Text

TER of Plant IPE Back-End Submittal - Final Rept
	ML18065A480
Person / Time
Site:	Palisades
Issue date:	04/30/1995
From:	Khatibrahbar, Alan Kuritzky, Vijaykumar R; ENERGY RESEARCH, INC.
To:	; NRC
Shared Package
ML18065A476	List: ML18065A477; ML18065A478; ML18065A479; ML18065A480;
References
	CON-NRC-04-91-068, CON-NRC-4-91-68 NUDOCS 9602120378
	Download: ML18065A480 (41)
	v • d • e

ERl/NRC 95-102 TECHNICAL EVALUATION REPORT OF THE PALISADES INDIVIDUAL PLANT EXAMINATION BACK-END SUBMITTAL FINAL REPORT April 1995 R. Vijaykumar, A. S. Kuritzky, and M. Khatib-Rahbar Energy Research, Inc.

9602120378 960207 PDR ADOCK 05000255 Q

PDR P.O Box 2034 Rockville, Maryland 20847-2034 Prepared for:

SCIENTECH, Inc.

Rockville, Maryland 20847 Under Contract NRC-04-91-068 With the U.S. Nuclear Regulatory Commission Washington, D.C. 20555

E.

EXECUTIVE

SUMMARY

This Technical Evaluation Report (TER) documents the findings from a review of the back-end portion of the Individual Plant Examination (IPE) for the Palisades Nuclear Plant. The review utilized both, the information provided in the IPE submittal, and additional information provided by the licensee (Consumers Power Company) as a pan of the responses to NRC questions. The back-end analyses were performed by the utility, with consulting support provided by TENERA, L. P., and Gabor, Kenton and Associates. A peer review of the IPE process was performed by the Plant Safety Engineering Group at the Palisades plant, which is responsible for the safety analyses for the plant. However, the peer review was focused on the front-end fault trees and system success criteria used for front-end analyses. The containment event trees were reviewed by contractor personnel from TENERA, L.P., and Gabor, Kenton and Associates. It should be noted that these personnel were also involved in some parts of the back-end analyses, such as MAAP calculations, and development of the event trees and fault trees. As a response to the NRC question on the extent of the peer review, the licensee stated that the submittal reflects and includes several comments from a contractor review of the back-end process.

The IPE submittal contains a substantial amount of information with regards to the intent of Generic Letter (GL) 88-20 and NUREG-1335.

E.l Plant Characteri7.ation The Palisades plant is a Pressurized Water Reactor (PWR) of Combustion Engineering (CE) design. The following plant-specific features are important for accident progression in the Palisades plant:

The Palisades plant is of early Combustion Engineering design, where the in-core instruments enter the RPV through the upper head. Hence, there is no instrument tunnel leading from the reactor cavity to the rest of the containment. In addition, the lower head is located only about one foot above the cavity floor.

A 30-inch diameter access tube (through the cavity wall) connects the bottom of the cavity to the containment. The reactor cavity is connected to the upper compartment of the containment through a 1-inch annular gap between the vessel flange and the refueling pool floor. The close proximity of the cavity floor to the RPV, the small flow area available for flow out of the cavity, and the flow path geometry in the cavity are all important in determining the direct containment heating-induced containment loads in the Palisades containment. Two I-inch diameter drains connect the cavity floor to a sump located directly below the cavity. The ceiling of the sump (i.e., the floor of the cavity) is 18 inches thick and made of reinforced concrete. In addition to the cavity water, water from the containment floor also enters the sump through five downcomer pipes. Eight 4-inch vent pipes lead from the top of the sump to the containment to allow venting of the sump and to permit complete filling of the sump with water. Two 24-inch recirculation suction pipes connect the sump to the recirculation pumps located in the auxiliary building. A 4-inch drain pipe in the sump floor allows periodic draining of the sump.

The Palisades plant in-core instrument tubes enter the RPV from the top, and there are no penetrations in the RPV lower head. The RPV lower head is 4.5 inches thick with 1/4-inch thick stainless steel cladding on the inside surface. The lower vessel head is uninsulated. Since the RPV is located less than one foot above the cavity floor, it is possible to have submergence of the RPV lower head in water for several accident sequences. The ability of the cavity water to prevent vessel breach is important in determining the course of several severe accident sequences.

Palisades IPE Back-End Review ii ERI/NRC 95-102

A Cavity Hooding System (CFS) in the Palisades containment collects all the drain water on the containment floor (accumulated due to the operation of the containment sprays) and drains it into the sump. During normal spray operation, the sump capacity is not sufficient to hold all the water, and the overflow is drained into the cavity. The CFS is aligned to the spray headers, and functions only if the sprays are in operation. Proper operation of the CFS leads to water levels in the cavity up to the RCS loop piping.

The grid spacers used in the core of the Palisades plant are made of zircaloy. Together with thicker cladding used in the core, the masses of zircaloy used in Combustion Engineering plants are larger than similar Westinghouse plants. The effect of larger masses of zircaloy is a larger potential for hydrogen generation and hence, there is a potential for higher hydrogen concentration in the Palisades containment. However, the higher hydrogen concentration is not sufficient to lead to hydrogen combustion in most accident sequences.

The Palisades plant is similar to the Surry plant in several aspects, such as RCS water volume, power, and mass of core inventory.

E.2 Licensee's IPE Process A full-scope Level-2 PRA was used for the back-end analyses.* The Level-2 evaluation starlS with the results of the Level-I analysis; i.e., a description of possible accident sequences, together with estimates of their annual frequencies of occurrence. Plant Damage States (PDSs) were defined to bin the end-states of the core damage sequences. Binning of PDSs involved grouping of the Core Damage Event Tree (CDET) sequences, by applying a PDS bridge tree. The bridge tree includes top event questions about the containment safeguard states, such as sprays and fan coolers, and the containment isolation status.

The binning process resulted in 392 possible plant damage states. The number of plant damage states was ultimately reduced to 28 by excluding implausible combinations, and by applying a cutoff frequency for truncation. A cut-off value of 1.0 x 10-12 for LOCA sequences and 1.0 x 10-9 for transients and A TWS sequences was used. Furthermore, by assigning a cutoff frequency of 1.0 x 10-s, while still making sure the cumulative core damage frequency exceeds 99 3 of the total core damage frequency, the total number of PDSs to be used as input to the CET was further reduced to 18. The definition of plant damage states in the submittal is adequate and meets the intent of GL 88-20.

Probabilistic quantification of severe accident progression is performed using an event tree/fault tree methodology, where the fault trees used to quantify each CET node (called "Top Heading" in the submittal) are called CET-logic trees. The CET is concise and contains the following thirteen nodes:

(I)

Plant damage state entry condition, (2)

Early containment bypass, (3)

Containment isolation successful, (4)

Late containment bypass, (5)

Recovery (after fuel melting),

(6)

Upward debris dispersal at vessel failure, (7)

Relocation of core debris at vessel failure, (8)

Containment intact early, (9)

Volatile fission product release early,

( 10)

Late relocation of core debris,

( 11)

Containment intact late, Palisades IPE Back-End Review iii ERI/NRC 95-102

(12)

Core concrete interactions resulting in fission product release, and (13)

Volatile fission product release late.

The CET is developed for all PDSs. The analyses performed to evaluate the basic event split fractions are extensive.

This submittal develops detailed probabilistic distributions for various uncertain phenomena. Containment failure probabilities were calculated by overlapping the probability distributions for the containment loads and the containment capacities*. In areas where the information provided in the submittal was not clear, questions were forwarded to the licensee. The lkensee responses, and the supporting fault trees provided by the licensee, were sufficient to clarify all outstanding concerns on the CET analyses.

Modifications were made to the EPRI-developed version of die MAAP 3.0B code (version 16) to enable the performance of integrated containment analyses and source term evaluations in Combustion Engineering plants. The Palisades-specific version of MAAP was renamed as CPMAAP, and was used to analyze postulated severe accidents at the Palisades plam.

A number of baseline and sensitivity analyses were performed using the CPMAAP code. Almost all of the phenomenological uncertainties in PWR severe accidents are treated in the IPE submittal, either in the CET analyses or through MAAP sensitivity calculations.

The results of the CET analyses lead to an extensive number.of end-states, and the lPE authors have attempted to quantify source terms corresponding to most of the end-states. Only a limited binning process was employed, and the analysts attempted to quantify as many accident sequences as possible.

The cut-off frequency for the CET end-states was chosen m be 1.0 x 10-1* Fission product release categories (source terms) are defined in terms of the magnitude of the releases, isotopic distribution, timing and release frequency. The magnitude of the releases was evaluated from the CPMAAP code calculations for the accident sequences that define the CET end-state. Typically, the CPMAAP code simulation was extended for at least twelve hours following oontainment failure to evaluate the magnitude of the source term. There are 65 possible CET end-states; however, after completion of the CET analyses, only 19 end-states were found to be of significance. *Source terms were quantified for all nineteen end-states.

E.3 Back-End Analysis The core damage frequency for internal events calculated in die submittal is 5.2 x 10-5 per reactor year, and is comparable with that calculated for the Surry and Zion plants (NUREG-1150 analyses).

The conditional probability of early containment failure in the Palisades plant' (see Table E. l) is comparable to the Zion and Surry results. The conditional probability of late containment failure at Palisades plant lies between the values calculated for the Surry and Zion plants. The largest containment-response difference between Palisades and the other two plants is the failure mode involving relocation of core debris to the auxiliary building. This is a Palisades-specific containment failure mode. It is expected that the Palisades risk profile will be dominated by the early relocation of core debris into the auxiliary building, and by bypass failure modes.

Palisades IPE Back-End Review iv ERI/NRC 95-102

Table E.1 Containment Failure as a Percentage of Total CDF: Comparison with Other PRA Studies Containment Failure Mode Early Failure Late Failure Early Relocation to Auxiliary Building Bypass (V)

Bypass (SGTR)

Isolation Failure Intact Core Damage Frequency, yr-1 lnch>dea Flooding Not Applicable Palisades IPE 1.5 14.7 31.0 0.5 5.1 0.5 46.3 5.2 X 10-s I Included as a Part of Early Containment Failure Surry Zion NUREG-1150 NUREG-1150 0.7 1.5 5.9 24.0 NA2 NA2 7.6 0.2 4.6 0.3

-3

_3 81.2 73.0 4.1 X 10-s 6.2 X 10-s E.4 Generic Issues and Containment Performance lmprov~ment (CPI) Issues One of the recommendations of the CPI program pertaining to PWRs with large dry containments was that the utility should evaluate the IPE results for containment and equipment wlnerabilities to hydrogen combustion (local and global), and point out any need for procedural and/or hardware improvements.

