ML20056A001
| ML20056A001 | |
| Person / Time | |
|---|---|
| Site: | South Texas  |
| Issue date: | 07/27/1990 |
| From: | Dick G Office of Nuclear Reactor Regulation |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| TAC-73009, TAC-73010, NUDOCS 9008030051 | |
| Download: ML20056A001 (79) | |
Text
4
'(g.s[o UNITED STATES
[
P( g.
NUCLEAR REGULATORY COMMISSION g
WASHINGTON, D. C. 20555
/;j
%*...*/
July 27, 1990 Docket Nos. 50-498 and 50-499 LICENSEE: HoustonLighting&PowerCompany(HL&P)
FACILITY: South Texas Project, Units 1 and 2
SUBJECT:
PROBABILISTIC RISK ASSESSMENT (PRA) REVIEW MEETING - SOUTH TEXAS PROJECT, UNITS l'AND 2 (TAC NOS. 73009 AND 73010)
'On May 30 and 31, 1990, the staff and its contractor, Sandia National Laboratories (SNL), met with the licensee in support of the ongoing review of the licensee's Probabilistic Safety Assessment (PSA). The purposes of tht meeting wers:
l (1) discuss the open items in the SNL draft report of the review of the PSA treatment of internal events, and (2) conduct a walkdown in support of the review of the PRA treatment of external events (excluding fire). The fire review is being conducted separately. Enclosure 1 is a listing of the meeting attendees.
With respect to the open items in the SNL draft report, the licensee had prepared i
written responses to each of the items. The written responses (Enclosure 2) were discussed.
In the discussion of response IE-7, the licensee was asked about procedures for mitigating an intersystem LOCA outside containment. There were no issnediate questions on the other responses.
There was also a discussion of the methodology used to incorporate human inter-action into the PSA. The methodology involved development of a matrix of factors which would be expected to affect a particular operator action (e.g.,
pruedures, stress, etc.). The matrix would be completed through operator interviews to assessments of both importance and degree of difficulty, resulting.
n i
in " Performance Shaping Factors" which were used in the PSA to characterize operator action.
l f
l The staff conducted a plant walkdown as part of the review of the PSA modeling.
The primary purpose of the walkdown was to develop insights into anchorages, potential spatial interactions, and the reasonableness of assumptions used in fragility evaluations. The walkdown findings were discussed with the licensee and some specific drawings were requested for the on-site examination.
As a result of the walkdown and discussions, the following action items and 1
information requests were identified:
1.
Provide a discussion on the potential seismic interactions of the overhead crane in the diesel generator building with other equipment located in the vicinity,
/g n~n 9008030031 900727 PDR ADOCK 05000498 P
ppc
,r 2-July 27, 1990 l
2.
Provide SSPS cabinet anchorage details and fragility calculations.
3.
Trace'the quantification of the top two. seismic plant damage states
=
(HXXXS and MXXXS) and provide plant damage state fragilities.
i
~4.
During the walkdown, an open penetration was noted in switchgear room C.
Provide a discussion on how this penetration was treated in the PRA.
'5.
Explain external event quantification process by tracing scenarios 1 and 7.of Table 3.4.3 1 from the initiating event frequency to the core damage and plant damage state frequencies. The purpose is to illustrate intermediate calculation steps and clarify assumptions made in the quantification.
6.
Provide a discussion on data used.in the aircraft impact analysis
' i performed in the PRA versus data used in the FSAR analysis.
If there i
are no significant differences between the two analyses, then state so.
The licensee indicated that it would develop and provide the answers.
OriginalStoned By:
George F. Dick, Jr., Project Manager Project Directorate IV-2 Division of Reactor Projects. III, i
IV, Y and Special Projects Office of Nuclear Reactor Regulation
Enclosures:
DISTRIBUTION As stated Docket File NRC PDR cc w/ enclosures:
Local PDR See next page F. Miraglia l-J. Partlow p
PDIV-2 R/F C. Grimes L
G. Dick 1.
0GC L
E. Jordan MS MNBB 37M L
R. Boyer l
E. Chellfah G. Kelly b
ACRS(10)MSP-315 l
MSlosson l
- PDIV-2/LA
- PDIV-2/P
- PDIV-2/D
[FC EPYlif
- GDick:y
- CGrime LAME - :
7/ 8 90 E= -: 7/n /90
- 7/.it/90 "0FFICIAL RECORD COPY Document Name: STP MEETING
SUMMARY
73009/10 L
k-
, July 27, 1990 cc w/ enclosures:
Senior-Resident Inspector Jack R. Newman, Esq.
U.S. Nuclear Regulatory Comission Newman & Holtzinger, P.C.
P. O. Box 910 1615 L Street, N.W.
Bay City, Texas-77414 Washington, D.C.
20036 Mr. J. C. Lanier Licensing Representative i
Director of Generation Houston Lighting and Power Company City of Austin Electric Utility Suite 610 721 Barton Springs Road Three Metro Center
' Austin, Texas 78704 Bethesda, Maryland 20814 Mr. R. J. Costello Bureau of Radiation Control Mr. M. T. Hardt State of Texas j
City Public Service Board 1101 West 49th Street
-l P. O. Box 1771 Austin, Texas 78756 San Antonio, Texas 78296 Rufus S. Scott Mr. R. P. Verret Associate General Counsel Mr. D. E. Ward Houston Lighting & Power Company Central Power and Light Company P. O. Box 61867 P. O. Box 2121 Houston, Texas 77208 Corpus Christi, Texas 78403 Mr. Donald P. Hall INPO Group Vice-President, Nuclear Records Center Houston Lighting & Power Company 1100 Circle 75-Parkway P. O. Box 1700
-Atlanta,-Georgia' 30339-3064 Houston, Texas 77251 Regional Administrator,- Region IV U.S. Nuclear-Regulatory Comission i
- 611 Ryan Plaza Drive, Suite 1000 Arlington, Texas 76011 Mr.: Joseph M. Hendrie 50 Bellport Lane Bellport, New York 11713 Judge, Matagorda County Matagorda County Courthouse
'1700 Seventh Street
' Bay City, Texas 77414 Mr.' M. A. McBurnett Manager, Operations Support Licensing Houston Lighting & Power Company P. O. Box 289 Wadsworth, Texas 77483
-m-
h, o
,1 t
t 3",
O' Meeting Attendees South Texas PRA Meetings May 30 and 31, 1990
-l Name Organiza tion Erul Chelliah NRC Millard Wohl NRC George Dick NRC Nilesh Chokshi NRC Sam Phillips HL&P 1
Bill Stillwell HL&P Mike Powell HL&P' Richard Murphy HL&P John. Stet kar Pickard, Lowe and Garrick Timothy Wheeler Sandia Teresa Sype Sandia l
i John Darby Sandia i
1
[
1 l
4
1,
' l HL&P Response to Open Items in Draft Report South Texas Project PRA I
=l ATTACHMENT 1 Page 1 of 43 i
Responses to " Potential Problems to be Resolved" and
" Items Insufficient 1v Exn3ained" PP1:
The time to steam generator dryout following loss of all feedwater is not fully justified.
(Section 2.1.1 of.the Sandia Interim Report on the STPEGS PSA Review)
Response
A reanalysis was performed by HL&P which resulted in a reduced j
. steam generator dryout time and provided justification for its applicability to the current' PSA.
This information was transmitted on
. March 1,
1990 via a.
letter to the
- NRC, ST-HL-AE-3380.
This analysis shows that even for a reduced steam generator dryout time of approximately 34 minutes, no impact on the likelihood of the operators to initiate bleed and feed primary side. cooling will result.
we
'[,
ATTACHMENT 1 pag 3 2 of 43 PP2:
The ~ ability of equipment in the ECCS pump rooms.to operate without forced cooling to _ the rooms is not fully justified.
(Section 2.2.3 of the Sandia Interim Report on the STPEGS PSA Review)
Response
)
Studies have been performed which. show that the equipment in the ECCS pump rooms can be expected to ~ operate up to three days without forced room cooling.
HL&p has-performed a
calculation (EQ-89-001) which extends the qualified life of equipment and cables in the FHB ECCS cubicles beyond the
- normal, abnormal,0 and accident service time to accomodate temperatures of 200 F for 7.4 days..
There are no electrical or control components in the rooms which could afient the operation of the pumps or valves.
As previously indicated to SNL (see Letter to T. A. Wheeler from S.
D.
- Phillips, and the reference and discussion on this subject
-on pp.
15 and 16 of -the draft Interim Report), two transient heatup studies have been performed (correspondence ST-3R-HS-00804 dated-November 17, 1989 and ST-3R-HS-00895 dated January 3, 1990 from Bechtel to HL&P).
These studies conclude that without forced room
- cooling, and without taking credit for natural convection between the ECCS pump room and the remainder of the FHB (which is a
conservative assumption given the layout of the ECCS pump 0
cubicles),
the temperature in the ECCS cubicles is under 200 F at a
termination time of 3
days.
This is well beyond the PSA analyzed mission time of twenty-four (24) hours, t
I
'i-
ATTACHMENT 1 P0go 3 of 43 PP3:
The confusion regarding labeling split fracti.ons AFP, AFQ, and AFO in the dominant sequences (Table 3.6-1) should be resolved.
(Section 3.6 of the Sandia Interim Report on the STPEGS PSA Review)
Responset HL&P reviewed the five dominant sequences identified in Section 3.6 of the Sandia report where a discrepancy in AFW split fraction assignment was identified.
Correction of the discrepancy does not effect the PSA calculated CDF of 1.7E-4 events per year.
To address this
- issue, some introductory information on AFW system modeling is first needed.
The STPEGS's AFW system includes four pump trains:
three motor driven (Trains A,
B, and C) and one steam turbine driven (Train D).
The motor driven pump trains are identical.
The technical specifications allow Trains B,
C, and D to be out of service for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and require Train,A to be repaired "as soon as possible".
- The, technical specifications also allow any combination of 1H2 trains to be out of service for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
As a
result, the PSA divides the four trains into three groups based-on their calculated unavailability.
First, Trains B and C
are identical motor driven pump trains that are limited to only 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for being out of service.
Second, Train A can be out of service indefinitely as long as the repair is being actively pursued (e.g.,
a long lead time for replacement parts),
thus it is represented with tho appropriate maintenance duration.
- Third, Train D
is a turbine driven pump train that has different characteristics than the three motor driven trains.
These characteristics include turbine driven pump maintenance frequency and additional steam supply valves.
Although Train A
has the same equipment and testing requirements as Trains B
and C, its extended maintenance contribution allowed by the technical-specifications makes it less available.
A conservative assumption used in assigning split fractions in the PSA event trees is that Train A unavailability is used to model at least one of the available motor driven pump trains.
For example, if the DG supplying AC power to Train B equipment is all that is available for a
LOSP initiating event, then the split fraction representing Trains A
and D is used, instead of Trains B and D.
Note that Train D is steam driven and does not require AC power.
For Sequences 10 and 17 in Table 3.6-1, the failure of AFW Trains C
and D is conservative 1v modeled by split fraction AFP because Train A's maintenance unavailability contributor is greater than Train C's.
i
ATTACHMENT 1 Pago 4'of 43-i For -Sequence 14 in Table 3.6-1, the failure of.AFW-Trains B and-D is conservative 1v modeled by split-fraction AFP because -Train A's maintenance unavailability contributor is greater than Train B's.
For Sequence 19 in Table 3.6-1,1 the event description is incorrect.
The event description should -identify that Trains A,
C, and D are available, but fail to supply makeup to their corresponding steam generator.
Split fraction AFO represents the likelihood of two motor-driven- (i.e.,- Trains A
& B or A & C) and the one turbine-driven (i.e.,
Train D)
AFW pump trains will fail.
As a result, the assignment-of AFO and the frequency associated with this sequence is correct.
For Sequence 18 in Table 3.6-1, the split -fraction assignment is not correct.
