rectmt diagnostic evaluation team (DET) repon identified persistent

.. problems with procedural Gdherence and poor quality procedures." Please discuss how

• the IPEIHRA reconciles itself with these later findings.

CPCo Response:

As noted iri the question, our original submittal HRA section needed revision. Part of that revision was to clarify, as noted in this question, th.at the HRA methodology actually.

used to provide Human Error Probabilities (HEPs) for quantification in the Palisades IPE did not employ any credit or penalty in developing the HEPs, as described by the ASEP method. The HEP development method (THERP - NUREG 1278 "Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications") was used to develop HEPs for human error events identified in the individual system models. As previously stated in our response to the April 1994 request for additional information (NRC Question HRA.9), the ASEP methodology was used for independent review of the IPE methodology and to develop new HEPs not prevfously *developed with the THERP methodology.

As such, the modelling and data development assumes that Palisades 'procedure quality' and 'adherence' is within the distribution of the data forming the basis for NUREG 1278 task HEPs. It should be noted that the basis for NUREG 1278 dates back to pre-INPO days and does* not reflect institutionalized improvements the industry has made since.

4

'{he THERP method, employed for the Palisades IPE, does recognize a distinction between normal operating procedure usage HEP, and abnormal/emergency procedure usage HEP. Generally, failure rates are lower for abnormal event actions as compared to normal operating actions. Recognizing that the DET observations regarding

'procedure usage' fall into the 'normal operating' category, a sensitivity check was performed. As a check on the effect of increasing the HRA HEPs, the ten highest

'normal operating' Risk Achievement Worth (See Table 2.3-6) HEPs were each increased, by an order of magnitude, to assess the sensitivity of CDF to significantly increased HEPs. The resultantincrease in CDF (CDF0 ew/CDF0 rig), was ~ increase of less than 20 % for each.

The use of plant specific data, when available, is a recognized benefit toward achieving a more accurate local risk profile.

• The Palisades IPE, like others being conducted, employs a combination of generic and plant specific data for hardware failures. The development and use of plant specific data reflects a consistent set of 'challenges' that may be detected and recorded. Generally, plant data is useful when the number of challenges and resultant successes I failures is accurately known. The notion of using such an approach with HEP data is compelling. However, consistent plant specific data collection I recordings for HEPs are not available at our plant. Given the relatively few actual ris.k significant human errors that exist, collecting data upon them is a task similar .\

to collecting data on significant sequence initiators such as LOCAs. As with the development of useful initiators, accepted HRA practice relies upon generic, or calculated values for such infrequent, or generally undocumented events.

A further argument against biasing our HRA data based upon such (small sample based) observations, would be the similar difficulty in also reconciling improvements. Palisades has .taken significant action to address both the procedural adherence and the procedure quality problems cited by the NRC DET report. In the absence of accepted industry methods, such data manipulation exercises would become sufficiently subjective, so as to degrade the value of analysis, and thereby limiting its utility in future decision-making.

In summary, the use of standard methods, and average data seems prudent under the circumstances of not being able to technically justify a consistent alternative using such (sampling type) data.

Finally, the question appears to ask whether our 'results' are sufficiently accurate given this DET observation. We believe the answer should be yes. It is not clear how to respond to the question of accuracy. A global change in the human error probabilities based on this observation would not necessarily change the relative ranking of the human errors as currently identified. However, the increase could cause some human errors that are currently below the stated risk significance criteria to become important. Table 2.3-6 *

(Risk Significant Human Errors) lists the human error events of particular interest. A sensitivity study of human errors that are currently below the significance criteria and have a RAW greater than 1.0 will be conducted. The probabilities of the actions that meet the criteria will be increased by an order of magnitude. For those actions that 5

. ~xceed the risk significance criteria as a result of the increase will be included in the

, operator training currently being developed. Understanding that a primary reason for conducting IPEs is the development of plant specific awareness of (such) unique insights, we will be providing training on these results to the plant Operations staff early in 1995.

This training is based on a commitment made in the response to the DET. This increased awareness coupled with simulator training exercises will further reduce the actual probabilities of these errors.

NRC Question 5:

The /PE submittal does not provide enough detail to *determine what diesel generator coping time is available, given the fuel in the day tank, in comparison with what is actually nf!,eded to mitigate severe accidents. However, a recent staff repon indicated that the 4ay tank coping time is actually less than that originally estimated in the FSAR.

Discuss the impact on the /PE results of using the actual1 as-built, diesel generator coping times inste,ad of the FSAR-based values.

CPCo Response:

The IPE submittal was consistent with the existing plant analysis at the time. That analysis indicated that the diesel's were capable of operating twenty-four hours without makeup to the day tanks. Subsequently it has been determined that the affect of added loads to the ~400V AC safety buses and ot_her conditions have reduced the coping time of the diesels given- the existing fuel in the diesel belly and day tanks. The current analysis indicates approximately sixteen hours of coping time. Events in which the d.iesel generators are successful for sixteen hours are. expected to have very little impact on the core damage frequency. The risk models need to be updated to include the probability of failure to transfer fuel from the storage tanks to the day tanks combined with the failure to recover offsite power within the coping time. At sixteen hours, the probability

• of failure to recover offsite power is expected to be on the order of 1.0E-05. The .

probability offailure to transfer fuel is expected to be on: the order of 1.0E-02 to 1.QE-

03. Therefore the combined probability is not expected to appreciably impact the current core damage frequency. The most likely failure of onsite power would remain the diesel generators. The models will be modified during the revision three of the PRA.

NRC Question 6:

As indicated in your response to Back-End (BE) Question 1 you indicated (July 22, 1994 transmittal) *that a potential containment modification which would prevent core debris

• from entering into the containmeni sump appeared to be cost beneficial. Please discuss your current implementation plans for this containment modification involving the blocking off of the drain lines between the containment cavity and the auxiliary building.

6

. CPCo Response:

Several alternatives have been investigated. The option identified in your question provides for blocking of drain lines in the reactor cavity floor. The floor is between the reactor cavity and the containment sump. A request for modification (RFM) has been generated and is currently in internal review within the engineering organization. Once issues identified in the internal review have been dispositioned, the RFM package will be presented to management for determination of the appropriate course of action. The presentation to management is currently on schedule for mid December. Blocking.-the .

drain lines in the reactor cavity floor is one of the alternatives included in the RFM package. The drain lines currently provide the capability to collect leakage into the reactor cavity to assure that it is included in the quantification of PCS leakage. Concerns have been identified in the review process with the alternative process of collecting any leakage. A letter to the NRC presenting the management decision on this. issue will be sent following the presentation of the RFM to man_agement.

7