The submittal documentation does not explicitly discuss the recommendations of the CPI program, but does treat the effect of hydrogen combustion through the basic events CACF AIL and CSPF AIL in the CET analyses, which treat the effect of accident progression on the performance of sprays and fan coolers. The licensee evaluation of the impact of detonations on containment and equipment failure is provided as a response to NRC questions. The methodology is based on NU}lEG/CR-5275, which classifies the reactivity of hydrogen-steam-air into a "mixture class", and the flame acceleration potential of the containment geometry into a "geometry class". A "result class" is then assigned based on a matrix which is a function of the mixture and geometry classes. After a qualitative review of hydrogen-steam-air concentrations expected in the containment, and after noting that the containment does not have a geometric configuration favorable for a Deflagration-to-Detonation Transition (DDT) to occur, the licensee concluded that a detailed evaluation of the effect of DDT upon equipment performance was unnecessary. In summary, all the CPI recommendations are addressed by the licensee, either in the submittal, or by the additional information provided as a part of the responses to NRC questions.

Palisades IPE Back-End Review v

ERI/NRC 95-102

E.S Vulnerabilities and Plant Improvements The Palisades IPE submittal has not identified any containment-related vulnerabilities. One particular containment failure mode that stands out from the IPE results involves the failure mode with early core debris relocation from the sump to the auxiliary building. This failure mode is due to the location of the ESF sump directly under the cavity. This mode of containment failure entails large releases of volatiles, especially in accident sequences where the SIRWT water is not injected into the containment. In addition, 31 3 of the core damage frequency leads to this mode of containment failure.

The licensee was aware of the impact of the location of the containment sump on the conditional probability of containment failure, radionuclide releases, and the overall risk. As a response to NRC questions, the licensee quoted the results of the Palisades offsite consequence analysis which showed that the individual fatality risk (1.87 x lo-8 per reactor year) and individual cancer risk (1.02 x 10*1 per reactor year) are both lower than the NRC safety goals.

Hence, according to the licensee, no "vulnerabilities" are deemed to exist, and it was concluded that "severe accidents at the Palisades plant pose no undue risk to the health and safety of the public, and no plant modifications are required. "

Although, the licensee did not identify the availability of the direct path from the cavity to the ESF sump as a vulnerability. an evaluation of methods to prevent or delay relocation of core debris from the reactor cavity to the ESF sump was performed after the IPE was completed. Sections 1.4 and 6.2 of the IPE submitta:l, and the licensee responses to NRC questions [11], discuss two possible strategies for reducing the risk associated with the ESF sump:

1.

Reduce the conditional probability of eore debris relocation to the auxiliary building, and

2.

J>.revent or delay the relocation of core debris from reactor cavity to the ESF sump.

The licensee evaluated a number of alternatives related to the second strategy listed above; of these, the preferred modification involves the filling of two one inch drain lines (from the cavity to the sump), by pumping grout from the sump end of the pipe. A plate supported by a column would be left underneath the filled drain hole to ensure that the plug could not be blown out by high pressure. With the cavity sump plugged in this manner, debris relocation will be considerably delayed. The results of the cost-benefit amiJyses led to the conclusion that plugging of the reactor cavity drains was the only cost-beneficia1 modification. This modification is stated to:

Reduce the frequency of early containment failure to 1.2 x 1 Q"-6 per reactor year, and Reduce the total off-site dose consequence by 393.

The licensee is committed to this modification, i.e., plugging of the reactor cavity drain lines, during the 1997 refuelling outage.

In addition to the proposed plant modification, the licensee addressed the first strategy listed above (i.e, reducing the probability of reactor vessel failure following core damage), by considering the following actions ( 11 ]:

Palisades IPE Back-End Review vi ERI/NRC 95-102

1.

Increasing the availability of the Containment Spray System (CSS).

An analysis [11] concluded that the increased availability of the spray system would not have a significant impact on risk.

2.

Increasing the availability of the Cavity Flooding System (CFS).

3.

To ensure the availability of the CFS, three actions have been planned to be completed prior to the end of the 1995 refueling outage:

a.

Perform an inspection to verify that the CFS is operable. This inspection will include a fiber-optic inspection of all CFS piping, up to and including the point of discharge into the reactor cavity.

b.

Revise Operations Department containment building cleanliness walkdown guidelines to include inspection of the ball float valve floor drains on the 607' elevation.

c.

Revise Palisades cleanliness procedures to alert personnel to the importance of maintaining the containment floor drain system operable, including the ball float valves, by preventing ingress of solid material into the drain system.

For accident progressions with the CSS and CFS operable, the reactor cavity will be completely flooded. The licensee stated that flooding the reactor cavity will cool the outside of the lower reactor vessel head and increase the probability of preventing vessel failure [13).

Increasing the likelihood of depressurizing the Primary Cooling System (PCS).

The probability of vessel failure can be decreased further by ensuring that the PCS is depressurized [13]. Intentional PCS depressurization could be accomplished by an operator action to open a pressurizer Power Operated Relief Valve (PORV). The availability of a pressurizer PORV is expected to be high for accident progressions with the CSS operable, since the PORVs and the associated block valves require only AC and DC power to operate, and both will be available if the CSS is available.

The licensee stated that [11.13] the specific guidance to depressurize the PCS using the pressurizer PORVs following core damage will be developed as part of the Severe Accident Management Program (SAMP).

Prevention of vessel failure by use of the CSS, CFS and pressurizer PORVs is one example of as-built plant features that mitigate the adverse effect of the ESF sump containment failure mode.

In the submittal, prevention of vessel failure is currently expected for about 33 3 of all core damage accident progressions. The licensee stated that intentional depressurization of the PCS is expected to increase the proportion of core damage sequences involving in-vessel recovery to approximately 50 3.

Hence, the licensee has committed to develop specific guidance to depressurize the PCS following core damage. As already mentioned, the guidance for PCS depressurization will be developed as a part of the licensee severe accident management program.

Palisades IPE Back-End Review vii ERl/NRC 95-102

E.6 Observations The assessment of the Step 1 review is that the Palisades IPE submittal contains substantial Back-End information regarding the severe accident wlnerability issues for the Palisades plant.

The IPE analysts have performed a thorough and detailed probabilistic analysis of severe accident progression in the Palisades plant. A significant containment response difference between typical U.S.

PWRs with large dry containments and the Palisades plant is the prevalence of early debris relocation into the auxiliary building as a mode of containment failure. This mode of containment failure entails significant releases of source terms, and results in a small warning time. The analysts have identified this as an important mode of containment failure, and subsequent to the release of the IPE submittal, the licensee performed a full-scope consequence analysis. Although the results of the consequence analysis seemed to indicate that the risk profile of the Palisades plant did not pose an undue threat to the safety and health of the public, the licensee continued to search for cost-beneficial ways of reducing the likelihood of containment failure due to transport of the core debris to the sump, and ultimately to the auxiliary building. The licensee evaluamn (i) considered ways to reduce the probability of core damage sequences that contribute to potential for core relocation; and (ii) considered ways to delay or prevent relocation of the core debris from the reactor cavity to the containment sump, and from the sump to the reactor building. The licensee concluded that the only cost-beneficial mod~fication was to plug the reactor cavity drain lines [ 11, 13]. In addition, a piate supported by a column would be left underneath the filled drain hole to ensure that the plug could not be blown out by high pressure. With the cavity sump plugged in this manner, debris relocation will be considerably delayed. It is stated by the licensee that the implementation of the proposed modification is expected to reduce the frequency of early containment failure to 1.2 x lo-6 per reactor year. In addition, the following commitments were.made by the licensee in response to the NRC Requests for Additional Information (RAis) [13]:

1.

Three actions to ensure the availability of the cavity flooding system (described in the previous section) have been planned to be* completed prior to the end of the 1995 refuelling outage.

2.

Specific guidance to depressurize the PCS using the PORVs following core damage will be developed as a part of the severe accident management program.

Palisades IPE Back-End Review viii ERI/NRC 95-102

TABLE OF CONTENTS

1.

INTRODUCTION............................................

1.1 Technical Review Process...................................

1.2 Plant Characterization.....................................

2.

CONTRACTOR REVIEW FINDINGS................................

2.1 Licensee's IPE Process.....................................

2.1.1 Completeness and Methodology................. ;........

2.1.2 As-Built/ As-Operated Status............................

2.1.3 Licensee Participation and Peer Review of IPE.................

2.2 Containment Analysis.....................................

2.2.1 Front-End/Back-End Dependencies........................

2.2.2 Containment Event Tree Development................. :....

2.2.3 Containment Failure Modes and Timing.....................

2.2.4 Containment Isolation Failure............................

2.2.5 System/Human Response..............................

2.3 Quantitative Assessment of Accident Progression and Containment Behavior...

2.3.1 Severe Accident Progression..... :......................

2.3.2 Dominant Contributors to Containment Failure.................

2.3.3 Characterization of Containment Performance.................

2.3.4 Impact on Equipment Behavior...........................

2.4 Reducing the Probability of Core Damage and Fission Product Releases......

2.4. l Definition of Vulnerability.............................

2.4.2 Plant Modifications..................................

2.5 Responses to CPI Program Recommendations......................

1 1

1 4

4 4

5 5

7 10 11 12 17 17 18 19 19 20 20 21 23

3.

CONTRACTOR OBSERVATIONS AND CONCLUSIONS....................

24

4.

REFERENCES..............................................

26 APPENDIX A IPE EVALUATION AND DATA

SUMMARY

SHEET................ 27 Palisades IPE Back-End Review ix ERl/NRC 95-102

LIST OF FIGURES Figure 1 Frequency of Exceedance of Cesium Iodide Release.....................

16 Palisades IPE Back-End Review x

ERI/NRC 95-102

Table 1.

Table 2.

Table 3.

Table 4 Table 5 Table 6 LIST OF TABLES Summary of Key Plant and Containment Design Features for Palisades.......

6 Comparison of Containment Capacities...........................

6 Comparison of Releases for Surry ("H" SGTR Sequence) and Palisades (DEJS SGTR sequence, CET End-State 02)............................

14 Comparison of Releases for Surry (V Sequence) and Palisades (CEJW V Sequence, with CET End-State 04b) 15 Comparison of Releases for Surry (TMLB Sequence) and Palisades (TEJW Station Blackout Sequence 422, CET End-States 26 and 28), Containment Failure At or Around the Time of Vessel Breach..........................

15 Containment Failure as a Percentage of Total CDF: Comparison with Other PRA Studies............................................

