ML20059M647
| ML20059M647 | |
| Person / Time | |
|---|---|
| Issue date: | 11/15/1993 |
| From: | Taylor J NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| To: | |
| References | |
| SECY-93-308, NUDOCS 9311190210 | |
| Download: ML20059M647 (33) | |
Text
..................c.....
r l
RELEASED TO THE IDR e
e p*~%
h=2 N
4 dd i
g
............... p3
(
TW e
e o, sb.,,..*g November 15, 1993 POLICY ISSUE sEcy-93-308 (Information)
FOR:
The Commissioners FROM:
James M. Taylor Executive Director for Operations
SUBJECT:
STATUS OF IMPLEMENTATION PLAN FOR CLOSURE I
0F SEVERE ACCIDENT ISSUES, STATUS OF THE INDIVIDUAL PLANT EXAMINATIONS AND STATUS l
l OF SEVERE ACCIDENT RESEARCH i
PURPOSE:
To inform the Commission of the status of the implementation of the l
integration plan for closure of severe accident issues, the Individual Plant Examinations (IPE) process and severe accident research.
SUMMARY
Progress achieved since the last report on the implementation of the integration plan for closure of severe accident issues (SECY-93-Il0, April 28, 1993) includes:
issuing staff evaluations of the Beaver Valley 2, Diablo Canyon I and 2, and Millstone 1 IPEs to the licensees and completion of the draft staff evaluations of the FitzPatrick, Monticello, and Palo Verde 1, 2, and 3 IPEs; providing a status paper addressing the Severe Accident Research Program; receiving vendor-specific accident management guidance and industry guidance on severe accident training and decision making; and initiating review of an additional Individual Plant Examination for External Events (IPEEE). The staff plans to continue providing semi-annual updates of progress to the Commission.
NOTE:
TO BE MADE PUBLICLY AVAILABLE IN 10 WORKING DAYS FROM THE DATE OF THIS PAPER
(
Contact:
T. Speis, RES 492-3710 D
030050[/.,,}lIiC..<dI C X /k u
^
,N
\\
l0
\\
l
.y The Comissioners 2
l BACKGROUND:
i l
On May 25, 1988, the staff presented to the Comission the " Integrated Plan for Closure of Severe Accident Issues," SECY-88-147. There are six main elements of this plan which include:
Individual Plant Examinations for internal events, External Events, Severe Accident Research Program (SARP),
Accident Management (AM) Program, Containment Performance Improvement (CPI)
Program, and Improved Plant Operations (IPO) Program.
On April 20, 1989, the Comission requested in a Staff Requirements Memoran: lum that the staff provide periodic updates of the status of the implementation pl an. The last update was provided April 28, 1993 in SECY-93-110.
DISCUSSION:
Since the last status report to the Comission, progress made in closure of severe accidents involved:
(1) issuance of tne Beaver Valley 2, Diablo Canyon 1 and 2, and Millstone 1 IPE staff evaluation reports to the licensees and completion of draft staff evaluation reports for the FitzPatrick, Monticello, and Palo Verde 1, 2, and 3 IPEs and (2) initiation of the reviews for seven additional IPE submittals. Updates of these and other elements of the plan are discussed below. depicts the latest schedule for key elements of the plan. As noted in SECY-92-363, the CPI program has been completed, and the Comission is kept informed of the IPO program through other mechanisms.
These elements of the Integration Plan are therefore not discussed in this report.
Individual Plant Examination - Internal Events The staff recently issued the Beaver Valley 2, Diablo Canyon 1 and 2, and Millstone I staff evaluation reports to the licensees and completed draft evaluation reports for FitzPatrick, Monticello and Palo Verde Units 1, 2, and 3.
(As discussed in the periodic update to the Comission dated May 18, 1990, SECY-90-180, all submittals are to receive a Step 1 screening review with selected submittals receiving a more in-depth Step 2 review.) The FitzPatrick IPE received a Step 2 review, whereas Beaver Valley 2, Diablo Canyon 1 and 2, Millstone 1, Monticello, and Palo Verde 1, 2, and 3 staff evaluations were based on Step 1 reviews. At the present time, one additional full scope Step 2 review (Zion 1 and 2) and a focused scope (human reliability analysis only)
Step 2 of McGuire Units 1 and 2 are in progress.
Comonwealth Edison Company's (Ceco) Zion Units 1, and 2 is the third IPE to receive a Step 2 review. The decision to initiate a Step 2 review was based, in part, on Ceco's plans to use the same IPE methodology on ten of its twelve nuclear units. The Step 2 review has involved increased contractor support and a 3-day onsite review of the licensee's IPE program by the NRC review team and coatractors (September 22 - 24, 1993).
In addition, a focused scope Step 2 review was conducted at the McGuire Units 1 and 2 site (July 28-30, 1993) to better understand the licensee's human reliability analysis.
A brief sumary of insights resulting from the Diablo Canyon I and 2, FitzPatrick, Millstone 1, Monticello, and Palo Verde 1, 2, and 3 staff
The Commissioners 3
evaluations follows (a summary of insights resulting from the Beaver Valley 2 staff evaluation was provided in the last update paper). The staff found that these licensee IPE processes met the intent of Generic Letter 88-20 and therefore were acceptable. A more detailed summary of each of these IPEs is provided in Enclosure 2.
The Diablo Canyon IPE utilized a Level 2 PRA which expanded on an earlier (1988) Level 1 Diablo Canyon PRA.
Several plant modifications resulted from the PRA study, one of which included charging pump backup cooling from the I
fire water system.
Several other potential plant improvements were identified through the IPE process and are under consideration by the licensee.
The licensee also plans to maintain the IPE "living" by performing periodic PRA 1
updates, and it expects to utilize IPE insights during the development of its risk management program.
i The FitzPatrick IPE is based on an earlier Level 1 PRA and a containment performance analysis consistent with Generic Letter 88-20 guidelines. The licensees' long term involvement in the FitzPatrick PRA had resulted in the i
l incorporation of several plant and procedural modifications prior to the IPE effort. One of the plant modifications that resulted directly from the IPE effort included use of the fire protection system to provide emergency diesel jacket water cooling directly through the emergency water system. A number of l
other potential plant modifications were identified and have led to follow-on l
evaluations by the licensee. The licensee plans to maintain its IPE program l
"living," and update the component data base which at the time of the staff review, did not reflect more recent (previous six years experience) operating l
experience.
The Millstone 1 IPE is based on a Level 2 PRA, and represents an enhancement to the 1985 Level 1 probabilistic safety study.
(The Millstone 3 IPE had been l
submitted earlier by the licensee and found acceptable by the staff.)