Split fraction AFQ represents the likelihood of two motor-driven (i.e., Trains A'& B or A
C)
AFW pump trains will fail.
The correct split fraction for the failure of AFW Trains A-and D is AFP, i
which is a
factor of 1.92 (= AFP/AFQ = 4.088E-3/2.544E-3) greater than AFQ because of the difference between a
motor-driven and turbine-driven pump train unavailability.
As a result of using split fraction AFP instead of AFQ, the sequence ranking will rise to the number six position withf a frequency of approximately 2.69E-6.
A review of the top 100 sequences was made to ensure that the correct AFW split fraction assignments were made.
The L
result of that review = identified another example of using split fraction-AFQ instead of. AFP.
This example would raise Sequence 33 to-the nineteenth (19) position with a frequency of 1.34E-6.
Sequence 33 is similar to Sequence 18, but with one DG-and -another ECW pump train being unavailable which represents two DGs unavailable.
Although l
the impact-on both of these sequences is noted, no change l
in the published CDF of 1.7E-4 results, l
During the next update of the
- PSA, the split fraction misassignment will be addressed and corrected.
It is anticipated that a
change in the event tree split fraction assignments will correct this problem.
ATTACKMENT 1 Pago 5 of 43 IE1:
-Quantification of the PTS split fraction is not clearly provided.
(Section 2.1.1 of the Sandia Interim Report on the STPEGS PSA Review) gesponse:
The vessel integrity split fraction VIA evaluates the failure probability of the reactor vessel after a pressurized thermal shock (PTS) challenge.
PTS is the term used to describe an event in a PWR that produces a severe overcooling of the inside surface of the reactor vessel
- wall, concurrent with or followed by repressurization.
The STP PRA transient event tree models the potential PTS challenge when the reactor trips, but the turbine fails to trip and the MSIVs fail to close; that is, severe
-secondary depressurization event.
The value of 1.1E-4 used for split fraction VIA (vessel integrity after a PTS challenge) in the-STP event tree model quantifications was taken from the result of an evaluation of the failure probability of the reactor vessel under a
similar condition in the Diablo Canyon PRA (See Appendix A,
DCPRA report, DCPRA-PLG-4 09 ).
This was judged to be conservative since the STP Unit i reactor vessel is expected to be able to better withstand a
PTS challenge than the Diablo Canyon Unit 2
reactor vessel because of the following reason:
the copper content of the STP Unit i vessel components which are important to PTS failure is in the range of approximately 0.03 to 0.07%
(see the STPEGS UFSAR Table 5.3-3), which is much lower than that of the Diablo Canyon Unit 2 vessel material (0.14 to 0.15%).
The copper content in the vessel material directly-influences the value of the end-of-life RT which is the reference temperature for nil-ductility tran!$kion and is a
measure of fracture toughness of the vessel material.
The lower the value of the
- RTgs, the greater the toughness of the values for the Diablo Canyon material.
The end-of-life RT Unit 2
vary from
<185 F to
$$b0F which are much higher than 0
those of STP unit i
vessel material which ranges from 5 to 0
93 F.
The PSA indicates that PTS is valid challenge for overcooling
No details for the quantification of the PTS split fraction are provided in the PSA (as indicated in the Sandia comment).
Ref: '
UFSAR Section 5.3.2.
Using the Regulatory Guide 1.99 Rev.
1
" Predicted Adjustment of Reference Temperature" curve, the 0
predicted adjusted reference temperature is less than 200 F.
The limiting material for Unit i
reactor vessel is the intermediate shell plate No.
R-1606-3.
The reactor vessel materials have properties of 0.05%
Cu, 0.62%
Ni and 10 F initial RTNDT.
The estimated end of life RT is equal to PTS 88 F.
The limiting material for Unit 2 reactor vessel is the 0
intermediate shell plate No.
R-2507-2.
The reactor. vessel materials have properties of 0.05%
Cu, 0.64%
Ni and
-20 F
7 ATTACHMENT 1 PCgo 6 of 43-
~'
is equal to
. ingtial RT The-estimated and of li's RT RT values are well N$ow the-NRC 68 F.
N.
above screening criteria which $g 0
s-270 F for
- plates, forgings,,and 0
axial' welds,-and 300 F for circumferential' welds.
- Lastly, the plant Emergency Operating Procedures include guidance for the operators to limit challenges to the vessel-from the injection of cold water from the RWST. (cold leg temperature 0
decrease 100 F-in last 60 minutes AHQ RCS cold. leg,.
temperature 244 F).
This would indicate that overcooling j
0 from unisolated steam generators may not be a concern.
1
1 ATTACHMENT 1 P;go 7 of 43 IE2:
The
_use of the nomenclature
" hot standby" and
" hot shutdown" are inconsistent with the definitions in the
-Technical Specifications.
(Section 2.1.1 of the-Sandia Interim Report on the STPEGS PSA Review)
Responser-l' Inconsistencies-in the use of " hot standby" and " hot shutdown"
-are identified below.
The definitions in the plant Technical Specifications are as follows:
i M2da Definition L
1 Power Operation
[
2 Startup 3
Hot Standby (greater-than or equal to 0
l 350 F) 0 0
4 Hot Shutdown (350 F > Tavg > 200 F)
L 5
Cold Shutdown 6
Refueling consistent with these definitions, the following clarifications are made:
Page 5.4 should be hot standby (Event 70).
This will b3 changed from hot shutdown.
should be hot shutdown (4th paragraph) as Page 5.4-29 indicated for the description.
should be hot standby (Top Events CD and Page 5.4-33 AF).
This will be changed from hot shutdown.
L
' Page' 5.4-34
- should be hot standby (Top Event S2).
This will be changed from hot shutdown.
i Page 5.4-37
- should be hot standby (Top Event ON).
This will be changed from hot shutdown.
Table 5.4 should be hot standby.
This will be changed from hot shutdown.
The above clarifications do not impact the PSA analysis, they only correct inconsistencies in the use of the terms
" hot g
standby" and
" hot shutdown."
These inconsistencies will be corrected in the next update of the STPEGS PSA.
r 1,
ATTACHMENT 1 Pags 8 of 43
]
IE3:
Accumulator injection 'following.
large or medium LOCAs is assumed to not be. required.
This assumption is not justified.
(Sections-2.1.2 and 2.1.3 of thu Sandia Interim Report on the STPEGS PSA Review)
Response
. As discussed in the November 1989 meeting between HL&P, SNL and the
- NRC, HL&P has already commmitted to. include the accumulators in the Level II (i.e., IPE Back End) analysis.
4 For the Level I-
- analysis, a
Large LOCA initiating event with success of the-accumulators and failure of LHSI leads to' severe core damage.
Failure of the accumulators and success of LHSI-leads-to no severe core damage (minor clad damage possible).
Success or failure of the accumulators has no effect of the likelihood of severe core damage.
For Medium LOCAs (2 to 6 inch), the HHSI pumps will be operating' and reflooding the RPV prior to reaching 600 psi.
At most, the accumulators will aid in refilling the RPV for these breaks and slow down RCS depressurization to the LHSI shutoff head.
U7SAR Chapter 15 analysis for 6"
and 3"
breaks (see attachments) indicate that vessel water level is above the active core prior to accumulator injection.
For the 4" break, vessel level is recovering prior to accumulator injection (approximately 1000 seconds).
See attached figures from the STPEGS UFSAR.
Question 211.04 (UFSAR
Response
to NRC. Questions) indicates that for the 4"
- break, HHSI flow matches break flow at 950 seconds and core mixture level is -increasing.
This is with one HHSI train-injecting into the vessel.
The accumulator system has been quantified using RISKMAN as part of the plant model update.
With the assumption that two (2) accumulators injecting into intact RCS loops are required for j
success in the Large LOCA initiating
- event, the system
- unavailability is approximately 2.2E-03.
From the PSA, the Large LOCA initiating event frequency is 2.0E-04 events per reactor year.
The likelihood of core damage due to accumulator failure after.a Large LOCA initiating event is:
CDF = LLOCA x Accumulator Failure CDF = 2.0E-04 x 2.2E-03 = 4.4E-07 / reactor year.
This frequency is considered negligible in relation to other causes of core damage.
l m.
..m
.t();
'STPECS UTSAR' TAB 1.E 15.6 8 4 44 RMALL BREAX TIME SEOUENCE OF EVENTS Times (second) 6 in.
4 in.
3 in.
i 0.0 0.0 0.0 Start-(Accident Initiation) 3.716 9.178 15.844 Reactor Trip Signal, sec 164.33 370.28 639.10 Top of Core Uncovered, see 424.45 1,057.18 N/A Accumulator Injection Begins, sec 197.89 885.86 701.67 Peak Clad Tenp, Occurs, see-f 214.92 1,195.17 715.02 Top of Core Covered, see Revision 0 15.6 31
p
'U STPECS UFSAR
+-
TABLE 15.6 9 j!'ALL BREAM RESULTS 6 in.
4 in.
T in.
Peak' clad Temp,, 'T 950.55 1,366.45*
1,030.25 Peak Clad Location, ft 13.0 14.0 13.0 Local Zr/H O Reaction, max 4 0.0361-0.2816 0.0366 2
' Local Zr/H O Reaction Location, f t 13.0 14.0 13.0 2
Total Zr/H O Reaction, 4
<0.3
<0.3
<0.3 2
Hot Rod Burst Time, see N/A N/ ~.
N/A i'
Hot Rod Burst Location, ft N/A N/A N/A-1 l
1 1
l o
Tect data reflecting reduced safety injection flow rates and the associated sensitivity analyses may increase this peak clad temperature value to approximately 1,407'F.
This value continues to maintain considerable margin (approximately 790*F) to the limit of 10CFR50.46, 15.6 32 Revision 0
i l.; -,-
l l
,y t
1~
i 9
2400 l
2200 1
2000 I-
- e E
1900 N--
l 1600 J
1400 j
1200 pe l
l000 sOO.
600.
1 I
I I
I 400.
O.
200.
400.
600.
800.
1000
' l2OO
- 1400 1600 TIME (SEC) l'
-l j
=
l
\\
l l
l l
l l
SOUTH TEXAS PROJECT UNITS 1 & 2 l
RCS DEPRESSURIZATlON TRANSIENT (4 INCH SREAK) l Figure 15.6-41 Revision 0 i.
w ns n
-vr----,.w,w-m --
t i
t t
32.
1 30.
28.
n U
26.
24.
w 22.
TOP OF CORE.
20.
.Z 18.
16.
14.
1 I
I I
I I
-l 12.
0, 200.
400.
600.
800.
1000 1200 1400 1600 TIME (SEC)
SOUTH TEXAS PROJECT UNITS 1 & 2 CORE MIXTURE HEIGHT (4 INCH BREAK)
Figure 15.6 42 Revision 0 L
e
-+
1 l
.f f
600.
500.
U 400.
B d
300. - -
b,/1k; j
5 t
v 200.
l 6
b L
ioo.
W I
I I
I I
I I
o, 0.
200.
'400, 600.
900.
1000 1200 1400 1600 TITE (SEC)
I.
SOUTH TEXAS PROJECT UNITS 1 & 2 STEAM FLOW f
(4 INCH BREAK) l Figure 15.6 43 Revision 0 l.
>y i
1, 3000 2500 i
2000 k L.
t 1500 1000
(
^-
500 i
i i
i i
i i
i i
i i
O300 400 500 600 700 000 900 1000 1100 1200 1300 1400 1500 TIME (SEC)
H i
l-SOUTH TEXAS PROJECT UNITS 1 & 2 CLAD TaiMPERATURE TRANSIENT (4 INCH BREAK)
Figure 15.6-44 Revision 0
i o
1 i
1
\\
i 3000 2500 2000 g k.
