ML20072E054
| ML20072E054 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 06/30/1994 |
| From: | Clark R, Darby J SCIENCE & ENGINEERING ASSOCIATES, INC. |
| To: | NRC |
| Shared Package | |
| ML18038A932 | List: |
| References | |
| CON-NRC-04-91-066, CON-NRC-4-91-66 SEA-92-553-011, SEA-92-553-011-A:3, SEA-92-553-11, SEA-92-553-11-A:3, NUDOCS 9408220090 | |
| Download: ML20072E054 (37) | |
Text
P SEA 92-553-Oll-A:3
~
June 30,1994 Browns Ferry Unit 2 IPE: Front End Review Technical Evaluation Repon NRC-04-91-066, Task 11 John L. Darby Robert A. Clark Science and Engineering Associates, Inc.
1 Prepared for the
. ~.___ Nuclear Regulatory Commission PoWW x ~
. 0 + %coS
)
t Table of Contents !
l
~
I. Introductio.o 1 I.1 SEA Review Process 1
1.2 Browns Ferry Methodology 3 >
1.3 Browns Ferry Plant 4 !
I.3.1 Unique Features 4 !
I.3.2 Similar Plants and PSA's 5
- 11. Review Findings 6 l 11.1 Review and Identification of IPE Insights 6 ;
11.1.1 General Overview of Front End Analysis 6 i 11.1.1.1 Completeness 6 11.1.1.2 Methodology 7 11.1.1.3 As-Built / Operated Confirmation 7 ,
11.1.1.4 Internal Flooding Methodology 8 ;
11.1.1.5 Peer Review 8 l 11.1.2 Review of Accident Sequence Delineation and System Analysis 8 !
11.1.2.1 Initiating Events 8 11.1.2.2 Front Line and Support Systems 9 i 11.1.2.3 System Dependencies 11 l
!!.l.2.4 Common Cause 14 7 11.1.2.5 Event Trees 14 11.1.2.6 Core Damage Sequences 17 !
11.1.2.7 Front and Back End Interfaces 19 ,
!!l.2.8 Multi-Unit Effects 20 .
Human Factors Interfaces 20 11.1.2.9 ,
11.1.3 Review of Quantitative Process 21 !
11.1.3.1 System and Component Quantification 21 11.1.3.2 Data Analysis 22 !
11.1.3.3 Generic Data 25 l 11.1.3.4 Quantification of Common Cause 25 11.1.4 Review of Approach to Reducing Vulnerabilities 25 !
11.1.4.1 Definition of Vulnerability 25 11.1.4.2 Plant improvements 26 !
11.1.5 Review of Evaluation of Decay Heat Removal 27 11.1.5.1 Reliability of DHR 27 11.1.5.2 Diverse Means for DHR 27 11.1.5.3 Unique Features 28 11.1.6 Review of Other Issues to be Resolved with IPE 28 !
9 ii ,
3
, , . . --y-. _
111. Conclusions from Review 29 Appendix A. Code Used for Thermal Hydraulic Analyses 30 l Appendix B. Decay Heat Energy Over 24 Hours 31 References 32 l
l
n List of Figures Figure 1-1 SEA-Review for Browns Ferry Front End IPE 2 Figure 2.1-1 RCIC at -122,1 SRV Open 12 Figure 2.1-2 Boil on SRVs, No Makeup 13 Figure 2.1-3 Loss of injection at 4 Hours 24 iv
r I. INTRODUCTION This introduction presents the process used by Science and Engineering Associates, Inc. (SEA) to review the front end' portion of the Tennessee Valley Authority (TVA) Individual Plant Examination (IPE) Submittal for the Browns Ferry Nuclear Power Plant Unit 2. This front end review focuses on accident sequences leading to core damage, due to internal initiating events and internal flooding. Reviews of the human factors and back end aspects of the Browns Ferry IPE were performed by the NRC with contractual assistance from Concord Associates, Inc., and Scientech. Inc., respectively.
I.1 SEA Review Process The issues initially raised in this report and provided to the NRC were not discussed with TVA personnel. Also, a visit to the Browns Ferry site was out of scope for this review. The purpose of this review was to identify issues related to the front end IPE analysis for Browns Ferry, and to provide the NRC with these issues. The NRC presented these issues to TVA for resolution, and this report was revised based on utility responses to the issues.
Figure 1-1 summarizes our front end review process, as subsequently described. ;
i i
1.1.1 Review of FSAR and Tech Specs j The NRC provided the Browns Ferry IPE Submittal to SEA in September,1992. SEA began [
i I
work in the Browns Ferry review in October.
\
With the assistance of NRC/NRR, SEA personnel in Washington D.C. obtained pertinent ;
i information from the Updated Final Safety Analysis Report (UFSAR) and from the Technical ;
Specifications (Tech Specs). This information was forwarded to the authors of this report in !
November. ;
1
ACTIVITY RESULT Receive Browns Ferrf Submittal List of Items of Review FSAR -----------> Interest Based on Tech Specs --
Plant Design Coordinate Review -----------> Plan and Schedule Schedule with NRC for Review I
Review Brotrns -----> List of Interface Ferry IPE Submittal Items to Issues with be Human Factors Resolved and Back-End Reviews Draft Reviaw Report to NRC Incorporate Review Comments ---------> Final Review On Draft Report Report to NRC Figure 1-1. SEA Review for Browns Ferry Front-End IPE 2
i I
I.1.2 Review of IPE Submittal ,
Between early O$tober and late December 1992, a review of the IPE Submittal for Browns Ferry i Unit 2 was accomplished. The effort incorporated a complete horizontal review of all aspects of the front end issues called for on the Statement of Work from the NRC to SEA, as well as i vertical reviews of selected key issues. Independent analyses were perfon..ed for some of the key issues identified in the vertical reviews. i l
l 1.1.3 Review Report t
On January 15,1993, a draft copy of this review report was prepared and sent to the NRC. The final review report of March 1994 incorporates NRC comments and utility responses to issues !
discussed between the NRC and the licensee.
1.2 Browns Ferry Methodology !
t The Browns Ferry IPE utilized the large event tree, small fault tree methodology of Pickard Lowe }
and Garrick (PLG). Support systems were modeled in support system event trees. System l
dependencies were explicitly considered by the use of split fractions in the linked event trees; ;
each split fraction was quantified by a fault tree specific to the conditions dictated by that split i fraction. and fault tree linking was not required. Common cause failures were considered.
