ML20070Q441
| ML20070Q441 | |
| Person / Time | |
|---|---|
| Site: | FitzPatrick  |
| Issue date: | 02/28/1993 |
| From: | Khatibrahbar, Alan Kuritzky, Vijaykumar R ENERGY RESEARCH, INC. |
| To: | NRC |
| Shared Package | |
| ML20070Q426 | List: |
| References | |
| CON-NRC-04-91-068, CON-NRC-4-91-68 ERI-NRC-93-102, NUDOCS 9405130234 | |
| Download: ML20070Q441 (57) | |
Text
._..
ERl/NRC 93-102 i
TECHNICAL EVALUATION REPORT OF THE J. A. FITZPATRICK INDIVIDUAL PLANT EXAMINATION (IPE) BACK-END SUBMITTAL i
(TASK 3 REPORT)
February 1993 i
M. Khatib-Rahbar, R. Vijaykumar, and A. S. Kuritzky i
Energy Research, Inc.
6290 Montrose Road i
Rockville, Maryland 20852 l
Prepared for:
~
SCIENTECH, Inc.
~
11821 Parklawn Drive Rockvule, Maryland 20852 under contract NRC-04 91-068-04 with the U. S. Nuclear Regulatory Commission Washington, D. C. 20555 9405130234 940509 PDR ADOCK 05000333 P
TABLE OF CONTENTS l
1.
I NTR O D U CTI O N..........................................
1 1.1 Introductory Comments..,.............................
1 1.2 Summary of Technical Evaluation Report....................
1-l 2.
CONTRACTOR AUDIT 3
2.1 Information Audited at the Site...........................
3 2.1.1 General Findings................................
3 2.1.2 Specifie lte ms..................................
3 2.1.2.1 Containment Performance improvements.....
3 2.1.2.2 Containment Event Trees (CETs) and Quantification.........................
4 2.1.2.3 Containment Capacity and Failure Characterization.......................
4 2.1.2.4 Secondary Building Hydrogen Combustion issues..............................
4 2.1.2.5 Pressure and Temperature Histories and Consistency of Computer Codes Used for the Anahses............................
5 2.2 Personnel lnterviewed 5
l 2.3 Wal k d own s.........................................
S 3.
R EVIEW OF TH E SU B MITTAL................................
7 3.1 Review of The Plant and Containment Design Features That l
Contribute to the Progression of Severe Accidents.............
7 l
3.2 Audit of Ucensee's Sequence Binning, Containment Event Trees I
and the Fault Trees (Logic Trees) Associated with the Back-End:
)
Accident Progression Analysis............................
9 3.2.1 Plant Damage States.............................
9 3.2.2 Accident Progression Analysis......................
11 l
3.2.3 Containment Event Tree Analysis....................
13 3.2.4 Containment Failure Modes........................
14 3.2.5 The Containment Matrix and Fission Product Release Bins..
15 3.2.6 Rad lonuclide Release Calculations...................
16 3.3 Comparison of Results with Other Studies...................
17 3.4 Containment Performance improvement Program..............
18 4.
R EFER E N C E S...........................................
19 APPENDIX...................................................
20 FitzPatrick IPE Back-End Review ii Energy Research, Inc.
l
LIST OF TABLES Table 1 Comparison of Peach Bottom and FitzPatrick Plant and Containment Design Features that Contnbute to The Progression of Severe Accidents 8
Table 2 Comparison of Containment Capacities 8
Table 3 Plant Damage States for RtzPatrick 11 Tcble 4 FitzPatrick IPE Containment Matrix 16 Table 5 Containment Failure as a Percentage of Total CDF: Comparison to Peach Bottom NUREG-1150 Results 18 b
r miW' FitzPatrick IPE Back-End Review iii Energy Research, Inc.
1.
INTRODUCTION AND
SUMMARY
1.1 Introductory Comments This final report sets out our technical evaluation of the Back-End portion of the J. A.
FitzPatrick Individual Plant Examination (IPE) performed by the New York Power Authority (NYPA). The audit carried out by Energy Research, Inc. was divided into three parts:
initial review of the submittal document [1] in preparation for a site visit (Task 1); the site visit itself (Task 2); and the followup assessment of the FitzPatrick IPE, based on the original submittal, the site visit, and NYPA responses to questions from the NRC and ERI (Task 3).
On November 10,1992, NRC received the Task 1 report, " Technical Evaluation Report of the J. A. FitzPatrick Individual Plant Examination (IPE) Back-End Submittal (Task 1 Report)." As part of the Task 1 report, ERI provided a list of questions that helped the NRC to formulate questions to NYPA. NYPA distributed formal responses to these questions during the site visit. A number of concerns that were raised in the Task 1 report were resolved, based on the information presented by NYPA and their consultants and contained in the NYPA responses [2]. However, the resolution of each of these issues was based for the most part on oral presentations. Since the site visit, NYPA has provided a response to one open issue [3] that could not be resolved during the site visit.
1.2 Summary of Technical Evaluation Report The FitzPatrick IPE Back-End submittal uses the NRC's NUREG-1150 study for Peach Bottom as a template. The presentation of the material in the utility submittal is sound and relatively easy to evaluate. NYPA should be commended for presenting a Back-End structure that can be evaluated in a relatively straightforward manner. Several problem areas were identified as part of the audit process.
in general, the FitzPatrick IPE Back-End submittal is technically sound, and consistent with the level of effort appropriate for this activity [4,5). Insights from PRAs performed previously were used to guide development of the IPE as well as the present audit. The sources of information used for review and comparison include NUREG-1150 study [6]
and our review experience with other rtudies dealing with BWRs with MARK 1 containments. In Section 3.1 of this report, specific comparisons of design features are drawn between the FitzPatrick plant and the Peach Bottom plant, and in Section 3.3, IPE Back-End results comparisons are provided.
The site visit demonstrated that sub.t.2r!!!ai analysis has been performed for this study, and an understanding of severe accidents and containment challenges has been developed by the NYPA staff. However, the NYPA contractors appeared to have had a major role in the performance of the FitzPatrick Back-End submittal. Concerns exist regarding the direct implementation of the NUREG-1150 study resuits at FitzPatrick, and FitzPatrick IPE Back-End Review 1
Energy Research, Inc.
I the absence of research results that are more recent than those of the NUREG-1150, specifically related to the containment shell mett-through issue. The over-reliance on the NUREG-1150 study for Peach Bottom has a tendency to limit the knowledge gained and l
to restrict resourcefulness on the part of the IPE analysis team. The MARK-l shell melt-through issue analysis is based on the Peach Bottom results of the NUREG-1150 study which are relatively conservative when compared with the results of a more recent NRC study [7]. The use of a conservative analysis in the FitzPatrick Back-End IPE submittal could conceivably mask the potential benefits from some of the Containment Performance improvement options.
The structure of the report follows that required in the Task Order. This introduction is followed by a summary of the site visit audit in Section 2, and by the Energy Research, Inc. findings in Section 3. The references appear in Section 4, and the Appendix contains the IPE evaluation data summary sheet.
j i
l l
i FitzPatrick IPE Back-End Review 2
Energy Research, Inc.
4
2.
CONTRACTOR AUDIT 2.1 Information Audited at the Site During the site visit, which took place January 27 through 30,1993, members of the NYPA staff provided written responses to the questions that appear in the Energy Research, Inc. Task 1 report, Sections 4 and 5. Information audited at the site pertained to the following subject categories:
Containment Performance improvement EOP-4 " Primary Containment Control" AOP-35, Revision 8 " Post Accident Venting of the Primary Containment" Containment Event Trees (CETs) and quantification Containment capacity and failure characterization Secondary building hydrogen combustion issues Pressure and temperature histories and consistericy of computer codes used for the analyses.
2.1.1 General Findinos Staffing and Level of Effort - NYPA has a PRA team consisting of fivo to six individuals, who are fully dedicated to the NYPA IPE program at FitzPatrick and Indian Point. These same people will also perfom1 the IPEEE for the same units, which demonstrates the NYPA commitment to the IPE program. The NYPA lPE team is located at White Plains,
)
a couple of hundred miles away from the FitzPatrick plant. The contractor is Science Applications International Corporation (SAIC) of Albuquerque, New Mexico. The NYPA IPE activity was started prior to the issuance of the IPE Generic Letter, and a relatively smaller size of the NYPA team has Back-End expertise, with considerable reliance on the SAIC consultants. A large contingent of SAIC personnel were present for the entire duration of the site visit meetings.
The Authority appears to be committed to continued maintenance, application, and usage of the plant specific FitzPatrick IPE study.
It was said by the NYPA staff that the knowledge gained from the IPE is becoming an integral part of plant procedures and training programs.
2.1.2 Soecific items 2.1.2.1 Containment Performance improvements The five Containment Performance improvement (CPI) issues that were examined as part of the FitzPatrick IPE are discussed in Section 3.4. Other than implementation of Revision 4 of the Emergency Operating Procedures (EOPs), the remainder of the CPIissues were not found to be either feasible or beneficial at the FitzPatrick plant. The specifics of the RtzPatrick IPE Back-End Review 3
Energy Research, Inc.
1 I
EOP-4 and AOP-35 procedures were discussed with the team members of the NYPA IPE, and the FitzPatrick operating staff. It was brought to their attention that the mitigative benefits of some of the CPI recommendations would be enhanced if the likelihood of containment failure at vessel breach due to shell meit through were lower than the estimates used in the FitzPatrick IPE.
Implementation of EOP-4, " Primary Containment Control," and the AOP-35, Revision 8,
" Post Accident Venting of the Primary Containment," were discussed at length with the IPE analysts, the FitzPatrick operating staff, and the NYPA consultants. The plant tour included an inspection of the containment vent valve positions, manual actuation procedures, and vent pathways out to the SGTS area. These discussions were useful for understanding the submittal analyses and conclusions. In general, it is feit that the CPI recommendations were not a prominent part of the FitzPatrick Back-End submittal.
2.1.2.2 Containment Event Trees (CETs) and Quantification The usage of NUREG-1150 as a template for the FrtzPatrick severe accident progression and containment analyses was discussed in detail with the IPE Back-End team members in order to determine the rationale for this approach. The NYPA staff contend that in cases where they utilized the Peach Bottom NUREG-1150 CET quantification results for the FitzPatrick IPE, the use of the NUREG-1150 results were conservative given the plant differences, or else, the NUREG-1150 results were appropriately scaled to represent the FitzPatrick design.
Specific NYPA response to several specific questions on the FitzPatrick CET was also helpful in better understanding of the FitzPatrick analyses.
2.1.2.3 Containment Capacity and Failure Characterization During the site visit, the containment capacity and failure characterization issues centered on the questions raised as part of the ERI Task 1 report. NYPA clarified that the 140-psig failure pressure assumed for the FitzPatrick containment is based on a comparative evaluation of the containment capacity using Peach Bottom Unit 2 as the reference plant.
This comparative evaluation, performed by Chicago Bridge and Iron (CBI), concluded that the "(FitzPatrick) containment is generally as strong (as) or stronger than the reference structure." The adaptation by NYPA of the Peach Bottom containment failure modes for use in FitzPatrick was based on the CBI conclusions.
2.1.2.4 Secondary Building Hydrogen Combustion issues During the site visit, the issues relating to the expected quantity of hydrogen following severe accidents, and the potentialimpacts of combustion at several secondary building locations, were discussed. The NYPA staff and consultants indicated that the sources of hydrogen considered include (1) hydrogen generation during the in-vessel phase, (2) hydrogen generation during vessel breach, and (3) hydrogen generation during ex vessel j
(core-concrete-interactions) phase.
in addition, the anticipated response of the FitzPatrick IPE Back-End Review 4
Energy Research, Inc.
