ML20005G363

Staff Evaluation of Idcor Individual Plant Evaluation Methodology for Pwrs

ML20005G363
Person / Time
Site:	Summer
Issue date:	01/12/1990
From:	NRC
To:
Shared Package
ML20005G359	List: ML20005G358 ML20005G363
References
NUDOCS 9001190047
Download: ML20005G363 (41)

Text

(W:

l9 -

s-sf.

^ff 4'

1

. ~ _.

ENCLOSURE.

1 1

U.S. NUCLEAR REGULATORY COMMISS10tl

^

WASHII:GTON, DC 20555 l.'

k.i_

STAf f EVALUATI0t. OF THE

i.

• IF0VSTRYDEGRADEDCORERUL&;AKING-(IDCOR) lilDIVICUAL PLAl.T EVALVAT10t liETHODOLOGY (IPEM) 1-FOR PRESSURIZED WATER REACTORS l

i i

i 9001190047 900112 PDR ADOCK 05000395 P'

PDC MM-r a.

(.

n x

+;

1 4

=-,1 co

..a

-=-

• ,r j

i 1

b J

t EVALUATION Of THE IDCOR IPEM FOR PWR TABLE OF CONTENTS PAGE l'.

lHTRODUCT10H........................................................

1 i

2.-

STAFF EVALUATION....................................................

5 2.1 Sy s t en ( F r on t-E nd ) A n a ly s i s....................................

5 2.1.1 System Modeling/ Fault Tree Analysis..................... 7 2.1.2 ~ Ar41ys is' of Dependent f ailur es..........................

9 2.1.3 Operator Actions and Human Reliability Analysis........

11 2.1.4 Plant f ar..iliar izat ion and Sear ch Exercises.............

12 2.1. 5. D a t a B a s e..............................................

13 2.1.E Applicability to Babcock and Wilcox and Combustion Engineering Plants.....................................

13 2.2 S cur ce 1 erm ( B a c k-E nd ) Ana ly s i s...............................

15 2.2.1 Containment Event Tree S tructure.......................

17 2.2.1 Appr oa ch a nd Objectives................................

19 2.2.3 Generic Issues..........................................

2.2.4 Systems /Phenomenology Integration.......................

2.3 Front-End to Back-End Interfaces............................... C$

1.4 S t u dy R e s u l t s.................................................

2 6 2.4.1 Interpretation of Results..............................

26 2.4.2 Documentation of Results............................... 27 2.4.3 Study Management....................................... 28 L

2.4.4 ' Application of Results................................. 29 3.

CCNCLUSIONS........................................................ 30 4

REFERENCES.........................................................

33 E.

L Staff's Evaluation of V-Sequence Checklist

-1 1.

l l

l

{;

. 94

• f

• i.-

r Evaluation of the Industry Degraded Rulemaking Group (IDCOR)

Individual Plant Evaluation Methodology (IPEM) for the Pressurized Water Reactors 1.

INTRODUCT10l!

On. August 8,1985, the U.S. Nuclear Regulatory Comission issued a policy e

statement on severe accidents (50 FR 32130). On the basis of the avsilable L

information at that time, the Comission concluded that existing plants pose no undue risk.to. the public, and the Comission sees no present basis for imediate 6ction on generic ruler..aking or other regulatory changes for these ' plants because of severe at.cident risk. Thus the Commission withdrew the advan p

notice'of propusec rulemaking on Severe 1.ccident Design Criteria published on

-October 2, 1980.

I However, the Commission emphasized that systematic examina-

.tions of existing plants are needed, s

1 For existi_ng_ nuclear power plants, the Comission specified the formulation of a

. systematic aprrooch to an examination of each plant now operating or under construction for possible vulnerabilities to severe accidents. These individual-plant examinations (IPEs) are intended to identify the plant-specific vulner-abilitti.s that contribute sigt.ificantly to the overall risk from severe accidents, i:RC and industry experience with plant-specific probabilistic risk assessrnents (FRAs) indicate that systematic examinations exposed relatively unique vulnerabilities to severe accidents. Experience also showed that the plants' unique risks could be reduced by low-cost improvements.

Through an initiative by the Industry Degraded Core Rulemaking Group (IDCOR),

two separate niethudolog45 were developed for evaluating generic applicability of the reference plant results to other individual plants.

IDCOR submitted the methodologies to provide a framework for performir.g the systematic examinations required by the severe accident policy statement. The methodologies, one for BWRs end one for PWRs, were structured to examine the

h

{

plant's design and operation:to ascertain if there are any vulnerabilities f rom ti.o st6ticpcint of scvere accidsr.t prevention or mitiption, lhe vulnerabilities to core damage are addressed in the system analysis or front-end portion of the IDCOR IPEM. The ability to mitigate the-consequences of_ a damaged core is examined in the source term analysis or back-end portion, s

In May 1986, IDCOR submitted to the NRC staff the first package of documents describing the methodologies.

The methodology, termed the Individual Plant Evaluation tiethodology (IPEM)_ was developed as part of 1DCOR Task 85.3,

" Generic ArplicaL111ty Report," and are documented in IDCOR Technical Report T85.3. The T85.3 report is composed of four volumes -- the Al and A2 reports covering the system analyses and source. term analyses for PWRs and the B1 and

.B reports covering analogous material for BWRs. Subsequent revisions to the methodsweresubmittedin' December 1986-(Refs.Ithrough5)andMarch1987 (Refs 6, 7, end 8).

A preliminary review of-the 1985 version of the IPEM was performed by the staff and its contractor, Brookhaven National Laboratory. A resulting set of comments regardirig the methodology was provided to IDCOR by a letter dated Septerter9,1980(Fef.9).

IDC00 responded tu these commerits by a letter datec December 10, 1986 (Ref. 10). The staff's evaluation was based on review of the Decertcr 10, 1986 responses to staff concerns; the revised T85.3 documents; comments received froir other parties, e.g., Sandia National Laboratories (Ref.11); IDCOR responses (Ref.12) provided independently to the ACRS; and cocumented test applic6tior.s of the IDCOR IPEN for seven plants (Refs. 13 through 19), in addition, the staff's evaluation reflects the insights obtained by the staff and its consultants through (1) meetings with IDCOR and utilities at four different plants for which test applications were performed and (F) participation by the staff and its consultants in a walk-through exercise at one pl6nt.

2

u F

O, I

.The staff h'as completed its review of the IDCOR-IPEMs. The results of the

~

staff's review are'provided.in two separate evaluation reports, one on the PWR

'IPER and the other on.the BWR IPEM. This report provides the staff's evaluation of the IDCOR PWR IPEM.

i As a result of.the staff's evaluation, a set of enhancements has been

-identified for the performance of an effective and useful IPE, including identifiu. tion of poteritial area of improvements as called for in the severe accident policy. These enhancements are summarized below and discussed in raore detail in the later part of the report.

1 L

A.

Front-End Enhancements (1) Only 6 small number of support systems end state were judged to be irr.purtant and included in the_1PEM. The staff recommends that most of the support systems traditionally used in PRAs in the analysis be included since potential plant-specific support systems end-state vulnerabilities car, be overlooked. A list of support systems recommended for inclusion in the IPEs is provided in Section 2.1.1.

(2)' Symmetry is assumed between support systems and front-line systems in the'IPEM. For asymetric cases this can lead to incomplete enc-states and over or uncer estiraation of accicent sequence frequencies. Therefore, symetries should not be credited unless the support system cunfiguration is confirmed by the IPE team to possess this property.

(3) Hist 11gnment of shared systems in multiple unit plants must be considered in the IPEM.

(4) Underlying causes of vulnerabilities among the screened sequences are not rigorously identified by the IPEM. Sequences must be further expanded to identify specific components, plant conditions - -

y, -

z.-

P.

p.,

-or_ behaviors, common cause failures, or human actions that dominate

' plant outliers. This expansion is also necessary to objectively identify any potential fixes.

'(5 ) Subtle dependencies among plant systems with regard to certain acciden't conditions are not adequately addressed. Development of a

.more detailed (Appendix C to NUREG/CR-2815) (Ref. 20) and

~

comprehensive dependency matrix (cr equivalent)'is required.