20 Palisades IPE Back-End Review xi ERl/NRC 95-102

AC AFW ATWS BCD BNL CCI CDF CDET CHR CPI CFS css DCH ECCS EOP EPRI ESF GL HEP HPME HPSI HRA IPE ISLOCA LOCA LOSP LT-SBO MAAP MCC

.MFW MOV NRC PCS PDS PORV PRA PWR RAI RC RCS RHR RPS RPV SAMP SBO SG Alternating Current Auxiliary Feedwater NOMENCLATURE Anticipated Transient Without Scram Battelle Columbus Division Brookhaven National Laboratory Core Concrete Interactions Core Damage Frequency Containment Deterministic Event Tree Containment Heat Rejection Containment Performance Improvement Containment Flooding System Containment Spray System Direct Containment Heating Emergency Core Cooling Systems Emergency Operating Procedure Electric Power Research Institute Engineered Safety Features Generic Letter Human Error Probability High Pressure Melt Ejection High Pressure Safety Injection Human Reliability Analysis Individual Plant Examination Interfacing Systems Loss of Coolant Accident Loss of Coolant Accident Loss of Offsite Power

~ng Term Station Blackout Modular Accident Analysis Program Motor Control Center Main Feedwater Motor Operated Valve Nuclear Regulatory Commission Primaty Coolant System Plant Damage State Power Operated Relief Valve Probabilistic Risk Assessment Pressurized Water Reactor Request for Additional Information Release Category Reactor Coolant System Residual Heat Rejection Reactor Protection System Reactor Pressure Vessel Severe Accident Management Program Station Black-Out Steam Generator Palisades IPE Back-End Review xii ERI/NRC 95-102

SGTR smWT SORV SRV SSW TER NOMENCLATURE (Continued)

Steam Generator Tube Rupture Safety Injection Refueling Water Tanlc Stuck-Open Relief Valve Safety Relief Valve Station Service Water Technical Evaluation Report Palisades IPE Back-End Review xiii ERI/NRC 95-102

1.

INTRODUCTION This Technical Evaluation Report (TER) documents the results of a review of the Palisades Individual Plant Examination (IPE) Back-End submittal [l], based on the review objectives set forth by the NRC.

These objectives include the following:

To dmnnine if the IPE submittal essentially provides the level of detail requested in the Submittal Guidance Document, NUREG-1335, To amess the strengths and the weaknesses of the IPE submittal, and To complete the IPE Evaluation Data Summary Sheet.

This TER complies wid:l the requirements of the contractor task order for review. The remainder of Section 1 of this report describes the technical evaluation process employed in this review, and presents a summary of the important characteristics of the Palisades nuclear power plant related to containment behavior and post~mage severe-accident progression, as derived from the IPE.

Section 2 summarizes the review technical findings, and briefly describes the submittal scope as it pertains to the work requirements..Each portion of Section 2 corresponds to a specific work requirement as outlined in the NRC contractor task order. A summary of the overall IPE evaluation, identification of IPE submittal strengths and weaknesses, and review conclusions are summarized in Section 3. Section 4 contains a list of cited references. Appendix A to this report contains the IPE evaluation summary sheets.

1.1 Technical Rerit!w Process The technical review process for back-end analysis consists of a complete examination of S~tion 1 and Sections 3 to 6 of the 1PE submittal. In this examination, key findings are noted; inputs, methods, and results are reviewed; and any issues or concerns pertaining to the submittal are identified. The primary intent in the review is to ascertain whether or not, or to what extent, the back-end IPE submittal satisfies the major intent of Generic Letter (GL) 88-20 [3] and achieves the four IPE sub-objectives. In addition, the submittal is evaluated with respect to the review objectives listed above, including completeness with respect to IPE guideliees. A list of questions and requests for additional information were developed to help resolve issues and concerns noted in the examination process, and forwarded to the licensee. The licensee responses (ll-13] were reviewed. Evaluation of the responses ensured that the preliminary findings of the technical review remain valid, and many of the outstanding concerns were resolved.

1.2 Plant Characterimtion Palisades is a one UDit PWR of CE design with a large, dry containment. A detailed description of the Palisades containmem and plant data are provided in Section 3.1 and Tables 3.1-1 and 3.1-2 of the submittal. Additional data are said to be contained in a MAAP Palisades parameter file, but the MAAP input is not included. A comparison of plant data with the Zion aild Surry plants is provided in Table 3.1-1 of the submittal. Figures 3.2.1-1through3.2.6-2 (of the submittal) illustrate some of the design features of the containment and cavity that are important for severe accident progression.

The Palisades containment is a horizontally and vertically prestressed, post-tensioned concrete cylinder and dome resting on the top of a reinforced concrete slab. The containment is lined with a 1/4-inch thick welded steel liner plate.

Palisades IPE Back-End Review 1

ERI/NRC 95-102

The following plant-specific features are important for accident progression in the Palisades plant:

The Palisades plant is of early Combustion Engineering design, where the in-core instruments enter the RPV through the upper head. Hence, there is no instrument tunnel leading from the reactor cavity to the rest of the containment. In addition, the lower head is located only about one foot above the cavity floor.

A 30-inch diameter access tube (through the cavity wall) connects the bottom of the cavity to the containment. The con~ainment end of the tube is closed (during normal reactor operation) by a reinforced flange, which can wnhstand differential pressures on the order of 300 psid.

The reactor cavity is connected to the upper compartment of the containment through a 1-inch annular gap between the vessel flange and the refueling pool floor. A seal plate is used to block off the rest of the region between the vessel flange and the refueling pool floor. However, the seal plate is expected to fail at a differential pressure of 12 psid. The close proximity of the cavity floor to the RPV, the small flow area available for flow out of the cavity, and the flow path geometry in the cavity are all important in determining the direct containment heating-induced containment loads in the Palisades containment.

Two 1-inch diameter drains connect the cavity floor to a sump located directly below the cavity.

The ceiling or-the sump (i.e., the floor of the cavity) is 18 inches thick and made of reinforced concrete. In addition to the cavity water, water from the containment floor also enters the sump

through five downcomer pipes. Eight 4-inch vent pipes lead from the top of the sump to the containment to allow venting of the sump and to permit complete filling of the sump with water.

Two 24-inch recirculation suction pipes connect the sump to the recirculation pumps located in the auxiliary building. A 4-inch drain pipe in the sump floor allows periodic draining of the sump.

As already mentioned, the Palisades plant in-core instrument tubes enter the RPV from the top, and there are no penetrations in the RPV lower head. The RPV lower head is 4.5 inches thick with 1 /4-inch thick stainless steel cladding on the inside surface. The lower vessel head is uninsulated. Since the RPV is located less than one foot above the cavity floor, it is possible to have submergence of the RPV lower head in water for several accident sequences. The ability of the cavity water to prevent vessel breach is important in determining the course of several severe accident sequences.

A Cavity Flooding System (CFS) in the Palisades containment collects all the drain water on the containment floor (accumulated due to the operation of the containment sprays) and drains it into the sump. During normal spray operation, the sump capacity is not sufficient to hold all the water, and the overflow is drained into the cavity. The CFS is aligned to the spray headers, and functions only if the sprays are in operation. Proper operation of the CFS leads to water levels in the cavity up to the RCS loop piping.

The grid spacers used in the core of the Palisades plant are made of zircaloy. Together with thicker cladding used in the core, the masses of zircaloy used in Combustion Engineering plants are larger than similar Westinghouse plants. The effect of larger masses of zircaloy is a larger potential for hydrogen generation and hence, as shown in Table 1, there is a potential for higher hydrogen concentration in the Palisades containment.

However, the higher hydrogen concentration is not sufficient to lead to hydrogen combustion in most accident sequences.

Palisades IPE Back-End Review 2

ERI/NRC 95-102

The containment capacities of the three plants are similar; however, the concrete used in the Palisades plant is stated to be dolomotic limestone (50% CaO and 50% MgO). This type of concrete can lead to generation of larger quantities of carbon monoxide due to core-concrete interactions.

It should be pointed out that the IPE submittal shows a good awareness of these plant specific features and their effects on accident progression. Section 3.2 of the submittal provides a detailed discussion of these (and other) plant specific features.

Palisades IPE Back-End Review 3

ERI/NRC 95-102

2.

CONTRACTOR REVIEW FINDINGS The present review compared the Palisades IPE submittal to the intent of the Generic Letter (GL) 88-20, according to the guidance provided in NUREG-1335. The responses of the licensee were also reviewed.

The findings of the present review are reported in this section, and follow the structure of Task Order Subtask I.

2.1 Licensee's IPE Process 2.1.1 Completeness and Methodology The IPE submittal (together with additional information provided by the licensee) is essentially complete with regard to the intent of the Generic Letter and the guidance of NUREG-1335.

The methodology employed in the Palisades IPE submittal for the back-end evaluation is clearly described, and the IPE is logical and consistent with GL 88-20. The definition of Plant Damage States (PDSs) involved grouping of the Core Damage Event Tree (CDET) sequences into a PDS bin, by applying a PDS bridge tree. The bridge tree includes top event questions about the containment safeguard states, such as sprays and fan coolers, and the containment isolation status. Probabilistic quantification of severe accident progression involved the development of a small Containment Event Tree (CET), and use of small supporting fault trees to evaluate the split fractions for each node. The results of the CET analyses lead to an extensive number of end-states, and the IPE authors have attempted to quantify source terms corresponding to most of the end-states. Only a limited binning process was employed, and the analysts attempted to quantify as many accident sequences as possible. By performing MAAP simulations of accident sequences that characterize the PDSs, the IPE analysts determined the containment loads and timings of key events that define the accident progression. In addition to these base case MAAP calculations performed for the dominant PDSs, a number of sensitivity analyses (for both, deterministic MAAP calculations and probabilistic containment analyses) were performed to assess the impact of uncertainties in the phenomena on the accident progression, and on the fission product source terms.

2.1.2 As-Built/ As-Operated Status The submittal states that the IPE models the containment and plant systems for the as-operated plant as of 1990. Insofar as the containment systems are concerned, it appears that all the Palisades containment-specific features are modelled.

2.1.3 Licensee Participation and Peer Review of IPE The back-end analyses were performed by the utility with consulting support provided by TENERA, L.

P., and Gabor, Kenton, and Associates. A peer review of the IPE process was performed by the Palisades Plant Safety Engineering Group at the Palisades plant, which is responsible for the safety analyses for the plant. However, this group was primarily involved in the review of fault trees and system success criteria used for front-end analyses. The containment event trees were reviewed by contractor personnel from TENERA, L.P., and Gabor, Kenton and Associates. It should be noted that these personnel were also involved in some parts of the back-end analyses, such as MAAP calculations, and development of the event trees and fault trees.