In j
addition to a number of plant improvements that have been implemented as a result of the IPE effort, the licensee plans to maintain a "living" PRA with periodic updates.
In addition to using the IPE to develop a risk management i
program, the licensee also plans to use the PRA for updating training and implementing technical specification improvements.
The Monticello IPE is based on a Level 2 PRA. The licensee identified hardware modifications and procedural changes which have been or will be implemented, l
including modification to allow crosstie of a diesel fire water pump to the l
RHR system. The licensee plans to maintain a "living" PRA Program to " support 1
i Monticello licensing, training, engineering and operations."
1 The Palo Verde 1, 2, and 3 IPE is based on a Level 2 PRA. As part of the preliminary stage of the IPE process, the licensee identified two transient initiators responsible for over 70% of the total CDF (estimated as 1E-3/ year).
These were: (1) loss of Heating Ventilation and Air Conditioning (HVAC) to train A DC equipment rooms, and (2) loss of Class IE channel A DC power. To reduce the importance of these initiating events, the licensee identified four modifications, including implementation of a backup source of control power to the train N auxiliary feedwater pump circuit breaker, and installation of temperature detectors in the DC equipment rooms, with an alarm in the control I
1
The Commissioners 4
i room. The licensee now estimates the total CDF as 9E-5.
The licensee also intends to maintain a "living" PRA.
Evaluations of several other IPEs are nearing completion.
Staff evaluation reports are being prepared for McGuire Units I and 2, Catawba Units I and 2, Nine Mile Point 2, and Susquehanna Units 1 and 2.
In addition, the staff has also initiated the internal events reviews for Sequoyah I and 2, WNP-2, Fermi 2, Dresden 2 and 3, Cooper, Hadam Neck, and Point Beach I and 2.
Currently, 24 IPEs are in various stages of review.
Three licensee submittal dates have changed since the last report to the Commission (Enclosure 3). The delays, which primarily resulted from the need to upgrade or perform additional analyses, will not impact the NRC's overall review schedule. To date, 63 submittals have been received, the remaining 15 submittals are expected within the next 8 months.
Individual Plant Examination - External Events As stated in SECY-93-118, four IPEEE submittals have been received by the staff. The other licensees proposed to submit their IPEEE reports on schedules ranging from June 1994 to July 1997. Watts Bar 2 will submit the IPEEE results before fuel load, which has not been determined. Table I summarizes the proposed schedule of the IPEEE submittals.
Table I IPEEE SUBMITTAL SCHEDULE FY 94 95 96 97 No. of Submittals 13 35 16 7
All but nine licensees have proposed to use approaches described in NUREG-1407 for their IPEEEs. These nine licensees for 24 plants proposed to use alternate approaches for their seismic IPEEEs. The staff has reviewed the proposed approaches and met with four of the nine licensees. To date, the staff has found the approaches proposed by four licensees acceptable. The staff is continuing the review effort and plans to meet with other licensees to discuss their proposed approaches.
The staff plans to use a two-step process for the review of licensees' IPEEE submittals similar to that currently being used for the Individual Plant Examination Submittals. During the Step 1 review, all licensees' IPEEE submittals will receive a short screening review. The objective is to perform an evaluation on the quality of the licensee's IPEEE process, and extract and store all important IPEEE insights.
In a Step 2 review, selected submittals will receive a more in-depth review. The objective of the Step 2 review is to evaluate the licensee's IPEEE process, methodology, and conclusions in more detail. To date, the staff has received fr.: IPEEE submittals, and two of which (D. C. Cook and Millstone 3) are presently undergoing Step 1 reviews.
As mentioned in SECY-93-Il8, the staff will use contractors to support IPEEE reviews because of the constraints on the available resources.
In December 1992 the staff issued an announcement in the Commerce Business Daily i
.i The Comissioners 5
j soliciting proposals for providing such technical assistance. Review of the proposals is ongoing.
l IPE Insichts Program An added objective of the IPE review program is to identify any insights gained from reviewing the IPE submittals. To assist staff in identifying these insights, Brookhaven National Laboratory has developed a computerized IPE data base that will store information from the IPE submittals. The data base is expected to provide generic insights into plant behavior by i
categorizing plant-specific system characteristics, and their associated response to initiating ever.ts. These insights will help identify potential weaknesses associated with groups or classes of plants, and provide a framework from which the strength of the regulations can ultimately be evaluated.
Information being collected includes dominant accident sequences, success criteria, system dependencies, and mitigation strategies. To date, 37 plants have been entered into the data base with 50 expected by the end of the calendar year.
Staff will be making the insights gained from reviewing the IPE submittals available primarily through three means.
First, plant specific insights are i
beirg captured through the individual reviews and documented as part of the i
staff evaluation reports. Second, as generic insights are identified, staff plans on issuing information notices to licensees to provide them information l
that may be useful in their living PRA programs. Third, staff is developing plans to document the significant safety insights gained from the IPE reviews in an overall sumary report.
In this report, staff will document insights i
gleaned from a global look at dominant accident sequences across a broad spectrum of plant groupings and provide an evaluation of the generic significance of items found.
Severe Accident Research Program (SARP)
The staff briefed the Comission on October 26, 1993, on its accomplishments since the issuance of NUREG 1365 Rev. 1, " Severe Accident Research Program Plan Update (SECY-92-329)." A status paper was also provided on October 18, 1993 which sumarized the current status of the following: Mark I containment liner failure closure; direct containment heating closure; debris coolability l
research firdings; high-speed, high temperature hydrogen combustion test t
program; late phase core melt progression research; completion of the THI-2 Vessel Investigation Project; severe accident code development tad assessment; severe accident research for ALWRs; and International Cooperatian.
Accident Management At the time of the last status report on the implementation plan, the owners groups for each of the NSSS vendors were continuing to work towards completion i
of vendor-specific accident management guidance. The industry effort to develop guidance on severe accident training and decision-making was also continuing.
Significant progress in these areas has been made since that time. As a most recent development, NUMARC has offered to pursue a binding industry initiative on accident management in lieu of the planned NRC Generic l
The Commissioners 6
Letter on accident management.
Each of these areas is briefly summarized below.
Vendor-Soecific Accident Manacement Guidance Over the period from late June 1993 to late August 1993, vendor-specific accident management guidelines were submitted to NRC for each of the PWR NS%
designs. Although this information was provided as part of the industry severe accident related initiatives that exceeds present regulatory requirements, the staff intends to conduct a review of the vendor-specific guidance documents.
The staff is presently working to define the scope and objectives of its review of the owners group submittals.
