ML20072D979

Ipe:Step 1 Front-End Audit

ML20072D979
Person / Time
Site:	Perry
Issue date:	06/15/1994
From:	Clark J, Darby J, Rao D SCIENCE & ENGINEERING ASSOCIATES, INC.
To:	NRC
Shared Package
ML20072D793	List: ML20072D979 ML20072E032 NRC-92-1106, Step 1 TER of Perry IPE Back End Submittal,Final Rept
References
CON-NRC-04-91-066, CON-NRC-4-91-66 SEA-93-553-006, SEA-93-553-006-A:1, SEA-93-553-6, SEA-93-553-6-A:1, NUDOCS 9408220061
Download: ML20072D979 (42)

Text

.__

l l

l EliCLOSURE 2 PERRY INDIVIDUAL PLANT EXAMlllAT10N (

TECHN]C AL EVALUATION REPORT (FRONT-Ef;D) 1 i

l l

w I

9+DCz2DDlo( ' PP' j

y ; 4 u3.. ,.;. .4 :

h 'i icN Perry Nuclear Power Plant Unit 1 IPE:

Step 1 Front-End Audit Contractor Step 1 Audit Report NRC-04-91-066, Task 6 D.V.Rao J. Clark J. Darby R. A. Clank l

Science and Engineering Associates,Inc.

1 I

4 As crah sfinc.

Prepared for the Nuclear Ke;;ulatory Commi<sion

f r TABLE OF CONTENTS 1

4 L'GRODUCTION 1

11 SEA Audat Proces+

1 1.1.1 Review of F5AR and Tech Specs 3

1.1.2 Review ofIPE Submitta:

3 1.13 Audit Report 3

12 PNPP IPE Methodology 3

1.3 PNPP Plant 3

1.3.1 Sunilar Plants and PSAs 4  :

13.2 Unique Features 5

!! CONTRACTOR REVIEW FINDINGS '

Review and Idennheaton cf Front End Analysts 5 11 1 Genera:Ovemew of Frent End Analys:s 5 11 ; ,

5 II i 1 : Cempletenes: Cheek I

11.1.1 2 Me:hodo!cgy Check Dees IPE Mode! A' Bu:lt. As-Operated P: ant 3 1:113 6

111 L4 Intemal Fioedmg Methodo:ogy I:11: Utt : P&- Ses to.-

1: L2 Review of Accident Sequenct Delmeanen and e, stem Ana:ysis 171.2.1 Irenatmg Event Review Review cf Front Lme and Support System < Analysis 5 1112.2 ,

9

!!.1.2.3 System.- Dependenc:es and Supper: Syste:ns Treatment of Correnon Cause Failures 10 11124 Review of Es ent Trees 10 111.2.5 Dominant Sequences 13 11.1.2.6 Front End and Back-End Interfaces 17 11.1.2.7 Mult-Unit Considerations 19 11.1.2.8 11.1.3 Review of IPE Quanntante Process lo 11.' .3.1.

Quantficat2on of the impact of Integrated Systems and Component Failures 20 l

11.1.3.2 Fault Tree Component Failure Data 20 in I

TABLE OF CONTENTS (Continued) 11.1.4 Review of IPE Approach to Reducing the CDF 22 11.1. 4 .1 Methodology for Identification of Plant Vulnerabilities 22

11. 1.4 .2 Plant Improvements and Planned Modifications 23 11.1.5 Review of Licensee's Evaluation of DHR Function 24

11. 1.5 .1 IPE's Focus on Reliability of DHR 24

11. 1.5 .2 IPE Conudered Diverse Means of DHR 24 11.1.5.3 Unique Features 24 111. OVERALL EVALUATION AND CONCLUSION 25 IV. IPE EVALUATIONS AND DATA SUMM ARY SHEETS 26 iii

1. INTRODUCTION Tn.- mt edu:terc dapict presen:s 6e prxess used er 5:lence ard Engmee mg Arse:ia:e . In: '5EA toauit the trent-end perten ci se Clese:and Elect:: 12ummatmg 'CEl s Iniudua; P! ant Exammaten 'IPE Subtrattal fer the Perry Nuclear Power Plant (PNPP) Urat 1 This front end review fo:uses en accident sequences leadmg to core damage, due to mtemal m:tatng events and internal floodmg. Auits of the human fa: tors analysis and back-enct ana!ysis were performed by the NRC with contractual help from Concord Associates. Inc. and Scientech,Inc., respecurely. There have been discussions between these teams to check IPE treatnent of Level 1/ Level 2 interfaces, and LevelI/ Human Factors interface >. The contractor review fmings are presented in Secten D. and IPE Evaluanons and Data Summary Sheets are enclosed as Secton IV.

1.1 SEA Audit Process Tha suit is a 5:ep 1 auit. which means that 6e issues raised m this report have not been discussed with the CE) persennel Also, a visit to the PNPP site a cut c f scere of this audit. The purpose of this audit is to identi':-

w es related te se frent-end IPE anaipes for PNFP Urat 1, and to provide NRC with these issues SEA Auit i

recess a :Lumau j m Figure I and suNequen:!v descnbed be:ew I.1.1 Review of FSAR and Tech Specs Tne NRC pres 1::ed the PNPP sub u::a to SEA m September 19E SEA began work on September 11 bens een September 11 and 30. the renew focused en a henzental review of the subtrattal to develop sufhcient 2.-m ^;" ' :m nerRre an:: turnr! 'vctems and ident:iv apparent dehciencies if any. :n the

.:c ma:.cr. asse nb;y prxe:S ef the IPE The ebect ce ci the prelimmary terw.e was to idennfy specih: areas

. de F5AR that need specia; attenten be: ween Octeber 4 and 30. the latest tupdatedi Fmal Safety Analysis Report (FSAR) and Techrucal 5per.i:atens (Tes Specs)ier PNPP were reviewed Copies of the requded parts of the FSAR and Tech 5pecs w ere brought to SEA Albuquerque with perrrassion of the NRR Project Manager, Mr J. R. Hall. This provided aditonal tme for FSAR renew as well as permittmg the FSAR to be referred to during various stages ofIPE renew. The focus of the renew was to obtatn a better understanding of vanous plant systems, cf plant design.

and of acedent response, and to determine whether the licensee modeled the as-built and as-operated plant.

i 1

I RESULT ACTIVITY  ;

Receive Perry Nuclear Power Plant Unit 1 Submittal s i

17 Review FSAR ,_,,,,,,,,,,,_,_p,,,,,

List of items of interest Based on Plant Design Technical Specifications if If Interface Review Perry Nuclear Power ,,

issues with Plant Unit 1 IPE Submittal List of Items to M Fa to s and Resolved Back-End Audits IT

-"*"" Draft Audit Report to NRC Complete Data Sheets if II incorporate Review ' - -

41""" Final Audit Report to NRC Comments on Draft Report

)

i I

I Figure 1. SEA Step 1 Audit for Perry Nuclear Power Plant Unit 1 Front-End IPE

\

2

1.1.2 Review ofIPE Submittal Bew een Octeber 4 and 0:teber V a detade:' review ei de IPE subm:na;:ar PNP" u a 3::cmrlished The encr* :ncerperaud a her:: ental reuew ei an aspe:ts 0: de trent end asuu cand ic .n step : Reuew Gu: dance Dr.:rnent idated 05. ic h as wcE as vern:a! reviews ei se:e:ted key issues The r.ndmps of ee review are documented in Seenon U of th:s report The review procedure focused on checker och check-item lated in the ' Step I' Review Guidance Document as well as the Statement-Of4Vork (50WL i .1.3 Audit Report On November 6,a draft copy of the audit report was sent to NRC for review. The report addressed each werk requirement called-out in the SOW. The report also includes (Section IV) a set of IPE Evaluabon and Data' Summarv Sheets The standard format for these summary sheets was provided by the NRC. These sheets were completed as requ: red

,nc rea; repert will tn:c rerate the ecmments trem the NRC on this Dra't report I.: PNPP IPE Methodology The PNPP IPE uses the smal! cvent tree and large Imked fault tree methodology to perform the trent end ana ues Deand fault trees a crc deve::pcd to the ccmpenent and tratn level, for ca:h of the front ime and Recos erv a nens w ere censidered and common mode failures were tncorporated into the support systenu '

n..: ~ee- Gercn and Piant spe: : f a:!.:re data were used m he analysis NTPR.-\ was used for sequence cua ncaoon a .d fault :ree 1: dung Data uncertamr. analys:s was performed, also usmg NTPRA. te quanniy data uncertart. and its r. pact en se CDF Tr.e mesodo erv used m se IPE trent end analysis of PNPP Urut 1 meets the enteria of NTREG-1335 and Genen: Letiu 55 :  ;

1.3 PNPP Piant The PNPP site consists of one BWR nuclear unit, BWR/6-23S, manufactured by General Electric Company The turbine generator was supphed by General Electric Company, and the engineering and construction was by Gilben / Commonwealth. Unit I was declared commercial on November 1967 and is rated at 3579 1250 hnve. Unit 2 is parnally complete t.nd is expected to be completed in the future. Some of the equipment in Unit 2, e g., DC Batteries, are used at present for Unit 1 operation.

1.3.1 Similar Plants and PSNs PNPP is similar to Grand Gulf nuclear power plant which is a BWR/6-251. This plant is a NTREG-4550 plant.

Other sirrular plants tnclude genenc General Electnc 23S Nuclear Island (CESSAR 11), and Kuosheng ,

p 3

i a E '. . ~ . : : - PR.; r d;e! < o . - de-e p;ar 2.. c alie pr 9 " - -- . . re.;ew ed by -

NEC Tre dehreces rer.s eer Grand Gu : and PNTP appea: be maner :F5A.7 C arie- 1.1 and none ha.e

. a r :0 5;cuncant;v ;mpa:: 2e CDF cu:: cme .

i 1.3.2 Unique Features Uruque features of PNPP Urat 1 mdude 1 There :s a meter dnven feed pump that is normallv m standby and will start on an automatt:

signai at Level 2. following failure of the turbme driven pumps 2 The safetv-related de buses can be cross-tied to the de batteries in the not yet completed Urut 1 Th:s feature extends availabihty of de power following LOOP and Station Blackout sequen:es 3 The HPC5 D G is not of same size c: tvpe as de ether two D G s Th2s da ersity will reduce ,

the hiehhood of seme ccmmen cause failure of all three D G s 4 T. c HPC5 D G can be cess ted to D:us:en : emergency bus. wh2ch enables the centauunent s(n . a's es and by drogen :g: ters to ec paw ered :n the event of LOOP and loss of Div. I and

DG- ,

Centa:nment ta lure leads to mice:wn tailure r Mait up to the 5,:ppre.stan Poolis provided by gravity head No pumps are mveh ed.

