ML20078E047
| ML20078E047 | |
| Person / Time | |
|---|---|
| Site: | Point Beach  |
| Issue date: | 10/04/1994 |
| From: | Darby J SCIENCE & ENGINEERING ASSOCIATES, INC. |
| To: | NRC |
| Shared Package | |
| ML20078D982 | List: |
| References | |
| SEA-92-553-022, SEA-92-553-022-A:3, SEA-92-553-22, SEA-92-553-22-A:3, NUDOCS 9501310106 | |
| Download: ML20078E047 (62) | |
Text
,
I e
POINT BEACH NUCLEAR PLANT INDIVIDUAL PLANT EXANINATION TECHNICAL EVALUATION REPORT j
i (FRONT-END) i I
i i
9501310106 941004 ENCLOSURE 2 PDR ADOCK 050002663 i
P PDR i
u i
SEA 92-553-022-A:3 o
October 4,1994
)
l Point Beach 1 and 2 Technical Evaluation Report on the Front End IPE Submittal Technical Evaluation Report NRC-04-91-066, Task 22 i
John L. Darby Science and Engineering Associates, Inc.
i i
1 Prepared for the Nuclear Regulatory Commission
l l
TABLE OF CONTENTS o
I. EX E C UTIVE S U M M A R Y....................................... 1 1.1 B a c ka ro u n d......................................
1 1.2 Licensee's I P E Process.................................
2 1.3 Front End Analvsis 3
1.4 Pla nt i mo rove ments.....................................
5 i
- 11. RESPONSE TO WORK REQUIREMENTS..........................7 i
l1.1 Licensee's IPE Process..................................
7 11.1.1 Completeness.............................
7 11.1.2 Methodology...................................
7 11.1.3 Multi. Unit Effects................................
8 j
11.1.4 As-Built Status..................................
8 11.1.5 Licensee Participation.............................
9 j
11.1.6 in-House Peer Review............................
9 11.2 Accident Seauence Delineation and Svstem Analvsis 9
l 11.2.1 Initiating E vents.................................. 9 l1.2.2 Internal Flood Methodology...................
11 II.2.3 E vent Trees................................... 12 II.2.4 Systems Analysis................................ 17 l1.2.5 System Dependencies............................ 19 11.2.6 Common Cause Analysis.....................
19 l1.3 Quantitative Process................................... 19 ll.3.1 Quantification of Accident Sequence Frequencies......... 20 11.3.2 Point Estimates and Uncertainty / Sensitivity Analyses...... 20 11.3.3 Use of Plant Specific Data......................... 21 11.3.4 Use of Generic Data.............................. 21 11.3.5 Common Cause Quantification...................... 22 II.3.6 Intemal Flooding Quantification...................... 23 11.4 Core Damage Seouence Results........................... 24
- 11. 4. 1 Dominant Core Damage Sequences..............
24 11.4.2 Vulne rabilities.................................. 29 11.4.3 Proposed improvements and Modifications.......
29 11.5 I nt e rf a ce i s s u e s.......................................30 l1.5.1 Front-End and Back End interfaces................... 30 l1.5.2 Human Factors Interfaces...........
31
~i 11.6 Evaluation of Decay Heat Removal and Other SafeMs.ugs......
31 i
11.6.1 Examination of DH R.............................
31 11.6.2 Diverse Means of DHR...........................
32 11.6.3 Unique Features of DHR........................... 32 11.6.4 Other GSI/USl's Addressed in the Submittal............. 34 i
i
-~r--
m
... =.
i I
.(.
ll1. REVIEW
SUMMARY
AND DISCUSSION OF IPE INSIGHTS, IMPROVEMENTS, AND COMMITMENTS........................ 35 IV. D ATA S U M M ARY S H E ETS.................................... 39 APPENDIX A. CALCULATIONS IN SUPPORT OF REVIEW 41 REFERENCES........................................,,,,,,,,
54 l
I I
il i
)
LIST OF TABLES Table ll 1.
Component Failure Data 22 Table 112.
Comparison of Beta Factors 23 Table ll-3.
Top Five Systemic Core Damage Sequences 27 Table 11-4.
CDF from RCP Seal LOCA by initiating Event 28 Table A-1.
RHR/CCW/SW Model Results 45 I
i i
lii
-a LIST OF FIGURES l
Figure 11-1.
CDF by initiating Event for Point Beach 26 Figure A-1.
Decay Heat for Point Beach 42 Figure A-2.
Integrated Energy from Decay Heat for Point Beach 43 Figure A-3.
Mass Flow rates for Feed and Bleed 47 Figure A-4.
Probability of Non-Recovery of Offsite Power 49 Figure A-5.
Probability of RCP Seal LOCA 52 i
l i
i
)
IV
l
- 1. EXECUTIVE
SUMMARY
This report is based on the results of a Submitial only review of the IPE.
Requests for additionalinformation were proposed as a result of this review.
Responses to these requests were received, reviewed, and incorporated into this report. [lPE Responses) 1.1 Backaround The Point Beach site contains two units, each a two loop pressurized water reactor (PWR). The units are located on Lake Michigan in Wisconsin about 90 miles north-northeast of Milwaukee. The units have a steel lined, pre-stressed, post-tensioned concrete containment. Westinghouse was the nuclear steam system supplier (NSSS), and Bechtel was the architect engineer (AE), for both units. Unit 1 achieved commercial operation in 1970; unit 2 achieved commercial operation in 1972.
The design power is 1518.5 MWt,523.8 MWe (gross), for er.ch unit. Similar units in operation are: Kewaunee, Ginna, and Prairie island 1 and 2.
The following design features tend to increase the CDF:
Manual Actions Required for ECCS Recirculation from Containment Sump Manual Actions Required for Supply of Water to AFW after 4 Hours Two Onsite Diesel Generators Shared by Each Unit One Hour Battery Time after Station Blackout.
Other plants have automatic switchover of ECCS from injection to recirculation, and are not susceptible to loss of ECCS following LOCAs due to operator failure to institute ECCS switchover. Other plants have more inventory available to AFW and do not require alternate sources of water as soon. Other dual unit sites have more 1
than 2 diesel generators. Other plants have a significant longer battery lifetime during station blackout and can operate the TD AFW pump longer allowing for a higher likelihood of recovery offsite power.
The following c'esign features tend to decrease the CDF:
One Onsite Gas Turbine Generator Ability to Cool Turbine Driven AFW Pump Bearings with Diesel Driven Fire Water Air Cooled Charging Pumps 1
O No Need for HVAC except for DG Room Ventilation.
The gas turbine generator can mitigate the loss of both DGs. The ability to cool the TD AFW pump bearings with diesel driven firewater prevents loss of AFW during station blackout due to loss of normal bearing cooling for this pun;,). Since the charging pumps are air cooled, they remain a/allable for seal injection following loss of component cooling water or loss of service water. HVAC support system failures do not impact the ability to provide for core cooling, except that ventilation for the DGs is required; other plants require other HVAC systems to operate to maintain frontline core cooling systems.
1.2 Licensee's IPE Process
{
The Submittalis a full level 1 PRA with a limited scope level 2 PRA. The PRA l
was initiated in response to Generic Letter 88-20. The freeze data for the IPE model i
was September 5,1990. No planned modifications beyond the freeze data were I
considered in the PRA model.
Utility personnel were involved in all facets of the totalIPE effort. Major contractors for the front-end PRA were Halliburton NUS, Westinghouse, and El International. The original contractor support was provided by El International. After El Ir ternational declared bankruptcy in 1990, Westinghouse was retained for support.
In 1992, the contract with Westinghouse was terminated and Halliburton NUS was retained for support. SAROS, incorporated provided independent review of the level 1 PRA.
Plant walkdowns were performed to verify that the PRA model represented the as-built condition. Walkdowns were conducted for three areas of,the analysis: intemal flooding, systems walk downs, and the Level 2 PRA. Major documentation used in the IPE included: the UFSAR, technical specifications, system descriptions, plant drawings, simulator runs, operating procedures, and discussions with operations staff.
IPE studies of eight other plants were reviewed, and information from several PRA studies was reviewed. The specific IPEs and studies reviewed are summarized in Section 11.1.4 of this report.
Several reviews of the level 1 PRA were performed. The initial PRA documentation was reviewed by operations staff with systems responsibilities.
Reviews of the initial documentation were also performed by engineers with system specific experience. An initial review of the level 1 PRA was performed by SAROS Incorporated, utility PRA personnel, personnel from Rochester Gas and Electric, and utility personnel not involved in the latest work on the PRA. After the final draft PRA notebooks were completed, they were reviewed by knowledgeable utility personnel.
The Submittal defines a vulnerability as follows:
- Severe accident vulnerabilities 1
are plant specific design or operating characteristics resulting in dominant contributors to core damage frequency (CDF) or large fission product release frequency (FPRF) significantly above the NRC's mean safety goal targets for all domestic nuclear power plants (from SECY-89-102, ' implementation of Safety Goal Policy')".
2
- _ _ =
These safety goal targets are 1E-4/Ry yr for CDF and 1E-6/Ry yr for FPRF. Based on this definition of vulnerability, the Submittal states that there are no vulnerabilities at Point Beach. The Submittal does discuss improvements that are expected to reduce the CDF and FPRF.
The utility indicated in the Submittal that it intends to maintain and upgrade the IPE as necessary for future use; however, no commitment is made to do so. With respect to maintaining and updating the PRA, the submittal states: "... usage will continue only while it is in the best interest of WEPCO's customers and stockholders *.
1.3 Front-End Analysis The methodology chosen for the Point Beach IPE front-end analysis was a Level l PRA; the small event tree /large fault tree technique with fault tree linking was used and quantification was performed with SETS.
The IPE quantified 50 specific internal initiating events by using 16 groups of initiating events: 6 LOCAs, 5 plant specific support system failures, and 5 generic transients. Flooding initiating events in six flooding zones were included as a separate group of initiating events. The IPE developed systemic event trees for frontline systems, to model the plant response to each class of initiating event. All relevant frontline systems were modeled in the event trees; support systems were modeled in the frontline system fault trees. Special event trees were developed for ATWS, station blackout, and steam generator tube rupture.
Plant specific initiating events were evaluated by examining all support systems.
Failures in support systems that result in reactor trip and affect safety systems were retained as plant specific initiating events if they were not already considered in other generic initiating event categories. The Submittal evaluated loss.of HVAC systems as initiating events, but screened out loss of these systems as initiating events due to the time available to take compensatory actions to either provide alternate cooling or shutdown the plant. Loss of instrument air was modeled as a plant specific initiating event.
The criteria for core cooling was not specifically stated in the Submittal. In response to a question, the licensee stated that core coverage was the criterion used for all sequences except a large LOCA for which UFSAR criteria were used.
Success criteria were developed based on thermal hydraulic analyses, the Updated Final Safety Analysis Report (UFSAR), and engineering judgement. The success criteria are reasonable in comparison with success criteria used for PRA/IPEs of similar plants.
Support system dependencies were modeled in the frontline system fault trees.
The Submittal contained tebles summarizing the inter system dependencies considered in the models.
The IPE used plant specific data from 1985 through 1990. Generic data were used in lieu of plant specific data or to Bayesian update plant specific data, depending on the statistical significance of the plant specific data. The IPE used plant specific data for system unavailability for testing and maintenance.
3
8 i
The Multiple Greek Letter (MGL) method was used to model common cause failures. The data for common cause failures were taken from standard sources as discussed in Section l1.2.6 of this report, and the values used were reasonable in comparison with those typically used in PRA/IPEs. Common cause failures were modeled within systems. Common cause failures contributed 16% to the total CDF, and the dominant common cause failures were in the service water system.
The description in the Submittal of the technique used to evaluate intemal
[
flooding is very thorough. All areas of the plant were evaluated to identify those zones-which if flooded to the extent that all equipment in the area was disabled-would result in reactor trip and loss of at least or.J mitigating component. For the l
Point Beach flood zones, analyses were performed to quantify flood frequencies, l
drainage rates, submergence rates, flood propagation, and effects of spray, drip, and steam. Operator actions to prevent submergence were considered; damage from spray, drip, and steam was assumed to be instantaneous and therefore not subject to prevention by operator action.
The total CDF from intemal initiating events and internal flooding is 1.15E-4/Ry yr. The CDF from internal flooding is 1.08E-5/Ry yr. The Submittal identified all systemic sequences which contribute to the top 95% of CDF, in accordance with the reporting guidelines of NUREG 1335.
Internal initiating events that contribute the most.to CDF, and their percent contribution, are as follows:
Large LOCA 22 %
Station Blackout 13%
Intemal Flooding 9%
Medium LOCA 9%
Loss of Service Water 7%
Steam Generator Tube Rupture 5%
The CDF involving RCP seal LOCAs is 8%, with only 0.3% contribution from I
station blackout; nearly all the CDF from seal LOCAs is due to three initiating events:
loss of component cooling water (4%), loss of service water (2%), and loss of offsite power (2%). One reason the CDF from a seal LOCA is so low following station blackout as compared to the other three initiating events, is that a detailed model for seal LOCAs was used for station blackout, but not for the other three initiating events.
\\
The detailed seal LOCA model predicts little likelihood of a seal LOCA for times less than about four hours after loss of all seal cooling.
l In response to our request for more information, the licensee provided more r
information related to loss of DHR leading to core damage. Loss of DHR contributes 67% to the overall CDF. The response discussed each of the contributors to loss of DHR and the plant changes completed or planned to reduce loss of DHR.
l 4
u i
The licensee proposes that the Submittal resolves two issues:
USl A-17 Systems interactions Generic lasue 23, RCP Seal Failure.
These issues are being addressed by other programs within the NRC, and are out of scope for this review.