We expect that our review will focus on assuring that: (1) the accident management guidance is appropriately interfaced with plant emergency operating procedures (E0Ps), and does not conflict with the strategies embodied within the E0PS, (2) the accident management strategies as implemented in the accident management e Mance (AMG) are generally consistent with the current understanding of severe ident progression and phenomenology, and (3) the AMG can be used by uti' t
technical support staff without consuming undue emergency responst organization resources, thereby detracting from the effectiveness of the technical support function.
Staff expects to complete its review of the accident management guidelines for PWRs by the end of the first quarter of CY 1994.
This should provide for feedback of the staff's findings to industry in time to permit the guidance to be finalized by mid-1994.
Accident management guidelines for BWRs have not yet been submitted. This is because relative to the PWR owners groups, the BWR owners group (BWROG) intends to incorporate a proportionally greater amount of the accident management information within the emergency procedure guidelines (EPGs) thereby requiring more careful integration with the existing EPGs. The present BWROG schedule calls for completion of the draft BWR accident management guidelines by October 1993, and,ompletion of draft accident management-related changes to the E0Ps by the end of December 1993. The BWROG is working to submit information to the NRC for review as soon as possible after completion of these draft products. A review schedule for the BWROG products has not yet beer established.
The BWROG is continuing to develop a methodology for use by utilities to assign individual E0P and accident management strategies to the best location (control room or Emergency Response Organization / Technical Support Center) without the need for documenting the selection of the location as deviations from the BWROG products. The E0P/AMG assignment process includes a combination of deterministic, mechanistic, and probabilistic tests / criteria on which the placement of a particular action would be judged. A second methodology, for prioritizing training and examination exposure to severe accident information, is also being further developed. The methodology provides for sorting E0P-and AMG-related strategies into various categories, where each category carries a different level of required training and i
~
The Comissioners 7
associated examination.
Follow-up meetings with industry on this topic are anticipated after further details on the methodologies become available.
Guidance on Severe Accident Training and Decision-Makino The focus of the industry effort concerning severe accident training and decision-making is on: (1) identifying severe accident training program i
attributes for personnel with accident management responsibilities, (2) assessing, and enhancing as necessary, the existing decision-making process and addressing any factors important to effective accident management, (3) identifying methods to exercise severe accident management guidance, and (4) determining the optimal vehicle for reflecting training and decision-making guidance. The product of this effort is expected to be a revision to industry guidelines on training to recognize and mitigate the consequences of core damage.
f As discussed in SECY-93-110, an initial set of tasks important to severe accident management has been developed based on the accident management strategies (candidate high level actions) treated in the EPRI Severe Accident Management Technical Basis Report. Three different types of individual accident response roles have been defined in conjunction with the task list, namely, " evaluator," " decision maker," and " implementor." Defined tasks and knowledge items have also been identified for the evaluator and decision maker positions in the form of a task training matrix.
Existing operator training programs for the most part already address the role of the implementor.
The status of industry efforts on training and decision making was discussed
)
with NRC staff during a June 3, 1993 NRC-NUMARC meeting on accident i
management.
The industry working group effort to refine the accident
{
management task list and training matrix to reflect any additional considerations contained in the vendor-specific accident management guidelines has been completed.
Revision of the industry guidelines on training to recognize and mitigate the consequences of core damage is now in progress. A draft training / decision-making guideline, for industry coment, is anticipated in November 1993.
Issuance of the revised guideline is targeted for March 1994.
Generic letter on Accident Management Since the inception of the accident management program (SECY-89-012), the staff had anticipated that the regulatory mechanism for obtaining improvements in industry's accident management capabilities would be through issuance of a generic letter.
In the last status report on the implementation plan, the staff indicated that the generic letter would be issued for coment no earlier than first quarter CY 1994.
This included a delay of about 3 months in the issuance of the generic letter in order to accomodate staff review of the owners groups guidance.
During a June 3, 1993 meeting with staff, NUMARC outlined a proposal to pursue a binding industry initiative on accident management in lieu of the planned NRC Generic Letter on accident management, and the necessary steps to completing this initiative.
The initiative would be voted on by the NUMARC l
l 1
The Commissioners 8
Board of Directors, and if approved, be incorporated as a revision to NUMARC Report 91-04, " Severe Accident Issue Closure Guidelines." Such a vote could take place in the March 1994 timeframe. Subsequent utility implementation would be completed by mid-1997.
It is NRR's view that endorsir.g an industry initiative on accident management is preferable to the NRC promulgating additional requirements, in that the accident management initiative and associated principles might be more readily accepted by industry.
Furthermore, such an initiative can potentially achieve the same objectives as originally envisioned by NRC with fewer staff resources, and be completed on the same timeframe as issuance and implementation of an NRC generic letter.
In accepting any industry initiative, NRC would need to assure that the initiative meets the objectives for accident management established at the time the severe accident program was initiated.
This would include reaching agreement with industry on the application / implementation of industry guidance documents, and training and performance-based evaluation expectations.
As a result of the June meeting, it was agreed that NUMARC will proceed to further develop the industry initiative, including a proposal on how utilities would test and evaluate their accident management capabilities, and that a follow-up senior management level meeting would be held in the December 1993 timeframe. The staff will keep the Commission informed and provide the Commission additional details on this initiative as they are developed.
es M.
lor xecutive Director for Operatio..s
Enclosures:
1.
Severe Accident Program Master Plan 2.
Summaries of IPE Evaluations Issued Since Last Report 3.
IPE Submittal Delays DISTRIBUTION:
Conrnissioners OGC OChh OIG OPA OCA OPP EDO SECY l
J l
l 1
4 i
ENCLOSURE 1 SEVERE ACCIDENT PROGRAM MASTER PLAN l
-l
i b.b i
I 5
h I
g m
{-
u I
'I i
g g
1le I
gg I
l!
i ec l
E !;
d i
m l
l l
.A n l_ _g _ _i i
A I
I s
1 I
a" 8
i I!
- a l
t f5g dll!
I I
I lE l
I I
I A
ll I
I l
g 1
7<
I I
Jk g
d I
g i
V Ij l.
I gz I
!o G
5!!
E 8 i i
I w se g
1
)g I
B I
!l-I h
l i
igli=
2
)
E le f:
s h
b g
A g!;
E I
E gr 1
I-i t
15:
i-I w
[
t I
l" l
l I
9 5
BI u
i fI l
j" i
I NI l
U ll$
n B
g i
F I
N y
n h
l l
g w
1 I g!
{
g l
I I
E!
8 shy lE El" f'
E*
l I
,35 l
E s-5 I
ag Es
!=
I=
lf I tl d
I n
g p p 1
I h
l 1
1 I
g l
llv
!!y i
I r
o x!