1500 a
1000 500 0300: 400 500 600 700 800 900 I000 II00 1200 1300 1400 I500 TIME (SEC)
SOUTH TEXAS PROJECT UNITS 1 & 2 HOT SPOT FLUID TEMPERATURE (4 INCH BREAK)
Figure 15.6 45 Revision 0
. _ _. ~
'o 1
i l
1
)
i i
103_
E C
Y
=
t B
~
m 102
)
=
~
g m %
lOI
=
Z W.
l l
l l
l l
l l
l I
l00
~A 300 400 500 600 700 000 900 1000 l100 1200 1300 1400 1500 TIME (SEC) i 1
SOUTH TEXAS PROJECT UNITS 1 & 2 ROD FILM HEAT TRANSFER COEFFICIENT (4 lNCH BREAK)
Figure 15.6 46 Revision 0
'l 10 0 "OTAL RESIDUAL HEAT 6 =
1WITH 4% SHUTDOWN 4
MARGIN) 2 10-I d{
6==
4 b
2 10-2 r
=
Q 6 5 4
E 2
I IIIIlll I IIIllll l I I Illll!
I IIIllll I IIlill!
10-3IO-l 100 lol io2 lo3 104 TIME AFTER SHUTDOWN (SECONDS)
SOUTH TEXAS PROJECT UNITS 1 & 2 CORE POVVER AFTER i
REACTOR TRIP (4,6, & 3 INCH SREAK)
Figure 15.6 47 Revision 0
. -....~ - _.. -
l l
2400 2200 3 2000 1800 1600 1400 l200 1000 800.
600.
400.
- 200, O.
100.
200.
- 300, 400.
500.
600.
TIME (SEC)
SOUTH TEXAS PROJECT UNITS 1 & 2 RCS DEPRES$URIZATION TRANSIENT Figure 15.6 48 Revision 0
l
?
h h
l h
32.5 30, 27.5
~
I 25.
22.5
_TO_P OF CO_RE _ _ _ _ _ _ _ _.
20.
X 17.5 I
15.
12.5 10.
7.5 O.
100.
200.
300.
400.
- 500, 600.
TI'ME (SEC) 2 SOUTH TEXAS PROJECT UNITS 1 & 2.
CORE MlXTURE HEIGHT i
(6 INCH BREAK)
Figure 15.6 49 Revision 0
l j
s 6
J l
3000 i
o 2500 t
N 2000 Su.
I_
1500 98
<- t000 d
500 I
I I
I I
I I
I 0
150 200 250 300 350 400 450 500 550 600 TIME (SEC)
SOUTH TEXAS PROJECT UNITS 1 & 2 CLAD TEMPERATURE TRANSIENT (6 INCH SREAK)
Figure 15.6 50 Revision 0
o
~
3400 2200
- y. 2000
\\
1900 I_
i1400 1200 1000 N
I I
I I
I I
I I
0.
200.
400.
600.
800.
1000 1200-1400 1600 1000 2000 T!>E (SEC) 9 SOUTH TEXAS PROJECT UNITS 1 & 2 I
RCS DEPRES$URIZATION TRANSIENT (3 INCH SREAK)
Figure 15.6 51 Revision 0 i.
... ~.
i
)
1 I
i I
s 32.
j 30.
L~-
20.
g 2s.
\\
~
24 TOP OF COM 22.
1-I I 20.
f i
0 10.
16.
14 I
I I
I I
I I
I I
0.
200.
400.
600.
800.
1000 1200 1400 1600 1000 2000 TIE (SEC)
SOUTH TEXAS PROJECT UNITS 1 & 2 Code MIXTURE HEIGHT (3 INCH BREAK)
Figure 15,6 52 Revision 0 s.
n,--
n,-,._..
1,
i
- s000, 2s00 I
2000
$C is00 i
E8 1000 n
.i-
\\
I I
I I
I I
I I
I I
'l I
I 600 700 000 900 1000 l10012001300140015001600170018001900 2000 1
TIME (SEC)
I SOUTH TEXAS PROJECT UNITS 1 & 2 CLAD TEMPERATURE TRAN51ENT (3. INCH BREAK)
Figure 15.6 53 Revision 0 4
v.
.--.--,w+-w-..
. ~... _... -. -... -. -. - -. -
1 1
l
?#
3 00 gss00 3400 E
3200 3000 2900 g 2600 l
l 1
I
" 2400 g
2200 2000 1
I 1900 1600 g 1400 l200
)
~
io00 g.
e00 h
600 400 1
200 1
I I
I I
I I
I I
I I
I I
I o
1 0
100 200 300 400 500 600 700 000 900 1000 1100 1200 1300 1400 1500 1600 RCS PRESSURE IN PSIO 1
1 SOUTH TEXAS PROJECT UNITS 1 & 2 TGX $ MALL BREAK SAFETY INJECTION FLOW RATE VERSUS RCS PRE 55URE Figute 15.6 54 Reviston 0 h
,.ev..-
e-e
, - - - + - -,, -, -
m.-v,, m,.,e w,- -
-,-,w-m.,,,-----o-w*
-e--o-+--
ATTACHMENT 1 POgo 9 cf 43 i
IE4 The effect of early failure to isolate containment on
- reflood, following a
large
- LOCA, is not' addressed.
(Section 2.1.2 of the Sandia Interim Report on the STPEGS PSA Review)
Resconset Failure to isolate containment following a
large LOCA is considered to impact the core reflood rate, but not result in core malt.
This conclusion is based on engineering judgement drawn from the discussion presented below.
Failure to isolate a large enough containment penetration prior to, or
- during, a large LOCA can be assumed to have no impact on the containment pressure, thus representing a minimum containment pressure responso for LOCA analyses.
LOCA analyses account for containment back pressure in assisting the core flooding rate during the core reflood phase.
The rate of flooding the core affects the calculated peak clad temperature (PCT).
Westinghouse identified in their 1989 LOCA Familiarization and Issues Course that PCT is sensitive to containment pressure.
As a result of assuming no containment pressurization, the lower back pressure yields a
lower reflood rate and possibly a higher PCT.
The question is how much of an increase in PCT results and does the increase represent sufficient fuel damage to yield an uncoolable geometry (or core melt)?
The regulatory success criteria for PCT 0
is less than 2200 F.
Two LOCA analyses are presented in the STPEGS UFSAR that account 1
for the sensitivity of containment pressure on the core flooding rate.
Both cases utilize the same set of conditions and/or J.
assumptions, except for different safety injection (SI) and containment-heat removal system (CHRS) configurations.
The first case represents the DBA with minimum SI and CHRS to yield the maximum containment pressure response.
The second case represents the ECCS performance capability analysis which utlizes maximum SI and CHRS to yeild the minimum containment pressure response.
The following referenced figures and tables are attached.
Figure 6.2.1.1-5 of UFSAR Section 6.2 provides the maximum containment pressure response resulting from a Large break LOCA with minimum containment heat removal capability (First case).
UFSAR Figure 6.2.1.1-5 shows containment pressure rising to a maximum of 37.5 psig within 83 seconds and dropping off to about 5 psig by 20,000 seconds following a Large break LOCA.
Figure 6.2.1.5-1 of UFSAR Section 6.2 provides the minimum I
containment pressure response resulting from a Large break LOCA with maximum containment heat removal capability (Second case).
UFSAR Figure 6.2.1.5-1 shows containment pressure rising to a maximum of 16 psig within 30 seconds and dropping off to about 4 psig by 300 seconds following a Large break LOCA.
ATTACHMENT 1 PCgo 10 of 43 Table 15.6.5-7 of UFSAR Section 15.6 compares the peak clad temperature for the minimum and maximum SI/CHRS scenarios (or, for this discussion, the maximum and minimum containment pressure response scenarios, respectively).
For the maximum containment pressure
- response, the calculated peak clad temperature reaches 1991 F,
whereas for the Einimum pressure response it reaches C
2127 F.
The minimum containment pressure response yielded the 0
C most limiting PCT with a margin of approximately 73 F under the C
C 2200 F
design limit.
The 2200 F
limit ensures that post-LOCA cooling is not precluded by changes in core geometry and limits excessive hydrogen generation.
Figures 15.6-14 and 15.6-26 of UFSAR Section 15.6 shows that the calculated PCT occurs at about 125 seconds for both scenarios and the maximum containment pressure for both cases occurs prior to this time.
Thus, a 136 F
increase in PCT resulted from a
21 psig drop in peak 0
containment pressure and the corresponding pressure responses.
Assuming that the change in PCT between the two cases is entirely the result of containment pressure and a
similar decrease in pressure would result from assuming the containment pressure remains constant at the initial value, then a similar increase in 0
PCT would result.
The resulting PCT may rise above the 2200 F
design limit by approximately 100 F.
IDCOR Technical Report 15.1B 0(September 1983) states that at approximately 1000 O.Y (or O
1340 F) the Zircaloy integrity fails and at 1800 K (or 2780 F) the energy generation rate due to Zircaloy oxidation can 0
reach the equivalent of 10%
of full core power.
Not that the 2200 F
design limit includes a margin of safety that ensures a C
coolable core geometry for design purposes.
Therefore, a
0 calculated peak clad temperatures slightly above 2200 F should also result in a coolable core geometry.
HL&P contends that the PSA LLOCA event tree adequately models this phenonmena and no additional analysis is required.
G I
W S
1 t
s l
ee y
f J
v
/
t 3
N
.d 3
T N_
w 4
N N o
9 E
o e
o n
o e
o O
C O
I e
n n
N N
e (6 sd)38nSS3Wd SOUTH TEXAS PROJECT 1
UNITS 1 & 2 LOCA 2 CONTAINMENT PRESSURE Figure 6.2.1.15 Revision 0
_.. _ _ ~.
' ^
20 i
le 16 to 14
[
12 --
pI d
e-_-
t m
W 6'
t 4
2 I
I I
I I
I I
I I
I 0
O 40 80 120 150 200 240 280 TIME (SEC)
SOUTH TEXAS PROJECT UNITS 1 & 2 TGX Large. Break LOCA Analysis DECLG, Co = 0.6 (Max.51)
Containment Backpressure Revision 0 Figure 6.2.1.51
STFECS UFSAt TABLE 15.6 7 f ARCE BRDK ANALYSIS RESULL$
DECLC DECLC DECLC DEC14 Co-0. 4 C -0.6 Co-0.8 Co-0.6 3
(Min SI)
(Min $1)
(Min $1)
(May $1)
Peak clad terrporature, 'T 1,685 1,991 1,973 2,127 Elevation, ft 7.75 8.00 8.00 8.00 Max local Zr/H O 2.06 4.45 5.64 4.94 2
rear. tion, t Elevation, it 8.00 7.75 7.75 8.00 Total Zr/H O reaction, 4
<0.3
<0.3
<0.3
<0.3 2
i Hot rod burst time, see 103.4 45.6 60.2 45.4 i=
Elevation, ft 8,00 7.00 7.75 7.00 1
l 1
l l
l l
t I
l l
l 15.6 30 Revision 0
l I
n i
~
R N
~
o s
n l
N OO H
N L
g W
W o.