Uncertainty was included in the model. Recovery actions were considered. Data was from the ;
proprietary PLG generic dr.ta base. Quantification was performed using the Riskman software. j There is a major difference between the large event tree, small fault tree technique, as used in ;
i this study, and the small event tree large fault tree approach, which is the other major technique l
used in PRA. The large event tree technique considers all inter-system dependencies in the event l trees; a sufficient number of branches are developed for each event in the event tree to consider all preceding system success / failure effects. Each of these multiple branches is quantified as a j split fraction. A split fraction is a failure frequency that is conditional on the preceding events l
in the event tree. Since the split fraction explicitly includes all conditional effects, the fault tree j for that split fraction can be solved independently. f I
i
?
3 :
4
t i
i l
i The small event tree technique does not develop split fractions. The branches in the event tree !
do not consider all preceding system success / failure effects. Fault trees for the event branches I cannot be solvedjndependently; the trees are linked and solved together on a sequence by sequence basis. f l
1.3 Browns Ferry Plant l
The Browns Ferry site consists of three nuclear units, located on Wheeler Lake on the Tennessee l t
River in Limestone County Alabama,30 miles West of Huntsville, Alabama. The systems at the j three units are similar, with those for Units 1 and 2 being the most similar. General Electric was the Nuclear Steam System Supplier and the turbine generator supplier, and TVA was the architect ;
engineer and constructor. I Each unit is a BWR 4 design with a hiark I containment. Only unit 2 is currently operating. j Each unit has a design power of 3440 hiWt, a rated power of 3293 MWt, and a net output of j 1065 MWe. Unit I achieved commercial operation in August 1974, and Units 2 and 3 achieved !
operation in March 1975, and March 1977, respectively. ;
f I.3.1 Unique Features Unit 2 is a standard BWR 4 Mark I design. It shares numerous systems with Units 1 and 3, as j is typical for this vintage plant. There are no unique features at the plant, although a number of $
features are noteworthy. i Units I and 2 share four emergency diesel generators; Unit 3 has four emergency diesel generators. The diesel generators can be crosstied among all three units. The HPCI pump is l turbine driven and injects into a feedwater line, hence into the downcomer region. A LPCI f system is used, as opposed to LPCS, and injects into the recirculation loops, not directly into the i core region. Variable speed recirculation pumps are used. A Mark I containment design is used, which is nitrogen inerted during operation. :
i 1
4 ;
l l
i i
I i
At Browns Ferry, ser ice water for many important components can be provided by either the raw cooling water system (RCWS) or the emergency equipment cooling water system (EECWS).
Also. four swing ; pumps' can supply either EECWS or RHR service water. Selected RHR l pumps / heat exchangers from Unit I can be crosstied to Unit 2. The station batteries deplete four hours after station blackout. !
i 1.3.2 Similar Plants and PSA's i The twenty BWR 4 plants in the United States are the following: [ Nuclear Plant Sourcebook)
Browns Ferry 1,2, and 3 l Brunswick I and 2 Cooper l Duane Arnold !
Fermi 2 Fitzpatrick l Hatch I and 2 Hope Creek Limerick I and 2 Peach Bottom 2 and 3 Shoreham Susquehanna 1 and 2 !
Vermont Yankee.
All of these plants use a Mark I containment except for Limerick I and 2, Shoreham, and l Susquehanna 1 and 2, which use a Mark II containment. Shoreham has been cancelled.
i Probabilistic Safety Studies (PSA) for plants similar to Browns Ferry include the Peach Bottom analysis of NUREG 1150, and the PSA for Shoreham.
- 5
l II. REVIEW FINDINGS This section of the report summarizes the findings of the SEA audit of the front end portion of j the IPE Submittal.for Br' owns Ferry Unit 2. !
9 As indicated in Section 1.1 of this report, only the information contained in the Submittal has #
been reviewed. No discussions with TVA personnel were held and no visit to the site was made.
Summary review findings of note are in bold type.
1 11.1 Review and Identification of IPE Insights This report focuses on issues of concern as identified by the review. Issues that were reviewed -
and for which no concerns were identified are not discussed to any significant extent in this report.
11.1.1 General Overview of Front End Analysis This section of the report summarizes the general results of the review.
11.1.1.1 Completeness .
The IPE evaluated internal initiating events and internal flooding for Unit 2. Units I and 3 are presently not operating, and this was the status considered in the analysis. Therefore, the analysis j did not address multi-unit initiating events, nor did it address the requirements for maintaining hot shutdown in the other two operating units while responding to an initiating event in Unit 2.
For the site status as evaluated, the IPE is complete.
l TVA has committed to perform an expanded Probabilistic Risk Assessment (PRA) which .
considers all three units in operation, and to present a summary report to the NRC prior to the ;
restart of Unit 3. [PRA Update] This expanded analysis will not be a separate PRA for all three units, rather it will address the change in core damage frequency for Unit 2 with Units 1 and 3 ;
t in operation. TVA intends to consider two initiating events common to all three units, namely:
loss of offsite power, and loss of instrument air. Without a qualitative analysis, it is not 6
1 J
l I
j obvious that initiating events in shared systems other than offsite power and instrument air can be screened out from consideration as multi-unit initiating events. I I
11.1.1.2 Methodology The IPE used the large event tree, small fault tree methodology. Intersystem dependencies were !
handled by developing split fractions and by linking event trees. i i
The methodology included common cause, uncertainty, and recovery. l Fault tree models are not included in the Submittal, only values for quantified split fractions are !
given. It is not required that detailed system models be provided in the submittal The methodology is documented in the Submittal, both generically and as applied to Browns !
Ferry Unit 2. ;
The methodology utilized in the IPE is satisfactory. !
11.1.1.3 As-Built / Operated Confirmation l t
Numerous modifications have been made to Browns Ferry since initial commercial operation was !
achieved. The IPE is based on the status of Unit 2 as of December 1991, and the IPE considered l all modifications up to this date. The IPE did not model the hardened containment vent that !
was to be installed after the freeze date. The utility plans to model the containment vent !
if the IPE is updated for multi-unit operation; the update is expected in 1995. l t
I Although the model addressed the current configuration of the plant, a containment walkthrough j specifically for the IPE was not performed. [lPE, Section 2.4.3] Data from a 1982 containment walkthrough performed by Oak Ridge National Laboratories was used. A walk-through ,
addressing Internal Flooding and Interfacing Systems LOCAs was performed. [
t l
I 7 !
t
I 1I.1.1.4 Internal Flooding Methodology The IPE identified flooding initiating events and modeled the plant response using the transient event trees, considering dependent effects from the flooding.