4
torus / crescent room to hydrogen combustion was addressed as part of the source term assessment for the FitzPatrick Back End submittal. The discussions with the IPE team members and plant engineers familiar with the containment systems provided a better understanding of the configuration of the crescent room as it impacts hydrogen combustion outside containment.
2.1.2.5 Pressure and Temperature Histories and Consistency of Computer Codes Used for the Analyses For the long term station blackout sequence, differences were noted between the BWRSAR calculations in the IPE submittal, and CONTAIN calculations (performed in response to the NRC questions), in Figure 24.4 of the response to the NRC questions
[8], the drywell pressure prior to vessel breach is about 40 psia, and rises to 84 psia in about 80 seconds after vessel breach. However, Figure 12.2.4 of the Submittal shows a drywell pressure of 64 psia prior to vessel breach, and 105 psia in about 12 seconds.
This inconsistency in results from the BWRSAR and CONTAIN analyses could not be resolved during the site visit; however, NYPA has since provided a response to the NRC on this issue [3]. An error in the CONTAIN input was determined to be the cause of the differences in the results from the two codes. This error was subsequently corrected, and the updated results show that the final pressure (calculated by CONTAIN) is about 96 psia. The CONTAIN calculation was used only in response to the NRC request regarding the evaluation of temperatures in the containment penetration after a severe accident. No other use was made of the CONTAIN analyses in the submittal.
2.2 Personnel interviewed During the Back-End portion of the site audit, the NYPA personnel and consultants interviewed were Adams, Childs, Herrmann, Homing, Aldrich, Burch, Schilling, Frank, Romanowski, Catella, and Amos. These individuals seemed knowledgeable about the submittal, and various severe accident issues.
2.3 Walkdowns During the site visit, the FitzPatrick plant was in the power ascension phase after a long outage period, which precluded entry into the containment buildings, and thus limited the Back-End walkdowns. Bill Milstead of the NRC and Mohsen Khatib-Rahbar of Energy Research did walk down the secondary building. This included the following areas:
~
1.
The crescent room between the reactor building and the containment.
2.
The location of the containment vent valves, vent path, and connections to the SGTS.
A visit was also made to the p! ant simulator, where several operator actions were FitzPatrick IPE Back-End Review 5
Energy Research, Inc.
l discussed with the simulator staff and the IPE team. The NRC team also visited the laser-photo library, where several in-containment areas that were not accessible for walkdown J
were viewed and discussed with key plant personnel.
m FitzPatrick IPE Back-End Review 6
Energy Research, Inc.
c 3.
REVIEW OF THE SUBMITTAL 3.1 Review of The Plant and Containment Design Features That Contribute to the Progression of Severe Accidents A summary of the plant and containment system design features that contribute to core mett progression and containment system response is provided in Table 1 (note similar table on Page 4-39 of the submittal). Also listed are the design data for Peach Bottom (BWR-4 with Mark-l containment), one of the reference plants used for the recently published NUREG-1150 risk study [6].
Tho containment pressure capacity is one of the most important attributes with direct impact on severe accident mitigation. Comparisons of these pressure capacities between the RtzPatrick and Peach Bottom containments are enumerated in Table 2.
The following observations were made based on comparisons of the design features listed in Table 1:
The Reactor Coolant System (RCS) for the RtzPatrick plant is similar to that of the Peach Bottom (similar RCS volume-to-power ratios). This indicates that the RCS time windows (e.g., time to core uncovery and inventory boil-off) during severe accidents is similar.
The ratio of containment free volume to reactor power for the RtzPatrick plant, as shown in Table 1, is about 25 percent larger than that of Peach Bottom. This increased volume ratio provides an additional margin for the buildup of noncondansible gases in the containment during severe accidents.
The ratio of the core inventory of zircalloy and fuel to the containment free volume is indicative of the potential containment pressurization due to high pressure melt ejection-induced direct containment heating. It is clear that the maximum pressurization due to DCH in RtzPatrick appears to be roughly 80% of that expected for Peach Bottom.
1 The available drywell floor sump capacity in the RtzPatrick plant is 50%
larger than in Peach Bottom. The RtzPatrick under vessel sump can potentially retain a larger fraction of the core debris following vessel breach, as compared to Peach Bottom. This has an important bearing on molten debris spreading on the pedestal floor following vessel failure, with direct impact on the drywell shell failure issue.
l RtzPatrick IPE Back-End Review 7
Energy Research, Inc.
Table 1 Comparison of Peach Bottom and FitzPatrick Plant and Containment Design Features that Contribute to The Progression of Severe Accidents Feature FitzPatrick Peach Bottom Power Level, MW(t) 2,436 3,293 Volume of RCS Water, M' 264 334 Volume of Suppression pool, M' 2,990 3,600 Free Volume of Drywell, M' 4,248 4,502 Volume of Wetwell Air Space, M 3,228 3,737 3
Volume of Drywell Sump, M 7.4 6.1 Mass of Fuel, kg 109,765 159,412 Mass of Zircailoy, kg 50,447 65,491 Concrete Type Umestone/
Limestone /
Common Sand Common Sand 3
RCS Water Volume / Power, M /MW(t) 0.11 0.1 S. Pool Water Vol./ Power, M'/MW(t) 1.23 1.2 Containment Volume / Power, M /MW(t) 3.1 2.5 3
Zr Mass / Containment Volume, Kg/M 6.75 8.0 3
Fuel Mass / Containment Volume, Kg/M 14.7 19.6 Core Debris Vol./ Sump Volume 2.5 3.8 Table 2 Comparison of Containment Capacities
. Containment Region FitzPatrick Peach Bottom Containmen' Design 0.49 MPa 0.49 MPa Pressure (56 psig)
(56 psig)
Containment Failure 1.06 MPa 1.09 MPa Pressure (140 psig)
(150 psig)
FitzPatrick IPE Back End Review 8
Energy Research, Inc.
The maximum amount of hydrogen which can be produced as a result of zircalloy oxidation by steam is about 2200 kg for FitzPatrick, and 2900 kg for Peach Bottom, respectively. This estimate corresponds to a maximum hydrogen concentration 3
of 0.15 moles /m for FitzPatrick as compared to a concentration of 0.18 moles /m3 for Peach Bottom.
Although, hydrogen combustion in an inerted Mark-l containments is impossible, hydrogen combustion is of concem within the secondary building, following containment failure.
The torus room and the crescent area that surround the primary containment in the reactor building in FitzPatrick have a direct path to the environment through the concrete ceiling in the crescent room.
3.2 Audit of Ucensee's Sequence Blnning, Containment Event Trees and the Fault Trees (Logic Trees) Associated with the Back-End:
Accident Progression Analysis 3.2.1 Plant Damace States The Plant Damage State (PDS) binning attributes include the following: (see page 3-155 of the IPE subniittal)
(1) initiatina Event LOCAs (small, intermediate and large breaks)
Transients (includes loss of offsite power, loss of PCS (MSIV or turbine bypass failure), loss of feedwater, open SRV, ATWS, station blackout, loss of AC bus, and loss of DC power)
(2)
AC Power Status (offsite/onsite)
Offsite/onsite power recovery in the short term (valid for station blackout sequences only)
Offsite/onsite power recovery long term (valid for station blackout sequences only)
(3)
DC Power Status Loss of all DC power At least one source of DC power available (4)
SRV Valve Status No stuck open SRV At least one stuck open SRV (up to 3 valves can be failed)
(5)
Vessel Pressure Status Vessel pressure is high at the onset of core damage Vessel pressure is high, but manual depressurization possible Vessel pressure is low FitzPatrick IPE Back-End Review g
Energy Research, Inc.
(6)
In-Vesselinlection Status Vessel injection can be recovered after core damage if AC power is recovered Vessel injection not recoverable Vessel injection recoverable (7)
Ex-Vessel Inlection Status Water injection to the drywell floor is possible if AC power is recovered Water injection not possible Water injection possible (8)
Containment Heat Removal Containment heat removal is recoverable if AC power is recovered Containment heat removal is not recoverable Containment heat removal is recoverable (9)
Containment Venting Containment is vented before core damage Containment is not vented before core damage (10)
Containment Status (Prior to Core Damace}
Intact Leaking Ruptured (11)
Timing of Core Damace Short term (core damage occurs within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after accident initiation)
Long term (core damage occurs at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after accident initiation)
Accident sequence cut-sets were grouped, or binned into PDSs applying the cut-sets the criteria presented above. By examining the dominant cut-sets of the nine accident sequences, seven plant damage states were created, and these are summarized in Table 3.1.5.4 of the IPE submittal (Page 3-162).
Table 3 provides a list of PDS bins and the corresponding core damage frequencies for the RtzPatrick IPE. A potentially risk dominant group of transients,i.e., ATWS sequences are not found to be a dominant contributor to the CDF at FitzPatrick. In Peach Bottom, ATWS sequences contributed to more than 43% of the internal events CDF.
Nevertheless, the matrix of PDS provided in Tables 3.1.5-4 and 4.4.2-2 of the submittal appears to be comprehensive, and the definition of PDS is also sufficient to bridge the Level 1 system analyses and the Level 2 containment analyses.
FitzPatrick IPE Back-End Review 10 Energy Research, Inc.
Table 3 Plant Damage States for FitzPatrick Plant Damage Description Mean Core Damage State Frequency PDS-1 Long term SBO, with battery 1x104 (55.4%')
depletion. Injection for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Late core damage with vessel at high pressure; possible core damage arrest due to AC power recovery PDS-2 Long term SBO, with loss of 3.8x10'7 (20.6%')
HPCI and RCIC injection, vessel at low pressure due to one stuck open SRV or operator action. Possible core damage arrest.
PDS-3 Short term SBO, with loss of 1.4x10-7 (7.6%')
DC power, vessel at high pressure, early core damage PDS-4 Short term SBO, with failure of 2.2x10-7 (12.0%')
HPCI and RCIC, or two stuck open SRVs, low vessel pressure PDS-5 LOSP with stuck open SRV, 8.3x104 (4.4%')
low pressure
' PDS frequency as a percentags of total CDF 3.2.2 Accident Prooression Analysis Dominant plant damage states are assessed deterministically using the BWRSAR computer code. The BWRSAR code models the in-vessel meit progression, including the core debris relocation and release from the reactor vessel after vessel failure. However, the primary containment models embodied in the BWRSAR code are very simplified, and do not cover a wide spectrum of severe accident phenomenology. The BWRSAR calculations terminate one-half hour after the initial vessel penetration failure, and BWRSAR has no provision for modeling the presence of core debris on the containment floor. The primary containment models included in BWRSAR include the following:
i (1)
Heat transfer between the reactor vessel and the drywell, (2)
Degassing of concrete in the drywell prior to vessel failure, FitzPatrick IPE Back-End Review 11 Energy Research, Inc.
(3)
Modelling of water flow in the drywell sump, (4)
Modelling of gas flow between drywell and wetwell, and (5)
Transport of water vapor to the wetwell atmosphere by SRV noncondensible gas discharge.
However, several phenomena of importance to BWR severe accident phenomenology are not modelled in BWRSAR, and they include the following:
(1)
Heat transfer and pressurization at vessel breach due to direct containment heating and e: essel steam explosions, (2)
Core-concrea interactions in the drywell, (3)
Hydrogen transport and combustion, (4)
Aerosol and fission product transport, (5)
Fission product scrubbing, and release to the environment.