5 m
N O
~
m-
~
l R
g g
l l
I O
O O
O O
O O
O O
O O
O in O
LO O
lD N
N
(_-l 030) 008.LOH dW3.L DAY OY10 SOUTH TEXAS PROJECT UNITS 1 & 2 Peak Clad Temperature DECLG,Co = 0.6 Figure 15.614 Revision 0
1 2500 B.O FT g
C 2000 E
1500 k$
~$
7.0 FT gg 1000 O
500 d
]
1 1
l 1
1 I
I I
I I
O O
50 I00 150 200 250 300 TIME (SEC)
SOUTH TEXAS PROJECT UNITS 1 & 2 Peak Clad Temperature DECLG,Co 0.6(Max.51) e Figure 15.6 26 Revision 0
m i
i TaOLE 4.2.1.1-11 e
i tweenstest etsmTS: WeeWT GF EE5mTS SF testateEW retssimE ame.TiseteAftBE anALYSf5 FOR TE SPECfWW8 SF FU5 twt ATE 9 ACCSSEWTS i
~
)
accident 1
2 3
4 5
6 f
4 treedt lecetten remp suctlen PS est les told les PS PS i
l (PS) ed type pendele-ended SEC SES SES 9.4 SEG 1pilt gulttetine I
t9EG) i ereek else 16.48 ft 19.48 ft 9.18 ft 8.M ft 4.M ft 3,,,,,2 l
2 2
2 2
2 I
l safety injectlen een oma seu uma ses esa Centelvement meet Semovel System-ein
, ein e6n een e6n een (CeRS)
Peelt preseure, pelg 3T.4 36.8 38.5 36.8 36.9 g
l 5
flee to peelt pressure, eec 82.6 82.6 39.3
- 16. 5 82.6 S2.6 et e
Peelt toepereture, *F 30T.S 292.9 288.6
.W.4 295.9 i
l l
w.3 s2.6 w.6 ar.6 vise i. poet t e.t-e,.ee s2.6 Energy reteseed to Centelveent t tiner of peelt pressure, e/ Stu 1
451.1 452.48 4M.62 349.31 444.5T 436.46 i
Eversy abeertmed ler poselve heet elv*s flee of peak
- pressure, 9tw 82.49 82.74 62.6T.
19.85 FT.96 75.T3 Energy in seper reghn et time of poet pressure, tek etw 296.0 296.04 312.30 209.9 291.13 289.98
(
)
Enerer in enop ester et ti.e io,een
,1# 9e.
,s.te se.as Tr.4 ev.1 w.m w.96 i
7 Energy renewed for Centelveent fan coeters eg> to tk t4ee of 7
peelt preeswe, M 9tw 3.21 3.21 S.S 9.9 3.96 2.72 Enerer reueved tur centelewee l
speers my to t h of peek pressure, 16" Stu g.g g,g g,g g,g 9.9 9.9 I
l I,
t i
~
x--
c
..u-.-
a.
ATTACHMENT 1 P3g3 11 of 43
!E5:
The need to switchover from cold leg.to hot leg recirculation to avoid boron precipitation is not addressed.
(Section 2.1.2 of the Sandia Interim Report on the STPEGS PSA Review)
Responsti Switchovwr from cold leg recirculation to hot leg recirculation to avoid boron precipitation is not included in the PSA since it was not considered as leading to core melt.
If it were assumed to lead to core melt it is estimated that its contribution to STPEGS CDF would be approximately 0.01% or less.
Reft ERG
Background
document ES-1.4 LP Rev. 1A July 1, 1987.
This document discusses the need for switching to hot leg recirculation.
The basis for the switch to hot leg recirculation is the design basis cold leg LOCA (by definition a Large LOCA in the PSA).
The switch to hot leg recirculation is considered to be necessary, using conservative
- analyses, to limit the boron concentration increase that occurs in the RPV after the design basis cold leg break.
Boron precipitation could reduce heat transfer from the fuel to the reactor coolant.
The plant emergency procedures discuss the steps necessary to achieve hot leg recirculation (F '?05-EO-ES14 ).
Failure to shift to hot leg recirculation is ne
'onsidered as leading to severe core damage included in the Large LOCA event tree.
If in the PSA and war s
the event were b,Jded, and if the assumption is made that failure to shift to hot leg recirculation leads to core damage, the frequency of core damage associated with this failure can be determined by multiplying the Large LOCA initiating event frequency (per year) by the operator failure frequency for this event.
From the PSA, the Large LOCA initiating event frequency is 2.0E-04' Events / Reactor Year.
From NUREG/CR
-4550/Vol. 3 (Analysis of Core Damage Frequency from Internal Events:
- Surry, Unit 1) the operator failure frequency for failure to shift to hot leg recirculation is 8,0E-05/ Event.
The likelihood of core damage given Large LOCA and failure to initiate hot leg recirculation ist CDP = LLOCA x Op. Error CDP = 2.0 E-04 x 8.0 E-05 = 1.6 E-08 / Reactor Year This frequency is considered negligible in relation to other causes of core damage.
ATTACHMENT 1 P2g3 12 cf 43
-IE6 The instrument tube breach as a potentially unique san 11 LOCA is not discussed.
(Section 2.1.4 of the Sandia Interim Report on the STPEGS PSA Review)
Responset Instrument tube breach is not considered as a small LOCA in the PSA since coolant loss is not expected to exceed the makeup capability of normal charging.
The response to NRC Question 492.07N (attached) in the STP UFSAR
...up to three (3)
BMI thimble tubes can fail states simultaneously with a complete instantaneous guillotine break, and the coolant loss can be made-up by the output of the on-line charging pump.
Since the coolant loss would not exceed the make-up'iscapability of normal charging, no SI (safety injection) signal generated."
Because no LOCA is initiated, instrument tube breech is not included in the small LOCA category.
In l
- addition, it is judged that the likelihood of simultaneous failure l
of more than 3 BMI thimble tubes is very low.
l l
(
l l
l 1
Do you feel the same vibrational problems are possible at STP7 If you do, then quantify the safety impact of such a problem.
If you do not, then Cxplain any design differences between STP and Paluel that lead to this conclusion.
Egg,onse As was previously noted (letter ST.HL.AE.1334, dated 2/3/86) the vibrational probles experienced at Paluel is the vibration of the BMI thimble, not vibration of the reactor vessel lower internals. The South Texas Units 1 6 2 use a flux thimble with a nominal outside diameter of.313 in.
The Paluel units (1, 2, 3, 4) are using a thimble with an outside diameter of.295 in.
The South Texas Project thimbles also have a slightly thicker vall than the Paluel thimbles. The larger thimble also results in a smaller annular gap between the flux thimble and the inside of the BMI columns.
(Unit 1 vill be 55 modified such that the BMI column gap size is similar to Unit 2.)
In conclusion, the stiffer South Texas Project thimbles, with the smaller gaps, will perform satisfactorily based on the European plant experience to date.
With respect to the safety aspects of a thimble wear problem if it were to occur, we do not believe the issue to be a safety concern.
Previous evaluations have been made by Wertinghouse regarding the failure of flux thimble tubes. The evaluation concluded that up to three (3) BMI thimble tubes can fail simultaneously with a complete instantaneous guillotine break, and the coolant loss can be made up by the output of the on line charging pump.
Since the coolant loss would not exceed the make up capability of normal charging, no $1 (safety injection) signal is generated.
The occurrence of a thimble tube leak would be identified by the detectors in the seal table room.
It should be pointed out that the assumption of three tubes rupturing at the i
same time is highly conservative. As noted above, even if the tubes ruptured, the plant would easily be able to eneplete a controlled shutdown so that the leaking thimble could be either isolated or replaced, l
Vol. 2 QER 4.4 8N Amendment 55 l
t L
.a ATTACHNENT 1 P g3 13 cf 43 IE7:
The ability of STP to mitigate a V sequence LOCA should be discussed to justify screening such sequences from the analysis.
(Section 2.1.6 of the Sandia Interim Report on the STPEGS PSA Review)
Responset An interfacing system LoCA in properly screened from analysis in the PSA.
An interfacing systems LOCA was screened for the following reasons as described in the PSA on page 5.4-151.
3 normally closed, leak tested, check LHSI Cold Legs valves inside containment.
The RHR heat exchanger (the most likely-failure location in the Seabrook interfacing systems LOCA analysis) is located inside containment downstream of the first check valve inside containment.
3 normally
- closed, leak tested, check LHSI Hot Legs valves inside containment t.nd one normally closed Mov inside containment.
The
'1HR heat exchanger is located inside containment downstream of the first check valve inside containment.
3 normh11y
- closed, leak tested check HHSI Cold Legs valves and pump discharge piping that is designed for high pressure.
3 normally
- closed, leak tested, check HHSI Hot Legs
- valves, one normally closed Mov, and pump discharge piping that is designed for high pressure.
The most likely interfacing systems LOCA in past PRA's is the LOCA to the RHR system.
The RHR system at STPEGS is located entirely within containment.
Failure in the low pressure RHR lines connected to the RCS resembles a large LOCA which included in the PSA.
Interfacing systems LOCA in an RHR train will disable one safety injection train but will not result in a LOCA outside containment which is the concern for an interfacing systems LOCA.
Mitigation of this LOCA is modeled in the Large LOCA event tree.
ATTACHMENT 1 P g3 14 Cf 43 IE8:
A discussion of the letdown line break is not provided.
(Section 2.1.6 of the Sandia Interim Report on the STPEGS PSA Review)
Response
A letdown line. break is not included in the PSA since break flow is limited to less than the charging pump capacity.
The letdown line break is described in UFSAR Chapter 15.
The flow limiting orifices limit break flow to less than charging pump
- capacity, thus this break is not a 14cA.
Because it is not a 14CA it is not included in Table 5.4-31 which includes "... those systems that may have a
potential of initiating a V-sequence event." (PSA page 5.4-151).
9 1
4
-..,-.4.
i e
KTTSCHMENT 1 P;g3 15 Cf 43 IE9 Minimum containment cooling requirements are not i
sufficiently discussed.
(Section 2.1.8 of the sandia Interim Report on the STPEGS PSA Review)
Responset l
The concern regarding minimum containment cooling requirements is summarized into two parts.
First, the PSA does not explicitly discuss the effect of no containment spray on the calculated i
containment pressure response.
Second, a discrepancy exists in the PSA with respect to minimum requirements for maintaining containment integrity during the recirculation phase of. an accident.
Note that the following, discussion relates to containment integrity and does not impact CDF as estimated by the PSA.
Failure of the STPEGS containment sprays to actuate following a large break LOCA results in a peak calculated containment pressure less than the design value of 56.5 psig based on an analysis performed by Bechtel (Reference ST-3R-HS-00805 dated November 17, 1989).
In
- summary, the analysis assumes only one RCFC and its associated CCW pump train is operating with no containment spray.
The corresponding RHR pump train is also available for LMSI recirculation flow heat removal.
The peak calculated containment pressure was 42 psig at approximately 1200 seconds in the subject analysis.
Table 6.2.1.1-11 of UFSAR Section 15.6 shows a peak calculated containment pressure of 37.5 psig at 83 seconds for the design basis accident.
]
- Thus, the above described analysis supports the PSA success criteria that containment spray injection and spray recirculation are not required for containment integrity, but are helpful for fission product removal (or scrubbing).
Based upon the analysis performed, containment pressure will exceed the calculated peak pressure of 37.5 psig shown in the UFSAR, but will be less than the design value of 56.5.
The draft Sandia report also identified that a conflict exists in the PSA with respect to the minimum cooling requirements for maintaining containment integrity.
The conflict exists between Chapters, 5 and 16 of the PSA.
Chapter 16 provides two different success criteria for coding plant damage states as either
" containment heat removal and fission product scrubbing" or
" containment heat removal only".
Chapter 5 identifies a success criteria for event tree top events that corresponds to the
" containment heat removal and fission product scrubbing" category i
and does not support the " containment heat removal only" success criteria.
For the purpose of Level II
- analyses, the PSA
)
conservatively bins the core damage sequences categorized as
" containment heat removal only" into the plant damage state of "D2
)
containment heat removal and fission product scrubbing".
Therefore, the conflict is a result of having a plant damage state category that is not currently used, but is available for future use provided the appropriate modification (s) to the event trees i
l are made.
l
- ~__.... _ -
l ATTACHMENT 1 P2g3 16 Cf 43 i
The analysis identified and discussed above was,not available prior to completion of the
- PSA, thus the event tree top event success criteri.'.
was established to correspond to that required for the
" containment heat removal and fission product scrubbing" plant damage scate.
Sequentes coded as being " containment heat removal only5' represented only a
negligible fraction of the calculated total CDF and were bitaed to a more conservative plant damage state.
This binning astv ption will be evaluated further during the Level II analysis.
The Sandia draft report also pointed out a
concern with the statement that high head recirculation can provide adequate decay heat removal since the HHSI pump can not be aligned to its corresponding RHR heat exchanger.