HPC5 2-d LPC5 m ect uwde se c::e shroud Consettuent!.v.the HPC5 is not a recemminded I

,- hi * '. i ma:.ga:.:

The .De :r.h:ht a nen is net au:cmat: ,

Ean d en de u: que :ea:urt s the icy areas : dent:ned fe: review are ATW5 and LOOP.

7 l

L l

l 1

i a

I 4

II. CONTRACTOR REVIEW FINDINGS de IPE The IPE was peer A tea m cent stng c: CE! pc cerr.e; and cent-acter perierr.c: hai perferm reuewed bv CFJ persennel w s centractual help It is stated that CE: miends te mamtam the IPE as a ' .mg deccent w,th updates es ery tue y ears. Mam updates wtU melude usage c: mere plant spec;r.c cempenent fadure data and human accens 11.1 Review and Identification of Front End Analysis Ilus secton presents our hndmgs, mdadmg a summary of IPE strengths and weaknesses and a L5t of que to the bcensee. The foUowmg sectons address each work area expbcitly in the order they appear in the SOW.

11.1.1 General Overview of Front-End Analysis 11.1.1.1 Completeness Check bet .ccn Sepicmber and October 1 a dety:cd renew ef the PNPP IPE sub=tta! was accomphshed Iruna!

renew ciien :ces d en a comp:cteress med w htrem the centent oi the JPE sub=rtal was carefully exa nmed te see u the =etmanen presen:cd and the c.e: ef deta:1 te w h:ch it vu presented met the guidelmes +ct bv NUREG-:3^~ The PNPP IPE sub=ttal dese:v adhered to the format recommended m NUREG 1335, wh ch

- .ade tJus =tal renew precei* snaightierward Based on the review it is concluded that the PNPP IPE U EG 1335.

cubrruttalis complete with respect to the type of information and level of detail requested in N R The S ep ; Reuca Gu. dance was extensa e:y used m the renew 11.1.12 Methodology Check T; e PNPP 1PE uses Sma!! Funct er.a: Event Tree and Large Lmked Fault Tree methodology to perform the

+ rent-end analyses It is reporte:

that fault trees were des eloped for a ; frent-Ime and suppert svetem Reco'.ery accons were considered. Common mode failures were mcorporated mte the fault tree mode:'

Uncertamty analyses were carned out. In addmon, a sensmvity analysis and importance ranking were performed as part of the IPE effort. An intemal floodmg analysis was carned out to the level of de by huEG-1335 and the GSI A-45 issue was adequately addressed. In conclusion, the methodology the PNPP IPE submittal is consistent with the methods identified in Generic Letter 88-20, and NUREG-1335.

11.1.1.3 Does IPE Model As Built, As-Operated Plant Secten 2 4 of the IPE subtruttal discusser. the mformaton gathenng process employed by the utibty. Accordmg to the subrnittal, the desenpton of each system was based on the most current versions of the FSAR. P&lDs, 1&C drawmgs, and other related documents. For all the trent-Ime systems, the systems desenptien was 5

runc repre:en: 9 e as + =.:

.hded agam.5: U5F G a.tpa-e earcv u Te :cerr. ia: s.5:e= me::

as- perated plan se :o; cweg precetre was te2cwe: bv the S:ersee The study wagene-med bv the incependen: Safety Engmeerm;5e:cen at the Perrv 5 :e se that design documentarien was directly available 2 Analysis bles were set up for ear.h phase of the mode: development to ensure that th dccuments used and the deosions made on the basis of mformanon m a given document were recorded. Tlus en>ures that companson between the model and subsequent design change packages can be made m a controlled manner.

3. The design engmeets reviewed all the system models for correctness of assumpbons concernmg design, abgnment and eperanon.

4 Cyerations stait reviewed all the es ent trees 5

The current se: of operatmg procedures were used in performmg the human rehab:.1:::,

ana:vs:s and many of the acnons w ere discussed with tratmng and operanons persormel

- Mam:enance da:a w as acquired d:re::!v frem plant eperanng expenence.

m u ere made to the plant te walidown systems which could lead

' g.mcan: n a-bcr , -

~

te ficodmg and to trare potent:a; r. cod prepaganon pathways v

~r.c Con:ammc : E.Ed:g 5:renge Evaluanen and pertions of the mtemal floodmg anah - -

Commonwea:th. the arclu:ect/ engineer (A/E) for the Perry a c:e peric med h G;:bert s; . - . pg. . . q,..

9 Ir. add:nen te reuews ei ea:h of ee system analpes by the appropnate design engmeer3 m:ermed:a:e reuews , the weri products and the draf t report were performed by key persennel trem the eperatons. trammg. and engmeenng departments.

This procedure appears to be thorough and ensures that plant models represent as built,as o 11.1.1.4 Internal Flooding Methodology As part of t.his review, the JPE submittal Secton 337 covenng the internal floodmg scena Secten 337.1 indacates that the full floodmg analysis is described in Appendix C. However, Append not subtrutted for this review, and comments are based on observatons documented in Secnon 3 contnbuton (from mtemal flooding) of -1.5 x 10*/ yr. represents a 12% contribunon to core dama ge freq from mtemal events and flooding. In Seccon 33f, the beensee stated that a 12% contribution (with a single floodir,g scenana concibunng about 7% of the 12%) is a conservative estimate and As a result, no plant specahe improvements were proposed by the licensee l I

6

Th :." owr.g are spect: ccmments a eas c::encem sat are e:mer ;mp..cc . u. ume.: .w r. : ::cumer ::

addrwed m Appenix G er w ere emmed . ~cm the fleedmg anaivsa

!!.1.1.5 Utility Feer Review An mdependent review tea.n consisung of several CEI engineers and centractor personnel from RAPA.

cenducted the peer review. The CEI staff was entrely responsible for review of the systems models and the accident seciuence models. Several engmeers and hcensed operators were tramed irunally in PRA methodowgies and were then used m the review process. After the quantihcanon process u as complete, the corporate technical staff were responsible for review of the dommant sequences. The plant shift supervisor was the coordmator of this effort. In additon, two independent reviews by RAPA have taken place during the IPE effert. Phase 1 of the review covered mitatng events, acodent sequence analysis, and system modeling. Phase I! cesered common cause and dependency analys:s. data base, human mteracnons, internal floodmg. and sequence quanthcaton The major cemrnents generated by the IPE peer review process were documented as par ei the IPE (Secten 53) and reflect theroughness of the review procen These comments were adequate!y andrened m the IPE Se: ten 5 4 11 1.2 Review of Accident Sequence Delineation and Ssstems Analysis 11121 Initiating Event Review c . cnt-  : amen c_e w rec- n=cni . by Sc r*v- % : I cf the Dr.if* Ster 1 Re" e G.. dan:e 2e imdep cf t'e res:ew er are as te!!cw s Tbe iden:n:aten of the in:tatng Es ents (IEs)is based on standard techtuques consisung of mdustry operatng openen:e. ether PRAs, and PNPP specinc reviews Table 31.1-2 of the subm:ttal provides a complete bst of

• ne ER1 Trans:ents, as bsted m NUREG 2330 Tab!e 31.15 provides classihranon of these transients m: 05 Lutatng Es ent Groups:T1,T2.T3A, T3B, and T3C. A total of three transients were discarded as they are not relevant to the PNPP and sufhcient }usnheation was provided in section 3.1.1. In addition to the IEs hsted above, six other IEs were considered These are: A, Large LOCA; 51, Intermediate LOCA: 52, Smal) LOCA; V, interfacng Systems LOCA; O, Contamment Bypass LOCA: and R. Vessel Rupture. This list of irutiating events as well as the nomenclature is same as NUREC4550 Grand Gulf Study, and is in general agreement with other BWR stuches. The IE frequencies for these IPEs were essentially the same as for those used in the Grand Guli Study. The only notteable discepancy is that IE frequ mey for T1 of 0.06C?/ yr. was lower th.m 0.11/yr. used m the Grand Gulf Study. This was attributed primarily to the differences in the off site power distribunon system. The only other difference is LOCA classihcanon, which was discussed in secnon 31.1.1.2 of the subm:tta!

7

L 2:iten :c de e:e'.en IE. hs:ed abes e. ta e r: art specmc =ta:cr w ere cc-::dered m ss ana'ys:> Tre-(

are !! A. Less of Ins u .en: A::, and TSW. l.es cf Sen :ce Water These t.ve matater> were reta ned a:ter TME.A w as reper:edly used to chrn.nate :ac.:re ei a s anc:v ei e:eemcal syster a a: svstems water su:er: and ETAC systems as:n::a: ors The screenmg proces' used to ebtam plant spcahc manatng evenir a reasenab:e and consutent with PRA pracuces However,it is not clear to the reviewer how PNPP IPE arnved at the IE nequences used for these two plant spechc irutates tn the analysis. Specinc d:scussions to this regard wou be benehcial.

The IPE bnefly descnbed dependences between uutsatmg events and the mitigating functions and systerns-The submittal did provide a complete dependency matrix for front line-to-support and support-to-support systems. Also, further details on the system dependencies were summarized in Section 3.2 of the IPE.

In su-nmary, the manatmg events se:ected were the same as those used m the Grand Gulf study, except for p'rt specmc trutaters The IE frequencies w ere essentially the same as those used m the Grand Guli study.

cuspt fer p;an: spechc = cater- In our judgment, the list of IEs, generic and plant-specific,is complete.

Grouping of the Its is consistent. The only possible deficiencyis that the IPE does not clearly describe how IE trequencies for T1 A and TSW were obtained.