(6) -Treatment of: common cause f ailures in the IPEM is inadequ6te. Use of theLqualitative and quantitative methods detailed in

-hUREG/CR-4780(Ref.21)(orequivalent)isrequired.

(7) Use of sensitivity studies to determine the more vital assumptions is required.

e (8) The use of failure data from PSA Procedures Guide (NUREG/CR-2815)

(Ref.20)isrequired.

(9).Bettertreatmentofhumanrecoveryactionsisrequired.

NUREG/CR-4834 (Ref. 22) provides adequate guidance for such treatments.

(10) Certain. sequences of events make the front-end and back-end analyses dependent. This must be appropriately treated in the IPE.

B.

Back-End As a result of the staff review of the IDCOR IPEM back-end analysis, we concludt that it is unacceptable for performing the IPE since it does not account for uncertainties and precludes several phenomena an6 alternative issue outcomes recognized as plausible by the reactor safety community, t.ppendix 1 to the IFE generic letter provides guidance for evaluating containment performance.

l.

}

g3

.w,;

j s"

1.

STAFF EVALUATION 4

-In January 1985, IDCOR began the development of methodologies'for evaluating 5

tre generic applicability of their reference plant analyses and results to

.+

other individual pl6nts. The IDCOR'PWR IPEH systematically searches to identify those plants that are vulnerable to severe accidents and as such

'could pose an undue risk. Since no precedent exists for the regulatory-

~

l y

accePtetility of severe accident methods for consistency with the severe accioent policy, the IDCOR PWR IPEM was evaluated against the following items.

1.

The capability to discover severe accident _ vulr.erabilities and potential areas of improvement.

O.

.The degree to which the methods provide for a systematic examination of s

the' plant.

3.

Identification of the limitations of the scope and results.

4 The capability to assess the effects of proposed fixes for resolution of USI:A-45.

The results cf the staff's evaluation of the IDCOR PWR methodology is providec in four parts. These correspond to (1) the system (front-end) analysis, (2) the source term (back-end) analysis, (3) the front-end to back-end interfaces, and (4) the study results.

l'.1 System (Front-End) Analysis The IDCOR 1PEM makes direct use of past PRA experiences, it requires a small fraction of the resources required to perform a full-scope PRA, and it repre-sents an effective tool for PRA technology transfer, especially for those utilities with very limited er grith no PRA experience.

The IPEM features are:

1.

The IDCOR IPEH (with the staff's enhancements) is estimated by the staff to recuire a level-of-effort corunitment equivalent to Level-1 PRA. '

4 '

ni1 2 'l..',.,

-,g u

2.

The IDCOR:lPEM iny'olves the direct use of previous PRA experiences and

insights to sharpen the focus of the analytical effort and to aid in I

identifying plant' outlier features.

It takes advantage of system sirailarities among plants and provides guidance to allow for plant-t specific design and configurational and operational differences.to be incorporated 'into the. analysis.

[

.3..

Syst(.rs notebooks. include a Lsubstantial amount of PRA-type data (e.g.,

system success criteria and support system. dependencies).

4 The 1DCOR 1PEH takes advantage of insights derived from the past PRA

}

studies and their review, as well as deterministic safety evaluation.

It emphasizes what has been identified as risk dominating initiators and incorporates such events as interfacing system LOCAs and transient-incuced LOCAs. ' The IDCOR IPEM explicitly models support systems, dependent failures, impaired containment, and human factors.

L The ICC0F IPEt' systerr analysis methcd guides utility analycts through the

. investigation of most plant-features that previous PRAs and operating

. experiences have identified as specific vulnerabilities to severe accidents. It concentrates on those areas where system vulnerabilities,

' key operator actions, essential front-line system and support system functicrs have been. icentifitt in previous studies of similar plants to

.be important.

6.

The use of the support state concept and support system event tree l

separates the effect of the initiating events on support systems from local failure of the support systeir. This. simplifies the analyses necessary to generate, manipulate, and quantify plant specific accident sequence.

It also allows efficient perforrnance of sensitivity analysis and reevaluation uf those proposed modifications that will not change plant support.

L l-L.

-(.

-m

fe:

)

,-~

J J

-The IECOR IPEM relies heavily on the analyst's judgment. Enhancements to the

~ methodology for-the performance of an IPE are discussed below. These are

-divided intolthe following five areas:-(1) system modeling/ fault. tree analysis -(2) analysis of dcpendent failures, (3) operator actions and human reliab.ility analysis, (4) data b6se, and (5) applicability to Babcock & Wilcox and Combustion Engineering plants.

~ Utile the derth of the ICCOR IPEM an6 lyses does not provide cssurance th6t all risk significant features that are possibly unique to a plant will be

. captured in the IPE, we believe a majority of such risk significant features will be identified provided the IDC0k IPEN guidance, the reconnended level of' effort. 6no the staff's enhancements are implemented.

2.1.1 System Hoceling/Faul+ Tree Analysis The IDCOR IPEN uses'the concept of support states to separate the influence of

-iriitiating events from local faults of support systems. This concept n inin.izes the ' amount ci-cutset raar.ipulation necessary for the generetion and cuantification of accident sequences. While this approach is conceptually adequote for gener6 ting accident sequences, the analyst must' be careful to generate only indeper. cent and unique support states. The IDCOR IPEM has not provided adequate guidance for the creation of such unique support system eno-states. For. example:

1. -

Only some of the support systems that are prejudged to be critical to front-line systems are considered for inclusion into the support states.

Other' support systems can also be critical in certain plants.

Inclusion of mest of the suppcrt systen.s i> recommended. The following support systems have been shown to be important and as a minimum should be included in the analyses:

(a) electric power system (AC and DC), (b) ESF 6ctuation system, (c) instrument air system, (d) heating ventillation and air conditioning (HVAC) system, (e) service water system and (f) component cooling water system. However, the IPE team is encouraged to include other support systems where appropriate..

M a

w

' w, g

T.

In-order tu minimize the number of independent and unique support states, the.lDCOR IPEM takes advantage of. highly symetric support system configuration (i.e., when train 1 of support system (s) only supports train 1 cf. the systen.(s) being supported).

This way, the support states can be described at the support system level and not the train or segment i

level. However,. most of the Pi.'R plants exhibit a small degree of asymmetry in their design and ecnfiguration.. As a result, certain highly contributint support states cen be overlooked, which in turn impacts the

accident sequence evaluation and vulnerability determination. The asymmetry problem may also exist within a support system.

In this case the.asymnetric parts of a support system must be explicitly modeled in the support system event tree that is used to generate the support states. Livision of the support systems to train or segment levels ensures that til independent and unique' support states are calculated.

This division would obvicusly increase the number of support states, but incorporates more rigor into the IpE.

3.

The IDCOR 1 PEP, a.llows credit for support systen.s that can be shared by multiple units.

It is not clear from the guidance that misalignment of these shared systems will be adeouctely accounted for in the unique support stctes.

Possible misaligned configurations of support systems niust also be explicitly modeled and accounted for in the calculation of the support states (e.g., diesel generators that are shared between two units).

'4 There 'is sonie ambiguity in the guidance in the system analysis methodology regarding the separation of front-line systems and support systers.

For exergie, the sefeguard actuation is categorized as a support system (Table 2.2-7), yet it also appears as a top event in LOCA trees (Figures A.1-1, A.3-1, and A.4-1).

The IPE team should establish explicit and consistent criterit for treating top and basic events.

-G-

s$,

I

'gn d.

c;.

I,;.

T 3;,

The IDCOR PWR IPEM suggests the use of a modular fault tree concept.

I-The E

t fault trees are developed, or trees from a reference plant are modified, at

[

in'depencent segment or train levels in order to'make numerical calculations i,

single. The end result of the fault tree analysis is the evaluation of a point estiniate for the'. top event. When the fault tree numerical results are k,

combined with'the front-line event trees along with the support states.

L:

dominant accident sequences are generated and their frequencies are calcu-L l e ' o c'.