Palisades IPE Back-End Review 4

ERI/NRC 95-102

As a response to an NRC question on the extent of the peer review, the I icensee stated that the submittal reflects and includes several comments from a contractor review of the back-end process. Contractor review identified specific weaknesses in three areas: treatment of SGTR bypass accident sequence modelling in the IPE submittal, fission product release from early core relocation to the auxiliary building, and Molten Core-Concrete Interactions (MCCI) in the auxiliary building. The licensee noted that the submittal was revised to address these weaknesses. In summary, it is concluded that the submittal document addresses all the back-end comments and concerns of the reviewers.

2.2 Containment Analysis The key characteristics of the Palisades plant and containment were identified in Section 1.2. Tables 1 and 2 provide a summary comparison of the key design features of the Palisades plant and containment systems with the Zion and Surry plants. The Palisades plant is similar to the Surry plant in several aspects, such as RCS water volume, power, and masses of core, as shown in Table 1.

2.2.1 Front-End/Back-End Dependencies The Plant Damage States (PDSs) are a combination of five separate binning characteristics as described below:

1.

Initiator: Describes the accident initiator. Seven types of accident initiators were considered and they include the following:

Large Break LOCAs Medium Break LOCAs Small Break LOCAs Interfacing Systems LOCA Steam Generator Tube Rupture Transients Anticipated Transient Without Scram (ATWS) Sequences All types of accident initiators appear to have been included in this definition.

2.

Core Damage Timing: Accident sequences are classified into two types depending on the time of core damage initiation relative to accident inception; namely, early and late core damage.

3.

Containment Safeguard Status: This indicator differentiates accident sequences based on the functional availability of containment safeguards. Seven distinct states of containment safeguard systems are considered, and are listed in Table 3.3.6-3 of the submittal (page 3.3-10).

4.

State of Secondary Cooling: The plant damage states are differentiated based on the availability of secondary side cooling.

5.

Pressurizer PORV Availability:

This indicator classifies acCident sequences based on the availability of the PORVs.

Palisades IPE Back-End Review 5

ERI/NRC 95-102

Table 1.

Summary of Key Plant and Containment Design Features for Palisades I Feature I Palisades I Zion I Surry I Power Level, MW(t) 2,530 3,236 2,441 Volume of RCS Water, M3 290 368 283 Free Volume of Containment,M3 50,970 81,000 46,440 Mass of Fuel, kg 82,712 98,250 79,652 Mass of Zircaloy, kg 29,330 20,230 16,466 RCS Water Volume/Power, M3/MW(t) 0.11 0.11 0.12 Containment Volume/Power, M3/MW(t) 20.1 25.0 19.0 Zr Mass/Containment Volume, kg/M3 0.575 0.25 0.35 Fuel Mass/Containment Volume, kg/M3 1.62 1.21 1.72 Mass of H2 Generated by Zirconium Oxidation, kg 1285 886 721 Maximum H2 Concentration, 10-3 Moles/m3 12.6 7

9 Table 2.

Comparison of Containment Capacities Feature Palisades Zion Surry Design Pressure 55 psig 47 psig 45 psig Failure Pressure 132 psig 134 psig 126 psig Concrete Type Dolomitic Limestone Basaltic Limestone Palisades IPE Back-End Review 6

ERl/NRC 95-102

The definition of the PDSs can be found in Table 3.3.6-4 (page 3.3-12) of the submittal. A plant -damage state bridge tree is used to sort the outcomes of the core damage event trees (used to quantify the core damage frequency for the front-end analyses) into the proper PDS bins. The binning process resulted in 392 possible plant damage states. *The number of plant damage states was ultimately reduced to 28 by excluding implausible combinations, and by applying a cutoff frequency for truncation. A cut-off value of 1.0 x 10-12 per reactor-year (ry) for LOCA sequences and 1.0 x 10*9 for transients and ATWS sequences was used. A listing of the collapsed plant damage states is provided in Table 3.3.8-4 (page 3.3-27) of the submittal. Furthermore, by assigning a cutoff frequency of 1.0 x 1 o-s, while still making sure the cumulative core damage frequency exceeds 99 3 of the total core damage frequency, the total number of PDSs to be used as input to the CET was further reduced to 18. A detailed description of each. of these eighteen plant damage states, and the core damage sequences that contribute to them is provided in Section 3.3.9 of the submittal. The definition of plant damage states in the submittal is adequate and meets the intent of GL 88-20.

2.2.2 Containment Event Tree Development Probabilistic quantification of severe accident progression is performed using an event tree/fault tree methodology, where the fault trees used to quantify each CET node (called "Top Heading" in the submiLtal) are called CET-logic trees. The CET is concise and contains the following thirteen nodes:

(1)

Plant damage state entry condition, (2)

Early containment bypass, (3)

Containment isolation successful, (4)

Late containment bypass, (5)

Recovery (after fuel melting),

(6)

Upward debris dispersal at vessel failure, (7)

Relocation of core debris at vessel failure, (8)

Containment intact early, (9)

Volatile fission product release early,

( 10)

Late relocation of core debris,

( 11)

Containment intact late, (12)

Core concrete interactions resulting in fission product release, and (13)

Volatile fission product release late.

The CET is developed for all PDSs. The first node is self-explanatory. The second node considers bypass sequences prior to core damage, such as an interfacing systems LOCA, or a steam generator tube rupture with a stuck open secondary relief valve. The status of containment isolation is determined using the third node.

All containment isolation failures are clumped into large containment failures.

Thermally-induced steam generator tube ruptures are treated using the fourth node, for which a split fraction of 0.0034 is calculated for high pressure sequences in Section 3.5.6.4.3 of the submittal.

In the fifth node, two modes of recovery (i.e., core melt maintained in a coolable configuration) are considered. The first mode, the coolability of core debris in-vessel by coolant recovery, is included in the fault trees, but not credited in the submittal. Subsequently, the negative consequences ofreflood, i.e.,

hydrogen generation and in-vessel steam explosions due to reflood, are not considered in the submittal.

The second mode of recovery, which involves confinement of core debris in the RPV and prevention of vessel breach by external cooling due to cavity water, is credited in the submittal. The split fraction for the success of the external_ cooling of the RPV depends on five basic events, namely, ( 1) availability of Palisades IPE Back-End Review 7

ERl/NRC 95-102

the containment sprays (to flood the cavity), (2) availability of a flow path from the containment floor to the cavity, (3) the failure of the melt to pour as a jet and attack the lower vessel head, ( 4) the existence of RCS pressure of less than 110 bars, and (5) uncertainty in the lower head external heat transfer model.

The first basic event is defined by the PDS.

For the second basic event, the submittal assigns a probability of 1.65 x 10-2 for the failure of the CFS, based on the analyses presented in Section 3.4.6.4.3.12 of the submittal. For the third basic event, a model for jet impingement heat transfer and some analyses are referred to in the submittal, but the possibility of vessel failure by jet impingement-induced vessel failure is considered to be remote, and is assigned a probability of 1 x 10*3* Ex-vessel cooling by cavity water is not considered a credible mode of prevention of vessel breach for vessel pressures in excess of 110 bars. The submittal refers to an IDCOR report that suggests that for high pressure sequences, the time for vessel failure after relocation of debris in the lower plenum is on the order of minutes, and therefore ex-vessel cooling is not credited for high pressure sequences. Finally, for all sequences with RCS pressure less than 110 bars, the lower head cooling is considered a credible mechanism for prevention of vessel breach.

However, the fifth basic event takes into account the uncertainty in the heat transfer models, and a probability of 0.9 is assigned to the success of this event.

Ex-vessel cooling is a key phenomenological assumption which has a significant impact on the portrayal of.the Palisades containment vulnerabilities. A question was forwarded to the licensee regarding the validity of the assumption of prevention of vessel breach by ex-vessei cooi ing for low prnssure sequences

( -

903 probability).

A recent NRC-sponsored study [3-5] of lower head cooling is not in total agreement with the conclusions of the submittal. The licensee provided a limited justification of this assumption and argued that the overall results are not strongly impacted by this assumption.

The next node in the event tree concerns debris dispersion at vessel breach. For accident sequences at high pressures, upward debris dispersion is assured owing to the close proximity between the vessel and the cavity floor. Consequently, for high pressure sequences, it is assumed that upward dispersion leads to relocation of the debris to the upper compartment, and hence the debris does not relocate to the sump under the cavity.

The seventh node, debris relocation into the cavity, is assumed to occur in the absence of upward dispersion. Two possible consequences of the debris relocation into the cavity are the catastrophic failure of the cavity, or draining of the debris from the cavity into the sump. Upon relocation of debris into the sump, if prompt quenching does not occur in the sump, the debris can relocate further into the recirculation piping, ultimately causing the failure of the piping and subsequent release of the debris and fission products into the auxiliary building. An additional path of debris *relocation into the containment through the personnel access tube was not considered to be a credible path for dispersal.

The eighth node is related to containment failure at or around the time of vessel breach. Owing to the unique cavity design of the Palisades plant, there exists a possibility of cavity failure due to pressurization at vessel breach. Cavity failure can lead to direct debris relocation to the auxiliary building. In addition, the failure of the cavity can also lead to failure of the containment due to the movement of the RCS piping, steamlines, and letdown lines. A detailed analysis of cavity failure at vessel breach is presented in Section 3.5.6.4.3.2 of the submittal. A mean structural failure pressure of 25.5 bars (for the cavity floor) was arrived at as part of the calculations for the containment capacity, and the capacity distribution is shown in Figures 3.5.6-1 and 3.5.6-2 (for the floor and the walls respectively) of the submittal.

Palisades IPE Back-End Review 8

ERl/NRC 95-102

The pressure load on the cavity was obtained from MAAP calculations, and was determined to be dependent primarily on the following three factors, vessel pressure at vessel breach, vessel failure size, and the mode of dispersal. The first factor, vessel pressure at vessel breach, is determined by the accident sequence, and by whether or not the RCS is depressurized. For the second factor, a distribution for the vessel failure size is derived, based on a review of IDCOR and NRC publications. The final factor that determines the cavity pressurization is the mode of dispersal, i.e., whether the debris is expelled as droplets or as a film. Both modes of dispersal were considered, and by adjusting the proper MAAP input parameters, cavity pressures corresponding to both modes of dispersion could be determined. The peak cavity pressure was determined for a range of RCS pressures, and the pressure loads were compared with the cavity pressure capacities. The probabilities of cavity failure as a function of RCS pressure are presented in Tables 3.5.6-9 and 3.5.6-10 of the submittal. It can be seen from these tables that the failure of the cavity wall and floor is almost certain for high pressure scenarios.

The various contributors to early containment failure include direct containment heating, ex-vessel steam explosions (by dislodging and causing a seal plate to become a missile), hydrogen bum, catastrophic failure of cavity by pressurization, direct liner attack by dispersed debris, and vessel rocketing.