The analysis modeled equipment failure due to submergence; it appears that no consideration of other flooding induced failures, such as spray, were considered. Also, small flood sources were '
screened out based on plant design features, but these features seem to be compartment volumes and drainage paths, which do not rule out equipment failure due to local effects of the flood source. Without detailed information or a site visit, the importance of flooding induced failures otner than submergence cannot be reviewed.
The methedology used for internal flooding is reasonable, but the validity of the apparent exclusion of local effects (those not due to submergence) cannot be verified.
11.1.1.5 Peer Review The IPE for Browns Ferry Unit 2 was performed by TVA personnel with contractual assistance from: PLG. ERIN Engineering, Gabor, Kenton and Associates, and EQE Engineering Consultants.
t Peer reviews were performed by both TVA and PLG personnel who did not participate in the analysis effort.
The peer review process meets the intent of Generic Letter 88-20.
11.1.2 Review of Accident Sequence Delineation and Systems Analysis -
This section of the report provides detailed comments based on the audit. :
11.1.2.1 Initiating Events Events requiring controlled shutdown were not considered as initiating events, and plant specific ,
support system initiating events were identified by FMEA. [lPE, Section 3.1.1) Generic data 8
l were used to quantify initiating events; plant specific data were not used due to the number of plant changes made during the restart effort.
t HVAC failures were screened from consideration as initiating events, based on analyses documented in reference 3.1.1-9. [IPE, Section 3.1.1) The rationale for this screening is that loss l of HVAC is well annunciated and there is ample time for operator response.
Table 3.1.1-1 of the Submittal summarizes initiating events considered. LOCA events both inside and outside containment were considered, but the specific LOCAs outside containment are not indicated in this table; six different LOCAs outside containment, including feedwater line breaks and main steam line breaks, are discussed under the event ISO in the PRETREE event tree. [IPE, Section 3.1.2.1.1] LOCA sizes are not provided for the different LOCA classes modeled (large, small, and so on), and no distinction between LOCA sizes for water and steam line breaks is provided. The very small LOCA is not defined but it appears to be a recirculation pump seal LOCA.
Appendix D of the Submittal references an initiating event ISLOVA and indicates it has a frequency of 1.0/ reactor-year. [IPE, page D161) This event is identified as an interfacing systems LOCA, but it appears that this event was not actually included in the analysis. The initiating event ISLOVA should be clarified.
The frequencies assigned to the initiating events are reasonable.
11.1.2.2 Front Line and Support Systems The Submittal does not contain the fault tree models used to quantify the system level split fractions; therefore a detailed review of the component specific modeling for the systems cannot
'se performed using information only in the Submittal. The Submittal does contain system descriptions, summaries of thermal hydraulic calculations, split frac; ion logic equations, and values for the split fractions. The comments in this section of the report are taken from this information.
i 9 ,
The IPE does not model cooling for the recirculation pump seals. The seal cooling is provided by either the Reactor Building Closed Cooling Water System (RBCCWS) or the CRD system.
[UFSAR, Section4.3] 'if both seal cooling systems are lost, the seals will overheat in about seven minutes; leakage is expected to be less than 70 gpm. [UFSAR, Section 4.3] Without seal cooling, a transient evolves into a very small LOCA, and this is not modeled in the IPE.
For the Brown's Ferry design, this is not expected to have a major impact on the CDF, since all core cooling systems inject into the vessel and can accommodate the recirculation pump seal leakage.
The IPE modeled RCIC as a viable core cooling system for transients and small LOCAs, and claimed that RCIC will successfully cool the core if one SRV is stuck open. [lPE, page 3.1.2-22]
Furthermore, the IPE states that RCIC can be manually initiated as late as -122 inches level (where the MSIVs isolate); the auto-initiation setpoint for RCIC is -45 inches.10 to 15 minutes l is stated to be available for this manual initiation of RCIC. [IPE, page C9] The support information for this model is confusing. The discussion references a calculation indicating that :
26 minutes are available, but the calculation does not consider an SRV to be failed open. [lPE, page C9 and Table C8] The discussion indicates that the time to automatic RCIC isolation is 10 to 15 minutes, thus 10 to 15 minutes is conservative ume to reach -122 inches; however, it is not clear if this time to auto-isolation considers an SRV failed open.
We performed an independent calculation for RCIC using an SEA code developed for Grand l l
Gulf, modified for Browns Ferry. The code is discussed in Appendix A of this report. Figure '
2.1-1 provides our results for the case of I SRV failed open. This figure indicates that the -122 inch level is reached at about 10 minutes, and that if RCIC is manually initiated at this level the core will not uncover.
l Figure 2.1-2 provides our results for the case with no SRVs failed open. This figure indicates that -45 inches is reached at about 10 minutes and -122 inches is reached at about 25 minutes.
l l
10
The IPE model for RCIC, including times available for operator actions, appears correct based on our independent, analyses; however, the supporting information provided in the
~
IPE is confusing..-
The EECW system can supply non-safety related raw cooling water loads. [lPE, page 3.2-16]
If EECW flow is insufficient, these loads are isolated. It is not clear whether or not isolation of these non-essential EECW loads was considered in the IPE analysis, but the Submittal is not required to provide detailed system models, such as fault trees.
The split fraction logic and split fraction values in Appendix D of the Submittal were reviewed.
Some of the review comments on these split fractions are contained in following sections of this report in the context of the topic to which they apply. The remaining comments on these split fractions are as follows. The split fraction logic for event LPCI is incomplete. lIPE, page !