Therefort, the end robult is e frequency for each accident sequence.

One can examine the dominant sequences to conclude major contributing front-lua systems or support systerr.s (or vulnerabilities), but this examina-tion cannot reveal the basic source of such vulnerabilities.

In order to reveal the basic source of vulnerabilities, one must know the major contri-buting components. This would not only allow systematic identification of-basic contributing sources _ of vulnerabilities, but can aid in searching for potenti61 fixes. For the purpose of identification and objective evaluation of vulnerabilities, applicable dorr.inant accident sequences will need to be further expanded, through a Boolean expansion, to generate dominant i

.ccntribctirig compunents (e.g., specific plant components, human actions, common-cause failures, and system dependencies).

ince the ICCOR IPEH heavily relies on the reference plant results and analyst's judgment, the accident sequences generated through system modeling/

f 6 ult tree ani, lysis are approximate.

No provisiors for the performance of a formal sensitivity or importance calculation are made to highlight, and thus better. treat, sensitive or probabilistically important elements of the plant-specific accioent sequences. Use of sensitivity and/or importance analysis is l

requireo.

PSA Procedure Guide (huREG/CR-2815) (Ref. 20) discusses these L

methcci.

2.1.2 Ar,alysis of Dependent Failures One of the primary benefits of performing systematic examinations has been to identify dependencies within a system or between systems. While a detailed support state concept and system fault trees would incorporate a majority of these deper.dencies ir tv the IPEM model, subtle dependencies can still be over-

E' u

7.

I L-v.,

1 Icoksd. For ex6mple, one of the NUREC-1150 (Ref. 23) insights from the Sequoyah core damage sequences has been that use of sprays for containnent pressure suppression may rapidly deplete the RWST inventory and may, as a -

result, cause high-pressure injection failure if recirculation fails. Since lrost-of these dependencies are sequence dependent, they must be treated following the generation of accident sequences through a careful examination of each sequence. Support systems of U.S. nuclear plants vary widely from-plarr tc plant even in plants thct are of a similar class and have the san.e set of front-line systems.

Therefore, it is important to ensure a complete dependency analysis and to document the results in a scrutable form that would include'the failure mudes and timing.

The 10COR IPEM guidance for the treatment of common cause failures is not sufficiently rigorous to identify plant-specific vulnerabilities originating a

from common cause failure.

It is important to note that the source of a large portion of plant' vulnerabilities found in the past has been common cause 16ilures. Therefore, it is important to carry out a detailed and scrutable r..ethod of-screening accident sequences for potential contribution from comon cause failures.

In order to qualitatively incorporate more rigor into the analysis, one can expand the screened sequences using Boolean techniques and explicitly nicdel connon cause events in the relevant fault trees. Major contributing. plant vulnerabilities originating from connon cause failures must then be cardully examined so as to reveal possible root causes of such fLilures and determine likely fixes.

Use of one of several methods suggested in NUREG/CR-4780 (Ref. 21) (e.g., one of the parametric methods such as the beta factor) is recommended.

It is our view th6t ir tights on the relevance cf this type of dependent failure can be enhanced by using sensitivity analyses in conjunction with parametric models bnc that such studies should therefore be performed by utilities using the IDCOR IPEli. Guidance for performing the sensitivity studies is included in the PSA Procedures Guide (!!UREG/CR-2815, Section 6.4) (ref. 20)..

j 4

(;

~}

-l L}:

+

2.1.3_. Operator-Actions and Human Reliability Analysis 1

-Proper. treatment of recovery actions is necessary for identification of vulneratilities. In the case of sequence-dependent recovery actions, timing is recognized as the most important parameter on which errors of cognition-estimates are based. The IDCOR IPEM recognizes this importance but provides little guidance for-estimating the time interval available for recovery.

IDCKIPEM users should provide appropriate justification for their.~ estimates of errors of cognition. Sequences of events in which a recovery action will

/

c6use an adverse ettect if aeditional components fail have not been treated.

-Investigation of this. type of human recovery actions is very important when L

ider.tifying plant-related severe accident vulnerabilities.

In addition, in small LCCA. event trees, operator actions appear as event tree headings, f

Deper.cing on the_ reactor' design, there needs to be a specific guidance to treat operatui 6ctions either as basic events or as event tree headings.

For human reliability analysis (HRA) considerations, the PWR IDCOR IPEM refers L

to ar; cutdated version of !!UREC/CR-2815. The present version of flVREG/CR-2815 is.-Revision 1, dated August 1985.

The HRA section of NUREG/CR-2815, Rev. 1 (Section 4.3) is significtntly oifferent (updated, expanded, and enhanced with

- 10 HRA analytic methods) from its NUREG/CR-2815 predecessor and should be usec

-instead. Better treatment is given in NUREG/CR-4834.

Human error screening is addressed in NUREG/CR-2015, Rev.1, Section 6.3 (Ref.

20). The screening process describes how to determine the potential impurtance of each error to the core damage frequency. This involves a list of potential human errors together with screening values. Human errors that contribute significantly to core damage frequency ("important errors") are then studied further as part of the Human Performance subtask; errors that do not contribute significantly are deemed not worthy of further study. The list of errors and the output list of important errors should 'e supplied to the b

NRC by the IPE team along with a detailed statement of the criterion of impor tence. z

1 i

c.;,

Eesides the aforementioned screening process, another acceptable screening approach is described as the Systematic Human Action Reliability. Procedures (SHARP) (EPRl-NF_-3583) (Ref. 24) dated June 1984SHARP was developed to

+

provide a structured approach to the incorporation of human interactions into j

PRA. The SHARP screening techniques were formulated to identify and select only_ the most important/significant human interactions for further analysis.

The three SHARP techniques are qualitative judgmental screening, quantitative streening, nr.d quantitttive fine screening. These techniques are coarst discussed further in NP-3583, Section 2, which-includes a discussion of guidance in selecting a technique to eliminate from consideration human-

-interactions that are not significant to core damage frequency.

The IFE team should use the revised version of NUREG/CP-2815 in performing hun.an reliability analysis rather than the version referenced in the IDCOR systein er.alysis methodology. The team shuuld also determine whether a

~

recovery action can adversely affect mitig' ation of an accident in light of additional component failures. The team should treat the effect of such humar.

recover; Lctior, in the accident sequence quantification process.

j-L 2.1.4 Plant Familiarization and Search Exercises L

'f Plant familiarization and search exercises are tools of increasing importance fcr identifu.htion of system interactions, verification of as-built configurations, and validation of procedures as implemented by the plant operators. The IDCOR IPEM recormends approaches to the proper performance of

. visual inspections including (1) a mix of expertise for the walk-through teams, (2) defined inspection criteria for each hazard considered, and (3) a number of tables to dccument the team findings. Participation in part of a PWR walk-through led us to conclude that strict adherence to the methodology l

guidance is needed for a walk-through or a talk-through process. This process should be iterative in nature, starting with plant familiarization and evolving from this point to search for answers to questions raised during the enalytical effort. Timing, scope, and mix of expertise should be integrated intu the IPE analyses. We realize that specific guidance in this area can be difficult; however, SRP (Ref. 25) Appendix 7.B provides 6 general agenda that could be used for the development af a plant-specific agenda for the plant.

1 p

1 3

in I

a

-familiarization. _The;!PE team should give this process a prominence worthy of its11mportance, especially if the IDCOR IPEM scope is extended in the future to consider external events beyond internal floods.-

r2.1.5 Data Base The.lDCOR IPEM recommends-the-use of the Interim Reliability Evaluation Progren '(IEEP)-(!!UREC/CC-27tc) (Ref. 26) generic data base. However, some of the IPE: applications used-Zion or Oconee data es generic data. A unified ano up-to-date' generic data base would provide.a consistent and uniform basis for quantification. Updates of the data base included in the PSA Procedure Guide (M

• EG/CR-?F15, _ Appendix C) provides a better data base.