However, early containment failure is calculated to be principally due to direct containment heating, for which a failure probability of 9.92 x 10"3 is calculated. The split fractions for containment failure due to the other modes are lower. In addition, the IPE analysts have not con~idered the increased probability of rocketing that can occur in the Palisades plant owing to the lack of lower head penetrations, the small size of the cavity, the lack of the instrument tunnel, and the close physical proximity of the RPV to the vessel floor. Instead, the analysts judged that the generation of a rocket is twice as likely in the Palisades plant as in the Surry plant, and assigned a probability of 0.05 to the formation of a rocket. This, in tum, results in a conditional probability of 5.0 x 10-5 for containment failure by the rocketing failure mode.

For low pressure sequences, a significant failure mode involves early relocation of core debris to the auxiliary building, through a connecting pipe from the sump.

Various split fractions (from 0.125 to 0.75) are assigned to the probability of relocated debris quenching in the sump, depending on the availability of sprays, and the type of accident sequence. The relocation of core debris to the auxiliary building is an important failure mode, and it occurs for 31 3 of the total core damage frequency.

Nodes 10 and 11 treat late relocation of core debris and late containment failure. Late core debris relocation occurs in sequences where there was no early debris relocation. In the absence of early debris relocation, the debris on the cavity floor is assumed to attack the cavity, penetrate the floor into the sumps, and then relocate to the auxiliary building. Core concrete interactions in the auxiliary building are also treated. Late containment failure is assumed to occur due to hydrogen and carbon monoxide bum, and due to overpressurization. It should be pointed out that the IPE submittal treats core concrete

interaction in the upper compartment and refuelling pool floor after dispersion from the cavity, and the noncondensable gas generation from these interactions is a significant contributor to late containment pressurization. As was expected for the type of concrete used in Palisades, larger amounts of carbon monoxide were found to be generated.

One point that should be made here concerns the treatment of recovery events (Table 3.5.6-3, page 3.5-27). Assigning a value of zero for all recovery probabilities is neither conservative (due to potential negative effects) nor advisable. It is also not clear why AC power recovery is not considered as a part of the recovery actions. Two questions were posed to the licensee regarding the justification of the exclusion of recovery events. The licensee responded, using probabilistic and deterministic evaluations, that the inclusion of the recovery of sprays will not lead to an increase in the conditional probability of Palisades IPE Back-End Review 9

ERI/NRC 95-102

containment failure and will lead to a reduction of the magnitude of radiological releases. A simplified analysis was performed by the licensee in response to an NRC request to evaluate the impact of AC power recovery upon the conditional probability of containment failure. The analysis concentrated on one PDS (TEJW). Results show a reduction (of one order of magnitude) in the conditional probability of early containment failure, for this PDS.

In summary, the licensee position on the treatment of recovery actions is that the assignment of zero probabilities for the split fractions that correspond to the possibility of recovery of AC power, sprays, and fan coolers, is conservative.

A number of questions were posed to the licensee regarding the details of the quantification of the split fractions for the various basic events. More specifically, the questions concentrated on the following phenomena, and their treatment in the CET analyses:

Cavity pressurization at vessel breach, Vessel failure size, Cavity failure by overpressure, Containment failure due to the failure of cavity walls, Core relocation after vessel failure, Failure of spray and fan coolers due to severe accident conditions, Treatment of HPME-induced dispersion, and EVSEs in the submittal, Justification of split fractions for debris coolability in a dry cavity, and Treatment of in-vessel core coolability.

Detailed responses and supporting calculations were provided by the licensee. It appears that the licensee has treated many of these issues in considerable detail.

2.2.3 Containment Failure Modes and Tilnin&

The Palisades IPE submittal makes use of Palisades-specific calculations, performed by Bechtel Inc., for determining the ultimate pressure capacity of the containment. The Palisades containment is a prestressed concrete containment with a 1/4-inch thick steel plate as a liner.

A finite element model of the containment was developed. Seven failure locations were identified, namely, the mid-height region of the cylindrical wall, the apex region of the dome, the basemat-cylindrical wall interface, access openings, large pipe penetrations, small pipe penetrations, electrical penetrations, and the wall and skin juncture.

The failure capacities for several failure mechanisms were combined to arrive at a compound fragility curve for the containment (Figure 3.4.4-14 of the submittal). A median failure pressure of about 130 psig is indicated. This value is comparable to the failure capacity of similar large dry containments. In addition. the submittal also identifies the failure areas and locations for various containment overpressure scenarios. Both leaks and large ruptures were considered as possible modes of failure. For source term calculations, it was assumed that a rupture bas an area of 10 ft2, and a leak led to hole sizes varying from 0.05 to 0.10 ft2

Palisades IPE Back-End Review 10 ERl/NRC 95-102

In summary, the methods used in the submittal for the characterization of the containment capacity are detailed and sound. The effect of elevated temperature upon the containment failure capacity was not evaluated, and all the results for the containment capacity in the submittal correspond to a temperature of 400°F.

The effect of penetrations on the evaluation of the failure pressure was partially considered in the submittal. It was concluded that penetrations less than 24 inches in diameter do not constitute a potential weakness in a concrete containment, and hence a detailed evaluation of the structural capacity of small penetrations was not performed. However, a simplified evaluation of the effect of elevated temperatures upon penetration seals was performed as a part of the IPE. The gasket seal material used in Palisades is called EDPM (E603). The submittal states that these gasket seals will not be compromised by temperatures less than 700 K. An independent survey of typical CONTAIN and MELCOR calculations for severe accident sequences do not indicate structural temperatures in excess of 700 K in $e vertical wall and the dome of the containment for PWRs. The electrical penetrations were also investigated and all the penetrations were found to either use glass or ceramic seal materials. From a review of NUREG-1037, it was concluded that the leakage area for these seal materials for high temperatures was 10-1 in2 _

The Palisades containment has 44 electrical penetrations, and the maximum leak area was calculated to be 4.4 x 10..s in2* It was concluded that the failure area is so small that it will have an insigmficant effect on the leakage of fission products from the containment. However, the methodology used in the submittal is not complete. Hence, the licensee was requested to consider the performance of containment elastomer penetration sealant materials in more detail in an RAI. The licensee responded that a detailed quantitative analysis of containment elastomer penetration failure was not possible, but provided qualitative results.

Eight penetrations that used elastomeric seals were identified, and the CET analyses and results were reviewed to identify whether the containment penetrations could fail due to high temperature.

For accident sequences involving HPME, the licensee concluded that failure of elastomer seals was possible.

However, the licensee concluded that the failure of these penetrations could only lead to earlier release of fission products and a larger magnitude of releases. In addition, the licensee stated that accident sequences involving HPME contributed to less than 153 of the CDP, and hence, the impact on overall radiological releases and the risk, is expected to be small.

2.2.4 Containment Isolation Failure A fault tree was developed to quantify the probability of containment isolation failure. All isolation valves and penetrations larger than two inches in diameter were considered as possible candidates for isolation failure. The fault tree used for the evaluation of the probability of isolation failure was not provided as the part of the submittal, and hence no assessment could be made of the probability estimate of 0.005 for containment isolation failure. In response to an NRC RAI, the licensee provided more details of the quantification.

It appears that the method of calculation and the overall result are comparable to other PRAs. A number of incidents of containment isolation failure have been reported in the Palisades plant. For instance, two valves were left open in a 3" purge bypass line during an entire operating cycle (12-18 months) in 1979. Similar incidents, but of shorter duration, were also reported in 1980 and 1981-It was not clarified in the IPE whether these incidents were used in developing a database for isolation failure in the Palisades plant.

The licensee stated in the response that the information from containment isolation incidents were used to evaluate the pre-accident human error probability. The licensee stated that, following the incidents in 1979 through 1981, they have made modifications in procedures and implemented these procedures, for containment isolation.

Palisades IPE Back-End Review 11 ERI/NRC 95-102

2.2.5 System/Human Response The only operator action found to be modelled in the Palisades IPE submittal involves depressurization of the RCS after core damage (Basic Event ODEPRESS). Since there are no EOPs that direct the operator to depressurize the RCS after core damage, a split fraction of 0.0 is assigned to this basic event for all accident sequences. As a response to an NRC RAI, the licensee discussed the impact of intentional depressurization upon core damage arrest in-vessel. In the submittal, prevention of vessel failure is expected for about 33 % of all core damage accident progressions. The licensee stated that intentional depressurization of the PCS is expected to increase the proportion of core damage sequences involving in-vessel recovery to approximately 50% (11]. Based on these results, the licensee has committed to develop specific guidance to depressurize the PCS using the pressurizer PORVs following core damage, as a part of the severe accident management program; 2.2.6 Radionuclide Release Categories and Characterization The results of the CET analyses lead to an extensive number of end-states, which, in traditional PRAs, are classified into a manageable number of releases, characterized by similarities in accident progression and source term characteristics. However, in the Palisades IPE submittal, to a leading order, no binning was performed. Instead, all of the CETs were evaluated, and an attempt :was made to quantify the source terms corresponding to all the CET end-states. In cases where more than one PDS contributed to an end-state, attempts were made to quantify the source term for a few leading contributors, and a judgement was made based on the source term results to identify the proper source term. The cut-off frequency for the CET end-states was chosen to be 1.0 x 10-7* Fission product release categories (source terms) are defined in terms of the magnitude of the releases, isotopic distribution, timing and probability. The magnitude of the releases was evaluated from the CPMAAP code calculations for the accident sequences that define the CET end-state. Typically, the CPMAAP code simulation was extended for at least twelve hours following containment failure to evaluate the magnitude of the source term.

Ultimately, the analysts were forced to bin a few select end-states.. conservatively" with others, so as to arrive at a manageable number of releases.

There are 65 possible CET end-states; however, after completion of the CET analyses, only 19 end-states were found to be of significance. Section 3. 7 of the IPE submittal provides the details of the source term results for all the CET end-states. Generic Letter 88-20 states that the following should be reported: "any functional sequence that has a core damage frequency greater than or equal to 10-6 per reactor year and that leads to containment failure which can result in a radioactive release magnitude greater than or equal to BWR-3 or PWR-4 release categories of WASH-1400." In this regard, the IPE submittal meets the intent of the GL.

End-states 01, 02, 03, 04a, and 04b represent the releases due to the bypass sequences. End-states 01, 02, and 03 represent steam generator tube rupture sequences, and end-states 04a and 04b represent the V sequences. A comparison of releases for the steam generator tube rupture sequences between the IPE submittal results and results from Battelle Columbus Division calculations (for SGTR sequences in Surry plant [6]) is shown in Table 3. The results indicate that the Iodine and Cesium releases reported in the submittal (varying from 0.25 to 0.3) are comparable with the BCD results (0.25 for both species), and Tellurium releases are one order of magnitude smaller for the Palisades calculations. The submittal also reports Strontium, Barium, Cerium and Lanthanum releases, which are one order of magnitude higher than the BCD results.