1112.2 Review of Front-Line and Support Systems Analysis

~._3 c: nen:ime and suppor systems anah ced m detad are as follov 3 Frontline Systems RPV Depressunzanen Standby Liqu:d C nrrel Residua: H(at Eemoval Low pressure Coolant Iniecnon Mede

- Contatr. ment Spray Mode

- Suppression Pool Cochng Mode Low Pressure Core Spray High Pressure Core Spray Reactor Core Isolation Cooling Condensate /Feedwater l

Fue Protectirn Alternate injection j ESW o/RhR B Cross Tie Alternate injectwn l Reactor Feed Soester Pump A!!emate Injecton Ce ntatnrrent Ventmg by Fuel Pool Coohng and C.'eanup Contatnment Venttng by RHR Contamment Spray i

S 1

l

Surrett systems suppres-:en Poo! Make up LNyw c!! Vacuum Rebet ECCS Pump Roem Cochng Diesel Generator Room Ventilation Emergency Closed Coolmg Nuclear Closed Coolmg En ergency Seruce Water Safety Related Instrument Air Service /Instrurnent Air Emergency DC Power Emergency AC Power Service Water Turbme Eu21dmg Venttlar:en Heater Bay Ventuanon Turbrc Su:ldmg Clostd Conn; Fcr (29 c: thesc 5, sterrA the IPE presemed a Encf system descnprion. and details on system operanon. system dependenc:es and tnterface.s and system success enteria. Also provided are the schematics of each system

! rom the review it is concluded that PNPP IPE analyzed all the importan. front line and support systems

. required for prevention of core damage. It appears that the systems were modeled to the level of detail l requested in NUREG 1335 I 11.1 2 .3 Systems Dependencies and Support Systems Considerable ef fert was devoted in the PNPP IPE to idennfy important systems dependencies and interfaces l (see Secton 3h of the IPE). Dependtng on the type of the system, related discussions covered areas such as i

power supply and control power, actuation, coohng water, and related operator actions. In addition, two j dependency matnces were enclosed The first one presented dependence of front-line systems on the support l systems and the second one focu>ed on support system-to-support system dependencies. The list of support systems analyzed was presented above. Tnis includes the minimum required systems: electrical power, instrument air, HVAC, service water, and component water.

The IPE :ccu!d h.we beneMedfm a description of the diesel supportedpre trater system the iPE toc.k credit for pre reater x-::e m se:cr.-l e~ent trees 9

i

1 1

l N rew. c: the dependcr: T. ara res ea:s d reur =. =ccm ster::c T - .' .- - -

v: e.: - ' ~ .~ : : . r w . :n: .: : c ADE : i 5.T. -  : ~:r: ' icrc:.ie:: ~ ' e c.. * ::::- -

Th:s a nc bc - ee sm:e these systems can be eperated by the ensite D G 5 :0. 0wmp less of ciisite you er Th.# l dependen:v should be changed to partia: dependence Tu;c .tcrende:: ~:.: ":t .: n.d.: : a t:::: : : .-

4:ntime nste":s are pa t::: u dependent en ti:e MCC s:atci: gear HVAC The event tree for LOOP mode'ed the a:cdent progression based cc.the assumpton that MCC twitchgear HVAC fadure has little impact on the front lee systems. If the event tree, which is based on more 4ecent calculations is accurate, then the dependency ma:rn must be updated to reflect this new understandmg.

From the review it is concluded that IPE treated dependencies between various plant systems in a consistent and reasonable manner. Few deficiencies were identified as discussed above. Specifically the dependency matris should be updated to incorporate the comments presented above.

111.14 Treatment of Common Cause Failures s-: .rrc : cch ; ues und te nea: cor enen ca_se fadures :s :rcemplete and er tressmg The IPE ne:ed m: de:aud desenr en is prevised :n Appendn C : ntech is m:ssing from the subm2ttal The descr:pt:en n.d h :mpreus and suggest close adherence to NTREG-4750 guidelmes for common cause analym.

Ad .tc na. co:::r : eecms :o ind::2:e : .a: Be:a Fa::ct method was used for ccmmen cause analys:s 11 ; : ? Roiew of Es ent Trees Trc PNFP E'E uscd hmmena: event rees A d:iferen: FE1 was develeped for. Less of olisite power; trans2cnis w.= ;c: d PCs rar.s.e .ts w::n PCs m:ta;'y as adaHe. transient., with loss of feedwater, but with PCS m: nae.

a.adaEc. madverte .: epen rel:ei valve en the RPV. loss of instrument air. loss of service water;large LOC.4:

- t r en.2:. LOCA and smau LOC A The FET> were conhgured to mode! svctem response to specisc maa:mp es ents trzeugh the use of es en: tree tcp legies.

The followmg paragraphs provide our specihc comments related to each individual event trees.

Trannent mi a Less cf Pf 5 Es ent her:

The event tree is essentially same as that developed in NUREG-4550. The event tree modeled all impc,rtant steps of the accident mitigaton. No inconsistencies were found.

Trannent si ELS uuttalh Avadabh EYED hee-De event tree ts essentally same as that developed in NUREG-4550. The event tree top U3 in this tree it different from U3 tn the previous event tree. Confusion can be avoided if U3 in the previous tree 10

_ _ _ m _ . _ __ ~ _ _ _ _ _ _

a named D Oierwue. de s;cce+5 r.tena and es e .t trees ict bcs thec *ranner: are very nnn'ar The event tree modeled a2 :mpertant steps of the ac= dent nutpaten No inconsistencies were found.

L.cli cf Feedwater Transient Enn;he.g The event tree is essennally same as that developed m NL' REG-4550. The event ~e modeled all j

important steps of the accident rrungamen. No inconsistencies were found.

Large IRCA EventIIge; All break sizes greater than or equal to 0.5 sq. ft. for a bquid break and greater than 0.3 sq. ft. for a i steam break were classihed as a Large LOCA Event Tree. This critena is different from Grand Gulf study whic.h modeled all breaks larger than 0.3 sq. ft. for both liquid and steam break. This deviation  :

was adequately explamed The success enteria for LLOCA was based on MAAP code calculations. ,

The event tree modeled the success criteria as well as the important accident mitiganon events accurately Only possible denciency found was that the IPE may have not modeled closure of MSIVs and epenmg ei SRVs w ere not modeled m the event tree. For a large LOCA outside the con +ainment. ,

failure to ciese the M51Vs w:ll result m depletion of suppression pool water available for core Our calcu!atons m6cate that substantal water deplenon could occur m ten mmutes after the LOCA. Th2s

ncludes water from the upper contarr.ent pool It is possible that the IPE modeled this event. The IPE should specifically address this concern. No other deficiencies were found. ,

Inteme6 ate LOCA Event Tree A2 breai 52es between 0.01 and 0 5 sq ft. for a bquid break and between 0.1 and 0.3 sq. ft for a steam break were classihed as a Intermediate LOCA Es ent Tree. This criteria is also different from Grand  ;

Gulf study and the deviacon was adequately explained The success enteria for Intermediate LOCA was based on MAAP code calculabons. The event tree modeled the success cnteria as well as the important accident m:ngation events accurately. Failure of MSIVs to close is important event for m2ngatmg Intermediate LOCA. Water depletion rate is substannally larger than the make up rate.

This concern should be addressed in the IPE. No other deficiencies were found.

Small LOCA Etenther; All break sizes less than or equal to 0.01 sq. ft for a Uquid break and less than 0.1 sq. ft for a steam bre:k were classi6ed as a SLOCA Event Tree. This criteria is different from Grand Gulf study. This deviation was adequately explamed. The success criteria for SLOCA was based on MAAF code calculatons The event tree modeled the success entena as well as the important accident mitigation j events accurately. In our judgment. fatlure of MSIVs to close is not important for mitgating SLOCA.

No deficiencies were found.

11

In our judgment, these event trees adequatch model all important miticating actions to the les el of detad required by the Generic 1.etter 55 20 and described in NUREG-1335 Deiiciencies noted were discussed abose.

Special Event Trees:

A total of hve special event trees were developed for PNPP IPE Our review comments on these event trees are hsted below Less d Offsite Power Event h The es ent tree top B1 should be "Onsite AC Power to Division I and Division 2" instead of ' Offsite AC Power to Dmsion 1 and Division 21 T1us is a simple misprint and should be corrected. Indusion c!

an event tee top cress-cetng of the Divis;cn 3 and Divisien 2 DGs' could be benehcial to mede! 6e acadent progress On the other hand Esent tree top Hv models failure of MCC, Switchgear and Shsc.

A eas HVAC The dxumentaten ctes recent calculations whach indicate that Hv has little impact en the ucidcrt nut:gaten and thu5 a success probabbty cf I was assigned ict this event Hence we rcccmmert remetu g H', frem the es ent tree which would substannally simph!y the accident r rep re-:cr. Otherwise the event tree has mode:ed all important mingatmg accons No other deficiencies were found

.. -=

Cc men cause f ailure of the DGs are the mam centributers to stanon blackout The event tree is e: senna:,, ie same as that do e'ered m NUREG'CR 4550 The es ent tree modeled allimpor:a .!

step, e: the a:cident mmgaton No inconsistencies were found.

Trm:em d 1 ads etent h Er::et Mvi.

Tne es ent tee is essentaUy the same as that developed in NUREG, CR-4550. The event tree mode:ed allimportant steps of the accident mingaton. No inconsistencies were found.

Less d Instn: ment im Eunt Tree-In our judgment, the functional event tree is correct and no deficiencies were found.

i

)

Len d Service Water Es ent h Tb event was not analyzed in NUREG-4550 in our judgment the functional event tree is correct 1 and no cleficiencies were found, l

12 r l

AD.Ei EC 1:.11.

Tr.a e an :rnper:ar: centnbuirr :c 2e to:a: CDF 1mrertr.t human 3:::en a :aCure te ADi Lib:-

A ma:er 1::eren:e between the Grand Guh -tud:. and the PSP"IPE :- :N m:-smg e er : ec :::

Operator manually uverts miv: dual groups of contre! rods O$erwise de event tree .s essenna:5 same as that develeped in NTREG/CR-4550. The event tree modeled all tmportant steps of the accident mingaton No inconsistencies were found.

Internal Floodm e See section 11.1.1.4 for 6scussions on the methodology chosen and results of the Internal Flooing No event trees were developed for Interfacing System LOCA, Containment Bypass LOCA, and Vessel Rupture. Their contribution is expected to be less than 1.0E-S. In our judgment, the special events were We found no treated rigorously, with the level-of-detail sufficient to reveal any vulnerabilities.

deticiencies.

11 L: e Dominant Sequences Tne port estmate for the CDF is L:Ef vr Tne dentnant IEs are: ATW5. LOOP, S.B., transients with the le cf PCs r.dle-s of ns umen a.: Tegether these tranatmg events cont ibuted about c5 4% ef se tota! CDF ATW3 a:cne contnbuted abcut 4E of the teral CDF. Although this is inconsistent with the NTREG-4550

.-,. << -..wr d:!fe ente < m the analvset

,,,, . , _c 7., . 7 Grand Gul: srady taca crei: for operator manually mscrtmg mdividual groups ei cent ..

rods PNPP IPE ici not take cred.t for this operator action.