It is true that the HMSI pump and RHR heat exchanger can not be aligned for recirculation.
- However, it is possible to remove decay heat in a high head recirculation mode.
The PSA models high head recirculation as an alternative to low head recirculation for removing core decay heat during small LOCAs.
High head recirculation requires the availability of a HHSI pump and two RCFCs.
The HHSI pump recirculates sump water inventory through the core.
The RCFCs provide adequate heat removal capability at elevated containment temperatures.
The condensate generated by the RCFCs replenishes the sumps for recirculation.
Therefore, the PSA does not require an RHR heat exchanger for high head recirculation.
However, by procedure, low i
head recirculation is the preferred method for long term core decay heat removal.
Low head recirculation requires the availability of a
LMSI pump and its corresponding RHR heat exchanger after the operator successfully depressurizes the reactor coolant system.
The basis' for the use of two RCFCs to remove containment heat during recirculation phase is engineering judgement based on discussions with Westinghouse PRA personnel and technical analyses similar to that included in the SNL draf t report.
Westinghouse personnel who had performed similar PRA analyses on its plants have indicated in discussions with HL&P personnel that it was their judgement that two fan coolers alone are adequate for decay heat removal after successful RWST injaction and after switchover to recirculation.
In addition, an evaluation was performed by PLG which led to the same conclusion.
Thus it has been assumed in the PSA that two RCFCs
- alone, after successful injection and initiation of recirculation, will prevent containment overpressurization.
As indicated by the SNL reviewer, and referring to the attached figures from the STPEGS
- UFSAR, core decay heat generation at approximatgly 4000 seconds (Figure 6.2.1.1-18) is approximately 200 x
10 BTU /hr.
It can be seen from Figure 6.2.1.1-3 that the 0
hegt removal rate of two RCFCs at 280 F is approximately 220 x 10 BTU /hr.
If it is assumed that recirculation is initiated at
p~
&TTACHMENT 1 pQg3 17 Of 43 1216 seconds which is the case fo't the design basia LLOCA (Table decay heat injection at that time is,approximately 6.2.1.1-10g, BTU /hrandcontainmentandsumpvaportangeraturesage 300 x
10 as shown in Figure 6.2.1.1-11 (approximately 235 F and 260 F respectively).
Reference to steam tables indicate that containment -vapor temperature and pressure increase due to the excess decay heat injection over removal rate during this period will not result in exceeding design containment pressure of 71.2 psia..
Subsequently, decay heat injection is exceeded by the RCFC
. removal rate.
4
STPEG8 UFAAR TA313 6.2.1.1 10 (Continued)
. (
AccintNr cmt0NotDCY 8.
Most Severe Hot 145 Break Double. ended cuillotine Break with Max $1, Min CHR$
Break Type:
U ma (Emeenda)
IXRAL o
Break occurs 14.2 Accumulator injection begins 18.5 Peak Containment pressure during blevdown 21.0 ECCS injection begins 21.0 End of blowdown 37.4 kginning of fan cooler operation 39.3 Peak Containment pressure 82.6, Reginning of Containment spray injection 103.7 End of core reflood Containment pressure is 50 percent of design value 216.0 :
1,216.0 kginning e.f recirculation l
6.2 77 Revision 0
7, i
e s
X y
s I
f f
\\
/
uo o
I E'
8 8
8 8
2 n
n
}
SOUTH TEXAS PROJECT (s4/niq)18H O WO10Y3W UNITS 1 & 2 I
REACTOR DF4AY HEAT Figure 6.2.1.11s Revision 0
,.m.._,___-...,....
Q
~
J l}
og L
E *W l
E l
C E
N n s-W I
l' E
(
~~
-Q I-o<
g N
8 i
'N E
N O
h
\\
w N 3 x
N 8o x s h.
8
't
\\ s e
%\\
C
-N e
g g
g f@
@ hk h
e O
p e
e (aq/ngq)ntovd AoW38.LY3H SOUTH TEXAS PROJECT UNITS 1 & 2 FAN COOLER DUTY CURVE i
PER UNIT Revision C -
Figure 6.2.1.13
-.~
~ _..
f.
I i
i.
e
/,
S
/
)
2 f
/
i s
/
s s
g s
?
?
/
s p
s
/
n s
l f
N s
\\
\\
}
9 N
y O
~~
s
/
p c-s g
\\
o f,
(
K
._,.8 o
N N
j N
4 o
,1
. c..
N i
g
,i.
1 N g N
I
.)
% N
+
ln j,
,1 i
i o o o o o o o o o o o e-o o o o'o o o o l
o e CD 6 so o t M N e o m to 5 e o T M N 1
e *= w e
=e e
en n N N N V: NNNNNNe U)3N3N SOUTH TEXAS PROJECT I
UNITS 1 & 2
.LOCA 2 CONTAINMENT VAPOR AND SUMP WATER TEMPERATURES Figure 6.2.1.1 11 Revision 0
-=== ^ -~~ ~~~ ~ ~'~~ ~'~' ~ '
i e1 L
{
J
.ap-y
]
n Q
/
2 F
2 5
N N og 1
79.
g g
g a
i
=
(5 sd)38nSS3Wd SOUTH TEXAS PROJECT 1
UNITS 1 & 2
. LOCA.2 CONTAINMENT PRESSUR Figure 6.2.1.15 Revision 0
ATTACHMENT 1 P;go 18 of 43 IE10:
The assumption of no early containment failure is not discussed.
(Section 2.1.8 of the Sandia Interim Report on the STPEGS PSA Review)
Response
Early containment failure in the context of the Sandia review is not an issue for large dry PWR containments.
Early containment j
failure due to the causes identified in the Sandia review will be investigated as part of the Level' II analysis requirements of i
Early containment failure is typically defined as failure of containment at vessel failure or slightly after.
The key point is early containment failure for large dry PWR containments occurs-after the onset of core damage (see Sandia comments on page 11 of the draft report on causes e.g. direct containment heating only occurs in high pressure atit scenarios at vessel breech, in-vessel steam explosion occurs during core slump (severe damage)).
The PSA is a
Level I model that stops when core damage occurs.
The Level II analysis will investigate the likelihood and consequences of "early" containment failure after core damage.
a l
t 1
i
ATTACHMENT 1 P2go 19 of 43 IE11:
The three-inch criterion for containment pressurization is not justified.
(Section 2.1.8 of the Sandia Interim Report on the STPEGS PSA-Review)
Response
The Sandia= comment refers to the classification of hole sizes in the STPPSA event tree analysis of containment isolation failures.
In the STPPSA and in other PLG PRAs on Westinghouse plants with large dry containments, penetrations that communicate with the RCS and/or the-containment atmosphere having lines with inside diameter of 3"
or less are classified as "small" and those with diameters of greater than 3"-
are classified as large.
In the context of a
Level 1
PSA this distinction has an impact'on the plant damage state assignment-but does not impact core damage frequency.
The selection of the 3" value is based on work in the full scope Level 3 PSA for Seabrook (see Section 11.3 of PLG-0300) to examine self-limiting containment failure modes.
It was determined that, for a
hole size of about 3 inches, the containment pressure would rise until an equilibrium was reached between the pressurization driven by decay heat and containment leakage at a
level of pressure that would not seriously challenge the structural integrity of the containment.
The attached figures from the SSPSA show that:
the probability of gross containm failure for WET 0
sequences at 150 psia is less than 10~gnt(Figure 11.3-14) at 21-22 hours'after shutdown, a 3-inch diameter hole will l
O prevent pressurization beyond 150 psia for wet sequences (Figure 11.3-1)
O at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after shutdown for the TE sequence, contain-ment pressure is about 145 psia (Figure 2.2.4-1A)
In Section 16 of the STPPSA a detailed qualitative comparison was made between the STP and Seabrook containments with results that point favorably to the use.of this type of information from Seabrook on STP.
The key difference between the SNL calculation and the Seabrook calculation was the use of the 71.2 psia design i
pressure by SNL vs.
150 psia for Seabrook.
The STPPSA documentation should be revised to state that 3" would lead to a pressure rise toward equilibrium conditions at an elevated pressure much less than that needed to seriously challenge containment structural integrity.
Having stated' this, it should be noted that all the penetrations that meet the. criteria for containment isolation considerations of diameter 3"
or less were classified as
- small, and full pressurization to failure was then assumed for no containment heat i
removal sequences.
The largest penetrations classified as small L
i u'
ATTACHMENT 1 Pag 3 20 of 43
.c.
- were the 3"
RCP seal-return.land CVCS letdown lines.
The only penetrations greater :than 3"-
that were classified as large, no pressurization-type-sequences that met the criteria of communicating with.the RCS and/or the containment atmosphere were the containment:
purge lineg whose diameter is 18" and in.
Hence, the STPPSA results.would
-l corresponding area is 254 be no different if the criteria were changed to read,.aall j
penetrations of 18". diameter or greater are considered.large and anything smaller is considered'small."
6 I-c-.
+. - -
~'
..)
i
,,ww---
2
,ggy
~
10T AL F AILURE b
,RissuR E,
_ ~
- = w. '
y-
~ _ _.
/
/
BENION (TYPE B)
,\\
/
/*
F AILURE. WET
\\/
/
SEQUENCES,
/
/
/
/
,n 1
- b. '
E CROSS (TYPE C1 F AILURE. WET
/
SEQUENCES
,/
/
/
I t 'o =
/
~
2
/
/
o I
E
,I a
h
~
8-I I
L
/
a 10 2'
/
~;
j I
I i
I
/
10 :
l I
I I
/
l I
5 I
I I
I 10 14 0 100 180 200 220 240 200 PRELLURE (PCIA)
FIGURE 11.3-14.
COMPOSITE CONTAINMENT FAILURE PROBARILITY DISTRIBUTIONS FOR BENIGN FAILURE, GROSS FAILURE, AND TOTAL FAILURE k
11.3-42 e
i m
w T
N O
I r
Y T r T
T a
R i e E
C M8 O
t t
t w
N t
4 A A A
8 1
t U
5 S s S F
P P
P P
0 0 o 0 8
5 s 3 A
1 i 2 S
A y
E R
S D
IN A
RW s
O e
ED n
RT I
UU o
TF SA E
3 RE
~
RM b
AI 0
T 6
O 1
I 4
TD t
I w
i
^
f O
DA D
E T
0 J R,
f 2 n IE os UR st QU E
ES T
RS s
A E
E AR a
EP 9t R
T A,
E KP AY 872 ET L
X E
5 TC 2
l l l l X.
EE MU 5
o g
2 s
Q f
x
(
lE S
AS N
T O
F I
T 0O A
0 R
T E
N E
P 1
3
-3 1
1 8
\\
E R
c U
5 0
5 7
s G
2 2
1 I
b5EIs 5bs F
I b d l
.D lo l
}
CY l
\\
ll<
~
Yk~
?
~
5u g
l
,8
,iii,
,?i lig a
a m
t a
e i.m.
m 55J E
SA C
E T
HT R
d f5J F
Y T
E I T o
4 f
VU t
a I
(
T t
5 f
CY e
O R
T RO t
S i
A O
n V
t T
E TR i
A M
CO t
D i
AO T
t l
EL 9
O A
RF T
T S
P l
A f
i 0
L h
C E
C0(
f5; R
l C
U 5
0 S
N C
A S
a E
ts R
t P
A i (t
T t
l tn l
e E
I 1
l A f
m i
a1 l
0 T 5 l
0 u P.
A 8 o T
0 C1 f
A 0
f0
( (1 5f P C
f54 L
A 1
4 2
2
- r
~
E RU G
I F
o5 it58 6
f, l
0 0
0 o
0 0
0 0
0 0
0 0
0 0
o, 0
0 0
0 0
5 0
3 0
0 7
5 3
0 3
0 5
2 1
1 i
3 1
5 2
.2*
?NmOS t
ll Il lll
o ATTACHMENT 1 Pago 21 of 43 IE12:
I&C necessary for throttling HHSI is. not included.