2.1.6 Applicability to Babcock and Wilcox and Combustion Engineering Plants The 10COR PWR IPEM was based primarily on a Westinghouse reactor design and is

' structured to assess the applicability of the IDCOR reference plant results to other PWRs. However, various levels of addition 61 information and modifi-cations.ere expecteo in an application to Babcock and Wilcox (B&W) and Ccmbustion Engineering (C-E) plants as demonstrated by the test application performed for the Oconee plant (BEM reactor design) using an earlier version of the IDCOR IPEM. For example, B&W plants show a unique response to those anticipated transients involving overcooling and undercooling events as well as small LOCAs. This is mainly due to the small heat sink represented by the

- once-through ste6n. generator, which is a unique design feature of the B&W plants. Accordingly, the operator actions and available times for recovery are significantly limited. These design variations can influence the icentificatich of plant-specific initiators, modeling of accident sequences, system analysis, and data quantification. Therefore, the IPE team should compare the f eatures that are specific to the B&W or C-E plant with those of the Westinghouse reference plant to determine the significance of the features on the. fault tree matching process. A list of the potential vulnerabilities previously identified by PRAs for B&W end C-E plants should also be considered i

h u%,

- 4..

K

~

- by the IPE team. For example, in station blackout sequences of loss of cf f sitt:

ter and the resultins 1 cts of the er..e gency feedwater motor-driven pumps, if the turbine driven auxiliary feedwnter system pump fails, core damage will occur soner for B&W plants. This.is due.to the smaller B&W plant inventory which.results;in's short time available to the operator to recover offsite power prior to onset of fuel failure.

In'non-B&W plants, because of

1arger inventory than B&W plants, longer time' is available for the operator to recover offsite power.. If recovery of-offsite power occurs within about'two

- hours, the motor-driven auxiliary feed purrp can then keep non B&W-plant cooled.

1 Some-specificLexamples at each stage of the IPEM follow:

. 1.

Initiating Event identification. The integrated control system (ICS) is a control system unique to a B&W plant.

It provides fast control

.of ste6ta flow and pressure, feedwater flow, and reactor power by 1 manipulating various control devices. Failures in the ICS or in the ICS power supplies are possible candidates for-B&W plant-specific initiating Also, failures it, the ICS during plant transients r.ay cause events.

plant operators to misdiagnose the symptoms so that the human error rate might'be high.

2.

' System Analysis and Event Tree Development.

B&W, C-E and Westinghouse plants 6te quite different in design and operation, which makes the respective systems analysis and event tree different. For example, the large LCCA event tree given in Figure A.1-1 of the PWR system analysis methodology does nut necessar'lly represent the accident progression in B&W or C-E plants. High-pressure injection may not celiver enough coolir.g er makeup of reactor coolant system inventory if the same success criterion as that used for small LOCA is used.

Separate event trees and success criteri6 for the different reactor designs appear to be needed.

Some B&W plants use the low-pressure recirculation pumps to solve NPSH problems of high-pressure recirculation pumps.

Therefore, the loss of low-pressure injection pumps results in the loss of the high-pressure recirculation function. Some C-E plants, unlike Westinghouse and B&W plants use a high-pressure system whose pumps can perform both i

+:

p i

7

• 2 q

(1 s a

L

.high' pressure. injection ar.d high-pressure recirculation functions.

Duririg'the injection phase, the system takes suction from the refueling borateo water tank, while during the recirculation phase' the system will

'be realigned to the containment surap.. Therefore, the JPE team should provide explicit success criteria for each B&W or C-E plant.

O.2 Source Term (Back-End) Analysis v

IDCOR stated. that the purpose of the. lDCOR IPEM source term analyses is:

i

't...the purpose is to determine if the potential for fission product retentior, ir, a-given plant is comparable to or better than that determined for the most sic.ilar IDCOE reference plant.

For this reason the r

simplified source term methodology is directed toward estimating the s

i environraental releases for the dominant severe accident conditions and determining whether there is a difference in plant design which would substantially increase the releases over those of the reference plant."

On this basis,-IDCOR contends that it is " appropriate and sufficient" that the

~

methodulogy focus on station blackout sequences. Such sequences involve loss

-of all containtrient heat removal capability and a-dried-out (water-depleted) debris bed configuration. They lead to containment failure, and a great deal of the propused-lpEM quantification deals with the approximate estimation of the resulting releases to the environment.

l

~ Briefly summarized, the PWR source term methodology consists of a simplified containment tvent tree (CET) and an approach for assigning a source term to each CET end stete. Source terms are assigried in the methodology as indicated in Table 1..

n

. = -

• ~; :.

t

3.

:* :.

L i

i,. f s>

Table.1 - PWR CET.and-Source Term Releases IS THE DEBRIS.

COVERED AND I

IS C0ftTAINMENT:

ISL C0llTAIM1ENT IS CONTAINMENT HEAT REMOVAL END STATE / RELEASE t;0T BYPASSED.

ISOL ATED?-

AVAILABLE7 QUANTIFICATION Yes Yes Yes

1. Insignificant Yes Yes flo

2. Determine using calculation 61 scheme provided.

s Yes No Yes

3. Much less then r

PWR-2, e.g...

noble gases plus S% volatiles

~ Yes No 1:o

4. Perform detailed analysis' if required by probability tio

5. Assess using checklist provided h

a.

4 1

'g; i

r c

The-CET is entered once for each plant damage state identified in the front-end analysis, in applying the CET within the' context of the IPEM, rather than quantifying-each branch of the CET, the analyst assigns an s

affirmLtive-or negative response to the CET top event questions based on information developed as' par _t of the front-end analysis. Only sequences with l releases corresponding to CET end-states 4 and 5 are flagged in the methodology for.further investigetion.

In addition, the methodology

-ider.tifies' ~ seveisi plarit features that niay invalidate the simplified approach for. estimating source terms and require analysis outside the methodology. For PWRs with ice condenser. containments, the source terms are directly assigned g-for CET end-state 2-based on the results of previous IDCOR calculations.

t tin.the sections that follow, the results of the staff's evaluation'of the-IDCOR PWR source _ term methodology are provided.

it should be noted that the

.a documented test applications cf the IDCOR IPEM played only a minor role in A

this evaluation since the test applications either did not involve the use of L

all portions-of the source term methodology or were not adequately documented, j

_ E.2.1-Containment Event Tree Structure The PWR source term methocology consists of a simplified Cf1 with three top event questions. These address (1) whether the containment is bypassed by the N

initiating. event, (E) whether containn,ent isolation has succeeded, and (3) whether, the debris bed in the reactor cavity is covered and containment he61 reniovalmis available. The simplicity of the CET derives in part from the fact

- that it was developed based or, insights obtained using the Modular Accident Analysis Program (MAAP).

M6ny of the assumptions in the MAAP code received some staff review over the past several years as part of the NRC/IDCOR Technical Exchange meetings. Key differences between many of the NRC and the IDCOR irodels and assumptions were identified during the meetir.gs and were consclicated into 18 NRC/IDCOR Technical Issues.

On the basis of IDCOR s

ana' lyses and modeling changes described in IDCOR Program Technical Report 85.2, (Ref. 27), the issues were disposed of by the NRC either (1) by determining that the differences had little effect on the results or (2) by developing interim -

w.;

q v....

1 positions that conservatively' treated the phenomena.

In References 28, 29,

.and L30, the staff positions on these phenomenological issues are presented.

The: staff finds that the models and assumptions in MAAP and the lack of treatment of issue uncertainties in the code preclude several phenomena and 2

alternative-issue outcomes recognized as plausible by the reactor safety

- community and, therefore, the sorce term methodology is not adequate for meeting the IPE objectives in Section 2.2.2.

While the issues addressed by the top event questions in the CET are indeed m

risk import 6nt, O

the-lack of treatment in the CET of several other aspects of severe accident releases that have generally been considered in most PRAs and

.fcund to be important is considered by the staff to be a major limitation of

. the-source term methodology.

Foremost, the CET oces not consider the potential for containment failure due to certain ex-vessel phenomena, namely, steam spike (resulting from repid core quench), direct containment heating, and hydrogen combustion.- - As a result, the CET does not recognire the potential for;early. containment failures; except for a limited number of situations that the methodology'specities as requiring additionel analyses, all containment failures-are treated as late failures. Also, in formulating the CET, an optimistic characterization of certain phenomena or issue outcomes was choser, 4

without adequate basis.