Grand Gul: study assumed that HPCS is an acceptable means of core mjecnon. On the other hand Pern rehed on BWR e ou ners group recemmendanon that HPCS should not be used to truegate the accident These two deviations essentally conenbuted to the noted increase in ATWS contnbution to CDF. The only other &fferences between the Grand Gulf study and the Perry IPE related to T2 and TIA. In both cases Grand Gul! CDF islower than Perry values. But the deviations were adequately explained and appear to be correct.

The IPE identdied and clearly discussed 15 dominant sequences that together contributed to about 81', of the CDF. Secten 3 413 of the IPE present these discussions. Top ten dominant sequences that contribute to about PO% of the CDF are 6scussed below:

Sequence (T3 A + T2)-C L'3-X"(T2-c530)

Fre::<er::y 2.2]T4 Centnhtti:n 1.0 5'o 13

A rars.ert ha oc:u- ed The PCs ma:. be ; cst enha due irec:: :o : e cr :en: c due to ubsequen-cc ninens wh;c.h may result m .\!51V isolatien The contre! reds iad te insert m c the core and the reacter rema .s at pc.,c: T're meter feed pump has f a:!ed to tniect mto the RPi to mam:am RPV leve' contre; The Cyeraters hasc faded to ehta AD5 resultmg tn rapid depressunzaten 0: RPV an: miecton of low pressure ECCS resultmp tn a reacnvity excursien leadmg to core damage The initatmg event T3A (transient with PCS available) contnbutes almost, three emes as much to the fa !ure of this sequence than does T2 (transient without PCS). This is due to the failure of the operators to maintain PCS available for an ATWS scenano. FoUowing the initiating events T3A and T2 given the mechanical fatlure of the control rods, the dommant contnbutors to this sequence are failure of the operators to re-open the motor feed pump control valves. manuaUy depressunze the RPV, and inhibit ADS.

Sequence T2-W-i-Cv (T2504)

= u.e' - : 1: E - Centr:?:.: ~: 13 ?%

A D- ,: . C5 can':en: hat. eccurre." with a reacter scram and successful $RV eperaton to maintatn RPV pressurc cenne; The motor feed pump has started and is successfuuy matntauung high pressure RPV le cc-re Tre RHR s.cem and s entmg has e f aded to provide long-term centamrnent heat removal. Without cen amren: heat remeval the centaminent ruptures disabimg the mjection path from the motor feed pump,

- ;as:c- rere damace Tre de~.mr.: centnb.ner' to the fadure of ths sequence are fadure of the injecton path upon failure of the c ntammer.: and fadute of 4.It0 VAC Division 2 Bus EH12 The mamtenance unavailabihty of RHR tratn A and the epera:er f adute ei the operators to aben a contatnment vent path also contribute to the frequenc tn.-sequence Sequence T1-B1-U1-Va-R (BS24)

Fre.iurn:u ~1 E-7 Contnbutwn 6 6%

A loss of offsite power has occurred and the Division 1 and 2 diesel generators have failed to provide onsite AC power. HPCS has failed to provide high pressure RPV level control. RCIC has successfuuy prov pressure RPV level control for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> at which eme the suppression temperature limit of 185' F exceeded and RCIC hils. The operators have successfully depressurized the RPV, but the hre protection system has faJed to provide adequate low pressure RPV level control and offsite power was not re 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> leaing to core damage.

14

inc ic=.: nan: ::ntnbut :- :: &c iadu:e :t 6:+ se:;uen;e a:e una'.aCab - : . e :e pt:te: rn -:e= ::

prende ahemate :njecten due to:adtre ei:he ciste power.fadure ei the iese: :.:e pump te . .m and radure c: &e cperate:' to abc- de n:e p;cteenen system to: RTV:ruerten after RCIC i 105-Sequence TI A-UI-L 2-V-Va (TI AS14 Frf.:w::y 7.53 E-7 Centntut:on E 5'o A loss of instrument au has occurred with a reactor scram and successful SRV operation to maintain RPV i

pressure control. RCIC and HPCS have failed to provide adequate RPV level control at high pressure. The RPV has been successfully depressunzed. With the RPV depressunzed low pressure ECCS make-up and low pressure alternate in}eccon have failed to provide RPV lewi controlleadmg to core damage.

The dernmant contnbutors to the failure of this sequence are failure of the operators to successfully alp de rearter feed booster pumps or suppression poo! cleanup for alternate low pressure mjection. Common cause 2; ute c: Emergen:c Sernce Wata r~mr- A ard B. and other randem railures of Emergencv Se:n:c Wate:

a.m A. B and C a!5e cent &ux * ' de cere damage frequency for this sequence.

Sequence (T3 A - T21-C-D-X" (T2-CS:01 1

' ~ x::;. ili E ~ C:'::r:h.' ': ! T ran::ent has c: curred The PCS may be lest either due directly to the transient or due to subsequcr*

rninens uh::.5 may reiu t m MSIV isolanen The control rods fail to msert mto the core and the reacrc-remau.s at power The : noter feed pump has successfuUy injected into the RPV but the operators hate iaded 0 cento: RPV les el Tre operaters hase successfully irdubted ADS but have subsequently failed to runate

-:andt equ;d centro::eadmg a :::c damage The trunatmg event T3A (transient with PCS available) contnbutes almost three times as muc.h to the fadute of this sequence than does T2 (transient without PCS). This is due to the fadure of the operators to maintain PCS available for an ATWS scenano.

Sequence T--UI-RI-Ws-V-Va (RS20)

Frrquenev 6 04 E-7 Cont ributson 5.2*.

A less of offsite power has occurred wath a reactor scram and successful SRV operation to maintain RPY pressure control. HPCS has faded, but RCIC has successfully provided high pressure RPV level contro! At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> RCIC f aded due to fadure of the Suppression PoolCoohng mode of RHR and non-recovery of offsite 15

O p rw er The RPV has been sue:esshdiv depressunze: Lea prew.re FCC5 make-cr and a;temaa ;ow press =e make-up has e faded :eadmg te care damage Tne cerranant contnbutors to tne fadure of ths sequence are the fadure ci the operater to abgn f:re protect:en for a!temate mjeccon after RCIC fads and the failure of the Divaion 3 diesel generator to start. Fadure of the Division 1 and 2 diesel generators to start. the fadure of the offsite power to provide adequate low pressure altemate m;ecton, and the failure of the chesel dnven hre pump also contribute to the failure of this sequence Sequence T1-B1-UI-U2-R-Va (BS3 D Frcauen:v 5 26 E-7 Contribution 4 5%

A ! css of offsite pow er has occurred, and the Division 1 and 2 diesel generators have failed to provide onsite AC power. HPC5 and RCIC have faded to provide h2gh pressure RPV level control. Offsite power was not recovered at 0 4 he=5 The operators successfully depressunzed the RPV, but fire protection altemate mjection f aded :c provide adequate RTV level ce=c:

The de=nant centnbutors to the fadure of this sequence are the failure of the offsite power, failure of the operaters to bypass the RCIC isclat:en en high stcam tunnel temperature, runnmg failure of the diesel fire pump.iafure of the operaters to abgn nre w ater m a ttmely manner, and start failure of the division 3 diesel

'n '. ard 2 diesel cenerators alsc centribute to this sequence.

gerera or start f adure+ ef the Dn:

Sequence T1-fil-U1-R (BSI-)

Frcm.e:.~ 3 3i E: Ccntr:h.ncn 25 A:055 ef offsite power Nas occuned, and tre Divmen 1 and 2 diesel generaters have failed to provide ons:te AC pow er HPC5 has f aded to provide h:gh pressure Rr'V les el control RCIC has successfu!]y provided high pressure RPV level control for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> at which tur.e the operators have successfully depressurized the RPV and abgned fire water as alternate low pressure injecnon. The batteries fail at 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />, and offsite power was not recovered by 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. There is no containment heat removal leading to failure of the con;ainment and l

subsequent fadure of RPV injecton leading to core damage.

The d'minant contnbutors to the failure of this sequence are maintenance and starting failures of the Division 1,2, and 3 diesel generators.

Sequence TI-UI-U2-R1-V-Va (US29)

Fre.?:sency 3.34 E-7 Contrihaticn 23%

16

A c'+ ci ef:::te pcwcr has occared w:d a reacter scram ana succepm. 5RV creranen te mactam R"V pren=e cenre! HPC5 and RCIC have faded to provide successful RPV leve: centre! a: Nch presure Oinite r ow cr w as not recovered by 0 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. but the RTV has been successfubt depressunzed Depresunzanen may be delayed untd the MZIWL is reached dependent en the m:cenen system abgnmen: With the RPV depresurued low pressure ECC5 make-up and 6:e protecnon anernate mjection has e faded to provide RTV level controlleaing to core camage.

The dommant contnbutors to the fadure of this sequence are failure of the Division 3 diesel generator to start and mamtenance of residual heat removal train A, LPCS, and RCIC. Failure of the offsite power and failure of the RCIC turbine driven pump also contnbute to the core damage frequency for this sequence.

Sequence (T3 A - T2)-C-L*3-X (T2-CS:S)

Frequenn 31: E- Centnhtuu: 27%

A trans:ent has occu red The PC5 may be lost either due directly to the transient or due to subsequent cerinen, wh:ch may result m M51V isolatten The conne! rods fad to msert mto the core and the reactor remams at pow er The motor feed pump was not successfully placed mto operaton ADS irhbit and standby bqu:d centro: are successful, but depressunzanen of the RTV by the operators was unsuccessful resulnnc in cere damage Tre ders.r.t cen=butor to the fadure ci tms sequcnce is the fadure of the oprators to re-open the moter feed pmnp cenne: s a ves and depressunze the RPV For the IPE for a trans:ent with PCS available coupled with an ATW5. ,t was assumed that the M51V isolation at RPV level was not bypassed. This is also one ei the demmant cenmbuters to this sequence Based on our review,it is concluded that the IPE identified dominant sequences and expanded to the level of detail required to identify dominant contributors. In our judgment, the sequences are consistent with  !

plant design.

i 11.1.2.7 Front End and Back End Interfaces The Level 1/ Level 2 mterfaang was accomphshed through a set of Plant Damage States (PDS). The PDS groupmg logie diagram (Figure 3.1.4-19 of IPE) was used to group some PDSs together in order to reduce the number of requued containment analyses. The groapinglogic diagram asked a total of eleven questions bsted l l

below:

l l

Not a containment bypass sequ mee j 1

l 2 Containment status at core damage 17

E en:!vpe 4 1runa: Cen:ammen: Hea: Remeva! wie suppreseen Ceek.g

. Centar=en: Vent Ise:ated at RTV Fad .re e RPV In!ecten Fadute Im.e Offsite Power Recovery Time

5. Contamment Heat Removal with R.HR 5 pray Loop

9. Contamment Heat Removal with Vent 10 Late In-vessel Injecton and Pedestal Cavity Supply

11. RPV depressunzed durmg core damage.

The logic diagram was checked for conststencv. In our judgment, this grouping logic examined all the possible Les el 1 J Les el 2 mterfaces.