The front-end core damage sequences were binned into Plant Damage States (PDS) for back and analysis. The binning considered: type of initiating event, availability of RHR inje:: tion at the time of core damage, availability of containment fan cooling or coratainment bypassed, and the estimated time of core damage. The binning process used was reasonable in comparison with that typically used in IPE/PRAs.
i Plant design characteristics impact the overall CDF. Operator actions j
contributing significantly to the overall CDF are: failure to institute ECCS recirculation, and failure to provide water for AFW supply after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The one hour battery
{
lifetime requires special operator actions to provide turbine driven auxiliary feedwater for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> during a station blackout. The ability to cool the turbine driven AFW pump bearings with water from the diesel driven firewater pump, an automatic backup cooling supply, allows turbine driven AFW to be used during station blackout.
j Based on our review, the following modeling assumptions specific to the Point j
Beach IPE tend to lower the overall CDF:
(a) credit taken for use of the turbine driven AFW for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following station blackout, with battery lifetime of only 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> i
(b) no requirement for any containment cooling system for any accident sequence (c) the detailed seal LOCA model used for station blackout seal LOCA analysis.
1.4 Plant imorovements The Submittal states that improvements already made since the freeze date of the model are estimated to reduce overall CDF by about 13%, from 1.15E-4 Ry yr to about 1.0E-4/Ry yr. Those improvements already completed by the date of the Submittal, June,1993, are as follows:
j installation of an additional safety related battery j
installation of an additional non safety related battery installation of alternate shutdown switchgear upgrade of gas turbine generator improvements in reliability of MSIVs.
The upgrade of the gas turbine generator contributed most to the reduction in CDF.
The Submittal discusses plant improvements either already scheduled, or under consideration as a result of the IPE. Both procedural and hardware modifications are identified. The improvements are as follows.
5
i i
O l
Changes to the procedures dealing with Switchover of ECCS to Recirculation
~
from the Containment Sump [ scheduled for June 1994)
Changes to the procedures dealing with Providing Long Term Supply of Water to the Auxiliary Feedwater System [ scheduled for June 1994)
Modifications to allow Rapid Connection of Fire Water to Refill the CSTs.
[ Scheduled for September 1994)
Modifications to reverse Door Frames in the Control Building Tunnel to Ensure Doors Fail Open at Low Flood Level [ Scheduled for September 1994) i Modifications to Install Additional Diesel Generators; this modification was not initiated as a result of the IPE [ Schedule for Third DG Operational, and of 1994; Schedule for Fourth DG Operational, and of 1995)
These improvements, in total, are estimated to reduce the CDF from 1.0E-4/Ry
.yr to about BE-5/Ry yr. The effect of the two additional diesel generators alone is estimated to reduce CDF by about 10%.
The improvements identified and committed to appear responsive to the results of the IPE analyses and should result in a reduction in CDF.
We found no areas where the Point Beach IPE process could be improved. We identified specific issues from the Submittal to be resolved with the licensee as summarized in Appendix A of this report.
h P
t 6
t
~ lt}
l II. RESPONSE TO WORK REQUIREMENTS This section of the report addresses the requirements in the Statement of Work.
Strengths of the Submittal are noted, and perceived weaknesses of the Submittal are i
discussed and characterized with respect to their overall significance. Unique findings of the Submittal are summarized.
11.1 Licensee's IPE Process We reviewed the process used by the licensee in the Submittal with respect to I
the requirements of Generic Letter 88-20. [GL 88-20) 11.1.1 Completeness We reviewed the completeness of the Submittal with respect to the type of l
information and level of detail requested in NUREG 1335. [NUREG 1335)
{
The Point Beach IPE is a level 1 PRA for the front end, with a limited scope l
level 2 PRA for the back end. The Submittal is complete in terms of the overall requirements of NUREG 1335. The Submittal follows the Standard Table of Contents for a utility submittal as specified in NUREG 1335, Table 2.1. No obvious omissions l
were noted.
i The Submittal is complete with respect to the type of information required by l
Generic Letter 88-20 and NUREG 1335.
l1.1.2 Methodology i
We assessed the methodology employed in the front-end portion of the IPE.
{
The front-end portion of the IPE is a level i PRA, which is a method that is acceptable by Generic Letter 88-20. The specific technique used for the level i PRA was a small event tree large fault tree technique with fault tree linking, and it was clearly described in the Submittal.
The Submittal described the details of the technique, internalinitiating events I
and internal flooding were considered. Event trees were developed for all classes of initiating events. The development of component level system fau!t trees was i
summarized, and system descriptions were provided. Support systems were modeled with fault trees and linked with the appropriate frontline system fault trees. Inter-system dependencies were discussed in the system descriptions and a table of system deper. ncies was provided. Data for quantification of the models were l
provided, including common cause and recovery data. The application of the j
technique for modeling internal flooding was described in the Submittal. The l
techniques used for performing importance and sensitivity analyses were described in the Submittal.
The level 1 PRA upon which the front-end portion of the Submittal is based, was initiated in response to Generic Letter 88-20.
l 7
s
I 11.1.3 Multi-Unit Effects i
We reviewed the considerations in the IPE given to multi-unit effects for plants i
collocated at a common site, specifically for events common to the plants and for systems shared among the plants.
i Point Beach is a two-unit site, with numerous shared systems and components as described in the UFSAR, including: AC and DC electrical power, service water and instrument air. The Submittal addressed shared cvstem in the event trees and fault t
trees; however, dual unit core damage frequency was not calculated. [lPE, Section i
3.2.1.7)
We requested more information on dual unit core damage in more detail, since design characteristics indicate that the potential for dual unit core damage from common failures may be more important at Point Beach than at newer plants. For example, the site has only two diesel generators, shared between the two units, either one of which can mitigate a design basis accident (DBA) in one unit and provide power for shutdown cooling at the other unit; thus, station blackout, which involves loss of both diesel generators, affects both units simultaneously.
i The licensee response states that 22% (2.55E-5/yr) of the total CDF reported in i
the IPE represents dual unit core damage. [lPE Responses] The internal flooding core j
damage sequences are all dual unit core damage sequences. Station blackout j
without recovery of ac power results in core damage at both units.
l1.1.4 As-Built Status We reviewed the process used to confirm that the IPE modeled the as-built plant configuration.
Plant walkdowns were performed to verify that the PRA model represented the as built condition. [lPE, Section 1.3) Walkdowns were conducted for three areas of the analysis: internal flooding, systems walk downs, and the Level 2 PRA. [lPE, I
Section 2.4.4)
Major documentation used in the IPE included: the UFSAR, technical specifications, system descriptions, plant drawings, simulator runs, operating procedures, and discussions with operations staff. [lPE, Section 2.4.3]
IPE studies of eight other plants were reviewed, and information from several PRA studies was reviewed. [lPE, Section 2.4.2] The specific studies reviewed are as follows: WASH-1400, NUREG/CR-4550 reports for: Zion, Sequoyah, and Surry, NSAC-60 for Oconee Unit 3, and NUREG-4458, Decay Heat Removal for Point Beach.
The freeze date for the IPE model was September 5,1990. [lPE, Section 1.3]
The iPE did not include any planned modifications in the basic models, but additional analyses were performed related to modifications installed since the freeze date to estimate their impact on core damage frequency (CDF). This is discussed in Section 11.4.3 of this report.
8 m
---.e--
r e.
+
v--
11.1.5 Licensee Participation We reviewed the degree to which licensee personnel were involved in the IPE.
Utility personnel were involved in the IPE from the beginning of the effort and were involved in all major IPE tasks, as described in Section 5.1 of the Submittal. Major contractors for the front-end PRA were Halliburton NUS, Westinghouse, and El Intemational. The original contractor support was provided by El Intemational. After El intomational declared bankruptcy in 1990, Westinghouse was retained for support.
In 1992, the contract with Westinghouse was terminated and Halliburton NUS was retained for support. [lPE, Section 5.1) SAROS, incorporated provided independent review of the level 1 PRA.
The utility indicated in the Submittal that it intends to maintain and upgrade the I
IPE as necessary for future use; however, no commitment is made to do so. With respect to maintaining and updating the PRA, the submittal states: "... usage will continue only while it is in the best interest of WEPCO's customers and stockholders".
llPE, Section 1.1) l1.1.6 in-House Peer Review We assessed the process used by the licensee to review the IPE.
Several reviews of the level 1 PRA were performed. [lPE, Section 5.2) The initial PRA documentation was reviewed by operations staff with systems responsibilities.
Reviews of the initial documentation were also performed by engineers with system specific experience. An initial review of the level 1 PRA was performed by SAROS Incorporated, utility PRA personnel, personnel from Rochester Gas and Electric, and utility personnel not involved in the latest work on the PRA. After the final draft PRA I
notebooks were completed, they were reviewed by knowledgeable utility personnel.
II.2 Accident Seauence Delineation and System Analvsis This section of the report documents our review of both the accident sequence delineation and the evaluation of system performance and system dependencies provided in the Submittal.
- 11. 2.1 initiating Events We reviewed the initiating events, both internal and internal flooding, considered in the IPE. Dependencies among initiating events and mitigative functions were reviewed. The completeness of the set of initiating events was reviewed. The consideration of plant specific initiating events was reviewed, including the use of plant historical operating experience. The point estimate frequencies assigned to the initiating events were reviewed.
The following process was used to identify initiating events. [lPE, Section 3.1.1.3) A survey of PWR operating experience and reviews of other PRAs were 9
11.1.5 Licensee Participation We reviewed the degree to which licensee personnel were involved in the IPE.
i Utility personnel were involved in the IPE from the beginning of the effort and were involved in all major IPE tasks, as described in Section 5.1 of the Submittal. Major contractors for the front-end PRA were Halliburton NUS, Westinghouse, and El infomational. The original contractor support was provided by El Intemational. After El Intemational declared bankruptcy in 1990, Westinghouse was retained for support.
in 1992, the contract with Westinghouse was terminated and Halliburton NUS was retained for support. [lPE, Section 5.1] SAROS, incorporated provided independent review of the level 1 PRA.
l The utility indicated in the Submittal that it intends to maintain and upgrade the IPE as necessary for future use; however, no commitment is made to do so. With respect to maintaining and updating the PRA, the submittal states: "... usage will continue only while it is in the best interest of WEPCO's customers and stockholders *.
IlPE, Section 1.1) 11.1.6 in-House Peer Review i
We assessed the process used by the licensee to review the IPE.
Several reviews of the level 1 PRA were performed. [lPE, Section 5.2] The initial PRA documentation was reviewed by operations staff with systems responsibilities.
Reviews of the initial documentation were also performed by engineers with system specific experience. An initial review of the level 1 PRA was performed by SAROS Incorporated, utility PRA personnel, personnel from Rochester Gas and Electric, and utility personnel not involved in the latest work on the PRA. After the final draft PRA notebooks were completed, they were reviewed by knowledgeable utility personnel.
11.2 Accident Secuence Delineation and Svstem Analvsis This section of the report documents our review of both the accident sequence delineation and the evaluation of system performance and system dependencies provided in the Submittal.
- 11. 2. 1 initiating Events t
We reviewed the initiating events, both internal and internal flooding, considered in the IPE. Dependencies among inluating events and mitigative functions were i
reviewed. The completeness of the set of initiating events was reviewed. The consideration of plant specific initiating events was reviewed, including the use of plant historical operating experience. The point estimate frequencies assigned to the initiating events were reviewed.
The following process was used to identify initiating events. [lPE, Section 3.1.1.3) A survey of PWR operating experience and reviews of other PRAs were 9
l
~ - -.
performed to produce a list of possible initiating events. Then, the plant operational l
history was reviewed to screen out initiating events not applicable to Point Beach, and to identify any unique initiating events that had occurred. Finally, a review of the plant i
specific support systems was conducted to identify plant specific initiating events.
The generic initiating events, specifically LOCAs and typical transients, considered for Point Beach are complete and comparable to those events considered in typical PWR PRA/IPEs. LOCAs were quantified using data from other PRAs, except that a plant specific analysis was performed to quantify interfacing systems LOCAs. Generic transient initiating events were quantified by using plant specific data to bayesian update generic data. Plant specific initiating events were quantified by solving detailed system fault trees developed for the specific systems of concem.
The discussion of plant specific initiating events is comprehensive. (IPE, Section 3.1.1.3.4] The description of the process by which plant specific initiating events were considered, and screened or retained for analysis, is thorough. A plant specific initiating event was retained for specific analysis if it caused reactor trip and if it imposed unique unavailabilities not already modeled by another class of initiating event. A good discussion of the impact of loss of HVAC systems is provided. Fifty initiating events were retained for analysis. [lPE, Table 3.1.1.A-9] These fifty events were placed into classes of initiating events based on similar impacts on the availability of mitigating systems; sixteen groups of initiating events were specifically analyzed with event trees. [lPE, Table 3.1.1.A-14) Plant specific initiating events retained for specific analysis were as follows:
Loss of instrument Air Loss of 125 Vdc Bus D01 Loss of 125 Vdc Bus D02 Loss of Component Cooling Water System Loss of Service Water System.
Loss of non-vital 4160 V AC power components and loss of 480 V AC power l
components are included in appropriate generic initiating event categories. Loss of one 1E 4160 V AC bus does not result in plant trip and therefore is not an initiating i
event.
The list of initiating events appears complete.
The point estimate frequencies assigned to the initiating events appear reasonable in magnitude compared to values typically used in IPE/PRAs, except that the frequencies for plant specific initiating events as calculated from fault tree models were not provided. The Submittalindicates that the fault trees for these specific initiating events were linked to the mitigating system fault trees to automatically l
account for the impact of component-specific initiating events on the availability of mitigating systems. However, the table of initiating events did not provide a quantitative estimate of the overall frequencies for failure of the systems as initiating events so that they can be understood in the context of plant specific design characteristics. (It should be noted that the linking of an initiating event tree is not as simple as just linking another mitigating system tree. Component initiating events can i
be common to component mitigating events, but the initiating events are quantified as l
10 e
t
a frequency, while the mitigating events are quantified as a probability. Special techniques are required to link identical components that have two values, a frequency and a probability. [Bott and Stack])
We requested that the licensee provide values used for the frequencies of plant specific initiating events. The licensee provided the following values: [lPE Responses]
Loss of CCW 1.59E-3/yr Loss of DC Bus D01 9.33E-4/yr Loss of DC Bus D02 9.33E-4/yr Loss of Instrument Air 5.63E-3/yr Loss of Service Water 5.41 E-4/yr.