In broad terms, the staff finds the 10COR source term methodology to be unacceptable. The staff's concerns may be summarized as follows:

1.

The IDCOR source term IPEtt is too narrowly 1ocused, 2.

The 1DCOR source term IPEM does not adequately reflect remaining generic issues and associated uncertainties, and 3.

Containrent systers performance is not adequately integrated with containment phenomenology.

Details on these areas of concern are given in the following sections.

^

9,

?: y ;

F e

2;2.2 Approach and Objectives The staff recugnizes:that the 10COR IPEM needs to provide a mechanism for seeking-out~ plant-specific differences that would substantially increase the

.i

-releases'over those estimated for the dominant severe accidents in t reference plant (i.e.,'in IDCOR's terminology, identifying " outliers").

But'it.is the staff's opinion that the IPE objectives should also include:

1 i

1.

Appreciation lof severe accident behavior, and Recvgnition of the rule of the niitigation systems and accident m6nagenien.'

It is-the st6ff's belief that such objectives can be attairied to-a reasonable

.ccgree with relatively modest coneiitn.ents of effort, by the utilities, and that the IPE provides a unique opportunity for doing so. This conclusion is based on~ existing detailed calculations which:

-1.

Have alreacy mapped a_rather broad range of containment failure timing ano containment atmosphere conditions into a set of release categories and consequences,

).

Have demonstrated, that containment loads depend on a few key phenomeno-

. logical ~ behaviors, and 3.

Have concluded that the system responses and human actions are of decisive iniportance.

Frota these observations, the following deductions are provided for the IPE E

- overall 6pproach.

' 1.-

The approach could beneficially focus on containment failure rechanisms and timing. Releases should be based on corresponding release categories and associated detailed quantification from reference plant analyses.

2.

' All classes of sequences with significant probability (front-end results) should be considered.

4.... w.,. m, u a i

".s

. : -~

,v..

?.

System / human response should be integrated probabilistically with phenomenulogical aspects. into simplified but realistic containment event trees. _ Allowance should be made for recovery or other accident management procedures (particul6tly for long-term respons'es).

i On this basis, the back-end analysis also emerges as system oriented. The thrust of the suggestion here is that the source term quantification should be judiciously integtated into the containment phenomenology to 'acdress containment response as~ well as failure modes and timing. The fundamental premise is that_ such an enhanced scope would involve the utility to en crpruprim Itvel necesskry to undcrstand the possible range of severe accident behavior in their plants and thus be better prepared to mitigate severe accident progression and consequences.

2.2.3 Generic issues

. Starting with the ZIP study (Zion / Indian Point PRAs and associated NRC studies, HUREG-0850) (Ref. 31), our understanding of severe accident phenomena has-developed rapidly in the past few years. The Containment Loads Working Group (CLKf,? effort (NUREG-1079) (Ref. 32), the IDCOR program, and the Severe Accident f,1sk Peorch Program (SARP) have been key contributors to this development.

)itb this improved understanding came a gradual convergence of the NRC and industry's views in many areas of quantifying severe accident phenomena and associated containment loadings or source terms.

Still, a number of issues are difficult to quantify, and there is considerable uncertainty in the results. In a recent series of NRC-IDCOR meetings, these

' issues v.ere deelt with in depth and the nature of the difficulties was distilled and_ clarified (Refs. 28, 29, and 30). The NUREG-1150 (Ref. 23) results, when-considered against the IDCOR reference plan analyses (including their treatment of uncertainties), provide a further illustration of the origin cf these difficulties and their risk implications. Clearly, a number of risk-significant phenomenological aspects of severe accident behavior have so far defied reliable quantification.

t s

g c.

-n y,

.[

.+

s

(

The vast majority of these issues is associated with the so-called high-L

-pressure sequences. Such sequences involve core meltdown and vessel meltthrough from a high primary system pressure condition. Station blackout provides a typical example.

. As a consequence of the high primary system pressure, the in-vessel portion of

'the accident involves strong natural circulation flows (Ref. 33) between the

' core,= the uppe inttrr.als, and steam generators. The natural circulation flows provide energy reoistribution of such magnitude that it may induce

+

_ primary boundary failure before core slump. The concern is that such failure

'could occur in the steam generator ' tubes yielding containment bypass. The fission product transport irivolves eugmenting the velocity of many of the less vol'atile radionuclides (U0, Ba0, Mo). in the presence of high-pressure steam.

2 Their transport to other parts of the system (including ste6m generator tubes) would: result in additional heat load and hertce enhanced failure potential.

On the other h6nd, gas-phase mass-transport processes at high pressure are found to sharply limit the release of the more volatile fission products (Cs I, and.

Te), which would then enhance the source term following blowdown.

None of these issues are addressed in the IDCOR IPEM.

For-the ex-vessel portion of the sequences, melt release at high pressure implies high-velocity steam flows in the reactor cavity and the potential for large-scale melt dispersal throughout the containmerit volume.

Such dispersal could lead to dirtet heating of the containment atmosphere and associated pressurization.

Clearly, the extent of dispersal would be geometry dependent, but the appropriate manner to quantify such effects is not clear at this time.

Furthermore, such a sequence would also give rise to highly dynamic hydrogen release (fror.. that already released during the core heatup/ slumping phases and that released during the blowdown / dispersal process) and mixing phenomena.

Predicting the poteritial for the formation of combustible or detonable raixtures or assessing igniter performance is inherently more uncertaire under such conditions. Again, containment geometry could play a significant role

- E1 -

r-4 i

y.'.i

?

.y.

em here, but:st this time this role remains unspecified. An attempt to address the dispersal _ issue (in-terms of entrainment and deentrainment) was made in

-the 1DCOR IPEM.

The staff and its consultant reviewed the IDCOR screening.

criteria for direct containment heating and identified several areas where the proposed. approach does not provide adequate basis and, therefore, is not acceprable.

1 To surcarize, it is the staff's view that, although entrainment and deentrainment can be. relegated to some threshold between inertia and buoyancy f orcesL(i.e., the Kutateltcze number), the use of the existing 10COR threshold is~ problematic and further confused by the choice of vessel failure area, c6vity gas temperature, possible degassing and splashing effects, and v

predominar.t particle sizes.

In particular, for cases where the cavity is strongly 'overoriven (i.e., Kutateladze number being much higher than the

~

i entrainment threshold) particle sizes could be well below the capillary length, which could affect the deentrainment behavior in the steam generator compartment in yet unknown ways. It would therefore appear difficult to reliably scrt out at this time the geometric features of importance and their quantit6tive effect on dispersal.

Itiis.the staff's view that the CET failure to account for the potential for p

early containment failure due to ex-vessel phenomena, including steam spike, direct containment heating, hydrogen burn, and the interaction of core debris with sttel liner / containment, is unacceptable.

It is the staff's position that a ' low containment failure probability should not be assumed without convincing evidence.

l' A recent independent review by an NRC panel of experts provided an addition 61

[

perspective on these issues and made recomendations for their resolution J

(Ref. 34), narrely, "if direct containment heating or containment bypass through steam gerierator tube failure contribute importantly to risk, this may indicate a need for a hardware modification or a procedural measure to ensure depressurization before primary system failure. An early study of relative merits of the possibilities available would be valuable." -

Ey contrast, e low-pressure scenario presents ftw remaining areas of uncertainty.

They relate to the behavior of deep molten corium pools, coincident steam spike and hydrogen burn, and the long-term behavior of hydrogen (and other combustibles) resulting from deinerting by steam condensing on structures, by the late operation of spray, or by the containment atmosphere coolers. The concerns about oeep coriur pools arose from experiments with top-flooded melts that exhibited crust formation and long-term isolation of the melt from the water coolar1. Such uncoolable configurations woule yield contiruing concrett attack and a containment loading behavior significantly different from that of coolable ones. The IDCOR 1PEM assumes that coolability is equivalent to the presence of water on top of the corium melt. The staf f views this as an area of uncertainty ind is conducting research to reduce this uncertainty.