PDs Es en: trees w ere des cleped and sub u:ted as part of the IPE for each event. These PDS event trees were u.eleped bs add =g new es ent tree ters te the Leve! I event trees PD5 sequence quantificatien was I

ptr e ed usmg NTTRA The PD5 scquence scrtere.g cntena is truncation value of 10E T/yr . as recermended m NUREG-133E Based en the renew the followmg conclusions have been drawn:

• Impertan: sequences u ere not screened out. As noted above, a sequence was screened out nr:- s Per i- requer: fe:' bel,w the nuncation value of 1.0E-7 or sequence cut set trequenev fe!! be:cw 1 CE R Th;s is consistent with NTREG-1335 guidelmes.

• One et the top leg;c = the PDs groupmg logic diagram (Figure 3.1419) pertamed to Contar=en hv-pas-

• Plant Damage States exphcitly censidered allimportant reacter and containment systems Adcutenal tep es en:.5 w c:e . ., .ated m de PD5 es ent 'ree te mclude contamment system' and some of the reacter systems and recos ery accons mto Level 1 Event trees.

• Source Term estmates could not be checked and could not be verified for consistency. This is primarily due to the fact that the IPE did not provide a clear defminon of core damage states,i e., percentage of core damage corresponding to each PDS. Given that, the only means of checking for the source term is to examine the MAAP output. This is out of our scope of work.

• System mission t.mes, mventory depleton concems and dual usage of sprays were accurately addressed. The only important issue it cavitaten of HPCS pumps when the suppression pool reaches saturaton The IPE subrruttal clearly state > that this is not a concem even when a 1

}

maumum cred2ble Large LOCA occurs, depletmg the suppression pool l 16 i l

l i

I

e Tre a a: su a::=a:i. -::c.i::3 ure c:::n:am=c- rc., :i. o .a: :cai. ; ::: re : c: .:-

iadze The ::n:am:c-::ad5 rei::e equ;pment :adurc c:: - Tha a r- .2: :: Grand Gu::

and uriie Erewns Fer s documented.

In our judgment, the Level 1/ Level 11 interfaces were accurately addressed and adequately No deficiencies were found.

11.1.2.5 Multi-Unit Considerations Perry Nudear Power Plant consists of a single urut, Unit I;the Un:t 2 is mcomplete and non operat2onal. There are no expected insta:mg even:s from Urat 2 that will effect Unit 1 operation. The only system shared between Uruts 1 and 2 a DC Battenes which are cross-hed. At present the cross-ticing is manual and efforts are

=dem av to qu:Sen th:s pr: cess The IPE has taken sed:t for batten s-t2e m the Stat:en Blackout Event Tree N eser dependennes c: cron-t:es were found.

11.1 3 Review of IPE Quantitative Process

^ -TNPP TEu t; .N' based ecmru:c code NUPRA for sequance quanniitat:en and event tree c fau:: nee

--; c: The +::eer=g cn:ena lated tr the Genenc Letter 55-20 was used m the analysis. For examp:e. a sc q en:e cuue nt euenn :-=:an.- s a.ue c: 10E-10 w as used te screen-out some of the urumpertant sgt. :e

- Re: : erv a:ne a ere m:iuded after the: utial quannhcanen by modtfymg the event trees No c.;;; ;: r . :: Adi.t :.

f the seauenret with frequency h:cbc ma- : .E wen re:ared ic::u-se: analys: 3 specialattennen was pa:d to analyztng IE that have important de creer :o = :."e Frent-;me systemc The oscrau quant hcat:en procen a widely accepted in thc PRA cr r.un.:c and r.c de:. :er.::es were icund In adition NUPRA was used for uncertamty analysa da:

.a.r hed da:a =:e::amr and - impa:t on CDT Addmona!!v the uncertamty analysis focused on

.~rc- ar:c ra6=p ci the ba, : eventa b. Fusse"-Veie!y. Rai Reducten and Rak Achievement techn:que.-

Final .. a sens:nw analysa was carned out to quantify the impact o: tranarmg event frequency human rehab:hty, corr. men cause fatlure data and mamtenance data on the over all CDF. The results of the quannhcation process 'uncertamty analyses are summanzed below.

The pomt estrnate fer total CDF is 12E.5/yr. The distnbution for CDF following uncertainty analysis is Mean: 1.4E 5/yr. ,

Standard Des.ation- 3.9E-5 /yr.

95th percentde: 2iE-5 / yr.

Median 1IE-5c'yr 5th percenn:e 6 2E-6 /yr.

19 l

l 1

'::t ;4:: an: &:se Tnt .~u=ma:. c: se:;en:es p e pci tv ::an~ : 2:e p:ese=ed m ex ::.m * '-

cr- .runn; 9e eide CDF are presented as TaEe 3 4 : ; The centar:nent h -- see,uences are ga en m 2 a . . t' :

in our judgment,the quan.ification process is sound and is based on methodology that is widely accepted in the PRA community. No deficiencies were found. A few inconsistencies in the data used are discussed below.

11.1.3.1. Quantification of the Impact of Integrated Systems and Component failures As mentioned previously, Fault Trees were developed for each of the front Ime and support systems Component faiare data was obtamed for each compenent Fault trees were then mtegrated and linked to the e.cnt trees usmg NTPRA. However a detailed uncertamty analysis was carried out to quantify the en:ertainty ;n the data Other comments on the data are presented below. In our judgment, the quantificatien process is good. No deficiencies were found.

1 11 1.3.2 Fault Tree Component Failure Data

'rc e: . m g sect:r m i-cus- the s_b=ttal 5 *:carment cf fault tree component fa:!ure data. Separate l i c s-;cra are presen ed cen:e=ng p! ant-spech:. genenc. and comme, cause component failure data These 2.4r;- cn- a;;:e. - Work requirements 1.3.2.1.3 3 and 13.4 ophrith T 2 che::e was made to mtegraic the n.::u .:cre to :===zc repennen Generic Data i i

~ ntacer3ee na.- pnmanly used NTREG-4550 as the source for the genc : f a:!ure data. We have spot che:ked 2 are data usen to: eve 50 :=pertant cempenents a,d teund no nen:caMe m:ensistencies The PNFP IFE idennf:es ie genen: data as pomt esnmates. where as the NTREG-4550 failure data are mean values. Th:s meensistency should be addressed or the discussion m the IPE should be changed to accurately identify the form of the data used it is concluded that the licensee has met th:t NRC"5 teview guidance criteria regarding generic failure data used in the system fault trees.

1 Plant Specific Data Gu: dance pren on p 2-6 htem 215 5) of NTREG 1335 states that plant-specihc data generally should be used f:: certam types of items for plants with several years of expenence unless a rationale is pren. The i

20 l J

- 7ene-:s re::==e .ded by .WEEC-;3?? m:'ude auchar:ieeda ater pu= - emerge: :ere:Oc:m ; wa:er pump. Eanenes.e:ectnca! buses breaker > and diesel generater-Ee:ause a: the sher operann; histerc ci Perry, the heensee has chosen to use genen: data ier mest of the components hsted abow Hewever, the hcensee stated that the diesel generators do have a fadure historv for seme modes of failure and that a plant specthe diesel f adure rate is developed. It appears that the rate ier runnmg fadures p.56E-3) was denved frem plant speche data. However, no method or model was presented in the subrruttal for thedevelopment of this value. Consequently we could not venfy the accuracy of this value.

Licensee should explain how they obtained data for failure to start in the IPE.

It is concluded that the use of generic data in the place of plant specific data is reasonable given the age of the plant. It was stated in the IPE that the licensee plans to update the IPE using plant specific data as it becomes available. However, no discussions were presented on how such a plan will be carried out.

The development of the running f ailure rate for the diesel generators was not justified. Considering that this valuc is nonconservative when compared to the NUREG/CR-4550 value (1.6E-02),it should be clearly l iustified I I

l Common Cause Data j l

~rt .n . . '"E ec r=c -ca.:. t fad.re m!vsr va: *-f e=ed icLmve: tbe . central cuide!mes of NL* REG CR-4W!osleh. F55 The Perry analvsis rehed en t'oth a histencal database (source. Hahburten .WS) and a quan: tatse screenm; proces to ebram the dernmant common cause cor.1ponent groups. The dommant eemsen cause fadure groups identined are hsted below:

I l

e E5W.Meter Operated Vanes e Diesel Generaters

• E5WMotor Dnven Pumps

• ECC Motor Driven Pumps i

i i

The Pern ,ed.ysis rebed :Jso on the Habburton NUS failure database for data analysis. The generic common- l cauw fatture evens inthe clat: base were "re-integrated' to be Perry specinc as recommended by NUREG/CR- 1 4750. 1 l

1 Tne data analysis resuhed m the followtng common-cause failure probabilities.

21

Cr -c- W,. _ E WS- i 1 s'.  : .' 1.~r' E .: 23:4 E-4 E 5'. l MOVs e :34 E : .

5: 3>  ;455E-4 ' 34 ? E 4 E S'.*/ P ump s  : 4: E4 1 15 e6 t 6:4 E-5 Tes4 E-4 ECC Purn:s L:91E-4 DC5 3 s 0 E-4 15  :: 6 629 E 1 .29: E-3 The methodology used for the Perry IPE common-cause failure analysis follows the procedures of NUREG/CR-4780 and is, therefore, acceptable for the IPE based on the guidance of NUREG 1335.