Il
~
i I!
ll*
i j
I l !
i tr!
i i
i r
I g,
t r!
I I
I l
o l
1 l
B E"
I l'
E I
B i
e
SEVERE ACCIDENT PROGRAM. MASTER PLAN EMCLOSUREl' (CONT.)
A'M CLTElltE IM290TED M.AWT OFFR 4 T1013
'ntrys swrtnerr Pv AwATu ternJres FOOGa4M l
Sw etAas I
Am eAPA91RWE r
Too y
Two msAmnAM mi mee 1
TR 91mF8
)(
LTH.
COMPLETE IFK fInIE St'DMfTTAIJE DTMFFE 7-97
EftNCll 7
mm.TTM cF CUTTTAs8tFDe W PT84L RTWWff74L O3
==
s==
,rm m., rat.
l
,ev,wao
- w. m
= t= =a omt-----
tvDIVIDUAL m
TBANE Ftatet m a.
EOS W e et seat ess es NNRA EXAMt44T10N
,k 225L StW8M8'R$
j n=rrTrum marc O4 Ta Arn MTICATEN!
nc m
-08 99 8 Bf 79 C
ScuMITff PtAMT RPECFIC L'T L MCOFtrATuwe O
B 0899 TfD ttfL 10-01-93
~
t t
i V
t i
i I
f ENCLOSURE 2
[
I
SUMMARY
OF INDIVIDUAL PLANT EXAMINATION
{
STAFF EVALUATION REPORTS i
i DIABLO CANYON 1, 2 1
T FITZPATRICK MILLSTONE 1 MONTICELLO r
PALO VERDE 1, 2, 3
?
i r
1 6
i b
1 1
l l
Summary of the Diablo Canyon Units I and 2 Individual Plant Examination (IPE) Submittal on Internal Events The NRC staff completed its review of the internal events portion of the Diablo Canyon Units 2 Individual Plant Examination (IPE) submittal and associated information. The latter includes licensee's responses to staff i
generated questions seeking clarification of the licensee's process.
The licensee's IPE is based on a Level 2 Diablo Canyon probabilistic risk assessment (PRA) and represents an enhancement to the 1988 Level 1 Diablo i
Canyon PRA. The Pacific Gas and Electric Company (PG&E) personnel maintained involvement in the development and application of PRA techniques to the Diablo Canyon facility. The staff notes that virtually all of the plant departments l
l provided input to the IPE/PRA development.
The licensee used the NUMARC i
Severe Accident Issue Closure Guidelines (NUMARC 91-04) for purpose of screening for vulnerabilities. Based on these guidelines, a vulnerability refers to any component, system, operator action, or accident sequence that contributes more than 50% to the CDF or has a frequency that exceeds 1.0E-4/yr.
In addition, any containment bypass sequence with a frequency exceeding 1.0E-5/yr. is considered to be a vulnerability. Based on these criteria, the l
licensee did not identify any vulnerabilities with respect to core damage or containment performance.
I l
Based on the review of the Diablo Canyon IPE submittal and associated l
documentation, the staff concludes that the licensee met the intent of Generic Letter 88-20.
In addition, the licensee intends to maintain a "living" PRA.
l This latter activity is not a requirement of Generic letter 88-20.
The licensee's IPE results* are summarized below, o Total core damage frequency (CDF): 9.5E-5/ year mean estimate 8.8E-5/yr. point estimate o Major initiating events and contribution to point estimate CDF:
Event Contribution Loss of offsite power (LOOP) 41%
General transients 26%
Loss of coolant accidents (LOCAs) 9.3%
Loss of one 125 VDC bus 8.2%
Loss of auxiliary saltwater system (ASW) or component cooling water system (CCW) 6.2%
l Internal floods 3.6%
l Loss of ventilation (control room l
or 480V switchgear room) 3.3%
Steam generator tube rupture 2%
Interfacing system LOCAs
<1%
'All irformation is taken from the Diablo Canyon 1 and 2 IPE and has not been validated by the NRC staff.
1 l
o Major contributions to dominant core damage sequences:
Transient-induced LOCA 25%
Feed and Bleed 11%
Station blackout 5.7%
Reactor coolant pump (RCP) seal LOCA 3.9%
Other 1.8%
Pressurized thermal shock 5%
Anticipated transient without trip (ATWT) <1%
o Major operator action failures (c'.atribution to CDF):
Reduce unnecessary header "C" component cooling water (CCW) loads 16.6%
Backup cooling with firewater for centrifugal charging pump on loss of CCW 11%
480 V switchgear ventilation recovery 3.3%
Electric power recovery during partial or full SB0 1.8%
Switchover to recirculation mode during large or medium LOCA 1%
Initiation of feed and bleed cooling 1%
o Conditional containment failure probability given core damage:
Small, Early Containment Failure 0.09 Large, Early Containment Failure 0.03 Late Containment failures 0.45 Containment Bypass Failure 0.02 No Containment Failure 0.41 o System importance ranking (percent CDF not mutually exclusive):
(includes independent system failures leading to an initiating event or occurring during recovery actions)
Emergency Diesel Generator 1-3, Bus F 34%
Emergency Diesel Generator 1-2, Bus G 28%
Component cooling water system 25%
RCS pressure relief and PORV reclosure 24%
Reactor coolant system pump seal 19%
Auxiliary feedwater system 16%
Auxiliary salt water system (ASW) 14%
125 VDC Bus G 12%
Emergency Diesel Generators 1-1, Bus H 12%
125 VDC Bus H 11%
o Significant PRA findings:
The failure of RCP seal cooling contributes to over 40% of the CDF.
The unavailability of the swing EDG l-3 (bus F) either being aligned to Unit 2 or out for scheduled maintenance contributes to 34% of the CDF.
2
j Loss of EDGs 1-2 and 1-3 or their buses causes loss of both ASW pumps j
requiring operator action to cross-tie the ASW system from the other
- unit, j
Failure to recover ASW system causes loss of all CCW pumps causing loss of cooling for the charging pumps, safety injection pumps, RHR pumps, and the containment fan cooler units.
Failure to recover ASW system contributes to 4.5% of the CDF.