These frequencies include failures of shared components that are used to mitigate the responses to these initiating events (most notably electrical failures), thus the values by themselves do not reflect the true importance of the initiating events. The frequency for loss of CCW and loss of SW are not unreasonable, but are higher than values used in some other IPEs.
The Submittal did not consider complete loss of DC power as an initiating event. We requested further information supporting screening out common cause failure of loss of all DC power as an initiating event. The licensee responded that due to the alignment and variation in the DC power trains, common cause failure of all DC power trains is an unlikely event and was not considered. [ Licensee Responses]
Random failure of DC trains subsequent to the initial failure of one train were considered in the event tree models.
The frequency assigned to the interfacing systems LOCA is relatively low,7.2E-8/ reactor year (Ry yr) compared to other PRA studies such as the NUREG 1150 studies. The frequency of the interfacing systems LOCA includes consideration of operator recovery (isolation of the LOCA by closure of isolation valves); without consideration of recovery the frequency would increase to about 1.4E-6/Ry yr. [lPE, Section 3.1.1.B.9.0] A thorough discussion of the model for interfacing system LOCAs provided in the Submittal; the model included the use of best-estimate values from NUREG\\CR-5102 for failures of piping and components exposed to beyond design pressure. [lPE, Appendix 3.1.1B][NUREG\\CR-5102]
11.2.2 Internal Flocd Methodology We reviewed the methodology used in the IPE to evaluate core damage from internal flooding initiating events. The processes used to identify flood sources and to model flood propagation among plant zones were reviewed.
The description in the Submittal of the technique used to evaluate internal flooding is comprehensive, except that the Submittal does not clearly indicate how random failures leading to core damage following a flood initiating event were quantified. [lPE, Section 3.3.8) The intemal flooding analysis was performed in the following manner. All areas of the plant were evaluated to identify those areas-which if flooded to the extent that all equipment in the area was disabled-would result in 11 l
reactor trip and loss of at least one mitigating component. Submergence, spray, dripping, and steam damage were considered. Of all the areas so identified, areas were screened from further consideration if the effect of the flood was already considered in a much more likely transient internalinitiating event. Areas surviving this screening were denoted Point Beach flood zones, and were retained for further detailed analysis. For the Point Beach flood zones, analyses were performed to quantify flood frequencies, drainage rates, submergence rates, flood propagation, and effects of spray, drip, and steam. Operator actions to prevent submergence were considered; damage from spray, drip, and steam was assumed to be instantaneous and therefore not subject to prevention by operator action. The flooding frequencies and times es%ated for operator actions appear to be reasonable i., nomparison with other IPE/h1As. The previously developed event trees for transient accidents due to internal initiating events were used with pre-existing unavailabilities of equipment specified as dictated by the particular flood event under study. The sensitivity of the results of the flooding study to uncertainty in two areas was evaluated, these areas being: the frequency of flood initiating events, and the probability the operators isolate flood sources or recover accident mitigating systems disabled by flood effects.
The Submittal is not clear on the process used to quantify core damage from floods that do not directly lead to core damage. Typical PRA practice is to use the transient event trees that were developed for internal events, modify them to account for failures directly due to the flood, and use to modified event trees to quantify subsequent random failures that in combination with the flood cause core damage.
Page 70 of Section 3.3 of the Submittalimplies that such scenarios were considered.
Section 11.3.6 of this report summarizes our review of the results of the internal flooding analysis as summarized in the Submittal.
11.2.3 Event Trees We reviewed the event trees provided in the Submittal. The event trees use a mixture of functions and systems for the top events, and are best characterized as mixed systemic / functional event trees. Hereafter, this report refers to the event trees as systemic since results of the analyses are reported on a systemic basis. Each accident initiating oveat was included in an appropriate class of initiating events, and each class of initiaDog events was modeled with an event tree. Sixteen event trees were constructed, these being: [lPE, Section 3.1.2]
A Large LOCA S1 Medium LOCA S2 Small LOCA R
Steam generator Tube Rupture T3 Transient with PCS Available T2 Transient with PCS Unavailable TSB Steamline Break Outside Containment TFB Steamline/Feedline Break inside Containment T1 Loss of Offsite Power 12
0 SBO Station Blackout ATW ATWS TCC Loss of Component Cooling Water TD01 Loss of 125 Vdc Bus D01 TD02 Loss of 125 V Bus D02 TIA Loss of instrument Air TSW Loss of Service Water Two other initiating events, interfacing systems LOCA and excessive LOCA (e.g.,
vessel rupture), lead directly to core damage and no event trees were developed for these events. Consideration was given in the transient event treas for transients evolving into a small LOCA, due to either a stuck open pressurizer PORV or an RCP seal LOCA. The mission tirre used was 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
The Submittal does not specifically state the criteria for core damage. The discussion of success criteria addresses system successes but does not relate them to any core protection criteria such as water level for transients and small LOCAs, or peak cladding temperature for large and medium LOCAs. We requested that the licensee provide the criteria for core damage. The licensee responded that, except for large LOCAs, the criterion was uncovery of the top of the core, and that if systems designed to mitigate the consequences of a large break LOCA fail, core damage is assumed regardless of the water level. [lPE Responses) The criteria for a large LOCA were not specifically calculated, since the IPE models were based on the UFSAR licensing criteria for the early stages of the large LOCA when the fuel is uncovered.
We reviewed the systems success criteria used in the IPE to model rnitigation of accidents. We reviewed the success criteria for all accident types: LOCAs, transients, ATWS, SGTR, and so on. The Submittal clearly identifies the systems success criteria for each class of accident. The success criteria are reasonable compared to those used in other IPE/PRAs, and are consistent with the licensing analyses used in the UFSAR, except for the requirements for containment heat removal, as subsequently discussed.
We requested further information on systems success criteria for the following two criteria used in the IPE:
(1) 200 gpm to each of 2 SGs from auxiliary feedwater following an ATWS (2) no requirement for containment cooling systems.
The Submittal assumes that an ATWS resulting from a loss of main feedwater can be mitigated if at least 200 gpm is provided to both steam generators. [lPE, Section 3.1.4.1) In a follow-up response, the licensee stated that this assumption was based on Westinghouse analysis for ATWS from WCAP-11992, " Joint Westinghouse Owner's Group / Westinghouse Program: ATWS Rule Administration Process",
December,1988.
The Submittal states that containment cooling is not needed to support long term heat removal, and the event trees reflect this. [lPE, Section 3.1.2.9) The Submittal considers ' containment cooling' to specifically be containment cooling systems, either fan coolers or sprays. The Submittal does require CCW cooling for at least one RHR heat exchanger for all scenarios in which energy is released to 13
l e
containment, so in a sense it does have a system that removes heat from containment: however, the assumption that one RHR heat exchanger with CCW cooling is sufficient is a deviation from UFSAR success criteria and should be i
discussed more in the Submittal. The UFSAR licensing analyses are based on the following containment heat removal capabilities: 4 fan coolers, or 2 containment spray trains and two RHR heat exchangers, or 2 fan coolers and 1 containment spray train and 1 RHR heat exchanger. [UFSAR, Section 6.3]
We performed a conservative scoping calculation which indicates that with one RHR heat exchanger used for containment cooling, the CCW temperature may be excessive; however, our calculation is very conservative. This calculation is summarized in Appendix A of this report.
We requested the quantitative basis for the ast,umption that containment cooling systems are not required to prevent core damage for sequences in which energy is discharged into containment. The licensee summarized analyses that indicate the maximum temperature of RHR and CCWin recirculation with one RHR heat exchanger in operation are 250 F and 174 F, respectively, which are below the RHR i
and CCW design temperatures of 400 F and 200 F, respectively. [lPE Responses)
Also, the response states that loss of adequate NPSHA will not occur.
The Submittal assumes that one Si pump can provide feed and bleed with only one PORV if operator action is taken within 30 minutes. [lPE, Section 3.1.4.1] We did a quick check on the reasonableness of this success criteria. Our scoping calculation for feed and bleed is summarized in Appendix A of this report. We conclude that the success criteria for feed and bleed are reasonable.
All functions or systems important to the accident sequences were reflected on the event trees. The interface among the events in the event trees and the corresponding mitigating systems was clearly indicated. The event trees properly accounted for: time ordered response, system level dependencies, sequence specific effects on system operability-such as environmental conditions, and high level operator actions as appropriate. We conclude that the event tree models in the IPE are complete and consistent with current PRA techniques.
Loss of ac power was modeled only for the Loss of Offsite Power initiating event. As indicated by our analysis in Appendix A, loss of ac power for other initiating i
events is sufficiently unlikely so that it can be screened from consideration.
The ability of turbine driven auxiliary feedwater to operate is of major importance for station blackout scenarios. The Submittal states that the batteries can be counted on for one hour after station blackout, but that the batteries used for SG level indication can 'likely' last longer; furthermore, the Submittal claims that even with loss of DC, turbine driven aux feedwater can be operated ' blind' for a perbd of time.
IIPE, Section 3.1.4.1) We requested more information related to these assumptions since they impact the length of time that TD AFW is available during a station blackout. The licensee responded that changes had been made which would essentially reduce the load on these batteries by half, and the licensee believes it is reasonable to assume that the batteries would last much longer than the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> originally calculated at the larger load. Credit for operation of the batteries after one 14
.w
hour was not taken in the model. [lPE Responses] Discussion of the licensee response for the ability to operate the TD AFW pump after loss of DC with no instrumentation, is deferred to the review of the human factors aspect of the Submittal, performed by Concord Associates.
The CST is the primary source of water for auxiliary feedwater. The Submittal states that the minimum tech spec requirement for CST supply is 13,000 gal, but that i
the CSTs v.ill have 40,000 'most of the time'. [lPE, Section 3.1.4.1] We requested i
further information to support the assumption that 40,000 gal is available in the CST.
The licensee provided historical data indicating that the CST has 40,000 gal available during operation at full power. [lPE Responses) l The Submittal states that if the CST has 40,000 gal, AFW can be used for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. [lPE, Section 3.1.4.1] We checked this claim and found it to be reasonable as discussed in Appendix A.
Section 11.2.4 and Appendix A of this report summarizes our review of the detailed model used for reactor coolant pump seal LOCAs. Our comments on the use of the model in the event trees follow.
Two types of RCP seal LOCAs are considered in the Submittal:
(a) random seal LOCA as an initiating event (included in the small LOCA initiating event)
(b) seal LOCA as result of loss of seal cooling.
Seal cooling can be provided by either injection with charging pumps or by back-leakage of primary coolant cooled with CCW to the thermal barrier. The Submittal states that the charging pumps do not require CCW or SW for cooling, and that they are adequately cooled by ambient air. [lPE, Section 6.0 and Section 3.1.3.1.3] This is an important design feature, since CCW is required for cooling of ECCS pump seal coolers during recirculation, if CCW were required for cooling charging pumps, then a loss of CCW would result in a seal LOCA that could not be mitigated. We requested more information supporting the assumption that air cooling to the charging pumps is sufficient, including a discussion of the need for room cooling to support air cooling of the pumps. The licensee responded that the charging pumps are designed to be air cooled and operate normally with air cooling, and the loss of HVAC in the charging pump room will not result in overheating of the charging pumps due to the adequacy of natural circulation in the rooms. [lPE Responses]
The Submittal does not discuss seal LOCAs due to loss of CCW to the RCP motor bearings that could result in a vibration-induced seal LOCA if operators do not trip the RCPs. The event tree in the Submittal for the loss of CCW initiating event specifically addresses reactor trip but does not address RCP trip. [lPE, Section 3.1.3]
11 operators do not trip the RCPs, the vibration induced seal LOCA is of concern for the following reasons:
(1) a seal LOCA may occur with loss of only CCW; loss of both CCW and sealinjection are not necessary to cause a seal LOCA as is the case for a seal LOCA due to loss of seal cooling to a tripped pump (2) all ECCS pumps, both high head and low head, at Point Beach require CCW for pump seal cooling in the recirculation phase [lPE, Table 3.2.3-15
C 1]; thus, the vibration induced seal LOCA due to loss of CCW cannot be mitigated.
We requested information from the licensee regarding a vibration induced seal LOCA.
The licensee stated that there is little information in the industry regarding how the RCP would respond to this event, and that operator action to trip the RCPs would be highly likely and that consideration of failure to trip the RCPs would not greatly increase the CDF due to an RCP seal LOCA. [lPE Responses)
Four of the transient event trees consider a transient progressing to a seal LOCA. Three of the trees modelloss of seal cooling systems, CCW and charging injection, these three being: Loss of Offsite Power (T1), Loss of Component Cooling Water, and Loss of Service Water. The fourth tree, the Station Blackout event tree,is a continuation of the loss of offsite power tree under conditions where onsite ac power is also lost; the station blackout tree models a transient progressing to a seal LOCA as the result of failure to restore offsite power !n a timely manner. The rest of the transient event trees do not consider progression of the transients to a seal LOCA; such scenarios were screened out.