It is entirely possible that beds below a certain cepth (heat loading) will eventually be shown to be coolable, in which case cavity floor area would

-a beccme the decisive f actor in the IPE.

It should also be mentioned, however, that gravity spreading to 611 available floor area becomes increasingly froblematic as the m69nitude of the 6rea increases.

This is because of heat ic>ses (and 6ssociatec ccriura raelt sclidification) and pctsibly a slurry-like corium state at vessel nieltthrough.

With regard to the behavior of hydrogen in the containment atmosphere, Appendix 0 to the final version of the IDCOR PWR source term methodology (Ref. B) includes a conputation scheme for estimating the conteinment loading associated with postulated global deflagration of an amount of hydrogen corresponding to oxidation of 751 of the claoding.

The methodology, in Appendices A and 0, states that if tne resulting peak pressure (initial pressure plus pressure rise) exceeds twice the design pressure, a detailed assessment of the containmer.t response should be performed.

In this regard, the staff's concerns are related to the quantities of combustible gases released to the containment from reactor vessel structural materials, local inerting and de-inerting as well as hydrogen mixing and

- E3 -

-+

~

transport.- For exanple, in large dry containments, combustible concentrations builo very slowly and only if continuing concrete attack is postulated.

Because_ of-the large volume and flow release rates, detonable compositions do.

_ not _ develop unless significant spatial concentration gradients exist.

On one yY&

hand, _a containn.ent atmosphere under such conditions would exhibit strong natural circulation currents that would tend to even out any tendency to stratify.

However,'on the other hand, a condensation-driven stratification (P.ef 30) rrechanist stould limit the circul6 tion patterns to compartmentalizte f

' structures thus effectively reducing the volume available for mixing.

For the ice condenser, the IDCOR approach is based on the premise that hydrogen frorre coriuni-concrete interactions will ignite in the high-temperature cavity atraosphere and burn as it is being produced. Local inerting and air availability (natural circulation loops) on the other hand could alter this conclusiori, as c r ecent study (Ref. 36) seems to indicate.

It is the staff's current judgment that combustible gas behavior should be cylicitl3 ccrsidered in the IPEl' cot.tainment event trees.

It is necesse )

that the IPE team include consideration of gaseous pathways between the cavity cro : upper containment volume to confirm adequate communication to promote natural circulation and recornbination of combustible gases in the reactor cavity.

2.2.4 Systems /Phenomenology Integration System performance may be integrated into the severe accident phenomenology with help of containment event trees (CETs). On the basis of the rationale previced in Section 2.2.2, we should address all prominent classes of severe accident sequences (as determined from the front-end analysis) and should

- E4 -

l i

I eccount for urcertainties. Most importantly, these trees must be mech 6 histic and allow'for accident management actions by providing a realistic road map I

under all physic 611y meaningful outcomes.

t In sursnary, the staff has reviewed the proposed use of the CET in the IDCOR IPEM, and the effect thtt this approach would have on the ability of the 10COR IFEM to identify outlier plant features. We conclude that the use of the CET I

in a qublitative rather than quantitative manner will not provide utilities i

the informatior. end perspective necessary to make a judgment regarding the expected level of containment performance for severe accidents, and the f requer.:;> cf leric 161(ases ti.C, therefore, is unacceptable.

Te produce the information considered necessary by the staff, the CET needs to be ausnichtte as recorr.raenced in the previous stctions and then quantified as part of each IPE.

The branch point probabilities should be propagated through the CET in such a way that estimates of the likelihood of early containment failure and large releases from containment are developed as part of the IPE.

The staff therrfore provicied, it Appendix 1 to the IPE generic letter, guidance aimed at providing a quantitative assessment of source term teleases and the relativt frequency of the various types of releases to be used in performing IPEs.

1 2.3 Front-Er.d to Back-End Interfaces The role of interfaces between the front end and back end is particularly important fron two perspectives. First, the cendition of the system analysis directly influences the capability of the plant to cope with the damaged core.

Second, the conditiors of some systems designed to preserve containment integrity and control the release of radionuclides also can influence the likelihood of the core beconiing damaged. Thus, because the influences can flow in both directions between the system analysis (front end) and the source term an61ysis (back end), particular attention should be given by the IPE team to these interfaces.

1 ---

1

4 With regard to a staff concern related to front-end and back end interf aces 6td the potential for inconsistencies in system availability assumptions, IDCOR has proposec the addition of a sigh off sheet to the methodology that would identify, by sequence, (1) the sequence frequency, (2) whether the containment is bypassed, (3) whether the containment is isolated, (4) the containment system and reactor system availability, and (5) the approximate sourse term. This sheet would be signed by both the systems analyst and the source term ar.alyst, which would provide added assurance that the availability of key systems is treated consistently in the front end and tack-end analyses.

In adcition, IDCOR has proposed the addition of an operator interview form to the source term methodology aimed at ensuring that assumed l

operator actions are given adequate consideratior..

The staff has reviewed the IDC0k proposal 6nd believes that use of the sign-off sheet and operator interview form, it' incorporated into the pWR methodology, will substantially istprovc treatmeret of the interfaces. The use of these forms, however, does not replace human reliability analyses for sequences in which operator recovery actions are a key ingredient.

The forms also do not address the twtstion cf cission tiras, it.ventory depletion, and cual usage (e.g., the CST supplies water for vessel injection and containment sprays. Early injection ney deplete the water so that it is not available for sprays atd vice versa).

It is necessary that n.ission tirnes, inventory depletion, and multiple usage also be carried through the interfaces.

T.4 Study Fesults Adoitional staff views on the IDCOR IpEM and its use are provided in this section. These can be divided into four areas:

(1)interpretationofresults, (E) doeurtentatiori of results. (3) study stanagen,ent, and (4) application of results.

2.4.1 Interpretation of Results The IDCOR 1pEI) guicance for quantification is not followed up by further guidance about how to systematically review these results for the purpose of derivir.g it. sights obout the plant design and operations.

Instead, it is left

- I6 -

4 g, g.

..,4 p

l l

to the analyst to evaluate the results and identify the root causes behind dominant sequences or f actors driving an outlier feature. Reliance on analyst judgment, despite its drawbacks, may have its best potential during the IPE or right after it has been completec. Following the completion of an IPE, the insights drawn from the IPE and the associated analytical details should be fully documented and retained by the utility in easily accessible form.

Some of the IDCOR IPEM test applications, e.g., for Sequoyah, appear tc iticlude a reasonable effort of analysis of IPE results supplemented with in.portance an61yses. Systems, comporients, operator actions, and support states with major cont.'ibutions to dominant sequence frequencies were identified as part of this analysis.

IDCOR IPLE users should recognize characterization of the dominant accicent sequences as an integral part of the analyses.

2.4.2 Documentation of RtsL1th The importance of the documentation requirements within the IDCOR IPEM is it.tf old.

Firt,t, the i.ecessary docunentttion m'st be av6tleble to the IPE team u

in order to provide meaningful conclusions at the end of its study. Second, tt.e documentation needs to be suf ficiently orper.ized to enable an independent review. Tu achieve these goals, three basic criteria must be satisfied:

1.

Explicit documentatior, requirements should be listed to ensure that sufficient information will be gathered to adequately perform the IPE, 2.

Sufficient quality assurance nicasures should be provided to ensure the accuracy and retention of the documentation packages (notebooks), and 3.

Sufficient study mar;agement should follow the above actions to ensure that the dccumentatior, is indeed gathered and handled as intended by the JPEH.

The IPF should bt documented to provide the basis for the findings in a trace-tble manner. This is viewed as being de61t with most efficiently by a two-tiered 6pricach. The first tier shculd t,e the results of the ex6 min 6 tion that

-G-

rill be reported to and reviewed by the t:PC. The second tier is the documentetton that must be retait ed by the utility. The reporting requirement is specifiec in the IPE generic letter and the review document to be issued sher tly.

If the IDCOR IFEM was modified by the utility during an IPE, the utility shoulo also describe and provide the basis for the modifications. The description shoulo clearly identify the differences, the effects on the results, and the t' asis for the selection of the different method.