Loss of EDGs 1-2 and 1-3 also causes loss of all charging pumps and loss of 2 of 3 CCW pumps requiring operator actin to reduce heat loads on header C to meet the success criteria for operation of 1 CCW pump.
o Enhanced plant hardware, procedures, and operator actions:
(implemented after 1988 PRA)
Diesel generator fuel-transfer system Charging pump backup cooling from fire water Substation spare parts for seismic events Overcurrent relay remote reset Valve control switch replacement o Other completed, ongoing, or potential improvements not modeled:
Addition of the sixth diesel generator Installation of Westinghouse ATWS mitigation system (AMSAC)
Implementation of digital feedwater control Boron injection tank elimination Addition of RHR check valves Hodification of 480 V switchgear ventilation Modification of the reactor coolant drain tank door 1
P i
3
Summary of the FitzPatrick Individual Plant Examination (IPE)
Submittal on Internal Events The NRC staff completed its review of the internal events portion of the FitzPatrick Individual Plant Examination (IPE) submittal and associated information. The latter included licensee responses to staff generated questions seeking clarification of the licensee's process, audit of " tier 2" information held at the licensee site, plant walkdowns and interviews with key personnel involved in the IPE process.
The licensee's IPE is based on a FitzPatrick level 1 Probabilistic Risk Assessment (PRA) and a containment performance analysis consistent with Generic Letter 88-20 Appendix 1 guidelines. NUREG-II5O (Peach Bottom) insights and methodology were utilized extensively, and differences between the plants were accounted for in the models.
New York Power Authority (NYPA) personnel maintained involvement throughout the development and application of probabilistic risk assessment techniques to the FitzPatrick facility, with the objective of bringing PSA technology ii.-house. The staff notes that major plant departments contributed to the IPE/PRA development. Science Application International Corporation (SAIC) and Risk Management Associates provided technical support, primarily as reviewers and by contributing expertise in specific areas, such as human failure data analysis, common cause data analysis, internal flooding analysis, and the thermal hydraulic analysis.
The licensee identified dominant contributors expressed in terms of accident sequences, individual components, common cause failures, and human errors.
Lists of dominant event contributors to three importance measure categories i
were generated. These importance measures were used to evaluate
{
" vulnerabilities," defined as those events that contribute most to risk increases (if their probability increases), risk reduction (if their probability decreases), and uncertainty.
By reviewing the analytic results, i
I the licensee identified potential plant vulnerabilities and associated safety enhancements. The IPE submittal, however, did not identify any vulnerabilities requiring immediate action or accident strategy.
i However, a number of actions are under evaluation that would reduce the risk of core damage and loss of containment function.
Implementation of the plant modifications, however, does not affect the overall conclusions of the IPE as the absolute risk reduction from these plant modifications is not significant.
Based on the review of the FitzPatrick IPE submittal and associated documentation, the staff concludes that the licensee met the intent of Generic Letter 88-20.
In addition, the licensee intends to maintain a "living" PRA.
This latter activity is not a requirement of Generic Letter 88-20.
1 l
1 4
The licensee's IPE results* are summarized below:
o Total core damage frequency (CDF) :
1.92E-6/ Year o
Contributions to dominant core damage sequences:
Contribution Station blackout (SB0) 91.1%
Transient with stuck-open SRV 6.2%
Transient with loss of containment heat removal (TW) 1.6%
<l.0%
<1.0%
o Major operator actions to prevent core damage or containment failure:
Containment venting during loss of containment heat removal events.
Initiation of standby liquid control (SLC) during ATWS events controlling the reactor water level at the top of active fuel and-using the control rod drive system to inject born should the SLC system fail.
Manual opening of emergency core cooling system injection valve locally.
Enhancing CRD system flow to provide coolant in various transients.
Conditional containment failure probability given core damage: (Note:
o containment venting considered as failure)
Early/Drywell Failure 53.6%
Early/Wetwell Failure 6.8%
Late /Drywell Failure 11.6%
Late /Wetwell Failure 14.4%
No Failure 13.6%
o Significant PRA findings:
l lhe most significant risk-reduction events are:
4 Loss of offsite power initiator Failure to recover offsite power in 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> One stuck-open safety relief valve ESW system loop B out for maintenance Failure to recover offsite power in 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
- All information is taken from the FitzPatrick IPE and has not been validated by the NRC.
l 5
The most significant risk-increase events are:
Common cause failure of the batteries Common cause failure of the ESW pump to continue to run and to start on demand Mechanical failure ;f the reactor protection system Common cause failure of emergency diesel generators.
o Improvements stemming from IPE study:
Increasing the RCIC turbine exhaust set points, Repowering the RCIC enclosure exhaust fans from AC to DC, Fire Protection System modifications to provide emergency diesel generator jacket water cooling directly or through the ESW system.
o Important plant hardware and plant characteristics:
Primary containment (drywell or torus) venting: hard piping i
Alternate born injection:
SLC-to-CRD pump Fire protection system: cross-tie to RHRSW A RHR pump seal: cooling failure does not lead to pump failure Core spray pump seal: cooling failure does not lead to pump failure HPCI turbine: turbine exhaust trip at 150 psi MSIV isolation : low-level trip from 118 in, to 59.5 in.
HPCI/RCIC high temperature trip: increased availability during SB0 RCIC suction: no provision for auto transfer on high toru. level Emergency diesel generators: any one of four can provide shutdown o
Potential improvements under evaluation:
Administrative changes to minimize reactor pressure transmitter miscalibration.
Increased nitrogen pressure for SRV l
Modify the HPCI logic on the auto transfer Limitation of a maximum reactor water level Procedural modification CRD injection flow, and modification of the CRD flow control valve to fail safe or as-is on loss of instrument air Modification of procedures on fire protection system for containment heat removal.
Providing portable generator of charging the 125 VDC batteries.
Procedural change on HPCI and RCIC trip: E0P-8 Revise station blackout A0P #.9 Providing protection of HPCI and RCTC from floods.
1 6
1
Summary of the Millstone 1 Individual Plant Examination (IPE) Submittal on Internal Events The NRC staff completed its review of the internal events portion of the l
Millstone 1 Individual Plant Examination (IPE) submittal and associated j
information. The latter includes licensee responses to staff generated questions seeking clarification of the licensee's process. No specific unresolved safety issues (USIs) or generic safety issues (GSIs) were proposed for resolution as part of the Millstone 1 IPE.
l The licensee's IPE is based on a Level 2 Millstone Unit I probabilistic risk j
assessment (PRA) and represents an enhancement to the 1985 Level 1 Millstone 1 l
probability safety study (PSS) which has been reviewed previously with I
findings documented in NUREG-1184. The Northeast Nuclear Energy Company (NNECO) personnel maintained their involvement in the development and application of PRA techniques to the Millstone 1 facility. The staff notes that primary plant departments provided input to the IPE/PRA development.
The IPE has identified a point estimate of core damage frequency (CDF) as 1.1E-5/ reactor-year.
Loss of normal power / station blackout (580) contributes 73%, general transients 21%, and loss of coolant accidents (LOCAs) 6%.
In addition, LOCAs outside containment (V-sequer.ces) contribute to less than 2%
of the CDF.