The detailed seal LOCA model described in Appendix 3.1.4.A of the Submittal was used in the quantification of a seal LOCA following station blackout. However, the use of this detailed modelin the other three event trees that considered a transient progressing to a seal LOCA is not clear. Event SC, seal cooling, in the loss of offsite power event tree, does not definitively state how the seal LOCA was modeled with failure of event SC. [lPE, Sectiun 3.1.2.20.4) Based on the description of a seal LOCA in the Loss of Component Cooling Water event tree, [lPE, Section 3.1.3.1.4) the detailed model for a seal LOCA was not used to analyze a seal LOCA occurring from loss of charging supplied injection following loss of component cooling water. The Submittal states that to prevent a seal LOCA under these conditions, operator action to restore charging is required within 30 minutes. Similarly, the discussion of the Loss of Service Water event tree indicated that 30 minutes are available for restoration of charging injection before a seal LOCA occurs. [lPE, Section 3.1.3.4.4)
The model for seal LOCAs presented in Appendix 3.1.4.A of the Submittal which provides the probability of a seal LOCA as a function of time from loss of seal cooling, evidently was only used for seal LOCAs during station blackout. We requested clarification as to why the detailed model for seal LOCAs was used in modeling the response to station blackout, but was not used in modeling the response to foss of seal cooling following: loss of offsite power, loss of component cooling water, or loss of service water. The licensee responded that recovery of seal cooling was only considered for station blackout, and that the utility of the detailed seal LOCA modelis for sequences involving time dependent recovery. [lPE Responses) For loss of SW or CCW, recovery of cooling water is not postulated.
The Submittalindicates that following a non-isolable steamline break, injection with borated water from the SI system is not required to prevent excessive power due to positive reactivity from cooldown. [lPE, Section 3.1.2.19.3]
The Submittal does not address overcooling transients in general to any detailed degree; many IPE/PRAs do not consider overcooling transients to be a 16
O significant contributor to overall CDF.
j We reviewed the ATWS event tree. Our first impression was that the tree did not consider early in core life conditions for which the moderator temperature coefficient may be insufficiently negative (due to high boration) to provide sufficient
[
power runback during an ATWS. However, upon more detailed review, we found that the event PR, primary pressure relief, in the ATWS tree considers the unfavorable exposure time (UET) during which insufficient relief is available with all safety and relief valves on the pressurizer. [lPE, Section 3.1.2.22.4]
We reviewed the small LOCA event tree to verify that the model requires steam i
generator cooling if Si is used to mitigate the accident without instituting feed and i
bleed. The model does require steam generator cooling in addition to injection with the Si pumps; feed and bleed can also be used to cool the core without steam generator cooling. [lPE, Sections 3.1.2.16.6 and 3.1.4.1]
The models for mitigation assumed that sufficient water inventory is available to provide adequate service water for both units 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. We requested information on the likelihood of loss of service water due to clogging of traveling screens. The ilcensee responded that water flows from the forebay through traveling screens to the pump suctions. [lPE Responses] If the traveling screens were to begin to clog, the i
circulating water pumps would trip thereby greatly reducing flow through the traveling i
screens and reducing the rate of clogging. The probability that sufficient clogging to I
cause loss of service water would occur is deemed sufficiently low so that it was screened from consideration as a mitigating systems failure. The frequency used for loss of service water as an initiating event does include failure due to clogging of the j
screens.
11.2.4 Systems Analysis This section of the report summarizes our high level review of the systems modeled in the IPE. It is not required that any IPE Submittalinclude detailed system failure models, such as fault trees, and the Point Beach Submittal did not include any l
detailed system modeling information. Therefore, our review was not a detailed evaluation of the system models; rather, the review focused on the following areas.
Identification of systems modeled,
Modeling of all Necessary Systems, Discussion of the process used to model constituent component failures, Dependencies among systems, frontline and support, and i
Completeness of system descriptions in terms of the operational characteristics i
of the systems.
i The Submittal states that fault trees were constructed for both frontline and
)
support systems, and support systems required for a given frontline system were analyzed by linking the support fault tree into the frontline fault tree. System descriptions are included in Section 3.2 of the Submittal. The system descriptions are adequate for documenting an overview of the system models used in the IPE. Our comments on the system models are as follows.
17
~
The IPE used a detailed model to evaluate RCP seal LOCAs. This model is based on West!nghouse data and is summarized in Appendix 3.1.4.A of the Submittal.
a The IPE proposes to resolve Generic issue 23, Reactor Coolant Pump Seal Failure, with the Submittal. [lPE, Section 3.4.6.3) Therefore, we focused on the seal LOCA model as an impwtant aspect of our review of the Submittal. We have no information on the exact sea; design currently in use at Point Beach and on the details of the Westinghouse data upon which the seal LOCA model in the Submittal is based; therefore, we confined our review to the treatment of seal LOCAs in the Submittal, without addressing the correctness of the Westinghouse data or its applicability to the Point Beach seals.
Our comments on the detailed model for a seal LOCA as described in Appendix 3.1.4.A of the Submittal are included in Appendix A of this report. Also, the licensee responses to our detailed comments are included in Appendix A.
As discussed in Section 11.2.3 of this report, the Submittal states that the charging pumps are air cooled and do not require CCW cooling. Thus, loss of CCW r
cooling to the thermal barriers of a tripped reactor coolant pump does not in itself cause loss of seal cooling, since seal injection with charging is not lost.
The UFSAR indicates that a safety injection signal also results in a containment isplation signal. A containment pressure of about 6 psig initiates safety injection.
[UFSAR, Section 7.2 and Tables 7.2-4 and 7.2-7] We could find no discussion in the Submittal on the effects of containment isolation, due to either a spurious safety injection signal or due to reaching the 6 psig trip setpoint over the long term for transients in which energy is released into containment without containment cooling (refer to the discussion related to containment cooling in Section 11.2.3 of this report.)
One concem is the effect of containment isolation on cooling for the RCP motors and seals. We requested more information on the effects of containment isolation as impacting the progression of transient sequences, with specific emphasis on the effects of support to the RCPs. The licensee responded that automatic containment isolation has no effect on seal cooling from either the charging pumps or the thermal barrier cooler, since neither CCW nor seal injection are automatically isolated. [lPE
]
Responses)
The AFW pumps require bearing cooling. Normally, this is supplied by service water, but backup cooling using the diesel driven firewater pump is automatically provided to the turbine driven AFW pump. [lPE, Section 3.1.4.1)
The ECCS pump seal coolers require cooling with CCW during recirculation from the sump; during injection with cold water, cooling to the seal coolers is not required. [lPE, Section 3.1.4.1] ECCS pumps are: RHR, Si, and containment spray.
During injection with SI, borated water is supplied first by a boric acid storage i
tank and then by the RWST. The switchover is automatic. [lPE, Section 3.2.1.1.2)
I Section 3.2.1.2.8 of the Submittal provides a detailed evaluation of the effects of loss of HVAC. Eleven HVAC systems were reviewed and the results of the evaluation i
are summarized in the Submittal. The Submittal concludes that overheating is not of concem with loss of HVAC, except for the case of ventilation to the DG rooms.
Therefore, the only ventilation system modeled as required was that of ventilation for 18
the DG rooms, and this dependency was modeled in the system fault tree for failure of the DGs.
11.2.5 System Dependencies We reviewed the consideration of system dependencies provided in the Submittal. The Submittal provided a table that indicate the dependencies of frontline systems on support systems and support systems on support systems. [IPE, Table 3.2.3-1}
The following types of dependencies were considered: shared component, instrumentation and control, isolation, motive power, direct equipment cooling, area HVAC, operator actions, instrument air, and environmental and phenomenological effects. Our specific comments on the dependency table follow.
Little dependence on HVAC is indicated, consistent with the assumptions discussed in Section ll.2.4 of this report. The only requirement for HVAC specified in the dependency table in the Submittal, is that ac power requires HVAC. In Section 3.2.1.2.8 of the Submittal it is claimed that the only HVAC required for electrical power is once through ventilation to the diesel generator rooms.
11.2.6 Common Cause Analysis We reviewed the process by which the IPE modeled common cause failures.
The method used to model common cause failures was reviewed, and the process by which classes of components were selected for consideration for common cause failures was reviewed.
The MGL method was used to model common cause failures. The data for common cause failures were taken from the Westinghouse RMOI Guidebook 2, " Point Beach Nuclear Plant Probabilistic Risk Assessment Guidebook, Treatment of Common Cause in Fault Tree Models", EPRI NP-3967, and NUREG/CR-4780. The Submittal identifies the components and associated systems for which common cause failures were considered. [lPE, Section 3.3.4) Common cause failures were modeled within systems; it appears that common cause failures across systems were not considered, but the Submittalis not clear on this point. Consideration of common cause failures only within systems is a typical practice in PRA, except for unusual, redundant systems ll.3 Quantitative Process This section of the report summarizes our review of the process by which the IPE quantified core damage accident sequences. It also summarizes our review of the data base, including consideration given to plant specific data, in the IPE. The uncertainty and/or sensitivity analyses that were performed were also reviewed.
19
~
~ _.
6 11.3.1. Quantification of Accident Sequence Frequencies l
We reviewed the process used to quantify accident sequences at either the functional or systemic level. The following topics were addressed in the review: the technique used to quantify accident sequences, the truncation limit (s) used in the quantification, and the quantification of shared component dependencies and common cause failures.
The Point Beach IPE used the small event tree /large fault tree technique with fault tree linking for quantifying core damage. Support systems were modeled with l
support system fault trees, linked as necessary to frontline system fault trees. The event trees are systemic, for the most part. The fault trees were developed with the NUS PRA Workstation Fault Tree Module. Quantification was accomplished with the El version of SETS. Truncation limits used were 1E-9 for cut sets and 1E-7 for sequences. [lPE, Section 3.3.7.1) Recovery actions were applied to dominant j
sequences and cut sets.
11.3.2 Point Estimates and Uncertainty / Sensitivity Analyses Mean values were used for point estimate failure frequencies and probabilities.
[lPE, Section 1.4] No detailed uncertainty analyses were performed, but importance l
and sensitivity analyses were performed. [lPE, Section 3.4.4] The importance analysis was performed with the TEMAC code. The sensitivity analyses consisted of estimating the CDF as the reliability of specific components and operator actions was varied. Sensitivity analyses were performed for each of the following components and t
operator actions:
Diesel Generators Gas Turbine Generator MSIVs 4
Turbine Driven AFW Pump Train Operator Action for Low Pressure ECCS Recirculation Operator Action for High Pressure ECCS Recirculation 6
Operator Action for Providing Long Term AFW Supply Operator Action for Initiating Feed and Bleed Cooling.
Sensitivity analyses were also performed by varying initiating event frequencies for the following initiating' events:
Based on these sensitivity analyses, CDF was shown to be highly sensitive to the values used for: operator action to initiate high pressure ECCS recirculation, and operator action to provide for long term supply of water to AFW.
I f
L 20 s
~ -- ---
r
11.3.3 Use of Plant Specific Data I
We reviewed the process by which components to be modeled with plant specific data were selected, the use of plant specific data in the IPE, the data base used for quantification of plant specific data, and the reasonableness of the values assigned for plant specific failure. The use of plant specific data was reviewed for hardware failures-both start and run-and unavailabilities due to test and mainte The Submittal states that p! ant specific data was used based on the time period January 1,1985 through September 5,1990. [lPE, Section 3.3.2]
This plant specific data was used to model maintenance unavailabilities of major components. [lPE, i
Section 2.1) Generic data was used in lieu of plant specific data when plant specific data were not available; generic data were used to bayesian update plant specific data when the plant specific data were too sparse to be statistically significant.
The IPE modeled recovery of offshe power following a station blackout; this recovery action was directly modeled in the event tree. As discussed in Section l1.2.4 of this report, the curve used to model non recovery of offsite power is questionable at short times. Table 3.3.7-1 of the Submittallists the recovery actions that were applied to dominant CDF cut sets and sequences.
i l1.3.4 Use of Generic Data We reviewed the criteria for modeling component failures with generic data, the i
sources of data used for generic failures, and the reasonableness of the generic data failure values used. The use of generic data was reviewed for hardware failures-both start and run-and unavailabilities due to test and maintenance.
Sources of generic data were: EGG-SSRE-8875, NUREG/CR-2815, NUREG/CR-4550, and IEEE-500.
We performed a spot check of the data from Table 3.3-1, the listing of the data values use in the IPE, to values use in the NUREG-4550 study of Sequoyah; the comparison is summarized in Table 11-1. From the information in the Submittal, we cannot tell which data in Table 3.3-1 is plant specific.
i 21 4
e
Table ll-1. Component Failure Data '
Component Submittal Point Estimate Sequoyah NUREG 4550 Table 3.3-1 Point Estimate Turbine driven AFW pump 2E-3 Fall to Start 3E-2 Fall to Start 4E-2 Fall to Run 3E-3 Fall to Run Si pump 3E-3 Fall to Start 3E 3 Fall to Start 7E-4 Fall to Run 1E-3 Fall to Run RHR pump 1E-3 Fall to Start 3E-3 Fall to Start 2E-4 Fall to Run 1E-3 Fall to Run Diesel Generator 2E-3 Fall to Start 2E-2 Fall to Start 2E-2 Fall to Run 2E-2 Fall to Run Typical MOV 4E-3 Fall to Open 4E-3 Fall to Open Failures to start or open are probabilities of failure on demand. Failures to run are probabilities based on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time, except for the Diesel Generators for which the mission time is 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.
The data in this table indicates a possible trend, that being that the values for failure of pumps to run are lower than those used in some other PRAs. Other values from Table 3.3.1 for failure of pumps to run also seem low; for example, j
CCW pump fails to run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 3.5E 5 i
main feedwater pump falls to run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1.6E-4.
We found discrepancies in some of the equipment failure frequencies identified in the Submittal. We requested clarification on this discrepancy from the licensee.
The licensee responded that Table 3.3-1 has errors, and provided documentation of the actual values used in the analysis. [lPE Response) The values used for failure to run frequencies of low and high head Si pumps, respectively, were: 9.65E 6/hr and 3.00E-5/hr.
We requested that the licensee identify those components for which plant specific data were used. The licensee provided a table from the PBNP Data Analysis Notebook which lists those components modeled with plant specific data. [lPE Responses) Based on that response, of the components listed in Table 11-1, plant specific data were used exclusively for the DGs; the other component failures in Table 11-1 were computed by performing a bayeslan update of generic data with plant specific data.