Palisades IPE Back-End Review 12 ERI/NRC 95-102

A comparison of releases for the V sequences is shown in Table 4. For these sequences, the releases for Cesium and Iodine provided in the submittal (varying from 0.81 to 0.92) are much larger than those calculated ~y BCD [6] or BNL [7]. References [6] and [7] report that Cesium and Iodine releases vary from 0.26 to 0.4. The only explanation that can be provided is that the submittal calculations assume break sizes which are much larger than those assumed by the BCD and BNL analysts. Although these results are conservative, it is possible that the releases and the resulting risk may be dominated by the bypass sequences. However, it should be noted that the Tellurium, S_trontium, Lanthanum and Cerium releases reported by BNL results [7] and the submittal are comparable.

The Sarium releases are comparable to BCD results [6], and one order of magnitude larger than BNL results [7].

In addition to the above mentioned results for the bypass sequences, results are reported for end-state 10, which represents the releases for the temperature-induced multiple steam generator tube rupture sequence.

Although the release frequency (4.4 x 10-11) is less than the cutoff frequency, the releases are still reported in the submittal even though they are considerably smaller than the other steam generator tube rupture sequences.

CET end-states 22 and 23 represent accident progressions with vessel failure at high pressure, debris dispersal, late containment failure, both with and without late revaporization. The releases are all very low ( :S: 10"3), as the containment failure was calculated to occur only after five days.

CET end-states 26, 28 and 29 represent accident progressions with vessel failure at high pressure, upward debris dispersal, and early containment failure. In Table 5, the results for end-state 28 is compared with BCD [8] calculations for a similar sequence in the Surry plant. The releases oflodine and Cesium (0.05) calculated in the submittal are comparable to BCD results (0.06 to 0.07). Telluriµm releases (0.1) are larger for the CPMAAP calculations, but can be attributed to larger in-vessel zirconium oxidation calculated by CPMAAP. However, one difference that should be noted is that presently there is no model in CPMAAP for the calculation of nonvolatile releases during debris dispersion in the upper compartment, and a release of 0.1 is assumed for these species. Hence, the releases for these species are much larger in the IPE submittal than comparable results from the BCD and BNL calculations.

CET end-states 30, 31 and 32 represent accident progressions with vessel failure at low pressure, no upward debris dispersal, and core relocation to the auxiliary building. The representative accident sequences are transients and station blackout sequences with depressurization (stuck-open PORV, hot leg rupture, etc). The early core relocation to the auxiliary building results in releases of volatiles in end-states 30 and 31, where no injection of water into the containment takes place. The release fraction of the volatiles varies from 12 to 15 percent for these cases. However in end-state 32, where there is injection of refuelling tank water to the containment (and, hence, to the auxiliary building), the release of volatiles is smaller, and no core-concrete interactions take place in the auxiliary building. CET end-state 33 represents a similar accident progression, except that the core relocation to the auxiliary building is after cavity failure due to MCCI. No comparable results could be found in the literature. It should be noted that the probability of these releases are large, and correspond to 31 3 of the core damage frequency. It is expected that these releases will dominate the risk profile for the Palisades plant.

The last end-state 57, represents sequences that involve failure of containment isolation. The volatiles released during this sequence are released in two stages; the first stage involves leakage through the unisolated purge line during accident progression in-vessel.

After core relocation to the auxiliary building, the second stage of release occurs. About a 103 release of Cesium, Iodine and Tellurium are calculated to occur for this sequence.

Palisades IPE Back-End Review 13 ERl/NRC 95-102

Figure 1 shows a plot of the probability of exceedance (per reactor year) as a function of the fractional release of Iodine. A comparison between this plot and Figure 3.3-16 (page 3.53) of NUREG/CR-4551

[9], which shows similar results for Surry, shows that the releases for Palisades are one order of magnitude larger than those for Surry. The difference can be attributed to two reasons. The first reason concerns the V sequence(s), for which the releases reported are larger than similar results calculated for NUREG-1150. The second reason concerns the sequences that involve low pressure at vessel breach, and relocation of core debris to the auxiliary building. Large releases of volatile species are found to occur for these sequences, and in some cases releases are comparable to the releases for high pressure sequences. A similar comparison of fractional releases of Tellurium and Strontium with Figure 3.3-16 of NUREG/CR-4551 [9], shows that the releases for Palisades are one order of magnitude larger than those for Surry. In spite of such differences, it is concluded that, in general, the source terms reported in the IPE submittal are sufficient and satisfy the scope of the generic letter.

Table 3 Comparison of Releases for Surry ("H" SGTR Sequence) and Palisades (DEJS SGTR sequence, CET End-State 02)

WPWR Surry Palisades (MELCOR)

(STCP)

(CPMAAP)

Group

[5]

[7]

[1]

I 0.28 0.25 0.30 Cs 0.28 0.25 0.29 Te 0.06 0.08 lE-3 Sr 3E-3 2E-4 IE-3 Ru IE-4 3E-7 NA+

La IE-5 2E-8 3E-5 Ce 2E-5 0.0

< IE-7 Ba NA+

3E-3 0.01

+ NA Not Available Palisades IPE Back-End Review 14 ERl/NRC 95-102

Table 4 I I Group I

Cs Te Sr Ru La Ce I Ba Table 5 Group I

Cs Te Sr Ru La Ce Ba Comparison of Releases for Surry (V Sequence) and Palisades (CEJW V Sequence, with CET End-State 04b)

I Surry I

Surry I

Palisades STCP STCP CPMAAP I

[5]

I

[8)

I

[1]

0.29 0.40 0.92 0.26 0.40 0.92 0.05 0.12 0.1 5E-3 0.01 2E-7 7E-4 NA+

4E-4 3E-04 4E-4 lE-5 3E-3 0.01 0.02

+NA Not Available Comparison of Releases for Surry (TMLB Sequence) and Palisades (TEJW Sequence, CET End-States 26 and 28), Containment Failure Around the Time of Vessel Breach Surry Surry.

Palisades STCP STCP CPMAAP

[6]

[8]

[1]

0.07 0.14 0.02 - 0.05 0.06 0.13 0.02 - 0.05 0.06 0.19 0.1 0.01 0.03 0.1 lE-3 2E-7 NA+

2E-4 lE-3 0.1 8E-4 0.1 0.02 0.1 NA Not Available I I I

Palisades IPE Back-End Review 15 ERI/NRC 95-102

Frequency of Exceedance per Year of Csl Release to

Environment Frequency of Exceedance(per Year) 0.001

=-.:.:::::*.:.:.::.- ---

~ *--....

Cl.DOOi

... ::-:.'::-_-___ ~: *---**- *-**-*.

... \\

.-:*.~: -~

1E-ll7 IE-GI OJIOOOOI j--Zion NUREG-1150 **- Robinsdn -** Suny NUREG-1150 -Palisades D.DOOOI D.llOOI D.DDI 0.01 Fraction of Inventory Released to Environment

.--... i..

0.1 Figure 1 Frequency of Exceedance of Cesium.Iodide Relea'\\e Palisades IPE Back-End Review 16 ERI/NRC 95-102

2.3 Quantitative Assessment or Accident Progression and Containment Behavior 2.3.1 Severe Accident Progression Modifications were made to the EPRI-developed version of the MAAP 3.0B code (version 16) to enable the performance of integrated containment analyses and source term evaluations in Combustion Engineering plants. The Palisades-specific version of MAAP was renamed as CPMAAP, and was used to analyze postulated severe accidents at the Palisades plant. A summary of modifications made to the MAAP code is listed in Table 3.2.12-1 of the submittal. Some specific features include addition of paths for the flow of debris from the sump to the auxiliary building, modelling of melting of the RCS insulation, and models for release of Tellurium during ex-vessel zirconium oxidation. Although mention is made of the MAAP parameter input file, it is not included in the submittal. However, the MAAP analyses performed for severe accident analyses and source term quantification are very detailed, and a total of thirty-six sequences were analyzed. The choice of sequences to be analyzed was based on the CET analyses, in order to enable the proper quantification of source terms for all important end-states.

A listing of all the analyzed accident sequences is provided in Table 3.6.1-4 of the submittal.

Both base case and sensitivity analyses were performed to quantify the timings of key events, containment response and source terms for all the 19 dominant POSs. The results of the MAAP analyses are displayed in Sections 3.6.3 through 3.6.20, in the form of tables for timings of key events, and as plots of key containment response parameters, for each PDS.

Almost all of the phenomenological uncertainties in PWR severe accidents are treated in the IPE submittal, either in the CET analyses or through MAAP sensitivity calculations. As a part of the CET analyses (Section 3.5.6 of the submittal), the submittal considers uncertainties in the following phenomena; Temperature-induced RCS failure Prevention of vessel failure due to ex-vessel cooling Vessel failure radius Mass of hydrogen released to the containment (in-vessel release)

Hydrogen bum and associated containment loads Ex-vessel steam explosions, dislodging of pool seal plate, and containment failure Peak cavity pressure after vessel breach Probability of cavity failure after vessel failure Failure of containment liner upon contact with dispersed debris Maximum core debris mass available for entrainment and for participation in OCH Containment pressure rise due to OCH Palisades IPE Back-End Review 17 ERl/NRC 95-102

Aammable gas concentration in the late phase of the accident Debris bed coolability and heat transfer to overlying pool of water The list provided above is partial, and Section 3.5.6 of the submittal provides more details of the uncertainties treated as a part of the CET analyses. It should also be pointed out that the IPE submittal also uses cumulative probability distributions for containment loads and capacities for the assessment of early and late containment failure and cavity failure. The containment load and capacity distributions are overlapped in order to arrive at the resulting probabilities of failure.

2.3.2 Dominant Contributors to Containment Failure The containment failure modes and timings for various accident sequences are provided in Section 3.6 of the submittal. Table 6 of this review shows a comparison of the conditional probabilities of the various containment failure modes of the Palisades IPE submittal with the Surry and Zion/NUREG-1150 results. All comparisons are made for internal initiating events only.