11.1.4 Review of IPE approach to reducing the CDF 11.1.4.1 Methodology for Identification of Plant Vulnerabilities Tne PNPP IFE used N131 ARC Se.ere Accident Issues Closure Guidelines for vulnerabity screerung. These gu:dehnes are bsted as followr

ie ecnriut:r hem a g:s en m;r:stor er svstems f a !ure is greater than 50% to the total CDF then 2:

- mte:Treted as a sr ::: ant s u'.nerabWty. :* :: connibutes 20 50 . it :s interpreted as a potential vulnerabity to be ms estgated 5Wdarly. conmbuton trom sequen:e groups be: ween a core damage heque .x ef 1 :E: . and : CE-4 are retten ed to deter nme if an effe:nve plant procedure or hardware chance w bus w culd reduce the frequency of the sequences Eased on &as s u'rerab: . denrut:en. the IPE concluded that no s:gn:ficant vulnerabities ew The IPE rep:uptd the sqr:es etc a senes of hectona! accdent poups accoring to the criteria of N13LARC Ta 4 -: of the subn.ittalpresents these sequence groups and their contribut:en to CDF. Of these. two groups c: sequences has e been :dennhed wh:s cone *':te between 20-50%. The hrst group. referred to as Grou

Fe IPE is made up 0: acciden sequences :mo:vu.g ATW5 leadm; to contamment failure. The se:ond poup. referred to as Grcup 2 in the IPE. is made up of accident sequences tnvolvmg loss of contam removal leadmg to contamment fatlure and subsequently core injecnon failure Scenen 3.4.2.1 presents d;scussions on these vulnerabihties and identf:es specthe systems / actions that contribute to these vulnerabataes several moihcations have been proposed in response to these identihed vulnerabilities, which are the matter of d2scussions in the following section.

1 No j In our judgment, the IPE has taken a reasonable approach to identifying plant vulnerabilities. i deficiencies were fous.d.

2

11.1 4.2 Plant Impres ements and Planned .\todifications The JPE hsted ic! ow:ng plant mei:::atens that e:6er hate been cerrieted er m se traces- e: remp

piemented er to be imp:emen:cd m de near iun:re.

.N1odifications Already Implemented Lt.u tf 0ffsite Pott erinstructions

• Retenton of RCIC isolaten bypass for 1 ugh steam tunnel temperature

• Enhanced process for cross-temg Unit I and Urut 2 batteries

• Ersanced process for off stte power recovery to HPCS and alternate injecton system buses Flo odin e ins truction

• Enhanced response mstns ten for floodmg scenaries N1odifications to be Completed in the Near Future e AD5 automate in:nanc-

• Fast F:rewater te Sc:a een : re Protection and HPC5

• Permanent D;vmen 3 to D v: sten : qu::k ceru e:t

• Redu:n:n ci Cu-ci Sc ce T:me for certam ennral compenents N1odii;.ation to be Considered for Implementatien Passst e Centamment hui Path 6

Onee: the sens:tvity ana') 5ei per#0rmed was to assess the lmpact of contamment failure en les ei RPV m;ecten and subsequent cere damage. Tne aditon ei a passive containment vent path that does n:t depend en AC power would reduce the cere damace frequenev from mternal and flooing events byIP.c: rem'.3E.t-: :E-C:

Automatic ADS Inhsbitfrz ATlVS One of the contnbutors to core damage frequency for ATWS is manually inhibiting AD5. By mstalhng an automatic inhibit of ADS, those A1WS sequences in which manual mhibit fails would drop out.

The overall core damage frequency is reduced by i9 . from 1.3E-5 to 1.0E-5. The sequences resuinng from this f ailure result m an uncontrolled flow to the RPV from the low pressure injecton systems with subsequent core damage and contamment fai'ure. The add 2 tion of the auto inhibit would reduce the frequency of this set of sequences.

23

:ur tu d p .cnt +i ::E ha+ adapud a rea : ?Ne accrea:- -  % rt m;  ::' nac ; - ne r:rtr.g aprrepna:e p; ant meihrat:en- The IPE nas a:-o egendes asee.ua:t e: tert e,ua~ . tre ract c: . e mei.~.:anc-' ei t c CDF 11.1.5 Review of Licensee's Evaluation of DHR Function 11.1.5.1 IPE's Focus on Reliability of DHR Based on the Vulnerabthey Screening, discussed above, and importance ranking measures examined ter a potential vulnerabdity. As stated in the IPE. their contnbunon to CDF from loss of DHR is about 45* and comes pnmanly from the following funcnonal failures.

Percenta re Functional Fri!ure Lee of Decay Heat Remos a! trem Contamment Leadmg to Core in:ecten Failure and Core Damage 22^

Les- cf 0:fste Pow er and Slake up 13' Lc.-- ei CcMant inventen Maie.up at Lew Pressure i Le-- et H4;h Pre-surc Make-up and Fadure te DEP <2i 1

Fased en be u . penance and >e:u;tv:r. ana:ysc- the IPE cene.uded that a smg!c p! ant moih: anon that would

.r r.:an: dc:reatc h- cenr:but:en :s pres ent:en of contamment fa::ure The centibunen of rema:.nmg

. ;c.;.:aa: :c re.-cn . :- smal! A pas n e s ent path i+ prope>ed tn respen< ind will be asses:ed m the :utare 1

111.52 IPE Considered Diverse Means of DHR 1 IPE censidcrc d a iser e means of remortng decay heat trom the core tncludtng Feedwater Pumps. Meter l Feedpum: 3CIC. ADM5RVs sentmg. HPCs. LPC5, and LPCI (once through and closed loepst it a:so cont:dered re;;an:e en the fire water tron-ne as an alternat;ve for low pressure injection Similarh. the ITE cons:dered suppression Pool cochng, RHR Heat Exchangers, and contamment venting as possible opnens for heat removal from the containment. In our judgment, the IPE has considered all available diverse means of DHR. No deficiencies were found, 11.1.5.3 Unique Features

1. Failure of containmentleads to f ailure of core injection and Core Damage. Failure of RHR leais to failure of containment. f 1

2. HPCS and RCIC switch-over from CST to suppression Pool Cooling is automanc.

3 Fire water cross-ne is a standby core injcenon mode at low pressures. -

4 Suppression Pcol Makeup is by gravity head The makeup rate can prevent NPSH failure of HPCS in the case of worst creible LOCA.

24

!!I OVERALL EVALCATION AND CONCLC510N Tre TNFP ITE a a Les c; U FRA ic: a" mtema; e. ens and m:ema: i'ecim; erk. Tre subru::a. me.udes trie:

.O.,

e am desen cens fer 'reth the ::ent ime and supper

• system . es:cp: - the Ef f . aa: n- is a m pnen are kne drawn schemat:s eiea:h system The bs: er nnaung es enn are comp;ea and m:;udes ses c:a;

' plant-spe::he 'special mitators. The NF. !EA was used to screen out HVAC related uutatmg events The The

n:tator frequencies were reasonable and obtamed from accepted sources (NUREGs and EPRI Reports) fault trees were not enclosed to the submittal, which is not a requirement for ~ Step 1 Review" From the discussions it is clear that each system is modeled to the component and train level The generic component f ailure data for a vanety of components is taken from Grand Gulf study and appears to be reasonable and conservatte. For several systems, mcludmg ECCS generic data was used in place of plant specihc data due to the short operating history. The common mode failures were reportedly handled accordmg to the guidelines ei NTREG CR rSO. The methodologv used appears to be adequate although we could not conhrm it smce the descipter of commen cause analysis m the subnuttalis bnei. Sequence quannh: anon methodology :...d menmg zi:ena are a::eptable An uncertamty analysis was carried out to quantify the impact of the data

. s -:amr en the CDF The NT5 cemputer code NTPRA was used ict SET /LFT !mimg sequence cuar :aten and un:e: tam::. analysi.- A hstmg of dommant sequen:es was presided and do:ranant centnbutors were espheit!v iscussed An importance rarimg of the fun:nonal events based en Fusseli-

' u e; nsi reduenen and : -L a&es ement te&uques was provided Explicit and detailed DHR analyses aere presented This analysn. :ensidered a diverse means of RHR removal from the core as we!! as from the re- -er F: a': u .:w ra- npaten a se LPE a4 well as the unhtv peer review process is reasonaMe and mes:- tne m:ent of Ger.eric Le::e: is S F:: T. the Prus it u clear that the CEI egended reasonaMe effort to cam tnsights and design plant modiheacons 2: .o ' : un:mm r!an vulnerahhties Some of the plant modih anons have already been completed and c T.e a:e u nder.. a . Die: p: ant rnein:ations utuch meiude Autemat:: A D 5 Irta b t' an; Tas.-n e Cen:am: .en: Vent are under consideraten 25

IV. IPE EVALUATIONS AND DATA SUMMART SHEETS Th:5 sernen mdudes the data sheets related to the iront-end portion e the PNPP IPE The format ci :h;5 4 The appenix foUows that provided by the NRC m our tasi statement for Perry Nudear Pew er Plant Cre:

secten numbers are accering to the NUREG-1335 Standard Table of Content which was close'y adhered te by the IPE This appenix simply hsts the data; no enuque of the da" is presented here. This information is presented m the previous sections.

2.4 Information Assembly Perry Unit 1 is a BWR/6 with Mark III containment. This unit is very similar to the Grand Gulf nuclear power stat:en wh:ch is a NUREG/CR-4550 reference plant Other similar plants for which PRA studies have been perforrned mclude BWR/ S at Kuosheng tn Taiwan and Coftentes m Spain. All these plants have been cited m the IPE subm:ttf Very minor differences in the front-!me systems eust between the Grand Gulinudear u ;t and Pem Ur;: 1 Most of the 6fferences are re!ated to cross ties between units (DC battenes x-te' But none of dem were found to play sign:!: cant role m the accident nuttgaton 3.1.1 Initiating Es ents TaSe 311-1 of the subtr;ttal provided the PNPP IPE uuttatng event bst. which meludes the mean hequency ier eacP m:r:atm es en! Also T3He i 41. ei the IPE submittal provided a summary of core damage hqaency bv : rut:atng event These :wo taHes were merged together to comptle the fouowmg tame.

3.1.2 Front-line Esent Tree Review Licensee"s basis for the Success Criteria l Tne b:ensee used MAAP analysa to des elop success entena for the Les el 1 and the Level 2 PRA analyses. The l

)

success critena are very smular to those bsted in NUREG/CR-45SO for Grand Gulf, except they are shghtly j i

conservatte m few cases. The success enteria are consistent with the information provided in theUpdated Fmal Safety Analysis Report (USFAR).