C.4.3 Study l'anagn et.t insights obtainec from previous PRAs involve not only technical matters but 61so lessons les.rned in both the man 69enient and performance of the PRA itself and the' scheduling and execution of technical audits. The IDCOR IPEM reports s

contain numerous references to the need for PRA project management and technical audits. However, the IDCOR IPEM does not specifically call for independent review and does not provide guidance on formal management. Study nar.epement is considered by the staff to be essential since the quality and comprehensinness' of the results coniing out of the IDCOR IPEM will depend simultaneously cn the rigor with which the utility applies the IDCOR IPEli and the utility commitment to the objectives of the IPE.

The following actions are recommended by the staff as part of the Study Management:

3.

Each utility should formally include an independent review to ensute the accuracy of the documentation packages and to validate both the IPE process and its results.

2.

Experienced PRA analysts and utility engineers who are f amiliar with the details of the design, controls, procedures, and system configurations should be involved in the analysis as well as in the technical reviews.

- ib -

h I

J Ir avvition the following views are offered:

I 1.

A 2 to 3 staff-year effort was recommended by IDCOR as an appropriate level for performing an IPE. The staff has observed that most of the j

utilities applying the IDCOR IPEM performed their IPEM tests in about 2 to 3 staff. years, in most cases, however the utilities used their i

existing PRA studies as a source of information.

Thus these applications did not involve the use of all portions of the IDCOR IPEM and are considered by the staff to be incomplete tests of the IDCOR IPEM. Also, for those utilities with B&W or C-E plants, modification of the sample fault tites, event trees, and 6ttident initiators provided in the system l

analysis methodology will require additional effort and a correspondingly higher level of PRA expertise. We estimate that a 4 to 5 staff-year hvel of effort taay be needed for the analysis, documentation, and independent technical reviews before submittal to the fRC. Additional staff level of effort is necessary to upgrade the IDCOR IPEN to Level 1 PRA so that it could achieve one of the goals set forth in the IPE generic letter, namely, establishment of an accident management plan.

2.

It is the staff's view that, in such a complex undertaking as an IPE study, computer enalysis is essential, especially in evaluating logic trees with a large number of gates or in cases where logic reduction is required to generate minimal cutset information.

Thus, unless the subject plant is nearly identical to the reference plant, the staf f does not believe that 6pplication of the IDCOR IPEM is feasible without computer analysis.

2.4.4 Application of Results An important aspect of severe accident prevention and mitigation is human involverrent. E6rly recognition of events, availability of procedures specifying corrective actions, and well-trained operators and emergency teams can have a major influence on the course of events in case of a severe a ccider.t. An accident management strategy that has the capability to ~

o:.

eccomplish thtse functions for each dominant accident secuence despite the f

cegradec state of the plant should be developed. Additional discussion is proviced in the IPE generic letter.

i i

l

[

I 3

I l-p.

l i

i J

3.

CONCL US10!is I

The IDCOR IPEM niokes direct use of past PRA analyses and operating experiences et a fraction of the resources normally needed to perform a full-scope PRA.

l The method provides a readily usable tool for the transfer of PRA technology to

{

utilities with little experience in integrated probabilistic assessnents.

t The IDCOR IPEM is not an exact algorithm and the quality and comprehensiveness of thk rescits coming' cut of the IDC0F, JPEll will dcpend on the rigor with which the utility applies the IDCOR 1PEM and on the utility's commitment to the intent of the IPE.

l The 1DCCR systera enalysis methodology includes the preparation of System Notebooks that include a substantial amount of PRA-type information (includirig i

system success criteri6 ar.d support system dependencies) that has been useful i

in probabilistic safety assessir,ents. The IDCOR IPEN particularly emphasizes the systematic examination of support systems since past experience has underscored the importance 'of the support functions.

The staff evaluated the 10COR IPEM for use only in the performance of an IPE.

Subject to the incorporation of the enhancerrents discussed in Sections 2.1 ar.c F.4 of this report, the IDCOR IPEM is considered to be adequati: for the

[

perforniance of an IPE. The specific items identified in this evaluation h

clarify how the IbCOR IPEll should be enhanced. The potential exists for an IPE team to develop irrprovements beyond those given in this evaluation.

1.lternative enhancements may be usec by the IPE teams provided their bases are

}

fully described in the 1PE report. The staff-identified enhancements are

[

summarized in three groups: general, system analyses, and source term tr.alyses.

u l

l

- 31

.r 3.1 General Considering the importance of the IPE and the flexibility in PRA analyses, utilities using the IDCOR IPEM should establish an independent review of the

-technical accuracy of the examination and the validity of the results.

The validation process will aid in ensuring that the utility in its primary safety role will assimilate the insights gained from the performance of the IPE.

The documented test applications of the IDCOR IPEM used earlier versions of the methodology. The methodology was subsequently revised without a repetition of the test applications. For example, one important revision concerned the performance of the visual inspections.

The revisions were acceptt.ble although the staff has not had the opportunity to observe a test applicaticn involving visual inspections that rigorously adhered to the methodology revisiu..

In performing the 1FLs, each IPE team shoulo rigorously adhere to the guidance provided in the revised methodology and incorporate the enhancenients called for by the staff in Sections 2.1 and 2.4 of this report.

Utilities using the IDCOR IPEM should fully document and retain the insights crawr. frota the IPE and their associated analytical details. The insights should be suppurted by appropriate evaluation of the results by importance L

rankings and sensitivity studies as described in Section 6.4 of NUREG/CR-2815, the PSA Procedures Guide (ref. 20). The IPE results should be documented as discussed in Section 2.4.2.

3.2 System Analyses Utilities using the 1DCOR IPEt' should be familiar with the staff added guidance and enhancements in Sections 2.1 and 2.4 along with the supplemental guidance provided on the treatment of common cause failures in Section 6 of the llRC Probabilistic Safety Assessment Procedures Guide (l:UREG/CR-1015) and Sections 3, 5, and 6 of the PRA Procedures Guide (NUREG/CR-2300) (Ref. 37).

Utilities using the IDCOR IPEll should clearly justify their estimates of the tirne interv615 available for each recovery action credited in the shalysis..

.. _. _ =.

e i

>s

?.3 Source Term Analyses 6

With regare to the adequacy of the IDCOR source term methodology for use in i

performing IPEs, we believe that the usefulness of the sethodology is limited by its stated objectives as well as in its particulars and is unacceptable.

I Regarding the objectives, the staff finds the IDCOR IPEM unnecessarily narrow in 1iocus.

It is suggested that the IPE be directed toward the more meaningful goals of developing reelistic risk profiles and accident management schemes on a plant-specific basis. To achieve such ends, it would be necessary that each ut'.'ity develop its owr, L,6>is for uncerst6nding severe accident behavior in its plant (in particular, integrating system / human aspects with the accident phenomerology). This, in turn, requires a quantitative approach to containirent event trees and 6 creative attitude in reflecting on them.

Regarding the particular technical details, the staff finds the JDCOR IPEM position in several key phenomenological issues affecting the high-pressure scenario unacceptable. As a result of the staff's evaluation, we conclude that the ILCOP source term methodology is unacceptable.

It is the staff's judgment that the tools are available for proceeding with the IPE. Appendix 1 tu the IPE generic letter provides the utility with guidance to proceed with the evaluation of containment performance despite the phenomenological uncertainties. ~

e i

4

.c4 y

0 l

l

,e 4

REFERENCES 1.

Craf t IDCOR Program Report, Technical Report 85.3-A1, "PWR Accident Sequence. Individual Plant Evaluation Methodology," Rev. 3, December 1986.

l 2.

IDC0k Program Report, Techt.ical Report FAl/85 58, " Approximate

$curce Tern. tiethodology for Pressurized Water Re6ctors " Tauske &

Associates, March 1987.

1 3.

Draf t IDCOR Progr6m Report, Technical Report 85.3-B1, "BWR Accident p

Sequence - Inuividual Plant Evaluation itethodology," December 1986.