LOCAs and transients are not major contributors to the CDF because of the diversity and redundancy of the multiple makeup systems to the reactor pressure vessel (RPV). The V-sequences are not significant because of revision of procedures, and improvement in testing of isolation valves and training of operators. Major contributors to dominant core damage sequences include emergency gas turbine generator unreliability, emergency diesel generator failure to start, maintenance unavailability of the diesel and the gas turbine generators, failure of diesel room coolers, and failure of the operator to establish isolation condenser (IC) cooWq.then needed.
The licensee used a set of criteria to screen for major vulnerabilities. The licensee did not formally define " vulnerability," but did specify criteria in line with the licensee's concept of a major vulnerability.
In rumary, these criteria involve safety or non-safety components, support systems, or operator I
actions that contribute significantly to CDF and co* Went failure with a i
relatively high probability of occurrence given a nre
. age (i.e., greater than about 10 percent).
Based on this criteria, t W ensee did not identify l
any major vulnerabilities with respect to core da ie. However, the licensee i
identified that drywell steel liner melt-through L, w1 ten debris following core melt and RPV failure is a major vulnerability with respect to containment performance. The licensee stated that it will closely folle: vesearch related i.c this area, and will consider strategies as the accident management program develops.
Further, the staff notes that the licensee has made a modification to the low pressure coolant injection (LPCI) heat exchanger so that fire water
)
can be aligned via hoses to supply water for drywell spraying if a supply from LPCI pumps are not available.
7
i Based on the review of the IPE submittal and associated documentation, the staff concludes that the licensee met the intent of Generic letter 88-20.
In addition, the licensee intends to maintain a "living" PRA. However, limited documentation of the human reliability analysis (HRA) process was identified as a key shortcoming of the traceability of the Millstone 1 HRA, and may limit the IPE's application to other areas that are sensitive to human performance.
The staff encourages the licensee to consider improving its HRA docurtation in its "living" PRA program.
The licensee's IPE results' are summarized below:
o Total core damage frequency (CDF) :
1.It-s/ Year o Major initiating events and contribution to CDF:
Contribution Loss of normal (offsite) power 64.2%
Load (electric) reject with loss 9.0%
of offsite power (LOOP)
Reactor trip 5.7%
Transient with main condenser 5.5%
Transient without main condenser 4.1%
r Small loss of coolant accident (LOCA) 3.6%
Inadvertent opening of safety relief 3.6%
valve (SRV)
Loss of service water 1.9%
o Major contributors to dominant core damage sequences:
Emergency gas turbine generator unreliability Emergency diesel generator failure to start Maintenance unavailability of the diesel and the gas turbine generators Failure of diesel room coolers Failure of the operator to establish isolation condenser (IC) r cooling when needed.
o Major operator actions:
Isolation of recirculation pump seal leak Flooding of the reactor pressure vessel (RPV) following a LOCA Maintaining RPV water level Manual start of emergency condensate transfer (ECT) pump
- All information is taken from the Millstone Unit 1 IPE and has not been validated by the NRC staff.
8
Manual start of emergency diesel generator (EDG) or gas turbine generator Manual initiation of IC from the control room Local recovery of 1-1C-3 and 1-1C-10 Manual initiation of the IC following a station blackout (SBO) event prior to SRV lift Reenergization of an ela:trical bus by cross connection Core spray and low pressure coolant injection (LPCI) systems initiation Alternate shutdown cooling initiation See Table 3.3.3-1 of the IPE submittal for other major operator actions o Conditional containment failure probability givca core damage:
164 psia at temperature of s 600 F 0.29 rupture 0.71 leak 143 psia at temperature of 600-900*F 0.32 rupture 0.68 leak 61 psia at temperature > 900 f 0.57 rupture 0.43 leak o Mean conditional source term release probabilities:
Early Releases 0.34 Intermediate Releases 0.28 Late Releases 0.02 i
o Significant PRA findings:
No major vulnerabilities with respect to core damage or human performance was identified.
Drywell steel liner melt-through by molten debris following core melt
[
and reactor pressure vessel (RPV) failure was identified as a major vulnerability with respect to containment performance.
o Important plant hardware, procedures, and operator actions:
Isolation condenser Gas turbine. generator and EDG l
SRV Ability to cross tie AC power from Unit 2 to Unit 1.
Diesel-driven fire pump provides an AC-independent means of IC j
makeup and RPV makeup.
Self-cooling (but AC dependent) mode of control rod drive (CRD) system.
9 j
s
r o Potential improvements under evaluation:
Increase of the drywell head bolts's preload from 54 kips to resist the design pressure of 62 psig.
d I
n i
1
?
L' t
i i
4 I
1 f
10 i
s
Summary of the Monticello Individual Plant Examination (IPE) Submittal on Internal Events The staff completed its review of the internal events portion of the Monticello Nuclear Generating Plant (Monticello) Individual Plant Examination (IPE) submittal, and associated documentation which includes licensee responses to staff generated questions and comments. The licensee's IPE is based on a full scope level 2 PRA performed in fulfillment of Generic Letter 88-20 and is documented in the submittal.
I The findings presented in the submittal under the specific damage classes identify station blackout as the dominant contributor to overall core damage frequency (46%). The next largest overall contributor to core damage involved flooding (26%), followed by transients with loss of high pressure reactor inventory makeup (13%), with either subsequent failure to depressurize (contributing (12%) of CD) or subsequent failure of low pressure reactor inventory makeup (contributing 1% of CD). These were followed by ATWS (10%)
and LOCA (5%). The IPE estimated the core damage frequency as 1.9E-5/yr for internal events excluding flooding and 2.6E-5/yr with internal flooding.
The licensee used the following questions to determine if vulnerabilities existed:
1.
Are there any new or unusual means by which core damage or containment failure occur as compared to those identified in other PRA's?
2.
Do the results suggest that the Monticello core damage frequency would not be able to meet the NRC's safety goal for core damage.
The Monticello IPE did not identify any severe accident vulnerabilities associated with either core damage or containment failure.
However, the licensee has identified hardware modifications and procedural changes which have been or will be implemented during the 1993 refueling outage. These improvements focus on both reducing core damage frequency and offsite release of radioactivity.
In addition the licensee has indicated that," NSP plans to have a living PRA Program to support Monticello licensing, training, engineering and operations."
i Based on the reviewed of the Monticello IPE submittals and associated documentation, staff concludes that the licensee met the intent of Generic Letter 88-20.
The licensee's IPE results' are summarized below.
Total core damage frequency (TCDF) with flooding:2.6E-5/yr core damage without flooding:1.9E-5/yr i
' All information has been taken from the Monticello IPE and has not been i
validated by the NRC staff.