(Section 2.2.2 of the Sandia Interim Report on the STPEGS PSA Review)
Response
During the HL&P internal PSA review
- process, the phrase
" throttling HHSI" was screened out several times.
The reason for this screening was because the STPEGS HHSI cannot be throttled.
A re-review of the schematic drawings for the HHSI discharge valves show the circuit is " locked in" upon actuation, thus driving the valve stem from fully closed to open or vise versa.
Therefore, the STPEGS HHSI pumps and discharge valves cannot be throttled and no I&C is available to throttle the HHSI. pumps.
The phrase
" throttling HHSI" is still present in the PSA and should be
. deleted or modified to reflect what'is stated for Event 25 on page 5.4-16 of the PSA.
This will be corrected in the next update of the'STPEGS PSA.
One other comment.
On page 14 of the SNL draft report, it is-stated that "For control of HHSI, QDPS is required.". QDPS has no control function for HHSI.
)
i
~
~
1 m
c'
&TTACHMENT 1 Pago 22 of 43 1
l IE13:
The ability of equipment in the PDP pump room to operate without forced cooling to the room is not justified.
(Section 2.2.3 of the Sandia Interim Report on the STPEGS PSA Report)
Responset A
calculation has been completed to determine the impact of loss of room' cooling in the PDP pump cubicle.
The study indicates that the-room temperature in the cubicle will not exceed approximately 112 F at the end of eight hours.
No credit is taken for mixing 0
with outside-air.
This calculation is the basis for the l.,
assumption that the PDP can be operated with loss of room cooling j
under station blackout conditions with the TSC diesel available.
)
l 1
1 l,.
l l
L 1
L
)
ATTACHMENT 1 Pago 23 of 43' IE14:
The exclusion-of instrument air'(IA) from the mitigating systems-is not clearly justified.
(Section-2.2.5 of the Sandia Interim Report on the STPEGS'PSA Review)
Response
Instrument air is a-non-safety system at STPEGS' and is not required for safe shutdown of the plant.
Many such non-safety systems were screened in the early stages of the PSA and are not described in the final PSA.
The exclusion of instrument air as a support system is based upon the system screening process described in Chapter 4.2 (Section 4.2.1.2) of the-PSA.
This system is only one of many that were screened-from analysis in'the PSA because their failures did not affect successful-operation of the systems which were analyzed.
Loss of instrument air is-included as a unique' support system failure leading-to an initiating event as described in the Sandia review.-
Justification of the exclusion of instrument air and other systems is included in system notebooks at STPEGS.
Including justification of the exclusion of this system would force inclusion of the justification for other unnecessary systems and is not felt to be warranted in the PSA.
t l'
l l-(
ATTACHMENT 1 Pago 24 of 43 TE151.
The-ability of EAB NVAC to provide adequate cooling in a once-through mode with no cooling provided to AHUs is not explicitly justified.
(section 2.3.2-of the Sandia Interim Report on the STPEGS PSA Review)
Responset Sections 12.2 through 12.5 of the STP PSA addresses the analysis performed to determine the success criteria for EAB HVAC.
In particular, these sections present the basis for a very detailed evaluation to show that the use of the EAB HVAC system in the once-through (smoke-purge) mode will be effective in preventing components in the EAB from overheating.
ATTACHMENT 1 P0go 25 of 43 IE16:
The acceptability of one steam generator in removing decay heat without its PORV being available is not clarified in the System Description for AFW.
(Section 2.3.2 of the
'Sandia Interim Report on the STPEGS PSA Review)
Response
The PSA requires various combinations of AFW pumps and steam
-relief valves depending on the' initiating event and the operator response modeled.
First, each AFW pump is assumed to be dedicated to its associated steam generator, thus no credit is taken for the air operated AFW crossover valves for alternative alignments.
For
- example, the-plant model accounts for the possibility of an AFW pump delivering flow to a
steam generator experiencing a tube rupture or steam line break, thus requiring the availability of at least-a second AFW pump to deliver to an unaffected steam generator.
- Second, for the operator to depressurize a steam generator and maintain adequate decay heat removal, at least one AFW pump and its associated PORV must be available to an unfaulted steam generator.
The setpoint for the steam generator PORVs can be adjusted manually by the operators, thus providing them the ability to depressurize the steam generators and the RCS for scenarios such as SGTR.
However, most initiating events simply require decay heat removal which can be performed at Hot Standby q
conditions.
The PSA assumes that one AFW pump and adequate steam relief (i.e.,
the PORV or two safeties) are adequate for decay heat' removal at hot standby conditions without challenging the pressurizer PORVs.
For ATWS
- events, two steam generators and their associated AFW pumps are required.
. Reference 71 in the AFW System Description is summarized in the PSA in a.very' brief simplified way.
Reference 71 discusses the results ~ of a conservative study performed by Westinghouse for the Loss of Normal Feedwater and Feedwater Line Break events.
The success-criteria for this study was that the pressurizer will not go solid.
The study concluded that AFW flow to one steam generator without operator action to lower the steam generator PORV setpoint within 20 minutes would result in the pressurizer going solid.
Failure of this criteria does not necessarily result in core damage, but does challenge the pressurizer PORVs.
The PSA correctly models this pressurizer PORV challenge.
a.
ATTACHMENT 1 Pega 26 of.43 IE17:
The-screening of high and. medium energy line breaks and cracks as initiating events except for LOCAs, main steam line
- breaks, and feedwater line breaks is not justified.
(Section 3.1 of the Sandia Interim Report on the STPEGS PSA Review)
Response
High energy line breaks are included in the PSA as described in Chapter 5.
Medium energy line breaks (e.g. ECW, CCW, IA) are included as system initiators.
Breaks in specific locations are not described-or analyzed in the PGA as the general categories of breaks analyzed bound these other specific breaks.
For the example cited, a break in the steam supply to the turbine driven AFW
.i-i ATTACHMENT 1 Pcgo 27 of 43-IE18:.The justification-for excluding core blockage as an initiating event is not provided.
(section 3.1 of the-Sandia-Interim Report on the STPEGS PSA Review)
Response
i In Table 5.2-6 of the STPEGS PSA, an initiating event category 1 is' identified which includes " core blockage / boron precipitation" as one. possible-event.
This event was not considered further for quantification in the PSA (Table 5.2-7).
NUREG\\CR-2300, the PRA Procedures Guide, -does not list core blockage / boron precipitation in its list of PWR initiating events for consideration (see Table 3-4).-
In Table 3.5, a
few examples are given of possible initiating
- events, including core flow
- blockage, which may be identified from the use of a master logic diagram.
The possible cause identified with the example is corrosion or crud buildup.
A review of other documents including the Indian Point PSA, the Seabrook
- PSA, Wash
- 1400, NUREG-1150, and EPRI NP2230 does not reveal the consideration of such an initiating event.
3 Boron precipitation during power operation of the plant is not L
considered a credible event (boron precipitation during a cold leg LOCA is addressed in question IE5).
Corrosion / crud buildup would result in fuel
" leakers" but would likely not result in a plant trip.
Even if it did result in a trip, it would look like a transient and would be considered to be in the transient initiating event frequency.
Both STP units have gone through extensive preoperational/ acceptance testing of all safety and many non-safety
- systems, including several weeks of hot functional testing of.the primary system prior to fuel load.
In addition, initial startup testing included ascension to full-power testing encompassing approximately six months. _Section 14.2 of the UFSAR l
describes in some detail the preoperational and startup tests performed.
In
- addition, the NSSS includes a
Loose Parts Monitoring System as described. in the UFSAR in Section 4.4.6.4.
The core blockage as an initiating event was screened from consideration due to the extensive testing performed, the 1
extensive and continued monitoring for loose parts in the NSSS, and the experience base which indicates that the event would be a very low probability event.
1 1
!l
=,.
ATTACHMENT 1 P go 28 of 43 i
IE19 Units in the data base tables of Section 7
are not provided.
(Section 3.4.2 of the Sandia Interim Report on the STPEGS PSA Review)
Response
The description of the bacic events conta!.ned in the PSA data base is felt -to sufficiently define the units, e.g. failure on demand implies per demand
- units, failure during operation implies per operating
- hour, maintenance frequencies are per hour, maintenance durations are in hours, etc.
IE19a: It is impossible t'o.tell from the tables of the PSA data base which types' of-distributions are used for each frequency distribution.
(Section 3.4.2 of the San'dia Interim Report on the STPEGS PSA Review)
Resoonse!
This statement is true but incomplete.
The types of distributions are completely described in-PSA reference 7-17.
This data base is proprietary;
- however, the data base was made available'for review by Sandia during the November 1989 plant visit.
H ATTACHMENT 1 Pag 3 29 of ' 43
- IE20
'The-majority of Lthe: values used for the Human Error Rates-(HERs).are ' conservative,.the remainder are similar. to
. values: used. in other.PRA studies.
The HER values used do
'not seem unreasonable but, how these values were derived'is not always clear.
(Section 3.4.5 of the Sandia Interim Report on the STPEGS PSA Review)
Responser Attachment 2 responds to the questions raised by SNL in~its review of Section.3.4.5.
i
)
i
ATTACHMENT 1 Pago 30 of 43 l
IE21:
The table of the twenty one dominant sequences which identifies split fractions contributing to each sequence, Table 3.6-1 is not included in the PSA.
(Section 3.6 and Section 4.3 of the Sandia Interim Report on the STPEGS PSA Review)
Responami The top twenty-one dominant sequences are identified in the PSA in Table 2.1-3.
However the sequences are not characterized in terms of the split fractions which make up the frequency of occurrance The characterization of the split fractions is of the sequence.
left to the verbal description of the failures that make up the sequences 'in Table 2.1-3.
Approximately 1200 sequences make up the dominant sequence model, each sequence of which is a combination of split fractions.
The dominant sequence model represents those sequences which total approximately 85%
of CDF.
The twenty-one sequences are a very small fraction of the total.
The intent of the PSA is to convey the results of the analysis and the higher level detail of the models and the quantification process (consistent with IPE, NUREG-1335, requirements).
Much of the detailed quantification documentation was not
- included, including the dominant sequences (the 1200 and therefore the 21).
When it was recognized that the greater detail on the 21 sequences would facilitate the review
- process, this detail. was quickly supplied.
This detail is now appropriately included in the SNL review package (i.e., Table 3.6-1).
- - - - - ~
. - - ~ -. _ _ _ _ _ _. - _ _ _ _ _ _ _ _ _. _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _
-ATTACHMENT 1 POgo 31 of 43 IE22:
Quantification of LOSP sequences are such that the exposure time-for the DGs and the time.for recovery of offsite power are inconsistent.
(Section 5.1.of the -Sandia Interim Report on the STPEGS PSA Review)
Response
The quantification of electric power recovery after a loss of on-site and off-site AC power is described in the PSA.
The quantification of recovery is based upon a time sequenced recovery model described in Chapter 15.6.
In this model, consistent exposure times and recovery times'are used (also see question IE20 and the response in Attachment II).
The process used to quantify offsite power recovery and diesel generator run times is vague.
The following paragraphs-are provided to briefly describe the process used, j
The diesel generator systems analysis-quantified the likelihood of diesel generator failure for a
24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time to be consistent with the mission times for the other systems analyzed in the PSA.
The results of the system analysis were used in the electric power event tree as a
screening value to identify important core damage sequences resulting from. loss of'offsite power and failure of the emergency diesel generators.
These important core damage scenarios were then analyzed in detail to determine times available for recovery of offsite power and/or
. diesel generators given the plant conditions that exist for the sequence.
A time sequenced model for offsite power and diesel generators was then quantified for each important scenario.
The sequences identified in the top 21 core damage scenarios are actually the result of the time sequenced quantification of loss of offsite-power and diese'. generators with appropriate allowance for the frequency of rr.covery of the offsite grid and/or the diesel generators.
Section 15.6.2 describes the time-dependent power failure analysis in more detail.