D120] The split fraction logic on the top of page D140 is incomplete. The split fraction logic for events RVCO, ;RVCI, and so on up through RVC9 on page D69 is confusing; these split fraction rules appear to define the event in terms ofitself(RVC) and no definition of events SORV0, SORVI, SORV2, and SORV3 could be found (SORV is defined on page ;
D67).
t 11.1.2.3 System Dependencies System dependencies are provided as Tables 3.2-3 and 3.2-4 of the Submittal. For the most part.
the dependencies are correctly identified and indicated on the tables.
l Table 3.2-3 indicates that the emergency power switchgear requires room cooling from HVAC. ;
However. in the discussion of the support system event trees, it is stated that analyses indicated that room cooling for the switchgear is not required, and that the requirement for room cooling I was left in the event trees but assigned 0 probability of failure. [lPE, page 3.1.4 3] The analysis supporting removing the requirement for room cooling is provided in reference 3.1.41.
I1
-RCIO On et -122 In Meas.,1 SRV Open
- 0_ :
.C . : ris s : : : :
Q ,
........,..I..s.i..I.,.........,......,......,t.........:.........:,...
C C -
.T E.
0 6 _. ......... .. ...:.. ... .:.. .... .:..........:... ......:.. .... .:. .... .
_......: ........:. ......[..... ...j....... 4.,.. ......j..........:....
C g .
S . . . . . . .
g .
......,..........;......;........;.......4.........;......;.......
- . :. :. :. :. l. l C .
E -100 -- - i-- --- - - - i - - - !- ---- ! - ---- - -- - - l - - - ! - - -
O6.
l "g"""
....g......g...........p........ :...........
,} - . . . . . . . . . . . . . . . g.....
a .
a .3m -- .........!.. . .. ..................!.. p..Oi.. COC.G... .
. i.
i i
- 1601.nches
-180 O 500 1000 1500 2000 2500 3000 3500 4000 Time after 1 Minute (Saconds)
Figure 2.1-1. RCIC at -122, 1 SRV Open 12
Loss of Makeup at 0 Hrs., Boil on SRVs
- E :.
8 .
fi -
! In.it. ia l Level i ;
Q -. . . . . . . ..
- g. .{ .. j. . . . . . .. . .. . . .
l : : : : . .
Q L
~
l l.
l l l y -.....h.............;.........y................f.........;.....
3 w
. ......p.......... ..L..........&........J...........4...
- : l l l l b -
y: i ! ! !
E ~
level at i 8 -150 - -582 Ir1che$ ---- : -- + ---l.----+. -
-+. .
i i ncovere.d:
i
,,,,.i . . . . .
_g ...i....i....i..., ,,,,i,,,, ,,,,
0 500 1000 1500 2000 2500 3000 3500 4000 Time after 1 Minute (Seconds)
Figure 2.1-2 Boil on SRVs, No Makeup 1 ),
No control room cooling is indicated in the dependency tables. Section 3.2.1.5 indicates that control room cooling is provided by chillers cooled by EECW. No discussion could be found related to the modeling of control room cooling .
The source of water for the EECW is RHR Service Water. Table 3.2-3 does not indicate a '
dependency of EECW on RHR Service Water; however, Section 3.2.1-5 of the IPE implies that ;
this was directly considered in the model for EECW. Similarly, Table 3.2-3 does not indicate ventilation requirements for the diesel generators, but ventilation was probably directly included in the models for the diesel generators.
11.1.2.4 Common Cause Common cause failures due to shared components and required dependencies were considered in the linked event trees and the associated split fraction logic rules. Common cause due to subtle interactions such as identical equipment type were considered using the Multiple Greek Letter (MGL) method.
Generic data was used to quantify the MGL parameters, and the values used are reasonable.
f The scope of the MGL analysis is not clearly indicated. It is likely that common cause :
failures within systems were considered, but that common cause failures among systems ,
were not considered. ;
i 11.1.2.5 Event Trees i Three front line event trees are used for modeling transients, LOCAs outside containment, and ;
small I.CCAs. These three trees are: PRETREE, HPGTET, and LPGTET. The large LOCA !
event tree is LLOCAl, and the medium LOCA tree is MLOCA2. Numerous support system trees, containment interface trees, and plant damage state trees are also used. All of these trees are in the Submittal, and all were reviewed in this audit. Major comments from this review follow.
14
=. .. .-.
i
~
The PRETREE event tree considers a LOCA outside of containment. The event ISO is isolation of a break outside primary containment and addresses six specific LOCAs including a feedwater line break. However, the split fraction logic rules appear to only model isolation of a RCIC steam line break. [IPE, Section 3.1.2.1.1. and pages D149 and D178] For a feed' water line break, it appears that a check valve must close to isolate the break. The split fraction logic for event ISO does not model isolation in detail for all identified LOCAs outside of .
containment; rather, it assumes that isolation of RCIC is a conservative model of all I isolation requirements.
The LPGTET tree considers the use of LPCI or CS for core cooling for transients, but the model does not appear to address closure of the MSIVs for maintenance of suppression pool inventory.
The concern is that without closure of the MSIVs, fluid pulled from the suppression pool is lost out the containment through the open steam lines resulting in loss of suppression pool water supply to the ECCS pumps. The model does require control of vessel level, event OLP, [lPE, page 3.1.2-44] which prevents pumping water out the open lines, but inventory is lost by steaming out the open steam lines. The suppression pool water volume is 129,000 ft); to heat then boil off half of this inventory requires about 4.2 x 10' Btu. The total energy from decay heat over 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is about 2.1 x 10' Btu, based on a calculation described in Appendix B of this :
report. Thus, loss of adequate suppression pool inventory may not be of concern; however, the use of ECCS systems with the MSIVs open differs from the design criteria for these systems. ;
The HPGTET tree assumes that a recire pump seal LOCA occurs if SRVs fail to open during an ATWS, and this LOCA is modeled as equivalent to a stuck open SRV. [lPE, page 3.1.2-13] It appears that the IPE model considered every small LOCA as equivalent to a stuck open SRV, ;
because the split fraction logic rules for event RVC, SRV closure, assign RVC9 to the event with a failure probability of 1.0 if the initiating event is a small LOCA. [lPE, pages 3.1.2-15, D69, and D193)
The assumption that a small LOCA can be modeled as an open SRV requires further discussion.
An open SRV discharges directly to the suppression pool, while a small LOCA does not. For ;
the Mark I contamment at Browns Ferry, the distinction is not important, but for a Mark 111 15
containment it is important because suppression pool makeup is required for LOCAs to compensate for inventory discharged to the large drywell floor area.
The interface between containment cooling and core cooling is discussed in Section 11.1.2.7 of this report.