11.3.5 Common Cause Quantification We reviewed the sources of data used to quantify common cause failures, and 22 9
_._.,-m y._.
y 1
Io 1
\\
the reasonableness of the values assigned to common cause failures.
Table 3.3.4-2 of the Submittal lists the' common cause failure data MGL factors.
We compared selected beta factors from this table in the Submittal to those used in NUREG 4550; [NUREG 4550, Methodology] Table 112 of this report summarizes the comparison.
Table ll-2. Comparison of Beta Factors Component Bets Factor from Table Beta Factor from 3.3.4-2 of Submittal NUREG 4550 AFW Pump 0.021 0.056 CCW Pump 0.032 0.026 RHR Pump 0.077 0.15 StPump 0.10 0.21 Containment Spray Pump 0.057 0.11
)
MOV 0.038 0.088 i
Diesel Generator 0.025 0.038 Safety / Relief Valve 0.094 0.07 The data in Table 11-2 of this report indicates that the beta factors used in the Submittal are reasonable. The same common cause factors were applied to both i
failure to start and failure to run events for those components for which common t
cause failure was modeled.
i 11.3.6 Intemal Flooding Quantification l
We reviewed the quantification of intamal flooding sequences in the Submittal.
l The review focused on the following areas: critical flood sources, consideration of mode of equipment damage (such as coverage with water or impingement of spray),
i propagation of floods to other plant zones, and flood detection and credit for isolation j
of flooding sources.
The treatment of intemal flooding is thoroughly described in the Submittal. [lPE, Section 3.3.8) in addition to failure of equipment due to submergence, the following types of failures were evaluated: spray, drip, and steam. Intemal flooding was estimated to contribute about 10% to the total CDF from intomal initiating events and l
internal flooding. [lPE, Figure 1.4.1) The two largest contributors to CDF from intamal flooding were identified to be as follows. (a) Flooding in the Auxiliary building from a j
service water pipe leak, that disables all RCP seal cooling and ECCS pumps. (b)
{
23 l
0-
- Flooding in the pump house that disables service water and fire water.
The Submittal implied that spray-induced failure was not considered for equipment located farther than 10 feet from a source of spray. [lPE, Page 64) We l
requested the basis for this' assumption. The licensee responded that the 10 feet is a separation criteria and was not used in the analysis. [lPE Responses]
The analysis of internal flooding appears complete.
II.4 Core Damage Seouence Results This section of the report reviews the dominant core damage sequences i
reported in the Submittal. The reporting of core damage sequences-whether systemic or functional is reviewed for consistency with the screening criteria of NUREG-1335.
The definition of vulnerability provided in the Submittalis reviewed. Vulnerabilities, enhancements, and commitments to plant hardware and procedural modifications, as reported in the Submittal, are reviewed.
11.4.1 Dominant Core Damage Sequences We reviewed the dominant core damage sequences reported in the Submittal.
l The review addressed the following items: the screening criteria applied for reporting.
dominant sequences and consistency with the guidance of NUREG 1335, the quality to which the dominant core damage sequences are described, and the dominant contributors to core damage in terms of initiating events, classes of accidents-such as station blackout, ATWS, LOCA, and so on-and failures in mitigating systems. The dominant sequences were checked for consistency with unique plant design or operating characteristics, and with results of other safety studies.and PRAs for plants with similar design characteristics.
The IPE utilized systemic event trees, and reported results using the screening criteria from NUREG 1335 for systemic sequences. [lPE, Section 3.4.1)
I i
24 l
i Figure 11-1 of this report summarizes the major contributors to core damage by intemalinitiating event. These results apply to each of the two units. Definitions of i
the acronyms and abbreviations used in this figure are as follows:
LOCA Loss of Coolant Accident LOSP Loss of Offsite Power SBO Station Blackout SLB Steam Line Break ATWS Anticipated Transient without Scram V LOCA Interfacing Systems LOCA SGTR Steam Generator Tube Rupture PCS Power Conversion System SW Service Water CCW Component Cooling Water lA Instrument Air Cont.
Containment D01 125 Vdc Bus #D01 D02 125 Vdc Bus #D02 Trans.
with w/o without int.
Internal 25
Point Beach CDF by Class of ynitiating Event Large LOCA [
SBO_
Trans, w/o PCS _
Int. Flood ~
I m
Med. LOCA g
LOSP[
i y
Loss of SW_
i SGTR
-c Trans. w PCS Loss of CCW~
Sm, L$Ch Loss Total CDF o,
5 Excess LOCA [
,l 1.15E-4
.9 Loss of D01 l
ATWS[
Loss of D02 V LOCA[1 SLB in Cont._
u SLB out Cont. ~i
\\
TOTAL CDF 1.00k10'7 1.00k10 1.00x10 1.00k10 1.00N10
1.00x10* 1.00x10 4 4
4 4
Core Damane Frequency,1/ Reactor-Year Figure 11-1. CDF by Initiating Event for Point Beach 26
i The Scbmittallists the highest frequency systemic core damage sequences, per the screening criteria of NUREG 1335, in Table 3.41.
The total CDF from intemal initiating events and intemal flooding is 1.15E-4/Ry yr. The CDF from intemal flooding is 1.08E-5/Ry yr.
The top five sequences are summarized in Table 11-3 of this report.
Table 11-3. Top 5 Systemic Core Damage Sequences initiating Event Subsequent Failures Sequence Frequency 1/Ry yr and % of Total CDF Large LOCA Failure to Establish 2.57E-5 22.4 %
Recirculation from Containment Sump Intemal Flooding in any of Dominated by Flooding of 1.08E-5, for all flood 6 Flood Zones' Components in Auxiliary sequences Building or in Pamp House 9.4%
Medium LOCA Failure to Establish 1.07E-5 9.3%
Recirculation from Containment Sump Transient w/o PCS Failure to Establish AFW 9.7E-6 8.5%
or Feed and Bleed Loss of Service Water Failure of AFW 5.8E-6 5.1 %
includes All Sequences for this initiating Event The CDF contribution from sequences involving reactor coolant pump seal LOCAs is summarized in Table 11-4 of this report. [iPE, Table 3.4-8]
27
u 1
Table ll-4. CDF from RCP Seal LOCA oy initiating Event InMiating Event CDF (1/Ry yr) and % of Totai Loss of Component Cooling Water 5.1 E-6 4%
Loss of Service Water 2E-6 2%
Station Blackout 3E-7 0.3%
Total: 9E-6 8%
As discussed previously in Sections 11.2.3 and 11.2.4 of this report, the Submittal used a detailed model for seal failure following station blackout, but did not use this model for the other three initiating events in Table ll-5, namely: loss of CCW, loss of SW, and loss of offsite power. For example, in the discussion of the event tree for loss of component cooling water, the Submittal states that if charging fails resulting in loss of seal cooling, seal cooling must be restored within 30 minutes. [lPE, Section 3.1.3.1.4 )
However, Figure A-5 of this report shows that the detailed seal LOCA model used for station blackout predicts that after 30 minutes without seal cooling the probability for a seal LOCA is only 0.006 for the depressurized case and 0.01 for the pressurized case.
The licensee stated in a response that no credit for recovery of seal cooling was taken except for the station blackout scenarios, so the detailed model for a seal LOCA is not needed for the other scenarios. [lPE Responses)
The Submittal summarizes the top 200 cut sets that contribute to CDF in Table 3.4.11.
The Submittal states that three core damage sequences dropped by more than an order of magnitude to below the screening criteria for reporting, after operator recovery actions were considered and quantified. [lPE, Section 3.4.2) These three sequences are as follows. (1) A steam generator tube rupture, with the recovery action being long term cooldown and depressurization of the primary. (2) A consequential SGTR following a steam /feedwater line break inside containment, with the recovery action being long term isolation of the ruptured SG. (3) A consequential SGTR following a steam /feedwater line break outside containment, with the recovery action being long term isolation of the ruptured SG.
28
. -~
j e
11.4.2 Vulnerabilities We reviewed the definition of vulnerability as provided in the Submittal, and the vulnerabilities, if any, identified and discussed in the Submittal.
i Section 3.4.3 of the Submittal defines a vulnerability as follows:
- severe accident vulnerabilities are plant-specific design or operating characteristics resulting in dominant contributors to core damage frequency
)
(CDF) or large fission product release frequency (FPRF) significantly above the i
NRC's mean safety goal targets for all domestic nuclear power plants (from SECY-89-102, " Implementation of Safety Goal Policy')'.
These safety goal targets are 1E-4/Ry yr for CDF and 1E-6/Ry yr for FPRF. Based on this definition of vulnerability, the Submittal states that there are no vulnerabilities at Point Beach. The Submi'.al does discuss improvements that are expected to reduce-i the CDF and FPRF.
h II.4.3 Proposed improvements and Modifications W9 reviewed the changes to the plant that have been incorportated, are scheduled for incorporation, and/or are under consideration as a result of the IPE.
Both hardware and procedural modifications were reviewed. The review addressed whether or not these changes to the plant are expector.' to significantly improve safety; also, the review addressed potential changes, if any, th:,t are not addressed in the Submittal but which appear to have significant safety penefits.
Sections 1.3 and 7.1 of the Submittal states that improvements already made i
since the freeze date of the model are estimated to reduce overall CDF by about 12%,
from 1.15E-4 Ry yr to about 1.0E-4/Ry yr. Those improvements,already completed are as follows:
installation of an additional safety related battery Installation of an additional non safety related battery installation of alternate shutdown switchgear j
upgrade of gas turbine generator Improvements in reliability of MSIVs.
The upgrade of the gas turbine generator contributed most to the reduction in CDF.
1 Section 6.2 of the Submittal discusses plant improvements either already scheduled, or under consideration as a result of the IPE. Both procedural and hardware modifications are identified. The improvements are as follows.
Changes to the procedures dealing *M. Switchover of ECCS to Recirculation from the Containment Sump [ scheduled for June 1994) j l
Changes to the procedures dealing with Providing Long Term Supply of Water to the Auxiliary Feedwater System [ scheduled for June 1994) 29
J
l s',
l Modifications to allow Rapid Connection of Fire Water to Refill the CSTs.
[ Scheduled for September 1994]
j Modifications to reverse Door Frames in the Control Building Tunnel to Ensure Doors Fall Open at Low rem i.evel [ Scheduled for September 1994]
Modifications to install Additional Diesel Generators; this modification was not initiated as a result of the IPE [ Schedule for Third DG Operational, and of 1994; Schedule for Fourth DG Operational, and of 1995) i These improvements, in total, are estimated to reduce the CDF from 1.0E-4/Ry yr to about 8E-5/Ry yr. The effect of the two additional diesel generators alone is estimated to reduce CDF by about 10%.
The utility has identified several improvements, both to procedures and j
hardware, as' a result of the IPE and has committed to implement these improvements.
These planned improvements, along with the improvements already completed since the IPE model freeze data, should be effective in reducing overall CDF.
II.5 Interface issues This section of the report summarizes our review of the interfaces between the front-end and back-end analyses, and the interfaces between the front-end and human factors analyses. The focus of the review was on significant interfaces that affect tho' ability to prevent core damage.
l 11.5.1 Front-End and Back-End inteifaces We reviewed the following aspects of the front-end and back-end interfaces for the IPE.
l Impact of loss of containment cooling on core cooling when using recirculation 1
from the sump or suppression pool
.i impact of containment isolation on the ability to cool the core, specifically on the ability to cool reactor coolant pump mechanical seals I
binning of core damage sequences into plant damage states.
Our comments on the first two of these interfaces are given in Sectionc l1.2.3 and i
11.2.4 of this report.
The IPE used plant damage states (PDS) to bin core damage sequences for subsequent back-end analysis. [lPE, Section 3.1.5) The PDS designation was based i
on the status of four parameters: type of initiating event, availability of RHR injection at i
the time of core damage, availability of containment fan cooling cr containment
\\
l 30 l
~.,. -.
. - ~
bypassed, and the estimated time for core melt. Each PDS was identified with a four letter acronym, each letter reflecting the state of one of the four parameters. There are 48 possible combinations of the four parameters, but not all com'oinations are physically meaningful. For example, if the initiating event is a steam generator tube rupture, than containment is bypassed and only one state is possible for fan cooler availability / containment bypass, that being containment bypass. The Submittal indicates that 16 PDSs result from all core damage sequences modeled in the front-end event trees; the PDSs for each core damage sequence are listed in Table 3.1.5.1 of the Submittal. Also, in Section 3.1.5, the Submittal provides the front-line event trees with core damage sequence outcomes designated by the same acronyms-corresponding to sequence systemic failures-that are used in Table 3.1.5.1 to identify PDS by core damage sequence. Thus, it is easy to follow the binning of core damage sequences into PDSs. We have no concerns with the PDSs used in the IPE.
11.5.2 Human Factors Interfaces We reviewed the Submittal fo operator actions important to the front-end model. The following types of operator actions were reviewed:
(1) human errors that contribute significantly to CDF (2) operator actions that contribute significantly to reducing CDF (3) unique operator actions.
Based on our review the front-end model, the following operator actions are of note:
operator action to transfer ECCS to recirculation from the containment sump operator action to provide water supply for AFW after the. CST is depleted operator action to initiate feed and bleed cooling operator action to conserve de power and operate turbine driven AFW following station blackout operator action to depressurize steam generators during station blackout operator action to start and load gas turbine generator operator action to start standby service water pumps operator action to depressurize primary following SGTR.
11.6 Evaluation of Decav Heat Removal and Other Safety issues This section of the report summarizes our review of the evaluation of Decay Heat Removal (DHR) provided in the Submittal. Other GSI/USI's, if they were addressed in the Submittal, were also reviewed.
- 11. 6. 1 Examination of DHR We reviewed the evaluation of DHR provided in the Submittal. DHR is addressed throughout the IPE model. Our detailed comments on the model 31 t
associated with DHR are provided throughout the rest of this report.
The Submittal specifically addresses DHR and its contribution to CDF in Section 3.4.6.2 of the Submittal. This section of the Submittal contains no insights into DHR; it merely states that DHR was modeled and that loss of DHR dominates CDF.