Quantification of the CET requires a knowledge of peak containment pressure (and other parameters), and these were not available from the BWRSAR analyses. Hence, for most of the severe accident results, the NUREG-1150 Peach Bottom results were used either directly and appropriately scaled.
Results of the analyses performed to sirnulate severe accident progression are reported
)
in Section i of the submittal. Five accident sequences were analyzed, namely:
(1)
A long term station blackout sequence, with battery depletion after eight
- hours, (2)
A long term station blackout sequence, with DC power available, and a stuck open SRV, (3)
A short term station blackout, with loss of DC power, (4)
A short term blackout sequence, with reactor vessel depressurized using the ADS, and (5)
A plant transient sequence, with a stuck-open SRV and suppression pool cooling available.
From the results reported in the IPE Appendix 1, the long term station blackout sequence appears to be the most important sequence as far as containment pressurization is concemed.
Additional calculations were performed by NYPA using1he HECTR code for simulation of hydrogen combustion outside of the primary containment. In FitzPatrick, a portion of the crescent room, located adjacent to the primary building, ha, a ceiling covered by two concrete slabs. A hydrogen burn in the torus / crescent room can displace the slabs, thus providing a direct path to the environment bypassing the reactor building. The HECTR calculations were performed for the long term station blackout sequence, since that sequence was found to produce the largest initial mass of hydrogen in the piimary FitzPatrick IPE Back-End Review 12 Energy Research, Inc.
l
containment.
Calculations were performed assuming that a minimum hydrogen concentration of 7% was necessary for combustion. The pressures required to dislodge the concrc'u slabs were calcu'ated to be of the order of a few psi. Since the pressures calculateo for hydrogen burns were always much larger, it was concluded that these concrete slabs will always be dislodged should a hydrogen burn occur in the torus / crescent room. Combustion of hydrogen in the reactor building has been property included in ths avent tree; however, the split fractions from the Peach Bottom event tree are used direc+Jy. The effect of hydrogen bum in the torus / crescent room was addressed only in the radionuclide characterization.
1he impact of hydrogen bum in the torus / crescent room on accident source terms was judged (in the submittal) to be insignificant. It is argued that for reactor building bypass to occur, the torus had to fail.
If drywell failure occurs, the gaser would flow into the reactor building. However, if torus failure occurs, the gases released would be scrubbed by torus water. Since scrubbing in the torus is an effective way of removing radionuclides, the effect of reactor building bypass (due to failure of torus / crescent room) upon source terms was judged to be small.
3.2.3 Containment Event Tree Analysis Probabilistic quantification of severe accident progression is performed using the same event tree as that used in the Peach Bottom NUREG-1150 study. The CET structure is very complicated and consists of 145 questions (see Table 4.6.2.1, on pages 4-56 to 4-60 of the IPE submittal).
However, it would have been worthwhile making some modifications to the event tree, especially for the questions pertaining to late combustion inside the reactor building, since, in FitzPatrick, late hydrogen combustion in the torus /crescert room is of some concem.
Essentia!!y, there are two differences between the Peach Bottom plant and the J. A.
FitzPatrick plant that are important for the evaluation of the event trees, and these are:
(1) in FitzPatrick, DC power is considered to be available for eight hours, and (2)
The FitzPatrick reactor building design is such that the failure of concrete slabs in the torus / crescent rooms due to hydrogen combustion is of primary concem, and a hydrogen bum in the reactor building is only of secondary concem.
The FitzPatrick CET was evaluated for all of the five plant damage states listed previously in Section 3.2.1.
The quantification of the event trees, prior to vessel breach, was performed using the results of the BWRSAR analyses. Alisting of the parameters and the CET split fractions used in the submittal is provided in Tables K1 and K.2. The following discussion is based on Tables K.1 and K.2 of the submittal.
Questions 1 to 17 are based on the definition of the PDSs (Section 3.2.1) and provide an FitzPatrick IPE Back-End Review 13 Energy Research, Inc.
4 l
entry point to the event tree. Question 18 pertains to the injection of SLC, and is not of importance to the FitzPatrick event tree analyses, as the ATWS sequences were not found to contribute to the core damage frequency. Questions 19 to 81 relate to events that occur prior to vessel breach. The only differences in values between the split fractions and parameter values used in the FitzPatrick and the Peach Bottom event trees are the values of containment pressure at core damage and the generated amount of hydrogen.
These data were obtained from BWRSAR analyses. Questions 82 to 109 pertain to events that occur at, and immediately following vessel breach. Most of the phenomena that occur at vessel breach (and are of importance to severe accident phenomenology) are not modelled in BWRSAR; hence, the quantification in the FitzPatrick CET is based on the NUREG-1150 analyses. However, for Question 93, i.e., the amount of hydrogen released from the vessel at the time of breach, the quantification is based on BWRSAR analyses. The release of hydrogen from the vessel is substantial in FitzPatrick and is, in some cases, four to ten times larger than the releases for similar accident sequences in Peach Bottom. The quantification of the pressure rise at vessel breach is based on Peach Bottom analyses, and appears to have been scaled by a factor of 0.96. The rationale for this scaling is not provided in the submittal. However, for evaluating the peak pressure in pedestal at vessel breach (Question 94), the values used are the same as in NUREG-1150.
Question 110 to 145 pertain to the late phase of the accident, during the period of significant core concrete interactions.
No analyses were performed for evaluating accident progression; hence, the split fractions and parameters from the NUREG-1150 analyses were used for all the questions, except for the value of the late failure pressure of the containment. It is to be noted here that for the shell failure issue, the same split fractions used in NUREG-1150 are used in the FitzPatrick IPE. Thus, the submittal does not account for geometric differences between the two plants (e.g., the larger sump j
volume and pedestal areas available in the FitzPatrick plant). In addition, the considerable i
advances made in resolving this issue since the publication of NUREG-1150 [7] are not taken into account in the submittal.
j 3.2.4 Containment Failure Modes No calculations of the containment capacity were performed as a part of the IPE submittal. Instead, an estimate of the mean containment capacity was arrived at using the containment failure pressure as calculated for the Peach Bottom plant. In NUREG-1150, the mean capacity of the Peach Bottom is calculated to be 150 psig. For the FitzPatrick IPE submittal, a comparative analysis was performed by CBI Technical Services. The analysis compared construction materials used and examined the major structural components in the drywell and torus at both plants. The components examined include the drywell head region, the transition knuckle between the cylindrical and hemispherical regions of the containment structure, the cylindrical region, and the torus.
The only major difference was found to be the thickness of the top part of the torus shell and vent line bellows, which was expected to lead to a 12-13% decrease in failure FitzPatrick IPE Back-End Review 14 Energy Research, Inc.
pressure. Ultimately, the CBI study concluded that the J.A. FitzPatrick containment capacity was 140 psig, which represented a 12% reduction of the CBI estimate of the Peach Bottom capacity (159 psig). Although inexact, the method provides an appropriate estimate of the mean containment failure, and should be sufficient for the IPE.
All of the important phenomena that can lead to containment failure are included in the submittal. Early failure is assumed to occur due to overpressurization, DCH, steam explosions, shell melt through, and vessel thrust forces. Late containment failure is assumed to occur due to pressurization caused by noncondensible gases. In addition, vessel structural support failure due to erosion by core debris is also traated. Thus, all the phenomena of interest in BWR Mark i severe accident phenomenology appear to have been included.
3.2.5 The Containment Matrix and Fission Product Release Bins The results of CET analyses lead to an extensive number of end-states, which are in tum binned into source term classes. This process is analogous to the definition of PDSs for the Level 1 and Level 2 interface. Outcomes of the CETs are classified into a manageable number of releases, which are characterized by similarities in accident progression and source term characteristics. The definition of release classes, categories and bins should contain as much information as possible on the accident sequence signatures and the status of the containment systems. However, the possible number of release bins increases dramatically with the degree of detail included in the bin definitions.
The FitzPatrick IPE definition of source term bins is based on the Peach Bottom /NUREG-1150 study, but modified to account for the absence of containment isolation and bypass plant damage states for FitzPatrick. The key bin attributes include the following (as displayed in Table 4.7.2.1 of the submittal):
Accident sequence type, Zirconium oxidation level (in-vessel),
Vessel condition at vessel breach (includes vessel pressure, and possible core damage arrest),
Fraction of core participating in DCH or steam explosion, Containment failure mode, Containment failure time, Availability of drywell sprays, Occurrence of Molten Core-Concrete Interaction (MCCl),
Suppression pool bypass level, and Reactor building bypass level.
The source term bin definitions are essentially similar to those of NUREG-1150. Table 4 lists a simplified form of the C-Matrix for the five PDSs in the FitzPatrick IPE submittal. For i
simplicity, failure modes were reduced to early, late and no failure, and failure locations FitzPatrick IPE Back-End Review 15 Energy Research, Inc.
were reduced to failures in the drywell and the wetwell. It is seen that the containment failure is dominated by early drywell failure, which, in turn, is dominated by drywell liner attack.
Table 4 FitzPatrick IPE Containment Matrix TIME OF LATE EARLY INTACT CONTAINMENT FAILURE Location of Drywell Wetwell Drywell Wetwell Failure PDS (Frequency) 4 1
(1.0x10 )
0.079 0.112 0.682 0.094 0.034 2
(3.8x10'7) 0.240 0.153 0.484 0.086 0.038 3
(1.4x10'7) 0.071 0.254 0.288 0.001 0.387 4
(2.2x10'7) 0.156 0.204 0.362 0.278 4
5 (8.3x10 )
0.067 0.260 0.240 0.430 3.2.6 Radionuclide Release Calculations No radionuclide release calculations were performed as a part of the IPE submittal. The FitzPatrick IPE radiological source terms are estimated based on the Peach Bottom analyses in support of the NUREG-1150 program. The source terms adopted for a particular accident progression are those calculated for that sequence in Peach Bottom /NUREG-1150. These source terms are reported for the 20 most probable bins for each plant damage state in Tables 4.8.2.1 to 4.8.2.5. In addition, these releases were grouped into four distinct radionuclide categories, or bins, according to the magnitude of release (i.e., high, medium-high, medium-low, and low). This classification is based on the total release of iodine. The results are plotted in Figures 4.8.4.1 and 4.8.4.2 of the IPE submittal. It appears that PDSs 1 and 2 have the largest releases.
Sensitivity studies are stated to have been performed to evaluate the impact of different important events on the source term outcomes. The phenomena evaluated include the (reduced) probability of shell melt through, the effect of drywell sprays, and the impact of containment venting. However, the IPE submittal does not report any quantitative results, since no source term calculations were actually performed, f
j FitzPatrick IPE Back-End Review 16 Energy Research, Inc.
l
3.3 Comparison of Results with Other Studies Table 5 shows a comparison of the conditional probabilities of the various containment failure modes based on the FitzPatrick IPE submittal and the Peach Bottom /NUREG-1150 study. All results are for internal events only.
The core melt frequency from internal events is about a factor of two higher for Peach Bottom than for FitzPatrick. This can be largely attributed to the lower contribution of ATWS, and to a lesser extent, the lower frequency of LOCAs. The largest containment response difference is that the conditional probabi'ity for late wetwell failure for FitzPatrick includes late venting. From the CET analyses, it appears that the late failure probability is essentially due to wetwell venting.