The LLOCAl event tree model large LOCAs. The success criteria for a large LOCA in the IPE ~
is as follows: [lPE, pages 3.1.2-49 and 3.1.2-54]
1 CS Loop (Both Pumps)
- For a recirc suction line break, either LPCI loop can be used and the recire discharge valve in loop used must close.
For recire discharge line break, only the LPCI loop in the line without the break can be used and the recirc discharge valve in the intact loop must close.
This IPE success criteria states that either CS or LPCI can mitigate a large LOCA. This success criteria is not in agreement with that of the FSAR. [UFSAR, Table 6.5-2], which requires CS.
The FSAR success criteria is based on preventing peak clad temperature from exceeding 2200 F. Tae FSAR does state that any single system, CS or LPCI, can prevent clad melting at 3370 F, but cannot maintain peak clad temperature below 2200 F based on 10 CFR 50.46 and 10 CFR 50 Appendix K requirements. (UFSAR, Sections 6.5.1 and 6.5.2.5]
For the IPE success criteria for a large LOCA to be acceptable, it must be shown that the core geometry remains in a coolable condition, and this is not directly addressed in the Submittal. The large LOCA success criteria is especially important for the BWR4 design in which LPCI injects into the recirc loops and not onto the core. With LPCI alone (no CS) the injected water enters the downcomer and fills the core from the bottom, and the top 1/3 of the core, which is 16
uncovered, must ,be cooled by swell and steam. If CS is available, the top 1/3 is showered with water. (In later designs, su,ch as the BWR6, LPCI injects into the core). However, the success criteria used in the Brown's Ferry IPE is consistent with best estimate success criteria used
, t in other BWR PRAs, where credit for core cooling has been taken with no CS and with the core collapsed level at the two foot core level. [NUREG/CR-4550, Vol. 6, Part lj i
INUREG/CR-4550, Vol. 4, Part 1]
i The documentation of the success criteria is inconsistent. For example, Table 3.1.3-6 of the Submittal, Success Criteria for a Large LOCA, does not include closure of recirc loop discharge valves which is required for LPCI. The success criteria is not consistently documented in the <
i Submittal. !
11.1.2.6 Core Damage Sequences ;
The IPE Submittal provides a great deal of documentation on the dominant core damage f
sequences. A good summary of the dominant sequences is given in Section 1.4.2 of the :
Submittal.
The mean CDF is 4.8 x 104per reactor year, including internal flood. To 95% confidence, the l 4
CDF is no greater than 1.1 x 10", and to 5% confidence the CDF is no greater than 5.6 x 10 .
For internal initiating events only, the mean CDF is 4.3 x 104 , which is about a factor of 10 higher than that for Peach Bottom as analyzed in NUREG 1150. A comparison of frequencies of different accident types for the two plants is as follows, units are 1/ reactor year:
Accident Type Browns Ferry 2 Peach Bottom 2 Station Bgkyt 1.3 E-5 2.1 E-6 Loss of Offsite Power 2.0 E-5 1.0 E-7 (No Station Blackout)
ATWS 1.3 E-6 1.9 E-6 l
LOCAs 7.0 E-7 2.6 E-7 Other Events 1.3 E-5 1.4 E 7 17
The higher CDF for Browns Ferry compared to Peach Bottom is due to some plant differences and more conservative modeling. HPCI and RCIC are lost after 4 hourt at Browns Ferry, given loss of AC due to-batterv depletion; 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> was used for Peach Bottom. The Peach Bottom model credited recovery of failed diesel generators, the Browns Ferry model did not. The Peach Bottom study also credited recovery from common cause failures, while the Browns Ferry study did not. The Browns Ferry study used more conservative data for recovery of offsite power than did the Peach Bottom study. The Browns Ferry study used more conservative models, tnan did the Peach Bottom Study, for operator action to align alternate AC power sources to equipment during non-station blackout, loss of offsite power scenarios. The Browns Ferry study credited fewer operator actions than did the Peach Bottom Study.
The top 10 CDF sequences are summarized in Section 1.4.2.2 of the Submittal, and they are as follows:
- 1. Loss of Offsite Power, Loss of 4 Unit 1/2 Diesel Generators, Loss of 4 Unit 3 Diesel Generators, no Power Recovery within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
- 3. Loss of Offsite Power, Loss of A, B, and C Diesel Generators, Loss of RHR Pump 2D
- 4. Loss of Offsite Power, Loss of A, B, and D Diesel Generators, Loss of RHR '
Pump 2B
- 5. Sequence 1 Plus Failure of Reactor Building isolation System
- 6. Turbine Building Flood with Failure of 250 V DC resulting in Loss of f
Low Pressure Injection ;
- 7. Sequence I with Failure of HPCI to Operate
- 9. Sequence 1 Plus Failure of RCIC to Operate
- 10. Sequence 1 Plus Stuck Open SRV. l l
l 18
The core damage frequency from internal flooding is 4.7 x 104, which is about 10% of the l overall frequency. ,
The core damage frequency from interfacing system LOCAs is 4.6 x 10-', which is small. The frequency of a low pressure line outside containment being exposed to vessel pressure is 2.6 x 4
10 ; [IPE, Section 3.3.9.1] the low likelihood of core damage is due to a detailed analysis of actual component failure procaointies and credit for operator action, as discussed in Section !
II.l.2.9 and 11.1.3.2 of this report.
11.1.2.7 Front and Back End Interfaces Brown Ferry is a BWR 4 with a Mark I containment. The design pressure is 56 psig [UFSAR]
i and the IPE took the failure pressure as about 165 psig. '
The RHR pumps at Browns Ferry will cavitate unless the suppression pool is subcooled. The NPSHR of the pumps is 30 to 34 feet, but the drop in elevation from the suppression pool water f 4
surface to the RHR pumps is only (537 - 519) = 18 feet. [ Original FSAR Table 4.8-6, and :
i Updated FSAR Figures 1.6-8 and 1.6-9)) l Long-term cooling with LPCI, CS, HPCI, or RCIC requires containment cooling. With !
i containment cooling using one RHR heat exchanger, NPSHA requirements, pump temperature f
limits, and high turbine back pressure trip (for HPCI and RCIC) are not of concern. If ;
t containment cooling is not available, core cooling with these systems using the suppression pool cannot be maintained.
i The Submittal did not address containment venting, a plant modification to be installed after the !
i freeze date. ,
t For ATWS scenarios, if reactor shutdown with SLC is not accomplished, the steam flow to the .
suppression pool exceeds the capacity of suppression pool cooling. This causes containment failure; it is conservatively assumed that containment failure causes loss of core cooling due to
I f
such effects as. saturation of the suppression pool and loss of adequate NPSHA. or EQ effects on j core cooling equipment outside containment. ;
l 1
For station blackout without timely recovery of power, HPCI and RCIC fail due to loss of de I control power prior to failure due to loss of suppression pool cooling. ;
t 1I.1.2.8 Multi-Unit Effects -
The IPE model for Unit 2 assumes that Units 1 and 3 are not operating. This issue is addressed !
in Section 11.1.1.1 of this report.