4 10COR Program Report Technical Report FAl/861, " Approximate Source Term Methodology for Eoiling Water Reactors," Fauske &

Associates, March 1987.

E.

Draf t IPCOR Progren. Repert, "BWR IPE Pltr.t Specific Accident Sequence Evaluation Methodology, User's Guide," Rev.1, December 1986.

l L

_6.

. Letter frorr. A. Buhl, IT, to T. Speis, NRC, " Submittal of Revisions to the IDCOR Individual Plant Evaluation (IPE) Pressurized Water Reactor 53 stems !!tthodology." ticrch 9,190i.

7.

Letter from A. Buhl, IT, to T. Speis, liRC, "Submittel of Revisions to the IDCOR Individual Plant Evaluation (IPE) Boiling Water Reactor Systems Methodology," I:erch 12, 1987.

i S.

Letter from A. Buhl, IT, to T. Speis, NRC, " Submittal of Revisions to the 10COR Ir.dividual Plant Evaluation (IPE) BWR and PWR Source Term Methodologies," March 31, 1967..- -

- ~

E o

, i c,,-

s I?. Draft IDCOR Program Report, " Individual P16nt Evaluation, Peach Bottom Atomic Power St6 tion," Philadelphia Electric Company, May 1986.

14 Drr.ft IDCOR Program Report, " Individual Plant Evaluation for Susquehanna f

Steam Electric Station," P.R. Hill, C. A. Kukielka, and C.A. Boschetti, submitted to IDCOR, April 198E.

lE.

Drtft IDCOP Program Report. "Shorehem lluclear Pcwer Station, 10COR Plant Evalu6 tion," Long Island Lighting Company, April 1986.

1(.

Dre't IDCCR Program Report, " Individual Plant Evaluation Methodology Applied to the Oconee I:uclear Generating Station," Submitted to l

Alf/lDCOR Program, 1986.

17.

Craf t IDCOR Program Report, " Individual Plant Evaluation Methodology Applied to the Zion Nuclear Generating Station," Submitted to AIF/lDCOR g

l-Program, February 1986.

l.

p 18.

Draf t IDCOR Program Report, IDCOR/IPE Report, "Calvert Cliffs Nuclear Power Plant Unit 1,* Submitte6 to IT Corp. by BG&E with Letter dated l

October 20, 19BE.

19.

Letter from A. Buhl, IDCOR, to T. Speis, NRC,

Subject:

• $ubmittel of the IDCOR Individual Plant Evaluation Methodology (IPEM) Test Appli-cation to the Grand Gulf huclear Plant," January 7,1987 9.

Letter from T. Speis, NRC, to A. Buhl, IDCOR, with " Preliminary Evaluttien of the ICCOR IPEft," September 9, 1986.

10.

Letter from A. Buhl, IDCOR, to T. Speis. NRC,

Subject:

"lDCOR Response to tlRC Commenth on the Individual Plant Evaluation tiethodology," December 10, 1986.

h

^

- e.

.es c.

11.

Letter from J.W. Hickman, SHL, to M.D. Houston, ACRS, Transmitting Comments from a Reniew of the IDCOR IPEM, September 22, 1986.

12. Letter from A. Buhl, ICCOR, to W. Kerr, ACRS,

Subject:

"IDCOR l

Responses to SNL Comments on the IDCOR IPEM," October 30, 1986.

IDCOR P'rogram Report, IDCOR Technical Report 85.I. " Technical Support 27.

for Issue Resolution," July 1985.

26.

Letter f rom 1. Speis, NRC, to A. Buhl, IDCOR, dated September II,1986.

79. L ette r f rom T. Speis NRC, to A. Euhl,1000P., dated November 26, 1906.

30. Letter-frem T. Spets, NRC, to A. Buhl, IDCOR, dated March 11, 1987.

34 NUREG/CR-4883, " Review of Research on Uncertainties in Estimates of

-Source Term From Severe Accidents In Nuclear Power Plants," April 1987.

l' 33.

H. P. Nourbakhsh, C H Lee, and T. G. Theofanous, " Natural Circulation Fhenomen6 and Primary System Failure in Station Blackout Accidents "

Sixth 1r. formation Exchange Heeting on Debris Coolability (UCLA), November 7-9, 1984 35.

"Some Examples of Hydrogen Transport and Mixing," Dr. John Travis, Los Alamos Scientific Laburatory and T. G. Theof anous... To be presented at L

1987 NHTC, Pittsburg, PA, 9-12 August, i

3(.

" Natural Convection and Recombination of Combustible Cases in Reactor Cavity," Dr. C. Channy Wong, Sandia National Laboratories, Albuquerque, J

131, To be prestnted at 1987 NHTC, Pittsburgh, PA, 9-12 August.

l 1

l.-

h

I O

y, f

o. c-20.

IlVREG/CR-tC15, "Probabilistic Safety Analysis Procedures Guide " August 1985.

24 EPR1-NP-3583,

• Systematic Human Action Reliability Procedure Guide,"

June 1984

26. NUREG/CR-2728, " Interim Reliability Evaluation Program Procedure Guide,"

January, 19f3.

51. NURE6 0650, "Prelininary Assessment of Core llelt Accidents at Zion ano Indian Point Nuclear Power Plants and Strategies for Mitigating Their Effects," November 1981.

2F. NUREG-1079, " Estimate of Early Containnient Loads From Core Melt s

Accidents," October 19E3.

F3. NUREG-1150, " Reactor Risk Reference Document," Volumes 1-3, February 1967.

1. I;UREG/CR-4760, " Procedures for Treating Common Cause failures in Sefety and Peliability Studies," January 1960.

12. HUREG/CR-4834,

• Recovery Actions in PRA for the Risk fiethods Integration and Evaluation Program (RitlEP), June 1987,

25. NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants."

37. NUREG/CR-2300, "Probabilistic Risk Assessment Procedures Guide," January 1983.._.

c.

.,r.., c -

o; o j

I ATTACHMENT Staff's Evaluation of Y Sequence Checklist A loose interpretation of the V-sequence checklist questions by the utilities could result-ir. a lack of sufficient attention to available means for reducing the frequency and consequences of bypass sequences. The staff in a letter from T. Speis tc I.

Buhl dated September 9,1985 requested that IDCOR modify the checklist to include guidance and prescriptive acceptance criteria for each checklist question. Such clarification was considered necessary to ensure that the checklist would not be loosely interpreted by utilities performing the lpE' and that undue reliance would not be placed on the auxiliary building as a fission product removal f eature. Specific iter.s requiring additional p

c1brification include:

L 1.

i The methods and assumptions to be used in defining the low pressure-systeri. boundary that must be analyzed by each utility.

n 1

2.

Required actions in the event that only portions of the RHR lines art mainteir.edwaterfilledandacceptablebases(e.g., Technical Specifications / plant Operatino Drocedures) fur er.suring a water-fillec' state.

l 3.

The inethods 6nd frequencies of hydrostatic testing by which system integrity is den.onstrcted.

4 Analytical techniques to be used for analysis of piping stresses at elbows and piping supports and the material prcperties to be used for all stress analyses, e.g., actual material properties with suitable margins to account for uncertainties in modeling, material properties, and construction tolerance. I

E 4 ;. '

O 4

5.

Quai.titative criteria regarding the submergence of the failure site required to take credit for pool scrubbing in the auxiliary building and the methods and assumptions to be used to calculate the water adoitions and the flooding level.

6..

The inethod to be used by each utility for identifying the potential pathways to the environment (including guidance on assessing auxiliary Luildir.1, tressure c6pbility, performance 6r.d failure location) anc quantitative criteria regarding the minimum release pathway length and

~

intervening structures required to claim applicability of the reference plant an61ysis.

7.

Acceptable bases for ensuring that fire sprays are available and would L

be actuated (e.g., emergency operating procedures and automatic initiation) and prescriptive criteria regarding the minimum acceptable coverage cf auxiliary building (and release pathways) by fire sprays required to c1cim applicability of the reference plant analysis, i

E.

Ar.clyses required by each utility ir, order to claim that ventilation systems trill remain intact and effective.

1 I t

.