However, considering that the core damage frequency in FitzPatrick is dominated by station blackout and transient sequences, the containment response is very similar to Peach Bottom. This is not unexpected, since the quantification of the event tree and the event tree itself are the same as that of Peach Bottom. It is seen that the containment failure is dominated by early drywell failure, which was found to be principally caused by liner attack.
Sensitivity calculations were performed to determine the impact of various mitigative features on containment failure in Section 4.9 of the IPE submittal. The phenomena evaluated include the (reduced) probability of shell melt-through, the effect of drywell sprays, and the impact of containment venting. The effect of preventing shell mett-through (Question 103 in the CET) on containment failure was found to result in only a limited reduction in the probability of containment failure (varying from 2 to 12%).
However, containment failure was found to occur later, and the mode of failure was determined to be principally wetwell rupture and wetwell venting.
The effect of thecontinuous operation of drywell sprays was also similar. But, as stated earlier, the effect on source terms was not evaluated quantitatively. It should also be noted that AC power is required for the operation of drywell sprays, and for the operation of the vent.
However for PDS-1 to PDS-4, all AC power is lost, and sprays and venting are not available.
FitzPatrick IPE Back-End Review 17 Energy Research, Inc.
Table 5 Containment Failure as a Percentage of Total CDF: Comparison to Peach Bottom NUREG-1150 Results Containment Failure Peach Bottom /
FitzPatrick IPE NUREG-1150 4
4 CDF (per year)
Intemal 4.5x10 Internal 1.9x10 Early/Drywell Failure 52.4 53.6 Early/Wetwell Failure 3.3 6.8 Late /Drywell Failure 4.7 11.6 Late /Wetwell Failure 0.3 14.4 Wetwell Venting 11.0 na Intact 28.0 13.6 3.4 Containment Performance improvement Program No attempt was made in the submittal to address containment performance improvements. However, it appears that some work was performed by the licensee in this area, and was reported as a part of the response to the questions submitted by the NRC. The response to NRC Ouestion #28 (p-82 of the responses) addresses this issue.
Five CPI issues were examined. The first suggested CPI, i.e., implementation of Revision 4 of the EOP, is already included in the submittal. The second CPI, i.e., cross-connection of fire protection system to the low pressure coolant injection, was not found to be feasible in FitzPatrick, since all the affected accident sequences in the submittal involve failure (to open) of the LPCI valves. The third improvement, i.e., afternate water supply for the drywell sprays, was not examined, since no studies had been made to determine if a sufficient flow of water for the drywell spray headers could be provided by the fire protection systems. The effect of continuous operation of the drywell sprays was irwestigated in the submittal. The fourth improvement studied was the enhanced RPV depressurization capability. The effect of RPV depressurization was to reduce the probability of early containment fciture. However, NYPA concluded that the steps that could be taken to enhance the reliability of the RPV depressurization system, such as the provision of a portable generator to charge the DC batteries, were not practical. Finally, the effect of containment venting upon core damage frequency was examined. The effect of containment venting upon the TW accident sequence (loss of suppression pool cooling and drywell sprays) was found to be an eight fold reduction in core damage frequency.
The effect of wetwell venting upon station blackout sequences was found to be ambiguous. On one hand, drywell failure due to liner attack could not be prevented, but on the other hand, wetwell venting is expected to reduce the fission product release to l
the environment. However, no calculations were performed to evaluate the effect of wetwell venting upon containment response and radiological release.
FitzPatrick IPE Back-End Review 18 Energy Research, Inc.
4.
REFERENCES 1.
" James A. FitzPatrick Nuclear Power Plant Individual Plant Examination," Prepared by New York Power Authority, August 1991, 2.
Untitled Document Usting the Formal Responses to NRC Back End Review Questions, Prepped by New York Power Authority, January 1993.
3.
Additional Response to item 7, Prepared by New York Power Authority, February 1993.
4.
NRC Letter to All Ucensees Holding Operating Ucenses and Construction Permits for Nuclear Power Reactor Facilities, " Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54 (f)," Generic Letter No. 88-20, Dated November 23,1988.
5.
NRC Letter to All Ucensees Holding Operating Ucenses and Construction Permits for Nuclear Power Reactor Facilities, " Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54 (f)," Generic Letter No. 88-20, Supplement No.1, Dated August 29,1989.
6.
" Evaluation of Severe Accident Risks: Peach Bottom, Unit 2," U.S. Nuclear Regulatory Commission, NUREG-4550, Vol 4, Part 1, June 1990.
7.
T. G. Theofanous, et al., "The Probability of Liner Failure in a Mark-l Containment,"
U.S. Nuclear Regulatory Commission, NUREG-5423, August 1991.
B.
Responses to Request for Additional Information, New York Power Authority, (Letter dated September 1,1992).
FitzPatrick IPE Back-End Review 19 Energy Research, Inc.
[
\\
j APPENDIX i
IPE EVALUATION AND DATA
SUMMARY
SHEET A.1 Plant Data and Plant DescrictlQD A.1.1 Plant-Specific Analysis Yes (partial)
A.1.2 Unique Vessel Features None found A.1.3 Most Ukely Vessel Failure Mode Lower vessel head penetration tube failure A.1.4 Unique Containment Features None Found A.2 Plant Models and Methods for Physical Processes A.2.1 Codes Exercised during The Analysis BWRSAR, CONTAIN 1.12 Code, EVENTRE code A.2.2 Referenced Codes or Models Codes and models utilized in NUREG-1150 Peach Bottom analyses A.2.3 References on Phenomenological Treatment NUREG/CR-4551, NUREG-1150 A.2.4 Phenomenology Considered HPME/DCH in-vessel and ex-vessel steam explosion Hydrogen burns in the torus and crescent room Reflooding of degraded core FitzPatrick IPE Back-End Review 20 Energy Research, Inc.
A.3 Bins and Plant Damage States A.3.1 Number of Plant Damage States 5
A.3.2 Binning Factors
-Initiating event
-AC power status (offsite/onsite)
-DC power status
-Vessel pressure status
-In vessel injection status
-Ex-vessel injection status
-Containment heat removal
-Containment venting
-Containment status (before core damage)
-Timing of core damage A.4 Containment Failure Characterization A.4.1 Structural Calculations NUREG-1150 as reference plant A.4.2 Ultimate Containment Failure Pressure Early 140 osia Late (due to elevated temperatures) 125 osia A.4.3 Additional Radlonuclide Transport and Retention-3tructures Auxiliary building retenti6n was quantified similar to NUREG-1150 FitzPatrick IPE Back-End Review 21 Energy Research, Inc.
A.5 Containment Event Trqq A.S.1 Conditional Probability That The Containment is Not isolated Neglected since the failure probabilities of the bypass leak paths were less than 10 per reactor year A.5.2 Number of CETs 1
1 l
A.5.3 Number of Nodes in Smallest And Largest CET 145 A.5.4 List CET Top Events Too numerous to list; see Table 4.6.2-1 of the submittal A.5.5 Dominant Containment Failure Mode for SBO Early drywell failure (shell failure due to melt attack)
A.6 Accident Prooression and CET Quantification A.6.1 Calculated or Template Containment Loads Template loads from Peach Bottom (NUREG-1150)
A 6.2 Technique Used to Treat Equipment Survivability None A.6.3 Equipment identified as Susceptible to Severe Accident Environments None identified A.6.4 Dominant Contributors to Containment isolation Sequences Three bypass leak paths listed in the response to NRC Step 1 Review Ouestion 23.
A.6.5 Dominant Contributors to Containment Bypass Sequences FitzPatrick IPE Back-End Review 22 Energy Research, Inc.
None A.6.6 Qualitative or Quantitative Treatment of Uncertainties Treated similar to NUREG-1150 A.6.7 C-Matrix Provided in Table 4 of the main report A.7 Radionuclide Release Characterization A.7.1 Method to Determine Source Terms NUREG/CR-4551 A.7.2 Code or Referenced Source Term Analysis NUREG-1150 (NUREG/CR-4551)
A.7.3 Number of Release Categories 100 A.8 Containment Performance imDrovements BWR-4 Mark i See Section 3.4 of the main report FrtzPatrick IPE Back-End Review 23 Energy Research, Inc.
8 y
ENCLOSURE 4 FITZPATRICK INDIVIDUAL PLANT EXAMINATION TECHNICAL EVALUATION REPORT (HUMAN RELIABILITY ANALYSIS)
.- _ 7, CA/TR-93-19-05 STEP 2 REVIEW J. A. FITZPATRICK NUCLEAR PLANT IPE SUBMITTAL IIUMAN RELIABILITY ANALYSIS P. J. Swanson P. M. Haas Prepared for U.S. Nuclear Regulatory Conunission Office of Nuclear Regulatory Research Division of Safety Issue Resolution February,1993 CONCORD ASSOCIATES. INC.
Systems Performance Engineers 725 Pellissippi Parkway Knoxville, TN 37932 i
Contract No. NRC-04-91-069 Task Order No.' 5 4
TABLE OF CONTENTS Page EXECUTIVE OVERVIEW iii
1.0 INTRODUCTION
1.
1.1 J. A. Fitzpatrick IPE/HRA Process....................... I 1.2 Step 2 HRA Audit Process............................ 1 1.2.1 Objectives of the HRA Review..................... 2 1.2.2 HRA Review Approach.......................... 2 1.2.3 HRA Areas ofInterest 3
1.3 Pre-site Visit Activities.............................. 3 1.3.1 Review of Available Information.................... 3 1.3.2 Kickoff Meeting at NRC......................... 4 1.3.3 Site Visit Plan............................... 5 1.4 Site Visit Activities 6
1.4.1 Tier 2 Documentation Review...................... 6 1.4.2 Interviews Conducted........................... 7 1.4.3 Plant Walkdowns 7
- 1. 4. 4 Sim ulator.................................. 9 1.4.5 Review of HRA Areas of Interest...................
10 2.0 AUDIT FINDINGS
...................................12 2.1 Familiarization....................................
13 2.1.1 Pre-initiator Tasks............................
13 2.1.2 Administrative Controls.........................
13 2.1.3 Participation - Initial IPE Site-visit..................
13 2.2 Qualitative Assessment...............................
14 2.2.1 Structured process for walk- / talk-throughs
............14 2.3 Quantitative Assessment..............................
14 2.3.1 Involvement of Fitzpatrick Plant Staff................
14 2.3.2 Sensitivity analysis for human recovery events...........
15
- 2. 4 In corporation.....................................
16 2.4.1 HRA in the Living IPE.
........................16
3.0 CONCLUSION
S AND RECOMMENDATIONS..................
16 3.1 Concl u sions....................................
16 3.1.1 Licensee HRA Process Is Consistent With General Intent of Generic letter 8 8 -2 0........................
17 3.1.2 Analytic Processes Used for HRA Was Reasonable 17 3.2 Recommendations................................
17 I
- LIST OF TABLES Table Title Page I
Major James A. Fitzpatrick IPE Documentation and Background Sources Reviewed Prior to the Site Visit.................... 4 11 Schedule for Site Visit to J. A. Fitzpatrick Nuclear Power Plant 5
III Documentation Reviewed during the Site Visit................ 7 IV Key Personnel Interviewed During Site-Visit................. 8 V
Items Identified for Examination by HRA Team During Plant Visit /Walkdown
...............................10 VI Review Matrix for Discussion Items and Observations
..........11 VII In-House IPE Review by Plant Staff.....................