11.1.2.9 Human Factors Interfaces l Tables 1.5 and 3.4-6 of the Submittal summarize important operator actions for core damage. i important actions include manual depressurization of the vessel, control of vessel level with CS l
or LPCI, and initiation / recovery of suppression pool cooling. ;
These tables also indicate that an important operator action is initiation of drywell spray; for !
example, action ODWS1 in table 3.4-6. This appears to be wrong, since the core cooling model does not consider the use of spray. Also, event ODWS does not appear in the core damage event ,
trees, it appears in the containment interface tree CNTMT. [lPE. page 3.1.3-1] It appears that ODWS1 does not affect core cooling, rather it affects the plant damage state.
The IPE modeled operator action in response to interfacing system LOCAs. [lPE, Section 3.3.9) ;
With credit for operator action, the frequency of core damage from interfacing system LOCAs 4
is 4.6 x 10 , while without operator action the frequency is 6.9 x .10. [IPE, page 3.3.9-2] i Operator action is an important factor in reducing the likelihood of core damage following an i interfacing systems LOCA.
f i
Recovery actions are described in Sections 3.3.3.3 and Appendix B Section B.7.
- Important recovery actions include: [IPE, Table 3.3.3-7] i Recovery of Offsite Power following Total Loss of Offsite Power :
l 20 l
l Transfer to Alternate Source of Offsite Power following Failure of Normal Offsite Power Supply Restore Power to'480V RMOV Board 2A (2B) i Align Unit 1 RHR for Unit 2 Use RHRSW Swing Pump for EECW Supply Recover Suppression Pool Cooling.
No alternate power sources in addition to offsite power and the eight diesel generators were considered. The FSAR does not indicate the presence of any station blackout power sources at the site. [UFSAR. Section 8]
The onsite electrical power supply system includes eight emergency diesel generators (DGs); four for Units 1 and 2, and four for Unit 3. The FSAR indicates that the Unit 3 DGs can be manually crosstied to power Unit I and 2 loads. [UFSAR. Section 8.5.3.1] The system description for the electrical power system in the IPE discusses the DGs but does not indicate whether or not operator action is required to power Unit 2 loads with the Unit 3 DGs. [lPE, Section 3.2.1.4] ;
The IPE model is for the current plant configuration in which Units 1 and 3 are shutdown, and the FSAR is for a condition in which all three Units are in operation. It is possible that the i action to load Unit 2 loads onto Unit 3 DGs is automatic under the current site conditions, but this is not discussed in the Submittal. The table of dynamic human actions provided in the i Submittal does not include an operator action for powering Unit 2 loads off Unit 3 DGs. [IPE, Table B.8] The Submittal should clarify whether or not operator action is required to power Unit 2 electrical equipment off Unit 3 emergency diesel generators.
11.1.3 Review of Quantitative Process This section of the report summarizes the results of the audit of the quantitati.e process used in the front end portion of the IPE.
11.1.3.1 System and Component Quantification The IPE used the following process to quantify core damage:
21
p i
Initiating Events were Identified and Quantified Core Damage Sequences were Developed with Systemic Event Trees System Dependencies were Considered Using Split Fractions in the Event Trees !
Split Fractions were Developed with Fault Trees, which modeled Component Failures including Common Cause Basic Events in the Fault Trees were Assigned Values The Core Damage Sequences were Quantified with Riskman Software. :
1 This process is the standard one used for the large event tree, small fault tree methodology. ,
Different truncation values were used for different initiating events; truncation values ranged from 1 x 10* to 1 x 10 ". A post-accident mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was used. Recovery actions were incorporated into the model, including a detailed model for recovery of offsite power, and an uncertainty analysis was performed. Core damage sequences were binned into Plant Damage :
States (PDS). ;
i The Subminal provides data used for initiating events and for basic events. The Submittal also provides the event trees, the split fraction logic, and the split fraction values. The fault trees are not provided in the Submittal.
i The Submittal provides the discrete probability distribution for the core damage frequency. ;
Dominant sequences are discussed, as well as important systems and important operator actions. ;
11.1.3.2 Data Analysis None of the data tables provided in the Submittal indicate units of the data in the tables.
This is an impediment to checking the data and could cause errors in the IPE quantification
{
process. For example, some of the failure data is per unit time and some is per demand; the '
failure rates per unit time are multiplied by an exposure time to provide failure probabilities while !
the demand failures are the probability. Also, the component failures per unit time are in 1/hr l L
as distinct from initiating event frequencies which are in 1/ year. [lPE, Tables in Section 3.3) l 22 l
l
Generic data was used exclusively in the analysis. [lPE, Section 1.4-2] No plant specific data was used for initiating eve,nt frequencies. component failures. or maintenance unavailabilities.
~
The data in Section 3.3 of the Submittal was reviewed and the values are reasonable for a generic set of data.
The maintenance frequency and duration data in Tables 3.3.1-2 and 3.3.1-3 are surprisingly terse compared to that used for other PSAs such as South 'fexas. l anie 3.3.1-3 indicates that the first column of numbers are' medians'; this may be a mis-labeled column since all the other data tables provide 'means'. Table 3.3.1-3 includes eight types of events designated ' TYPE A' through ' TYPE II', but no description of these events is provided.
One important aspect of Browns Ferry is that the batteries deplete after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following loss of AC power. [IPE, page 3.3.3-6] This has an important effect on the frequency of core damage from station blackout, sic e the time available for recovery of AC power, while using RCIC or HPCI until the batteries deplete, is relatively short.