ATTACHMENT 1 Pago 32 of 43 7
Additional Commentst SECTION 1.1 - METHODOLOGICAL OVERVIEW This section presents a fairly accurate description of some of the key differences between the approach to PRA utilized in the STFEGS PSA (the "PLG" methodology) and the one the NRC is more familiar with.
The following discussion is provided to further clarify and enhance the reviewer's understanding of the PSA methodology.
In addition to the points raised in the second paragraph, there-are very important aspects of the PLG approach to modeling dependencies that are not mentioned here.
First, before the event trees are constructed, great emphasis is placed on the development of a
firm understanding of the
- plant, its dependencies and interactions.
. This understanding is documented in the dependency matrices (Section 5.3.1) and the event sequence diagrams (Section 5.4) and reviewed with plant operations personnel long before the event / fault tree models that are derived from them are developed.
It is-correctly noted that the resulting sequences are presented differently.
One key difference is the explicit representation of the. dependent failures in the sequence descriptions.
This serves more complete description of the sequence which pays to convey a
dividends in reviewing the results and in performing the human reliability analysis.
Cutset information is contained in the PLG approach.
The fourth paragraph of this section of the Draft Interim Report is incorrect in saying the PLG approach has no cutset or basic event representation.
The cutsets and basic event representations are there,- they are just packaged differently.
PLG's methodology relies on
" success paths" in block diagrams.
The information contained in the block diagrams is manipulated as described in Section 4.2 of the PSA to produce the equation files contained in the PSA system descriptions (Volume 9).
These equations contain the same logical information that is contained in a list of minimum cutsets.
The systems analysis documentation includes equation files and cat!se tables that permit the identification of cutsets and basic event probabilities to the split fractions.
The key difference is that cutset contributions to entire sequences are not provided.
Such information can.be generated, if it is needed, from information presented in the report.
There is a
different philosophy behind the PLG approach that renders the cutset and basic information to be relatively less useful.
Because of the more detailed representation of the accident sequences, experience indicates that opportunities for the development of engineering and risk management insights such
ATTACHMENT 1 P;go 33 of 43 SECTION 1.~1 Continued as those' developed in the STPPSA have been available without the extra analysis that would be needed to generate sequence level cutsets and importance measures.
The characterization of the differences as
" fundamental" is incorrect.
The two methods are fundamentally equivalent.
As
- noted, there are commonalities between the common cause data bases used in the STPPSA and NUREG-1150.
However, it should be noted that the STPPSA common cause analysis followed NUREG/CR-4780 very closely,' whereas NUREG-1150 did not.
For
- example, NUREG-1150 did not screen the data base for applica-
'bility to the-analyzed plants as called for in NUREG/CR-4780 and done in the STPPSA.
It is strongly concurred that both methods will produce correct results when applied properly.
i l
I
- sw.
a ATTACHMENT 1 P2gs 34 of 43' SECTION 1.2 - LIMITATIONS OF THE ANALYSIS Exception is. taken to some of the Limitations that are listed if the phrase "not treated here" is meant to be "is not treated in the STPPSA."
Some partial failures are modeled in O
Parti'al Failures the-event trees and others are considered in the formulation of success criteria.
There are other' aspects of partial failures that are not considered.
The probability that systems will not O
Desian Adesuaev operate due to design adequacy is partially treated via the common cause analysis.
The same is true with adequacy of procedures and similar parts related common cause.- In
- fact, it is considered that the latter is treated to a high level of completeness in this PSA.
A great deal of O
Environmentally Related Common Cause effort was made in the spatial interactions task to treat this issue.
Part of these are included in the common cause analysis.
It is-agreed -that no consideration was given to aging and sabotage.
The break-in portion of the data base was partially removed in the component data
- base, however, so that the STPPSA. results do not' apply to the first few months to a year of operation.
4
?
KTTACHMENT 2 pago 35 of 43 l
SECTION 3.4.5 - STP PSA HUMAN RELIABILITY ANALYSIS.
The reviewers' thoughtful, in-depth comments on the human reliability analysis (HRA) methodology and documentation are well-taken.
Many of the reviewers' comments pertain to issues related to the qualification, validation, and theoretical justifications-for the PLG adaptation of the Success-Likelihood Index Methodology (SLIM).
Although many of these concerns address broadly troublesome topics, it should be acknowledged that the same, or directly analogous, concerns have been voiced in many arenas about every contemporary HRA methodology.
Indeed, the only uniform consensus among HRA/PRA practitioners is that no-currently available methodology provides
- precise, theoretically verifiable, numerical-predictions for human performance during the types' of conditions typically modeled in modern PRA studies.
- However, it should not be inferred from the preceding statement that it is a fruitless academic exercise to attempt the quantitative evaluation of human reliability.
Consistent, quantitative estimates of human error rates and their associated uncertainties are a necessary and important part of any meaningful risk assessment.
However, it is also vitally important to openly acknowledge the fact that, while it is very desirable to strive for "the" methodology that will accurately predict numerical human reliability estimates from qualitative information about human behavior, that methodology has yet to be discovered.
The best that can be done is to ensure that the estimation processes that are used produce
" reasonable" numerical
- results, account for the associated uncertainties, and do not contradict actual experience or informed-expert opinion.
That is, without deference, the current state-of-the-art in applied HRA.
A conscious decision was made not to encumber the STP PSA documentation with voluminous descriptions of the
- bases, background, and justifications for the methodologies applied
-in any part of the study.
After consideration of the detailed
_ hich could be elicited from the reviewer's comments w
response in the Draft Interim Report (DIR), it is HL&P's judgement that an item-by-item written response to each concern raised in these review comments is not warranted at this. time.
In-depth discussion of the HRA methodology is scheduled for meetings on May 30 and 31, 1990.
Any remaining concerns will be documented at the conclusion of those meetings
- and, if necessary, detailed written responses will then be prepared.
b ATTACHMENT 2 Pego 36 cf 43 The following sections will briefly ~ address some of the reviewers' more significant questions and concerns'about the HRA methodology..
These responses do not necessarily address each topic comprehensively or completely,;but they will serve to. focus the discussions at the May meeting.
It is agreed with the reviewer that any HRA methodology should allow an independent reviewer to reproduce the results, or to at least understand the process that was used to produce the results.
Therefore, because the ruviewers concur that the final-STP PSA numerical human error rates (HER) are either somewhat conservative or are consistent with those produced by other methodologies, the questions that relate to "how we got from the beginning to the end" of the analyses will be addressed in the following sections.
Responses are ordered according to the issues raised for each specific section of the report.
SECTIONS 15.1 AND 15.2 It is considered that there are at least three significant advantages that 'have been achieved from the PLG adaptation of SLIM.
0 Detailed documentation of ooerator inout.
The scenario evaluation sheets (e.g.,
STP PSA Tables 15.4-31 through 15.4-38) clearly document how each polled group of experts has assessed each human response scenario.
It has been found that most plant operators feel more comfortable i
assessing.the
" degree of badness" for each performance shaping factor (PSF).
This is one of the most significant reasons that lead PLG to transform the SLIM analysis to calculate a " failure likelihood index."
Specifications of the H,
M, and L weights also allows the operators to provide separate inputs to more carefully shape their-assessment of each PSF.
For example, no procedures may be available to guide a specific action; this would indicate a
"relatively bad" rating of 10.
However, there may be general agreement that the use of procedures for this activity is relatively unimportant; this would indicate a weight of L.
Thus, the operators can provide quantitative and qualitative guidance for such traditional classifications as
- skill, rule, or knowledge-based behavior without being unduly confined to a set of rigid criteria and predefined categories.
The tabular displays afforded by these evaluation sheets also ensure internal consistency among the assessments within each group of experts.
Observations of more than 25 expert teams have shown a
uniform trend for each group to go through a
y, ATTACHMENT 2 Pago 37 of 43 e
i "self-calibration" process during the early stages of the evaluations.and to maintain subsequent consistency through continual' cross-checking among their assessments.
It should also be noted that after some initial skepticism, the evaluation process has reewived very enthusiastic support from licensed operating crews at several plants.
O Direct auantification of uncertainties.
Variability of the assessments within each group of experts and variability of the assessments between groups are used directly to quantify the uncertainty in the numerical HER estimates.
- Thus, if all groups of-experts are in close agreement about a
particular
- action, the resulting-numerical uncertainty distribution is relatively narrow; if there is a
wide variation among the
- groups, the numerical uncertainty is correspondingly increased.
The final HER uncertainty distributions are not arbitrarily constrained to a
predetermined analytical form, and the uncertainty bounds are not simp,1y assigned by a single HRA analyst after a point-estimate central tendency value has been calculated.
0 Oualitative insichts and identification of areas for imorovement.
The scenario evaluation sheets provide valuable information for plant engineers, trainers, and operators, regardless of the numerical HER values.
Several changes have been made to plant instrumentation,
- controls, procedures, and training programs based only on reviews of the evaluation sheets.
For HERs that are quantitatively important to the PRA
- results, the evaluation sheets provide a method for quickly identifying the most important areas for improvement (e.g., PSFs with numerical ratings and a weight of "H").
Estimates of the quantitative effects from proposed improvements can be made quickly by appropriately adjusting the affected PSF ratings.
-The set of seven PSFs used for the STP PSA was adopted after a number of trials to determine an appropriate balance among concerns about completeness, independence of the PSFs, detail in identification of all possible influences, and evaluation efficiency.
It is believed that the set of seven is a reasonable compromise among these attributes, and PLG is using this same set for all of its studies.
In striving for completeness and detail in previous analyses, it was initially believed that "more must be better."
PLG has tried (in one study) to use up to a total of 22 PSFs.
Unfortunately, the PLG experience has shown that large numbers of parameters have two negative effects on the HRA results.
The most important is that the experts became overwhelmed by-the evaluation
- process, and the care and quality of their assessments is diminished.
A large number of PSFs would certainly provide somewhat better definition if only a few actions were being evaluated.
However, a typical PRA contains 50 to 100 dynamic l
=
ATTACHMENT 2 Pago 38 of 43
- actions, and the enormity of the enumeration task causes most operators -to quickly lose interest.
Dividing'the e' valuation process among several separate sessions for each expert group is impractical, because it creates difficult scheduling problems and brings into question the internal consistency of the evaluations.-
A second effect noted from applying a.large number of PRFs is a tendency for all actions to converge to a fairly small range of HER values.
PLG has not investigated this phenomenon in
- detail, but the sense is that it is very difficult for experts to adequately express extremes in their opinions when a-large number of parameters must be assessed.
The
" operator response form" noted in STP PSA Section 15.2 is the
" scenario sheet" that briefly describes the situation-and the required action (e.g.,
STP PSA Tables 15.4-1 through 15.4-30).
The experts are first briefed on the PRA models for the plant using the event sequence diagrams and their associ-ated documentation.
This briefing provides the context for each action and orienta the experts to the analysis process.
The
" scenario sheets" are then used to prompt the experts to the specific conditions surrounding the action to be evalu-ated.
Additional information may be supplied by a member of the PRA team who monitors each PSF evaluation session.
- However, extreme care is exercised to not unduly influence the experts' assessment by providing explicit or implicit clues about possible actions, available procedures, alarms, indica-tions and other guidance /etc.
The scenario descriptions must provide enough information for experienced personnel to understand what is happening in the' plant when the desired
.s requested.
- However, overspecification of the i
action information tends to remind the experts about conditions that they may not otherwise
- consider, and it generally leads to more optimistic evaluations.
During-the briefings prior to each evaluation session, it is requested that the group of experts try to reach a consensus-value for each PSF rating and weight that they assign.
This is reasonable, because a
consensus will-be reached during a real accident response scenario.
(If there is a dominant individual to the
- group, this person will control the consensus. opinions to both the evaluation process and during actual response).
- However, we also advise each group-that irreconcilable differences should be noted in the " Remarks" column of the evaluation sheets with the corresponding values.