11 l
1 a
Major initiating events:
Contribution
(% of TCDF)
Loss of Offsite Power 50.8%
Turbine Building 931' Service Water Flood 9.4%
Reactor Building 896' and higher Service Water Flood 9.3%
Turbine Trip 7.0%
Turbine Building 911' Service Water Flood 6.6%
Loss of Feedwater 3.8%
Manual Shutdown 2.6%
MSIV Closure 2.6%
Medium LOCA 1.9%
Large LOCA 1.2%
Small LOCA 0.9%
Major contributions by functional group:
Contribution
(% of TCDF)
Station Blackout 46%
Floods 26%
Loss of Injection, without Depressurization 12%
Anticipated Transient Without Scram (ATWS) 10%
LOCA 5%
Loss of Injection, with Depressurization 1%
Loss of Heat Removal
<1%
Major contributions to dominant core damage sequences:
Station Blackout - Loss of offsite power and diesel generators and 1) failure to recover offsite and onsite power leading to failure of high pressure makeup after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> as a result of battery depletion and failure to depressurize.
- 2) failure to recover offsite power within 30 min. and independent failure of HP makeup and failure to depressurize.
Intern flooding from 1) a service water line break in reactor building >
el. 896', failure of all high pressure injection systems and failure to depressurize.
or 2) a service water line break in the 931'el. east turbine building which propagates to motor control centers and main y
access control and station batteries rendering high pressure injection system inoperable, and failure to depressurize. or 3) service water flood at 911'el. turbine building disabling Div 14KV room, failure of high and low pressure makeup.
Transient - loss of offsite power, manual shutdown, turbine trip or loss of feedwater and subsequent failure of cll high ;I* essure sources of makeup and failure to depressurize.
k 12
\\
n
Major operator action failures (% contribution to the total core damage frequency:
Failure to depressurize reactor (45 minutes) 22.0%
Failure to inject SLC/ turbine trip initiator 3.1%
Failing to control level; dilutes boron 1.8%
Failure to inject SLC/MSIV closure initiator 1.2%
Failure to manually open SV-4234/35 (alternate nitrogen supply) 1.0%
Significant IFE findings:
The assumption that the RHR and core spray pumps will continue to provide adequate flow after containment failure, reduced the calculated core damage frequency by about IE-5/yr.
Loss of high pressure injection and failure to depressurize stems from the dependency of long term operation of the SRVs on a key instrumen':
panel.
Instrument panel Y20 powers AC solenoid valves which provide nitrogen to the SRVs for the purpose of depressurizing the reactor. The solenoid valves isolate on SB0 because panel Y20 is not powered from the battery supplied essential AC. Accumulators assure operation of SRVs until Y20 is repowered by a diesel or until offsite power is restored.
Station Blackout coping is negatively influenced by the potential inability to provide high pressure makeup and depressurization of the reactor vessel following battery depletion after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
The benefit of the crosstie between the diesel fire pump and the RHR as an injection source is limited unless the ADS capability is increased by extending battery life and modifying the power supply to the SRV pneumatic solenoid valves as recommended in the IPE.
NSP took credit for quick recovery of loss of feedwater events based on occurrences which they used to estimate that the failure to recover would be only 11%. They indicated that this had the effect of significantly reducing the total contribution of accident class IA, characterized by loss of high pressure makeup and failure to depressurize (CDF - 3E-6).
Loss of feedwater accounted for 20% of this class.
An anticipated transient without scram (ATWS) is exacerbated by the g
small capacity of the turbine bypass at Monticello. A turbine trip with j
bypass could result in heatup of the containment at a rate similar to 7
MSIV closure until the operator takes act'on to initiate power / level
.(
control as specified by E0Ps.
Important support systems (% contribution to the total core damage frequency:
AC 58.0%
Emergench Service and Emergency Diesel Generator ~ Service Water (mostly EDG-ESW) 19.0%
DC 5.0%
13
Important plant hardware RCIC - In 73% of cutsets of Class lA(CDF - 3E-6).
36% of failure due to failure of pumps to start or run.
23% of failure due to valve failure HPCI - In 69% of cutsets of class lA(CDF - 3E-6).
61% of failure due to failure of HPCI or aux oil pump to start or run.
Enhanced procedures, hardware, and operator actions:
In response to the accident class IA, concerning a loss of high pressure injection and failure to depressurize:
Modifications are under consideration to supply power to the bottled nitrogen supply for the solenoid valves from an instrument panel that can be powered by an essential power supply or batteries.
In response to accident class IB, concerning Station Blackout:
1)
Operator training was conducted covering such items as shedding DC loads, operating HPCI and RCIC to minimize battery drain, and plant response for at least four hours.
2)
Procedure changes were drafted to upgrade the steps to r
loadshed the station batteries after a SB0 to extend battery life if the diesels are not available, which would provide 2 extra hours of capacity.
3)
Recomendations made to add procedural steps to comence a controlled cooldown as soon as possible after a SBO.
4)
Recomendations made to supply station battery chargers with t
an AC independent power supply to extend battery life.
5)
Plant was modified to allow the diesel fire pump to be aligned to RHR as a reactor vessel injection source.
In response to accident class IC, concerning Loss of high and low pressure injection systems.
1)
A recomendation was considered for development of procedures for the use of low pressure backup injection systems such as RHRSW through LPCI, condensate service water, i
service water to the hotwell.
2)
Operators trained on operation of RHR and core spray pumps under certain operating conditions such as when cavitation is possible.
14
i" In response to accident class 2, concerning Loss of Decay Heat Removal:
~j Recommendations were being considered for j
t 1)
Operator training on recovery of failed RHR system and failed condenser with degraded or failed support systems.
1 2)
Elimination of locked open condition for discharge. valves j
for air receiver tanks to allow isolation to prevent loss of i
air.
3)
Writing a procedure for the replenishment of the water in l
'the CSTs.
In response to the accident class 4, concerning ATWS:
i 1)
Operator training was conducted on the significant' insights regarding ATWS.
2)
Actions for mechanically bound CRDs were moved to a contingency procedure in the E0Ps, so that the operator _will l
focus on reactor shutdown with SLC.
5 l
l i
i b
r t
[
i
-f P
i 15 a
Summary of the Palo Verde Units 1. 2 and 3 Individual Plant Examination (IPE) Submittal on Internal Events The NRC staff completed its review of the internal events portion of the Palo Verde Units 1, 2 and 3 Individual Plant Examination (IPE) submittal and associated information.
The latter includes licensee's responses to staff generated questions seeking clarification of the licensee's process.
The licensee's IPE is based on a Palo Verde Level I and 2 probabilistic risk assessment (PRA).