Recovery of offsite electric power was considered during two time intervals: up to 30 minutes, ;
I and between 30 minutes and 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. [lPE, Section 3.3.3.4) The recovery factors used are j reasonable. The 30 minute time frame corresponds to a transient with total loss of mjection; it j is stated that analyses were performed indicating that it requires 45 minutes for more than 1/3 of j the core to be uncovered. Figure 2.1-2 of this report indicates that about 50 minutes are available l until 1/3 of the core is uncovered; thus, the IPE times are reasonable. !
The 6-hour time frame corresponds to a scenario in which HPCI or RCIC inject for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> until batteries deplete; it is stated that analyses were performed indicating that 1/3 core uncovery occurs in an additional 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. An independent analysis of this scenario was performed with the software discussed in Appendix A. Figure 2.1-3 provides results; the time of 1/3 core uncovery is estimated to occur at about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The IPE times are reasonable.
23 j
e r
Loss of Makeup at 4 Hrs., Boll on SRVs
, 50 -
i i i i i E
8 : ilnitial! Level! ! !
Q .
........g. . . . . . . . . . . . . . ...........;...........
C: . . . .
C".l, -
6 O .- : : : : :
m
_ . . . . . . . . . . . . .y. . ..
....3.......... . . . . . . . . . . y............g..........
9 .
e -100 Y. - - - - - - +. - - - t. - -- - - t. - - - - - - V. - - - - -
E -
- 3 -
i i. i. :. !.
1N __..
C: -
i i ! i >
ya -
..........}......1)acore...g-;........}.........
- Uncovered ; ;
..................:.........:........:........I.........
3 U
3 -
. . i. i. .
g g ............'...........j.........'...........y.....}.. . . . . . . .
l l : : :
e i e i l i ie il i e i il i i e iI . i i i I i i . .
0 2000 4000 6000 8000 10000 12000 Time after 4 Hours (Seconds) i 1
I Figure 2.1-3. Loss of injection at 4 Hours ;
i 24
The IPE performed an analysis of interfacing LOCAs. [lPE, Sections 3.3.9 and Appendix E)
Actual failure probabilities,for low pressure rated components exposed to high pressure were calculated. For example.'the RHR suction line for shutdown cooling was evaluated. This line has a rating of only 150 psig, but the IPE assigned a probability of failure of this line given exposure to primary pressure (1000 psig) of only 1 x 10". [lPE, page 3.3.9-2] This low failure pressure is based on analyses by EQE as summarized in Appendix E of the Submittal. The EQE results are reasonable when safety margins in the ratings and ultimate failure stress are considered. For example, assuming the RHR suction piping is 20 inch standard 304 stainless l (wall thickness of 0.375 inches), the pressure corresponding to ultiraate failure at 65 kips (at 500 ,
F) is about 2500 psi. Consideration of actual failures when pressure rating are exceeded has an :
important effect on the quantificatioa of an interfacing systems LOCA.
2.1.3.3 Generic Data !
The IPE exclusively used generic data as discussed in Section 11.1.3.2 of this report. The generic data is the PLG proprietary data base. The values in the generic data tables of Section 3.3.1 of l
the Submittal were reviewed and compared to other data such as that used for South Texas, Grand Gulf, and Peach Bottom. The generic values are reasonable.
11.1.3.4 Quantification of Common Cause Common cause was quantified using the MLG method. The data used was from the proprietary PLG data base. The values in the common cause data table 3.3.4-10 of the Submittal were i reviewed and compared to other data such as that used for South Texas, Grand Gulf, and Peach !
Bottom. The generic values are reasonable.
l 11.1.4 Review of Approach to Reducing Vulnerabilities i 11.1.4.1 Definition of Vulnerability :
Vulnerabilities are addressed in Sections 3.4.3 and 6 of the Submhtal.
25
i 1
l
)
The Submittal evaluates vulnerability based on common failures that contribute significantly to core damage or early radionuclide release. Furthermore, unless the numerical mean values for core damage freq0ency or for early radionuclide release are above specific thresholds, no vulnerabilities are considered.
The thresholds given in Section 3.4 are:
- 1. A total mean CDF of greater than 5 x 10", or
- 2. A total mean frequency of early release greater than 5 x 10 5 In addition to the above consideration of vulnerabilities, improvements were considered if the following criteria are met: [lPE, Section 6.3)
- 1. A contribution of a single initiator, component failure, or operator action results in a CDF greater than 5 x 10, or
- 2. A contribution of a single system division results in a CDF greater than 1 x 10" 11.1.4.2 Plant Improvements Based on the vulnerability thresholds described in Section 11.1.4.1 of this report, no vulnerabilities were identined. Based on the improvement thresholds described in Section 11.1.4.1 of this report, no improvements were identined.
The Submittal does tabulate split fraction events of importance to the core damage frequency in Section 3.4.3. However, since no contributors exceeded the threshold values used for identifying vulnerabilities or improvements, no plant enhancements are considered as a result of the IPE.
The Submittal does indicate that one plant operation feature could be improved. [IPE Section 6.3]
At Browns Ferry, the operator routinely blocks ADS to allow time to fully pursue recovery of high pressure injection. The ADS design does include a " level only blowdown" feature, which if used, would allow time for operator action but not block ADS, thereby reducing the likelihood 26
=
of failing to depressurize. Evidently, this improvement is not being pursued because it did not satisfy the threshold criteria.
~
II.I.5 Review of Evaluation of Decay Heat Removal Section 3.4.4 of the Submittal summarizes the evaluation of Decay Heat Removal (DHR). The IPE evaluated DHR for all accident sequences. Thus, the function of decay heat removal is rigorously considered in the model. The review comments in this report are directed at the adequacy of the details of the system models for decay heat removal.
11.1.5.1 Reliability of DHR Section 3.4.4 of the Submittal discusses the importance of systems that provide the heat sink for DHR; these being the main condenser, suppression pool cooling, and shutdown cooling. Thus, in the discussion of DHR, the Submittal focuses on loss of heat sink. Loss ofinjection to the core is not addressed in the discussion of DHR. Loss of DHR as defined by loss of heat sink contributes 64% to the total CDF. If station blackout sequences are excluded, the contribution is 38%. [lPE, Section 3.4.4] No vulnerabilities for DHR were identified; the majority of the CDF from loss of DHR is due to station blackout.
The IPE definition of DHR as exclusively limited to the heat sink is overly restrictive. DHR evaluations should include injection to the core, since DHR is concerned with removing decay energy from the core as well as with providing a heat sink for the energy removed.