(Although animated discussions often occur, signif-icant lingering differences of opinion are quite rare.)
The PSF ratings-are varied during the HER quantification process, including any explicitly noted differences, to provide numerical estimates for each group's uncertainty.
Variability among the estimates from all the groups is also explicitly used to quantify the composite uncertainty for each final HER probability distribution.
4 4 '
ATTACHMENT 2 Page 39 of 43 The LOTUS 1-2-3 program serves two principal functions during the HER quantification process.
Simple spreadsheet sort and merge operations are' used to compare the normalized PSF weights from each set of experts during the action grouping These functions allow the HRA analyst to efficiently process.
examine similar patterns among the PSF weights and to asaign individual actions to the appropriate groups.
Rather than using such predefined categories as
- skill, rule, and knowledge-based
- behavior, the grouping process simply aggregates all actions that exhibit similar patterns in the l
l PSF weights.
In this manner, a typical population of 50 to 100 PRA actions is usually divided among approximately 3 to 8 groups of differing sizes.
The second function performed by the LOTUS 1-2-3 program is a
numerical-analysis that
' determines a
best-fit curve for the input calibration task index and HER
- values, calculates the
" failure likelihood index" for each action being evaluated, and stores the corresponding _ point-estimate HER from the calibration cu ve.
SECTION 15.3 Many of the references for Section 15 of the STP PSA report were regrettably omitted.
The HER values in STP PSA Tables 15.3-1 and 15.3-2 are based on the information in Tables 15-3 and 14-1, respectively, from Swain, A.
D.,
and H. E. Guttmann,
" Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications,"
NUREG/CL-1278, U.
S.
Nuclear Regulatory Commission, August 1983.
The miscali-bration HER distribution presented in STP PSA Figure 15.3-1 and Table 15.3-3 is taken fror the analyses in Appendix D, Section D.6.3.2.2.2, and relate Section 6.5 of the Seabrook PSA (Pickard, Lowe and Garric.',
Inc.,
"Seabrook Station Probabilistic Safety Assessment,' prepared for Public Service company of New Hampshire and Yankee Atomic Electric Company, PLG-0300, December 1983).
RISKMAN is the name of the PLG-proprietary software for the integrated analysis of data, systems models, and event trees.
The RISKMAN designators mentioned on STP PSA page 15.3-2 are the database event names tabulated in the first column of Table 15.3-4.
These event names are used to identify the corresponding HER distributions in the RISkiAN database and in the STP PSA system analysis equation files.
The designations in Table 15.3-4 are admittedly somewhat confusing and appear to have suffered from editing problems during production of the report.
The reviewers have correctly deduced that the reference to Table 15-6 should instead be a reference to Tables 15.3-1 and 15.3-2.
A second typographical error was made in the first entry labeled "ZHE01B" ("On completion of ECW... full-open position").
This entry should be labeled "ZHEOIA".
The tabulated HER distribution for this
h ATTACHMENT 2 POg3 40 Cf 43 entry is identical to the.ZHE0IA HER distribution that is applied to three other entries noted in Table 15.3-4.
The mean HER for designator ZHE01A is 6.lE-03, and the mean HER for designator ZHE01B is 9.4E-03.
Section 15.4 The event sequence diagrams and event trees documented in STPPSA report Section 5
are the basis for the full STPPSA plant
- model, including all dynamic human actions.
These models were reviewed by the PLG PSA project team, the HL&P PSA project
- team, and STP plant operations and training personnel to identify and confirm the human actions.
No screening values were used to perform a preliminary ranking of the dynamic human actions in the STPPSA.
As a result of the detailed reviews of the event scqJance diagrams and event
- trees, actions were classified into two categories for quantitative analysis.
Those actionc judged to be important for the Level I core damage results, the Level 2 interfacing plant damage
- states, or for general understanding of event st-7uence progression were quantified using the detailed ac tysis methodology described in STPPSA report Section 15.
A14 other potential human actions were left unquantified; that is, a
failure rate of 1.0 was used as the effectiva screening value.
This approach avoids well-documented problems from other quant ification methodologies that result from the broad application of
" conservative" HER screening values.
These
" conservative" estimates are often combined independently through the event model quantification. logic to produce excessively. optimistic estimates for the composite HERs within the full accident scenarios.
The resulting sequence or cutsot results are then eliminated from further examinatior., because they are subjectively characterized as being both "conserva-tive" and " quantitatively insignificant."
The seven PSPs described in Secti,n 15.2 are the fir.al set used for the expert evaluations and the HER quantification.
The human action scenario sheets (e.g., STPPSA Tables 15.4-1 through 15.4-30) and the event sequence diagrams were given to the evaluation teams prior to each evaluation session.
Each team also had available a full set of t5e STP plant drawings, all procedures, and the emergency response guideline background documents.
The first portion of each evaluation session included one to two hours of train!ng on the HRA evaluation methodology and probabilistic analysis.
No formal debiassing training was performed.
However, the results from the eight evaluation teams were thoroughly reviewed by the HRA analysis to check for possible biases.
No uniform biases were obse rved.
At least one member of the HRA team monitored each evaluation session.
The HRA analyst answered selected questions about event sequence progression but did not supply
1 ATTACMMENT 2 P;g3 41 ef 43 information about postulated operator performance, procedures, alarms, etc.
i The evaluations documented in STPPSA Tables 15.4-32 and 15.4-33 were performed early in the analysis process.
These early sessions were planned to orient senior GTP plant train-ing and operations personnel to the evaluation process and to receive feedback on the human action scenario descriptions, information
- content, and possible problems to be anticipated when the control room operating crews were polled.
As a result of comments received during these evaluations, some human actions were deleted from further consideration, and others were combined to -form the final set of actions evaluated by the remaining teams.
For reference, missing STPPSA report page 15.4-73 is included with these responses.
The reviewers have correctly normalized the weights for the sample PSFs.
The minor differences between the normalized values calculated by the reviewers and those published in STPPSA Table 15.4-38 arise from the application of an intermediate
" fine tuning" step in the STPPSA calculation process.
Unfortunately, this step was not documented in the PSA report.
Some of the original PSF weights assigned by selseted evaluation teams were annotated with
"+" and " "
signs to indicate a
finer range of definition than that afforded by the simple H, M, and L designators.
The HRA team accounted for these expressed opinions by using a continuum of numerical weights between 0
and 10, rather than the three discrete values of 0 for L, 5 for M, and 10 for H as noted in the report.
Tha "+" and " " signs were also omitted frem the affected weights when Tables 15.4-31 through 15.4-38 were published.
The confusion created by these omissions is unfortunate and regrettable.
- Hcwcyor, as shown by the reviewers' calculations, the numerical ispacts from these differenens are quite minor.
The PLG HRA team assigned the PSF rating factors and weights for the calibration tasks.
Unfortunately, scheduling constraints precluded the incorporation of these task descriptions into the full set of actions that were evaluated by each expert team.
" Blind" evaluation of the calibration tasks by all the experts is certainly preferred to this method.
- However, STPPSA Tables 15.4-31 through 15.4-38 show that the PLG HRA team evaluations for the PSA actions were quite consistent with those team STP plant personnel.
These results indicate that similar consistency would also be expected from the broader evaluation of the calibration tasks by all the expert teams.
a
.W p
-. ~~
C
~
+
D.
d y-y y
3
~
.z m_.
,t M
w u
u M
~,
-[
6 6
I 3
8 9
=,
d.
L w
s e
e n
L L
s ia' a
is 8
9 I
2 9
g T* E I
M M
M M
L L
e F.
l r
5 5
S I
9 g
o 7
uc a
u M
L u
u M
T
{,
3 5
I 3
3 5
g n
o i
t a
s e,
t y
M L
w H
s h
7 a
- n
,n v
.i E
3 g
?
1, 1
I 7
l w
+
e 1
. li r
u n
M H
M e
C g
n i
t 3
9 I
8 E
3 g
arep s./
u L
H O
s L
e s
/_
m y
e m t
/
E d.
p t
I S
g f
T 4
4 I
8 ihS s
p s
a
)
m o
C o
P d
5 h
s t
.a e
e s
=
d e
a f
ts s
Mc S'
s s
o e
o
.S s
N CW er 8C O
eC 2
F e
eC t
e
.s s
t s
A e
a Sm C. o.
O r P
5R g
C C.
u w
ru Ww.
t w
wf a
re s
s s
ec
.e es S.
P q
r p n
F g e
eo e n
. r
(
e
., e e
C y,
- 0. o Cg oC o
Oo r
re p
pe 8
t 3-4 5
e 1
2 2
I 1
e A
0 C
e T
am S
C C
e c
O e
ie e C
O O
w o
O E
E t
I l
I G
H u
u H
b A
s aT Z
r89C o33-aPeyM yR ka, eoEo O3C O%:"w. P 3
I T*
]
ATTACHMENT 2 PCg3 42 Cf 43 SECTION 15.5 All PSF weights for the recovery actions summarized in STPPSA Tables 15.5-18 through 15.5-20 were normalized according to the same methodology usad for the analyses in Section 15.4.
The correct normalized weights are displayed in the LOTUS 1-2-3 output in Tables 15.5-21 through 15.5-36.
The numerical values displayed near the H, M, and L designators in Tables 15.5-19 and 15.5-20 were apparently copied from rough notes and were not deleted during the final report editing process.
Although some of these values
- are, in
- fact, the correct normalized
- weights, all numerical values associated with the H,
M, and L designators in Tables 15.5-19 and 15.5-20 should be ignored.'
SECTION 15.6 i
STADIC is a
PLG proprietary computer code that s used for probability distribution arithmetic and Monte ca sampling.
H accepts input data in any type of probability,istribution format, ' including discrete probability histograms.
Algebraic equations that describe the desired combinations of these distributions are input by the user an FORTRAN subroutines.
QDG is one of these subroutines that is used to calculate the unavailability of the STP diesel generators as a function of their operating mission time after a loss of offsite power.
STADIC is fully documented and has been verified according to PLG's quality assurance program.
If
- desired, the STADIC user's manual can be provided to the reviewsrs for a more complete description of the code and its operation.
The analytical format of the electric power recovery model is expressed,by STpPSA equationE 15.6.1, 15.6.2, and 15.6.3.
The
boundary conditions" from a specific event scenaric uetermine the expected plant response and the associated time window that is available for AC power recovert (i.e., variable t).
Fcr
- example, if offsite power is lost at time t = 0 and all three diesel generatora fail to start, different recovery time window 7 are defined by the status of the turbine-driven auxiliary feedwater pump and the positivo displacement charging pump.
Depending on the availability of staam generator makeup flow and reactor coolant pump seal injection
- flow, the amount of time that is available to restore AC power may be limited by the time for steam generator dryout, reactor coolant pump seal failure, or station battery depletion.
The tabulated probability distributions on STPPSA report pages 15.6-7, 15.6-8, 15.6-9, and 15.6-16 were input to the recovery calculations in their cumulative forms.
As
- such, the tabulated probability values were assigned to the upper end of each value range.
For example, for the table on page 15.6-9, the cumulative probability distribution shows a.
20%
probability value at a time of 0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, a 30% value at a time
I o
ATTACHMENT 2 P;g3 43 Cf 43 4
of 1.0
- hour, and a 45% value at a time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />,.etc.
The probability density at intermediate times is obtained by differentiating the cumulative probability curve through these points.
i The response time distribution tabulated on page 15.6-9 was developed by the PSA team after discussions with STP plant operations personnel, review of the STP emergency operating procedures, evaluation of typical and minimum required shift
- staffing, and actual walkdowns at the plant site.
The statement on page 15.6-13 indicates that a
detailed MAAP j
analysis could provide more refined estimates of plant i
thermal-hydraulic behavior and the associated recovery time 1
windows for selected transients.
However, it is also noted that no MAAP analyses were performed.
All recovery time windows were defined by applying straightforward mass and energy balance calculations as described in Section 15.6.4.1.
l l
l
.