Arizona Public Service Company (APS) personnel maintained involvement in the development and application of PRA techniques to the Palo Verde facility, with the objective of transfer of PRA technology to the APS personnel. The staff notes that major plant departments provided input to the IPE/PRA development.
The IPE was performed in two stages.
The results of the preliminary stage, completed in mid-1990, showed a core damage frequency (CDF) of 1.0E-3/ reactor year. Two transient initiators accounted for over 70% of the CDF, namely, loss of heating, ventilation, and air conditioning (HVAC) to the Train A DC equipment rooms, and loss of Class IE Channel A DC power.
To reduce the importance of these initiating events (IEs) and also enhance the capability of feedwater (FW),
the licensee identified four modifications that were scheduled tc be installed in all units by the Spring of 1993.
The licensee's IPE described in its submittal took credit for these modifications.
As a consequence of these changes, the CDF was reduced to 9.0E-5.
The licensee used a set of conceptual guidelines to identify vulnerabilities.
In summary, these guidelines involve safety or non-safety components, support systems, or operator actions that contribute significantly to CDF and containment failure with a high probability of occurrence in comparison to other large dry PWRs. Based on these guidelines, the IPE indicates that no vulnerabilities with respect to core damage and containment failure exist at Palo Verde. The single largest contributor to the CDF identified in this IPE is station blackout at 21%,
followed by loss of offsite power (LOOP) at 18%, and miscellaneous reactor trips, also at 18% (The IPE does not take credit for the installation of gas turbine generators planned in response to the SB0 Rule).
Additionally, the single functional failure that contributes to over 85% of the CDF is loss of steam generator cooling following an accident.
Based on the review of the Palo Verde IPE submittal and associated documentation, the staff concludes that the licensee met the intent of Generic Letter 88-20.
In addition, the licensee intends to maintain a "living" PRA.
This latter activity is not a requirement of Generic Letter 88-20.
16
l 1
The licensee's IPE results* are summarized below:
i l
o Total core damage frequency (CDF) :
9.0E-5/ Year o Major initiating events and contribution to CDF:
Contribution Station blackout (SBO) 21%
l Loss of offsite power (LOOP) 18%
l Miscellaneous reactor trips 18%
l Loss of turbine or plant cooling 8%
water (component & service water) l Loss of instrument air 6%
Small loss of coolant accident (LOCA) 4%
Anticipated transient without scram (ATWS) 4%
Steam generator tube rupture 2%
(SC'R) l Others 19%
o Major operator action failures:
l Operator failure to recover offsite power within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
Operator failure to isolate high pressure nitrogen from low pressure nitrogen.
l l
Operator failure to align diesel-driven air compressor.
Operator failure to align alternate feedwater within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
Operator failure to manually actuate auxiliary feedwater (AFW).
l actuation signal.
o Contribution to total containment failure probability l
given core damage:
Early Containment Failure 0.10 Late Containment Failures Overpressurization 0.08 Basemat Helt-through 0.05 SGTR 0.03 Event V/ Containment not 0.01 i
isolated No Containment Failure 0.73
' All information has been taken from the Palo Verde Units 1, 2, and 3 IPE and has not been validated by the staff.
3 17 i
o Significant PRA findings:
1 Loss of heating ventilation and air conditioning (HVAC) space cooling to the train A DC equipment room results in loss of channel A DC.
Loss of channel A DC power makes four of the five sources of feedwater unavailable.
o Important plant functional characteristics (percent CDF):
Steam generator cooling (85.0%)
High pressure injection
( 4.9%)
Low pressure injection
( 3.8%)
High pressure recirculation cooling
( 3.7%)
Reactor Scram
( 3.5%)
Reactor coolant system integrity
( l.4%)
Hot leg recirculation
( l.3%)
Low pressure recirculation cooling
( 0.5%)
Loss of steam generator integrity
( 0.3%)
Interfacing system LOCA
( 0.2%)
o Enhanced plant hardware, procedures, and operator actions:
Configuration for the 125V DC channel A load distribution was modified to provide power for the main steam and feedwater isolation valve logic.
Train A downcomer isolation valves were modified to fail open upon ~
i loss of channel A DC power.
l The non-essential AFW pump will have a manual transfer switch to permit supply of DC control power directly from the channel A battery charger should the DC bus fail.
All four class DC equipment rooms have high temperature alarms that indicate an HVAC problem.
Installation of two gas-powered turbine generators.
0 Potential improvements under evaluation:
Internal flooding: Zone boundaries features be regularly surveilled including the floor drain check valves, sump room level detection equipment and associated alarm circuits.
The integrity of walls, ceilings, and piping penetration seals also would be scrutinized to ensure the integrity.
18
Implementation of procedure changes to improve the reliability of the downcomer valves (FW isolation and control valves) following events involving loss of instrument air: manual isolation of the high pressure from the low pressure nitrogen upon loss of instrument air.
Expanding the scope of shutdown risk evaluation.
Modification of procedure for refilling the refueling water tank.
Providing operator guidance for recovery of failed containment sprays.
Implementation of alternate containment spray capability.
o Future activities:
Applications and upgrading of PRA for:
Design changes.
Evaluation of compliance issues (justifications for continuing 1
operation and technical specifications waivers).
Upgrading emergency operating procedures.
Training licensed operators on risk insights.
b b
- l 19
7 e
. e
+
6 9
5 6
8 s
ENCLOSURE 3 IPE SUBMITTAL DELAYS 4
?
I t
I L
i
3 IPE SUBMITTAL DELAYS Since the last Commission update, several licensee internal event IPE schedules have slipped.
Below is a brief summary of the licensee reasons for the delays:
Ginna - slipped from August 1, 1993 to February 1994. The licensee stated that a more detailed plant walkdown is requ', red for internal flooding analysis; Ginna-specific MAAP model is under re-review and recompilation to take advantage of code improvements; and level I to level 2 interfacing models need to be reworked after changing level 2 contractor organizations.
Quad Cities - slipped from September 1, 1993 to December 1993. The licensee stated that the majority of work on the IPE has been ceapleted and they are in the process of drafting the submittal and obtaining man:gement review.
Big Rock Point - slipped from September 1, 1993 to May 1, 1994. The licensee stated that more time is needed to update the 1981 Big Rock Point risk assessment using the latest industry developments in vendor codes.
Results to date have not identified any new outliers and the latest CDF and release fraction calculations are less than reported in 1981.
Hope Creek - Slipped from July 1993 to April 1994. The licensee stated that they were unable to meet the original commitment date due to the underestimation of the impact of competing resources between Salem and Hope Creek, and the underestimation of the effects of personnel turnover early in the project.
i i
-