15 APPENDIX A Proposed Approach for Fitzpatrick Site Visit i
4 nw 9
0 ii l-I
EXECUTIVE
SUMMARY
This report is the contractor report on the " Step 2" HRA review of the IPE submittal by The New York Power Authority for the James A. Fitzpatrick Nuclear Power Plant. The scope of the review, and of this report, is limited to HRA, though HRA is closely interrelated with the Front-end and the Back-end analyses. In particular, specific human actions ofimportance for closer examination were selected in close cooperation with the Front-end analysis contractor.
The objectives of this report are to document:
(1) the general approach used to conduct the Step 2 HRA review and the specific audit activities conducted, (2) findings of those audit activities, and (3) conclusions and recommendations to NRC staff for their final evaluation.
Objective 1 is addressed in Section 1. Objective 2 related to the activities and results of the review are addressed in Section 2. Conclusions and recommendations are presented in Section 3.
The Step 2 review suggests that the HRA processes applied in the J.A. Fitzpatrick plant IPE are reasonable for satisfying the general objectives pertinent to HRA identified in Generic Letter 88-20, and that the analytic methods applied are consistent with accepted procedures (ASEP) for the HRA portions of the IPE.
1 l
l 1
1.0 INTRODUCTION
1.1 J. A. Fitzpatrick IPE/HRA Process The New York Power Authority (The Authority) chose to use the Level I PRA approach and a containment performance analysis in performi'ng the IPE for the James A. Fitzpatrick Nuclear Power Plant (JAF) (Reference 1). An integral part of the approach taken was to integrate human error contributors based primarily on the Accident Sequence Evaluation Program - Human Reliability Analysis Procedure (ASEP-HRAP) described in NUREG/CR 4772 (Reference 2). In addition to ASEP-HRAP, elements of the Systematic Human Action Reliability Procedure (SHARP), (Reference 3) were used in the representation of complex diagnosis events. Of particular interest in the JAF HRA is the handling of human error probabilities (HEPs), specifically the adjustments taken through treatment of recovery factors and expected operator response during pre-and post-accident tasks.
1.2 HRA Audit Process All IPE submittals are to be reviewed by the NRC staff to determine if the licensee met the intent of Generic Letter 88-20 (Reference 4). This staff review is being accomplished in two steps. In the first, or " Step 1" review, NRC staff evaluates the licensee's submittal, gathers important IPE information, and, as necessary, formulates review questions for which a response is requested of the licensee. All submittals will undergo a Step 1 review.
For some plants, a more detailed Step 2 review may be required to provide additional information upon which the NRC staff can base a final evaluation of the licensee's IPE process. The NRC staff is supported in these Step 2 reviews by contractors specializing in three separate areas " Front-end" analysis, Human Reliability Analysis (HRA), and "Back-end" analysis. Each contractor will conduct an assessment of the IPE, including a site audit, and submit a report to NRC which will be used by NRC staff to make its final evaluation.
Draft NRC guidance (Reference 5) states that the contractor assessment is to include:
(1)
An assessment of any limitations or weakness in the licensee's IPE methodology identified by the NRC staff during the Step 1 review.
(2)
An evaluation of any inconsistencies or shortcomings associated with the accident frequency estimates based on previous PRA experience.
(3)
An audit of the licensee's fault tree models, human event trees, -
reliability block diagrams, or other analytic process, and an evaluation of any inconsistencies whh known and accepted methods.
(4)
A determination whether the analytic methods used by the licensee are capable of identifying decay heat removal vulnerabilities at the level expected for resolution of USI A-45.
I
(5)
An evaluation of the licensee's process used to identify, eliminate, or reduce the effects of vulnerabilities.
(6)
An evaluation of the licensee's response to identified vulnerabilities, and identification of any vulnerabilities that may appear to require further analysis of evaluation.
(7)
An assessment of the dominant contributors to severe sccidents, including the strengths and weaknesses of unique design features.
1.2.1 Objectives of the HRA Review Based on the seven areas of assessment identified above and other guidance from Reference 4, and from NRC staff, the following specific objectives were identified for the Fitzpatrick HRA review:
(1)
Assist NRC staff in obtaining resolution of issues raised by the Step 1 review.
(2)
Assess the analytic processes used by JAF to perform the HRA; this includes identification of potentially important human-actions, screening, qualitative analysis, evaluation of impact, and any system improvements to reduce or eliminate vulnerability.
(3)
Identify any potential weaknesses in the analysis and evaluate specific items as necessary to determine if further assessment by the licensee is required.
(4)
Assess to determine the degree to which the JAF plant personnel were involved in the HRA.
(5)
Assess the documentation of the HRA process, assumptions, data sources, decisions, and results to assure that the knowledge and information gained was accurately and appropriately recorded to provide a basis for future assessments such as accident management planning, and to assure continuity as staff changes and system changes occur in the future.
1.2.2 HRA Review Approach To accomplish these objectives, the Fitzpatrick Step 2 HRA review was organized into the following three primary activities:
i 2
)
v (1)
Collection and assessment of information, and preparation for a site visit to conduct an audit of the HRA.
(2)
Conduct of the site visit, including document review, interviews, and plant walkdowns.
(3)
Evaluation of site visit findings, and preparation of a final report summarizing review activities,
- results, findings, conclusions and recommendations.
1.2.3 HRA Areas of Interest The JAF HRA approach exercises the latitude allowed by ASEP-HRAP to apply adjustment factors to basic HEPs (BHEPs) in order to arrive at nominal HEPs (NHEPs) which are less conservative. It is recognized that ASEP-HRAP allows for such modification. However, the licensee in opting to take this latitude must support those adjustments with appropriate detailed analysis. Adjustments in HEPs based on expected operator actions are to be supported with detailed evaluation of those performance shaping factors which influence operator behavior.
The JAF IPE original submittal and Step 1 question responses did not provide sufficient detail to explain the rationale and basis for the adjustments made. Operating history of JAF, as well as NRC audit findings during the time frame the IPE was being developed, suggest there may have been weaknesses in areas related with the performance shaping factors for which credit was taken. Additionally, there appeared to have been somewhat limited involvement on the part of the JAF plant personnel in the IPE process. A close working relationship between appropriate plant personnel and White Plains (WPO) Nuclear Safety Analysis people responsible for development of the IPE is considered essential for determining what adjustment factors are to be made on the BHEPs.
1.3 Pre-site Visit Activities Materials pertinent to the JAF IPE were distributed to the contractor prior to the initial kick-off meeting. This information, as well as background material on previous HRA studies, was reviewed. A kickoff meeting was held at NRC to identify the Step 2 review objectives and organize for the site visit. A detailed plan for the site visit was prepared, including specific items of concern, documentation required, and JAF personnel to be interviewed. A structured guideline for addressing methodology and process issues was developed.
All of the information was documented in a letter report to NRC, which was subsequently sent to the licensee. Details of the pre-site visit activities are provided below.
1.3.1 Raylew of Available Information Prior to the site visit, the team reviewed all available IPE materials and examined all relevant HRA information. A listing of the most significant documentation and background sources reviewed in preparation for the site visit is provided in Table I.
After thorough review, 3
i l
assessments of materials were made, specific items of concem for the site visit were identified, and a detailed itinerary for the site visit was prepared.
Subsequent to' the kickoff meeting, additional materials received at the meeting were reviewed. Items pertinent to HRA were identified and examined in detail. Additional background information was acquired and reviewed, and pertinent basic reference sources.
were scanned to refresh and/or update familiarity with important background information.
TABLE I Major Fitzpatrick IPE Documentation and Background Sources Reviewed Prior to the Site 1
Visit 1.
James A. Fitzpatrick Nuclear Power Plant IPE Submittal (Ref.1) 2.
IPE Generic letter 88-20 (Ref. 4) 3.
IPE Generic Letter 88-20 Supplement No.1, August 29,1989 4.
NUREG-1335 Individual Plant Examination: Submittal Guidance, (Ref. 9) 5.
NRR/RES Summary Report on Relevant Items to IPE (Ref 8) 6.
NYPA letter response to Murley,5/28/92 (Ref. 6) 7.
NYPA letter response to Team Member questions, 9/1/92 (Ref.10) 8.
USNRC, " Draft Step 2 Review Guidance Document," (Unpublished) (Ref. 5) 9.
NUREG/CR4772, ' Accident Sequence Evaluation Program Human Reliability Analysis Procedure," (Ref. 2) 10.
NUREG/CR-1278-F, ' Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications,' (Ref.11) 1.3.2 Kickoff Meeting at NRC The key initial activity for the IPE Step 2 review was a " kickoff" meeting held October 14, 1992, at NRC/RES offices in Rockville, that included NRC/RES staff, NRC/NRR staff and' contractors for all three IPE areas. A copy of the licensee's IPE submittal was transmitted to the NRC contractors prior to the meeting. The submittal was briefly reviewed at the meeting, along with guidance provided by Generic Letter 88-20 and NUREG-1335. Guidance I
for Step 2 review was discussed. NRC " Step 1" questions submitted to date were discussed, along with the licensee responses, and additional questions were generated for transmittal to the licensee prior to the site visit. A review was presented by a representative of NRR on 4
j l
I l
~
operational insights stemming from previous NRC audits (References 6, 7 & 8) that were found to have relevancy to JAF's IPE. General plans for the Step 2 review and specific plans
~
and tentative schedule for the site visit were generated.
1.3.3 Site Visit Plan Based on results of the " Step 1" Review, discussions at the kickoff meeting, review of all available information collected during and after the kickoff meeting, and additional independent assessment of the IPE Submittal, a detailed plan was prepared for conducting the site visit and audit oflicensee documentation. Details of this plan are presented in Table II.
TABLE 11 Schedule for Site Visit to J. A. Fitzpatrick Nuclear Power Plant Wednesday, December 27 8:00 AM Arrive at Site Check-in; Site Access Training 10:00 AM Kick-off meeting with management 10:15 AM Brief presentation by Team leader Agenda planning session 10:30 AM Licensee presentation, overview of site and overview of IPE effort 11:00 AM Break into separate group discussions 12:00 AM Lunch 1:00 PM Separate group discussions contmue 4:00 PM Groups combine to discuss next day's agenda and information needs 5:00 PM Adjourn Thursday, December 28 8:00 AM Groups meet to review day's agenda 8:15 AM Plant walkthroughs 12:00 AM Lunch 1:00 PM Examine documents and pursue questions identified in Appendix A 5:00 PM Adjourn Friday, December 29 8:00 AM Groups meet to discuss findings and iseed for follow-up information 10:30 AM Closing meeting with Licensee 11:00 AM
~ Team exit 5
w
]
o l
Since the IPE Submittal indicated that the licensee had followed, at 1.ast in principle, NUREG/CR-4772, Accident Sequence Evaluation Program - Human Reliability Analysis Procedure (ASEP-HRAP) (Ref. 6), a series of questions paralleling the basic elements of ASEP was developed as an aid for systematic evaluation of the licensee's HRA methodology, Specific human actions for which more specific investigation and/or walkdown was required were identified in concert with the contractors for Front-end and for Back-end analysis.
Individuals with whom interviews were desired were identified by position. A letter report summarizing the proposed site visit plan was documented for NRC, and was in turn transmitted to the applicant. A copy of that letter report including HRA question list is presented as Appendix A to this report.