Furthermore, loss of DHR at Point Beach was previously addressed as a case study by NRC. [NUREG 4458] The Submittal provides no discussion of the differences in modeling or in results between the IPE and the earlier case study.
We requested more information related to loss of DHR leading to CDF. The licensee provided an extensive response to this request. [lPE Responses] The response defined DHR as "the ability to remove decay heat from the reactor core following an accident or transient from normal operating conditions". Systems providing DHR are: AFW, ECCS recirculation, feed and bleed, and closed cycle RHR. 67.3% of the overall CDF is associated with loss of DHR. The most significant system failures contributing to loss of DHR, in decreasing order, are: AFW, feed and blood, closed cycle RHR, and ECCS recirculation. Loss of electrical power dominates the contribution of failures of support systems to loss of DHR. The licensee discussed each of the contributors to loss of DHR and the plant changes completed or planned to reduce loss of DHR, including those based on the IPE and those done in response to NUREG/CR-4558.
11.6.2 Diverse Means of DHR j
i We reviewed the diverse means of DHR evaluated in the Submittal, such as:
feed and bleed, containment venting, and so on.
The IPE evaluated the diverse means for DHR, including: use of the power conversion system, feed and bleed, auxiliary feedwater, and EC_CS. Cooling for RCP seals and cooldown/depressurization of the primary to reduce the likelihood of a seal LOCA were considered. A detailed model for seal failure following station blackout was developed and applied. All of these means of DHR were quantified with event trees and fault trees.
11.6.3 Unique Features of DHR We reviewed the unique features available for DHR, based on the unique design and operating characteristics of the plant.
The notable features at Point Beach that directly impact the availability to provide DHR are as follows:
Manual Actions Required for ECCS Switchover from injection to Recirculation from the Containment Sump, as opposed to Automatic Switchover used at Some Plants Manual Actions Required for Supply of Water to AFW after 4 Hours 32
m l
0-l Two Onsite Diesel Generators Shared by Each Unit l
One Onsite Gas Turbine Generator One Hour Battery Time after Station Blackout, and Associated Actions to 1
Maintain Turbine Supplied AFW for 4 Hours after Station Blackout Charging Pumps are Air Cooled l
Ability to Coo l Turbine Driven AFW Pump Bearings with Diesel Driven Fire Water i
Ability to Provide Alternate Source of Water to AFW after depletion of CST Inventory Two Shared Motor Driven AFW pumps for the Two Units, and a Dedicated i
Turbine AFW pump for Each Unit High Pressure Recirculation and Containment Spray in piggyback operation off RHR Pump Discharge in Recirculation from Containment Sump Six Service Water Pumps Shared by the Two Units Operation at 1985 psig with PORV Auto-Relief Set at 2335 psig (significant pressure margin until pressure reaches PORV setpoint)
RHR Design temperature of 400 F No Need for HVAC except for DG Room Ventilation.
I i
Other special features of note for the Point Beach design that we noted during our review of the Submittal, UFSAR, and Technical Specifications, which do not have an obvious major impact on the overall CDF, are as follows:
j Relatively Low Power Units Use of BWST for Initial Source of Boration for Sl with Auto-Switchover to the
{
RWST LPCI ECCS injection into Upper Plenum, Not into Downcomer Containment Floor serves as Containment Sump l
33
11.6.4 Other GSI/USI's Addressed in the Submittal We reviewed GSI/USI's other than DHR that were addressed in the Submittal.
There is no requirement that such issues be considered in the IPE, but the licensee has the option of addressing them in the IPE.
The licensee proposes that the Submittal resolves two issues: [lPE, Section 3.4.6]
USl A-17 Systems interactions Generic issue 23, RCP Seal Failure.
The Submittal claims that the IPE analysis of internal flooding was complete and identified no vulnerabilities associated with intemal flooding.
The Submittal claims that Generic issue 23 is resolved as a result of the detailed consideration of seal LOCAs in the Submittal and the calculated low CDF involving seal LOCAs (about 8% of the total CDF). We have numerous concerns about the modeling of seal LOCAs as discussed previously in Sections 11.2.3 and 11.2.4 of this report. Furthermore, our review did not address the Westinghouse data upon which the iPE model was based, nor did it investigate the seal design in use at Point Beach.
These issues are being addressed by existing programs at the NRC and are outside the scope of this review.
34
Ill. REVIEW
SUMMARY
AND DISCUSSION OF IPE INSIGHTS, IMPROVEMENTS, AND COMMITMENTS This section of the report provides an overall evaluation of the quality of the Submittal based on this review. Strengths and weaknesses of the Submittal are summarized. Also, the dominant contributors to CDF are summarized, with insights as to the effect of plant design and modeling assumptions on the overall CDF and the types of scenarios that dominate CDF. Improvements committed to as a result of the IPE are summarized. Areas where liccasse efforts could improve safety are summarized. Areas where the IPE process could be improved are summarized.'
The Submittal is complete in terms of the information required by Generic Letter 88 20 and NUREG 1335. The small event tree, large fault tree methodology with fault tree linking was used to perform a level i PRA; it is an acceptable methodology for performing the front-end portion of an IPE. Plant walkdowns and the use of plant i
specific documentation were used to assure that the IPE modeled the as-built plant.
Major strengths of the Submittal are as follows. The Submittal is well written.
The discussion on identification of plant specific initiating events in the Submittal is complete. The discussion on intedacing system LOCAs in the Submittalis complete.
The justification in the Submittal for excluding HVAC systems as required support, except for diesel generator room ventilation, is comprehensive. The discussion of internal flooding in the Submittal is comprehensive. The documentation of the development of the PDSs and the allocation of core damage accident sequences to the PDSs is clearly described in the Submittal. The Submittal has identified and committed to implement appropriate changes to procedures and hardware as a result of the IPE insights; these changes should reduce the overall CDF.
Major weaknesses of the Submittal are as follows. There is no discussion of j
dual unit CDF in the Submittal. The criteria for core damage are not clearly specified in the Submittal. Justification is lacking for the assumption that containment cooling is not required in the success criteria for any accident sequence. The seal LOCA model, although comprehensive, has intamalinconsistencies and numerical errors. No-summary discussion on DHR is provided, regarding insights, unique features, key results driving CDF, and differences from earlier studies The total CDF from internal initiating events and intemal flooding is 1.2E-4/Ry yr. The CDF from internal flooding is 1.1E-5/Ry yr.
Internal initiating events that contribute the most to CDF, and their percent contribution, are as follows:
Large LOCA 22%
Station Blackout 13%
Medium LOCA 9%
4 35
~
. ~.
Loss of Service Water 7%
Steam Generator Tube Rupture 5%
Loss of Component Cooling Water 4%
The CDF involving RCP seal LOCAs is 8%, with only 0.3% arising from the station blackout; nearly all the CDF from seal LOCAs comes from three initiating events: loss of component cooling water (4%), loss of service water (2%), and loss of offsite power (23). We believe that one reason the CDF from a seal LOCA is so low for station blackout as compared to the other three initiating events, is that a detailed model for seal LOCAs was used for station blackout, but not for the other three initiating events. The detailed seal LOCA model predicts little likelihood of a seal LOCA for times less than about four hours after loss of all seal cooling.
The Submittal modeled the plant as of September 5,1990 without credit for any modifications after this freeze date.
The following design features tend to increase the CDF:
Manual Actions Required for ECCS Recirculation from Containment Sump Manual Actions Required for Supply of Water to AFW after 4 Hours Two Onsite Diesel Generators Shared by Each Unit One Hour Battery Time after Station Blackout.
Other plants have automatic switchover of ECCS from injection to recirculation, and are not susceptible to loss of ECCS following LOCAs due to operator failure to institute ECCS switchover. Other plants have more inventory available to AFW and do not require alternate sources of water as soon. Other dual unit sites have more than 2 diesel generators. Other plants have a significant longer battery lifetime during i
station blackout and can operate the TD AFW pump longer allowing for a higher likelihood of recovery offsite power.
l The following design features tend to decrease CDF:
I One Onsite Gas Turbine Generator Ability to Cool Turbine Driven AFW Pump Bearings with Diesel Driven Fire W ater 36
-gn
i l
l L
Air Cooled Charging Pumps No Need for HVAC except for DG Room Ventilation.
The gas turbine generator can mitigate the loss of both DGs. The ability to cool the TD AFW pump bearings with diesel driven firewater prevents loss of AFW during i
station blackout due to loss of normal bearing cooling for this pump. Since the charging pumps are air cooled, they remain available for seal injection following loss of component cooling water or loss of service water. HVAC support system failures do not impact the ability to provide for core cooling, except that ventilation for the DGs is required; other plants require other HVAC systems to operate to maintain frontline core cooling systems.
Operator actions contributing significantly to magnitude of the overall CDF are:
failure to institute ECCS recirculation, and failure to provide water for AFW supply after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The one hour battery lifetime requires special operator actions to provide turbine driven auxiliary feedwater for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> during a station blackout. The ability to cool the AFW pump bearings with diesel driven firewater, an automatic backup cooling supply, allows turbine driven AFW to be used during station blackout.
Based on our review, the following modeling assumptions have an impact on the overall CDF:
(a) ability to use turbine driven AFW for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following station blackout, t
with battery lifetime of only 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (b) no requirement for any containment cooling system for any accident j
sequence (c) the detailed seal LOCA model used for station blac.kout seal LOCA analysis.
I improvements to the plant already made since the freeze date of the model are estimated to reduce overall CDF by about 12%, from 1.15E-4 Ry yr to about 1.0E-4/Ry yr. Those improvements already completed are as follows:
installation of an additional safety related battery Installation of an additional non safety related battery installation of alternate shutdown switchgear i
upgrade of gas turbine generator improvements in reliability of MSIVs.
The upgrade of the gas turbine generator contributed most to the reduction in CDF.
The Submittal discusses plant improvements either already scheduled, or under consideration as a result of the IPE. Both procedural and hardware modifications are identified. The improvements are as follows.
Changes to the procedures dsaing with Switchover of ECCS to Recirculation from the Containment Sump [ scheduled for June 1994]
37
Changes to the procedures dealing with Providing Long Term Supply of Water to the Auxiliary Feedwater System [ scheduled for June 1994)
Modifications to a!!ow Rapid Connection c' Fire Water to Refill the CSTs.
l
[ Scheduled for September 1994)
Modifications to reverse Door Frames in the Control Building Tunnel to Ensure Doors Fall Open at Low Flood Level [ Scheduled for September 1994)
Modifications to Install Additional Diesel Generators; this modification was not initiated as a result of the IPE [ Schedule for Third DG Operational, end of 1994; Schedule for Fourth DG Operational, and of 1995)
These improvements, in total, are estimated to reduce the CDF from 1.0E-4/Ry yr to about 8E-5/Ry yr. The effect of the two additional diesel generators alone is estimated to reduce CDF by about 10%.
The utility has identified several improvements, both to procedures and hardware, as a result of the IPE and has committed to implement these improvements.
These planned improvements, along with the improvements already completed since the IPE model freeze data, should be effective in reducing overall CDF.
We found no areas where the Point Beach IPE process could be improved.
38
m IV. DATA
SUMMARY
SHEETS This section of the report is a compilation of the information in the Submittal.
No critique of the information as summarized is provided in this section of the report; Section 11 of this report provides a discussion of the information in the Submittal.
The total CDF from internal initiating events and intamal flooding is 1.15E-4/Ry yr. The CDF from internal flooding is 1.08E-5/Ry yr.
intamal initiating events that contribute the most to CDF, and their percent contribution, are as follows:
i Large LOCA 0.22 Station Blackout 0.13 Transient without PCS 0.1 Internal Flooding 0.09 Medium LOCA 0.09 Loss of Offsite Power 0.08 without Station Blackout i
Loss of Service Water 0.07 Steam Generator Tube Rupture 0.05 Transient with PCS 0.05 Loss of Component Cooling Water 0.04 Loss of Instrument Air 0.03 Small LOCA 0.02 Excessive LOCA 0.006 Loss of DC Bus D01 0.003 Anticipated Transient without 0.002 Scram Loss of DC Bus D02 0.001 Interfacing Systems LOCA 0.001 Steam Line Break in Containment
<0.1%
Steam Line Break outside
<0.1%
Containment i
39 I
+
l The CDF involving RCP seal LOCAs is 8%, with only 0.3% from the station blackout; nearly all the CDF from seal LOCAs comes from three initiating events: loss of component cooling water (4%), loss of service water (2%), and loss of offsite power (2%).
The Submittal modeled the plant as of September 5,1990; no planned modifications beyond this data were credited in the model. The following improvements are planned:
Changes to the procedures dealing with Switchover of ECCS to Recirculation from the Containment Sump [ scheduled for June 1994)
Changes to the procedures dealing with Providing Long Term Supply of Water to the Auxiliary Feedwater System [ scheduled for June 1994)
Modifications to allow Rapid Connection of Fire Water to Refill the CSTs.
[ Scheduled for September 1994)
Modifications to reverse Door Frames in the Control Building Tunnel to Ensure Doors Fail Open at Low Flood Level [ Scheduled for September 1994)
Modifications to Install Additional Diesel Generators; this modification was not initiated as a result of the IPE [ Schedule for Third DG Operational, end of 1994; Schedule for Fourth DG Operational, end of 1995]
In addition to DHR, the Submittal proposes to resolve the following two safety
. issues:
USl A-17 Systems Interactions Generic issue 23, RCP Seal Failure.
1 40
APPENDIX A. CALCULATIONS IN SUPPORT OF REVIEW This appendix provides a brief summary of the confirmatory calculations performed as part of our review. The purpose of these calculations was to check the reasonableness of selected assumptions and models used in the IPE. If our scoping j
calculation did not agree with the information in the IPE, we requested follow-up i
information from the licensee.
i Containment Heat Removal As discussed in Section ll.2.3 of this report, the IPE assumes that significantly less heat removal from containment is required to support core cooling than is required in the UFSAR licensing analysis. The UFSAR analysis is based on containment design pressure while the IPE analysis is based on best-estimate failure pressure, so less heat removal is required in the IPE to prevent containment failure; however, it needs to be demonstrated that with less heat removal, the ECCS pumps in recirculation will not fall due to either loss of adequate NPSHA or overtemperature.