Table 6 Containment Failure as a Percentage of Total CDF: Comparison with Other PRA Studies z

Containment Failure Mode Early Failure Late Failure Early Relocation to Auxiliary Building Bypass (V)

Bypass (SGTR)

Isolation Failure Intact Core Damage Frequency, yr*1 laoludea Flooding Not Applimble Palisades IPE 1.5 14.7 31.0 0.5 5.1 0.5 46.3 5.2x1Q*S l lacluded M a Part of Early Conlainmenl Fallun Surry NU REG-Zion 1150 NUREG-1150 0.7 1.5 5.9 24.0 NA2 NA2 7.6 0.2 4.6 0.3

_3

_3 81.2 73.0 4.lxt0*5 6.2xI0*5 The Palisades core damage frequency for internal events is comparable with that calculated for Surry and Zion (NUREG-1150). The conditional probabil_ity of early containment failure in the Palisades plant is Palisades IPE Back-End Review 18 ERI/NRC 95-102

comparable to the Zion results, and about twice the probability of early failure in Surry.

This is consistent with the plant design, since the Palisades design is, in several ways, comparable to the Zion plant. The conditional probability of late containment failure at Palisades plant lies between the values calculated for the Surry and Zion plarits. The largest containment-response difference between Palisades and the other two plants is the. failure mode involving relocation of core debris to the auxiliary building.

This is a Palisades-specific containment failure mode. It is expected that the Palisades risk profile will be dominated by the early relocation of core debris into the auxiliary building, and by bypass failure modes.

2.3.3 Characterization of Containment Performance By performing MAAP simulations of accident sequences that characterize the PDSs, the IPE analysts determined the containment loads and timings of key events that define the accident progression. In addition to these base case MAAP calculations performed for the dominant PDSs, a number of sensitivity analyses were performed to assess the impact of uncertainties in the phenomena on the accident progression, and on the fission product source terms. Some of the sensitivity analyses performed as a part of the submittal include the following:

Effect of break size on Interfacing Systems LOCA.

Effect of secondary side cooling on fission product release in ISLOCAs.

Upward dispersal of debris by high pressure melt ejection.

Debris bed coolability and/or core-concrete interactions.

Induced rupture of hot legs and steam generator due to overheating.

Sections 3.6-3 through 3.6-20 of the submittal describe other sensitivity calculations that were performed, and they are too numerous to mention here.

Appendix A of the EPRI "Guidance Document" on performing IPEs with MAAP [ 10] recommends sensitivity calculations on more than 20 parameters for the MAAP code. Not all of the recommended sensitivity analyses were performed as a part of the IPE submittal. However, some of the recommended sensitivities were directly included in the base case (i.e.,

.. No blockage model" for in-vessel hydrogen generation, and release of unbound Tellurium ex-vessel),

and some recommended sensitivities could not be carried out to completion, owing to numerical sensitivities in the CPMAAP code. In summary, it appears that the sensitivity analyses performed for this submittal are very extensive and detailed.

2.3.4 Impact on Equipment Behavior The impact of the accident progression on equipment performance was considered as a part of the CET

analyses. This section briefly describes the specific impacts on equipment behavior that were assessed.

The impact of accident progression on the performance of the fan coolers is evaluated in the IPE submittal through the CACF AIL node which, in turn, depends on the following four basic event nodes:

(1) beyond design basis thermodynamic conditions reached in the containment, (2) aerosol plugging of the coolant fins, (3) hydrogen bums fail air coolant motors, and (4) local detonations and Detonation-to-Deflagration (DDT) transitions fail fan coolers. The probability of occurrence of detonations and DDTs Palisades IPE Back-End Review 19 ERl/NRC 95-102

are judged to be negligible in the Palisades IPE submittal. However, for all other basic events, finite probabilities are stated to be assigned after an examination of containment conditions such as temperatures and pressures. The probabilities for these basic events can be found in Appendix 3.6.1 of the submittal for all accident sequences. In the absence of detailed fault trees, it could not be determined where the CACF AIL node was used in the CETs, and how the probability estimate for this node was obtained.

The impact of accident progression upon the functioning of containment sprays is included in the CET analysis through the CSPFAIL node, in the same manner as the for the fan coolers. Failure of the sprays is considered for the following four basic events: (1) beyond design basis thermodynamic conditions, (2) aerosol plugging of spray nozzles and the shutdown cooling heat exchanger, (3) hydrogen bums, and (4) local detonations. Once again, the probability of occurrence of detonations and DDTs is judged to be negligible in the Palisades IPE submittal. The basic event split fractions are listed in Appendix 3.6.1 of the submittal.

It should be noted that the same split fraction of 0.1 (Appendix 3.6.1) is assigned to the probability of failure of sprays for all accidents. The licensee provided supporting fault trees, and a discussion of how the basic event probabilities are calculated in response to an NRC RAI. The licensee noted that the assignment of basic event probabilities for the failure of equipment under severe accident conditions, is, for the most part, qualitative.

The possibly of ECC recirculation failure due to blocking of the connecting pipe (from the sump to the recirculation pump), owing to debris relocation to the sump, is considered in the event tree. The IPE analysts could not judge the probability ofrecirculation failure under these conditions, and assigned a split fraction probability of 0.5 for the failure under these conditions. Since most of the accident sequences involve recirculation failure, this is not expected to affect the results significantly.

2.4 Reducing the Probability of Core Damage and Fi~ion Product Releases 2.4.1 Definition of Vulnerability The Palisades IPE submittal has not identified any unique plant and containment systml vulnerabilities.

One particular containment failure mode that stands out from the IPE results involves. the containment failure mode with early core debris relocation from the sump to the auxiliary building. This failure mode is due to the location of the ESF sump directly under the cavity. This mode of contaEa.ment failure has large releases of volatiles, especially in accident sequences where the SIRWT water is* not injected into the containment. In addition, 31 3 of the core damage frequency leads to this mode of containment failure.

The licensee was aware of the impact of the location of the containment sump on the conditional probability of containment failure, radionuclide releases, and the overall risk. As a response to NRC questions, the licensee quoted the results of the Palisades offsite consequence analysis which showed that the individual fatality risk (1.87 x 10-8 per reactor year) and individual cancer risk (1.02 x 10-1 per reactor year) are both lower than the NRC safety goals.

Hence, according to the licensee, no

"'vulnerabilities" are deemed to exist, and it was concluded that "severe accidents at 1he Palisades plant pose no undue risk to the health and safety of the public, and no plant modifications are required."

Palisades IPE Back-End Review 20 ERl/NRC 95-102

2.4.2 Plant Modifications Although, as per the arguments presented by the licensee, no plant modifications are required, the licensee [page 22 of 12, 13] continued to identify plant modifications that will prevent or delay relocation of core debris from the reactor cavity to the ESF sump. Sections 1.4 and 6.2 of the IPE submittal and the licensee responses to NRC questions [11] discuss two possible strategies for reducing the risk associated with the ESF sump:

1.

Reduce the conditional probability of core debris relocation to the auxiliary building, and

2.

Prevent or delay the relocation of core debris from reactor cavity to the ESF sump.

The licensee evaluated a number of alternatives related to the second strategy listed above. Of these, the licensee stated that the only promising modification was to fill the two one inch drain lines (from the cavity to the sump) by pumping grout from the sump end of the pipe. A plate supported by a column would be left underneath the filled drain hole to ensure that the plug could not be blown out by high pressure. With the cavity sump plugged in this manner, debris relocation will be considerably delayed.

It is realized by the licensee that containment failure cannot be completely prevented even for this configuration. For sequences that involve noncoolable debris on the cavity floor, the cavity floor is expected to be failed in 5 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. However, this delay in containment failure is presumed to be long enough to allow completion of full evacuation from a 10-mile radius from the plant site.

A review of the risk and cost-benefit analyses performed by the licensee is beyond the scope of the TER, and it is not possible to comment on the cost-benefit analyses that led to the conclusion that plugging of the cavity drains was the only cost-beneficial modification. This modification is stated to:

Reduce the frequency of early containment failure to 1.2 x 10"6 per reactor year, and Reduce the total off-site dose consequence by 393.

It is not clear how these results are obtained. The licensee is committed to this modification, i.e.,

plugging of the reactor cavity drain lines, during the 1997 refuelling outage.

In addition to the proposed plant modification, the licensee addressed the methods of reducing the probability of reactor vessel failure following core damage, by the following actions [ 11]:

1.

Increasing the availability of Containment Spray System (CSS).

An analysis [11] concluded that the increased availability of the spray system would not have a significant impact on risk.

2.

Increasing the availability of Cavity Flooding System (CFS).

To ensure the availability of the CFS, three actions have been planned to be completed prior to the end of the 1995 !'efueling outage:

Palisades IPE Back-End Review 21 ERI/NRC 95-102

3.

a.

Perform an inspection to verify that the CFS is operable. This inspection will include a fiber-optic inspection of all CFS piping, up to and including the point of discharge into the reactor cavity.

b.

Revise Operations Department containment building cleanliness walkdown guidelines to include inspection of the ball float valve floor drains on the 607' elevation.

c.

Revise Palisades cleanliness procedures to alert personnel to the importance of maintaining the containment floor drain system operable, including the ball float valves, by preventing ingress of solid material into the drain system.

For accident progressiom with the CSS and CFS operable, the reactor cavity will be completely flooded. Flooding the reactor cavity will cool the outside of the lower reactor vessel head and increase the probability of preventing vessel failure.

Increasing the likelihood of depressurizing the PCS.

The probability of vessel failure can be decreased further by ensuring that the Primary Cooling System (PCS) is depressurized. Intentional PCS depressurization couid be accomplished by an operator action to open a pressurizer Power Operated Relief Valve (PORV). The availability of a pressurizer PORV is expected to be high for accident progressions with the CSS operable, since the PORVs and the associated block valves require only AC and DC power to operate, and both will be available if the CSS is available. The licensee stated that [ 11] the specific guidance to depressurize the PCS using the pressurizer PORV's following core damage will be developed as part of the Severe Accident Management Program (SAMP).

Prevention of vessel failure by use of the CSS, CFS and pressurizer PORV's is one example of as-built plant features that mitigate the adverse effect of the ESP sump containment failure mode.

In the submittal, prevention of vessel failure is currently expected for about 33 % of all core damage accident progressions. The licensee stated that intentional depressurization of the PCS is expected to increase the proportion of core damage sequences involving in-vessel recovery to approximately 50%.

Hence, the licensee has committed to develop specific guidance to depressurize the pressurizer PORVs following core damage. As already mentioned, the guidance for PCS depressurization will be developed as a part of the licensee severe accident management program.

A number of safety insights were stated to have been obtained as part of the IPE. They include the following:

Small break LOCAs with HPSI failure make a significant contribution to core damage frequency (26.3 3 of the total CDF).

Although small break LOCAs with HPSI failure was identified as an important contributor to total CDF, the HPSI failure was not determined to be a vulnerability.