1.4 Site Visit Activities The site visit by the team was conducted over a two and one-half day period, January 27-29, 1993. The overall schedule for the visit is shown in Table II. HRA team members included one NRC staff member and one Concord staff member. After badging and an introductory meeting with James A. Fitzpatrick (JAF) and White Plains Operations (WPO) staff and management, detailed discussion were held with licensee's HRA support personnel.
The Authority /WPO and JAF plant staffs were prepared to support the NRC review team for the Step 2 review. The licensee's attention to detail in front-end planning and assignment of dedicated personnel made the time available productive. The attitude of all licensee personnel supported an image that their commitment to the IPE and its overall objectives was shared throughout the organization.
The primary activities by the two HRA team members consisted of (1) a review of HR.A methodology / process and supporting tier 2 documentation with representatives from J AF/WPO and SAIC HRA contractors to NYPA, (2) a plant walkdown, including assessment of plant -
equipment associated with specific human actions identified in the HRA, and (3) a visit to the simulator facility, which included interviews with key training and operations support staff.
Debriefing discussions with JAF/WPO HRA staff and a full team debriefing with JAF/WPO staff and management concluded the visit. A summary of activities and results in each of these three areas is provided in the paragraphs below.
1.4.1 Tier 2 Documentation Review A sizeable package of additional detailed information was made available by the licensee, and appropriate sections were reviewed. This included information directly associated with the organization and execution of the HRA, with documentation of results, and with important supporting information, such as the EOPs. In addition to the formal tier 2 documentation package, examples of plant working documents such as equipment history performance tracking and trend analysis, design change work packages, root cause analysis, and a draft procedure for implementation of the living IPE, were also obtained. Some of this material was reviewed after the site visit, and was a factor in evaluating the overall licensee response 6
to Generic Letter 88-20. A listing of Tier 2 material reviewed during the site visit is provided in Table III.
TABLEUI Documentation Reviewed during the Site Visit Procedure No. ISP-100C, Rev.16, Reactor Protection System And Primary Containment Isolation System Instrument Functional Test / Calibration (ATTS).
Instrument Surveillance Procedure Checklist / Data Sheet, ISP 100C.
Documentation of tasks and associated actions inside and/or outside of the control room. (band written data sheets for simulator observations and in-plant walk down of manual actions)
ORG Trends Analysis Reports, including Root Cause Analysis for Reports 91002 and 91003.
IPE In-House Review Comment Sheets (reviewed approximately 350 comments).
Correspondence between JAP and WPO related to incorporation of comments by plant staff.
Maintenance History Tracking and Reporting Documents for Fans.
Instructor Lesson Plan for Operator Course NET-238.13, Individual Plant Examination (IPE).
J.A. Fitzpatrick PRA Suramary of Operator Interviews, MAF-8847, November 29,1983.
Draft Procedure NSD 9.2, Individual Plant Examination Maintenance.
1.4.2 Interviews Conducted The entire duration of the HRA review was supporte.d with the full time participation by Joe Romanowsky, representative from JAF plant management, Douglas Squires, representative from JAF operations department, John Bretti,'WPO Associate Nuclear Safety Analysis Engineer, and Alan Kolaczkowski and John Forester, SAIC HRA contractors to the Authority.
In addition, key personnel responsible for, or associated with, the panicular area of review met with the HRA review team. A listing of JAF/WPO personnel participating in the HRA review is provided in Table IV. The licensee arranged for the right personnel to be available to the HRA reviewers.
1.4.3 Plant Walkdowns On the second day of the site visit a tour of the plant areas was provided by JAF staff to assess those systems and operator actions identified by the HRA reviewers prior to site ~ visit.
The JAF staff escorts provided excellent information and background discussions on equipment operation, required operator actions, and various factors potentially impacting human performance. This phase of the review was particularly enhanced by having one of the operators and two HRA analysts actually involved with JAF's demonstrative walk.-through of procedures participate in the walkdown. Two basic observations were made: 1)
]
7
TABLE IV Key Personnel Interviewed During Site-Visit Name Iills Company Area of involvement J. Romanowsky Simulator NYPA/JAF Plant management representative, i
Sup'v.
knowledgeable of all aspects ofIPE HRA i
activities. Full time participant.
J.F. Bretti Assoc. NSA NYPA/WPO Nuclear Safety Analysis representative, Engr.
responsible for HRA maintenance in the
- living IPE*. Full time participant.
A.M. Kolaczkowski HRA Consultant SAIC HRA Consultant (SAIC), IM having involvement with all aspects of IPE HRA activities. Full time participant.
J. Forester HRA Consultant SAIC HRA Consultant (SAIC), full time participant.
D. Squires Shift Sup'v NYPA/JAF Plant operations subject matter expert, full time participant.
C. Yeh Sr. Engt. NSA NYPA/WPO PRA analyst, part time participation.
M. Hogan I&C Sup'v NYPA/JAF Pre-initiator HRA,1&C area, part time participation J. Adams Mgr., NSA NYPA/WPO Implementation and maintenance of the IPE, living IPE plans and organization, part tinw participant.
K.J. Vehstedt Sr. Engr. Nuc NYPA/WPO Plant engineering / technical, part time Ops.
participation.
A. Zaremba ORG Mgr.
NYPA/JAF Site visit coordinator, Operations Review Group inputs, part time participation.
Topley Trng. Mgr.
NYPA/JAF Training contribution to IPE, part time participant.
Catella Ops. Trng.
NYPA/JAF Operator training, simulator, part time Sup'v participation.
Hendrick Ops. Procedures NYPA/JAF Operating procedures, part time participation.
Deroy Maintenance NYPA/JAF Maintenance department contribution, part Sup'v time participation.
P. McGuire ORG Engr.
NYPA/JAF Operations Review Group, part time participation.
8 m.
4 Observation of actual scheduled ATTS instrumentation surveillance testing in progress 2)
Simulated walk-through of local manual operator actions for those task identified in Table V.
A tour of the main control room and training simulator facility were also included. Deserving of note was good housekeeping in all areas of plant toured. All areas viewed were clean and clutter free.
Prior to the visit, general areas of the plant and specific operator actions to be addressed during the walkdown had been defined in cooperation with the NRC Front-end analysis contractor. During early discussions with JAF staff at the site, a detailed list of specific items to be examined was selected, and specific items of interest to the NRC HRA reviewers were identified. Included in this listing were a number of procedural items for which credit was taken for human action to decrease NHEPs and thereby improve the core melt frequency.
Sampling a number of different manual actions was of particular interest to the NRC HRA team in order to gain insight and appreciation of the formality, depth and consistency of the walk-through process performed by the licensee. A complete list of items is presented as Table V and each are discussed in Section 3.0.
The walkdowns provided a better insight as to the realism of the assumptions used to estimate human error probabilities in the HRA. For example, the NRC reviewers walked through the basic steps for local manual operation for the key events identified in Table V. The reviewers obtained a sense of the time required to get through the plant to reach key equipment following an accident, as well as the routine environmental conditions (noise, heat, lighting, etc.). Some unusual features, such as the location of equipment, were made much more evident than by simply reading about them. Physically observing equipment, such as the various types of breakers, and looking at in-place procedures located in the actual environment of use helped provide.a realistic sense of the operational requirements and human factors affecting operator performance.
1 1.4.4 Simulator As part of the plant walkdown, the NRC HRA team visited the Fitzpatrick simulator. One of the major elements of the HRA was the assessment of operator performance on the Fitzpatrick simulator. The simulator is a full-scope, high fidelity simulator made by Singer-Link. As part of the HRA analysis performed by JAF, HRA analysts observed numerous accident scenarios that were run using normal operating crews. The crews involved in these evaluations were on normal training cycle and were not pre-briefed on the accidents which were evaluated. These crews also participated in post-exercise debrief sessions which were conducted to capture relevant HRA findings. Review of tier 2 documentation included data sheets filled out during these evaluations. Of particular interest was the actuation of Standby Liquid Control (SLC) during ATWS. This accident response was selected as a test scenario to examine in detail the process applied by the licensee for determination of error factors and adjustment of ASEP-HRAP HEPs. As part of this review, the NRC HRA team observed a walk-through demonstration by Douglas Squires of an ATWS event and manual activation of SLC.
9
TABLE V Items Identified for Examination by HRA Team During Plant Visit /Walkdown Catecory jhm Operatorfrechnician Decay Heat Removal Actions Cross feeding Fire Protection System alternative Alternate Boron Injection CRD system makeup Actuation of SLC during ATWS Station Blackout Diesel generator relay calibration & surveillance Contamment Pressure Control Manual venting Procedures EOP - RPV Control
- Primary Containment Control OP - Main Steam
- Demin Water makeup & transfer
- RHR Operation
- Condenser Air Removal AOP - RHR
- Recovery from Isolation
- Electrical
- Contamment Venting
- Alternate Boron injection
- EOP Isolation / Interlock Overrides
- Electrical. SBO -
During the simulator visit, discussions were held with the operations shift supervisor member supporting the IPE as well as with training center management and a simulator instructor.
These interviews provided additional background on plant and control room design, training l-practice, and procedures, and on the active involvement of these individuals with the IPE.
Training facility management and staff was actively aware of and involved the in IPE effort.
Contributions to the IPE from the simulator training instnictors provided additional depth to the HRA process as a result of their formal instructor training and applied experience in-i l
human performance evaluation.
l 1.4.5 Review of IIRA Areas of Interest Fairly extensive discussions with the JAF staff regarding the HRA methodology and data sources were conducted early in the visit, and later after the _walM wns and simulator visit.
t I
10
{
L j
m-i 0
The set of general questions for licensees using ASEP HRAP (see Appendix A) was used as a guide to structure the discussions. This list of questions was provided to the licensee prior to the actual site visit. Although not requested, the licensee was prepared with written responses to the question list. During the course of the site discussions, a decision was made in the interest of time to defer until after the site visit to review some items for which the written response appeared to be adequate. Table VI presents a matrix of review discussion items and observations identified and how each was handled. The summaries of discussions and results are presented in Section 2.0, and parallel the four major ASEP divisions in the question set; 1) Familiarization, 2) Qualitative Assessment,3) Quantitative Assessment and,
- 4) Incorporation.
TABLE VI Review Matrix for Discussion Items and Observations Appendix A Interview Tier 2 Walkdown Observation Post visit item / Number Review review Familiarization X
X X
Item 1.1.1 Item 1.1.2 X
Item 1.1.3 X
X Item 1.2.1 X
ltem 1
't X
Qaalitative Assessment X
X X
ltem 2.1.1 Item 2.2.1 X
X 1 tem 2.2.2 X
ltem 2.2.3 X
ltem 2.2.4 X
X 1 tem 2.2.5 X
X ltem 2.3.1 X
X Item 2.3.2 X
Quantitative Assessment X
ltem 3.1.1 Item 3.1.2 X
11
w-J J
Jtem 3.1.3 X
ltem 3.2.1 X
1 Item 3.2.2 X
j ltem 3.2.3 X
X ltem 3.2.4 X
Item 3.3.1 X
Item 3.3.2 X
ltem 3.4.1 X
ltem 3.5.1 X
ltem 3.5.2 X
lacorporation X
ltem 4.1.1 Item 4.1.2 X
X ltem 4.1.3 X
Item 4.14 X
Item 4.2.1 X
Item 4.2.2 X
Item 4.3.1 X
X X
Item 4.3.2 X
ltem 4.3.3 X
X Item 4.3.4 X
ltem 4.3.5 X
3 2.0 AUDIT FINDINGS The following summaries represent the reviewers best understanding of the licensee's process for those areas of concern identified in Section 1.2.3 above. The discussion which follows is organized under the four major areas defining the ASEP-HRAP methodology. The italicized statements are taken from the review guideline and relate to the concerns identifiM 12
,c.