1 i

I i

1 26

i

~

e  ;

Table IV.I. Contribution of Generic and Plant-Spenfic initiators to the CDF

+ ,

'L n,uri sta., r e n 't, bnrrer I% ,

L_i r Loss of Offsite Power Transient 0.0609 1.44E-6 12.4 T1

!al 2.25E-6 19.3 5 Station Blackout T2 l Transients with the Loss of the Power Conversion 1.62 1.67E-6 14.3 Systern (PCS) 4.51 <1E-8 <0.01 T3A T3B Transients with PCS Initially Available Transients involving Loss of Feedwater; 0.76 <1E 5 <0.01  !

l

' j

, T3C , with  ;

i the PCS Initially Available 0.14 1.35E 7 1.2

! TIA l Transients Caused by an inadvertent Open l ,

l i l

i 0.092 j 1.01E 6 5.7

!! Relief Valve (IORV) on the RPV i e I l I  ! +

TSW Transient Caused by a loss of Instrument l t

r l Air i 1.0E-3  ! 6.7E 5 l06

' I  !

• A Transient Caused bv a Lee of Service 1.0E-4 ' 2.11E-7 l'1.5 .

Water 3.0E 4 6.19E 5 0.5 l

[. 51 i 3.0 E. 3 l 3.34E 5 0.3 j 5: Larc.e Loss of Coolant Accident <LOCA) '

V  ! <1E 5 <1E S <0.01 Intermediate LOC A  ;

1 I

<1E S <1E 5 t <0.01 iO Small LOC A R Interf ace System LOCA 1.0E - <1 E-5 j <0.01 ATWS Containment Bvpass LOCA ib} ' 4.74E 6 40.7 Vessel Rupture f i Anticipated Transient Without Soam l I

1 Notes:

(a) Stauon Blackout is a separate event tree developed as part of LOOP (TIL It is not an I.E. by itself. l (b) A'l events leading to failure of scram following an I. E. are classified as ATWS. ATWS is not an A

l 1.E. by itself.

• 1 Es sn the bold are the plant specific 1.E.s.

27

Functional vs Sy stemic Event Trees Tne PNFP IFE used functenal event rees A dai:erent FET was deve!cre: int er:t I E 1:rted abm e The FETs were cenhgured te mode; system respense to specmc tratatmg events threuth the use er es ent eee tre leg::s Fault Trees were develeped te mode! bei:ront-hne and support systems Es ent tree top lepcs and fault trees are r et a part of the IPE subrruttal.

HVAC Assumptions The HVAC systems were reviewed for specialinitiators and were screened out through Failure Mo Effects Analysis (FMEA). IPE cited engineering calculanons which revealed that in spite of the f control room HVAC the control room temperature would remain less that 120' F, thus not challenging the coneo! roem equ:pment. Consequently no reactor tnp is expected from the failure of the control r 5:mdar reaserung was provided for MCC Switchgear and M:sc Electncal Equipment Area HVAC systemo  ;

Thus HVAC was screened out from the hst of trutators In;ta' anaj pn. as repened 4Page 3 :N. apparent:s sugtested that less of MCC and Switc.hgear HVACs Thus. t'rus f ailure was formulated as a major event tree top event in the LOOP and rou. m break er :a. ure Statan 5;aciout event trees Apparently more recent analyses revealed that this was not the case. Although th;s rur:rrn has remamed m the es ent tree a success trebabthty of 1 was assigned.

ir e f - , .

Pr '"E nuumed e,t ere cf the HVAC systems centnt "e to reactor tnp and that none play a sigruncant re:e m the accident trangaten The IP't cited several utthty calculanons as the b asumpr:cr-3.1.3 Special Es ent Tree Review hr: Nuc; ear Pcwer Plantis a BWR e RCP seal coolmg :5 not relevant to th:5 IPE 3.1.4 Support System Event Tree Event Tree Methodology The PNPP IPE employed SET /LFT methodology.

Contractor Employed The contactor employed by the PNPP is Halbburton NUS Corporaton.

l l

l i

2S

P t

322 Fault Trees Td:e 3 ; ;- prev: des a detded 1:st et the r ent !=e and super: restems ter + ch::3 fa.:lt trees were analyzed

.. u reprc::uced belo..

Frontline Systems RPV Depressun2aten Standby Liquid Contro!

, Residual Heat Removal

- Low pressure Coolant injecton Mode

- Containment Spray Mode Suppression Pool Coolmg Mode Low Pressure Core Spray H;gh Pressure Core Spray Rea:ter Core Iso!aton Coolmg i

Cendensate Feedwater F:re Pre:e ::en Alternate Infecten EFW E RHR S Cross-Tse Alternate inje: con Pv>acter Fecd Beester Pump Alternate inje:non  ;

Centamment Ventmg by fuel Poel Coolmg and C canup Centamine. : Venirg h RHR Centammen: Spra*. l support Systems t suppres::en Pee. Maie up Dr. .vci: Va:uum Rehef ECC5 Pump Room Coe:mg D;e e. Gercater Recm Ventlanen E:nergency C!esed Coolmg Nuclear Closed Coolmg Emergency Service Water Safety Related Instrument Air 1 Service / Instrument Air Emergency DC Power i Emergency AC Power Service Water Turbme Building Ventdanon Heater Bay Ventdanon Turbme Buildmg Closed Coolmg I

I 29 l

l

4 3.2.3 System Dependencies Plant Unique Dependencies The dependency rnatm mdica:es that ses era' of the trent-Ime systems are ccar:e:e:y dependen: en c' -ae power The>e mclude ADS ar d SRV, among numerous others. Th:s can not be true smce these systems rece:vc emergency power, and the dependency matm must be corrected Similarly, the dependency matm mei2 ca partal or delayed dependence of several front lme systems on the HVAC systems. The IPE on the oth states that recent calculanons have shown this to be untrue. In which case the dependency matrix must be corrected. Otherwise, the only uruque dependencies noted m the review are as foljows:

1 The safery-related de buses can be cross-ned to the de batteries m unit 2. which is incomplete Tras feature estends avadabity cf dc power follomng LOPA and Stanon Blackout sequences

The HPCS D G. can be cross-oed to Division emergency bus. which enables the contairecr-I and s ent vah es and hydrogen ign tors to be powered m the event of LOOP and loss ei D..

DGs

'- Cere in e rn as a functen a dependem trarnal and ddayed, en the conta:rcem heat removal systems Tha 25 not adequately represented m the IPE 4

Nonc ef tN rem-hne sprems are cependent on the HVAC systems Plant Asvir :-etnes The D.v:suen 3 HPC5 D2ese! Generater is a ditterent size and type from the D: visions 1 and 2 DGs Any e6er as.~.: ctnes presem are then :mpbca to BWR 4 dengn <

3.3.1 Lift of Generic Data NUFEG CJ4550 was ader:cd as the pnmarv source ter the genent data Only slagt.t differences were netei between the genenc data fer In:narmg Frequencies reported m NUREG/CR-4553. wh2ch were taken from NUREG/ CR-3S62. and the PNPP IPE. The generic failure data for vanous components is checked against other sources, mching NUS BWR Genenc Data, NUREG/CR-1363, NUREG /CR-1740, NUREG /CR-3831, IEEE-50 WASH-1400, and CESSAR II Our review revealed httle 6fference between the Generic Data used in the PNPP IPE and NUREG /CR-4550 for most componer.ts.

3.3.2 Plant Specific Data and Analysis Plant spec 6cdata was used for failure rate of the diescl generators. Also system unavailabilities from testm and mamte: .ance of ECCS and RCIC were derived based on plant specihc data. Howes er, due to lack of plant speed: dau for fadure of ether systems. such as ECCS pumps. generic data was used The IPE i

not providespecie sources of th:s genenc data Addanonally,IPE d2d not provide methodelegy (e g. Baye 30

=. . - . - .

1 Upca w used to den e se ph .t spe .: data :er the ags ahee :t a at du .ed :r.- Mant 4pcc.: : :ata fu:.-

m: rmanen must be provided as part ef the IPE for review in some casei dt r' ant see::i:: failure data

't snou:d be better esplamed apn ars to be cressly m:enststent with the NUREC CR-455? data V

3.3.4 Common Cause Failure Analysis Techniques Used to Treat Common Cause Failures Desenpnon is incomplete and/or misstng. The IPE noted that detailed desenption is provided in Appen C.2 which is missing from the subrruttal. The desenption provided is inadequate and suggest close adherence to NUREG-4780 guidelines for common cause analysis. Additional desenprion seem to indicate that Beta Factor method was used for common cause analysis.

Les el of Treatment '

Me agam th2s m:ormanon is not provided m the IPE. It is assumed that IPE fo!!ow ed NCREG-4750. which c.:.d md:: ate t".at the :et el of treatment 25 component groups

.\1ost Significant Common Cause Failures The fol:owmg w ere listed in the IPE as the most sigraficant commen cause failures.

cvctem Ec;n Vcie Ef'. MOVs c234F.3 Diese! Generators 3 CE-4 E5'.V \!ctor Pump 53 41$E-4 ECC N. ietor Pump.31291E-4 Sources of Common Cause Data Sour:es of the data w ere not explintly stated tn the IPE. Our review has clearly demonstrated that failure data is significantly different from the NUREG/CR-4550 common cause failure data. One of our recommend is to provide sources of this data.

3.3.5 Quantification of Unavailability of Systems and Functions Systems or Components with Noted Unusually High or Low Unavailability No systems or function were found to have unusually large or low unavailabihties.

31 l

{

i 1

Sources of the Data  ;

CY e agam. tne sources ei de da:a a:( net : lear;y 4denti:e: In sector 3 3 2 :t va mennere:i:na: Ferry Un::

dx.

men w ere us.ed :o ne:erm:ne plan: spe:m: unas a:! abo:y data :c: ECC ar.d RCIC system. Howew:

methodo:cp used was not sreched sources of the data fe: remamang cerronent xas ne: Es:ed It appear-that atleast for some componen:s NUEG;CR-4550 data was used This remams to be conhrmed by the unbty.

3.33 Quantification of Sequence frequencies Codes Employed The entire Level 1 analys:s includmg the internal floodtng was performed on the NUPRA workstahon, developed and supported by Halbburton NUS Corporation.

Uncertainty Analysis 5:rpe An uncertamtv analvsis was performed to evaluate the uncertamty on CDF resulnne from the uncer:a:nno en tr4 parame:cr sa;.:e of the cere dam. age model In addit:cr. a sent:t ity analys:5 was cenducted v quan::s the impa: 0: uncertamty m m.:tanng even: frequency, success cnter:a. human ,

rehabc com .on cause fadure da:a and mamtenance da:a on the overall CDF.

'4 H I: appears 62: N' TFG w a- a:-r used fer uncertamtv propagation.