The UFSAR provides insufficient information for us to assess NPSHA. The UFSAR provides some information that can be used to address temperature concems. We performed a calculation to estimate the effect of the IPE assumed containment cooling on ECCS component temperatures while in recirculation from the containment sump.
This is a steady state calculation that is conservative. We generated decay heat and integrated decay heat energy curves for Point Beach, included as Figures A-1 and A-2 of this report.
i 41
i l
O e
l l
i l
I m
..,.,.r.,e q
- g.. g.
% V % 4.*. J 4.*........ r..
9.
,..,. 3.,
..e A".e..J...s*4.a. h
?.
.....e m.w w 2 #.,,4....
4-... -4 we.u a 3
.t ys..p. us s veu.,...'.,.-.
'F"
. %..vs s r.~s es.....m.a
.m.,.+ai m.wrs..w.
. 2.
.. a..v.,..%. n. : :.:.w:. ;
i
....,... e w.,.
y npe u,, m a,w.
r' h.y y-w g y..,q p. r
...f.0..s y hs w M,6 @g " g y ' Q..iytg.bawef.%* g t3 MV, g.g ;
.. v n~.. ~ 3,a...n. m,. %. e.
, ww::.
..d.4f.c y
,. 4q e,.g Jeg '4:pp% @7, *ngA g*Q,qirg.a...e p.s.
.. s
..e m.n.tg',;$ M; mS
)
r u -
p A.
. ?M.k?eMigq r;us,p
- W
- P *6 M/b nW
.:,jWw".%..,:.*g.
K..1;'* A.5., * *. m.
..&;.% R
-P *::*
.~. y. m.. e y.
.9 m
. % Y. S
. 1....,
..- '.,.. 7m tw aW h
$v.. C ~v.N4.
m h.
.g s.
- 1..g,s e.*
- 1 Q
W
' + e m.*,* mw.a ser. Mc.spfpe '-.,*p s.:::
W*;d. s. v:.1 $:~P.
- r t-e w.*. L*: %.m-r..;.%. MtrP W/%. P.C%se-*eW
'*1=
b=
- .. a.
.a cr $s%.*> y x.stws%;>.ri% s t,3c* C.2 eram M
- -~ 1.
- V,.*.,C.~1. 2.,?.,'s ** ^~,q.P. M.,t'p*;/'L'g**
... u
.C
'l* W8* R +%
+
- x..
%1.** **.*;*u*..*
e Q
..m.......
s._.a. #....
n..
(tl y
.-~..m-s >
..4
&W
..-..s...e.C. M.: A o '.a ae'
.u k.a i, :
l.,
O @e
' N..*'#.:. *.tt. e.
.%n... -y
- c t"....s M O
.a s-
.t.
.m.. 3-;t' W PJ.4W".. WE. tr.v.v=_'
.e.4.. f, n,=..e..,
..y e.
.%..ve[.
.,. s e... ; :..
.q
.e
~.
u.
% q a
- 9. =..Im.....m.,..e 2 w..n.O
< m.
.y
- d. s w.- e a $ 4 _.
w.. 4... u. c..
~C C
~
+
. '. 4, i.1 h. '...t
- 4 ', G.sE,*M 5
g e gn.r;jef m.
,u.t..
i44..w*.he '%',;"P; t. E,.,* &y. w,y v. p g.L3 Q O L
. '... ( :4
. ~..
e ' s.. g.. r...,.y
.. y
- w..~.,
.e-y
~.
..nwa.x.m + e.u %g.m,
.C,y
. y. m. r.a...
.; n:
Q o
.m.a u
=.c.:.
.....m.
gg
- g,..r.%
i 1+
.:.,.s.
4 m. f % % *; g e 2 a.4 s,. y 2.;...wed-a.:.M J-M r..# *r *,*4..+,5 4.p-! b s
- 4..*.?.*
'4"6
- ..a
- a. *,. r e
..-1 8
sw.
w.
m g Q
. % % % s s.. a.
g g
g ym.
e J a,a.: a.s 4.
c e e 1,;.. W.t.h' 14.%?.,.h.,or V, W.,.a A.!4. %
I de a
+
Ud
% 4 %...J
- e. e..
.<...',.. o.. b ara 44.a:.,#../~
J
- 3.. 1:. <..
. -; w g.. w g,
,y.
m 1v p,q h,* gg e.
g 7 3,.D p. 1 h
a w. G.x.~3; w. $q.
+. g.,.,.,,. w.. '.. -
(O V.
.x.
a g,
.s. c.R 62
- p;a p;.w;m y ; cy.,t+'u
- _.
p s.
.. a.
- e.Ed m n w. n.e.dree 4 %. m. M.....w. W e1NN.a m
w av. *.e.~f.
ms,..,a* pes *p *&,
s.=,
C c
o.,+.,,.
.s.1..,.........c.....-....m........
=.,s
-s 4
-===
-4
..n.....,
., m.p
. ; m ;. t.c p v,...u. :..
f....
. q. q,.... -
O "a"m#
- Jc % A....
e n..-
_ s....
+
- g. ~.
4 Q
y..
,.x...
g, s
'. 7
...,..a..o...,
s. s..e CD
...,....w q.;..<., :.f
.,.;.4s.%.a......e.,.w.t....
Q
. % % r. t.
2 w
Jwy,......y..A..,
3
.. f...-.,...
sy-g
........ r...* r ". t.- *.i * ?.*.* > * --
-E 1 * *. * *.-;. *
- q t. 4.*' J.g :y... 7.z.*.4.;.m.,. s..
- g. 4..- ~
.g s gs,;.p.,.
3.m..,
y, p.
.y
... e,,.s g
5 "'d ~."
- Q'.**j'.*@5...e,,..,....r_A,,,.
c r.t. pp...
2.f"R..*C.;.y:0,'.f 'H**W$& WP.' '*.W
..l p
.g.
- .y p p.pp.g.w.;.
.e sJr%. w %y.,*,fWa.f.3.*,T,';Ty *g@A1,.hl.
A
. i f.
,,- j., 3 g y,.
y* 4,% #( i, tg%.y a "W
- m....,...
s,,.-;,?'
..........,..r.s.6
,... ~...,
.... =
sw..
.....,.....e
.c
.... w 9 -..se 4 J. eN i,M..
..L.. v s.r m. :.4 2. ~'...W':. g.$
, eury *e y y.,yy.
.,4.,o. +.,
's e.....
e...
e e a.
a a
e ae e a a a n-O O
O '"
O O
O O
O.
O.
O O
v=
O v=
<r-oes/nig 'Jamod
~
--- - - - - - - - - - - ^
e I
a i
l TW c
.L2. c. ;,...=.r p
,. ;. A.,. : n.p
,ys.
,. g?,y.
~.
.c '.
O..c ;
y ; ; }. 4._.,..
y
.m.w..
-.gm 4;x(q
.,.y.
- .. -..,r.q, py;.y,.
C M....r.n... yy..M.. 4e., e.. e. yr..:.m 3..
T P'
,,..-l.
,..t g'
...... s:..
W., :.va.. w.. a^h.
4. s:s.
W E
w e. m N.5 w.ic. M. p.tsc ;*if m <ey$.v.nc.
W W;% %,,u..s.Jfut e.Nhs g.. n.s,., Ne'.....,.. N..,.. t
- m
.,0,;...
7 e..
hWWN9,.. ; s O
~ G m-...,.4.
L s.-.
J..,
.a
.w
.~.
b
.,....s.
MM.nr.
w.
. T.p., y -.
- s. ram.m s.w.,h,oy. p*'g$.. a..w.n n, 3..W g
- * = -
- wp e to.,n*
e
. m*
.a e. y m
4*w*.. ~
m 'n.p
. v,..g,.,
m.,,.,$ q A.N......,..; w n~
a.
' ' * *, - 't e '=r' ' + ' b.
g'.6,S,.-1..*4.,- uq"f i b f3..9'4.f.h A.y.ug.,.'.
.a' V 'r 2
aW v*
i v -
t j
g
.,. q.. o.
w.
p%,.,
,e.. a,. g,
. e y %.'j e.g,t,.t.y.;,z. e.;,,. %...g.a.7.,... v. ~ 3 m
,,. v:.-
v.
.m.
. c....
T.
n,.
t.,t.. (.,..., :..... mu. u r.... r,.a ys..a., v m. -
W
. a a.,.
u
- ? M%W &.fCH,fM'c%W;w.tM?X.
- As;&;;;
g
.8 Wp
% w n;org:*.t.L.:,$ p..:. n =<9,,& w/.de74
".M). 44.T=.s8p @ygy M *.w.e s u+4 e.y ** 5 e t.ah.n 4v O
5 43 t
1 e vi';;.M syg kw,tp.th,.ky,w'ptem 2,e.p4l aJ.Gea4.. 4 6 'J M & n h Q ;. M aus W
Q u..
Q T
I
. ;.-/ :.4 '.(-
.- :,.y A &g Q
WJ'.k:i: a' r:-.
- s %.;4a d 4 4 LK2 +u?Ct.1.*A.i.sw. w Q >a
- n.n y.s. w i;.m c=~; % cc% m m.d419 W.gcg~;1ui'h w %
b k'&m w$3WA. inh %. kN *.*h4;9&$$?)l&.Wh*'&
.a u :~ <
.:-i f 5 %.'io. l w" w' ', m:5 4ino6 $3 sip %.eX:.*,$a.v.;hy,.:/%'T" O
fas;';n x,.w.,
Q
.0m*
h u.;,4;.$,;@yy *;n% a :(.pym me3dy..-
T on 4.'; ;. a.* 4.
q. 4 aW... e..a.V.a v.'
.A Le. ;.
Q W
.end
< < W, m. n ? N.-
....-..e.un We.,.. r w
N er.w g W i..W t.
X.
Q
.eu.
- /+-m +s MM.. Matt :siW4. a+ - e -. fr u w 4. A.v.u,e 3sh*49p-.er%.%'/4,
<~
.s.
w..
< ~. -
i
. s -
q.
p.,
a
- c. -c
- .:.: - u.c x
.m M T:n W
s'c >'* %%;~.%Yeg cs%wK..'. V+W".., y,y, e,W.,../,N'i" :", m.<W,.., 4 e: -,a Q') (f)
T e
.~ mn...yc, s.. t c..p,
...s y
2
- 3. g ;,, y.g. ;>.....,,....:c..
g g,gj g.
g
@O a
- o.,,
- s......,s....r. m.. #
- s...
.eue w-' -;......
'v T.., a:.:
...:e
^r..~,: d h S N*
w..r m h, p P**4 e# r 4.~;.A.
r-p.,
CD
]
.cc; Wt- *T.7
%,,,,,p q t@w*,M...".
g
'y==
^
m
% r n.; t..w. 2.-c wW F.c @.. 4 ?.y A su G
- r. Ju L
..f<,;s...i...
T rn g
'f""
cis s.v... ; (d;(.r@syU.%qn a; #;* M.'.. 4:g
- .4.
- .'
W
.. :.. 0 *:G. ; ::4 g
g, 4
j
@ g t.u.W;.WG. ; q.. ;. 4c-. oz M ;p. u;3
.a Mr, a -..
r
..w
.... a. y 7
+c
- e g
c j
..,l Q
J i 't. L.*;.M LW.' i*R.'s H.,.qu.4..y t40Q.. !M 2. '.?.Y.3. *.:<%,.) :.'*.m.
=
. n ' e.. em.
j a n,w e,>
~.. - ~.;. {%; ~
N (D O a ~_ -.f ;.Lc 3. w T
k
<*. es.:. p.~,.i> s.m.,g.; %m,: u.,s,.e..,..
- r. - - - W e
, Q,,
~
.,...~.m
.r
.. ~.. - w.
C_
s.:q e. 1..~....~,,- ~.,c m;m,% mt g w we e;.~c.w.n g
O "; 3
- @~ @ d... M. w, W W 9 f.' W @ + h 4; %g h.
~
m o
<.. l... ; 1. T. J.n c.... ~..~ l...,.. '. l.. ~.
g gj,,
....l...;l
...I l....
y CD CD CD 00 CD CD CD 00 00 00 CO O
O O
O O
O O
O O
O O
O O
O O
O O
O O
O
+
+
+
+
+
+
+
+
+
+
W W W W W W W W W W
'r" m
c0 b.
em e
to N
'r-i nig 'A6Jeug
-m
m
~
l l
These curves are based on 90% of the decay heat curves provided in the Standard Review Plan; 90% approximates best estimate decay heat. [SRP, Decay Heat] Using data from the UFSAR, we modeled heat removal from the containment sump through RHR/CCW/SW cooling with one RHR and one CCW heat exchanger.
[UFSAR, Tables 6.2-7 and 9.3-1) We took service water temperature as 90 F; the technical specifications do not specify an allowable upper limit on service water temperature. [ Tech Specs) Assuming switchover to recirculation at 30 minutes, Figure A-1 of this report implies the heat load is about 9.4E7 Blu/hr. Our model consists of five coupled equations with five unknowns; we solved the model using Mathematica. [Mathematica] Using this model we calculated the results given in Table A-1 of this report.