11.1.5.2 Diverse Means for DHR Restricting the definition of DHR to the heat sink, as done in the Sub ittal, the following diverse means of RHR were considered:
Main Condenser Suppression Pool Cooling Shutdown Cooling.
I 27 i
i i
If a more comprehensive definition of DHR is taken, namely heat removal from the core for all i accidents except medium and large LOCAs and ATWS sequences, then the list of diverse means would also include. injection to the core with HPCI, RCIC, CS, LPCI, and so on. These diverse !
systems are included in the IPE model, but they are not discussed under the function DHR. l 1
11.1.5.3 Unique Features I The Browns Ferry Unit 2 plant has no truly unique features associated with DHR. The systems ;
used at Browns Ferry are common to the BWR 4 Mark I design.
t Units 1 and 2 share four emergency diesel generators; Unit 3 has four emergency diesel ,
1 generators. The diesel generators can be crosstied among all three units. The HPCI pump is j i
turbine driven and injects into a feedwater line, hence into the downcomer region. A LPCI system is used, as opposed to LPCS, and injects into the recirculation loops, not directly into the core region. Variable speed recirculation pumps are used. A Mark I containment design is used, l which is nitrogen inerted during operation, f i
At Browns Ferry, service water for many important components can be provided by either the
{
raw cooling water system (RCWS) or the emergency equipment cooling water system (EECWS).
l Also, four swing pumps can supply either EECWS or RHR service water. Selected RHR !
I pumps / heat exchangers from Unit I can be crosstied to Unit 2. The station batteries deplete four hours after station blackout. :
i f
11.1,6 Review of Other issues to be Resolved with IPE l As stated in Section 3.4.5 of the Submittal, only USI-45, evaluation of DHR,is addressed by the j IPE.
4 No other USIs or GSis are resolved by the Submittal. l r
t E
i 28 [
h
. - _ - - ~ _ . _ . . - . -. - -
i i
III. CONCLUSIONS FROh! REVIEW The Submittal provides the.information required by the IPE Generic Letter. The documentation ,
is extensive, and for the most part clear. The Submittal provides excellent summaries of results. ,
System failure models (fault trees), are not included in the Submittal, but system descriptions and split fraction logic rules and values are provided.
t Specific review comments are given in the preceding sections of this report, highlighted with bold l type. ;
I I
i r
t 4
i I
i i
i i
i i
I i
i t
4 29 l
t i
1 APPENDIX A. CODE USED FOR THERMAL HYDRAULIC ANALYSES -
I As part of the audit, we pirformed independent thermal hydraulic calculations to verify some of the IPE estimates of times available for operator actions . These calculations are described and l their results are presented in Section 2.1 of this report. l This appendix summarizo the code used to perform these calculations. The code is written in Turbo Pascal and is typically run on a 486 PC under Turbo Pascal for Windows. The code was originally developed by SEA to perform a general energy balance on an open thermodynamic .
system with saturated water and steam; the name of the original code is ENERBAL. PAS. Time dependent decay heat, mass loss, and mass injection are considered. The code provides thermal hydraulic conditions of the system at specified time intervals. Also, for analyses of BWRs, the code calculates both actual water levels and measured water levels, which differ at low pressures
{
because the safety grade level instrumentation is uncompensated for changes in density from full !
i power conditions. '
I l
The code was used to model the thermal hydraulic behavior of Grand Gulf for the shutdown PRA !
study at Sandia National Laboratories. The code was also recently used for independent analyses in cur IPE review of McGuire. [lPE Audit, McGuire] For this report, the code was modified to
{
model Browns Ferry, and applied to selected issues of interest, as part of our vertical review of ;
the Browns Ferry IPE Submittal.
i 6
6 30 i
t a
APPENDIX B. DECAY HEAT ENERGY OVER 24 HOURS l The energy from decay heat following reactor shutdown determines the ability of core cooling f systems to prevent core damage. As part of our vertical review of selected issues in the l Submittal, we developed a code to calculate decay heat (power), and total energy released [
from decay heat over any specified time interval. This code is DECAYHT.MA and is written !
in Mathematica 2.1. [Mathematica}
i The decay heat data is from the Standard Review Plan, reduced by 90% to provide best estimate. [ Standard Review Plan] Using Mathematica 2.1, this data for decay heat is fit with !
I an interpolating function, and the energy released is calculated by integrating the interpolating !
polynomial over time.
1 i
I I
f 7
i I
f l
L 31 l
i
REFERENCES e
[ Nuclear Plant Sourcebook) " Overview and Comparison of U.S. Commercial Nuclear Power Plants", NUREG/CR-5640, September,1990.
[PRA Update] Letter from 0.J. Zeringue, TVA, to NRC dated February 7,1992, " Browns Ferry Nuclear Plant (BFN) - Expanded Probabilistic Risk Assessment (PRA) Considering Operation of Browns Ferry, Units I and 3".
[lPE] Browns Ferry IPE Submittal to NRC, September 1, 1992.
[UFSAR) Updated Final Safety Analysis Repon for Browns Ferry.
[NUREG 4550, Vol. 6. Part 1] " Analysis of Core Damage Frequency: Grand Gulf.
Unit 1 Internal Events", NUREG/CR-4550, Vol.6, Rev.1, Part 1, September 1989.
[NUREG 4550, Vol. 4, Pan 1] " Analysis of Core Damage Frequency: Peach Bottom Unit 2 Internal Events", NUREG/CR-4550, Vol.4, Rev.1, Part 1, August 1989.
[lPE Audit. McGuire] "McGuire IPE: Front End Audit", SEA 91-553-02-A:1.
April 15,1992.
32
)
i b
i NRC Standard Review Plan, NUREG-0800 3 ranch
[ Standard Review Plan] '
Technical Position ASB 9-2, " Residual Decay Heat j Energy for Light Water Reactors for Long Term Core i Cooling", Rev. 2, July 1981. l
.i Mathematica 2.1, Wolfram Research,1992. !
[Matnematica] ;
e I
r I
I L
i I
t f
I, i
i i
l t
l i
33 !
1 f
1 BROWNS FERRY NUCLEAR PLANT UNIT 2 INDIVIDUAL PLANT EXAMINATION TECHNICAL EVALUATION REPORT BACK-END ENCLOSURE 3