/
during the pre-visit review. The JAF HRA team prepared specific written responses to question set submitted pnor to the site visit, these responses are attached as Appendix B.
These questions and responses served as the basis for much of the interview discussions.
2.1 Familiarization Erplain the inputs, activities, rationale / rules, and outputs of the process used to assimilate plant spectpc information modifers for key human actions included in the accident / event sequences analyzedfor screening and nominal HRA.
2.1.1 Pre-initiator Tasks (question 1.1.1, Appendix A)
The licensee employed the ASEP-HRAP guidelines to assess pre-initiator human actions.
Plant specific information, principally surveillance and calibration procedures, was reviewed to identify activities in which human error may occur. No quantitative screening analysis was employed. Review of tier 2 documents supported observations that were made of a select number of diverse functional test / calibration activities as a confirmatory measure of the integrity of the procedure review process. The NRC HRA reviewers discussed the field abservation process with the HRA analyst, I&C supervisor and I&C technicians who perform these tests on a regular basis. In addition, on 1/27/93, the NRC review team directly observed the performance of a functional test of the instrumentation that initiates the primary containment isolation system and reactor protection system, specifically instrument channel 02MTU-219C, System A Main Steam Line Flow High (PCIS). As a result of discussions, observation and document review we concluded that the process applied by JAF to assess pre-initiator human actions was reasonable, systematic and consistent with other PS As.
2.1.2 Administrative controls. (question 1.1.2, Appendix A)
In the pre-site visit review of the IPE a concern was raised as to the existen:e of administrative controls that assure consistency in performance of activities falling under pre-initiator tasks. Pre-initiator task selection was based on review of plant-specific procedures.
Insufficient detail was presented in the IPE related to consideration of those controls which assure consistent implementation of those procedures. It was determined from discussions with the HRA analysts involved that the JAF HRA pre-initiator review included a look at those factors which can alter the consistency and integrity of calibration and restoration of instrument channels after testing is completed.
Furthermore, the control afforded by Operations Department Standing Orders, Work Activity Control Procedure, and Operations Surveillance Test Procedure provide appropriate means to address these concerns.
2.1.3 Participation - Initial IPE Site-visit. (question 1.1.3, Appendix A)
The IPE did not contain adequate information to ascertain the extent of involvement of the plant personnel during the site visit. Where credit is taken for operator response and formal procedure guidance, it is essential to involve those individuals who have direct hands-on 13
1 experience with the plant operating practices in order to assure a comprehensive assessment of all vulnerabilities. As evidenced through interviews with key HRA contributors, including plant operations and maintenance staff, the involvement of plant personnel appeared greater than that mentioned in the IPE. Opportunity for operations and instrumentation personnel to review and provide input to the assessment process was verified during interviews with the respective deoartments. Also, included in the tier 2 documentation were recorded meeting minutes held with various operating personnel during site visitation which supports the type of informa' ion exchange which would be expected.
2.2 Qualitative Assessment Erplain the inputs, activities, rationale / rules, and outputs of the process used to breakdown the descriptions of human actions into tasks / subtasks or otherwise amphfy the qualitative description of the key human interactions.
2.2.1 Structured process for walk- / talk-throughs. (question 2.1.1, App A)
For pre-initiator actions, the review was performed by directly applying the guidelines from the ASEP-HRAP. In the case of post-accident actions, three major structured processes were used, along with the EOPs, to identify and quantify post-accident error potential. These included: 1) development of detailed flowcharts for each type of accident sequence and critical operator task being considered, 2) Simulator observations and, 3) out-of-control room walk-throughs.
Considerable credit was taken for the use of the symptom based EOPs in minimizing vulnerability to operator post accident response errors. The HRA peer review supported the EOPs contribution with due consideration of operator training and demonstrated performance in routine requalification simulator training. Twenty-two accident scenarios were run on the simulator in suppon of the HRA. Different operating crews panicipated in the sessions, and shift staffing levels were consistent with Technical Specification requirements.
From interviews with HRA analyst, operations personnel, and training personnel, it appears that results of these exercises were reasonably consistent and met the criteria for applying error factors to the NHEPs. This finding is supported by tier 2 task data sheets.
2.3 Quantitative Assessment Explain the inputs, activities, rationale / rules, and outputs of the process used to estimate probabilities ofsuccess/ failure ofhuman interactions.
2.3.1 Involvement of Fitzpatrick Plant Staff (question 3.1.3, Appendix A)
As mentioned in Section 1.2.3 and Item 2.1.3 above, the extent of plant staffinput to the IPE was of particular interest to the HRA reviewer. Review of tier 2 documentation, specifically the in-house review comments, identified a broad cross-section of involvement on the part of 14
the plant staff. Approximately 350 comments from plant staff members participating in the in-house review were reviewed. Table VII provides a list of plant staff personnel commenting on the IPE, their position at the time of comment, and their systems area of interest.
TABLE VII In-House IPE Review by Plant Staff NAME POSITION / TITLE AREA OF INTEREST F. Aldrich Operations Requal Instructor ARI, ADS R. Baker Maintenance Manager 4.16KV, TECLC, HVAC, RCIC, ARI TBCLC, RWR, SW, SLC V. Childs Senior Licensing Engineer EDG T. Herrmann System Engineering FWS, MSIV, ADS, CND, RHR/LPCI, CWS, CORE Supervisor SPRAY,CRD.
R. Hladik System Engineer D. Johnson Assistant Operations RER SW, ESW, WISW, MCW, RHR SFC, CORE Manager SPRAY, HPCI, LPCI C. Jones System Engineer RCIC H. Keith I & C Manager 115KV, RCIC EDG,4.16KV.
J. Klevorn System Engineer J. Moore System Engineer VAPOR SUPPRESSION, INSTRUMENT AIR.
C. Ponzi System Engineer 046(NSW), TBCLC, CIRWTR, RECLC D. Ruddy Engineering Sup'v (MODS)
D. Slagle System Engineer ARI D. Squires Shift Supervisor LPCI, RCIC, ADS, ARI, RWRSW,419 VDC, SLC, HVAC.
F. Weinert System Engineer Based on the site-visit review of the comments submitted by plant staff and the action taken by the JAF IPE team, participation by plant staff personnel appeared adequate. From the site-visit review of tier 2 documents it was concluded that better than 80 percent of the plant staff peer review comments were used as input to the final IPE.
~
2.3.2 Sensitivity walysis for human recovery events. (question 3.3.2, Appendix A)
As stated in the IPE, four human recovery events reduced core damage frequency resulting from internal causes by a factor of 3.7. These events are: 1) initiation of standby liquid 15
control during ATWS,2) controlling reactor water level at the top of active fuel and using control rod drive system to inject boron should the SLC fail,3) manual opening emergency core cooling system injection valves (should LPCI system fail) during a transient that result from stuck-open SRVs and LOCA,4) enhancing CRD system flow to provide coolant in various transient scenarios. During the plant walk-down, reasonableness of assumptions made about the accessibility of equipment, manual actions required, etc., and the rigor of the process applied in performance of walk-throughs were discussed with the HRA analyst and operator. It is our opinion that the approach taken is reasonable.
2.4 Incorporation l
The retention, maintenance, distribution, and utilization of HRA resultsfrom the initialIPE process. Also, the licensee's plansfor implementation of the "Living IPE*.
2.4.1 HRA in the Living IPE. (questions 4.2.2 and 4.3.1, Appendix A)
Implementation of the living IPE concept will be procedurally controlled. Present plans call for implementation of the procedure after the Indian Point Unit 3 (IP-3) IPE is completed.
A draft procedure was made available for our review. It provided some insight as to the licensee's thought process thus far, as well as level of attention given. It is expected that changes will be made to the present draft procedure. Some may be very substantive based on experienced gained through informal reviews and analysis of plant changes. At least the draft procedure indicates that JAF has given considerable thought to the living IPE concept, is attempting to structure a program that will be effective, and has a strong commitment to a living IPE for safety and other benefits such a program can bring.
JAF's commitment is to re-run the analysis every two years. A nuclear safety analysis engineer has been given responsibility for coordinating activities related to the living IPE.
Plant. The IP-3 IPE effort should be completed prior to the first two-year anniversary of the JAF IPE, thereby freeing up the necessary resources to accomplish this analysis. In the interim period, monitoring of changes to the IPE baseline is being performed. Any plant design changes, procedure changes, etc. which could influence the assumptions made and analysis performed is reviewed and limit portions of the analysis repeated should that be warranted.
JAF has documented support for plant changes made and repeat analysis performed as a result of those changes which have occurred since submittal of the IPE.
3.0 CONCLUSION
S AND RECOMMENDATIONS 3.1 Conclusions The areas identified prior to site visit, which were associated with both methodology and data, were reviewed in considerable depth. Review of tier 2 documentation and interviews with those responsible for the IPE HRA has satisfied the reviewers concerns as to basic data used, 4
16
assumptions made, and justification for realistic values generated. Pre-initiator inputs were consistent and reasonable. Performance shaping factors were assessed in depth, beyond what was evident in the initial IPE submittal, as evidenced from discussions with maintenance, plant operations, I&C, plant procedures group and plant training personnel, and as supported by additional tier 2 documentation. The use of simulator exercises and in-plant walk-through were discussed with some of the individuals involved in the actual data collection effort.
These processes for obtaining data appear to have been reasonably rigorous and systematic.
It is apparent from discussions with principals involved from both NYPA/WPO and JAF organizations that plant personnel provided substantial review and input to the IPE process.
The HRA review team had ample access to all information and resources necessary to perform our review, and gain insight to the working process. There were no significant findings which would indicate the methods and approach taken fail to support the intent of Generic Letter 88-20. The conclusion of the HRA review are presented in 3.1.1 and 3.1.2 below.
Although not strictly an HRA issue, it is noted that indicators such as management involvement, cooperation, emphasis of IPE importance at all levels of the JAF organization, staff morale, and cleanliness of facility suggest that JAF management has taken effective measures to correct previous problems.
3.1.1 Licensee HRA Process Is Consistent With General Intent of Generic Letter 88-20 It is our assessment that overall the licensee used a reasonable and appropriate process to meet the general objectives pertinent to HRA identified in Generic Letter 88-20.
The documentation reviewed and the interviews conducted during the site visit, taken as a whole, indicates that the licensee has: gained an appreciation for human performance contributions to and impact on Fitzpatrick severe accident behavior; confirmed and increased its understanding of the importance of human performance in the most likely severe accident sequences that could occur at Fitzpatrick; and gained a more quantitative understanding of the impact of human performance on the overall probabilities of core damage and fission product release.
3.1.2 Analytic Processes Used for HRA Was Reasonable The Step 2 review indicates that the licensee appropriately applied an accepted HRA procedure (ASEP) to quantify HEPs. Overall, the analytic methods used by the applicant are reasonable and consistent with methods used in other PSAs. The tier 2 documentation and other information assessed provide support for the summary results provided in the IPE submittal.
3.2 Reconunendations Although, outside the scope of Generic Letter 88-20 it is recommended that the IPE be retained as a living document.
17
References 1.
" James A. Fitzpatrick Nuclear Power Plant Individual Plant Examination," Volumes I and II, New York Power Authority, August,1991.
2.
Sandia National Laboratories, " Accident Sequence Evaluation Program Human Reliability Analysis Procedure," NUREG/CR-4772, February,1987.