2 44
Table A-1. RHR/CCW/SW Mooel Results Parameter Source for Parameter Value of Parameter Value Decay Heat at 30 Minutes Figure 11-1, this report 9.4E7 Btu /hr Service Water Supply Reasonable high value 90 F Temperature (CCW HX based on engineering SW Cold Leg experience temperature)
RHR Heat Exchanger UFSAR, Table 6.2-7 7.45ES Btu /hr/F Overall Heat Transfer Coefficient CCW Heat Exchanger Estimated using UFSAR, 1.2E6 Btu /hr/F Overall Heat transfer Table 9.3.1 Coefficient RHR Flow Rate in RHR UFSAR, Table 6.2-7 7.63E5 lbm/hr Hx CCW ; iw Rate in RHR UFSAR, Table 6.2-7 1.375E6 lbm/hr and CCW HXs SW Flow Rate in CCW UFSAR, Table 9.3.1 2.103E6 lbm/hr HX Containment Sump Calculated from Model 380 F Temperature (RHR HX RHR hot leg temperature)
RHR Hx RHR Cold leg Calculated from Model 256 F Temperature CCW Hx CCW Hot Leg Calculated from Model 226 F Temperature CCW Hx CCW Cold Leg Calculated from Model 157 Temperature CCW Hx SW Hot Leg Calculated from Model 135 F Temperature j
l 45
The model calculates a sump temperature of 380 F and a CCW hot leg temperature of 226 F for this heat input to the sump. Design temperatures for RHR and CCW are given in the UFSAR. [UFSAR, Tables 6.2-7 and 9.3-1) The calculated sump temperature,380 F, is less than the RHR design limit of 400 F, but the calculated CCW hot leg temperature,226 F, is greater than the CCW design limit of 200 F. The CCW pump is in the CCW hot leg. [lPE, Figure 3.2.1.1.81) This calculation indicates that the CCW pump could overheat, but a more accurate calculation is required to make definitive conclusions. An accurate calculation should consider the transient aspects of the heat removal and the containment heat sinks. One issue that should be cons ldered is the effectiveness of the RHR and CCW heat exchangers; Point Beach is an older plant, and at some older plants the effectiveness of the heat exchangers has degraded below UFSAR design values due to fouling.
We requested further information supporting the IPE assumption for containment heat removal. As discussed in Section ll.2.3 of this report, the beensee summarized detailed thermal hydraulic calculations indicating that adequate NPSHA is maintained and that the pumps will not overheat. [lPE Responses)
Feed and Bleed We evaluated the ability to feed and bleed. Based on Figure 14.3.1-1 of the UFSAR and information on PORV relief capability from the Submittal in Section 3.1.4.1, we generated Figure A-3 using the interpolating polynomial curve fitting capabilities of Mathematica. We assumed that the pressurizer will be steaming when the vessel level drops sufficiently to uncover the pressurizer surge line in the hot leg.
The curve for PORV relief as a function of pressure is based on a Moody model with an effective PORV area calculated from the data in the Submittal for relief capability at a given pressure. Figure A 3 indicates that the ' match' point for makeup and loss is 25 lbm'sec at 1150 psla. Assuming feed with 100 F water and steaming out the PORV at 1150 psia, the heat that can be removed is Q = m,(h
-hy = 2.79x10'Bru/see where m,is the mass flow rate and h is enthalpy. Using Figure A-1 of this report, it is concluded that feed and bleed with one Si pump and one PORV can match decay heat at 25 minutes. Since the time to steam generator dryout is about 30 minutes,
[lPE, Section 3.1.4.1) the feed and bleed criteria are reasonable.
i 46
c t
i 6 -
I RCS Pressure, psia
/
2000
/
[
1500 g.v..
s.
1000
,w f
\\
500 h N
~
10 2'O 30 40 5'O i
P 3
l l
5 l
l Figure A-3. Mass Flow Rates for Feed and Bleed 7
47 i
i
e Loss of Offsite Power Durino the Mission Time We estimated the likelihood of loss of ac power following an initiating event other than loss of offsite power. Evidently, station blackout as a random event during the mitigation phase of the rest of the initiating event accident sequences was screened out due to low frequency. We checked the probability for station blackout during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time. The Submittalindicates that the frequency for station blackout is 8E-4/Ry yr, and the frequency for loss of offsite power is 6E-2/Ry yr. [lPE, Tables 3.4-7 and 3.1.1.A-14] This implies that the probability for loss of onsite ac power (DGs and the gas turbine generator) is 1.3E-2. Therefore the probability for loss of offsite power during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is 6E-2/365 = 1.6E-4, and the probability for station blackout during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time is 1.6E-4 x 1.3E-2 =
2.1E-6. The initiating event with the highest frequency by far is T3, transient with PCS available, which has a frequency of 1.45. Thus, the frequency of a transient followed by station blackout during the mission time is about 3E-6. The Submittal states that the CDF due to station blackout, modeled only as a result of loss of offsite power, is 1.5E-5. [lPE, Figure 1.4.-1) Thus, consideration of mitigation for station blackout is about a factor of 1.5E-5/8E-4 = 0.02. Assuming the same reduction of CDF from all situations involving station blackout, the frequency of the unanalyzed station blackovt sequences is about 3E-6 x 0.02 = SE-8; this is sufficiently low to be screened out.
Adecuary of CST inventorv We estimated the heat removal capability of 40,000 gal of water in the CST for AFW. Assuming that steam generator initialinventory lasts for 30 minutes, Figure 11-2 of this report implies that the CST must be used to remove 2.7E8 - 6.2 E7 Btu. To cool the primary to 350 F (to institute shutdown cooling) requires about 1.5E8 Btu.
Thus the total heat requirements are about 3.6E8 Btu. Using the 40,000 gal with steaming out SG safety and/or relief valves provides about 3.7E8 Btu of heat removal capability. The Submittal claim is reasonable.
l Acolication of the Seal LOCA Model We evaluated the application of the Westinghouse seal LOCA model as used in the Submittal. The detailed seal LOCA model used in the Submittalincludes the effects of restoration of offsite power. The model used for non recovery of offsite power is based on the following curve fit provided in the Submittal:
i (Eqn 1)
G(t) = 0.61e *"
This curve is plotted in Figure A-4 of this report.
48
~
9
r.
a.
D s
Prob. Non-Recovery 0.0 O.5 0.4 i
D.:
o.:
o.s N
N Time, Hours 2
4 6
8 10 12 r
Figure A-4. Probability of Non Recovery of Offsite Power 49
This curve cannot be correct at short times. For example, the curve indicates a probability of non-recovery of 0.61 at time 0 which cannot be right; at time O the probability must be 1.0. For times of about an hour or later the data from the curve agrees with typical non-recovery data. We conclude that the curve fit used did not fit the data for early times. The licensee responded that the curve for non-recovery of offsite power does not apply for early times; the likelihood of core uncovery prior to 30 minutes was taken as 0.0 based on the seal LOCA model. [lPE Responses)
The basic information used in the model is from WCAP-10541, Rev. 2. Using two data points from this reference for each of two cases, pressurized and depressurized, the following type of curve fit was produced in the Submittal for both cases:
i k
(Egn D) y(t) = ae y(t) in equation (II) is the orobability that the core is uncovered by time t due to seal i
failure resultino from loss of coolino to a trioned RCP at time O. The values of a and b depend on the case, pressurized or depressurized. y(t) should be 0 at t=0 since the seal LO A does not occur ' instantaneous!y' at the time of loss of seal cooling.
)
Equation (11) indicates that y is not 0 at time 0. Perhaps this is due to using only two points for the curve fits. The licensee stated that this equation does not apply for times less than 30 minutes, and that for less than 30 minutes, y(t) is 0.0. [lPE Responses] Using equation (11) for core uncovery following loss of seal cooling, and equation (l) for nonrecovery of offsite power, the orobability that core uncovery due to seal failure occurs bv time t considerino recoverv of offsite oower is given in the l
Submittal as:
(Egn H1)
P(t) = [labe G(z)dz k
where G(t) is from equation I, and z is the dummy variable of integration. We solved equation (111) using Mathematica and obtained the same results provided in the Submittal, indicating that equation (Ill) was solved correctly.
The Submittal also calculates the orobability that seal failure occurs as a function of time after loss of cooling [lPE, Appendix 3.1.4.A, page 297 of Section 3.1)
To estimate the probability of a seal LOCA, the Submittal assumes that following a seal LOCA, core uncovery occurs after 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, based on NUREG 4550 estimates
{
that each of the two RCPs with failed seals leaks at 250 gpm; then, the 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> i
estimate is used to 'back-out' the probability of a seal LOCA from equation (11). The use of the 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> time to core uncovery with equation (11) is intemally inconsistent.
Equation (11) does not assume core uncovery always at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after a seal LOCA; if they did, then y(t) would be O for any time less than three hours. The licensee i
50
a responded that the 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> assumption and the 250 gpm leak rate were based on a simple conservative estimate of the timing and size of a seal LOCA. [lPE Responses]
Using the 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> time for core uncovery following a seal LOCA, the Submittal indicates that the orobability of seal failure by time t is:
M8+3)
(Egn IV) se That is, seal failure by time t corresponds to core uncovery by time t+3.
A plot of equation (IV) is given in Figure A-5 for the two cases, pressurized and depressurized, using the values for a and b in the Submittal. Equation (IV) is the model used in the Submittal for the probability of a seal LOCA as a function of time after loss of all seal cooling. Note that this modelindicates that the probability of a seal LOCA is small for times less than about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
The Submittal has a numerical error in using equation (IV). The Submittal simplifies equation (IV) incorrectly; it uses M
ce ) = ae'e *
( Q n Y) which is incorrect, the correct simplification is M
ae ) = ae *ek (Qn. Yl)
Using equation (V) for the likelihood of a seal LOCA and equation (1) for non-recovery of offsite power, the Submittal calculates the orobability that a seal LOCA occurs bv time t considerino recoverv of offsite oower. We have concerns related to the equation presented in the Submittal for this probability. We calculate the probability that a seal LOCA occurs up to time t considering recovery of offsite power as:
(Egn. IX) lo'abe *')G(z)dz M
where z is the dummy variable of integration. The equation given on page 297 of Appendix 3.1.4.A of the Submittal, denoted as PROB-SL,is close to but not identical to equation (IX); the equation in the Submittal is:
'abe'e G(z)dz (Qn X)
[9 k
)
51
.c 1
4.
a.
t i
i Prob. Seal LOCA 1
/
0.0 0.0 Prensurize 0.4 0.2
e ieE5Liized v
I
.#l Time, Hours 2
4 6
8 i
i J
l 1
i i
i Figure A-5. Probability of RCP Seal LOCA 52
e Evidently the upper limit in equation (X) is intended to be t,-3 where t, is the sequence-specific time for core uncovery without offr9e power if no RCP seal LOCA occurs.
PROB SL is based on the assumption ther core uncovery from a seal LOCA occurs 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the RCP seal LOCA; thus, RCP seal LOCAs within the time interval (t,-3, t,)
I do not contribute to core uncovery within time t,.
However, an RCP seal LOCA within the time interval (t,-3, t) does affect the time to core uncovery by increasing the mass i
loss from the primary system; in effect, the RCP seal LOCA reduces the time T. The model does not address this effect since it excludes consideration of a seal LOCA within time (t,-3, t,). One conservative way to address this issue is to use T instead of t,-3 as the upper limit of integration.
We have two problems with equation (X):
(1) the integrand contains the error of equation (V)
(2) the upper limit t,-3 is not correct.
The licensee responded to both these issues. [lPE Response] Calculations were redone with the error in equation (V) corrected and with the upper limit specified as T.
The overall impact on the change in CDF was very small.
Solutions to equation (X) at various times are provided in the Submittalin Appendix 3.1.4.A on page 297. Table 3.3-1 of the Submittal, the summary of the data base, also provides values for the solution of equation (X) that were evidently tP.,
actual values used in the quantification. The values in the data table do not agree with those given in the Appendix. The licensee stated that the values in Appendix 3.1.4.A are the correct values, and the incorrect values in Table 3.3.1 were inadveriently used in the quantification. [lPE Responses] The licensee recalculated the CDF for the affected sequences. The overall effect on CDF was small.
l
[
f l
53
~
+
2 s
.o y
REFERFNCES
[GL 88 20)
' Individual Plant Examination For Severe Accident Vulnerabilities - 10 CFR 50.54 (f)", Generic Letter 88.20, U.S. Nuclear Regulatory Commission, November 23,1988.
[NUREG 1335)
" individual Plant Examination Submittal Guidance",
NUMEG-1335, U. S. Nuclear Regulatory Commission, August,1989.
[lPE)
Point Beach IPE Submittal, June 30,1993
)
[lPE Responses)
Wisconsin Electric Responses to Requests for, i
AdditionalInformation, August 8,1994.
[UFSAR)
Updated Final Safety Analysis Report for Point Beach
[ Tech Specs]
Technical Specifications for Point Beach
[Bott and Stack)
Bott, T. F., and Stack, D. W., 'N Reactor Probabilistic Risk Assessment Methodologv",
Proceedings of the intomational Topical Meeting on i
Probability, Reliability, and Safety Assessment PSA
'89, Pittsburgh. Pennsylvania, April 2 7,1989.
j
[NUREG\\CR 5102)
" Interfacing Systems LOCA, Pressurized Water Reactors", NUREG/CR-5102, Feb 89.
[Mathematica]
Wolfram, Steven A., Mathematica. A Svstem for Dolna Mathematics by Comouter, Second Edition, Addison Wesley,1991. (Version 2.2.1)
[SRP, Decay Heat)
NRC Standard Review Plan, NUREG 0800, Branch Technical Position ASB 9-2, " Residual Decay Heat Energy for Light Water Reactors for Long Term Core Cooling", Rev 2, July 1981.
[NUREG 4458)
NUREG/CR-445f. Oscay Heat Removal Analysis of a Westinghouse 2-Loop PWR'
[NUREG 4550, Sequoyah)
NUREG/CR-4550, Vol 5, Rev 1, Part 1, Analysis of 54
O i
i i
Core Damage Frequency from intemal Events:
Sequoyah, Unit 1
[NUREG 4550, Methodology)
NUREG/Gil-4550, Vol 1 Rev 1, " Analysis of Core Damage Frequency: Intemal Events Methodology" t
i b
i 1
l 1
r i
.Il 55
.-