Palisades IPE Back-End Review 22 ERl/NRC 95-102

Loss of off site power makes a significant contribution to core damage frequency (22. 7 3 of the total CDP).

New transformers were installed in the switchyard, power lines from the transformers were routed underground, and changes were made to reduce the time required to backfeed the station power transformers in LOOP accidents.

However, these backfits were not credited in the submittal, and it is anticipated that these backfits will lead to reduction in core damage frequency, although no calculations were performed to quantify these improvements.

Condensate Storage Tank (CST) Makeup New sources of CST makeup (fire water pumps and gravity feed from T-81) were identified, procedures were updated, and the operators were trained in the use of these new procedures. It is conjectured that these procedures wm

reduce the vulnerability of the Palisades plant to transients involving loss of feedwater sequences, although no calculations were performed to quantify the effect of these procedural changes upon the core damage frequency or on the containment analyses.

SIRWT Makeup 2.S The consequences of ISLOCA sequences and SGTR sequences can be mitigated by providing for SIRWT makeup. These two sequences are low probability, high risk sequences. It is stated in the submittal that methods for SIRWT makeup were identified. No calculations were performed to quantify the effect of these procedural changes upon the core damage frequency or on the containment analyses.

Responses to CPI Program Recommendations Orne of the recommendations of the CPI program pertaining to PWRs with large dry containments was that ithe utility should evaluate the IPE results for containment and equipment vulnerabilities to hydrogen combustion (local and global), and point out any need for procedural and/or hardware improvements.

The submittal documentation does not explicitly discuss the recommendations of the CPI program, but does treat the effect of hydrogen combustion through the basic events CACF AIL and CSPF AIL in the CET analyses, which treat the effect of accident progression on the performance of sprays and fan eot~lers. The licensee evaluation of the impact of detonations on containment and equipment failure is provided as a response to NRC questions. The methodology is based on NUREG/CR-5275, which classifies the reactivity of hydrogen-steam-air into a "mixture class", and the flame acceleration potential of the containment geometry into.a "geometry class". A "result class" is then assigned based on a matrix which is a function of the mixture and geometry classes. After a qualitative review of hydrogen-steam-air concentrations expected in the containment, and after noting that the containment does not have a geometric configuration favorable for a Deflagration-to-Detonation Transition (DDT) to occur, the licensee concluded that a detailed evaluation of the effect of DDT upon equipment performance was u1U1ecessary. In summary, all the CPI recommendations are addressed by the licensee, either in the submittal, or by the additional information provided as a part of the responses to NRC questions.

Palisades IPE Back-End Review 23 ERI/NRC 95-102

3.

CONTRACTOR OBSERVATIONS AND CONCLUSIONS The ERI assessment of the Step 1 review is that the Palisades IPE submittal contains substantial Back-End information regarding the severe accident vulnerability issues for Palisades.

The IPE analysts have performed a thorough and detailed probabilistic analysis of severe accident progression in the Palisades plant. A significant containment response difference between typical U.S.

PWRs with large dry containments and the Palisades plant is the prevalence of early debris relocation into the auxiliary building as a mode of containment failure.

This mode of containment failure entails significant releases of source terms, and results in a small warning time. The analysts have identified this as an important mode of containment failure, and subsequent to the release of the IPE submittal, the licensee performed a full-scope consequence analysis. Although the results of the consequence analysis seemed to indicate that the risk profile of the Palisades plant did not pose an undue threat to the safety and health of the public, the licensee continued to search for cost-:beneficial ways of reducing the likelihood of containment failure due to transport of the core debris to the sump, and ultimately to the auxiliary building. The licensee evaluation (i) considered ways to reduce the probability of core damage sequences that contribute to potential for core relocation; and (ii) considered ways to delay or prevent relocation of the core debris from the reactor cavity to the containment sump, and from the sump to the reactor building. The licensee conciuded that the only cost-beneficial modification was to plug the reactor cavity drain lines. In addition, a plate supported by a column-would be left underneath the filled drain hole to ensure that the plug could not be blown out by high pressure. With the cavity sump plugged in this manner, debris relocation will be considerably delayed.

It is stated by the licensee that the implementation of the proposed modification is expected to reduce the frequency of early containment failure to 1.2 x 10"6 per reactor year.

Specific strengths and weaknesses of the Palisades back-end study are summarized as follows:

Strengths of IPE

1.

The Back-End portion of the IPE supplies a substantial amount of information with regards to the subject areas identified in Generic Letter 88-20.

2.

For the most part, the separate models used in the Palisades IPE Back-End analysis are technically sound.

3.

The Palisades IPE treats all phenomena of importance in severe accident progression in accordance with Appendix I of the Generic Letter.

4.

The analyses performed to evaluate the basic event split fractions are extensive. This submittal develops detailed probabilistic distributions for various uncertain phenomena.

Containment failure probabilities were calculated by overlapping distributions for the containment loads and the containment capacities.

5.

The analyses performed to arrive at the containment loads are conservative. For example, for most high pressure sequences, with no cavity water, the submittal analyses show that DCH-induced containment loads will fail the cavity. Although it is not required that the IPE analyses be conservative, the submittal makes use of conservative estimates for containment loads, yet still the true containment vulnerabilities are not masked.

Palisades IPE Back-End Review 24 ERI/NRC 95-102

6.

Det_ailed MAAP results in the form of plots of key thermal hydraulic parameters, tables listing timings of key events, and tabular results of source terms are presented for all important accident sequences.

1.

The source term analysis in the Palisades IPE submittal has been performed with state-of-the-art tools, and sufficient source terms have been calculated. Large releases are calculated for the ISLOCA sequences, and for the early core debris relocation sequences.

8.

The submittal claims that the licensee has acquired new insights about the operational safety of the plant from the IPE, which led to minor modifications to operating procedures for SIRWT and CST refill. A plant modification involving the plugging of the cavity drain lines is planned for implementation in the 1997.refuelling outage.

In addition, the following commitments were made by the licensee in response to the NRC RAls [12]:

Sa.

Three actions to ensure the availability of the cavity flooding system (listed in Section 2.4.2 of this TER) have been planned to be completed prior to the end of the 1995 refuelling outage.

Sb.

Specific guidance to depressurize the PCS using the PORVs following core damage will be developed as a part of the severe accident management program.

All the weaknesses (and concerns) identified in the draft version of the TER have been addressed by the licensee responses [11 - 13].

Palisades IPE Back-End Review 25 ERI/NRC 95-102

4.

REFERENCES

1.

"Palisades Nuclear Station Individual Plant Examination Submittal Report," prepared by Consumers Power Company, (January 1993).

2.

"Severe Accident Risk: An Assessment of Five U.S. Nuclear Power Plants," NUREG-1150, (1990).

3.

Park, H., and Dhir, V.K., "Steady State Thermal Analysis of External Cooling of a PWR Vessel Lower Head," AICHE Symposium Series, No 283, Vol. 87, (1991).

4.

Park, H., and Dhir, V.K., "Effect of Outside Cooling on the Thermal Behavior of a Pressurized Water Reactor Vessel Lower Head," Submitted to Nuclear Technology.

5.

M. Khatib-Rahbar, R. Vijaykumar, I. K. Madni, E.G. Cazzoli, H.P. Isaac, and U. Schmocker, "Simulation of Severe Reactor Accidents: A Comparison of MELCOR and MAAP Computer Codes.., Paper Presented at the ANS Probabilistic Safety Assessment International Topical Meeting, Clearwater Beach, Florida, January 26-29 (1993).

6.

R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios, Supplemental Calculations," U. S. Nuclear Regulatory Commission, NUREG-4551, Vol. 6

7.

8.

9.

10.

11.

(August 1990).

R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios," U. S. Nuclear Regulatory Commission, NUREG-4551, Vol. 3 (July 1986).

E. Cazzoli et al., "Independent Verification of Radionuclide Release Calculations for Selected Accident Scenarios," U.S. Nuclear Regulatory Commission, NUREG-4629 (July 1986).

"Evaluation of Severe Accident Risks: Surry Unit 1 ", U. S. Nuclear Regulatory Commission, NUREG-4551, Vol. 3, Part 1, (June 1990).

Kenton, M. K., and Gabor, J. R., "Recommended Sensitivity Analyses for an Individual Plant Examination Using MAAP 3.0B," EPRI report (1988).

Individual Plant Examination (IPE) Additional Information, Consumers Power Company (July.

1994).

12.

Individual Plant Examination (IPE) Additional Information, Consumers Power Company (December 1994).

13.

Individual Plant Examination (IPE) Additional Information, Consumers Power Company (February 1994).

Palisades IPE Back-End Review 26 ERl/NRC 95-102

APPENDIX A IPE EVALUATION AND DATA

SUMMARY

SHEET PWR Back-End Facts Plant Name Palisades Containment Type Large dry containment Unique Containment FeaturfS No instrument tunnel connecting the reactor cavity to the containment Lower head located just one foot above the cavity floor Sump located directly below the cavity and connected to the cavity by drains Cavity flooding system drains water from sprays into the cavity The sump is connected to the recirculation pumps located in the auxiliary building Direct path from the cavity to the auxiliary building Dolomitic limestone used as concrete Unique Vessel Features No penetrations in the lower head No insulation on the lower vessel head Use of zircaloy for grid spacers Number* of Plant Damage States 18 Palisades IPE Back-End Review 27 ERI/NRC 95-102

9' Containment Failure Pressure Dry t 32 psig (mean)

Additional Radionuclide Transport and Retention Structures Not clear whether auxiliary building structures have been credited; magnitude of source term indicates that they have not been credited.

Conditional Probability That The Containment Is Not Isolated 0.005 Important Insights Including Unique Safety Features Insights No insight pertaining to the containment analyses, except the identification of low pressure accidents with melt relocation to the cavity as the dominant accident sequence Identified Safety Features Increased PORV capability Closed PORV block valves Cavity Flooding System Integral reactor vessel head (no penetrations)

Nitrogen backup systems Implemented (and Planned) Plant Improvements Operating procedures for SIRWT refill and CST refill were modified.

Reactor cavity drain lines will be plugged during the 1997 refuelling outage.

The cavity flooding system will be inspected during the 1995 refuelling outage to ensure availability.

Specific guidance to depressurize the PCS using the PORVs following core damage will be developed as a part of the severe accident management program."

C-Matrix See Table 3.6.1-1, page 3.6-4 of the IPE submittal (Table includes 18 PDSs and 65 CET end-states, and hence is too large to be included here)

Palisades IPE Back-End Review 28 ERI/NRC 95-102

ML18065A480

Contents

Text

SUMMARY

SUMMARY

SUMMARY

Navigation menu

ML18065A480

Text

SUMMARY

SUMMARY

SUMMARY

Navigation menu

Search