I 3.3.5 Internal Flooding I

i l

Methodology A p chmanary 5::ecrang a-3:ys:s to!! owed bv a more m-depth analysis on those areas no: screened was employed The 5:recrang analysa i 5:mdar to the IDCOR method where the p! ant buildmps are broken up mto ileod zones and vital safety equipment is idennned withm each zone. Ma}or floodmg sources are then 2dennhed withm the zones and floodmg initiator frequences are calculated from generic data from U.S. nuclear plant expenence. For the screening analysis, vital safety equipment located within the flood zone is assigned a failure probabihty of I and a condinonal failure probabihty of the remaining safety equipment required to lead to core damage. The frequency of core damage appears to have been screened against a frequency of 3 X 10-7/yr. with the survivmg scenarios then being more thoroughly analyzed.

Contribution to CDF A total contnbution of 15 X 10-6/yr. representing 12'. of the total contnbution from internal events and floodmg was determmed 32

i l

l

)

Criticalintemal Flood Areas: i l

F m Table 3 3.7-1. rane areas survned m:ta! screer=g They cons: c:

l l

l

1. Centro: Comp!es - 576 10

. Control Cemplev599 ,

3 Turbme Buildmg and Turbme Power Complex, 4 Auuhary buildmg-56S",

t

5. Auxihary Buildmg-599",

6. Steam Tunnel,

7. Control Complex Unit 1 Division 1/2, Battery Room /$ witch gear -638.5"

8. Auxiliary Buildmg Corndors,

9. Service Water Pumphouse CtJv hveof these areas are subsequently d2scussed as harmg been analyzed in detail. Of the rune survivmg

'rcro enir the fust four appear to be 5:gnificant con:nbuters to core damage accountmg for a total ef 955 ei re ete r.a! ficodmg centnbuton to core damap 4

Most Critical flood Sources:

fe vice Water. Cuculatmg Water (Turbme Bu;ldmgi. Emergency service Water, Condensate Transfer 3 4.1 Screening Criteria screer.:.nc cnter:a hsted m the Ger.cnc letter 55-:2 was used m the analys: 5.

Form of Truncation A recaton value ei ; OE-10 f or the sequence cu*.cu wa! used In addiorr.. es erv sequence with a probab:Lt.

c: 1 OE-7 were retamed for further analysis.

Definition of Core Damage Core damage was dehned as failure to mamtam the water level tn the RPV above the Minimum Zero injecton Water Level or, sn the case of ATWS, failure to maintain the madmum claddmg temperatures below 2000 F, with no possibihty of recovery of injection in the short term . 4 l

l 33

Total Core Damage Frequency T e pc:nt esn:nate fer tota; CDF u 12E-5 s: The d;smbuten :cr CDF :ellowmg uncertemtv ana!vs' -

Mean 14E-5 ". :

5tandard Devianon:3 9E-5. yr.

95th percentde.2.5E-5 e yr.

Median:1.1E 5/ yr.

5th percentile.6.2E-6/yr Dominant Contributors The dominant contnbutors to the nsk are: ATWS, Transients (mostly T2 and TIA), LOOP, and Station Blackout.

Toge:her they conenbute about 97.4'o of the total CDF.

Recos ers Actions TN iiewm; humar recoven accens w ere censidered m the analysr 1 Operater fails te N-ne L' rat I and L' rut 2 bar enes

Operater fails to ahgn condensate transfer alternate tntection 3 Operater f ah to ahgn :.re protect:on after RCIC fails due to suppression pool temperature 4 Operator fads to aben fire protection after RHR fads due to MCC HVAC fai!ure

Cecret fa:b 'e abr fire prciecnon af ter HPCs f a:!5 r Cprater fails to abgn f ast fire proteenen alternate miecton Cierator rads to cenno: reactor feed booster pump dunng a loss of instrument air trans:ent i Cyerater fails to contro! the reacter feed booster pump followmg loss of Instrument Air m a tme trame g-eater than 2 hrs 9 Cyca:c f ads to abgn suppressen pool clean up alternate m;eeten (late miecnon) is Operater fails to loca!!y open IG41-F0145

11. Operator fails to depressunze after core damage harmg failed to depressunze early 11 Operator fails to irutiate SLC given early failure to initiate.

Only other recovery acnon is recovery of offsite power m the case of LOOP.

3.4.2 Vulnerability Screening Importance or Relative Ranking Provided?

Yes Iratatng Event Importance Ranking by Fussell-Vesely. Risk Reduenon and Risk Achievement methods were provided m the IPE (Tables 3 4.17).

34

Licensee"s Definition of Vulnerability b re cent .ruten hem a cn en ::utator c system fa:!ure:4 greater inn N of ee :c:a: CDF :t u eterrreted as a sc unca-t ndnerabity, , it centnbau betw een 20 and K . .e eter re:(d as a peurna! vukseraban to be m estgated Adinena!!) . centnbunen ::om sequence group, re:w een a CDF c: UE4 and if E-4 are rev:ewed to determ:ne if there is an effecnve plant procedure or hardware change wh26 . , _!d reduce the

!:equency of the sequences Vulnerabilities No minators or a group of sequences resulted m CDFlarger than 50% of the total. Hence no significant )

vulnerabilities were found. However, ATWS sequences (Group 4) and loss of containment heat removal sequences (Group 2) contnbute between 20-50 of the total CDF. In the ATWS sequences the potential vulnerabig a the failure to mh: bit ADS. whis leads to reacnvity esci!]anens and possible core damage In tbe Group 2 sequences the potennal vulnerab2hty is due to the fact that loss of contamment heat removal also resu.ts in less c: core m ecten The contnbuten of these wquences is about 2 eE-o. wh:ch a well below 1 OE?

Ncr c c: ce . ulneratines are RHR :c:ated e: Interna! F:cer.mg re:ated Plant Fixes

> pr: crna: 7: ant : ::cremtr - w cre sc rsdercd tareduce the cere damage !:cquency These are l

P. . c C c -: : m.t r- Jt r: Pat '.'r c' :t duct- CDF frem : 3E 5 to 1.1E-? Po rc '

i

Autamanc AD5 L.h&t : : ATW5 wh26 reduces CDF ficm 13E-5 to 1 OE-5 l Mc se c these propcaed 2mprevemenu are under connderatien and the:: necessity will be determmed

< c s m; :ururc t rda e3 to th( IFE Ne 56edules we:e proposed for th25 change Plant Life Extension IPE did not consider plant hfe extension m the proposed plant modificanons.

3.4.3 Decay Heat Removal Method of DHR IPE considered a diverse means of removmg decay heat from the core mcludmg feedwater pumps, meter feedpump, RCIC, ADS &SRVs m ung. HPC5. LPCS and LPCI (once through and closed loops). It also censidered rebance on the im ss ater cross-ne as an altemative for low pressure mjecnon. Similarly. the IPE considered suppression pool cooltng. RHR heat eschangers. and containment ventmg as possible options for heat removal trom the contamment. Thus, the IPE has considered all available diverse means of DHR.

Credit for Recoverv of PCS

~E dw no take c:e&* ':t reco.en ci pou er c:nver':ct system ~

Main Feed Water Trip on Reactor Tnp No Creit was taken m son.e sequences for contmued operanen of the main feed water pumps after reac c-InP Unique Front-end System Features important uruque features tnclude.

L There is a motor driven feed pump that is normally in standby and will start on an automanc signal at Level: following f ailure e! the turbine dnven pumps 2

The safetv-related dc buses can be cess-ned to the dc batteries m urut 2 wh26 is tncomp:co Tha feature extend.t avatlahhty of de power followtng LOPA and Station Blackout sequences.

hiel:n od

- 2 nc H"CS D G u no: ci same 5:2c or type as the other two D G s Th:s will reduce c: corr.on cause ia: lure of all t'ruee D C S 4

The HTCS D G can be co-s-ted to Dwv.:en: emergency bus. w ha$ enar:e> the centarr.n*

.cr .

ahes and hs dregen y=wr> to be powered m the event of LOOP and less of Div and

DGs t: -rcr* !..;.ure lead < to in cenen failure

- Maicup to the suppression Poo! a previded by gravity head No pumps are tntch ed

- HPC5 and LPCS inlect miide the shroud Consequently. the HPCS is not a recommended

>vstem for ATWs trungaton

.- 2 re AD5 tnF2a acnon is not automanc

6. Plant improvements and Unique Safety Features Important insights The IPE results tndicate that ATWS is the largest contributor to the CDF. This result is different from G' Gulf study, where the major contnbuton was by common cause failure of the DGs. Ma}or reason denanon are:

PNPP IPE did not take credit for operator manually inserting individual groups of contro! l 4

L rods, and 2.

PNPP IPE assumed that HPCS tnjecnon is no longer an acceptable means of tniecting water into the core following ATWS. f 36

~ s .a:;e+: c n=tu::' . AT>'.i scquc .ces ~ =~ : c" ~ *s .us . :.:e A:+ ~:: e=:> c :a.: :. : ..:

.c.n: :: rea:n.<'c cs:Ganoni and sa?+equentV cc:e camace Tre second '.acgest cent-butor to the CDF is f adurs 3: core m ec :en uren :a:.are : cen:a=cn hea: remc va:

The th.::d largest contnbutor is common cause f adure of the Division i and : DGs This latter one is furthe:

comphcated by the fact that Dirtsten 3 DG cross ne to Division is very hrruted m companson to Grand G ..:

Preposed plant improvements tn response to these insights are listed below.

Implemented Plant improvements or Enhancements Tne foljowing plant improvements were made as a result of the IPE:

Eetennen of RCIC iso! anon bv ass fer high steam runre! remperature

Enhanced process for cross nemg Urut 1 and Urut banenes Er}an:cd process for offsite power recovery to HPCS and alternate injecton system buses 4 Enhanad resrense mst ueners to floodmc scenarw Ec d :non of 0.:t-e: Service Time for certam cnnea? ccmpencr:-

Piant impres ements for Which Credit Has Been Taken l'iant impros ements Under Consideration

?m _r..  ; 7. art :c'.ements are r raceedmg al: hough exact scheduie ic: completten are no: r rovided I.~ t ? a r t' T a F ae'.. ate: ::e be:v.een Fue Prote:nen and HTC5

Fe:manen: Division 3 te D:vison : quick cross-tie Ad dinonally, thc following plant improvements are under consideration: ,

1. Passive Containment Vent Path

2. Automanc ADSInhibit for ATWS.

3. Systemat:c Maintenance Optunizanon.

)/