3.
Electric Power Research Institute, " Systematic Human Action Reliability Procedure (SHARP)," EPRI NP-3583, June,1984.
4.
USNRC letter to All Licensees Holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities, " Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f)," Generic Letter 88-20, November 23, 1988.
5.
USNRC, " Draft Step 2 Review Guidance Document," (Unpublished).
6.
NYPA letter, R.E. Beedle to NRC, JPN-92-024, dated May 28, 1992, response to Murley.
7.
NRC letter, T.E. Murley to J.C. Brons, dated February 6,1992, requesting a review of the Fitzpatrick IPE with respect to the NRC's Diagnostic Evaluation Team Report.
8.
NRC internal document, J.W. Chung, NRR/RES Interface, "Fitzpatrick Individual Plant Evaluations" 9.
USNRC " Individual Plant Examination: Submittal Guidance," NUREG, Draft for Comment, January,1989.
10.
NYPA letter, R.E. Beedle to NRC, JPN-92-046, dated September 1,1992, response to Team Member questions.
11.
Sandia National Laboratories, " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications (Final Report)," NUREG/CR 1278-F, August,1983.
I 18 t
N
. APPENDIX A 1
g Iluman factors Review Guidance DNCORD ASSOCIATES, INC.
tems Performance Engineers l'elhzippi Parkway Telephone (615) 675-0930 101. Box 6 (615) 675 4725 vino. TN 37932 facsimile (615) 675 0432 November 6, 1992 Mr. Bill Milstead, IPE Team Leader Nuclear Regulatory Commission Severe Accident Issues Branch NLS - 324 Washington, D.C.
20555 PROPOSED APPROACH FOR FITZPATRICK SITE VISIT The following items suggest an approach for, and document the information required for, our site visit review and evaluation of the Fitzpatrick IPE submittal HRA:
(1)
Response to Specific Questions Submitted by NRC.
Specific questions have been submitted to the applicant by the NRC staff as a result of the Step 1 review.
Those items should be addressed on the first day after the general presentation by the applicant.
(2)
General Methodology and Data Review.
It is proposed that detailed discussions be held with the applicant lead responsible for the HRA and with other contributors responsible for the analysis regarding basic issues of methodology and data.
The format for those discussions will be to follow the " Process Review for Applicants Following ASEP HARP" provided as Attachment 1 to this letter.
It is suggested that Attachment 1 be sent to the applicant with the understanding that we do not expect a written answer to every question, but that these are the " process related" issues we plan to discuss in detail during the visit.
These discussions should take place the second day of the site visit.
(3)
Review of Specific Human Actions.
A number of specific human actions of particular importance have been identified by NRC's front-end and back-end contractors and from our review of the submittal.
A listing is provided as Attachment 2 to this letter.
We would like to discuss the analysis, assumptions, data sources and conclusions regarding those specific actions with the systems analysts and HRA specialist involved (if possible).
The applicant should be sent Attachment 2 with the understanding that we expect t o.. require. some ~ ley (1., of'..pl;rlt wa D:down f.crr.l.at least.-.,sorqc of.. t;bes.e acti~ ens.
'Iri additio'n,.obse.rvati'on of a' calibrat'i'on/su'rv'ei'lQnch 1625 Autumnwood Dr.
2672 Tammi Lane Reston, VA 22094 Gainesville, GA 30504 (703) 318 9262 (404) 287 3367 g,,,,
test in progress, subject to being compatible with normal work schedule.
These discussions most likely would be conducted in concert with the front-end er back-end contractors as they pursue these events / actions of interest, and could be expected to take place on the afternoon of the first day, and perhaps some on the second day.
Note that in some cases, these discussions on specific actions in Attachment 2 may serve as examples for resolving, and therefore eliminating the need for discussions on, the general process issues in Attachment 1.
(4)
Interviews With Key Plant Personnel.
Interviews with plant personnel will need to be conducted from at least two perspectives:
(1)
Followup discussions with various plant personnel, such as control room operators and supervisors or maintenance personnel and supervisors, related to information on specific human actions, controls, HRA assumptions, results, etc.;
(2)
A brief meeting with the following site personnel (or their representatives) to review their involvement with HRA process, potential use of results, and future interactions with the "living IPE":
Training Manager; Manager responsible for development, validation and verification of procedures; Responsible person for. evaluation of operational experience (HPES, root cause analysis, LER reviews, etc.).
(S)
General Items and Plant Areas.
Regardless of the results of the specific review items above, I will want to visit the control room and, if possible the training simulator; and I will want to review representative examples of key emergency procedures and maintenance, test and calibration procedures.
All HRA tier 2 documentation should be available to support the review. lists specific procedures of interest.
Sincerely, j rf,,
Philip J.
Swanson HRA Team Member, Contractor jm/PJS Attachments cc:
3.
Flack M
t,.Loiff W.
Thomas, SEA M.
Khatib-Rahbar, Scientech
Rev. 01 ATTACHMENT 1 PROCESS REVIEW FOR APPLICANTS FOLLOWING ASEP HRAP 1.0 FAMILIARIZATION Explain the inputs, activities, rationale / rules, and outputs of the process used to assimilate plant specific information modifiers for key human actions included in the accident / event sequences analyzed for screening and nominal ERA.
1.1 Plant visit 1.1.1 To what extent were pre-accident tasks actually observed?
Provide example (s) of documented finding from the observation (s).
1.1.2 Identify the administrative controls reviewed and the criteria for ascertaining level of quality for the implementation of these controls.
1.1.3 Who participated in the initial site visit and what were their qualifications?
1.2 Review information from system analyst 1.2.1 What were the qualifications of the analyst (s) responsible for evaluation of these pre-accident task reviews.
1.2.2 What information sources were used to identify key human actions?
2.0 QUALITATIVE ASSESSMENT j
Explain the inputs, activities, rationale / rules, and outputs of the process used to breakdown the descriptions of human actions into tasks / subtasks or otherwise amplify the qualitative description of the key human interactions.
j I
2.1 Talk-or walk-throuch l
2.1.1 Provide an example of any structured process or aids a
used for walk-throughs or talk-throughs with plant I
operations / maintenance personnel.
Include examples of results of application of that process.
l
Rev. 01 2.2 Task Analysis 2.2.1 Identify the analytical process used to produce more detailed task information and identify influences on human performance.
2.2.2 Who performed this process, and what were their qualifications?
2.2.3 What technique was used to rank and select key pre-accident & post-accident human interactions for detailed analysis?
What was the " cut-off" criterion, and the basis for its selection?
2.2.4 Provide some examples of the application of the screening technique to select human actions for more detailed assessment.
2.2.5 For time-critical actions, how were time available and expected (average and bounds) time of performance determined?
Provide examples.
2.3 Develon HRA Event Trees 2.3.1 Describe the process used to breakdown human interactions, and provide an example of its use.
Was a
systematic classification scheme used?
If so, what was it, and what evidence is there that it was effective?
2.3.2 Was there a list prepared of redundant components susceptible to common influences of humans?
If so, provide that list and some examples of findings.
3.0 QUANTITATIVE ASSESSMENT Explain the inputs, activities, rationale / rules, and outputs of the process used to estimate probabilities of success / failure of human interactions.
3.1 Assion nominal HEPs 3.1.1 Identify specific sources used to obtain all basic HEP data, and provide examples of human interactions for which probabilities were estimated using each source.
3.1.2 For each " generic" data source, explain how the basic data were interpreted and adapted for site-specific analysis.
3.1.3 Identify site-specific data sources, including any site-specific experience base, simulator data, expert l
Rev. 01 judgement, walk-throughs, etc. from which HEPs were determined.
3.2 Estimate the relative effects of performance shaoina factors 3.2.1 Identify influences on human performance (performance shaping factors).
3.2.2 How was it determined which influence (performance shaping) factors were important and which were not?
3.2.3 Identify sources of information on generic and plant-specific operating experience, and provide examples of use of these sources to identify possible mishaps or corrective actions.
3.2.4 What were the quiaifications of the individual (s ) who performed this analysis?
3.3 Assess dependence 3.3.1 How were dependencies identified and what criteria were used to apply these factors to a particular accident.
Provide examples.
3.3.2 Using several of the most important human interactions as examples, state the key dependencies, uncertainties, and sensitivities, and show how they were addressed.
3.4 Determine success and failure probabilities 3.4.1 Explain how human interactions were grouped, screened and incorporated into the system analysis at this point.
Jul Determine the effects of recovery factors 3.5.1 How were recovery factors identified and what criteria was used to apply these factors to a particular accident, provide examples.
3.5.2 What assumptions were made in determination of appropriate recovery factors?
Provide justification for the assumptions made, j
4.0 INCORPORATION 4.1 Perform a sensitivity analysis, if warranted 4.1.1 Was a sensitivity analysis applied?
If not, why not?
If so, what technique was applied and were any substantive i
k.
Rev. 01 modifications to the analysis resulting (provide example) ?
4.1.2 Show how the following kinds of impacts (of results of human interaction analysis on systems analysis) would have been identified if they exist:
Changes to equipment reliability estimates New initiating events identified Additional common-cause links identified Modifications to the logic of event trees Time to accomplish and sufficient personnel resources 4.1.3 Were any new key human interactions identified as a result of this assessment?
If so, provide examples.
4.1.4 Were there any adjustment or modifications to event j
trees as a result of this assessment? If so, provide
)
examples.
4.2 Documentation 4.2.1 List all documentation of the analysis maintained by the plant or other support organization.
4.2.2 Who is responsible for the maintenance and distribution of the HRA information?
4.3 Supply information to system analysts 4.3.1 Identify responsibilities for updating or periodic review of HRA information ("living document").
4.3.2 Identify any interfaces, i.e.,
other assessments, information sources programs or organizations that have used or will use (or contribute to) the information obtained from the HRA.
4.3.3 Explain how " lessons learned" during the analysis, as well as final results, are communicated to plant personnel.
4.3.4 Identity any impacts to training, procedures, or other " human performance" related aspects of the oper Lion that resulted directly or indirectly from the HRA.
4.3.5 Explain how results of the HRA will be used to develop accident management plans, strategies, procedures, etc.
L
ATTACHMENT 2 Specific Operator / Technician Actions Associated with:
(1)
Decay heat removal Cross feeding Fire Protection System alternative (2)
Alternate Boron Injection CRD system makeup (3)
Actuation of SLC during ATWS (4)
Station Blackout Diesel Generator relay calibration & surveillance (5)
Containment Pressure Control Manual venting t
r-ATTACHMENT 3 Procedures:
EOP-2, RPV Control EOP-4, Primary Containment Control F-OP-1, Main Steam F-OP-6, Demin Water makeup & transfer F-OP-7, Dc?.in Water makeup & transfer F-OP-9, Main Turbine F-OP-13, RHR Operation F-OP-24C, Condenser Air Removal F-OP-25, Domin Water makeup & transfer F-AOP-13, RHR F-AOP-15, Recovery from Isolation F-AOP-18, Electrical F-AOP-19, Electrical F-AOP-35, Containment Venting F-AOP-37, Alternate Boron Injection F-AOP-38, EOP Isolation / Interlock Overrides F-AOP-49, Electrical, SBO In addition to the above listed procedures, I would like to review a sample of instrumentation calibration and surveillance test procedures (IMP, ISP), should include Diesel Generator load sequencing relays, reactor level instrument channels associated with ATF level control, and containment pressure control.
1 1
I
-